diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f61c89ec544a..6b01f6100a4a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14866,6 +14866,12 @@
     githubId = 7365864;
     name = "Rafael Varago";
   };
+  rvdp = {
+    email = "ramses@well-founded.dev";
+    github = "R-VdP";
+    githubId = 141248;
+    name = "Ramses";
+  };
   rvl = {
     email = "dev+nix@rodney.id.au";
     github = "rvl";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 49b2433c8820..d4fa6e941e57 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -223,6 +223,12 @@ The module update takes care of the new config syntax and the data itself (user
 
 - Suricata was upgraded from 6.0 to 7.0 and no longer considers HTTP/2 support as experimental, see [upstream release notes](https://forum.suricata.io/t/suricata-7-0-0-released/3715) for more details.
 
+- `networking.nftables` now has the option `networking.nftables.table.<table>` to create tables
+  and have them be updated atomically, instead of flushing the ruleset.
+
+- `networking.nftables` is no longer flushing all rulesets on every reload.
+  Use `networking.nftables.flushRuleset = true;` to get back the old behaviour.
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.
diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix
index 452dd97d89d2..7c7136cc96f1 100644
--- a/nixos/modules/services/networking/firewall-nftables.nix
+++ b/nixos/modules/services/networking/firewall-nftables.nix
@@ -70,10 +70,8 @@ in
       }
     ];
 
-    networking.nftables.ruleset = ''
-
-      table inet nixos-fw {
-
+    networking.nftables.tables."nixos-fw".family = "inet";
+    networking.nftables.tables."nixos-fw".content = ''
         ${optionalString (cfg.checkReversePath != false) ''
           chain rpfilter {
             type filter hook prerouting priority mangle + 10; policy drop;
@@ -169,9 +167,6 @@ in
 
           }
         ''}
-
-      }
-
     '';
 
   };
diff --git a/nixos/modules/services/networking/nat-nftables.nix b/nixos/modules/services/networking/nat-nftables.nix
index 483910a16658..4b2317ca2ffc 100644
--- a/nixos/modules/services/networking/nat-nftables.nix
+++ b/nixos/modules/services/networking/nat-nftables.nix
@@ -145,28 +145,28 @@ in
       }
     ];
 
-    networking.nftables.ruleset = ''
-      table ip nixos-nat {
-        ${mkTable {
+    networking.nftables.tables = {
+      "nixos-nat" = {
+        family = "ip";
+        content = mkTable {
           ipVer = "ip";
           inherit dest ipSet;
           forwardPorts = filter (x: !(isIPv6 x.destination)) cfg.forwardPorts;
           inherit (cfg) dmzHost;
-        }}
-      }
-
-      ${optionalString cfg.enableIPv6 ''
-        table ip6 nixos-nat {
-          ${mkTable {
-            ipVer = "ip6";
-            dest = destIPv6;
-            ipSet = ipv6Set;
-            forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts;
-            dmzHost = null;
-          }}
-        }
-      ''}
-    '';
+        };
+      };
+      "nixos-nat6" = mkIf cfg.enableIPv6 {
+        family = "ip6";
+        name = "nixos-nat";
+        content = mkTable {
+          ipVer = "ip6";
+          dest = destIPv6;
+          ipSet = ipv6Set;
+          forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts;
+          dmzHost = null;
+        };
+      };
+    };
 
     networking.firewall.extraForwardRules = optionalString config.networking.firewall.filterForward ''
       ${optionalString (ifaceSet != "") ''
diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index faff1dca89ba..0e4cd6fa1503 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -2,6 +2,35 @@
 with lib;
 let
   cfg = config.networking.nftables;
+
+  tableSubmodule = { name, ... }: {
+    options = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Enable this table.";
+      };
+
+      name = mkOption {
+        type = types.str;
+        description = lib.mdDoc "Table name.";
+      };
+
+      content = mkOption {
+        type = types.lines;
+        description = lib.mdDoc "The table content.";
+      };
+
+      family = mkOption {
+        description = lib.mdDoc "Table family.";
+        type = types.enum [ "ip" "ip6" "inet" "arp" "bridge" "netdev" ];
+      };
+    };
+
+    config = {
+      name = mkDefault name;
+    };
+  };
 in
 {
   ###### interface
@@ -54,6 +83,24 @@ in
       '';
     };
 
+    networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "Flush the entire ruleset on each reload.");
+
+    networking.nftables.extraDeletions = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        # this makes deleting a non-existing table a no-op instead of an error
+        table inet some-table;
+
+        delete table inet some-table;
+      '';
+      description =
+        lib.mdDoc ''
+          Extra deletion commands to be run on every firewall start, reload
+          and after stopping the firewall.
+        '';
+    };
+
     networking.nftables.ruleset = mkOption {
       type = types.lines;
       default = "";
@@ -103,7 +150,10 @@ in
         lib.mdDoc ''
           The ruleset to be used with nftables.  Should be in a format that
           can be loaded using "/bin/nft -f".  The ruleset is updated atomically.
-          This option conflicts with rulesetFile.
+          Note that if the tables should be cleaned first, either:
+          - networking.nftables.flushRuleset = true; needs to be set (flushes all tables)
+          - networking.nftables.extraDeletions needs to be set
+          - or networking.nftables.tables can be used, which will clean up the table automatically
         '';
     };
     networking.nftables.rulesetFile = mkOption {
@@ -113,9 +163,64 @@ in
         lib.mdDoc ''
           The ruleset file to be used with nftables.  Should be in a format that
           can be loaded using "nft -f".  The ruleset is updated atomically.
-          This option conflicts with ruleset and nftables based firewall.
         '';
     };
+    networking.nftables.tables = mkOption {
+      type = types.attrsOf (types.submodule tableSubmodule);
+
+      default = {};
+
+      description = lib.mdDoc ''
+        Tables to be added to ruleset.
+        Tables will be added together with delete statements to clean up the table before every update.
+      '';
+
+      example = {
+        filter = {
+          family = "inet";
+          content = ''
+            # Check out https://wiki.nftables.org/ for better documentation.
+            # Table for both IPv4 and IPv6.
+            # Block all incoming connections traffic except SSH and "ping".
+            chain input {
+              type filter hook input priority 0;
+
+              # accept any localhost traffic
+              iifname lo accept
+
+              # accept traffic originated from us
+              ct state {established, related} accept
+
+              # ICMP
+              # routers may also want: mld-listener-query, nd-router-solicit
+              ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
+              ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
+
+              # allow "ping"
+              ip6 nexthdr icmpv6 icmpv6 type echo-request accept
+              ip protocol icmp icmp type echo-request accept
+
+              # accept SSH connections (required for a server)
+              tcp dport 22 accept
+
+              # count and drop any other traffic
+              counter drop
+            }
+
+            # Allow all outgoing connections.
+            chain output {
+              type filter hook output priority 0;
+              accept
+            }
+
+            chain forward {
+              type filter hook forward priority 0;
+              accept
+            }
+          '';
+        };
+      };
+    };
   };
 
   ###### implementation
@@ -124,6 +229,8 @@ in
     boot.blacklistedKernelModules = [ "ip_tables" ];
     environment.systemPackages = [ pkgs.nftables ];
     networking.networkmanager.firewallBackend = mkDefault "nftables";
+    # versionOlder for backportability, remove afterwards
+    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));
     systemd.services.nftables = {
       description = "nftables firewall";
       before = [ "network-pre.target" ];
@@ -131,18 +238,49 @@ in
       wantedBy = [ "multi-user.target" ];
       reloadIfChanged = true;
       serviceConfig = let
+        enabledTables = filterAttrs (_: table: table.enable) cfg.tables;
+        deletionsScript = pkgs.writeScript "nftables-deletions" ''
+          #! ${pkgs.nftables}/bin/nft -f
+          ${if cfg.flushRuleset then "flush ruleset"
+            else concatStringsSep "\n" (mapAttrsToList (_: table: ''
+              table ${table.family} ${table.name}
+              delete table ${table.family} ${table.name}
+            '') enabledTables)}
+          ${cfg.extraDeletions}
+        '';
+        deletionsScriptVar = "/var/lib/nftables/deletions.nft";
+        ensureDeletions = pkgs.writeShellScript "nftables-ensure-deletions" ''
+          touch ${deletionsScriptVar}
+          chmod +x ${deletionsScriptVar}
+        '';
+        saveDeletionsScript = pkgs.writeShellScript "nftables-save-deletions" ''
+          cp ${deletionsScript} ${deletionsScriptVar}
+        '';
+        cleanupDeletionsScript = pkgs.writeShellScript "nftables-cleanup-deletions" ''
+          rm ${deletionsScriptVar}
+        '';
         rulesScript = pkgs.writeTextFile {
           name =  "nftables-rules";
           executable = true;
           text = ''
             #! ${pkgs.nftables}/bin/nft -f
-            flush ruleset
-            ${if cfg.rulesetFile != null then ''
+            # previous deletions, if any
+            include "${deletionsScriptVar}"
+            # current deletions
+            include "${deletionsScript}"
+            ${concatStringsSep "\n" (mapAttrsToList (_: table: ''
+              table ${table.family} ${table.name} {
+                ${table.content}
+              }
+            '') enabledTables)}
+            ${cfg.ruleset}
+            ${lib.optionalString (cfg.rulesetFile != null) ''
               include "${cfg.rulesetFile}"
-            '' else cfg.ruleset}
+            ''}
           '';
           checkPhase = lib.optionalString cfg.checkRuleset ''
             cp $out ruleset.conf
+            sed 's|include "${deletionsScriptVar}"||' -i ruleset.conf
             ${cfg.preCheckRuleset}
             export NIX_REDIRECTS=/etc/protocols=${pkgs.buildPackages.iana-etc}/etc/protocols:/etc/services=${pkgs.buildPackages.iana-etc}/etc/services
             LD_PRELOAD="${pkgs.buildPackages.libredirect}/lib/libredirect.so ${pkgs.buildPackages.lklWithFirewall.lib}/lib/liblkl-hijack.so" \
@@ -152,9 +290,11 @@ in
       in {
         Type = "oneshot";
         RemainAfterExit = true;
-        ExecStart = rulesScript;
-        ExecReload = rulesScript;
-        ExecStop = "${pkgs.nftables}/bin/nft flush ruleset";
+        ExecStart = [ ensureDeletions rulesScript ];
+        ExecStartPost = saveDeletionsScript;
+        ExecReload = [ ensureDeletions rulesScript saveDeletionsScript ];
+        ExecStop = [ deletionsScriptVar cleanupDeletionsScript ];
+        StateDirectory = "nftables";
       };
     };
   };
diff --git a/nixos/modules/services/x11/window-managers/default.nix b/nixos/modules/services/x11/window-managers/default.nix
index ce1d4115f225..e180f2693e0c 100644
--- a/nixos/modules/services/x11/window-managers/default.nix
+++ b/nixos/modules/services/x11/window-managers/default.nix
@@ -35,6 +35,7 @@ in
     ./openbox.nix
     ./pekwm.nix
     ./notion.nix
+    ./ragnarwm.nix
     ./ratpoison.nix
     ./sawfish.nix
     ./smallwm.nix
diff --git a/nixos/modules/services/x11/window-managers/ragnarwm.nix b/nixos/modules/services/x11/window-managers/ragnarwm.nix
new file mode 100644
index 000000000000..0843b872dba5
--- /dev/null
+++ b/nixos/modules/services/x11/window-managers/ragnarwm.nix
@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.xserver.windowManager.ragnarwm;
+in
+{
+  ###### interface
+
+  options = {
+    services.xserver.windowManager.ragnarwm = {
+      enable = mkEnableOption (lib.mdDoc "ragnarwm");
+      package = mkOption {
+        type = types.package;
+        default = pkgs.ragnarwm;
+        defaultText = literalExpression "pkgs.ragnarwm";
+        description = lib.mdDoc ''
+          The ragnar package to use.
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    services.xserver.displayManager.sessionPackages = [ cfg.package ];
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ sigmanificient ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index c6565bd8afc1..3b9608b7f20e 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -673,6 +673,7 @@ in {
   rabbitmq = handleTest ./rabbitmq.nix {};
   radarr = handleTest ./radarr.nix {};
   radicale = handleTest ./radicale.nix {};
+  ragnarwm = handleTest ./ragnarwm.nix {};
   rasdaemon = handleTest ./rasdaemon.nix {};
   readarr = handleTest ./readarr.nix {};
   redis = handleTest ./redis.nix {};
diff --git a/nixos/tests/lxd/nftables.nix b/nixos/tests/lxd/nftables.nix
index b85caa9eb368..d98bd4952906 100644
--- a/nixos/tests/lxd/nftables.nix
+++ b/nixos/tests/lxd/nftables.nix
@@ -20,8 +20,8 @@ import ../make-test-python.nix ({ pkgs, ...} : {
     networking = {
       firewall.enable = false;
       nftables.enable = true;
-      nftables.ruleset = ''
-        table inet filter {
+      nftables.tables."filter".family = "inet";
+      nftables.tables."filter".content = ''
           chain incoming {
             type filter hook input priority 0;
             policy accept;
@@ -36,7 +36,6 @@ import ../make-test-python.nix ({ pkgs, ...} : {
             type filter hook output priority 0;
             policy accept;
           }
-        }
       '';
     };
   };
diff --git a/nixos/tests/ragnarwm.nix b/nixos/tests/ragnarwm.nix
new file mode 100644
index 000000000000..f7c588b92008
--- /dev/null
+++ b/nixos/tests/ragnarwm.nix
@@ -0,0 +1,32 @@
+import ./make-test-python.nix ({ lib, ...} : {
+  name = "ragnarwm";
+
+  meta = {
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+
+  nodes.machine = { pkgs, lib, ... }: {
+    imports = [ ./common/x11.nix ./common/user-account.nix ];
+    test-support.displayManager.auto.user = "alice";
+    services.xserver.displayManager.defaultSession = lib.mkForce "ragnar";
+    services.xserver.windowManager.ragnarwm.enable = true;
+
+    # Setup the default terminal of Ragnar
+    environment.systemPackages = [ pkgs.alacritty ];
+  };
+
+  testScript = ''
+    with subtest("ensure x starts"):
+        machine.wait_for_x()
+        machine.wait_for_file("/home/alice/.Xauthority")
+        machine.succeed("xauth merge ~alice/.Xauthority")
+
+    with subtest("ensure we can open a new terminal"):
+        # Sleeping a bit before the test, as it may help for sending keys
+        machine.sleep(2)
+        machine.send_key("meta_l-ret")
+        machine.wait_for_window(r"alice.*?machine")
+        machine.sleep(2)
+        machine.screenshot("terminal")
+  '';
+})
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index bc8051d6de5f..8b1b4966ddab 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   ++ lib.optionals tlsSupport    [ pkgs.openssl pkgs.gnutls ]
   ++ lib.optionals (openglSupport && !stdenv.isDarwin) [ pkgs.libGLU pkgs.libGL pkgs.mesa.osmesa pkgs.libdrm ]
   ++ lib.optionals stdenv.isDarwin (with pkgs.buildPackages.darwin.apple_sdk.frameworks; [
-     CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration Security
+     CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration PCSC Security
      ApplicationServices AudioToolbox CoreAudio AudioUnit CoreMIDI OpenCL Cocoa Carbon
   ])
   ++ lib.optionals (stdenv.isLinux && !waylandSupport) (with pkgs.xorg; [
@@ -103,14 +103,27 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
 
   patches = [ ]
     ++ lib.optionals stdenv.isDarwin [
-      # Wine requires `MTLDevice.registryID` for `winemac.drv`, but that property is not available
-      # in the 10.12 SDK (current SDK on x86_64-darwin). Work around that by using selector syntax.
+      # Wine uses `MTLDevice.registryID` in `winemac.drv`, but that property is not available in
+      # the 10.12 SDK (current SDK on x86_64-darwin). That can be worked around by using selector
+      # syntax. As of Wine 8.12, the logic has changed and uses selector syntax, but it still
+      # uses property syntax in one place. The first patch is necessary only with older
+      # versions of Wine. The second is needed on all versions of Wine.
+      (lib.optional (lib.versionOlder version "8.12") ./darwin-metal-compat-pre8.12.patch)
       ./darwin-metal-compat.patch
       # Wine requires `qos.h`, which is not included by default on the 10.12 SDK in nixpkgs.
       ./darwin-qos.patch
     ]
     ++ patches';
 
+  # Because the 10.12 SDK doesn’t define `registryID`, clang assumes the undefined selector returns
+  # `id`, which is a pointer. This causes implicit pointer to integer errors in clang 15+.
+  # The following post-processing step adds a cast to `uint64_t` before the selector invocation to
+  # silence these errors.
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    sed -e 's|\(\[[A-Za-z_][][A-Za-z_0-9]* registryID\]\)|(uint64_t)\1|' \
+      -i dlls/winemac.drv/cocoa_display.m
+  '';
+
   configureFlags = prevConfigFlags
     ++ lib.optionals supportFlags.waylandSupport [ "--with-wayland" ]
     ++ lib.optionals supportFlags.vulkanSupport [ "--with-vulkan" ]
@@ -192,7 +205,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
     ];
     description = if supportFlags.waylandSupport then "An Open Source implementation of the Windows API on top of OpenGL and Unix (with experimental Wayland support)" else "An Open Source implementation of the Windows API on top of X, OpenGL, and Unix";
     platforms = if supportFlags.waylandSupport then (lib.remove "x86_64-darwin" prevPlatforms) else prevPlatforms;
-    maintainers = with lib.maintainers; [ avnik raskin bendlas jmc-figueira ];
+    maintainers = with lib.maintainers; [ avnik raskin bendlas jmc-figueira reckenrode ];
     inherit mainProgram;
   };
 })
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch
new file mode 100644
index 000000000000..aaf8a1b89bfd
--- /dev/null
+++ b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch
@@ -0,0 +1,22 @@
+diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
+--- a/dlls/winemac.drv/cocoa_display.m
++++ b/dlls/winemac.drv/cocoa_display.m
+@@ -289,7 +289,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
+      * the primary GPU because we need to hide the integrated GPU for an automatic graphic switching pair to avoid apps
+      * using the integrated GPU. This is the behavior of Windows on a Mac. */
+     primary_device = [MTLCreateSystemDefaultDevice() autorelease];
+-    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, primary_device.registryID))
++    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, [primary_device registryID]))
+         goto done;
+
+     /* Hide the integrated GPU if the system default device is a dedicated GPU */
+@@ -301,7 +301,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
+
+     for (i = 0; i < devices.count; i++)
+     {
+-        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], devices[i].registryID))
++        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], [devices[i] registryID]))
+             goto done;
+
+         if (hide_integrated && devices[i].isLowPower)
+
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat.patch b/pkgs/applications/emulators/wine/darwin-metal-compat.patch
index aeee7533bbd4..181b2a0d1a47 100644
--- a/pkgs/applications/emulators/wine/darwin-metal-compat.patch
+++ b/pkgs/applications/emulators/wine/darwin-metal-compat.patch
@@ -1,31 +1,12 @@
 diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
-index f64a6c0f6ad..6da0391e3fa 100644
 --- a/dlls/winemac.drv/cocoa_display.m
 +++ b/dlls/winemac.drv/cocoa_display.m
-@@ -289,7 +289,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
-      * the primary GPU because we need to hide the integrated GPU for an automatic graphic switching pair to avoid apps
-      * using the integrated GPU. This is the behavior of Windows on a Mac. */
-     primary_device = [MTLCreateSystemDefaultDevice() autorelease];
--    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, primary_device.registryID))
-+    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, (uint64_t)[primary_device registryID]))
-         goto done;
- 
-     /* Hide the integrated GPU if the system default device is a dedicated GPU */
-@@ -301,7 +301,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
- 
-     for (i = 0; i < devices.count; i++)
-     {
--        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], devices[i].registryID))
-+        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], (uint64_t)[devices[i] registryID]))
-             goto done;
- 
-         if (hide_integrated && devices[i].isLowPower)
 @@ -354,7 +354,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
  
      device = [CGDirectDisplayCopyCurrentMetalDevice(display_id) autorelease];
      if (device && [device respondsToSelector:@selector(registryID)])
 -        ret = macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
-+        ret = macdrv_get_gpu_info_from_registry_id(gpu, (uint64_t)[device registryID]);
++        ret = macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
  
  done:
      [pool release];
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 1bfb35e76d78..aca987417558 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "8.13";
+    version = "8.14";
     url = "https://dl.winehq.org/wine/source/8.x/wine-${version}.tar.xz";
-    hash = "sha256-JuXTqD0lxUGMbA9USORD0gh2OiZDqrSw8a01KSKkwnU=";
+    hash = "sha256-4YNu9msYJfqdoEKDDASVsqw5SBVENkNGaXnuif3X+vQ=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    hash = "sha256-5upC+IWHBJE5DeFv96lD1hr4LYYaqAAzfxIroK9KlOY=";
+    hash = "sha256-ct/RGXt9B6F3PHbirX8K03AZ0Kunitd2HmI0N5k6VHI=";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";
diff --git a/pkgs/applications/finance/odoo/default.nix b/pkgs/applications/finance/odoo/default.nix
index d3436f929ed1..dc52f72b2d52 100644
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchurl
+, fetchzip
 , python310
 , nodePackages
 , wkhtmltopdf
@@ -53,17 +53,12 @@ in python.pkgs.buildPythonApplication rec {
   format = "setuptools";
 
   # latest release is at https://github.com/odoo/docker/blob/master/16.0/Dockerfile
-  src = fetchurl {
-    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.tar.gz";
+  src = fetchzip {
+    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
     name = "${pname}-${version}";
-    hash = "sha256-DV5JBY+2gq5mUfcvN9S5xkd+ufgEBjvyvBY1X7pPFPk="; # odoo
+    hash = "sha256-pSycpYSiqJ6DKENvCWwLz+JaPUXT5dmaq8x4Aency60="; # odoo
   };
 
-  unpackPhase = ''
-    tar xfz $src
-    cd odoo*
-  '';
-
   # needs some investigation
   doCheck = false;
 
diff --git a/pkgs/applications/finance/odoo/odoo15.nix b/pkgs/applications/finance/odoo/odoo15.nix
index 1ed0cf316088..675264e42a38 100644
--- a/pkgs/applications/finance/odoo/odoo15.nix
+++ b/pkgs/applications/finance/odoo/odoo15.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchurl, python310, nodePackages, wkhtmltopdf
+{ stdenv, lib, fetchFromGitHub, fetchzip, python310, nodePackages, wkhtmltopdf
 , nixosTests }:
 
 let
@@ -38,7 +38,7 @@ let
   };
 
   odoo_version = "15.0";
-  odoo_release = "20230720";
+  odoo_release = "20230816";
 in python.pkgs.buildPythonApplication rec {
   pname = "odoo15";
   version = "${odoo_version}.${odoo_release}";
@@ -46,18 +46,12 @@ in python.pkgs.buildPythonApplication rec {
   format = "setuptools";
 
   # latest release is at https://github.com/odoo/docker/blob/master/15.0/Dockerfile
-  src = fetchurl {
-    url =
-      "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.tar.gz";
+  src = fetchzip {
+    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
     name = "${pname}-${version}";
-    hash = "sha256-XH4cN2OrPvMjN3VcDJFxCacNxKkrN65jwhUN1dnGwgo="; # odoo
+    hash = "sha256-h81JA0o44DVtl/bZ52rGQfg54TigwQcNpcMjQbi0zIQ="; # odoo
   };
 
-  unpackPhase = ''
-    tar xfz $src
-    cd odoo*
-  '';
-
   # needs some investigation
   doCheck = false;
 
@@ -115,7 +109,6 @@ in python.pkgs.buildPythonApplication rec {
   dontStrip = true;
 
   passthru = {
-    updateScript = ./update.sh;
     tests = { inherit (nixosTests) odoo15; };
   };
 
diff --git a/pkgs/applications/finance/odoo/update.sh b/pkgs/applications/finance/odoo/update.sh
index 1bec751ae7e7..0f7ee144cf8a 100755
--- a/pkgs/applications/finance/odoo/update.sh
+++ b/pkgs/applications/finance/odoo/update.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix coreutils
+#!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
 
 set -euo pipefail
 
-DOCKER=$(curl -s https://raw.githubusercontent.com/odoo/docker/master/15.0/Dockerfile)
+DOCKER=$(curl -s https://raw.githubusercontent.com/odoo/docker/master/16.0/Dockerfile)
 
 get_var() {
   echo "$DOCKER" | grep -E "^[A-Z][A-Z][A-Z] ODOO_$1" | sed -r "s|^[A-Z]{3} ODOO_$1.||g"
@@ -22,6 +22,6 @@ fi
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch-url --type sha256 "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.tar.gz")\"; # odoo|g" default.nix
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" default.nix
 sed -ri "s| odoo_version.+| odoo_version = \"$VERSION\";|" default.nix
 sed -ri "s| odoo_release.+| odoo_release = \"$RELEASE\";|" default.nix
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index c7a2c1637e15..d7a8d0244130 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -2,36 +2,36 @@
   beta = {
     deps = {
       gn = {
-        rev = "4bd1a77e67958fb7f6739bd4542641646f264e5d";
-        sha256 = "14h9jqspb86sl5lhh6q0kk2rwa9zcak63f8drp7kb3r4dx08vzsw";
+        rev = "811d332bd90551342c5cbd39e133aa276022d7f8";
+        sha256 = "0jlg3d31p346na6a3yk0x29pm6b7q03ck423n5n6mi8nv4ybwajq";
         url = "https://gn.googlesource.com/gn";
-        version = "2023-06-09";
+        version = "2023-08-01";
       };
     };
-    sha256 = "0r5m2bcrh2zpl2m8wnzyl4afh8s0dh2m2fnfjf50li94694vy4jz";
-    sha256bin64 = "047wsszg4c23vxq93a335iymiqpy7lw5izzz4f0zk1a4sijafd59";
-    version = "116.0.5845.50";
+    sha256 = "1wf0j189cxpayy6ffmj5j6h5yg3amivryilimjc2ap0jkyj4xrbi";
+    sha256bin64 = "11w1di146mjb9ql30df9yk9x4b9amc6514jzyfbf09mqsrw88dvr";
+    version = "117.0.5938.22";
   };
   dev = {
     deps = {
       gn = {
-        rev = "fae280eabe5d31accc53100137459ece19a7a295";
-        sha256 = "02javy4jsllwl4mxl2zmg964jvzw800w6gbmr5z6jdkip24fw0kj";
+        rev = "cc56a0f98bb34accd5323316e0292575ff17a5d4";
+        sha256 = "1ly7z48v147bfdb1kqkbc98myxpgqq3g6vgr8bjx1ikrk17l82ab";
         url = "https://gn.googlesource.com/gn";
-        version = "2023-07-12";
+        version = "2023-08-10";
       };
     };
-    sha256 = "0pyf3k58m26lkc6v6mqpwvhyaj6bbyywl4c17cxb5zmzc1zmc5ia";
-    sha256bin64 = "10w5dm68aaffgdq0xqi4ans2w7byisqqld09pz5vpk350gy16fjh";
-    version = "117.0.5897.3";
+    sha256 = "1z01b6w4sgndrlcd26jgimk3rhv3wzpn67nv1fd5ln7dwfwkyq20";
+    sha256bin64 = "11y09hsy7y1vg65xfilq44ffsmn15dqy80fa57psj1kin4a52v2x";
+    version = "118.0.5966.0";
   };
   stable = {
     chromedriver = {
-      sha256_darwin = "1c41cb7zh13ny4xvpwy7703cnjrkmqxd3n8zpja7n6a38mi8mgsk";
+      sha256_darwin = "0gzx3zka8i2ngsdiqp8sr0v6ir978vywa1pj7j08vsf8kmb93iiy";
       sha256_darwin_aarch64 =
-        "1kliszw10jnnlhzi8jrdzjq0r7vfn6ksk1spsh2rfn2hmghccv2d";
-      sha256_linux = "1797qmb213anvp9lmrkj6wmfdwkdfswmshmk1816zankw5dl883j";
-      version = "115.0.5790.98";
+        "18iyapwjg0yha8qgbw7f605n0j54nd36shv3497bd84lc9k74b14";
+      sha256_linux = "0d8mqzjc11g1bvxvffk0xyhxfls2ycl7ym4ssyjq752g2apjblhp";
+      version = "116.0.5845.96";
     };
     deps = {
       gn = {
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 84827d228108..649be6767c28 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.9.4";
+  version = "3.9.5";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cdmW0VSWjr3rm/1T0uDy1iPm3ojR5wrgRixyjIQhodU=";
+    hash = "sha256-L3AQCc5ErWjMATKMSZf9r+4rfFA8SjCCcT0rW9oMmbA=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/window-managers/ragnarwm/default.nix b/pkgs/applications/window-managers/ragnarwm/default.nix
new file mode 100644
index 000000000000..528ae2bf7b80
--- /dev/null
+++ b/pkgs/applications/window-managers/ragnarwm/default.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeText
+, fontconfig
+, libX11
+, libXft
+, libXcursor
+, libXcomposite
+, conf ? null
+, nixosTests
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ragnarwm";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "cococry";
+    repo = "Ragnar";
+    rev = finalAttrs.version;
+    hash = "sha256-SZWhmFNmS2oLdO9BnPzimoind1452v/EEQzadc5A+bI";
+  };
+
+  prePatch = ''
+    substituteInPlace Makefile \
+      --replace '/usr/bin' "$out/bin" \
+      --replace '/usr/share' "$out/share"
+  '';
+
+  postPatch =
+    let
+      configFile =
+        if lib.isDerivation conf || builtins.isPath conf
+        then conf else writeText "config.h" conf;
+    in
+    lib.optionalString (conf != null) "cp ${configFile} config.h";
+
+  buildInputs = [
+    fontconfig
+    libX11
+    libXft
+    libXcursor
+    libXcomposite
+  ];
+
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/applications
+  '';
+
+  postInstall = ''
+    install -Dm644 $out/share/applications/ragnar.desktop $out/share/xsessions/ragnar.desktop
+  '';
+
+  passthru = {
+    tests.ragnarwm = nixosTests.ragnarwm;
+    providedSessions = [ "ragnar" ];
+  };
+
+  meta = with lib; {
+    description = "Minimal, flexible & user-friendly X tiling window manager";
+    homepage = "https://ragnar-website.vercel.app";
+    changelog = "https://github.com/cococry/Ragnar/releases/tag/${finalAttrs.version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ sigmanificient ];
+    mainProgram = "ragnar";
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/development/libraries/freetds/default.nix b/pkgs/development/libraries/freetds/default.nix
index cd9e99b352eb..b42fdbd60ccb 100644
--- a/pkgs/development/libraries/freetds/default.nix
+++ b/pkgs/development/libraries/freetds/default.nix
@@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   pname = "freetds";
-  version = "1.3.18";
+  version = "1.3.20";
 
   src = fetchurl {
     url    = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-HYVh1XxxmRoo9GgTQ3hcI6aj61TVvNI4l9B+OCX/LVY=";
+    sha256 = "sha256-IK4R87gG5PvA+gtZMftHO7V0i+6dSH9qoSiFCDV4pe0=";
   };
 
   buildInputs = [
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Libraries to natively talk to Microsoft SQL Server and Sybase databases";
     homepage    = "https://www.freetds.org";
+    changelog   = "https://github.com/FreeTDS/freetds/releases/tag/v${version}";
     license     = licenses.lgpl2;
     maintainers = with maintainers; [ peterhoeg ];
     platforms   = platforms.all;
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 37043e3e4bde..d1ea44b6ac2f 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -9,6 +9,16 @@
 , pkg-config
 , withBluez ? false
 , withRemote ? false
+
+# for passthru.tests
+, ettercap
+, nmap
+, ostinato
+, tcpreplay
+, vde2
+, wireshark
+, python3
+, haskellPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -44,6 +54,12 @@ stdenv.mkDerivation rec {
     fi
   '';
 
+  passthru.tests = {
+    inherit ettercap nmap ostinato tcpreplay vde2 wireshark;
+    inherit (python3.pkgs) pcapy-ng scapy;
+    haskell-pcap = haskellPackages.pcap;
+  };
+
   meta = with lib; {
     homepage = "https://www.tcpdump.org";
     description = "Packet Capture Library";
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index d81a31ce05c4..d5738153f0ab 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -29,6 +29,16 @@
 , common-updater-scripts
 , jq
 , nix
+
+# for passthru.tests
+, enlightenment
+, ffmpeg
+, gegl
+, gimp
+, imagemagick
+, imlib2
+, vips
+, xfce
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -193,6 +203,17 @@ stdenv.mkDerivation (finalAttrs: {
         updateSource
         updateLockfile
       ];
+    tests = {
+      inherit
+        gegl
+        gimp
+        imagemagick
+        imlib2
+        vips;
+      inherit (enlightenment) efl;
+      inherit (xfce) xfwm4;
+      ffmpeg = ffmpeg.override { withSvg = true; };
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/click-odoo-contrib/default.nix b/pkgs/development/python-modules/click-odoo-contrib/default.nix
new file mode 100644
index 000000000000..b0ddaef004b9
--- /dev/null
+++ b/pkgs/development/python-modules/click-odoo-contrib/default.nix
@@ -0,0 +1,43 @@
+{ buildPythonPackage
+, click-odoo
+, fetchPypi
+, importlib-resources
+, lib
+, manifestoo-core
+, nix-update-script
+, pythonOlder
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "click-odoo-contrib";
+  version = "1.16.1";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-VFoS/lOw/jbJNj9xfgZHKzR6JDTwnlCAItq4mZ3RA6I=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    click-odoo
+    manifestoo-core
+  ] ++ lib.optionals (pythonOlder "3.9") [ importlib-resources ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.updateScript = nix-update-script { };
+
+  pythonImportsCheck = [ "click_odoo_contrib" ];
+
+  meta = with lib; {
+    description = "Collection of community-maintained scripts for Odoo maintenance";
+    homepage = "https://github.com/acsone/click-odoo-contrib";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/development/python-modules/click-odoo/default.nix b/pkgs/development/python-modules/click-odoo/default.nix
new file mode 100644
index 000000000000..a618359735f1
--- /dev/null
+++ b/pkgs/development/python-modules/click-odoo/default.nix
@@ -0,0 +1,37 @@
+{ buildPythonPackage
+, click
+, fetchPypi
+, lib
+, nix-update-script
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "click-odoo";
+  version = "1.6.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-zyfgsHzIoz4lnqANe63b2oqgD/oxBbTbJYEedfSHWQ8=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    click
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Odoo scripting helper library";
+    homepage = "https://github.com/acsone/click-odoo";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/development/python-modules/manifestoo-core/default.nix b/pkgs/development/python-modules/manifestoo-core/default.nix
new file mode 100644
index 000000000000..3135ded66ebf
--- /dev/null
+++ b/pkgs/development/python-modules/manifestoo-core/default.nix
@@ -0,0 +1,40 @@
+{ buildPythonPackage
+, typing-extensions
+, fetchPypi
+, lib
+, nix-update-script
+, hatch-vcs
+, pythonOlder
+, importlib-resources
+}:
+
+buildPythonPackage rec {
+  pname = "manifestoo-core";
+  version = "0.11.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "manifestoo_core";
+    hash = "sha256-ZZAJDOtGcYWm0yS5bMOUdM1Jf+kfurwiLsJwyTYPz/4=";
+  };
+
+  nativeBuildInputs = [
+    hatch-vcs
+  ];
+
+  propagatedBuildInputs =
+    lib.optionals (pythonOlder "3.7") [ importlib-resources ]
+    ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "A library to reason about Odoo addons manifests";
+    homepage = "https://github.com/acsone/manifestoo-core";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/development/python-modules/manifestoo/default.nix b/pkgs/development/python-modules/manifestoo/default.nix
new file mode 100644
index 000000000000..c9499eb11310
--- /dev/null
+++ b/pkgs/development/python-modules/manifestoo/default.nix
@@ -0,0 +1,51 @@
+{ buildPythonPackage
+, fetchPypi
+, hatch-vcs
+, importlib-metadata
+, lib
+, manifestoo-core
+, nix-update-script
+, pytestCheckHook
+, pythonOlder
+, textual
+, typer
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "manifestoo";
+  version = "0.7";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-gCGchc+fShBgt6fVJAx80+QnH+vxWo3jsIyePkFwhYE=";
+  };
+
+  nativeBuildInputs = [
+    hatch-vcs
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  propagatedBuildInputs = [
+    manifestoo-core
+    textual
+    typer
+  ]
+  ++ typer.passthru.optional-dependencies.all
+  ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "A tool to reason about Odoo addons manifests";
+    homepage = "https://github.com/acsone/manifestoo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/development/python-modules/msgspec/default.nix b/pkgs/development/python-modules/msgspec/default.nix
index 89ccbb63ff60..f5ae1860039c 100644
--- a/pkgs/development/python-modules/msgspec/default.nix
+++ b/pkgs/development/python-modules/msgspec/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "msgspec";
-  version = "0.18.1";
+  version = "0.18.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "jcrist";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-cacwbl5JYqQGXhdt/F0nhX032GCw8RwFi0XBsn7dlq0=";
+    hash = "sha256-t5TM7CgVIxdXR6jMOXh1XhpA9vBrYHBcR2iLYP4A/Jc=";
   };
 
   # Requires libasan to be accessible
diff --git a/pkgs/development/python-modules/pyssim/default.nix b/pkgs/development/python-modules/pyssim/default.nix
index 6b32660ad02d..b69bf47c96d7 100644
--- a/pkgs/development/python-modules/pyssim/default.nix
+++ b/pkgs/development/python-modules/pyssim/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, numpy, scipy, pillow }:
+{ lib, buildPythonPackage, fetchFromGitHub, numpy, scipy, pillow, fetchpatch }:
 
 buildPythonPackage rec {
   pname = "pyssim";
@@ -14,6 +14,18 @@ buildPythonPackage rec {
     sha256 = "sha256-VvxQTvDTDms6Ccyclbf9P0HEQksl5atPPzHuH8yXTmc=";
   };
 
+  patches = [
+    # "Replace Image.ANTIALIAS with Image.LANCZOS"
+    # Image.ANTIALIAS has been removed in Pillow 10.0.0,
+    # the version currently in nixpkgs,
+    # and Image.LANCZOS is a drop-in since Pillow 2.7.0.
+    # https://github.com/jterrace/pyssim/pull/45
+    (fetchpatch {
+      url = "https://github.com/jterrace/pyssim/commit/db4296c12ca9c027eb9cd61b52195a78dfcc6711.patch";
+      hash = "sha256-wNp47EFtjXv6jIFX25IErXg83ksmGRNFKNeMFS+tP6s=";
+    })
+  ];
+
   # Tests are copied from .travis.yml
   checkPhase = ''
     $out/bin/pyssim test-images/test1-1.png test-images/test1-1.png | grep 1
diff --git a/pkgs/development/python-modules/setuptools-odoo/default.nix b/pkgs/development/python-modules/setuptools-odoo/default.nix
new file mode 100644
index 000000000000..a9129334208f
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools-odoo/default.nix
@@ -0,0 +1,76 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, nix-update-script
+, pytestCheckHook
+, git
+, setuptools-scm
+, writeScript
+}:
+buildPythonPackage rec {
+  pname = "setuptools-odoo";
+  version = "3.1.12";
+  src = fetchFromGitHub {
+    owner = "acsone";
+    repo = pname;
+    rev = version;
+    hash = "sha256-GIX21gOENE0r3yFIyzwjaoEcb0XvuCqiPU8F3GLxNt4=";
+  };
+
+  propagatedBuildInputs = [
+    setuptools-scm
+  ];
+
+  # HACK https://github.com/NixOS/nixpkgs/pull/229460
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  patchPhase = ''
+    runHook prePatch
+
+    old_manifest="$(cat MANIFEST.in 2>/dev/null || true)"
+    echo 'global-include **' > MANIFEST.in
+    echo "$old_manifest" >> MANIFEST.in
+
+    runHook postPatch
+  '';
+
+  pythonImportsCheck = [
+    "setuptools_odoo"
+  ];
+
+  setupHook = writeScript "setupHook.sh" ''
+    setuptoolsOdooHook() {
+      # Don't look for a version suffix from git when building addons
+      export SETUPTOOLS_ODOO_POST_VERSION_STRATEGY_OVERRIDE=none
+
+      # Let setuptools-odoo know which files to install, when Git is missing
+      # HACK https://github.com/acsone/setuptools-odoo/issues/20#issuecomment-340192355
+      echo 'recursive-include odoo/addons/* **' >> MANIFEST.in
+
+      # Make sure you can import the built addon
+      for manifest in $(find -L . -name __manifest__.py); do
+        export pythonImportsCheck="$pythonImportsCheck odoo.addons.$(basename $(dirname $manifest))"
+      done
+    }
+
+    preBuildHooks+=(setuptoolsOdooHook)
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook git ];
+  disabledTests = [
+    "test_addon1_uncommitted_change"
+    "test_addon1"
+    "test_addon2_uncommitted_version_change"
+    "test_odoo_addon1_sdist"
+    "test_odoo_addon1"
+    "test_odoo_addon5_wheel"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Setuptools plugin for Odoo addons";
+    homepage = "https://github.com/acsone/setuptools-odoo";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index a8047c5b16be..bfc889b2f992 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
+, python
 , poetry-core
 , pytest
 , colored
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   version = "4.0.8";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8.1";
+  disabled = lib.versionOlder python.version "3.8.1";
 
   src = fetchFromGitHub {
     owner = "tophat";
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 1c7e54ffbc43..4c0b4ffd156b 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -22,14 +22,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.4.10";
+  version = "2.4.12";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-L5BRpwWAP4WyP3kyzp8ELVnXth84jRwP9wmj9kA+xcw=";
+    hash = "sha256-DBwYEE/JyjN97VZX1bwooozFONwMf9w31NTlzDA058k=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/database/liquibase/default.nix b/pkgs/development/tools/database/liquibase/default.nix
index 3309dbd41862..ffc9e712381e 100644
--- a/pkgs/development/tools/database/liquibase/default.nix
+++ b/pkgs/development/tools/database/liquibase/default.nix
@@ -25,11 +25,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "liquibase";
-  version = "4.23.0";
+  version = "4.23.1";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-mIuHNNo/L5h2RvpTN0jZt6ri+Il0H9aSL4auOjIepjU=";
+    hash = "sha256-uWZ9l6C6QlVHqp/ma6/sz07zuCHpGucy7GhNDq8v1/U=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/kdash/default.nix b/pkgs/development/tools/kdash/default.nix
index 9a95071bb480..0269598a3e90 100644
--- a/pkgs/development/tools/kdash/default.nix
+++ b/pkgs/development/tools/kdash/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kdash";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "kdash-rs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-U2Ne0wDgPkNZa68KbJ9Hke5l+tBAf7imu1Cj+r/uZUE=";
+    sha256 = "sha256-PjkRE4JWDxiDKpENN/yDnO45CegxLPov/EhxnUbmpOg=";
   };
 
   nativeBuildInputs = [ perl python3 pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl xorg.xcbutil ]
     ++ lib.optional stdenv.isDarwin AppKit;
 
-  cargoHash = "sha256-dX5p+eLhZlU1Xg2SoqtEYb8T3/lvoJa78zgQStLPZNE=";
+  cargoHash = "sha256-nCFXhAaVrIkm6XOSa1cDCxukbf/CVmwPEu6gk7VybVQ=";
 
   meta = with lib; {
     description = "A simple and fast dashboard for Kubernetes";
diff --git a/pkgs/development/tools/language-servers/neocmakelsp/default.nix b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
index fde707ec6641..b8807f0a26f8 100644
--- a/pkgs/development/tools/language-servers/neocmakelsp/default.nix
+++ b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "neocmakelsp";
-  version = "0.6.1";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "Decodetalkers";
     repo = "neocmakelsp";
     rev = "v${version}";
-    hash = "sha256-wwFek9668tC+j2F12b9YiYbYJWp5z4J4F09dlj+hlq0=";
+    hash = "sha256-8FQFg9EV50wGnhAoK6TNL2n7BSuvJnVw73LRNdmaegw=";
   };
 
-  cargoHash = "sha256-XmacBalkevCmYxWFcez/++1ng2yyURge466VX6QZC9M=";
+  cargoHash = "sha256-HWu+SYwjnZCv9K9Uru3YlZukpjK9+en2HBMTbRz5oW4=";
 
   meta = with lib; {
     description = "A cmake lsp based on tower-lsp and treesitter";
diff --git a/pkgs/development/tools/rust/cargo-udeps/default.nix b/pkgs/development/tools/rust/cargo-udeps/default.nix
index 8ff6c841758e..55bf3bb36b68 100644
--- a/pkgs/development/tools/rust/cargo-udeps/default.nix
+++ b/pkgs/development/tools/rust/cargo-udeps/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-udeps";
-  version = "0.1.41";
+  version = "0.1.42";
 
   src = fetchFromGitHub {
     owner = "est31";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LfPhs3hTM47ktDSSC5TVYQoJa4OzMfL7zKLWV4d6bAA=";
+    sha256 = "sha256-8CQnmUk7jMlcdtZh6046B5duKnZKaMVk2xG4D2svqVw=";
   };
 
-  cargoHash = "sha256-NBxQ75J60kZX6ASk3/42N5JT6pDLEZpnZtUCgRDOvSY=";
+  cargoHash = "sha256-e3ku9c4VLZtnJIUDRMAcUVaJnOsMqckj3XmuJHSR364=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/rust/leptosfmt/default.nix b/pkgs/development/tools/rust/leptosfmt/default.nix
index b4e2480d1c70..c2dbf742162a 100644
--- a/pkgs/development/tools/rust/leptosfmt/default.nix
+++ b/pkgs/development/tools/rust/leptosfmt/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "leptosfmt";
-  version = "0.1.12";
+  version = "0.1.13";
 
   src = fetchFromGitHub {
     owner = "bram209";
     repo = "leptosfmt";
     rev = version;
-    hash = "sha256-RR4gwmYna/mvUw5akQutWKaUCWzCjK512gynR9Pddd0=";
+    hash = "sha256-QitvZ0AkZcXmjv8EnewWjexQMVEHy/naUarBIrzHbBA=";
   };
 
-  cargoHash = "sha256-6du44SfH0dT1gWVFluB3+AA3GUzwN7Sjh03rKhSRKCM=";
+  cargoHash = "sha256-Fjj4lgkdHeA/3ajNbF1vTf6/YzGvDUJsDmiXzkEpels=";
 
   meta = with lib; {
     description = "A formatter for the leptos view! macro";
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 371e13de589e..25bce432bc5f 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -123,7 +123,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.9.3";
+  version = "1.9.4";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-IVP5RVHRxWkvPqndiuCxiguYWN5d32qJo9YzBOHoyUk";
+    hash = "sha256-xjN6nHqg7sQzgojClySQEjLQBdI5291TxPhgLjKzKvk=";
   };
 
   patches = [
@@ -212,9 +212,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dplugin_dummy=true"
     # We are building the official releases.
     "-Dsupported_build=enabled"
-    # Would dlopen libsoup to preserve compatibility with clients linking against older fwupd.
-    # https://github.com/fwupd/fwupd/commit/173d389fa59d8db152a5b9da7cc1171586639c97
-    "-Dsoup_session_compat=false"
     "-Dudevdir=lib/udev"
     "-Dsystemd_root_prefix=${placeholder "out"}"
     "-Dinstalled_test_prefix=${placeholder "installedTests"}"
@@ -399,7 +396,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     homepage = "https://fwupd.org/";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ rvdp ];
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 17fcbd128408..9b23625102ae 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -1,6 +1,18 @@
 { stdenv, lib, buildPackages, fetchurl, attr, runtimeShell
 , usePam ? !isStatic, pam ? null
 , isStatic ? stdenv.hostPlatform.isStatic
+
+# passthru.tests
+, bind
+, chrony
+, htop
+, libgcrypt
+, libvirt
+, ntp
+, qemu
+, squid
+, tor
+, uwsgi
 }:
 
 assert usePam -> pam != null;
@@ -57,6 +69,20 @@ stdenv.mkDerivation rec {
     mv "$lib"/lib/security "$pam/lib"
   '';
 
+  passthru.tests = {
+    inherit
+      bind
+      chrony
+      htop
+      libgcrypt
+      libvirt
+      ntp
+      qemu
+      squid
+      tor
+      uwsgi;
+  };
+
   meta = {
     description = "Library for working with POSIX capabilities";
     homepage = "https://sites.google.com/site/fullycapable";
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index f2bc1e7af4d8..61ee89b6e742 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "34508966027fce3f460d9670eeecef67b92565a0",
-    "sha256": "sha256-z+6YHhESb0Ws9DRaVH4AR2i/SaWgM9OhTzxdY1bkv/0=",
-    "version": "unstable-2023-08-07"
+    "rev": "1377f2ce7d0a8fed716e8e285902bfbfef1a17e0",
+    "sha256": "sha256-ro5XneQqKGOfR7UZrowiht5V45s7EgkpbJiyBoLcnBo=",
+    "version": "unstable-2023-08-25"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/tools/backup/awsbck/default.nix b/pkgs/tools/backup/awsbck/default.nix
index 9e1286312120..f0ef8367e0ee 100644
--- a/pkgs/tools/backup/awsbck/default.nix
+++ b/pkgs/tools/backup/awsbck/default.nix
@@ -8,20 +8,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awsbck";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "awsbck";
     rev = "v${version}";
-    hash = "sha256-L5hQ6vwuC9HuAGD9mvS8BGkPV3Ry5jJgRUF4Qf7fqaM=";
+    hash = "sha256-MDlFCbBAvGovhCO5uxXRQhIN4Fw9wav0afIBNzz3Mow=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
-  cargoSha256 = "sha256-VKm27IzCUv3e1Mapb46SBJqvEwifgGxaRX2uM9MTNnQ=";
+  cargoSha256 = "sha256-p7t/QtihdP6dyJ7tKpNkqcyYJvFJG8+fPqSGH7DNAtg=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/graphics/textplots/default.nix b/pkgs/tools/graphics/textplots/default.nix
index a0c5e72ac23c..efb6c6cce7ef 100644
--- a/pkgs/tools/graphics/textplots/default.nix
+++ b/pkgs/tools/graphics/textplots/default.nix
@@ -1,15 +1,15 @@
-{ fetchCrate, lib, rustPlatform }:
+{ lib, rustPlatform, fetchCrate }:
 
 rustPlatform.buildRustPackage rec {
   pname = "textplots";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "07lxnvg8g24r1j6h07w91j5lp0azngmb76lagk55y28br0y70qr4";
+    hash = "sha256-fzuvJwxU6Vi9hWW0IcRAHUeSoOBpGyebzvgjKiYxAbs=";
   };
 
-  cargoSha256 = "19xb1ann3bqx26nhjjvcwqdsvzg7lflg9fdrnlx05ndd2ip44flz";
+  cargoHash = "sha256-QH27BjS75jZOQBBflGapAjg49LpG12DxWZo8TjLoXmI=";
 
   meta = with lib; {
     description = "Terminal plotting written in Rust";
diff --git a/pkgs/tools/misc/nomino/default.nix b/pkgs/tools/misc/nomino/default.nix
index ce9be1fd5878..1eb472ee8fa1 100644
--- a/pkgs/tools/misc/nomino/default.nix
+++ b/pkgs/tools/misc/nomino/default.nix
@@ -1,21 +1,22 @@
-{ fetchFromGitHub, lib, rustPlatform }:
+{ lib, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nomino";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "yaa110";
     repo = pname;
     rev = version;
-    sha256 = "sha256-XUxoHmZePn/VVlu2KctC+TbmCwp+tYEYg5EYXI8ZB7o=";
+    hash = "sha256-pzAL7e72sO94qLEwsH/5RuiuzvnsSelIq47jdU8INDw=";
   };
 
-  cargoSha256 = "sha256-RyEqDC2gRacd27uvNf3XOATZdeVg70vBEdPURNuf38w=";
+  cargoHash = "sha256-gDOZ3nD7pTIRNXG3S+qTkl+HInBcAErvwPqa0NZWxY4=";
 
   meta = with lib; {
     description = "Batch rename utility for developers";
     homepage = "https://github.com/yaa110/nomino";
+    changelog = "https://github.com/yaa110/nomino/releases/tag/${src.rev}";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ figsoda ];
   };
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 078d80af10eb..519aedad558e 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.51.2";
+  version = "0.51.3";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uiF27qGHwAg05o9thCxIf6Z2xhMnKzhDgMKTuS6IJ8A=";
+    sha256 = "sha256-ijcYSuB91I9lD4qx6ohVFDQgTE0+FTQ5Hr1heNwKyUo=";
   };
 
-  vendorHash = "sha256-sqlBgEfIWuDnGsepSZtrgxmG/DoP+Hc4c3nOpo8S/Ks=";
+  vendorHash = "sha256-DFQ59E24LR5/qodtge0EsqajvrjPN0otpxGB8JQ0ERw=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index b7c39d83d896..6ac8dfb04ef6 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -18,11 +18,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-SFVS/NnV1fQarQRvEx/Ap+hJvvJaNJoEB1CvDG/FaAc=";
+    hash = "sha256-aY1pBtFwlGqGl2mWTleBa6PaOt9h/3XomXKxN/RljbA=";
   };
 
   buildInputs = [ openssl zlib libxcrypt ]
@@ -76,5 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     maintainers = with lib.maintainers; [ ];
     platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "haproxy";
   };
 })
diff --git a/pkgs/tools/networking/ssl-proxy/default.nix b/pkgs/tools/networking/ssl-proxy/default.nix
new file mode 100644
index 000000000000..1aac650885b6
--- /dev/null
+++ b/pkgs/tools/networking/ssl-proxy/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGo118Module, fetchFromGitHub }:
+
+buildGo118Module rec {
+  pname = "ssl-proxy";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "suyashkumar";
+    repo = "ssl-proxy";
+    rev = "v${version}";
+    hash = "sha256-c9BLdDlkrg1z1QrO+vEAVyPtrV/nQcYlGXFmwfAOSpQ=";
+  };
+
+  vendorHash = "sha256-310K9ZSxy/OQ4HYFCcHQaj4NQwzATrOZ2YkhiSkhY5I=";
+
+  checkTarget = "test";
+
+  meta = with lib; {
+    homepage = "https://github.com/suyashkumar/ssl-proxy";
+    description = "Simple single-command SSL reverse proxy with autogenerated certificates (LetsEncrypt, self-signed)";
+    longDescription = ''
+      A handy and simple way to add SSL to your thing running on a VM--be it your personal jupyter
+      notebook or your team jenkins instance. ssl-proxy autogenerates SSL certs and proxies
+      HTTPS traffic to an existing HTTP server in a single command.
+    '';
+    license = licenses.mit;
+    mainProgram = "ssl-proxy";
+    maintainers = [ maintainers.konst-aa ];
+    platforms = platforms.linux ++ platforms.darwin ++ platforms.windows ;
+  };
+}
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index 1821d1c090de..8a3265727168 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -1,4 +1,6 @@
-params: with params;
+{ lib, buildEnv, runCommand, writeText, makeWrapper, libfaketime, makeFontsConf
+, perl, bash, coreutils, gnused, gnugrep, gawk, ghostscript
+, bin, tl }:
 # combine =
 args@{
   pkgFilter ? (pkg: pkg.tlType == "run" || pkg.tlType == "bin" || pkg.pname == "core"
@@ -8,6 +10,22 @@ args@{
 , ...
 }:
 let
+  # combine a set of TL packages into a single TL meta-package
+  combinePkgs = pkgList: lib.catAttrs "pkg" (
+    let
+      # a TeX package is an attribute set { pkgs = [ ... ]; ... } where pkgs is a list of derivations
+      # the derivations make up the TeX package and optionally (for backward compatibility) its dependencies
+      tlPkgToSets = { pkgs, ... }: map ({ tlType, version ? "", outputName ? "", ... }@pkg: {
+          # outputName required to distinguish among bin.core-big outputs
+          key = "${pkg.pname or pkg.name}.${tlType}-${version}-${outputName}";
+          inherit pkg;
+        }) pkgs;
+      pkgListToSets = lib.concatMap tlPkgToSets; in
+    builtins.genericClosure {
+      startSet = pkgListToSets pkgList;
+      operator = { pkg, ... }: pkgListToSets (pkg.tlDeps or []);
+    });
+
   pkgSet = removeAttrs args [ "pkgFilter" "extraName" "extraVersion" ];
   pkgList = rec {
     combined = combinePkgs (lib.attrValues pkgSet);
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 90a65ab1405e..96bc6f61e4f0 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -23,8 +23,8 @@ let
 
   # function for creating a working environment from a set of TL packages
   combine = import ./combine.nix {
-    inherit bin combinePkgs buildEnv lib makeWrapper writeText runCommand
-      stdenv perl libfaketime makeFontsConf bash tl coreutils gawk gnugrep gnused;
+    inherit bin buildEnv lib makeWrapper writeText runCommand
+      perl libfaketime makeFontsConf bash tl coreutils gawk gnugrep gnused;
     ghostscript = ghostscript_headless;
   };
 
@@ -34,406 +34,14 @@ let
 
   # the set of TeX Live packages, collections, and schemes; using upstream naming
   overriddenTlpdb = let
-    # most format -> engine links are generated by texlinks according to fmtutil.cnf at combine time
-    # so we remove them from binfiles, and add back the ones texlinks purposefully ignore (e.g. mptopdf)
-    removeFormatLinks = lib.mapAttrs (_: attrs:
-      if (attrs ? formats && attrs ? binfiles)
-      then let formatLinks = lib.catAttrs "name" (lib.filter (f: f.name != f.engine) attrs.formats);
-               binNotFormats = lib.subtractLists formatLinks attrs.binfiles;
-           in if binNotFormats != [] then attrs // { binfiles = binNotFormats; } else removeAttrs attrs [ "binfiles" ]
-      else attrs);
-
-    orig = removeFormatLinks (removeAttrs tlpdb [ "00texlive.config" ]); in
-
-    lib.recursiveUpdate orig rec {
-      #### overrides of texlive.tlpdb
-
-      #### nonstandard script folders
-      context.scriptsFolder = "context/stubs/unix";
-      cyrillic-bin.scriptsFolder = "texlive-extra";
-      fontinst.scriptsFolder = "texlive-extra";
-      mptopdf.scriptsFolder = "context/perl";
-      pdftex.scriptsFolder = "simpdftex";
-      texlive-scripts.scriptsFolder = "texlive";
-      texlive-scripts-extra.scriptsFolder = "texlive-extra";
-      xetex.scriptsFolder = "texlive-extra";
-
-      #### interpreters not detected by looking at the script extensions
-      ctanbib.extraBuildInputs = [ bin.luatex ];
-      de-macro.extraBuildInputs = [ python3 ];
-      match_parens.extraBuildInputs = [ ruby ];
-      optexcount.extraBuildInputs = [ python3 ];
-      pdfbook2.extraBuildInputs = [ python3 ];
-      texlogsieve.extraBuildInputs = [ bin.luatex ];
-
-      #### perl packages
-      crossrefware.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ LWP URI ])) ];
-      ctan-o-mat.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ LWP LWPProtocolHttps ])) ];
-      ctanify.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileCopyRecursive ])) ];
-      ctanupload.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ HTMLFormatter WWWMechanize ])) ];
-      exceltex.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ SpreadsheetParseExcel ])) ];
-      latex-git-log.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ IPCSystemSimple ])) ];
-      latexindent.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileHomeDir LogDispatch LogLog4perl UnicodeLineBreak YAMLTiny ])) ];
-      pax.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileWhich ])) ];
-      ptex-fontmaps.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ Tk ])) ];
-      purifyeps.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileWhich ])) ];
-      svn-multi.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ TimeDate ])) ];
-      texdoctk.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ Tk ])) ];
-      ulqda.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ DigestSHA1 ])) ];
-
-      #### python packages
-      pythontex.extraBuildInputs = [ (python3.withPackages (ps: with ps; [ pygments ])) ];
-
-      #### other runtime PATH dependencies
-      a2ping.extraBuildInputs = [ ghostscript_headless ];
-      bibexport.extraBuildInputs = [ gnugrep ];
-      checklistings.extraBuildInputs = [ coreutils ];
-      cjk-gs-integrate.extraBuildInputs = [ ghostscript_headless ];
-      context.extraBuildInputs = [ coreutils ruby ];
-      cyrillic-bin.extraBuildInputs = [ coreutils gnused ];
-      dtxgen.extraBuildInputs = [ coreutils getopt gnumake zip ];
-      dviljk.extraBuildInputs = [ coreutils ];
-      epspdf.extraBuildInputs = [ ghostscript_headless ];
-      epstopdf.extraBuildInputs = [ ghostscript_headless ];
-      fragmaster.extraBuildInputs = [ ghostscript_headless ];
-      installfont.extraBuildInputs = [ coreutils getopt gnused ];
-      latexfileversion.extraBuildInputs = [ coreutils gnugrep gnused ];
-      listings-ext.extraBuildInputs = [ coreutils getopt ];
-      ltxfileinfo.extraBuildInputs = [ coreutils getopt gnused ];
-      ltximg.extraBuildInputs = [ ghostscript_headless ];
-      luaotfload.extraBuildInputs = [ ncurses ];
-      makeindex.extraBuildInputs = [ coreutils gnused ];
-      pagelayout.extraBuildInputs = [ gnused ncurses ];
-      pdfcrop.extraBuildInputs = [ ghostscript_headless ];
-      pdftex.extraBuildInputs = [ coreutils ghostscript_headless gnused ];
-      pdftex-quiet.extraBuildInputs = [ coreutils ];
-      pdfxup.extraBuildInputs = [ coreutils ghostscript_headless ];
-      pkfix-helper.extraBuildInputs = [ ghostscript_headless ];
-      ps2eps.extraBuildInputs = [ ghostscript_headless ];
-      pst2pdf.extraBuildInputs = [ ghostscript_headless ];
-      tex4ht.extraBuildInputs = [ ruby ];
-      texlive-scripts.extraBuildInputs = [ gnused ];
-      texlive-scripts-extra.extraBuildInputs = [ coreutils findutils ghostscript_headless gnused ];
-      thumbpdf.extraBuildInputs = [ ghostscript_headless ];
-      tpic2pdftex.extraBuildInputs = [ gawk ];
-      wordcount.extraBuildInputs = [ coreutils gnugrep ];
-      xdvi.extraBuildInputs = [ coreutils gnugrep ];
-      xindy.extraBuildInputs = [ gzip ];
-
-      #### adjustments to binaries
-      # TODO patch the scripts from bin.* directly in bin.* instead of here
-
-      # mptopdf is a format link, but not generated by texlinks
-      # so we add it back to binfiles to generate it from mkPkgBin
-      mptopdf.binfiles = (orig.mptopdf.binfiles or []) ++ [ "mptopdf" ];
-
-      # remove man
-      texlive-scripts.binfiles = lib.remove "man" orig.texlive-scripts.binfiles;
-
-      # upmendex is "TODO" in bin.nix
-      uptex.binfiles = lib.remove "upmendex" orig.uptex.binfiles;
-
-      # xindy is broken on some platforms unfortunately
-      xindy.binfiles = if bin ? xindy
-        then lib.subtractLists [ "xindy.mem" "xindy.run" ] orig.xindy.binfiles
-        else [];
-
-      #### additional symlinks
-      cluttex.binlinks = {
-        cllualatex = "cluttex";
-        clxelatex = "cluttex";
-      };
-
-      epstopdf.binlinks.repstopdf = "epstopdf";
-      pdfcrop.binlinks.rpdfcrop = "pdfcrop";
-
-      ptex.binlinks = {
-        pdvitomp = bin.metapost + "/bin/pdvitomp";
-        pmpost = bin.metapost + "/bin/pmpost";
-        r-pmpost = bin.metapost + "/bin/r-pmpost";
-      };
-
-      texdef.binlinks = {
-        latexdef = "texdef";
-      };
-
-      texlive-scripts.binlinks = {
-        mktexfmt = "fmtutil";
-        texhash = (lib.last tl."texlive.infra".pkgs) + "/bin/mktexlsr";
-      };
-
-      texlive-scripts-extra.binlinks = {
-        allec = "allcm";
-        kpsepath = "kpsetool";
-        kpsexpand = "kpsetool";
-      };
-
-      # metapost binaries are in bin.metapost instead of bin.core
-      uptex.binlinks = {
-        r-upmpost = bin.metapost + "/bin/r-upmpost";
-        updvitomp = bin.metapost + "/bin/updvitomp";
-        upmpost = bin.metapost + "/bin/upmpost";
-      };
-
-      #### add PATH dependencies without wrappers
-      # TODO deduplicate this code
-      a2ping.postFixup = ''
-        sed -i '6i$ENV{PATH}='"'"'${lib.makeBinPath a2ping.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/a2ping
-      '';
-
-      bibexport.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath bibexport.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/bibexport
-      '';
-
-      checklistings.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath checklistings.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/checklistings
-      '';
-
-      cjk-gs-integrate.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath cjk-gs-integrate.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/cjk-gs-integrate
-      '';
-
-      context.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{contextjit,mtxrunjit}
-        sed -i '2iPATH="${lib.makeBinPath [ ruby ]}''${PATH:+:$PATH}"' "$out"/bin/texexec
-      '';
-
-      cyrillic-bin.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath cyrillic-bin.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/rumakeindex
-      '';
-
-      dtxgen.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath dtxgen.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/dtxgen
-      '';
-
-      dviljk.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath dviljk.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/dvihp
-      '';
-
-      epstopdf.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath epstopdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/epstopdf
-      '';
-
-      fragmaster.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath fragmaster.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/fragmaster
-      '';
-
-      installfont.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath installfont.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/installfont-tl
-      '';
-
-      latexfileversion.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath latexfileversion.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/latexfileversion
-      '';
-
-      listings-ext.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath listings-ext.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/listings-ext.sh
-      '';
-
-      ltxfileinfo.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath ltxfileinfo.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/ltxfileinfo
-      '';
-
-      ltximg.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath ltximg.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/ltximg
-      '';
-
-      luaotfload.postFixup = ''
-        sed -i '2ios.setenv("PATH","${lib.makeBinPath luaotfload.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/luaotfload-tool
-      '';
-
-      makeindex.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath makeindex.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/mkindex
-      '';
-
-      pagelayout.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath [ gnused ]}''${PATH:+:$PATH}"' "$out"/bin/pagelayoutapi
-        sed -i '2iPATH="${lib.makeBinPath [ ncurses ]}''${PATH:+:$PATH}"' "$out"/bin/textestvis
-      '';
-
-      pdfcrop.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pdfcrop.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pdfcrop
-      '';
-
-      pdftex.postFixup = ''
-        sed -i -e '2iPATH="${lib.makeBinPath [ coreutils gnused ]}''${PATH:+:$PATH}"' \
-          -e 's!^distillerpath="/usr/local/bin"$!distillerpath="${lib.makeBinPath [ ghostscript_headless ]}"!' \
-          "$out"/bin/simpdftex
-      '';
-
-      pdftex-quiet.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath pdftex-quiet.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/pdftex-quiet
-      '';
-
-      pdfxup.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath pdfxup.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/pdfxup
-      '';
-
-      pkfix-helper.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pkfix-helper.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pkfix-helper
-      '';
-
-      ps2eps.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath ps2eps.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/ps2eps
-      '';
-
-      pst2pdf.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pst2pdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pst2pdf
-      '';
-
-      tex4ht.postFixup = ''
-        sed -i -e '2iPATH="${lib.makeBinPath tex4ht.extraBuildInputs}''${PATH:+:$PATH}"' -e 's/\\rubyCall//g;' "$out"/bin/htcontext
-      '';
-
-      texlive-scripts.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath texlive-scripts.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/{fmtutil-user,mktexmf,mktexpk,mktextfm,updmap-user}
-      '';
-
-      thumbpdf.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath thumbpdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/thumbpdf
-      '';
-
-      tpic2pdftex.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath tpic2pdftex.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/tpic2pdftex
-      '';
-
-      wordcount.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath wordcount.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/wordcount
-      '';
-
-      # TODO patch in bin.xdvi
-      xdvi.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath xdvi.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/xdvi
-      '';
-
-      xindy.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath xindy.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/{texindy,xindy}
-      '';
-
-      #### other script fixes
-      # misc tab and python3 fixes
-      ebong.postFixup = ''
-        sed -Ei 's/import sre/import re/; s/file\(/open(/g; s/\t/        /g; s/print +(.*)$/print(\1)/g' "$out"/bin/ebong
-      '';
-
-      # find files in script directory, not binary directory
-      # add runtime dependencies to PATH
-      epspdf.postFixup = ''
-        sed -i '2ios.setenv("PATH","${lib.makeBinPath epspdf.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/epspdf
-        substituteInPlace "$out"/bin/epspdftk --replace '[info script]' "\"$scriptsFolder/epspdftk.tcl\""
-      '';
-
-      # find files in script directory, not in binary directory
-      latexindent.postFixup = ''
-        substituteInPlace "$out"/bin/latexindent --replace 'use FindBin;' "BEGIN { \$0 = '$scriptsFolder' . '/latexindent.pl'; }; use FindBin;"
-      '';
-
-      # Patch texlinks.sh back to 2015 version;
-      # otherwise some bin/ links break, e.g. xe(la)tex.
-      # add runtime dependencies to PATH
-      texlive-scripts-extra.postFixup = ''
-        patch -R "$out"/bin/texlinks < '${./texlinks.diff}'
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{allcm,dvired,mkocp,ps2frag}
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils findutils ]}''${PATH:+:$PATH}"' "$out"/bin/allneeded
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils ghostscript_headless ]}''${PATH:+:$PATH}"' "$out"/bin/dvi2fax
-        sed -i '2iPATH="${lib.makeBinPath [ gnused ]}''${PATH:+:$PATH}"' "$out"/bin/{kpsetool,texconfig,texconfig-sys}
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused ]}''${PATH:+:$PATH}"' "$out"/bin/texconfig-dialog
-      '';
-
-      # patch interpreter
-      texosquery.postFixup = ''
-        substituteInPlace "$out"/bin/* --replace java "$interpJava"
-      '';
-
-      # hardcode revision numbers (since texlive.infra, tlshell are not in either system or user texlive.tlpdb)
-      tlshell.postFixup = ''
-        substituteInPlace "$out"/bin/tlshell \
-          --replace '[dict get $::pkgs texlive.infra localrev]' '${toString orig."texlive.infra".revision}' \
-          --replace '[dict get $::pkgs tlshell localrev]' '${toString orig.tlshell.revision}'
-      '';
-      #### dependency changes
-
-      # it seems to need it to transform fonts
-      xdvi.deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
-
-      # remove dependency-heavy packages from the basic collections
-      collection-basic.deps = lib.subtractLists [ "metafont" "xdvi" ] orig.collection-basic.deps;
-
-      # add them elsewhere so that collections cover all packages
-      collection-metapost.deps = orig.collection-metapost.deps ++ [ "metafont" ];
-      collection-plaingeneric.deps = orig.collection-plaingeneric.deps ++ [ "xdvi" ];
-
-      #### misc
-
-      # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
-      arabi-add.license = [  "lppl13c" ];
-
-      # TODO: remove this when updating to texlive-2023, npp-for-context is no longer in texlive
-      # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
-      npp-for-context.license = [  "gpl3Only" ];
-
-      texdoc = {
-        extraRevision = "-tlpdb${toString tlpdbVersion.revision}";
-        extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
-
-        extraNativeBuildInputs = [ installShellFiles ];
-
-        # build Data.tlpdb.lua (part of the 'tlType == "run"' package)
-        postUnpack = ''
-          if [[ -f "$out"/scripts/texdoc/texdoc.tlu ]]; then
-            unxz --stdout "${tlpdbxz}" > texlive.tlpdb
-
-            # create dummy doc file to ensure that texdoc does not return an error
-            mkdir -p support/texdoc
-            touch support/texdoc/NEWS
-
-            TEXMFCNF="${bin.core}"/share/texmf-dist/web2c TEXMF="$out" TEXDOCS=. TEXMFVAR=. \
-              "${bin.luatex}"/bin/texlua "$out"/scripts/texdoc/texdoc.tlu \
-              -c texlive_tlpdb=texlive.tlpdb -lM texdoc
-
-            cp texdoc/cache-tlpdb.lua "$out"/scripts/texdoc/Data.tlpdb.lua
-          fi
-        '';
-
-        # install zsh completion
-        postFixup = ''
-          TEXMFCNF="${bin.core}"/share/texmf-dist/web2c TEXMF="$scriptsFolder/../.." \
-            texlua "$out"/bin/texdoc --print-completion zsh > "$TMPDIR"/_texdoc
-          substituteInPlace "$TMPDIR"/_texdoc \
-            --replace 'compdef __texdoc texdoc' '#compdef texdoc' \
-            --replace '$(kpsewhich -var-value TEXMFROOT)/tlpkg/texlive.tlpdb' '$(kpsewhich Data.tlpdb.lua)' \
-            --replace '/^name[^.]*$/ {print $2}' '/^  \["[^"]*"\] = {$/ { print substr($1,3,length($1)-4) }'
-          echo '__texdoc' >> "$TMPDIR"/_texdoc
-          installShellCompletion --zsh "$TMPDIR"/_texdoc
-        '';
-      };
-
-      "texlive.infra" = {
-        extraRevision = ".tlpdb${toString tlpdbVersion.revision}";
-        extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
-
-        # add license of tlmgr and TeXLive::* perl packages and of bin.core
-        license = [ "gpl2Plus" ] ++ lib.toList bin.core.meta.license.shortName ++ orig."texlive.infra".license or [ ];
-
-        scriptsFolder = "texlive";
-        extraBuildInputs = [ coreutils gnused gnupg (lib.last tl.kpathsea.pkgs) (perl.withPackages (ps: with ps; [ Tk ])) ];
-
-        # make tlmgr believe it can use kpsewhich to evaluate TEXMFROOT
-        postFixup = ''
-          substituteInPlace "$out"/bin/tlmgr \
-            --replace 'if (-r "$bindir/$kpsewhichname")' 'if (1)'
-          sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath [ gnupg ]}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/tlmgr
-          sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused (lib.last tl.kpathsea.pkgs) ]}''${PATH:+:$PATH}"' "$out"/bin/mktexlsr
-        '';
-
-        # add minimal texlive.tlpdb
-        postUnpack = ''
-          if [[ "$tlType" == "tlpkg" ]] ; then
-            xzcat "${tlpdbxz}" | sed -n -e '/^name \(00texlive.config\|00texlive.installation\)$/,/^$/p' > "$out"/texlive.tlpdb
-          fi
-        '';
-      };
-    }; # overrides
+    overrides = import ./tlpdb-overrides.nix {
+      inherit
+        lib bin tlpdb tlpdbxz tl
+        installShellFiles
+        coreutils findutils gawk getopt ghostscript_headless gnugrep
+        gnumake gnupg gnused gzip ncurses perl python3 ruby zip;
+    };
+  in overrides tlpdb;
 
   version = {
     # day of the snapshot being taken
@@ -492,22 +100,6 @@ let
       // lib.optionalAttrs (args ? deps) { deps = map (n: tl.${n}) (args.deps or [ ]); })
   ) overriddenTlpdb;
 
-  # combine a set of TL packages into a single TL meta-package
-  combinePkgs = pkgList: lib.catAttrs "pkg" (
-    let
-      # a TeX package is an attribute set { pkgs = [ ... ]; ... } where pkgs is a list of derivations
-      # the derivations make up the TeX package and optionally (for backward compatibility) its dependencies
-      tlPkgToSets = { pkgs, ... }: map ({ tlType, version ? "", outputName ? "", ... }@pkg: {
-          # outputName required to distinguish among bin.core-big outputs
-          key = "${pkg.pname or pkg.name}.${tlType}-${version}-${outputName}";
-          inherit pkg;
-        }) pkgs;
-      pkgListToSets = lib.concatMap tlPkgToSets; in
-    builtins.genericClosure {
-      startSet = pkgListToSets pkgList;
-      operator = { pkg, ... }: pkgListToSets (pkg.tlDeps or []);
-    });
-
   assertions = with lib;
     assertMsg (tlpdbVersion.year == version.texliveYear) "TeX Live year in texlive does not match tlpdb.nix, refusing to evaluate" &&
     assertMsg (tlpdbVersion.frozen == version.final) "TeX Live final status in texlive does not match tlpdb.nix, refusing to evaluate";
diff --git a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
new file mode 100644
index 000000000000..4d2ce46ed475
--- /dev/null
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
@@ -0,0 +1,411 @@
+{ lib, tlpdb, bin, tlpdbxz, tl
+, installShellFiles
+, coreutils, findutils, gawk, getopt, ghostscript_headless, gnugrep
+, gnumake, gnupg, gnused, gzip, ncurses, perl, python3, ruby, zip
+}:
+
+oldTlpdb:
+
+let
+  tlpdbVersion = tlpdb."00texlive.config";
+
+    # most format -> engine links are generated by texlinks according to fmtutil.cnf at combine time
+    # so we remove them from binfiles, and add back the ones texlinks purposefully ignore (e.g. mptopdf)
+    removeFormatLinks = lib.mapAttrs (_: attrs:
+      if (attrs ? formats && attrs ? binfiles)
+      then let formatLinks = lib.catAttrs "name" (lib.filter (f: f.name != f.engine) attrs.formats);
+               binNotFormats = lib.subtractLists formatLinks attrs.binfiles;
+           in if binNotFormats != [] then attrs // { binfiles = binNotFormats; } else removeAttrs attrs [ "binfiles" ]
+      else attrs);
+
+    orig = removeFormatLinks (removeAttrs oldTlpdb [ "00texlive.config" ]);
+
+in lib.recursiveUpdate orig rec {
+  #### overrides of texlive.tlpdb
+
+  #### nonstandard script folders
+  context.scriptsFolder = "context/stubs/unix";
+  cyrillic-bin.scriptsFolder = "texlive-extra";
+  fontinst.scriptsFolder = "texlive-extra";
+  mptopdf.scriptsFolder = "context/perl";
+  pdftex.scriptsFolder = "simpdftex";
+  texlive-scripts.scriptsFolder = "texlive";
+  texlive-scripts-extra.scriptsFolder = "texlive-extra";
+  xetex.scriptsFolder = "texlive-extra";
+
+  #### interpreters not detected by looking at the script extensions
+  ctanbib.extraBuildInputs = [ bin.luatex ];
+  de-macro.extraBuildInputs = [ python3 ];
+  match_parens.extraBuildInputs = [ ruby ];
+  optexcount.extraBuildInputs = [ python3 ];
+  pdfbook2.extraBuildInputs = [ python3 ];
+  texlogsieve.extraBuildInputs = [ bin.luatex ];
+
+  #### perl packages
+  crossrefware.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ LWP URI ])) ];
+  ctan-o-mat.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ LWP LWPProtocolHttps ])) ];
+  ctanify.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileCopyRecursive ])) ];
+  ctanupload.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ HTMLFormatter WWWMechanize ])) ];
+  exceltex.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ SpreadsheetParseExcel ])) ];
+  latex-git-log.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ IPCSystemSimple ])) ];
+  latexindent.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileHomeDir LogDispatch LogLog4perl UnicodeLineBreak YAMLTiny ])) ];
+  pax.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileWhich ])) ];
+  ptex-fontmaps.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ Tk ])) ];
+  purifyeps.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileWhich ])) ];
+  svn-multi.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ TimeDate ])) ];
+  texdoctk.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ Tk ])) ];
+  ulqda.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ DigestSHA1 ])) ];
+
+  #### python packages
+  pythontex.extraBuildInputs = [ (python3.withPackages (ps: with ps; [ pygments ])) ];
+
+  #### other runtime PATH dependencies
+  a2ping.extraBuildInputs = [ ghostscript_headless ];
+  bibexport.extraBuildInputs = [ gnugrep ];
+  checklistings.extraBuildInputs = [ coreutils ];
+  cjk-gs-integrate.extraBuildInputs = [ ghostscript_headless ];
+  context.extraBuildInputs = [ coreutils ruby ];
+  cyrillic-bin.extraBuildInputs = [ coreutils gnused ];
+  dtxgen.extraBuildInputs = [ coreutils getopt gnumake zip ];
+  dviljk.extraBuildInputs = [ coreutils ];
+  epspdf.extraBuildInputs = [ ghostscript_headless ];
+  epstopdf.extraBuildInputs = [ ghostscript_headless ];
+  fragmaster.extraBuildInputs = [ ghostscript_headless ];
+  installfont.extraBuildInputs = [ coreutils getopt gnused ];
+  latexfileversion.extraBuildInputs = [ coreutils gnugrep gnused ];
+  listings-ext.extraBuildInputs = [ coreutils getopt ];
+  ltxfileinfo.extraBuildInputs = [ coreutils getopt gnused ];
+  ltximg.extraBuildInputs = [ ghostscript_headless ];
+  luaotfload.extraBuildInputs = [ ncurses ];
+  makeindex.extraBuildInputs = [ coreutils gnused ];
+  pagelayout.extraBuildInputs = [ gnused ncurses ];
+  pdfcrop.extraBuildInputs = [ ghostscript_headless ];
+  pdftex.extraBuildInputs = [ coreutils ghostscript_headless gnused ];
+  pdftex-quiet.extraBuildInputs = [ coreutils ];
+  pdfxup.extraBuildInputs = [ coreutils ghostscript_headless ];
+  pkfix-helper.extraBuildInputs = [ ghostscript_headless ];
+  ps2eps.extraBuildInputs = [ ghostscript_headless ];
+  pst2pdf.extraBuildInputs = [ ghostscript_headless ];
+  tex4ht.extraBuildInputs = [ ruby ];
+  texlive-scripts.extraBuildInputs = [ gnused ];
+  texlive-scripts-extra.extraBuildInputs = [ coreutils findutils ghostscript_headless gnused ];
+  thumbpdf.extraBuildInputs = [ ghostscript_headless ];
+  tpic2pdftex.extraBuildInputs = [ gawk ];
+  wordcount.extraBuildInputs = [ coreutils gnugrep ];
+  xdvi.extraBuildInputs = [ coreutils gnugrep ];
+  xindy.extraBuildInputs = [ gzip ];
+
+  #### adjustments to binaries
+  # TODO patch the scripts from bin.* directly in bin.* instead of here
+
+  # mptopdf is a format link, but not generated by texlinks
+  # so we add it back to binfiles to generate it from mkPkgBin
+  mptopdf.binfiles = (orig.mptopdf.binfiles or []) ++ [ "mptopdf" ];
+
+  # remove man
+  texlive-scripts.binfiles = lib.remove "man" orig.texlive-scripts.binfiles;
+
+  # upmendex is "TODO" in bin.nix
+  uptex.binfiles = lib.remove "upmendex" orig.uptex.binfiles;
+
+  # xindy is broken on some platforms unfortunately
+  xindy.binfiles = if bin ? xindy
+    then lib.subtractLists [ "xindy.mem" "xindy.run" ] orig.xindy.binfiles
+    else [];
+
+  #### additional symlinks
+  cluttex.binlinks = {
+    cllualatex = "cluttex";
+    clxelatex = "cluttex";
+  };
+
+  epstopdf.binlinks.repstopdf = "epstopdf";
+  pdfcrop.binlinks.rpdfcrop = "pdfcrop";
+
+  ptex.binlinks = {
+    pdvitomp = bin.metapost + "/bin/pdvitomp";
+    pmpost = bin.metapost + "/bin/pmpost";
+    r-pmpost = bin.metapost + "/bin/r-pmpost";
+  };
+
+  texdef.binlinks = {
+    latexdef = "texdef";
+  };
+
+  texlive-scripts.binlinks = {
+    mktexfmt = "fmtutil";
+    texhash = (lib.last tl."texlive.infra".pkgs) + "/bin/mktexlsr";
+  };
+
+  texlive-scripts-extra.binlinks = {
+    allec = "allcm";
+    kpsepath = "kpsetool";
+    kpsexpand = "kpsetool";
+  };
+
+  # metapost binaries are in bin.metapost instead of bin.core
+  uptex.binlinks = {
+    r-upmpost = bin.metapost + "/bin/r-upmpost";
+    updvitomp = bin.metapost + "/bin/updvitomp";
+    upmpost = bin.metapost + "/bin/upmpost";
+  };
+
+  #### add PATH dependencies without wrappers
+  # TODO deduplicate this code
+  a2ping.postFixup = ''
+    sed -i '6i$ENV{PATH}='"'"'${lib.makeBinPath a2ping.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/a2ping
+  '';
+
+  bibexport.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath bibexport.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/bibexport
+  '';
+
+  checklistings.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath checklistings.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/checklistings
+  '';
+
+  cjk-gs-integrate.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath cjk-gs-integrate.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/cjk-gs-integrate
+  '';
+
+  context.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{contextjit,mtxrunjit}
+    sed -i '2iPATH="${lib.makeBinPath [ ruby ]}''${PATH:+:$PATH}"' "$out"/bin/texexec
+  '';
+
+  cyrillic-bin.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath cyrillic-bin.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/rumakeindex
+  '';
+
+  dtxgen.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath dtxgen.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/dtxgen
+  '';
+
+  dviljk.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath dviljk.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/dvihp
+  '';
+
+  epstopdf.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath epstopdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/epstopdf
+  '';
+
+  fragmaster.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath fragmaster.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/fragmaster
+  '';
+
+  installfont.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath installfont.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/installfont-tl
+  '';
+
+  latexfileversion.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath latexfileversion.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/latexfileversion
+  '';
+
+  listings-ext.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath listings-ext.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/listings-ext.sh
+  '';
+
+  ltxfileinfo.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath ltxfileinfo.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/ltxfileinfo
+  '';
+
+  ltximg.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath ltximg.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/ltximg
+  '';
+
+  luaotfload.postFixup = ''
+    sed -i '2ios.setenv("PATH","${lib.makeBinPath luaotfload.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/luaotfload-tool
+  '';
+
+  makeindex.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath makeindex.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/mkindex
+  '';
+
+  pagelayout.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath [ gnused ]}''${PATH:+:$PATH}"' "$out"/bin/pagelayoutapi
+    sed -i '2iPATH="${lib.makeBinPath [ ncurses ]}''${PATH:+:$PATH}"' "$out"/bin/textestvis
+  '';
+
+  pdfcrop.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pdfcrop.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pdfcrop
+  '';
+
+  pdftex.postFixup = ''
+    sed -i -e '2iPATH="${lib.makeBinPath [ coreutils gnused ]}''${PATH:+:$PATH}"' \
+      -e 's!^distillerpath="/usr/local/bin"$!distillerpath="${lib.makeBinPath [ ghostscript_headless ]}"!' \
+      "$out"/bin/simpdftex
+  '';
+
+  pdftex-quiet.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath pdftex-quiet.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/pdftex-quiet
+  '';
+
+  pdfxup.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath pdfxup.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/pdfxup
+  '';
+
+  pkfix-helper.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pkfix-helper.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pkfix-helper
+  '';
+
+  ps2eps.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath ps2eps.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/ps2eps
+  '';
+
+  pst2pdf.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pst2pdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pst2pdf
+  '';
+
+  tex4ht.postFixup = ''
+    sed -i -e '2iPATH="${lib.makeBinPath tex4ht.extraBuildInputs}''${PATH:+:$PATH}"' -e 's/\\rubyCall//g;' "$out"/bin/htcontext
+  '';
+
+  texlive-scripts.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath texlive-scripts.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/{fmtutil-user,mktexmf,mktexpk,mktextfm,updmap-user}
+  '';
+
+  thumbpdf.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath thumbpdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/thumbpdf
+  '';
+
+  tpic2pdftex.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath tpic2pdftex.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/tpic2pdftex
+  '';
+
+  wordcount.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath wordcount.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/wordcount
+  '';
+
+  # TODO patch in bin.xdvi
+  xdvi.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath xdvi.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/xdvi
+  '';
+
+  xindy.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath xindy.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/{texindy,xindy}
+  '';
+
+  #### other script fixes
+  # misc tab and python3 fixes
+  ebong.postFixup = ''
+    sed -Ei 's/import sre/import re/; s/file\(/open(/g; s/\t/        /g; s/print +(.*)$/print(\1)/g' "$out"/bin/ebong
+  '';
+
+  # find files in script directory, not binary directory
+  # add runtime dependencies to PATH
+  epspdf.postFixup = ''
+    sed -i '2ios.setenv("PATH","${lib.makeBinPath epspdf.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/epspdf
+    substituteInPlace "$out"/bin/epspdftk --replace '[info script]' "\"$scriptsFolder/epspdftk.tcl\""
+  '';
+
+  # find files in script directory, not in binary directory
+  latexindent.postFixup = ''
+    substituteInPlace "$out"/bin/latexindent --replace 'use FindBin;' "BEGIN { \$0 = '$scriptsFolder' . '/latexindent.pl'; }; use FindBin;"
+  '';
+
+  # Patch texlinks.sh back to 2015 version;
+  # otherwise some bin/ links break, e.g. xe(la)tex.
+  # add runtime dependencies to PATH
+  texlive-scripts-extra.postFixup = ''
+    patch -R "$out"/bin/texlinks < '${./texlinks.diff}'
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{allcm,dvired,mkocp,ps2frag}
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils findutils ]}''${PATH:+:$PATH}"' "$out"/bin/allneeded
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils ghostscript_headless ]}''${PATH:+:$PATH}"' "$out"/bin/dvi2fax
+    sed -i '2iPATH="${lib.makeBinPath [ gnused ]}''${PATH:+:$PATH}"' "$out"/bin/{kpsetool,texconfig,texconfig-sys}
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused ]}''${PATH:+:$PATH}"' "$out"/bin/texconfig-dialog
+  '';
+
+  # patch interpreter
+  texosquery.postFixup = ''
+    substituteInPlace "$out"/bin/* --replace java "$interpJava"
+  '';
+
+  # hardcode revision numbers (since texlive.infra, tlshell are not in either system or user texlive.tlpdb)
+  tlshell.postFixup = ''
+    substituteInPlace "$out"/bin/tlshell \
+      --replace '[dict get $::pkgs texlive.infra localrev]' '${toString orig."texlive.infra".revision}' \
+      --replace '[dict get $::pkgs tlshell localrev]' '${toString orig.tlshell.revision}'
+  '';
+  #### dependency changes
+
+  # it seems to need it to transform fonts
+  xdvi.deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
+
+  # remove dependency-heavy packages from the basic collections
+  collection-basic.deps = lib.subtractLists [ "metafont" "xdvi" ] orig.collection-basic.deps;
+
+  # add them elsewhere so that collections cover all packages
+  collection-metapost.deps = orig.collection-metapost.deps ++ [ "metafont" ];
+  collection-plaingeneric.deps = orig.collection-plaingeneric.deps ++ [ "xdvi" ];
+
+  #### misc
+
+  # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
+  arabi-add.license = [  "lppl13c" ];
+
+  # TODO: remove this when updating to texlive-2023, npp-for-context is no longer in texlive
+  # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
+  npp-for-context.license = [  "gpl3Only" ];
+
+  texdoc = {
+    extraRevision = "-tlpdb${toString tlpdbVersion.revision}";
+    extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
+
+    extraNativeBuildInputs = [ installShellFiles ];
+
+    # build Data.tlpdb.lua (part of the 'tlType == "run"' package)
+    postUnpack = ''
+      if [[ -f "$out"/scripts/texdoc/texdoc.tlu ]]; then
+        unxz --stdout "${tlpdbxz}" > texlive.tlpdb
+
+        # create dummy doc file to ensure that texdoc does not return an error
+        mkdir -p support/texdoc
+        touch support/texdoc/NEWS
+
+        TEXMFCNF="${bin.core}"/share/texmf-dist/web2c TEXMF="$out" TEXDOCS=. TEXMFVAR=. \
+          "${bin.luatex}"/bin/texlua "$out"/scripts/texdoc/texdoc.tlu \
+          -c texlive_tlpdb=texlive.tlpdb -lM texdoc
+
+        cp texdoc/cache-tlpdb.lua "$out"/scripts/texdoc/Data.tlpdb.lua
+      fi
+    '';
+
+    # install zsh completion
+    postFixup = ''
+      TEXMFCNF="${bin.core}"/share/texmf-dist/web2c TEXMF="$scriptsFolder/../.." \
+        texlua "$out"/bin/texdoc --print-completion zsh > "$TMPDIR"/_texdoc
+      substituteInPlace "$TMPDIR"/_texdoc \
+        --replace 'compdef __texdoc texdoc' '#compdef texdoc' \
+        --replace '$(kpsewhich -var-value TEXMFROOT)/tlpkg/texlive.tlpdb' '$(kpsewhich Data.tlpdb.lua)' \
+        --replace '/^name[^.]*$/ {print $2}' '/^  \["[^"]*"\] = {$/ { print substr($1,3,length($1)-4) }'
+      echo '__texdoc' >> "$TMPDIR"/_texdoc
+      installShellCompletion --zsh "$TMPDIR"/_texdoc
+    '';
+  };
+
+  "texlive.infra" = {
+    extraRevision = ".tlpdb${toString tlpdbVersion.revision}";
+    extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
+
+    # add license of tlmgr and TeXLive::* perl packages and of bin.core
+    license = [ "gpl2Plus" ] ++ lib.toList bin.core.meta.license.shortName ++ orig."texlive.infra".license or [ ];
+
+    scriptsFolder = "texlive";
+    extraBuildInputs = [ coreutils gnused gnupg (lib.last tl.kpathsea.pkgs) (perl.withPackages (ps: with ps; [ Tk ])) ];
+
+    # make tlmgr believe it can use kpsewhich to evaluate TEXMFROOT
+    postFixup = ''
+      substituteInPlace "$out"/bin/tlmgr \
+        --replace 'if (-r "$bindir/$kpsewhichname")' 'if (1)'
+      sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath [ gnupg ]}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/tlmgr
+      sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused (lib.last tl.kpathsea.pkgs) ]}''${PATH:+:$PATH}"' "$out"/bin/mktexlsr
+    '';
+
+    # add minimal texlive.tlpdb
+    postUnpack = ''
+      if [[ "$tlType" == "tlpkg" ]] ; then
+        xzcat "${tlpdbxz}" | sed -n -e '/^name \(00texlive.config\|00texlive.installation\)$/,/^$/p' > "$out"/texlive.tlpdb
+      fi
+    '';
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e18de7f5e2ca..465a228e5ce9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -34309,6 +34309,8 @@ with pkgs;
 
   qemacs = callPackage ../applications/editors/qemacs { };
 
+  ragnarwm = callPackage ../applications/window-managers/ragnarwm {};
+
   rime-cli = callPackage ../applications/office/rime-cli { };
 
   roxctl = callPackage ../applications/networking/cluster/roxctl {
@@ -42170,4 +42172,6 @@ with pkgs;
   wpm = callPackage ../applications/misc/wpm { };
 
   yazi = callPackage ../applications/file-managers/yazi { inherit (darwin.apple_sdk.frameworks) Foundation; };
+
+  ssl-proxy = callPackage ../tools/networking/ssl-proxy { };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 386a25b44b30..726b95b1ce3c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2003,6 +2003,10 @@ self: super: with self; {
 
   click-log = callPackage ../development/python-modules/click-log { };
 
+  click-odoo = callPackage ../development/python-modules/click-odoo { };
+
+  click-odoo-contrib = callPackage ../development/python-modules/click-odoo-contrib { };
+
   click-option-group = callPackage ../development/python-modules/click-option-group { };
 
   click-plugins = callPackage ../development/python-modules/click-plugins { };
@@ -6327,6 +6331,10 @@ self: super: with self; {
 
   manifest-ml = callPackage ../development/python-modules/manifest-ml { };
 
+  manifestoo = callPackage ../development/python-modules/manifestoo { };
+
+  manifestoo-core = callPackage ../development/python-modules/manifestoo-core { };
+
   manifestparser = callPackage ../development/python-modules/marionette-harness/manifestparser.nix { };
 
   manuel = callPackage ../development/python-modules/manuel { };
@@ -11640,6 +11648,8 @@ self: super: with self; {
 
   setuptools-lint = callPackage ../development/python-modules/setuptools-lint { };
 
+  setuptools-odoo = callPackage ../development/python-modules/setuptools-odoo { };
+
   setuptools-rust = callPackage ../development/python-modules/setuptools-rust { };
 
   setuptools-scm = callPackage ../development/python-modules/setuptools-scm { };