diff --git a/doc/build-helpers/fetchers.chapter.md b/doc/build-helpers/fetchers.chapter.md
index 6efe64281e82..cb37dca06d48 100644
--- a/doc/build-helpers/fetchers.chapter.md
+++ b/doc/build-helpers/fetchers.chapter.md
@@ -283,7 +283,7 @@ If `pname` and `version` are specified, `fetchurl` will use those values and wil
 
   _Default value:_ `""`.
 
-`recursiveHash` (Boolean; _optional_)
+`recursiveHash` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash}
 : If set to `true`, will signal to Nix that the hash given to `fetchurl` was calculated using the `"recursive"` mode.
   See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHashMode) for more information about the existing modes.
 
@@ -296,7 +296,7 @@ If `pname` and `version` are specified, `fetchurl` will use those values and wil
 
   _Default value_: `false`.
 
-`downloadToTemp` (Boolean; _optional_)
+`downloadToTemp` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp}
 : If `true`, saves the downloaded file to a temporary location instead of the expected Nix store location.
   This is useful when used in conjunction with `postFetch` attribute, otherwise `fetchurl` will not produce any meaningful output.
 
@@ -519,15 +519,81 @@ See [](#chap-pkgs-fetchers-caveats) for more details on how to work with the `ha
 
 ## `fetchzip` {#sec-pkgs-fetchers-fetchzip}
 
-Downloads content from a given URL (which is assumed to be an archive), and decompresses the archive for you, making files and directories directly accessible.
-`fetchzip` can only be used with archives.
-Despite its name, `fetchzip` is not limited to `.zip` files and can also be used with any tarball.
+Returns a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary.html#gloss-fixed-output-derivation) which downloads an archive from a given URL and decompresses it.
 
-It has two required arguments, a URL and a hash.
-The hash is typically `hash`, although many more hash algorithms are supported.
-Nixpkgs contributors are currently recommended to use `hash`.
-This hash will be used by Nix to identify your source.
-A typical usage of `fetchzip` is provided below.
+Despite its name, `fetchzip` is not limited to `.zip` files but can also be used with [various compressed tarball formats](#tar-files) by default.
+This can extended by specifying additional attributes, see [](#ex-fetchers-fetchzip-rar-archive) to understand how to do that.
+
+### Inputs {#sec-pkgs-fetchers-fetchzip-inputs}
+
+`fetchzip` requires an attribute set, and most attributes are passed to the underlying call to [`fetchurl`](#sec-pkgs-fetchers-fetchurl).
+
+The attributes below are treated differently by `fetchzip` when compared to what `fetchurl` expects:
+
+`name` (String; _optional_)
+: Works as defined in `fetchurl`, but has a different default value than `fetchurl`.
+
+  _Default value:_ `"source"`.
+
+`nativeBuildInputs` (List of Attribute Set; _optional_)
+: Works as defined in `fetchurl`, but it is also augmented by `fetchzip` to include packages to deal with additional archives (such as `.zip`).
+
+  _Default value:_ `[]`.
+
+`postFetch` (String; _optional_)
+: Works as defined in `fetchurl`, but it is also augmented with the code needed to make `fetchzip` work.
+
+  :::{.caution}
+  It is only safe to modify files in `$out` in `postFetch`.
+  Consult the implementation of `fetchzip` for anything more involved.
+  :::
+
+  _Default value:_ `""`.
+
+`stripRoot` (Boolean; _optional_)
+: If `true`, the decompressed contents are moved one level up the directory tree.
+
+  This is useful for archives that decompress into a single directory which commonly includes some values that change with time, such as version numbers.
+  When this is the case (and `stripRoot` is `true`), `fetchzip` will remove this directory and make the decompressed contents available in the top-level directory.
+
+  [](#ex-fetchers-fetchzip-simple-striproot) shows what this attribute does.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+  _Default value:_ `true`.
+
+`extension` (String or Null; _optional_)
+: If set, the archive downloaded by `fetchzip` will be renamed to a filename with the extension specified in this attribute.
+
+  This is useful when making `fetchzip` support additional types of archives, because the implementation may use the extension of an archive to determine whether they can decompress it.
+  If the URL you're using to download the contents doesn't end with the extension associated with the archive, use this attribute to fix the filename of the archive.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+  _Default value:_ `null`.
+
+`recursiveHash` (Boolean; _optional_)
+: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash), but its default value is different than for `fetchurl`.
+
+  _Default value:_ `true`.
+
+`downloadToTemp` (Boolean; _optional_)
+: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp), but its default value is different than for `fetchurl`.
+
+  _Default value:_ `true`.
+
+`extraPostFetch` **DEPRECATED**
+: This attribute is deprecated.
+  Please use `postFetch` instead.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+### Examples {#sec-pkgs-fetchers-fetchzip-examples}
+
+::::{.example #ex-fetchers-fetchzip-simple-striproot}
+# Using `fetchzip` to output contents directly
+
+The following recipe shows how to use `fetchzip` to decompress a `.tar.gz` archive:
 
 ```nix
 { fetchzip }:
@@ -537,6 +603,80 @@ fetchzip {
 }
 ```
 
+This archive has all its contents in a directory named `patchelf-0.18.0`.
+This means that after decompressing, you'd have to enter this directory to see the contents of the archive.
+However, `fetchzip` makes this easier through the attribute `stripRoot` (enabled by default).
+
+After building the recipe, the derivation output will show all the files in the archive at the top level:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
+
+$ ls /nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
+aclocal.m4  completions  configure.ac  m4           Makefile.in  patchelf.spec     README.md  tests
+build-aux   configure    COPYING       Makefile.am  patchelf.1   patchelf.spec.in  src        version
+```
+
+If `stripRoot` is set to `false`, the derivation output will be the decompressed archive as-is:
+
+```nix
+{ fetchzip }:
+fetchzip {
+  url = "https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0.tar.gz";
+  hash = "sha256-uv3FuKE4DqpHT3yfE0qcnq0gYjDNQNKZEZt2+PUAneg=";
+  stripRoot = false;
+}
+```
+
+:::{.caution}
+The hash changed!
+Whenever changing attributes of a Nixpkgs fetcher, [remember to invalidate the hash](#chap-pkgs-fetchers-caveats), otherwise you won't get the results you're expecting!
+:::
+
+After building the recipe:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
+
+$ ls /nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
+patchelf-0.18.0
+```
+::::
+
+::::{.example #ex-fetchers-fetchzip-rar-archive}
+# Using `fetchzip` to decompress a `.rar` file
+
+The `unrar` package provides a [setup hook](#ssec-setup-hooks) to decompress `.rar` archives during the [unpack phase](#ssec-unpack-phase), which can be used with `fetchzip` to decompress those archives:
+
+```nix
+{ fetchzip, unrar }:
+fetchzip {
+  url = "https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar";
+  hash = "sha256-fC+zsR8BY6vXpUkVd6i1jF0IZZxVKVvNi6VWCKT+pA4=";
+  stripRoot = false;
+  nativeBuildInputs = [ unrar ];
+}
+```
+
+Since this particular `.rar` file doesn't put its contents in a directory inside the archive, `stripRoot` must be set to `false`.
+
+After building the recipe, the derivation output will show the decompressed files:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
+
+$ ls /nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
+FONT.DAT      PINBALL.DAT  PINBALL.EXE	PINBALL2.MID  TABLE.BMP    WMCONFIG.EXE
+MSCREATE.DIR  PINBALL.DOC  PINBALL.MID	Sounds	     WAVEMIX.INF
+```
+::::
+
 ## `fetchpatch` {#fetchpatch}
 
 `fetchpatch` works very similarly to `fetchurl` with the same arguments expected. It expects patch files as a source and performs normalization on them before computing the checksum. For example, it will remove comments or other unstable parts that are sometimes added by version control systems and can change over time.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 05eba26df6f2..adc0d3563ea4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15508,6 +15508,12 @@
       fingerprint = "7756 E88F 3C6A 47A5 C5F0  CDFB AB54 6777 F93E 20BF";
     }];
   };
+  phdyellow = {
+    name = "Phil Dyer";
+    email = "phildyer@protonmail.com";
+    github = "PhDyellow";
+    githubId = 7740661;
+  };
   phfroidmont = {
     name = "Paul-Henri Froidmont";
     email = "nix.contact-j9dw4d@froidmont.org";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 5e87d28992dc..5a627d45c4ab 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -484,6 +484,7 @@ with lib.maintainers; {
       ryantm
       lassulus
       yayayayaka
+      asymmetric
     ];
     scope = "Maintain Jitsi.";
     shortName = "Jitsi";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 243c7dc81f59..2d487bd23e1b 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -90,6 +90,10 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - [maubot](https://github.com/maubot/maubot), a plugin-based Matrix bot framework. Available as [services.maubot](#opt-services.maubot.enable).
 
+- [ryzen-monitor-ng](https://github.com/mann1x/ryzen_monitor_ng), a desktop AMD CPU power monitor and controller, similar to Ryzen Master but for Linux. Available as [programs.ryzen-monitor-ng](#opt-programs.ryzen-monitor-ng.enable)
+
+- [ryzen-smu](https://gitlab.com/leogx9r/ryzen_smu), Linux kernel driver to expose the SMU (System Management Unit) for certain AMD Ryzen Processors. Includes the userspace program `monitor_cpu`. Available at [hardward.cpu.amd.ryzen-smu](#opt-hardware.cpu.amd.ryzen-smu.enable)
+
 - systemd's gateway, upload, and remote services, which provides ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).
 
 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
@@ -498,9 +502,6 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   existing process, but will need to start that process from gdb (so it is a
   child). Or you can set `boot.kernel.sysctl."kernel.yama.ptrace_scope"` to 0.
 
-- The new option `services.getty.autologinOnce` was added to limit the automatic login to once per boot and on the first tty only.
-  When using full disk encryption, this option allows to unlock the system without retyping the passphrase while keeping the other ttys protected.
-
 - The netbird module now allows running multiple tunnels in parallel through [`services.netbird.tunnels`](#opt-services.netbird.tunnels).
 
 - [Nginx virtual hosts](#opt-services.nginx.virtualHosts) using `forceSSL` or
diff --git a/nixos/modules/hardware/cpu/amd-ryzen-smu.nix b/nixos/modules/hardware/cpu/amd-ryzen-smu.nix
new file mode 100644
index 000000000000..b1a5895aaa24
--- /dev/null
+++ b/nixos/modules/hardware/cpu/amd-ryzen-smu.nix
@@ -0,0 +1,26 @@
+{ config
+, lib
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkIf;
+  cfg = config.hardware.cpu.amd.ryzen-smu;
+  ryzen-smu = config.boot.kernelPackages.ryzen-smu;
+in
+{
+  options.hardware.cpu.amd.ryzen-smu = {
+    enable = mkEnableOption ''
+        ryzen_smu, a linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors.
+
+        WARNING: Damage cause by use of your AMD processor outside of official AMD specifications or outside of factory settings are not covered under any AMD product warranty and may not be covered by your board or system manufacturer's warranty
+      '';
+  };
+
+  config = mkIf cfg.enable {
+    boot.kernelModules = [ "ryzen-smu" ];
+    boot.extraModulePackages = [ ryzen-smu ];
+    environment.systemPackages = [ ryzen-smu ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ Cryolitia phdyellow ];
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9fc036f9213a..32ce0f3ec58d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -54,6 +54,7 @@
   ./hardware/corectrl.nix
   ./hardware/cpu/amd-microcode.nix
   ./hardware/cpu/amd-sev.nix
+  ./hardware/cpu/amd-ryzen-smu.nix
   ./hardware/cpu/intel-microcode.nix
   ./hardware/cpu/intel-sgx.nix
   ./hardware/cpu/x86-msr.nix
@@ -251,6 +252,7 @@
   ./programs/regreet.nix
   ./programs/rog-control-center.nix
   ./programs/rust-motd.nix
+  ./programs/ryzen-monitor-ng.nix
   ./programs/screen.nix
   ./programs/seahorse.nix
   ./programs/sedutil.nix
diff --git a/nixos/modules/programs/ryzen-monitor-ng.nix b/nixos/modules/programs/ryzen-monitor-ng.nix
new file mode 100644
index 000000000000..cb0c391ce6b1
--- /dev/null
+++ b/nixos/modules/programs/ryzen-monitor-ng.nix
@@ -0,0 +1,35 @@
+{ pkgs
+, config
+, lib
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkPackageOption mkIf;
+  cfg = config.programs.ryzen-monitor-ng;
+in
+{
+  options = {
+    programs.ryzen-monitor-ng = {
+      enable =  mkEnableOption ''
+        ryzen_monitor_ng, a userspace application for setting and getting Ryzen SMU (System Management Unit) parameters via the ryzen_smu kernel driver.
+
+        Monitor power information of Ryzen processors via the PM table of the SMU.
+
+        SMU Set and Get for many parameters and CO counts.
+
+        https://github.com/mann1x/ryzen_monitor_ng
+
+        WARNING: Damage cause by use of your AMD processor outside of official AMD specifications or outside of factory settings are not covered under any AMD product warranty and may not be covered by your board or system manufacturer's warranty
+      '';
+
+      package = mkPackageOption pkgs "ryzen-monitor-ng" {};
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    hardware.cpu.amd.ryzen-smu.enable = true;
+  };
+
+  meta.maintainers = with lib.maintainers; [ Cryolitia phdyellow ];
+}
diff --git a/nixos/modules/services/networking/cloudflared.nix b/nixos/modules/services/networking/cloudflared.nix
index b9556bfa60d0..76db339a1831 100644
--- a/nixos/modules/services/networking/cloudflared.nix
+++ b/nixos/modules/services/networking/cloudflared.nix
@@ -11,7 +11,7 @@ let
       default = null;
       example = "30s";
       description = lib.mdDoc ''
-        Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#tlstimeout](tlsTimeout).
+        Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [tlsTimeout](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#tlstimeout).
       '';
     };
 
diff --git a/nixos/modules/services/networking/i2p.nix b/nixos/modules/services/networking/i2p.nix
index c5c7a955cbd4..5c6c08831a43 100644
--- a/nixos/modules/services/networking/i2p.nix
+++ b/nixos/modules/services/networking/i2p.nix
@@ -5,7 +5,8 @@ with lib;
 let
   cfg = config.services.i2p;
   homeDir = "/var/lib/i2p";
-in {
+in
+{
   ###### interface
   options.services.i2p.enable = mkEnableOption (lib.mdDoc "I2P router");
 
@@ -27,7 +28,7 @@ in {
         User = "i2p";
         WorkingDirectory = homeDir;
         Restart = "on-abort";
-        ExecStart = "${pkgs.i2p}/bin/i2prouter-plain";
+        ExecStart = "${pkgs.i2p}/bin/i2prouter";
       };
     };
   };
diff --git a/nixos/modules/services/ttys/getty.nix b/nixos/modules/services/ttys/getty.nix
index 3578f4ba8773..22ae9c27e5bc 100644
--- a/nixos/modules/services/ttys/getty.nix
+++ b/nixos/modules/services/ttys/getty.nix
@@ -7,26 +7,14 @@ let
 
   baseArgs = [
     "--login-program" "${cfg.loginProgram}"
-  ] ++ optionals (cfg.autologinUser != null && !cfg.autologinOnce) [
+  ] ++ optionals (cfg.autologinUser != null) [
     "--autologin" cfg.autologinUser
   ] ++ optionals (cfg.loginOptions != null) [
     "--login-options" cfg.loginOptions
   ] ++ cfg.extraArgs;
 
   gettyCmd = args:
-    "${pkgs.util-linux}/sbin/agetty ${escapeShellArgs baseArgs} ${args}";
-
-  autologinScript = ''
-    otherArgs="--noclear --keep-baud $TTY 115200,38400,9600 $TERM";
-    ${lib.optionalString cfg.autologinOnce ''
-      autologged="/run/agetty.autologged"
-      if test "$TTY" = tty1 && ! test -f "$autologged"; then
-        touch "$autologged"
-        exec ${gettyCmd "$otherArgs --autologin ${cfg.autologinUser}"}
-      fi
-    ''}
-    exec ${gettyCmd "$otherArgs"}
-  '';
+    "@${pkgs.util-linux}/sbin/agetty agetty ${escapeShellArgs baseArgs} ${args}";
 
 in
 
@@ -52,16 +40,6 @@ in
         '';
       };
 
-      autologinOnce = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled the automatic login will only happen in the first tty
-          once per boot. This can be useful to avoid retyping the account
-          password on systems with full disk encrypted.
-        '';
-      };
-
       loginProgram = mkOption {
         type = types.path;
         default = "${pkgs.shadow}/bin/login";
@@ -128,11 +106,9 @@ in
 
     systemd.services."getty@" =
       { serviceConfig.ExecStart = [
-          # override upstream default with an empty ExecStart
-          ""
-          (pkgs.writers.writeDash "getty" autologinScript)
+          "" # override upstream default with an empty ExecStart
+          (gettyCmd "--noclear --keep-baud %I 115200,38400,9600 $TERM")
         ];
-        environment.TTY = "%I";
         restartIfChanged = false;
       };
 
diff --git a/nixos/modules/services/x11/desktop-managers/budgie.nix b/nixos/modules/services/x11/desktop-managers/budgie.nix
index a911db725c01..d6e6bb2fa14e 100644
--- a/nixos/modules/services/x11/desktop-managers/budgie.nix
+++ b/nixos/modules/services/x11/desktop-managers/budgie.nix
@@ -43,6 +43,8 @@ let
   budgie-control-center = pkgs.budgie.budgie-control-center.override {
     enableSshSocket = config.services.openssh.startWhenNeeded;
   };
+
+  notExcluded = pkg: (!(lib.elem pkg config.environment.budgie.excludePackages));
 in {
   meta.maintainers = lib.teams.budgie.members;
 
@@ -160,7 +162,7 @@ in {
       ++ cfg.sessionPath;
 
     # Both budgie-desktop-view and nemo defaults to this emulator.
-    programs.gnome-terminal.enable = mkDefault true;
+    programs.gnome-terminal.enable = mkDefault (notExcluded pkgs.gnome.gnome-terminal);
 
     # Fonts.
     fonts.packages = [
diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
index 935f173a9d81..6983b51376fd 100644
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@@ -95,7 +95,7 @@ in
       '';
 
       # Default services
-      services.blueman.enable = mkDefault true;
+      services.blueman.enable = mkDefault (notExcluded pkgs.blueman);
       hardware.bluetooth.enable = mkDefault true;
       hardware.pulseaudio.enable = mkDefault true;
       security.polkit.enable = true;
@@ -228,10 +228,10 @@ in
     })
 
     (mkIf serviceCfg.apps.enable {
-      programs.geary.enable = mkDefault true;
-      programs.gnome-disks.enable = mkDefault true;
-      programs.gnome-terminal.enable = mkDefault true;
-      programs.file-roller.enable = mkDefault true;
+      programs.geary.enable = mkDefault (notExcluded pkgs.gnome.geary);
+      programs.gnome-disks.enable = mkDefault (notExcluded pkgs.gnome.gnome-disk-utility);
+      programs.gnome-terminal.enable = mkDefault (notExcluded pkgs.gnome.gnome-terminal);
+      programs.file-roller.enable = mkDefault (notExcluded pkgs.gnome.file-roller);
 
       environment.systemPackages = with pkgs // pkgs.gnome // pkgs.cinnamon; utils.removePackagesByName [
         # cinnamon team apps
diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.nix b/nixos/modules/services/x11/desktop-managers/pantheon.nix
index 695d81f666a1..2115f8f0ab23 100644
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@@ -12,6 +12,7 @@ let
     extraGSettingsOverrides = cfg.extraGSettingsOverrides;
   };
 
+  notExcluded = pkg: (!(lib.elem pkg config.environment.pantheon.excludePackages));
 in
 
 {
@@ -288,8 +289,8 @@ in
     })
 
     (mkIf serviceCfg.apps.enable {
-      programs.evince.enable = mkDefault true;
-      programs.file-roller.enable = mkDefault true;
+      programs.evince.enable = mkDefault (notExcluded pkgs.gnome.evince);
+      programs.file-roller.enable = mkDefault (notExcluded pkgs.gnome.file-roller);
 
       environment.systemPackages = utils.removePackagesByName ([
         pkgs.gnome.gnome-font-viewer
diff --git a/nixos/tests/budgie.nix b/nixos/tests/budgie.nix
index 5228e869b056..203e718c8c6d 100644
--- a/nixos/tests/budgie.nix
+++ b/nixos/tests/budgie.nix
@@ -18,6 +18,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
       };
     };
 
+    # We don't ship gnome-text-editor in Budgie module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.budgie.excludePackages = [ pkgs.gnome-text-editor ];
+
     services.xserver.desktopManager.budgie = {
       enable = true;
       extraPlugins = [
diff --git a/nixos/tests/cinnamon.nix b/nixos/tests/cinnamon.nix
index eab907d0b712..694308152149 100644
--- a/nixos/tests/cinnamon.nix
+++ b/nixos/tests/cinnamon.nix
@@ -8,6 +8,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     services.xserver.enable = true;
     services.xserver.desktopManager.cinnamon.enable = true;
 
+    # We don't ship gnome-text-editor in Cinnamon module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.cinnamon.excludePackages = [ pkgs.gnome-text-editor ];
+
     # For the sessionPath subtest.
     services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gnome.gpaste ];
   };
diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix
index f8de2eb8061d..d2a4a009af53 100644
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@@ -13,6 +13,13 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
     services.xserver.enable = true;
     services.xserver.desktopManager.pantheon.enable = true;
 
+    # We ship pantheon.appcenter by default when this is enabled.
+    services.flatpak.enable = true;
+
+    # We don't ship gnome-text-editor in Pantheon module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.pantheon.excludePackages = [ pkgs.gnome-text-editor ];
+
     environment.systemPackages = [ pkgs.xdotool ];
   };
 
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 53201241f6a2..727a5a30042f 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -941,8 +941,8 @@ let
         mktplcRef = {
           name = "coder-remote";
           publisher = "coder";
-          version = "0.1.18";
-          sha256 = "soNGZuyvG5+haWRcwYmYB+0OcyDAm4UQ419UnEd8waA=";
+          version = "0.1.36";
+          hash = "sha256-N1X8wB2n6JYoFHCP5iHBXHnEaRa9S1zooQZsR5mUeh8=";
         };
         meta = {
           description = "An extension for Visual Studio Code to open any Coder workspace in VS Code with a single click.";
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index b46ed8f329b1..15599846c719 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "kubernetes-helm";
-  version = "3.14.3";
+  version = "3.14.4";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-GC9rkB35m+a/9pEvD7aNjE4z3qrv33NES842crrzD3I=";
+    sha256 = "sha256-Wt5ovKa2CHrD0VSxvReYAwoC4SsuZHAhi/P6Kn1H7So=";
   };
-  vendorHash = "sha256-f5tLyq9tP5tdE73Mlee9vAUSHqkUAtAJkwjZP/K6wPM=";
+  vendorHash = "sha256-b25LUyr4B4fF/WF4Q+zzrDo78kuSTEPBklKkA4o+DBo=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index be3d984cfc4c..a2f8fd2fbaa1 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.56.2";
+  version = "0.56.5";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FbuXdng2pGd1Wi4GdFzQjk4quP5yz3APNXm6dcfGO7U=";
+    hash = "sha256-aKgcXLxFZBoomrKJFmUr/XfxHmNrkvK2IlfTR2dJNY0=";
   };
 
-  vendorHash = "sha256-ijAg0Y/dfNxDS/Jov7QYjlTZ4N4/jDMH/zCV0jdVXRc=";
+  vendorHash = "sha256-joEmkFtoVxqlVrgl2mtJN9Cyr3YdnT6tBjaSXj9z2WU=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/science/math/eigenmath/default.nix b/pkgs/applications/science/math/eigenmath/default.nix
index 358e491b2f4a..b39d7ae26079 100644
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "unstable-2024-03-20";
+  version = "unstable-2024-04-08";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "262a6525225be7bcef52c3072b1061db3c238055";
-    hash = "sha256-QH8mLlcCOuq77vLer8RsSnD9VeJu9kAVv2qWAH3ky6I=";
+    rev = "c0be6c47309aa40d44784a3a4c4c07bc4e8fb6fa";
+    hash = "sha256-UVCazX0P03+e1exnpXrGNc/1vHxLH04Xtvgsy00UAoI=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
diff --git a/pkgs/applications/version-management/git-cliff/default.nix b/pkgs/applications/version-management/git-cliff/default.nix
index fd840580cade..817394cdc570 100644
--- a/pkgs/applications/version-management/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-cliff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-cliff";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "git-cliff";
     rev = "v${version}";
-    hash = "sha256-pOmSVySn8QUpFLTXFXBVm1KTX9ny221t1xSxBRHkljQ=";
+    hash = "sha256-FRcreSnSO65m9h9+SUg4qdFELvpVX1+HkWH3dI2RR/M=";
   };
 
-  cargoHash = "sha256-y0XTvSV8JE6nmSJfJKLw2Gt/D/yX12kbx2+RHqVCVWI=";
+  cargoHash = "sha256-RlcZvyFi7fc8eJYB5X64axAnNp8Z1h0WOV4hM1SLoRk=";
 
   # attempts to run the program on .git in src which is not deterministic
   doCheck = false;
diff --git a/pkgs/applications/version-management/git-mit/default.nix b/pkgs/applications/version-management/git-mit/default.nix
index bc59aa6ffda1..f3dbcc6273d6 100644
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.191";
+  version = "5.12.194";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-aSEoAs0s7zyALf3s77eVlrjkCrn7ihW/4OW5hN8YL8k=";
+    hash = "sha256-9ITy2VPLIunSLSNx4EXbvxZ7V/Kr+DwmjzDVj/QVGHs=";
   };
 
-  cargoHash = "sha256-pm+XreLGxZJKRcrmU1ooMjN7MTRJqgKOy2J1OqdodxE=";
+  cargoHash = "sha256-6R+T0BSgT6IivugkXXsX5xJ2c3/J3FnLY3ZvcfYW53E=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/gi/gitu/package.nix b/pkgs/by-name/gi/gitu/package.nix
index 9ad397566547..7948fdd82966 100644
--- a/pkgs/by-name/gi/gitu/package.nix
+++ b/pkgs/by-name/gi/gitu/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitu";
-  version = "0.13.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "altsem";
     repo = "gitu";
     rev = "v${version}";
-    hash = "sha256-1wfc3n3uSkox2wa5i+Qiv7PZ0d2dXXbwjWw8NMXJXj8=";
+    hash = "sha256-/yPP8GzeaVMauhcYLDAgXzOafUpOhJF2tyHOyD6KWS8=";
   };
 
-  cargoHash = "sha256-JwNyzA6D8mIzp/+egjD2C7T9mGbcCKKtwFRXBuXMQ+U=";
+  cargoHash = "sha256-eKRFPnH9MvSykrnPo4dc5DtEfb79s0hBtmYfERGQbWg=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/i2/i2p/package.nix b/pkgs/by-name/i2/i2p/package.nix
new file mode 100644
index 000000000000..88d3041ffd65
--- /dev/null
+++ b/pkgs/by-name/i2/i2p/package.nix
@@ -0,0 +1,122 @@
+{ lib
+, stdenv
+, fetchzip
+, jdk
+, ant
+, gettext
+, which
+, dbip-country-lite
+, java-service-wrapper
+, makeWrapper
+, gmp
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "i2p";
+  version = "2.4.0";
+
+  src = fetchzip {
+    urls = map (mirror: "${mirror}${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
+      "https://github.com/i2p/i2p.i2p/releases/download/i2p-"
+      "https://download.i2p2.de/releases/"
+      "https://files.i2p-projekt.de/"
+      "https://download.i2p2.no/releases/"
+    ];
+    hash = "sha256-RESN1qA/SD9MajUSJyXssNZnph2XZge7xr2kTgOp5V4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    ant
+    gettext
+    jdk
+    which
+  ];
+
+  buildInputs = [ gmp ];
+
+  postConfigure = ''
+    rm -r installer/lib
+    mkdir -p installer/lib/wrapper/all/
+    # The java-service-wrapper is needed for build but not really used in runtime
+    ln -s ${java-service-wrapper}/lib/wrapper.jar installer/lib/wrapper/all/wrapper.jar
+    # Don't use the bundled geoip data
+    echo "with-geoip-database=true" >> override.properties
+  '';
+
+  buildPhase = ''
+    # When this variable exists we can build the .so files only.
+    export DEBIANVERSION=1
+    pushd core/c/jcpuid
+    ./build.sh
+    popd
+    pushd core/c/jbigi
+    ./build_jbigi.sh dynamic
+    popd
+    export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"
+    SOURCE_DATE_EPOCH=0 ant preppkg-unix
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,share,geoip}
+    mv pkg-temp/* $out
+    mv core/c/jbigi/*.so $out/lib
+    mv $out/man $out/share/
+    rm $out/{osid,postinstall.sh,INSTALL-headless.txt}
+
+    for jar in $out/lib/*.jar; do
+      if [ ! -z $CP ]; then
+        CP=$CP:$jar;
+      else
+        CP=$jar
+      fi
+    done
+
+    makeWrapper ${jdk}/bin/java $out/bin/i2prouter \
+      --add-flags "-cp $CP -Djava.library.path=$out/lib/ -Di2p.dir.base=$out -DloggerFilenameOverride=logs/log-router-@.txt" \
+      --add-flags "net.i2p.router.RouterLaunch"
+
+    ln -s ${dbip-country-lite.mmdb} $out/geoip/GeoLite2-Country.mmdb
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # Check if jbigi is used
+    java -cp $out/lib/i2p.jar -Djava.library.path=$out/lib/ net.i2p.util.NativeBigInteger \
+      | tee /dev/stderr | grep -Fw "Found native library" || exit 1
+
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    description = "Applications and router for I2P, anonymity over the Internet";
+    homepage = "https://geti2p.net";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # source bundles dependencies as jars
+    ];
+    license = with licenses; [
+      asl20
+      boost
+      bsd2
+      bsd3
+      cc-by-30
+      cc0
+      epl10
+      gpl2
+      gpl3
+      lgpl21Only
+      lgpl3Only
+      mit
+      publicDomain
+    ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ linsui ];
+    mainProgram = "i2prouter-plain";
+  };
+})
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index b98d249ad71f..0f9325f842e4 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.354";
+  version = "0.0.355";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-wO1ygoaqgCkvtVJ+ATxNGSiJpAZAqe2LXyPg8r4osQk=";
+    hash = "sha256-St/zZqfoate9TwYo7q9Za+T6q4kRw9vSzcBfMW7AXkw=";
   };
 
   vendorHash = "sha256-a/e+xPOD9BDSlKknmfcX2tTMyIUrzKxqtUpFXcFIDSE=";
diff --git a/pkgs/by-name/ry/ryzen-monitor-ng/package.nix b/pkgs/by-name/ry/ryzen-monitor-ng/package.nix
new file mode 100644
index 000000000000..9a9996ecf61a
--- /dev/null
+++ b/pkgs/by-name/ry/ryzen-monitor-ng/package.nix
@@ -0,0 +1,41 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "ryzen-monitor-ng";
+  version = "2.0.5-unstable-2023-11-05";
+
+  # Upstream has not updated ryzen_smu header version
+  # This fork corrects ryzen_smu header version and
+  # adds support for Matisse AMD CPUs.
+  src = fetchFromGitHub {
+    owner = "plasmin";
+    repo = "ryzen_monitor_ng";
+    rev = "8b7854791d78de731a45ce7d30dd17983228b7b1";
+    hash = "sha256-fcW2fEsCFliRnMFnboR0jchzVIlCYbr2AE6AS06cb6o=";
+  };
+
+  ## Remove binaries committed into upstream repo
+  preBuild = ''
+    rm src/ryzen_monitor
+  '';
+
+  makeTargets = [ "clean" "install" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mv ./src/ryzen_monitor $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Access Ryzen SMU information exposed by the ryzen_smu driver";
+    homepage = "https://github.com/mann1x/ryzen_monitor_ng";
+    license = licenses.agpl3Only;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ phdyellow ];
+    mainProgram = "ryzen_monitor";
+  };
+}
diff --git a/pkgs/by-name/sc/scrutiny/package.nix b/pkgs/by-name/sc/scrutiny/package.nix
index 34712b96e431..179365c49dfe 100644
--- a/pkgs/by-name/sc/scrutiny/package.nix
+++ b/pkgs/by-name/sc/scrutiny/package.nix
@@ -7,13 +7,13 @@
 }:
 let
   pname = "scrutiny";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "AnalogJ";
     repo = "scrutiny";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ysjE2nn1WwhEiFIvJ5cRCJQf9mECTgiGUyenwf3mKTA=";
+    hash = "sha256-WoU5rdsIEhZQ+kPoXcestrGXC76rFPvhxa0msXjFsNg=";
   };
 
   frontend = buildNpmPackage {
@@ -64,6 +64,7 @@ buildGoModule rec {
   meta = {
     description = "Hard Drive S.M.A.R.T Monitoring, Historical Trends & Real World Failure Thresholds.";
     homepage = "https://github.com/AnalogJ/scrutiny";
+    changelog = "https://github.com/AnalogJ/scrutiny/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jnsgruk ];
     mainProgram = "scrutiny";
diff --git a/pkgs/by-name/to/tootik/package.nix b/pkgs/by-name/to/tootik/package.nix
new file mode 100644
index 000000000000..4917f781528c
--- /dev/null
+++ b/pkgs/by-name/to/tootik/package.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, buildGoModule, fetchFromGitHub, openssl }:
+
+buildGoModule rec {
+  pname = "tootik";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "dimkr";
+    repo = "tootik";
+    rev = version;
+    hash = "sha256-RcuioFb0+mvZupwgaCN6qbcOy7gHp9KjJxRwaPI55yo=";
+  };
+
+  vendorHash = "sha256-/52VjfoecXaML1cDRIEe1EQPYU8xeP9lu4lY3cMV3VE=";
+
+  nativeBuildInputs = [ openssl ];
+
+  preBuild = ''
+    go generate ./migrations
+  '';
+
+  ldflags = [ "-X github.com/dimkr/tootik/buildinfo.Version=${version}" ];
+
+  tags = [ "fts5" ];
+
+  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
+
+  meta = {
+    description = "A federated nanoblogging service with a Gemini frontend";
+    homepage = "https://github.com/dimkr/tootik";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sikmir ];
+    mainProgram = "tootik";
+  };
+}
diff --git a/pkgs/by-name/ws/wslu/package.nix b/pkgs/by-name/ws/wslu/package.nix
index b45d566b0f85..015d0350af92 100644
--- a/pkgs/by-name/ws/wslu/package.nix
+++ b/pkgs/by-name/ws/wslu/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wslu";
-  version = "4.1.2";
+  version = "4.1.3";
 
   src = fetchFromGitHub {
     owner = "wslutilities";
     repo = "wslu";
     rev = "v${version}";
-    hash = "sha256-rmNGKayg8Y872yICilveMpDFBLkDZ6Ox8rqtWrK2om8=";
+    hash = "sha256-lyJk8nOADq+s7GkZXsd1T4ilrDzMRsoALOesG8NxYK8=";
   };
 
   nativeBuildInputs = [ copyDesktopItems ];
diff --git a/pkgs/by-name/xe/xevd/package.nix b/pkgs/by-name/xe/xevd/package.nix
new file mode 100644
index 000000000000..8cf6d20fbfe8
--- /dev/null
+++ b/pkgs/by-name/xe/xevd/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch2,
+  stdenv,
+  gitUpdater,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xevd";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "mpeg5";
+    repo = "xevd";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-+qC/BnP8o/kfl5ax+g1PohvXIJBL2gin/QZ9Gkvi0WU=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      name = "fix dangling pointer error";
+      url = "https://github.com/mpeg5/xevd/commit/13b86a74e26df979dd1cc3a1cb19bf1ac828e197.patch";
+      sha256 = "sha256-CeSfhN78ldooyZ9H4F2ex9wTBFXuNZdBcnLdk7GqDXI=";
+    })
+    (fetchpatch2 {
+      name = "fix invalid comparison of c_buf in write_y4m_header ";
+      url = "https://github.com/mpeg5/xevd/commit/e4ae0c567a6ec5e10c9f5ed44c61e4e3b6816c16.patch";
+      sha256 = "sha256-9bG6hyIV/AZ0mRbd3Fc/c137Xm1i6NJ1IfuGadG0vUU=";
+    })
+  ];
+
+  postPatch = ''
+    echo v$version > version.txt
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  postInstall = ''
+    ln $dev/include/xevd/* $dev/include/
+  '';
+
+  env.NIX_CFLAGS_COMPILE = toString [ "-lm" ];
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    homepage = "https://github.com/mpeg5/xevd";
+    description = "eXtra-fast Essential Video Decoder, MPEG-5 EVC";
+    license = lib.licenses.bsd3;
+    mainProgram = "xevd_app";
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+    broken = !stdenv.hostPlatform.isx86;
+  };
+})
diff --git a/pkgs/by-name/xe/xeve/package.nix b/pkgs/by-name/xe/xeve/package.nix
new file mode 100644
index 000000000000..5132656e58c2
--- /dev/null
+++ b/pkgs/by-name/xe/xeve/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  fetchFromGitHub,
+  gitUpdater,
+  stdenv,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xeve";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "mpeg5";
+    repo = "xeve";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-8YueEx2oIh24jV38bzpDlCVHNZB7HDOXeP5MANM8zBc=";
+  };
+
+  postPatch = ''
+    echo v$version > version.txt
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  postInstall = ''
+    ln $dev/include/xeve/* $dev/include/
+  '';
+
+  env.NIX_CFLAGS_COMPILE = toString [ "-lm" ];
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    homepage = "https://github.com/mpeg5/xeve";
+    description = "eXtra-fast Essential Video Encoder, MPEG-5 EVC";
+    license = lib.licenses.bsd3;
+    mainProgram = "xeve_app";
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+    broken = !stdenv.hostPlatform.isx86;
+  };
+})
diff --git a/pkgs/desktops/mate/mate-themes/default.nix b/pkgs/desktops/mate/mate-themes/default.nix
index bcef002dac99..259b29c6c9b4 100644
--- a/pkgs/desktops/mate/mate-themes/default.nix
+++ b/pkgs/desktops/mate/mate-themes/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-themes";
-  version = "3.22.24";
+  version = "3.22.26";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/themes/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "PYs6KihTMd4kxM9djJ3YRtqhFpXyBnZdjxaT68rPbko=";
+    sha256 = "Ik6J02TrO3Pxz3VtBUlKmEIak8v1Q0miyF/GB+t1Xtc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index be01d49d5f5a..4d7be6c4b282 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -25,10 +25,7 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-g7B0y2cxfVi+8ejQzIYveuinekW7/wVqH5h8ZIiy9f0=";
   };
 
-  postPatch = lib.optionalString stdenv.isAarch32 ''
-    # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/20
-    sed -i '/exec_opcodes_sys/d' testsuite/meson.build
-  '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
     # This benchmark times out on Hydra.nixos.org
     sed -i '/memcpy_speed/d' testsuite/meson.build
   '';
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 2be86d5cb85a..85214a79e2d3 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -80,6 +80,8 @@
 , withOpus ? withHeadlessDeps # Opus de/encoder
 , withPlacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
 , withPulse ? withSmallDeps && stdenv.isLinux # Pulseaudio input support
+, withQrencode ? withFullDeps && lib.versionAtLeast version "7" # QR encode generation
+, withQuirc ? withFullDeps && lib.versionAtLeast version "7" # QR decoding
 , withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
 , withRtmp ? false # RTMP[E] support
 , withSamba ? withFullDeps && !stdenv.isDarwin && withGPLv3 # Samba protocol
@@ -112,6 +114,8 @@
 , withXcbShape ? withFullDeps # X11 grabbing shape rendering
 , withXcbShm ? withFullDeps # X11 grabbing shm communication
 , withXcbxfixes ? withFullDeps # X11 grabbing mouse rendering
+, withXevd ? withFullDeps && lib.versionAtLeast version "7" && stdenv.hostPlatform.isx86 # MPEG-5 EVC decoding
+, withXeve ? withFullDeps && lib.versionAtLeast version "7" && stdenv.hostPlatform.isx86 # MPEG-5 EVC encoding
 , withXlib ? withFullDeps # Xlib support
 , withXml2 ? withFullDeps # libxml2 support, for IMF and DASH demuxers
 , withXvid ? withHeadlessDeps && withGPL # Xvid encoder, native encoder exists
@@ -263,6 +267,8 @@
 , opencore-amr
 , openh264
 , openjpeg
+, qrencode
+, quirc
 , rav1e
 , rtmpdump
 , samba
@@ -279,6 +285,8 @@
 , x264
 , x265
 , xavs
+, xevd
+, xeve
 , xvidcore
 , xz
 , zeromq4
@@ -551,6 +559,10 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withPlacebo "libplacebo")
   ] ++ [
     (enableFeature withPulse "libpulse")
+  ] ++ optionals (versionAtLeast version "7") [
+    (enableFeature withQrencode "libqrencode")
+    (enableFeature withQuirc "libquirc")
+  ] ++ [
     (enableFeature withRav1e "librav1e")
     (enableFeature withRtmp "librtmp")
     (enableFeature withSamba "libsmbclient")
@@ -587,6 +599,10 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withXcbShape "libxcb-shape")
     (enableFeature withXcbShm "libxcb-shm")
     (enableFeature withXcbxfixes "libxcb-xfixes")
+  ] ++ optionals (versionAtLeast version "7")  [
+    (enableFeature withXevd "libxevd")
+    (enableFeature withXeve "libxeve")
+  ] ++ [
     (enableFeature withXlib "xlib")
     (enableFeature withXml2 "libxml2")
     (enableFeature withXvid "libxvid")
@@ -668,6 +684,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withOpus [ libopus ]
   ++ optionals withPlacebo [ (if (lib.versionAtLeast version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withPulse [ libpulseaudio ]
+  ++ optionals withQrencode [ qrencode ]
+  ++ optionals withQuirc [ quirc ]
   ++ optionals withRav1e [ rav1e ]
   ++ optionals withRtmp [ rtmpdump ]
   ++ optionals withSamba [ samba ]
@@ -696,6 +714,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withX265 [ x265 ]
   ++ optionals withXavs [ xavs ]
   ++ optionals withXcb [ libxcb ]
+  ++ optionals withXevd [ xevd ]
+  ++ optionals withXeve [ xeve ]
   ++ optionals withXlib [ libX11 libXv libXext ]
   ++ optionals withXml2 [ libxml2 ]
   ++ optionals withXvid [ xvidcore ]
diff --git a/pkgs/development/python-modules/graphene-django/default.nix b/pkgs/development/python-modules/graphene-django/default.nix
index 64d07a538429..e2c0ea0fdd7a 100644
--- a/pkgs/development/python-modules/graphene-django/default.nix
+++ b/pkgs/development/python-modules/graphene-django/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "graphene-django";
-  version = "3.2.0";
+  version = "3.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "graphql-python";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-SOLY3NogovwQ5gr2gnvOcROWpbk9p134wI2f9FKr+5M=";
+    hash = "sha256-wzU9U4mYvBf43qBQi20ewKtmw1eFskQk+nnsdaM7HQM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 802e3602f37f..3cbee2e10dfa 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -133,7 +133,7 @@ rec {
 
   mypy-boto3-chime-sdk-voice = buildMypyBoto3Package "chime-sdk-voice" "1.34.0" "sha256-9fQQgWFKeabSblJIhP6mN0CEnSixkz1r3mf/k6IL/BE=";
 
-  mypy-boto3-cleanrooms = buildMypyBoto3Package "cleanrooms" "1.34.78" "sha256-76zy6rTsSqmKdwrZwBsf7m6qPZXSdi6GpQEXMvN82Tw=";
+  mypy-boto3-cleanrooms = buildMypyBoto3Package "cleanrooms" "1.34.82" "sha256-KaCs/P3NM3IeZ9V9khIwysyBXBG/8RuGFBAlrbMYn4Y=";
 
   mypy-boto3-cloud9 = buildMypyBoto3Package "cloud9" "1.34.24" "sha256-fryD7UfO5cdFS7vMxmZaT9LW4nNSGTQCd3NyD60f9wA=";
 
@@ -197,7 +197,7 @@ rec {
 
   mypy-boto3-config = buildMypyBoto3Package "config" "1.34.45" "sha256-LN1CcIOj9cgzSNCvnUVwLRNPXlitHAlt+5jj6wu6i8E=";
 
-  mypy-boto3-connect = buildMypyBoto3Package "connect" "1.34.67" "sha256-kWjC/FacCsC0xevx2dOs67UxaKG1WM3xMahcO3CqZL8=";
+  mypy-boto3-connect = buildMypyBoto3Package "connect" "1.34.82" "sha256-QyZteRrk1d+Qwqj87uUb4f2ZK5SjPdMJV4NGv6kwrl4=";
 
   mypy-boto3-connect-contact-lens = buildMypyBoto3Package "connect-contact-lens" "1.34.0" "sha256-Wx9vcjlgXdWZ2qP3Y/hTY2LAeTd+hyyV5JSIuKQ5I5k=";
 
@@ -591,7 +591,7 @@ rec {
 
   mypy-boto3-redshift-serverless = buildMypyBoto3Package "redshift-serverless" "1.34.16" "sha256-ag5tKb1+4cHiG99OszDNGdnX9RPRPraaqM8p3IqgLBg=";
 
-  mypy-boto3-rekognition = buildMypyBoto3Package "rekognition" "1.34.20" "sha256-zKJX/AlDoDKUbrI1LZq2kk5fr+SNqES6gniM0FQGeaM=";
+  mypy-boto3-rekognition = buildMypyBoto3Package "rekognition" "1.34.82" "sha256-qy7yacSuG6cARR2L/YjBGWYM1BU5/qtMr/H08x3XFIM=";
 
   mypy-boto3-resiliencehub = buildMypyBoto3Package "resiliencehub" "1.34.0" "sha256-F/ZRCp/M/6kBI4Apb3mISzqe1Zi4Y7gq/vu0dvyyTvM=";
 
diff --git a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
index 2e3455b677e4..21da795609d9 100644
--- a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
+++ b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
@@ -1,15 +1,17 @@
 { buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , lib
-, setuptools
 , numpy
 , onnx
 , packaging
 , pytestCheckHook
+, pythonAtLeast
+, setuptools
+, stdenv
 , torch
 , torchvision
 , typing-extensions
-, pythonAtLeast
 }:
 
 buildPythonPackage rec {
@@ -24,18 +26,27 @@ buildPythonPackage rec {
     hash = "sha256-vSon/0GxQfaRtSPsQbYAvE3s/F0HEN59VpzE3w1PnVE=";
   };
 
-  nativeBuildInputs = [
+  patches = [
+    (fetchpatch {
+      name = "relax-setuptools.patch";
+      url = "https://github.com/pfnet/pytorch-pfn-extras/commit/96abe38c4baa6a144d604bdd4744c55627e55440.patch";
+      hash = "sha256-85UDGcgJyQS5gINbgpNM58b3XJGvf+ArtGhwJ5EXdhk=";
+    })
+  ];
+
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [ numpy packaging torch typing-extensions ];
+  dependencies = [ numpy packaging torch typing-extensions ];
 
   nativeCheckInputs = [ onnx pytestCheckHook torchvision ];
 
-  # ignore all pytest warnings
-  preCheck = ''
-    rm pytest.ini
-  '';
+  pytestFlagsArray = [
+    # Requires CUDA access which is not possible in the nix environment.
+    "-m 'not gpu and not mpi'"
+    "-Wignore::DeprecationWarning"
+  ];
 
   pythonImportsCheck = [ "pytorch_pfn_extras" ];
 
@@ -45,31 +56,28 @@ buildPythonPackage rec {
 
     # requires onnxruntime which was removed because of poor maintainability
     # See https://github.com/NixOS/nixpkgs/pull/105951 https://github.com/NixOS/nixpkgs/pull/155058
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_annotate.py"
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_as_output.py"
     "tests/pytorch_pfn_extras_tests/onnx_tests/test_export.py"
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_export_testcase.py"
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_lax.py"
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_load_model.py"
     "tests/pytorch_pfn_extras_tests/onnx_tests/test_torchvision.py"
     "tests/pytorch_pfn_extras_tests/onnx_tests/utils.py"
-    "tests/pytorch_pfn_extras_tests/onnx_tests/test_lax.py"
 
     # RuntimeError: No Op registered for Gradient with domain_version of 9
     "tests/pytorch_pfn_extras_tests/onnx_tests/test_grad.py"
-
-    # Requires CUDA access which is not possible in the nix environment.
-    "tests/pytorch_pfn_extras_tests/cuda_tests/test_allocator.py"
-    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_batchnorm.py"
-    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_conv.py"
-    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_linear.py"
-    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy.py"
-    "tests/pytorch_pfn_extras_tests/profiler_tests/test_record.py"
-    "tests/pytorch_pfn_extras_tests/runtime_tests/test_to.py"
-    "tests/pytorch_pfn_extras_tests/handler_tests/test_handler.py"
-    "tests/pytorch_pfn_extras_tests/test_reporter.py"
-    "tests/pytorch_pfn_extras_tests/training_tests/test_trainer.py"
-    "tests/pytorch_pfn_extras_tests/utils_tests/test_checkpoint.py"
-    "tests/pytorch_pfn_extras_tests/utils_tests/test_comparer.py"
-    "tests/pytorch_pfn_extras_tests/utils_tests/test_new_comparer.py"
-  ] ++ lib.optionals (pythonAtLeast "3.11") [
-    # Remove this when https://github.com/NixOS/nixpkgs/pull/259068 is merged
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # RuntimeError: Dynamo is not supported on Python 3.12+
     "tests/pytorch_pfn_extras_tests/dynamo_tests/test_compile.py"
+    "tests/pytorch_pfn_extras_tests/test_ops/test_register.py"
+  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+    # torch.distributed is not available on darwin
+    "tests/pytorch_pfn_extras_tests/training_tests/extensions_tests/test_sharded_snapshot.py"
+  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # RuntimeError: internal error
+    # convolution (e.g. F.conv3d) causes runtime error
+    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_conv.py"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/sphinxcontrib-confluencebuilder/default.nix b/pkgs/development/python-modules/sphinxcontrib-confluencebuilder/default.nix
index 849bc559c0ef..240e51c72418 100644
--- a/pkgs/development/python-modules/sphinxcontrib-confluencebuilder/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-confluencebuilder/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-confluencebuilder";
-  version = "2.5.0";
+  version = "2.5.1";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "sphinxcontrib_confluencebuilder";
     inherit version;
-    hash = "sha256-rE9tWUie9ZaeWnKR+ojwS9A6BHEtsgVpwzXAuWoxknQ=";
+    hash = "sha256-PQpkwQ95UVJwDGTAq1xdcSvd07FZpZfA/4jq3ywlMas=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/faas-cli/default.nix b/pkgs/development/tools/faas-cli/default.nix
index 35db119791cc..bd6b56e932be 100644
--- a/pkgs/development/tools/faas-cli/default.nix
+++ b/pkgs/development/tools/faas-cli/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.16.23";
+  version = "0.16.25";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-QbMwokFHaISvsNuHy/Do90bvXtwaJmie/hDLybuy2qk=";
+    sha256 = "sha256-6HX+n3OXSA2gJ0LW5zlH3FboM5RNaOI72EmnEI9wbFE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/micronaut/default.nix b/pkgs/development/tools/micronaut/default.nix
index a126ce98314c..7acf37c5ccf8 100644
--- a/pkgs/development/tools/micronaut/default.nix
+++ b/pkgs/development/tools/micronaut/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "4.3.7";
+  version = "4.3.8";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-starter/releases/download/v${version}/micronaut-cli-${version}.zip";
-    sha256 = "sha256-TP7Ccv/Krc5l35AxyrkRmeRMSgQP9Q3BpNiHxlqLD4I=";
+    sha256 = "sha256-8sUXJExg1CApMbF95Lx3B/mnOJ5Y6HAck8+0UgF0bdc=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/development/tools/templ/default.nix b/pkgs/development/tools/templ/default.nix
index 154ce64ce364..d4380a959609 100644
--- a/pkgs/development/tools/templ/default.nix
+++ b/pkgs/development/tools/templ/default.nix
@@ -5,7 +5,7 @@
 
 buildGoModule rec {
   pname = "templ";
-  version = "0.2.648";
+  version = "0.2.663";
 
   subPackages = [ "cmd/templ" ];
 
@@ -21,7 +21,7 @@ buildGoModule rec {
     owner = "a-h";
     repo = "templ";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9Co3yvfy8X69PIffPg2lDjVCVTjDhiFnSsJd4MQ6cf4=";
+    hash = "sha256-TU8QG6OmUzSNDAX9W0Ntmz5cucLqVQeTskfnJbm/YM0=";
   };
 
   vendorHash = "sha256-Upd5Wq4ajsyOMDiAWS2g2iNO1sm1XJc43AFQLIo5eDM=";
diff --git a/pkgs/os-specific/linux/ndiswrapper/default.nix b/pkgs/os-specific/linux/ndiswrapper/default.nix
index 2db046e6392f..39a8d919d8be 100644
--- a/pkgs/os-specific/linux/ndiswrapper/default.nix
+++ b/pkgs/os-specific/linux/ndiswrapper/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, kernel, perl, kmod, libelf }:
+{ lib, stdenv, fetchurl, kernel, perl, kmod, elfutils }:
 let
   version = "1.63";
 in
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
     sha256 = "1v6b66jhisl110jfl00hm43lmnrav32vs39d85gcbxrjqnmcx08g";
   };
 
-  buildInputs = [ perl libelf ];
+  buildInputs = [ perl elfutils ];
 
   meta = {
     description = "Ndis driver wrapper for the Linux kernel";
diff --git a/pkgs/os-specific/linux/ryzen-smu/default.nix b/pkgs/os-specific/linux/ryzen-smu/default.nix
new file mode 100644
index 000000000000..7f899f2c2c90
--- /dev/null
+++ b/pkgs/os-specific/linux/ryzen-smu/default.nix
@@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
+
+let
+  version = "0.1.5-unstable-2024-01-03";
+
+  ## Upstream has not been merging PRs.
+  ## Nixpkgs maintainers are providing a
+  ## repo with PRs merged until upstream is
+  ## updated.
+  src = fetchFromGitHub {
+    owner = "Cryolitia";
+    repo = "ryzen_smu";
+    rev = "ce1aa918efa33ca79998f0f7d467c04d4b07016c";
+    hash = "sha256-s9SSmbL6ixWqZUKEhrZdxN4xoWgk+8ClZPoKq2FDAAE=";
+  };
+
+  monitor-cpu = stdenv.mkDerivation {
+    pname = "monitor-cpu";
+    inherit version src;
+
+    makeFlags = [
+      "-C userspace"
+    ];
+
+    installPhase = ''
+    runHook preInstall
+
+    install userspace/monitor_cpu -Dm755 -t $out/bin
+
+    runHook postInstall
+  '';
+  };
+
+in
+stdenv.mkDerivation {
+  pname = "ryzen-smu-${kernel.version}";
+  inherit version src;
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "TARGET=${kernel.modDirVersion}"
+    "KERNEL_BUILD=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install ryzen_smu.ko -Dm444 -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/ryzen_smu
+    install ${monitor-cpu}/bin/monitor_cpu -Dm755 -t $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A Linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors";
+    homepage = "https://gitlab.com/leogx9r/ryzen_smu";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ Cryolitia phdyellow ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "monitor_cpu";
+  };
+}
diff --git a/pkgs/servers/search/weaviate/default.nix b/pkgs/servers/search/weaviate/default.nix
index 3072c846f79c..9f814dd68e2a 100644
--- a/pkgs/servers/search/weaviate/default.nix
+++ b/pkgs/servers/search/weaviate/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "weaviate";
-  version = "1.24.7";
+  version = "1.24.8";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${version}";
-    hash = "sha256-KLKzHB+MzaLifMNdMCziFNawFBMUWJ75Xozu53yvJFU=";
+    hash = "sha256-OydGohfsS2/Wb9uuFP+6IogmfiWMFLBIEdooFJwS3TU=";
   };
 
   vendorHash = "sha256-DMzwIxtF267C2OLyVdZ6CrCz44sy6ZeKL2qh8AkhS2I=";
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index c82984154879..3ef10799a5f1 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.30.0";
+  version = "1.30.1";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-enMUGLOoVy56PCAqfW6jTOgEr/Me6kbuUvq3YmlxMPs=";
+    hash = "sha256-4hxIDdmPXU+wnD6O7S/H30YIAroOWAQobAPimwwxxv0=";
   };
 
   vendorHash = "sha256-lMhfCkuLuA8aj3Q+I/v/Ohof/htBJjPRmQ3c9QXsioc=";
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
index 2509659cf8ef..f2b2b3b30511 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ibus-m17n";
-  version = "1.4.28";
+  version = "1.4.29";
 
   src = fetchFromGitHub {
     owner = "ibus";
     repo = "ibus-m17n";
     rev = version;
-    sha256 = "sha256-3/AnytPIIi1Q2i/25rkqOZWgUCtouO+cS+TByp9neOI=";
+    sha256 = "sha256-KHAdGTlRdTNpSuYbT6rocbT9rSNhxCdt4Z6QSLlbBsg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index e01f8f8485a6..a27c9082f7f0 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -13,13 +13,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.25.4";
+  version = "2.25.6";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-uTq+/g2DtiftfQvNVYIKtARyxA9Y8LE6VCeGFcWs5SQ=";
+    hash = "sha256-HFC6VhlA3Kt1oZd1R5bOHRMQrNiNu4J0Op1uCKOXj9w=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook gobject-introspection ];
diff --git a/pkgs/tools/networking/grpcui/default.nix b/pkgs/tools/networking/grpcui/default.nix
index f4bca5a29911..92a5df036de1 100644
--- a/pkgs/tools/networking/grpcui/default.nix
+++ b/pkgs/tools/networking/grpcui/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grpcui";
-  version = "1.3.3";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G4lVYwx8fYxuyHI2CzAfBQHQV/G4lf7zBwL8JTpnscA=";
+    sha256 = "sha256-OIwfLuWY7Y0t85v+P/0F55vEe0hNohlqMl16Omr8AF0=";
   };
 
-  vendorHash = "sha256-lw8HildV1RFTGLOf6FaitbXPxr4FtVGg7GxdzBVFiTM=";
+  vendorHash = "sha256-dEek7q8OjFgCn+f/qyiQL/5qu8RJp38vZk3OrBREHx4=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/grpcurl/default.nix b/pkgs/tools/networking/grpcurl/default.nix
index 252a148f6fc7..3aadefc1d871 100644
--- a/pkgs/tools/networking/grpcurl/default.nix
+++ b/pkgs/tools/networking/grpcurl/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "grpcurl";
-  version = "1.8.9";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
     repo = "grpcurl";
     rev = "v${version}";
-    sha256 = "sha256-zN/vleCph919HXZZ9wsXoJBXRT6y7gjyuQxnjRMzq00=";
+    sha256 = "sha256-OVlFOZD4+ZXRKl0Q0Dh5Etij/zeB1jTGoY8n13AyLa4=";
   };
 
   subPackages = [ "cmd/grpcurl" ];
 
-  vendorHash = "sha256-g5G966CuaVILGAgWunHAPrrkLjSv8pBj9R4bcLzyI+A=";
+  vendorHash = "sha256-KsPrJC4hGrGEny8wVWE1EG00qn+b1Rrvh4qK27VzgLU=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/networking/i2p/default.nix b/pkgs/tools/networking/i2p/default.nix
deleted file mode 100644
index 6958a12cdf3d..000000000000
--- a/pkgs/tools/networking/i2p/default.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ lib
-, stdenv
-, ps
-, coreutils
-, fetchurl
-, jdk
-, jre
-, ant
-, gettext
-, which
-, java-service-wrapper
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "i2p";
-  version = "2.4.0";
-
-  src = fetchurl {
-    urls = map (mirror: "${mirror}/${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
-      "https://download.i2p2.de/releases"
-      "https://files.i2p-projekt.de"
-      "https://download.i2p2.no/releases"
-    ];
-    sha256 = "sha256-MO+K/K0P/6/ZTTCsMH+GtaazGOLB9EoCMAWEGh/NB3w=";
-  };
-
-  buildInputs = [ jdk ant gettext which ];
-  patches = [ ./i2p.patch ];
-
-  buildPhase = ''
-    export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"
-    ant preppkg-linux-only
-  '';
-
-  installPhase = ''
-    set -B
-    mkdir -p $out/{bin,share}
-    cp -r pkg-temp/* $out
-
-    cp ${java-service-wrapper}/bin/wrapper $out/i2psvc
-    cp ${java-service-wrapper}/lib/wrapper.jar $out/lib
-    cp ${java-service-wrapper}/lib/libwrapper.so $out/lib
-
-    sed -i $out/i2prouter -i $out/runplain.sh \
-      -e "s#uname#${coreutils}/bin/uname#" \
-      -e "s#which#${which}/bin/which#" \
-      -e "s#%gettext%#${gettext}/bin/gettext#" \
-      -e "s#/usr/ucb/ps#${ps}/bin/ps#" \
-      -e "s#/usr/bin/tr#${coreutils}/bin/tr#" \
-      -e "s#%INSTALL_PATH#$out#" \
-      -e 's#%USER_HOME#$HOME#' \
-      -e "s#%SYSTEM_java_io_tmpdir#/tmp#" \
-      -e "s#%JAVA%#${jre}/bin/java#"
-    mv $out/runplain.sh $out/bin/i2prouter-plain
-    mv $out/man $out/share/
-    chmod +x $out/bin/* $out/i2psvc
-    rm $out/{osid,postinstall.sh,INSTALL-headless.txt}
-  '';
-
-  meta = with lib; {
-    description = "Applications and router for I2P, anonymity over the Internet";
-    homepage = "https://geti2p.net";
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode # source bundles dependencies as jars
-    ];
-    license = with licenses; [
-      asl20
-      boost
-      bsd2
-      bsd3
-      cc-by-30
-      cc0
-      epl10
-      gpl2
-      gpl3
-      lgpl21Only
-      lgpl3Only
-      mit
-      publicDomain
-    ];
-    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ joelmo ];
-    mainProgram = "i2prouter-plain";
-  };
-})
diff --git a/pkgs/tools/networking/i2p/i2p.patch b/pkgs/tools/networking/i2p/i2p.patch
deleted file mode 100644
index 3bb4da729173..000000000000
--- a/pkgs/tools/networking/i2p/i2p.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-diff --git a/installer/resources/i2prouter b/installer/resources/i2prouter
-index 365737d89..2ea14db3e 100644
---- a/installer/resources/i2prouter
-+++ b/installer/resources/i2prouter
-@@ -49,7 +49,7 @@ APP_LONG_NAME="I2P Service"
- 
- # gettext - we look for it in the path
- # fallback to echo is below, we can't set it to echo here.
--GETTEXT=$(which gettext > /dev/null 2>&1)
-+GETTEXT=%gettext%
- 
- # Where to install the systemd service
- SYSTEMD_SERVICE="/etc/systemd/system/${APP_NAME}.service"
-diff --git a/installer/resources/runplain.sh b/installer/resources/runplain.sh
-index eb4995dfe..0186cede3 100644
---- a/installer/resources/runplain.sh
-+++ b/installer/resources/runplain.sh
-@@ -25,7 +25,7 @@ CP=
- 
- # Try using the Java binary that I2P was installed with.
- # If it's not found, try looking in the system PATH.
--JAVA=$(which "%JAVA_HOME"/bin/java || which java)
-+JAVA=%JAVA%
- 
- if [ -z $JAVA ] || [ ! -x $JAVA ]; then
-     echo "Error: Cannot find java." >&2
-@@ -44,15 +44,4 @@ if [ $(uname -s) = "Darwin" ]; then
-     export JAVA_TOOL_OPTIONS="-Djava.awt.headless=true"
- fi
- JAVAOPTS="${MAXMEMOPT} -Djava.net.preferIPv4Stack=${PREFERv4} -Djava.library.path=${I2P}:${I2P}/lib -Di2p.dir.base=${I2P} -DloggerFilenameOverride=logs/log-router-@.txt"
--(
--    nohup ${JAVA} -cp \"${CP}\" ${JAVAOPTS} net.i2p.router.RouterLaunch > /dev/null 2>&1
--) &
--PID=$!
--
--if [ ! -z $PID ] && kill -0 $PID > /dev/null 2>&1 ; then
--    echo "I2P started [$PID]" >&2
--    echo $PID > "${I2PTEMP}/router.pid"
--else
--    echo "I2P failed to start." >&2
--    exit 1
--fi
-+exec ${JAVA} -cp \"${CP}\" ${JAVAOPTS} net.i2p.router.RouterLaunch
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 8842cbab248c..689719237ed2 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , kernel ? null
-, libelf
+, elfutils
 , nasm
 , python3
 , withDriver ? false
@@ -26,8 +26,9 @@ python3.pkgs.buildPythonApplication rec {
   KSRC = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   nativeBuildInputs = [
-    libelf
     nasm
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.buildPlatform elfutils) [
+    elfutils
   ] ++ lib.optionals withDriver kernel.moduleBuildDependencies;
 
   nativeCheckInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 050894307503..2f33862fcffe 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -30,11 +30,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.8.10";
+  version = "0.4.8.11";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-5ii0+rcO20cncVsjzykxN1qfdoWsCPLFnqSYoXhGOoY=";
+    sha256 = "sha256-jyvfkOYzgHgSNap9YE4VlXDyg+zuZ0Zwhz2LtwUsjgc=";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 336c304aa1fd..76e887824b53 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -17,7 +17,8 @@ buildGoModule rec {
     hash = "sha256-2xgvXHeltoODr5Rok7yaUqdVcO2crtdPvvRrN+DDGr4=";
   };
 
-  vendorHash = "sha256-dQ/oKVy5RZ5R8cbNom1msSbuzrQ7VbtK7m+8aS33u7Y=";
+  vendorHash = "sha256-zpHrwQ1egD2juWkQicHl2HVzXGr3DCmAyRdUgm5jdGg=";
+  proxyVendor = true;
 
   ldflags = [
     "-s"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 151530685e71..cdaa063bcdd3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9183,8 +9183,6 @@ with pkgs;
 
   i2c-tools = callPackage ../os-specific/linux/i2c-tools { };
 
-  i2p = callPackage ../tools/networking/i2p { };
-
   i2pd = callPackage ../tools/networking/i2pd { };
 
   iannix = libsForQt5.callPackage ../applications/audio/iannix { };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 21b044583b9e..4ab227d9975a 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -548,6 +548,8 @@ in {
 
     ithc = callPackage ../os-specific/linux/ithc { };
 
+    ryzen-smu = callPackage ../os-specific/linux/ryzen-smu { };
+
     zenpower = callPackage ../os-specific/linux/zenpower { };
 
     zfs_2_1 = callPackage ../os-specific/linux/zfs/2_1.nix {