diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 58bb5cbd2ad2..3faa46db67a5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17160,6 +17160,12 @@
       fingerprint = "897E 6BE3 0345 B43D CADD  05B7 290F CF08 1AED B3EC";
     }];
   };
+  smrehman = {
+    name = "Syed Moiz Ur Rehman";
+    email = "smrehman@proton.me";
+    github = "syedmoizurrehman";
+    githubId = 17818950;
+  };
   sna = {
     email = "abouzahra.9@wright.edu";
     github = "S-NA";
diff --git a/nixos/modules/programs/gamemode.nix b/nixos/modules/programs/gamemode.nix
index c43e2c2296f5..344f392852e2 100644
--- a/nixos/modules/programs/gamemode.nix
+++ b/nixos/modules/programs/gamemode.nix
@@ -18,7 +18,7 @@ in
 
       settings = mkOption {
         type = settingsFormat.type;
-        default = {};
+        default = { };
         description = lib.mdDoc ''
           System-wide configuration for GameMode (/etc/gamemode.ini).
           See gamemoded(8) man page for available settings.
diff --git a/pkgs/applications/backup/timeshift/unwrapped.nix b/pkgs/applications/backup/timeshift/unwrapped.nix
index b41ca774cf96..bcf6ff6af721 100644
--- a/pkgs/applications/backup/timeshift/unwrapped.nix
+++ b/pkgs/applications/backup/timeshift/unwrapped.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "timeshift";
-  version = "23.12.1";
+  version = "23.12.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "timeshift";
     rev = version;
-    sha256 = "uesedEXPfvI/mRs8BiNkv8B2vVxmtTSaIvlQIsajkVg=";
+    sha256 = "xeO1/YQGRTCCGMRPr6Dqb9+89lP24fPBDBJpvtcr2X0=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/cluster/popeye/default.nix b/pkgs/applications/networking/cluster/popeye/default.nix
index c65c795a173b..8e5a7e68ef56 100644
--- a/pkgs/applications/networking/cluster/popeye/default.nix
+++ b/pkgs/applications/networking/cluster/popeye/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "popeye";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "derailed";
     repo = "popeye";
-    sha256 = "sha256-A1jUlEgjBoiN+NYwpyW/1eYzkCK3UuPID++fu+zGvzk=";
+    sha256 = "sha256-2mLbBvdUWGspTNeU3QJzR5NDI24njvRO2nss/Bo93W8=";
   };
 
   ldflags = [
@@ -17,7 +17,7 @@ buildGoModule rec {
     "-X github.com/derailed/popeye/cmd.commit=${version}"
   ];
 
-  vendorHash = "sha256-MEsChBBn0mixgJ7pzRoqAqup75b/mVv6k3OMmzgyLC4=";
+  vendorHash = "sha256-Vt5QwggdasVk4j2huSIneBMemi3Q0R4MgZn2yNlOH5E=";
 
   doInstallCheck = true;
   installCheckPhase = ''
diff --git a/pkgs/build-support/emacs/melpa.nix b/pkgs/build-support/emacs/melpa.nix
index 83654cf47144..85bc8aa37b3a 100644
--- a/pkgs/build-support/emacs/melpa.nix
+++ b/pkgs/build-support/emacs/melpa.nix
@@ -40,8 +40,8 @@ import ./generic.nix { inherit lib stdenv emacs texinfo writeText gcc; } ({
     src = fetchFromGitHub {
       owner = "melpa";
       repo = "package-build";
-      rev = "c48aa078c01b4f07b804270c4583a0a58ffea1c0";
-      sha256 = "sha256-MzPj375upIiYXdQR+wWXv3A1zMqbSrZlH0taLuxx/1M=";
+      rev = "c3c535e93d9dc92acd21ebc4b15016b5c3b90e7d";
+      sha256 = "17z0wbqdd6fspbj43yq8biff6wfggk74xgnaf1xx6ynsp1i74is5";
     };
 
     patches = [ ./package-build-dont-use-mtime.patch ];
diff --git a/pkgs/build-support/emacs/melpa2nix.el b/pkgs/build-support/emacs/melpa2nix.el
index 3de77dbf5e5c..72667dea652c 100644
--- a/pkgs/build-support/emacs/melpa2nix.el
+++ b/pkgs/build-support/emacs/melpa2nix.el
@@ -11,22 +11,22 @@
 ;; Allow installing package tarfiles larger than 10MB
 (setq large-file-warning-threshold nil)
 
-(defun melpa2nix-build-package-1 (rcp)
-  (let* ((default-directory (package-recipe--working-tree rcp)))
+(defun melpa2nix-build-package-1 (rcp version commit)
+  (let ((source-dir (package-recipe--working-tree rcp)))
     (unwind-protect
         (let ((files (package-build-expand-files-spec rcp t)))
-          (unless files
-            (error "Unable to find files matching recipe patterns"))
-          (if (> (length files) 1)
-              (package-build--build-multi-file-package rcp files)
-            (package-build--build-single-file-package rcp files))))))
+          (cond
+           ((= (length files) 1)
+            (package-build--build-single-file-package
+             rcp version commit files source-dir))
+           ((> (length files) 1)
+            (package-build--build-multi-file-package
+             rcp version commit files source-dir))
+           (t (error "Unable to find files matching recipe patterns")))))))
 
 (defun melpa2nix-build-package ()
-  (unless noninteractive
-    (error "`melpa2nix-build-package' is to be used only with -batch"))
+  (if (not noninteractive)
+      (error "`melpa2nix-build-package' is to be used only with -batch"))
   (pcase command-line-args-left
     (`(,package ,version ,commit)
-     (let ((recipe (package-recipe-lookup package)))
-       (setf (oref recipe commit) commit)
-       (setf (oref recipe version) version)
-       (melpa2nix-build-package-1 recipe)))))
+     (melpa2nix-build-package-1 (package-recipe-lookup package) version commit))))
diff --git a/pkgs/build-support/emacs/package-build-dont-use-mtime.patch b/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
index 1ace7771ea3a..fe94de57a300 100644
--- a/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
+++ b/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
@@ -1,21 +1,40 @@
 diff --git a/package-build.el b/package-build.el
-index 29cdb61..c19be1b 100644
+index e572045..9eb0f82 100644
 --- a/package-build.el
 +++ b/package-build.el
-@@ -923,7 +923,6 @@ DIRECTORY is a temporary directory that contains the directory
- that is put in the tarball."
-   (let* ((name (oref rcp name))
-          (version (oref rcp version))
--         (time (oref rcp time))
-          (tar (expand-file-name (concat name "-" version ".tar")
-                                 package-build-archive-dir))
-          (dir (concat name "-" version)))
-@@ -939,7 +938,7 @@ that is put in the tarball."
-        ;; prevent a reproducible tarball as described at
+@@ -415,7 +415,7 @@ (defun package-build--write-pkg-file (desc dir)
+       (princ ";; Local Variables:\n;; no-byte-compile: t\n;; End:\n"
+              (current-buffer)))))
+ 
+-(defun package-build--create-tar (name version directory mtime)
++(defun package-build--create-tar (name version directory)
+   "Create a tar file containing the contents of VERSION of package NAME.
+ DIRECTORY is a temporary directory that contains the directory
+ that is put in the tarball.  MTIME is used as the modification
+@@ -434,7 +434,7 @@ (defun package-build--create-tar (name version directory mtime)
+        ;; prevent a reproducable tarball as described at
         ;; https://reproducible-builds.org/docs/archives.
         "--sort=name"
--       (format "--mtime=@%d" time)
+-       (format "--mtime=@%d" mtime)
 +       "--mtime=@0"
         "--owner=0" "--group=0" "--numeric-owner"
         "--pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime"))
      (when (and package-build-verbose noninteractive)
+@@ -848,12 +848,11 @@ (defun package-build--build-multi-file-package (rcp version commit files source-
+                            (package-build--desc-from-library
+                             name version commit files 'tar)
+                            (error "%s[-pkg].el matching package name is missing"
+-                                  name))))
+-               (mtime (package-build--get-commit-time rcp commit)))
++                                  name)))))
+           (package-build--copy-package-files files source-dir target)
+           (package-build--write-pkg-file desc target)
+           (package-build--generate-info-files files source-dir target)
+-          (package-build--create-tar name version tmp-dir mtime)
++          (package-build--create-tar name version tmp-dir)
+           (package-build--write-pkg-readme name files source-dir)
+           (package-build--write-archive-entry desc))
+       (delete-directory tmp-dir t nil))))
+-- 
+2.37.2
+
diff --git a/pkgs/by-name/pg/pgmoneta/package.nix b/pkgs/by-name/pg/pgmoneta/package.nix
index 8f04fdae7bbd..7ff1794850a2 100644
--- a/pkgs/by-name/pg/pgmoneta/package.nix
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmoneta";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "pgmoneta";
     repo = "pgmoneta";
     rev = version;
-    hash = "sha256-4jysBL6fwX2ns+N+ldhTCXZ7L/IuXjbAwou18Ur5+JU=";
+    hash = "sha256-sErdlHXMn97acVIxKapsnLkyOAgO7lOB0UQC5GkL4sQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/cinnamon/cinnamon-common/default.nix b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
index 2d3d3be5092f..2f6f2f77ba4c 100644
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -71,13 +71,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon-common";
-  version = "6.0.2";
+  version = "6.0.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon";
     rev = version;
-    hash = "sha256-/kjl/0Qdro6H3fMfs1dA0Zf/GT5Z4s6kK4vB+EBKw0g=";
+    hash = "sha256-8Y+WUnNQ4p/JeUR4q6Ti6HdoN5bghXs6XJsuWGY66S4=";
   };
 
   patches = [
diff --git a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
index a42fa79c6768..17d846f305b2 100644
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-screensaver";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-jWUPn5+ynuLdb2GaqKph1M62Ky00sRP/vUXedEvBT7A=";
+    hash = "sha256-6Js670Z3/5BwAHvEJrXJkBZvEvx1NeT+eXOKaqKqFqI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/cinnamon/mint-y-icons/default.nix b/pkgs/desktops/cinnamon/mint-y-icons/default.nix
index 9e86a0fb9dda..4742e7af8308 100644
--- a/pkgs/desktops/cinnamon/mint-y-icons/default.nix
+++ b/pkgs/desktops/cinnamon/mint-y-icons/default.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-y-icons";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-Uzayo1hmNwOMszTV8/KqOLxjERBC/L16hRpCWbK10Uc=";
+    hash = "sha256-8dwJyvM5sQNtUzhreBCgSWeElGlp/z3Dk7/xCeUSGKU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/desktops/cinnamon/muffin/default.nix b/pkgs/desktops/cinnamon/muffin/default.nix
index 98ee19c27e78..893ddf065333 100644
--- a/pkgs/desktops/cinnamon/muffin/default.nix
+++ b/pkgs/desktops/cinnamon/muffin/default.nix
@@ -40,7 +40,7 @@
 
 stdenv.mkDerivation rec {
   pname = "muffin";
-  version = "6.0.0";
+  version = "6.0.1";
 
   outputs = [ "out" "dev" "man" ];
 
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-17B2C3SW9smTgLBBGJc9LwFpXoP9WidZEGgI2hbJTH8=";
+    hash = "sha256-yd23naaPIa6xrdf7ipOvVZKqkr7/CMxNqDZ3CQ2QH+Y=";
   };
 
   patches = [
diff --git a/pkgs/desktops/cinnamon/nemo/default.nix b/pkgs/desktops/cinnamon/nemo/default.nix
index 202bfa19af39..7b124c7987da 100644
--- a/pkgs/desktops/cinnamon/nemo/default.nix
+++ b/pkgs/desktops/cinnamon/nemo/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nemo";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3iGwpHuZrRBd35nAa3x1Lu/KDS1L42y5u8A4vM41b0Q=";
+    sha256 = "sha256-vSLFp0sgqGsZtcXdv82PVH0HcBbmcxrMySLFCBrLJpA=";
   };
 
   patches = [
diff --git a/pkgs/desktops/cinnamon/warpinator/default.nix b/pkgs/desktops/cinnamon/warpinator/default.nix
index 4ccb373d0666..0539075ca51d 100644
--- a/pkgs/desktops/cinnamon/warpinator/default.nix
+++ b/pkgs/desktops/cinnamon/warpinator/default.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "warpinator";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-dxbs2Qq1Ix04yIA587tntLJ3W/pnA0wTiQ4BB5GCTR0=";
+    hash = "sha256-wBln4YqjZ8aI3D4Arwa7UgDKxNPSlC5fRZtjanTHl4Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/cinnamon/xreader/default.nix b/pkgs/desktops/cinnamon/xreader/default.nix
index fbf8fbdf64d4..c20177e043ee 100644
--- a/pkgs/desktops/cinnamon/xreader/default.nix
+++ b/pkgs/desktops/cinnamon/xreader/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xreader";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-TL8LlNQLGUevXlNcnS9HcdGh1TzC/0I/6reJpe6rahM=";
+    sha256 = "sha256-sADdslxDtI+zV8DLnczlzNtB9W+BhMP8vb5riSnPYaw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 1bc1777acd47..ff0ecf45fd23 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage.override {
 
   passthru = {
     rustc = rustc;
-    inherit (rustc) tests;
+    inherit (rustc.unwrapped) tests;
   };
 
   # Upstream rustc still assumes that musl = static[1].  The fix for
diff --git a/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs-darwin.patch
new file mode 100644
index 000000000000..e8b07b4ae599
--- /dev/null
+++ b/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs-darwin.patch
@@ -0,0 +1,13 @@
+diff --git a/include/internal/common.h b/include/internal/common.h
+index 15666f1..d91e25b 100644
+--- a/include/internal/common.h
++++ b/include/internal/common.h
+@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr,
+ # ifndef OPENSSL_SYS_VMS
+ #  define X509_CERT_AREA          OPENSSLDIR
+ #  define X509_CERT_DIR           OPENSSLDIR "/certs"
+-#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
++#  define X509_CERT_FILE          "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+ #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
+ #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf"
+ # else
diff --git a/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs.patch
new file mode 100644
index 000000000000..13a36fbcd031
--- /dev/null
+++ b/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs.patch
@@ -0,0 +1,13 @@
+diff --git a/include/internal/common.h b/include/internal/common.h
+index 15666f1..d91e25b 100644
+--- a/include/internal/common.h
++++ b/include/internal/common.h
+@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr,
+ # ifndef OPENSSL_SYS_VMS
+ #  define X509_CERT_AREA          OPENSSLDIR
+ #  define X509_CERT_DIR           OPENSSLDIR "/certs"
+-#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
++#  define X509_CERT_FILE          "/etc/ssl/certs/ca-certificates.crt"
+ #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
+ #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf"
+ # else
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 3aeafccb1edb..a8e178c7e6d3 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -234,6 +234,13 @@ let
   });
 
 in {
+  # intended version "policy":
+  # - 1.1 as long as some package exists, which does not build without it
+  # - latest 3.x LTS
+  # - latest 3.x non-LTS as preview/for development
+  #
+  # - other versions in between only when reasonable need is stated for some package
+  # - backport every security critical fix release e.g. 3.0.y -> 3.0.y+1 but no new version, e.g. 3.1 -> 3.2
 
   # If you do upgrade here, please update in pkgs/top-level/release.nix
   # the permitted insecure version to ensure it gets cached for our users
@@ -279,9 +286,9 @@ in {
     };
   };
 
-  openssl_3_1 = common {
-    version = "3.1.4";
-    hash = "sha256-hAr1Nmq5tSK95SWCa+PvD7Cvgcap69hMqmAP6hcx7uM=";
+  openssl_3_2 = common {
+    version = "3.2.0";
+    hash = "sha256-FMgm8Hx+QzcG+1xp+p4l2rlWhIRLTJYqLPG/GD60aQ4=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
@@ -291,8 +298,8 @@ in {
       ./3.0/openssl-disable-kernel-detection.patch
 
       (if stdenv.hostPlatform.isDarwin
-       then ./use-etc-ssl-certs-darwin.patch
-       else ./use-etc-ssl-certs.patch)
+       then ./3.2/use-etc-ssl-certs-darwin.patch
+       else ./3.2/use-etc-ssl-certs.patch)
     ];
 
     withDocs = true;
diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index 8e3bccc473cf..d607fab5194b 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -11,6 +11,7 @@
 , packaging
 , psutil
 , pyyaml
+, safetensors
 , torch
 , evaluate
 , parameterized
@@ -20,7 +21,8 @@
 buildPythonPackage rec {
   pname = "accelerate";
   version = "0.25.0";
-  format = "pyproject";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
@@ -30,15 +32,6 @@ buildPythonPackage rec {
     hash = "sha256-WIMOSfo9fGbevMkUHvFsA51SOiGkBO1cK388FudRDY0=";
   };
 
-  patches = [
-    # https://github.com/huggingface/accelerate/pull/2121
-    (fetchpatch {
-      name = "fix-import-error-without-torch_distributed.patch";
-      url = "https://github.com/huggingface/accelerate/commit/42048092eabd67a407ea513a62f2acde97079fbc.patch";
-      hash = "sha256-9lvnU6z5ZEFc5RVw2bP0cGVyrwAp/pxX4ZgnmCN7qH8=";
-    })
-  ];
-
   nativeBuildInputs = [ setuptools ];
 
   propagatedBuildInputs = [
@@ -46,6 +39,7 @@ buildPythonPackage rec {
     packaging
     psutil
     pyyaml
+    safetensors
     torch
   ];
 
@@ -83,9 +77,6 @@ buildPythonPackage rec {
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
     # RuntimeError: torch_shm_manager: execl failed: Permission denied
     "CheckpointTest"
-  ] ++ lib.optionals (pythonAtLeast "3.11") [
-    # python3.11 not yet supported for torch.compile
-    "test_dynamo_extract_model"
   ];
 
   disabledTestPaths = lib.optionals (!(stdenv.isLinux && stdenv.isx86_64)) [
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 8edaa2495824..e85c15e534d8 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.81";
+  version = "9.2.82";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ovV6BlhED9Du/jKQzgBFSp+XPYVAkNONU5iOEd52e2s=";
+    hash = "sha256-jDejI5e2ASoQUMPS9Ajis14RF66HnbkoOK6+Xs8ydis=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 3d15fbb30be5..516d86acb6fd 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.81";
+  version = "9.2.82";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ckak602Uz8YqBDVmh3iDh9d9/SPNRZMil8PskUbrjLA=";
+    hash = "sha256-3DqR1p2VK9Xe2Yk+gZ81GM4Cn39TDrx1LSivu4xVDOI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index e8096551d022..fc31ed21b814 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.81";
+  version = "9.2.82";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-e/13v2hm0yYoO2A/kz6ekvN1FP8XNqqypfZdHKGEItM=";
+    hash = "sha256-uK42wbP6zZFRR6JqHs3Ag5zsPT9JFyKviDRxLDa1QjY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/arviz/default.nix b/pkgs/development/python-modules/arviz/default.nix
index 0a186781b4a2..63bf85273811 100644
--- a/pkgs/development/python-modules/arviz/default.nix
+++ b/pkgs/development/python-modules/arviz/default.nix
@@ -8,13 +8,11 @@
 , numba
 , numpy
 , pandas
-, pytest
 , setuptools
 , cloudpickle
 , pytestCheckHook
 , scipy
 , packaging
-, typing-extensions
 , pythonOlder
 , xarray
 , xarray-einstats
@@ -33,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "arviz";
-  version = "0.16.1";
+  version = "0.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -42,7 +40,7 @@ buildPythonPackage rec {
     owner = "arviz-devs";
     repo = "arviz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kixWGj0M0flTq5rXSiPB0nfZaGYRvvMBGAJpehdW8KY=";
+    hash = "sha256-DqVwbiNJHdRxK3Ppfa6sqPJzDqMaj1mtlAJHFq09u2Y=";
   };
 
   propagatedBuildInputs = [
@@ -86,6 +84,7 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Tests require network access
+    "test_plot_ppc_transposed"
     "test_plot_separation"
     "test_plot_trace_legend"
     "test_cov"
diff --git a/pkgs/development/python-modules/binary2strings/default.nix b/pkgs/development/python-modules/binary2strings/default.nix
new file mode 100644
index 000000000000..c122b67886da
--- /dev/null
+++ b/pkgs/development/python-modules/binary2strings/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pybind11
+, pytestCheckHook
+, pythonOlder
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "binary2strings";
+  version = "0.1.13";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "glmcdona";
+    repo = "binary2strings";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3UPT0PdnPAhOu3J2vU5NxE3f4Nb1zwuX3hJiy87nLD0=";
+  };
+
+  nativeBuildInputs = [
+    pybind11
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "binary2strings"
+  ];
+
+  pytestFlagsArray = [
+    "tests/test.py"
+  ];
+
+  meta = with lib; {
+    description = "Module to extract Ascii, Utf8, and Unicode strings from binary data";
+    homepage = "https://github.com/glmcdona/binary2strings";
+    changelog = "https://github.com/glmcdona/binary2strings/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/clarifai-grpc/default.nix b/pkgs/development/python-modules/clarifai-grpc/default.nix
index d7b727830b13..d8b74f55f7d4 100644
--- a/pkgs/development/python-modules/clarifai-grpc/default.nix
+++ b/pkgs/development/python-modules/clarifai-grpc/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "clarifai-grpc";
-  version = "9.11.2";
+  version = "9.11.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Clarifai";
     repo = "clarifai-python-grpc";
     rev = "refs/tags/${version}";
-    hash = "sha256-ImfZ5g/EhAqkP4CbA7AZHWHQ88KBVCwMVU/j0OQCilg=";
+    hash = "sha256-uCXtd9m2phIgP85syIPtoFIxM9dkBzFxxK6OOF0VWAA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 138c75836d15..81a111c7f145 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.81";
+  version = "9.2.82";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6DqIeLoJzpONte4WHI5EeV3iDDh1lNhegrNiKIgSAbY=";
+    hash = "sha256-veJd3M2Jf6snXZsR4P0wQpC0rSbIFT92QgyFFI5Er4Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index e6906ffe103b..1ae119f8404a 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,14 +16,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.81";
+  version = "9.2.82";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-42J6uBM5Ek1uv5gc4ZwtWpVgUdS3Sd4Y+ge2hkG8QTA=";
+    hash = "sha256-fUp0nS4ILU90uvROH3qNy3kYrpt7yHzbCG5TE/0BqKU=";
   };
 
 in
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NS3yi5Ysu0s5PcqnLYOUYI0qpfOX4/E/UDmReX7aNGM=";
+    hash = "sha256-wzRHYgnZPLDgcf1IlXxY2a52mbeImejj/F8DUAuB1VU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cloudpathlib/default.nix b/pkgs/development/python-modules/cloudpathlib/default.nix
index ae22d4bcafbf..b76de3717bf4 100644
--- a/pkgs/development/python-modules/cloudpathlib/default.nix
+++ b/pkgs/development/python-modules/cloudpathlib/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "cloudpathlib";
-  version = "0.16.0";
+  version = "0.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,8 +29,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "drivendataorg";
     repo = "cloudpathlib";
-    rev = "v${version}";
-    hash = "sha256-d4CbzPy3H5HQ4YmSRCRMEYaTpwB7F0Bznd26aKWiHTA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-rj8v4EUMPdB5zmbP4VQli2H6GjDor3BHaA95GwoKS5E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-azure/default.nix b/pkgs/development/python-modules/dvc-azure/default.nix
index 0575558920ba..339e36fc0489 100644
--- a/pkgs/development/python-modules/dvc-azure/default.nix
+++ b/pkgs/development/python-modules/dvc-azure/default.nix
@@ -6,34 +6,46 @@
 , fetchPypi
 , knack
 , pythonRelaxDepsHook
-, setuptools-scm }:
+, setuptools-scm
+}:
 
 buildPythonPackage rec {
   pname = "dvc-azure";
-  version = "2.23.0";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0+G2n1ysRF/ggl5hkOsUW2UPOm6Y1ExZFBSMfOrEQyg=";
+    hash = "sha256-TB7yY5b2AWBFt8+AnxyKyP6hoXi6cdHVjtffapRVfHc=";
   };
 
   # Prevent circular dependency
-  pythonRemoveDeps = [ "dvc" ];
+  pythonRemoveDeps = [
+    "dvc"
+  ];
 
-  nativeBuildInputs = [ setuptools-scm pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    setuptools-scm
+    pythonRelaxDepsHook
+  ];
 
   propagatedBuildInputs = [
-    adlfs azure-identity dvc-objects knack
+    adlfs
+    azure-identity
+    dvc-objects
+    knack
   ];
 
   # Network access is needed for tests
   doCheck = false;
 
-  pythonImportsCheck = [ "dvc_azure" ];
+  # Circular dependency
+  # pythonImportsCheck = [
+  #   "dvc_azure"
+  # ];
 
   meta = with lib; {
-    description = "azure plugin for dvc";
+    description = "Azure plugin for dvc";
     homepage = "https://pypi.org/project/dvc-azure/${version}";
     changelog = "https://github.com/iterative/dvc-azure/releases/tag/${version}";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index f342412dc63e..d71c4b5e1eed 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "3.0.1";
+  version = "3.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc-data";
     rev = "refs/tags/${version}";
-    hash = "sha256-OySGTJFHBb+Ot5NUZsQZ4gJkbc6ojrSyDWDPp32q74E=";
+    hash = "sha256-vLSb+RIaebF+ili+6bvU8wplcpycPVRadUkhkLHdqi8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-gs/default.nix b/pkgs/development/python-modules/dvc-gs/default.nix
index e36ec61a88c3..fa01c64c8daf 100644
--- a/pkgs/development/python-modules/dvc-gs/default.nix
+++ b/pkgs/development/python-modules/dvc-gs/default.nix
@@ -4,29 +4,41 @@
 , fetchPypi
 , gcsfs
 , pythonRelaxDepsHook
-, setuptools-scm }:
+, setuptools-scm
+}:
 
 buildPythonPackage rec {
   pname = "dvc-gs";
-  version = "2.22.1";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IKDwdSfolZwv8TvHHicVV42PYeULhskv8csbkiJzLbk=";
+    hash = "sha256-5UMKKX+4GCNm98S8kQsasQTY5cwi9hGhm84FFl3/7NQ=";
   };
 
   # Prevent circular dependency
-  pythonRemoveDeps = [ "dvc" ];
+  pythonRemoveDeps = [
+    "dvc"
+  ];
 
-  nativeBuildInputs = [ setuptools-scm pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    setuptools-scm
+    pythonRelaxDepsHook
+  ];
 
-  propagatedBuildInputs = [ gcsfs dvc-objects ];
+  propagatedBuildInputs = [
+    gcsfs
+    dvc-objects
+  ];
 
   # Network access is needed for tests
   doCheck = false;
 
-  pythonImportsCheck = [ "dvc_gs" ];
+  # Circular dependency
+  # pythonImportsCheck = [
+  #   "dvc_gs"
+  # ];
 
   meta = with lib; {
     description = "gs plugin for dvc";
diff --git a/pkgs/development/python-modules/dvc-objects/default.nix b/pkgs/development/python-modules/dvc-objects/default.nix
index ba583f4a8aa4..5525464f860b 100644
--- a/pkgs/development/python-modules/dvc-objects/default.nix
+++ b/pkgs/development/python-modules/dvc-objects/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-objects";
-  version = "2.0.1";
+  version = "3.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc-objects";
     rev = "refs/tags/${version}";
-    hash = "sha256-nxZN0Q9mRAZJUOoxfE58lXZVOrY0r05iROcuo+nV99A=";
+    hash = "sha256-hpiDbECVXbBkewJa+RwrgTQFEFAb3Ir2qs0ENYuJtwI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dvc-s3/default.nix b/pkgs/development/python-modules/dvc-s3/default.nix
index ca4fe5a810d0..a15295649d4e 100644
--- a/pkgs/development/python-modules/dvc-s3/default.nix
+++ b/pkgs/development/python-modules/dvc-s3/default.nix
@@ -7,36 +7,48 @@
 , flatten-dict
 , pythonRelaxDepsHook
 , s3fs
-, setuptools-scm }:
+, setuptools-scm
+}:
 
 buildPythonPackage rec {
   pname = "dvc-s3";
-  version = "2.23.0";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HyhZj1sN70o1CTNCiroGKjaMk7tBGqPG2PRsrnm1uVc=";
+    hash = "sha256-ax2Wsjfvu4hoF99eDPT2sbFhl30wuYtGdEonYCCkJMY=";
   };
 
   # Prevent circular dependency
-  pythonRemoveDeps = [ "dvc" ];
+  pythonRemoveDeps = [
+    "dvc"
+  ];
 
   # dvc-s3 uses boto3 directly, we add in propagatedBuildInputs
   postPatch = ''
     substituteInPlace setup.cfg --replace 'aiobotocore[boto3]' 'aiobotocore'
   '';
 
-  nativeBuildInputs = [ setuptools-scm pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    setuptools-scm
+    pythonRelaxDepsHook
+  ];
 
   propagatedBuildInputs = [
-    aiobotocore boto3 dvc-objects flatten-dict s3fs
+    aiobotocore
+    boto3
+    dvc-objects
+    flatten-dict s3fs
   ];
 
   # Network access is needed for tests
   doCheck = false;
 
-  pythonImportsCheck = [ "dvc_s3" ];
+  # Circular dependency
+  # pythonImportsCheck = [
+  #   "dvc_s3"
+  # ];
 
   meta = with lib; {
     description = "s3 plugin for dvc";
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index c4577e691357..3d1461ab0a76 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -55,14 +55,14 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.33.4";
+  version = "3.37.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-NWu12FVJDSSuxYGVWFNlbAEUINg05s64EJ6gIaErQ9E=";
+    hash = "sha256-mO6fhPUub09nWmiFSciwNhuS4VJAjQgIukc+lQWB7Qg=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/dvclive/default.nix b/pkgs/development/python-modules/dvclive/default.nix
index 440f7595de74..67f70fffb3e0 100644
--- a/pkgs/development/python-modules/dvclive/default.nix
+++ b/pkgs/development/python-modules/dvclive/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvclive";
-  version = "3.4.1";
+  version = "3.5.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-apk1akdFLtps5fq28GUgLef2VEgZulj7vuhxsGpCqJE=";
+    hash = "sha256-QsA8HZ6wIWKvtQ+f3nyRKKZRNJS56eZ1sKw+KNHxfXc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gpxpy/default.nix b/pkgs/development/python-modules/gpxpy/default.nix
index 17632c72a397..40708972823a 100644
--- a/pkgs/development/python-modules/gpxpy/default.nix
+++ b/pkgs/development/python-modules/gpxpy/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "gpxpy";
-  version = "1.5.0";
+  version = "1.6.2";
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     owner = "tkrajina";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Fkl2dte1WkPi2hBOdT23BMfNflR0j4GeNH86d46WNQk=";
+    hash = "sha256-s65k0u4LIwHX9RJMJIYMkNS4/Z0wstzqYVPAjydo2iI=";
   };
 
   propagatedBuildInputs = [ lxml ];
diff --git a/pkgs/development/python-modules/ipykernel/default.nix b/pkgs/development/python-modules/ipykernel/default.nix
index 9d32925f0ca9..d96ab023c87f 100644
--- a/pkgs/development/python-modules/ipykernel/default.nix
+++ b/pkgs/development/python-modules/ipykernel/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "ipykernel";
-  version = "6.27.1";
+  version = "6.28.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fV1ZS2aQZUtNKZ7bpehy3Be7c5ao0GCcl8t7ihxgXeY=";
+    hash = "sha256-acEUA9Jt5p3wIiWRb5FrN+pLmvQX2gqMgn+EMo2I5fM=";
   };
 
   # debugpy is optional, see https://github.com/ipython/ipykernel/pull/767
@@ -68,6 +68,7 @@ buildPythonPackage rec {
   meta = {
     description = "IPython Kernel for Jupyter";
     homepage = "https://ipython.org/";
+    changelog = "https://github.com/ipython/ipykernel/releases/tag/v${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fridh ] ++ lib.teams.jupyter.members;
   };
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index 888147b4b571..a24fc80db16c 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.0.72";
+  version = "0.0.75";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-o7KERA+fYo69jR8LSsa901nE1r3GD38rYO7sj0QsOgM=";
+    hash = "sha256-BbDB3xP3OCRXxbOqFIzFNrpK5+wHbIZ/VlurNXrXpTw=";
   };
 
   sourceRoot = "${src.name}/python";
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index 42bcc9e660f1..6b415cf9f52a 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "2.12.1";
+  version = "2.12.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-So9Kyj4jMRiaBRQGXE88DSWgLEPqQkv8R/Sd8tyRvE0=";
+    hash = "sha256-fzHEy9/BxstPAYhVTG0o7Gn2D9UKuSZvI0X5ynZ+oEk=";
   };
 
   buildInputs = [ pip ];
diff --git a/pkgs/development/python-modules/pylibjpeg/default.nix b/pkgs/development/python-modules/pylibjpeg/default.nix
new file mode 100644
index 000000000000..65055d94280c
--- /dev/null
+++ b/pkgs/development/python-modules/pylibjpeg/default.nix
@@ -0,0 +1,69 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, setuptools
+, numpy
+, pydicom
+, pylibjpeg-libjpeg
+}:
+
+let
+  pylibjpeg-data = buildPythonPackage rec {
+    pname = "pylibjpeg-data";
+    version = "1.0.0dev0";
+    pyproject = true;
+
+    nativeBuildInputs = [ setuptools ];
+
+    src = fetchFromGitHub {
+      owner = "pydicom";
+      repo = "pylibjpeg-data";
+      rev = "2ab4b8a65b070656eca2582bd23197a3d01cdccd";
+      hash = "sha256-cFE1XjrqyGqwHCYGRucXK+q4k7ftUIbYwBw4WwIFtEc=";
+    };
+
+    doCheck = false;
+  };
+in
+
+buildPythonPackage rec {
+  pname = "pylibjpeg";
+  version = "1.4.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pydicom";
+    repo = "pylibjpeg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Px1DyYDkKAUdYo+ZxZ1w7TkPzWN++styiFl02iQOvyQ=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [ numpy ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pydicom
+    pylibjpeg-data
+    pylibjpeg-libjpeg
+  ];
+
+  pythonImportsCheck = [ "pylibjpeg" ];
+
+  meta = with lib; {
+    description = "Python framework for decoding JPEG images, with a focus on supporting Pydicom";
+    homepage = "https://github.com/pydicom/pylibjpeg";
+    changelog = "https://github.com/pydicom/pylibjpeg/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+    # several test failures of form
+    # "pydicom.errors.InvalidDicomError: File is missing DICOM File Meta Information header or the 'DICM' prefix is missing from the header. ..."
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index bddd7fa9b73c..8f22b137ee37 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyngrok";
-  version = "7.0.3";
+  version = "7.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RNi0ivQKsLb/JD9+vdJYGf5HDC6BmeNdseR2OU8v1uY=";
+    hash = "sha256-VEIsGjVFx5Q7G2cKtMYQY7Te1TpFUZYZJRZvRMAwSS8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 17f8185a8dfb..371258063763 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.81";
+  version = "9.2.82";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-59Lq2JKDWrtkRMZb5AjH69LX9+Zk+BvfKxKXG/qGw6g=";
+    hash = "sha256-m3vHz56w15M2oZhSDzO5wiAVk1+/DoxZxS0qBFh5pQM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvicare/default.nix b/pkgs/development/python-modules/pyvicare/default.nix
index 9b6457d9797d..56f74a93b21e 100644
--- a/pkgs/development/python-modules/pyvicare/default.nix
+++ b/pkgs/development/python-modules/pyvicare/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyvicare";
-  version = "2.30.0";
+  version = "2.32.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "somm15";
     repo = "PyViCare";
     rev = "refs/tags/${version}";
-    hash = "sha256-jcnA5qxS4eq1nZ0uo8NGPoSGTI/JrrH02MJPFxL3hQM=";
+    hash = "sha256-qK5JCaCL+gbgNcBo5IjhlRrXD1IhA1B56hmcjvPie6Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/simple-term-menu/default.nix b/pkgs/development/python-modules/simple-term-menu/default.nix
new file mode 100644
index 000000000000..9f21c327da97
--- /dev/null
+++ b/pkgs/development/python-modules/simple-term-menu/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "simple-term-menu";
+  version = "1.6.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-vpxdvY3xKkBLFM2Oldb8AtWMYOJVX2Xd3kF3fEh/s7k=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  pythonImportsCheck = [ "simple_term_menu" ];
+
+  # no unit tests in the upstream
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Python package which creates simple interactive menus on the command line";
+    homepage = "https://github.com/IngoMeyer441/simple-term-menu";
+    license = licenses.mit;
+    changelog = "https://github.com/IngoMeyer441/simple-term-menu/releases/tag/v${version}";
+    maintainers = with maintainers; [ smrehman ];
+  };
+}
diff --git a/pkgs/development/python-modules/soco/default.nix b/pkgs/development/python-modules/soco/default.nix
index d496d42fff1b..40bcd475604e 100644
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "soco";
-  version = "0.30.0";
+  version = "0.30.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "SoCo";
     repo = "SoCo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xoHXUcHmzEDmE17r0+vI56UBAPQEhpglBkWtwE9b2Nw=";
+    hash = "sha256-MajtB754VY+WmeJ2UROeNfvFdqSWIDXQwDSDK7zn8fk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/streamdeck/default.nix b/pkgs/development/python-modules/streamdeck/default.nix
index 7c17ba2d49a9..6202fcdf1f79 100644
--- a/pkgs/development/python-modules/streamdeck/default.nix
+++ b/pkgs/development/python-modules/streamdeck/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "streamdeck";
-  version = "0.9.4";
+  version = "0.9.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aVmWbrBhZ49NfwOp23FD1dxZF+w/q26fIOVs7iQXUxo=";
+    hash = "sha256-BHliZrRFd64D+UD1xcpp2HAH4D0Z7tibawJobAMM65E=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/djlint/default.nix b/pkgs/development/tools/djlint/default.nix
index ba3e5606d095..27d66f6dd42c 100644
--- a/pkgs/development/tools/djlint/default.nix
+++ b/pkgs/development/tools/djlint/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "djlint";
-  version = "1.32.1";
-  format = "pyproject";
+  version = "1.34.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Riverside-Healthcare";
     repo = "djlint";
     rev = "v${version}";
-    hash = "sha256-///ZEkVohioloBJn6kxpEK5wmCzMp9ZYeAH1mONOA0E=";
+    hash = "sha256-p9RIzX9zoZxBrhiNaIeCX9OgfQm/lXNwYsh6IcsnIVk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/gi-crystal/default.nix b/pkgs/development/tools/gi-crystal/default.nix
index b5d66566a6ff..8b664ee1e00f 100644
--- a/pkgs/development/tools/gi-crystal/default.nix
+++ b/pkgs/development/tools/gi-crystal/default.nix
@@ -5,13 +5,13 @@
 }:
 crystal.buildCrystalPackage rec {
   pname = "gi-crystal";
-  version = "0.19.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "hugopl";
     repo = "gi-crystal";
     rev = "v${version}";
-    hash = "sha256-SwBzGAgs0cBbBYXtaJSDWjORE+vrvI5aKG9kaC9VA4o=";
+    hash = "sha256-hL+4MvJn1z9UKCtyvU4zzIxOwRyYQ3Qt4qRb5F0J+sg=";
   };
 
   # Make sure gi-crystal picks up the name of the so or dylib and not the leading nix store path
diff --git a/pkgs/development/tools/rust/cargo-expand/default.nix b/pkgs/development/tools/rust/cargo-expand/default.nix
index 85ff24c845d6..bf3a36591d3d 100644
--- a/pkgs/development/tools/rust/cargo-expand/default.nix
+++ b/pkgs/development/tools/rust/cargo-expand/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.75";
+  version = "1.0.77";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-1huB+wQ0x770PQF/mFEDzfyjhjYiTRmr2Y+IhqAKP8M=";
+    sha256 = "sha256-jaTSbEmqu9xyv9E5VgiHLE5YIBHVNXdVw8B+rSCjaZQ=";
   };
 
-  cargoHash = "sha256-svb1qWJpaZ2uBdXGWrMXwm1wwQGrhGe891JOtiHnaVg=";
+  cargoHash = "sha256-WXNfxyD0CpoXEkVI+t30aTrdq/KqPnqeDt3wCEBoyLg=";
 
   meta = with lib; {
     description = "A utility and Cargo subcommand designed to let people expand macros in their Rust source code";
diff --git a/pkgs/development/tools/rust/cargo-semver-checks/default.nix b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
index 51e2e5d062dd..e1b2f6867e1f 100644
--- a/pkgs/development/tools/rust/cargo-semver-checks/default.nix
+++ b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-M7ovDD9dwxVZgbggnXhe1A/hDQ8QRmY/2J6qdWU4mys=";
+    hash = "sha256-DN50syZ965MWXKg3lhEhvINeqZUtZgJNjusevf4EIUw=";
   };
 
-  cargoHash = "sha256-wPWSuvAmPCquwg44PsbExnDKp7xDVWIy+/1SnnCuJmE=";
+  cargoHash = "sha256-ulsU/QSSNqyZTjM77PQnr3HVUg2dS8SxHv2y6Lsvths=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index c635af0672c7..3d95407fbe81 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -22,12 +22,12 @@
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.144-hardened1.patch",
-            "sha256": "03b2hg01z7fpscgpiw10bvlhq5dph5shdx5zn15csg5vjy6dl2cb",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.144-hardened1/linux-hardened-5.15.144-hardened1.patch"
+            "name": "linux-hardened-5.15.145-hardened1.patch",
+            "sha256": "0jip4c7r41a3nzgv6zzrkjg4flb0ri6ar60l246ixzyp9sv19x9r",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.145-hardened1/linux-hardened-5.15.145-hardened1.patch"
         },
-        "sha256": "0fsv18q64q17ad7mq818wfhb11dax4bdvbvqyk5ilxyfmypsylzh",
-        "version": "5.15.144"
+        "sha256": "086nssif66s86wkixz4yb7xilz1k49g32l0ib28r8fjzc23rv95j",
+        "version": "5.15.145"
     },
     "5.4": {
         "patch": {
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index bddd68d46ae4..13fd2ed4d371 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.7-rc6",
-        "hash": "sha256:164jik11lv35jxfbci3vdb413qi241w51jrisilvfqy8ap0ccs4k"
+        "version": "6.7-rc7",
+        "hash": "sha256:1w1np05mqyviykj0gyx6z2l9ql4f909dy0ximh0gkcpkgy6zz9qc"
     },
     "6.5": {
         "version": "6.5.13",
@@ -12,8 +12,8 @@
         "hash": "sha256:0hdm28k49kmy9r96hckps0bvvaq9m06l72n8ih305rccs6a2cgby"
     },
     "5.15": {
-        "version": "5.15.144",
-        "hash": "sha256:0fsv18q64q17ad7mq818wfhb11dax4bdvbvqyk5ilxyfmypsylzh"
+        "version": "5.15.145",
+        "hash": "sha256:086nssif66s86wkixz4yb7xilz1k49g32l0ib28r8fjzc23rv95j"
     },
     "5.10": {
         "version": "5.10.205",
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 9cf5f46cfb80..9308cba46f13 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19441";
-    sha256 = "1z0x8cw9nr7qf5qh3xjf6rg20q0i79bg71lik847sabyb6vcrk0z";
+    rev = "19453";
+    sha256 = "12jy0kyhl9dsp20yprbw27kzh1p4qxi5m5zy9j7sglm9ajrbnkar";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index ce26a38ed069..58a1be131962 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.201-rt98"; # updated by ./update-rt.sh
+  version = "5.10.204-rt100"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0642y6qj2d4aww6jcki81ba53pvjyfazjxgzgj8brqx8ixchdz3a";
+    sha256 = "1vnamiyr378q52xgkg7kvpx80zck729dim77vp06a3q6n580g5gz";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1g7xbjsfrgins3agz9sq9ia13h5k9605gak7s14z5i4vd34y8pk8";
+      sha256 = "1zbpkira8wf3w46586af72k43j8xkj15f0dgq86z975vl60hdk68";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index ce64711dac42..658dc4a193c3 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -12,8 +12,8 @@ let
   # ./update-zen.py lqx
   lqxVariant = {
     version = "6.6.8"; #lqx
-    suffix = "lqx1"; #lqx
-    sha256 = "04ix6mifnwg1flk2mnjxsajg227svwazhyi8r2h6xwbg0sy80qps"; #lqx
+    suffix = "lqx2"; #lqx
+    sha256 = "1hb6g657ivpnyqw6xsd6b09kwlh4vv11wv68ydcmsd5cg6qmv2zy"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/servers/ebusd/default.nix b/pkgs/servers/ebusd/default.nix
index 318c274cf270..3e0b24c42c86 100644
--- a/pkgs/servers/ebusd/default.nix
+++ b/pkgs/servers/ebusd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ebusd";
-  version = "23.2";
+  version = "23.3";
 
   src = fetchFromGitHub {
     owner = "john30";
     repo = "ebusd";
     rev = version;
-    sha256 = "2CkcTTxEzVrEPtUVVDxXPPkYqZT6+gsCcfTrt83sFv8=";
+    sha256 = "sha256-K3gZ5OudNA92S38U1+HndxjA7OVfh2ymYf8OetB646M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index 3450ea73c68a..42db8a165a55 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.55.0";
+  version = "1.56.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-KF3tbMgcmZHn8u2wPVidH35vi/Aj7xXUvXPXUci6qrM=";
+    sha256 = "sha256-7tnl8iItGegfRXLF3f+tmNxgJWkai6n8EOP00zyqyYs=";
   };
 
-  vendorHash = "sha256-zwWiUXexGI9noHSRC+h9/IT0qdNwPMDZyP3AIKtnRn0=";
+  vendorHash = "sha256-r+VJ2+4F3BQ0tmNTVHDOxKaKAPSIvgu7ZcQZ6BXt2kA=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/servers/web-apps/freshrss/default.nix b/pkgs/servers/web-apps/freshrss/default.nix
index e7eee6515fb7..3c2c27a9e956 100644
--- a/pkgs/servers/web-apps/freshrss/default.nix
+++ b/pkgs/servers/web-apps/freshrss/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , nixosTests
 , php
-, pkgs
 }:
 
 stdenvNoCC.mkDerivation rec {
@@ -31,8 +30,10 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out
     cp -vr * $out/
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 35cdb6311df3..d2f3cc31ca08 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -89,9 +89,9 @@
     else null) null (lib.attrNames archLookupTable);
 
   archLookupTable = table.${localSystem.libc}
-    or (abort "unsupported libc for the pure Linux stdenv");
+    or (throw "unsupported libc for the pure Linux stdenv");
   files = archLookupTable.${localSystem.system} or (if getCompatibleTools != null then getCompatibleTools
-    else (abort "unsupported platform for the pure Linux stdenv"));
+    else (throw "unsupported platform for the pure Linux stdenv"));
   in files
 }:
 
diff --git a/pkgs/tools/filesystems/juicefs/default.nix b/pkgs/tools/filesystems/juicefs/default.nix
index 5df6986380b7..00f45c332cbe 100644
--- a/pkgs/tools/filesystems/juicefs/default.nix
+++ b/pkgs/tools/filesystems/juicefs/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "juicefs";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "juicedata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UtERYOjAKOTK+A1qPdD1PajOkf/t5vqWRBvEuxkZmdg=";
+    sha256 = "sha256-dMzBgwd5tVxE6OFHf6QTZfoqgL/t2pX+OgI6Pki6PG8=";
   };
 
-  vendorHash = "sha256-BpqxCCuWyUgzPyh7sq3/HyQ29qm/PWD7mQFh1nkkAkA=";
+  vendorHash = "sha256-orq03bwN1cbwHoZFXz92tcA2F0oivGR/C5EJDAPA+pk=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/tools/games/gamemode/default.nix b/pkgs/tools/games/gamemode/default.nix
index 25acf8cebb1e..928b9233bccd 100644
--- a/pkgs/tools/games/gamemode/default.nix
+++ b/pkgs/tools/games/gamemode/default.nix
@@ -1,8 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , libgamemode32
+, makeWrapper
 , meson
 , ninja
 , pkg-config
@@ -10,36 +10,28 @@
 , inih
 , systemd
 , appstream
-, makeWrapper
 , findutils
 , gawk
 , procps
+, nix-update-script
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gamemode";
-  version = "1.7";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "FeralInteractive";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-DIFcmWFkoZOklo1keYcCl6n2GJgzWKC8usHFcJmfarU=";
+    repo = "gamemode";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-kusb58nGxYA3U9GbZdW3hLjA3NmHc+af0VT4iGRewBw=";
   };
 
-  outputs = [ "out" "dev" "lib" "man" "static" ];
+  outputs = [ "out" "dev" "lib" "man" ];
 
   patches = [
     # Add @libraryPath@ template variable to fix loading the PRELOAD library
     ./preload-nix-workaround.patch
-    # Do not install systemd sysusers configuration
-    ./no-install-systemd-sysusers.patch
-
-    # fix build with glibc >=2.36 (declaration of pidfd_open)
-    (fetchpatch {
-      url = "https://github.com/FeralInteractive/gamemode/commit/4934191b1928ef695c3e8af21e75781f8591745f.patch";
-      sha256 = "sha256-pWf2NGbd3gEJFwVP/EIJRbTD29V7keTQHy388enktsY=";
-    })
   ];
 
   postPatch = ''
@@ -66,12 +58,15 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    # libexec is just a way to package binaries without including them
-    # in PATH. It doesn't make sense to install them to $lib
-    # (the default behaviour in the meson hook).
-    "--libexecdir=${placeholder "out"}/libexec"
-
+    "-Dwith-pam-limits-dir=etc/security/limits.d"
     "-Dwith-systemd-user-unit-dir=lib/systemd/user"
+    "-Dwith-systemd-group-dir=lib/sysusers.d"
+
+    # The meson builder installs internal executables to $lib/lib by
+    # default, but they should be installed to "$out". It's also more
+    # appropriate to install these executables under a libexec
+    # directory instead of lib.
+    "--libexecdir=libexec"
   ];
 
   doCheck = true;
@@ -79,11 +74,6 @@ stdenv.mkDerivation rec {
     appstream
   ];
 
-  # Move static libraries to $static so $lib only contains dynamic libraries.
-  postInstall = ''
-    moveToOutput lib/*.a "$static"
-  '';
-
   postFixup = ''
     # Add $lib/lib to gamemoded & gamemode-simulate-game's rpath since
     # they use dlopen to load libgamemode. Can't use makeWrapper since
@@ -100,11 +90,15 @@ stdenv.mkDerivation rec {
       ]}
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Optimise Linux system performance on demand";
-    homepage = "https://github.com/FeralInteractive/GameMode";
+    homepage = "https://github.com/FeralInteractive/gamemode";
+    changelog = "https://github.com/FeralInteractive/gamemode/blob/${finalAttrs.version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ kira-bruneau ];
     platforms = platforms.linux;
+    mainProgram = "gamemoderun"; # Requires NixOS module to run
   };
-}
+})
diff --git a/pkgs/tools/games/gamemode/no-install-systemd-sysusers.patch b/pkgs/tools/games/gamemode/no-install-systemd-sysusers.patch
deleted file mode 100644
index 27aa1d4d710c..000000000000
--- a/pkgs/tools/games/gamemode/no-install-systemd-sysusers.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git i/data/meson.build w/data/meson.build
-index 6fb82d8..2e9e170 100644
---- i/data/meson.build
-+++ w/data/meson.build
-@@ -21,11 +21,6 @@ if sd_bus_provider == 'systemd'
-         configuration: data_conf,
-         install_dir: path_systemd_unit_dir,
-     )
--    # Install the sysusers.d file
--    install_data(
--        files('gamemode.conf'),
--        install_dir: path_systemd_sysusers_dir,
--    )
- endif
- 
- # Install the D-BUS service file
diff --git a/pkgs/tools/games/gamemode/preload-nix-workaround.patch b/pkgs/tools/games/gamemode/preload-nix-workaround.patch
index 9c8db37f5d91..06989ff984ab 100644
--- a/pkgs/tools/games/gamemode/preload-nix-workaround.patch
+++ b/pkgs/tools/games/gamemode/preload-nix-workaround.patch
@@ -6,7 +6,7 @@ index 573b3e4..6f2799e 100755
  
  # ld will find the right path to load the library, including for 32-bit apps.
  LD_PRELOAD="${GAMEMODEAUTO_NAME}${LD_PRELOAD:+:$LD_PRELOAD}"
-+LD_LIBRARY_PATH="@libraryPath@${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
++LD_LIBRARY_PATH="@libraryPath@${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
  
 -exec env LD_PRELOAD="${LD_PRELOAD}" $GAMEMODERUNEXEC "$@"
 +exec env LD_PRELOAD="${LD_PRELOAD}" LD_LIBRARY_PATH="${LD_LIBRARY_PATH}" $GAMEMODERUNEXEC "$@"
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 489250776213..a8ab91f8f329 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -75,6 +75,7 @@ python.pkgs.buildPythonApplication rec {
     # esptool is used in esphomeyaml/__main__.py
     # git is used in esphomeyaml/writer.py
     "--prefix PATH : ${lib.makeBinPath [ platformio esptool git ]}"
+    "--prefix PYTHONPATH : $PYTHONPATH" # will show better error messages
     "--set ESPHOME_USE_SUBPROCESS ''"
   ];
 
diff --git a/pkgs/tools/misc/pmbootstrap/default.nix b/pkgs/tools/misc/pmbootstrap/default.nix
index 43a803dfa3e5..6f11a2b3f3b5 100644
--- a/pkgs/tools/misc/pmbootstrap/default.nix
+++ b/pkgs/tools/misc/pmbootstrap/default.nix
@@ -1,21 +1,20 @@
 { stdenv, lib, git, openssl, buildPythonApplication, pytestCheckHook, ps
-, fetchPypi, fetchFromGitLab, sudo }:
+, fetchPypi, fetchFromSourcehut, sudo }:
 
 buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nN4KUP9l3g5Q+QeWr4Fju2GiOyu2f7u94hz/VJlCYdw=";
+    hash = "sha256-buCfQsi10LezDzYeplArmFRSc3vbjtl+FuTm/VUS2us=";
   };
 
-  repo = fetchFromGitLab {
-    domain = "gitlab.com";
-    owner = "postmarketOS";
+  repo = fetchFromSourcehut {
+    owner = "~postmarketos";
     repo = pname;
     rev = version;
-    hash = "sha256-UkgCNob4nazFO8xXyosV+11Sj4yveYBfgh7aw+/6Rlg=";
+    hash = "sha256-3GZ4PeMnG/a46WwvWPQFeYbJPp+NGU7A98QasnlMIL0=";
   };
 
   pmb_test = "${repo}/test";
@@ -45,6 +44,7 @@ buildPythonApplication rec {
     "test_chroot_arguments"
     "test_chroot_interactive_shell"
     "test_chroot_interactive_shell_user"
+    "test_chroot_mount"
     "test_clean_worktree"
     "test_config_user"
     "test_cross_compile_distcc"
diff --git a/pkgs/tools/networking/onetun/default.nix b/pkgs/tools/networking/onetun/default.nix
index ca07db7583a4..5200cff7076f 100644
--- a/pkgs/tools/networking/onetun/default.nix
+++ b/pkgs/tools/networking/onetun/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "onetun";
-  version = "0.3.6";
+  version = "0.3.7";
 
   src = fetchFromGitHub {
     owner = "aramperes";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NH3K/EGFtBcTAxGntneV86zd8eWSV4fFxvr76xtE/mw=";
+    sha256 = "sha256-GVIRCMeuuhUA8lqQ1oI/Xcuf90QIlwhqYeU+HhbGWXQ=";
   };
 
-  cargoHash = "sha256-ZpgcFzQLiOWyhjSI+WcLa0UFUw8zQWfqJkrVVpIexgM=";
+  cargoHash = "sha256-TRfr4riMzR/MbsV2RiQNlPoPLhHK5EScNBCeyyamfgE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
diff --git a/pkgs/tools/security/flare-floss/default.nix b/pkgs/tools/security/flare-floss/default.nix
index 49de8f68ed97..c9a9c8cd1380 100644
--- a/pkgs/tools/security/flare-floss/default.nix
+++ b/pkgs/tools/security/flare-floss/default.nix
@@ -5,15 +5,15 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "flare-floss";
-  version = "2.3.0";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mandiant";
     repo = "flare-floss";
     rev = "refs/tags/v${version}";
     fetchSubmodules = true; # for tests
-    hash = "sha256-tOLnve5XBc3TtSgucPIddBHD0YJhsRpRduXsKrtJ/eQ=";
+    hash = "sha256-bmOWOFqyvOvSrNTbwLqo0WMq4IAZxZ0YYaWCdCrpziU=";
   };
 
   postPatch = ''
@@ -24,7 +24,12 @@ python3.pkgs.buildPythonPackage rec {
       --replace 'sigs_path = os.path.join(get_default_root(), "sigs")' 'sigs_path = "'"$out"'/share/flare-floss/sigs"'
   '';
 
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
+    binary2strings
     halo
     networkx
     pefile
@@ -47,6 +52,10 @@ python3.pkgs.buildPythonPackage rec {
     cp -r floss/sigs $out/share/flare-floss/
   '';
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
   meta = with lib; {
     description = "Automatically extract obfuscated strings from malware";
     homepage = "https://github.com/mandiant/flare-floss";
diff --git a/pkgs/tools/wayland/kanshi/default.nix b/pkgs/tools/wayland/kanshi/default.nix
index c0884acfeadb..6d2d1a4b1a98 100644
--- a/pkgs/tools/wayland/kanshi/default.nix
+++ b/pkgs/tools/wayland/kanshi/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kanshi";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromSourcehut {
     owner = "~emersion";
     repo = "kanshi";
     rev = "v${version}";
-    sha256 = "sha256-5dIBQBA3OMlmaSYswwggFuedsb3i4uy9bcTZahIS2gQ=";
+    sha256 = "sha256-vxysZWFcfYwOgFMcRuPzYpWmFOFMiwc62DqI+nTQ4MI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 37f51bc7c50c..d26fec5d1277 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24464,7 +24464,7 @@ with pkgs;
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_1
     openssl_3
-    openssl_3_1;
+    openssl_3_2;
 
   opensubdiv = callPackage ../development/libraries/opensubdiv { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7669bf2db61e..0c2464cb071c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22693,10 +22693,10 @@ with self; {
 
   SpreadsheetParseExcel = buildPerlPackage {
     pname = "Spreadsheet-ParseExcel";
-    version = "0.65";
+    version = "0.66";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DO/DOUGW/Spreadsheet-ParseExcel-0.65.tar.gz";
-      hash = "sha256-bsTLQpvVjYFkD+EhFvQ1xG9R/xBAxo8JzIt2gcFnW+w=";
+      url = "mirror://cpan/authors/id/J/JM/JMCNAMARA/Spreadsheet-ParseExcel-0.66.tar.gz";
+      hash = "sha256-v9dqz7qYhgHcBRvac7S7JfaDmgBt2WC2p0AcJJJF9ls=";
     };
     propagatedBuildInputs = [ CryptRC4 DigestPerlMD5 IOStringy OLEStorage_Lite ];
     meta = {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 712227faac61..f62509cf1805 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1461,6 +1461,8 @@ self: super: with self; {
 
   binary = callPackage ../development/python-modules/binary { };
 
+  binary2strings = callPackage ../development/python-modules/binary2strings { };
+
   binaryornot = callPackage ../development/python-modules/binaryornot { };
 
   bincopy = callPackage ../development/python-modules/bincopy { };
@@ -10620,6 +10622,8 @@ self: super: with self; {
     inherit (pkgs) libusb1;
   };
 
+  pylibjpeg = callPackage ../development/python-modules/pylibjpeg { };
+
   pylibjpeg-libjpeg = callPackage ../development/python-modules/pylibjpeg-libjpeg { };
 
   pyliblo = callPackage ../development/python-modules/pyliblo { };
@@ -13142,6 +13146,8 @@ self: super: with self; {
 
   simber = callPackage ../development/python-modules/simber { };
 
+  simple-term-menu = callPackage ../development/python-modules/simple-term-menu { };
+
   simpleaudio = callPackage ../development/python-modules/simpleaudio { };
 
   simplebayes = callPackage ../development/python-modules/simplebayes { };