diff --git a/nixos/modules/programs/partition-manager.nix b/nixos/modules/programs/partition-manager.nix
index c18598b7c25d..cf0491ff028f 100644
--- a/nixos/modules/programs/partition-manager.nix
+++ b/nixos/modules/programs/partition-manager.nix
@@ -14,6 +14,6 @@ with lib;
   config = mkIf config.programs.partition-manager.enable {
     services.dbus.packages = [ pkgs.libsForQt5.kpmcore ];
     # `kpmcore` need to be installed to pull in polkit actions.
-    environment.systemPackages = [ pkgs.libsForQt5.kpmcore pkgs.partition-manager ];
+    environment.systemPackages = [ pkgs.libsForQt5.kpmcore pkgs.libsForQt5.partitionmanager ];
   };
 }
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index e771b706bece..fdb149a3d9a1 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -123,8 +123,8 @@ in
       inherit assertions;
       # needed for systemd-remount-fs
       system.fsPackages = [ pkgs.bcachefs-tools ];
-      # FIXME: Replace this with `linuxPackages_latest` when 6.7 is released, remove this line when the LTS version is at least 6.7
-      boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_testing;
+      # FIXME: Remove this line when the default kernel has bcachefs
+      boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
       systemd.services = lib.mapAttrs' (mkUnits "") (lib.filterAttrs (n: fs: (fs.fsType == "bcachefs") && (!utils.fsNeededForBoot fs)) config.fileSystems);
     }
 
diff --git a/pkgs/applications/audio/tidal-hifi/default.nix b/pkgs/applications/audio/tidal-hifi/default.nix
index 557d43603786..98bb8a562885 100644
--- a/pkgs/applications/audio/tidal-hifi/default.nix
+++ b/pkgs/applications/audio/tidal-hifi/default.nix
@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tidal-hifi";
-  version = "5.7.1";
+  version = "5.8.0";
 
   src = fetchurl {
     url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${finalAttrs.version}/tidal-hifi_${finalAttrs.version}_amd64.deb";
-    sha256 = "sha256-7wBQgoglLS67aiQsF9iUeFoJDDqq0fJgu5BSyH+HI7M=";
+    sha256 = "sha256-g3CDoFeXGLj/bG0WP8fCF/uphqEHfKA/wmfQfjk52aM=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 840ec65428af..946a9844b793 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -7,7 +7,7 @@
 , nodePackages
 , python3Packages
 , jdk
-, llvmPackages_8
+, llvmPackages
 , llvmPackages_14
 , nixpkgs-fmt
 , protobuf
@@ -2162,7 +2162,7 @@ let
         };
       };
 
-      llvm-org.lldb-vscode = llvmPackages_8.lldb;
+      llvm-org.lldb-vscode = llvmPackages.lldb;
 
       llvm-vs-code-extensions.vscode-clangd = buildVscodeMarketplaceExtension {
         mktplcRef = {
diff --git a/pkgs/applications/kde/default.nix b/pkgs/applications/kde/default.nix
index ab2c10d15779..3fd389471975 100644
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@@ -187,6 +187,7 @@ let
       kpat = callPackage ./kpat.nix {};
       kpimtextedit = callPackage ./kpimtextedit.nix {};
       kpkpass = callPackage ./kpkpass.nix {};
+      kpmcore = callPackage ./kpmcore {};
       kpublictransport = callPackage ./kpublictransport.nix {};
       kqtquickcharts = callPackage ./kqtquickcharts.nix {};
       krdc = callPackage ./krdc.nix {};
@@ -230,6 +231,7 @@ let
       minuet = callPackage ./minuet.nix {};
       okular = callPackage ./okular.nix {};
       palapeli = callPackage ./palapeli.nix {};
+      partitionmanager = callPackage ./partitionmanager {};
       picmi = callPackage ./picmi.nix {};
       pim-data-exporter = callPackage ./pim-data-exporter.nix {};
       pim-sieve-editor = callPackage ./pim-sieve-editor.nix {};
diff --git a/pkgs/development/libraries/kpmcore/default.nix b/pkgs/applications/kde/kpmcore/default.nix
similarity index 75%
rename from pkgs/development/libraries/kpmcore/default.nix
rename to pkgs/applications/kde/kpmcore/default.nix
index 260a94e06ade..4bfc4db0f4a5 100644
--- a/pkgs/development/libraries/kpmcore/default.nix
+++ b/pkgs/applications/kde/kpmcore/default.nix
@@ -1,6 +1,5 @@
-{ stdenv
+{ mkDerivation
 , lib
-, fetchurl
 , extra-cmake-modules
 , qca-qt5
 , kauth
@@ -9,15 +8,8 @@
 , util-linux
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "kpmcore";
-  # NOTE: When changing this version, also change the version of `partition-manager`.
-  version = "23.04.1";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/release-service/${version}/src/${pname}-${version}.tar.xz";
-    hash = "sha256-NFIq8CZwYvpqDOOYLlBqoGdgfNPsyf15FkB3dToDCB8=";
-  };
 
   patches = [
     ./nixostrustedprefix.patch
diff --git a/pkgs/development/libraries/kpmcore/nixostrustedprefix.patch b/pkgs/applications/kde/kpmcore/nixostrustedprefix.patch
similarity index 100%
rename from pkgs/development/libraries/kpmcore/nixostrustedprefix.patch
rename to pkgs/applications/kde/kpmcore/nixostrustedprefix.patch
diff --git a/pkgs/tools/misc/partition-manager/default.nix b/pkgs/applications/kde/partitionmanager/default.nix
similarity index 88%
rename from pkgs/tools/misc/partition-manager/default.nix
rename to pkgs/applications/kde/partitionmanager/default.nix
index 8dde1e68bd29..a898984d4502 100644
--- a/pkgs/tools/misc/partition-manager/default.nix
+++ b/pkgs/applications/kde/partitionmanager/default.nix
@@ -65,15 +65,8 @@ let
   ];
 
 in
-mkDerivation rec {
+mkDerivation {
   pname = "partitionmanager";
-  # NOTE: When changing this version, also change the version of `kpmcore`.
-  version = "23.04.1";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/release-service/${version}/src/${pname}-${version}.tar.xz";
-    hash = "sha256-iMf6/QOJIDTKHAsCg3ey4GX0QHwrYl2LcCWxZsolMl8=";
-  };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
 
diff --git a/pkgs/applications/terminal-emulators/rio/default.nix b/pkgs/applications/terminal-emulators/rio/default.nix
index 8409ec883c52..afb380134b58 100644
--- a/pkgs/applications/terminal-emulators/rio/default.nix
+++ b/pkgs/applications/terminal-emulators/rio/default.nix
@@ -51,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rio";
-  version = "0.0.33";
+  version = "0.0.34";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     rev = "v${version}";
-    hash = "sha256-/SpSOcxuEL2vsqbZAqbjTgnLhcyr0/ckfvcI1nwkWFg=";
+    hash = "sha256-UHA2j7NOPBl7qrCu5bWLHjpVgWxlydtj0F7lfAlQZXg=";
   };
 
-  cargoHash = "sha256-hXO/hdHmYjbwR3Ae5VV/HB1SVp/jhY05fIxi04n7X/Y=";
+  cargoHash = "sha256-xqLticREnGxsuo2d7d3VaFWbGJ5A1L7GvDwV7qQ61xs=";
 
   nativeBuildInputs = [
     ncurses
diff --git a/pkgs/applications/version-management/gittyup/default.nix b/pkgs/applications/version-management/gittyup/default.nix
index 51cbacdcf37f..822ff838df0c 100644
--- a/pkgs/applications/version-management/gittyup/default.nix
+++ b/pkgs/applications/version-management/gittyup/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     description = "A graphical Git client designed to help you understand and manage your source code history";
     homepage = "https://murmele.github.io/Gittyup";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ thiagokokada ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.unix;
     broken = stdenv.isDarwin;
   };
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 0b9f696d1cb8..bdb79d9bf463 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -9,31 +9,41 @@ in
 
 rec {
 
-  /* Run the shell command `buildCommand' to produce a store path named
-   `name'.  The attributes in `env' are added to the environment
-   prior to running the command. By default `runCommand` runs in a
-   stdenv with no compiler environment. `runCommandCC` uses the default
-   stdenv, `pkgs.stdenv`.
+  /*
+    Run the shell command `buildCommand' to produce a store path named `name'.
 
-   Example:
+    The attributes in `env' are added to the environment prior to running the command.
+    Environment variables set by `stdenv.mkDerivation` take precedence.
 
+    By default `runCommand` runs in a stdenv with no compiler environment.
+    `runCommandCC` uses the default stdenv, `pkgs.stdenv`.
 
-   runCommand "name" {envVariable = true;} ''echo hello > $out''
-   runCommandCC "name" {} ''gcc -o myfile myfile.c; cp myfile $out'';
+    Example:
 
+    ```nix
+    runCommand "name" {envVariable = true;} ''echo hello > $out'';
+    ```
 
-   The `*Local` variants force a derivation to be built locally,
-   it is not substituted.
+    ```nix
+    runCommandCC "name" {} ''gcc -o myfile myfile.c; cp myfile $out'';
+    ```
 
-   This is intended for very cheap commands (<1s execution time).
-   It saves on the network roundrip and can speed up a build.
+    The `*Local` variants force a derivation to be built locally,
+    it is not substituted.
 
-   It is the same as adding the special fields
+    This is intended for very cheap commands (<1s execution time).
+    It saves on the network roundrip and can speed up a build.
 
-   `preferLocalBuild = true;`
-   `allowSubstitutes = false;`
+    It is the same as adding the special fields
 
-   to a derivation’s attributes.
+    ```nix
+    {
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+    }
+    ```
+
+    to a derivation’s attributes.
   */
   runCommand = name: env: runCommandWith {
     stdenv = stdenvNoCC;
@@ -57,7 +67,8 @@ rec {
   # `runCommandCCLocal` left out on purpose.
   # We shouldn’t force the user to have a cc in scope.
 
-  /* Generalized version of the `runCommand`-variants
+  /*
+    Generalized version of the `runCommand`-variants
     which does customized behavior via a single
     attribute set passed as the first argument
     instead of having a lot of variants like
@@ -72,36 +83,37 @@ rec {
       defaultStdenv = stdenv;
     in
     {
-    # which stdenv to use, defaults to a stdenv with a C compiler, pkgs.stdenv
+      # which stdenv to use, defaults to a stdenv with a C compiler, pkgs.stdenv
       stdenv ? defaultStdenv
-    # whether to build this derivation locally instead of substituting
+      # whether to build this derivation locally instead of substituting
     , runLocal ? false
-    # extra arguments to pass to stdenv.mkDerivation
-    , derivationArgs ? {}
-    # name of the resulting derivation
+      # extra arguments to pass to stdenv.mkDerivation
+    , derivationArgs ? { }
+      # name of the resulting derivation
     , name
-    # TODO(@Artturin): enable strictDeps always
+      # TODO(@Artturin): enable strictDeps always
     }: buildCommand:
-    stdenv.mkDerivation ({
-      enableParallelBuilding = true;
-      inherit buildCommand name;
-      passAsFile = [ "buildCommand" ]
-        ++ (derivationArgs.passAsFile or []);
-    }
-    // lib.optionalAttrs (! derivationArgs?meta) {
-      pos = let args = builtins.attrNames derivationArgs; in
-        if builtins.length args > 0
-        then builtins.unsafeGetAttrPos (builtins.head args) derivationArgs
-        else null;
-    }
-    // (lib.optionalAttrs runLocal {
-          preferLocalBuild = true;
-          allowSubstitutes = false;
-       })
-    // builtins.removeAttrs derivationArgs [ "passAsFile" ]);
+      stdenv.mkDerivation ({
+        enableParallelBuilding = true;
+        inherit buildCommand name;
+        passAsFile = [ "buildCommand" ]
+          ++ (derivationArgs.passAsFile or [ ]);
+      }
+      // lib.optionalAttrs (! derivationArgs?meta) {
+        pos = let args = builtins.attrNames derivationArgs; in
+          if builtins.length args > 0
+          then builtins.unsafeGetAttrPos (builtins.head args) derivationArgs
+          else null;
+      }
+      // (lib.optionalAttrs runLocal {
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+      })
+      // builtins.removeAttrs derivationArgs [ "passAsFile" ]);
 
 
-  /* Writes a text file to the nix store.
+  /*
+    Writes a text file to the nix store.
     The contents of text is added to the file in the store.
 
     Example:
@@ -145,11 +157,13 @@ rec {
       matches = builtins.match "/bin/([^/]+)" destination;
     in
     runCommand name
-      { inherit text executable checkPhase allowSubstitutes preferLocalBuild;
+      {
+        inherit text executable checkPhase allowSubstitutes preferLocalBuild;
         passAsFile = [ "text" ];
-        meta = lib.optionalAttrs (executable && matches != null) {
-          mainProgram = lib.head matches;
-        } // meta;
+        meta = lib.optionalAttrs (executable && matches != null)
+          {
+            mainProgram = lib.head matches;
+          } // meta;
       }
       ''
         target=$out${lib.escapeShellArg destination}
@@ -169,20 +183,20 @@ rec {
       '';
 
   /*
-   Writes a text file to nix store with no optional parameters available.
+     Writes a text file to nix store with no optional parameters available.
 
-   Example:
+     Example:
 
 
-   # Writes contents of file to /nix/store/<store path>
-   writeText "my-file"
+     # Writes contents of file to /nix/store/<store path>
+     writeText "my-file"
      ''
      Contents of File
      '';
 
 
   */
-  writeText = name: text: writeTextFile {inherit name text;};
+  writeText = name: text: writeTextFile { inherit name text; };
 
   /*
     Writes a text file to nix store in a specific directory with no
@@ -224,7 +238,7 @@ rec {
 
 
   */
-  writeScript = name: text: writeTextFile {inherit name text; executable = true;};
+  writeScript = name: text: writeTextFile { inherit name text; executable = true; };
 
   /*
     Writes a text file to /nix/store/<store path>/bin/<name> and
@@ -270,7 +284,7 @@ rec {
       text = ''
         #!${runtimeShell}
         ${text}
-        '';
+      '';
       checkPhase = ''
         ${stdenv.shellDryRun} "$target"
       '';
@@ -292,7 +306,7 @@ rec {
 
 
   */
-  writeShellScriptBin = name : text :
+  writeShellScriptBin = name: text:
     writeTextFile {
       inherit name;
       executable = true;
@@ -300,7 +314,7 @@ rec {
       text = ''
         #!${runtimeShell}
         ${text}
-        '';
+      '';
       checkPhase = ''
         ${stdenv.shellDryRun} "$target"
       '';
@@ -340,7 +354,7 @@ rec {
     , runtimeInputs ? [ ]
     , meta ? { }
     , checkPhase ? null
-    , excludeShellChecks ? [  ]
+    , excludeShellChecks ? [ ]
     }:
     writeTextFile {
       inherit name meta;
@@ -366,7 +380,7 @@ rec {
         # but we still want to use writeShellApplication on those platforms
         let
           shellcheckSupported = lib.meta.availableOn stdenv.buildPlatform shellcheck-minimal.compiler;
-          excludeOption = lib.optionalString (excludeShellChecks != [  ]) "--exclude '${lib.concatStringsSep "," excludeShellChecks}'";
+          excludeOption = lib.optionalString (excludeShellChecks != [ ]) "--exclude '${lib.concatStringsSep "," excludeShellChecks}'";
           shellcheckCommand = lib.optionalString shellcheckSupported ''
             # use shellcheck which does not include docs
             # pandoc takes long to build and documentation isn't needed for just running the cli
@@ -385,23 +399,23 @@ rec {
   # Create a C binary
   writeCBin = pname: code:
     runCommandCC pname
-    {
-      inherit pname code;
-      executable = true;
-      passAsFile = ["code"];
-      # Pointless to do this on a remote machine.
-      preferLocalBuild = true;
-      allowSubstitutes = false;
-      meta = {
-        mainProgram = pname;
-      };
-    }
-    ''
-      n=$out/bin/${pname}
-      mkdir -p "$(dirname "$n")"
-      mv "$codePath" code.c
-      $CC -x c code.c -o "$n"
-    '';
+      {
+        inherit pname code;
+        executable = true;
+        passAsFile = [ "code" ];
+        # Pointless to do this on a remote machine.
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+        meta = {
+          mainProgram = pname;
+        };
+      }
+      ''
+        n=$out/bin/${pname}
+        mkdir -p "$(dirname "$n")"
+        mv "$codePath" code.c
+        $CC -x c code.c -o "$n"
+      '';
 
 
   /* concat a list of files to the nix store.
@@ -532,19 +546,20 @@ rec {
    */
   symlinkJoin =
     args_@{ name
-         , paths
-         , preferLocalBuild ? true
-         , allowSubstitutes ? false
-         , postBuild ? ""
-         , ...
-         }:
+    , paths
+    , preferLocalBuild ? true
+    , allowSubstitutes ? false
+    , postBuild ? ""
+    , ...
+    }:
     let
       args = removeAttrs args_ [ "name" "postBuild" ]
         // {
-          inherit preferLocalBuild allowSubstitutes;
-          passAsFile = [ "paths" ];
-        }; # pass the defaults
-    in runCommand name args
+        inherit preferLocalBuild allowSubstitutes;
+        passAsFile = [ "paths" ];
+      }; # pass the defaults
+    in
+    runCommand name args
       ''
         mkdir -p $out
         for i in $(cat $pathsPath); do
@@ -584,27 +599,30 @@ rec {
     See the note on symlinkJoin for the difference between linkFarm and symlinkJoin.
    */
   linkFarm = name: entries:
-  let
-    entries' =
-      if (lib.isAttrs entries) then entries
-      # We do this foldl to have last-wins semantics in case of repeated entries
-      else if (lib.isList entries) then lib.foldl (a: b: a // { "${b.name}" = b.path; }) { } entries
-      else throw "linkFarm entries must be either attrs or a list!";
+    let
+      entries' =
+        if (lib.isAttrs entries) then entries
+        # We do this foldl to have last-wins semantics in case of repeated entries
+        else if (lib.isList entries) then lib.foldl (a: b: a // { "${b.name}" = b.path; }) { } entries
+        else throw "linkFarm entries must be either attrs or a list!";
 
-    linkCommands = lib.mapAttrsToList (name: path: ''
-      mkdir -p "$(dirname ${lib.escapeShellArg "${name}"})"
-      ln -s ${lib.escapeShellArg "${path}"} ${lib.escapeShellArg "${name}"}
-    '') entries';
-  in
-  runCommand name {
-    preferLocalBuild = true;
-    allowSubstitutes = false;
-    passthru.entries = entries';
-   } ''
-    mkdir -p $out
-    cd $out
-    ${lib.concatStrings linkCommands}
-  '';
+      linkCommands = lib.mapAttrsToList
+        (name: path: ''
+          mkdir -p "$(dirname ${lib.escapeShellArg "${name}"})"
+          ln -s ${lib.escapeShellArg "${path}"} ${lib.escapeShellArg "${name}"}
+        '')
+        entries';
+    in
+    runCommand name
+      {
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+        passthru.entries = entries';
+      } ''
+      mkdir -p $out
+      cd $out
+      ${lib.concatStrings linkCommands}
+    '';
 
   /*
     Easily create a linkFarm from a set of derivations.
@@ -639,7 +657,7 @@ rec {
     bin output and other contents of the package's output (e.g. setup
     hooks) cause trouble when used in your environment.
   */
-  onlyBin = drv: runCommand "${drv.name}-only-bin" {} ''
+  onlyBin = drv: runCommand "${drv.name}-only-bin" { } ''
     mkdir -p $out
     ln -s ${lib.getBin drv}/bin $out/bin
   '';
@@ -675,14 +693,14 @@ rec {
         # TODO 2023-01, no backport: simplify to inherit passthru;
         passthru = passthru
           // optionalAttrs (substitutions?passthru)
-            (warn "makeSetupHook (name = ${lib.strings.escapeNixString name}): `substitutions.passthru` is deprecated. Please set `passthru` directly."
-              substitutions.passthru);
+          (warn "makeSetupHook (name = ${lib.strings.escapeNixString name}): `substitutions.passthru` is deprecated. Please set `passthru` directly."
+            substitutions.passthru);
       })
       (''
         mkdir -p $out/nix-support
         cp ${script} $out/nix-support/setup-hook
         recordPropagatedDependencies
-      '' + lib.optionalString (substitutions != {}) ''
+      '' + lib.optionalString (substitutions != { }) ''
         substituteAll ${script} $out/nix-support/setup-hook
       '');
 
@@ -691,7 +709,7 @@ rec {
 
   writeReferencesToFile = path: runCommand "runtime-deps"
     {
-      exportReferencesGraph = ["graph" path];
+      exportReferencesGraph = [ "graph" path ];
     }
     ''
       touch $out
@@ -710,7 +728,7 @@ rec {
    */
   writeDirectReferencesToFile = path: runCommand "runtime-references"
     {
-      exportReferencesGraph = ["graph" path];
+      exportReferencesGraph = [ "graph" path ];
       inherit path;
     }
     ''
@@ -744,17 +762,17 @@ rec {
    */
   writeStringReferencesToFile = string:
     /*
-     The basic operation this performs is to copy the string context
-     from `string' to a second string and wrap that string in a
-     derivation. However, that alone is not enough, since nothing in the
-     string refers to the output paths of the derivations/paths in its
-     context, meaning they'll be considered build-time dependencies and
-     removed from the wrapper derivation's closure. Putting the
-     necessary output paths in the new string is however not very
-     straightforward - the attrset returned by `getContext' contains
-     only references to derivations' .drv-paths, not their output
-     paths. In order to "convert" them, we try to extract the
-     corresponding paths from the original string using regex.
+       The basic operation this performs is to copy the string context
+       from `string' to a second string and wrap that string in a
+       derivation. However, that alone is not enough, since nothing in the
+       string refers to the output paths of the derivations/paths in its
+       context, meaning they'll be considered build-time dependencies and
+       removed from the wrapper derivation's closure. Putting the
+       necessary output paths in the new string is however not very
+       straightforward - the attrset returned by `getContext' contains
+       only references to derivations' .drv-paths, not their output
+       paths. In order to "convert" them, we try to extract the
+       corresponding paths from the original string using regex.
     */
     let
       # Taken from https://github.com/NixOS/nix/blob/130284b8508dad3c70e8160b15f3d62042fc730a/src/libutil/hash.cc#L84
@@ -798,21 +816,21 @@ rec {
               if lib.elem "out" value.outputs then
                 lib.filter
                   (x: lib.isList x &&
-                      # If the matched path is in `namedOutputPaths`,
-                      # it's a partial match of an output path where
-                      # the output name isn't `out`
-                      lib.all (o: !lib.hasPrefix (lib.head x) o) namedOutputPaths)
+                    # If the matched path is in `namedOutputPaths`,
+                    # it's a partial match of an output path where
+                    # the output name isn't `out`
+                    lib.all (o: !lib.hasPrefix (lib.head x) o) namedOutputPaths)
                   (builtins.split "(${builtins.storeDir}/[${nixHashChars}]+-${name})" string)
               else
-                [])
+                [ ])
             packages);
       allPaths = lib.concatStringsSep "\n" (lib.unique (sources ++ namedOutputPaths ++ outputPaths));
       allPathsWithContext = builtins.appendContext allPaths context;
     in
-      if builtins ? getContext then
-        writeText "string-references" allPathsWithContext
-      else
-        writeDirectReferencesToFile (writeText "string-file" string);
+    if builtins ? getContext then
+      writeText "string-references" allPathsWithContext
+    else
+      writeDirectReferencesToFile (writeText "string-file" string);
 
 
   /* Print an error message if the file with the specified name and
@@ -830,55 +848,59 @@ rec {
     }
 
    */
-  requireFile = { name ? null
-                , sha256 ? null
-                , sha1 ? null
-                , hash ? null
-                , url ? null
-                , message ? null
-                , hashMode ? "flat"
-                } :
-    assert (message != null) || (url != null);
-    assert (sha256 != null) || (sha1 != null) || (hash != null);
-    assert (name != null) || (url != null);
-    let msg =
-      if message != null then message
-      else ''
-        Unfortunately, we cannot download file ${name_} automatically.
-        Please go to ${url} to download it yourself, and add it to the Nix store
-        using either
-          nix-store --add-fixed ${hashAlgo} ${name_}
-        or
-          nix-prefetch-url --type ${hashAlgo} file:///path/to/${name_}
-      '';
-      hashAlgo = if hash != null then (builtins.head (lib.strings.splitString "-" hash))
-            else if sha256 != null then "sha256"
-            else "sha1";
-      hashAlgo_ = if hash != null then "" else hashAlgo;
-      hash_ = if hash != null then hash
-         else if sha256 != null then sha256
-         else sha1;
-      name_ = if name == null then baseNameOf (toString url) else name;
-    in
-    stdenvNoCC.mkDerivation {
-      name = name_;
-      outputHashMode = hashMode;
-      outputHashAlgo = hashAlgo_;
-      outputHash = hash_;
-      preferLocalBuild = true;
-      allowSubstitutes = false;
-      builder = writeScript "restrict-message" ''
-        source ${stdenvNoCC}/setup
-        cat <<_EOF_
+  requireFile =
+    { name ? null
+    , sha256 ? null
+    , sha1 ? null
+    , hash ? null
+    , url ? null
+    , message ? null
+    , hashMode ? "flat"
+    }:
+      assert (message != null) || (url != null);
+      assert (sha256 != null) || (sha1 != null) || (hash != null);
+      assert (name != null) || (url != null);
+      let
+        msg =
+          if message != null then message
+          else ''
+            Unfortunately, we cannot download file ${name_} automatically.
+            Please go to ${url} to download it yourself, and add it to the Nix store
+            using either
+              nix-store --add-fixed ${hashAlgo} ${name_}
+            or
+              nix-prefetch-url --type ${hashAlgo} file:///path/to/${name_}
+          '';
+        hashAlgo =
+          if hash != null then (builtins.head (lib.strings.splitString "-" hash))
+          else if sha256 != null then "sha256"
+          else "sha1";
+        hashAlgo_ = if hash != null then "" else hashAlgo;
+        hash_ =
+          if hash != null then hash
+          else if sha256 != null then sha256
+          else sha1;
+        name_ = if name == null then baseNameOf (toString url) else name;
+      in
+      stdenvNoCC.mkDerivation {
+        name = name_;
+        outputHashMode = hashMode;
+        outputHashAlgo = hashAlgo_;
+        outputHash = hash_;
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+        builder = writeScript "restrict-message" ''
+          source ${stdenvNoCC}/setup
+          cat <<_EOF_
 
-        ***
-        ${msg}
-        ***
+          ***
+          ${msg}
+          ***
 
-        _EOF_
-        exit 1
-      '';
-    };
+          _EOF_
+          exit 1
+        '';
+      };
 
 
   /*
@@ -915,39 +937,42 @@ rec {
   applyPatches =
     { src
     , name ? (if builtins.typeOf src == "path"
-              then builtins.baseNameOf src
-              else
-                if builtins.isAttrs src && builtins.hasAttr "name" src
-                then src.name
-                else throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
-             ) + "-patched"
-    , patches   ? []
+      then builtins.baseNameOf src
+      else
+        if builtins.isAttrs src && builtins.hasAttr "name" src
+        then src.name
+        else throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
+      ) + "-patched"
+    , patches ? [ ]
     , postPatch ? ""
     , ...
-    }@args: stdenvNoCC.mkDerivation {
-      inherit name src patches postPatch;
-      preferLocalBuild = true;
-      allowSubstitutes = false;
-      phases = "unpackPhase patchPhase installPhase";
-      installPhase = "cp -R ./ $out";
-    }
+    }@args: stdenvNoCC.mkDerivation
+      {
+        inherit name src patches postPatch;
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+        phases = "unpackPhase patchPhase installPhase";
+        installPhase = "cp -R ./ $out";
+      }
     # Carry `meta` information from the underlying `src` if present.
     // (optionalAttrs (src?meta) { inherit (src) meta; })
     // (removeAttrs args [ "src" "name" "patches" "postPatch" ]);
 
   /* An immutable file in the store with a length of 0 bytes. */
-  emptyFile = runCommand "empty-file" {
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-    outputHash = "0ip26j2h11n1kgkz36rl4akv694yz65hr72q4kv4b3lxcbi65b3p";
-    preferLocalBuild = true;
-  } "touch $out";
+  emptyFile = runCommand "empty-file"
+    {
+      outputHashAlgo = "sha256";
+      outputHashMode = "recursive";
+      outputHash = "0ip26j2h11n1kgkz36rl4akv694yz65hr72q4kv4b3lxcbi65b3p";
+      preferLocalBuild = true;
+    } "touch $out";
 
   /* An immutable empty directory in the store. */
-  emptyDirectory = runCommand "empty-directory" {
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-    outputHash = "0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5";
-    preferLocalBuild = true;
-  } "mkdir $out";
+  emptyDirectory = runCommand "empty-directory"
+    {
+      outputHashAlgo = "sha256";
+      outputHashMode = "recursive";
+      outputHash = "0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5";
+      preferLocalBuild = true;
+    } "mkdir $out";
 }
diff --git a/pkgs/by-name/di/disko/package.nix b/pkgs/by-name/di/disko/package.nix
new file mode 100644
index 000000000000..0ac7101283eb
--- /dev/null
+++ b/pkgs/by-name/di/disko/package.nix
@@ -0,0 +1,39 @@
+{ stdenvNoCC
+, makeWrapper
+, lib
+, fetchFromGitHub
+, bash
+, nix
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  name = "disko";
+  version = "1.3.0";
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "disko";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-wOIJwAsnZhM0NlFRwYJRgO4Lldh8j9viyzwQXtrbNtM=";
+  };
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];
+  installPhase = ''
+    mkdir -p $out/bin $out/share/disko
+    cp -r cli.nix default.nix disk-deactivate lib $out/share/disko
+    sed -e "s|libexec_dir=\".*\"|libexec_dir=\"$out/share/disko\"|" disko > $out/bin/disko
+    chmod 755 $out/bin/disko
+    wrapProgram $out/bin/disko --prefix PATH : ${lib.makeBinPath [ nix ]}
+  '';
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/disko --help
+  '';
+  meta = {
+    homepage = "https://github.com/nix-community/disko";
+    description = "Declarative disk partitioning and formatting using nix";
+    license = lib.licenses.mit;
+    mainProgram = "disko";
+    maintainers = with lib.maintainers; [ mic92 lassulus ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix b/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix
index 782fcf0fa89e..c05c4b9b0a25 100644
--- a/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix
+++ b/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pantheon-tweaks";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "pantheon-tweaks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-KYnrQnh/Zz3EjMAqasdk2CZMXzw15txKtPm/K5+FzhI=";
+    sha256 = "sha256-E9YSRfh9bLAHn2y4p3aKwR5NOtexKokLWj3RwtDnLsQ=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/llvm/common/lldb.nix b/pkgs/development/compilers/llvm/common/lldb.nix
index 3ab71a8d3e9d..23ed4a2a2042 100644
--- a/pkgs/development/compilers/llvm/common/lldb.nix
+++ b/pkgs/development/compilers/llvm/common/lldb.nix
@@ -159,6 +159,10 @@ stdenv.mkDerivation (rec {
     ln -s $out/bin/*-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
   '';
 
+  passthru.vscodeExtName = "lldb-vscode";
+  passthru.vscodeExtPublisher = "llvm";
+  passthru.vscodeExtUniqueId = "llvm-org.lldb-vscode-0.1.0";
+
   meta = llvm_meta // {
     homepage = "https://lldb.llvm.org/";
     description = "A next-generation high-performance debugger";
diff --git a/pkgs/development/compilers/pakcs/curry-base.nix b/pkgs/development/compilers/pakcs/curry-base.nix
deleted file mode 100644
index c461d2caa93c..000000000000
--- a/pkgs/development/compilers/pakcs/curry-base.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ mkDerivation, base, Cabal, containers, directory, extra, filepath
-, mtl, parsec, pretty, lib, time, transformers
-}:
-mkDerivation {
-  pname = "curry-base";
-  version = "1.1.0";
-  src = ./.;
-  libraryHaskellDepends = [
-    base containers directory extra filepath mtl parsec pretty time
-    transformers
-  ];
-  testHaskellDepends = [ base Cabal filepath mtl ];
-  homepage = "http://curry-language.org";
-  description = "Functions for manipulating Curry programs";
-  license = lib.licenses.bsd3;
-}
diff --git a/pkgs/development/compilers/pakcs/curry-frontend.nix b/pkgs/development/compilers/pakcs/curry-frontend.nix
index 88e88487594b..acf658024b01 100644
--- a/pkgs/development/compilers/pakcs/curry-frontend.nix
+++ b/pkgs/development/compilers/pakcs/curry-frontend.nix
@@ -1,26 +1,28 @@
-{ mkDerivation, base, bytestring, Cabal, containers, curry-base
-, directory, extra, file-embed, filepath, mtl, network-uri, pretty
-, process, set-extra, lib, template-haskell, transformers
+{ mkDerivation, base, binary, bytestring, Cabal, containers
+, directory, extra, file-embed, filepath, lib, mtl, network-uri
+, parsec, pretty, process, set-extra, template-haskell, time
+, transformers
 }:
 mkDerivation {
   pname = "curry-frontend";
-  version = "1.0.4";
+  version = "2.1.0";
   src = ./.;
   isLibrary = true;
   isExecutable = true;
   enableSeparateDataOutput = true;
   libraryHaskellDepends = [
-    base bytestring containers curry-base directory extra file-embed
+    base binary bytestring containers directory extra file-embed
+    filepath mtl network-uri parsec pretty process set-extra
+    template-haskell time transformers
+  ];
+  executableHaskellDepends = [ base ];
+  testHaskellDepends = [
+    base bytestring Cabal containers directory extra file-embed
     filepath mtl network-uri pretty process set-extra template-haskell
     transformers
   ];
-  executableHaskellDepends = [
-    base bytestring containers curry-base directory extra file-embed
-    filepath mtl network-uri pretty process set-extra template-haskell
-    transformers
-  ];
-  testHaskellDepends = [ base Cabal curry-base filepath ];
   homepage = "http://curry-language.org";
   description = "Compile the functional logic language Curry to several intermediate formats";
   license = lib.licenses.bsd3;
+  mainProgram = "curry-frontend";
 }
diff --git a/pkgs/development/compilers/pakcs/default.nix b/pkgs/development/compilers/pakcs/default.nix
index e38f4e8c02ba..42b2e208c1d4 100644
--- a/pkgs/development/compilers/pakcs/default.nix
+++ b/pkgs/development/compilers/pakcs/default.nix
@@ -5,27 +5,24 @@
 
 let
   pname = "pakcs";
-  version = "2.2.1";
+  version = "3.6.0";
 
   # Don't switch to "Current release" without a reason, because its
   # source updates without version bump. Prefer last from "Older releases" instead.
   src = fetchurl {
     url = "https://www.informatik.uni-kiel.de/~pakcs/download/pakcs-${version}-src.tar.gz";
-    sha256 = "1jyg29j8r8pgcin7ixdya6c3zzfjdi66rghpwrfnkk133fz4iz7s";
+    hash = "sha256-1r6jEY3eEGESKcAepiziVbxpIvQLtCS6l0trBU3SGGo=";
   };
 
   curry-frontend = (haskellPackages.override {
     overrides = self: super: {
-      curry-base = haskell.lib.compose.overrideCabal (drv: {
-        inherit src;
-        postUnpack = "sourceRoot+=/frontend/curry-base";
-      }) (super.callPackage ./curry-base.nix {});
       curry-frontend = haskell.lib.compose.overrideCabal (drv: {
         inherit src;
-        postUnpack = "sourceRoot+=/frontend/curry-frontend";
-      }) (super.callPackage ./curry-frontend.nix {});
+        postUnpack = "sourceRoot+=/frontend";
+      }) (super.callPackage ./curry-frontend.nix { });
     };
   }).curry-frontend;
+
 in stdenv.mkDerivation {
   inherit pname version src;
 
@@ -41,28 +38,24 @@ in stdenv.mkDerivation {
   ];
 
   preConfigure = ''
-    # Since we can't expand $out in `makeFlags`
-    #makeFlags="$makeFlags PAKCSINSTALLDIR=$out/pakcs"
-
-    for file in currytools/cpm/src/CPM/Repository.curry \
-                currytools/cpm/src/CPM/Repository/CacheDB.curry \
-                scripts/compile-all-libs.sh \
-                scripts/cleancurry.sh \
-                examples/test.sh testsuite/test.sh lib/test.sh; do
+    for file in examples/test.sh             \
+                currytools/optimize/Makefile \
+                testsuite/test.sh            \
+                scripts/cleancurry.sh        \
+                scripts/compile-all-libs.sh; do
         substituteInPlace $file --replace "/bin/rm" "rm"
     done
   '' ;
 
-  # cypm new: EXISTENCE ERROR: source_sink
-  # "/tmp/nix-build-pakcs-2.0.2.drv-0/pakcs-2.0.2/currytools/cpm/templates/LICENSE"
-  # does not exist
-  buildPhase = ''
+  preBuild = ''
     mkdir -p $out/pakcs
     cp -r * $out/pakcs
-    (cd $out/pakcs ; make -j$NIX_BUILD_CORES $makeFlags)
+    cd $out/pakcs
   '';
 
   installPhase = ''
+    runHook preInstall
+
     ln -s $out/pakcs/bin $out
 
     mkdir -p $out/share/emacs/site-lisp
@@ -75,6 +68,8 @@ in stdenv.mkDerivation {
     # List of dependencies from currytools/cpm/src/CPM/Main.curry
     wrapProgram $out/pakcs/bin/cypm \
       --prefix PATH ":" "${lib.makeBinPath [ curl git unzip gnutar coreutils sqlite ]}"
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -94,7 +89,7 @@ in stdenv.mkDerivation {
       with dynamic web pages, prototyping embedded systems).
     '';
 
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ t4ccer ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/interpreters/expr/default.nix b/pkgs/development/interpreters/expr/default.nix
index 7a6384620d44..2ff0ffd4f6a9 100644
--- a/pkgs/development/interpreters/expr/default.nix
+++ b/pkgs/development/interpreters/expr/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "expr";
-  version = "1.15.7";
+  version = "1.15.8";
 
   src = fetchFromGitHub {
     owner = "antonmedv";
     repo = "expr";
     rev = "v${version}";
-    hash = "sha256-dSZVReKQqQMKjVocqz6eoh8/+Yyf37egDf1tJ/JePJ0=";
+    hash = "sha256-leZEP6RJv136z/bNc1S74tw+JQ3QD7NCMbo/Wo7q0ek=";
   };
 
   sourceRoot = "${src.name}/repl";
 
-  vendorHash = "sha256-ioNXzEQLLpBWhVw4tnDnL/umkEoExHBTSj2WBjIl3PQ=";
+  vendorHash = "sha256-Rs2tlno0vJo8FSdnnk3cxQCCxdByQD1jRzmePzMMfvs=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 5cdd307e70fe..a77206ae3852 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -344,7 +344,7 @@ in with passthru; stdenv.mkDerivation ({
       '';
       license = lib.licenses.psfl;
       platforms = lib.platforms.all;
-      maintainers = with lib.maintainers; [ fridh thiagokokada ];
+      maintainers = with lib.maintainers; [ fridh ];
       knownVulnerabilities = [
         "Python 2.7 has reached its end of life after 2020-01-01. See https://www.python.org/doc/sunset-python-2/."
         # Quote: That means that we will not improve it anymore after that day,
diff --git a/pkgs/development/libraries/libsodium/default.nix b/pkgs/development/libraries/libsodium/default.nix
index 5ecd27f60078..4570b10db39c 100644
--- a/pkgs/development/libraries/libsodium/default.nix
+++ b/pkgs/development/libraries/libsodium/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
       url  = "https://github.com/jedisct1/libsodium/commit/ffd1e374989197b44d815ac8b5d8f0b43b6ce534.patch";
       hash = "sha256-jG0VirIoFBwYmRx6zHSu2xe6pXYwbeqNVhPJxO6eJEY=";
     })
-  ] ++ lib.optional stdenv.hostPlatform.isMinGW ./mingw-no-fortify.patch;
+  ];
 
   nativeBuildInputs = [ autoreconfHook ];
 
diff --git a/pkgs/development/libraries/libsodium/mingw-no-fortify.patch b/pkgs/development/libraries/libsodium/mingw-no-fortify.patch
deleted file mode 100644
index e13a801f8db7..000000000000
--- a/pkgs/development/libraries/libsodium/mingw-no-fortify.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff -Naur libsodium-1.0.18-orig/configure.ac libsodium-1.0.18/configure.ac
---- libsodium-1.0.18-orig/configure.ac	2019-05-30 16:20:24.000000000 -0400
-+++ libsodium-1.0.18/configure.ac	2021-08-11 08:09:54.653907245 -0400
-@@ -217,11 +217,6 @@
- 
- AC_CHECK_DEFINE([__wasi__], [WASI="yes"], [])
- 
--AC_CHECK_DEFINE([_FORTIFY_SOURCE], [], [
--  AX_CHECK_COMPILE_FLAG([-D_FORTIFY_SOURCE=2],
--    [CPPFLAGS="$CPPFLAGS -D_FORTIFY_SOURCE=2"])
--])
--
- AX_CHECK_COMPILE_FLAG([-fvisibility=hidden],
-   [CFLAGS="$CFLAGS -fvisibility=hidden"])
- 
diff --git a/pkgs/development/libraries/pdal/default.nix b/pkgs/development/libraries/pdal/default.nix
index 1c11e4d449e1..4f477a94a683 100644
--- a/pkgs/development/libraries/pdal/default.nix
+++ b/pkgs/development/libraries/pdal/default.nix
@@ -1,18 +1,22 @@
-{ lib, stdenv
+{ lib
+, stdenv
+, callPackage
 , fetchFromGitHub
-, fetchpatch
+, testers
+
+, enableE57 ? lib.meta.availableOn stdenv.hostPlatform libe57format
+
 , cmake
-, pkg-config
-, openscenegraph
 , curl
 , gdal
 , hdf5-cpp
 , LASzip
-, enableE57 ? lib.meta.availableOn stdenv.hostPlatform libe57format
 , libe57format
 , libgeotiff
 , libtiff
 , libxml2
+, openscenegraph
+, pkg-config
 , postgresql
 , tiledb
 , xercesc
@@ -20,14 +24,14 @@
 , zstd
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "pdal";
   version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "PDAL";
     repo = "PDAL";
-    rev = version;
+    rev = finalAttrs.version;
     sha256 = "sha256-JKwa89c05EfZ/FxOkj8lYmw0o2EgSqafRDIV2mTpZ5E=";
   };
 
@@ -37,7 +41,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    openscenegraph
     curl
     gdal
     hdf5-cpp
@@ -45,6 +48,7 @@ stdenv.mkDerivation rec {
     libgeotiff
     libtiff
     libxml2
+    openscenegraph
     postgresql
     tiledb
     xercesc
@@ -59,6 +63,8 @@ stdenv.mkDerivation rec {
     "-DBUILD_PLUGIN_HDF=ON"
     "-DBUILD_PLUGIN_PGPOINTCLOUD=ON"
     "-DBUILD_PLUGIN_TILEDB=ON"
+    "-DWITH_TESTS=ON"
+    "-DBUILD_PGPOINTCLOUD_TESTS=OFF"
 
     # Plugins can probably not be made work easily:
     "-DBUILD_PLUGIN_CPD=OFF"
@@ -75,11 +81,52 @@ stdenv.mkDerivation rec {
     "-DBUILD_PLUGIN_RIVLIB=OFF"
   ];
 
+  doCheck = true;
+
+  disabledTests = [
+    # Tests failing due to TileDB library implementation, disabled also
+    # by upstream CI.
+    # See: https://github.com/PDAL/PDAL/blob/bc46bc77f595add4a6d568a1ff923d7fe20f7e74/.github/workflows/linux.yml#L81
+    "pdal_io_tiledb_writer_test"
+    "pdal_io_tiledb_reader_test"
+    "pdal_io_tiledb_time_writer_test"
+    "pdal_io_tiledb_time_reader_test"
+    "pdal_io_tiledb_bit_fields_test"
+    "pdal_io_e57_read_test"
+    "pdal_io_e57_write_test"
+    "pdal_io_stac_reader_test"
+
+    # Segfault
+    "pdal_io_hdf_reader_test"
+
+    # Failure
+    "pdal_app_plugin_test"
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    # tests are flaky and they seem to fail less often when they don't run in
+    # parallel
+    ctest -j 1 --output-on-failure -E '^${lib.concatStringsSep "|" finalAttrs.disabledTests}$'
+    runHook postCheck
+  '';
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "pdal --version";
+      version = "pdal ${finalAttrs.finalPackage.version}";
+    };
+    pdal = callPackage ./tests.nix { pdal = finalAttrs.finalPackage; };
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
   meta = with lib; {
     description = "PDAL is Point Data Abstraction Library. GDAL for point cloud data";
     homepage = "https://pdal.io";
     license = licenses.bsd3;
     maintainers = teams.geospatial.members;
     platforms = platforms.all;
+    pkgConfigModules = [ "pdal" ];
   };
-}
+})
diff --git a/pkgs/development/libraries/pdal/tests.nix b/pkgs/development/libraries/pdal/tests.nix
new file mode 100644
index 000000000000..1f71626856b3
--- /dev/null
+++ b/pkgs/development/libraries/pdal/tests.nix
@@ -0,0 +1,10 @@
+{ runCommand, pdal }:
+
+let
+  inherit (pdal) pname;
+in
+runCommand "${pname}-tests" { meta.timeout = 60; }
+  ''
+    ${pdal}/bin/pdal --drivers
+    touch $out
+  ''
diff --git a/pkgs/development/python-modules/aiohappyeyeballs/default.nix b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
index ece43814ab55..a2be5384a04c 100644
--- a/pkgs/development/python-modules/aiohappyeyeballs/default.nix
+++ b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohappyeyeballs";
-  version = "2.3.0";
+  version = "2.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = "aiohappyeyeballs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LMvELnN6Sy6DssXfH6fQ84N2rhdjqB8AlikTMidrjT4=";
+    hash = "sha256-3Lj1eUDPoVCElrxowBhhrS0GCjD5qeUCiSB/gHoqC3Q=";
   };
 
   outputs = [
@@ -71,7 +71,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Happy Eyeballs for pre-resolved hosts";
     homepage = "https://github.com/bdraco/aiohappyeyeballs";
-    changelog = "https://github.com/bdraco/aiohappyeyeballs/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/bdraco/aiohappyeyeballs/blob/v${version}/CHANGELOG.md";
     license = licenses.psfl;
     maintainers = with maintainers; [ fab hexa ];
   };
diff --git a/pkgs/development/python-modules/aiowithings/default.nix b/pkgs/development/python-modules/aiowithings/default.nix
index 64f7a23a17e4..46dfafb2ad75 100644
--- a/pkgs/development/python-modules/aiowithings/default.nix
+++ b/pkgs/development/python-modules/aiowithings/default.nix
@@ -1,6 +1,6 @@
 { lib
 , aiohttp
-, aresponses
+, aioresponses
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiowithings";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "joostlek";
     repo = "python-withings";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wVLoM1Lq1fchyjOOmn+6wVzEAra8x2uK6qaiocVqzmw=";
+    hash = "sha256-+pIIVCR+QsW9M3pH9Ss3dMvkeKM1OdhQ1y+s/T6pHtk=";
   };
 
   postPatch = ''
@@ -40,7 +40,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    aresponses
+    aioresponses
     pytest-asyncio
     pytestCheckHook
     syrupy
diff --git a/pkgs/development/python-modules/pystatgrab/default.nix b/pkgs/development/python-modules/pystatgrab/default.nix
new file mode 100644
index 000000000000..9ba3fb7b3785
--- /dev/null
+++ b/pkgs/development/python-modules/pystatgrab/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, buildPythonPackage
+, cython
+, fetchFromGitHub
+, libstatgrab
+, pkg-config
+, pythonOlder
+, setuptools
+, unittestCheckHook
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "pystatgrab";
+  version = "0.7.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "libstatgrab";
+    repo = "pystatgrab";
+    rev = "PYSTATGRAB_${lib.replaceStrings ["."] ["_"] version}";
+    hash = "sha256-0FDhkIK8jy3/SFmCzrl9l4RTeIKDjO0o5UoODx6Wnfs=";
+  };
+
+  nativeBuildInputs = [
+    cython
+    pkg-config
+    setuptools
+    wheel
+  ];
+
+  buildInputs = [
+    libstatgrab
+  ];
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "statgrab"
+  ];
+
+  meta = with lib; {
+    description = "Python bindings for libstatgrab";
+    homepage = "https://github.com/libstatgrab/pystatgrab";
+    changelog = "https://github.com/libstatgrab/pystatgrab/blob/PYSTATGRAB_${lib.replaceStrings ["."] ["_"] version}/NEWS";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/tools/clj-kondo/default.nix b/pkgs/development/tools/clj-kondo/default.nix
index a0c784d58258..058f894ab36b 100644
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@@ -29,6 +29,6 @@ buildGraalvmNativeImage rec {
     license = licenses.epl10;
     changelog =
       "https://github.com/clj-kondo/clj-kondo/blob/v${version}/CHANGELOG.md";
-    maintainers = with maintainers; [ jlesquembre bandresen thiagokokada ];
+    maintainers = with maintainers; [ jlesquembre bandresen ];
   };
 }
diff --git a/pkgs/development/tools/language-servers/lua-language-server/default.nix b/pkgs/development/tools/language-servers/lua-language-server/default.nix
index e0f9b6811d9b..e56d3240cafb 100644
--- a/pkgs/development/tools/language-servers/lua-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/lua-language-server/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, ninja, makeWrapper, CoreFoundation, Foundation, ditto }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lua-language-server";
-  version = "3.7.3";
+  version = "3.7.4";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
-    rev = version;
-    hash = "sha256-iAxRGG7/zaUbJ/PWgmjxGS0UTq9/OXc8RWzlpUTUftc=";
+    rev = finalAttrs.version;
+    hash = "sha256-wJOOzKM2pgxfRqx5WZjOcCyRapz0Sub3AYm51LRYpFU=";
     fetchSubmodules = true;
   };
 
@@ -89,4 +89,4 @@ stdenv.mkDerivation rec {
     mainProgram = "lua-language-server";
     platforms = platforms.linux ++ platforms.darwin;
   };
-}
+})
diff --git a/pkgs/development/tools/manifest-tool/default.nix b/pkgs/development/tools/manifest-tool/default.nix
index 6282619535b9..bba035d01e7c 100644
--- a/pkgs/development/tools/manifest-tool/default.nix
+++ b/pkgs/development/tools/manifest-tool/default.nix
@@ -9,15 +9,14 @@
 
 buildGoModule rec {
   pname = "manifest-tool";
-  version = "2.0.6";
-  gitCommit = "2ed9312726765567a84f2acc44a0c8a6e50f4b7a";
+  version = "2.1.5";
   modRoot = "v2";
 
   src = fetchFromGitHub {
     owner = "estesp";
     repo = "manifest-tool";
     rev = "v${version}";
-    sha256 = "sha256-oopk++IdNF6msxOszT0fKxQABgWKbaQZ2aNH9chqWU0=";
+    hash = "sha256-TCR8A35oETAZszrZFtNZulzCsh9UwGueTyHyYe+JQeI=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse HEAD > $out/.git-revision
@@ -29,14 +28,26 @@ buildGoModule rec {
 
   nativeBuildInputs = [ git ];
 
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "-linkmode=external"
+    "-extldflags"
+    "-static"
+  ];
+
   preConfigure = ''
-    ldflags="-X main.gitCommit=$(cat .git-revision)"
+    export ldflags+=" -X main.gitCommit=$(cat .git-revision)"
   '';
 
-  CGO_ENABLED = if stdenv.hostPlatform.isStatic then "0" else "1";
-  GO_EXTLINK_ENABLED = if stdenv.hostPlatform.isStatic then "0" else "1";
-  ldflags = lib.optionals stdenv.hostPlatform.isStatic [ "-w" "-extldflags" "-static" ];
-  tags = lib.optionals stdenv.hostPlatform.isStatic [ "netgo" ];
+  tags = lib.optionals stdenv.hostPlatform.isStatic [
+    "cgo"
+    "netgo"
+    "osusergo"
+    "static_build"
+  ];
 
   passthru.tests.version = testers.testVersion {
     package = manifest-tool;
diff --git a/pkgs/development/tools/misc/blackfire/php-probe.nix b/pkgs/development/tools/misc/blackfire/php-probe.nix
index b6c43956adf7..15c634357217 100644
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -14,47 +14,47 @@ assert lib.assertMsg (!php.ztsSupport) "blackfire only supports non zts versions
 let
   phpMajor = lib.versions.majorMinor php.version;
 
-  version = "1.92.5";
+  version = "1.92.6";
 
   hashes = {
     "x86_64-linux" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-DT1ETsJGOebC0kt4zKiSMu/wF0TG2zUiNNh+Giokjz4=";
-        "8.2" = "sha256-X/inhHAA34aQSycoSzT28jfntH3QTZgHPId5zYgcWT4=";
-        "8.3" = "sha256-SHR+J+yFA2YxggdNPq2HtLkh9I3bG01TMk9EUKGkRM0=";
+        "8.1" = "sha256-ygBgs6tGZyim69tCol+tTXV5Lt/JLuatmKAo9aomM1s=";
+        "8.2" = "sha256-TrT7H2Tbu4ZrfeCUjpqlTMw9DAxS62aLvzTbpAdsZOc=";
+        "8.3" = "sha256-AH/kYlpVjCwXxNa90Qe5XpzAdSyNn9jdeyYTLlXxfLI=";
       };
     };
     "i686-linux" = {
       system = "i386";
       hash = {
-        "8.1" = "sha256-7aDO6shHWIAgby8qCwpc7aICnWyYvferqjDgtnYZCeI=";
-        "8.2" = "sha256-mpHS9zUjgJnxvi3np2sUS0GhtOjhDOzlepRByYbjUCk=";
-        "8.3" = "sha256-75C9NwMuUTNuAfdPRgtq4XK6bqo/IRa/SXfM7Wz2y90=";
+        "8.1" = "sha256-c1i6eq7l4LeUpuZCsYzS1N++IU4j0WydCxPokSJf6dI=";
+        "8.2" = "sha256-gWhyUQ3QP13klusSv7KWdHatnjy/4k17VvHJUCtqF1g=";
+        "8.3" = "sha256-kI3sVcI/bDVRMcjzPzlai1D2HvmBTXwQ3DF5zcp2GJk=";
       };
     };
     "aarch64-linux" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-Vj2rnKik+Fy+9yfbUMSOoiXTGm84YNPo1cfh9hojr9c=";
-        "8.2" = "sha256-lvWwwKJj3/ZxAQcnbcjv/0CLqDDRiOkFo2rJeMhZLHQ=";
-        "8.3" = "sha256-yqa5GE/FBINR3oFNTP1IZGnhSDYCfluRiEFiTSySjns=";
+        "8.1" = "sha256-1QPKTNOsJTrx+Q0MigiMBDCC7X3YlSDB33gy8DU9KBg=";
+        "8.2" = "sha256-e3YUAOLWSmsiHczb44oRiOIafMSBWQaJY+m4OSUMzV8=";
+        "8.3" = "sha256-h0/ZEy6IkIpAfeL0Al7a+FpPeX2KMSd7zD1i1ew5rUk=";
       };
     };
     "aarch64-darwin" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-OcQtr16Qt6TsxPBG3OY/viGXqknKx5GdM/fcCJlFiaY=";
-        "8.2" = "sha256-ay/6JwB959bT2f18LGMB5560dIPAPSAY5Nby44FGBMc=";
-        "8.3" = "sha256-7yyhcusin7pLYZqjUgyIkDGmufIPX8cKWqplXetZzMU=";
+        "8.1" = "sha256-gLCPTTCfoBgp3GgKzVisfGlxQsYa+4x2WDwvhwcf1R8=";
+        "8.2" = "sha256-OtWUwkeLGfxkxjGSDMyv61UVoSwFo1puGjmwYOB51nI=";
+        "8.3" = "sha256-M3lz0TnTuJVgD32RS3ffcZsKVJdyx75AjSKFkkODiSE=";
       };
     };
     "x86_64-darwin" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-l0xgj0tAjYNI0EwoZhnGpRadg5EJtBlt5WhylmZaGDg=";
-        "8.2" = "sha256-lD6lE6u9nzHhHPTPLoGKaDsZlvrpbshd+4fr4ua8H8c=";
-        "8.3" = "sha256-CMPv+pDPJVwQ4gDAnQxyeJXp4YYkwAVoSdS3a+49fDU=";
+        "8.1" = "sha256-dVau4kieQsj4m97Sepw1jMRtf1VCUnvZEJjVsO+hFWs=";
+        "8.2" = "sha256-HRBVr4JTiZDRzIt6JfITD5N824Ivcag6DUyEhsc23co=";
+        "8.3" = "sha256-nRRG42/Yhsupln4j7nWlKvfQ067fwQ17un1yXplPf14=";
       };
     };
   };
diff --git a/pkgs/development/tools/rust/cargo-careful/default.nix b/pkgs/development/tools/rust/cargo-careful/default.nix
index 9d4aa2d95600..7d147241b46e 100644
--- a/pkgs/development/tools/rust/cargo-careful/default.nix
+++ b/pkgs/development/tools/rust/cargo-careful/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-careful";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "RalfJung";
     repo = "cargo-careful";
     rev = "v${version}";
-    hash = "sha256-5FteKVlEx5NSj3lzRRj3qerkyK+UdJfTWtG6xEzI4t4=";
+    hash = "sha256-oiwR6NgHHu9B1L6dSK6KZfgcSdwBPEzUZONwPHr0a4k=";
   };
 
-  cargoHash = "sha256-gs8o+tWvC4cgIITpfvJqfTquyYaEbvNMeZEJKFzd83I=";
+  cargoHash = "sha256-sVIAY9eYlpyS/PU6kLInc4hMeD3qcewoMbTH+wTIBuI=";
 
   meta = with lib; {
     description = "A tool to execute Rust code carefully, with extra checking along the way";
diff --git a/pkgs/games/anki/bin.nix b/pkgs/games/anki/bin.nix
index 7404be23bc64..cb872c7a54dd 100644
--- a/pkgs/games/anki/bin.nix
+++ b/pkgs/games/anki/bin.nix
@@ -3,22 +3,22 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "23.10.1";
+  version = "23.12.1";
 
   sources = {
     linux = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-qt6.tar.zst";
-      sha256 = "sha256-Kv0SH+bLnBSM/tYHe2kEJc4n7izZTBNWQs2nm/teLEU=";
+      sha256 = "sha256-bFtAUqSoFS8CWESiepWXywndkijATbWp6CJdqlQecuk=";
     };
 
     # For some reason anki distributes completely separate dmg-files for the aarch64 version and the x86_64 version
     darwin-x86_64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel-qt6.dmg";
-      sha256 = "sha256-MSlKsEv4N/H7G1bUOBlPBXerpHIW32P6Va02aRq1+54=";
+      sha256 = "sha256-z48REB14p7rb50ty9u/26wx0sY4QZb4pj6wOXsSBCdg=";
     };
     darwin-aarch64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple-qt6.dmg";
-      sha256 = "sha256-jEm9WJBXx77KpldzBuxK1Pu6VGiARZPnRmMhEjZdm1I=";
+      sha256 = "sha256-bdaCqSjje86wmVKIFZqzuFaEZ7SWQr7CAS/Hm1CpOMg=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/amdctl/default.nix b/pkgs/os-specific/linux/amdctl/default.nix
index 1fcd8fc93402..d0a15578857c 100644
--- a/pkgs/os-specific/linux/amdctl/default.nix
+++ b/pkgs/os-specific/linux/amdctl/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     description = "Set P-State voltages and clock speeds on recent AMD CPUs on Linux.";
     homepage = "https://github.com/kevinlekiller/amdctl";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ thiagokokada ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/README.md b/pkgs/os-specific/linux/kernel/README.md
index 92d5308e1c05..84fb05fc07a2 100644
--- a/pkgs/os-specific/linux/kernel/README.md
+++ b/pkgs/os-specific/linux/kernel/README.md
@@ -4,23 +4,37 @@
 
 2.  Add the new kernel to the `kernels` attribute set in [`linux-kernels.nix`](./linux-kernels.nix) (e.g., create an attribute `kernel_2_6_22`).
 
-3.  Update the kernel configuration. First unpack the kernel. Then for each supported platform (`i686`, `x86_64`, `uml`) do the following:
+3.  Update the kernel configuration:
 
-    1.  Make a copy from the old config (e.g., `config-2.6.21-i686-smp`) to the new one (e.g., `config-2.6.22-i686-smp`).
+    1. While in the Nixpkgs repository, enter the development shell for that kernel:
 
-    2.  Copy the config file for this platform (e.g., `config-2.6.22-i686-smp`) to `.config` in the kernel source tree.
+       ```console
+       $ nix-shell -A linuxKernel.kernels.linux_2_6_22
+       ```
 
-    3.  Run `make oldconfig ARCH={i386,x86_64,um}` and answer all questions. (For the uml configuration, also add `SHELL=bash`.) Make sure to keep the configuration consistent between platforms (i.e., don’t enable some feature on `i686` and disable it on `x86_64`).
+    2. Unpack the kernel:
 
-    4.  If needed, you can also run `make menuconfig`:
+       ```console
+       [nix-shell]$ pushd $(mktemp -d)
+       [nix-shell]$ unpackPhase
+       ```
 
-        ```ShellSession
-        $ nix-env -f "<nixpkgs>" -iA ncurses
-        $ export NIX_CFLAGS_LINK=-lncurses
-        $ make menuconfig ARCH=arch
-        ```
+    3. For each supported platform (`i686`, `x86_64`, `uml`) do the following:
 
-    5.  Copy `.config` over the new config file (e.g., `config-2.6.22-i686-smp`).
+       1. Make a copy from the old config (e.g., `config-2.6.21-i686-smp`) to the new one (e.g., `config-2.6.22-i686-smp`).
+
+       2. Copy the config file for this platform (e.g., `config-2.6.22-i686-smp`) to `.config` in the unpacked kernel source tree.
+
+       3. Run `make oldconfig ARCH={i386,x86_64,um}` and answer all questions. (For the uml configuration, also add `SHELL=bash`.) Make sure to keep the configuration consistent between platforms (i.e., don’t enable some feature on `i686` and disable it on `x86_64`).
+
+       4. If needed, you can also run `make menuconfig`:
+
+          ```ShellSession
+          $ nix-shell -p ncurses pkg-config
+          $ make menuconfig ARCH=arch
+          ```
+
+       5. Copy `.config` over the new config file (e.g., `config-2.6.22-i686-smp`).
 
 4.  Test building the kernel:
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 836d1a359589..515fbed1636c 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,5 +30,9 @@
     "6.6": {
         "version": "6.6.10",
         "hash": "sha256:0v2l0l90w7scv7bxkxxjgqnay0fjh678k9gdlgycgbh9q7j2grly"
+    },
+    "6.7": {
+        "version": "6.7",
+        "hash": "sha256:0s8hbcsg7fdvspqam8kzcxygjsznr4zfi60nqgc81l3n4m518cgg"
     }
 }
diff --git a/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix b/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
index 3964538a4096..464b77ce969e 100644
--- a/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
+++ b/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl }:
 
 let
-  version = "28-1ubuntu4"; # impish 2021-06-24
+  version = "30+20230519-1ubuntu3"; # mantic 2023-08-26
 
 in stdenv.mkDerivation {
   pname = "kmod-blacklist";
@@ -9,7 +9,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://launchpad.net/ubuntu/+archive/primary/+files/kmod_${version}.debian.tar.xz";
-    sha256 = "sha256-K8tWpaLmCm3Jcxw3OZ+D7Koiug7epooRn1YMfqjGAiw=";
+    hash = "sha256-VGw1/rUjl9/j6026ut0dvC0/8maAAz8umb0D3YGf8p4=";
   };
 
   installPhase = ''
@@ -22,7 +22,6 @@ in stdenv.mkDerivation {
     done
 
     substituteInPlace "$out"/modprobe.conf \
-      --replace "blacklist bochs-drm" "" \
       --replace /sbin/lsmod /run/booted-system/sw/bin/lsmod \
       --replace /sbin/rmmod /run/booted-system/sw/bin/rmmod \
       --replace /sbin/modprobe /run/booted-system/sw/bin/modprobe \
diff --git a/pkgs/os-specific/linux/kmod-debian-aliases/default.nix b/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
index 15f7251f9961..a4474f7c08fa 100644
--- a/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
+++ b/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
@@ -2,16 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "kmod-debian-aliases.conf";
-  version = "22-1.1";
+  version = "30+20230601-2";
 
   src = fetchurl {
-    url = "https://snapshot.debian.org/archive/debian/20160404T220610Z/pool/main/k/kmod/kmod_${version}.debian.tar.xz";
-    sha256 = "0daap2n4bvjqcnksaayy6csmdb1px4r02w3xp36bcp6w3lbnqamh";
+    url = "https://snapshot.debian.org/archive/debian/20231117T085632Z/pool/main/k/kmod/kmod_${version}.debian.tar.xz";
+    hash = "sha256-xJMGKht8hu0aQjN9TER87Rv5EYkVMeDfX/jJ8+UjAqM=";
   };
 
   installPhase = ''
-    patch -i patches/aliases_conf
-    cp aliases.conf $out
+    cp extra/aliases.conf $out
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/archivers/unar/default.nix b/pkgs/tools/archivers/unar/default.nix
index 07aa89fa5caf..4b2c66c0fc40 100644
--- a/pkgs/tools/archivers/unar/default.nix
+++ b/pkgs/tools/archivers/unar/default.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
       ADF, DMS, LZX, PowerPacker, LBR, Squeeze, Crunch, and other old formats.
     '';
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ peterhoeg thiagokokada ];
+    maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index 0ee5d2e47dcc..8061d535bc23 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.24.2";
+  version = "2.26.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    hash = "sha256-1rGzgKusUKlkH/Ew8qDzq143mu+gvSlXTcqL+I+ypSY=";
+    hash = "sha256-+7pf87mmT5KB4KtKzZXYnV6GwMzb6ieXjBVZpvmQ3eU=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoHash = "sha256-+GHVZNuEpOxu29EuHOshrYyhg1HFcYJjC4MnFJgjw38=";
+  cargoHash = "sha256-5n6zjuoL5v3ieP8eOzvyJf/YDmQ+MuGMk3T/8rHKQVE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Foundation
diff --git a/pkgs/tools/security/mitmproxy2swagger/default.nix b/pkgs/tools/security/mitmproxy2swagger/default.nix
index bf83c7303eef..56d47973b7e3 100644
--- a/pkgs/tools/security/mitmproxy2swagger/default.nix
+++ b/pkgs/tools/security/mitmproxy2swagger/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mitmproxy2swagger";
-  version = "0.11.0";
+  version = "0.13.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "alufers";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-NwU3GtnWL90gSCbPbGnkbLX/o77NZJ4t4xME8dhWEbA=";
+    hash = "sha256-VHxqxee5sQWRS13V4SfY4LWaN0oxxWsNVDOEqUyKHfg=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/text/difftastic/Cargo.lock b/pkgs/tools/text/difftastic/Cargo.lock
index e3a8902da002..3170c0454f42 100644
--- a/pkgs/tools/text/difftastic/Cargo.lock
+++ b/pkgs/tools/text/difftastic/Cargo.lock
@@ -253,7 +253,7 @@ checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
 
 [[package]]
 name = "difftastic"
-version = "0.53.1"
+version = "0.54.0"
 dependencies = [
  "aho-corasick",
  "assert_cmd",
@@ -266,7 +266,6 @@ dependencies = [
  "hashbrown 0.12.3",
  "humansize",
  "ignore",
- "is-terminal",
  "itertools 0.11.0",
  "lazy_static",
  "libc",
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index 317c79239009..c38edc9af64f 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -17,13 +17,13 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "difftastic";
-  version = "0.53.1";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = pname;
     rev = version;
-    hash = "sha256-D//LMfwk2n5jGOXhix2jZyoppYMxVkTkg4HuNHCtHNI=";
+    hash = "sha256-1QnDBRhJGzKKMmvnwVoi8rTd6acBFO0hITF9d1HkizM=";
   };
 
   cargoLock = {
diff --git a/pkgs/tools/virtualization/guestfs-tools/default.nix b/pkgs/tools/virtualization/guestfs-tools/default.nix
index 2b7cfb79d870..e78bd106993d 100644
--- a/pkgs/tools/virtualization/guestfs-tools/default.nix
+++ b/pkgs/tools/virtualization/guestfs-tools/default.nix
@@ -111,7 +111,7 @@ stdenv.mkDerivation rec {
     description = "Extra tools for accessing and modifying virtual machine disk images";
     license = with licenses; [ gpl2Plus lgpl21Plus ];
     homepage = "https://libguestfs.org/";
-    maintainers = with maintainers; [ thiagokokada ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/wayland/wl-clip-persist/default.nix b/pkgs/tools/wayland/wl-clip-persist/default.nix
index 0828a34be840..2cfe8cc01743 100644
--- a/pkgs/tools/wayland/wl-clip-persist/default.nix
+++ b/pkgs/tools/wayland/wl-clip-persist/default.nix
@@ -35,6 +35,6 @@ rustPlatform.buildRustPackage {
     inherit (wayland.meta) platforms;
     license = licenses.mit;
     mainProgram = "wl-clip-persist";
-    maintainers = with maintainers; [ thiagokokada ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4ee19a5b5dbd..42874cc88933 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -759,6 +759,7 @@ mapAliases ({
   paperless-ng = paperless-ngx; # Added 2022-04-11
   paper-note = throw "paper-note has been removed: abandoned by upstream"; # Added 2023-05-03
   parity = openethereum; # Added 2020-08-01
+  partition-manager = libsForQt5.partitionmanager; # Added 2024-01-08
   pash = throw "'pash' has been removed: abandoned by upstream. Use 'powershell' instead"; # Added 2023-09-16
   pcsctools = pcsc-tools; # Added 2023-12-07
   pdf2xml = throw "'pdf2xml' was removed: abandoned for years."; # Added 2023-10-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9216524afa74..799439404974 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9863,8 +9863,6 @@ with pkgs;
 
   krakenx = callPackage ../tools/system/krakenx { };
 
-  partition-manager = libsForQt5.callPackage ../tools/misc/partition-manager { };
-
   kpcli = callPackage ../tools/security/kpcli { };
 
   kphotoalbum = libsForQt5.callPackage ../applications/graphics/kphotoalbum { };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 0783f358a4a6..92e527c735a8 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -185,6 +185,14 @@ in {
       ];
     };
 
+    linux_6_7 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "6.7";
+      kernelPatches = [
+        kernelPatches.bridge_stp_helper
+        kernelPatches.request_key_helper
+      ];
+    };
+
     linux_testing = let
       testing = callPackage ../os-specific/linux/kernel/mainline.nix {
         # A special branch that tracks the kernel under the release process
@@ -586,6 +594,7 @@ in {
     linux_6_1 = recurseIntoAttrs (packagesFor kernels.linux_6_1);
     linux_6_5 = recurseIntoAttrs (packagesFor kernels.linux_6_5);
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
+    linux_6_7 = recurseIntoAttrs (packagesFor kernels.linux_6_7);
     __attrsFailEvaluation = true;
   } // lib.optionalAttrs config.allowAliases {
     linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11"; # Added 2022-11-08
@@ -650,7 +659,7 @@ in {
   packageAliases = {
     linux_default = packages.linux_6_1;
     # Update this when adding the newest kernel major version!
-    linux_latest = packages.linux_6_6;
+    linux_latest = packages.linux_6_7;
     linux_mptcp = throw "'linux_mptcp' has been moved to https://github.com/teto/mptcp-flake";
     linux_rt_default = packages.linux_rt_5_4;
     linux_rt_latest = packages.linux_rt_6_1;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 65d8fbadad9f..b29e80706620 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11321,6 +11321,8 @@ self: super: with self; {
 
   pystardict = callPackage ../development/python-modules/pystardict { };
 
+  pystatgrab = callPackage ../development/python-modules/pystatgrab { };
+
   pystemd = callPackage ../development/python-modules/pystemd {
     inherit (pkgs) systemd;
   };
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index ea5454dafd2b..decb95383438 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -168,8 +168,6 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   libqaccessibilityclient = callPackage ../development/libraries/libqaccessibilityclient { };
 
-  kpmcore = callPackage ../development/libraries/kpmcore { };
-
   mapbox-gl-native = libsForQt5.callPackage ../development/libraries/mapbox-gl-native { };
 
   mapbox-gl-qml = libsForQt5.callPackage ../development/libraries/mapbox-gl-qml { };
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 6a60de224ade..afaa94a23a32 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -333,6 +333,7 @@ let
         nota
         nvfetcher
         ormolu
+        pakcs
         pandoc
         petrinizer
         place-cursor-at
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index f2b38b4a8964..fd05bae549f4 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -158,10 +158,6 @@ let
               jobs.tests.cc-wrapper.llvmPackages.libcxx.x86_64-linux
               jobs.tests.cc-wrapper.llvmPackages_6.clang.x86_64-linux
               jobs.tests.cc-wrapper.llvmPackages_6.libcxx.x86_64-linux
-              jobs.tests.cc-wrapper.llvmPackages_7.clang.x86_64-linux
-              jobs.tests.cc-wrapper.llvmPackages_7.libcxx.x86_64-linux
-              jobs.tests.cc-wrapper.llvmPackages_7.clang.x86_64-linux
-              jobs.tests.cc-wrapper.llvmPackages_7.libcxx.x86_64-linux
               jobs.tests.cc-multilib-gcc.x86_64-linux
               jobs.tests.cc-multilib-clang.x86_64-linux
               jobs.tests.stdenv-inputs.x86_64-linux