diff --git a/doc/packages/linux.section.md b/doc/packages/linux.section.md
index 0edf40043361..4c3b2a3b132a 100644
--- a/doc/packages/linux.section.md
+++ b/doc/packages/linux.section.md
@@ -12,20 +12,6 @@ Both functions have an argument `kernelPatches` which should be a list of `{name
 
 The kernel derivation created with `pkgs.buildLinux` exports an attribute `features` specifying whether optional functionality is or isn’t enabled. This is used in NixOS to implement kernel-specific behaviour.
 
-:::{.example #ex-skip-package-from-kernel-feature}
-
-# Skipping an external package because of a kernel feature
-
-For instance, if the kernel has the `iwlwifi` feature (i.e., has built-in support for Intel wireless chipsets), then NixOS doesn’t have to build the external `iwlwifi` package:
-
-```nix
-modulesTree = [kernel]
-  ++ pkgs.lib.optional (!kernel.features ? iwlwifi) kernelPackages.iwlwifi
-  ++ ...;
-```
-
-:::
-
 If you are using a kernel packaged in Nixpkgs, you can customize it by overriding its arguments. For details on how each argument affects the generated kernel, refer to [the `pkgs.buildLinux` source code](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/generic.nix).
 
 :::{.example #ex-overriding-kernel-derivation}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8d1584235d84..dbed94efca19 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19316,6 +19316,11 @@
     githubId = 1607770;
     name = "Ulrik Strid";
   };
+  umlx5h = {
+    github = "umlx5h";
+    githubId = 20206121;
+    name = "umlx5h";
+  };
   unclamped = {
     name = "Maru";
     email = "clear6860@tutanota.com";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b31154b9624e..d8a2e064cfc1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1468,6 +1468,7 @@
   ./system/boot/stratisroot.nix
   ./system/boot/modprobe.nix
   ./system/boot/networkd.nix
+  ./system/boot/uki.nix
   ./system/boot/unl0kr.nix
   ./system/boot/plymouth.nix
   ./system/boot/resolved.nix
diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index c86cb81e5df4..9f702b17937c 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -267,8 +267,7 @@ in {
 
     systemd.services.buildbot-master = {
       description = "Buildbot Continuous Integration Server.";
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
+      after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       path = cfg.packages ++ cfg.pythonPackages python.pkgs;
       environment.PYTHONPATH = "${python.withPackages (self: cfg.pythonPackages self ++ [ package ])}/${python.sitePackages}";
diff --git a/nixos/modules/services/misc/nix-gc.nix b/nixos/modules/services/misc/nix-gc.nix
index 97596d28cd89..de6bd76c7eb9 100644
--- a/nixos/modules/services/misc/nix-gc.nix
+++ b/nixos/modules/services/misc/nix-gc.nix
@@ -1,7 +1,5 @@
 { config, lib, ... }:
 
-with lib;
-
 let
   cfg = config.nix.gc;
 in
@@ -14,14 +12,14 @@ in
 
     nix.gc = {
 
-      automatic = mkOption {
+      automatic = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = lib.mdDoc "Automatically run the garbage collector at a specific time.";
       };
 
-      dates = mkOption {
-        type = types.str;
+      dates = lib.mkOption {
+        type = lib.types.singleLineStr;
         default = "03:15";
         example = "weekly";
         description = lib.mdDoc ''
@@ -33,9 +31,9 @@ in
         '';
       };
 
-      randomizedDelaySec = mkOption {
+      randomizedDelaySec = lib.mkOption {
         default = "0";
-        type = types.str;
+        type = lib.types.singleLineStr;
         example = "45min";
         description = lib.mdDoc ''
           Add a randomized delay before each garbage collection.
@@ -45,9 +43,9 @@ in
         '';
       };
 
-      persistent = mkOption {
+      persistent = lib.mkOption {
         default = true;
-        type = types.bool;
+        type = lib.types.bool;
         example = false;
         description = lib.mdDoc ''
           Takes a boolean argument. If true, the time when the service
@@ -61,10 +59,10 @@ in
         '';
       };
 
-      options = mkOption {
+      options = lib.mkOption {
         default = "";
         example = "--max-freed $((64 * 1024**3))";
-        type = types.str;
+        type = lib.types.singleLineStr;
         description = lib.mdDoc ''
           Options given to {file}`nix-collect-garbage` when the
           garbage collector is run automatically.
@@ -89,7 +87,8 @@ in
     systemd.services.nix-gc = lib.mkIf config.nix.enable {
       description = "Nix Garbage Collector";
       script = "exec ${config.nix.package.out}/bin/nix-collect-garbage ${cfg.options}";
-      startAt = optional cfg.automatic cfg.dates;
+      serviceConfig.Type = "oneshot";
+      startAt = lib.optional cfg.automatic cfg.dates;
     };
 
     systemd.timers.nix-gc = lib.mkIf cfg.automatic {
diff --git a/nixos/modules/system/boot/uki.nix b/nixos/modules/system/boot/uki.nix
new file mode 100644
index 000000000000..63c4e0c0e391
--- /dev/null
+++ b/nixos/modules/system/boot/uki.nix
@@ -0,0 +1,85 @@
+{ config, lib, pkgs, ... }:
+
+let
+
+  cfg = config.boot.uki;
+
+  inherit (pkgs.stdenv.hostPlatform) efiArch;
+
+  format = pkgs.formats.ini { };
+  ukifyConfig = format.generate "ukify.conf" cfg.settings;
+
+in
+
+{
+  options = {
+
+    boot.uki = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Name of the UKI";
+      };
+
+      version = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = config.system.image.version;
+        defaultText = lib.literalExpression "config.system.image.version";
+        description = lib.mdDoc "Version of the image or generation the UKI belongs to";
+      };
+
+      settings = lib.mkOption {
+        type = format.type;
+        description = lib.mdDoc ''
+          The configuration settings for ukify. These control what the UKI
+          contains and how it is built.
+        '';
+      };
+    };
+
+    system.boot.loader.ukiFile = lib.mkOption {
+      type = lib.types.str;
+      internal = true;
+      description = lib.mdDoc "Name of the UKI file";
+    };
+
+  };
+
+  config = {
+
+    boot.uki.name = lib.mkOptionDefault (if config.system.image.id != null then
+      config.system.image.id
+    else
+      "nixos");
+
+    boot.uki.settings = lib.mkOptionDefault {
+      UKI = {
+        Linux = "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
+        Initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
+        Cmdline = "init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}";
+        Stub = "${pkgs.systemd}/lib/systemd/boot/efi/linux${efiArch}.efi.stub";
+        Uname = "${config.boot.kernelPackages.kernel.modDirVersion}";
+        OSRelease = "@${config.system.build.etc}/etc/os-release";
+        # This is needed for cross compiling.
+        EFIArch = efiArch;
+      };
+    };
+
+    system.boot.loader.ukiFile =
+      let
+        name = config.boot.uki.name;
+        version = config.boot.uki.version;
+        versionInfix = if version != null then "_${version}" else "";
+      in
+      name + versionInfix + ".efi";
+
+    system.build.uki = pkgs.runCommand config.system.boot.loader.ukiFile { } ''
+      mkdir -p $out
+      ${pkgs.buildPackages.systemdUkify}/lib/systemd/ukify build \
+        --config=${ukifyConfig} \
+        --output="$out/${config.system.boot.loader.ukiFile}"
+    '';
+
+    meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  };
+}
diff --git a/nixos/modules/tasks/auto-upgrade.nix b/nixos/modules/tasks/auto-upgrade.nix
index 29e3e313336f..22311871274b 100644
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@@ -109,6 +109,17 @@ in {
         '';
       };
 
+      fixedRandomDelay = mkOption {
+        default = false;
+        type = types.bool;
+        example = true;
+        description = lib.mdDoc ''
+          Make the randomized delay consistent between runs.
+          This reduces the jitter between automatic upgrades.
+          See {option}`randomizedDelaySec` for configuring the randomized delay.
+        '';
+      };
+
       rebootWindow = mkOption {
         description = lib.mdDoc ''
           Define a lower and upper time value (in HH:MM format) which
@@ -253,6 +264,7 @@ in {
     systemd.timers.nixos-upgrade = {
       timerConfig = {
         RandomizedDelaySec = cfg.randomizedDelaySec;
+        FixedRandomDelay = cfg.fixedRandomDelay;
         Persistent = cfg.persistent;
       };
     };
diff --git a/nixos/tests/appliance-repart-image.nix b/nixos/tests/appliance-repart-image.nix
index 1c4495baba13..b18968d3b963 100644
--- a/nixos/tests/appliance-repart-image.nix
+++ b/nixos/tests/appliance-repart-image.nix
@@ -10,10 +10,6 @@ let
 
   imageId = "nixos-appliance";
   imageVersion = "1-rc1";
-
-  bootLoaderConfigPath = "/loader/entries/nixos.conf";
-  kernelPath = "/EFI/nixos/kernel.efi";
-  initrdPath = "/EFI/nixos/initrd.efi";
 in
 {
   name = "appliance-gpt-image";
@@ -54,19 +50,8 @@ in
               "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
                 "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
 
-              # TODO: create an abstraction for Boot Loader Specification (BLS) entries.
-              "${bootLoaderConfigPath}".source = pkgs.writeText "nixos.conf" ''
-                title NixOS
-                linux ${kernelPath}
-                initrd ${initrdPath}
-                options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
-              '';
-
-              "${kernelPath}".source =
-                "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
-
-              "${initrdPath}".source =
-                "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
+              "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
+                "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
             };
           repartConfig = {
             Type = "esp";
@@ -119,8 +104,6 @@ in
     assert 'IMAGE_VERSION="${imageVersion}"' in os_release
 
     bootctl_status = machine.succeed("bootctl status")
-    assert "${bootLoaderConfigPath}" in bootctl_status
-    assert "${kernelPath}" in bootctl_status
-    assert "${initrdPath}" in bootctl_status
+    assert "Boot Loader Specification Type #2 (.efi)" in bootctl_status
   '';
 }
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index b4c0a4480ccc..ab9a5b51ee2c 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -15,11 +15,11 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1fhvzwhkcqn3bxh92nidhg2bagxbxyg7c8b582wz1msp1l7c27mq";
-    x86_64-darwin = "1fspzw4zz8z9f91xhaw5h9r82q8anlk9ck3n3sms3vrb2g992xdr";
-    aarch64-linux = "1hynvczhz946xz9ygrsax1ap3kyw5wm19mn6s9vcdw7wg8imvcyr";
-    aarch64-darwin = "0kfr8i7z8x4ys2qsabfg78yvk42f0lnaax0l0wdiv94pp0iixijy";
-    armv7l-linux = "0vcywp0cqd1rxvb2zf4h3l5sc9rbi88w1v087q12q265c56izzw8";
+    x86_64-linux = "0nd9hipz1jhjdv6hrm6q2jpppanh8nmkpy9zpayymy4dwif8a49q";
+    x86_64-darwin = "1fk146dikiy8dab83v4j6jrnzdg8dxnjvwmdddif130jrpxsp875";
+    aarch64-linux = "0zqm8zl3vhisp6rlb2vhc2i0z4rln38858l07r70jr76zxbbs5xv";
+    aarch64-darwin = "0i0bsrygdg2ij3wf0jm9n6fci5zrghnvzdw0p528c08rjgkhrmrb";
+    armv7l-linux = "0h0v5irf23ijn21j4sll2ynj12wclm17bh46s1dlpzy73f4h17jb";
   }.${system} or throwSystem;
 
   sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@@ -29,7 +29,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.85.1.23348";
+    version = "1.85.2.24019";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/emulators/cemu/default.nix b/pkgs/applications/emulators/cemu/default.nix
index 7bc25ab058ab..c6ae93b98054 100644
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cemu";
-  version = "2.0-61";
+  version = "2.0-65";
 
   src = fetchFromGitHub {
     owner = "cemu-project";
     repo = "Cemu";
     rev = "v${version}";
-    hash = "sha256-oKVVBie3Q3VtsHbh0wJfdlx1YnF424hib8mFRYnbgXY=";
+    hash = "sha256-jsDmxol3zZMmpo4whDeUXTzfO+QVK/h6lItXTyJyoak=";
   };
 
   patches = [
diff --git a/pkgs/applications/file-managers/yazi/default.nix b/pkgs/applications/file-managers/yazi/default.nix
index 60e0013f2427..b559f8886572 100644
--- a/pkgs/applications/file-managers/yazi/default.nix
+++ b/pkgs/applications/file-managers/yazi/default.nix
@@ -31,16 +31,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yazi";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "sxyazi";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-XdN2oP5c2lK+bR3i+Hwd4oOlccMQisbzgevHsZ8YbSQ=";
+    hash = "sha256-XF5zCFXiViFsRPqI6p1Z7093NSWrGmcoyWcGEagIoEA=";
   };
 
-  cargoHash = "sha256-0JNKlzmMS5wcTW0faTnhFgNK2VHXixNnMx6ZS3eKbPA=";
+  cargoHash = "sha256-9fXHpq5lXG9Gup1dZPlXiNilbP79fJ3Jp3+ZD7mAzP4=";
 
   env.YAZI_GEN_COMPLETIONS = true;
 
diff --git a/pkgs/applications/graphics/fstl/default.nix b/pkgs/applications/graphics/fstl/default.nix
index c6b77300cb31..c7faf43e24e8 100644
--- a/pkgs/applications/graphics/fstl/default.nix
+++ b/pkgs/applications/graphics/fstl/default.nix
@@ -1,34 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, mkDerivation, qtbase, mesa_glu }:
+{ lib, stdenv, fetchFromGitHub, mkDerivation, cmake }:
 
 mkDerivation rec {
   pname = "fstl";
-  version = "0.9.4";
+  version = "0.10.0";
 
-  buildInputs = [qtbase mesa_glu];
+  nativeBuildInputs = [ cmake ];
 
-  prePatch = ''
-    sed -i "s|/usr/bin|$out/bin|g" qt/fstl.pro
-  '';
+  installPhase = lib.optionalString stdenv.isDarwin ''
+    runHook preInstall
 
-  preBuild = ''
-    qmake qt/fstl.pro
-  '';
-
-  postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv fstl.app $out/Applications
+
+    runHook postInstall
   '';
 
   src = fetchFromGitHub {
-    owner = "mkeeter";
+    owner = "fstl-app";
     repo = "fstl";
     rev = "v" + version;
-    sha256 = "028hzdv11hgvcpc36q5scf4nw1256qswh37xhfn5a0iv7wycmnif";
+    hash = "sha256-z2X78GW/IeiPCnwkeLBCLjILhfMe2sT3V9Gbw4TSf4c=";
   };
 
   meta = with lib; {
     description = "The fastest STL file viewer";
-    homepage = "https://github.com/mkeeter/fstl";
+    homepage = "https://github.com/fstl-app/fstl";
     license = licenses.mit;
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ tweber ];
diff --git a/pkgs/applications/misc/ipatool/default.nix b/pkgs/applications/misc/ipatool/default.nix
index a40a22fc6a01..6c3ffc5455e5 100644
--- a/pkgs/applications/misc/ipatool/default.nix
+++ b/pkgs/applications/misc/ipatool/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "ipatool";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "majd";
     repo = "ipatool";
     rev = "v${version}";
-    hash = "sha256-kIFKVIhH+Vjt05XzR5jNwYQokNLSckdiWJ97A03Lgqc=";
+    hash = "sha256-e+gkr8i6dVfxyBM5Vi2YpW4eQ4LE2vhgQadLAFeHK4Q=";
   };
 
-  vendorHash = "sha256-ZTz3eW/rs3bV16Ugd4kUOW7NaXzBa5c9qTIqRCanPRU=";
+  vendorHash = "sha256-aVMWXlHMGdbApKLhuZZpaAYY5QpMMgXc/6f9r79/dTw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index d8a6ff79ad4c..c2ffbc7970df 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -3,15 +3,15 @@
 }:
 let
   pname = "josm";
-  version = "18907";
+  version = "18940";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-EASSuZn18oruUmPFNZ1Bwv0krTJa0tw4ddTJzkGEjW8=";
+      hash = "sha256-NfSTwh0SabdVQwh7tA5Xx80Qbp+V/ZcurKkr+AhPoz8=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      hash = "sha256-tEJKBst+n669JENURd9ipFzV7yS/JZWEYkflq8d4g2Q=";
+      hash = "sha256-b/8vSEy3qXmRjRZ43MMISB6qZHne7nuZ+tFy8Dmbp18=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index e3c5e9a28bd8..7974466a1c2c 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-DylYRuEy0qjhjCEoTmjCJAT3nD31D8Xaaw13oexViAg=";
+    sha256 = "sha256-s1PVm5RBqHe5XVHt5Wgm05+6xXJYnMU9QO7Z8567oKk=";
   };
 
-  cargoHash = "sha256-gmzXl2psj4mftX/0Hsbki/eRQHWnspkYlzQAX4gv4vo=";
+  cargoHash = "sha256-zZFys59vEiGfB9NlAY5yjHBeXf8zQ3npFF7sg2SQTwU=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";
diff --git a/pkgs/applications/misc/tuba/default.nix b/pkgs/applications/misc/tuba/default.nix
index 6ce4ed4be7b5..cf4007983a17 100644
--- a/pkgs/applications/misc/tuba/default.nix
+++ b/pkgs/applications/misc/tuba/default.nix
@@ -27,12 +27,12 @@
 
 stdenv.mkDerivation rec {
   pname = "tuba";
-  version = "0.6.1";
+  version = "0.6.2";
   src = fetchFromGitHub {
     owner = "GeopJr";
     repo = "Tuba";
     rev = "v${version}";
-    hash = "sha256-Tt2g7xwXf/o/ip5RgUCXclL9omWa/pRglkDMoEGn1AM=";
+    hash = "sha256-SRK3I4sKJEaWBNs9VOs7Bhth/7gxybWpXJTn4DiQi6U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/kaniko/default.nix b/pkgs/applications/networking/cluster/kaniko/default.nix
index 2127ae5b3135..b4b667ccece6 100644
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kaniko";
-  version = "1.19.2";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "kaniko";
     rev = "v${version}";
-    hash = "sha256-YxOuZb1R9Orm3RTnZyzi54VzQbbmE+lO+4osvG97pwE=";
+    hash = "sha256-/JSrkxhW2w9K+MGp7+4xMGwWM8dpwRoUam02K+8NsCU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/kubecm/default.nix b/pkgs/applications/networking/cluster/kubecm/default.nix
index 6283b8387ddb..9f9433253944 100644
--- a/pkgs/applications/networking/cluster/kubecm/default.nix
+++ b/pkgs/applications/networking/cluster/kubecm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubecm";
-  version = "0.26.0";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "sunny0826";
     repo = "kubecm";
     rev = "v${version}";
-    hash = "sha256-53diz+TNGRmNbSZJAIKPFi0x/BdL02Tjb847I/XdhW0=";
+    hash = "sha256-Fg+jlnYkdv9Vfj94lxfmhoc6pyM0EAqwIBepFXYoO5M=";
   };
 
-  vendorHash = "sha256-QPd7gUEY6qNdl96slKvY7+Av6fCU9q+XdjKNKUXz2Wo=";
+  vendorHash = "sha256-wj/IHNN8r6pwkKk0ZmpRjxr5nE2c+iypjCsZb+i5vwo=";
   ldflags = [ "-s" "-w" "-X github.com/sunny0826/kubecm/version.Version=${version}"];
 
   doCheck = false;
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
index 0d20072fc4b7..830c7080925a 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.54";
+  "version" = "1.11.55";
   "hashes" = {
-    "desktopSrcHash" = "sha256-lKqcFe73UoGExSK7GGLiknLiRcaP3mIwLzqWdwOKHvQ=";
+    "desktopSrcHash" = "sha256-Gk6RjhU0vJymz2KmaNJgnuGcSVyJo53iWR3naOx49X4=";
     "desktopYarnHash" = "0v3j54a2ixik424za0iwj4sf60g934480jyp5lblhg7z8y5xqks8";
-    "webSrcHash" = "sha256-4cAa1QjM3N0xFcwwgFtUMJ2hh9uYDn+BE8tcsIuU4U0=";
-    "webYarnHash" = "13rbll0p4fmmmx3vqdyb5zlxy6zj6sbfklw5v73dacy0j8hzvz2i";
+    "webSrcHash" = "sha256-dAfPYw3qqj+xY3ZaACsT/Vtp57mag6PJtquxqXZ6F1Q=";
+    "webYarnHash" = "1aqhdk9mgz5hq7iawjclzfd78wi64kygkklwg6sp6qfv1ayi6b51";
   };
 }
diff --git a/pkgs/applications/networking/seaweedfs/default.nix b/pkgs/applications/networking/seaweedfs/default.nix
index 6c091d3f56f7..b41e535b0535 100644
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.61";
+  version = "3.62";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-pDCTiuM3PBQxDIwWCDP9ZIjhVMCg70bZzYntJaUn574=";
+    hash = "sha256-z4RyrrM27krm54iVWKDbMB14MiiydLj4Z/RdjYMZxh0=";
   };
 
-  vendorHash = "sha256-9i11Kf6rIS1ktHMCk9y3+e0u1hDGNRP/oHKWpOVayy4=";
+  vendorHash = "sha256-WAGuaL8kDtMUDkHetWagCGZS91Y3Tg2DV2StKgRpuIg=";
 
   subPackages = [ "weed" ];
 
diff --git a/pkgs/applications/science/chemistry/openmolcas/default.nix b/pkgs/applications/science/chemistry/openmolcas/default.nix
index 33c77c063bf9..0aeb01c2916b 100644
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@@ -59,6 +59,9 @@ stdenv.mkDerivation {
 
     # Required for a local QCMaquis build
     ./qcmaquis.patch
+
+    # PyParsing >= 3.11 compatibility, can be removed on next release
+    ./pyparsing.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/science/chemistry/openmolcas/pyparsing.patch b/pkgs/applications/science/chemistry/openmolcas/pyparsing.patch
new file mode 100644
index 000000000000..271b52840ff9
--- /dev/null
+++ b/pkgs/applications/science/chemistry/openmolcas/pyparsing.patch
@@ -0,0 +1,37 @@
+diff --git a/Tools/pymolcas/emil_grammar.py b/Tools/pymolcas/emil_grammar.py
+index acbbae8..509c56f 100644
+--- a/Tools/pymolcas/emil_grammar.py
++++ b/Tools/pymolcas/emil_grammar.py
+@@ -15,6 +15,14 @@
+ 
+ from __future__ import (unicode_literals, division, absolute_import, print_function)
+ 
++try:
++  u = unicode
++  del u
++  py2 = True
++except NameError:
++  pass
++
++
+ from re import sub
+ from pyparsing import *
+ 
+@@ -24,6 +32,8 @@ def chomp(s):
+ 
+ def chompAction(s, l, t):
+   try:
++    if (py2):
++      pass
+     return list(map(lambda s: chomp(unicode(s)), t))
+   except NameError:
+     return list(map(chomp, t))
+@@ -33,6 +43,8 @@ def removeEMILEnd(s):
+ 
+ def removeEMILEndAction(s, l, t):
+   try:
++    if (py2):
++      pass
+     return list(map(lambda s: removeEMILEnd(unicode(s)), t))
+   except NameError:
+     return list(map(removeEMILEnd, t))
diff --git a/pkgs/applications/science/math/eigenmath/default.nix b/pkgs/applications/science/math/eigenmath/default.nix
index 561c9c66a50e..3cd9384ecf1f 100644
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "unstable-2023-12-31";
+  version = "unstable-2024-01-22";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "cc92936e226b0a4c77cdc5d00b7a02c472746f6f";
-    hash = "sha256-wY06pZzqcgYdBS7ecB3ZnvmK74ve651n6aHHAN5DWdw=";
+    rev = "db4b22cd536cefbdf0b6c928f11c793a5580da0b";
+    hash = "sha256-T1GXh1go08XVTToEg5Dq4BuwTCxxqYwQsx+c8g1RPxg=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
diff --git a/pkgs/applications/video/davinci-resolve/default.nix b/pkgs/applications/video/davinci-resolve/default.nix
index ba37c886352e..faaef6d5b086 100644
--- a/pkgs/applications/video/davinci-resolve/default.nix
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@@ -82,6 +82,7 @@ let
             "email" = "someone@nixos.org";
             "phone" = "+31 71 452 5670";
             "country" = "nl";
+            "street" = "-";
             "state" = "Province of Utrecht";
             "city" = "Utrecht";
             "product" = PRODUCT;
@@ -109,6 +110,7 @@ let
           --data-ascii "$REQJSON" \
           --compressed \
           "$SITEURL/$DOWNLOADID")
+        echo "resolveurl is $RESOLVEURL"
 
         curl \
           --retry 3 --retry-delay 3 \
@@ -252,7 +254,7 @@ buildFHSEnv {
     description = "Professional video editing, color, effects and audio post-processing";
     homepage = "https://www.blackmagicdesign.com/products/davinciresolve";
     license = licenses.unfree;
-    maintainers = with maintainers; [ jshcmpbll ];
+    maintainers = with maintainers; [ jshcmpbll orivej ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     mainProgram = "davinci-resolve";
diff --git a/pkgs/build-support/build-graalvm-native-image/default.nix b/pkgs/build-support/build-graalvm-native-image/default.nix
index 0612db2ad79b..815c2bf14aae 100644
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@@ -49,17 +49,10 @@ stdenv.mkDerivation ({
 
   nativeImageBuildArgs = nativeImageBuildArgs ++ extraNativeImageBuildArgs ++ [ graalvmXmx ];
 
-  # Workaround GraalVM issue where the builder does not have access to the
-  # environment variables since 21.0.0
-  # https://github.com/oracle/graal/pull/6095
-  # https://github.com/oracle/graal/pull/6095
-  # https://github.com/oracle/graal/issues/7502
-  env.NATIVE_IMAGE_DEPRECATED_BUILDER_SANITATION = "true";
-
   buildPhase = args.buildPhase or ''
     runHook preBuild
 
-    native-image -jar "$jar" ''${nativeImageBuildArgs[@]}
+    native-image -jar "$jar" $(export -p | sed -n 's/^declare -x \([^=]\+\)=.*$/ -E\1/p' | tr -d \\n) ''${nativeImageBuildArgs[@]}
 
     runHook postBuild
   '';
diff --git a/pkgs/by-name/ap/apt/package.nix b/pkgs/by-name/ap/apt/package.nix
index d776493c04b9..d383268b52e1 100644
--- a/pkgs/by-name/ap/apt/package.nix
+++ b/pkgs/by-name/ap/apt/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "2.7.8";
+  version = "2.7.9";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/a/apt/apt_${finalAttrs.version}.tar.xz";
-    hash = "sha256-nAmiwfGEiftDDWFrk+bfWhX2FHOFanidXjzOCtIZXcY=";
+    hash = "sha256-Zm9BzWQf+YlMulMbDMT88ZnmSUWH/LgqObANyItGuyc=";
   };
 
   # cycle detection; lib can't be split
diff --git a/pkgs/by-name/ga/gato/package.nix b/pkgs/by-name/ga/gato/package.nix
index 38297c71dc18..655b60b2b839 100644
--- a/pkgs/by-name/ga/gato/package.nix
+++ b/pkgs/by-name/ga/gato/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gato";
-  version = "1.5";
+  version = "1.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "gato";
     rev = "refs/tags/${version}";
-    hash = "sha256-M9ONeLjEKQD5Kys7OriM34dEBWDKW3qrBk9lu2TitGE=";
+    hash = "sha256-vXQFgP0KDWo1VWe7tMGCB2yEYlr/1KMXsiNupBVLBqc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gt/gtrash/package.nix b/pkgs/by-name/gt/gtrash/package.nix
new file mode 100644
index 000000000000..aee737aa83df
--- /dev/null
+++ b/pkgs/by-name/gt/gtrash/package.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "gtrash";
+  version = "0.0.5";
+
+  src = fetchFromGitHub {
+    owner = "umlx5h";
+    repo = "gtrash";
+    rev = "v${version}";
+    hash = "sha256-5+wcrU2mx/ZawMCSCU4xddMlMVpoIW/Duv7XqUVIDoo=";
+  };
+
+  vendorHash = "sha256-iWNuPxetYH9xJpf3WMoA5c50kII9DUpWvhTVSE1kSk0=";
+
+  subPackages = [ "." ];
+
+  # disabled because it is required to run on docker.
+  doCheck = false;
+
+  CGO_ENABLED = 0;
+  GOFLAGS = [ "-trimpath" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+    "-X main.builtBy=nixpkgs"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd gtrash \
+      --bash <($out/bin/gtrash completion bash) \
+      --fish <($out/bin/gtrash completion fish) \
+      --zsh <($out/bin/gtrash completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "A Trash CLI manager written in Go";
+    homepage = "https://github.com/umlx5h/gtrash";
+    changelog = "https://github.com/umlx5h/gtrash/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ umlx5h ];
+    mainProgram = "gtrash";
+  };
+}
diff --git a/pkgs/by-name/le/lefthook/package.nix b/pkgs/by-name/le/lefthook/package.nix
index 4de73f6cd57c..8fad59a85c2e 100644
--- a/pkgs/by-name/le/lefthook/package.nix
+++ b/pkgs/by-name/le/lefthook/package.nix
@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.5.6";
+  version = "1.5.7";
 in
 buildGoModule rec {
   inherit pname version;
@@ -15,7 +15,7 @@ buildGoModule rec {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-6RSIrsm2VNlOtjAwz/HuCH4VOz/3W6snHSI1LypINYU=";
+    hash = "sha256-0z4hTx9ClGh20Ncf23SbwuPBdGoFz80FQUx7s77l7y8=";
   };
 
   vendorHash = "sha256-/VLS7+nPERjIU7V2CzqXH69Z3/y+GKZbAFn+KcRKRuA=";
diff --git a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
index 37c72e94aa30..aebaab0c7627 100644
--- a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
+++ b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 let
-  version = "1.56.1";
+  version = "1.58.0";
 in
 buildGoModule {
   pname = "tailscale-nginx-auth";
@@ -11,9 +11,9 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-kMk5Q/KvNcsohHNLDMmpBm+gUxQEOeO8o/odukcJi0A=";
+    hash = "sha256-ue1opjT8wkL+hYzMxU/GtOrJd3/KPSOptU8A8nklacY=";
   };
-  vendorHash = "sha256-bG/ydsJf2UncOcDo8/BXdvQJO3Mk0tl8JGje1b6kto4=";
+  vendorHash = "sha256-BK1zugKGtx2RpWHDvFZaFqz/YdoewsG8SscGt25uwtQ=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/vc/vcpkg/package.nix b/pkgs/by-name/vc/vcpkg/package.nix
index 1c19a0a50210..338f8da7c1d2 100644
--- a/pkgs/by-name/vc/vcpkg/package.nix
+++ b/pkgs/by-name/vc/vcpkg/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "vcpkg";
-  version = "2023.12.12";
+  version = "2024.01.12";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg";
     rev = finalAttrs.version;
-    hash = "sha256-WNQJ19bgb55MBnz87Ho9BEHDjD7INLDevfW6lCwV/4U=";
+    hash = "sha256-oIx/eMceFN2q7EfPCR6nFZAw5HK3U6qbyu7z9H1aJbU=";
   };
 
   installPhase = let
diff --git a/pkgs/by-name/zp/zpaqfranz/package.nix b/pkgs/by-name/zp/zpaqfranz/package.nix
index afb7ba4c069c..1cadf937b5cf 100644
--- a/pkgs/by-name/zp/zpaqfranz/package.nix
+++ b/pkgs/by-name/zp/zpaqfranz/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zpaqfranz";
-  version = "58.11";
+  version = "59.1";
 
   src = fetchFromGitHub {
     owner = "fcorbelli";
     repo = "zpaqfranz";
     rev = finalAttrs.version;
-    hash = "sha256-XewHMsHF65LvoRzPFiDQcClVSTfSCn69iDRjwKTLpRs=";
+    hash = "sha256-i5HWAeREeMBjPMNhSSyJPmKRCChn9/08kV97kHOWJdk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/cinnamon/mint-artwork/default.nix b/pkgs/desktops/cinnamon/mint-artwork/default.nix
index d20be81f37a6..7641272b0ec8 100644
--- a/pkgs/desktops/cinnamon/mint-artwork/default.nix
+++ b/pkgs/desktops/cinnamon/mint-artwork/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mint-artwork";
-  version = "1.7.9";
+  version = "1.8.0";
 
   src = fetchurl {
     urls = [
       "http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
-      "https://web.archive.org/web/20231214142428/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
+      "https://web.archive.org/web/20240122135036/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
     ];
-    hash = "sha256-64S7NAQtJuhSeMiSTbW2bqosL4A9M/nzmPYJI/ZAi0U=";
+    hash = "sha256-eCrch5IQdTd92DIqdjZFzvE4oShv3HuXfrLLUmLb0Ms=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/beam-modules/elixir-ls/default.nix b/pkgs/development/beam-modules/elixir-ls/default.nix
index c2f688efce4d..79945e81af25 100644
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@@ -4,12 +4,12 @@
 
 let
   pname = "elixir-ls";
-  version = "0.18.1";
+  version = "0.19.0";
   src = fetchFromGitHub {
     owner = "elixir-lsp";
     repo = "elixir-ls";
     rev = "v${version}";
-    hash = "sha256-o5/H2FeDXzT/ZyWtLmRs+TWJQfmuDUnnR5Brvkifn6E=";
+    hash = "sha256-pd/ZkDpzlheEJfX7X6fFWY4Y5B5Y2EnJMBtuNHPuUJw=";
     fetchSubmodules = true;
   };
 in
@@ -21,7 +21,7 @@ mixRelease {
   mixFodDeps = fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version elixir;
-    hash = "sha256-q4VKtGxrRaAhtNIJFjNN7tF+HFgU/UX9sKq0BkOIiQI=";
+    hash = "sha256-yxcUljclKKVFbY6iUphnTUSqMPpsEiPcw4yUs6atU0c=";
   };
 
   # elixir-ls is an umbrella app
diff --git a/pkgs/development/interpreters/babashka/clojure-tools.nix b/pkgs/development/interpreters/babashka/clojure-tools.nix
index 732b3631583b..afd170a41938 100644
--- a/pkgs/development/interpreters/babashka/clojure-tools.nix
+++ b/pkgs/development/interpreters/babashka/clojure-tools.nix
@@ -6,10 +6,10 @@
 }:
 clojure.overrideAttrs (previousAttrs: {
   pname = "babashka-clojure-tools";
-  version = "1.11.1.1413";
+  version = "1.11.1.1435";
 
   src = fetchurl {
     url = previousAttrs.src.url;
-    hash = "sha256-k8Olo63KUcWFgGNBmr9myD2/JOoV4f2S95v35mI4H+A=";
+    hash = "sha256-RS/FebIED8RYYXRXBKXZPRROO0HqyDo0zhb+p4Q5m8A=";
   };
 })
diff --git a/pkgs/development/interpreters/babashka/default.nix b/pkgs/development/interpreters/babashka/default.nix
index c56ca1ed252c..d548dee0345b 100644
--- a/pkgs/development/interpreters/babashka/default.nix
+++ b/pkgs/development/interpreters/babashka/default.nix
@@ -9,11 +9,11 @@
 let
   babashka-unwrapped = buildGraalvmNativeImage rec {
     pname = "babashka-unwrapped";
-    version = "1.3.186";
+    version = "1.3.188";
 
     src = fetchurl {
       url = "https://github.com/babashka/babashka/releases/download/v${version}/babashka-${version}-standalone.jar";
-      sha256 = "sha256-T7inTJHSnUySituU0fcgZ0xWjIY3yb8BlSakqym67ew=";
+      sha256 = "sha256-EjsSUPWiLQcCos2oyVXt3VzLlGEfiXK5CqJZ1NMvF/E=";
     };
 
     graalvmDrv = graalvmCEPackages.graalvm-ce;
diff --git a/pkgs/development/libraries/pdfhummus/default.nix b/pkgs/development/libraries/pdfhummus/default.nix
index bc587d83f158..bfba4ad09620 100644
--- a/pkgs/development/libraries/pdfhummus/default.nix
+++ b/pkgs/development/libraries/pdfhummus/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pdfhummus";
-  version = "4.6.2";
+  version = "4.6.3";
 
   src = fetchFromGitHub {
     owner = "galkahana";
     repo = "PDF-Writer";
     rev = "v${version}";
-    hash = "sha256-PXiLP0lgqBdDbHHfvRT/d0M1jGjMVZZ3VDYnByzkKeI=";
+    hash = "sha256-6Hp5hacMpVdsiUvMSXBQ5432tPrkHSOiVoWa91sv38k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/crytic-compile/default.nix b/pkgs/development/python-modules/crytic-compile/default.nix
index 26e7080c2139..56dab1fbbb54 100644
--- a/pkgs/development/python-modules/crytic-compile/default.nix
+++ b/pkgs/development/python-modules/crytic-compile/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "crytic-compile";
-  version = "0.3.5";
+  version = "0.3.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "crytic";
     repo = "crytic-compile";
     rev = "refs/tags/${version}";
-    hash = "sha256-aO2K0lc3qjKK8CZAbu/lotI5QJ/R+8npSIRX4a6HdrI=";
+    hash = "sha256-dQynnILHt6YO5qtvVVwcxRwtBJgokyfsQ5ubH15dkuA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/diffusers/default.nix b/pkgs/development/python-modules/diffusers/default.nix
index 2d2c901a5016..2150fdabe66e 100644
--- a/pkgs/development/python-modules/diffusers/default.nix
+++ b/pkgs/development/python-modules/diffusers/default.nix
@@ -39,7 +39,7 @@
 
 buildPythonPackage rec {
   pname = "diffusers";
-  version = "0.25.0";
+  version = "0.25.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -48,7 +48,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "diffusers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3IwBZWSbAMaOo76rUejt4YG7PA0RMLq4LYkNB6SvK6k=";
+    hash = "sha256-AvD/kiwKGojsLlJ0n/U6tTu7ON8Ujl0lZd1e/fDY+CM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gvm-tools/default.nix b/pkgs/development/python-modules/gvm-tools/default.nix
index 7cb78248c172..6f273d09a62b 100644
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "gvm-tools";
-  version = "23.11.0";
+  version = "24.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZwImkTYYSscmGJYCpMWmZjToi41XjT4Znpo8j66BKIs=";
+    hash = "sha256-4uYOhsnprYybt5EB/b4LW8/9cn0Nahc1lYQ+DwPNlOU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index 1fffd07adff8..21ee2b4ac871 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.0.80";
+  version = "0.0.83";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YFXwM/YiQJzJ1Nf76kuq3WtFhU6dUIHzK4K33+VO/lQ=";
+    hash = "sha256-WRrwekh4pcn3I0U/A2Q91ePrRx2RUC3XX+z4bez0BzU=";
   };
 
   sourceRoot = "${src.name}/python";
diff --git a/pkgs/development/python-modules/monai-deploy/default.nix b/pkgs/development/python-modules/monai-deploy/default.nix
index e3a4f2418d16..74b88ca8dc73 100644
--- a/pkgs/development/python-modules/monai-deploy/default.nix
+++ b/pkgs/development/python-modules/monai-deploy/default.nix
@@ -1,13 +1,14 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, pytestCheckHook
-, pytest-lazy-fixture
-, numpy
-, networkx
-, pydicom
 , colorama
+, fetchFromGitHub
+, networkx
+, numpy
+, pydicom
+, pytest-lazy-fixture
+, pytestCheckHook
+, pythonOlder
+, setuptools
 , typeguard
 , versioneer
 }:
@@ -29,10 +30,14 @@ buildPythonPackage rec {
   postPatch = ''
     # Asked in https://github.com/Project-MONAI/monai-deploy-app-sdk/issues/450
     # if this patch can be incorporated upstream.
-    substituteInPlace pyproject.toml --replace 'versioneer-518' 'versioneer'
+    substituteInPlace pyproject.toml \
+      --replace 'versioneer-518' 'versioneer'
   '';
 
-  nativeBuildInputs = [ versioneer ];
+  nativeBuildInputs = [
+    versioneer
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     numpy
@@ -41,11 +46,16 @@ buildPythonPackage rec {
     typeguard
   ];
 
-  nativeCheckInputs = [ pytestCheckHook pytest-lazy-fixture ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-lazy-fixture
+  ];
+
   disabledTests = [
     # requires Docker daemon:
     "test_packager"
   ];
+
   pythonImportsCheck = [
     "monai.deploy"
     "monai.deploy.core"
@@ -57,7 +67,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Framework and tools to design, develop and verify AI applications in healthcare imaging";
     homepage = "https://monai.io/deploy.html";
+    changelog = "https://github.com/Project-MONAI/monai-deploy-app-sdk/blob/main/docs/source/release_notes/v${version}.md";
     license = licenses.asl20;
-    maintainers = [ maintainers.bcdarwin ];
+    maintainers = with maintainers; [ bcdarwin ];
   };
 }
diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index 8e9ac1b408d2..dc9313b9e4fb 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -9,6 +9,8 @@
 , pytestCheckHook
 , pythonOlder
 , ruamel-yaml
+, setuptools
+, setuptools-scm
 , torch
 , tqdm
 }:
@@ -16,13 +18,13 @@
 buildPythonPackage rec {
   pname = "monty";
   version = "2023.11.3";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "materialsvirtuallab";
-    repo = pname;
+    repo = "monty";
     rev = "refs/tags/v${version}";
     hash = "sha256-SENrAHCCWYEMWqPQSy61E8bMYkCBJepK5otb7B7UGXA=";
   };
@@ -32,6 +34,11 @@ buildPythonPackage rec {
       --replace 'self.assertEqual("/usr/bin/find", which("/usr/bin/find"))' '#'
   '';
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
     msgpack
     ruamel-yaml
diff --git a/pkgs/development/python-modules/python-frontmatter/default.nix b/pkgs/development/python-modules/python-frontmatter/default.nix
index c359d4ee87f7..eab892f49283 100644
--- a/pkgs/development/python-modules/python-frontmatter/default.nix
+++ b/pkgs/development/python-modules/python-frontmatter/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "python-frontmatter";
-  version = "1.0.1";
+  version = "1.1.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "eyeseast";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-lkBCKZ1fZF580+4TnHYkfaGJjsWk7/Ksnk7VagZuef8=";
+    sha256 = "sha256-Sr0RbNVk87Zu01U7nkuPUSnl1bm6G72EZDP/eDn099s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-songpal/default.nix b/pkgs/development/python-modules/python-songpal/default.nix
index 3f73bf1e5a94..916288860fb5 100644
--- a/pkgs/development/python-modules/python-songpal/default.nix
+++ b/pkgs/development/python-modules/python-songpal/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "python-songpal";
-  version = "0.16";
+  version = "0.16.1";
 
   format = "pyproject";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "rytilahti";
     repo = "python-songpal";
     rev = "refs/tags/release/${version}";
-    hash = "sha256-wHyq63RG0lhzG33ssWyvzLjc7s1OqquXMN26N2MBHU8=";
+    hash = "sha256-qlypUGrObvn6YyzFhJe2rJvVdI6v+PkWLfjMpc1Lm2k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qtile/default.nix b/pkgs/development/python-modules/qtile/default.nix
index ef1df14b2184..43e6cb00bfe2 100644
--- a/pkgs/development/python-modules/qtile/default.nix
+++ b/pkgs/development/python-modules/qtile/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "qtile";
-  version = "0.23.0";
+  version = "0.24.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "qtile";
     repo = "qtile";
     rev = "v${version}";
-    hash = "sha256-WxnpkKqYGGEsFTt/1iCSiCzdESJP6HFJ6BztaMsMbYo=";
+    hash = "sha256-mgMRkoKT0Gp5/OfVQbkeDTkg9QRFn4PU3ziM5E6V+oI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/qutip/default.nix b/pkgs/development/python-modules/qutip/default.nix
index 0b58eafa398d..ddd3b18adbf0 100644
--- a/pkgs/development/python-modules/qutip/default.nix
+++ b/pkgs/development/python-modules/qutip/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "qutip";
-  version = "4.7.3";
+  version = "4.7.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-cpzUHjZBpAbNEnYRuY1wUZouAEAgBaN9rWdxRSfI3bs=";
+    hash = "sha256-gfWYlQoGESE+EryLVfsnmBq9xFf3d92xOmEz4A32iqU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/b4/default.nix b/pkgs/development/tools/b4/default.nix
index 24da485d863d..8999d3f4b62a 100644
--- a/pkgs/development/tools/b4/default.nix
+++ b/pkgs/development/tools/b4/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "b4";
-  version = "0.12.3";
+  version = "0.12.4";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tk4VBvSnHE6VnUAa3QYCqFLQbsHTJ6Bfqwa1wKEC6mI=";
+    hash = "sha256-n3mLtthtTN1uAmsmM6dX+Nc7iEo5KzzHiH8iAJmV/Q0=";
   };
 
   # tests make dns requests and fails
diff --git a/pkgs/development/tools/backblaze-b2/default.nix b/pkgs/development/tools/backblaze-b2/default.nix
index e37fd54832c2..e82c32940891 100644
--- a/pkgs/development/tools/backblaze-b2/default.nix
+++ b/pkgs/development/tools/backblaze-b2/default.nix
@@ -1,4 +1,7 @@
-{ lib, python3Packages, fetchPypi, installShellFiles, testers, backblaze-b2 }:
+{ lib, python3Packages, fetchPypi, installShellFiles, testers, backblaze-b2
+# executable is renamed to backblaze-b2 by default, to avoid collision with boost's 'b2'
+, execName ? "backblaze-b2"
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "backblaze-b2";
@@ -68,17 +71,18 @@ python3Packages.buildPythonApplication rec {
     "test/unit/console_tool"
   ];
 
-  postInstall = ''
-    mv "$out/bin/b2" "$out/bin/backblaze-b2"
-
-    installShellCompletion --cmd backblaze-b2 \
-      --bash <(${python3Packages.argcomplete}/bin/register-python-argcomplete backblaze-b2) \
-      --zsh <(${python3Packages.argcomplete}/bin/register-python-argcomplete backblaze-b2)
+  postInstall = lib.optionalString (execName != "b2") ''
+    mv "$out/bin/b2" "$out/bin/${execName}"
+  ''
+  + ''
+    installShellCompletion --cmd ${execName} \
+      --bash <(${python3Packages.argcomplete}/bin/register-python-argcomplete ${execName}) \
+      --zsh <(${python3Packages.argcomplete}/bin/register-python-argcomplete ${execName})
   '';
 
   passthru.tests.version = (testers.testVersion {
     package = backblaze-b2;
-    command = "backblaze-b2 version --short";
+    command = "${execName} version --short";
   }).overrideAttrs (old: {
     # workaround the error: Permission denied: '/homeless-shelter'
     # backblaze-b2 fails to create a 'b2' directory under the XDG config path
diff --git a/pkgs/development/tools/go-containerregistry/default.nix b/pkgs/development/tools/go-containerregistry/default.nix
index 956ded6b6edb..f5c742ce9102 100644
--- a/pkgs/development/tools/go-containerregistry/default.nix
+++ b/pkgs/development/tools/go-containerregistry/default.nix
@@ -4,13 +4,13 @@ let bins = [ "crane" "gcrane" ]; in
 
 buildGoModule rec {
   pname = "go-containerregistry";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-spo8iRf3FqX7DyaTqIuiGOVrgv0PRqa05TQcanzB8FY=";
+    sha256 = "sha256-JL8OLL0dTvtk6gfzyCdQi+mSbcLZeklvQc/bC4L5+eE=";
   };
   vendorHash = null;
 
diff --git a/pkgs/development/tools/misc/gdbgui/default.nix b/pkgs/development/tools/misc/gdbgui/default.nix
index 523cd85efb6a..d42639892062 100644
--- a/pkgs/development/tools/misc/gdbgui/default.nix
+++ b/pkgs/development/tools/misc/gdbgui/default.nix
@@ -12,7 +12,7 @@
 buildPythonApplication rec {
   pname = "gdbgui";
 
-  version = "0.15.1.0";
+  version = "0.15.2.0";
 
   buildInputs = [ gdb ];
   propagatedBuildInputs = [
@@ -25,7 +25,7 @@ buildPythonApplication rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-YcD3om7N6yddm02It6/fjXDsVHG0Cs46fdGof0PMJXM=";
+    sha256 = "sha256-vmMlRmjFqhs3Vf+IU9IDtJzt4dZ0yIOmXIVOx5chZPA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/usbsdmux/default.nix b/pkgs/development/tools/misc/usbsdmux/default.nix
index 5fda623d819f..03c2b9c9dbec 100644
--- a/pkgs/development/tools/misc/usbsdmux/default.nix
+++ b/pkgs/development/tools/misc/usbsdmux/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "usbsdmux";
-  version = "0.2.1";
+  version = "24.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-gCxwR5jxzkH22B6nxBwAd0HpwWMIj/zp5VROJ0IWq7c=";
+    sha256 = "sha256-Qt60QKRadFoPiHjmpx9tmid4K+6ixCN7JD7JHcT5MDE=";
   };
 
   # usbsdmux is not meant to be used as an importable module and has no tests
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index ffd29e81794d..26e3947e191c 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "19.6.0";
+  version = "19.8.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-/VkI/ACUTGRcFpJhUV068m8HdM44NiandS+2a+Ms6vs=";
+    hash = "sha256-nCzGvWthu+gmYKKEqnU552Y4Ii4O7Ttel/9wmZo84fY=";
   };
 
   vendorHash = "sha256-8ZupQe4b3uCX79Q0oYqggMWZE9CfX5OSFdLIrxT8CHY=";
diff --git a/pkgs/development/tools/patatt/default.nix b/pkgs/development/tools/patatt/default.nix
index 847698f79954..aed80b94ac6b 100644
--- a/pkgs/development/tools/patatt/default.nix
+++ b/pkgs/development/tools/patatt/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "patatt";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-WaEq4qWL6xAZ3cJJ/lkJ5XTIrXcOMIESbytvWbsYx2s=";
+    sha256 = "sha256-mAgm9lKdJXbCZ8ofVk1b7wRstH5UIVu1mO1sS5stCig=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/development/tools/reshape/default.nix b/pkgs/development/tools/reshape/default.nix
index 9a4176313258..d0bf9110c14e 100644
--- a/pkgs/development/tools/reshape/default.nix
+++ b/pkgs/development/tools/reshape/default.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reshape";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-pTEOVDeCE69dn005nj1ULGKjguCtC1uReI/l3WEz4+w=";
+    hash = "sha256-wv2gKyXCEH+tnZkUUAisMbuseth3dsFiJujH8VO1ii4=";
   };
 
-  cargoHash = "sha256-KYU5drTVHdWmlE01Fq1TxJZTe87yBpDKIGm4P+RRCGw=";
+  cargoHash = "sha256-VTJ3FNhVLgxo/VVBhk1yF9UUktLXcbrEkYwoyoWFhXA=";
 
   nativeCheckInputs = [
     postgresqlTestHook
diff --git a/pkgs/development/tools/sd-local/default.nix b/pkgs/development/tools/sd-local/default.nix
index 56fff1c2d56b..b8a01e2633b5 100644
--- a/pkgs/development/tools/sd-local/default.nix
+++ b/pkgs/development/tools/sd-local/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "sd-local";
-  version = "1.0.51";
+  version = "1.0.52";
 
   src = fetchFromGitHub {
     owner = "screwdriver-cd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CKbOgZ9dnQ5ao5fQYMbPhMNS5ww4N54ECHKhhdBEII8=";
+    sha256 = "sha256-2EWLi42ztuohouhMZ3DXa2wHx1tgPAUH0IKbn6lQeF0=";
   };
 
   vendorHash = "sha256-uHu8jPPQCJAhXE+Lzw5/9wyw7sL5REQJsPsYII+Nusc=";
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 7fc90ace2624..a2f80505cd95 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -40,7 +40,7 @@
   modDirVersion ? null
 
 , # An attribute set whose attributes express the availability of
-  # certain features in this kernel.  E.g. `{iwlwifi = true;}'
+  # certain features in this kernel.  E.g. `{ia32Emulation = true;}'
   # indicates a kernel that provides Intel wireless support.  Used in
   # NixOS to implement kernel-specific behaviour.
   features ? {}
@@ -92,9 +92,7 @@ let
 
   # Combine the `features' attribute sets of all the kernel patches.
   kernelFeatures = lib.foldr (x: y: (x.features or {}) // y) ({
-    iwlwifi = true;
     efiBootStub = true;
-    needsCifsUtils = true;
     netfilterRPFilter = true;
     ia32Emulation = true;
   } // features) kernelPatches;
diff --git a/pkgs/os-specific/linux/nsncd/default.nix b/pkgs/os-specific/linux/nsncd/default.nix
index 81590a6f8692..01cb6695b330 100644
--- a/pkgs/os-specific/linux/nsncd/default.nix
+++ b/pkgs/os-specific/linux/nsncd/default.nix
@@ -7,19 +7,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nsncd";
-  version = "unstable-2023-10-26";
+  version = "unstable-2024-01-16";
 
-  # https://github.com/twosigma/nsncd/pull/71 has not been upstreamed
-  # to twosigma/nsncd yet. Using the nix-community fork in the
-  # meantime.
   src = fetchFromGitHub {
-    owner = "nix-community";
+    owner = "twosigma";
     repo = "nsncd";
-    rev =  "d6513421f420e407248c6d0aee39ae2f861a7cec";
-    hash = "sha256-PykzwpPxMDHJOr2HubXuw+Krk9Jbi0E3M2lEAOXhx2M=";
+    rev =  "f4706786f26d12c533035fb2916be9be5751150b";
+    hash = "sha256-GbKDWW00eZZwmslkaGIO8hjCyD5xi7h+S2WP6q5ekOQ=";
   };
 
-  cargoSha256 = "sha256-cUM7rYXWpJ0aMiurXBp15IlxAmf/x5uiodxEqBPCQT0=";
+  cargoSha256 = "sha256-jAxcyMPDTBFBrG0cuKm0Tm5p/UEnUgTPQKDgqY2yK7w=";
+  checkFlags = [
+    # Relies on the test environment to be able to resolve "localhost"
+    # on IPv4. That's not the case in the Nix sandbox somehow. Works
+    # when running cargo test impurely on a (NixOS|Debian) machine.
+    "--skip=ffi::test_gethostbyname2_r"
+  ];
 
   meta = with lib; {
     description = "the name service non-caching daemon";
diff --git a/pkgs/servers/homepage-dashboard/default.nix b/pkgs/servers/homepage-dashboard/default.nix
index ca35f31fc1fa..973208affa0a 100644
--- a/pkgs/servers/homepage-dashboard/default.nix
+++ b/pkgs/servers/homepage-dashboard/default.nix
@@ -13,13 +13,13 @@
 
 buildNpmPackage rec {
   pname = "homepage-dashboard";
-  version = "0.8.4";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "gethomepage";
     repo = "homepage";
     rev = "v${version}";
-    hash = "sha256-WjyOpR8DcjlJJgUkWortc0ApgpusknTSeVQlSa5rCRQ=";
+    hash = "sha256-ws4zPt6N4gPRLgJAeozPlbSJm0mOQKmkOZpKeB1y+J0=";
   };
 
   npmDepsHash = "sha256-RC2Y4XZqO+mLEKQxq+j2ukZYi/uu9XIjYadxek9P+SM=";
diff --git a/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch b/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch
deleted file mode 100644
index 3b6094bd02f0..000000000000
--- a/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 1a914beafe2b00770213fa4d146ffad9d897dc0c Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Sat, 12 Aug 2023 12:27:25 +0200
-Subject: [PATCH] Disable broken `test_help_output` testcase
-
-The assertion fails, but checking for the exact whereabouts of helptext
-doesn't bring too much value anyways, so it seems OK to just skip the
-test.
----
- .../tests/commands/test_attachments_to_file.py      | 13 -------------
- 1 file changed, 13 deletions(-)
-
-diff --git a/hyperkitty/tests/commands/test_attachments_to_file.py b/hyperkitty/tests/commands/test_attachments_to_file.py
-index b3e61f3a..8db7c4b2 100644
---- a/hyperkitty/tests/commands/test_attachments_to_file.py
-+++ b/hyperkitty/tests/commands/test_attachments_to_file.py
-@@ -83,16 +83,3 @@ class CommandTestCase(TestCase):
-             self.assertEqual(fp.getvalue(), """\
- 2 attachments moved.
- """)
--
--    def test_help_output(self):
--        with io.StringIO() as fp, redirect_stdout(fp):
--            with suppress(SystemExit):
--                call_command('attachments_to_file', '--help')
--
--            output_value = fp.getvalue()
--            assert (
--                "HYPERKITTY_ATTACHMENT_FOLDER" in output_value
--                and "-c CHUNK_SIZE" in output_value
--                and "-c CHUNK_SIZE, --chunk-size CHUNK_SIZE" in output_value
--                and "-v {0,1}, --verbosity {0,1}" in output_value
--            )
--- 
-2.40.1
-
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index d52964f3a1a2..89195e593737 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -1,7 +1,6 @@
 { lib
 , python3
 , fetchPypi
-, fetchpatch
 , nixosTests
 }:
 
@@ -9,28 +8,17 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "HyperKitty";
-  version = "1.3.7";
-  disabled = pythonOlder "3.8";
+  version = "1.3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-TXSso+wwVGdBymIzns5yOS4pj1EdConmm87b/NyBAss=";
+    hash = "sha256-j//Mrbos/g1BGenHRmOe5GvAza5nu/mchAgdLQu9h7g=";
   };
 
-  patches = [
-    ./0001-Disable-broken-test_help_output-testcase.patch
-    (fetchpatch {
-      url = "https://gitlab.com/mailman/hyperkitty/-/commit/5bb394662882bfc73c3e877458da44343aa06922.patch";
-      hash = "sha256-9vcY6nu3txDftH6aYpdh9qSrLzZceGjVFxuD1Ux18gw=";
-    })
-  ];
-
   postPatch = ''
     # isort is a development dependency
     sed -i '/isort/d' setup.py
-    # Fix mistune imports for mistune >= 2.0.0
-    # https://gitlab.com/mailman/hyperkitty/-/merge_requests/379
-    sed -i 's/mistune.scanner/mistune.util/' hyperkitty/lib/renderer.py
   '';
 
   propagatedBuildInputs = [
@@ -56,6 +44,7 @@ buildPythonPackage rec {
   # HyperKitty so they're not included for people who don't need them.
   nativeCheckInputs = [
     beautifulsoup4
+    elastic-transport
     elasticsearch
     mock
     whoosh
@@ -70,6 +59,7 @@ buildPythonPackage rec {
   passthru.tests = { inherit (nixosTests) mailman; };
 
   meta = {
+    changelog = "https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html";
     homepage = "https://www.gnu.org/software/mailman/";
     description = "Archiver for GNU Mailman v3";
     license = lib.licenses.gpl3;
diff --git a/pkgs/servers/mail/mailman/package.nix b/pkgs/servers/mail/mailman/package.nix
index 1069c6332306..f38a182461ac 100644
--- a/pkgs/servers/mail/mailman/package.nix
+++ b/pkgs/servers/mail/mailman/package.nix
@@ -11,12 +11,12 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "mailman";
-  version = "3.3.8";
+  version = "3.3.9";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-g6wH7lXqK0yJ8AxO1HFxMvBicBJ9NGWlPePFyxl9Qc4=";
+    hash = "sha256-GblXI6IwkLl+V1gEbMAe1baVyZOHMaYaYITXcTkp2Mo=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -52,18 +52,10 @@ buildPythonPackage rec {
       url = "https://gitlab.com/mailman/mailman/-/commit/9613154f3c04fa2383fbf017031ef263c291418d.patch";
       sha256 = "0vyw87s857vfxbf7kihwb6w094xyxmxbi1bpdqi3ybjamjycp55r";
     })
-    (fetchpatch {
-      url = "https://gitlab.com/mailman/mailman/-/commit/5e4431af6bb7d672a7ed7e3329f8fac7812d47f8.patch";
-      excludes = [ ".gitlab-ci.yml" ];
-      hash = "sha256-y2AE9hU4Z1BpBlJywxMWiuRvltWkk+R9YgMkpemvlIo=";
-    })
     ./log-stderr.patch
   ];
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace "alembic>=1.6.2,<1.7" "alembic>=1.6.2"
-
     substituteInPlace src/mailman/config/postfix.cfg \
       --replace /usr/sbin/postmap ${postfix}/bin/postmap
     substituteInPlace src/mailman/config/schema.cfg \
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index de1951ce15c1..27b878c38502 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -4,11 +4,11 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "postorius";
-  version = "1.3.8";
+  version = "1.3.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-1mSt+PVx3xUJDc5JwrCmKiRNIDwbsjjbM2Fi5Sgz6h8=";
+    hash = "sha256-GmbIqO+03LgbUxJ1nTStXrYN3t2MfvzbeYRAipfTW1o=";
   };
 
   propagatedBuildInputs = [ django-mailman3 readme_renderer ];
diff --git a/pkgs/servers/mail/mailman/python.nix b/pkgs/servers/mail/mailman/python.nix
index e5eb2251b5e1..ebac15e443bf 100644
--- a/pkgs/servers/mail/mailman/python.nix
+++ b/pkgs/servers/mail/mailman/python.nix
@@ -18,14 +18,6 @@ python3.override {
         [1] 72a14ea563a3f5bf85db659349a533fe75a8b0ce
         [2] f931bc81d63f5cfda55ac73d754c87b3fd63b291
       */
-      elasticsearch = super.elasticsearch.overridePythonAttrs ({ pname, ... }: rec {
-        version = "7.17.9";
-        src = fetchPypi {
-          inherit pname version;
-          hash = "sha256-ZsTs4q3+fMEg4rameYof1cd3rs+C7sObuVzvfPx+orM=";
-        };
-      });
-
       # https://gitlab.com/mailman/hyperkitty/-/merge_requests/541
       mistune = super.mistune.overridePythonAttrs (old: rec {
         version = "2.0.5";
@@ -37,11 +29,12 @@ python3.override {
       });
 
       # django-q tests fail with redis 5.0.0.
+      # https://gitlab.com/mailman/hyperkitty/-/issues/493
       redis = super.redis.overridePythonAttrs ({ pname, ... }: rec {
-        version = "4.5.4";
+        version = "4.6.0";
         src = fetchPypi {
           inherit pname version;
-          hash = "sha256-c+w12k2iZ9aEfkf2hzD91fYuLKaePvWIXGp4qTdMOJM=";
+          hash = "sha256-WF3FFrnrBCphnvCjnD19Vf6BvbTfCaUsnN3g0Hvxqn0=";
         };
       });
     })
diff --git a/pkgs/servers/mail/mailman/web.nix b/pkgs/servers/mail/mailman/web.nix
index e9ef718d84f1..d347f434ab50 100644
--- a/pkgs/servers/mail/mailman/web.nix
+++ b/pkgs/servers/mail/mailman/web.nix
@@ -1,4 +1,4 @@
-{ lib, python3, fetchPypi, fetchpatch
+{ lib, python3, fetchPypi
 , sassc, hyperkitty, postorius
 , nixosTests
 }:
@@ -7,21 +7,14 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "mailman-web";
-  version = "0.0.6";
+  version = "0.0.8";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-UWdqrcx529r6kwgf0YEHiDrpZlGoUBR6OdYtHMTPMGY=";
+    hash = "sha256-nN/L+X2Rvm6rqkscns4Tn2TAr59O5lCJObvcJp6M0+Q=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.com/mailman/mailman-web/-/commit/448bba249d39c09c0cef5e059415cc07a3ce569c.patch";
-      hash = "sha256-rs1vaV4YyLyJ0+EGY70CirvjArpGQr29DOTvgj68wgs=";
-    })
-  ];
-
   postPatch = ''
     # Django is depended on transitively by hyperkitty and postorius,
     # and mailman_web has overly restrictive version bounds on it, so
diff --git a/pkgs/servers/nats-server/default.nix b/pkgs/servers/nats-server/default.nix
index 60073aef2a1d..a173224a1b40 100644
--- a/pkgs/servers/nats-server/default.nix
+++ b/pkgs/servers/nats-server/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "nats-server";
-  version = "2.10.7";
+  version = "2.10.9";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DZ0a4gptTjuSVBlhDEWKTmU6Dgt36xulfjVK1kJtXhI=";
+    hash = "sha256-ncNiU5n7LvVXEgDiZAu+OzbtAkGHyrbOsGLTSMMIVps=";
   };
 
-  vendorHash = "sha256-Q2wc4esu2H81ct9TUPs+ysT3LrW698+9JllbvdDa5Yc=";
+  vendorHash = "sha256-akkDKIRp2uG+6z/YVB2M6BxLQGNt1qPhvW/BwnjsBHA=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index fc12e6dd4071..f8db6e252209 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.20.5";
+  version = "0.20.7";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-a6UraZzl4mtacjrK3CbuJaOJ2jDw/8+t77w/JDMy9XA=";
+    hash = "sha256-ySdgq9U4pgXMSsP8fTbVop7Dwm3vUhTWwysndhNaBUU=";
   };
 
-  vendorHash = "sha256-Y70GNXThSZdG+28/ZQgxXhyZWAtMu0OM97Yhmo0Eigc=";
+  vendorHash = "sha256-72Q9/lLs57y+OPMV/ITcLLxW79YzHjSFThK4txZ1qZo=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/shells/zsh/zsh-prezto/default.nix b/pkgs/shells/zsh/zsh-prezto/default.nix
index 3645305d401c..a15c93d3df26 100644
--- a/pkgs/shells/zsh/zsh-prezto/default.nix
+++ b/pkgs/shells/zsh/zsh-prezto/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsh-prezto";
-  version = "unstable-2023-11-30";
+  version = "unstable-2024-01-18";
 
   src = fetchFromGitHub {
     owner = "sorin-ionescu";
     repo = "prezto";
-    rev = "c0cdc12708803c4503cb1b3d7d42e5c1b8ba6e86";
-    sha256 = "gexMZEb2n3izZk0c7Q42S9s2ILevK0mn09pTCGQhp1M=";
+    rev = "ac356c8cf6af51f276483ae8bb8c9c4954183eb9";
+    sha256 = "tyj92iZUFfS0xMaEkqIYvPJcksNlAQS4bKtDkWp0Ctc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/admin/balena-cli/default.nix b/pkgs/tools/admin/balena-cli/default.nix
index b1eb3db82b1f..04eccbc6cac4 100644
--- a/pkgs/tools/admin/balena-cli/default.nix
+++ b/pkgs/tools/admin/balena-cli/default.nix
@@ -18,16 +18,16 @@ let
   };
 in buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "17.4.11";
+  version = "17.4.12";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-iDIbykHSI5mVi6wvQhsox+d/Eu03dJB3qOk664CHATY=";
+    hash = "sha256-lyGcsGM/QCkOl9wFy8u1UEHkLHaWPPRfgkcD/uH4MD0=";
   };
 
-  npmDepsHash = "sha256-D0vGwYl0oofeAZhIZDGZttjhjbKldGzDJmt1IRYqUCs=";
+  npmDepsHash = "sha256-/kbvJwNdH86oHv7SpGmtns7QwoLTwCgN+LUsZE2A+to=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/tools/backup/gphotos-sync/default.nix b/pkgs/tools/backup/gphotos-sync/default.nix
index 74c442c09583..9fefd79c3c62 100644
--- a/pkgs/tools/backup/gphotos-sync/default.nix
+++ b/pkgs/tools/backup/gphotos-sync/default.nix
@@ -5,41 +5,26 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "gphotos-sync";
-  version = "3.1.2";
+  version = "3.2.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "gilesknap";
     repo = "gphotos-sync";
     rev = version;
-    hash = "sha256-lLw450Rk7tIENFTZWHoinkhv3VtctDv18NKxhox+NgI=";
+    hash = "sha256-iTqD/oUQqC7Fju8SEPkSZX7FC9tE4eRCewiJR8STmEw=";
   };
 
   patches = [
     ./skip-network-tests.patch
   ];
 
-  # Consider fixing this upstream by following up on:
-  # https://github.com/gilesknap/gphotos-sync/issues/441
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "setuptools<57" "setuptools" \
-      --replace "wheel==0.33.1" "wheel"
-  '';
-
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
   ];
 
-  pythonRelaxDeps = [
-    "psutil"
-    "exif"
-    "pyyaml"
-  ];
-
   propagatedBuildInputs = with python3.pkgs; [
     appdirs
     attrs
@@ -63,9 +48,8 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   preCheck = ''
+    export PY_IGNORE_IMPORTMISMATCH=1
     export HOME=$(mktemp -d)
-    substituteInPlace setup.cfg \
-      --replace "--cov=gphotos_sync --cov-report term --cov-report xml:cov.xml" ""
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/backup/monolith/default.nix b/pkgs/tools/backup/monolith/default.nix
index 38ae3e7cddd3..10859512ef80 100644
--- a/pkgs/tools/backup/monolith/default.nix
+++ b/pkgs/tools/backup/monolith/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "monolith";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "Y2Z";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TYLQkVVjIFr6BrPaKJSHDnLAK0HQuI3Pmi2IkWVoIn4=";
+    sha256 = "sha256-qMB4Tok0tYAqj8r9LEkjhBV5ko+hwagFS7MsL8AYJnc=";
   };
 
-  cargoHash = "sha256-NIKueum/BQEW21e8/DGadtwylXeT3Vl2TOVbbxxWkLY=";
+  cargoHash = "sha256-FeD0+s79orFDUVsb205W0pdXgDI+p1UrH3GIfKwUqDQ=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
   buildInputs = lib.optionals stdenv.isLinux [ openssl ]
diff --git a/pkgs/tools/misc/audible-cli/default.nix b/pkgs/tools/misc/audible-cli/default.nix
index e7f073451b5d..297917b6a92a 100644
--- a/pkgs/tools/misc/audible-cli/default.nix
+++ b/pkgs/tools/misc/audible-cli/default.nix
@@ -2,14 +2,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "audible-cli";
-  version = "0.2.5";
+  version = "0.2.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkb79";
     repo = "audible-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YGvnye6YSp/H/2HAw6A8z5VzzCqa3ktJucq+3cXPUpc=";
+    hash = "sha256-J81RcehFokOpsQBJLvmeihSrlMyX0geHPl3PPxvGjmY=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/misc/doitlive/default.nix b/pkgs/tools/misc/doitlive/default.nix
index 483b36d98d31..9e1d83bb4d98 100644
--- a/pkgs/tools/misc/doitlive/default.nix
+++ b/pkgs/tools/misc/doitlive/default.nix
@@ -2,13 +2,16 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "doitlive";
-  version = "4.3.0";
+  version = "5.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03qrs032x206xrl0x3z0fpvxgjivzz9rkmb11bqlk1id10707cac";
+    hash = "sha256-jAoibszDpQJjiNCZDhX3fLniALOG7r9YqaYEySkmMM4=";
   };
 
+  nativeBuildInputs = with python3Packages; [ setuptools ];
+
   propagatedBuildInputs = with python3Packages; [ click click-completion click-didyoumean ];
 
   # disable tests (too many failures)
@@ -16,7 +19,8 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Tool for live presentations in the terminal";
-    homepage = "https://pypi.python.org/pypi/doitlive";
+    homepage = "https://github.com/sloria/doitlive";
+    changelog = "https://github.com/sloria/doitlive/blob/${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ mbode ];
     mainProgram = "doitlive";
diff --git a/pkgs/tools/misc/edir/default.nix b/pkgs/tools/misc/edir/default.nix
index 9fd1c70ba7eb..41e51a251b38 100644
--- a/pkgs/tools/misc/edir/default.nix
+++ b/pkgs/tools/misc/edir/default.nix
@@ -2,12 +2,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "edir";
-  version = "2.22";
+  version = "2.27";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Z4p16v0J7mgl1Av8tdUZ6vSILgbOpLHs3rWx2P7AH+E=";
+    sha256 = "sha256-i9c5DDZnCj6Roqw6fpy+rhX2/Sup1hh8vIpsRcWZQFc=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index d7562da9cd42..1f7a27e61914 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.6.1";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-XxQtAEGQEnwX3ks1ukAfDrGvgFfFjwe2XdF6uQViRjc=";
+    hash = "sha256-pHDlMeFsC99RuTCSbQT+2LbQ7SACeTWfwP56D/AUb3g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/fuc/default.nix b/pkgs/tools/misc/fuc/default.nix
index 1c033ba32349..f30c26092a97 100644
--- a/pkgs/tools/misc/fuc/default.nix
+++ b/pkgs/tools/misc/fuc/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fuc";
-  version = "1.1.10";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "SUPERCILEX";
     repo = "fuc";
     rev = version;
-    hash = "sha256-NFYIz8YwS4Qpj2owfqV5ZSCzRuUi8nEAJl0m3V46Vnk=";
+    hash = "sha256-Y43+LB6JXxpU94BrrjSBs2ge2g3NB7O3wYeU6rbF28U=";
   };
 
-  cargoHash = "sha256-QcpdAJH7Ry3VzSqXd1xM++Z44TCL6r9nrrt1OGj89oI=";
+  cargoHash = "sha256-uNG+7a9EvGLkPIu/p8tnucZ3R6/LhZ2Lfv7V0e5YIxs=";
 
   RUSTC_BOOTSTRAP = 1;
 
diff --git a/pkgs/tools/misc/tailspin/default.nix b/pkgs/tools/misc/tailspin/default.nix
index 15af583ce0c4..c3262cb26ac1 100644
--- a/pkgs/tools/misc/tailspin/default.nix
+++ b/pkgs/tools/misc/tailspin/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tailspin";
-  version = "2.4.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "bensadeh";
     repo = "tailspin";
     rev = version;
-    hash = "sha256-xr9dxq6hUlF3kcXCfmnX2C71NYuGducD0BwbQDnyYJU=";
+    hash = "sha256-cZG4Yu//MKLkQeGP7q+8O0Iy72iyyxfOERsS6kzT7ts=";
   };
 
-  cargoHash = "sha256-1jPVCYq8W+LjJCdEimImUcSmd2OvIKMs5n9yl3g7sBM=";
+  cargoHash = "sha256-rOKJAmqL58UHuG6X5fcQ4UEw2U3g81lKftmFeKy25+w=";
 
   meta = with lib; {
     description = "A log file highlighter";
diff --git a/pkgs/tools/networking/hblock/default.nix b/pkgs/tools/networking/hblock/default.nix
index 8d7f25678edf..d7931276e444 100644
--- a/pkgs/tools/networking/hblock/default.nix
+++ b/pkgs/tools/networking/hblock/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hblock";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchFromGitHub {
     owner = "hectorm";
     repo = "hblock";
     rev = "v${version}";
-    hash = "sha256-wO0xfD1bMRhoU7jorsIenlKJ87DzrtVH66OSZ4UT3MM=";
+    hash = "sha256-x9gkPCuGAPMCh9i4gM+9bIY8zVFiWlJ3eTNlhG6zR8Y=";
   };
 
   buildInputs = [ coreutils curl gnugrep gawk ];
diff --git a/pkgs/tools/security/mkp224o/default.nix b/pkgs/tools/security/mkp224o/default.nix
index 2ac4304d6d2e..d6ee40e6f5ea 100644
--- a/pkgs/tools/security/mkp224o/default.nix
+++ b/pkgs/tools/security/mkp224o/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mkp224o";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "cathugger";
     repo = "mkp224o";
     rev = "v${version}";
-    sha256 = "sha256-+TJ137DmgaFZX+/N6VwXJwfVCoTWtC8NqfXfYJC8UHo=";
+    sha256 = "sha256-OL3xhoxIS1OqfVp0QboENFdNH/e1Aq1R/MFFM9LNFbQ=";
   };
 
   buildCommand =
diff --git a/pkgs/tools/security/trustymail/default.nix b/pkgs/tools/security/trustymail/default.nix
index eb384ce16253..88d321708886 100644
--- a/pkgs/tools/security/trustymail/default.nix
+++ b/pkgs/tools/security/trustymail/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "trustymail";
-  version = "0.8.1";
+  version = "0.8.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "cisagov";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-hKiQWAOzUjmoCcEH9OTgkgU7s1V+Vv3+93OLkqDRDoU=";
+    hash = "sha256-aFXz78Gviki0yIcnn2EgR3mHmt0wMoY5u6RoT6zQc1Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/security/vals/default.nix b/pkgs/tools/security/vals/default.nix
index 8f25dc1a211a..55fffe9fd2bf 100644
--- a/pkgs/tools/security/vals/default.nix
+++ b/pkgs/tools/security/vals/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vals";
-  version = "0.32.0";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "variantdev";
     repo = pname;
-    sha256 = "sha256-UBN0QMrYyYm7O1MrduGmXOSLZ5Qwjq0LMgvWhoVwzGI=";
+    sha256 = "sha256-ZF73oLe/2s+zsMNElgjnVT7GCsH4VSP1IWTy647JZyw=";
   };
 
-  vendorHash = "sha256-2gS4m+eQSrXcMtT/7AzPW5KcGww8gSJm2doyBa6pLHQ=";
+  vendorHash = "sha256-1wlwG0YaLcoLEh5t1hAfgQ+8EMfMDQn430nWGsuFTqs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/percollate/default.nix b/pkgs/tools/text/percollate/default.nix
index be38866e5bdc..ea55446aac6e 100644
--- a/pkgs/tools/text/percollate/default.nix
+++ b/pkgs/tools/text/percollate/default.nix
@@ -2,21 +2,21 @@
 
 buildNpmPackage rec {
   pname = "percollate";
-  version = "4.0.4";
+  version = "4.0.5";
 
   src = fetchFromGitHub {
     owner = "danburzo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Gl9v8WdntiatgxIvH1PZe3U9imGqdm5iYUx8gCwJhLw=";
+    hash = "sha256-St9a22Af2QV3gOR80LmDMeq0x9tf/ZJz9Z4IgeeM80I=";
   };
 
-  npmDepsHash = "sha256-/HYnoMd+rriZ4WYGyM7g62Yii7lc/+ZKkc5QfPpFAQU=";
+  npmDepsHash = "sha256-WHOv5N893G35bMC03aGb2m7rQz5xIRd9hPldbRku+RY=";
 
   dontNpmBuild = true;
 
   # Dev dependencies include an unnecessary Java dependency (epubchecker)
-  # https://github.com/danburzo/percollate/blob/v4.0.4/package.json#L40
+  # https://github.com/danburzo/percollate/blob/v4.0.5/package.json#L40
   npmInstallFlags = [ "--omit=dev" ];
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/virtualization/xe-guest-utilities/default.nix b/pkgs/tools/virtualization/xe-guest-utilities/default.nix
index cea1553e0bc6..e1b89a562a8f 100644
--- a/pkgs/tools/virtualization/xe-guest-utilities/default.nix
+++ b/pkgs/tools/virtualization/xe-guest-utilities/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "xe-guest-utilities";
-  version = "8.3.1";
+  version = "8.4.0";
 
   src = fetchFromGitHub {
     owner = "xenserver";
     repo = "xe-guest-utilities";
     rev = "v${version}";
-    hash = "sha256-d0WdezcT44ExeHSnoJ3Dn0u/IRlhWreOZPSVw6Q1h/w=";
+    hash = "sha256-LpZx+Km2qRywYK/eFLP3aCDku6K6HC4+MzEODH+8Gvs=";
   };
 
   deleteVendor = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 87239aaeba8c..93a06a8fd4d2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28760,6 +28760,11 @@ with pkgs;
     pname = "systemd-minimal-libs";
     buildLibsOnly = true;
   };
+  # We do not want to include ukify in the normal systemd attribute as it
+  # relies on Python at runtime.
+  systemdUkify = systemd.override {
+    withUkify = true;
+  };
 
   udev =
     if (with stdenv.hostPlatform; isLinux && isStatic) then libudev-zero