diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3f9853f33a91..c24be60fc15d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15774,6 +15774,12 @@
     githubId = 4201956;
     name = "pongo1231";
   };
+  poptart = {
+    email = "poptart@hosakacorp.net";
+    github = "terrorbyte";
+    githubId = 1601039;
+    name = "Cale Black";
+  };
   portothree = {
     name = "Gustavo Porto";
     email = "gus@p8s.co";
diff --git a/nixos/doc/manual/development/option-declarations.section.md b/nixos/doc/manual/development/option-declarations.section.md
index ad5857b11a2e..325f4d11cb08 100644
--- a/nixos/doc/manual/development/option-declarations.section.md
+++ b/nixos/doc/manual/development/option-declarations.section.md
@@ -12,7 +12,7 @@ looks like this:
       type = type specification;
       default = default value;
       example = example value;
-      description = lib.mdDoc "Description for use in the NixOS manual.";
+      description = "Description for use in the NixOS manual.";
     };
   };
 }
@@ -58,12 +58,9 @@ The function `mkOption` accepts the following arguments.
 
 `description`
 
-:   A textual description of the option, in [Nixpkgs-flavored Markdown](
-    https://nixos.org/nixpkgs/manual/#sec-contributing-markup) format, that will be
-    included in the NixOS manual. During the migration process from DocBook
-    it is necessary to mark descriptions written in CommonMark with `lib.mdDoc`.
-    The description may still be written in DocBook (without any marker), but this
-    is discouraged and will be deprecated in the future.
+:   A textual description of the option in [Nixpkgs-flavored Markdown](
+    https://nixos.org/nixpkgs/manual/#sec-contributing-markup) format that will be
+    included in the NixOS manual.
 
 ## Utility functions for common option patterns {#sec-option-declarations-util}
 
@@ -81,13 +78,13 @@ For example:
 ::: {#ex-options-declarations-util-mkEnableOption-magic .example}
 ### `mkEnableOption` usage
 ```nix
-lib.mkEnableOption (lib.mdDoc "magic")
+lib.mkEnableOption "magic"
 # is like
 lib.mkOption {
   type = lib.types.bool;
   default = false;
   example = true;
-  description = lib.mdDoc "Whether to enable magic.";
+  description = "Whether to enable magic.";
 }
 ```
 :::
@@ -135,7 +132,7 @@ lib.mkOption {
   type = lib.types.package;
   default = pkgs.hello;
   defaultText = lib.literalExpression "pkgs.hello";
-  description = lib.mdDoc "The hello package to use.";
+  description = "The hello package to use.";
 }
 ```
 :::
@@ -153,7 +150,7 @@ lib.mkOption {
   default = pkgs.ghc;
   defaultText = lib.literalExpression "pkgs.ghc";
   example = lib.literalExpression "pkgs.haskell.packages.ghc92.ghc.withPackages (hkgs: [ hkgs.primes ])";
-  description = lib.mdDoc "The GHC package to use.";
+  description = "The GHC package to use.";
 }
 ```
 :::
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index aea66a3bb137..dddb2b9241ad 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -473,6 +473,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `services.zfs.zed.enableMail` now uses the global `sendmail` wrapper defined by an email module
   (such as msmtp or Postfix). It no longer requires using a special ZFS build with email support.
 
+- `castopod` has some migration actions to be taken in case of a S3 setup. Some new features may also need some manual migration actions. See [https://code.castopod.org/adaures/castopod/-/releases](https://code.castopod.org/adaures/castopod/-/releases) for more informations.
+
 - `nextcloud-setup.service` no longer changes the group of each file & directory inside `/var/lib/nextcloud/{config,data,store-apps}` if one of these directories has the wrong owner group. This was part of transitioning the group used for `/var/lib/nextcloud`, but isn't necessary anymore.
 
 - `services.kavita` now uses the freeform option `services.kavita.settings` for the application settings file.
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 4ae9d018e96f..17e03baf3bb7 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -117,9 +117,7 @@
 # deprecated since 23.11.
 # TODO remove in a while.
 , allowDocBook ? false
-# whether lib.mdDoc is required for descriptions to be read as markdown.
-# deprecated since 23.11.
-# TODO remove in a while.
+# TODO remove in a while (see https://github.com/NixOS/nixpkgs/issues/300735)
 , markdownByDefault ? true
 }:
 
diff --git a/nixos/lib/systemd-types.nix b/nixos/lib/systemd-types.nix
index ba8bed35e1c0..c4c5771cff82 100644
--- a/nixos/lib/systemd-types.nix
+++ b/nixos/lib/systemd-types.nix
@@ -31,7 +31,6 @@ let
     ;
 
   inherit (lib)
-    mdDoc
     mkDefault
     mkDerivedConfig
     mkEnableOption
@@ -81,11 +80,11 @@ rec {
 
   initrdContents = attrsOf (submodule ({ config, options, name, ... }: {
     options = {
-      enable = mkEnableOption (mdDoc "copying of this file and symlinking it") // { default = true; };
+      enable = (mkEnableOption "copying of this file and symlinking it") // { default = true; };
 
       target = mkOption {
         type = path;
-        description = mdDoc ''
+        description = ''
           Path of the symlink.
         '';
         default = name;
@@ -94,12 +93,12 @@ rec {
       text = mkOption {
         default = null;
         type = nullOr lines;
-        description = mdDoc "Text of the file.";
+        description = "Text of the file.";
       };
 
       source = mkOption {
         type = path;
-        description = mdDoc "Path of the source file.";
+        description = "Path of the source file.";
       };
     };
 
diff --git a/nixos/lib/systemd-unit-options.nix b/nixos/lib/systemd-unit-options.nix
index db644e006552..fc990a87f0c2 100644
--- a/nixos/lib/systemd-unit-options.nix
+++ b/nixos/lib/systemd-unit-options.nix
@@ -17,7 +17,6 @@ let
     concatMap
     filterOverrides
     isList
-    mdDoc
     mergeEqualOption
     mkIf
     mkMerge
@@ -55,7 +54,7 @@ in rec {
     enable = mkOption {
       default = true;
       type = types.bool;
-      description = mdDoc ''
+      description = ''
         If set to false, this unit will be a symlink to
         /dev/null. This is primarily useful to prevent specific
         template instances
@@ -69,7 +68,7 @@ in rec {
     overrideStrategy = mkOption {
       default = "asDropinIfExists";
       type = types.enum [ "asDropinIfExists" "asDropin" ];
-      description = mdDoc ''
+      description = ''
         Defines how unit configuration is provided for systemd:
 
         `asDropinIfExists` creates a unit file when no unit file is provided by the package
@@ -85,7 +84,7 @@ in rec {
     requiredBy = mkOption {
       default = [];
       type = types.listOf unitNameType;
-      description = mdDoc ''
+      description = ''
         Units that require (i.e. depend on and need to go down with) this unit.
         As discussed in the `wantedBy` option description this also creates
         `.requires` symlinks automatically.
@@ -95,7 +94,7 @@ in rec {
     upheldBy = mkOption {
       default = [];
       type = types.listOf unitNameType;
-      description = mdDoc ''
+      description = ''
         Keep this unit running as long as the listed units are running. This is a continuously
         enforced version of wantedBy.
       '';
@@ -104,7 +103,7 @@ in rec {
     wantedBy = mkOption {
       default = [];
       type = types.listOf unitNameType;
-      description = mdDoc ''
+      description = ''
         Units that want (i.e. depend on) this unit. The default method for
         starting a unit by default at boot time is to set this option to
         `["multi-user.target"]` for system services. Likewise for user units
@@ -122,7 +121,7 @@ in rec {
     aliases = mkOption {
       default = [];
       type = types.listOf unitNameType;
-      description = mdDoc "Aliases of that unit.";
+      description = "Aliases of that unit.";
     };
 
   };
@@ -132,12 +131,12 @@ in rec {
     text = mkOption {
       type = types.nullOr types.str;
       default = null;
-      description = mdDoc "Text of this systemd unit.";
+      description = "Text of this systemd unit.";
     };
 
     unit = mkOption {
       internal = true;
-      description = mdDoc "The generated unit.";
+      description = "The generated unit.";
     };
 
   };
@@ -148,19 +147,19 @@ in rec {
       description = mkOption {
         default = "";
         type = types.singleLineStr;
-        description = mdDoc "Description of this unit used in systemd messages and progress indicators.";
+        description = "Description of this unit used in systemd messages and progress indicators.";
       };
 
       documentation = mkOption {
         default = [];
         type = types.listOf types.str;
-        description = mdDoc "A list of URIs referencing documentation for this unit or its configuration.";
+        description = "A list of URIs referencing documentation for this unit or its configuration.";
       };
 
       requires = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           Start the specified units when this unit is started, and stop
           this unit when the specified units are stopped or fail.
         '';
@@ -169,7 +168,7 @@ in rec {
       wants = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           Start the specified units when this unit is started.
         '';
       };
@@ -177,7 +176,7 @@ in rec {
       upholds = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           Keeps the specified running while this unit is running. A continuous version of `wants`.
         '';
       };
@@ -185,7 +184,7 @@ in rec {
       after = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           If the specified units are started at the same time as
           this unit, delay this unit until they have started.
         '';
@@ -194,7 +193,7 @@ in rec {
       before = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           If the specified units are started at the same time as
           this unit, delay them until this unit has started.
         '';
@@ -203,7 +202,7 @@ in rec {
       bindsTo = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           Like ‘requires’, but in addition, if the specified units
           unexpectedly disappear, this unit will be stopped as well.
         '';
@@ -212,7 +211,7 @@ in rec {
       partOf = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           If the specified units are stopped or restarted, then this
           unit is stopped or restarted as well.
         '';
@@ -221,7 +220,7 @@ in rec {
       conflicts = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           If the specified units are started, then this unit is stopped
           and vice versa.
         '';
@@ -230,7 +229,7 @@ in rec {
       requisite = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           Similar to requires. However if the units listed are not started,
           they will not be started and the transaction will fail.
         '';
@@ -240,7 +239,7 @@ in rec {
         default = {};
         example = { RequiresMountsFor = "/data"; };
         type = types.attrsOf unitOption;
-        description = mdDoc ''
+        description = ''
           Each attribute in this set specifies an option in the
           `[Unit]` section of the unit.  See
           {manpage}`systemd.unit(5)` for details.
@@ -250,7 +249,7 @@ in rec {
       onFailure = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           A list of one or more units that are activated when
           this unit enters the "failed" state.
         '';
@@ -259,7 +258,7 @@ in rec {
       onSuccess = mkOption {
         default = [];
         type = types.listOf unitNameType;
-        description = mdDoc ''
+        description = ''
           A list of one or more units that are activated when
           this unit enters the "inactive" state.
         '';
@@ -267,7 +266,7 @@ in rec {
 
       startLimitBurst = mkOption {
          type = types.int;
-         description = mdDoc ''
+         description = ''
            Configure unit start rate limiting. Units which are started
            more than startLimitBurst times within an interval time
            interval are not permitted to start any more.
@@ -276,7 +275,7 @@ in rec {
 
       startLimitIntervalSec = mkOption {
          type = types.int;
-         description = mdDoc ''
+         description = ''
            Configure unit start rate limiting. Units which are started
            more than startLimitBurst times within an interval time
            interval are not permitted to start any more.
@@ -295,7 +294,7 @@ in rec {
       restartTriggers = mkOption {
         default = [];
         type = types.listOf types.unspecified;
-        description = mdDoc ''
+        description = ''
           An arbitrary list of items such as derivations.  If any item
           in the list changes between reconfigurations, the service will
           be restarted.
@@ -305,7 +304,7 @@ in rec {
       reloadTriggers = mkOption {
         default = [];
         type = types.listOf unitOption;
-        description = mdDoc ''
+        description = ''
           An arbitrary list of items such as derivations.  If any item
           in the list changes between reconfigurations, the service will
           be reloaded.  If anything but a reload trigger changes in the
@@ -323,13 +322,13 @@ in rec {
         default = {};
         type = with types; attrsOf (nullOr (oneOf [ str path package ]));
         example = { PATH = "/foo/bar/bin"; LANG = "nl_NL.UTF-8"; };
-        description = mdDoc "Environment variables passed to the service's processes.";
+        description = "Environment variables passed to the service's processes.";
       };
 
       path = mkOption {
         default = [];
         type = with types; listOf (oneOf [ package str ]);
-        description = mdDoc ''
+        description = ''
           Packages added to the service's {env}`PATH`
           environment variable.  Both the {file}`bin`
           and {file}`sbin` subdirectories of each
@@ -343,7 +342,7 @@ in rec {
           { RestartSec = 5;
           };
         type = types.addCheck (types.attrsOf unitOption) checkService;
-        description = mdDoc ''
+        description = ''
           Each attribute in this set specifies an option in the
           `[Service]` section of the unit.  See
           {manpage}`systemd.service(5)` for details.
@@ -353,14 +352,14 @@ in rec {
       script = mkOption {
         type = types.lines;
         default = "";
-        description = mdDoc "Shell commands executed as the service's main process.";
+        description = "Shell commands executed as the service's main process.";
       };
 
       scriptArgs = mkOption {
         type = types.str;
         default = "";
         example = "%i";
-        description = mdDoc ''
+        description = ''
           Arguments passed to the main process script.
           Can contain specifiers (`%` placeholders expanded by systemd, see {manpage}`systemd.unit(5)`).
         '';
@@ -369,7 +368,7 @@ in rec {
       preStart = mkOption {
         type = types.lines;
         default = "";
-        description = mdDoc ''
+        description = ''
           Shell commands executed before the service's main process
           is started.
         '';
@@ -378,7 +377,7 @@ in rec {
       postStart = mkOption {
         type = types.lines;
         default = "";
-        description = mdDoc ''
+        description = ''
           Shell commands executed after the service's main process
           is started.
         '';
@@ -387,7 +386,7 @@ in rec {
       reload = mkOption {
         type = types.lines;
         default = "";
-        description = mdDoc ''
+        description = ''
           Shell commands executed when the service's main process
           is reloaded.
         '';
@@ -396,7 +395,7 @@ in rec {
       preStop = mkOption {
         type = types.lines;
         default = "";
-        description = mdDoc ''
+        description = ''
           Shell commands executed to stop the service.
         '';
       };
@@ -404,7 +403,7 @@ in rec {
       postStop = mkOption {
         type = types.lines;
         default = "";
-        description = mdDoc ''
+        description = ''
           Shell commands executed after the service's main process
           has exited.
         '';
@@ -413,7 +412,7 @@ in rec {
       jobScripts = mkOption {
         type = with types; coercedTo path singleton (listOf path);
         internal = true;
-        description = mdDoc "A list of all job script derivations of this unit.";
+        description = "A list of all job script derivations of this unit.";
         default = [];
       };
 
@@ -458,7 +457,7 @@ in rec {
       restartIfChanged = mkOption {
         type = types.bool;
         default = true;
-        description = mdDoc ''
+        description = ''
           Whether the service should be restarted during a NixOS
           configuration switch if its definition has changed.
         '';
@@ -467,7 +466,7 @@ in rec {
       reloadIfChanged = mkOption {
         type = types.bool;
         default = false;
-        description = mdDoc ''
+        description = ''
           Whether the service should be reloaded during a NixOS
           configuration switch if its definition has changed.  If
           enabled, the value of {option}`restartIfChanged` is
@@ -483,7 +482,7 @@ in rec {
       stopIfChanged = mkOption {
         type = types.bool;
         default = true;
-        description = mdDoc ''
+        description = ''
           If set, a changed unit is restarted by calling
           {command}`systemctl stop` in the old configuration,
           then {command}`systemctl start` in the new one.
@@ -499,7 +498,7 @@ in rec {
         type = with types; either str (listOf str);
         default = [];
         example = "Sun 14:00:00";
-        description = mdDoc ''
+        description = ''
           Automatically start this unit at the given date/time, which
           must be in the format described in
           {manpage}`systemd.time(7)`.  This is equivalent
@@ -526,7 +525,7 @@ in rec {
         default = [];
         type = types.listOf types.str;
         example = [ "0.0.0.0:993" "/run/my-socket" ];
-        description = mdDoc ''
+        description = ''
           For each item in this list, a `ListenStream`
           option in the `[Socket]` section will be created.
         '';
@@ -536,7 +535,7 @@ in rec {
         default = [];
         type = types.listOf types.str;
         example = [ "0.0.0.0:993" "/run/my-socket" ];
-        description = mdDoc ''
+        description = ''
           For each item in this list, a `ListenDatagram`
           option in the `[Socket]` section will be created.
         '';
@@ -546,7 +545,7 @@ in rec {
         default = {};
         example = { ListenStream = "/run/my-socket"; };
         type = types.attrsOf unitOption;
-        description = mdDoc ''
+        description = ''
           Each attribute in this set specifies an option in the
           `[Socket]` section of the unit.  See
           {manpage}`systemd.socket(5)` for details.
@@ -578,7 +577,7 @@ in rec {
         default = {};
         example = { OnCalendar = "Sun 14:00:00"; Unit = "foo.service"; };
         type = types.attrsOf unitOption;
-        description = mdDoc ''
+        description = ''
           Each attribute in this set specifies an option in the
           `[Timer]` section of the unit.  See
           {manpage}`systemd.timer(5)` and
@@ -611,7 +610,7 @@ in rec {
         default = {};
         example = { PathChanged = "/some/path"; Unit = "changedpath.service"; };
         type = types.attrsOf unitOption;
-        description = mdDoc ''
+        description = ''
           Each attribute in this set specifies an option in the
           `[Path]` section of the unit.  See
           {manpage}`systemd.path(5)` for details.
@@ -642,13 +641,13 @@ in rec {
       what = mkOption {
         example = "/dev/sda1";
         type = types.str;
-        description = mdDoc "Absolute path of device node, file or other resource. (Mandatory)";
+        description = "Absolute path of device node, file or other resource. (Mandatory)";
       };
 
       where = mkOption {
         example = "/mnt";
         type = types.str;
-        description = mdDoc ''
+        description = ''
           Absolute path of a directory of the mount point.
           Will be created if it doesn't exist. (Mandatory)
         '';
@@ -658,21 +657,21 @@ in rec {
         default = "";
         example = "ext4";
         type = types.str;
-        description = mdDoc "File system type.";
+        description = "File system type.";
       };
 
       options = mkOption {
         default = "";
         example = "noatime";
         type = types.commas;
-        description = mdDoc "Options used to mount the file system.";
+        description = "Options used to mount the file system.";
       };
 
       mountConfig = mkOption {
         default = {};
         example = { DirectoryMode = "0775"; };
         type = types.attrsOf unitOption;
-        description = mdDoc ''
+        description = ''
           Each attribute in this set specifies an option in the
           `[Mount]` section of the unit.  See
           {manpage}`systemd.mount(5)` for details.
@@ -702,7 +701,7 @@ in rec {
       where = mkOption {
         example = "/mnt";
         type = types.str;
-        description = mdDoc ''
+        description = ''
           Absolute path of a directory of the mount point.
           Will be created if it doesn't exist. (Mandatory)
         '';
@@ -712,7 +711,7 @@ in rec {
         default = {};
         example = { DirectoryMode = "0775"; };
         type = types.attrsOf unitOption;
-        description = mdDoc ''
+        description = ''
           Each attribute in this set specifies an option in the
           `[Automount]` section of the unit.  See
           {manpage}`systemd.automount(5)` for details.
@@ -743,7 +742,7 @@ in rec {
         default = {};
         example = { MemoryMax = "2G"; };
         type = types.attrsOf unitOption;
-        description = mdDoc ''
+        description = ''
           Each attribute in this set specifies an option in the
           `[Slice]` section of the unit.  See
           {manpage}`systemd.slice(5)` for details.
diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix
index b6f01c38191d..7eb06e023918 100644
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@@ -1,6 +1,6 @@
 { config, lib, hostPkgs, ... }:
 let
-  inherit (lib) mkOption types literalMD mdDoc;
+  inherit (lib) mkOption types literalMD;
 
   # Reifies and correctly wraps the python test driver for
   # the respective qemu version and with or without ocr support
@@ -104,13 +104,13 @@ in
   options = {
 
     driver = mkOption {
-      description = mdDoc "Package containing a script that runs the test.";
+      description = "Package containing a script that runs the test.";
       type = types.package;
       defaultText = literalMD "set by the test framework";
     };
 
     hostPkgs = mkOption {
-      description = mdDoc "Nixpkgs attrset used outside the nodes.";
+      description = "Nixpkgs attrset used outside the nodes.";
       type = types.raw;
       example = lib.literalExpression ''
         import nixpkgs { inherit system config overlays; }
@@ -118,14 +118,14 @@ in
     };
 
     qemu.package = mkOption {
-      description = mdDoc "Which qemu package to use for the virtualisation of [{option}`nodes`](#test-opt-nodes).";
+      description = "Which qemu package to use for the virtualisation of [{option}`nodes`](#test-opt-nodes).";
       type = types.package;
       default = hostPkgs.qemu_test;
       defaultText = "hostPkgs.qemu_test";
     };
 
     globalTimeout = mkOption {
-      description = mdDoc ''
+      description = ''
         A global timeout for the complete test, expressed in seconds.
         Beyond that timeout, every resource will be killed and released and the test will fail.
 
@@ -137,7 +137,7 @@ in
     };
 
     enableOCR = mkOption {
-      description = mdDoc ''
+      description = ''
         Whether to enable Optical Character Recognition functionality for
         testing graphical programs. See [Machine objects](`ssec-machine-objects`).
       '';
@@ -146,7 +146,7 @@ in
     };
 
     extraPythonPackages = mkOption {
-      description = mdDoc ''
+      description = ''
         Python packages to add to the test driver.
 
         The argument is a Python package set, similar to `pkgs.pythonPackages`.
@@ -159,7 +159,7 @@ in
     };
 
     extraDriverArgs = mkOption {
-      description = mdDoc ''
+      description = ''
         Extra arguments to pass to the test driver.
 
         They become part of [{option}`driver`](#test-opt-driver) via `wrapProgram`.
@@ -171,7 +171,7 @@ in
     skipLint = mkOption {
       type = types.bool;
       default = false;
-      description = mdDoc ''
+      description = ''
         Do not run the linters. This may speed up your iteration cycle, but it is not something you should commit.
       '';
     };
@@ -179,7 +179,7 @@ in
     skipTypeCheck = mkOption {
       type = types.bool;
       default = false;
-      description = mdDoc ''
+      description = ''
         Disable type checking. This must not be enabled for new NixOS tests.
 
         This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#test-opt-testScript).
diff --git a/nixos/lib/testing/interactive.nix b/nixos/lib/testing/interactive.nix
index 317ed4241882..0b1209669282 100644
--- a/nixos/lib/testing/interactive.nix
+++ b/nixos/lib/testing/interactive.nix
@@ -1,11 +1,11 @@
 { config, lib, moduleType, hostPkgs, ... }:
 let
-  inherit (lib) mkOption types mdDoc;
+  inherit (lib) mkOption types;
 in
 {
   options = {
     interactive = mkOption {
-      description = mdDoc ''
+      description = ''
         Tests [can be run interactively](#sec-running-nixos-tests-interactively)
         using the program in the test derivation's `.driverInteractive` attribute.
 
diff --git a/nixos/lib/testing/meta.nix b/nixos/lib/testing/meta.nix
index 805b7520edff..8d053ce86d88 100644
--- a/nixos/lib/testing/meta.nix
+++ b/nixos/lib/testing/meta.nix
@@ -1,11 +1,11 @@
 { lib, ... }:
 let
-  inherit (lib) types mkOption mdDoc;
+  inherit (lib) types mkOption;
 in
 {
   options = {
     meta = lib.mkOption {
-      description = mdDoc ''
+      description = ''
         The [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes that will be set on the returned derivations.
 
         Not all [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes are supported, but more can be added as desired.
@@ -16,21 +16,21 @@ in
           maintainers = lib.mkOption {
             type = types.listOf types.raw;
             default = [];
-            description = mdDoc ''
+            description = ''
               The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
             '';
           };
           timeout = lib.mkOption {
             type = types.nullOr types.int;
             default = 3600;  # 1 hour
-            description = mdDoc ''
+            description = ''
               The [{option}`test`](#test-opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
             '';
           };
           broken = lib.mkOption {
             type = types.bool;
             default = false;
-            description = mdDoc ''
+            description = ''
               Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#test-opt-test) derivation.
             '';
           };
diff --git a/nixos/lib/testing/name.nix b/nixos/lib/testing/name.nix
index 0af593169eec..0682873c7bcd 100644
--- a/nixos/lib/testing/name.nix
+++ b/nixos/lib/testing/name.nix
@@ -1,10 +1,10 @@
 { lib, ... }:
 let
-  inherit (lib) mkOption types mdDoc;
+  inherit (lib) mkOption types;
 in
 {
   options.name = mkOption {
-    description = mdDoc ''
+    description = ''
       The name of the test.
 
       This is used in the derivation names of the [{option}`driver`](#test-opt-driver) and [{option}`test`](#test-opt-test) runner.
diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix
index 1edc9e276530..0f1615a0ad3b 100644
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@@ -5,7 +5,6 @@ let
     attrNames concatMap concatMapStrings flip forEach head
     listToAttrs mkDefault mkOption nameValuePair optionalString
     range toLower types zipListsWith zipLists
-    mdDoc
     ;
 
   nodeNumbers =
@@ -89,7 +88,7 @@ let
         default = name;
         # We need to force this in specilisations, otherwise it'd be
         # readOnly = true;
-        description = mdDoc ''
+        description = ''
           The `name` in `nodes.<name>`; stable across `specialisations`.
         '';
       };
@@ -98,7 +97,7 @@ let
         type = types.int;
         readOnly = true;
         default = nodeNumbers.${config.virtualisation.test.nodeName};
-        description = mdDoc ''
+        description = ''
           A unique number assigned for each node in `nodes`.
         '';
       };
diff --git a/nixos/lib/testing/nodes.nix b/nixos/lib/testing/nodes.nix
index 7941d69e38d2..9aecca10ac6b 100644
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@@ -5,7 +5,6 @@ let
     literalExpression
     literalMD
     mapAttrs
-    mdDoc
     mkDefault
     mkIf
     mkOption mkForce
@@ -76,7 +75,7 @@ in
     nodes = mkOption {
       type = types.lazyAttrsOf config.node.type;
       visible = "shallow";
-      description = mdDoc ''
+      description = ''
         An attribute set of NixOS configuration modules.
 
         The configurations are augmented by the [`defaults`](#test-opt-defaults) option.
@@ -88,7 +87,7 @@ in
     };
 
     defaults = mkOption {
-      description = mdDoc ''
+      description = ''
         NixOS configuration that is applied to all [{option}`nodes`](#test-opt-nodes).
       '';
       type = types.deferredModule;
@@ -96,7 +95,7 @@ in
     };
 
     extraBaseModules = mkOption {
-      description = mdDoc ''
+      description = ''
         NixOS configuration that, like [{option}`defaults`](#test-opt-defaults), is applied to all [{option}`nodes`](#test-opt-nodes) and can not be undone with [`specialisation.<name>.inheritParentConfig`](https://search.nixos.org/options?show=specialisation.%3Cname%3E.inheritParentConfig&from=0&size=50&sort=relevance&type=packages&query=specialisation).
       '';
       type = types.deferredModule;
@@ -104,7 +103,7 @@ in
     };
 
     node.pkgs = mkOption {
-      description = mdDoc ''
+      description = ''
         The Nixpkgs to use for the nodes.
 
         Setting this will make the `nixpkgs.*` options read-only, to avoid mistakenly testing with a Nixpkgs configuration that diverges from regular use.
@@ -117,7 +116,7 @@ in
     };
 
     node.pkgsReadOnly = mkOption {
-      description = mdDoc ''
+      description = ''
         Whether to make the `nixpkgs.*` options read-only. This is only relevant when [`node.pkgs`](#test-opt-node.pkgs) is set.
 
         Set this to `false` when any of the [`nodes`](#test-opt-nodes) needs to configure any of the `nixpkgs.*` options. This will slow down evaluation of your test a bit.
@@ -130,7 +129,7 @@ in
     node.specialArgs = mkOption {
       type = types.lazyAttrsOf types.raw;
       default = { };
-      description = mdDoc ''
+      description = ''
         An attribute set of arbitrary values that will be made available as module arguments during the resolution of module `imports`.
 
         Note that it is not possible to override these from within the NixOS configurations. If you argument is not relevant to `imports`, consider setting {option}`defaults._module.args.<name>` instead.
@@ -139,7 +138,7 @@ in
 
     nodesCompat = mkOption {
       internal = true;
-      description = mdDoc ''
+      description = ''
         Basically `_module.args.nodes`, but with backcompat and warnings added.
 
         This will go away.
diff --git a/nixos/lib/testing/run.nix b/nixos/lib/testing/run.nix
index de5a9b97e61d..218292121ee7 100644
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@@ -1,12 +1,12 @@
 { config, hostPkgs, lib, ... }:
 let
-  inherit (lib) types mkOption mdDoc;
+  inherit (lib) types mkOption;
 in
 {
   options = {
     passthru = mkOption {
       type = types.lazyAttrsOf types.raw;
-      description = mdDoc ''
+      description = ''
         Attributes to add to the returned derivations,
         which are not necessarily part of the build.
 
@@ -18,7 +18,7 @@ in
 
     rawTestDerivation = mkOption {
       type = types.package;
-      description = mdDoc ''
+      description = ''
         Unfiltered version of `test`, for troubleshooting the test framework and `testBuildFailure` in the test framework's test suite.
         This is not intended for general use. Use `test` instead.
       '';
@@ -28,7 +28,7 @@ in
     test = mkOption {
       type = types.package;
       # TODO: can the interactive driver be configured to access the network?
-      description = mdDoc ''
+      description = ''
         Derivation that runs the test as its "build" process.
 
         This implies that NixOS tests run isolated from the network, making them
diff --git a/nixos/lib/testing/testScript.nix b/nixos/lib/testing/testScript.nix
index 5c36d754d79d..09964777bd92 100644
--- a/nixos/lib/testing/testScript.nix
+++ b/nixos/lib/testing/testScript.nix
@@ -1,13 +1,13 @@
 testModuleArgs@{ config, lib, hostPkgs, nodes, moduleType, ... }:
 let
-  inherit (lib) mkOption types mdDoc;
+  inherit (lib) mkOption types;
   inherit (types) either str functionTo;
 in
 {
   options = {
     testScript = mkOption {
       type = either str (functionTo str);
-      description = mdDoc ''
+      description = ''
         A series of python declarations and statements that you write to perform
         the test.
       '';
@@ -25,7 +25,7 @@ in
     };
     withoutTestScriptReferences = mkOption {
       type = moduleType;
-      description = mdDoc ''
+      description = ''
         A parallel universe where the testScript is invalid and has no references.
       '';
       internal = true;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9a1bfe94a405..914a31dfe1b3 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -342,7 +342,6 @@
   ./services/amqp/rabbitmq.nix
   ./services/audio/alsa.nix
   ./services/audio/botamusique.nix
-  ./services/audio/castopod.nix
   ./services/audio/gmediarender.nix
   ./services/audio/gonic.nix
   ./services/audio/goxlr-utility.nix
@@ -1303,6 +1302,7 @@
   ./services/web-apps/bookstack.nix
   ./services/web-apps/c2fmzq-server.nix
   ./services/web-apps/calibre-web.nix
+  ./services/web-apps/castopod.nix
   ./services/web-apps/coder.nix
   ./services/web-apps/changedetection-io.nix
   ./services/web-apps/chatgpt-retrieval-plugin.nix
diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index 6cce8f542a53..8a587832cd8c 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -118,7 +118,7 @@ are already created.
       before = "service1.service";
       after = "postgresql.service";
       serviceConfig.User = "postgres";
-      environment.PSQL = "psql --port=${toString services.postgresql.port}";
+      environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
       path = [ postgresql ];
       script = ''
         $PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
@@ -139,7 +139,7 @@ are already created.
 
 ```nix
   {
-    environment.PSQL = "psql --port=${toString services.postgresql.port}";
+    environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
     path = [ postgresql ];
     systemd.services."service1".preStart = ''
       $PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
@@ -159,7 +159,7 @@ are already created.
       before = "service1.service";
       after = "postgresql.service";
       serviceConfig.User = "service1";
-      environment.PSQL = "psql --port=${toString services.postgresql.port}";
+      environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
       path = [ postgresql ];
       script = ''
         $PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index c3f3b98ae5e7..d3fd6db6aea1 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -27,7 +27,7 @@ let
     else toString value;
 
   # The main PostgreSQL configuration file.
-  configFile = pkgs.writeTextDir "postgresql.conf" (concatStringsSep "\n" (mapAttrsToList (n: v: "${n} = ${toStr v}") cfg.settings));
+  configFile = pkgs.writeTextDir "postgresql.conf" (concatStringsSep "\n" (mapAttrsToList (n: v: "${n} = ${toStr v}") (filterAttrs (const (x: x != null)) cfg.settings)));
 
   configFileCheck = pkgs.runCommand "postgresql-configfile-check" {} ''
     ${cfg.package}/bin/postgres -D${configFile} -C config_file >/dev/null
@@ -41,6 +41,9 @@ in
 {
   imports = [
     (mkRemovedOptionModule [ "services" "postgresql" "extraConfig" ] "Use services.postgresql.settings instead.")
+
+    (mkRenamedOptionModule [ "services" "postgresql" "logLinePrefix" ] [ "services" "postgresql" "settings" "log_line_prefix" ])
+    (mkRenamedOptionModule [ "services" "postgresql" "port" ] [ "services" "postgresql" "settings" "port" ])
   ];
 
   ###### interface
@@ -57,14 +60,6 @@ in
         example = "postgresql_15";
       };
 
-      port = mkOption {
-        type = types.port;
-        default = 5432;
-        description = lib.mdDoc ''
-          The port on which PostgreSQL listens.
-        '';
-      };
-
       checkConfig = mkOption {
         type = types.bool;
         default = true;
@@ -352,17 +347,6 @@ in
         '';
       };
 
-      logLinePrefix = mkOption {
-        type = types.str;
-        default = "[%p] ";
-        example = "%m [%p] ";
-        description = lib.mdDoc ''
-          A printf-style string that is output at the beginning of each log line.
-          Upstream default is `'%m [%p] '`, i.e. it includes the timestamp. We do
-          not include the timestamp, because journal has it anyway.
-        '';
-      };
-
       extraPlugins = mkOption {
         type = with types; coercedTo (listOf path) (path: _ignorePg: path) (functionTo (listOf path));
         default = _: [];
@@ -373,7 +357,38 @@ in
       };
 
       settings = mkOption {
-        type = with types; attrsOf (oneOf [ bool float int str ]);
+        type = with types; submodule {
+          freeformType = attrsOf (oneOf [ bool float int str ]);
+          options = {
+            shared_preload_libraries = mkOption {
+              type = nullOr (coercedTo (listOf str) (concatStringsSep ", ") str);
+              default = null;
+              example = literalExpression ''[ "auto_explain" "anon" ]'';
+              description = mdDoc ''
+                List of libraries to be preloaded.
+              '';
+            };
+
+            log_line_prefix = mkOption {
+              type = types.str;
+              default = "[%p] ";
+              example = "%m [%p] ";
+              description = lib.mdDoc ''
+                A printf-style string that is output at the beginning of each log line.
+                Upstream default is `'%m [%p] '`, i.e. it includes the timestamp. We do
+                not include the timestamp, because journal has it anyway.
+              '';
+            };
+
+            port = mkOption {
+              type = types.port;
+              default = 5432;
+              description = lib.mdDoc ''
+                The port on which PostgreSQL listens.
+              '';
+            };
+          };
+        };
         default = {};
         description = lib.mdDoc ''
           PostgreSQL configuration. Refer to
@@ -439,9 +454,7 @@ in
         hba_file = "${pkgs.writeText "pg_hba.conf" cfg.authentication}";
         ident_file = "${pkgs.writeText "pg_ident.conf" cfg.identMap}";
         log_destination = "stderr";
-        log_line_prefix = cfg.logLinePrefix;
         listen_addresses = if cfg.enableTCPIP then "*" else "localhost";
-        port = cfg.port;
         jit = mkDefault (if cfg.enableJIT then "on" else "off");
       };
 
@@ -524,7 +537,7 @@ in
         # Wait for PostgreSQL to be ready to accept connections.
         postStart =
           ''
-            PSQL="psql --port=${toString cfg.port}"
+            PSQL="psql --port=${toString cfg.settings.port}"
 
             while ! $PSQL -d postgres -c "" 2> /dev/null; do
                 if ! kill -0 "$MAINPID"; then exit 1; fi
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 08cddc3a0710..2b1700626870 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -114,11 +114,11 @@ in
 
         port = mkOption {
           type = types.port;
-          default = if !usePostgresql then 3306 else pg.port;
+          default = if usePostgresql then pg.settings.port else 3306;
           defaultText = literalExpression ''
             if config.${opt.database.type} != "postgresql"
             then 3306
-            else config.${options.services.postgresql.port}
+            else 5432
           '';
           description = mdDoc "Database host port.";
         };
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 08feea853e47..13617931c23e 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -100,11 +100,11 @@ in
 
         port = mkOption {
           type = types.port;
-          default = if !usePostgresql then 3306 else pg.port;
+          default = if usePostgresql then pg.settings.port else 3306;
           defaultText = literalExpression ''
             if config.${opt.database.type} != "postgresql"
             then 3306
-            else config.${options.services.postgresql.port}
+            else 5432
           '';
           description = lib.mdDoc "Database host port.";
         };
diff --git a/nixos/modules/services/misc/llama-cpp.nix b/nixos/modules/services/misc/llama-cpp.nix
index 305d4538e89a..c73cff027e22 100644
--- a/nixos/modules/services/misc/llama-cpp.nix
+++ b/nixos/modules/services/misc/llama-cpp.nix
@@ -20,7 +20,7 @@ in {
       extraFlags = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         description = "Extra flags passed to llama-cpp-server.";
-        example = ["-c" "4096" "-ngl" "32" "--numa"];
+        example = ["-c" "4096" "-ngl" "32" "--numa" "numactl"];
         default = [];
       };
 
diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index c1209e34a92b..957571944b28 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -10,16 +10,22 @@ let
   format = pkgs.formats.yaml {};
   bundle = "${cfg.package}/share/redmine/bin/bundle";
 
-  databaseYml = pkgs.writeText "database.yml" ''
-    production:
-      adapter: ${cfg.database.type}
-      database: ${cfg.database.name}
-      host: ${if (cfg.database.type == "postgresql" && cfg.database.socket != null) then cfg.database.socket else cfg.database.host}
-      port: ${toString cfg.database.port}
-      username: ${cfg.database.user}
-      password: #dbpass#
-      ${optionalString (cfg.database.type == "mysql2" && cfg.database.socket != null) "socket: ${cfg.database.socket}"}
-  '';
+  databaseSettings = {
+    production = {
+      adapter = cfg.database.type;
+      database = if cfg.database.type == "sqlite3" then "${cfg.stateDir}/database.sqlite3" else cfg.database.name;
+    } // optionalAttrs (cfg.database.type != "sqlite3") {
+      host = if (cfg.database.type == "postgresql" && cfg.database.socket != null) then cfg.database.socket else cfg.database.host;
+      port = cfg.database.port;
+      username = cfg.database.user;
+    } // optionalAttrs (cfg.database.type != "sqlite3" && cfg.database.passwordFile != null) {
+      password = "#dbpass#";
+    } // optionalAttrs (cfg.database.type == "mysql2" && cfg.database.socket != null) {
+      socket = cfg.database.socket;
+    };
+  };
+
+  databaseYml = format.generate "database.yml" databaseSettings;
 
   configurationYml = format.generate "configuration.yml" cfg.settings;
   additionalEnvironment = pkgs.writeText "additional_environment.rb" cfg.extraEnv;
@@ -145,7 +151,7 @@ in
 
       database = {
         type = mkOption {
-          type = types.enum [ "mysql2" "postgresql" ];
+          type = types.enum [ "mysql2" "postgresql" "sqlite3" ];
           example = "postgresql";
           default = "mysql2";
           description = lib.mdDoc "Database engine to use.";
@@ -261,7 +267,7 @@ in
   config = mkIf cfg.enable {
 
     assertions = [
-      { assertion = cfg.database.passwordFile != null || cfg.database.socket != null;
+      { assertion = cfg.database.type != "sqlite3" -> cfg.database.passwordFile != null || cfg.database.socket != null;
         message = "one of services.redmine.database.socket or services.redmine.database.passwordFile must be set";
       }
       { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
@@ -270,7 +276,7 @@ in
       { assertion = pgsqlLocal -> cfg.database.user == cfg.database.name;
         message = "services.redmine.database.user and services.redmine.database.name must be the same when using a local postgresql database";
       }
-      { assertion = cfg.database.createLocally -> cfg.database.socket != null;
+      { assertion = cfg.database.createLocally -> cfg.database.type != "sqlite3" && cfg.database.socket != null;
         message = "services.redmine.database.socket must be set if services.redmine.database.createLocally is set to true";
       }
       { assertion = cfg.database.createLocally -> cfg.database.host == "localhost";
@@ -395,9 +401,13 @@ in
 
 
         # handle database.passwordFile & permissions
-        DBPASS=${optionalString (cfg.database.passwordFile != null) "$(head -n1 ${cfg.database.passwordFile})"}
         cp -f ${databaseYml} "${cfg.stateDir}/config/database.yml"
-        sed -e "s,#dbpass#,$DBPASS,g" -i "${cfg.stateDir}/config/database.yml"
+
+        ${optionalString ((cfg.database.type != "sqlite3") && (cfg.database.passwordFile != null)) ''
+          DBPASS="$(head -n1 ${cfg.database.passwordFile})"
+          sed -e "s,#dbpass#,$DBPASS,g" -i "${cfg.stateDir}/config/database.yml"
+        ''}
+
         chmod 440 "${cfg.stateDir}/config/database.yml"
 
 
diff --git a/nixos/modules/services/monitoring/zabbix-proxy.nix b/nixos/modules/services/monitoring/zabbix-proxy.nix
index fea5704af6f6..7a0fc77d5b25 100644
--- a/nixos/modules/services/monitoring/zabbix-proxy.nix
+++ b/nixos/modules/services/monitoring/zabbix-proxy.nix
@@ -103,11 +103,11 @@ in
 
         port = mkOption {
           type = types.port;
-          default = if cfg.database.type == "mysql" then mysql.port else pgsql.port;
+          default = if cfg.database.type == "mysql" then mysql.port else pgsql.services.port;
           defaultText = literalExpression ''
             if config.${opt.database.type} == "mysql"
             then config.${options.services.mysql.port}
-            else config.${options.services.postgresql.port}
+            else config.services.postgresql.settings.port
           '';
           description = lib.mdDoc "Database host port.";
         };
diff --git a/nixos/modules/services/monitoring/zabbix-server.nix b/nixos/modules/services/monitoring/zabbix-server.nix
index f2fb5fbe7ac6..fc9295d294d1 100644
--- a/nixos/modules/services/monitoring/zabbix-server.nix
+++ b/nixos/modules/services/monitoring/zabbix-server.nix
@@ -95,11 +95,11 @@ in
 
         port = mkOption {
           type = types.port;
-          default = if cfg.database.type == "mysql" then mysql.port else pgsql.port;
+          default = if cfg.database.type == "mysql" then mysql.port else pgsql.settings.port;
           defaultText = literalExpression ''
             if config.${opt.database.type} == "mysql"
             then config.${options.services.mysql.port}
-            else config.${options.services.postgresql.port}
+            else config.services.postgresql.settings.port
           '';
           description = lib.mdDoc "Database host port.";
         };
diff --git a/nixos/modules/services/audio/castopod.md b/nixos/modules/services/web-apps/castopod.md
similarity index 89%
rename from nixos/modules/services/audio/castopod.md
rename to nixos/modules/services/web-apps/castopod.md
index 40838cc77aa6..5ecd807686fd 100644
--- a/nixos/modules/services/audio/castopod.md
+++ b/nixos/modules/services/web-apps/castopod.md
@@ -4,6 +4,7 @@ Castopod is an open-source hosting platform made for podcasters who want to enga
 
 ## Quickstart {#module-services-castopod-quickstart}
 
+Configure ACME (https://nixos.org/manual/nixos/unstable/#module-security-acme).
 Use the following configuration to start a public instance of Castopod on `castopod.example.com` domain:
 
 ```nix
diff --git a/nixos/modules/services/audio/castopod.nix b/nixos/modules/services/web-apps/castopod.nix
similarity index 76%
rename from nixos/modules/services/audio/castopod.nix
rename to nixos/modules/services/web-apps/castopod.nix
index b782b5489147..0ccba217be4d 100644
--- a/nixos/modules/services/audio/castopod.nix
+++ b/nixos/modules/services/web-apps/castopod.nix
@@ -4,7 +4,6 @@ let
   fpm = config.services.phpfpm.pools.castopod;
 
   user = "castopod";
-  stateDirectory = "/var/lib/castopod";
 
   # https://docs.castopod.org/getting-started/install.html#requirements
   phpPackage = pkgs.php.withExtensions ({ enabled, all }: with all; [
@@ -29,6 +28,15 @@ in
         defaultText = lib.literalMD "pkgs.castopod";
         description = lib.mdDoc "Which Castopod package to use.";
       };
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/castopod";
+        description = lib.mdDoc ''
+          The path where castopod stores all data. This path must be in sync
+          with the castopod package (where it is hardcoded during the build in
+          accordance with its own `dataDir` argument).
+        '';
+      };
       database = {
         createLocally = lib.mkOption {
           type = lib.types.bool;
@@ -59,6 +67,8 @@ in
           description = lib.mdDoc ''
             A file containing the password corresponding to
             [](#opt-services.castopod.database.user).
+
+            This file is loaded using systemd LoadCredentials.
           '';
         };
       };
@@ -85,6 +95,8 @@ in
           Environment file to inject e.g. secrets into the configuration.
           See [](https://code.castopod.org/adaures/castopod/-/blob/main/.env.example)
           for available environment variables.
+
+          This file is loaded using systemd LoadCredentials.
         '';
       };
       configureNginx = lib.mkOption {
@@ -111,6 +123,19 @@ in
           Options for Castopod's PHP pool. See the documentation on `php-fpm.conf` for details on configuration directives.
         '';
       };
+      maxUploadSize = lib.mkOption {
+        type = lib.types.str;
+        default = "512M";
+        description = lib.mdDoc ''
+          Maximum supported size for a file upload in. Maximum HTTP body
+          size is set to this value for nginx and PHP (because castopod doesn't
+          support chunked uploads yet:
+          https://code.castopod.org/adaures/castopod/-/issues/330).
+
+          Note, that practical upload size limit is smaller. For example, with
+          512 MiB setting - around 500 MiB is possible.
+        '';
+      };
     };
   };
 
@@ -120,13 +145,13 @@ in
         sslEnabled = with config.services.nginx.virtualHosts.${cfg.localDomain}; addSSL || forceSSL || onlySSL || enableACME || useACMEHost != null;
         baseURL = "http${lib.optionalString sslEnabled "s"}://${cfg.localDomain}";
       in
-      lib.mapAttrs (name: lib.mkDefault) {
+      lib.mapAttrs (_: lib.mkDefault) {
         "app.forceGlobalSecureRequests" = sslEnabled;
         "app.baseURL" = baseURL;
 
-        "media.baseURL" = "/";
+        "media.baseURL" = baseURL;
         "media.root" = "media";
-        "media.storage" = stateDirectory;
+        "media.storage" = cfg.dataDir;
 
         "admin.gateway" = "admin";
         "auth.gateway" = "auth";
@@ -142,13 +167,13 @@ in
     services.phpfpm.pools.castopod = {
       inherit user;
       group = config.services.nginx.group;
-      phpPackage = phpPackage;
+      inherit phpPackage;
       phpOptions = ''
-        # https://code.castopod.org/adaures/castopod/-/blob/main/docker/production/app/uploads.ini
+        # https://code.castopod.org/adaures/castopod/-/blob/develop/docker/production/common/uploads.template.ini
         file_uploads = On
         memory_limit = 512M
-        upload_max_filesize = 500M
-        post_max_size = 512M
+        upload_max_filesize = ${cfg.maxUploadSize}
+        post_max_size = ${cfg.maxUploadSize}
         max_execution_time = 300
         max_input_time = 300
       '';
@@ -165,45 +190,50 @@ in
       path = [ pkgs.openssl phpPackage ];
       script =
         let
-          envFile = "${stateDirectory}/.env";
+          envFile = "${cfg.dataDir}/.env";
           media = "${cfg.settings."media.storage"}/${cfg.settings."media.root"}";
         in
         ''
-          mkdir -p ${stateDirectory}/writable/{cache,logs,session,temp,uploads}
+          mkdir -p ${cfg.dataDir}/writable/{cache,logs,session,temp,uploads}
 
           if [ ! -d ${lib.escapeShellArg media} ]; then
             cp --no-preserve=mode,ownership -r ${cfg.package}/share/castopod/public/media ${lib.escapeShellArg media}
           fi
 
-          if [ ! -f ${stateDirectory}/salt ]; then
-            openssl rand -base64 33 > ${stateDirectory}/salt
+          if [ ! -f ${cfg.dataDir}/salt ]; then
+            openssl rand -base64 33 > ${cfg.dataDir}/salt
           fi
 
           cat <<'EOF' > ${envFile}
           ${lib.generators.toKeyValue { } cfg.settings}
           EOF
 
-          echo "analytics.salt=$(cat ${stateDirectory}/salt)" >> ${envFile}
+          echo "analytics.salt=$(cat ${cfg.dataDir}/salt)" >> ${envFile}
 
           ${if (cfg.database.passwordFile != null) then ''
-            echo "database.default.password=$(cat ${lib.escapeShellArg cfg.database.passwordFile})" >> ${envFile}
+            echo "database.default.password=$(cat "$CREDENTIALS_DIRECTORY/dbpasswordfile)" >> ${envFile}
           '' else ''
             echo "database.default.password=" >> ${envFile}
           ''}
 
           ${lib.optionalString (cfg.environmentFile != null) ''
-            cat ${lib.escapeShellArg cfg.environmentFile}) >> ${envFile}
+            cat "$CREDENTIALS_DIRECTORY/envfile" >> ${envFile}
           ''}
 
-          php spark castopod:database-update
+          php ${cfg.package}/share/castopod/spark castopod:database-update
         '';
       serviceConfig = {
         StateDirectory = "castopod";
+        LoadCredential = lib.optional (cfg.environmentFile != null)
+          "envfile:${cfg.environmentFile}"
+        ++ (lib.optional (cfg.database.passwordFile != null)
+          "dbpasswordfile:${cfg.database.passwordFile}");
         WorkingDirectory = "${cfg.package}/share/castopod";
         Type = "oneshot";
         RemainAfterExit = true;
         User = user;
         Group = config.services.nginx.group;
+        ReadWritePaths = cfg.dataDir;
       };
     };
 
@@ -212,9 +242,7 @@ in
       wantedBy = [ "multi-user.target" ];
       path = [ phpPackage ];
       script = ''
-        php public/index.php scheduled-activities
-        php public/index.php scheduled-websub-publish
-        php public/index.php scheduled-video-clips
+        php ${cfg.package}/share/castopod/spark tasks:run
       '';
       serviceConfig = {
         StateDirectory = "castopod";
@@ -222,6 +250,8 @@ in
         Type = "oneshot";
         User = user;
         Group = config.services.nginx.group;
+        ReadWritePaths = cfg.dataDir;
+        LogLevelMax = "notice"; # otherwise periodic tasks flood the journal
       };
     };
 
@@ -251,6 +281,7 @@ in
         extraConfig = ''
           try_files $uri $uri/ /index.php?$args;
           index index.php index.html;
+          client_max_body_size ${cfg.maxUploadSize};
         '';
 
         locations."^~ /${cfg.settings."media.root"}/" = {
@@ -278,7 +309,7 @@ in
       };
     };
 
-    users.users.${user} = lib.mapAttrs (name: lib.mkDefault) {
+    users.users.${user} = lib.mapAttrs (_: lib.mkDefault) {
       description = "Castopod user";
       isSystemUser = true;
       group = config.services.nginx.group;
diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 359aaabfe673..ac7937b16e48 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -346,8 +346,8 @@ in
 
       port = lib.mkOption {
         type = types.port;
-        default = options.services.postgresql.port.default;
-        defaultText = lib.literalExpression "options.services.postgresql.port.default";
+        default = config.services.postgresql.settings.port;
+        defaultText = lib.literalExpression "config.services.postgresql.settings.port";
         description = lib.mdDoc ''
           The port of the database Invidious should use.
 
diff --git a/nixos/modules/services/web-apps/zabbix.nix b/nixos/modules/services/web-apps/zabbix.nix
index 4f6d7e4e6c1c..ac3c85af2a71 100644
--- a/nixos/modules/services/web-apps/zabbix.nix
+++ b/nixos/modules/services/web-apps/zabbix.nix
@@ -76,11 +76,11 @@ in
           type = types.port;
           default =
             if cfg.database.type == "mysql" then config.services.mysql.port
-            else if cfg.database.type == "pgsql" then config.services.postgresql.port
+            else if cfg.database.type == "pgsql" then config.services.postgresql.settings.port
             else 1521;
           defaultText = literalExpression ''
             if config.${opt.database.type} == "mysql" then config.${options.services.mysql.port}
-            else if config.${opt.database.type} == "pgsql" then config.${options.services.postgresql.port}
+            else if config.${opt.database.type} == "pgsql" then config.services.postgresql.settings.port
             else 1521
           '';
           description = lib.mdDoc "Database host port.";
diff --git a/nixos/tests/castopod.nix b/nixos/tests/castopod.nix
index 4435ec617d4e..29bf8e8cacd8 100644
--- a/nixos/tests/castopod.nix
+++ b/nixos/tests/castopod.nix
@@ -4,74 +4,218 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
   meta = with lib.maintainers; {
     maintainers = [ alexoundos misuzu ];
   };
+
   nodes.castopod = { nodes, ... }: {
+    # otherwise 500 MiB file upload fails!
+    virtualisation.diskSize = 512 + 3 * 512;
+
     networking.firewall.allowedTCPPorts = [ 80 ];
-    networking.extraHosts = ''
-      127.0.0.1 castopod.example.com
-    '';
+    networking.extraHosts =
+      lib.strings.concatStringsSep "\n"
+        (lib.attrsets.mapAttrsToList
+          (name: _: "127.0.0.1 ${name}")
+          nodes.castopod.services.nginx.virtualHosts);
+
     services.castopod = {
       enable = true;
       database.createLocally = true;
       localDomain = "castopod.example.com";
+      maxUploadSize = "512M";
     };
-    environment.systemPackages =
-      let
-        username = "admin";
-        email = "admin@castood.example.com";
-        password = "v82HmEp5";
-        testRunner = pkgs.writers.writePython3Bin "test-runner"
-          {
-            libraries = [ pkgs.python3Packages.selenium ];
-            flakeIgnore = [
-              "E501"
-            ];
-          } ''
-          from selenium.webdriver.common.by import By
-          from selenium.webdriver import Firefox
-          from selenium.webdriver.firefox.options import Options
-          from selenium.webdriver.support.ui import WebDriverWait
-          from selenium.webdriver.support import expected_conditions as EC
-
-          options = Options()
-          options.add_argument('--headless')
-          driver = Firefox(options=options)
-          try:
-              driver.implicitly_wait(20)
-              driver.get('http://castopod.example.com/cp-install')
-
-              wait = WebDriverWait(driver, 10)
-
-              wait.until(EC.title_contains("installer"))
-
-              driver.find_element(By.CSS_SELECTOR, '#username').send_keys(
-                  '${username}'
-              )
-              driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
-                  '${email}'
-              )
-              driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
-                  '${password}'
-              )
-              driver.find_element(By.XPATH, "//button[contains(., 'Finish install')]").click()
-
-              wait.until(EC.title_contains("Auth"))
-
-              driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
-                  '${email}'
-              )
-              driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
-                  '${password}'
-              )
-              driver.find_element(By.XPATH, "//button[contains(., 'Login')]").click()
-
-              wait.until(EC.title_contains("Admin dashboard"))
-          finally:
-              driver.close()
-              driver.quit()
-        '';
-      in
-      [ pkgs.firefox-unwrapped pkgs.geckodriver testRunner ];
   };
+
+  nodes.client = { nodes, pkgs, lib, ... }:
+    let
+      domain = nodes.castopod.services.castopod.localDomain;
+
+      getIP = node:
+        (builtins.head node.networking.interfaces.eth1.ipv4.addresses).address;
+
+      targetPodcastSize = 500 * 1024 * 1024;
+      lameMp3Bitrate = 348300;
+      lameMp3FileAdjust = -800;
+      targetPodcastDuration = toString
+        ((targetPodcastSize + lameMp3FileAdjust) / (lameMp3Bitrate / 8));
+      bannerWidth = 3000;
+      banner = pkgs.runCommand "gen-castopod-cover.jpg" { } ''
+        ${pkgs.imagemagick}/bin/magick `
+        `-background green -bordercolor white -gravity northwest xc:black `
+        `-duplicate 99 `
+        `-seed 1 -resize "%[fx:rand()*72+24]" `
+        `-seed 0 -rotate "%[fx:rand()*360]" -border 6x6 -splice 16x36 `
+        `-seed 0 -rotate "%[fx:floor(rand()*4)*90]" -resize "150x50!" `
+        `+append -crop 10x1@ +repage -roll "+%[fx:(t%2)*72]+0" -append `
+        `-resize ${toString bannerWidth} -quality 1 $out
+      '';
+
+      coverWidth = toString 3000;
+      cover = pkgs.runCommand "gen-castopod-banner.jpg" { } ''
+        ${pkgs.imagemagick}/bin/magick `
+        `-background white -bordercolor white -gravity northwest xc:black `
+        `-duplicate 99 `
+        `-seed 1 -resize "%[fx:rand()*72+24]" `
+        `-seed 0 -rotate "%[fx:rand()*360]" -border 6x6 -splice 36x36 `
+        `-seed 0 -rotate "%[fx:floor(rand()*4)*90]" -resize "144x144!" `
+        `+append -crop 10x1@ +repage -roll "+%[fx:(t%2)*72]+0" -append `
+        `-resize ${coverWidth} -quality 1 $out
+      '';
+    in
+    {
+      networking.extraHosts =
+        lib.strings.concatStringsSep "\n"
+          (lib.attrsets.mapAttrsToList
+            (name: _: "${getIP nodes.castopod} ${name}")
+            nodes.castopod.services.nginx.virtualHosts);
+
+      environment.systemPackages =
+        let
+          username = "admin";
+          email = "admin@${domain}";
+          password = "Abcd1234";
+          podcastTitle = "Some Title";
+          episodeTitle = "Episode Title";
+          browser-test = pkgs.writers.writePython3Bin "browser-test"
+            {
+              libraries = [ pkgs.python3Packages.selenium ];
+              flakeIgnore = [ "E124" "E501" ];
+            } ''
+            from selenium.webdriver.common.by import By
+            from selenium.webdriver import Firefox
+            from selenium.webdriver.firefox.options import Options
+            from selenium.webdriver.firefox.service import Service
+            from selenium.webdriver.support.ui import WebDriverWait
+            from selenium.webdriver.support import expected_conditions as EC
+            from subprocess import STDOUT
+            import logging
+
+            selenium_logger = logging.getLogger("selenium")
+            selenium_logger.setLevel(logging.DEBUG)
+            selenium_logger.addHandler(logging.StreamHandler())
+
+            options = Options()
+            options.add_argument('--headless')
+            service = Service(log_output=STDOUT)
+            driver = Firefox(options=options, service=service)
+            driver = Firefox(options=options)
+            driver.implicitly_wait(30)
+
+            # install ##########################################################
+
+            driver.get('http://${domain}/cp-install')
+
+            wait = WebDriverWait(driver, 20)
+
+            wait.until(EC.title_contains("installer"))
+
+            driver.find_element(By.CSS_SELECTOR, '#username').send_keys(
+                '${username}'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
+                '${email}'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
+                '${password}'
+            )
+            driver.find_element(By.XPATH,
+                                "//button[contains(., 'Finish install')]"
+            ).click()
+
+            wait.until(EC.title_contains("Auth"))
+
+            driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
+                '${email}'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
+                '${password}'
+            )
+            driver.find_element(By.XPATH,
+                                "//button[contains(., 'Login')]"
+            ).click()
+
+            wait.until(EC.title_contains("Admin dashboard"))
+
+            # create podcast ###################################################
+
+            driver.get('http://${domain}/admin/podcasts/new')
+
+            wait.until(EC.title_contains("Create podcast"))
+
+            driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
+                '${cover}'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#banner').send_keys(
+                '${banner}'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#title').send_keys(
+                '${podcastTitle}'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#handle').send_keys(
+                'some_handle'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#description').send_keys(
+                'Some description'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#owner_name').send_keys(
+                'Owner Name'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#owner_email').send_keys(
+                'owner@email.xyz'
+            )
+            driver.find_element(By.XPATH,
+                                "//button[contains(., 'Create podcast')]"
+            ).click()
+
+            wait.until(EC.title_contains("${podcastTitle}"))
+
+            driver.find_element(By.XPATH,
+                                "//span[contains(., 'Add an episode')]"
+            ).click()
+
+            wait.until(EC.title_contains("Add an episode"))
+
+            # upload podcast ###################################################
+
+            driver.find_element(By.CSS_SELECTOR, '#audio_file').send_keys(
+                '/tmp/podcast.mp3'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
+                '${cover}'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#description').send_keys(
+                'Episode description'
+            )
+            driver.find_element(By.CSS_SELECTOR, '#title').send_keys(
+                '${episodeTitle}'
+            )
+            driver.find_element(By.XPATH,
+                                "//button[contains(., 'Create episode')]"
+            ).click()
+
+            wait.until(EC.title_contains("${episodeTitle}"))
+
+            driver.close()
+            driver.quit()
+          '';
+        in
+        [
+          pkgs.firefox-unwrapped
+          pkgs.geckodriver
+          browser-test
+          (pkgs.writeShellApplication {
+            name = "build-mp3";
+            runtimeInputs = with pkgs; [ sox lame ];
+            text = ''
+              out=/tmp/podcast.mp3
+              sox -n -r 48000 -t wav - synth ${targetPodcastDuration} sine 440 `
+              `| lame --noreplaygain -cbr -q 9 -b 320 - $out
+              FILESIZE="$(stat -c%s $out)"
+              [ "$FILESIZE" -gt 0 ]
+              [ "$FILESIZE" -le "${toString targetPodcastSize}" ]
+            '';
+          })
+        ];
+    };
+
   testScript = ''
     start_all()
     castopod.wait_for_unit("castopod-setup.service")
@@ -79,9 +223,11 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     castopod.wait_for_unit("nginx.service")
     castopod.wait_for_open_port(80)
     castopod.wait_until_succeeds("curl -sS -f http://castopod.example.com")
-    castopod.succeed("curl -s http://localhost/cp-install | grep 'Create your Super Admin account' > /dev/null")
 
-    with subtest("Create superadmin and log in"):
-        castopod.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner")
+    client.succeed("build-mp3")
+
+    with subtest("Create superadmin, log in, create and upload a podcast"):
+        client.succeed(\
+          "PYTHONUNBUFFERED=1 systemd-cat -t browser-test browser-test")
   '';
 })
diff --git a/nixos/tests/invidious.nix b/nixos/tests/invidious.nix
index e31cd87f6a00..372b47b56c34 100644
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@@ -18,7 +18,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
           host invidious invidious samenet scram-sha-256
         '';
       };
-      networking.firewall.allowedTCPPorts = [ config.services.postgresql.port ];
+      networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
     };
     machine = { config, lib, pkgs, ... }: {
       services.invidious = {
diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix
index 6d38224448ed..2adf9010051c 100644
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@@ -76,7 +76,7 @@ in
       systemd.services.postgresql.postStart = lib.mkAfter ''
         $PSQL -tAd miniflux -c 'CREATE EXTENSION hstore;'
       '';
-      networking.firewall.allowedTCPPorts = [ config.services.postgresql.port ];
+      networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
     };
     externalDb = { ... }: {
       security.apparmor.enable = true;
diff --git a/nixos/tests/pg_anonymizer.nix b/nixos/tests/pg_anonymizer.nix
index 2960108e37c3..b26e4dca0580 100644
--- a/nixos/tests/pg_anonymizer.nix
+++ b/nixos/tests/pg_anonymizer.nix
@@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     services.postgresql = {
       enable = true;
       extraPlugins = ps: [ ps.anonymizer ];
-      settings.shared_preload_libraries = "anon";
+      settings.shared_preload_libraries = [ "anon" ];
     };
   };
 
diff --git a/nixos/tests/pgmanage.nix b/nixos/tests/pgmanage.nix
index 6f8f2f965340..6e72b32eca36 100644
--- a/nixos/tests/pgmanage.nix
+++ b/nixos/tests/pgmanage.nix
@@ -21,7 +21,7 @@ in
         pgmanage = {
           enable = true;
           connections = {
-            ${conn} = "hostaddr=127.0.0.1 port=${toString config.services.postgresql.port} dbname=postgres";
+            ${conn} = "hostaddr=127.0.0.1 port=${toString config.services.postgresql.settings.port} dbname=postgres";
           };
         };
       };
diff --git a/nixos/tests/web-apps/mastodon/remote-databases.nix b/nixos/tests/web-apps/mastodon/remote-databases.nix
index fa6430a99353..55243658ec6a 100644
--- a/nixos/tests/web-apps/mastodon/remote-databases.nix
+++ b/nixos/tests/web-apps/mastodon/remote-databases.nix
@@ -33,7 +33,7 @@ in
         extraHosts = hosts;
         firewall.allowedTCPPorts = [
           config.services.redis.servers.mastodon.port
-          config.services.postgresql.port
+          config.services.postgresql.settings.port
         ];
       };
 
diff --git a/pkgs/applications/audio/castopod/default.nix b/pkgs/applications/audio/castopod/default.nix
index 801368a131cf..13bb4afe8e2d 100644
--- a/pkgs/applications/audio/castopod/default.nix
+++ b/pkgs/applications/audio/castopod/default.nix
@@ -3,7 +3,7 @@
 , ffmpeg-headless
 , lib
 , nixosTests
-, stateDirectory ? "/var/lib/castopod"
+, dataDir ? "/var/lib/castopod"
 }:
 stdenv.mkDerivation {
   pname = "castopod";
@@ -20,13 +20,16 @@ stdenv.mkDerivation {
   postPatch = ''
     # not configurable at runtime unfortunately:
     substituteInPlace app/Config/Paths.php \
-      --replace "__DIR__ . '/../../writable'" "'${stateDirectory}/writable'"
+      --replace "__DIR__ . '/../../writable'" "'${dataDir}/writable'"
 
-    # configuration file must be writable, place it to ${stateDirectory}
+    substituteInPlace modules/Admin/Controllers/DashboardController.php \
+      --replace "disk_total_space('./')" "disk_total_space('${dataDir}')"
+
+    # configuration file must be writable, place it to ${dataDir}
     substituteInPlace modules/Install/Controllers/InstallController.php \
-      --replace "ROOTPATH" "'${stateDirectory}/'"
+      --replace "ROOTPATH" "'${dataDir}/'"
     substituteInPlace public/index.php spark \
-      --replace "DotEnv(ROOTPATH)" "DotEnv('${stateDirectory}')"
+      --replace "DotEnv(ROOTPATH)" "DotEnv('${dataDir}')"
 
     # ffmpeg is required for Video Clips feature
     substituteInPlace modules/MediaClipper/VideoClipper.php \
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index 73acf782e813..b3ff8ccce2c2 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "5.0.20";
+  version = "5.0.21";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-wC3KnuKHsUw1jt7EXVAgPhB6Sk8630sVaM3yn6CGPqs=";
+    sha256 = "sha256-WtBsChSHnYbRBojxRUGdMnXlG+45hp4ZSd8GLx5n/88=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ded569df4d8d..e159e30f2f54 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -17081,5 +17081,17 @@ final: prev:
     meta.homepage = "https://github.com/codethread/qmk.nvim/";
   };
 
+  vim-godot = buildVimPlugin {
+    pname = "vim-godot";
+    version = "2024-02-18";
+    src = fetchFromGitHub {
+      owner = "habamax";
+      repo = "vim-godot";
+      rev = "f9c0b36b299efcc4aa4cb119a2be36a83fe10388";
+      sha256 = "sha256-HKp3CQwAOs+7TL8MjWZ2EHLHMZ3Ss7AckAZ5eOjTDEg=";
+    };
+    meta.homepage = "https://github.com/habamax/vim-godot/";
+  };
+
 
 }
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 720593f0487b..a63adaaea340 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1100,6 +1100,7 @@ https://github.com/junegunn/vim-github-dashboard/,,
 https://github.com/tikhomirov/vim-glsl/,,
 https://github.com/jamessan/vim-gnupg/,,
 https://github.com/fatih/vim-go/,,
+https://github.com/habamax/vim-godot/,HEAD,
 https://github.com/rhysd/vim-grammarous/,,
 https://github.com/jparise/vim-graphql/,,
 https://github.com/mhinz/vim-grepper/,,
diff --git a/pkgs/applications/networking/browsers/badwolf/default.nix b/pkgs/applications/networking/browsers/badwolf/default.nix
index 2200f878172b..5772586d8d4e 100644
--- a/pkgs/applications/networking/browsers/badwolf/default.nix
+++ b/pkgs/applications/networking/browsers/badwolf/default.nix
@@ -1,39 +1,49 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , fetchgit
+, ninja
 , pkg-config
+, ed
 , wrapGAppsHook
 , webkitgtk
 , libxml2
-, glib
 , glib-networking
 , gettext
 }:
+
 stdenv.mkDerivation rec {
   pname = "badwolf";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchgit {
-    url = "git://hacktivis.me/git/badwolf.git";
+    url = "https://hacktivis.me/git/badwolf.git";
     rev = "v${version}";
-    hash = "sha256-HfAsq6z+1kqMAsNxJjWJx9nd2cbv0XN4KRS8cYuhOsQ=";
+    hash = "sha256-feWSxK9TJ5MWxUKutuTcdmMk5IbLjNseUAvfm20kQ1U=";
   };
 
-  preConfigure = ''
-    export PREFIX=$out
-  '';
+  # configure script not accepting '--prefix'
+  prefixKey = "PREFIX=";
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [
+    ninja
+    pkg-config
+    ed
+    wrapGAppsHook
+  ];
 
-  buildInputs = [ webkitgtk libxml2 gettext glib glib-networking ];
+  buildInputs = [
+    webkitgtk
+    libxml2
+    gettext
+    glib-networking
+  ];
 
   meta = with lib; {
     description = "Minimalist and privacy-oriented WebKitGTK+ browser";
     mainProgram = "badwolf";
     homepage = "https://hacktivis.me/projects/badwolf";
-    license = licenses.bsd3;
+    license = with licenses; [ bsd3 cc-by-sa-40 ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ laalsaas ];
+    maintainers = with maintainers; [ laalsaas aleksana ];
   };
-
 }
diff --git a/pkgs/applications/networking/browsers/litebrowser/default.nix b/pkgs/applications/networking/browsers/litebrowser/default.nix
index d1ffce7e6e5e..0c2c2b2e9b3c 100644
--- a/pkgs/applications/networking/browsers/litebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/litebrowser/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation {
   pname = "litebrowser";
-  version = "unstable-2022-10-31";
+  version = "unstable-2024-02-25";
 
   src = fetchFromGitHub {
     owner = "litehtml";
     repo = "litebrowser-linux";
-    rev = "4654f8fb2d5e2deba7ac6223b6639341bd3b7eba";
-    hash = "sha256-SvW1AOxLBLKqa+/2u2Zn+/t33ZzQHmqlcLRl6z0rK9U=";
+    rev = "8130cf50af90e07d201d43b934b5a57f7ed4e68d";
+    hash = "sha256-L/pd4VypDfjLKfh+HLpc4um+POWGzGa4OOttudwJxyk=";
     fetchSubmodules = true; # litehtml submodule
   };
 
@@ -46,6 +46,7 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
+    broken = stdenv.cc.isClang;  # https://github.com/litehtml/litebrowser-linux/issues/19
     description = "A simple browser based on the litehtml engine";
     mainProgram = "litebrowser";
     homepage = "https://github.com/litehtml/litebrowser-linux";
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index c9052133e5d9..5502c5c582f1 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.16.3";
+  version = "0.16.4";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-WD0CUPl9Qkalhog2IbefMkiLiVZFW59X21sYH4hUqZs=";
+    hash = "sha256-fhTjYhRCtJu18AGYF6hiTdRMEdlNO+DmDwh2hZBXzPk=";
   };
 
   vendorHash = null;
@@ -37,11 +37,12 @@ buildGoModule rec {
       --zsh <($out/bin/cilium completion zsh)
   '';
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/cilium/cilium-cli/releases/tag/v${version}";
     description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
     homepage = "https://www.cilium.io/";
-    maintainers = with maintainers; [ humancalico bryanasdev000 qjoly ];
+    maintainers = with lib.maintainers; [ bryanasdev000 humancalico qjoly superherointj ];
     mainProgram = "cilium";
   };
 }
diff --git a/pkgs/applications/networking/cluster/kubebuilder/default.nix b/pkgs/applications/networking/cluster/kubebuilder/default.nix
index 55f29f0deb47..b50320d7c1a0 100644
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "3.14.0";
+  version = "3.14.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    hash = "sha256-em+I2YICcqljaaNQ+zOAnOZ552elmV6Ywbfla8buwaY=";
+    hash = "sha256-TMKixwZonYGPXIqOtgnuilbH7BaIRyqJU6uKtp9ANKM=";
   };
 
-  vendorHash = "sha256-iBwhpVs9u5AQAvmzb69SaewdYHmmaV19Bstd0Tux9CA=";
+  vendorHash = "sha256-Hl01dFSffYv59zensKTjXWLXxwfkQYAO5xadlc5iBJY=";
 
   subPackages = ["cmd"];
 
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 92d7c73eb697..e17fd5d6916e 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.11.25";
+  version = "3.11.27";
   pyproject = true;
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bvCogSBB990LIkk273EMTlqNN303JKr5WCI8g7hLU9Q=";
+    hash = "sha256-0ENBUOH+/pe4OsVQ6cu1xLTPPHtUMNARQGVyxOk60X0=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 8dd3a1713955..7af592f0a8a1 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240320";
+  version = "20240328-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-2H+VGVPnSHdsx62hPygWc5uz5vH6DS7AfmYSlBZuB4A=";
+    hash = "sha256-oEwWbTs8Orpo+qRCKVvkeJYEob8O/qkKmv/iA5JUpfQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index b19d1f6f8a01..f406181b4511 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -45,14 +45,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.36.140";
-  x86_64-darwin-sha256 = "0w1fxza3aglh7513znv190gsha12rk7k1ybdp4ml2pffwmm8diad";
+  x86_64-darwin-version = "4.37.94";
+  x86_64-darwin-sha256 = "01v7v977fq8mfsl0lipdc7ig55p2sknxzr1jmh8qxiq4f4y0rj5g";
 
-  x86_64-linux-version = "4.36.140";
-  x86_64-linux-sha256 = "0zahhhpcb1dxdhfmam32iqr5w3pspzbmcdv53ciqfnbkmwzkc3xr";
+  x86_64-linux-version = "4.37.94";
+  x86_64-linux-sha256 = "1f1spl767ldrarvpxrayry2d0nyr22b8xacxl4g1r8raryvnyz0x";
 
-  aarch64-darwin-version = "4.36.140";
-  aarch64-darwin-sha256 = "118mzkpk431dcm61gkbj5m4sdxkwnk6fvmxg9f96xiv6n22n7pnx";
+  aarch64-darwin-version = "4.37.94";
+  aarch64-darwin-sha256 = "0gh45gvlbjzxh0fn24z15glxqih5lggam8w6kpawsxgivkw6rjcc";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;
diff --git a/pkgs/applications/science/misc/colmap/default.nix b/pkgs/applications/science/misc/colmap/default.nix
index 64a7952be4cc..d071c90562cd 100644
--- a/pkgs/applications/science/misc/colmap/default.nix
+++ b/pkgs/applications/science/misc/colmap/default.nix
@@ -1,7 +1,9 @@
 { mkDerivation, lib, fetchFromGitHub, cmake, boost179, ceres-solver, eigen,
   freeimage, glog, libGLU, glew, qtbase,
+  autoAddDriverRunpath,
   config,
-  cudaSupport ? config.cudaSupport, cudaPackages }:
+  cudaSupport ? config.cudaSupport, cudaPackages
+}:
 
 assert cudaSupport -> cudaPackages != { };
 
@@ -37,7 +39,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     cmake
   ] ++ lib.optionals cudaSupport [
-    cudaPackages.autoAddDriverRunpath
+    autoAddDriverRunpath
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/redmine/Gemfile b/pkgs/applications/version-management/redmine/Gemfile
deleted file mode 100644
index 326f0e0bab0b..000000000000
--- a/pkgs/applications/version-management/redmine/Gemfile
+++ /dev/null
@@ -1,107 +0,0 @@
-source 'https://rubygems.org'
-
-ruby '>= 2.5.0', '< 3.2.0'
-gem 'bundler', '>= 1.12.0'
-
-gem 'rails', '6.1.7.6'
-gem 'globalid', '~> 0.4.2' if Gem.ruby_version < Gem::Version.new('2.6.0')
-gem 'rouge', '~> 3.28.0'
-gem 'request_store', '~> 1.5.0'
-gem 'mini_mime', '~> 1.1.0'
-gem "actionpack-xml_parser"
-gem 'roadie-rails', (Gem.ruby_version < Gem::Version.new('2.6.0') ? '~> 2.2.0' : '~> 3.0.0')
-gem 'marcel'
-gem "mail", "~> 2.7.1"
-gem 'csv', '~> 3.2.0'
-gem 'nokogiri', (if Gem.ruby_version < Gem::Version.new('2.6.0')
-                   '~> 1.12.5'
-                 elsif Gem.ruby_version < Gem::Version.new('2.7.0')
-                   '~> 1.13.10'
-                 else
-                   '~> 1.15.2'
-                 end)
-gem "rexml", require: false if Gem.ruby_version >= Gem::Version.new('3.0')
-gem 'i18n', '~> 1.10.0'
-gem 'rbpdf', '~> 1.21.3'
-gem 'addressable'
-gem 'rubyzip', '~> 2.3.0'
-gem 'net-smtp', '~> 0.3.0'
-gem 'net-imap', '~> 0.2.2'
-gem 'net-pop', '~> 0.1.1'
-# Rails 6.1.6.1 does not work with Pysch 3.0.2, which is installed by default with Ruby 2.5. See https://github.com/rails/rails/issues/45590
-gem 'psych', '>= 3.1.0' if Gem.ruby_version < Gem::Version.new('2.6.0')
-
-# Windows does not include zoneinfo files, so bundle the tzinfo-data gem
-gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
-
-# TOTP-based 2-factor authentication
-gem 'rotp', '>= 5.0.0'
-gem 'rqrcode'
-
-# Optional gem for LDAP authentication
-group :ldap do
-  gem 'net-ldap', '~> 0.17.0'
-end
-
-# Optional gem for exporting the gantt to a PNG file
-group :minimagick do
-  gem 'mini_magick', '~> 4.11.0'
-end
-
-# Optional Markdown support, not for JRuby
-# ToDo: Remove common_mark group when common_mark is decoupled from markdown. See defect (#36892) for more details.
-gem 'redcarpet', '~> 3.5.1', groups: [:markdown, :common_mark]
-
-# Optional CommonMark support, not for JRuby
-group :common_mark do
-  gem "html-pipeline", "~> 2.13.2"
-  gem "commonmarker", (Gem.ruby_version < Gem::Version.new('2.6.0') ? '0.21.0' : '~> 0.23.8')
-  gem "sanitize", "~> 6.0"
-  gem 'deckar01-task_list', '2.3.2'
-end
-
-# webrick
-gem 'webrick'
-
-# Include database gems for the database adapters NixOS supports
-require 'erb'
-require 'yaml'
-gem "mysql2", "~> 0.5.0", :platforms => [:mri, :mingw, :x64_mingw]
-gem "pg", "~> 1.4.2", :platforms => [:mri, :mingw, :x64_mingw]
-
-group :development do
-  gem 'listen', '~> 3.3'
-  gem "yard"
-end
-
-group :test do
-  gem "rails-dom-testing"
-  gem 'mocha', '>= 2.0.1'
-  gem 'simplecov', '~> 0.21.2', :require => false
-  gem "ffi", platforms: [:mri, :mingw, :x64_mingw, :mswin]
-  # For running system tests
-  gem 'puma', (Gem.ruby_version < Gem::Version.new('2.7') ? '< 6.0.0' : '>= 0')
-  gem 'capybara', (if Gem.ruby_version < Gem::Version.new('2.6')
-                     '~> 3.35.3'
-                   elsif Gem.ruby_version < Gem::Version.new('2.7')
-                     '~> 3.36.0'
-                   else
-                     '~> 3.38.0'
-                   end)
-  gem "selenium-webdriver", "~> 3.142.7"
-  gem 'webdrivers', '4.6.1', require: false
-  # RuboCop
-  gem 'rubocop', '~> 1.26.0'
-  gem 'rubocop-performance', '~> 1.13.0'
-  gem 'rubocop-rails', '~> 2.14.0'
-end
-
-local_gemfile = File.join(File.dirname(__FILE__), "Gemfile.local")
-if File.exist?(local_gemfile)
-  eval_gemfile local_gemfile
-end
-
-# Load plugins' Gemfiles
-Dir.glob File.expand_path("../plugins/*/{Gemfile,PluginGemfile}", __FILE__) do |file|
-  eval_gemfile file
-end
diff --git a/pkgs/applications/virtualization/tart/default.nix b/pkgs/applications/virtualization/tart/default.nix
index fd46baba6fce..e8791404fb87 100644
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.6.0";
+  version = "2.7.2";
 
   src = fetchurl {
       url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart-arm64.tar.gz";
-      hash = "sha256-QtVqgmjYpLAhFibW1DIVWNYiOjHB1X/YY6zRVB+1soA=";
+      hash = "sha256-Z/LZ8g1/FYT7Jh943tFxN8L5HeNf0CVz1VEJj+2fCd8=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/applications/networking/bee/bee.nix b/pkgs/by-name/be/bee/package.nix
similarity index 69%
rename from pkgs/applications/networking/bee/bee.nix
rename to pkgs/by-name/be/bee/package.nix
index cca2e549c8b1..a1f9e469b1ef 100644
--- a/pkgs/applications/networking/bee/bee.nix
+++ b/pkgs/by-name/be/bee/package.nix
@@ -5,27 +5,27 @@
 
 buildGoModule rec {
   pname = "bee";
-  version = "1.18.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "ethersphere";
     repo = "bee";
     rev = "v${version}";
-    sha256 = "sha256-LUOKF1073GmQWG2q4w0cTErSHw7ok5N6PQZ45xpjYx4=";
+    sha256 = "sha256-gZDmFufk/zBftQe7Ju4rDpZqw0hm2nf9YQg1Oa8540s=";
   };
 
-  vendorHash = "sha256-UdsF/otjXqS1NY3PkCimRiD93hGntHG3Xhw6avFtHog=";
+  vendorHash = "sha256-GpazHMQ8xZ6P7mADvsG3bXxDxEWnCJRIsBwDnL/McZA=";
 
   subPackages = [ "cmd/bee" ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/ethersphere/bee.version=${version}"
-    "-X github.com/ethersphere/bee/pkg/api.Version=5.2.0"
-    "-X github.com/ethersphere/bee/pkg/api.DebugVersion=4.1.0"
-    "-X github.com/ethersphere/bee/pkg/p2p/libp2p.reachabilityOverridePublic=false"
-    "-X github.com/ethersphere/bee/pkg/postage/listener.batchFactorOverridePublic=5"
+    "-X github.com/ethersphere/bee/v2.version=${version}"
+    "-X github.com/ethersphere/bee/v2/pkg/api.Version=5.2.0"
+    "-X github.com/ethersphere/bee/v2/pkg/api.DebugVersion=4.1.1"
+    "-X github.com/ethersphere/bee/v2/pkg/p2p/libp2p.reachabilityOverridePublic=false"
+    "-X github.com/ethersphere/bee/v2/pkg/postage/listener.batchFactorOverridePublic=5"
   ];
 
   CGO_ENABLED = 0;
diff --git a/pkgs/by-name/bo/boxbuddy/package.nix b/pkgs/by-name/bo/boxbuddy/package.nix
index db19ca5b3998..d57286e76a0b 100644
--- a/pkgs/by-name/bo/boxbuddy/package.nix
+++ b/pkgs/by-name/bo/boxbuddy/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "boxbuddy";
-  version = "2.1.5";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "Dvlv";
     repo = "BoxBuddyRS";
     rev = version;
-    hash = "sha256-XMLgUYOv2ObHqYxqPch5i0Q1/BvfDuC1Lti5FYAVmnk=";
+    hash = "sha256-Fb3Df+P2ovSVQhtDxhed/hH06UKnJY/iugt3Pi9/Jp0=";
   };
 
-  cargoHash = "sha256-zbhdGpF3TonGlvRXCWF00PhIc0k1ZO2xIMXuwYD90mY=";
+  cargoHash = "sha256-dmBQdE4rsL8ygXOGupjtZrWuXjVAy5m1p/xJlUdUwkY=";
 
   # The software assumes it is installed either in flatpak or in the home directory
   # so the xdg data path needs to be patched here
diff --git a/pkgs/by-name/go/go-bare/package.nix b/pkgs/by-name/go/go-bare/package.nix
new file mode 100644
index 000000000000..0fd076c580ce
--- /dev/null
+++ b/pkgs/by-name/go/go-bare/package.nix
@@ -0,0 +1,25 @@
+{ buildGoModule, fetchFromSourcehut, lib }:
+
+buildGoModule rec {
+  pname = "go-bare";
+  version = "0-unstable-2021-04-06";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "go-bare";
+    rev = "ab86bc2846d997bc8760fdb0d06d4a55e746b1db";
+    hash = "sha256-SKTYDKidB1Ia3Jg4EBg5rPAtqlXAa19RY5qieS82A34=";
+  };
+
+  vendorHash = "sha256-OhJb/q1XJ/U/AvCcCXw2Ll86UKlkHGuURHS5J6aXNTs=";
+
+  subPackages = [ "cmd/gen" ];
+
+  meta = with lib; {
+    description = "An implementation of the BARE message format for Go";
+    mainProgram = "gen";
+    homepage = "https://git.sr.ht/~sircmpwn/go-bare";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ poptart ];
+  };
+}
diff --git a/pkgs/data/fonts/lxgw-neoxihei/default.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
similarity index 88%
rename from pkgs/data/fonts/lxgw-neoxihei/default.nix
rename to pkgs/by-name/lx/lxgw-neoxihei/package.nix
index 3832ba8d510b..aa8df5a62547 100644
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.120.1";
+  version = "1.120.2";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-shzJ5y2mjvodtSHct9gm+09CludxUpR38qi9zvewjaQ=";
+    hash = "sha256-RN0OmNS3aSRMK19nNiqXYJ4PIAQh6u5W/+L8DCeqMcE=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/mi/miru/package.nix b/pkgs/by-name/mi/miru/package.nix
index c89dc296d8b3..45e747ad9771 100644
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@@ -5,12 +5,12 @@
 
 appimageTools.wrapType2 rec {
   pname = "miru";
-  version = "5.0.0";
+  version = "5.0.3";
 
   src = fetchurl {
     url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/linux-Miru-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-Gp3pP973+peSr0pfUDqKQWZFiY4jdOp4tsn1336wcwY=";
+    sha256 = "sha256-vKV1Scd+YiJMIV8EWx4udoOxTXW9NA7k/CxRVNRqrjk=";
   };
 
   extraInstallCommands =
@@ -29,7 +29,7 @@ appimageTools.wrapType2 rec {
 
   meta = with lib; {
     description = "Stream anime torrents, real-time with no waiting for downloads";
-    homepage = "https://github.com/ThaUnknown/miru#readme";
+    homepage = "https://miru.watch";
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.d4ilyrun ];
     mainProgram = "miru";
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
new file mode 100644
index 000000000000..1d0c1c6c90bb
--- /dev/null
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "nuclei-templates";
+  version = "9.8.0";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = "nuclei-templates";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1aLy8wNWMFouZRjhCSiwSq1uo20C9wN7LPxyBqK6K0k=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/nuclei-templates
+    cp -R cloud code config dns file headless helpers http javascript network ssl \
+      $out/share/nuclei-templates/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Templates for the nuclei engine to find security vulnerabilities";
+    homepage = "https://github.com/projectdiscovery/nuclei-templates";
+    changelog = "https://github.com/projectdiscovery/nuclei-templates/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/version-management/redmine/0001-python3.patch b/pkgs/by-name/re/redmine/0001-python3.patch
similarity index 100%
rename from pkgs/applications/version-management/redmine/0001-python3.patch
rename to pkgs/by-name/re/redmine/0001-python3.patch
diff --git a/pkgs/by-name/re/redmine/Gemfile b/pkgs/by-name/re/redmine/Gemfile
new file mode 100644
index 000000000000..e29e240c75b7
--- /dev/null
+++ b/pkgs/by-name/re/redmine/Gemfile
@@ -0,0 +1,101 @@
+source 'https://rubygems.org'
+
+ruby '>= 2.7.0', '< 3.3.0'
+
+gem 'rails', '6.1.7.7'
+gem 'rouge', '~> 4.2.0'
+gem 'request_store', '~> 1.5.0'
+gem 'mini_mime', '~> 1.1.0'
+gem "actionpack-xml_parser"
+gem 'roadie-rails', '~> 3.1.0'
+gem 'marcel'
+gem 'mail', '~> 2.8.1'
+gem 'nokogiri', '~> 1.15.2'
+gem 'i18n', '~> 1.14.1'
+gem 'rbpdf', '~> 1.21.3'
+gem 'addressable'
+gem 'rubyzip', '~> 2.3.0'
+
+#  Ruby Standard Gems
+gem 'csv', '~> 3.2.6'
+gem 'net-imap', '~> 0.3.4'
+gem 'net-pop', '~> 0.1.2'
+gem 'net-smtp', '~> 0.3.3'
+gem 'rexml', require: false if Gem.ruby_version >= Gem::Version.new('3.0')
+
+# Windows does not include zoneinfo files, so bundle the tzinfo-data gem
+gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
+
+# TOTP-based 2-factor authentication
+gem 'rotp', '>= 5.0.0'
+gem 'rqrcode'
+
+# HTML pipeline and sanitization
+gem "html-pipeline", "~> 2.13.2"
+gem "sanitize", "~> 6.0"
+
+# Optional gem for LDAP authentication
+group :ldap do
+  gem 'net-ldap', '~> 0.17.0'
+end
+
+# Optional gem for exporting the gantt to a PNG file
+group :minimagick do
+  gem 'mini_magick', '~> 4.12.0'
+end
+
+# Optional Markdown support
+group :markdown do
+  gem 'redcarpet', '~> 3.6.0'
+end
+
+# Optional CommonMark support, not for JRuby
+group :common_mark do
+  gem "commonmarker", '~> 0.23.8'
+  gem 'deckar01-task_list', '2.3.2'
+end
+
+# Include database gems for the database adapters NixOS supports
+require 'erb'
+require 'yaml'
+gem "mysql2", "~> 0.5.0", :platforms => [:mri, :mingw, :x64_mingw]
+gem "with_advisory_lock"
+gem 'pg', '~> 1.5.3', :platforms => [:mri, :mingw, :x64_mingw]
+gem 'sqlite3', '~> 1.6.0', :platforms => [:mri, :mingw, :x64_mingw]
+
+group :development do
+  gem 'listen', '~> 3.3'
+  gem "yard"
+end
+
+group :test do
+  gem "rails-dom-testing"
+  gem 'mocha', '>= 2.0.1'
+  gem 'simplecov', '~> 0.22.0', :require => false
+  gem "ffi", platforms: [:mri, :mingw, :x64_mingw, :mswin]
+  # For running system tests
+  gem 'puma'
+  gem "capybara", ">= 3.39"
+  if Gem.ruby_version < Gem::Version.new('3.0')
+    gem "selenium-webdriver", "<= 4.9.0"
+    gem "webdrivers", require: false
+  else
+    gem "selenium-webdriver", ">= 4.11.0"
+  end
+  # RuboCop
+  gem 'rubocop', '~> 1.57.0', require: false
+  gem 'rubocop-performance', '~> 1.19.0', require: false
+  gem 'rubocop-rails', '~> 2.22.1', require: false
+end
+
+gem "webrick"
+
+local_gemfile = File.join(File.dirname(__FILE__), "Gemfile.local")
+if File.exist?(local_gemfile)
+  eval_gemfile local_gemfile
+end
+
+# Load plugins' Gemfiles
+Dir.glob File.expand_path("../plugins/*/{Gemfile,PluginGemfile}", __FILE__) do |file|
+  eval_gemfile file
+end
diff --git a/pkgs/applications/version-management/redmine/Gemfile.lock b/pkgs/by-name/re/redmine/Gemfile.lock
similarity index 55%
rename from pkgs/applications/version-management/redmine/Gemfile.lock
rename to pkgs/by-name/re/redmine/Gemfile.lock
index f9efc5ecede6..c1600850c9a7 100644
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/by-name/re/redmine/Gemfile.lock
@@ -1,28 +1,28 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (6.1.7.6)
-      actionpack (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
+    actioncable (6.1.7.7)
+      actionpack (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.7.6)
-      actionpack (= 6.1.7.6)
-      activejob (= 6.1.7.6)
-      activerecord (= 6.1.7.6)
-      activestorage (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
+    actionmailbox (6.1.7.7)
+      actionpack (= 6.1.7.7)
+      activejob (= 6.1.7.7)
+      activerecord (= 6.1.7.7)
+      activestorage (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
       mail (>= 2.7.1)
-    actionmailer (6.1.7.6)
-      actionpack (= 6.1.7.6)
-      actionview (= 6.1.7.6)
-      activejob (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
+    actionmailer (6.1.7.7)
+      actionpack (= 6.1.7.7)
+      actionview (= 6.1.7.7)
+      activejob (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.1.7.6)
-      actionview (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
+    actionpack (6.1.7.7)
+      actionview (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
@@ -30,63 +30,63 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actiontext (6.1.7.6)
-      actionpack (= 6.1.7.6)
-      activerecord (= 6.1.7.6)
-      activestorage (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
+    actiontext (6.1.7.7)
+      actionpack (= 6.1.7.7)
+      activerecord (= 6.1.7.7)
+      activestorage (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
       nokogiri (>= 1.8.5)
-    actionview (6.1.7.6)
-      activesupport (= 6.1.7.6)
+    actionview (6.1.7.7)
+      activesupport (= 6.1.7.7)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.7.6)
-      activesupport (= 6.1.7.6)
+    activejob (6.1.7.7)
+      activesupport (= 6.1.7.7)
       globalid (>= 0.3.6)
-    activemodel (6.1.7.6)
-      activesupport (= 6.1.7.6)
-    activerecord (6.1.7.6)
-      activemodel (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
-    activestorage (6.1.7.6)
-      actionpack (= 6.1.7.6)
-      activejob (= 6.1.7.6)
-      activerecord (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
+    activemodel (6.1.7.7)
+      activesupport (= 6.1.7.7)
+    activerecord (6.1.7.7)
+      activemodel (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
+    activestorage (6.1.7.7)
+      actionpack (= 6.1.7.7)
+      activejob (= 6.1.7.7)
+      activerecord (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
       marcel (~> 1.0)
       mini_mime (>= 1.1.0)
-    activesupport (6.1.7.6)
+    activesupport (6.1.7.7)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
       zeitwerk (~> 2.3)
-    addressable (2.8.5)
+    addressable (2.8.6)
       public_suffix (>= 2.0.2, < 6.0)
     ast (2.4.2)
+    base64 (0.2.0)
     builder (3.2.4)
-    capybara (3.38.0)
+    capybara (3.40.0)
       addressable
       matrix
       mini_mime (>= 0.1.3)
-      nokogiri (~> 1.8)
+      nokogiri (~> 1.11)
       rack (>= 1.6.0)
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    childprocess (3.0.0)
     chunky_png (1.4.0)
     commonmarker (0.23.10)
-    concurrent-ruby (1.2.2)
+    concurrent-ruby (1.2.3)
     crass (1.0.6)
     css_parser (1.16.0)
       addressable
-    csv (3.2.8)
+    csv (3.2.9)
+    date (3.3.4)
     deckar01-task_list (2.3.2)
       html-pipeline
-    digest (3.1.1)
     docile (1.4.0)
     erubi (1.12.0)
     ffi (1.16.3)
@@ -96,67 +96,71 @@ GEM
       activesupport (>= 2)
       nokogiri (>= 1.4)
     htmlentities (4.3.4)
-    i18n (1.10.0)
+    i18n (1.14.4)
       concurrent-ruby (~> 1.0)
-    listen (3.8.0)
+    json (2.7.1)
+    language_server-protocol (3.17.0.3)
+    listen (3.9.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     loofah (2.22.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.7.1)
+    mail (2.8.1)
       mini_mime (>= 0.1.1)
-    marcel (1.0.2)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.0.4)
     matrix (0.4.2)
     method_source (1.0.0)
-    mini_magick (4.11.0)
+    mini_magick (4.12.0)
     mini_mime (1.1.5)
     mini_portile2 (2.8.5)
-    minitest (5.20.0)
+    minitest (5.22.3)
     mocha (2.1.0)
       ruby2_keywords (>= 0.0.5)
-    mysql2 (0.5.5)
-    net-imap (0.2.3)
-      digest
+    mysql2 (0.5.6)
+    net-imap (0.3.7)
+      date
       net-protocol
-      strscan
     net-ldap (0.17.1)
     net-pop (0.1.2)
       net-protocol
     net-protocol (0.2.2)
       timeout
-    net-smtp (0.3.3)
+    net-smtp (0.3.4)
       net-protocol
-    nio4r (2.6.1)
-    nokogiri (1.15.5)
+    nio4r (2.7.1)
+    nokogiri (1.15.6)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    parallel (1.23.0)
-    parser (3.2.2.4)
+    parallel (1.24.0)
+    parser (3.3.0.5)
       ast (~> 2.4.1)
       racc
-    pg (1.4.6)
+    pg (1.5.6)
     public_suffix (5.0.4)
-    puma (6.4.0)
+    puma (6.4.2)
       nio4r (~> 2.0)
     racc (1.7.3)
-    rack (2.2.8)
+    rack (2.2.9)
     rack-test (2.1.0)
       rack (>= 1.3)
-    rails (6.1.7.6)
-      actioncable (= 6.1.7.6)
-      actionmailbox (= 6.1.7.6)
-      actionmailer (= 6.1.7.6)
-      actionpack (= 6.1.7.6)
-      actiontext (= 6.1.7.6)
-      actionview (= 6.1.7.6)
-      activejob (= 6.1.7.6)
-      activemodel (= 6.1.7.6)
-      activerecord (= 6.1.7.6)
-      activestorage (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
+    rails (6.1.7.7)
+      actioncable (= 6.1.7.7)
+      actionmailbox (= 6.1.7.7)
+      actionmailer (= 6.1.7.7)
+      actionpack (= 6.1.7.7)
+      actiontext (= 6.1.7.7)
+      actionview (= 6.1.7.7)
+      activejob (= 6.1.7.7)
+      activemodel (= 6.1.7.7)
+      activerecord (= 6.1.7.7)
+      activestorage (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
       bundler (>= 1.15.0)
-      railties (= 6.1.7.6)
+      railties (= 6.1.7.7)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.2.0)
       activesupport (>= 5.0.0)
@@ -165,9 +169,9 @@ GEM
     rails-html-sanitizer (1.6.0)
       loofah (~> 2.21)
       nokogiri (~> 1.14)
-    railties (6.1.7.6)
-      actionpack (= 6.1.7.6)
-      activesupport (= 6.1.7.6)
+    railties (6.1.7.7)
+      actionpack (= 6.1.7.7)
+      activesupport (= 6.1.7.7)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
@@ -180,51 +184,56 @@ GEM
       htmlentities
       rbpdf-font (~> 1.19.0)
     rbpdf-font (1.19.1)
-    redcarpet (3.5.1)
-    regexp_parser (2.8.2)
+    redcarpet (3.6.0)
+    regexp_parser (2.9.0)
     request_store (1.5.1)
       rack (>= 1.4)
     rexml (3.2.6)
-    roadie (5.2.0)
+    roadie (5.2.1)
       css_parser (~> 1.4)
       nokogiri (~> 1.15)
-    roadie-rails (3.0.0)
-      railties (>= 5.1, < 7.1)
+    roadie-rails (3.1.0)
+      railties (>= 5.1, < 8.0)
       roadie (~> 5.0)
     rotp (6.3.0)
-    rouge (3.28.0)
+    rouge (4.2.1)
     rqrcode (2.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 1.0)
     rqrcode_core (1.2.0)
-    rubocop (1.26.1)
+    rubocop (1.57.2)
+      json (~> 2.3)
+      language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
-      parser (>= 3.1.0.0)
+      parser (>= 3.2.2.4)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
-      rexml
-      rubocop-ast (>= 1.16.0, < 2.0)
+      rexml (>= 3.2.5, < 4.0)
+      rubocop-ast (>= 1.28.1, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.30.0)
-      parser (>= 3.2.1.0)
-    rubocop-performance (1.13.3)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.31.2)
+      parser (>= 3.3.0.4)
+    rubocop-performance (1.19.1)
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
-    rubocop-rails (2.14.2)
+    rubocop-rails (2.22.2)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
-      rubocop (>= 1.7.0, < 2.0)
+      rubocop (>= 1.33.0, < 2.0)
+      rubocop-ast (>= 1.30.0, < 2.0)
     ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
     rubyzip (2.3.2)
     sanitize (6.1.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    selenium-webdriver (3.142.7)
-      childprocess (>= 0.5, < 4.0)
-      rubyzip (>= 1.2.2)
-    simplecov (0.21.2)
+    selenium-webdriver (4.18.1)
+      base64 (~> 0.2)
+      rexml (~> 3.2, >= 3.2.5)
+      rubyzip (>= 1.2.2, < 3.0)
+      websocket (~> 1.0)
+    simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
@@ -237,24 +246,25 @@ GEM
       actionpack (>= 5.2)
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
-    strscan (3.0.7)
-    thor (1.3.0)
+    sqlite3 (1.6.9)
+      mini_portile2 (~> 2.8.0)
+    thor (1.3.1)
     timeout (0.4.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.5.0)
-    webdrivers (4.6.1)
-      nokogiri (~> 1.6)
-      rubyzip (>= 1.3.0)
-      selenium-webdriver (>= 3.0, < 4.0)
     webrick (1.8.1)
+    websocket (1.2.10)
     websocket-driver (0.7.6)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
+    with_advisory_lock (5.1.0)
+      activerecord (>= 6.1)
+      zeitwerk (>= 2.6)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    yard (0.9.34)
-    zeitwerk (2.6.12)
+    yard (0.9.36)
+    zeitwerk (2.6.13)
 
 PLATFORMS
   ruby
@@ -262,52 +272,52 @@ PLATFORMS
 DEPENDENCIES
   actionpack-xml_parser
   addressable
-  bundler (>= 1.12.0)
-  capybara (~> 3.38.0)
+  capybara (>= 3.39)
   commonmarker (~> 0.23.8)
-  csv (~> 3.2.0)
+  csv (~> 3.2.6)
   deckar01-task_list (= 2.3.2)
   ffi
   html-pipeline (~> 2.13.2)
-  i18n (~> 1.10.0)
+  i18n (~> 1.14.1)
   listen (~> 3.3)
-  mail (~> 2.7.1)
+  mail (~> 2.8.1)
   marcel
-  mini_magick (~> 4.11.0)
+  mini_magick (~> 4.12.0)
   mini_mime (~> 1.1.0)
   mocha (>= 2.0.1)
   mysql2 (~> 0.5.0)
-  net-imap (~> 0.2.2)
+  net-imap (~> 0.3.4)
   net-ldap (~> 0.17.0)
-  net-pop (~> 0.1.1)
-  net-smtp (~> 0.3.0)
+  net-pop (~> 0.1.2)
+  net-smtp (~> 0.3.3)
   nokogiri (~> 1.15.2)
-  pg (~> 1.4.2)
+  pg (~> 1.5.3)
   puma
-  rails (= 6.1.7.6)
+  rails (= 6.1.7.7)
   rails-dom-testing
   rbpdf (~> 1.21.3)
-  redcarpet (~> 3.5.1)
+  redcarpet (~> 3.6.0)
   request_store (~> 1.5.0)
   rexml
-  roadie-rails (~> 3.0.0)
+  roadie-rails (~> 3.1.0)
   rotp (>= 5.0.0)
-  rouge (~> 3.28.0)
+  rouge (~> 4.2.0)
   rqrcode
-  rubocop (~> 1.26.0)
-  rubocop-performance (~> 1.13.0)
-  rubocop-rails (~> 2.14.0)
+  rubocop (~> 1.57.0)
+  rubocop-performance (~> 1.19.0)
+  rubocop-rails (~> 2.22.1)
   rubyzip (~> 2.3.0)
   sanitize (~> 6.0)
-  selenium-webdriver (~> 3.142.7)
-  simplecov (~> 0.21.2)
+  selenium-webdriver (>= 4.11.0)
+  simplecov (~> 0.22.0)
+  sqlite3 (~> 1.6.0)
   tzinfo-data
-  webdrivers (= 4.6.1)
   webrick
+  with_advisory_lock
   yard
 
 RUBY VERSION
    ruby 3.1.4p223
 
 BUNDLED WITH
-   2.4.12
+   2.4.22
diff --git a/pkgs/applications/version-management/redmine/gemset.nix b/pkgs/by-name/re/redmine/gemset.nix
similarity index 78%
rename from pkgs/applications/version-management/redmine/gemset.nix
rename to pkgs/by-name/re/redmine/gemset.nix
index bfd433274b05..10c5de5ed7e2 100644
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/by-name/re/redmine/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fdbks9byqqlkd6glj6lkz5f1z6948hh8fhv9x5pzqciralmz142";
+      sha256 = "1br4vjv1si1gvhh8p96r95crljqwbx3nlzbkkdqg21xq8f9106kl";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   actionmailbox = {
     dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rfya6qgsl14cm9l2w7h7lg4znsyg3gqiskhqr8wn76sh0x2hln0";
+      sha256 = "1i21621aiv233pa8fp1pvibwgbzzdddp0bx44qqn16yca6z35zrj";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jr9jpf542svzqz8x68s08jnf30shxrrh7rq1a0s7jia5a5zx3qd";
+      sha256 = "0irkj00z2mzsvbrpdl8sd08k04hz5lhvy8rfkzhx2sqq5x1n155a";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -38,10 +38,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vf6ncs647psa9p23d2108zgmlf0pr7gcjr080yg5yf68gyhs53k";
+      sha256 = "15jp9a1mgz8xjm618s8g69d70w19nn2svav4fhz3aarjwfbkvwj7";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   actionpack-xml_parser = {
     dependencies = ["actionpack" "railties"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i8s3v6m8q3y17c40l6d3k2vs1mdqr0y1lfm7i6dfbj2y673lk9r";
+      sha256 = "0hjm6vapqq1f7addwl71qwzn72lnmq686ypnbyhd873hqlnzangf";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1s4c1n5lv31sc7w4w74xz8gzyq3sann00bm4l7lxgy3vgi2wqkid";
+      sha256 = "1hkdqf299dx8bgvgpgknf37kcbprqgq0iy8xdipww6pmbbc45bwk";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1641003plszig5ybhrqy90fv43l1vcai5h35qmhh9j12byk5hp26";
+      sha256 = "06rp7kks22wrc55vric8yh0kg137jsiwd62jimdiqhh9bp48jbbm";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "148szdj5jlnfpv3nmy8cby8rxgpdvs43f3rzqby1f7a0l2knd3va";
+      sha256 = "0zz32997k2fsyd0fzrh8f79yjr6hv3i4j9wykkxncl02j8dhrkay";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport"];
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0n7hg582ajdncilfk1kkw8qfdchymp2gqgkad1znlhlmclihsafr";
+      sha256 = "0qzymgyrvw2k32ldabp2jr0zgp6z9w8smyb946qgvs9zfs4n2qnn";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   activestorage = {
     dependencies = ["actionpack" "activejob" "activerecord" "activesupport" "marcel" "mini_mime"];
@@ -115,10 +115,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16pylwnqsbvq2wxhl7k1rnravbr3dgpjmnj0psz5gijgkydd52yc";
+      sha256 = "12i033l3m41vr3qs7msy4p88a6pglx9vnsh5nakp0b6abf6mv5mk";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -126,10 +126,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nhrdih0rk46i0s6x7nqhbypmj1hf23zl5gfl9xasb6k4r2a1dxk";
+      sha256 = "0r2i9b0pm0b1dy8fc7kyls1g7f0bcnyq53v825rykibzdqfqdfgp";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -137,10 +137,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05r1fwy487klqkya7vzia8hnklcxy4vr92m9dmni3prfwk6zpw33";
+      sha256 = "0irbdwkkjwzajq1ip6ba46q49sxnrl2cw7ddkdhsfhb6aprnm3vr";
       type = "gem";
     };
-    version = "2.8.5";
+    version = "2.8.6";
   };
   ast = {
     groups = ["default" "test"];
@@ -152,6 +152,16 @@
     };
     version = "2.4.2";
   };
+  base64 = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
   builder = {
     groups = ["default"];
     platforms = [];
@@ -168,20 +178,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "123198zk2ak8mziwa5jc3ckgpmsg08zn064n3aywnqm9s1bwjv3v";
+      sha256 = "1vxfah83j6zpw3v5hic0j70h519nvmix2hbszmjwm8cfawhagns2";
       type = "gem";
     };
-    version = "3.38.0";
-  };
-  childprocess = {
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ic028k8xgm2dds9mqnvwwx3ibaz32j8455zxr9f4bcnviyahya5";
-      type = "gem";
-    };
-    version = "3.0.0";
+    version = "3.40.0";
   };
   chunky_png = {
     groups = ["default"];
@@ -208,13 +208,13 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
+      sha256 = "1qh1b14jwbbj242klkyz5fc7npd4j0mvndz62gajhvl1l3wd7zc2";
       type = "gem";
     };
-    version = "1.2.2";
+    version = "1.2.3";
   };
   crass = {
-    groups = ["common_mark" "default"];
+    groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
@@ -239,10 +239,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zmrgngggg4yvdbggdx9p3z4wcav4vxfigramxxvjh3hi7l12pig";
+      sha256 = "1fp986v5xfpzcj9v3dyvdd26fcnmbbzjwcp66pz34hv6g86z66a9";
       type = "gem";
     };
-    version = "3.2.8";
+    version = "3.2.9";
+  };
+  date = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "149jknsq999gnhy865n33fkk22s0r447k76x9pmcnnwldfv2q7wp";
+      type = "gem";
+    };
+    version = "3.3.4";
   };
   deckar01-task_list = {
     dependencies = ["html-pipeline"];
@@ -255,16 +265,6 @@
     };
     version = "2.3.2";
   };
-  digest = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "01qkpbkxq83ip3iysfh2kjrg9sh2n2q91prhyxh3vq10lcfzv9l1";
-      type = "gem";
-    };
-    version = "3.1.1";
-  };
   docile = {
     groups = ["default" "test"];
     platforms = [];
@@ -318,7 +318,7 @@
   };
   html-pipeline = {
     dependencies = ["activesupport" "nokogiri"];
-    groups = ["common_mark"];
+    groups = ["common_mark" "default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
@@ -343,10 +343,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b2qyvnk4yynlg17ymkq4g5xgr275637fhl1mjh0valw3cb1fhhg";
+      sha256 = "0lbm33fpb3w06wd2231sg58dwlwgjsvym93m548ajvl6s3mfvpn7";
       type = "gem";
     };
-    version = "1.10.0";
+    version = "1.14.4";
+  };
+  json = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0r9jmjhg2ly3l736flk7r2al47b5c8cayh0gqkq0yhjqzc9a6zhq";
+      type = "gem";
+    };
+    version = "2.7.1";
+  };
+  language_server-protocol = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gvb1j8xsqxms9mww01rmdl78zkd72zgxaap56bhv8j45z05hp1x";
+      type = "gem";
+    };
+    version = "3.17.0.3";
   };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify"];
@@ -354,10 +374,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13rgkfar8pp31z1aamxf5y7cfq88wv6rxxcwy7cmm177qq508ycn";
+      sha256 = "0rwwsmvq79qwzl6324yc53py02kbrcww35si720490z5w0j497nv";
       type = "gem";
     };
-    version = "3.8.0";
+    version = "3.9.0";
   };
   loofah = {
     dependencies = ["crass" "nokogiri"];
@@ -371,25 +391,25 @@
     version = "2.22.0";
   };
   mail = {
-    dependencies = ["mini_mime"];
+    dependencies = ["mini_mime" "net-imap" "net-pop" "net-smtp"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00wwz6ys0502dpk8xprwcqfwyf3hmnx6lgxaiq6vj43mkx43sapc";
+      sha256 = "1bf9pysw1jfgynv692hhaycfxa8ckay1gjw5hz3madrbrynryfzc";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.8.1";
   };
   marcel = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kky3yiwagsk8gfbzn3mvl2fxlh3b39v6nawzm4wpjs6xxvvc4x0";
+      sha256 = "190n2mk8m1l708kr88fh6mip9sdsh339d2s6sgrik3sbnvz4jmhd";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.0.4";
   };
   matrix = {
     groups = ["default" "test"];
@@ -416,10 +436,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1aj604x11d9pksbljh0l38f70b558rhdgji1s9i763hiagvvx2hs";
+      sha256 = "0slh78f9z6n0l1i2km7m48yz7l4fjrk88sj1f4mh1wb39sl2yc37";
       type = "gem";
     };
-    version = "4.11.0";
+    version = "4.12.0";
   };
   mini_mime = {
     groups = ["default" "test"];
@@ -433,7 +453,15 @@
   };
   mini_portile2 = {
     groups = ["common_mark" "default" "test"];
-    platforms = [];
+    platforms = [{
+      engine = "maglev";
+    } {
+      engine = "mingw";
+    } {
+      engine = "mingw";
+    } {
+      engine = "ruby";
+    }];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1kl9c3kdchjabrihdqfmcplk3lq4cw1rr9f378y6q22qwy5dndvs";
@@ -446,10 +474,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bkmfi9mb49m0fkdhl2g38i3xxa02d411gg0m8x0gvbwfmmg5ym3";
+      sha256 = "07lq26b86giy3ha3fhrywk9r1ajhc2pm2mzj657jnpnbj1i6g17a";
       type = "gem";
     };
-    version = "5.20.0";
+    version = "5.22.3";
   };
   mocha = {
     dependencies = ["ruby2_keywords"];
@@ -475,21 +503,21 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gjvj215qdhwk3292sc7xsn6fmwnnaq2xs35hh5hc8d8j22izlbn";
+      sha256 = "0cysv1wdfdbizwkd0d9s16s832khdwv31pgp01mw2g3bbpa4gx3h";
       type = "gem";
     };
-    version = "0.5.5";
+    version = "0.5.6";
   };
   net-imap = {
-    dependencies = ["digest" "net-protocol" "strscan"];
+    dependencies = ["date" "net-protocol"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rl79ykmxa2k4dlk6ykrb9l0a4h101q1gd8c4qv3cl0p9h68zmbn";
+      sha256 = "0lf7wqg7czhaj51qsnmn28j7jmcxhkh3m28rl1cjrqsgjxhwj7r3";
       type = "gem";
     };
-    version = "0.2.3";
+    version = "0.3.7";
   };
   net-ldap = {
     groups = ["ldap"];
@@ -529,20 +557,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1c6md06hm5bf6rv53sk54dl2vg038pg8kglwv3rayx0vk2mdql9x";
+      sha256 = "0hwiqplhi29kfjl8jm0rhl51qv6wmxfynl4qap1dhv9xdwc4bm1x";
       type = "gem";
     };
-    version = "0.3.3";
+    version = "0.3.4";
   };
   nio4r = {
     groups = ["default" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y99dfzlb3kgzh7pfk8km0p5zjiblxyh5rm8yal9h523vi5awji8";
+      sha256 = "15iwbiij52x6jhdbl0rkcldnhfndmsy0sbnsygkr9vhskfqrp72m";
       type = "gem";
     };
-    version = "2.6.1";
+    version = "2.7.1";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -550,20 +578,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "004ip9x9281fxhpipwi8di1sb1dnabscq9dy1p3cxgdwbniqqi12";
+      sha256 = "023f2j0q8makgmmfj4pv2fhwgcbh9y8s678za1cb68ry9fdpkkkh";
       type = "gem";
     };
-    version = "1.15.5";
+    version = "1.15.6";
   };
   parallel = {
     groups = ["default" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jcc512l38c0c163ni3jgskvq1vc3mr8ly5pvjijzwvfml9lf597";
+      sha256 = "15wkxrg1sj3n1h2g8jcrn7gcapwcgxr659ypjf75z1ipkgxqxwsv";
       type = "gem";
     };
-    version = "1.23.0";
+    version = "1.24.0";
   };
   parser = {
     dependencies = ["ast" "racc"];
@@ -571,10 +599,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r69dbh6h6j4d54isany2ir4ni4gf2ysvk3k44awi6amz18nggpd";
+      sha256 = "11r6kp8wam0nkfvnwyc1fmvky102r1vcfr84vi2p1a2wa0z32j3p";
       type = "gem";
     };
-    version = "3.2.2.4";
+    version = "3.3.0.5";
   };
   pg = {
     groups = ["default"];
@@ -589,10 +617,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07m6lxljabw9kyww5k5lgsxsznsm1v5l14r1la09gqka9b5kv3yr";
+      sha256 = "071b55bhsz7mivlnp2kv0a11msnl7xg5awvk8mlflpl270javhsb";
       type = "gem";
     };
-    version = "1.4.6";
+    version = "1.5.6";
   };
   public_suffix = {
     groups = ["default" "test"];
@@ -610,10 +638,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y8jcw80zcxvdq0id329lzmp5pzx7hpac227d7sgjkblc89s3pfm";
+      sha256 = "0i2vaww6qcazj0ywva1plmjnj6rk23b01szswc5jhcq7s2cikd1y";
       type = "gem";
     };
-    version = "6.4.0";
+    version = "6.4.2";
   };
   racc = {
     groups = ["common_mark" "default" "test"];
@@ -630,10 +658,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15rdwbyk71c9nxvd527bvb8jxkcys8r3dj3vqra5b3sa63qs30vv";
+      sha256 = "0hj0rkw2z9r1lcg2wlrcld2n3phwrcgqcp7qd1g9a7hwgalh2qzx";
       type = "gem";
     };
-    version = "2.2.8";
+    version = "2.2.9";
   };
   rack-test = {
     dependencies = ["rack"];
@@ -652,10 +680,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0gf5dqabzd0mf0q39a07kf0smdm2cv2z5swl3zr4cz50yb85zz3l";
+      sha256 = "0jqp5fggkxbjm4rhsywa7j5rvwkzp6gbaa1mg4k8zxrbfczhxwwl";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   rails-dom-testing = {
     dependencies = ["activesupport" "minitest" "nokogiri"];
@@ -685,10 +713,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vq4ahyg9hraixxmmwwypdnpcylpvznvdxhj4xa23xk45wzbl3h7";
+      sha256 = "07qxgrd92yq0cckrmzx54glvjdd1xx87xysgvaqd75hn50klp8ip";
       type = "gem";
     };
-    version = "6.1.7.6";
+    version = "6.1.7.7";
   };
   rainbow = {
     groups = ["default" "test"];
@@ -753,24 +781,24 @@
     version = "1.19.1";
   };
   redcarpet = {
-    groups = ["common_mark" "markdown"];
+    groups = ["markdown"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bvk8yyns5s1ls437z719y5sdv9fr8kfs8dmr6g8s761dv5n8zvi";
+      sha256 = "1sg9sbf9pm91l7lac7fs4silabyn0vflxwaa2x3lrzsm0ff8ilca";
       type = "gem";
     };
-    version = "3.5.1";
+    version = "3.6.0";
   };
   regexp_parser = {
     groups = ["default" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d9a5s3qrjdy50ll2s32gg3qmf10ryp3v2nr5k718kvfadp50ray";
+      sha256 = "1ndxm0xnv27p4gv6xynk6q41irckj76q1jsqpysd9h6f86hhp841";
       type = "gem";
     };
-    version = "2.8.2";
+    version = "2.9.0";
   };
   request_store = {
     dependencies = ["rack"];
@@ -799,10 +827,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qs594ybaz0lh2sakh95syzvhva4jms8xyiwhgjfncf3ri0qxp7l";
+      sha256 = "1mh1a0m0i0xrm20nry4d3gf0q5kbmm5lp15n52r93gcjwwfgd974";
       type = "gem";
     };
-    version = "5.2.0";
+    version = "5.2.1";
   };
   roadie-rails = {
     dependencies = ["railties" "roadie"];
@@ -810,10 +838,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16j1cjhq8xqr77vyf7m7ip2132619wdnpvlbig4cnn96yyi0cnan";
+      sha256 = "08fycjfbg9rqksk3bch8qv76g7acd1jbxy2y68lsqz1gxfky2ias";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "3.1.0";
   };
   rotp = {
     groups = ["default"];
@@ -830,10 +858,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "080fswzii68wnbsg7pgq55ba7p289sqjlxwp4vch0h32qy1f8v8d";
+      sha256 = "1zd1pdldi6h8x27dqim7cy8m69xr01aw5c8k1zhkz497n4np6wgk";
       type = "gem";
     };
-    version = "3.28.0";
+    version = "4.2.1";
   };
   rqrcode = {
     dependencies = ["chunky_png" "rqrcode_core"];
@@ -857,15 +885,15 @@
     version = "1.2.0";
   };
   rubocop = {
-    dependencies = ["parallel" "parser" "rainbow" "regexp_parser" "rexml" "rubocop-ast" "ruby-progressbar" "unicode-display_width"];
+    dependencies = ["json" "language_server-protocol" "parallel" "parser" "rainbow" "regexp_parser" "rexml" "rubocop-ast" "ruby-progressbar" "unicode-display_width"];
     groups = ["test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06105yrqajpm5l07fng1nbk55y9490hny542zclnan8hg841pjgl";
+      sha256 = "06qnp5zs233j4f59yyqrg8al6hr9n4a7vcdg3p31v0np8bz9srwg";
       type = "gem";
     };
-    version = "1.26.1";
+    version = "1.57.2";
   };
   rubocop-ast = {
     dependencies = ["parser"];
@@ -873,10 +901,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cs9cc5p9q70valk4na3lki4xs88b52486p2v46yx3q1n5969bgs";
+      sha256 = "1v3q8n48w8h809rqbgzihkikr4g3xk72m1na7s97jdsmjjq6y83w";
       type = "gem";
     };
-    version = "1.30.0";
+    version = "1.31.2";
   };
   rubocop-performance = {
     dependencies = ["rubocop" "rubocop-ast"];
@@ -884,21 +912,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17ny81dy5gjrvris8mni7la8yjg57snphyg9nmvnc3al7yhwr74x";
+      sha256 = "1pzsrnjmrachdjxzl9jpw47cydicn3408vgdg3a4bss4v5r42rjj";
       type = "gem";
     };
-    version = "1.13.3";
+    version = "1.19.1";
   };
   rubocop-rails = {
-    dependencies = ["activesupport" "rack" "rubocop"];
+    dependencies = ["activesupport" "rack" "rubocop" "rubocop-ast"];
     groups = ["test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "14xagb3jbms5mlcf932kx1djn2q4k952d4xia75ll36vh7xf2fpp";
+      sha256 = "0ym0h2w97b8c2h6zl44m22lzg253qkmim0ali32aiy58ddvbj0mm";
       type = "gem";
     };
-    version = "2.14.2";
+    version = "2.22.2";
   };
   ruby-progressbar = {
     groups = ["default" "test"];
@@ -932,7 +960,7 @@
   };
   sanitize = {
     dependencies = ["crass" "nokogiri"];
-    groups = ["common_mark"];
+    groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
@@ -942,15 +970,15 @@
     version = "6.1.0";
   };
   selenium-webdriver = {
-    dependencies = ["childprocess" "rubyzip"];
+    dependencies = ["base64" "rexml" "rubyzip" "websocket"];
     groups = ["test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0adcvp86dinaqq3nhf8p3m0rl2g6q0a4h52k0i7kdnsg1qz9k86y";
+      sha256 = "1asysih4l1mv24wqxrbnz0c0454kw3dhqaj6nsa8pyn9fjjdms5b";
       type = "gem";
     };
-    version = "3.142.7";
+    version = "4.18.1";
   };
   simplecov = {
     dependencies = ["docile" "simplecov-html" "simplecov_json_formatter"];
@@ -958,10 +986,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hrv046jll6ad1s964gsmcq4hvkr3zzr6jc7z1mns22mvfpbc3cr";
+      sha256 = "198kcbrjxhhzca19yrdcd6jjj9sb51aaic3b0sc3pwjghg3j49py";
       type = "gem";
     };
-    version = "0.21.2";
+    version = "0.22.0";
   };
   simplecov-html = {
     groups = ["default" "test"];
@@ -1005,25 +1033,34 @@
     };
     version = "3.4.2";
   };
-  strscan = {
+  sqlite3 = {
+    dependencies = ["mini_portile2"];
     groups = ["default"];
-    platforms = [];
+    platforms = [{
+      engine = "maglev";
+    } {
+      engine = "mingw";
+    } {
+      engine = "mingw";
+    } {
+      engine = "ruby";
+    }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0w2lc1mqia13x43ajzhih419r40ppddg936ydhawz57f63ab6fll";
+      sha256 = "08irz5llz31im8pmkk5k0kw433jyyji1qa98xkdmpphncdjr38am";
       type = "gem";
     };
-    version = "3.0.7";
+    version = "1.6.9";
   };
   thor = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hx77jxkrwi66yvs10wfxqa8s25ds25ywgrrf66acm9nbfg7zp0s";
+      sha256 = "1vq1fjp45az9hfp6fxljhdrkv75cvbab1jfrwcw738pnsiqk8zps";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.3.1";
   };
   timeout = {
     groups = ["default"];
@@ -1056,17 +1093,6 @@
     };
     version = "2.5.0";
   };
-  webdrivers = {
-    dependencies = ["nokogiri" "rubyzip" "selenium-webdriver"];
-    groups = ["test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1naymcfmm9pkf0f67xd99d9f6dpv477ggyvc1c04gxifirynfydp";
-      type = "gem";
-    };
-    version = "4.6.1";
-  };
   webrick = {
     groups = ["default"];
     platforms = [];
@@ -1077,6 +1103,16 @@
     };
     version = "1.8.1";
   };
+  websocket = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1a4zc8d0d91c3xqwapda3j3zgpfwdbj76hkb69xn6qvfkfks9h9c";
+      type = "gem";
+    };
+    version = "1.2.10";
+  };
   websocket-driver = {
     dependencies = ["websocket-extensions"];
     groups = ["default"];
@@ -1098,6 +1134,17 @@
     };
     version = "0.1.5";
   };
+  with_advisory_lock = {
+    dependencies = ["activerecord" "zeitwerk"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1mzy29advrdczf88j2ffvck4kf8sfhxn07sym9ciq9rv061cv4h6";
+      type = "gem";
+    };
+    version = "5.1.0";
+  };
   xpath = {
     dependencies = ["nokogiri"];
     groups = ["default" "test"];
@@ -1114,19 +1161,19 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "013yrnwx1zhzhn1fnc19zck22a1qgimsaglp2iwgf5bz9l8h93js";
+      sha256 = "1r0b8w58p7gy06wph1qdjv2p087hfnmhd9jk23vjdj803dn761am";
       type = "gem";
     };
-    version = "0.9.34";
+    version = "0.9.36";
   };
   zeitwerk = {
     groups = ["common_mark" "default" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gir0if4nryl1jhwi28669gjwhxb7gzrm1fcc8xzsch3bnbi47jn";
+      sha256 = "1m67qmsak3x8ixs8rb971azl3l7wapri65pmbf5z886h46q63f1d";
       type = "gem";
     };
-    version = "2.6.12";
+    version = "2.6.13";
   };
 }
diff --git a/pkgs/applications/version-management/redmine/default.nix b/pkgs/by-name/re/redmine/package.nix
similarity index 89%
rename from pkgs/applications/version-management/redmine/default.nix
rename to pkgs/by-name/re/redmine/package.nix
index 1235df9f6720..9329c0a111e6 100644
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/by-name/re/redmine/package.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchurl, bundlerEnv, ruby, defaultGemConfig, makeWrapper, nixosTests }:
+{ lib, stdenv, fetchurl, bundlerEnv, ruby, makeWrapper, nixosTests }:
 
 let
-  version = "5.0.6";
+  version = "5.1.2";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
@@ -16,7 +16,7 @@ in
 
     src = fetchurl {
       url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
-      hash = "sha256-SI/gjzeo6xARQVkiqOp0O3842Kel+IIpUKNKN13PCO4=";
+      hash = "sha256-JsDKCpqu4c65g4Jb8SZsmbCFC/ATwXhxP1o7AIABISM=";
     };
 
     nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/version-management/redmine/update.sh b/pkgs/by-name/re/redmine/update.sh
similarity index 100%
rename from pkgs/applications/version-management/redmine/update.sh
rename to pkgs/by-name/re/redmine/update.sh
diff --git a/pkgs/by-name/st/stats/package.nix b/pkgs/by-name/st/stats/package.nix
index 76bc6b84735b..5cc91cde455d 100644
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.10.5";
+  version = "2.10.6";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-IBliS0RSWlCSLYeSHTapW9B2mPJtZqL7k8jskpXy1F4=";
+    hash = "sha256-5FjxEBZ+HbiWVR/8DBfVPeWACRwrw+Kcn1jld/CR+Ck=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/ux/uxn/package.nix b/pkgs/by-name/ux/uxn/package.nix
index 2ce14ff19f80..36986fd17272 100644
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "unstable-2024-03-18";
+  version = "unstable-2024-03-30";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "250aecc920a6f12d2d5479a5230a31630dac2a1e";
-    hash = "sha256-nhKlcuhXkrhecRwVIuSf+jOmFbX0NMhmmc5pj6MCNdQ=";
+    rev = "fc6ec0b387723940868133fade8854ad37648881";
+    hash = "sha256-Ver8oI3IzxwF6KeZ85d3mmiCwARVoH+RZoFNCxhGFDc=";
   };
 
   outputs = [ "out" "projects" ];
diff --git a/pkgs/data/misc/sing-geosite/default.nix b/pkgs/data/misc/sing-geosite/default.nix
index ac521f3ec280..8540eb534001 100644
--- a/pkgs/data/misc/sing-geosite/default.nix
+++ b/pkgs/data/misc/sing-geosite/default.nix
@@ -38,6 +38,7 @@ buildGoModule {
   installPhase = ''
     runHook preInstall
     install -Dm644 geosite.db $out/share/sing-box/geosite.db
+    install -Dm644 rule-set/* -t $out/share/sing-box/rule-set
     runHook postInstall
   '';
 
diff --git a/pkgs/data/misc/sing-geosite/main.go b/pkgs/data/misc/sing-geosite/main.go
index d059d99ffe1e..e6ca57275adb 100644
--- a/pkgs/data/misc/sing-geosite/main.go
+++ b/pkgs/data/misc/sing-geosite/main.go
@@ -16,4 +16,37 @@ func main() {
 	if err != nil {
 		panic(err)
 	}
+
+	ruleSetOutput := "rule-set"
+	err = os.MkdirAll(ruleSetOutput, 0o755)
+	if err != nil {
+		panic(err)
+	}
+	for code, domains := range domainMap {
+		var headlessRule option.DefaultHeadlessRule
+		defaultRule := geosite.Compile(domains)
+		headlessRule.Domain = defaultRule.Domain
+		headlessRule.DomainSuffix = defaultRule.DomainSuffix
+		headlessRule.DomainKeyword = defaultRule.DomainKeyword
+		headlessRule.DomainRegex = defaultRule.DomainRegex
+		var plainRuleSet option.PlainRuleSet
+		plainRuleSet.Rules = []option.HeadlessRule{
+			{
+				Type:           C.RuleTypeDefault,
+				DefaultOptions: headlessRule,
+			},
+		}
+		srsPath, _ := filepath.Abs(filepath.Join(ruleSetOutput, "geosite-"+code+".srs"))
+		os.Stderr.WriteString("write " + srsPath + "\n")
+		outputRuleSet, err := os.Create(srsPath)
+		if err != nil {
+			panic(err)
+		}
+		err = srs.Write(outputRuleSet, plainRuleSet)
+		if err != nil {
+			outputRuleSet.Close()
+			panic(err)
+		}
+		outputRuleSet.Close()
+	}
 }
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 351c1c22207c..100599b34c3c 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2023-10-20";
+  version = "2024-04-01";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    hash = "sha256-GhSzTtbuvbAuXxKNm29sJX5kXE2s2jMDB6Ww6Q7GNSo=";
+    hash = "sha256-gszyUZGWlgrBTQnaz6Ws7jzfTN5KAfX5SjVwmVrP9QE=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/development/compilers/dotnet/combine-deps.nix b/pkgs/development/compilers/dotnet/combine-deps.nix
index a7c4356b34b0..90db947667a8 100644
--- a/pkgs/development/compilers/dotnet/combine-deps.nix
+++ b/pkgs/development/compilers/dotnet/combine-deps.nix
@@ -4,11 +4,22 @@
   otherRids,
   pkgs ? import ../../../.. {}
 }:
-with pkgs.lib;
 let
   inherit (pkgs) writeText;
 
+  inherit (pkgs.lib)
+    concatMap
+    concatMapStringsSep
+    generators
+    optionals
+    replaceStrings
+    sortOn
+    strings
+    unique
+    ;
+
   fns = map (file: import file) list;
+
   packages = unique
     (concatMap (fn: fn { fetchNuGet = package: package; }) fns);
 
diff --git a/pkgs/development/compilers/gerbil/gerbil-support.nix b/pkgs/development/compilers/gerbil/gerbil-support.nix
index 230126ade007..e395d8ca1dec 100644
--- a/pkgs/development/compilers/gerbil/gerbil-support.nix
+++ b/pkgs/development/compilers/gerbil/gerbil-support.nix
@@ -1,11 +1,52 @@
 { pkgs, lib, callPackage, ... }:
 
-with pkgs.gerbil-support; {
+let
+  inherit (builtins) filterSource;
 
-  pppToName = ppp: lib.removeSuffix ".nix" (baseNameOf ppp); # from pre-package path to name
+  inherit (lib)
+    commitIdFromGitRepo
+    concatStringsSep
+    elem
+    elemAt
+    hasSuffix
+    listToAttrs
+    mapAttrs
+    optionalString
+    pathExists
+    readFile
+    removeSuffix
+    substring
+    traceSeqN
+    ;
+
+  inherit (lib.strings) match;
+
+  # Implicitly calls through to this file, similar to `let .. in` or `rec`.
+  inherit (pkgs.gerbil-support)
+    callPpp
+    gerbilLoadPath
+    gerbilPackage
+    gerbilPackages-unstable
+    gerbilSkippableFiles
+    gerbilSourceFilter
+    overrideSrcIfShaDiff
+    ppaToPl
+    pppToKV
+    pppToName
+    ppplToPpa
+    prePackage-defaults
+    prePackages-unstable
+    resolve-pre-src
+    sha256-of-pre-src
+    view
+    ;
+in
+
+{
+  pppToName = ppp: removeSuffix ".nix" (baseNameOf ppp); # from pre-package path to name
   callPpp = ppp: callPackage ppp prePackage-defaults; # from pre-package path to pre-package
   pppToKV = ppp: { name = pppToName ppp; value = callPpp ppp; }; # from pre-package path to name
-  ppplToPpa = ppps: builtins.listToAttrs (map pppToKV ppps); # from pre-package path list to name/pre-package attr
+  ppplToPpa = ppps: listToAttrs (map pppToKV ppps); # from pre-package path list to name/pre-package attr
 
   prePackages-unstable =
     ppplToPpa
@@ -32,37 +73,37 @@ with pkgs.gerbil-support; {
     softwareName = "";
   };
 
-  ppaToPl = builtins.mapAttrs (_: gerbilPackage);
+  ppaToPl = mapAttrs (_: gerbilPackage);
   gerbilPackages-unstable = ppaToPl prePackages-unstable;
 
   resolve-pre-src = pre-src: pre-src.fun (removeAttrs pre-src ["fun"]);
 
   gerbilVersionFromGit = srcDir: version-path:
     let version-file = "${srcDir}/${version-path}.ss"; in
-    if builtins.pathExists version-file then
+    if pathExists version-file then
       let m =
-        builtins.match "\\(import :clan/versioning.*\\)\n\\(register-software \"([-_.A-Za-z0-9]+)\" \"([-_.A-Za-z0-9]+)\"\\) ;; ([-0-9]+)\n"
-          (builtins.readFile version-file); in
-          { version = "${builtins.elemAt m 2}-git"; git-version = builtins.elemAt m 1; }
+        match "\\(import :clan/versioning.*\\)\n\\(register-software \"([-_.A-Za-z0-9]+)\" \"([-_.A-Za-z0-9]+)\"\\) ;; ([-0-9]+)\n"
+          (readFile version-file); in
+          { version = "${elemAt m 2}-git"; git-version = elemAt m 1; }
      else { version = "0.0-git";
             git-version = let gitpath = "${srcDir}/.git"; in
-              if builtins.pathExists gitpath then lib.commitIdFromGitRepo gitpath else "0"; };
+              if pathExists gitpath then commitIdFromGitRepo gitpath else "0"; };
 
   gerbilSkippableFiles = [".git" ".build" ".build_outputs" "run" "result" "dep" "BLAH" "tmp.nix"];
 
   gerbilSourceFilter = path: type:
     let baseName = baseNameOf path; in
-      ! (builtins.elem baseName gerbilSkippableFiles || lib.hasSuffix "~" baseName);
+      ! (elem baseName gerbilSkippableFiles || hasSuffix "~" baseName);
 
-  gerbilFilterSource = builtins.filterSource gerbilSourceFilter;
+  gerbilFilterSource = filterSource gerbilSourceFilter;
 
   # Use this function in any package that uses Gerbil libraries, to define the GERBIL_LOADPATH.
   gerbilLoadPath =
-    gerbilInputs: builtins.concatStringsSep ":" (map (x: x + "/gerbil/lib") gerbilInputs);
+    gerbilInputs: concatStringsSep ":" (map (x: x + "/gerbil/lib") gerbilInputs);
 
   path-src = path: { fun = _: path; };
 
-  view = lib.debug.traceSeqN 4;
+  view = traceSeqN 4;
 
   sha256-of-pre-src = pre-src: if pre-src ? sha256 then pre-src.sha256 else "none";
 
@@ -75,7 +116,7 @@ with pkgs.gerbil-support; {
                        pre-src = new-pre-src;
                        version = "override";
                        git-version = if new-pre-src ? rev
-                                     then lib.substring 0 7 new-pre-src.rev
+                                     then substring 0 7 new-pre-src.rev
                                      else "unknown";};
                      };
 
@@ -102,10 +143,10 @@ with pkgs.gerbil-support; {
 
       postPatch = ''
         set -e ;
-        ${lib.optionalString (version-path != "")
-          ''echo -e '(import :clan/versioning${builtins.concatStringsSep ""
+        ${optionalString (version-path != "")
+          ''echo -e '(import :clan/versioning${concatStringsSep ""
                      (map (x: let px = x.passthru.pre-pkg; in
-                              lib.optionalString (px.version-path != "")
+                              optionalString (px.version-path != "")
                                 " :${px.gerbil-package}/${px.version-path}")
                           gerbilInputs)
                      })\n(register-software "${softwareName}" "v${git-version}")\n' > "${version-path}.ss"''}
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 1e3e04d72f4e..f22a455e4503 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -19,11 +19,6 @@
 
 let
   versionMap = {
-    # Only kept around for BCLM. Remove once unneeded there.
-    "2.1.9" = {
-      sha256 = "189gjqzdz10xh3ybiy4ch1r98bsmkcb4hpnrmggd4y2g5kqnyx4y";
-    };
-
     "2.4.2" = {
       sha256 = "sha256-/APLUtEqr+h1nmMoRQogG73fibFwcaToPznoC0Pd7w8=";
     };
@@ -103,11 +98,6 @@ stdenv.mkDerivation (self: rec {
     [ zstd ]
   );
 
-  patches = lib.optionals (lib.versionOlder self.version "2.4.2") [
-    # Fixed in 2.4.2
-    ./search-for-binaries-in-PATH.patch
-  ];
-
   # I don’t know why these are failing (on ofBorg), and I’d rather just disable
   # them and move forward with the succeeding tests than block testing
   # altogether. One by one hopefully we can fix these (on ofBorg,
diff --git a/pkgs/development/compilers/sbcl/search-for-binaries-in-PATH.patch b/pkgs/development/compilers/sbcl/search-for-binaries-in-PATH.patch
deleted file mode 100644
index 95263ec85753..000000000000
--- a/pkgs/development/compilers/sbcl/search-for-binaries-in-PATH.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From 35856b09e3606361b17f21225c759632be1cdf34 Mon Sep 17 00:00:00 2001
-From: Hraban Luyat <hraban@0brg.net>
-Date: Wed, 24 Jan 2024 14:58:53 -0500
-Subject: [PATCH] Search for binaries in tests in PATH, not /usr/bin
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Same as 8ed662fbfeb5dde35eb265f390b55b01f79f70c1 but for tests, and for more
-than just ‘cat’. For the same reasons as that diff.
----
- tests/run-program.impure.lisp | 18 ++++++++++--------
- tests/run-program.test.sh     |  9 ++++-----
- 2 files changed, 14 insertions(+), 13 deletions(-)
-
-diff --git a/tests/run-program.impure.lisp b/tests/run-program.impure.lisp
-index 0eab8884c..b07d1e4fb 100644
---- a/tests/run-program.impure.lisp
-+++ b/tests/run-program.impure.lisp
-@@ -15,7 +15,7 @@
- 
- (defun bin-pwd-ignoring-result ()
-   (let ((initially-open-fds (directory "/proc/self/fd/*" :resolve-symlinks nil)))
--    (sb-ext:run-program "/usr/bin/pwd" nil :input :stream :output :stream :wait nil)
-+    (sb-ext:run-program "pwd" nil :search t :input :stream :output :stream :wait nil)
-     (length initially-open-fds)))
- 
- (with-test (:name (run-program :autoclose-streams)
-@@ -49,7 +49,7 @@
- (with-test (:name (run-program :cat 2)
-                   :skipped-on (or (not :sb-thread) :win32))
-   ;; Tests that reading from a FIFO is interruptible.
--  (let* ((process (run-program "/bin/cat" '()
-+  (let* ((process (run-program "cat" '() :search t
-                                :wait nil :output :stream :input :stream))
-          (in (process-input process))
-          (out (process-output process))
-@@ -167,7 +167,7 @@
-   (defparameter *cat-out* (make-synonym-stream '*cat-out-pipe*)))
- 
- (with-test (:name (run-program :cat 5) :fails-on :win32)
--  (let ((cat (run-program "/bin/cat" nil :input *cat-in* :output *cat-out*
-+  (let ((cat (run-program "cat" nil :search t :input *cat-in* :output *cat-out*
-                           :wait nil)))
-     (dolist (test '("This is a test!"
-                     "This is another test!"
-@@ -310,14 +310,16 @@
-   (let ((had-error-p nil))
-     (flet ((barf (&optional (format :default))
-              (with-output-to-string (stream)
--               (run-program #-netbsd "/usr/bin/perl" #+netbsd "/usr/pkg/bin/perl"
-+               (run-program #-netbsd "perl" #+netbsd "/usr/pkg/bin/perl"
-                             '("-e" "print \"\\x20\\xfe\\xff\\x0a\"")
-+                            :search #-netbsd t #+netbsd nil
-                             :output stream
-                             :external-format format)))
-            (no-barf ()
-              (with-output-to-string (stream)
--               (run-program "/bin/echo"
-+               (run-program "echo"
-                             '("This is a test")
-+                            :search t
-                             :output stream))))
-       (handler-case
-           (barf :utf-8)
-@@ -353,9 +355,9 @@
-                ;; If the permitted inputs are :ANY then leave it be
-                (listp (symbol-value 'run-tests::*allowed-inputs*)))
-       (push (namestring file) (symbol-value 'run-tests::*allowed-inputs*)))
--    (assert (null (run-program "/bin/cat" '() :input file)))
--    (assert (null (run-program "/bin/cat" '() :output #.(or *compile-file-truename*
--                                                            *load-truename*)
-+    (assert (null (run-program "cat" '() :search t :input file)))
-+    (assert (null (run-program "cat" '() :search t :output #.(or *compile-file-truename*
-+                                                                 *load-truename*)
-                                       :if-output-exists nil)))))
- 
- 
-diff --git a/tests/run-program.test.sh b/tests/run-program.test.sh
-index 48eaef889..c926e5a05 100755
---- a/tests/run-program.test.sh
-+++ b/tests/run-program.test.sh
-@@ -39,9 +39,8 @@ run_sbcl --eval "(defvar *exit-ok* $EXIT_LISP_WIN)" <<'EOF'
-   (assert (not (zerop (sb-ext:process-exit-code
-                        (sb-ext:run-program "false" () :search t :wait t)))))
-   (let ((string (with-output-to-string (stream)
--                  (our-run-program    "/bin/echo"
--                                      '("foo" "bar")
--                                      :output stream))))
-+                  (run-program  "echo" '("foo" "bar")
-+                                :search t :output stream))))
-     (assert (string= string "foo bar
- ")))
-   (format t ";;; Smoke tests: PASS~%")
-@@ -103,8 +102,8 @@ run_sbcl --eval "(defvar *exit-ok* $EXIT_LISP_WIN)" <<'EOF'
-   ;; make sure that a stream input argument is basically reasonable.
-   (let ((string (let ((i (make-string-input-stream "abcdef")))
-                   (with-output-to-string (stream)
--                    (our-run-program "/bin/cat" ()
--                                        :input i :output stream)))))
-+                    (run-program "cat" ()
-+                                 :search t :input i :output stream)))))
-     (assert (= (length string) 6))
-     (assert (string= string "abcdef")))
- 
--- 
-2.43.0
-
diff --git a/pkgs/development/libraries/ode/default.nix b/pkgs/development/libraries/ode/default.nix
index be67a95ebfc5..8b426654147f 100644
--- a/pkgs/development/libraries/ode/default.nix
+++ b/pkgs/development/libraries/ode/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ode";
-  version = "0.16.4";
+  version = "0.16.5";
 
   src = fetchurl {
     url = "https://bitbucket.org/odedevs/ode/downloads/ode-${finalAttrs.version}.tar.gz";
-    hash = "sha256-cQN7goHGyGsKVXKfkNXbaXq+TL7B2BGBV+ANSOwlNGc=";
+    hash = "sha256-uode3RZFcJWHle6qcPFIU7/DTMmHH4rd6NpH4SvVRnk=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/poco/default.nix b/pkgs/development/libraries/poco/default.nix
index 2358d19240a2..029767aaa608 100644
--- a/pkgs/development/libraries/poco/default.nix
+++ b/pkgs/development/libraries/poco/default.nix
@@ -3,12 +3,12 @@
 stdenv.mkDerivation rec {
   pname = "poco";
 
-  version = "1.12.5p2";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "pocoproject";
     repo = "poco";
-    sha256 = "sha256-UAseNOC9n+OooDl4E67qcndJ02fAgmp2d8Ii/IyPvhg=";
+    sha256 = "sha256-GcwkGiui9j9RzMQyEEmqq8dxWzKpv5xWxJgvJpSMdbw=";
     rev = "poco-${version}-release";
   };
 
diff --git a/pkgs/development/libraries/ucx/default.nix b/pkgs/development/libraries/ucx/default.nix
index 8e0772479ccb..35574d7c788a 100644
--- a/pkgs/development/libraries/ucx/default.nix
+++ b/pkgs/development/libraries/ucx/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, doxygen, numactl
 , rdma-core, libbfd, libiberty, perl, zlib, symlinkJoin, pkg-config
 , config
+, autoAddDriverRunpath
 , enableCuda ? config.cudaSupport
 , cudaPackages
 , enableRocm ? config.rocmSupport
@@ -36,7 +37,7 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals enableCuda [
     cudaPackages.cuda_nvcc
-    cudaPackages.autoAddDriverRunpath
+    autoAddDriverRunpath
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/aiolyric/default.nix b/pkgs/development/python-modules/aiolyric/default.nix
index 989c704d3659..916754dc8c67 100644
--- a/pkgs/development/python-modules/aiolyric/default.nix
+++ b/pkgs/development/python-modules/aiolyric/default.nix
@@ -4,23 +4,28 @@
 , fetchFromGitHub
 , pythonOlder
 , pytestCheckHook
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "aiolyric";
-  version = "1.1.1";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "timmo001";
-    repo = pname;
-    rev = "refs/tags/v${version}";
+    repo = "aiolyric";
+    rev = "refs/tags/${version}";
     hash = "sha256-FZhLjVrLzLv6CZz/ROlvbtBK9XnpO8pG48aSIoBxhCo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     aiohttp
   ];
 
diff --git a/pkgs/development/python-modules/async-upnp-client/default.nix b/pkgs/development/python-modules/async-upnp-client/default.nix
index 4cb8e0bbbbb9..d896a16f5ab6 100644
--- a/pkgs/development/python-modules/async-upnp-client/default.nix
+++ b/pkgs/development/python-modules/async-upnp-client/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "async-upnp-client";
-  version = "0.38.2";
+  version = "0.38.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -31,14 +31,14 @@ buildPythonPackage rec {
     owner = "StevenLooman";
     repo = "async_upnp_client";
     rev = "refs/tags/${version}";
-    hash = "sha256-gPA9u1BuMswfg5Nll8l6vrcTP2s3Zn9ESTbV+dOxlhA=";
+    hash = "sha256-RmpQOVZ/s3Zv2e+iS7LTI5Wh/g0yy0Xv0M8ppsbYZPg=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     async-timeout
     defusedxml
@@ -56,20 +56,6 @@ buildPythonPackage rec {
     # socket.gaierror: [Errno -2] Name or service not known
     "test_async_get_local_ip"
     "test_get_local_ip"
-    # OSError: [Errno 101] Network is unreachable
-    "test_auto_resubscribe_fail"
-    "test_init"
-    "test_on_notify_dlna_event"
-    "test_on_notify_upnp_event"
-    "test_server_init"
-    "test_server_start"
-    "test_start_server"
-    "test_subscribe"
-    "test_subscribe_auto_resubscribe"
-    "test_subscribe_fail"
-    "test_subscribe_manual_resubscribe"
-    "test_subscribe_renew"
-    "test_unsubscribe"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_deferred_callback_url"
   ];
@@ -85,10 +71,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Asyncio UPnP Client library for Python";
-    mainProgram = "upnp-client";
     homepage = "https://github.com/StevenLooman/async_upnp_client";
     changelog = "https://github.com/StevenLooman/async_upnp_client/blob/${version}/CHANGES.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ hexa ];
+    mainProgram = "upnp-client";
   };
 }
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index a878a17b0f2a..d78a2b57a934 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , glibcLocales
 , importlib-metadata
+, packaging
 , logfury
 , pyfakefs
 , pytestCheckHook
@@ -41,6 +42,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    packaging
     logfury
     requests
     tqdm
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 029db650ab86..727403f37c46 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonOlder
 , substituteAll
 
@@ -74,6 +75,11 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace tests/utils_tests/test_autoreload.py \
       --replace "/usr/bin/python" "${python.interpreter}"
+  '' + lib.optionalString (pythonAtLeast "3.12" && stdenv.hostPlatform.system == "aarch64-linux") ''
+    # Test regression after xz was reverted from 5.6.0 to 5.4.6
+    # https://hydra.nixos.org/build/254630990
+    substituteInPlace tests/view_tests/tests/test_debug.py \
+      --replace-fail "test_files" "dont_test_files"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 2fe896e3bd3d..d359df1c9a45 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonOlder
 , substituteAll
 
@@ -75,6 +76,11 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace tests/utils_tests/test_autoreload.py \
       --replace "/usr/bin/python" "${python.interpreter}"
+  '' + lib.optionalString (pythonAtLeast "3.12" && stdenv.hostPlatform.system == "aarch64-linux") ''
+    # Test regression after xz was reverted from 5.6.0 to 5.4.6
+    # https://hydra.nixos.org/build/254532197
+    substituteInPlace tests/view_tests/tests/test_debug.py \
+      --replace-fail "test_files" "dont_test_files"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ezyrb/default.nix b/pkgs/development/python-modules/ezyrb/default.nix
index 44d49ee16edd..ee9b16acdbe1 100644
--- a/pkgs/development/python-modules/ezyrb/default.nix
+++ b/pkgs/development/python-modules/ezyrb/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "ezyrb";
-  version = "1.3.0.post2403";
+  version = "1.3.0.post2404";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "mathLab";
     repo = "EZyRB";
     rev = "refs/tags/v${version}";
-    hash = "sha256-t0Mv8Kae6N+jHeQx57ljDR5lmmbW2mqrlqygtrwGWhY=";
+    hash = "sha256-nu75Geyeu1nTLoGaohXB9pmbUWKgdgch9Z5OJqz9xKQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/fastapi-sso/default.nix b/pkgs/development/python-modules/fastapi-sso/default.nix
index 3af37ecd587d..e2e61ecd1781 100644
--- a/pkgs/development/python-modules/fastapi-sso/default.nix
+++ b/pkgs/development/python-modules/fastapi-sso/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "fastapi-sso";
-  version = "0.13.0";
+  version = "0.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,18 +25,18 @@ buildPythonPackage rec {
     owner = "tomasvotava";
     repo = "fastapi-sso";
     rev = "refs/tags/${version}";
-    hash = "sha256-7gBJ6Etb9X2mJzrWYpNGAl3NFoI1bz+PcGfUsMgRlN8=";
+    hash = "sha256-gblxjunXNerbC+7IYkGrO/PJak0MCoxdmWfo7iVeV7g=";
   };
 
   postPatch = ''
     sed -i "/--cov/d" pyproject.toml
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     fastapi
     httpx
     oauthlib
diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index 0125fbe66c12..5283cb448d26 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.44.0";
+  version = "2.45.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-heNvRcepXqayn/impyP5h4L+eOJjGV1hMrZyg96aZKU=";
+    hash = "sha256-8vaSLR+cIKohDpbC679cKydLsnBKhewtTpdBDymxjss=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/jishaku/default.nix b/pkgs/development/python-modules/jishaku/default.nix
index e758f4c691eb..4501ffc68e6b 100644
--- a/pkgs/development/python-modules/jishaku/default.nix
+++ b/pkgs/development/python-modules/jishaku/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  bash,
   buildPythonPackage,
   fetchFromGitHub,
   fetchpatch,
@@ -33,9 +34,14 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = [ setuptools ];
+  postPatch = ''
+    substituteInPlace jishaku/shell.py \
+      --replace-fail '"/bin/bash"' '"${lib.getExe bash}"'
+  '';
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     discordpy
     click
     braceexpand
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index ad72dca6cf51..ecc987156fc1 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -12,19 +12,23 @@
 , importlib-metadata
 , substituteAll
 , runCommand
+, symlinkJoin
+, writers
+, numba
 
 , config
 
 # CUDA-only dependencies:
-, addOpenGLRunpath ? null
-, cudaPackages ? {}
+, addDriverRunpath
+, autoAddDriverRunpath ? cudaPackages.autoAddDriverRunpathHook or cudaPackages.autoAddOpenGLRunpathHook
+, cudaPackages
 
 # CUDA flags:
 , cudaSupport ? config.cudaSupport
 }:
 
 let
-  inherit (cudaPackages) cudatoolkit;
+  cudatoolkit = cudaPackages.cuda_nvcc;
 in buildPythonPackage rec {
   # Using an untagged version, with numpy 1.25 support, when it's released
   # also drop the versioneer patch in postPatch
@@ -52,12 +56,25 @@ in buildPythonPackage rec {
     # relevant strings ourselves, using `sed` commands, in extraPostFetch.
     hash = "sha256-wd4TujPhV2Jy/HUUXLHAlcbVFm4gfQNWxWFXD+jeZC4=";
   };
+
+  postPatch = ''
+    substituteInPlace numba/cuda/cudadrv/driver.py \
+      --replace-fail \
+        "dldir = [" \
+        "dldir = [ '${addDriverRunpath.driverLink}/lib', "
+  '';
+
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
   nativeBuildInputs = [
     numpy
   ] ++ lib.optionals cudaSupport [
-    addOpenGLRunpath
+    autoAddDriverRunpath
+    cudaPackages.cuda_nvcc
+  ];
+
+  buildInputs = with cudaPackages; [
+    cuda_cudart
   ];
 
   propagatedBuildInputs = [
@@ -66,26 +83,16 @@ in buildPythonPackage rec {
     setuptools
   ] ++ lib.optionals (pythonOlder "3.9") [
     importlib-metadata
-  ] ++ lib.optionals cudaSupport [
-    cudatoolkit
-    cudatoolkit.lib
   ];
 
   patches = lib.optionals cudaSupport [
     (substituteAll {
       src = ./cuda_path.patch;
       cuda_toolkit_path = cudatoolkit;
-      cuda_toolkit_lib_path = cudatoolkit.lib;
+      cuda_toolkit_lib_path = lib.getLib cudatoolkit;
     })
   ];
 
-  postFixup = lib.optionalString cudaSupport ''
-    find $out -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
-      addOpenGLRunpath "$lib"
-      patchelf --set-rpath "${cudatoolkit}/lib:${cudatoolkit.lib}/lib:$(patchelf --print-rpath "$lib")" "$lib"
-    done
-  '';
-
   # run a smoke test in a temporary directory so that
   # a) Python picks up the installed library in $out instead of the build files
   # b) we have somewhere to put $HOME so some caching tests work
@@ -104,6 +111,13 @@ in buildPythonPackage rec {
     "numba"
   ];
 
+  passthru.testers.cuda-detect =
+    writers.writePython3Bin "numba-cuda-detect"
+      { libraries = [ (numba.override { cudaSupport = true; }) ]; }
+      ''
+        from numba import cuda
+        cuda.detect()
+      '';
   passthru.tests = {
     # CONTRIBUTOR NOTE: numba also contains CUDA tests, though these cannot be run in
     # this sandbox environment. Consider running similar commands to those below outside the
diff --git a/pkgs/development/python-modules/openrgb-python/default.nix b/pkgs/development/python-modules/openrgb-python/default.nix
index 106a2f7533ea..c41c1d9760b5 100644
--- a/pkgs/development/python-modules/openrgb-python/default.nix
+++ b/pkgs/development/python-modules/openrgb-python/default.nix
@@ -2,20 +2,25 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "openrgb-python";
-  version = "0.2.15";
-  format = "setuptools";
+  version = "0.3.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rTfpqMM+IUd8rMmw/r15sICLoPHL6KLaRrmUjWTfUkA=";
+    hash = "sha256-2eeb2XHYvBaHkHHs9KxZKDGXtcLaT28c/aLC9pxrRmM=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   # Module has no tests
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index 0d25314befdf..1747389cc972 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,14 +21,14 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PB6t1ltxJs7aYn/OthCORHbyRXqMkTZ6YE2He0k/2mc=";
+    hash = "sha256-mQE3WypB//OPilx4vA8b8V+eO0MJ/cSa3wILLW+Jk4Y=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     arrow
     pyotp
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 6d0e49bcb3e3..9d53ed241ce4 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -10,17 +10,17 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20240312";
+  version = "0.10.0.20240328";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ApEvPghPrWfiRjNl/UMVRJIdnbP1H21DzqcWnIax8Yg=";
+    hash = "sha256-XArawQzC9J5ShtgCG02qf8RRxNTKJMn8aiclG+4CUKY=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
@@ -47,9 +47,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Public Suffix List parser implementation";
-    mainProgram = "publicsuffixlist-download";
     homepage = "https://github.com/ko-zu/psl";
     license = licenses.mpl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "publicsuffixlist-download";
   };
 }
diff --git a/pkgs/development/python-modules/pywbem/default.nix b/pkgs/development/python-modules/pywbem/default.nix
index e13aafe71485..bba152dd4367 100644
--- a/pkgs/development/python-modules/pywbem/default.nix
+++ b/pkgs/development/python-modules/pywbem/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "pywbem";
-  version = "1.6.2";
+  version = "1.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JugXm8F+MXa0zVdrn1p3MPhI1RvgUTdo/X8x/ZsnCpY=";
+    hash = "sha256-eN8w3umMUIYgtZm4lR8yKoHGwKnXt4/+XgF7lBfNl7k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/threadpoolctl/default.nix b/pkgs/development/python-modules/threadpoolctl/default.nix
index 50dbe491fdf8..a8d3cd41e6a8 100644
--- a/pkgs/development/python-modules/threadpoolctl/default.nix
+++ b/pkgs/development/python-modules/threadpoolctl/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "threadpoolctl";
-  version = "3.3.0";
+  version = "3.4.0";
 
   disabled = pythonOlder "3.6";
   format = "pyproject";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "joblib";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-mdOZcplqXrkKlL/SXipJg6A9Dh1lXGEHszBLGH/kxqs=";
+    hash = "sha256-nWaBhiFw76azx6dV4I18XodiUnHiLb0gNNhXks6iHIg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/clpm/default.nix b/pkgs/development/tools/clpm/default.nix
deleted file mode 100644
index 1a6262913aa4..000000000000
--- a/pkgs/development/tools/clpm/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ lib
-, stdenv
-, fetchgit
-, wrapLisp
-, openssl
-, sbcl
-}:
-
-# Broken on newer versions:
-# "https://gitlab.common-lisp.net/clpm/clpm/-/issues/51". Once that bug is
-# fixed, remove this, and all 2.1.9 references from the SBCL build file.
-with rec {
-  sbcl_2_1_9 = sbcl.override (_: {
-    version = "2.1.9";
-  });
-};
-
-
-stdenv.mkDerivation rec {
-  pname = "clpm";
-  version = "0.4.1";
-
-  src = fetchgit {
-    url = "https://gitlab.common-lisp.net/clpm/clpm";
-    rev = "v${version}";
-    fetchSubmodules = true;
-    sha256 = "sha256-UhaLmbdsIPj6O+s262HUMxuz/5t43JR+TlOjq8Y2CDs=";
-  };
-
-  propagatedBuildInputs = [
-    openssl
-  ];
-
-  postPatch = ''
-    # patch cl-plus-ssl to ensure that it finds libssl and libcrypto
-    sed 's|libssl.so|${lib.getLib openssl}/lib/libssl.so|' -i ext/cl-plus-ssl/src/reload.lisp
-    sed 's|libcrypto.so|${lib.getLib openssl}/lib/libcrypto.so|' -i ext/cl-plus-ssl/src/reload.lisp
-    # patch dexador to avoid error due to dexador being loaded multiple times
-    sed -i 's/defpackage/uiop:define-package/g' ext/dexador/src/dexador.lisp
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    # exporting home to avoid using /homeless-shelter/.cache/ as this will cause
-    # ld to complaing about `impure path used in link`.
-    export HOME=$TMP
-
-    ${sbcl_2_1_9}/bin/sbcl --script scripts/build-release.lisp
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cd build/release-staging/dynamic/clpm-${version}*/
-    INSTALL_ROOT=$out/ bash install.sh
-
-    runHook postInstall
-  '';
-
-  # Stripping binaries results in fatal error in SBCL, `Can't find sbcl.core`
-  dontStrip = true;
-
-  meta = with lib; {
-    description = "Common Lisp Package Manager";
-    homepage = "https://www.clpm.dev/";
-    license = licenses.bsd2;
-    maintainers = [ maintainers.petterstorvik ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/development/tools/go-toml/default.nix b/pkgs/development/tools/go-toml/default.nix
index fa36ca7eee1a..a6f75db9426e 100644
--- a/pkgs/development/tools/go-toml/default.nix
+++ b/pkgs/development/tools/go-toml/default.nix
@@ -13,7 +13,11 @@ buildGoModule rec {
 
   vendorHash = "sha256-4t/ft3XTfc7yrsFVMSfjdCur8QULho3NI2ym6gqjexI=";
 
-  excludedPackages = [ "cmd/gotoml-test-decoder" "cmd/tomltestgen" ];
+  excludedPackages = [
+    "cmd/gotoml-test-decoder"
+    "cmd/gotoml-test-encoder"
+    "cmd/tomltestgen"
+  ];
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/tools/gojq/default.nix b/pkgs/development/tools/gojq/default.nix
index af7bc42ca751..8d8ad98481ba 100644
--- a/pkgs/development/tools/gojq/default.nix
+++ b/pkgs/development/tools/gojq/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gojq";
-  version = "0.12.14";
+  version = "0.12.15";
 
   src = fetchFromGitHub {
     owner = "itchyny";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mgmgOi3nMPwmcofEAVIN9nTE2oXnNN89lqT+Vi+sjzY=";
+    hash = "sha256-2Og1Ek8Hnzd4KTgJurWtPaqm0W6ruoJ1RN2G+l/5yIY=";
   };
 
-  vendorHash = "sha256-dv4k2dIFnlJrGDTDM4mXBOpr4MF7oxms0y02ml50YyY=";
+  vendorHash = "sha256-tZB52w15MpAO3UnrDkhmL1M3EIcm/QwrPy9gvJycuD0=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/tools/twilio-cli/default.nix b/pkgs/development/tools/twilio-cli/default.nix
index f93643de351c..554f6a2db8f6 100644
--- a/pkgs/development/tools/twilio-cli/default.nix
+++ b/pkgs/development/tools/twilio-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "twilio-cli";
-  version = "5.19.1";
+  version = "5.19.2";
 
   src = fetchzip {
     url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-8IZaEL+F0FMR44KCnxYNC/8mLKBlAGdmgHG7Lv90thE=";
+    hash = "sha256-9bb9cVd40h3b88pRw+S+wK8AG/436aCVyTTlzyCtH9w=";
   };
 
   buildInputs = [ nodejs-slim ];
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 9bfbe18f16ab..dfa92cc8a361 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -64,11 +64,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "550.40.55";
+    version = "550.40.59";
     persistencedVersion = "550.54.14";
     settingsVersion = "550.54.14";
-    sha256_64bit = "sha256-i9FYgSZW0vLMEORg16+LxFBOacXXrAfWKbtCFuD8+IQ=";
-    openSha256 = "sha256-slb058rNKk/TEltGkdw6Shn/3SF3kjgsXQc8IyFMUB8=";
+    sha256_64bit = "sha256-hVwYC454vkxcK8I9bj1kp6iFS667em0c+Ral243C0J8=";
+    openSha256 = "sha256-/v1iVcmHhdvib54LDktNBHkcmgFxZVwQxwPdWSi0l/U=";
     settingsSha256 = "sha256-m2rNASJp0i0Ez2OuqL+JpgEF0Yd8sYVCyrOoo/ln2a4=";
     persistencedSha256 = "sha256-XaPN8jVTjdag9frLPgBtqvO/goB5zxeGzaTU0CdL6C4=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
index b75de560b1d5..9ef4abcdcd7b 100644
--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -22,13 +22,13 @@ callPackage ./generic.nix args {
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.2.3-unstable-2024-03-21";
-  rev = "58211157bf866bbcdd8720e92c27297db3ba75d6";
+  version = "2.2.3-unstable-2024-03-30";
+  rev = "deb7a84231aff8d772bb4ce9fa486d1886f1a2b6";
 
   isUnstable = true;
   tests = [
     nixosTests.zfs.unstable
   ];
 
-  hash = "sha256-zTTzHo/UDsTGp/b7BmCmy/m115HVipSG8Id/pnkUrvQ=";
+  hash = "sha256-d9ZoUFuHPmJmIBbJKENVTCTJ5U3As+3NYHk9ghWxCCA=";
 }
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 6bb931a961fc..30334840268b 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -53,6 +53,8 @@ unwrapped = stdenv.mkDerivation rec {
     echo 'os.exit(77)' > daemon/lua/trust_anchors.test/bootstrap.test.lua
     sed -E '/^[[:blank:]]*test_(dstaddr|headers),?$/d' -i \
       tests/config/doh2.test.lua modules/http/http_doh.test.lua
+  '' + /* FIXME: see PR #286822 */ ''
+    sed '/doh2\.test\.lua/d' -i tests/config/meson.build
   '';
 
   preConfigure = ''
@@ -118,7 +120,8 @@ wrapped-full = runCommand unwrapped.name
     allowSubstitutes = false;
     inherit (unwrapped) meta;
   }
-  (''
+  (assert false; # FIXME: the http module won't work; see PR #286822
+  ''
     mkdir -p "$out"/bin
     makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
       --set LUA_PATH  "$LUA_PATH" \
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index fedbe3879991..4e64f23b43f0 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -153,11 +153,6 @@ let
         doCheck = false;
       });
 
-      # https://cache.nixos.org/log/srr8kfhx8hzl60hxjpl2vkhbh3y4wmmn-python3.12-django-4.2.11.drv
-      django_4 = super.django_4.overridePythonAttrs {
-        doCheck = false;
-      };
-
       dsmr-parser = super.dsmr-parser.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.1";
         src = fetchFromGitHub {
diff --git a/pkgs/servers/miniflux/default.nix b/pkgs/servers/miniflux/default.nix
index 423a23e87885..cfc7ee8e5303 100644
--- a/pkgs/servers/miniflux/default.nix
+++ b/pkgs/servers/miniflux/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "miniflux";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     rev = "refs/tags/${version}";
-    hash = "sha256-vXSOHZt6Ov5g4fQBg0bubCfn76aaVrjw2b+LRebbV6s=";
+    hash = "sha256-ArGoSb4gL0Mpul9wQJWW0aaCpSgtBxqnEiv5wS1eIFY=";
   };
 
-  vendorHash = "sha256-p31kwJZQMYff5Us6mXpPmxbPrEXyxU6Sipf4LKSG3wU=";
+  vendorHash = "sha256-FcUKlvIdXJ3fSvf02zZu4lYa6943s3l2LwFBQ/EqtyY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/servers/sunshine/default.nix b/pkgs/servers/sunshine/default.nix
index a401f318a911..c5cad2a89166 100644
--- a/pkgs/servers/sunshine/default.nix
+++ b/pkgs/servers/sunshine/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , autoPatchelfHook
+, autoAddDriverRunpath
 , makeWrapper
 , buildNpmPackage
 , cmake
@@ -84,10 +85,11 @@ stdenv'.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    autoPatchelfHook
     makeWrapper
+    # Avoid fighting upstream's usage of vendored ffmpeg libraries
+    autoPatchelfHook
   ] ++ lib.optionals cudaSupport [
-    cudaPackages.autoAddDriverRunpath
+    autoAddDriverRunpath
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/audio/openai-whisper-cpp/default.nix b/pkgs/tools/audio/openai-whisper-cpp/default.nix
index 20d2a23d1dd5..ab1cbb77e97b 100644
--- a/pkgs/tools/audio/openai-whisper-cpp/default.nix
+++ b/pkgs/tools/audio/openai-whisper-cpp/default.nix
@@ -12,6 +12,7 @@
 , MetalKit
 
 , config
+, autoAddDriverRunpath
 , cudaSupport ? config.cudaSupport
 , cudaPackages ? {}
 }:
@@ -42,11 +43,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
       which
       makeWrapper
-    ] ++ lib.optionals cudaSupport ( with cudaPackages ;[
-      cuda_nvcc
-
+    ] ++ lib.optionals cudaSupport [
+      cudaPackages.cuda_nvcc
       autoAddDriverRunpath
-    ]);
+    ];
 
   buildInputs = [
       SDL2
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 452fab128e14..1da3131f85b0 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -11,40 +11,48 @@
 , rsync
 , makeWrapper
 , gettext
+, getconf
+, testers
+, nix-update-script
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let self = python3.pkgs.buildPythonApplication rec {
   pname = "duplicity";
-  version = "0.8.23";
+  version = "2.2.3";
 
   src = fetchFromGitLab {
     owner = "duplicity";
     repo = "duplicity";
     rev = "rel.${version}";
-    sha256 = "0my015zc8751smjgbsysmca7hvdm96cjw5zilqn3zq971nmmrksb";
+    hash = "sha256-4IwKqXlG7jh1siuPT5pVgiYB+KlmCzF6+OMPT3I3yTQ=";
   };
 
   patches = [
-    # We use the tar binary on all platforms.
-    ./gnutar-in-test.patch
-
-    # Our Python infrastructure runs test in installCheckPhase so we need
-    # to make the testing code stop assuming it is run from the source directory.
-    ./use-installed-scripts-in-test.patch
-  ] ++ lib.optionals stdenv.isLinux [
-    # Broken on Linux in Nix' build environment
-    ./linux-disable-timezone-test.patch
+    ./keep-pythonpath-in-testing.patch
   ];
 
-  preConfigure = ''
-    # fix version displayed by duplicity --version
-    # see SourceCopy in setup.py
-    ls
-    for i in bin/*.1 duplicity/__init__.py; do
-      substituteInPlace "$i" --replace '$version' "${version}"
-    done
+  postPatch = ''
+    patchShebangs duplicity/__main__.py
+
+    # don't try to use gtar on darwin/bsd
+    substituteInPlace testing/functional/test_restart.py \
+      --replace-fail 'tarcmd = "gtar"' 'tarcmd = "tar"'
+  '' + lib.optionalString stdenv.isDarwin ''
+    # tests try to access these files in the sandbox, but can't deal with EPERM
+    substituteInPlace testing/unit/test_globmatch.py \
+      --replace-fail /var/log /test/log
+    substituteInPlace testing/unit/test_selection.py \
+      --replace-fail /usr/bin /dev
+    # don't use /tmp/ in tests
+    substituteInPlace duplicity/backends/_testbackend.py \
+      --replace-fail '"/tmp/' 'os.environ.get("TMPDIR")+"/'
   '';
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # uses /tmp/
+    "testing/unit/test_cli_main.py::CommandlineTest::test_intermixed_args"
+  ];
+
   nativeBuildInputs = [
     makeWrapper
     gettext
@@ -80,51 +88,54 @@ python3.pkgs.buildPythonApplication rec {
     par2cmdline # Add 'par2' to PATH.
   ] ++ lib.optionals stdenv.isLinux [
     util-linux # Add 'setsid' to PATH.
+  ] ++ lib.optionals stdenv.isDarwin [
+    getconf
   ] ++ (with python3.pkgs; [
     lockfile
     mock
     pexpect
     pytest
     pytest-runner
+    fasteners
   ]);
 
-  postInstall = ''
+  postInstall = let
+    binPath = lib.makeBinPath ([
+      gnupg
+      ncftp
+      rsync
+    ] ++ lib.optionals stdenv.isDarwin [
+      getconf
+    ]); in ''
     wrapProgram $out/bin/duplicity \
-      --prefix PATH : "${lib.makeBinPath [ gnupg ncftp rsync ]}"
+      --prefix PATH : "${binPath}"
   '';
 
   preCheck = ''
+    # tests need writable $HOME
+    HOME=$PWD/.home
+
     wrapPythonProgramsIn "$PWD/testing/overrides/bin" "$pythonPath"
-
-    # Add 'duplicity' to PATH for tests.
-    # Normally, 'setup.py test' adds 'build/scripts-2.7/' to PATH before running
-    # tests. However, 'build/scripts-2.7/duplicity' is not wrapped, so its
-    # shebang is incorrect and it fails to run inside Nix' sandbox.
-    # In combination with use-installed-scripts-in-test.patch, make 'setup.py
-    # test' use the installed 'duplicity' instead.
-    PATH="$out/bin:$PATH"
-
-    # Don't run developer-only checks (pep8, etc.).
-    export RUN_CODE_TESTS=0
-
-    # check version string
-    duplicity --version | grep ${version}
-  '' + lib.optionalString stdenv.isDarwin ''
-    # Work around the following error when running tests:
-    # > Max open files of 256 is too low, should be >= 1024.
-    # > Use 'ulimit -n 1024' or higher to correct.
-    ulimit -n 1024
   '';
 
-  # TODO: Fix test failures on macOS 10.13:
-  #
-  # > OSError: out of pty devices
-  doCheck = !stdenv.isDarwin;
+  doCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex" "rel\.(.*)" ];
+    };
+
+    tests.version = testers.testVersion {
+      package = self;
+    };
+  };
 
   meta = with lib; {
     description = "Encrypted bandwidth-efficient backup using the rsync algorithm";
     homepage = "https://duplicity.gitlab.io/duplicity-web/";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ corngood ];
   };
-}
+};
+
+in self
diff --git a/pkgs/tools/backup/duplicity/gnutar-in-test.patch b/pkgs/tools/backup/duplicity/gnutar-in-test.patch
deleted file mode 100644
index ee95b68e2abb..000000000000
--- a/pkgs/tools/backup/duplicity/gnutar-in-test.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/testing/functional/test_restart.py b/testing/functional/test_restart.py
-index 6d972c82..e8435fd5 100644
---- a/testing/functional/test_restart.py
-+++ b/testing/functional/test_restart.py
-@@ -350,14 +350,7 @@ class RestartTestWithoutEncryption(RestartTest):
-         https://launchpad.net/bugs/929067
-         """
- 
--        if platform.system().startswith(u'Linux'):
--            tarcmd = u"tar"
--        elif platform.system().startswith(u'Darwin'):
--            tarcmd = u"gtar"
--        elif platform.system().endswith(u'BSD'):
--            tarcmd = u"gtar"
--        else:
--            raise Exception(u"Platform %s not supported by tar/gtar." % platform.platform())
-+        tarcmd = u"tar"
- 
-         # Intial normal backup
-         self.backup(u"full", u"{0}/testfiles/blocktartest".format(_runtest_dir))
diff --git a/pkgs/tools/backup/duplicity/keep-pythonpath-in-testing.patch b/pkgs/tools/backup/duplicity/keep-pythonpath-in-testing.patch
new file mode 100644
index 000000000000..c0cc6a2226d1
--- /dev/null
+++ b/pkgs/tools/backup/duplicity/keep-pythonpath-in-testing.patch
@@ -0,0 +1,15 @@
+diff --git a/testing/functional/__init__.py b/testing/functional/__init__.py
+index 6c82d2c7..22163fa3 100644
+--- a/testing/functional/__init__.py
++++ b/testing/functional/__init__.py
+@@ -94,8 +94,8 @@ class FunctionalTestCase(DuplicityTestCase):
+         for item in passphrase_input:
+             assert isinstance(item, str), f"item {os.fsdecode(item)} in passphrase_input is not unicode"
+ 
+-        # set python path to be dev directory
+-        os.environ["PYTHONPATH"] = _top_dir
++        # prepend dev directory to python path
++        os.environ["PYTHONPATH"] = _top_dir + ":" + os.environ["PYTHONPATH"]
+ 
+         cmd_list = []
+ 
diff --git a/pkgs/tools/backup/duplicity/linux-disable-timezone-test.patch b/pkgs/tools/backup/duplicity/linux-disable-timezone-test.patch
deleted file mode 100644
index e322625cdbf4..000000000000
--- a/pkgs/tools/backup/duplicity/linux-disable-timezone-test.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-commit f0142706c377b7c133753db57b5c4c90baa2de30
-Author: Guillaume Girol <symphorien+git@xlumurb.eu>
-Date:   Sun Jul 11 17:48:15 2021 +0200
-
-diff --git a/testing/unit/test_statistics.py b/testing/unit/test_statistics.py
-index 4be5000c..80545853 100644
---- a/testing/unit/test_statistics.py
-+++ b/testing/unit/test_statistics.py
-@@ -63,6 +63,7 @@ class StatsObjTest(UnitTestCase):
-         s1 = StatsDeltaProcess()
-         assert s1.get_stat(u'SourceFiles') == 0
- 
-+    @unittest.skip("Broken on Linux in Nix' build environment")
-     def test_get_stats_string(self):
-         u"""Test conversion of stat object into string"""
-         s = StatsObj()
diff --git a/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch b/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch
deleted file mode 100644
index a5ddc4381bd8..000000000000
--- a/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-commit ccd4dd92cd37acce1da20966ad9e4e0c7bcf1709
-Author: Guillaume Girol <symphorien+git@xlumurb.eu>
-Date:   Sun Jul 11 12:00:00 2021 +0000
-
-    use installed duplicity when running tests
-
-diff --git a/setup.py b/setup.py
-index fa474f20..604a242a 100755
---- a/setup.py
-+++ b/setup.py
-@@ -205,10 +205,6 @@ class TestCommand(test):
-                 except Exception:
-                     pass
- 
--        os.environ[u'PATH'] = u"%s:%s" % (
--            os.path.abspath(build_scripts_cmd.build_dir),
--            os.environ.get(u'PATH'))
--
-         test.run(self)
- 
- 
-diff --git a/testing/functional/__init__.py b/testing/functional/__init__.py
-index 4221576d..3cf44945 100644
---- a/testing/functional/__init__.py
-+++ b/testing/functional/__init__.py
-@@ -111,7 +111,7 @@ class FunctionalTestCase(DuplicityTestCase):
-         run_coverage = os.environ.get(u'RUN_COVERAGE', None)
-         if run_coverage is not None:
-             cmd_list.extend([u"-m", u"coverage", u"run", u"--source=duplicity", u"-p"])
--        cmd_list.extend([u"{0}/bin/duplicity".format(_top_dir)])
-+        cmd_list.extend([u"duplicity"])
-         cmd_list.extend(options)
-         cmd_list.extend([u"-v0"])
-         cmd_list.extend([u"--no-print-statistics"])
-diff --git a/testing/functional/test_log.py b/testing/functional/test_log.py
-index 9dfc86a6..b9cb55db 100644
---- a/testing/functional/test_log.py
-+++ b/testing/functional/test_log.py
-@@ -49,9 +49,9 @@ class LogTest(FunctionalTestCase):
-         # Run actual duplicity command (will fail, because no arguments passed)
-         basepython = os.environ.get(u'TOXPYTHON', None)
-         if basepython is not None:
--            os.system(u"{0} {1}/bin/duplicity --log-file={2} >/dev/null 2>&1".format(basepython, _top_dir, self.logfile))
-+            os.system(u"{0} duplicity --log-file={1} >/dev/null 2>&1".format(basepython, self.logfile))
-         else:
--            os.system(u"{0}/bin/duplicity --log-file={1} >/dev/null 2>&1".format(_top_dir, self.logfile))
-+            os.system(u"duplicity --log-file={0} >/dev/null 2>&1".format(self.logfile))
- 
-         # The format of the file should be:
-         # """ERROR 2
-diff --git a/testing/functional/test_rdiffdir.py b/testing/functional/test_rdiffdir.py
-index 0cbfdb33..47acd029 100644
---- a/testing/functional/test_rdiffdir.py
-+++ b/testing/functional/test_rdiffdir.py
-@@ -44,7 +44,7 @@ class RdiffdirTest(FunctionalTestCase):
-         basepython = os.environ.get(u'TOXPYTHON', None)
-         if basepython is not None:
-             cmd_list.extend([basepython])
--        cmd_list.extend([u"{0}/bin/rdiffdir".format(_top_dir)])
-+        cmd_list.extend([u"rdiffdir"])
-         cmd_list.extend(argstring.split())
-         cmdline = u" ".join([u'"%s"' % x for x in cmd_list])
-         self.run_cmd(cmdline)
diff --git a/pkgs/tools/graphics/sanjuuni/default.nix b/pkgs/tools/graphics/sanjuuni/default.nix
index 6b96e6ad5a92..70bc59f3eb40 100644
--- a/pkgs/tools/graphics/sanjuuni/default.nix
+++ b/pkgs/tools/graphics/sanjuuni/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , pkg-config
 , ffmpeg
 , poco
@@ -19,6 +20,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wgtyrik4Z5AXd8MHkiMuxMpGh/xcEtNqivyhvL68aac=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "build-with-cxx17.patch";
+      url = "https://github.com/MCJack123/sanjuuni/commit/f2164bc18935bcf63ee5b0a82087bc91f7fd258d.patch";
+      hash = "sha256-ZmP+AmUV7fcIFqSA6e56Nt6u03leE9PX36g2z0nLswo=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/tools/networking/ncftp/default.nix b/pkgs/tools/networking/ncftp/default.nix
index 02dd29c0fda5..c31e6333b684 100644
--- a/pkgs/tools/networking/ncftp/default.nix
+++ b/pkgs/tools/networking/ncftp/default.nix
@@ -17,7 +17,12 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: bookmark.o: (.bss+0x20): multiple definition of `gBm';
   #     gpshare.o:(.bss+0x0): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = toString ([ "-fcommon" ]
+    # these are required for the configure script to work with clang
+    ++ lib.optionals stdenv.isDarwin [
+      "-Wno-implicit-int"
+      "-Wno-implicit-function-declaration"
+    ]);
 
   preConfigure = ''
     find -name Makefile.in | xargs sed -i '/^TMPDIR=/d'
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index c6fb92044cdc..2c74013c3ad1 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -1,6 +1,8 @@
 { lib
+, stdenv
 , buildGoModule
 , fetchFromGitHub
+, git
 , installShellFiles
 , kubescape
 , testers
@@ -8,52 +10,55 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "2.9.1";
+  version = "3.0.8";
 
   src = fetchFromGitHub {
     owner = "kubescape";
-    repo = pname;
+    repo = "kubescape";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FKWR3pxFtJBEa14Mn3RKsLvrliHaj6TuF4F2JLtw2qA=";
+    hash = "sha256-ZGDE9go8BmaXE1YFT/z5Nob90MhsKZ6oKrodDMu2npY=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-zcv8oYm6srwkwT3pUECtTewyqVVpCIcs3i0VRTRft68=";
+  vendorHash = "sha256-qFJVoWzU9rqpYbb8gzdK33rq///zizxVkWhsNV8OXOM=";
+
+  subPackages = [
+    "."
+  ];
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
+  nativeCheckInputs = [
+    git
+  ];
+
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/kubescape/kubescape/v2/core/cautils.BuildNumber=v${version}"
+    "-X=github.com/kubescape/kubescape/v3/core/cautils.BuildNumber=v${version}"
   ];
 
-  subPackages = [ "." ];
-
   preCheck = ''
-    # Feed in all but the integration tests for testing
-    # This is because subPackages above limits what is built to just what we
-    # want but also limits the tests
-    # Skip httphandler tests - the checkPhase doesn't care about excludedPackages
-    getGoDirs() {
-      go list ./... | grep -v httphandler
-    }
+    export HOME=$(mktemp -d)
 
-    # remove tests that use networking
+    # Remove tests that use networking
     rm core/pkg/resourcehandler/urlloader_test.go
     rm core/pkg/opaprocessor/*_test.go
     rm core/cautils/getter/downloadreleasedpolicy_test.go
+    rm core/core/initutils_test.go
+    rm core/core/list_test.go
+    rm core/pkg/resourcehandler/remotegitutils_test.go
 
-    # remove tests that use networking
+    # Remove tests that use networking
     substituteInPlace core/pkg/resourcehandler/repositoryscanner_test.go \
-      --replace "TestScanRepository" "SkipScanRepository" \
-      --replace "TestGit" "SkipGit"
+      --replace-fail "TestScanRepository" "SkipScanRepository" \
+      --replace-fail "TestGit" "SkipGit"
 
-    # remove test that requires networking
+    # Remove test that requires networking
     substituteInPlace core/cautils/scaninfo_test.go \
-      --replace "TestSetContextMetadata" "SkipSetContextMetadata"
+      --replace-fail "TestSetContextMetadata" "SkipSetContextMetadata"
   '';
 
   postInstall = ''
@@ -71,7 +76,6 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Tool for testing if Kubernetes is deployed securely";
-    mainProgram = "kubescape";
     homepage = "https://github.com/kubescape/kubescape";
     changelog = "https://github.com/kubescape/kubescape/releases/tag/v${version}";
     longDescription = ''
@@ -87,5 +91,7 @@ buildGoModule rec {
     '';
     license = licenses.asl20;
     maintainers = with maintainers; [ fab jk ];
+    mainProgram = "kubescape";
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/security/pinentry-rofi/default.nix b/pkgs/tools/security/pinentry-rofi/default.nix
index e0fffff7cedf..45c817c69795 100644
--- a/pkgs/tools/security/pinentry-rofi/default.nix
+++ b/pkgs/tools/security/pinentry-rofi/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pinentry-rofi";
-  version = "2.0.5";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "plattfot";
     repo = pname;
     rev = version;
-    sha256 = "sha256-6dhzzxjE3GE5JZTirMLeMh91BS2wzDZoubgf4Wefe1o=";
+    sha256 = "sha256-J6aQTIFHlg21M9niBYdVih11heIPCLsGv0HOPaeguew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/teler/default.nix b/pkgs/tools/security/teler/default.nix
index 9232f4f88206..82183323de8a 100644
--- a/pkgs/tools/security/teler/default.nix
+++ b/pkgs/tools/security/teler/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "teler";
-  version = "2.0.0-dev.3";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "kitabisa";
     repo = "teler";
-    rev = "v${version}";
-    hash = "sha256-2QrHxToHxHTjSl76q9A8fXCkOZkCwh1fu1h+HDUGsGA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3+A1QloZQlH31snWfwYa6rprpKUf3fQc/HQgmKQgV9c=";
   };
 
   vendorHash = "sha256-gV/PJFcANeYTYUJG3PYNsApYaeBLx76+vVBvcuKDYO4=";
@@ -19,7 +19,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X ktbs.dev/teler/common.Version=${version}"
+    "-X=ktbs.dev/teler/common.Version=${version}"
   ];
 
   # test require internet access
@@ -27,7 +27,6 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Real-time HTTP Intrusion Detection";
-    mainProgram = "teler.app";
     longDescription = ''
       teler is an real-time intrusion detection and threat alert
       based on web log that runs in a terminal with resources that
@@ -37,5 +36,6 @@ buildGoModule rec {
     changelog = "https://github.com/kitabisa/teler/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "teler.app";
   };
 }
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index 45aed59dee8f..1796661c7d4c 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fio";
-  version = "3.36";
+  version = "3.37";
 
   src = fetchFromGitHub {
     owner  = "axboe";
     repo   = "fio";
     rev    = "fio-${version}";
-    sha256 = "sha256-w1k1DGgGYL2K/fZ30HMQE2vMcT6ZaaweM+KTcHKVEq4=";
+    sha256 = "sha256-dKHTxVglH10aV44RuSeIFATn83DVdmCYtuaiS3b0+zo=";
   };
 
   buildInputs = [ python3 zlib ]
diff --git a/pkgs/tools/text/kdiff3/default.nix b/pkgs/tools/text/kdiff3/default.nix
index 73fa2ed1baea..c852a4baf794 100644
--- a/pkgs/tools/text/kdiff3/default.nix
+++ b/pkgs/tools/text/kdiff3/default.nix
@@ -27,12 +27,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [ "-Wno-dev" ];
 
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    ln -s "$out/Applications/KDE/kdiff3.app/Contents/MacOS" "$out/bin"
+  '';
+
   meta = with lib; {
     description = "Compares and merges 2 or 3 files or directories";
     mainProgram = "kdiff3";
     homepage = "https://invent.kde.org/sdk/kdiff3";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ peterhoeg ];
-    platforms = with platforms; linux;
+    platforms = with platforms; linux ++ darwin;
   };
 })
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d13da6315485..068e2a670cb9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -172,6 +172,7 @@ mapAliases ({
   citra-canary = throw "citra-canary has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
   clang-ocl = throw "'clang-ocl' has been replaced with 'rocmPackages.clang-ocl'"; # Added 2023-10-08
   inherit (libsForQt5.mauiPackages) clip; # added 2022-05-17
+  clpm = throw "'clpm' has been removed from nixpkgs"; # Added 2024-04-01
   collada-dom = opencollada; # added 2024-02-21
   composable_kernel = throw "'composable_kernel' has been replaced with 'rocmPackages.composable_kernel'"; # Added 2023-10-08
   cpp-ipfs-api = cpp-ipfs-http-client; # Project has been renamed. Added 2022-05-15
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fd7d236a74d6..3f1ef52b3b9d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6555,8 +6555,6 @@ with pkgs;
 
   beanstalkd = callPackage ../servers/beanstalkd { };
 
-  bee = callPackage ../applications/networking/bee/bee.nix { };
-
   beetsPackages = lib.recurseIntoAttrs (callPackage ../tools/audio/beets { });
   inherit (beetsPackages) beets beets-unstable;
 
@@ -12516,8 +12514,6 @@ with pkgs;
 
   redir = callPackage ../tools/networking/redir { };
 
-  redmine = callPackage ../applications/version-management/redmine { };
-
   redpanda-client = callPackage ../servers/redpanda { };
 
   redpanda-server = redpanda-client.server;
@@ -18578,8 +18574,6 @@ with pkgs;
 
   cloudfoundry-cli = callPackage ../applications/networking/cluster/cloudfoundry-cli { };
 
-  clpm = callPackage ../development/tools/clpm { };
-
   coan = callPackage ../development/tools/analysis/coan { };
 
   coder = callPackage ../development/tools/coder { };
@@ -29094,8 +29088,6 @@ with pkgs;
     inherit (plasma5Packages) breeze-icons;
   };
 
-  lxgw-neoxihei = callPackage ../data/fonts/lxgw-neoxihei { };
-
   lxgw-wenkai = callPackage ../data/fonts/lxgw-wenkai { };
 
   maia-icon-theme = libsForQt5.callPackage ../data/icons/maia-icon-theme { };