diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b9d4cee99df7..594acdffddd5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16965,6 +16965,11 @@
     githubId = 50401154;
     name = "Simone Ruffini";
   };
+  simonhammes = {
+    github = "simonhammes";
+    githubId = 10352679;
+    name = "Simon Hammes";
+  };
   simonkampe = {
     email = "simon.kampe+nix@gmail.com";
     github = "simonkampe";
diff --git a/nixos/modules/services/hardware/thermald.nix b/nixos/modules/services/hardware/thermald.nix
index 7ae602823cd6..a4839f326cc4 100644
--- a/nixos/modules/services/hardware/thermald.nix
+++ b/nixos/modules/services/hardware/thermald.nix
@@ -19,6 +19,12 @@ in
         '';
       };
 
+     ignoreCpuidCheck = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc "Whether to ignore the cpuid check to allow running on unsupported platforms";
+      };
+
       configFile = mkOption {
         type = types.nullOr types.path;
         default = null;
@@ -42,6 +48,7 @@ in
           ${cfg.package}/sbin/thermald \
             --no-daemon \
             ${optionalString cfg.debug "--loglevel=debug"} \
+            ${optionalString cfg.ignoreCpuidCheck "--ignore-cpuid-check"} \
             ${optionalString (cfg.configFile != null) "--config-file ${cfg.configFile}"} \
             --dbus-enable \
             --adaptive
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 35c1bde285d8..b126f8fb0944 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -786,6 +786,7 @@ in {
   spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark {};
   sqlite3-to-mysql = handleTest ./sqlite3-to-mysql.nix {};
   sslh = handleTest ./sslh.nix {};
+  ssh-agent-auth = handleTest ./ssh-agent-auth.nix {};
   ssh-audit = handleTest ./ssh-audit.nix {};
   sssd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd.nix {};
   sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix {};
diff --git a/nixos/tests/ssh-agent-auth.nix b/nixos/tests/ssh-agent-auth.nix
new file mode 100644
index 000000000000..2274e463ce95
--- /dev/null
+++ b/nixos/tests/ssh-agent-auth.nix
@@ -0,0 +1,51 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+  let
+    inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  in {
+    name = "ssh-agent-auth";
+    meta.maintainers = with lib.maintainers; [ nicoo ];
+
+    nodes = let nodeConfig = n: { ... }: {
+      users.users = {
+        admin = {
+          isNormalUser = true;
+          extraGroups = [ "wheel" ];
+          openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+        };
+        foo.isNormalUser = true;
+      };
+
+      security.pam.enableSSHAgentAuth = true;
+      security.${lib.replaceStrings [ "_" ] [ "-" ] n} = {
+        enable = true;
+        wheelNeedsPassword = true;  # We are checking `pam_ssh_agent_auth(8)` works for a sudoer
+      };
+
+      # Necessary for pam_ssh_agent_auth  >_>'
+      services.openssh.enable = true;
+    };
+    in lib.genAttrs [ "sudo" "sudo_rs" ] nodeConfig;
+
+    testScript = let
+      privateKeyPath = "/home/admin/.ssh/id_ecdsa";
+      userScript = pkgs.writeShellScript "test-script" ''
+        set -e
+        ssh-add -q ${privateKeyPath}
+
+        # faketty needed to ensure `sudo` doesn't write to the controlling PTY,
+        #  which would break the test-driver's line-oriented protocol.
+        ${lib.getExe pkgs.faketty} sudo -u foo -- id -un
+      '';
+    in ''
+      for vm in (sudo, sudo_rs):
+        sudo_impl = vm.name.replace("_", "-")
+        with subtest(f"wheel user can auth with ssh-agent for {sudo_impl}"):
+            vm.copy_from_host("${snakeOilPrivateKey}", "${privateKeyPath}")
+            vm.succeed("chmod -R 0700 /home/admin")
+            vm.succeed("chown -R admin:users /home/admin")
+
+            # Run `userScript` in an environment with an SSH-agent available
+            assert vm.succeed("sudo -u admin -- ssh-agent ${userScript} 2>&1").strip() == "foo"
+    '';
+  }
+)
diff --git a/pkgs/applications/emulators/hercules/default.nix b/pkgs/applications/emulators/hercules/default.nix
deleted file mode 100644
index 67506d36b63c..000000000000
--- a/pkgs/applications/emulators/hercules/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-}:
-
-stdenv.mkDerivation rec {
-  pname = "hercules";
-  version = "3.13";
-
-  src = fetchurl {
-    url = "http://downloads.hercules-390.eu/${pname}-${version}.tar.gz";
-    sha256 = "0zg6rwz8ib4alibf8lygi8qn69xx8n92kbi8b3jhi1ymb32mf349";
-  };
-
-  meta = with lib; {
-    homepage = "http://www.hercules-390.eu";
-    description = "IBM mainframe emulator";
-    longDescription = ''
-      Hercules is an open source software implementation of the mainframe
-      System/370 and ESA/390 architectures, in addition to the latest 64-bit
-      z/Architecture. Hercules runs under Linux, Windows, Solaris, FreeBSD, and
-      Mac OS X.
-    '';
-    license = licenses.qpl;
-    maintainers = [ maintainers.anna328p ];
-  };
-}
diff --git a/pkgs/applications/emulators/yuzu/compat-list.nix b/pkgs/applications/emulators/yuzu/compat-list.nix
new file mode 100644
index 000000000000..431a2e5197e3
--- /dev/null
+++ b/pkgs/applications/emulators/yuzu/compat-list.nix
@@ -0,0 +1,18 @@
+{ stdenv, fetchFromGitHub, unstableGitUpdater }:
+stdenv.mkDerivation {
+  pname = "yuzu-compatibility-list";
+  version = "unstable-2023-12-28";
+
+  src = fetchFromGitHub {
+    owner = "flathub";
+    repo = "org.yuzu_emu.yuzu";
+    rev = "0b9bf10851d6ad54441dc4f687d5755ed2c6f7a8";
+    hash = "sha256-oWEeAhyxFO1TFH3d+/ivRf1KnNUU8y5c/7NtOzlpKXg=";
+  };
+
+  buildCommand = ''
+    cp $src/compatibility_list.json $out
+  '';
+
+  passthru.updateScript = unstableGitUpdater {};
+}
diff --git a/pkgs/applications/emulators/yuzu/default.nix b/pkgs/applications/emulators/yuzu/default.nix
index ef9c12703f24..116f12b2a963 100644
--- a/pkgs/applications/emulators/yuzu/default.nix
+++ b/pkgs/applications/emulators/yuzu/default.nix
@@ -1,68 +1,22 @@
-{ branch ? "mainline"
-, qt6Packages
-, fetchFromGitHub
-, fetchgit
-, fetchurl
-, fetchzip
-, runCommand
-, gnutar
-}:
+{ qt6Packages, makeScopeWithSplicing', generateSplicesForMkScope, vulkan-headers, fetchFromGitHub }:
 
-let
-  sources = import ./sources.nix;
+makeScopeWithSplicing' {
+  otherSplices = generateSplicesForMkScope "yuzuPackages";
+  f = self: qt6Packages // {
+    compat-list = self.callPackage ./compat-list.nix {};
+    nx_tzdb = self.callPackage ./nx_tzdb.nix {};
 
-  compat-list = fetchurl {
-    name = "yuzu-compat-list";
-    url = "https://raw.githubusercontent.com/flathub/org.yuzu_emu.yuzu/${sources.compatList.rev}/compatibility_list.json";
-    hash = sources.compatList.hash;
+    mainline = self.callPackage ./mainline.nix {};
+    early-access = self.callPackage ./early-access {};
+
+    vulkan-headers = vulkan-headers.overrideAttrs(old: rec {
+      version = "1.3.274";
+      src = fetchFromGitHub {
+        owner = "KhronosGroup";
+        repo = "Vulkan-Headers";
+        rev = "v${version}";
+        hash = "sha256-SsS5VlEnhjOSu8MlIVC0d2r2EAf8QsNJPEAXNtbDOJ4=";
+      };
+    });
   };
-
-  mainlineSrc = fetchFromGitHub {
-    owner = "yuzu-emu";
-    repo = "yuzu-mainline";
-    rev = "mainline-0-${sources.mainline.version}";
-    hash = sources.mainline.hash;
-    fetchSubmodules = true;
-  };
-
-  # The mirror repo for early access builds is missing submodule info,
-  # but the Windows distributions include a source tarball, which in turn
-  # includes the full git metadata. So, grab that and rehydrate it.
-  # This has the unfortunate side effect of requiring two FODs, one
-  # for the Windows download and one for the full repo with submodules.
-  eaZip = fetchzip {
-    name = "yuzu-ea-windows-dist";
-    url = "https://github.com/pineappleEA/pineapple-src/releases/download/EA-${sources.ea.version}/Windows-Yuzu-EA-${sources.ea.version}.zip";
-    hash = sources.ea.distHash;
-  };
-
-  eaGitSrc = runCommand "yuzu-ea-dist-unpacked" {
-    src = eaZip;
-    nativeBuildInputs = [ gnutar ];
-  }
-  ''
-    mkdir $out
-    tar xf $src/*.tar.xz --directory=$out --strip-components=1
-  '';
-
-  eaSrcRehydrated = fetchgit {
-    url = eaGitSrc;
-    fetchSubmodules = true;
-    hash = sources.ea.fullHash;
-  };
-
-in {
-  mainline = qt6Packages.callPackage ./generic.nix {
-    branch = "mainline";
-    version = sources.mainline.version;
-    src = mainlineSrc;
-    inherit compat-list;
-  };
-
-  early-access = qt6Packages.callPackage ./generic.nix {
-    branch = "early-access";
-    version = sources.ea.version;
-    src = eaSrcRehydrated;
-    inherit compat-list;
-  };
-}.${branch}
+}
diff --git a/pkgs/applications/emulators/yuzu/early-access/default.nix b/pkgs/applications/emulators/yuzu/early-access/default.nix
new file mode 100644
index 000000000000..842f7c107975
--- /dev/null
+++ b/pkgs/applications/emulators/yuzu/early-access/default.nix
@@ -0,0 +1,36 @@
+{ mainline, fetchzip, fetchgit, runCommand, gnutar }:
+# The mirror repo for early access builds is missing submodule info,
+# but the Windows distributions include a source tarball, which in turn
+# includes the full git metadata. So, grab that and rehydrate it.
+# This has the unfortunate side effect of requiring two FODs, one
+# for the Windows download and one for the full repo with submodules.
+let
+  sources = import ./sources.nix;
+
+  zip = fetchzip {
+    name = "yuzu-ea-windows-dist";
+    url = "https://github.com/pineappleEA/pineapple-src/releases/download/EA-${sources.version}/Windows-Yuzu-EA-${sources.version}.zip";
+    hash = sources.distHash;
+  };
+
+  gitSrc = runCommand "yuzu-ea-dist-unpacked" {
+    src = zip;
+    nativeBuildInputs = [ gnutar ];
+  }
+  ''
+    mkdir $out
+    tar xf $src/*.tar.xz --directory=$out --strip-components=1
+  '';
+
+  rehydratedSrc = fetchgit {
+    url = gitSrc;
+    fetchSubmodules = true;
+    hash = sources.fullHash;
+  };
+in mainline.overrideAttrs(old: {
+  pname = "yuzu-early-access";
+  version = sources.version;
+  src = rehydratedSrc;
+  passthru.updateScript = ./update.sh;
+  meta = old.meta // { description = old.meta.description + " - early access branch"; };
+})
diff --git a/pkgs/applications/emulators/yuzu/early-access/sources.nix b/pkgs/applications/emulators/yuzu/early-access/sources.nix
new file mode 100644
index 000000000000..4f9c6a1f8d39
--- /dev/null
+++ b/pkgs/applications/emulators/yuzu/early-access/sources.nix
@@ -0,0 +1,7 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2023-12-29
+{
+  version = "4037";
+  distHash = "sha256:0pw56hj13fm9j5nja1lhj839d88w00kcr30kygasr36w9c7yv2n7";
+  fullHash = "sha256:0f42fp8z333b3k4pn8j0cp3480llvlygl5p6qfgywhq3g5hcpzpb";
+}
diff --git a/pkgs/applications/emulators/yuzu/early-access/update.sh b/pkgs/applications/emulators/yuzu/early-access/update.sh
new file mode 100755
index 000000000000..0e98185bbf9a
--- /dev/null
+++ b/pkgs/applications/emulators/yuzu/early-access/update.sh
@@ -0,0 +1,48 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p nix nix-prefetch-git gnutar curl jq unzip
+
+set -euo pipefail
+
+cd "$(dirname "$(readlink -f "$0")")"
+
+log() {
+    tput bold
+    echo "#" "$@"
+    tput sgr0
+}
+
+oldVersion="$(nix --experimental-features nix-command eval -f sources.nix --raw version)"
+newVersion="$(curl "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].tag_name' | cut -d"-" -f2)"
+
+if [ "$oldVersion" == "$newVersion" ]; then
+    log "Already up to date"
+    exit 0
+fi
+
+fetched="$(nix-prefetch-url --unpack --print-path "https://github.com/pineappleEA/pineapple-src/releases/download/EA-${newVersion}/Windows-Yuzu-EA-${newVersion}.zip")"
+
+eaDistHash="$(echo "${fetched}" | head -n1)"
+eaDist="$(echo "${fetched}" | tail -n1)"
+
+eaDistUnpacked="$(mktemp -d)"
+trap 'rm -rf "$eaDistUnpacked"' EXIT
+
+log "Unpacking dist..."
+tar xf "$eaDist"/*.tar.xz --directory="$eaDistUnpacked" --strip-components=1
+
+log "Rehydrating..."
+eaFullHash="$(nix-prefetch-git --fetch-submodules "$eaDistUnpacked" | jq -r '.sha256')"
+
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{
+  version = "$newVersion";
+  distHash = "sha256:$eaDistHash";
+  fullHash = "sha256:$eaFullHash";
+}
+EOF
+
+if [ "${COMMIT:-0}" == "1" ]; then
+    git commit -m "yuzu-ea: ${oldVersion} -> ${newVersion}" ./sources.nix
+fi
diff --git a/pkgs/applications/emulators/yuzu/generic.nix b/pkgs/applications/emulators/yuzu/mainline.nix
similarity index 77%
rename from pkgs/applications/emulators/yuzu/generic.nix
rename to pkgs/applications/emulators/yuzu/mainline.nix
index a24ded852531..6964f272553e 100644
--- a/pkgs/applications/emulators/yuzu/generic.nix
+++ b/pkgs/applications/emulators/yuzu/mainline.nix
@@ -1,21 +1,18 @@
-{ version
-, src
-, branch
-, compat-list
-
-, lib
+{ lib
 , stdenv
+, fetchFromGitHub
+, nix-update-script
 , wrapQtAppsHook
 , alsa-lib
 , boost
 , catch2_3
 , cmake
+, compat-list
 , cpp-jwt
 , cubeb
 , discord-rpc
 , doxygen
 , enet
-, fetchurl
 , ffmpeg
 , fmt
 , glslang
@@ -29,6 +26,7 @@
 , libzip
 , lz4
 , nlohmann_json
+, nx_tzdb
 , perl
 , pkg-config
 , python3
@@ -47,17 +45,17 @@
 , zlib
 , zstd
 }:
+stdenv.mkDerivation(finalAttrs: {
+  pname = "yuzu";
+  version = "1665";
 
-let
-  tzinfoVersion = "221202";
-  tzinfo = fetchurl {
-    url = "https://github.com/lat9nq/tzdb_to_nx/releases/download/${tzinfoVersion}/${tzinfoVersion}.zip";
-    hash = "sha256-mRzW+iIwrU1zsxHmf+0RArU8BShAoEMvCz+McXFFK3c=";
+  src = fetchFromGitHub {
+    owner = "yuzu-emu";
+    repo = "yuzu-mainline";
+    rev = "mainline-0-${finalAttrs.version}";
+    hash = "sha256-xzSup1oz83GPpOGh9aJJ5YjoFX/cBI8RV6SvDYNH/zA=";
+    fetchSubmodules = true;
   };
-in stdenv.mkDerivation {
-  pname = "yuzu-${branch}";
-
-  inherit version src;
 
   nativeBuildInputs = [
     cmake
@@ -69,6 +67,10 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [
+    # vulkan-headers must come first, so the older propagated versions
+    # don't get picked up by accident
+    vulkan-headers
+
     alsa-lib
     boost
     catch2_3
@@ -101,7 +103,6 @@ in stdenv.mkDerivation {
     sndio
     speexdsp
     udev
-    vulkan-headers
     # intentionally omitted: xbyak - prefer vendored version for compatibility
     zlib
     zstd
@@ -120,6 +121,8 @@ in stdenv.mkDerivation {
     "-DENABLE_QT_TRANSLATION=ON"
 
     # use system libraries
+    # NB: "external" here means "from the externals/ directory in the source",
+    # so "off" means "use system"
     "-DYUZU_USE_EXTERNAL_SDL2=OFF"
     "-DYUZU_USE_EXTERNAL_VULKAN_HEADERS=OFF"
 
@@ -145,13 +148,13 @@ in stdenv.mkDerivation {
   preConfigure = ''
     # see https://github.com/NixOS/nixpkgs/issues/114044, setting this through cmakeFlags does not work.
     cmakeFlagsArray+=(
-      "-DTITLE_BAR_FORMAT_IDLE=yuzu | ${branch} ${version} (nixpkgs) {}"
-      "-DTITLE_BAR_FORMAT_RUNNING=yuzu | ${branch} ${version} (nixpkgs) | {}"
+      "-DTITLE_BAR_FORMAT_IDLE=${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) {}"
+      "-DTITLE_BAR_FORMAT_RUNNING=${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) | {}"
     )
 
     # provide pre-downloaded tz data
     mkdir -p build/externals/nx_tzdb
-    ln -sf ${tzinfo} build/externals/nx_tzdb/${tzinfoVersion}.zip
+    ln -sf ${nx_tzdb} build/externals/nx_tzdb/${nx_tzdb.version}.zip
   '';
 
   # This must be done after cmake finishes as it overwrites the file
@@ -159,12 +162,14 @@ in stdenv.mkDerivation {
     ln -sf ${compat-list} ./dist/compatibility_list/compatibility_list.json
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex" "mainline-0-(.*)" ];
+  };
 
   meta = with lib; {
     homepage = "https://yuzu-emu.org";
     changelog = "https://yuzu-emu.org/entry";
-    description = "The ${branch} branch of an experimental Nintendo Switch emulator written in C++";
+    description = "An experimental Nintendo Switch emulator written in C++";
     longDescription = ''
       An experimental Nintendo Switch emulator written in C++.
       Using the mainline branch is recommended for general usage.
@@ -185,4 +190,4 @@ in stdenv.mkDerivation {
       k900
     ];
   };
-}
+})
diff --git a/pkgs/applications/emulators/yuzu/nx_tzdb.nix b/pkgs/applications/emulators/yuzu/nx_tzdb.nix
new file mode 100644
index 000000000000..faca41e24737
--- /dev/null
+++ b/pkgs/applications/emulators/yuzu/nx_tzdb.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchurl, gitUpdater }:
+stdenv.mkDerivation rec {
+  pname = "nx_tzdb";
+  version = "221202";
+
+  src = fetchurl {
+    url = "https://github.com/lat9nq/tzdb_to_nx/releases/download/${version}/${version}.zip";
+    hash = "sha256-mRzW+iIwrU1zsxHmf+0RArU8BShAoEMvCz+McXFFK3c=";
+  };
+
+  dontUnpack = true;
+
+  buildCommand = ''
+    cp $src $out
+  '';
+
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/lat9nq/tzdb_to_nx.git";
+  };
+}
diff --git a/pkgs/applications/emulators/yuzu/sources.nix b/pkgs/applications/emulators/yuzu/sources.nix
deleted file mode 100644
index 4952c74ac4b4..000000000000
--- a/pkgs/applications/emulators/yuzu/sources.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-# Generated by ./update.sh - do not update manually!
-# Last updated: 2023-12-14
-{
-  compatList = {
-    rev = "fc974b6e78105774dae5f68e712a6beb51b9db1e";
-    hash = "sha256:1hdsza3wf9a0yvj6h55gsl7xqvhafvbz1i8paz9kg7l49b0gnlh1";
-  };
-
-  mainline = {
-    version = "1651";
-    hash = "sha256:00cxyh3d18k17g982yqcbaq4b6bgs4kji0yz6i15h066aj15dimy";
-  };
-
-  ea = {
-    version = "4019";
-    distHash = "sha256:1qd953bl216yxmaa6y0iil6pn2pn53k87qwagbmcd4l5h4aaqi7h";
-    fullHash = "sha256:0na96hqfdd40q6drrlgak4qdsxs3wfizxhb8kf8qrbai3qfpx00v";
-  };
-}
diff --git a/pkgs/applications/emulators/yuzu/update.sh b/pkgs/applications/emulators/yuzu/update.sh
deleted file mode 100755
index ad34bfee3d6b..000000000000
--- a/pkgs/applications/emulators/yuzu/update.sh
+++ /dev/null
@@ -1,66 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix nix-prefetch-git gnutar curl jq unzip
-
-set -euo pipefail
-
-cd "$(dirname "$(readlink -f "$0")")"
-
-log() {
-    tput bold
-    echo "#" "$@"
-    tput sgr0
-}
-
-alias curl='curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"}'
-
-log "Updating compatibility list..."
-compatListRev="$(curl "https://api.github.com/repos/flathub/org.yuzu_emu.yuzu/commits/master" | jq -r '.sha')"
-
-log "Downloading rev: ${compatListRev}"
-compatListHash="$(nix-prefetch-url "https://raw.githubusercontent.com/flathub/org.yuzu_emu.yuzu/${compatListRev}/compatibility_list.json")"
-
-log "Updating mainline..."
-mainlineVersion="$(curl "https://api.github.com/repos/yuzu-emu/yuzu-mainline/releases?per_page=1" | jq -r '.[0].name' | cut -d" " -f2)"
-
-log "Downloading version: ${mainlineVersion}"
-mainlineHash="$(nix-prefetch-git --fetch-submodules --rev "mainline-0-${mainlineVersion}" "https://github.com/yuzu-emu/yuzu-mainline" | jq -r '.sha256')"
-
-log "Updating early access..."
-eaVersion="$(curl "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].tag_name' | cut -d"-" -f2)"
-
-log "Downloading dist version: ${eaVersion}"
-fetched="$(nix-prefetch-url --unpack --print-path "https://github.com/pineappleEA/pineapple-src/releases/download/EA-${eaVersion}/Windows-Yuzu-EA-${eaVersion}.zip")"
-
-eaDistHash="$(echo "${fetched}" | head -n1)"
-eaDist="$(echo "${fetched}" | tail -n1)"
-
-eaDistUnpacked="$(mktemp -d)"
-trap 'rm -rf "$eaDistUnpacked"' EXIT
-
-log "Unpacking dist..."
-tar xf "$eaDist"/*.tar.xz --directory="$eaDistUnpacked" --strip-components=1
-
-log "Rehydrating..."
-eaFullHash="$(nix-prefetch-git --fetch-submodules "$eaDistUnpacked" | jq -r '.sha256')"
-
-cat >sources.nix <<EOF
-# Generated by ./update.sh - do not update manually!
-# Last updated: $(date +%F)
-{
-  compatList = {
-    rev = "$compatListRev";
-    hash = "sha256:$compatListHash";
-  };
-
-  mainline = {
-    version = "$mainlineVersion";
-    hash = "sha256:$mainlineHash";
-  };
-
-  ea = {
-    version = "$eaVersion";
-    distHash = "sha256:$eaDistHash";
-    fullHash = "sha256:$eaFullHash";
-  };
-}
-EOF
diff --git a/pkgs/applications/misc/jiten/cookie-fix.patch b/pkgs/applications/misc/jiten/cookie-fix.patch
new file mode 100644
index 000000000000..0a67c8a4e5e9
--- /dev/null
+++ b/pkgs/applications/misc/jiten/cookie-fix.patch
@@ -0,0 +1,39 @@
+diff --git a/jiten/app.py b/jiten/app.py
+index 6d54020..f30a1d8 100644
+--- a/jiten/app.py
++++ b/jiten/app.py
+@@ -149,13 +149,22 @@ True
+ >>> d.index("JLPT N3") < d.index("歯", d.index("JLPT N5")) < d.index("JLPT N2")
+ True
+ 
+->>> sorted( (c.name, c.value) for c in client.cookie_jar )
++>>> def cookies():
++...   import importlib.metadata
++...   v = tuple(map(int, importlib.metadata.version("werkzeug").split(".")))
++...   if v < (2, 3):
++...     return sorted( (c.name, c.value) for c in client.cookie_jar )
++...   else:
++...     cookies = [ client.get_cookie(k) for k in PREFS ]
++...     return sorted( (c.key, c.value) for c in cookies if c is not None )
++
++>>> cookies()
+ []
+ >>> p = dict(dark = "yes", lang = "eng ger oops".split())
+ >>> r = client.post("/_save_prefs", data = p, follow_redirects = True)
+ >>> r.status
+ '200 OK'
+->>> sorted( (c.name, c.value) for c in client.cookie_jar )
++>>> cookies()
+ [('dark', 'yes'), ('lang', '"eng ger"'), ('large', 'no'), ('max', '50'), ('nogrid', 'no'), ('nor2h', 'no'), ('roma', 'no')]
+ 
+ """                                                             # }}}1
+@@ -168,8 +177,7 @@ import kanjidraw
+ import click, flask, jinja2, werkzeug
+ 
+ os.environ["FLASK_SKIP_DOTENV"] = "yes"                       #  FIXME
+-from flask import Flask, abort, escape, make_response, redirect, \
+-                  request, render_template, url_for
++from flask import Flask, abort, make_response, redirect, request, render_template, url_for
+ 
+ from .version import __version__, py_version
+ from .kana import kana2romaji
diff --git a/pkgs/applications/misc/jiten/default.nix b/pkgs/applications/misc/jiten/default.nix
index 7a3326bc8d9e..381e1a33718d 100644
--- a/pkgs/applications/misc/jiten/default.nix
+++ b/pkgs/applications/misc/jiten/default.nix
@@ -27,6 +27,12 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "16sz8i0sw7ggy6kijcx4qyl2zr6xj789x4iav0yyllx12dfgp5b1";
   };
 
+  patches = [
+    # Potentially can be dropped after the next release
+    # https://github.com/NixOS/nixpkgs/issues/271600
+    ./cookie-fix.patch
+  ];
+
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ pcre sqlite ];
   propagatedBuildInputs = with python3.pkgs; [ click flask kanjidraw ];
diff --git a/pkgs/applications/networking/browsers/misc/widevine-cdm.nix b/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
index b9ba40a2932e..0c8d8fb24edd 100644
--- a/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
+++ b/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "widevine-cdm";
-  version = "4.10.2557.0";
+  version = "4.10.2710.0";
 
   src = fetchzip {
     url = "https://dl.google.com/widevine-cdm/${version}-linux-x64.zip";
-    hash = "sha256-XxTjuPjWy06SmHC6GaIVIp3zD76isCVATWwwdZljntE=";
+    hash = "sha256-lGTrSzUk5FluH1o4E/9atLIabEpco3C3gZw+y6H6LJo=";
     stripRoot = false;
   };
 
diff --git a/pkgs/applications/networking/cluster/k9s/default.nix b/pkgs/applications/networking/cluster/k9s/default.nix
index 124431b8dfc4..b43e4c70b3ae 100644
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.30.4";
+  version = "0.30.6";
 
   src = fetchFromGitHub {
     owner = "derailed";
     repo = "k9s";
     rev = "v${version}";
-    hash = "sha256-P06hKqVu/aUttjwdFVCvzC80WWbQn94bXk3LVl/97yw=";
+    hash = "sha256-ro2gm3EYput9l0CCfSPeRB/mTtEXlGIcZ00H0pCtQi8=";
   };
 
   ldflags = [
diff --git a/pkgs/applications/video/mpv/scripts/buildLua.nix b/pkgs/applications/video/mpv/scripts/buildLua.nix
index 37690d987430..cb29a4c9d1a9 100644
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@@ -51,7 +51,7 @@ lib.makeOverridable (args: stdenvNoCC.mkDerivation (extendedBy
           exit 1
         }
         mkdir -p "${scriptsDir}"
-        cp -a "${scriptPath}" "${scriptsDir}/${lib.removeSuffix ".lua" scriptName}"
+        cp -a "${scriptPath}" "${scriptsDir}/${scriptName}"
       else
         install -m644 -Dt "${scriptsDir}" \
           ${escapedList ([ scriptPath ] ++ extraScripts)}
diff --git a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
index c164bae1495d..ec25801edd22 100644
--- a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
@@ -2,13 +2,13 @@
 
 buildLua rec {
   pname = "mpv-playlistmanager";
-  version = "unstable-2023-08-09";
+  version = "unstable-2023-11-28";
 
   src = fetchFromGitHub {
     owner = "jonniek";
     repo = "mpv-playlistmanager";
-    rev = "e479cbc7e83a07c5444f335cfda13793681bcbd8";
-    sha256 = "sha256-Nh4g8uSkHWPjwl5wyqWtM+DW9fkEbmCcOsZa4eAF6Cs=";
+    rev = "579490c7ae1becc129736b7632deec4f3fb90b99";
+    hash = "sha256-swOtoB8UV/HPTpQRGXswAfUYsyC2Nj/QRIkGP8X1jk0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/he/hercules/package.nix b/pkgs/by-name/he/hercules/package.nix
new file mode 100644
index 000000000000..080d3a849beb
--- /dev/null
+++ b/pkgs/by-name/he/hercules/package.nix
@@ -0,0 +1,153 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, runCommand
+, libtool
+, cmake
+, zlib
+, bzip2
+, enableRexx ? stdenv.isLinux, regina
+}:
+let
+  herculesCpu =
+    if stdenv.hostPlatform.isx86 then "x86"
+    else stdenv.hostPlatform.qemuArch;
+  herculesBits = if stdenv.hostPlatform.is32bit then "32" else "64";
+
+  herculesLibDir =
+    if stdenv.hostPlatform.isx86 then "lib"
+    else "lib/${herculesCpu}";
+
+  mkExtPkg = depName: attrFn: (stdenv.mkDerivation {
+    pname = "hercules-${depName}";
+
+    postPatch = ''
+      patchShebangs build
+      sed -i build \
+        -e "s%_tool=.*$%_tool=${cmake}/bin/cmake%" \
+        -e "s/CPUS=.*$/CPUS=$NIX_BUILD_CORES/"
+    '';
+
+    dontUseCmakeConfigure = true;
+
+    buildPhase = ''
+      mkdir ../build $out
+      # In source builds are not allowed.
+      cd ../build
+      ../source/build \
+        --pkgname ${depName} \
+        --cpu ${herculesCpu} \
+        --arch ${herculesBits} \
+        --install "$out"
+    '';
+
+    nativeBuildInputs = [ cmake ];
+
+    enableParallelBuilding = true;
+
+    meta = with lib; {
+      description = "Hercules ${depName} library";
+      license = lib.licenses.free; # Mixture of Public Domain, ICU (MIT compatible) and others
+      maintainers = with maintainers; [ anna328p vifino ];
+    };
+  }).overrideAttrs (default: attrFn default);
+
+
+  crypto = mkExtPkg "crypto" (default: {
+    version = "1.0.0";
+    src = fetchFromGitHub {
+      owner = "SDL-Hercules-390";
+      repo = "crypto";
+      rev = "a5096e5dd79f46b568806240c0824cd8cb2fcda2";
+      hash = "sha256-VWjM8WxPMynyW49Z8U/r6SsF7u7Xbk7Dd0gR35lIw28=";
+    };
+  });
+
+  decNumber = mkExtPkg "decNumber" (default: {
+    version = "3.68.0";
+    src = fetchFromGitHub {
+      owner = "SDL-Hercules-390";
+      repo = "decNumber";
+      rev = "3aa2f4531b5fcbd0478ecbaf72ccc47079c67280";
+      hash = "sha256-PfPhnYUSIw1sYiGRM3iHRTbHHbQ+sK7oO12pH/yt+MQ=";
+    };
+  });
+
+  softFloat = mkExtPkg "SoftFloat" (default: {
+    version = "3.5.0";
+    src = fetchFromGitHub {
+      owner = "SDL-Hercules-390";
+      repo = "SoftFloat";
+      rev = "4b0c326008e174610969c92e69178939ed80653d";
+      hash = "sha256-DEIT5Xk6IqUXCIGD2Wj0h9xPOR0Mid2Das7aKMQMDaM=";
+    };
+  });
+
+  telnet = mkExtPkg "telnet" (default: {
+    version = "1.0.0";
+    src = fetchFromGitHub {
+      owner = "SDL-Hercules-390";
+      repo = "telnet";
+      rev = "729f0b688c1426018112c1e509f207fb5f266efa";
+      hash = "sha256-ED0Cl+VcK6yl59ShgJBZKy25oAFC8eji36pNLwMxTM0=";
+    };
+  });
+
+  extpkgs = runCommand "hercules-extpkgs" {} ''
+    OUTINC="$out/include"
+    OUTLIB="$out/${herculesLibDir}"
+    mkdir -p "$OUTINC" "$OUTLIB"
+    for dep in "${crypto}" "${decNumber}" "${softFloat}" "${telnet}"; do
+      ln -s $dep/include/* "$OUTINC"
+      ln -s $dep/${herculesLibDir}/* "$OUTLIB"
+    done
+  '';
+in
+stdenv.mkDerivation rec {
+  pname = "hercules";
+  version = "4.6";
+
+  src = fetchFromGitHub {
+    owner = "SDL-Hercules-390";
+    repo = "hyperion";
+    rev = "Release_${version}";
+    hash = "sha256-ZhMTun6tmTsmIiFPTRFudwRXzWydrih61RsLyv0p24U=";
+  };
+
+  postPatch = ''
+    patchShebangs _dynamic_version
+  '';
+
+  nativeBuildInputs = [ libtool ];
+  buildInputs = [
+    (lib.getOutput "lib" libtool)
+    zlib
+    bzip2
+    extpkgs
+  ] ++ lib.optionals enableRexx [
+    regina
+  ];
+
+  configureFlags = [
+    "--enable-extpkgs=${extpkgs}"
+    "--without-included-ltdl"
+    "--enable-ipv6"
+    "--enable-cckd-bzip2"
+    "--enable-het-bzip2"
+  ] ++ lib.optionals enableRexx [
+    "--enable-regina-rexx"
+  ];
+
+  meta = with lib; {
+    homepage = "https://sdl-hercules-390.github.io/html/";
+    description = "IBM mainframe emulator";
+    longDescription = ''
+      Hercules is an open source software implementation of the mainframe
+      System/370 and ESA/390 architectures, in addition to the latest 64-bit
+      z/Architecture. Hercules runs under Linux, Windows, Solaris, FreeBSD, and
+      Mac OS X.
+    '';
+    license = licenses.qpl;
+    maintainers = with maintainers; [ anna328p vifino ];
+  };
+}
diff --git a/pkgs/by-name/mc/mcfly-fzf/package.nix b/pkgs/by-name/mc/mcfly-fzf/package.nix
new file mode 100644
index 000000000000..b7099c96e527
--- /dev/null
+++ b/pkgs/by-name/mc/mcfly-fzf/package.nix
@@ -0,0 +1,29 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "mcfly-fzf";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "bnprks";
+    repo = "mcfly-fzf";
+    rev = version;
+    hash = "sha256-3QxiG9MR0BCKRjA8ue/Yb/AZ5SwiSdjn6qaOxSAK0SI=";
+  };
+
+  postPatch = ''
+    substituteInPlace shell/mcfly-fzf.bash --replace '$(command -v mcfly-fzf)' '${placeholder "out"}/bin/mcfly-fzf'
+    substituteInPlace shell/mcfly-fzf.zsh --replace '$(command -v mcfly-fzf)' '${placeholder "out"}/bin/mcfly-fzf'
+    substituteInPlace shell/mcfly-fzf.fish --replace '(command -v mcfly-fzf)' '${placeholder "out"}/bin/mcfly-fzf'
+  '';
+
+  cargoHash = "sha256-pR5Fni/8iJuaDyWKrOnSanO50hvFXh73Qlgmd4a3Ucs=";
+
+  meta = with lib; {
+    homepage = "https://github.com/bnprks/mcfly-fzf";
+    description = "Integrate Mcfly with fzf to combine a solid command history database with a widely-loved fuzzy search UI";
+    license = licenses.mit;
+    maintainers = [ maintainers.simonhammes ];
+    mainProgram = "mcfly-fzf";
+  };
+}
diff --git a/pkgs/by-name/qs/qspeakers/package.nix b/pkgs/by-name/qs/qspeakers/package.nix
new file mode 100644
index 000000000000..ffee7775154f
--- /dev/null
+++ b/pkgs/by-name/qs/qspeakers/package.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libsForQt5
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qspeakers";
+  version = "1.6.9";
+
+  src = fetchFromGitHub {
+    owner = "be1";
+    repo = "qspeakers";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-V4rcDUJU27ijzsc6zhsEiQ/7SdvHmGR2402iIazrMfE=";
+  };
+
+  nativeBuildInputs = [
+    libsForQt5.qmake
+    libsForQt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libsForQt5.qtcharts
+    libsForQt5.qttools
+  ];
+
+  meta = {
+    description = "A loudspeaker enclosure designer";
+    homepage = "https://github.com/be1/qspeakers";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "qspeakers";
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+})
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
new file mode 100644
index 000000000000..b94692a119ac
--- /dev/null
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -0,0 +1,16 @@
+{ renode
+, fetchurl
+, buildUnstable ? true
+}:
+
+(renode.override {
+  inherit buildUnstable;
+}).overrideAttrs (finalAttrs: _: {
+  pname = "renode-unstable";
+  version = "1.14.0+20231229gita76dac0ae";
+
+  src = fetchurl {
+    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
+    hash = "sha256-fvwNN3sT8VZ7XJPrfpAbjSiuAB274QhuPeekwz0AU3c=";
+  };
+})
diff --git a/pkgs/by-name/re/renode/package.nix b/pkgs/by-name/re/renode/package.nix
new file mode 100644
index 000000000000..33646daac8c5
--- /dev/null
+++ b/pkgs/by-name/re/renode/package.nix
@@ -0,0 +1,103 @@
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, makeWrapper
+, writeScript
+, glibcLocales
+, python3Packages
+, gtk-sharp-2_0
+, gtk2-x11
+, screen
+, buildUnstable ? false
+}:
+
+let
+  pythonLibs = with python3Packages; makePythonPath [
+    construct
+    psutil
+    pyyaml
+    requests
+    robotframework
+  ];
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "renode";
+  version = "1.14.0";
+
+  src = fetchurl {
+    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
+    hash = "sha256-1wfVHtCYc99ACz8m2XEg1R0nIDh9xP4ffV/vxeeEHxE=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  propagatedBuildInputs = [
+    gtk2-x11
+    gtk-sharp-2_0
+    screen
+  ];
+
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,libexec/renode}
+
+    mv * $out/libexec/renode
+    mv .renode-root $out/libexec/renode
+    chmod +x $out/libexec/renode/*.so
+
+    makeWrapper "$out/libexec/renode/renode" "$out/bin/renode" \
+      --prefix PATH : "$out/libexec/renode" \
+      --suffix LD_LIBRARY_PATH : "${gtk2-x11}/lib" \
+      --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
+
+    makeWrapper "$out/libexec/renode/renode-test" "$out/bin/renode-test" \
+      --prefix PATH : "$out/libexec/renode" \
+      --prefix PYTHONPATH : "${pythonLibs}" \
+      --suffix LD_LIBRARY_PATH : "${gtk2-x11}/lib" \
+      --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
+
+    substituteInPlace "$out/libexec/renode/renode-test" \
+      --replace '$PYTHON_RUNNER' '${python3Packages.python}/bin/python3'
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript =
+    let
+      versionRegex =
+        if buildUnstable
+        then "[0-9\.\+]+[^\+]*."
+        else "[0-9\.]+[^\+]*.";
+    in
+    writeScript "${finalAttrs.pname}-updater" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts curl gnugrep gnused pup
+
+      latestVersion=$(
+        curl -sS https://builds.renode.io \
+          | pup 'a text{}' \
+          | egrep 'renode-${versionRegex}\.linux-portable\.tar\.gz' \
+          | head -n1 \
+          | sed -e 's,renode-\(.*\)\.linux-portable\.tar\.gz,\1,g'
+      )
+
+      update-source-version ${finalAttrs.pname} "$latestVersion" \
+        --file=pkgs/by-name/re/${finalAttrs.pname}/package.nix \
+        --system=x86_64-linux
+    '';
+
+  meta = {
+    description = "Virtual development framework for complex embedded systems";
+    homepage = "https://renode.org";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ otavio ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index 7e7f19c56667..fe3b23323c63 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -21,9 +21,9 @@
 let unwrapped = mkXfceDerivation {
   category = "xfce";
   pname = "thunar";
-  version = "4.18.9";
+  version = "4.18.10";
 
-  sha256 = "sha256-FiJAxELdt/1g5ThTBshTSFK54f9Ncqhn/C+rWQ+zrig=";
+  sha256 = "sha256-jne+jETPmM6VksdwJAxruji/GKH42iftWm74Ok9qX44=";
 
   nativeBuildInputs = [
     docbook_xsl
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 630b5f5193fb..c80af02c32a7 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clojure";
-  version = "1.11.1.1429";
+  version = "1.11.1.1435";
 
   src = fetchurl {
     # https://github.com/clojure/brew-install/releases
     url = "https://github.com/clojure/brew-install/releases/download/${finalAttrs.version}/clojure-tools-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ov3s1qPGHfPGAPtgwAqPG+hU6R5nGMA7ucg8QVpquC4=";
+    hash = "sha256-RS/FebIED8RYYXRXBKXZPRROO0HqyDo0zhb+p4Q5m8A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libre/default.nix b/pkgs/development/libraries/libre/default.nix
index f45404e2c1f3..8e3b37c7635a 100644
--- a/pkgs/development/libraries/libre/default.nix
+++ b/pkgs/development/libraries/libre/default.nix
@@ -8,13 +8,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.7.0";
+  version = "3.8.0";
   pname = "libre";
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "re";
     rev = "v${version}";
-    sha256 = "sha256-7wNzYp6o3+71Jz/VuDWyVOj+OrAkDyDG0NWryYwuIT4=";
+    sha256 = "sha256-zKoK5GsgNnmQrEZ5HAse2e1Gy7fPO42DEvVAL5ZTNhc=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/php-packages/grpc/default.nix b/pkgs/development/php-packages/grpc/default.nix
index d3bae3ea9c76..e70432f37ee8 100644
--- a/pkgs/development/php-packages/grpc/default.nix
+++ b/pkgs/development/php-packages/grpc/default.nix
@@ -1,18 +1,24 @@
 { buildPecl
-, zlib
+, pkg-config
 , lib
+, grpc
 }:
 
 buildPecl {
   pname = "grpc";
-  version = "1.56.0";
+  inherit (grpc) version src;
 
-  sha256 = "sha256-uzxYMUzExMBDtwv3FipOuuUHg0v1wqAUtn69jXAQnf4=";
+  sourceRoot = "${grpc.src.name}/src/php/ext/grpc";
+
+  patches = [
+    ./use-pkgconfig.patch # https://github.com/grpc/grpc/pull/35404
+    ./skip-darwin-test.patch # https://github.com/grpc/grpc/pull/35403
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ grpc ];
 
   doCheck = true;
-  checkTarget = "test";
-
-  nativeBuildInputs = [ zlib ];
 
   meta = {
     description = "A high performance, open source, general RPC framework that puts mobile and HTTP/2 first.";
diff --git a/pkgs/development/php-packages/grpc/skip-darwin-test.patch b/pkgs/development/php-packages/grpc/skip-darwin-test.patch
new file mode 100644
index 000000000000..e6c5fb34a669
--- /dev/null
+++ b/pkgs/development/php-packages/grpc/skip-darwin-test.patch
@@ -0,0 +1,22 @@
+From b1fa212d0bc29dcc72107ad67fb99d4ef573942a Mon Sep 17 00:00:00 2001
+From: Shyim <github@shyim.de>
+Date: Thu, 28 Dec 2023 10:28:21 +0100
+Subject: [PATCH] php: skip epoll1 test on darwin
+
+---
+ tests/grpc-set-ini.phpt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/grpc-set-ini.phpt b/tests/grpc-set-ini.phpt
+index 55c18ee526e24..b39348ea2e685 100644
+--- a/tests/grpc-set-ini.phpt
++++ b/tests/grpc-set-ini.phpt
+@@ -1,7 +1,7 @@
+ --TEST--
+ Ensure ini settings are handled
+ --SKIPIF--
+-<?php if (!extension_loaded("grpc")) print "skip"; ?>
++<?php if (!extension_loaded("grpc") || PHP_OS === "Darwin") print "skip"; ?>
+ --INI--
+ grpc.enable_fork_support = 1
+ grpc.poll_strategy = epoll1
\ No newline at end of file
diff --git a/pkgs/development/php-packages/grpc/use-pkgconfig.patch b/pkgs/development/php-packages/grpc/use-pkgconfig.patch
new file mode 100644
index 000000000000..628f54abb305
--- /dev/null
+++ b/pkgs/development/php-packages/grpc/use-pkgconfig.patch
@@ -0,0 +1,82 @@
+From 24b4e273bd503760a485e92ca418e4699767ec51 Mon Sep 17 00:00:00 2001
+From: Shyim <github@shyim.de>
+Date: Thu, 28 Dec 2023 10:38:42 +0100
+Subject: [PATCH] [php]: add with-grpc-dir to configure and add pkg-config
+ support
+
+---
+ config.m4 | 48 +++++++++++++++++++++++++-------------
+ 1 file changed, 32 insertions(+), 16 deletions(-)
+
+diff --git a/config.m4 b/config.m4
+index 5600df34ccfa3..c2186a41d21f5 100755
+--- a/config.m4
++++ b/config.m4
+@@ -7,35 +7,51 @@ PHP_ARG_ENABLE(coverage, whether to include code coverage symbols,
+ PHP_ARG_ENABLE(tests, whether to compile helper methods for tests,
+ [  --enable-tests          Enable tests methods], no, no)
+ 
++PHP_ARG_WITH(grpc-dir,	for grpc,
++[	--with-grpc-dir[=DIR]	 Set the path to grpc install prefix.], yes)
++
+ dnl Check whether to enable tests
+ if test "$PHP_TESTS" != "no"; then
+   CPPFLAGS="$CPPFLAGS -DGRPC_PHP_DEBUG"
+ fi
+ 
+ if test "$PHP_GRPC" != "no"; then
+-  dnl Write more examples of tests here...
+-
+-  dnl # --with-grpc -> check with-path
+-  SEARCH_PATH="/usr/local /usr"     # you might want to change this
+-  SEARCH_FOR="include/grpc/grpc.h"  # you most likely want to change this
+-  if test -r $PHP_GRPC/$SEARCH_FOR; then # path given as parameter
+-    GRPC_DIR=$PHP_GRPC
+-  else # search default path list
++  AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
++
++  if test "$PHP_GRPC_DIR" = "yes" -a -x $PKG_CONFIG; then
++    AC_MSG_CHECKING([for grpc using pkg-config])
++
++    if ! $PKG_CONFIG --exists grpc ; then
++			AC_MSG_ERROR([grpc not found])
++		fi
++
++    GRPC_VERSION=`$PKG_CONFIG grpc --modversion`
++		AC_MSG_RESULT([found version $GRPC_VERSION])
++
++    PHP_GRPC_LIBS=`$PKG_CONFIG grpc --libs`
++		PHP_GRPC_INCS=`$PKG_CONFIG grpc --cflags`
++
++    PHP_EVAL_LIBLINE($PHP_GRPC_LIBS, AMQP_SHARED_LIBADD)
++    PHP_EVAL_INCLINE($PHP_GRPC_INCS)
++  else
+     AC_MSG_CHECKING([for grpc files in default path])
++
++    SEARCH_PATH="$PHP_GRPC_DIR /usr/local /usr"
++
+     for i in $SEARCH_PATH ; do
+-      if test -r $i/$SEARCH_FOR; then
++      if test -r $i/include/grpc/grpc.h; then
+         GRPC_DIR=$i
+         AC_MSG_RESULT(found in $i)
+       fi
+     done
+-  fi
+-  if test -z "$GRPC_DIR"; then
+-    AC_MSG_RESULT([not found])
+-    AC_MSG_ERROR([Please reinstall the grpc distribution])
+-  fi
+ 
+-  dnl # --with-grpc -> add include path
+-  PHP_ADD_INCLUDE($GRPC_DIR/include)
++    if test -z "$GRPC_DIR"; then
++      AC_MSG_RESULT([not found])
++      AC_MSG_ERROR([Please reinstall the grpc distribution])
++    fi
++
++    PHP_ADD_INCLUDE($GRPC_DIR/include)
++  fi
+ 
+   LIBS="-lpthread $LIBS"
+ 
diff --git a/pkgs/development/python-modules/apkinspector/default.nix b/pkgs/development/python-modules/apkinspector/default.nix
new file mode 100644
index 000000000000..6daf9868a4a4
--- /dev/null
+++ b/pkgs/development/python-modules/apkinspector/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "apkinspector";
+  version = "1.2.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-bB/WeCRnYOdfg4bm9Nloa2QMxr2IJW8IZd+svUno4N0=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  # Tests are not available
+  # https://github.com/erev0s/apkInspector/issues/21
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "apkInspector"
+  ];
+
+  meta = with lib; {
+    description = "Module designed to provide detailed insights into the zip structure of APK files";
+    homepage = "https://github.com/erev0s/apkInspector";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index 0acc3cb4589f..c6eaaab35a78 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.83";
+  version = "0.2.84";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = pname;
     rev = version;
-    hash = "sha256-tpncBgKUf2jRmvcHgi2fudTGdCEv0AhHUWD1sPO98/I=";
+    hash = "sha256-aSFnDLzJCZjHX6m/iZKC5F5kY7JXRZp0//jY8kkjC3I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/datetime/default.nix b/pkgs/development/python-modules/datetime/default.nix
index 173431c924da..98b33ecf7fd3 100644
--- a/pkgs/development/python-modules/datetime/default.nix
+++ b/pkgs/development/python-modules/datetime/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "datetime";
-  version = "5.2";
+  version = "5.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "zopefoundation";
     repo = "datetime";
     rev = "refs/tags/${version}";
-    hash = "sha256-J96IjyPyJaUC5mECK3g/cgxBh1OoVfj62XocBatYgOw=";
+    hash = "sha256-k4q9n3uikz+B9CUyqQTgl61OTKDWMsyhAt2gB1HWGRw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-reversion/default.nix b/pkgs/development/python-modules/django-reversion/default.nix
index cb0119bb7d50..7eaa9c3a7189 100644
--- a/pkgs/development/python-modules/django-reversion/default.nix
+++ b/pkgs/development/python-modules/django-reversion/default.nix
@@ -3,20 +3,25 @@
 , fetchPypi
 , django
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "django-reversion";
-  version = "5.0.8";
-  format = "setuptools";
+  version = "5.0.10";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
 src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RdN4vG5gbfayrQB3rsiwoA418Yx0yioa6cwmLOsy+5o=";
+    hash = "sha256-wYdJpnwdtBZ8yszDY5XF/mB48xKGloPC89IUBR5aayk=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     django
   ];
diff --git a/pkgs/development/python-modules/eiswarnung/default.nix b/pkgs/development/python-modules/eiswarnung/default.nix
index ccd2b849570c..c4a3cf9339cb 100644
--- a/pkgs/development/python-modules/eiswarnung/default.nix
+++ b/pkgs/development/python-modules/eiswarnung/default.nix
@@ -13,23 +13,25 @@
 
 buildPythonPackage rec {
   pname = "eiswarnung";
-  version = "1.2.0";
+  version = "2.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "klaasnicolaas";
     repo = "python-eiswarnung";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PVFAy34+UfNQNdzVdfvNiySrCTaKGuepnTINZYkOsuo=";
+    hash = "sha256-/61qrRfD7/gaEcvFot34HYXOVLWwTDi/fvcgHDTv9u0=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace '"0.0.0"' '"${version}"' \
       --replace 'addopts = "--cov"' "" \
-      --replace 'pytz = "^2022.7.1"' 'pytz = "*"'
+      --replace 'pytz = ">=2022.7.1,<2024.0.0"' 'pytz = "*"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/empy/default.nix b/pkgs/development/python-modules/empy/default.nix
index 1765fd4ff60b..ffae39669ad4 100644
--- a/pkgs/development/python-modules/empy/default.nix
+++ b/pkgs/development/python-modules/empy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "empy";
-  version = "4.0";
+  version = "4.0.1";
   format = "setuptools";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JNmmKyN+G1+c7Lqw6Ta/9zVAJS0R6sb95/62OxSHuOM=";
+    sha256 = "sha256-YjI3uYzWQ75eILrWJ1zJM//nz3ZFI5Lx0ybXZywqvWQ=";
   };
   pythonImportsCheck = [ "em" ];
   meta = with lib; {
diff --git a/pkgs/development/python-modules/langchainplus-sdk/default.nix b/pkgs/development/python-modules/langchainplus-sdk/default.nix
deleted file mode 100644
index 8747c0a8d9e8..000000000000
--- a/pkgs/development/python-modules/langchainplus-sdk/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, poetry-core
-, pydantic
-, pythonOlder
-, requests
-, tenacity
-}:
-
-buildPythonPackage rec {
-  pname = "langchainplus-sdk";
-  version = "0.0.21";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.8";
-
-  src = fetchPypi {
-    inherit version;
-    pname = "langchainplus_sdk";
-    hash = "sha256-frjZnQnOe6IHKrQk+Q/xMc5Akb+eBQ/eBzP545Fq6Xk=";
-  };
-
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
-  propagatedBuildInputs = [
-    pydantic
-    requests
-    tenacity
-  ];
-
-  # upstrem has no tests
-  doCheck = false;
-
-  pythonImportsCheck = [
-    "langchainplus_sdk"
-  ];
-
-  meta = {
-    description = "Client library to connect to the LangChainPlus LLM Tracing and Evaluation Platform";
-    homepage = "https://pypi.org/project/langchainplus-sdk/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ natsukium ];
-  };
-}
diff --git a/pkgs/development/python-modules/pylatex/default.nix b/pkgs/development/python-modules/pylatex/default.nix
new file mode 100644
index 000000000000..44926587aa33
--- /dev/null
+++ b/pkgs/development/python-modules/pylatex/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, ordered-set
+, pytestCheckHook
+, matplotlib
+, quantities
+, texlive
+}:
+
+buildPythonPackage rec {
+  pname = "pylatex";
+  version = "1.4.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "JelteF";
+    repo = "PyLaTeX";
+    rev = "v${version}";
+    hash = "sha256-gZKMYGMp7bzDY5+Xx9h1AFP4l0Zd936fDfSXyW5lY1k=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [ ordered-set ];
+
+  pythonImportsCheck = [
+    "pylatex"
+    "pylatex.base_classes"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    matplotlib
+    quantities
+    (texlive.combine { inherit (texlive)
+      scheme-small
+      lastpage
+      collection-fontsrecommended
+    ;})
+  ];
+
+  meta = with lib; {
+    description = "A Python library for creating LaTeX files and snippets";
+    homepage = "https://jeltef.github.io/PyLaTeX/current/";
+    downloadPage = "https://github.com/JelteF/PyLaTeX/releases";
+    changelog = "https://jeltef.github.io/PyLaTeX/current/changelog.html";
+    license = licenses.mit;
+    maintainers = with maintainers; [ MayNiklas ];
+  };
+}
diff --git a/pkgs/development/python-modules/scikit-build-core/default.nix b/pkgs/development/python-modules/scikit-build-core/default.nix
index 07dd52200143..fb218491c770 100644
--- a/pkgs/development/python-modules/scikit-build-core/default.nix
+++ b/pkgs/development/python-modules/scikit-build-core/default.nix
@@ -16,13 +16,14 @@
 , pytestCheckHook
 , setuptools
 , tomli
+, virtualenv
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "scikit-build-core";
   version = "0.7.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "scikit_build_core";
@@ -30,10 +31,9 @@ buildPythonPackage rec {
     hash = "sha256-hffyRpxWjGzjWrL6Uv4tJqBODeUH06JMGrtyg3Vlf9M=";
   };
 
-  postPatch = ''
+  postPatch = lib.optionalString (pythonOlder "3.11") ''
     substituteInPlace pyproject.toml \
-      --replace 'minversion = "7.2"' "" \
-      --replace '"error",' '"error", "ignore::DeprecationWarning", "ignore::UserWarning",'
+      --replace '"error",' '"error", "ignore::UserWarning",'
   '';
 
   nativeBuildInputs = [
@@ -65,6 +65,7 @@ buildPythonPackage rec {
     pytest-subprocess
     pytestCheckHook
     setuptools
+    virtualenv
     wheel
   ] ++ passthru.optional-dependencies.pyproject;
 
@@ -76,6 +77,8 @@ buildPythonPackage rec {
     "tests/test_pyproject_pep660.py"
     "tests/test_setuptools_pep517.py"
     "tests/test_setuptools_pep518.py"
+    # store permissions issue in Nix:
+    "tests/test_editable.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/textual-dev/default.nix b/pkgs/development/python-modules/textual-dev/default.nix
index 16b77ffabc47..ad1e3f0279b3 100644
--- a/pkgs/development/python-modules/textual-dev/default.nix
+++ b/pkgs/development/python-modules/textual-dev/default.nix
@@ -15,17 +15,16 @@
 
 buildPythonPackage rec {
   pname = "textual-dev";
-  version = "1.2.1";
+  version = "1.3.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "Textualize";
     repo = "textual-dev";
-    # we use rev instead of tag since upstream doesn't use tags
-    rev = "6afa9013a42cb18e9105e49d6a56874097f7c812";
-    hash = "sha256-ef35389ZMU/zih7Se3KkMGECf5o2i5y6up64/1AECas=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-66LcU9xXNWzoYV7ykbbKGO3/0URDu/GN2dmtxu1joqw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/virt-firmware/default.nix b/pkgs/development/python-modules/virt-firmware/default.nix
index aeaca734587d..77dbc45a1612 100644
--- a/pkgs/development/python-modules/virt-firmware/default.nix
+++ b/pkgs/development/python-modules/virt-firmware/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "virt-firmware";
-  version = "23.10";
+  version = "23.11";
 
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-orTIduS4KVH4nTSRcOnn2+Tqeyd4OMnnN2+AK5p1xtM=";
+    hash = "sha256-9HA87J01M9VGCHdcmdlA50AikXG8vYHDw/5ig8h9YXc=";
   };
 
   pythonImportsCheck = [ "virt.firmware.efi" ];
diff --git a/pkgs/development/python-modules/zope-exceptions/default.nix b/pkgs/development/python-modules/zope-exceptions/default.nix
new file mode 100644
index 000000000000..8146b2b2704b
--- /dev/null
+++ b/pkgs/development/python-modules/zope-exceptions/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools
+, zope_interface
+}:
+
+buildPythonPackage rec {
+  pname = "zope-exceptions";
+  version = "5.0.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    pname = "zope.exceptions";
+    inherit version;
+    hash = "sha256-MPxT5TOfX72dEzXg97afd/FePwbisXt/t++SXMJP3ZY=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [ zope_interface ];
+
+  # circular deps
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "zope.exceptions"
+  ];
+
+  meta = with lib; {
+    description = "Exception interfaces and implementations";
+    homepage = "https://pypi.python.org/pypi/zope.exceptions";
+    changelog = "https://github.com/zopefoundation/zope.exceptions/blob/${version}/CHANGES.rst";
+    license = licenses.zpl21;
+    maintainers = with maintainers; [ goibhniu ];
+  };
+
+}
diff --git a/pkgs/development/python-modules/zope_exceptions/default.nix b/pkgs/development/python-modules/zope_exceptions/default.nix
deleted file mode 100644
index 14c81f7924fa..000000000000
--- a/pkgs/development/python-modules/zope_exceptions/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, zope_interface
-}:
-
-buildPythonPackage rec {
-  pname = "zope.exceptions";
-  version = "4.6";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-YZ0kpMZb7Zez3QUV5zLoK2nxVdQsyUlV0b6MKCiGg80=";
-  };
-
-  propagatedBuildInputs = [ zope_interface ];
-
-  # circular deps
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Exception interfaces and implementations";
-    homepage = "https://pypi.python.org/pypi/zope.exceptions";
-    license = licenses.zpl20;
-    maintainers = with maintainers; [ goibhniu ];
-  };
-
-}
diff --git a/pkgs/development/python-modules/zope_testrunner/default.nix b/pkgs/development/python-modules/zope_testrunner/default.nix
index 2307494fcbde..f3a762e3a2c5 100644
--- a/pkgs/development/python-modules/zope_testrunner/default.nix
+++ b/pkgs/development/python-modules/zope_testrunner/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , zope_interface
-, zope_exceptions
+, zope-exceptions
 , zope-testing
 , six
 }:
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     hash = "sha256-1r1y9E6jLKpBW5bP4UFSsnhjF67xzW9IqCe2Le8Fj9Q=";
   };
 
-  propagatedBuildInputs = [ zope_interface zope_exceptions zope-testing six ];
+  propagatedBuildInputs = [ zope_interface zope-exceptions zope-testing six ];
 
   doCheck = false; # custom test modifies sys.path
 
diff --git a/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix b/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
index f28cb28ef373..46587028f296 100644
--- a/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
+++ b/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, fetchFromGitHub, pam, openssl, perl }:
+{ lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, pam, openssl, perl }:
 
 stdenv.mkDerivation rec {
   pname = "pam_ssh_agent_auth";
@@ -46,6 +46,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests.sudo = nixosTests.ssh-agent-auth;
+
   meta = {
     homepage = "https://github.com/jbeverly/pam_ssh_agent_auth";
     description = "PAM module for authentication through the SSH agent";
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index c9c1caff8018..eeb05dd4012e 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -22,11 +22,11 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2023.11.16";
+  version = "2023.12.30";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8Mza8S4IsVkCYBpGccerEpBtexHeOudfplBoEcJOxdo=";
+    hash = "sha256-oRhi5XchsKDwiD3+taTXm6ITotTEXhiA6f1w+OZXDDg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 083428425fde..411a132e166b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1057,8 +1057,10 @@ mapAliases ({
   yacc = bison; # moved from top-level 2021-03-14
   yafaray-core = libyafaray; # Added 2022-09-23
   yarn2nix-moretea-openssl_1_1 = throw "'yarn2nix-moretea-openssl_1_1' has been removed."; # Added 2023-02-04
-  yuzu-ea = yuzu-early-access; # Added 2022-08-18
-  yuzu = yuzu-mainline; # Added 2021-01-25
+  yuzu-ea = yuzuPackages.early-access; # Added 2022-08-18
+  yuzu-early-access = yuzuPackages.early-access; # Added 2023-12-29
+  yuzu = yuzuPackages.mainline; # Added 2021-01-25
+  yuzu-mainline = yuzuPackages.mainline; # Added 2023-12-29
 
   ### Z ###
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 205b61e1cf51..6c041e8b9b71 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2747,8 +2747,6 @@ with pkgs;
 
   hatari = callPackage ../applications/emulators/hatari { };
 
-  hercules = callPackage ../applications/emulators/hercules { };
-
   hostapd-mana = callPackage ../tools/networking/hostapd-mana { };
 
   image-analyzer = callPackage ../applications/emulators/cdemu/analyzer.nix { };
@@ -2949,16 +2947,7 @@ with pkgs;
     callPackage ../applications/emulators/retroarch/kodi-advanced-launchers.nix { };
 
   ### APPLICATIONS/EMULATORS/YUZU
-
-  yuzu-mainline = import ../applications/emulators/yuzu {
-    inherit qt6Packages fetchFromGitHub fetchgit fetchurl fetchzip runCommand gnutar;
-    branch = "mainline";
-  };
-
-  yuzu-early-access = import ../applications/emulators/yuzu {
-    inherit qt6Packages fetchFromGitHub fetchgit fetchurl fetchzip runCommand gnutar;
-    branch = "early-access";
-  };
+  yuzuPackages = callPackage ../applications/emulators/yuzu {};
 
   ### APPLICATIONS/EMULATORS/COMMANDERX16
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 7aff131c9e76..42da11b52aa9 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -221,6 +221,7 @@ mapAliases ({
   Keras = keras; # added 2021-11-25
   ldap = python-ldap; # added 2022-09-16
   lammps-cython = throw "lammps-cython no longer builds and is unmaintained"; # added 2021-07-04
+  langchainplus-sdk = langsmith; # added 2023-08-01
   lazr_config = lazr-config; # added 2023-11-03
   lazr_delegates = lazr-delegates; # added 2023-11-03
   lazy_imports = lazy-imports; # added 2023-10-13
@@ -477,6 +478,7 @@ mapAliases ({
   zope_contenttype = zope-contenttype; # added 2023-10-11
   zope_deprecation = zope-deprecation; # added 2023-10-07
   zope_dottedname = zope-dottedname; # added 2023-11-12
+  zope_exceptions = zope-exceptions; # added 2023-10-11
   zope_i18nmessageid = zope-i18nmessageid; # added 2023-07-29
   zope_lifecycleevent = zope-lifecycleevent; # added 2023-10-11
   zope_proxy = zope-proxy; # added 2023-10-07
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 716c993c4dd3..5218e481081e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -627,6 +627,8 @@ self: super: with self; {
 
   apispec-webframeworks = callPackage ../development/python-modules/apispec-webframeworks { };
 
+  apkinspector = callPackage ../development/python-modules/apkinspector { };
+
   apkit = callPackage ../development/python-modules/apkit { };
 
   aplpy = callPackage ../development/python-modules/aplpy { };
@@ -6162,8 +6164,6 @@ self: super: with self; {
 
   langchain = callPackage ../development/python-modules/langchain { };
 
-  langchainplus-sdk = callPackage ../development/python-modules/langchainplus-sdk { };
-
   langcodes = callPackage ../development/python-modules/langcodes { };
 
   langdetect = callPackage ../development/python-modules/langdetect { };
@@ -10604,6 +10604,8 @@ self: super: with self; {
 
   pylast = callPackage ../development/python-modules/pylast { };
 
+  pylatex = callPackage ../development/python-modules/pylatex { };
+
   pylatexenc = callPackage ../development/python-modules/pylatexenc { };
 
   pylaunches = callPackage ../development/python-modules/pylaunches { };
@@ -16465,7 +16467,7 @@ self: super: with self; {
 
   zope_event = callPackage ../development/python-modules/zope_event { };
 
-  zope_exceptions = callPackage ../development/python-modules/zope_exceptions { };
+  zope-exceptions = callPackage ../development/python-modules/zope-exceptions { };
 
   zope_filerepresentation = callPackage ../development/python-modules/zope_filerepresentation { };