diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3d88282a854c..edb4f243cc10 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17819,6 +17819,12 @@
       fingerprint = "E628 C811 6FB8 1657 F706  4EA4 F251 ADDC 9D04 1C7E";
     }];
   };
+  sailord = {
+    name = "Sailord";
+    email = "sailord328@gmail.com";
+    github = "Sail0rd";
+    githubId = 55802415;
+  };
   samalws = {
     email = "sam@samalws.com";
     name = "Sam Alws";
@@ -20692,6 +20698,11 @@
     githubId = 9870613;
     name = "Hubert Mühlhans";
   };
+  trishtzy = {
+    github = "trishtzy";
+    githubId = 5356506;
+    name = "Tricia Tan";
+  };
   trobert = {
     email = "thibaut.robert@gmail.com";
     github = "trobert";
@@ -21892,6 +21903,12 @@
     github = "wr0belj";
     githubId = 40501814;
   };
+  wr7 = {
+    name = "wr7";
+    email = "d-wr7@outlook.com";
+    github = "wr7";
+    githubId = 53203261;
+  };
   wraithm = {
     name = "Matthew Wraith";
     email = "wraithm@gmail.com";
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index 1bc391b4b55c..d5abb66d2398 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -20,16 +20,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    hash = "sha256-RgA3jV/vD6qgIVQCZ0Sm+9CST4SlqN4MUurVM3nIdh0=";
+    hash = "sha256-Sl4i9HFl+Dth9jmW6hPZzgh0Y35pRo1Xi9LRxCuSIP4=";
   };
 
-  cargoHash = "sha256-8ZUgm1O4NmZpxgNRKnh1MNhiFNoBWQHo22kyP3hWJwI=";
+  cargoHash = "sha256-INgDavtBI75h+qVlxTncYu3su+SH/D7HTlThRHJzwkY=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional withClipboard python3;
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index 4115c489b2e4..ead0a41cbe3c 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -419,10 +419,10 @@
         "src": {
             "owner": "libretro",
             "repo": "mame2000-libretro",
-            "rev": "1472da3a39ab14fff8325b1f51a1dfdb8eabb5c8",
-            "hash": "sha256-Nd5OqkoMJZ8TzEZGqDT0YX6lHK/H3I5EqJ841PteLi8="
+            "rev": "905808fbcc3adf8c610c1c60f0e41ce4b35db1c5",
+            "hash": "sha256-2J3QGlSb4YhDZND4T0wmt9zzDjOuNiscsMxn9zA1TtI="
         },
-        "version": "unstable-2023-10-31"
+        "version": "unstable-2024-05-07"
     },
     "mame2003": {
         "fetcher": "fetchFromGitHub",
@@ -652,11 +652,11 @@
         "src": {
             "owner": "jpd002",
             "repo": "Play-",
-            "rev": "9f8d623f5d7e6a9bb6fa7ff30ce4d5b1fdf72a1e",
-            "hash": "sha256-DtPIAQGHXR3urmKeFXNfKIdqQVU3HrrH6M28Ctwj3eI=",
+            "rev": "700a44a1548d099705c901203414724518c90d43",
+            "hash": "sha256-OZO8vVA2B/SdckC2Rm/v35cdJDzkpdU9lJhFYEyyl1U=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-05-01"
+        "version": "unstable-2024-05-05"
     },
     "ppsspp": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index b290a324f970..1c62a9aad97d 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -12,10 +12,9 @@
 with import ./util.nix { inherit lib; };
 
 let
-  patches' = patches;
   prevName = pname;
-  prevPlatforms = platforms;
   prevConfigFlags = configureFlags;
+
   setupHookDarwin = makeSetupHook {
     name = "darwin-mingw-hook";
     substitutions = {
@@ -23,30 +22,37 @@ let
       mingwGccsSuffixSalts = map (gcc: gcc.suffixSalt) mingwGccs;
     };
   } ./setup-hook-darwin.sh;
-  darwinUnsupportedFlags = [ "alsaSupport" "cairoSupport" "dbusSupport" "fontconfigSupport" "gtkSupport" "netapiSupport" "pulseaudioSupport" "udevSupport" "v4lSupport" "vaSupport" "waylandSupport" "x11Support" "xineramaSupport" ];
-  darwinUnsupported = builtins.any (name: builtins.getAttr name supportFlags) darwinUnsupportedFlags;
+
+  darwinFrameworks = lib.optionals stdenv.isDarwin (
+    toBuildInputs pkgArches (pkgs: with pkgs.buildPackages.darwin.apple_sdk.frameworks; [
+      CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration PCSC Security
+      ApplicationServices AudioToolbox CoreAudio AudioUnit CoreMIDI OpenCL Cocoa Carbon
+    ])
+  );
+  # Building Wine with these flags isn’t supported on Darwin. Using any of them will result in an evaluation failures
+  # because they will put Darwin in `meta.badPlatforms`.
+  darwinUnsupportedFlags = [
+    "alsaSupport" "cairoSupport" "dbusSupport" "fontconfigSupport" "gtkSupport" "netapiSupport" "pulseaudioSupport"
+    "udevSupport" "v4lSupport" "vaSupport" "waylandSupport" "x11Support" "xineramaSupport"
+  ];
+
+  badPlatforms = lib.optional (!supportFlags.mingwSupport || lib.any (flag: supportFlags.${flag}) darwinUnsupportedFlags) "x86_64-darwin";
 in
-stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
-  builder = buildScript;
-}) // (lib.optionalAttrs stdenv.isDarwin {
-  postConfigure = ''
-    # dynamic fallback, so this shouldn’t cause problems for older versions of macOS and will
-    # provide additional functionality on newer ones. This can be removed once the x86_64-darwin
-    # SDK is updated.
-    sed 's|/\* #undef HAVE_MTLDEVICE_REGISTRYID \*/|#define HAVE_MTLDEVICE_REGISTRYID 1|' \
-      -i include/config.h
-  '';
-  postBuild = ''
-    # The Wine preloader must _not_ be linked to any system libraries, but `NIX_LDFLAGS` will link
-    # to libintl, libiconv, and CoreFoundation no matter what. Delete the one that was built and
-    # rebuild it with empty NIX_LDFLAGS.
-    for preloader in wine-preloader wine64-preloader; do
-      rm loader/$preloader &> /dev/null \
-      && ( echo "Relinking loader/$preloader"; make loader/$preloader NIX_LDFLAGS="" NIX_LDFLAGS_${stdenv.cc.suffixSalt}="" ) \
-      || echo "loader/$preloader not built, skipping relink."
-    done
-  '';
-}) // rec {
+stdenv.mkDerivation (finalAttrs:
+lib.optionalAttrs (buildScript != null) { builder = buildScript; }
+// lib.optionalAttrs stdenv.isDarwin {
+    postBuild = ''
+      # The Wine preloader must _not_ be linked to any system libraries, but `NIX_LDFLAGS` will link
+      # to libintl, libiconv, and CoreFoundation no matter what. Delete the one that was built and
+      # rebuild it with empty NIX_LDFLAGS.
+      for preloader in wine-preloader wine64-preloader; do
+        rm loader/$preloader &> /dev/null \
+        && ( echo "Relinking loader/$preloader"; make loader/$preloader NIX_LDFLAGS="" NIX_LDFLAGS_${stdenv.cc.suffixSalt}="" ) \
+        || echo "loader/$preloader not built, skipping relink."
+      done
+    '';
+}
+// {
   inherit version src;
 
   pname = prevName + lib.optionalString (wineRelease != "stable" && wineRelease != "unstable") "-${wineRelease}";
@@ -95,10 +101,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   ++ lib.optionals openclSupport [ pkgs.opencl-headers pkgs.ocl-icd ]
   ++ lib.optionals tlsSupport    [ pkgs.openssl pkgs.gnutls ]
   ++ lib.optionals (openglSupport && !stdenv.isDarwin) [ pkgs.libGLU pkgs.libGL pkgs.mesa.osmesa pkgs.libdrm ]
-  ++ lib.optionals stdenv.isDarwin (with pkgs.buildPackages.darwin.apple_sdk.frameworks; [
-     CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration PCSC Security
-     ApplicationServices AudioToolbox CoreAudio AudioUnit CoreMIDI OpenCL Cocoa Carbon
-  ])
+  ++ lib.optionals stdenv.isDarwin darwinFrameworks
   ++ lib.optionals (x11Support) (with pkgs.xorg; [
     libX11 libXcomposite libXcursor libXext libXfixes libXi libXrandr libXrender libXxf86vm
   ])
@@ -107,29 +110,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
      mesa # for libgbm
   ])));
 
-  patches = [ ]
-    ++ lib.optionals stdenv.isDarwin [
-      # Wine uses `MTLDevice.registryID` in `winemac.drv`, but that property is not available in
-      # the 10.12 SDK (current SDK on x86_64-darwin). That can be worked around by using selector
-      # syntax. As of Wine 8.12, the logic has changed and uses selector syntax, but it still
-      # uses property syntax in one place. The first patch is necessary only with older
-      # versions of Wine. The second is needed on all versions of Wine.
-      (lib.optional (lib.versionOlder version "8.12") ./darwin-metal-compat-pre8.12.patch)
-      (lib.optional (lib.versionOlder version "8.18") ./darwin-metal-compat-pre8.18.patch)
-      (lib.optional (lib.versionAtLeast version "8.18") ./darwin-metal-compat.patch)
-      # Wine requires `qos.h`, which is not included by default on the 10.12 SDK in nixpkgs.
-      ./darwin-qos.patch
-    ]
-    ++ patches';
-
-  # Because the 10.12 SDK doesn’t define `registryID`, clang assumes the undefined selector returns
-  # `id`, which is a pointer. This causes implicit pointer to integer errors in clang 15+.
-  # The following post-processing step adds a cast to `uint64_t` before the selector invocation to
-  # silence these errors.
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    sed -e 's|\(\[[A-Za-z_][][A-Za-z_0-9]* registryID\]\)|(uint64_t)\1|' \
-      -i dlls/winemac.drv/cocoa_display.m
-  '';
+  inherit patches;
 
   configureFlags = prevConfigFlags
     ++ lib.optionals supportFlags.waylandSupport [ "--with-wayland" ]
@@ -140,7 +121,9 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   # them to the RPATH so that the user doesn't have to set them in
   # LD_LIBRARY_PATH.
   NIX_LDFLAGS = toString (map (path: "-rpath " + path) (
-      map (x: "${lib.getLib x}/lib") ([ stdenv.cc.cc ] ++ buildInputs)
+      map (x: "${lib.getLib x}/lib") ([ stdenv.cc.cc ]
+        # Avoid adding rpath references to non-existent framework `lib` paths.
+        ++ lib.subtractLists darwinFrameworks finalAttrs.buildInputs)
       # libpulsecommon.so is linked but not found otherwise
       ++ lib.optionals supportFlags.pulseaudioSupport (map (x: "${lib.getLib x}/lib/pulseaudio")
           (toBuildInputs pkgArches (pkgs: [ pkgs.libpulseaudio ])))
@@ -210,9 +193,8 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
       fromSource
       binaryNativeCode  # mono, gecko
     ];
-    broken = stdenv.isDarwin && !supportFlags.mingwSupport;
     description = "An Open Source implementation of the Windows API on top of X, OpenGL, and Unix";
-    platforms = if darwinUnsupported then (lib.remove "x86_64-darwin" prevPlatforms) else prevPlatforms;
+    inherit badPlatforms platforms;
     maintainers = with lib.maintainers; [ avnik raskin bendlas jmc-figueira reckenrode ];
     inherit mainProgram;
   };
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch
deleted file mode 100644
index aaf8a1b89bfd..000000000000
--- a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
---- a/dlls/winemac.drv/cocoa_display.m
-+++ b/dlls/winemac.drv/cocoa_display.m
-@@ -289,7 +289,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
-      * the primary GPU because we need to hide the integrated GPU for an automatic graphic switching pair to avoid apps
-      * using the integrated GPU. This is the behavior of Windows on a Mac. */
-     primary_device = [MTLCreateSystemDefaultDevice() autorelease];
--    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, primary_device.registryID))
-+    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, [primary_device registryID]))
-         goto done;
-
-     /* Hide the integrated GPU if the system default device is a dedicated GPU */
-@@ -301,7 +301,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
-
-     for (i = 0; i < devices.count; i++)
-     {
--        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], devices[i].registryID))
-+        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], [devices[i] registryID]))
-             goto done;
-
-         if (hide_integrated && devices[i].isLowPower)
-
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch
deleted file mode 100644
index 181b2a0d1a47..000000000000
--- a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
---- a/dlls/winemac.drv/cocoa_display.m
-+++ b/dlls/winemac.drv/cocoa_display.m
-@@ -354,7 +354,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
- 
-     device = [CGDirectDisplayCopyCurrentMetalDevice(display_id) autorelease];
-     if (device && [device respondsToSelector:@selector(registryID)])
--        ret = macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
-+        ret = macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
- 
- done:
-     [pool release];
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat.patch b/pkgs/applications/emulators/wine/darwin-metal-compat.patch
deleted file mode 100644
index 8176be8ef383..000000000000
--- a/pkgs/applications/emulators/wine/darwin-metal-compat.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
-index fbbe16efcbf..2db375ff3d5 100644
---- a/dlls/winemac.drv/cocoa_display.m
-+++ b/dlls/winemac.drv/cocoa_display.m
-@@ -387,7 +387,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
- 
-     device = [CGDirectDisplayCopyCurrentMetalDevice(display_id) autorelease];
-     if (device && [device respondsToSelector:@selector(registryID)])
--        return macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
-+        return macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
-     else
-         return -1;
- }
diff --git a/pkgs/applications/emulators/wine/darwin-qos.patch b/pkgs/applications/emulators/wine/darwin-qos.patch
deleted file mode 100644
index e9bd813feaab..000000000000
--- a/pkgs/applications/emulators/wine/darwin-qos.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/dlls/ntdll/unix/loader.c b/dlls/ntdll/unix/loader.c
-index cde37c48b0d..be237bc0ad3 100644
---- a/dlls/ntdll/unix/loader.c
-+++ b/dlls/ntdll/unix/loader.c
-@@ -65,6 +65,7 @@
- # undef LoadResource
- # undef GetCurrentThread
- # include <pthread.h>
-+# include <pthread/qos.h>
- # include <mach/mach.h>
- # include <mach/mach_error.h>
- # include <mach-o/getsect.h>
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 9ee1f53601a3..62fc12dd4eaf 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "9.7";
+    version = "9.8";
     url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
-    hash = "sha256-2fPDM2VuiL1M71Mx80sci2nJZKUnWe73RdjdrlGhU1M=";
+    hash = "sha256-hpQ8g47aj62aeUDUCZcDOUvx0b6aEBQ0L+2HnH3DuZM=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitLab rec {
     # https://gitlab.winehq.org/wine/wine-staging
     inherit (unstable) version;
-    hash = "sha256-KU6i1P81Fr+4aZH/SJ+YibaIfX88SZMPdPcGS2mT2CE=";
+    hash = "sha256-c69E+jr5DKdD8JJxQhM3ILJgvmGvOe54FqMghcVPkpg=";
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "wine-staging";
diff --git a/pkgs/applications/emulators/wine/staging.nix b/pkgs/applications/emulators/wine/staging.nix
index 0a99e6d42a87..56525d4fa067 100644
--- a/pkgs/applications/emulators/wine/staging.nix
+++ b/pkgs/applications/emulators/wine/staging.nix
@@ -1,4 +1,4 @@
-{ lib, callPackage, autoconf, hexdump, perl, python3, wineUnstable }:
+{ lib, stdenv, callPackage, autoconf, hexdump, perl, python3, wineUnstable }:
 
 with callPackage ./util.nix {};
 
@@ -7,8 +7,8 @@ let patch = (callPackage ./sources.nix {}).staging;
       (mkBuildInputs wineUnstable.pkgArches pkgNames) ++ extra;
 in assert lib.versions.majorMinor wineUnstable.version == lib.versions.majorMinor patch.version;
 
-(lib.overrideDerivation (wineUnstable.override { wineRelease = "staging"; }) (self: {
-  buildInputs = build-inputs [ "perl" "util-linux" "autoconf" "gitMinimal" ] self.buildInputs;
+(wineUnstable.override { wineRelease = "staging"; }).overrideAttrs (self: {
+  buildInputs = build-inputs ([ "perl" "autoconf" "gitMinimal" ] ++ lib.optional stdenv.isLinux "util-linux") self.buildInputs;
   nativeBuildInputs = [ autoconf hexdump perl python3 ] ++ self.nativeBuildInputs;
 
   prePatch = self.prePatch or "" + ''
@@ -18,7 +18,7 @@ in assert lib.versions.majorMinor wineUnstable.version == lib.versions.majorMino
     patchShebangs ./patches/gitapply.sh
     python3 ./staging/patchinstall.py DESTDIR="$PWD" --all ${lib.concatMapStringsSep " " (ps: "-W ${ps}") patch.disabledPatchsets}
   '';
-})) // {
+}) // {
   meta = wineUnstable.meta // {
     description = wineUnstable.meta.description + " (with staging patches)";
   };
diff --git a/pkgs/applications/graphics/lightburn/default.nix b/pkgs/applications/graphics/lightburn/default.nix
index e9ca6b52a041..19455d89c930 100644
--- a/pkgs/applications/graphics/lightburn/default.nix
+++ b/pkgs/applications/graphics/lightburn/default.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lightburn";
-  version = "1.5.06";
+  version = "1.6.00";
 
   nativeBuildInputs = [
     p7zip
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-VJMfvZHqdgUQXLyBBZLEV3nyP0qzibuXLnZyBhBBg9E=";
+    sha256 = "sha256-R9DBlmqvV23QXzC45Z4GN0t+ysv4WM63POJGU5N7jbw=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/oculante/default.nix b/pkgs/applications/graphics/oculante/default.nix
index a0c8da470555..c2f2840a5dee 100644
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oculante";
-  version = "0.8.19";
+  version = "0.8.21";
 
   src = fetchFromGitHub {
     owner = "woelper";
     repo = "oculante";
     rev = version;
-    hash = "sha256-oCgnz1WMg7YypIT8Tjk2m+f/43Aj88rDVCxQ92aL3RY=";
+    hash = "sha256-2QX7cD9SjhLb82O8T90BTQGsy3/gDaNwoX4Mbe2H6s4=";
   };
 
-  cargoHash = "sha256-vlU7egAht+kgA5Vx0HAwQOIax9qD4FLRo1ZUNx4RieY=";
+  cargoHash = "sha256-VAWLs15xsjoT0VSJjS/j0wd5P7OjQGrvyUSHp4B8hHI=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/misc/exercism/default.nix b/pkgs/applications/misc/exercism/default.nix
index d91f35980404..b3ea4b96b915 100644
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "exercism";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "exercism";
     repo  = "cli";
     rev   = "refs/tags/v${version}";
-    hash  = "sha256-Mtb5c1/k8kp7bETOSE0X969BV176jpoprr1/mQ3E4Vg=";
+    hash  = "sha256-+Tg9b7JZtriF5b+mnLgOeTTLiswH/dSGg3Mj1TBt4Wk=";
   };
 
-  vendorHash = "sha256-fnsSvbuVGRAndU88su2Ck7mV8QBDhxozdmwI3XGtxcA=";
+  vendorHash = "sha256-xY3C3emqtPIKyxIN9aEkrLXhTxWNmo0EJXNZVtbtIvs=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/ttdl/default.nix b/pkgs/applications/misc/ttdl/default.nix
index d4a74e6bdbc1..a67742aa6330 100644
--- a/pkgs/applications/misc/ttdl/default.nix
+++ b/pkgs/applications/misc/ttdl/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttdl";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "VladimirMarkelov";
     repo = "ttdl";
     rev = "v${version}";
-    sha256 = "sha256-fspqUzF3QqFpd16J1dbcNMdqjcR3PIiRu/s+VB4KgwQ=";
+    sha256 = "sha256-5v3Eu85x3xNvTRgfxhlDz4hiJ4UO010pZPY7UPHk7mQ=";
   };
 
-  cargoHash = "sha256-dvzm9lbVGGM4t6KZcHSlqwo55jssxi8HyFREMaj5I0Q=";
+  cargoHash = "sha256-+jYl/oUeJaABgDX/OBTyeo/B7RYc2MUTreU1ySLG0XQ=";
 
   meta = with lib; {
     description = "A CLI tool to manage todo lists in todo.txt format";
diff --git a/pkgs/applications/misc/wmenu/default.nix b/pkgs/applications/misc/wmenu/default.nix
index 23d9f2404ea2..72d437f74cc4 100644
--- a/pkgs/applications/misc/wmenu/default.nix
+++ b/pkgs/applications/misc/wmenu/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wmenu";
-  version = "0.1.7";
+  version = "0.1.8";
 
   strictDeps = true;
 
@@ -24,17 +24,9 @@ stdenv.mkDerivation rec {
     owner = "~adnano";
     repo = "wmenu";
     rev = version;
-    hash = "sha256-9do7zL7yaZuqVjastySwjsByo5ja+KUP3590VjIyVnI=";
+    hash = "sha256-gVoqRHQ5bcY58LTgKxpPM1PnZJrLRoSOJUiYYqc/vRI=";
   };
 
-  # Upstream patch needed to fix NULL deref
-  patches = [
-    (fetchpatch {
-      url = "https://git.sr.ht/~adnano/wmenu/commit/2856dddcac861ddf248143e66ba164d7aa05a0bb.patch";
-      hash = "sha256-P7SEjMssA8unNAlrgrTHm0uW5pefjpupPb4s/u2fTAM=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config meson ninja wayland-scanner ];
   buildInputs = [ cairo pango wayland libxkbcommon wayland-protocols scdoc ];
 
diff --git a/pkgs/applications/networking/avalanchego/default.nix b/pkgs/applications/networking/avalanchego/default.nix
index a6e0f5d58860..63d45b86fa7a 100644
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "avalanchego";
-  version = "1.11.4";
+  version = "1.11.5";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0YS+q1gy7YmTx/DwxaElBG1tzosXReXqPu6RpR3hTjw=";
+    hash = "sha256-IZ4Q67b+VsmBN/NEBPDzN2PYO8cVfLpHBU0tCo+v3Xc=";
   };
 
-  vendorHash = "sha256-et1PVLJQ/vBsg5438s6d9MA2oV40zahp9YKQOE0RX58=";
+  vendorHash = "sha256-z6MF/Kb///BSirdRycNs+7SMThv+yS7WmcrIcgiwBNg=";
   # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index e8638a1313f9..fc80fd76c102 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -51,11 +51,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "opera";
-  version = "109.0.5097.38";
+  version = "109.0.5097.80";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    hash = "sha256-eljVXaHN7gPqpoL3z+Fz/BH6b+1qxSHtFln6NCxl9tc=";
+    hash = "sha256-3NSinITYisulR5rNhSnwQC3D9pKWj4SdBtFt/9OgCvo=";
   };
 
   unpackPhase = "dpkg-deb -x $src .";
diff --git a/pkgs/applications/networking/cluster/atmos/default.nix b/pkgs/applications/networking/cluster/atmos/default.nix
index d5cd9a085142..2163adf6d5b2 100644
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atmos";
-  version = "1.71.0";
+  version = "1.72.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RnBMVVbZQrJ85uPVLniNjpcledYnOyu5zxIYsvV63qk=";
+    sha256 = "sha256-d4TgVSXTqrzgTdpGl1uXIdEvwb0EIgzqiEjOaWYAZgk=";
   };
 
-  vendorHash = "sha256-dcQWD6UrsSPJZzasovBSXUKaXvL9mZF6cLp458Ia8O4=";
+  vendorHash = "sha256-T3FvJfyGseW5vwN/mMCFEjpcpW90MG8QPkmaXJafD4s=";
 
   ldflags = [ "-s" "-w" "-X github.com/cloudposse/atmos/cmd.Version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/k0sctl/default.nix b/pkgs/applications/networking/cluster/k0sctl/default.nix
index 674adcf585d6..ff8957db2b2c 100644
--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@@ -2,20 +2,22 @@
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+, testers
+, k0sctl
 }:
 
 buildGoModule rec {
   pname = "k0sctl";
-  version = "0.17.5";
+  version = "0.17.8";
 
   src = fetchFromGitHub {
     owner = "k0sproject";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NHfS1iJtpt0t2iIqXBETiD4rpA2XzA8eOg5mP4N8El4=";
+    hash = "sha256-QHTVNrPglNDT9CUQWwc6oD7ttwEUBq8WIX49DiAXf8s=";
   };
 
-  vendorHash = "sha256-MPTdOcNoveBnHMJ2YHqHuvOHHe6IdisZLc05qViA1YQ=";
+  vendorHash = "sha256-6Kj1kHKXbbPMr9thkDTmGYbZvCSW7CvSzASpk6agEpI=";
 
   ldflags = [
     "-s"
@@ -34,6 +36,13 @@ buildGoModule rec {
     done
   '';
 
+  passthru.tests.version = testers.testVersion {
+    package = k0sctl;
+    command = "k0sctl version";
+    # See https://github.com/carlmjohnson/versioninfo/discussions/12
+    version = "version: (devel)\ncommit: v${version}\n";
+  };
+
   meta = with lib; {
     description = "A bootstrapping and management tool for k0s clusters.";
     homepage = "https://k0sproject.io/";
diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index 2e654d15d0b0..5e7646452383 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.4.6";
+  version = "2.4.8";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = "kubefirst";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PjqTtu9n9AqHaYnc/2yVQeIWLiQrQcFNdumDSigY7dY=";
+    hash = "sha256-r5y1eWjcw0HP/E9AQodEdCgWgKikGrwV6TvZ2mVcuoE=";
   };
 
   vendorHash = "sha256-ZcZl4knlyKAwTsiyZvlkN5e2ox30B5aNzutI/2UEE9U=";
diff --git a/pkgs/applications/networking/cluster/nerdctl/default.nix b/pkgs/applications/networking/cluster/nerdctl/default.nix
index 8f7a59c70e8a..0ef96ddf69a4 100644
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nerdctl";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eGDshnJ26rrRuM9lWwcdRg8udA4uE5ee6c+SYES7qt4=";
+    hash = "sha256-z83c8Ji0zSM1QDwjB4FwhHW6XCqG0Hb5crM3jjK46jk=";
   };
 
-  vendorHash = "sha256-GsI695T7nkwwAt78l7mc5JCD9wXAUcTxwsiLLFcANBI=";
+  vendorHash = "sha256-KqWmwwQRrWoyRehuSJBnlyPQgwk5hUGk2/d0Ue/reVc=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
@@ -48,13 +48,13 @@ buildGoModule rec {
     runHook postInstallCheck
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/containerd/nerdctl/";
     changelog = "https://github.com/containerd/nerdctl/releases/tag/v${version}";
     description = "A Docker-compatible CLI for containerd";
     mainProgram = "nerdctl";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jk developer-guy ];
-    platforms = platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ developer-guy jk ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/datovka/default.nix b/pkgs/applications/networking/datovka/default.nix
index bfffc97df6e6..3ed7a26138c8 100644
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@@ -12,11 +12,11 @@
 
 mkDerivation rec {
   pname = "datovka";
-  version = "4.23.6";
+  version = "4.23.7";
 
   src = fetchurl {
     url = "https://gitlab.nic.cz/datovka/datovka/-/archive/v${version}/datovka-v${version}.tar.gz";
-    sha256 = "sha256-g6IMUAE8z5uoLSUpoT+GradQRgwyIXNANt7g4JPOCxg=";
+    sha256 = "sha256-mGuTxOqudDhoJKZ9517H+A4PZxBqAOD+PfBHunhPXGw=";
   };
 
   buildInputs = [ libdatovka qmake qtbase qtsvg libxml2 qtwebsockets ];
diff --git a/pkgs/applications/networking/gns3/server.nix b/pkgs/applications/networking/gns3/server.nix
index f9939000f744..3e4764a14502 100644
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@@ -4,16 +4,17 @@
 }:
 
 { lib
-, python3
+, python3Packages
 , fetchFromGitHub
 , pkgsStatic
 , stdenv
 , nixosTests
 , testers
+, util-linux
 , gns3-server
 }:
 
-python3.pkgs.buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "gns3-server";
   inherit version;
 
@@ -29,7 +30,7 @@ python3.pkgs.buildPythonApplication {
     cp ${pkgsStatic.busybox}/bin/busybox gns3server/compute/docker/resources/bin/busybox
   '';
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python3Packages; [
     aiofiles
     aiohttp
     aiohttp-cors
@@ -55,6 +56,9 @@ python3.pkgs.buildPythonApplication {
     rm $out/bin/gns3loopback
   '';
 
+  # util-linux (script program) is required for Docker support
+  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ util-linux ]}" ];
+
   doCheck = true;
 
   # Otherwise tests will fail to create directory
@@ -63,7 +67,7 @@ python3.pkgs.buildPythonApplication {
     export HOME=$(mktemp -d)
   '';
 
-  checkInputs = with python3.pkgs; [
+  checkInputs = with python3Packages; [
     pytest-aiohttp
     pytest-rerunfailures
     (pytestCheckHook.override { pytest = pytest_7; })
diff --git a/pkgs/applications/networking/ids/suricata/default.nix b/pkgs/applications/networking/ids/suricata/default.nix
index 7661ec3cfbbe..823a455fe857 100644
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@@ -33,11 +33,11 @@
 in
 stdenv.mkDerivation rec {
   pname = "suricata";
-  version = "7.0.4";
+  version = "7.0.5";
 
   src = fetchurl {
     url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    hash = "sha256-ZABgEgAkvnDb6B9uxu/HLkYlD8s2IZ3/Z+ZBciD/Ibc=";
+    hash = "sha256-H/tWgVjyZcCFVEZL+4VOZWjvaDvwMxKSO1HyjFB5Ck4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index c8bea44ddd78..f1c8367b91c3 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alfaview";
-  version = "9.9.1";
+  version = "9.10.1";
 
   src = fetchurl {
     url = "https://assets.alfaview.com/stable/linux/deb/${pname}_${version}.deb";
-    hash = "sha256-GZLIVpXQ22W4JykdLJ7pTogOFhDaiukgsLa2E7giiaU=";
+    hash = "sha256-k58v8l/LE0lWQFbQ6p2XGiRjMMwzArW3KVbIxlKC1SA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index 29a892942018..d82fe6652afe 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -5,11 +5,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "220.240321.0";
+  version = "227.240502.0";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-LbvldnhvKHvBEaOwkxA2acuUKMcYi16ceYPuMW73qLs=";
+    hash = "sha256-D7qWwIFuCJmBvfdgf4Dsd2/jvi39tbAttaHOwLND4DY=";
   };
 
   extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
diff --git a/pkgs/applications/networking/newsreaders/pan/default.nix b/pkgs/applications/networking/newsreaders/pan/default.nix
index eb9b5ad3af95..3a8418e48bda 100644
--- a/pkgs/applications/networking/newsreaders/pan/default.nix
+++ b/pkgs/applications/networking/newsreaders/pan/default.nix
@@ -22,14 +22,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pan";
-  version = "0.157";
+  version = "0.158";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+zzAnppP6ICIhhlqXGVF4h/yIDa6oE1lxenmzcr2BQo=";
+    hash = "sha256-gcs3TsUzZAW8PhNPMzyOfwu+2SNynjRgfxdGIfAHrpA=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config gettext intltool itstool libxml2 makeWrapper ];
diff --git a/pkgs/applications/networking/sync/storj-uplink/default.nix b/pkgs/applications/networking/sync/storj-uplink/default.nix
index 6ac38b50e835..d2505a1a568f 100644
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.102.4";
+  version = "1.104.1";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-ryOWnVcJOUs9kToXtwjUTk7nwuAW0NCDn5Npn27hKXU=";
+    hash = "sha256-wB8SK91eJp+8Jjc/bfMqDQQC3FYtSLEjpqVdxEq9P3c=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-atIb/SmOShLIhvEsTcegX7+xoDXN+SI5a7TQrXpqdUg=";
+  vendorHash = "sha256-Eo6JHcTcfC8zmKZh9sXrZ90RhIgdEBgTldIUnvNm8ms=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index c8ea46d0978e..48384eca2998 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -7,13 +7,13 @@
 
 let
   pname = "mendeley";
-  version = "2.111.0";
+  version = "2.114.0";
 
   executableName = "${pname}-reference-manager";
 
   src = fetchurl {
     url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
-    hash = "sha256-tN76RKHETTMkJ239I6+a36RPTuWqYlCSs+tEP+BcB+M=";
+    hash = "sha256-1eLxk+nlgHoe0Gmo/DXlTOnWssrN9cAubvqpV6SqQS8=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/office/planify/default.nix b/pkgs/applications/office/planify/default.nix
index 595b12bf9ab2..86117b22e803 100644
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.7";
+  version = "4.7.2";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-5hiVTU1w3Rk/BdxYwDB0Y+EZFnSAaEWtx19IB1ak1yY=";
+    hash = "sha256-G0A3U0TUGL4RT1wpIXw/cIwDDlaLCPpo5QG6bJfoIYc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/quisk/default.nix b/pkgs/applications/radio/quisk/default.nix
index 8fa180e705c6..733f908ffc44 100644
--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@@ -8,11 +8,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quisk";
-  version = "4.2.32";
+  version = "4.2.33";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zzcygf7oVICO2/wfgyej1GD78fQB1xNRGHq19w6K4uY=";
+    sha256 = "sha256-41eyqYxRg0crtN6qp239eHWSFPt7XuJneTAndZuS3EY=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/radio/tqsl/default.nix b/pkgs/applications/radio/tqsl/default.nix
index bf6ee947785e..01059cc43430 100644
--- a/pkgs/applications/radio/tqsl/default.nix
+++ b/pkgs/applications/radio/tqsl/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tqsl";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchurl {
     url = "https://www.arrl.org/files/file/LoTW%20Instructions/${pname}-${version}.tar.gz";
-    sha256 = "sha256-T4NBCUTYHT6ugSg1gSfjQBOBndqwSwyWLr/qlDPQGKI=";
+    sha256 = "sha256-Ca9PsytjPvrU4u+b/x6pIbQc8CDNWI6hNM6jF60Bds8=";
   };
 
   nativeBuildInputs = [ cmake wrapGAppsHook3 ];
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 3f5567be03d5..bc69b0947e08 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "snakemake";
-  version = "8.11.2";
+  version = "8.11.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-rIA757FIIkb6h/QNzyVbIbipkZTwysNonHrPHLqFOyI=";
+    hash = "sha256-wNs5OW8bM5LU0Ik77VU47dEq2PlrsfNNtl6Zedocnm4=";
     # https://github.com/python-versioneer/python-versioneer/issues/217
     postFetch = ''
       sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'
diff --git a/pkgs/applications/terminal-emulators/terminator/default.nix b/pkgs/applications/terminal-emulators/terminator/default.nix
index 3eb374af71ab..175d3766594b 100644
--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@@ -7,6 +7,7 @@
 , gtk3
 , gobject-introspection
 , libnotify
+, makeBinaryWrapper
 , wrapGAppsHook3
 , vte
 , nixosTests
@@ -27,6 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     file
     intltool
     gobject-introspection
+    makeBinaryWrapper
     wrapGAppsHook3
     python3.pkgs.pytest-runner
   ];
@@ -55,8 +57,15 @@ python3.pkgs.buildPythonApplication rec {
 
   dontWrapGApps = true;
 
+  # HACK: 'wrapPythonPrograms' will add things to the $PATH in the wrapper. This bleeds into the
+  # terminal session produced by terminator. To avoid this, we force wrapPythonPrograms to only
+  # use gappsWrapperArgs by redefining wrapProgram to ignore its arguments and only apply the
+  # wrapper arguments we want it to use.
+  # TODO: Adjust wrapPythonPrograms to respect an argument that tells it to leave $PATH alone.
   preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    wrapProgram() {
+      wrapProgramBinary "$1" "''${gappsWrapperArgs[@]}"
+    }
   '';
 
   passthru.tests.test = nixosTests.terminal-emulators.terminator;
diff --git a/pkgs/applications/video/rtabmap/default.nix b/pkgs/applications/video/rtabmap/default.nix
index b44389045187..6d5270d344ea 100644
--- a/pkgs/applications/video/rtabmap/default.nix
+++ b/pkgs/applications/video/rtabmap/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtabmap";
-  version = "0.21.4";
+  version = "0.21.4.1";
 
   src = fetchFromGitHub {
     owner = "introlab";
     repo = "rtabmap";
     rev = "refs/tags/${version}";
-    hash = "sha256-HrIATYRuhFfTlO4oTRZo7CM30LFVyatZJON31Fe4HTQ=";
+    hash = "sha256-y/p1uFSxVQNXO383DLGCg4eWW7iu1esqpWlyPMF3huk=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook wrapGAppsHook3 ];
diff --git a/pkgs/applications/virtualization/podman-tui/default.nix b/pkgs/applications/virtualization/podman-tui/default.nix
index d1339b0d5f2c..b1ff999cd89c 100644
--- a/pkgs/applications/virtualization/podman-tui/default.nix
+++ b/pkgs/applications/virtualization/podman-tui/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-sJaiZJeT0oUAnSg9Kv8uMp1XoumumC3LB77lelmwSgw=";
+    hash = "sha256-t1vrUXv0ZP+vmOcUIue/yvB34DP+gduopuN0U9oixBQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/tart/default.nix b/pkgs/applications/virtualization/tart/default.nix
index e8791404fb87..921a8b7e3dbc 100644
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.7.2";
+  version = "2.10.0";
 
   src = fetchurl {
       url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart-arm64.tar.gz";
-      hash = "sha256-Z/LZ8g1/FYT7Jh943tFxN8L5HeNf0CVz1VEJj+2fCd8=";
+      hash = "sha256-9spBDqNm47nUZEGCCOfISjNpGx/22OtPPheB7iJTq1A=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/build-support/lib/meson.nix b/pkgs/build-support/lib/meson.nix
index 456c10fcb8ee..9ffc5b8c1710 100644
--- a/pkgs/build-support/lib/meson.nix
+++ b/pkgs/build-support/lib/meson.nix
@@ -23,6 +23,10 @@ let
     [binaries]
     llvm-config = 'llvm-config-native'
     rust = ['rustc', '--target', '${stdenv.targetPlatform.rust.rustcTargetSpec}']
+    # Meson refuses to consider any CMake binary during cross compilation if it's
+    # not explicitly specified here, in the cross file.
+    # https://github.com/mesonbuild/meson/blob/0ed78cf6fa6d87c0738f67ae43525e661b50a8a2/mesonbuild/cmake/executor.py#L72
+    cmake = 'cmake'
   '';
 
   crossFlags = optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
diff --git a/pkgs/by-name/al/alephone-durandal/package.nix b/pkgs/by-name/al/alephone-durandal/package.nix
index d8376457f644..b1bd2da8c8a3 100644
--- a/pkgs/by-name/al/alephone-durandal/package.nix
+++ b/pkgs/by-name/al/alephone-durandal/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
   pname = "durandal";
   desktopName = "Marathon-Durandal";
-  version = "20240119";
+  version = "20240510";
   icon = alephone.icons + "/marathon2.png";
 
   zip = fetchurl {
     url =
       "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/Marathon2-${version}-Data.zip";
-    sha256 = "sha256-Tp9EWMIY0moK6RLIpxB7rMzLOQ7zPfV58oeAyQsTbnM=";
+    sha256 = "sha256-uoBl1/7XlXmMLqpk3tvme9w18q4Yh0WCrmqSzjGxNz0=";
   };
 
   meta = {
diff --git a/pkgs/by-name/al/alephone-infinity/package.nix b/pkgs/by-name/al/alephone-infinity/package.nix
index 466f3bb7d4b6..d2ba3968f595 100644
--- a/pkgs/by-name/al/alephone-infinity/package.nix
+++ b/pkgs/by-name/al/alephone-infinity/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
   pname = "marathon-infinity";
   desktopName = "Marathon-Infinity";
-  version = "20240119";
+  version = "20240510";
   icon = alephone.icons + "/marathon-infinity.png";
 
   zip = fetchurl {
     url =
       "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/MarathonInfinity-${version}-Data.zip";
-    sha256 = "sha256-KfFu+cboaZMfjnu3W84/Qbcrc9kbkIZ2Y0GM1fXeXh8=";
+    sha256 = "sha256-+FPym4Avqzyo4cZtfYPHXCS+q21+g9AIdKOImkd/UjU=";
   };
 
   meta = {
diff --git a/pkgs/by-name/al/alephone-marathon/package.nix b/pkgs/by-name/al/alephone-marathon/package.nix
index 38018ec021b0..4710d47090d5 100644
--- a/pkgs/by-name/al/alephone-marathon/package.nix
+++ b/pkgs/by-name/al/alephone-marathon/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
   pname = "marathon";
   desktopName = "Marathon";
-  version = "20240119";
+  version = "20240510";
   icon = alephone.icons + "/marathon.png";
 
   zip = fetchurl {
     url =
       "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/Marathon-${version}-Data.zip";
-    sha256 = "sha256-60+dvXyzHe5PDepyKHcEIdWoRiGMvx5zYehubWKqaB0=";
+    sha256 = "sha256-shZ82e7veaaT/petxDQ8Fd7YtJPmTgxSCStf0kGfrFs=";
   };
 
   meta = {
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 0c7221679a88..3e9cf6b51fdc 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -27,20 +27,20 @@ let
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-rP3PHS6kuJCgbCQy4h+bJksmJAJvHDBMSysLM5FxQjk=";
+    hash = "sha256-z4KL6CX1jtuC4lxqYA6Mg1zPSc9/OpRb530jPIQK3Is=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-p4rBEOK9zKGO1q3SCKpfdX3EPMkYHRvn9UnGBhsksSE=";
+  npmDepsHash = "sha256-NIf7aMDAeE39+putw/7GTYODIdVmjJIvIwnL5O+sBmI=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bu/bugstalker/package.nix b/pkgs/by-name/bu/bugstalker/package.nix
new file mode 100644
index 000000000000..ccbf397e71d9
--- /dev/null
+++ b/pkgs/by-name/bu/bugstalker/package.nix
@@ -0,0 +1,104 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, libunwind
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bugstalker";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "godzie44";
+    repo = "BugStalker";
+    rev = "v${version}";
+    hash = "sha256-16bmvz6/t8H8Sx/32l+fp3QqP5lwi0o1Q9KqDHqF22U=";
+  };
+
+  cargoHash = "sha256-kp0GZ0cM57BMpH/8lhxevnBuJhUSH0rtxP4B/9fXYiU=";
+
+  buildInputs = [ libunwind ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  # Tests which require access to example source code fail in the sandbox. I
+  # haven't managed to figure out how to fix this.
+  checkFlags = [
+    "--skip=breakpoints::test_breakpoint_at_fn_with_monomorphization"
+    "--skip=breakpoints::test_breakpoint_at_line_with_monomorphization"
+    "--skip=breakpoints::test_brkpt_on_function"
+    "--skip=breakpoints::test_brkpt_on_function_name_collision"
+    "--skip=breakpoints::test_brkpt_on_line"
+    "--skip=breakpoints::test_brkpt_on_line2"
+    "--skip=breakpoints::test_brkpt_on_line_collision"
+    "--skip=breakpoints::test_debugee_run"
+    "--skip=breakpoints::test_deferred_breakpoint"
+    "--skip=breakpoints::test_multiple_brkpt_on_addr"
+    "--skip=breakpoints::test_set_breakpoint_idempotence"
+    "--skip=io::test_backtrace"
+    "--skip=io::test_read_register_write"
+    "--skip=io::test_read_value_u64"
+    "--skip=multithreaded::test_multithreaded_app_running"
+    "--skip=multithreaded::test_multithreaded_backtrace"
+    "--skip=multithreaded::test_multithreaded_breakpoints"
+    "--skip=multithreaded::test_multithreaded_trace"
+    "--skip=signal::test_signal_stop_multi_thread"
+    "--skip=signal::test_signal_stop_multi_thread_multiple_signal"
+    "--skip=signal::test_signal_stop_single_thread"
+    "--skip=signal::test_transparent_signals"
+    "--skip=steps::test_step_into"
+    "--skip=steps::test_step_into_recursion"
+    "--skip=steps::test_step_out"
+    "--skip=steps::test_step_over"
+    "--skip=steps::test_step_over_inline_code"
+    "--skip=steps::test_step_over_on_fn_decl"
+    "--skip=symbol::test_symbol"
+    "--skip=test_debugger_disassembler"
+    "--skip=test_debugger_graceful_shutdown"
+    "--skip=test_debugger_graceful_shutdown_multithread"
+    "--skip=test_frame_cfa"
+    "--skip=test_registers"
+    "--skip=variables::test_arguments"
+    "--skip=variables::test_btree_map"
+    "--skip=variables::test_cast_pointers"
+    "--skip=variables::test_cell"
+    "--skip=variables::test_circular_ref_types"
+    "--skip=variables::test_lexical_blocks"
+    "--skip=variables::test_read_array"
+    "--skip=variables::test_read_atomic"
+    "--skip=variables::test_read_btree_set"
+    "--skip=variables::test_read_closures"
+    "--skip=variables::test_read_enum"
+    "--skip=variables::test_read_hashmap"
+    "--skip=variables::test_read_hashset"
+    "--skip=variables::test_read_only_local_variables"
+    "--skip=variables::test_read_pointers"
+    "--skip=variables::test_read_scalar_variables"
+    "--skip=variables::test_read_scalar_variables_at_place"
+    "--skip=variables::test_read_static_in_fn_variable"
+    "--skip=variables::test_read_static_variables"
+    "--skip=variables::test_read_static_variables_different_modules"
+    "--skip=variables::test_read_strings"
+    "--skip=variables::test_read_struct"
+    "--skip=variables::test_read_tls_variables"
+    "--skip=variables::test_read_type_alias"
+    "--skip=variables::test_read_union"
+    "--skip=variables::test_read_uuid"
+    "--skip=variables::test_read_vec_and_slice"
+    "--skip=variables::test_read_vec_deque"
+    "--skip=variables::test_shared_ptr"
+    "--skip=variables::test_slice_operator"
+    "--skip=variables::test_type_parameters"
+    "--skip=variables::test_zst_types"
+  ];
+
+  meta = {
+    description = "Rust debugger for Linux x86-64";
+    homepage = "https://github.com/godzie44/BugStalker";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jacg ];
+    mainProgram = "bs";
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/servers/caddy/default.nix b/pkgs/by-name/ca/caddy/package.nix
similarity index 81%
rename from pkgs/servers/caddy/default.nix
rename to pkgs/by-name/ca/caddy/package.nix
index 399ce426d9dc..73ab67366483 100644
--- a/pkgs/servers/caddy/default.nix
+++ b/pkgs/by-name/ca/caddy/package.nix
@@ -5,6 +5,7 @@
 , caddy
 , testers
 , installShellFiles
+, stdenv
 }:
 let
   version = "2.7.6";
@@ -40,8 +41,13 @@ buildGoModule {
   postInstall = ''
     install -Dm644 ${dist}/init/caddy.service ${dist}/init/caddy-api.service -t $out/lib/systemd/system
 
-    substituteInPlace $out/lib/systemd/system/caddy.service --replace "/usr/bin/caddy" "$out/bin/caddy"
-    substituteInPlace $out/lib/systemd/system/caddy-api.service --replace "/usr/bin/caddy" "$out/bin/caddy"
+    substituteInPlace $out/lib/systemd/system/caddy.service \
+      --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
+    substituteInPlace $out/lib/systemd/system/caddy-api.service \
+      --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
+  '' + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # Generating man pages and completions fail on cross-compilation
+    # https://github.com/NixOS/nixpkgs/issues/308283
 
     $out/bin/caddy manpage --directory manpages
     installManPage manpages/*
diff --git a/pkgs/by-name/ca/caligula/package.nix b/pkgs/by-name/ca/caligula/package.nix
new file mode 100644
index 000000000000..f0f5c14664fc
--- /dev/null
+++ b/pkgs/by-name/ca/caligula/package.nix
@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "caligula";
+  version = "0.4.5";
+
+  src = fetchFromGitHub {
+    owner = "ifd3f";
+    repo = "caligula";
+    rev = "v${version}";
+    hash = "sha256-9+aLpxmMP76CsLFFmr1mhKgbaT7Zz0lx4D2jQCUA9VY=";
+  };
+
+  cargoHash = "sha256-VwtmU5jTQPn3hpNuLckPQl6joEFPfuax1gRVG0/nceg=";
+
+  buildInputs = lib.optionals stdenv.isDarwin (
+    with darwin.apple_sdk.frameworks; [
+      Cocoa
+      IOKit
+      Foundation
+      DiskArbitration
+    ]
+  );
+
+  RUSTFLAGS = "--cfg tracing_unstable";
+
+  meta = with lib; {
+    description = "A user-friendly, lightweight TUI for disk imaging";
+    homepage = "https://github.com/ifd3f/caligula/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ sodiboo ];
+    platforms = platforms.linux ++ platforms.darwin;
+    # https://github.com/ifd3f/caligula/issues/105
+    broken = stdenv.hostPlatform.isDarwin;
+    mainProgram = "caligula";
+  };
+}
diff --git a/pkgs/development/tools/misc/cli11/default.nix b/pkgs/by-name/cl/cli11/package.nix
similarity index 65%
rename from pkgs/development/tools/misc/cli11/default.nix
rename to pkgs/by-name/cl/cli11/package.nix
index 8c4c58c052b0..d88470fa4d51 100644
--- a/pkgs/development/tools/misc/cli11/default.nix
+++ b/pkgs/by-name/cl/cli11/package.nix
@@ -1,29 +1,34 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, boost
-, catch2
-, cmake
-, gtest
-, python3
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  boost,
+  catch2,
+  cmake,
+  python3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cli11";
   version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "CLIUtils";
     repo = "CLI11";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-x3/kBlf5LdzkTO4NYOKanZBfcU4oK+fJw9L7cf88LsY=";
   };
 
+  buildInputs = [ catch2 ];
   nativeBuildInputs = [ cmake ];
 
-  nativeCheckInputs = [ boost python3 catch2 ];
+  nativeCheckInputs = [
+    boost
+    python3
+  ];
 
   doCheck = true;
+  strictDeps = true;
 
   meta = with lib; {
     description = "Command line parser for C++11";
@@ -32,5 +37,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ ];
     license = licenses.bsd3;
   };
-
-}
+})
diff --git a/pkgs/by-name/fr/free42/package.nix b/pkgs/by-name/fr/free42/package.nix
index 415f6f6f8b9d..679e43fc1d2c 100644
--- a/pkgs/by-name/fr/free42/package.nix
+++ b/pkgs/by-name/fr/free42/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "free42";
-  version = "3.1.5";
+  version = "3.1.8";
 
   src = fetchFromGitHub {
     owner = "thomasokken";
     repo = "free42";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YFTmEyOd/r8Pbj+PzD+VYkkB0gqDJ4wteLBTdwa1qcE=";
+    hash = "sha256-z1HlI2e3mCRJ/sWMdsLF7IpcvTh+Zlrk77M8gaJXMzQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gl/glsl_analyzer/package.nix b/pkgs/by-name/gl/glsl_analyzer/package.nix
new file mode 100644
index 000000000000..ed57790a27d6
--- /dev/null
+++ b/pkgs/by-name/gl/glsl_analyzer/package.nix
@@ -0,0 +1,39 @@
+{ lib
+, pkgs
+, fetchFromGitHub
+, zig_0_12
+, darwin
+}:
+
+let stdenv = if pkgs.stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else pkgs.stdenv; in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "glsl_analyzer";
+  version = "1.4.5";
+
+  src = fetchFromGitHub {
+    owner = "nolanderc";
+    repo = "glsl_analyzer";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-+eYBw/F1RzI5waAkLgbV0J/Td91hbNcAtHcisQaL82k=";
+  };
+
+  nativeBuildInputs = [
+    zig_0_12.hook
+  ];
+
+  postPatch = ''
+    substituteInPlace build.zig \
+      --replace-fail 'b.run(&.{ "git", "describe", "--tags", "--always" })' '"${finalAttrs.src.rev}"'
+  '';
+
+  meta = {
+    description = "Language server for GLSL (OpenGL Shading Language)";
+    changelog = "https://github.com/nolanderc/glsl_analyzer/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/nolanderc/glsl_analyzer";
+    mainProgram = "glsl_analyzer";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ wr7 ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/go/go-passbolt-cli/package.nix b/pkgs/by-name/go/go-passbolt-cli/package.nix
new file mode 100644
index 000000000000..e774769ae45e
--- /dev/null
+++ b/pkgs/by-name/go/go-passbolt-cli/package.nix
@@ -0,0 +1,52 @@
+{ buildGoModule, fetchFromGitHub, installShellFiles, lib, stdenv }:
+
+buildGoModule rec {
+  pname = "go-passbolt-cli";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "passbolt";
+    repo = "go-passbolt-cli";
+    rev = "v${version}";
+    hash = "sha256-I+niNUowKTFDMa7yOnRToMFPzO/CbnjXHJr5nAhhHcg=";
+  };
+
+  vendorHash = "sha256-XRHGq3Qeq7VWHzw5WWVv4x5orQu740lttGVreiu7qP4=";
+
+  ldflags = [
+    "-X=main.version=${version}"
+    "-X=main.commit=${src.rev}"
+    "-X=main.date=1970-01-01T00:00:00Z"
+  ];
+
+  subPackages = [ "." ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D $GOPATH/bin/go-passbolt-cli $out/bin/passbolt
+    runHook postInstall
+  '';
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd passbolt \
+      --bash <($out/bin/passbolt completion bash) \
+      --fish <($out/bin/passbolt completion fish) \
+      --zsh <($out/bin/passbolt completion zsh)
+
+    export tmpDir=$(mktemp -d)
+    cd $tmpDir && mkdir man && $out/bin/passbolt gendoc --type man && installManPage man/*
+  '';
+
+  meta = with lib; {
+    description = "CLI tool to interact with Passbolt, an open source password manager for teams";
+    homepage = "https://github.com/passbolt/go-passbolt-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbek ];
+    mainProgram = "passbolt";
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index bbe71993674a..998e1f370698 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -7,10 +7,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.15.1";
+  version = "2.15.2";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/${pname}-${version}.jar";
-    hash = "sha256-6qgbUXd0E38Rhv0Jf1qP54yJhQiB1a/Jr1FYw3bC4qI=";
+    hash = "sha256-BCcIDaWtn8OkI+GWs741nWgqyO8qlE9m2hZ3e+iViUI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hyprland-workspaces/package.nix b/pkgs/by-name/hy/hyprland-workspaces/package.nix
index 4ca89b0da118..11307059e680 100644
--- a/pkgs/by-name/hy/hyprland-workspaces/package.nix
+++ b/pkgs/by-name/hy/hyprland-workspaces/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-workspaces";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "FieldofClay";
     repo = "hyprland-workspaces";
     rev = "v${version}";
-    hash = "sha256-4QGLTimIpx74gWUyHCheUZZT1WgVzBoJRY8OlUDdOh4=";
+    hash = "sha256-GhUjvFMlgjTdgtV9ASW7IqE2dBktPyOlRwg6qM1r7vc=";
   };
 
-  cargoHash = "sha256-9ndP0nyRBCdOGth4UWA263IvjbgnVW2x9PK8oTaMrxg=";
+  cargoHash = "sha256-RZVQSkegX8Fa9SNY7tGNxyu312oeDjXK4U1+1/UIAyA=";
 
   meta = with lib; {
     description = "A multi-monitor aware Hyprland workspace widget";
diff --git a/pkgs/by-name/kc/kcl-cli/package.nix b/pkgs/by-name/kc/kcl-cli/package.nix
index ea0b5536b528..a6aa42ead1b9 100644
--- a/pkgs/by-name/kc/kcl-cli/package.nix
+++ b/pkgs/by-name/kc/kcl-cli/package.nix
@@ -5,14 +5,14 @@
 
 buildGoModule rec {
   pname = "kcl-cli";
-  version = "0.8.7";
+  version = "0.8.8";
   src = fetchFromGitHub {
     owner = "kcl-lang";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-OKRMgxynKmHnO+5tcKlispFkpQehHINzB6qphH+lwHQ=";
+    hash = "sha256-Bk/sCNMDupdY/YyKT+VoPIzEfjFDa5z9pevcCPnTX8U=";
   };
-  vendorHash = "sha256-dF0n1/SmQVd2BUVOPmvZWWUJYTn2mMnbgZC92luSY2s=";
+  vendorHash = "sha256-Xv8Tfq9Kb1xGFCWZQwBFDX9xZW9j99td/DUb7jBtkpE=";
   ldflags = [
     "-X=kcl-lang.io/cli/pkg/version.version=${version}"
   ];
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index 75cc9c128187..692de5d3d909 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -1,20 +1,21 @@
-{ lib
-, stdenv
-, buildDotnetModule
-, fetchFromGitHub
-, dotnetCorePackages
-, wrapGAppsHook3
+{
+  lib,
+  stdenv,
+  buildDotnetModule,
+  fetchFromGitHub,
+  dotnetCorePackages,
+  wrapGAppsHook3,
 
-, libX11
-, libICE
-, libSM
-, libXi
-, libXcursor
-, libXext
-, libXrandr
-, fontconfig
-, glew
-, gtk3
+  libX11,
+  libICE,
+  libSM,
+  libXi,
+  libXcursor,
+  libXext,
+  libXrandr,
+  fontconfig,
+  glew,
+  gtk3,
 }:
 
 buildDotnetModule rec {
@@ -61,10 +62,10 @@ buildDotnetModule rec {
   ];
 
   postInstall = ''
-    install -Dm644 LoadByOS/LinuxConfigApp/libation_glass.svg $out/share/icons/hicolor/scalable/apps/${pname}.svg
-    install -Dm644 LoadByOS/LinuxConfigApp/Libation.desktop $out/share/applications/${pname}.desktop
-    substituteInPlace $out/share/applications/${pname}.desktop \
-        --replace "/usr/bin/libation" "${meta.mainProgram}"
+    install -Dm644 LoadByOS/LinuxConfigApp/libation_glass.svg $out/share/icons/hicolor/scalable/apps/libation.svg
+    install -Dm644 LoadByOS/LinuxConfigApp/Libation.desktop $out/share/applications/libation.desktop
+    substituteInPlace $out/share/applications/libation.desktop \
+        --replace-fail "/usr/bin/libation" "${meta.mainProgram}"
   '';
 
   # wrap manually, because we need lower case excutables
diff --git a/pkgs/by-name/li/litmusctl/package.nix b/pkgs/by-name/li/litmusctl/package.nix
new file mode 100644
index 000000000000..83ba16b98da2
--- /dev/null
+++ b/pkgs/by-name/li/litmusctl/package.nix
@@ -0,0 +1,43 @@
+{ buildGoModule
+, fetchFromGitHub
+, installShellFiles
+, kubectl
+, lib
+}:
+
+buildGoModule rec {
+  pname = "litmusctl";
+  version = "1.5.0";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  buildInputs = [
+    kubectl
+  ];
+
+  src = fetchFromGitHub {
+    owner = "litmuschaos";
+    repo = "litmusctl";
+    rev = "${version}";
+    hash = "sha256-FORrvPKDTG48WV03+HbXiBJa1IHfHV7yMDhQX64kn6U=";
+  };
+
+  vendorHash = "sha256-U4dp2E2TZ3rds63PS6GzUVhb2qDSv92bf9JCkWpdLew=";
+
+  postInstall = ''
+    installShellCompletion --cmd litmusctl \
+      --bash <($out/bin/litmusctl completion bash) \
+      --fish <($out/bin/listmusctl completion fish) \
+      --zsh <($out/bin/litmusctl completion zsh)
+  '';
+
+  meta = {
+    description = "Command-Line tool to manage Litmuschaos's agent plane";
+    homepage = "https://github.com/litmuschaos/litmusctl";
+    license = lib.licenses.asl20;
+    mainProgram = "litmusctl";
+    maintainers = with lib.maintainers; [ vinetos sailord ];
+  };
+}
diff --git a/pkgs/by-name/ni/nim_lk/package.nix b/pkgs/by-name/ni/nim_lk/package.nix
index 680ba976b5bd..184d1e27745a 100644
--- a/pkgs/by-name/ni/nim_lk/package.nix
+++ b/pkgs/by-name/ni/nim_lk/package.nix
@@ -1,23 +1,26 @@
-{ lib
-, buildNimPackage
-, fetchFromSourcehut
-, nim
-, nix-prefetch
-, nix-prefetch-git
-, openssl
-, makeWrapper
+{
+  lib,
+  buildNimPackage,
+  fetchFromSourcehut,
+  nim,
+  nix-prefetch,
+  nix-prefetch-git,
+  openssl,
+  makeWrapper,
 }:
 
-let nim' = nim.passthru.nim;
-in buildNimPackage (finalAttrs: {
+let
+  nim' = nim.passthru.nim;
+in
+buildNimPackage (finalAttrs: {
   pname = "nim_lk";
-  version = "20240210";
+  version = "20240510";
 
   src = fetchFromSourcehut {
     owner = "~ehmry";
     repo = "nim_lk";
     rev = finalAttrs.version;
-    hash = "sha256-LLOf8HNee0Mol+e7/dvu9hQUCmpaVBNggTxaAl/wV6Y=";
+    hash = "sha256-fwoGyYkbGstWG0qw15dOq1gmr3GyIn6ZEBeBmEivHlA=";
   };
 
   lockFile = ./lock.json;
@@ -29,7 +32,13 @@ in buildNimPackage (finalAttrs: {
 
   postFixup = ''
     wrapProgram $out/bin/nim_lk \
-      --suffix PATH : ${lib.makeBinPath [ nim' nix-prefetch nix-prefetch-git ]}
+      --suffix PATH : ${
+        lib.makeBinPath [
+          nim'
+          nix-prefetch
+          nix-prefetch-git
+        ]
+      }
   '';
 
   meta = finalAttrs.src.meta // {
diff --git a/pkgs/by-name/nr/nrr/package.nix b/pkgs/by-name/nr/nrr/package.nix
index 0992152aed3e..7d43400dba3e 100644
--- a/pkgs/by-name/nr/nrr/package.nix
+++ b/pkgs/by-name/nr/nrr/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nrr";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "ryanccn";
     repo = "nrr";
     rev = "v${version}";
-    hash = "sha256-94BeBCYCxZBoOp6xo4I/uxd6ULjIfmF4nw/vUWoaEpo=";
+    hash = "sha256-wof/KmoHiBkcn2aTh+M6bNH/B6Le3H6hnT8BzUCs0Pw=";
   };
 
-  cargoHash = "sha256-DTQTIAk914XC+LecQTXk1TdBc/5sMFG8KiD9lO5HLiM=";
+  cargoHash = "sha256-BtYZNZxFjgY/BFd1kwGyy/F1iRezSDxoPHF4exrNzuk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreFoundation
diff --git a/pkgs/by-name/on/onedriver/package.nix b/pkgs/by-name/on/onedriver/package.nix
index ae2ad038d58e..c4e3ba572d28 100644
--- a/pkgs/by-name/on/onedriver/package.nix
+++ b/pkgs/by-name/on/onedriver/package.nix
@@ -7,6 +7,7 @@
 , fuse
 , installShellFiles
 , wrapGAppsHook3
+, glib-networking
 , wrapperDir ? "/run/wrappers/bin"
 }:
 let
@@ -25,7 +26,7 @@ buildGoModule {
   vendorHash = "sha256-OOiiKtKb+BiFkoSBUQQfqm4dMfDW3Is+30Kwcdg8LNA=";
 
   nativeBuildInputs = [ pkg-config installShellFiles wrapGAppsHook3 ];
-  buildInputs = [ webkitgtk_4_1 glib fuse ];
+  buildInputs = [ webkitgtk_4_1 glib fuse glib-networking ];
 
   ldflags = [ "-X github.com/jstaf/onedriver/cmd/common.commit=v${version}" ];
 
diff --git a/pkgs/by-name/ot/oterm/package.nix b/pkgs/by-name/ot/oterm/package.nix
index 797ca5a05823..c321aca86236 100644
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@@ -1,59 +1,58 @@
-{ lib
-, python3Packages
-, fetchFromGitHub
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "oterm";
-  version = "0.2.7";
+  version = "0.2.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggozad";
     repo = "oterm";
     rev = "refs/tags/${version}";
-    hash = "sha256-vKVGSIneKQkFO1uoNaW/Yr6QTDhgokmIpkYFYIbm+U4=";
+    hash = "sha256-6UFNsEc6bYBrBYfCbeiDfemueeRMEXHGCT8junZVFtk=";
   };
 
   pythonRelaxDeps = [
     "aiosqlite"
-    "pillow"
     "httpx"
+    "ollama"
     "packaging"
+    "pillow"
     "typer"
   ];
 
+  build-system = with python3Packages; [ poetry-core ];
+
+  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
+
   propagatedBuildInputs = with python3Packages; [
-    ollama
-    textual
-    typer
-    python-dotenv
-    httpx
+    aiohttp
     aiosql
     aiosqlite
-    pyperclip
+    httpx
+    ollama
     packaging
-    rich-pixels
     pillow
-    aiohttp
+    pyperclip
+    python-dotenv
+    rich-pixels
+    textual
+    typer
   ];
 
-  nativeBuildInputs = with python3Packages; [
-    poetry-core
-    pythonRelaxDepsHook
-  ];
-
-  pythonImportsCheck = [
-    "oterm"
-  ];
+  pythonImportsCheck = [ "oterm" ];
 
   # Tests require a HTTP connection to ollama
   doCheck = false;
 
   meta = {
-    changelog = "https://github.com/ggozad/oterm/releases/tag/${version}";
     description = "A text-based terminal client for Ollama";
     homepage = "https://github.com/ggozad/oterm";
+    changelog = "https://github.com/ggozad/oterm/releases/tag/${version}";
     license = lib.licenses.mit;
     mainProgram = "oterm";
     maintainers = with lib.maintainers; [ suhr ];
diff --git a/pkgs/by-name/pr/pragtical/package.nix b/pkgs/by-name/pr/pragtical/package.nix
new file mode 100644
index 000000000000..cfa6269b89f4
--- /dev/null
+++ b/pkgs/by-name/pr/pragtical/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cacert,
+  meson,
+  ninja,
+  pkg-config,
+  freetype,
+  libgit2,
+  libuchardet,
+  libzip,
+  lua5_4,
+  luajit,
+  mbedtls_2,
+  pcre2,
+  SDL2,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pragtical";
+  version = "3.3.1";
+  pluginManagerVersion = "1.2.9";
+
+  src = fetchFromGitHub {
+    owner = "pragtical";
+    repo = "pragtical";
+    rev = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+
+    # also fetch required git submodules
+    postFetch = ''
+      cd "$out"
+
+      export NIX_SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+
+      substituteInPlace subprojects/ppm.wrap \
+          --replace-fail 'revision = head' 'revision = v${finalAttrs.pluginManagerVersion}'
+
+      ${lib.getExe meson} subprojects download \
+          colors plugins ppm
+
+      find subprojects -type d -name .git -prune -execdir rm -r {} +
+    '';
+
+    hash = "sha256-T0IHpfMfx4P84RyBLtaYNead6a7cID2cUYwkyNnYMgc=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    freetype
+    libgit2
+    libuchardet
+    libzip
+    lua5_4
+    luajit
+    mbedtls_2
+    pcre2
+    SDL2
+    zlib
+  ];
+
+  # workaround for `libmbedx509.so.1, libmbedcrypto.so.7: error adding symbols: DSO missing from command line`
+  env.NIX_LDFLAGS = "-lmbedx509 -lmbedcrypto";
+
+  mesonFlags = [ "-Duse_system_lua=true" ];
+
+  meta = {
+    changelog = "https://github.com/pragtical/pragtical/blob/${finalAttrs.src.rev}/changelog.md";
+    description = "A practical and pragmatic code editor";
+    homepage = "https://pragtical.dev";
+    license = lib.licenses.mit;
+    mainProgram = "pragtical";
+    maintainers = with lib.maintainers; [
+      suhr
+      tomasajt
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/sb/sbom-utility/package.nix b/pkgs/by-name/sb/sbom-utility/package.nix
index 213dc94cff57..0b3b9ffba21f 100644
--- a/pkgs/by-name/sb/sbom-utility/package.nix
+++ b/pkgs/by-name/sb/sbom-utility/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "sbom-utility";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "sbom-utility";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tNLMrtJj1eeJ4sVhDRR24/KVI1HzZSRquiImuDTNZFI=";
+    hash = "sha256-EqK2TGlv2RGfvR95lzYz3EHJkfq4q4Ty5H2zFdd9cME=";
   };
 
-  vendorHash = "sha256-EdzI5ypwZRksQVmcfGDUgEMa4CeAPcm237ZaKqmWQDY=";
+  vendorHash = "sha256-qh8kIwgrlmHkocM5ZoGnOY7ISJlct/TV7dAxvXlPw68=";
 
   preCheck = ''
     cd test
diff --git a/pkgs/by-name/su/superfile/package.nix b/pkgs/by-name/su/superfile/package.nix
new file mode 100644
index 000000000000..21abce75d3d0
--- /dev/null
+++ b/pkgs/by-name/su/superfile/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+let
+  version = "1.1.2";
+in
+buildGoModule {
+  pname = "superfile";
+  inherit version;
+
+  src =
+    fetchFromGitHub {
+      owner = "MHNightCat";
+      repo = "superfile";
+      rev = "v${version}";
+      hash = "sha256-Cn03oPGT+vCZQcC62p7COx8N8BGgra+qQaZyF+osVsA=";
+    }
+    + "/src";
+
+  vendorHash = "sha256-gWrhy3qzlXG072u5mW971N2Y4Vmt0KbZkB8SFsFgSzo=";
+
+  meta = {
+    changelog = "https://github.com/MHNightCat/superfile/blob/v${version}/changelog.md";
+    description = "Pretty fancy and modern terminal file manager";
+    homepage = "https://github.com/MHNightCat/superfile";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ momeemt ];
+    mainProgram = "superfile";
+  };
+}
diff --git a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
index 044334c60264..51b992bf7da7 100644
--- a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
+++ b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 let
-  version = "1.64.2";
+  version = "1.66.0";
 in
 buildGoModule {
   pname = "tailscale-nginx-auth";
@@ -11,9 +11,9 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-DS7C/G1Nj9gIjYwXaEeCLbtH9HbB0tRoJBDjZc/nq5g=";
+    hash = "sha256-ZI9/YlVHbdvEwD0YHWfUhciU2x4wp4GzTanwDvuIpz4=";
   };
-  vendorHash = "sha256-pYeHqYd2cCOVQlD1r2lh//KC+732H0lj1fPDBr+W8qA=";
+  vendorHash = "sha256-Hd77xy8stw0Y6sfk3/ItqRIbM/349M/4uf0iNy1xJGw=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/ue/ueberzugpp/package.nix b/pkgs/by-name/ue/ueberzugpp/package.nix
index 82fe4ef72ca8..cc0e0cd79535 100644
--- a/pkgs/by-name/ue/ueberzugpp/package.nix
+++ b/pkgs/by-name/ue/ueberzugpp/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ueberzugpp";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "jstkdng";
     repo = "ueberzugpp";
     rev = "v${version}";
-    hash = "sha256-D+7a+3Vxrt+XUq7c2F2eqi8ZGQ2eZd37aTqighWEKPs=";
+    hash = "sha256-BuVInCYpogkn1CnQ2hqLaTi1KJ0mHEEfRIOrTIg9duY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/wo/wowup-cf/package.nix b/pkgs/by-name/wo/wowup-cf/package.nix
new file mode 100644
index 000000000000..2fcbd3600309
--- /dev/null
+++ b/pkgs/by-name/wo/wowup-cf/package.nix
@@ -0,0 +1,37 @@
+{ lib, appimageTools, fetchurl }:
+
+let
+  version = "2.12.0";
+  pname = "wowup-cf";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/WowUp/WowUp.CF/releases/download/v${version}/WowUp-CF-${version}.AppImage";
+    hash = "sha256-uWz/EQBX/d1UBfpc9EL4x+UH72kINd6pqFIvJkV16e8=";
+  };
+
+  appimageContents = appimageTools.extractType1 { inherit name src; };
+in appimageTools.wrapType1 {
+  inherit name src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "World of Warcraft addon updater with CurseForge support";
+    longDescription = ''
+    WowUp is the community centered World of Warcraft addon updater. We attempt to bring the addon community together in an easy to use updater application. We have an ever growing list of supported features.
+    '';
+    homepage = "https://wowup.io/";
+    downloadPage = "https://github.com/WowUp/WowUp.CF/releases";
+    license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ pbek ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/servers/caddy/xcaddy/inject_version_info.diff b/pkgs/by-name/xc/xcaddy/inject_version_info.diff
similarity index 100%
rename from pkgs/servers/caddy/xcaddy/inject_version_info.diff
rename to pkgs/by-name/xc/xcaddy/inject_version_info.diff
diff --git a/pkgs/servers/caddy/xcaddy/default.nix b/pkgs/by-name/xc/xcaddy/package.nix
similarity index 100%
rename from pkgs/servers/caddy/xcaddy/default.nix
rename to pkgs/by-name/xc/xcaddy/package.nix
diff --git a/pkgs/servers/caddy/xcaddy/use_tmpdir_on_darwin.diff b/pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff
similarity index 100%
rename from pkgs/servers/caddy/xcaddy/use_tmpdir_on_darwin.diff
rename to pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff
diff --git a/pkgs/data/fonts/undefined-medium/default.nix b/pkgs/data/fonts/undefined-medium/default.nix
index c1b22f787117..f981b9f85e29 100644
--- a/pkgs/data/fonts/undefined-medium/default.nix
+++ b/pkgs/data/fonts/undefined-medium/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "undefined-medium";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchzip {
-    url = "https://github.com/andirueckel/undefined-medium/archive/v1.2.zip";
-    hash = "sha256-hgHwi25T+aM7ljzk5uR4x+CqoRJ3/IOyktdp/mDW46I=";
+    url = "https://github.com/andirueckel/undefined-medium/archive/v1.3.zip";
+    hash = "sha256-cVdk6a0xijAQ/18W5jalqRS7IiPufMJW27Scns+nbEY=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/icons/whitesur-cursors/default.nix b/pkgs/data/icons/whitesur-cursors/default.nix
index c16efa996d34..167c2b3578b7 100644
--- a/pkgs/data/icons/whitesur-cursors/default.nix
+++ b/pkgs/data/icons/whitesur-cursors/default.nix
@@ -1,17 +1,18 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
 }:
 
 stdenvNoCC.mkDerivation {
   pname = "whitesur-cursors";
-  version = "unstable-2022-06-17";
+  version = "0-unstable-2022-06-17";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = "WhiteSur-cursors";
     rev = "5c94e8c22de067282f4cf6d782afd7b75cdd08c8";
-    sha256 = "sha256-CFse0XZzJu+PWDcqmvIXvue+3cKX47oavZU9HYRDAg0=";
+    hash = "sha256-CFse0XZzJu+PWDcqmvIXvue+3cKX47oavZU9HYRDAg0=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index 72d626eed749..705dfed8a249 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -28,7 +28,7 @@
 , sysctl
 , buildLlvmTools
 , debugVersion ? false
-, doCheck ? (if lib.versionOlder release_version "15" then stdenv.isLinux else true)
+, doCheck ? !stdenv.isAarch32 && (if lib.versionOlder release_version "15" then stdenv.isLinux else true)
   && (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
   && !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian)
   && (stdenv.hostPlatform == stdenv.buildPlatform)
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 411695219971..75ead6184aa8 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -113,6 +113,15 @@ stdenv.mkDerivation (self: rec {
     # have it block a release.
     "futex-wait.test.sh"
   ];
+  patches = [
+    # Support the NIX_SBCL_DYNAMIC_SPACE_SIZE envvar. Upstream SBCL didn’t want
+    # to include this (see
+    # "https://sourceforge.net/p/sbcl/mailman/sbcl-devel/thread/2cf20df7-01d0-44f2-8551-0df01fe55f1a%400brg.net/"),
+    # but for Nix envvars are sufficiently useful that it’s worth maintaining
+    # this functionality downstream.
+    ./dynamic-space-size-envvar-feature.patch
+    ./dynamic-space-size-envvar-tests.patch
+  ];
   postPatch = lib.optionalString (self.disabledTestFiles != [ ]) ''
     (cd tests ; rm -f ${lib.concatStringsSep " " self.disabledTestFiles})
   ''
diff --git a/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-feature.patch b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-feature.patch
new file mode 100644
index 000000000000..f1596958a6f8
--- /dev/null
+++ b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-feature.patch
@@ -0,0 +1,63 @@
+From ac15f9f7c75c1fb5767514e64b609e2a75e6fe9d Mon Sep 17 00:00:00 2001
+From: Hraban Luyat <hraban@0brg.net>
+Date: Sat, 13 Apr 2024 14:04:57 -0400
+Subject: [PATCH] feat: NIX_SBCL_DYNAMIC_SPACE_SIZE envvar
+
+Read SBCL dynamic space size configuration from env if available.
+---
+ src/runtime/runtime.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/src/runtime/runtime.c b/src/runtime/runtime.c
+index 274687c8f..970caa8f4 100644
+--- a/src/runtime/runtime.c
++++ b/src/runtime/runtime.c
+@@ -422,6 +422,29 @@ static int is_memsize_arg(char *argv[], int argi, int argc, int *merge_core_page
+     return 0;
+ }
+ 
++/**
++ * Read memory options from the environment, if present.
++ *
++ * Memory settings are read in the following priority:
++ *
++ * 1. command line arguments
++ * 2. environment variable
++ * 3. embedded options in core
++ * 4. default
++ */
++static void
++read_memsize_from_env(void) {
++  const char *val = getenv("NIX_SBCL_DYNAMIC_SPACE_SIZE");
++  // The distinction is blurry between setting an envvar to the empty string and
++  // unsetting it entirely. Depending on the calling environment it can even be
++  // tricky to properly unset an envvar in the first place. An empty envvar is
++  // practically always intended to just mean “unset”, so let’s interpret it
++  // that way.
++  if (val != NULL && (strcmp(val, "") != 0)) {
++    dynamic_space_size = parse_size_arg(val, "NIX_SBCL_DYNAMIC_SPACE_SIZE");
++  }
++}
++
+ static struct cmdline_options
+ parse_argv(struct memsize_options memsize_options,
+            int argc, char *argv[], char *envp[], char *core)
+@@ -462,6 +485,7 @@ parse_argv(struct memsize_options memsize_options,
+         dynamic_space_size = memsize_options.dynamic_space_size;
+         thread_control_stack_size = memsize_options.thread_control_stack_size;
+         dynamic_values_bytes = memsize_options.thread_tls_bytes;
++        read_memsize_from_env();
+         int stop_parsing = 0; // have we seen '--'
+         int output_index = 1;
+ 
+@@ -488,6 +512,7 @@ parse_argv(struct memsize_options memsize_options,
+         }
+         sbcl_argv[output_index] = 0;
+     } else {
++        read_memsize_from_env();
+         bool end_runtime_options = 0;
+         /* Parse our any of the command-line options that we handle from C,
+          * stopping at the first one that we don't, and leave the rest */
+-- 
+2.44.0
+
diff --git a/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-tests.patch b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-tests.patch
new file mode 100644
index 000000000000..1a507cc90381
--- /dev/null
+++ b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-tests.patch
@@ -0,0 +1,104 @@
+From 9d4a886a8a76ea8be51bcf754cefacdf30986f46 Mon Sep 17 00:00:00 2001
+From: Hraban Luyat <hraban@0brg.net>
+Date: Sat, 13 Apr 2024 15:39:58 -0400
+Subject: [PATCH 2/2] test: dynamic space size envvar and precedence
+
+---
+ tests/memory-args.test.sh | 22 ++++++++++++++++++++++
+ tests/save7.test.sh       | 37 ++++++++++++++++++++++++++++++++-----
+ 2 files changed, 54 insertions(+), 5 deletions(-)
+ create mode 100755 tests/memory-args.test.sh
+
+diff --git a/tests/memory-args.test.sh b/tests/memory-args.test.sh
+new file mode 100755
+index 000000000..72ef0cc79
+--- /dev/null
++++ b/tests/memory-args.test.sh
+@@ -0,0 +1,22 @@
++#!/bin/sh
++
++. ./subr.sh
++
++use_test_subdirectory
++
++set -e
++
++# Allow slight shrinkage if heap relocation has to adjust for alignment
++NIX_SBCL_DYNAMIC_SPACE_SIZE=234mb run_sbcl_with_args --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++NIX_SBCL_DYNAMIC_SPACE_SIZE=555mb run_sbcl_with_args --dynamic-space-size 234mb --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++run_sbcl_with_args --dynamic-space-size 234mb --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++exit $EXIT_TEST_WIN
+diff --git a/tests/save7.test.sh b/tests/save7.test.sh
+index f9225543b..3c35e7b31 100644
+--- a/tests/save7.test.sh
++++ b/tests/save7.test.sh
+@@ -59,9 +59,9 @@ run_sbcl_with_core "$tmpcore" --noinform --control-stack-size 640KB \
+   (assert (eql (extern-alien "dynamic_values_bytes" (unsigned 32))
+                (* 5000 sb-vm:n-word-bytes)))
+   ; allow slight shrinkage if heap relocation has to adjust for alignment
+-  (defun dynamic-space-size-good-p ()
+-    (<= 0 (- (* 260 1048576) (dynamic-space-size)) 65536))
+-  (assert (dynamic-space-size-good-p))
++  (defun dynamic-space-size-good-p (expected-mb)
++    (<= 0 (- (* expected-mb 1024 1024) (dynamic-space-size)) 65536))
++  (assert (dynamic-space-size-good-p 260))
+   (save-lisp-and-die "${tmpcore}2" :executable t :save-runtime-options t)
+ EOF
+ chmod u+x "${tmpcore}2"
+@@ -70,15 +70,42 @@ echo "::: INFO: prepared test core"
+   (when (and (eql (extern-alien "thread_control_stack_size" unsigned) (* 640 1024))
+              (eql (extern-alien "dynamic_values_bytes" (unsigned 32))
+                   (* 5000 sb-vm:n-word-bytes))
+-             (dynamic-space-size-good-p))
++             (dynamic-space-size-good-p 260))
+     (exit :code 42))
+ EOF
+ status=$?
+-rm "$tmpcore" "${tmpcore}2"
+ if [ $status -ne 42 ]; then
+     echo "re-saved executable used wrong memory size options"
+     exit 1
+ fi
+ echo "::: Success"
+ 
++echo "::: Running :DYNAMIC-SPACE-SIZE-ENV"
++NIX_SBCL_DYNAMIC_SPACE_SIZE=432MB ./"${tmpcore}2" --no-userinit --no-sysinit --noprint <<EOF
++  (when (dynamic-space-size-good-p 432)
++    (exit :code 42))
++EOF
++status=$?
++if [ $status -ne 42 ]; then
++    echo "re-saved executable should have prioritized memory specification from env"
++    exit 1
++fi
++echo "::: Success"
++
++echo "::: Running :DYNAMIC-SPACE-SIZE-PRECEDENCE"
++NIX_SBCL_DYNAMIC_SPACE_SIZE=432MB ./"${tmpcore}2" --dynamic-space-size 333MB \
++  --no-userinit --no-sysinit --noprint <<EOF
++  (when (dynamic-space-size-good-p 333))
++    (exit :code 42))
++EOF
++status=$?
++rm "$tmpcore" "${tmpcore}2"
++if [ $status -ne 42 ]; then
++    echo "re-saved executable should have prioritized memory specification from arg"
++    exit 1
++fi
++echo "::: Success"
++
++
++
+ exit $EXIT_TEST_WIN
+-- 
+2.44.0
+
diff --git a/pkgs/development/compilers/terra/default.nix b/pkgs/development/compilers/terra/default.nix
index 3f6934f04212..ae81adf5f5b0 100644
--- a/pkgs/development/compilers/terra/default.nix
+++ b/pkgs/development/compilers/terra/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, llvmPackages, ncurses, cmake, libxml2
+{ lib, stdenv, fetchFromGitHub, llvmPackages_16, ncurses, cmake, libxml2
 , symlinkJoin, breakpointHook, cudaPackages, enableCUDA ? false
 , libffi, libobjc, libpfm, Cocoa, Foundation
 }:
@@ -14,6 +14,7 @@ let
     sha256 = "1g87pl014b5v6z2nnhiwn3wf405skawszfr5wdzyfbx00j3kgxd0";
   };
 
+  llvmPackages = llvmPackages_16;
   llvmMerged = symlinkJoin {
     name = "llvmClangMerged";
     paths = with llvmPackages; [
diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix
index d839e372570a..a63f1391616d 100644
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.2.18";
-    hash = "sha256-ygsHwlQgAyD1GKxbPfVAqc8U2GbzyT7cMBO1Lgb6x5Y=";
+    version = "8.2.19";
+    hash = "sha256-PBj3zlG3x7JreX4flwedOGswNH6wToF/XmyOmydeKmo=";
   });
 in
 base.withExtensions ({ all, ... }: with all; ([
diff --git a/pkgs/development/interpreters/php/8.3.nix b/pkgs/development/interpreters/php/8.3.nix
index d7ac07c1fb55..1da9841f7894 100644
--- a/pkgs/development/interpreters/php/8.3.nix
+++ b/pkgs/development/interpreters/php/8.3.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.3.6";
-    hash = "sha256-YySx3djrMCWwQQNLiNwrwLSBmwAiEp7q66N+R4AxCLw=";
+    version = "8.3.7";
+    hash = "sha256-AcIM3hxaVpZlGHXtIvUHhJZ5+6dA+MQhYWt9Q9f3l9o=";
   });
 in
 base.withExtensions ({ all, ... }: with all; ([
diff --git a/pkgs/development/libraries/java/commons/io/default.nix b/pkgs/development/libraries/java/commons/io/default.nix
index 4c010829c6ff..254709052348 100644
--- a/pkgs/development/libraries/java/commons/io/default.nix
+++ b/pkgs/development/libraries/java/commons/io/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "2.15.1";
+  version = "2.16.1";
   pname = "commons-io";
 
   src = fetchurl {
     url    = "mirror://apache/commons/io/binaries/${pname}-${version}-bin.tar.gz";
-    sha256 = "sha256-nYoYGHetdd3vFryFXLxuvvSUCIs6VZyPwWb8s0h+edg=";
+    sha256 = "sha256-4+YYSDyCHwUwlw71nAnGy4g9GOl1Z8qr3gHQEyv8EPo=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/java/commons/logging/default.nix b/pkgs/development/libraries/java/commons/logging/default.nix
index 085efc6e52b5..f7debe8a7bdc 100644
--- a/pkgs/development/libraries/java/commons/logging/default.nix
+++ b/pkgs/development/libraries/java/commons/logging/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "commons-logging";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchurl {
     url    = "mirror://apache/commons/logging/binaries/commons-logging-${version}-bin.tar.gz";
-    sha256 = "sha256-ij6jOi1Y/iQ/9Ht41nKtmOdZCvf0NmNseFGxBpyq1fg=";
+    sha256 = "sha256-mM85vfWDc88fNwwflvnRvoh/tb+jDH3o+96RZa9Sp7w=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/libsolv/default.nix b/pkgs/development/libraries/libsolv/default.nix
index 60e7da290726..e044037eb79d 100644
--- a/pkgs/development/libraries/libsolv/default.nix
+++ b/pkgs/development/libraries/libsolv/default.nix
@@ -17,14 +17,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.28";
+  version = "0.7.29";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "libsolv";
     rev = version;
-    hash = "sha256-cL7SDwCzXM2qJQfiu/3nfAiFbcFNn1YXD23Sl3n9nzY=";
+    hash = "sha256-867sCGFvKib1As9BCiCi6LYVrLUK0pjtM5Bw9Yuu0D8=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/malcontent/default.nix b/pkgs/development/libraries/malcontent/default.nix
index 34d1731e8a09..f346906eadc2 100644
--- a/pkgs/development/libraries/malcontent/default.nix
+++ b/pkgs/development/libraries/malcontent/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "malcontent";
-  version = "0.11.1";
+  version = "0.12.0";
 
   outputs = [ "bin" "out" "lib" "pam" "dev" "man" "installedTests" ];
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "pwithnall";
     repo = "malcontent";
     rev = version;
-    hash = "sha256-NZwVCnQrEG2gecUjuWe1+cyWFR3OdYJCmj87V14Uwjw=";
+    hash = "sha256-UK/WVqDMkwIqkTFFjzh7PRCA/Ej8Iyu33FasnAEApRs=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/rutabaga_gfx/default.nix b/pkgs/development/libraries/rutabaga_gfx/default.nix
index 687500272735..9b8f5bec42f3 100644
--- a/pkgs/development/libraries/rutabaga_gfx/default.nix
+++ b/pkgs/development/libraries/rutabaga_gfx/default.nix
@@ -54,14 +54,22 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-wuF3Isrp+u5J8jPQoPsIOWYGNKLSNa2pLfvladAWkLs=";
   };
 
+  CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
+  "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER" =
+    "${stdenv.cc.targetPrefix}cc";
+
+  postConfigure = ''
+    cd rutabaga_gfx/ffi
+    substituteInPlace Makefile --replace-fail pkg-config "$PKG_CONFIG"
+  '';
+
   # make install always rebuilds
   dontBuild = true;
 
-  makeFlags = [ "prefix=$(out)" ];
-
-  preInstall = ''
-    cd rutabaga_gfx/ffi
-  '';
+  makeFlags = [
+    "prefix=$(out)"
+    "OUT=target/${stdenv.hostPlatform.rust.cargoShortTarget}/release"
+  ];
 
   meta = with lib; {
     homepage = "https://crosvm.dev/book/appendix/rutabaga_gfx.html";
diff --git a/pkgs/development/python-modules/asyncio-dgram/default.nix b/pkgs/development/python-modules/asyncio-dgram/default.nix
index f999cd3b3b34..cdd6ac9b9781 100644
--- a/pkgs/development/python-modules/asyncio-dgram/default.nix
+++ b/pkgs/development/python-modules/asyncio-dgram/default.nix
@@ -1,32 +1,33 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "asyncio-dgram";
-  version = "2.1.2";
-  format = "setuptools";
+  version = "2.2.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jsbronder";
-    repo = pname;
-    rev = "refs/tagsv${version}";
+    repo = "asyncio-dgram";
+    rev = "refs/tags/v${version}";
     hash = "sha256-Eb/9JtgPT2yOlfnn5Ox8M0kcQhSlRCuX8+Rq6amki8Q=";
   };
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  build-system = [ setuptools ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     pytest-asyncio
+    pytestCheckHook
   ];
 
   # OSError: AF_UNIX path too long
@@ -38,9 +39,7 @@ buildPythonPackage rec {
     "test_from_socket_bad_socket"
   ];
 
-  pythonImportsCheck = [
-    "asyncio_dgram"
-  ];
+  pythonImportsCheck = [ "asyncio_dgram" ];
 
   meta = with lib; {
     description = "Python support for higher level Datagram";
diff --git a/pkgs/development/python-modules/binance-connector/default.nix b/pkgs/development/python-modules/binance-connector/default.nix
new file mode 100644
index 000000000000..c8d3b044b558
--- /dev/null
+++ b/pkgs/development/python-modules/binance-connector/default.nix
@@ -0,0 +1,61 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pycryptodome
+, pythonOlder
+, requests
+, websocket-client
+# dependencies for tests
+, pytest-cov
+, pytest
+, sure
+, responses
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "binance-connector";
+  version = "3.7.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "binance";
+    repo = "${pname}-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-hmn8WKr+krzOzHNJ/aynXAbf+rHxDfyKDgycdQQU3xk=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    pycryptodome
+    websocket-client
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov
+    pytest
+    sure
+    responses
+    pytestCheckHook
+  ];
+
+  # pytestCheckHook attempts to run examples directory, which requires
+  # network access
+  disabledTestPaths = [
+    "examples/"
+  ];
+
+  pythonImportsCheck = [
+    "binance.spot"
+    "binance.websocket"
+  ];
+
+  meta = with lib; {
+    description = "Simple connector to Binance Public API";
+    homepage = "https://github.com/binance/binance-connector-python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ trishtzy ];
+  };
+}
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index bb0a67a7ede0..6019b702efd5 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -366,7 +366,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.101";
+  version = "1.34.103";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -374,7 +374,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-GexON+k1FlMZID3tULcKLLxrVUscVMzS9fZNgD+rB4U=";
+    hash = "sha256-MxMTEnOQKpgEYyL4wZkl7NUykk66ZOm/wFKNBGrrbYw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dask-jobqueue/default.nix b/pkgs/development/python-modules/dask-jobqueue/default.nix
index dc668ea2639a..69ef4a56f962 100644
--- a/pkgs/development/python-modules/dask-jobqueue/default.nix
+++ b/pkgs/development/python-modules/dask-jobqueue/default.nix
@@ -8,6 +8,7 @@
 , fetchPypi
 , pytest-asyncio
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 }:
 
@@ -16,7 +17,8 @@ buildPythonPackage rec {
   version = "0.8.5";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  # Python 3.12 support should be added in 0.8.6
+  disabled = pythonOlder "3.8" || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/meilisearch/default.nix b/pkgs/development/python-modules/meilisearch/default.nix
index e5e47b934fd3..4ad70db3281b 100644
--- a/pkgs/development/python-modules/meilisearch/default.nix
+++ b/pkgs/development/python-modules/meilisearch/default.nix
@@ -1,38 +1,35 @@
-{ lib
-, buildPythonPackage
-, camel-converter
-, fetchFromGitHub
-, pythonOlder
-, setuptools
-, requests
+{
+  lib,
+  buildPythonPackage,
+  camel-converter,
+  fetchFromGitHub,
+  pythonOlder,
+  setuptools,
+  requests,
 }:
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.31.0";
+  version = "0.31.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mgslzRd2hvDI0SbQR3eY2vzvaaOVI6mUihdNPKe4jcg=";
+    hash = "sha256-rD9f0J8Ez+WrpEyDZa3GVuBxj6Kv7McBzIuk9RtsjHk=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     camel-converter
     requests
   ] ++ camel-converter.optional-dependencies.pydantic;
 
-  pythonImportsCheck = [
-    "meilisearch"
-  ];
+  pythonImportsCheck = [ "meilisearch" ];
 
   # Tests spin up a local server and are not mocking the requests
   doCheck = false;
diff --git a/pkgs/development/python-modules/ollama/default.nix b/pkgs/development/python-modules/ollama/default.nix
index 4d1999a8aae8..299af4e9c964 100644
--- a/pkgs/development/python-modules/ollama/default.nix
+++ b/pkgs/development/python-modules/ollama/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "ollama";
-  version = "0.1.9";
+  version = "0.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "ollama";
     repo = "ollama-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ilJgRMzCn/T+6Lr7IuvaCnKhN5cyyEOWuV0N1FtR+Yg=";
+    hash = "sha256-kfotKUUXBekUd0X32BYAjNWvQJO94bdEDCSrBg2yJRQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pydeck/default.nix b/pkgs/development/python-modules/pydeck/default.nix
index 6edd7a379b3e..2ea1a86f356a 100644
--- a/pkgs/development/python-modules/pydeck/default.nix
+++ b/pkgs/development/python-modules/pydeck/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pydeck";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B+3egz98/O9nSRJDURlap9zSRmPUkJ/XiY29C2+8Aew=";
+    hash = "sha256-/Yt19hyg1HEtMrTgc0QPHLdPLgwWoLV+V6AOZcVjzFQ=";
   };
 
   # upstream has an invalid pyproject.toml
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index c59205aa3f1a..93f5e3567839 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -1,26 +1,30 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, gitpython
-, pytestCheckHook
-, pythonOlder
-, requests
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  gitpython,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.9";
-  format = "setuptools";
+  version = "0.2.16";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-q16YB0lLlw9nXohcT20l41Bv40CqshWzE8nVBBSEppE=";
+    hash = "sha256-PP9dR8Jl4eWsky3vO9Pgraw0plik/5aWvmOAEc2/Qpo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     gitpython
     requests
   ];
@@ -28,14 +32,12 @@ buildPythonPackage rec {
   # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "pyExploitDb"
-  ];
+  pythonImportsCheck = [ "pyExploitDb" ];
 
   meta = with lib; {
     description = "Library to fetch the most recent exploit-database";
     homepage = "https://github.com/GoVanguard/pyExploitDb";
-    changelog = "https://github.com/GoVanguard/pyExploitDb/blob/master/Changelog.txt";
+    changelog = "https://github.com/GoVanguard/pyExploitDb/blob/master/ChangeLog.md";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/rq/default.nix b/pkgs/development/python-modules/rq/default.nix
index a0ed2d38b2d8..47a0a7dcfc5e 100644
--- a/pkgs/development/python-modules/rq/default.nix
+++ b/pkgs/development/python-modules/rq/default.nix
@@ -47,16 +47,17 @@ buildPythonPackage rec {
     sentry-sdk
   ];
 
-  preCheck = lib.optionalString stdenv.isLinux ''
+  preCheck = ''
     PATH=$out/bin:$PATH
     ${redis-server}/bin/redis-server &
-    REDIS_PID=$!
   '';
 
-  postCheck = lib.optionalString stdenv.isLinux ''
-    kill $REDIS_PID
+  postCheck = ''
+    kill %%
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTests = [
     # https://github.com/rq/rq/commit/fd261d5d8fc0fe604fa396ee6b9c9b7a7bb4142f
     "test_clean_large_registry"
diff --git a/pkgs/development/python-modules/thriftpy2/default.nix b/pkgs/development/python-modules/thriftpy2/default.nix
index e6a696dec9bb..4a125dd1775b 100644
--- a/pkgs/development/python-modules/thriftpy2/default.nix
+++ b/pkgs/development/python-modules/thriftpy2/default.nix
@@ -1,32 +1,34 @@
-{ lib
-, buildPythonPackage
-, cython
-, fetchFromGitHub
-, ply
-, pythonOlder
-, six
-, tornado
+{
+  lib,
+  buildPythonPackage,
+  cython,
+  fetchFromGitHub,
+  ply,
+  pythonOlder,
+  six,
+  setuptools,
+  tornado,
 }:
 
 buildPythonPackage rec {
   pname = "thriftpy2";
-  version = "0.4.20";
-  format = "setuptools";
+  version = "0.5.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Thriftpy";
-    repo = pname;
+    repo = "thriftpy2";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IEYoSLaJUeQdwHaXR0UUlCZg5zBEh5Y2/IwB4RVEAcg=";
+    hash = "sha256-Pjy9OPwFfKaw+XVl7IbbAKPz050TlqI4+yLqSITOkSY=";
   };
 
-  nativeBuildInputs = [
-    cython
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [ cython ];
+
+  dependencies = [
     ply
     six
     tornado
@@ -35,9 +37,7 @@ buildPythonPackage rec {
   # Not all needed files seems to be present
   doCheck = false;
 
-  pythonImportsCheck = [
-    "thriftpy2"
-  ];
+  pythonImportsCheck = [ "thriftpy2" ];
 
   meta = with lib; {
     description = "Python module for Apache Thrift";
diff --git a/pkgs/development/python-modules/types-pyopenssl/default.nix b/pkgs/development/python-modules/types-pyopenssl/default.nix
index a00f14c89395..586e5138aaac 100644
--- a/pkgs/development/python-modules/types-pyopenssl/default.nix
+++ b/pkgs/development/python-modules/types-pyopenssl/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyopenssl";
-  version = "24.0.0.20240417";
+  version = "24.1.0.20240425";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-pyOpenSSL";
     inherit version;
-    hash = "sha256-OOdfuCjScXvhc3cLuujCKBH97GjivD9YM5VBE+uEI30=";
+    hash = "sha256-Cn6CYmwZg9yNxZKSvyBlSlHDw4gby7mzN8HabjLwIE4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/stylelint/default.nix b/pkgs/development/tools/analysis/stylelint/default.nix
index 26bc3b7893fe..f2c478ea49cf 100644
--- a/pkgs/development/tools/analysis/stylelint/default.nix
+++ b/pkgs/development/tools/analysis/stylelint/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "stylelint";
-  version = "16.4.0";
+  version = "16.5.0";
 
   src = fetchFromGitHub {
     owner = "stylelint";
     repo = "stylelint";
     rev = version;
-    hash = "sha256-N689OjxUo3KPN3mfNQ1cKYoe8DXcVTNkUO4NuZPGuXI=";
+    hash = "sha256-kbcf0OPAIeEdh5YI2qqaLJww+ZejfXt/llJTK10nE0M=";
   };
 
-  npmDepsHash = "sha256-V+hiUMenskHV+ccYysBDD5WoQH9vem+uEfQ5SWEdVFU=";
+  npmDepsHash = "sha256-tENUngFWjrmsJErvbmFflwGL0uxou0vQjC/MwfCpm+Y=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/development/tools/apko/default.nix b/pkgs/development/tools/apko/default.nix
index 6a1ffc9376e2..34cf2c2e3a15 100644
--- a/pkgs/development/tools/apko/default.nix
+++ b/pkgs/development/tools/apko/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "apko";
-  version = "0.13.2";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PGRbJ7znsjvh/ATBF8k+pMnRO8wvGY0PAVswVmFaBUc=";
+    hash = "sha256-e9xWLDs0txl+eiqim3gj7vJRGOFY6MrqOAa1l0TaTbs=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-aqxXCqhvCGQKI+4FDjbqPNeFvELZviQ7Inwxl65sowk=";
+  vendorHash = "sha256-FeljCUtHTKni0yU7JwnaeKYJU7pM527drqBgaxWH/cI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/biome/default.nix b/pkgs/development/tools/biome/default.nix
index 2072adf22641..567484695251 100644
--- a/pkgs/development/tools/biome/default.nix
+++ b/pkgs/development/tools/biome/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "biome";
-  version = "1.6.3";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "cli/v${version}";
-    hash = "sha256-DooUOp+fr5oOrx04SLlTGro8xc2LieVPNtdvDyTLL/s=";
+    hash = "sha256-iSL0PRHj32PpKoUogej0bc/zXGpS4ZgZG/+9Pewhl4k=";
   };
 
-  cargoHash = "sha256-zMMfLDhiqG8Ahe+7PFjpOtwaBXbKkLDIIoHS329/4uQ=";
+  cargoHash = "sha256-no6ZrH1Ma+n66SLgA3h9dQX8FgeVjFVkxfqR35F/prs=";
 
   nativeBuildInputs = [
     pkg-config
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "-p=biome_cli" ];
   cargoTestFlags = cargoBuildFlags ++
-    # skip a broken test from v1.6.3 release
+    # skip a broken test from v1.7.3 release
     # this will be removed on the next version
     [ "-- --skip=diagnostics::test::termination_diagnostic_size" ];
 
diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
index e6f6b8bf4c45..26d98065c820 100644
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "drone.io${lib.optionalString (!enableUnfree) "-oss"}";
-  version = "2.23.0";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "harness";
     repo = "drone";
     rev = "v${version}";
-    sha256 = "sha256-HkyR2h7dgbEhqexJXyGebP3zkoTLlzuY+1O2pidAveQ=";
+    sha256 = "sha256-IiSsw0bZDAVuOrm7JBTT14Cf7I/koeS2Yw6vWYBG7kA=";
   };
 
   vendorHash = "sha256-n4KbKkqAnHDIsXs8A/FE+rCkSKQKr5fv7npJ/X6t0mk=";
diff --git a/pkgs/development/tools/database/atlas/default.nix b/pkgs/development/tools/database/atlas/default.nix
index 270d13492785..8fc770f92cd7 100644
--- a/pkgs/development/tools/database/atlas/default.nix
+++ b/pkgs/development/tools/database/atlas/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "atlas";
-  version = "0.21.1";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     rev = "v${version}";
-    hash = "sha256-i0nqjlL22sM8eVXCD/SBJyNdy0l0Hq4rjW0Lr3CRZlE=";
+    hash = "sha256-NsSDNeciHwlc7LZmuTOzoLNVsjAE+4YGThD/omMbjaE=";
   };
 
   modRoot = "cmd/atlas";
 
   proxyVendor = true;
-  vendorHash = "sha256-48UmLwp93SjwPPrdySFVApjVf1Rsj3oNhi1lha4ZvyE=";
+  vendorHash = "sha256-rM2l7U/ZkL0NIGPPbmBQ+P6mzGxdX4aQeS8Hz6EFmQc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/ent/default.nix b/pkgs/development/tools/ent/default.nix
index a1357c8ab2d3..58482135068c 100644
--- a/pkgs/development/tools/ent/default.nix
+++ b/pkgs/development/tools/ent/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ent-go";
-  version = "0.12.5";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "ent";
     repo = "ent";
     rev = "v${version}";
-    sha256 = "sha256-g4n9cOTv/35WkvMjrtP2eEcbiu5kiafVXifz1zlEuCY=";
+    sha256 = "sha256-OEQWNWGVs0QYhPuCGEFgAVaUnfswmvWVt+e0cAdkBKE=";
   };
 
-  vendorHash = "sha256-DUi4Ik+qFbx4LIm9MDJ4H9/+sIfCzK8MMGKp0GIGX7w=";
+  vendorHash = "sha256-9KdSGIyi95EVQq9jGoVqK8aq3JXlQXB+Qwlh/Kfz4Oc=";
 
   subPackages = [ "cmd/ent" ];
 
@@ -29,13 +29,13 @@ buildGoModule rec {
       --zsh <($out/bin/ent completion zsh)
   '';
 
-  meta = with lib; {
+  meta = {
     description = "An entity framework for Go";
     homepage = "https://entgo.io/";
+    changelog = "https://github.com/ent/ent/releases/tag/v${version}";
     downloadPage = "https://github.com/ent/ent";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    license = lib.licenses.asl20;
+    maintainers = [ ];
     mainProgram = "ent";
   };
 }
-
diff --git a/pkgs/development/tools/faas-cli/default.nix b/pkgs/development/tools/faas-cli/default.nix
index 2149eb50c278..da0151b8486e 100644
--- a/pkgs/development/tools/faas-cli/default.nix
+++ b/pkgs/development/tools/faas-cli/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.16.26";
+  version = "0.16.27";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-eyQpeud0rW07eb6wtcTYem10LWf/g2dxRwQEMH29wL8=";
+    sha256 = "sha256-CZvIvvkDfpb4YPQIe5i8vZcmhLu7x0zTQGXCL8SxcvM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/git-ps-rs/default.nix b/pkgs/development/tools/git-ps-rs/default.nix
index 6d4a5be75418..b9e41327237b 100644
--- a/pkgs/development/tools/git-ps-rs/default.nix
+++ b/pkgs/development/tools/git-ps-rs/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-ps-rs";
-  version = "7.0.0";
+  version = "7.1.1";
 
   src = fetchFromGitHub {
     owner = "uptech";
     repo = "git-ps-rs";
     rev = version;
-    hash = "sha256-HPHFjYfug642NXeNmv50UzsdOAlDR9F/MtgYnzwiZP8=";
+    hash = "sha256-HkiCc/5Xx+1IKMz/vXPXwUp3c8qSjobhQaIJCzq8dqQ=";
   };
 
-  cargoHash = "sha256-mvRcOwCe5NQ+cJ9brnbZ6HLtLn+fnjYzSBQwA3Qn9PU=";
+  cargoHash = "sha256-r4cmnLkW8ocTcTECAbCk3S94T09lOUzHLQIGHv97W54=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/misc/astyle/default.nix b/pkgs/development/tools/misc/astyle/default.nix
index f7c7a1f09cdb..a23e7936985c 100644
--- a/pkgs/development/tools/misc/astyle/default.nix
+++ b/pkgs/development/tools/misc/astyle/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "astyle";
-  version = "3.4.14";
+  version = "3.4.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-YGqD85FGczGF9nYwWdKSQzxA85Prb1IELhY/jfThaj4=";
+    hash = "sha256-BQTHM7v+lmiLZsEHtt8/oFJj3vq7I4WOQsRLpVRYbms=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/tools/profiling/pprof/default.nix b/pkgs/development/tools/profiling/pprof/default.nix
index e81446d7f12e..eba53210aa3e 100644
--- a/pkgs/development/tools/profiling/pprof/default.nix
+++ b/pkgs/development/tools/profiling/pprof/default.nix
@@ -5,20 +5,19 @@
 
 buildGoModule rec {
   pname = "pprof";
-  version = "unstable-2024-02-27";
+  version = "0-unstable-2024-05-09";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "pprof";
-    rev = "401108e1b7e7e113ef887df16b6227698eb5bb0f";
-    hash = "sha256-TD285HHXkePQA2J9W/dEciK5tOLmvbDPr54KNXeE1b4=";
+    rev = "723abb6459b72e964cbfb3f7064446bf3bb321dc";
+    hash = "sha256-zw9/xp5E5V/0D0pf5diWcx/SHX3ujwBtZNfH9tioiL0=";
   };
 
-  vendorHash = "sha256-XOcOt+pe1lZj4XHafxROLslhyJk4mTC72yn7R1k2JCk=";
+  vendorHash = "sha256-bQyloQPfweK4PlrkO1IcCFjyctj99e8C9mQbCj+HCXQ=";
 
   meta = with lib; {
     description = "A tool for visualization and analysis of profiling data";
-    mainProgram = "pprof";
     homepage = "https://github.com/google/pprof";
     license = licenses.asl20;
     longDescription = ''
@@ -41,5 +40,7 @@ buildGoModule rec {
 
       This is not an official Google product.
     '';
+    mainProgram = "pprof";
+    maintainers = with maintainers; [ hzeller ];
   };
 }
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index 324218082bc3..e291ed8eab37 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.31.0";
+  version = "2.31.2";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-2F8f+vw559FI7CCiLkP8WLpLzDYzr3SHf/Ec8yFHu6g=";
+    sha256 = "sha256-UL8PJnz+fV67F0t24OEReF4tIUa8S2NzICYgUU7fgUo=";
   };
   doCheck = false;
 
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices Security SystemConfiguration ];
   nativeBuildInputs = [ installShellFiles pkg-config ];
 
-  cargoHash = "sha256-G/c84j9BquLCJcl60H0ZZZDxjTHpaGHflfJL/hzdgYQ=";
+  cargoHash = "sha256-S1NwnPn3PRL6GoRBFEhhNuy9StrAhG5qCDW2uWNyU4E=";
 
   postInstall = ''
     installShellCompletion --cmd sentry-cli \
diff --git a/pkgs/development/tools/trunk/default.nix b/pkgs/development/tools/trunk/default.nix
index 55292d9d89fa..c4ec27393a48 100644
--- a/pkgs/development/tools/trunk/default.nix
+++ b/pkgs/development/tools/trunk/default.nix
@@ -12,13 +12,13 @@ SystemConfiguration
 
 rustPlatform.buildRustPackage rec {
   pname = "trunk";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "trunk-rs";
     repo = "trunk";
     rev = "v${version}";
-    hash = "sha256-iUW2tltF8RGyd84rN60Wv2NFgHS/x3cEFeD+YhMizhY=";
+    hash = "sha256-VcTlXGfNfkbFoJiNmOp0AS0/NApgTaiZEafZSV2PuTI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
   # requires network
   checkFlags = [ "--skip=tools::tests::download_and_install_binaries" ];
 
-  cargoHash = "sha256-fUURwuOwuI9ED08AwrVLhQtltwczyX4Q2M4rZlNEAHU=";
+  cargoHash = "sha256-jXp6B9eTYKfDgzzgp1oRMzwVJOzsh9h0+igQLBZmdsk=";
 
   meta = with lib; {
     homepage = "https://github.com/trunk-rs/trunk";
diff --git a/pkgs/development/tools/yamlfmt/default.nix b/pkgs/development/tools/yamlfmt/default.nix
index 1b7b34c70bd0..3b7fbc20ca38 100644
--- a/pkgs/development/tools/yamlfmt/default.nix
+++ b/pkgs/development/tools/yamlfmt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "yamlfmt";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hT5+7WaFl19iIdXWFPD82BE9z/2wzHKJJvVE4ZpZwsk=";
+    sha256 = "sha256-VAXDkD4JLoiTomCNtuex/ZEAZtWDEEg5cxETYemvQW8=";
   };
 
   vendorHash = "sha256-UfULQw7wAEJjTFp6+ACF5Ki04eFKeUEgmbt1c8pUolA=";
diff --git a/pkgs/games/nile/default.nix b/pkgs/games/nile/default.nix
index 18d1d3c28ae5..928ba0743d04 100644
--- a/pkgs/games/nile/default.nix
+++ b/pkgs/games/nile/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonApplication rec {
   pname = "nile";
-  version = "1.0.2-unstable-2024-03-09";
+  version = "1.0.3-unstable-2024-05-10";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "imLinguin";
     repo = "nile";
-    rev = "ae09acfc20fe4e462762666871f78caae70f6c74";
-    hash = "sha256-hqhIacsbultY3CvvkYAZHmhCkQLi1mkPQwkztaUOd10=";
+    rev = "74e3ca979b2a66f9174c04fd0279211e0276ac9c";
+    hash = "sha256-ezX9MLQsULRvX+X2NXYBQnKRzBRt9eN9JnJinzysI9o=";
   };
 
   disabled = pythonOlder "3.8";
diff --git a/pkgs/os-specific/linux/libbpf/0.x.nix b/pkgs/os-specific/linux/libbpf/0.x.nix
index 480e78d0803a..b34cca4a51af 100644
--- a/pkgs/os-specific/linux/libbpf/0.x.nix
+++ b/pkgs/os-specific/linux/libbpf/0.x.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "0.8.1";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-daVS+TErmDU8ksThOvcepg1A61iD8N8GIkC40cmc9/8=";
+    sha256 = "sha256-J5cUvfUYc+uLdkFa2jx/2bqBoZg/eSzc6SWlgKqcfIc=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index e31a54f56c31..553c6a309682 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8189es-${kernel.version}-${version}";
-  version = "2023-03-14";
+  version = "2024-01-21";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "ae7b31e55526ca0e01d2a3310118530bff4f1055";
-    sha256 = "sha256-l/xUxs63Y5LVT6ZafuRc+iaCXCSt2HwysYJLJ5hg3RM=";
+    rev = "eb51e021b0e1b6f94a4b49da3f4ee5c5fb20b715";
+    sha256 = "sha256-n7Bsstr1H1RvguAyJnVqk/JgEx8WEZWaVg7ZfEYykR0=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl8189fs/default.nix b/pkgs/os-specific/linux/rtl8189fs/default.nix
index 67642f11d322..0405fc8561a9 100644
--- a/pkgs/os-specific/linux/rtl8189fs/default.nix
+++ b/pkgs/os-specific/linux/rtl8189fs/default.nix
@@ -3,13 +3,13 @@
 # rtl8189fs is a branch of the rtl8189es driver
 rtl8189es.overrideAttrs (drv: rec {
   name = "rtl8189fs-${kernel.version}-${version}";
-  version = "2023-03-27";
+  version = "2024-01-22";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "c223a25b1000d64432eca4201a8f012414dfc7ce";
-    sha256 = "sha256-5b5IshLbWxvmzcKy/xLsqKa3kZpwDQXTQtjqZLHyOCo=";
+    rev = "5d523593f41c0b8d723c6aa86b217ee1d0965786";
+    sha256 = "sha256-pziaUM6XfF4Tt9yfWUnLUiTw+sw6uZrr1HcaXdRQ31E=";
   };
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/rtl8192eu/default.nix b/pkgs/os-specific/linux/rtl8192eu/default.nix
index 32b97b59c52e..529f16fc1db4 100644
--- a/pkgs/os-specific/linux/rtl8192eu/default.nix
+++ b/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -4,15 +4,15 @@ with lib;
 
 let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless/realtek/rtl8192eu";
 
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation {
   pname = "rtl8192eu";
-  version = "${kernel.version}-4.4.1.20230613";
+  version = "${kernel.version}-4.4.1.20240507";
 
   src = fetchFromGitHub {
     owner = "Mange";
     repo = "rtl8192eu-linux-driver";
-    rev = "f2fc8af7ab58d2123eed1aa4428e713cdfc27976";
-    sha256 = "sha256-OgsxBcXoIP8h9Z0bLsG91/s/+r89Tdn2dPOt4p3sx8k=";
+    rev = "27410641da6926eb1ac565068ff89d35f7496328";
+    sha256 = "sha256-/BztTE3yKw35Oo7KkzHMtD+8qpJNXWiSwR3YjrotR0I=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/rtl8723ds/default.nix b/pkgs/os-specific/linux/rtl8723ds/default.nix
index be4b954c1b61..a9c1f18de0c2 100644
--- a/pkgs/os-specific/linux/rtl8723ds/default.nix
+++ b/pkgs/os-specific/linux/rtl8723ds/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8723ds";
-  version = "${kernel.version}-unstable-2022-12-01";
+  version = "${kernel.version}-unstable-2023-11-14";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtl8723ds";
-    rev = "a638cc8639015b8b9390af3350fab0366b6c87e7";
-    sha256 = "sha256-qfVE7k71NPzw3FwoOaUxH66PnDjbpMAF6CyOyUVdSMA=";
+    rev = "52e593e8c889b68ba58bd51cbdbcad7fe71362e4";
+    sha256 = "sha256-SszvDuWN9opkXyVQAOLjnNtPp93qrKgnGvzK0y7Y9b0=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index ed330fc24637..d9fd92c4a9f0 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8812au";
-  version = "${kernel.version}-unstable-2024-01-19";
+  version = "${kernel.version}-unstable-2024-03-20";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8812au-20210629";
-    rev = "3b921c0beda8583c1d2d1b0b7e4692d11e7ea772";
-    hash = "sha256-Ji61Y23uGSTyj3Z5ia9iev5rVzSOv7XY/IfAClhz7Q8=";
+    rev = "8be3a1d7acf60f77c5d9c33b690b8d7301bdf127";
+    hash = "sha256-HchnRezJNzimOB72Sv5BwL4oXuxPxloAHVuaL+warj8=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index 806df9f6dd4d..9d83d4b4c28a 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2023-09-10";
+  version = "${kernel.version}-unstable-2024-05-03";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821cu-20210916";
-    rev = "f6d4598290c5e9c8e545130e8a31d130f6d135f4";
-    hash = "sha256-jpMf8K9diJ3mbEkP9Cp+VwairK+pwiEGU/AtUIouCqM=";
+    rev = "3eacc28b721950b51b0249508cc31e6e54988a0c";
+    hash = "sha256-JP7mvwhnKqmkb/B0l4vhc11TBjjUA1Ubzbj/IVEXvBM=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index dd86f2244745..f09d06370eaf 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.5.2";
+  version = "2024.5.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-bgXHEz8YuHcdGYzLpM7H8IVXixFC8Bz0i4SaatA49Qo=";
+    hash = "sha256-cWt5hOLnri+m7WXAjCA3z1k5ctDia2sAoZiyGe8zadI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix
index c75b4854daa5..79dd808eab29 100644
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metabase";
-  version = "0.49.2";
+  version = "0.49.9";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${version}/metabase.jar";
-    hash = "sha256-PmfzYPnfIFX92I0tnXJoZa3EdOF7EFo5bc0T9bo4bS0=";
+    hash = "sha256-1QUrXYpMvn/Gm8ljmF5MYKFRCIQ/v3vpoMJEJcSR2vI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/snac2/default.nix b/pkgs/servers/snac2/default.nix
index e15add96d644..9c2594c80f99 100644
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/servers/snac2/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "snac2";
-  version = "2.51";
+  version = "2.52";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = pname;
     rev = version;
-    hash = "sha256-ahUWHWtVgJksOg6CTqJSQBaD577zaNu4u1sDG0ksr4g=";
+    hash = "sha256-2dDIbY6IaB53BbtNtzyOrigjzkGk7By2N2zZSuQhDAs=";
   };
 
   buildInputs = [ curl openssl ];
diff --git a/pkgs/shells/fish/plugins/default.nix b/pkgs/shells/fish/plugins/default.nix
index d69c2ac2c29e..36a5a59e4398 100644
--- a/pkgs/shells/fish/plugins/default.nix
+++ b/pkgs/shells/fish/plugins/default.nix
@@ -36,6 +36,8 @@ lib.makeScope newScope (self: with self; {
 
   github-copilot-cli-fish = callPackage ./github-copilot-cli-fish.nix { };
 
+  git-abbr = callPackage ./git-abbr.nix { };
+
   grc = callPackage ./grc.nix { };
 
   gruvbox = callPackage ./gruvbox.nix { };
diff --git a/pkgs/shells/fish/plugins/git-abbr.nix b/pkgs/shells/fish/plugins/git-abbr.nix
new file mode 100644
index 000000000000..2ec33f6c7976
--- /dev/null
+++ b/pkgs/shells/fish/plugins/git-abbr.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  buildFishPlugin,
+  fetchFromGitHub,
+}:
+buildFishPlugin rec {
+  pname = "fish-git-abbr";
+  version = "0.2.1-unstable-2023-06-19";
+
+  src = fetchFromGitHub {
+    owner = "lewisacidic";
+    repo = "fish-git-abbr";
+    rev = "dc590a5b9d9d2095f95f7d90608b48e55bea0b0e";
+    hash = "sha256-6z3Wr2t8CP85xVEp6UCYaM2KC9PX4MDyx19f/wjHkb0=";
+  };
+
+  meta = with lib; {
+    description = "Abbreviations for git for the fish shell 🐟";
+    homepage = "https://github.com/lewisacidic/fish-git-abbr";
+    license = licenses.mit;
+    maintainers = with maintainers; [hmajid2301];
+  };
+}
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index cab43f365692..208107856896 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.12.18";
+  version = "0.12.19";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    hash = "sha256-ScHdYSDZVs9YYIh1/U/8ZcGa9BF5L+fIHnSHWSRlB4k=";
+    hash = "sha256-4R+wBjlCjk/7/iucC3zptrQ5D5wtQeqdeyfJ1DiFusY=";
   };
 
-  vendorHash = "sha256-7vIcfxDmO8tmVewRDx6JhOgtkKeHOk0qyFZf1U0VQs4=";
+  vendorHash = "sha256-mK10DxDUrEkCdumq6MM6h7B8C8P1hGE466ko3yj1kto=";
 
   meta = with lib; {
     description = "Command-line client for FI-TS Finance Cloud Native services";
diff --git a/pkgs/tools/misc/gh-markdown-preview/default.nix b/pkgs/tools/misc/gh-markdown-preview/default.nix
index 68f041dbbf2d..573cd607be41 100644
--- a/pkgs/tools/misc/gh-markdown-preview/default.nix
+++ b/pkgs/tools/misc/gh-markdown-preview/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gh-markdown-preview";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "yusukebe";
     repo = "gh-markdown-preview";
     rev = "v${version}";
-    hash = "sha256-UBveXL4/3GxxIVjqG0GuTbkGkzXFc/stew2s+dTj9BI=";
+    hash = "sha256-gi6Wza8v4V8PAHO75UycP0CEzvXEtm22hTEWs/dJ+LQ=";
   };
 
   vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";
diff --git a/pkgs/tools/misc/mongodb-compass/default.nix b/pkgs/tools/misc/mongodb-compass/default.nix
index 6df35c2ea734..c89018cf03a4 100644
--- a/pkgs/tools/misc/mongodb-compass/default.nix
+++ b/pkgs/tools/misc/mongodb-compass/default.nix
@@ -33,7 +33,7 @@ xorg,
 }:
 
 let
-  version = "1.42.5";
+  version = "1.43.0";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -82,7 +82,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.mongodb.com/compass/mongodb-compass_${version}_amd64.deb";
-        sha256 = "sha256-46JQXC2Ydq37TomtQdnvk8DwSs8aCfozxqUaEO6hmxo=";
+        sha256 = "sha256-hzPhF0NGwv+Lm+q5SoS8qv10UmuKf4RarGMkEeCxp9w=";
       }
     else
       throw "MongoDB compass is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/tools/misc/panoply/default.nix b/pkgs/tools/misc/panoply/default.nix
index b79d6b7d8e35..b5df3adc7b3d 100644
--- a/pkgs/tools/misc/panoply/default.nix
+++ b/pkgs/tools/misc/panoply/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "panoply";
-  version = "5.3.4";
+  version = "5.4.0";
 
   src = fetchurl {
     url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";
-    sha256 = "sha256-v7ieTtm2W8Sc/zhQ7QPh8rkMUgaqgfGYYXc6Ly+9iMg=";
+    sha256 = "sha256-mWk0wuTxkITVU3SwWYPHrX8Y9NceXeRMwyvpwEDWIiA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/topicctl/default.nix b/pkgs/tools/misc/topicctl/default.nix
index 86debbf38800..c3252987c4ce 100644
--- a/pkgs/tools/misc/topicctl/default.nix
+++ b/pkgs/tools/misc/topicctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "topicctl";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = "topicctl";
     rev = "v${version}";
-    sha256 = "sha256-Gx/ld651Se2mLlUG/CkHawfVBN2BsxV8w6vrnKFLHuE=";
+    sha256 = "sha256-S1i2Nv7FQzqCTTjkS5slEI0vdt3kXhVWdtaYyng1GsQ=";
   };
 
   vendorHash = "sha256-+mnnvdna1g6JE29weOJZmdO3jFp2a75dV9wK2XcWJ9s=";
diff --git a/pkgs/tools/misc/wootility/default.nix b/pkgs/tools/misc/wootility/default.nix
index 803ad53038e7..f8590702ecb9 100644
--- a/pkgs/tools/misc/wootility/default.nix
+++ b/pkgs/tools/misc/wootility/default.nix
@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "wootility";
-  version = "4.6.15";
+  version = "4.6.18";
 
   src = fetchurl {
     url = "https://s3.eu-west-2.amazonaws.com/wooting-update/wootility-lekker-linux-latest/wootility-lekker-${version}.AppImage";
-    sha256 = "sha256-A/cjm9rhcgp68hbyjy7OfYPBKBcccl0OdD7MTdpEdPM=";
+    sha256 = "sha256-oiPt1xgmYGYO1dk01rDwwaUf+yhDAbRCqTTuOivR/kI=";
   };
 
   profile = ''
diff --git a/pkgs/tools/networking/brook/default.nix b/pkgs/tools/networking/brook/default.nix
index 77a70381b1d9..943ccbc9798a 100644
--- a/pkgs/tools/networking/brook/default.nix
+++ b/pkgs/tools/networking/brook/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "brook";
-  version = "20240404";
+  version = "20240606";
 
   src = fetchFromGitHub {
     owner = "txthinking";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QqA0LnbC72bnAQ25AehTnoXgdqQPc8wztHcFd4Q19ko=";
+    sha256 = "sha256-rfCqYI0T/nbK+rlPGl5orLo3qHKITesdFNtXc/ECATA=";
   };
 
-  vendorHash = "sha256-1aaOPeKHPrZO6WK08EhX4+dME0A33raQnbZi/aNFpIw=";
+  vendorHash = "sha256-dYiifLUOq6RKAVSXuoGlok9Jp8jHmbXN/EjQeQpoqWw=";
 
   meta = with lib; {
     homepage = "https://github.com/txthinking/brook";
diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix
index 63f247ab986b..e14b3f8572b8 100644
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@@ -11,6 +11,10 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-wA2RDVOU5pZ1YI617g9QTVz9pB6ZCi2akbqsbfk+P5I=";
   };
 
+  patches = [
+    ./import-ferm-wrapped.patch
+  ];
+
   # perl is used at build time to gather the ferm version.
   nativeBuildInputs = [ makeWrapper perl ];
   buildInputs = [ perl ];
diff --git a/pkgs/tools/networking/ferm/import-ferm-wrapped.patch b/pkgs/tools/networking/ferm/import-ferm-wrapped.patch
new file mode 100644
index 000000000000..3975c79af886
--- /dev/null
+++ b/pkgs/tools/networking/ferm/import-ferm-wrapped.patch
@@ -0,0 +1,14 @@
+--- old/src/import-ferm
++++ new/src/import-ferm
+@@ -42,9 +42,9 @@
+     # find the main "ferm" program
+     my $ferm;
+     if ($0 =~ /^(.*)\//) {
+-        $ferm = "$1/ferm";
++        $ferm = "$1/.ferm-wrapped";
+     } else {
+-        $ferm = 'ferm';
++        $ferm = '.ferm-wrapped';
+     }
+ 
+     # Perl 5.24 requires this prefix or else it will only look in @INC
diff --git a/pkgs/tools/networking/lychee/default.nix b/pkgs/tools/networking/lychee/default.nix
index d14121759150..610869897b7b 100644
--- a/pkgs/tools/networking/lychee/default.nix
+++ b/pkgs/tools/networking/lychee/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lychee";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "lycheeverse";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-luc6rzNYhS+c5B4S3/cOvDqnRF+LfRDY1aw99hkF+nE=";
+    hash = "sha256-L1tvP2lZsFD2swhP1MetQFxxxA+EbrI4aDYTJwbpkVI=";
   };
 
-  cargoHash = "sha256-kGdRz5m0L3v3DBeabYq1Zp0bEEPW5C0y+A7tTjWkCwM=";
+  cargoHash = "sha256-SQ9Dgtg3TKAaj9XkpEzA13U8CumGOlpwiW+Lv6leQW4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index d8f0661f7d0d..f946bdca45b3 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.27.4";
+  version = "0.27.5";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+IcgzwLUA8OIa9od5LkGnI05FTbxC8PmOf8s5+akTrk=";
+    hash = "sha256-DWtTCx+vzOE4yE9jAUxB1oF1UubIXK4f7wptJY89az0=";
   };
 
   vendorHash = "sha256-LPq6ovulE+xdoRaQpwA0mNqw3kFxMs/am1ucO8UmDtU=";
diff --git a/pkgs/tools/networking/networkd-dispatcher/default.nix b/pkgs/tools/networking/networkd-dispatcher/default.nix
index a2a03d1f8404..3caadb67caf3 100644
--- a/pkgs/tools/networking/networkd-dispatcher/default.nix
+++ b/pkgs/tools/networking/networkd-dispatcher/default.nix
@@ -4,7 +4,7 @@
 , fetchpatch
 , python3Packages
 , asciidoc
-, makeWrapper
+, wrapGAppsNoGuiHook
 , iw
 }:
 
@@ -43,10 +43,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     asciidoc
-    makeWrapper
+    wrapGAppsNoGuiHook
     python3Packages.wrapPython
   ];
 
+  dontWrapGApps = true;
+
   checkInputs = with python3Packages; [
     dbus-python
     iw
@@ -72,9 +74,14 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  preFixup = ''
+    makeWrapperArgs+=( \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix PATH : "${lib.makeBinPath [ iw ]}" \
+    )
+  '';
   postFixup = ''
     wrapPythonPrograms
-    wrapProgram $out/bin/networkd-dispatcher --prefix PATH : ${lib.makeBinPath [ iw ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/zap/default.nix b/pkgs/tools/networking/zap/default.nix
index e3fe7d157743..e0ceade91f5a 100644
--- a/pkgs/tools/networking/zap/default.nix
+++ b/pkgs/tools/networking/zap/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://www.owasp.org/index.php/ZAP";
+    homepage = "https://www.zaproxy.org/";
     description = "Java application for web penetration testing";
     maintainers = with maintainers; [ mog rafael ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/security/arti/default.nix b/pkgs/tools/security/arti/default.nix
index e410a8685556..0ad27f3d08ab 100644
--- a/pkgs/tools/security/arti/default.nix
+++ b/pkgs/tools/security/arti/default.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "arti";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
     owner = "core";
     repo = "arti";
     rev = "arti-v${version}";
-    hash = "sha256-Ps1AIvL6hOnSYtvi4wbgJQiuv2eb1XIEPul/WypM9bo=";
+    hash = "sha256-DicOkh2yv6qbxf1x4fAZq34qtuD/T4twn8JMnI9XGCI=";
   };
 
-  cargoHash = "sha256-2u/8nn/9tz+hlNDz6I/g2cMPWXZSMVNV7FPsKFP8jqo=";
+  cargoHash = "sha256-ICJMcFTIHFLxB5XJeMRi1M6e9p0nKwT3vbqAZT22vmU=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/security/ecdsatool/ctype-header-c99-implicit-function-declaration.patch b/pkgs/tools/security/ecdsatool/ctype-header-c99-implicit-function-declaration.patch
new file mode 100644
index 000000000000..1bbe576e452e
--- /dev/null
+++ b/pkgs/tools/security/ecdsatool/ctype-header-c99-implicit-function-declaration.patch
@@ -0,0 +1,12 @@
+diff --git a/libecdsaauth/base64.c b/libecdsaauth/base64.c
+index 0f9b7a3..84df22a 100644
+--- a/libecdsaauth/base64.c
++++ b/libecdsaauth/base64.c
+@@ -45,6 +45,7 @@
+ #include <string.h>
+ #include <unistd.h>
+ #include <assert.h>
++#include <ctype.h>
+ 
+ static const char Base64[] =
+ 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
diff --git a/pkgs/tools/security/ecdsatool/default.nix b/pkgs/tools/security/ecdsatool/default.nix
index aa55facfd8e0..439ffac563c7 100644
--- a/pkgs/tools/security/ecdsatool/default.nix
+++ b/pkgs/tools/security/ecdsatool/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation {
     ./configure --prefix=$out
   '';
 
+  patches = [
+    ./ctype-header-c99-implicit-function-declaration.patch
+    ./openssl-header-c99-implicit-function-declaration.patch
+  ];
+
   nativeBuildInputs = with pkgs; [openssl autoconf automake];
   buildInputs = with pkgs; [libuecc];
 
diff --git a/pkgs/tools/security/ecdsatool/openssl-header-c99-implicit-function-declaration.patch b/pkgs/tools/security/ecdsatool/openssl-header-c99-implicit-function-declaration.patch
new file mode 100644
index 000000000000..1821743c1803
--- /dev/null
+++ b/pkgs/tools/security/ecdsatool/openssl-header-c99-implicit-function-declaration.patch
@@ -0,0 +1,33 @@
+diff --git a/libecdsaauth/keypair.c b/libecdsaauth/keypair.c
+index 5e098c5..b5dd21e 100644
+--- a/libecdsaauth/keypair.c
++++ b/libecdsaauth/keypair.c
+@@ -22,6 +22,7 @@
+ 
+ #include <string.h>
+ #include <stdlib.h>
++#include <openssl/pem.h>
+ 
+ static inline libecdsaauth_key_t *libecdsaauth_key_alloc(void)
+ {
+diff --git a/tool/main.c b/tool/main.c
+index 23d19a3..f88016c 100644
+--- a/tool/main.c
++++ b/tool/main.c
+@@ -21,6 +21,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <openssl/pem.h>
+ 
+ #include "libecdsaauth/keypair.h"
+ #include "libecdsaauth/op.h"
+@@ -41,7 +42,7 @@ static int tool_keygen(int argc, const char *argv[])
+ 	key = libecdsaauth_key_new();
+ 
+ 	pubout = fopen(argv[1], "w");
+-	PEM_write_ECPrivateKey(pubout, key->eckey, NULL, NULL, 0, NULL);
++	PEM_write_ECPrivateKey(pubout, key->eckey, NULL, NULL, 0, NULL, NULL);
+ 	fclose(pubout);
+ 
+ 	pubkey = libecdsaauth_key_public_key_base64(key);
diff --git a/pkgs/tools/security/fscan/default.nix b/pkgs/tools/security/fscan/default.nix
index 00ce9d8ec78e..29fbf2453ee4 100644
--- a/pkgs/tools/security/fscan/default.nix
+++ b/pkgs/tools/security/fscan/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fscan";
-  version = "1.8.3-build3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "shadow1ng";
     repo = "fscan";
     rev = version;
-    hash = "sha256-GtOCd8JaR6tx8hoB+P9QXrEnN7Wvmv7jddhc2/8hjvQ=";
+    hash = "sha256-5uFSvEkTBy0veMdeeg9BmSqu+qSqCwuozK0J3kerAdE=";
   };
 
-  vendorHash = "sha256-hvb2IfypwYauF3ubE36u0bTU+l/FWP/CZt6dFd9zc6s=";
+  vendorHash = "sha256-FFYqvGEFe7sUEb4G3ApQOuYoiDXeA54P7spmKfRiEF0=";
 
   meta = with lib; {
     description = "An intranet comprehensive scanning tool";
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index b6526540c77b..03770b1cc660 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.7"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.8"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 9e15c13be2d2..0cbc2a918ad4 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 2f47cc94d99413b39b5963e94355f0d1ae012cb5
-  ref: refs/tags/6.4.7
+  revision: e9f897a525576857abd73c96ac64beb0094ad547
+  ref: refs/tags/6.4.8
   specs:
-    metasploit-framework (6.4.7)
+    metasploit-framework (6.4.8)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 85b471c8e8c9..e9600b703bf8 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.7";
+  version = "6.4.8";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-HqISVgemx7heOxTfjjEf4si3wQle4pHGi5AW7nroPoc=";
+    hash = "sha256-a5Igd8i5K9qt6r5dHuzRMWLrXZn95PJtYnW4A4HcUNE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 7d3b53263be2..ee104260ca7b 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -674,12 +674,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "2f47cc94d99413b39b5963e94355f0d1ae012cb5";
-      sha256 = "11ryx1xfw5lhig393qjy170vgj723wqqxpql7dgbiix60xb158hy";
+      rev = "e9f897a525576857abd73c96ac64beb0094ad547";
+      sha256 = "1lahvj0h7f3mc9nz5r7xk5fynqiis7n1wpdyxanxlaxrr1vj14kb";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.7";
+    version = "6.4.8";
   };
   metasploit-model = {
     groups = ["default"];
diff --git a/pkgs/tools/security/notation/default.nix b/pkgs/tools/security/notation/default.nix
index 07c9ef499717..f9318296060f 100644
--- a/pkgs/tools/security/notation/default.nix
+++ b/pkgs/tools/security/notation/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, testers, notation }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, notation }:
 
 buildGoModule rec {
   pname = "notation";
@@ -13,6 +13,10 @@ buildGoModule rec {
 
   vendorHash = "sha256-USkufc1dG4eyRfRJHSX4mVZHnvOc5onHenF98Aedac4=";
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   # This is a Go sub-module and cannot be built directly (e2e tests).
   excludedPackages = [ "./test" ];
 
@@ -23,6 +27,13 @@ buildGoModule rec {
     "-X github.com/notaryproject/notation/internal/version.BuildMetadata="
   ];
 
+  postInstall = ''
+    installShellCompletion --cmd notation \
+      --bash <($out/bin/notation completion bash) \
+      --fish <($out/bin/notation completion fish) \
+      --zsh <($out/bin/notation completion zsh)
+  '';
+
   passthru.tests.version = testers.testVersion {
     package = notation;
     command = "notation version";
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index 0e87cbffd050..6ff1a8931b6e 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "stress-ng";
-  version = "0.17.07";
+  version = "0.17.08";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-eXDCzyZ/YeumHjuLpr6stkWkApwfi8ExDx3uZTVa/cs=";
+    hash = "sha256-ipiR7vLNF0+y0YtXZC0qpp361lfpXzlIp3eLUbn0oXc=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/typesetting/tex/texpresso/default.nix b/pkgs/tools/typesetting/tex/texpresso/default.nix
index 4b53c6d6def7..52e8be777c09 100644
--- a/pkgs/tools/typesetting/tex/texpresso/default.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "texpresso";
-  version = "0-unstable-2024-04-30";
+  version = "0-unstable-2024-05-09";
 
   nativeBuildInputs = [
     makeWrapper
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    rev = "a5241c3ac27eb5eda01bd58b6370982a64320106";
-    hash = "sha256-2RvbIFfYQQSsrXJ72q5LWyaCLCZvThTi7YuiOaJR9mE=";
+    rev = "8b6cfcd10c03596bc3645ac8425a48b105d8650d";
+    hash = "sha256-uLGanGEUGzxIYFbU3U8LLV3bpn/IN9XltvWCmwSlD7E=";
   };
 
   buildFlags = [ "texpresso" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 39fd9b891703..7e6c6720c912 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4485,10 +4485,6 @@ with pkgs;
     '';
   });
 
-  caddy = callPackage ../servers/caddy { };
-
-  xcaddy = callPackage ../servers/caddy/xcaddy { };
-
   traefik = callPackage ../servers/traefik { };
 
   traefik-certs-dumper = callPackage ../tools/misc/traefik-certs-dumper { };
@@ -18550,8 +18546,6 @@ with pkgs;
 
   sigrok-firmware-fx2lafw = callPackage ../development/tools/sigrok-firmware-fx2lafw { };
 
-  cli11 = callPackage ../development/tools/misc/cli11 { };
-
   datree = callPackage ../development/tools/datree { };
 
   detekt = callPackage ../development/tools/detekt { };
@@ -40412,6 +40406,15 @@ with pkgs;
 
   winePackagesFor = wineBuild: lib.makeExtensible (self: with self; {
     callPackage = newScope self;
+    stdenv =
+      if pkgs.stdenv.isDarwin then
+        # Match upstream, which builds with the latest SDK and a 10.7 deployment target.
+        overrideSDK pkgs.stdenv {
+          darwinMinVersion = "10.7";
+          darwinSdkVersion = "11.0";
+        }
+      else
+        pkgs.stdenv;
 
     inherit wineBuild;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1e3b6441ed36..399d87461a9a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1515,6 +1515,8 @@ self: super: with self; {
 
   bimmer-connected = callPackage ../development/python-modules/bimmer-connected { };
 
+  binance-connector = callPackage ../development/python-modules/binance-connector { };
+
   binary = callPackage ../development/python-modules/binary { };
 
   binary2strings = callPackage ../development/python-modules/binary2strings { };