diff --git a/doc/languages-frameworks/emscripten.section.md b/doc/languages-frameworks/emscripten.section.md
index 20d358f2e9e3..9ce48db2c2de 100644
--- a/doc/languages-frameworks/emscripten.section.md
+++ b/doc/languages-frameworks/emscripten.section.md
@@ -86,9 +86,9 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
 
   postPatch = pkgs.lib.optionalString pkgs.stdenv.isDarwin ''
     substituteInPlace configure \
-      --replace '/usr/bin/libtool' 'ar' \
-      --replace 'AR="libtool"' 'AR="ar"' \
-      --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
+      --replace-fail '/usr/bin/libtool' 'ar' \
+      --replace-fail 'AR="libtool"' 'AR="ar"' \
+      --replace-fail 'ARFLAGS="-o"' 'ARFLAGS="-r"'
   '';
 })
 ```
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 9be381c0bfe2..8191722071e9 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -700,7 +700,7 @@ with import <nixpkgs> {};
     hello = attrs: lib.optionalAttrs (lib.versionAtLeast attrs.version "1.0")  {
       postPatch = ''
         substituteInPlace lib/zoneinfo.rs \
-          --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+          --replace-fail "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
       '';
     };
   };
diff --git a/doc/stdenv/platform-notes.chapter.md b/doc/stdenv/platform-notes.chapter.md
index b47f5af349b8..409c9f2e7b2e 100644
--- a/doc/stdenv/platform-notes.chapter.md
+++ b/doc/stdenv/platform-notes.chapter.md
@@ -54,7 +54,7 @@ Some common issues when packaging software for Darwin:
     # ...
     prePatch = ''
       substituteInPlace Makefile \
-          --replace '/usr/bin/xcrun clang' clang
+          --replace-fail '/usr/bin/xcrun clang' clang
     '';
   }
   ```
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index c66301bcb1c8..c9c30fde172d 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -230,9 +230,9 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     substituteInPlace $out/bin/solo5-virtio-mkimage \
-      --replace "/usr/lib/syslinux" "${syslinux}/share/syslinux" \
-      --replace "/usr/share/syslinux" "${syslinux}/share/syslinux" \
-      --replace "cp " "cp --no-preserve=mode "
+      --replace-fail "/usr/lib/syslinux" "${syslinux}/share/syslinux" \
+      --replace-fail "/usr/share/syslinux" "${syslinux}/share/syslinux" \
+      --replace-fail "cp " "cp --no-preserve=mode "
 
     wrapProgram $out/bin/solo5-virtio-mkimage \
       --prefix PATH : ${lib.makeBinPath [ dosfstools mtools parted syslinux ]}
@@ -1253,9 +1253,20 @@ postInstall = ''
 
 Performs string substitution on the contents of \<infile\>, writing the result to \<outfile\>. The substitutions in \<subs\> are of the following form:
 
-#### `--replace` \<s1\> \<s2\> {#fun-substitute-replace}
+#### `--replace-fail` \<s1\> \<s2\> {#fun-substitute-replace-fail}
 
 Replace every occurrence of the string \<s1\> by \<s2\>.
+Will error if no change is made.
+
+#### `--replace-warn` \<s1\> \<s2\> {#fun-substitute-replace-warn}
+
+Replace every occurrence of the string \<s1\> by \<s2\>.
+Will print a warning if no change is made.
+
+#### `--replace-quiet` \<s1\> \<s2\> {#fun-substitute-replace-quiet}
+
+Replace every occurrence of the string \<s1\> by \<s2\>.
+Will do nothing if no change can be made.
 
 #### `--subst-var` \<varName\> {#fun-substitute-subst-var}
 
@@ -1269,8 +1280,8 @@ Example:
 
 ```shell
 substitute ./foo.in ./foo.out \
-    --replace /usr/bin/bar $bar/bin/bar \
-    --replace "a string containing spaces" "some other text" \
+    --replace-fail /usr/bin/bar $bar/bin/bar \
+    --replace-fail "a string containing spaces" "some other text" \
     --subst-var someVar
 ```
 
diff --git a/nixos/doc/manual/configuration/linux-kernel.chapter.md b/nixos/doc/manual/configuration/linux-kernel.chapter.md
index 9d1b2bc2f9b8..31d8d1a7d0cf 100644
--- a/nixos/doc/manual/configuration/linux-kernel.chapter.md
+++ b/nixos/doc/manual/configuration/linux-kernel.chapter.md
@@ -92,6 +92,24 @@ To use your custom kernel package in your NixOS configuration, set
 boot.kernelPackages = pkgs.linuxPackagesFor yourCustomKernel;
 ```
 
+## Rust {#sec-linux-rust}
+
+The Linux kernel does not have Rust language support enabled by
+default. For kernel versions 6.7 or newer, experimental Rust support
+can be enabled. In a NixOS configuration, set:
+
+```nix
+boot.kernelPatches = [
+  {
+    name = "Rust Support";
+    patch = null;
+    features = {
+      rust = true;
+    };
+  }
+];
+```
+
 ## Developing kernel modules {#sec-linux-config-developing-modules}
 
 This section was moved to the [Nixpkgs manual](https://nixos.org/nixpkgs/manual#sec-linux-kernel-developing-modules).
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 84ece231efea..1d402a51efb5 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -103,6 +103,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `services.resolved.fallbackDns` can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead.
 
+- `xxd` has been moved from `vim` default output to its own output to reduce closure size. The canonical way to reference it across all platforms is `unixtools.xxd`.
+
 - `services.avahi.nssmdns` got split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switch for IPv4 and IPv6 respectively.
   Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.
 
@@ -169,6 +171,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - The option [`services.nextcloud.config.dbport`] of the Nextcloud module was removed to match upstream.
   The port can be specified in [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost).
 
+- `stdenv`: The `--replace` flag in `substitute`, `substituteInPlace`, `substituteAll`, `substituteAllStream`, and `substituteStream` is now deprecated if favor of the new `--replace-fail`, `--replace-warn` and `--replace-quiet`. The deprecated `--replace` equates to `--replace-warn`.
+
 - The Yama LSM is now enabled by default in the kernel, which prevents ptracing
   non-child processes. This means you will not be able to attach gdb to an
   existing process, but will need to start that process from gdb (so it is a
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 221e90b6f38f..86a3875e2c67 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -1076,7 +1076,7 @@ in
     boot.initrd.systemd = {
       contents."/etc/crypttab".source = stage1Crypttab;
 
-      extraBin.systemd-cryptsetup = "${config.boot.initrd.systemd.package}/lib/systemd/systemd-cryptsetup";
+      extraBin.systemd-cryptsetup = "${config.boot.initrd.systemd.package}/bin/systemd-cryptsetup";
 
       additionalUpstreamUnits = [
         "cryptsetup-pre.target"
@@ -1084,7 +1084,7 @@ in
         "remote-cryptsetup.target"
       ];
       storePaths = [
-        "${config.boot.initrd.systemd.package}/lib/systemd/systemd-cryptsetup"
+        "${config.boot.initrd.systemd.package}/bin/systemd-cryptsetup"
         "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-cryptsetup-generator"
       ];
 
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 4ae07944afc3..26cc016869b3 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -70,6 +70,7 @@ let
     "systemd-tmpfiles-setup.service"
     "timers.target"
     "umount.target"
+    "systemd-bsod.service"
   ] ++ cfg.additionalUpstreamUnits;
 
   upstreamWants = [
@@ -424,6 +425,7 @@ in {
 
       storePaths = [
         # systemd tooling
+        "${cfg.package}/lib/systemd/systemd-executor"
         "${cfg.package}/lib/systemd/systemd-fsck"
         "${cfg.package}/lib/systemd/systemd-hibernate-resume"
         "${cfg.package}/lib/systemd/systemd-journald"
@@ -433,6 +435,7 @@ in {
         "${cfg.package}/lib/systemd/systemd-shutdown"
         "${cfg.package}/lib/systemd/systemd-sulogin-shell"
         "${cfg.package}/lib/systemd/systemd-sysctl"
+        "${cfg.package}/lib/systemd/systemd-bsod"
 
         # generators
         "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 63e957eace88..cf59c933e9ab 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -448,6 +448,7 @@ in {
   kerberos = handleTest ./kerberos/default.nix {};
   kernel-generic = handleTest ./kernel-generic.nix {};
   kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {};
+  kernel-rust = runTestOn ["x86_64-linux"] ./kernel-rust.nix;
   keter = handleTest ./keter.nix {};
   kexec = handleTest ./kexec.nix {};
   keycloak = discoverTests (import ./keycloak.nix);
diff --git a/nixos/tests/kernel-rust.nix b/nixos/tests/kernel-rust.nix
new file mode 100644
index 000000000000..80eb38693677
--- /dev/null
+++ b/nixos/tests/kernel-rust.nix
@@ -0,0 +1,30 @@
+{ pkgs, ... }: {
+  name = "kernel-rust";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ blitz ];
+  };
+
+  nodes.machine = { config, pkgs, ... }:
+    {
+      boot.kernelPackages = pkgs.linuxPackages_testing;
+
+      boot.extraModulePackages = [
+        config.boot.kernelPackages.rust-out-of-tree-module
+      ];
+
+      boot.kernelPatches = [
+        {
+          name = "Rust Support";
+          patch = null;
+          features = {
+            rust = true;
+          };
+        }
+      ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("default.target")
+    machine.succeed("modprobe rust_out_of_tree")
+  '';
+}
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 94ee6ad53e69..e1d2e8d35d52 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.3";
+  version = "1.32.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-LZkTpX1O6PSXoYLG6CWCYCQJeCpPtIHpif7r9ENYZ7Q=";
+    hash = "sha256-WplmQzj7L3UbZi9A7iWATQydtrV13LXOdBxtxkIkoIo=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 60035e3f1b58..aa5b007c4d1b 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -12,11 +12,10 @@
 
 # now defaults to false because some tests can be flaky (clipboard etc), see
 # also: https://github.com/neovim/neovim/issues/16233
-, doCheck ? false
 , nodejs ? null, fish ? null, python3 ? null
 }:
-
-let
+stdenv.mkDerivation (finalAttrs:
+  let
   nvim-lpeg-dylib = luapkgs: if stdenv.isDarwin
     then (luapkgs.lpeg.overrideAttrs (oa: {
       preConfigure = ''
@@ -42,7 +41,7 @@ let
     (nvim-lpeg-dylib ps)
     luabitop
     mpack
-  ] ++ lib.optionals doCheck [
+  ] ++ lib.optionals finalAttrs.doCheck [
     luv
     coxpcall
     busted
@@ -64,17 +63,17 @@ let
         in deterministicLuajit.withPackages(ps: [ ps.mpack (nvim-lpeg-dylib ps) ])
       else lua.luaOnBuild;
 
-  pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
 
-in
-  stdenv.mkDerivation rec {
+in {
     pname = "neovim-unwrapped";
     version = "0.9.5";
 
+    __structuredAttrs = true;
+
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
-      rev = "v${version}";
+      rev = "v${finalAttrs.version}";
       hash = "sha256-CcaBqA0yFCffNPmXOJTo8c9v1jrEBiqAl8CG5Dj5YxE=";
     };
 
@@ -87,7 +86,7 @@ in
 
     dontFixCmake = true;
 
-    inherit lua;
+    inherit lua treesitter-parsers;
 
     buildInputs = [
       gperf
@@ -105,15 +104,17 @@ in
       tree-sitter
       unibilium
     ] ++ lib.optionals stdenv.isDarwin [ libiconv CoreServices ]
-      ++ lib.optionals doCheck [ glibcLocales procps ]
+      ++ lib.optionals finalAttrs.doCheck [ glibcLocales procps ]
     ;
 
-    inherit doCheck;
+    doCheck = false;
 
     # to be exhaustive, one could run
     # make oldtests too
     checkPhase = ''
+      runHook preCheck
       make functionaltest
+      runHook postCheck
     '';
 
     nativeBuildInputs = [
@@ -123,7 +124,9 @@ in
     ];
 
     # extra programs test via `make functionaltest`
-    nativeCheckInputs = [
+    nativeCheckInputs = let
+      pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
+    in [
       fish
       nodejs
       pyEnv      # for src/clint.py
@@ -166,11 +169,11 @@ in
         ln -s \
           ${tree-sitter.buildGrammar {
             inherit language src;
-            version = "neovim-${version}";
+            version = "neovim-${finalAttrs.version}";
           }}/parser \
           $out/lib/nvim/parser/${language}.so
       '')
-      treesitter-parsers);
+      finalAttrs.treesitter-parsers);
 
     shellHook=''
       export VIMRUNTIME=$PWD/runtime
@@ -199,4 +202,4 @@ in
       maintainers = with maintainers; [ manveru rvolosatovs ];
       platforms   = platforms.unix;
     };
-  }
+  })
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index b392cc0aa565..9ebe4d7acd49 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,14 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.2116";
+  version = "9.1.0004";
+
+  outputs = [ "out" "xxd" ];
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-ZKcNg/RrjvEsxpIcTjzQYi1xig3zLeTV+PXaBb4gUuM=";
+    hash = "sha256-Y5ZSJLEFdptEMA0xvstr6H1G4iiaYXpkJGSSFwoTfc0=";
   };
 
   enableParallelBuilding = true;
@@ -14,12 +16,21 @@ rec {
 
   hardeningDisable = [ "fortify" ];
 
-  postPatch =
-    # Use man from $PATH; escape sequences are still problematic.
-    ''
-      substituteInPlace runtime/ftplugin/man.vim \
-        --replace "/usr/bin/man " "man "
-    '';
+  # Use man from $PATH; escape sequences are still problematic.
+  postPatch = ''
+    substituteInPlace runtime/ftplugin/man.vim \
+      --replace "/usr/bin/man " "man "
+  '';
+
+  # man page moving is done in postFixup instead of postInstall otherwise fixupPhase moves it right back where it was
+  postFixup = ''
+    moveToOutput bin/xxd "$xxd"
+    moveToOutput share/man/man1/xxd.1.gz "$xxd"
+    for manFile in $out/share/man/*/man1/xxd.1*; do
+      # moveToOutput does not take full paths or wildcards...
+      moveToOutput "share/man/$(basename "$(dirname "$(dirname "$manFile")")")/man1/xxd.1.gz" "$xxd"
+    done
+  '';
 
   meta = with lib; {
     description = "The most popular clone of the VI editor";
@@ -28,5 +39,6 @@ rec {
     maintainers = with maintainers; [ das_j equirosa ];
     platforms   = platforms.unix;
     mainProgram = "vim";
+    outputsToInstall = [ "out" "xxd" ];
   };
 }
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index c5b9a607f20d..d04fa241ba73 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -15,7 +15,7 @@ in
 stdenv.mkDerivation {
   pname = "vim";
 
-  inherit (common) version src postPatch hardeningDisable enableParallelBuilding enableParallelInstalling meta;
+  inherit (common) version outputs src postPatch hardeningDisable enableParallelBuilding enableParallelInstalling postFixup meta;
 
   nativeBuildInputs = [ gettext pkg-config ];
   buildInputs = [ ncurses bash gawk ]
@@ -62,11 +62,4 @@ stdenv.mkDerivation {
   '';
 
   __impureHostDeps = [ "/dev/ptmx" ];
-
-  # To fix the trouble in vim73, that it cannot cross-build with this patch
-  # to bypass a configure script check that cannot be done cross-building.
-  # http://groups.google.com/group/vim_dev/browse_thread/thread/66c02efd1523554b?pli=1
-  # patchPhase = ''
-  #   sed -i -e 's/as_fn_error.*int32.*/:/' src/auto/configure
-  # '';
 }
diff --git a/pkgs/applications/editors/vim/full.nix b/pkgs/applications/editors/vim/full.nix
index cfb8b84560cb..263f8d2984d0 100644
--- a/pkgs/applications/editors/vim/full.nix
+++ b/pkgs/applications/editors/vim/full.nix
@@ -66,7 +66,7 @@ in stdenv.mkDerivation {
 
   pname = "vim-full";
 
-  inherit (common) version postPatch hardeningDisable enableParallelBuilding meta;
+  inherit (common) version outputs postPatch hardeningDisable enableParallelBuilding meta;
 
   src = builtins.getAttr source {
     default = common.src; # latest release
@@ -181,7 +181,7 @@ in stdenv.mkDerivation {
     ln -sfn '${nixosRuntimepath}' "$out"/share/vim/vimrc
   '';
 
-  postFixup = lib.optionalString wrapPythonDrv ''
+  postFixup = common.postFixup + lib.optionalString wrapPythonDrv ''
     wrapProgram "$out/bin/vim" --prefix PATH : "${python3}/bin" \
       --set NIX_PYTHONPATH "${python3}/${python3.sitePackages}"
   '';
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 3856efd0187d..c5f819fc0f84 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -97,7 +97,6 @@
 , errcheck
 , go-motion
 , go-tools
-, gocode
 , gocode-gomod
 , godef
 , gogetdoc
@@ -110,6 +109,7 @@
 , iferr
 , impl
 , reftools
+, revive
 , # hurl dependencies
   hurl
 , # must be lua51Packages
@@ -1507,13 +1507,11 @@
   vim-go =
     let
       binPath = lib.makeBinPath [
-        # TODO: package commented packages
         asmfmt
         delve
         errcheck
         go-motion
-        go-tools # contains staticcheck
-        gocode
+        go-tools # contains staticcheck, keyify
         gocode-gomod
         godef
         gogetdoc
@@ -1521,15 +1519,12 @@
         golangci-lint
         gomodifytags
         gopls
-        # gorename
         gotags
-        gotools
-        # guru
+        gotools # contains guru, gorename
         iferr
         impl
-        # keyify
         reftools
-        # revive
+        revive
       ];
     in
     super.vim-go.overrideAttrs {
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 8ac049648889..b2d5dacb20fc 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -49,13 +49,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-25";
+  version = "7.1.1-26";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-HKDeeh8DNj0y7wS4DqctXhmNaOqZ02JeBXRFrEpH0M4=";
+    hash = "sha256-diJhCRDT0SbAYZdBPoxZJWlrUW2Nz4/d7H0Nnybw0Yw=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 7e172f279d44..b2c2335db0b2 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -98,9 +98,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional (enableGL || enableX11) copyDesktopItems
+    ++ lib.optional (stdenv.isDarwin && (enableGL || enableX11)) desktopToDarwinBundle
     ++ lib.optionals (enableCxx || enablePython) [ python3 python3.pkgs.setuptools python3.pkgs.libclang ]
     ++ lib.optionals (enablePython) [ which swig ]
-    ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle fixDarwinDylibNames xcbuild ];
+    ++ lib.optionals stdenv.isDarwin [ fixDarwinDylibNames xcbuild ];
 
   buildInputs = [ freetype harfbuzz openjpeg jbig2dec libjpeg gumbo ]
     ++ lib.optionals enableX11 [ libX11 libXext libXi libXrandr ]
@@ -126,7 +127,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  desktopItems = [
+  desktopItems = lib.optionals (enableGL || enableX11) [
     (makeDesktopItem {
       name = pname;
       desktopName = pname;
diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index ec9ca385e1ef..14dbcea6277b 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   CGO_ENABLED = 0;
 
-  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
+  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" ];
   vendorHash = "sha256-fnM4ycqDyruCdCA1Cr4Ki48xeQiTG4l5dLVuAafEm14=";
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch b/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch
new file mode 100644
index 000000000000..3305653d025f
--- /dev/null
+++ b/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch
@@ -0,0 +1,12 @@
+diff -rup rsync-3.2.7/configure.sh rsync-3.2.7-fixed/configure.sh
+--- rsync-3.2.7/configure.sh	2022-10-20 17:57:22
++++ rsync-3.2.7-fixed/configure.sh	2024-01-01 19:51:58
+@@ -7706,7 +7706,7 @@ else $as_nop
+ #include <stdlib.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+-main()
++int main()
+ {
+    if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+      exit(1);
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index 1baf1c40eb14..0d8b3d78ec05 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     # https://github.com/WayneD/rsync/issues/511#issuecomment-1774612577
     # original source: https://build.opensuse.org/package/view_file/network/rsync/rsync-fortified-strlcpy-fix.patch?expand=1&rev=3f8dd2f4a404c96c0f69176e60893714
     ./rsync-fortified-strlcpy-fix.patch
+    # https://github.com/WayneD/rsync/pull/558
+    ./configure.ac-fix-failing-IPv6-check.patch
   ];
 
   buildInputs = [ libiconv zlib popt ]
diff --git a/pkgs/applications/version-management/gitsign/default.nix b/pkgs/applications/version-management/gitsign/default.nix
index cf804ddfb54c..87b73391987e 100644
--- a/pkgs/applications/version-management/gitsign/default.nix
+++ b/pkgs/applications/version-management/gitsign/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  ldflags = [ "-s" "-w" "-buildid=" "-X github.com/sigstore/gitsign/pkg/version.gitVersion=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/sigstore/gitsign/pkg/version.gitVersion=${version}" ];
 
   preCheck = ''
     # test all paths
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 1051dc6da886..07cc4e7b8f58 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -23,11 +23,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.6.1";
+    version = "6.6.2";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-opRlo/5Ao+jUm6g0MTSsKrooa2g//rg42gz25FIflpU=";
+      sha256 = "sha256-y0lNe+fdwvydMXHIiDCvnAKyHHU+PlET3vrJwDc7S2A=";
     };
 
     format = "other";
@@ -37,7 +37,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-wLV0qdCfMgGpZRxnZik/lRwZHm/66p0sJn/mYVRvRkQ=";
+      sha256 = "sha256-yOysqMrTWDx/ENcJng8Rm338NI9vpuBGH6Yq8B7+MFg=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index afa948b00bb5..2b5c86b0efb2 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -44,7 +44,7 @@
 , libmtp
 , liboggz
 , libopus
-, libplacebo
+, libplacebo_5
 , libpulseaudio
 , libraw1394
 , librsvg
@@ -164,7 +164,7 @@ stdenv.mkDerivation (finalAttrs: {
     libmtp
     liboggz
     libopus
-    libplacebo
+    libplacebo_5
     libpulseaudio
     libraw1394
     librsvg
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 0b25d70b14a2..57a090b1976c 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -551,10 +551,10 @@ stdenv.mkDerivation {
     # additional -isystem flags will confuse gfortran (see
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
     + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
-      for dir in ${gccForLibs}${lib.optionalString (hostPlatform != targetPlatform) "/${targetPlatform.config}"}/include/c++/*; do
+      for dir in ${gccForLibs}/include/c++/*; do
         echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
       done
-      for dir in ${gccForLibs}${lib.optionalString (hostPlatform != targetPlatform) "/${targetPlatform.config}"}/include/c++/*/${targetPlatform.config}; do
+      for dir in ${gccForLibs}/include/c++/*/${targetPlatform.config}; do
         echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
       done
     ''
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 2fb59c634829..153b675d48ae 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -39,6 +39,8 @@
   # Not needed with buildGoModule
 , goPackagePath ? ""
 
+, ldflags ? [ ]
+
   # needed for buildFlags{,Array} warning
 , buildFlags ? ""
 , buildFlagsArray ? ""
@@ -154,6 +156,9 @@ let
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
     inherit CGO_ENABLED enableParallelBuilding GO111MODULE GOTOOLCHAIN;
 
+    # If not set to an explicit value, set the buildid empty for reproducibility.
+    ldflags = ldflags ++ lib.optionals (!lib.any (lib.hasPrefix "-buildid=") ldflags) [ "-buildid=" ];
+
     configurePhase = args.configurePhase or (''
       runHook preConfigure
 
@@ -301,4 +306,5 @@ in
 lib.warnIf (args' ? vendorSha256) "`vendorSha256` is deprecated. Use `vendorHash` instead"
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
+lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
   package
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index 7e099b76f0b7..8ca5ca0dca01 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -37,6 +37,8 @@
 
 , CGO_ENABLED ? go.CGO_ENABLED
 
+, ldflags ? [ ]
+
 # needed for buildFlags{,Array} warning
 , buildFlags ? ""
 , buildFlagsArray ? ""
@@ -91,6 +93,9 @@ let
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
 
+    # If not set to an explicit value, set the buildid empty for reproducibility.
+    ldflags = ldflags ++ lib.optionals (!lib.any (lib.hasPrefix "-buildid=") ldflags) [ "-buildid=" ];
+
     configurePhase = args.configurePhase or (''
       runHook preConfigure
 
@@ -280,4 +285,5 @@ let
 in
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
+lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
   package
diff --git a/pkgs/by-name/at/athens/package.nix b/pkgs/by-name/at/athens/package.nix
index e6095f7691a1..c53c571c036f 100644
--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
   vendorHash = "sha256-8+PdkanodNZW/xeFf+tDm3Ej7DRSpBBtiT/CqjnWthw=";
 
   CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-buildid=" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
 
   subPackages = [ "cmd/proxy" ];
 
diff --git a/pkgs/by-name/bl/bluez/package.nix b/pkgs/by-name/bl/bluez/package.nix
new file mode 100644
index 000000000000..e8b649db3939
--- /dev/null
+++ b/pkgs/by-name/bl/bluez/package.nix
@@ -0,0 +1,158 @@
+{ lib
+, stdenv
+, alsa-lib
+, dbus
+, docutils
+, ell
+, enableExperimental ? false
+, fetchpatch
+, fetchurl
+, glib
+, json_c
+, libical
+, pkg-config
+, python3
+, readline
+, systemdMinimal
+, udev
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bluez";
+  version = "5.71";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
+    hash = "sha256-uCjUGMk87R9Vthb7VILPAVN0QL+zT72hpWTz7OlHNdg=";
+  };
+
+  buildInputs = [
+    alsa-lib
+    dbus
+    ell
+    glib
+    json_c
+    libical
+    python3
+    readline
+    udev
+  ];
+
+  nativeBuildInputs = [
+    docutils
+    pkg-config
+    python3.pkgs.wrapPython
+  ];
+
+  outputs = [ "out" "dev" "test" ];
+
+  postPatch = ''
+    substituteInPlace tools/hid2hci.rules \
+      --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
+      --replace "hid2hci " "$out/lib/udev/hid2hci "
+  '' +
+  # Disable some tests:
+  # - test-mesh-crypto depends on the following kernel settings:
+  #   CONFIG_CRYPTO_[USER|USER_API|USER_API_AEAD|USER_API_HASH|AES|CCM|AEAD|CMAC]
+  ''
+    if [[ ! -f unit/test-mesh-crypto.c ]]; then
+      echo "unit/test-mesh-crypto.c no longer exists"
+      false
+    fi
+    echo 'int main() { return 77; }' > unit/test-mesh-crypto.c
+  '';
+
+  configureFlags = [
+    "--localstatedir=/var"
+    (lib.enableFeature enableExperimental "experimental")
+    (lib.enableFeature true "btpclient")
+    (lib.enableFeature true "cups")
+    (lib.enableFeature true "external-ell")
+    (lib.enableFeature true "health")
+    (lib.enableFeature true "hid2hci")
+    (lib.enableFeature true "library")
+    (lib.enableFeature true "logger")
+    (lib.enableFeature true "mesh")
+    (lib.enableFeature true "midi")
+    (lib.enableFeature true "nfc")
+    (lib.enableFeature true "pie")
+    (lib.enableFeature true "sixaxis")
+    # Set "deprecated" to provide ciptool, sdptool, and rfcomm (unmaintained);
+    # superseded by new D-Bus APIs
+    (lib.enableFeature true "deprecated")
+    (lib.withFeatureAs true "dbusconfdir" "${placeholder "out"}/share")
+    (lib.withFeatureAs true "dbussessionbusdir" "${placeholder "out"}/share/dbus-1/services")
+    (lib.withFeatureAs true "dbussystembusdir" "${placeholder "out"}/share/dbus-1/system-services")
+    (lib.withFeatureAs true "systemdsystemunitdir" "${placeholder "out"}/etc/systemd/system")
+    (lib.withFeatureAs true "systemduserunitdir" "${placeholder "out"}/etc/systemd/user")
+    (lib.withFeatureAs true "udevdir" "${placeholder "out"}/lib/udev")
+  ];
+
+  makeFlags = [
+    "rulesdir=${placeholder "out"}/lib/udev/rules.d"
+  ];
+
+  # Work around `make install' trying to create /var/lib/bluetooth.
+  installFlags = [
+    "statedir=$(TMPDIR)/var/lib/bluetooth"
+  ];
+
+  doCheck = stdenv.hostPlatform.isx86_64;
+
+  postInstall = let
+    pythonPath = with python3.pkgs; [
+      dbus-python
+      pygobject3
+      recursivePthLoader
+    ];
+  in
+  ''
+    mkdir -p $test/{bin,test}
+    cp -a test $test
+    pushd $test/test
+    for t in \
+            list-devices \
+            monitor-bluetooth \
+            simple-agent \
+            test-adapter \
+            test-device \
+            test-thermometer \
+            ; do
+      ln -s ../test/$t $test/bin/bluez-$t
+    done
+    popd
+    wrapPythonProgramsIn $test/test "$test/test ${toString pythonPath}"
+
+    # for bluez4 compatibility for NixOS
+    mkdir $out/sbin
+    ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
+    ln -s ../libexec/bluetooth/obexd $out/sbin/obexd
+
+    # Add extra configuration
+    mkdir $out/etc/bluetooth
+    ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf
+
+    # https://github.com/NixOS/nixpkgs/issues/204418
+    ln -s /etc/bluetooth/input.conf $out/etc/bluetooth/input.conf
+    ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
+
+    # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
+    for files in $(find tools/ -type f -perm -755); do
+      filename=$(basename $files)
+      install -Dm755 tools/$filename $out/bin/$filename
+    done
+    install -Dm755 attrib/gatttool $out/bin/gatttool
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "https://www.bluez.org/";
+    description = "Official Linux Bluetooth protocol stack";
+    changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
+    license = with lib.licenses; [ bsd2 gpl2Plus lgpl21Plus mit ];
+    mainProgram = "btinfo";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch b/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
deleted file mode 100644
index aea0348f4b63..000000000000
--- a/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From a908a574daf8bac10bb2a0ee3771052d2167a85f Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Sun, 3 Dec 2023 15:41:20 -0500
-Subject: [PATCH] Fix test failure on Darwin on a case-sensitive fs
-
-This was encountered while looking into an issue with
-https://github.com/NixOS/nixpkgs/pull/268583.
-
-I run my Nix store on case-sensitive APFS, so the test fails due to
-trying to link `-framework ldap` instead of `-framework LDAP`.
----
- test cases/osx/5 extra frameworks/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/test cases/osx/5 extra frameworks/meson.build b/test cases/osx/5 extra frameworks/meson.build
-index f6c01e63a1bd..96532846c632 100644
---- a/test cases/osx/5 extra frameworks/meson.build	
-+++ b/test cases/osx/5 extra frameworks/meson.build	
-@@ -7,7 +7,7 @@ dep_main = dependency('Foundation')
- assert(dep_main.type_name() == 'extraframeworks', 'type_name is ' + dep_main.type_name())
- 
- # https://github.com/mesonbuild/meson/issues/10002
--ldap_dep = dependency('ldap', method : 'extraframework')
-+ldap_dep = dependency('LDAP', method : 'extraframework')
- assert(ldap_dep.type_name() == 'extraframeworks', 'type_name is ' + ldap_dep.type_name())
- 
- stlib = static_library('stat', 'stat.c', install : true, dependencies: [opengl_dep, ldap_dep])
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 86ac76ffafbb..9064b9eaf793 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -18,13 +18,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-Jt3PWnbv/8P6Rvf3E/Yli2vdtfgx3CmsW+jlc9CK5KA=";
+    hash = "sha256-KNNtHi3jx0MRiOgmluA4ucZJWB2WeIYdApfHuspbCqg=";
   };
 
   patches = [
@@ -65,9 +65,6 @@ python3.pkgs.buildPythonApplication rec {
 
     # Nixpkgs cctools does not have bitcode support.
     ./006-disable-bitcode.patch
-
-    # https://github.com/mesonbuild/meson/pull/12587
-    ./007-darwin-case-sensitivity.patch
   ];
 
   buildInputs = lib.optionals (python3.pythonOlder "3.9") [
diff --git a/pkgs/by-name/up/uplosi/package.nix b/pkgs/by-name/up/uplosi/package.nix
index 05e38ca8026c..738f7ea5a567 100644
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@@ -16,7 +16,7 @@ buildGo121Module rec {
   vendorHash = "sha256-RsjUPLe8omoN+XGyNhHDxzNfZR7VVTkh/f/On1oCRqM=";
 
   CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-buildid=" "-X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
   flags = [ "-trimpath" ];
 
   meta = with lib; {
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index de19347e3403..ee83d1cca0bb 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20230316";
+  version = "20231227";
 
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-5acFYPSwevEw5tZNbQDpui3stWuMdnhaKHqC8lhnsOY=";
+    sha256 = "sha256-8Pa6LtAml8axjrUS32UbFIqTtM8v124U2Tt0J4sC0Is=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 05fd9406377d..b8dccf9fcc57 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -135,6 +135,8 @@ let
       # We pick "/" path to effectively avoid sysroot offset and make it work
       # as a native case.
       "--with-build-sysroot=/"
+      # Same with the stdlibc++ headers embedded in the gcc output
+      "--with-gxx-include-dir=${placeholder "out"}/include/c++/${version}/"
     ]
 
     # Basic configuration
diff --git a/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
index 4e6c392ce76e..51078925eeb8 100644
--- a/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
+++ b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
@@ -12,9 +12,20 @@ inputs to be retained in runtime closure.
 Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
 `lttng-ust.dev`.
 
+For this reason we want to remove the occurrences of hashes in the
+expansion of `__FILE__`. `nuke-references` does it by replacing hashes
+by `eeeeee...` but those paths are also used for debug symbols. It is
+handy to be able to invert the transformation to go back to the original
+store path for debuginfod servers. The chosen solution is to make the
+hash uppercase:
+- it does not trigger runtime references (except for all digit hashes,
+  which are unlikely enough)
+- it visually looks like a bogus store path
+- it is easy to find the original store path if required
+
 Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
 
-  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/$HASH1-nlohmann-json-ver
   -fmacro-prefix-map=/nix/...
 
 In practice it quickly exhausts argument length limit due to `gcc`
@@ -25,9 +36,9 @@ is present in the environment.
 
 Tested as:
 
-    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    $ printf "# 0 \"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
     ...
-    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    .string "/nix/store/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-pppppp-vvvvvvv"
     ...
 
 Mangled successfully.
@@ -43,7 +54,7 @@ Mangled successfully.
  /* Perform user-specified mapping of filename prefixes.  Return the
     GC-allocated new name corresponding to FILENAME or FILENAME if no
     remapping was performed.  */
-@@ -76,7 +79,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -76,7 +79,31 @@ remap_filename (file_prefix_map *maps, const char *filename)
      if (filename_ncmp (filename, map->old_prefix, map->old_len) == 0)
        break;
    if (!map)
@@ -51,8 +62,7 @@ Mangled successfully.
 +    {
 +      if (maps == macro_prefix_maps)
 +	{
-+	  /* Remap all fo $NIX_STORE/.{32} paths to
-+	  * equivalent $NIX_STORE/e{32}.
++	  /* Remap the 32 characters after $NIX_STORE/ to uppercase
 +	  *
 +	  * That way we avoid argument parameters explosion
 +	  * and still avoid embedding headers into runtime closure:
@@ -66,7 +76,9 @@ Mangled successfully.
 +	    {
 +	       s = (char *) ggc_alloc_atomic (name_len + 1);
 +	       memcpy(s, name, name_len + 1);
-+	       memset(s + nix_store_len + 1, 'e', 32);
++	       for (int i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
++		 s[i] = TOUPPER(s[i]);
++	       }
 +	       return s;
 +	    }
 +	}
@@ -75,7 +87,7 @@ Mangled successfully.
    name = filename + map->old_len;
    name_len = strlen (name) + 1;
  
-@@ -90,7 +116,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -90,7 +117,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
     ignore it in DW_AT_producer (dwarf2out.cc).  */
  
  /* Linked lists of file_prefix_map structures.  */
diff --git a/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch b/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch
new file mode 100644
index 000000000000..7338b3dd1ede
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch
@@ -0,0 +1,60 @@
+From f4029de35fb1b293a4fd586574b1b4b73ddf7880 Mon Sep 17 00:00:00 2001
+From: Prathamesh Kulkarni <prathamesh.kulkarni@linaro.org>
+Date: Wed, 26 Jul 2023 22:36:26 +0530
+Subject: [PATCH] [aarch64/match.pd] Fix ICE observed in PR110280.
+
+gcc/ChangeLog:
+	PR tree-optimization/110280
+	* match.pd (vec_perm_expr(v, v, mask) -> v): Explicitly build vector
+	using build_vector_from_val with the element of input operand, and
+	mask's type if operand and mask's types don't match.
+
+gcc/testsuite/ChangeLog:
+	PR tree-optimization/110280
+	* gcc.target/aarch64/sve/pr110280.c: New test.
+
+(cherry picked from commit 85d8e0d8d5342ec8b4e6a54e22741c30b33c6f04)
+---
+ gcc/match.pd                                    |  9 ++++++++-
+ gcc/testsuite/gcc.target/aarch64/sve/pr110280.c | 12 ++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+
+diff --git a/gcc/match.pd b/gcc/match.pd
+index 9118244825054..c3bb4fbc0a7a2 100644
+--- a/gcc/match.pd
++++ b/gcc/match.pd
+@@ -8292,7 +8292,14 @@ and,
+ 
+ (simplify
+  (vec_perm vec_same_elem_p@0 @0 @1)
+- @0)
++ (if (types_match (type, TREE_TYPE (@0)))
++  @0
++  (with
++   {
++     tree elem = uniform_vector_p (@0);
++   }
++   (if (elem)
++    { build_vector_from_val (type, elem); }))))
+ 
+ /* Push VEC_PERM earlier if that may help FMA perception (PR101895).  */
+ (simplify
+diff --git a/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c b/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+new file mode 100644
+index 0000000000000..d3279f383629f
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+@@ -0,0 +1,12 @@
++/* { dg-do compile } */
++/* { dg-options "-O3 -fdump-tree-optimized" } */
++
++#include "arm_sve.h"
++
++svuint32_t l()
++{
++  _Alignas(16) const unsigned int lanes[4] = {0, 0, 0, 0};
++  return svld1rq_u32(svptrue_b8(), lanes);
++}
++
++/* { dg-final { scan-tree-dump-not "VEC_PERM_EXPR" "optimized" } } */
diff --git a/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
index ea0673219eb1..351d6d0f764b 100644
--- a/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
+++ b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
@@ -12,9 +12,20 @@ inputs to be retained in runtime closure.
 Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
 `lttng-ust.dev`.
 
+For this reason we want to remove the occurrences of hashes in the
+expansion of `__FILE__`. `nuke-references` does it by replacing hashes
+by `eeeeee...` but those paths are also used for debug symbols. It is
+handy to be able to invert the transformation to go back to the original
+store path for debuginfod servers. The chosen solution is to make the
+hash uppercase:
+- it does not trigger runtime references (except for all digit hashes,
+  which are unlikely enough)
+- it visually looks like a bogus store path
+- it is easy to find the original store path if required
+
 Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
 
-  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/$HASH1-nlohmann-json-ver
   -fmacro-prefix-map=/nix/...
 
 In practice it quickly exhausts argument length limit due to `gcc`
@@ -25,9 +36,9 @@ is present in the environment.
 
 Tested as:
 
-    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    $ printf "# 0 \"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
     ...
-    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    .string "/nix/store/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-pppppp-vvvvvvv"
     ...
 
 Mangled successfully.
@@ -43,14 +54,13 @@ Mangled successfully.
  /* Perform user-specified mapping of filename prefixes.  Return the
     GC-allocated new name corresponding to FILENAME or FILENAME if no
     remapping was performed.  */
-@@ -102,6 +105,29 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -102,6 +105,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
        break;
    if (!map)
      {
 +      if (maps == macro_prefix_maps)
 +	{
-+	  /* Remap all fo $NIX_STORE/.{32} paths to
-+	   * equivalent $NIX_STORE/e{32}.
++	  /* Remap all fo $NIX_STORE/.{32} paths to uppercase
 +	   *
 +	   * That way we avoid argument parameters explosion
 +	   * and still avoid embedding headers into runtime closure:
@@ -64,7 +74,9 @@ Mangled successfully.
 +	     {
 +		s = (char *) ggc_alloc_atomic (name_len + 1);
 +		memcpy(s, name, name_len + 1);
-+		memset(s + nix_store_len + 1, 'e', 32);
++		for (int i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
++		  s[i] = TOUPPER(s[i]);
++		}
 +		if (realname != filename)
 +		  free (const_cast <char *> (realname));
 +		return s;
@@ -73,7 +85,7 @@ Mangled successfully.
        if (realname != filename)
  	free (const_cast <char *> (realname));
        return filename;
-@@ -124,7 +150,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -124,7 +151,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
     ignore it in DW_AT_producer (gen_command_line_string in opts.cc).  */
  
  /* Linked lists of file_prefix_map structures.  */
@@ -81,4 +93,3 @@ Mangled successfully.
  static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
  static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
  
-
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 55636b8ab51c..9cb2f701df57 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -74,6 +74,7 @@ in
 ++ optional langFortran (if atLeast12 then ./gcc-12-gfortran-driving.patch else ./gfortran-driving.patch)
 ++ optional atLeast7 ./ppc-musl.patch
 ++ optional is12 ./12/lambda-ICE-PR109241.patch # backport ICE fix on ccache code
+++ optional is13 ./13/ICE-PR110280.patch # backport ICE fix on const_unop
 ++ optional (atLeast9 && langD) ./libphobos.patch
 
 
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index ff55201ebd03..5387eb15b713 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "13.1.1";
+  version = "14.0.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    hash = "sha256-fuzNsVYdnThMzd4tLN/sTbCBXg6qXKLDJRziOKyOBGg=";
+    hash = "sha256-7kIIU45pe+IF7lGltpIKSvQBmcXR+TWFvmx7ztMNrpc=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index 5dec10e3e477..06391b1740a6 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.21.5";
+  version = "1.21.6";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-KFy730tubmLtWPNw8/bYwwgl1uVsWFPGbTwjvNsJ2xk=";
+    hash = "sha256-Ekkmpi5F942qu67bnAEdl2MxhqM8I4/8HiUyDAIEYkg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index bc72be0ce7a1..16238221e279 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -158,6 +158,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index c09ec676e9ea..534d38e86663 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -248,7 +248,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 2d9790fe61ac..3044199e2811 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -173,6 +173,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 01e6483ad640..423b08396666 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -256,7 +256,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 4de048827071..a38e35e91f6d 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -173,6 +173,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 97d8f27672e3..3263c4ddaf35 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -244,7 +244,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index c46ebee1d0db..c811b24c48ef 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -213,6 +213,7 @@ in let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 2a7c1c1867cb..1e71cdd89c6c 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -206,7 +206,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 3513833c6f56..090eec234886 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -216,6 +216,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 6eec4c563f9c..eab49d326ad4 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -205,7 +205,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index 307198b5e9a3..d9ca0819f2e0 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -221,6 +221,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/15/libcxx/default.nix b/pkgs/development/compilers/llvm/15/libcxx/default.nix
index ed5f48e8c38f..be56770039d8 100644
--- a/pkgs/development/compilers/llvm/15/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/15/libcxx/default.nix
@@ -56,6 +56,14 @@ stdenv.mkDerivation rec {
       hash = "sha256-AaM9A6tQ4YAw7uDqCIV4VaiUyLZv+unwcOqbakwW9/k=";
       relative = "libcxx";
     })
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     ../../libcxx-0001-musl-hacks.patch
   ];
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
index 0b9e83259b2c..4f17678ba14f 100644
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -343,7 +343,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 878806ff85ab..db9385043be2 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -226,6 +226,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/16/libcxx/default.nix b/pkgs/development/compilers/llvm/16/libcxx/default.nix
index 78cd632024cd..d6c8c57c1743 100644
--- a/pkgs/development/compilers/llvm/16/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/16/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -47,6 +47,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gnu-install-dirs.patch
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index a6faf9fd635d..73fb6a785413 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -331,7 +331,7 @@ in
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/17/libcxx/default.nix b/pkgs/development/compilers/llvm/17/libcxx/default.nix
index 7b9996641663..8a5272ea07af 100644
--- a/pkgs/development/compilers/llvm/17/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/17/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -45,6 +45,17 @@ stdenv.mkDerivation rec {
     chmod -R u+w .
   '';
 
+  patches = [
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
+  ];
+
   postPatch = ''
     cd ../runtimes
   '';
diff --git a/pkgs/development/compilers/llvm/17/llvm/default.nix b/pkgs/development/compilers/llvm/17/llvm/default.nix
index b38fef333135..627679ce812f 100644
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/17/llvm/default.nix
@@ -330,7 +330,7 @@ stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 0483916a620b..83e19e7e90a2 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -161,6 +161,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 7cef04347429..c2f924331098 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -222,7 +222,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index fbd2e57805be..a6274c8b2b9c 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -161,6 +161,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 75c786855973..c0ef7801c348 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -237,7 +237,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 41ce6076da5f..efa8daf5d98b 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -216,6 +216,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/git/libcxx/default.nix b/pkgs/development/compilers/llvm/git/libcxx/default.nix
index 7b9996641663..8a5272ea07af 100644
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -45,6 +45,17 @@ stdenv.mkDerivation rec {
     chmod -R u+w .
   '';
 
+  patches = [
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
+  ];
+
   postPatch = ''
     cd ../runtimes
   '';
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 36edfee8a091..a6e9f9289d03 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -329,7 +329,7 @@ stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/zulu/common.nix b/pkgs/development/compilers/zulu/common.nix
index d09555b00c9c..75925ed81bec 100644
--- a/pkgs/development/compilers/zulu/common.nix
+++ b/pkgs/development/compilers/zulu/common.nix
@@ -57,7 +57,7 @@ let
   isJdk8 = lib.versions.major dist.jdkVersion == "8";
 
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
+    pname = "zulu-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 95a6fb077eb1..a7f44a7b62dd 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.5.3";
+  version = "3.5.4";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-8xFe6AgJkvJXwBYbgR4HsBLyAXXtiTSfsayYl33cXJw=";
+    hash = "sha256-v3D+6NzBHr6nbTE5nDtu6pBZCwbBxYfO8bblPsMrASg=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 284671b43f17..f818e35c458e 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.7";
+  version = "0.7.10";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    sha256 = "sha256-GO3Sfbi1dwsqQM6rlnEHyE7wolQjdVwD5BAu5ychEuY=";
+    hash = "sha256-yJ0sgw0y9tIiIHgTPVnfYd8zAGjO83qfeeEzstGH9CE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/catch2/3.nix b/pkgs/development/libraries/catch2/3.nix
index f064eb7a4fdb..a6b51710e615 100644
--- a/pkgs/development/libraries/catch2/3.nix
+++ b/pkgs/development/libraries/catch2/3.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.4.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    hash = "sha256-DqGGfNjKPW9HFJrX9arFHyNYjB61uoL6NabZatTWrr0=";
+    hash = "sha256-OyYNUfnu6h1+MfCF8O+awQ4Usad0qrdCtdZhYgOY+Vw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a809eda31c0d..cb5fe9e4fbd3 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   outputs = [ "out" "dev" "lib" "doc" "man" ];
+  separateDebugInfo = true;
 
   strictDeps = true;
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/editline/default.nix b/pkgs/development/libraries/editline/default.nix
index 15a056edb691..4f891a24f1f0 100644
--- a/pkgs/development/libraries/editline/default.nix
+++ b/pkgs/development/libraries/editline/default.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/troglobit/editline/commit/265c1fb6a0b99bedb157dc7c320f2c9629136518.patch";
       sha256 = "sha256-9fhQH0hT8BcykGzOUoT18HBtWjjoXnePSGDJQp8GH30=";
     })
+
+    # Pending autoconf-2.72 upstream support:
+    #   https://github.com/troglobit/editline/pull/64
+    (fetchpatch {
+      name = "autoconf-2.72.patch";
+      url = "https://github.com/troglobit/editline/commit/f444a316f5178b8e20fe31e7b2d979e651da077e.patch";
+      hash = "sha256-m3jExTkPvE+ZBwHzf/A+ugzzfbLmeWYn726l7Po7f10=";
+    })
   ];
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 43f9093848b8..c843fef4a0ef 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-wcVxnypZfOPgbJOM+5n7aX2gk96nuFfMAE3B3PG7oYI=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     groff
     pkg-config
@@ -33,7 +35,7 @@ stdenv.mkDerivation rec {
     nuspell
   ];
 
-  nativeCheckInputs = [
+  checkInputs = [
     unittest-cpp
   ];
 
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 9d4369003e47..360c7759cd2a 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -213,6 +213,7 @@
 , libopenmpt
 , libopus
 , libplacebo
+, libplacebo_5
 , libpulseaudio
 , libraw1394
 , librsvg
@@ -356,7 +357,7 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-FQV9/PiarPXCm45ldtCsxGHjlrriL8DKpn1LaKJ8owI=";
       }
     )
-    ++ (lib.optional (stdenv.isDarwin && lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
+    ++ (lib.optional (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
       { # this can be removed post 6.1
         name = "fix_build_failure_due_to_PropertyKey_EncoderID";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
@@ -584,7 +585,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
   ++ optionals withJack [ libjack2 ]
   ++ optionals withLadspa [ ladspaH ]
-  ++ optionals withLibplacebo [ libplacebo vulkan-headers ]
+  ++ optionals withLibplacebo [ (if (lib.versionAtLeast version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withLzma [ xz ]
   ++ optionals withMfx [ intel-media-sdk ]
   ++ optionals withModplug [ libmodplug ]
diff --git a/pkgs/development/libraries/folly/default.nix b/pkgs/development/libraries/folly/default.nix
index 4d98c163c6d3..22d395785434 100644
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@@ -4,7 +4,6 @@
 , boost
 , cmake
 , double-conversion
-, fetchpatch
 , fmt_8
 , gflags
 , glog
@@ -64,12 +63,21 @@ stdenv.mkDerivation rec {
     # temporary hack until folly builds work on aarch64,
     # see https://github.com/facebook/folly/issues/1880
     "-DCMAKE_LIBRARY_ARCHITECTURE=${if stdenv.isx86_64 then "x86_64" else "dummy"}"
+
+    # ensure correct dirs in $dev/lib/pkgconfig/libfolly.pc
+    # see https://github.com/NixOS/nixpkgs/issues/144170
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
+  # split outputs to reduce downstream closure sizes
+  outputs = [ "out" "dev" ];
+
+  # patch prefix issues again
+  # see https://github.com/NixOS/nixpkgs/issues/144170
   postFixup = ''
-    substituteInPlace "$out"/lib/pkgconfig/libfolly.pc \
-      --replace '=''${prefix}//' '=/' \
-      --replace '=''${exec_prefix}//' '=/'
+    substituteInPlace $dev/lib/cmake/${pname}/${pname}-targets-release.cmake  \
+      --replace '$'{_IMPORT_PREFIX}/lib/ $out/lib/
   '';
 
   # folly-config.cmake, will `find_package` these, thus there should be
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index eadb30352e9a..9ff72c202193 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch2
 , pkg-config
 , python3
 , freetype
@@ -15,25 +14,15 @@
 
 stdenv.mkDerivation rec {
   pname = "fontconfig";
-  version = "2.14.2";
+  version = "2.15.0";
 
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/fontconfig/release/${pname}-${version}.tar.xz";
-    hash = "sha256-26aVtXvOFQI9LO7e+CBiwrkl5R9dTMSu9zbPE/YKRos=";
+    hash = "sha256-Y6BljQ4G4PqIYQZFK1jvBPIfWCAuoCqUw53g0zNdfA4=";
   };
 
-  patches = [
-    # Provide 11-lcdfilter-none.conf for NixOS module
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/268
-    (fetchpatch2 {
-      name = "add-optional-11-lcdfilter-none-configuration.patch";
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/c2666a6d9a6ed18b1bfcef8176e25f62993e24db.patch";
-      hash = "sha256-UBzkxy3uxFO+g0aQtPnBZv7OncgQdinwzNwWS8ngjcE=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     gperf
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
index aa84de4dcecd..cfe0a21e1d35 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
@@ -1,16 +1,29 @@
-{ runCommand, stdenv, lib, libxslt, fontconfig, dejavu_fonts, fontDirectories }:
+{ runCommand, stdenv, lib, libxslt, fontconfig, dejavu_fonts, fontDirectories
+, impureFontDirectories ? [
+    # nix user profile
+    "~/.nix-profile/lib/X11/fonts" "~/.nix-profile/share/fonts"
+  ]
+  ++ lib.optional stdenv.isDarwin "~/Library/Fonts"
+  ++ [
+    # FHS paths for non-NixOS platforms
+    "/usr/share/fonts" "/usr/local/share/fonts"
+  ]
+  # darwin paths
+  ++ lib.optionals stdenv.isDarwin [ "/Library/Fonts" "/System/Library/Fonts" ]
+  # nix default profile
+  ++ [ "/nix/var/nix/profiles/default/lib/X11/fonts" "/nix/var/nix/profiles/default/share/fonts" ] }:
 
 runCommand "fonts.conf"
   {
     nativeBuildInputs = [ libxslt ];
     buildInputs = [ fontconfig ];
+    inherit fontDirectories;
     # Add a default font for non-nixos systems, <1MB and in nixos defaults.
-    fontDirectories = fontDirectories ++ [ dejavu_fonts.minimal ]
-      # further non-nixos fonts on darwin
-      ++ lib.optionals stdenv.isDarwin [ "/System/Library/Fonts" "/Library/Fonts" "~/Library/Fonts" ];
+    impureFontDirectories = impureFontDirectories ++ [ dejavu_fonts.minimal ];
   }
   ''
     xsltproc --stringparam fontDirectories "$fontDirectories" \
+      --stringparam impureFontDirectories "$impureFontDirectories" \
       --path ${fontconfig.out}/share/xml/fontconfig \
       ${./make-fonts-conf.xsl} ${fontconfig.out}/etc/fonts/fonts.conf \
       > $out
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
index ed51b62a1d08..d04e4ffab967 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
@@ -15,6 +15,7 @@
   <xsl:output method='xml' encoding="UTF-8" doctype-system="urn:fontconfig:fonts.dtd" />
 
   <xsl:param name="fontDirectories" />
+  <xsl:param name="impureFontDirectories" />
 
   <xsl:template match="/fontconfig">
 
@@ -23,29 +24,26 @@
 
       <!-- the first cachedir will be used to store the cache -->
       <cachedir prefix="xdg">fontconfig</cachedir>
+      <xsl:text>&#0010;</xsl:text>
       <!-- /var/cache/fontconfig is useful for non-nixos systems -->
       <cachedir>/var/cache/fontconfig</cachedir>
+      <xsl:text>&#0010;</xsl:text>
 
       <!-- system-wide config -->
       <include ignore_missing="yes">/etc/fonts/conf.d</include>
+      <xsl:text>&#0010;</xsl:text>
 
       <dir prefix="xdg">fonts</dir>
+      <xsl:text>&#0010;</xsl:text>
       <xsl:for-each select="str:tokenize($fontDirectories)">
         <dir><xsl:value-of select="." /></dir>
         <xsl:text>&#0010;</xsl:text>
       </xsl:for-each>
 
-      <!-- nix user profile -->
-      <dir>~/.nix-profile/lib/X11/fonts</dir>
-      <dir>~/.nix-profile/share/fonts</dir>
-
-      <!-- FHS paths for non-NixOS platforms -->
-      <dir>/usr/share/fonts</dir>
-      <dir>/usr/local/share/fonts</dir>
-
-      <!-- nix default profile -->
-      <dir>/nix/var/nix/profiles/default/lib/X11/fonts</dir>
-      <dir>/nix/var/nix/profiles/default/share/fonts</dir>
+      <xsl:for-each select="str:tokenize($impureFontDirectories)">
+        <dir><xsl:value-of select="." /></dir>
+        <xsl:text>&#0010;</xsl:text>
+      </xsl:for-each>
 
     </fontconfig>
 
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index c9845feb9678..af96d9d06d27 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -44,8 +44,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake pkg-config ];
 
-  buildInputs = [ zlib fontconfig freetype libpng libjpeg libwebp libtiff libavif ]
-    ++ lib.optional withXorg libXpm;
+  buildInputs = [ zlib freetype libpng libjpeg libwebp libtiff libavif ]
+    ++ lib.optionals withXorg [ fontconfig libXpm ];
 
   outputs = [ "bin" "dev" "out" ];
 
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index bbbdf19a1909..b8c95653e366 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -35,11 +35,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    hash = "sha256-52XlAW/6m53SQ+NjoEYNV3B0RE7iSRJn2y6WycKt73c=";
+    hash = "sha256-90/FlUsn1Oxt+7Ed6ph4iLWxJCiaNwOvytoO5SD0Fz4=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/gperftools/default.nix b/pkgs/development/libraries/gperftools/default.nix
index da40c66e9fe5..132ae64577a7 100644
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@@ -4,6 +4,7 @@
 , fetchpatch
 , autoreconfHook
 , libunwind
+, perl
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +30,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   # tcmalloc uses libunwind in a way that works correctly only on non-ARM dynamically linked linux
-  buildInputs = lib.optional (stdenv.isLinux && !(stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isStatic )) libunwind;
+  buildInputs = [ perl ]
+             ++ lib.optional (stdenv.isLinux && !(stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isStatic )) libunwind;
 
   # Disable general dynamic TLS on AArch to support dlopen()'ing the library:
   # https://bugzilla.redhat.com/show_bug.cgi?id=1483558
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index 590818546a4b..a6797786ee53 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.113/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.114/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 06b5e6b04cfa..d51c74cc4e64 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/attica-5.113.0.tar.xz";
-      sha256 = "0p6n2jvky5x9gpwmp31mdxf0bzywaljgnkszgbklyc35xk9i6j14";
-      name = "attica-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/attica-5.114.0.tar.xz";
+      sha256 = "0gkdsm1vyyyxxyl4rni9s2bdz5w6zphzjl58fddjl899da06hqfq";
+      name = "attica-5.114.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/baloo-5.113.0.tar.xz";
-      sha256 = "1jv7202dj2w0vcv49bgp0iv1sfy3kdqr974rcr77pcfzhhda9bix";
-      name = "baloo-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/baloo-5.114.0.tar.xz";
+      sha256 = "19sib1y0m5h2gnnpr9rfk810p6pdfm4zzxlm0a44r7910llp8i50";
+      name = "baloo-5.114.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/bluez-qt-5.113.0.tar.xz";
-      sha256 = "1y6nkl9zc5298jc6klxz88h6srmma085w1q5l4jmjihgys2zkcx7";
-      name = "bluez-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/bluez-qt-5.114.0.tar.xz";
+      sha256 = "1ni50jwnb5ww8mkql0p3q8660c0srj8p0ik27lvxakwdq4wf6l9s";
+      name = "bluez-qt-5.114.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/breeze-icons-5.113.0.tar.xz";
-      sha256 = "0kb3wchx84dpi77zsi1b9pzlkhg3sjagxcsf1pdappagq3xn1p48";
-      name = "breeze-icons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/breeze-icons-5.114.0.tar.xz";
+      sha256 = "0z5cpv10jyjdwjfkm7nj6hyp4vj29apm476hvbpb4gan27jyb91y";
+      name = "breeze-icons-5.114.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/extra-cmake-modules-5.113.0.tar.xz";
-      sha256 = "1i1vpf9860cwrq5b01yrgf94hmzk9dx637j638shgjmyxr058pi6";
-      name = "extra-cmake-modules-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/extra-cmake-modules-5.114.0.tar.xz";
+      sha256 = "0z4nqravsfzlsgvkg5rha2d0qxfr3pfncw7z2fxzzqvzj7mfk6im";
+      name = "extra-cmake-modules-5.114.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/frameworkintegration-5.113.0.tar.xz";
-      sha256 = "17i7frachq23kfg78ar33x5acwf7pmwl1a5c02qif44mml8b09hi";
-      name = "frameworkintegration-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/frameworkintegration-5.114.0.tar.xz";
+      sha256 = "1dqgzhhh8gnvl8jsvh2i6pjn935d61avh63b4z9kpllhvp9a2lnd";
+      name = "frameworkintegration-5.114.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kactivities-5.113.0.tar.xz";
-      sha256 = "1d9lkhp344wdss9vab3gh9h31f1k6fifdhp17fblpkykgyvbb26y";
-      name = "kactivities-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kactivities-5.114.0.tar.xz";
+      sha256 = "10pyynqz8c22la9aqms080iqlisj3irbi1kwnn3s0vg5dsjxr1p3";
+      name = "kactivities-5.114.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kactivities-stats-5.113.0.tar.xz";
-      sha256 = "136z2njw3k2l71xp4vg10sm5q925xh8yfr9a784wnr0kwngdb71i";
-      name = "kactivities-stats-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kactivities-stats-5.114.0.tar.xz";
+      sha256 = "1zhrs2p3c831rwx7ww87i82k5i236vfywdxv7zhz93k3vffyqby7";
+      name = "kactivities-stats-5.114.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kapidox-5.113.0.tar.xz";
-      sha256 = "05407c01wnjyslbbz0w5wipjpx6ng3izya41mg13g700ainj9q1x";
-      name = "kapidox-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kapidox-5.114.0.tar.xz";
+      sha256 = "0xxw3lvipyax8r1af3ypwjj6waarbp2z9n11fjb4kvyigsypglmb";
+      name = "kapidox-5.114.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/karchive-5.113.0.tar.xz";
-      sha256 = "03a3p85hmx4ycfp0y5l9yw4cy3i9jwy7jd27psmckr4q0538k91d";
-      name = "karchive-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/karchive-5.114.0.tar.xz";
+      sha256 = "015gc1zarny8r478p7g9m6r67l5dk3r0vcp28ilmfmznxy0k0hda";
+      name = "karchive-5.114.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kauth-5.113.0.tar.xz";
-      sha256 = "0ncpyq2l53p4yhhxkvk23x0ji9amrbnm6kbz8dp573cqww79pih2";
-      name = "kauth-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kauth-5.114.0.tar.xz";
+      sha256 = "1rkf9mc9718wn8pzd3d3wcg3lsn0vkr9a2cqnz86rbg3cf2qdbir";
+      name = "kauth-5.114.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kbookmarks-5.113.0.tar.xz";
-      sha256 = "1fgnh8amy2ghn50i59al0iyqvj05pzdxai9qxqzbvi65f1pibi7d";
-      name = "kbookmarks-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kbookmarks-5.114.0.tar.xz";
+      sha256 = "06lnsyjhh80mdcqjww40glinmrjydbmkhv27a267vf34r7kam9rc";
+      name = "kbookmarks-5.114.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcalendarcore-5.113.0.tar.xz";
-      sha256 = "18psjzqcfzaplcfjpjda983mrpv306il0j49q3rm9hj9ycj54wc2";
-      name = "kcalendarcore-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcalendarcore-5.114.0.tar.xz";
+      sha256 = "0aimda01zqw4fz5ldvz4vh767bi10r00kvm62n89nxhsq46wlk7p";
+      name = "kcalendarcore-5.114.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcmutils-5.113.0.tar.xz";
-      sha256 = "1xbfzw2zfl966zp70jzfp3hjzn334zf4hnwr82priffafgrin57s";
-      name = "kcmutils-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcmutils-5.114.0.tar.xz";
+      sha256 = "1pblf3c60m0gn3vhdprw28f8y54kij02jwz91r2vnmng8d1xkrp9";
+      name = "kcmutils-5.114.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcodecs-5.113.0.tar.xz";
-      sha256 = "1xvaq0yg4n4lwyq3yx2m8jrvfg7f0qrwgxxam4rmp2l245bvn34i";
-      name = "kcodecs-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcodecs-5.114.0.tar.xz";
+      sha256 = "080zvcqd8iq05p5x3qaf3rryx75lg2l2j1dr18sp50ir50zfwh2w";
+      name = "kcodecs-5.114.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcompletion-5.113.0.tar.xz";
-      sha256 = "016280h98j1ssvc3a4b3vyh4s93s9y9hn1jrpbfbkm9xxnvi7k79";
-      name = "kcompletion-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcompletion-5.114.0.tar.xz";
+      sha256 = "0qvdxqlh1dklkbmqfjg5gc3dkdicgzn6q5lgvyf8cv46dinj6mwc";
+      name = "kcompletion-5.114.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kconfig-5.113.0.tar.xz";
-      sha256 = "0fwhn3yp4gfwjiy5dx7gs0zd65yjlrrzkqpy7fpg7n97qf99q2a8";
-      name = "kconfig-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kconfig-5.114.0.tar.xz";
+      sha256 = "0hghdh4p6cq9ckp4g5jdgd8w47pdsxxvzimrdfjrs71lmy8ydiy2";
+      name = "kconfig-5.114.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kconfigwidgets-5.113.0.tar.xz";
-      sha256 = "0bmk5qxiss7a71xpfsbqj831wkcf94b7wfbw9xisvnxlfmf60y4v";
-      name = "kconfigwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kconfigwidgets-5.114.0.tar.xz";
+      sha256 = "16layydkcwfbvzxqjzprkq8bbxifn0z0wm7mc9bzwrfxy761rjnj";
+      name = "kconfigwidgets-5.114.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcontacts-5.113.0.tar.xz";
-      sha256 = "1y9cdv1g2ypwl4b0hk1sxk7lvb5qkbm4n1gh62plqsran62jsimm";
-      name = "kcontacts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcontacts-5.114.0.tar.xz";
+      sha256 = "0lyqvbs216p5zpssaf4pyccph7nbwkbvhpmhbi32y2rm23cmxlwf";
+      name = "kcontacts-5.114.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcoreaddons-5.113.0.tar.xz";
-      sha256 = "1bhanzfjw2i49sx2hjnim8k72vvbs7gyig7nkqkgbaxzpa8qgwrf";
-      name = "kcoreaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcoreaddons-5.114.0.tar.xz";
+      sha256 = "1wv3s3xsiii96k17nzs2fb0ih2lyg52krf58v44nlk9wfi4wmnqx";
+      name = "kcoreaddons-5.114.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcrash-5.113.0.tar.xz";
-      sha256 = "1mg90xm6ckcd30s07psn30sgh81lx8kfs0p1h6cblg4q8bkgkndv";
-      name = "kcrash-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcrash-5.114.0.tar.xz";
+      sha256 = "1avi4yd3kpjqxrvci1nicxbh9mjafj1w2vgfmqanq66b76s4kxj1";
+      name = "kcrash-5.114.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdav-5.113.0.tar.xz";
-      sha256 = "1djng9c741xairr84nvjbkq4dk551p7yk91g8d4nndy8s1kiz1dv";
-      name = "kdav-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdav-5.114.0.tar.xz";
+      sha256 = "11959fxz24snk2l31kw8w96wah0s2fjimimrxh6xhppiy5qp2fp2";
+      name = "kdav-5.114.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdbusaddons-5.113.0.tar.xz";
-      sha256 = "101a406f8i0wgaxd0ilvfcb3plzjgvxw9bhhm5pin6fpr0xkjrnk";
-      name = "kdbusaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdbusaddons-5.114.0.tar.xz";
+      sha256 = "0pzzznyxhi48z5hhdsdxz3vaaihrdshpx65ha2v2nn2gh3ww7ikm";
+      name = "kdbusaddons-5.114.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdeclarative-5.113.0.tar.xz";
-      sha256 = "1wj9arkmjdrac04cq2w5bw5184jnlq5xn2cw6n7lajc31yrbc0rk";
-      name = "kdeclarative-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdeclarative-5.114.0.tar.xz";
+      sha256 = "0w98pj8acxb4m9645963rzq5vja1fbih5czz24mf9zdqlg2dkz8g";
+      name = "kdeclarative-5.114.0.tar.xz";
     };
   };
   kded = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kded-5.113.0.tar.xz";
-      sha256 = "1vb3z7r2l206n7p70a4cbkrm7fvyk7hqqf0bz7514r4g86l4l5n4";
-      name = "kded-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kded-5.114.0.tar.xz";
+      sha256 = "00n4isc4ahii0ldrg761lkmnq27kmrfqs9zkmpvmgbg57259mvc3";
+      name = "kded-5.114.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdelibs4support-5.113.0.tar.xz";
-      sha256 = "1z843zq1g5n3b8gb20y8266hyikvbzdsgc77gvcgzvqfdxk19l24";
-      name = "kdelibs4support-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdelibs4support-5.114.0.tar.xz";
+      sha256 = "17473him2fjfcw5f88diarqac815wsakfyb9fka82a4qqh9l41mc";
+      name = "kdelibs4support-5.114.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdesignerplugin-5.113.0.tar.xz";
-      sha256 = "05hwq8rpm1f9ad5fyk2gjqxm6gvvx2gx2zdbklww9ghlh8qndl9i";
-      name = "kdesignerplugin-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdesignerplugin-5.114.0.tar.xz";
+      sha256 = "0zlvkayv6zl5rp1076bscmdzyw93y7sxqb5848w11vs0g9amcj9n";
+      name = "kdesignerplugin-5.114.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdesu-5.113.0.tar.xz";
-      sha256 = "085d3d6qpl4m7z8smm0bq9khfjjglpb1gd9n8q0d541127y2cpq4";
-      name = "kdesu-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdesu-5.114.0.tar.xz";
+      sha256 = "14dcf32izn4lxr8vx372rfznflc1rcxwanx06phkd8mx9zyg4jxr";
+      name = "kdesu-5.114.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdewebkit-5.113.0.tar.xz";
-      sha256 = "18bmg88xj07h8y5f3f2ckjs9m61mf8jrxrg4vg8hrf4nabxz20xn";
-      name = "kdewebkit-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdewebkit-5.114.0.tar.xz";
+      sha256 = "04zc2qs13k04gsn124mnh6sqi3pax8c014jcb0qdh3h2r2y72bz3";
+      name = "kdewebkit-5.114.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdnssd-5.113.0.tar.xz";
-      sha256 = "1hbb9zy1f13m45b6kzndxw619vnmx0s418brqgkdaxgsh12j5anq";
-      name = "kdnssd-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdnssd-5.114.0.tar.xz";
+      sha256 = "1zw5rkprr54j05ic8zljk57zahp2v6333slr253r3n1679zqlv64";
+      name = "kdnssd-5.114.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdoctools-5.113.0.tar.xz";
-      sha256 = "0cfs4znhp7psrz99j3brp8q39gg0bpzvkrdx90zl6vvrc06d2zaa";
-      name = "kdoctools-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdoctools-5.114.0.tar.xz";
+      sha256 = "15s58r2zvdckw30x9q9ir8h1i8q2ncfgjn9h4jnmylwm79z3z27v";
+      name = "kdoctools-5.114.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kemoticons-5.113.0.tar.xz";
-      sha256 = "127frvsp1h9hg755vz2i609wxqqgzgsz15iqr7hcpbmmf6xvm8i2";
-      name = "kemoticons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kemoticons-5.114.0.tar.xz";
+      sha256 = "0w87prkhdmba7y8ylbycdpwdzd2djmp7hvv5ljb9s4aqqhnn3vw4";
+      name = "kemoticons-5.114.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kfilemetadata-5.113.0.tar.xz";
-      sha256 = "1ap25y66y1r185fghvkkkkp4f6acnkazny8wxw5hv1gg25ilpsir";
-      name = "kfilemetadata-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kfilemetadata-5.114.0.tar.xz";
+      sha256 = "15va29chlsrxii02w1ax718hp1b14ym59lcfyzh7w30zlf681560";
+      name = "kfilemetadata-5.114.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kglobalaccel-5.113.0.tar.xz";
-      sha256 = "0ibm1wd7fhi3j5za0agyq2zrs9nx5a8b47iijkzgkpz9ylxniwrs";
-      name = "kglobalaccel-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kglobalaccel-5.114.0.tar.xz";
+      sha256 = "19mmav055fnzyl760fyhf0pdvaidd5i1h04l2hcnpin4p1jnpfap";
+      name = "kglobalaccel-5.114.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kguiaddons-5.113.0.tar.xz";
-      sha256 = "1ykhxgx89x1qv916pcz3j0q14ylalg9v23jjw0dbwpg5hlj4qlyc";
-      name = "kguiaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kguiaddons-5.114.0.tar.xz";
+      sha256 = "0riya9plcz9c1ndhdbsradssndshbm12705swn7vf7am17n7f947";
+      name = "kguiaddons-5.114.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kholidays-5.113.0.tar.xz";
-      sha256 = "1wq397j3m3s9a45k9h5hsdsfansvb3a5q8biag2w3fsb1i84id0i";
-      name = "kholidays-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kholidays-5.114.0.tar.xz";
+      sha256 = "19r8dxglz5ll6iyvigsccil3ikvcsnyy5nwcpjvjr1c0brigcjmy";
+      name = "kholidays-5.114.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/khtml-5.113.0.tar.xz";
-      sha256 = "0m284rwq8f49j71lcapzr4qi0f72a0adnv67mfg5blar867161mq";
-      name = "khtml-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/khtml-5.114.0.tar.xz";
+      sha256 = "1mf84zs9hjvmi74f8rgqzrfkqjq597f9k64dn1bqcj13v0w10vry";
+      name = "khtml-5.114.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ki18n-5.113.0.tar.xz";
-      sha256 = "0hl0qp3653xiwa5ndk82ygy2kgrc0pygqkknb1cx5w54s56bm57w";
-      name = "ki18n-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ki18n-5.114.0.tar.xz";
+      sha256 = "1yg03awcx5ay6lgbgwv91i0ankrm94z9m0wky4v03gnwnvw8pa0v";
+      name = "ki18n-5.114.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kiconthemes-5.113.0.tar.xz";
-      sha256 = "0q2c1s8pwl7dnx9v7q061zn5n1prk0vv0j77kki9wfncjaf15g0g";
-      name = "kiconthemes-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kiconthemes-5.114.0.tar.xz";
+      sha256 = "0ndiqmcs1ybj4acc6k3p9jwq09slqc4nj12ifqvlxrfj3ak6sb28";
+      name = "kiconthemes-5.114.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kidletime-5.113.0.tar.xz";
-      sha256 = "1cdfhn3mcxvizba1gpf0viba3g0mnva3l226lkca3p9ps8c4z3rm";
-      name = "kidletime-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kidletime-5.114.0.tar.xz";
+      sha256 = "06sc9w54g4n7s5gjkqz08rgcz6v3pr0bdgx3gbjgzass6l4m8w7p";
+      name = "kidletime-5.114.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kimageformats-5.113.0.tar.xz";
-      sha256 = "0gys83sazgbj7h3yiaacqr464z951ixygrhzcw16cnqjm8phic44";
-      name = "kimageformats-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kimageformats-5.114.0.tar.xz";
+      sha256 = "1nfzpgnrbwncx9zp9cwa169jlfv7i85p00a07d4jc5hrdyvvkn0w";
+      name = "kimageformats-5.114.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kinit-5.113.0.tar.xz";
-      sha256 = "1ydmgxyr5j9zi0a5vlb64kkjxka3rsyvzj10y3dww92qyapnn2bv";
-      name = "kinit-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kinit-5.114.0.tar.xz";
+      sha256 = "0b6z9gq05vz20hm5y9ai3sbqq3gxwm3a3z88dkvi7dywk7vbqcph";
+      name = "kinit-5.114.0.tar.xz";
     };
   };
   kio = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kio-5.113.0.tar.xz";
-      sha256 = "1bjmv3wdpmzqbv1xzzl0ydirccbknnjyqn6wzb057zgy7kpi1cd8";
-      name = "kio-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kio-5.114.0.tar.xz";
+      sha256 = "0nwmxbfhvfw69q07vxvflri7rkdczyc89xv4ll3nrzrhgf15kb2z";
+      name = "kio-5.114.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kirigami2-5.113.0.tar.xz";
-      sha256 = "0zy3s841q2xw4d048a3qh4cfh9kb3qaqxml4ny5zi73crm173h8y";
-      name = "kirigami2-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kirigami2-5.114.0.tar.xz";
+      sha256 = "1bd232gs4394fa3aq31mjqrn8f3vjsghx7817szi7ryvnn6fnqkw";
+      name = "kirigami2-5.114.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kitemmodels-5.113.0.tar.xz";
-      sha256 = "01i1s7rw7ndp3gnl3bg0pv8a9qz95rmz0jxkw97p72gcah2q2yvk";
-      name = "kitemmodels-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kitemmodels-5.114.0.tar.xz";
+      sha256 = "1bfmcrbcbrvp2rcaf32vzvarqwp41gn6s4xpf56hnxbwf9kgk1fl";
+      name = "kitemmodels-5.114.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kitemviews-5.113.0.tar.xz";
-      sha256 = "0wnmgm72kv7vxadsrkdbnjknb4lkzrmn6gk7car7jx2i91kz7xdd";
-      name = "kitemviews-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kitemviews-5.114.0.tar.xz";
+      sha256 = "00vl2ck0pq0sqcxvhlr2pimgr27hd9v7y9dz6w4arb5smi5q1ixg";
+      name = "kitemviews-5.114.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kjobwidgets-5.113.0.tar.xz";
-      sha256 = "0f5shrapjvwp8bc34vypzfsfl07pj7nmdflf9lcwc8h3kwf2rxqr";
-      name = "kjobwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kjobwidgets-5.114.0.tar.xz";
+      sha256 = "1ymlqi5cqcs79nj1vff8pqwgvy0dxj5vv7l529w3a3n315hkrny8";
+      name = "kjobwidgets-5.114.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kjs-5.113.0.tar.xz";
-      sha256 = "0h50jyd9mddnavafikn9haqqcq1mql2v8qcc1c233ffplkx1f6hb";
-      name = "kjs-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kjs-5.114.0.tar.xz";
+      sha256 = "08nh6yr6bqifpb5s9a4wbjwmwnm7zp5k8hcdmyb6mlcbam9qp6j7";
+      name = "kjs-5.114.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kjsembed-5.113.0.tar.xz";
-      sha256 = "0bwsj0n3d038vs3n2mw6x8srbg4da40bw59q14cpv70ws1sg2r2n";
-      name = "kjsembed-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kjsembed-5.114.0.tar.xz";
+      sha256 = "1xglisxv7nfsbj9lgpvc4c5ql4f6m7n71vf7vih5ff3aqybrkgxa";
+      name = "kjsembed-5.114.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kmediaplayer-5.113.0.tar.xz";
-      sha256 = "1nyn7x28j17yrb7zx31519h2ghp5h3pwk6baxais0q1mv9azyfay";
-      name = "kmediaplayer-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kmediaplayer-5.114.0.tar.xz";
+      sha256 = "092yvzvrkvr8xxncw7h5ghfd2bggzxsqfj67c2vhymhfw4i0c54x";
+      name = "kmediaplayer-5.114.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knewstuff-5.113.0.tar.xz";
-      sha256 = "0fj17rxyp9wmmc9jh8zjpgwpia9r4xlvabvkb4ynd1vhy58k8w51";
-      name = "knewstuff-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knewstuff-5.114.0.tar.xz";
+      sha256 = "15xmx7rnnrsz2cj044aviyr4hi9h8r0nnva9qzcjcq2hkkgj7wjj";
+      name = "knewstuff-5.114.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knotifications-5.113.0.tar.xz";
-      sha256 = "1yzpf12wsi3h3v7z68b42rjdrnfkah6avq4y611b0r004shgkl1x";
-      name = "knotifications-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knotifications-5.114.0.tar.xz";
+      sha256 = "0cjd5ml9hyzprjgmrc132cmp7g9hnl0h5swlxw2ifqnxxyfkg72b";
+      name = "knotifications-5.114.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knotifyconfig-5.113.0.tar.xz";
-      sha256 = "1gdzyxcc371lmnzc153k8wdyxgsv7r2y44j8d5srld36amssxnc6";
-      name = "knotifyconfig-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knotifyconfig-5.114.0.tar.xz";
+      sha256 = "049n64qlr69zv1dc1dhgbsca37179hp06xfsxnhg97lblz3p3gds";
+      name = "knotifyconfig-5.114.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpackage-5.113.0.tar.xz";
-      sha256 = "04605kr2w0yhwx64lqq1qc1zmmip7vkxnxv3fs2846864814fkk2";
-      name = "kpackage-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpackage-5.114.0.tar.xz";
+      sha256 = "0v165az3k5lfszxy0kl2464573y0dcq92fyfiklwnkkcjsvba69d";
+      name = "kpackage-5.114.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kparts-5.113.0.tar.xz";
-      sha256 = "0mx95xrr6pad4q5p0sn2iqmc59787bpfkvkyiz9li56wynh1jf48";
-      name = "kparts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kparts-5.114.0.tar.xz";
+      sha256 = "1rrf765p554r7l8j23gx5zxdq6wimh0v91qdkwz7ilm2qr16vd5v";
+      name = "kparts-5.114.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpeople-5.113.0.tar.xz";
-      sha256 = "08g44hq1iywycf44imdqkql4gx2vyg87n1nxxqq6ssva0kybia7n";
-      name = "kpeople-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpeople-5.114.0.tar.xz";
+      sha256 = "04v0s3amn6lbb16qvp1r6figckva6xk8z7djk8jda8fbnx8dx2r1";
+      name = "kpeople-5.114.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kplotting-5.113.0.tar.xz";
-      sha256 = "16pfia711y9iqnl0svyg00g7a2x4ln8yaxmrmy74xj7y0dj5jcyj";
-      name = "kplotting-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kplotting-5.114.0.tar.xz";
+      sha256 = "17x58pplln0plqiyhjpzdiqxngylxq5gkc5gk7b91xzm783x2k0n";
+      name = "kplotting-5.114.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpty-5.113.0.tar.xz";
-      sha256 = "0hzn18lidiiaxr08fjhk0r5zh0m01ls46w1fyjnv42bvf7vd7v5y";
-      name = "kpty-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpty-5.114.0.tar.xz";
+      sha256 = "0fm7bfp89kvg1a64q8piiyal71p6vjnqcm13zak6r9fbfwcm0gs9";
+      name = "kpty-5.114.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kquickcharts-5.113.0.tar.xz";
-      sha256 = "0v47c6mdx72rdz441zk4csc6a2bj6wi7772vlpz2yr3ay70l8f5d";
-      name = "kquickcharts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kquickcharts-5.114.0.tar.xz";
+      sha256 = "1f91x92qdzxp31z7ixx9jn41hq9f3w9hjia94pab9vsnaz8prbd1";
+      name = "kquickcharts-5.114.0.tar.xz";
     };
   };
   kross = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kross-5.113.0.tar.xz";
-      sha256 = "1cqdcm086a4kjrb9k6cwqn05fg5ij3zppc8bi7dxrgrfxc494c8s";
-      name = "kross-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kross-5.114.0.tar.xz";
+      sha256 = "0bbpi63lxbb4ylx2jd172a2bqyxkd606n7w8zrvcjy466lkv3sz4";
+      name = "kross-5.114.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/krunner-5.113.0.tar.xz";
-      sha256 = "0z7d6nyvrlgr7aw9ibz1xgp62220iwzvhqpqikwlxhc9hjggmdlh";
-      name = "krunner-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/krunner-5.114.0.tar.xz";
+      sha256 = "1rjs9b87bi4f6pdm9fwnha2sj2mrq260l80iz2jq1zah83p546sw";
+      name = "krunner-5.114.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kservice-5.113.0.tar.xz";
-      sha256 = "09ph72jb40pkw1nzayvzzav4m6240amkj6jvx390dmsvr7jzn0nb";
-      name = "kservice-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kservice-5.114.0.tar.xz";
+      sha256 = "0jdvlplnsb9w628wh3ip6awxvhgyc097zh7ls9614ymkbnpc9xca";
+      name = "kservice-5.114.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ktexteditor-5.113.0.tar.xz";
-      sha256 = "02nclhfgqximsl8w6la5w0fshzcj71nrz5kjb2p1s28xdf1ahvgg";
-      name = "ktexteditor-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ktexteditor-5.114.0.tar.xz";
+      sha256 = "06amzk6290imi2gj3v1k3f56zdlad7zbz4wwlf34v4iibj9mfgw8";
+      name = "ktexteditor-5.114.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ktextwidgets-5.113.0.tar.xz";
-      sha256 = "060grfna4kj8nhxgk38yf3csqfgxg0358dkwmg8aw5y5k0jys2az";
-      name = "ktextwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ktextwidgets-5.114.0.tar.xz";
+      sha256 = "0w1wwyd3fy351rmkhf3i55is5031j2zxvswm0b1sb3pd159v888v";
+      name = "ktextwidgets-5.114.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kunitconversion-5.113.0.tar.xz";
-      sha256 = "1x7gwrz43wvd3r87x545bxxyzhqj87mhhx05dqh0b09vqk6gxzza";
-      name = "kunitconversion-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kunitconversion-5.114.0.tar.xz";
+      sha256 = "1qyqvl8fy105zwma5nrkz9zg5932w2f33daw0azhj322iffrm39n";
+      name = "kunitconversion-5.114.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwallet-5.113.0.tar.xz";
-      sha256 = "0aq8d5c5p9j19bzspd205gh297n7fh5f26m49826fx5mp1im4lwn";
-      name = "kwallet-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwallet-5.114.0.tar.xz";
+      sha256 = "1cji8bvy5m77zljyrrgipsw8pxcds1sgikxlq3sdfxymcsw2wr36";
+      name = "kwallet-5.114.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwayland-5.113.0.tar.xz";
-      sha256 = "1anhvz4b1q835py451jznnfj9z2jh1fwnx4lfwhi67viaplpiwqg";
-      name = "kwayland-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwayland-5.114.0.tar.xz";
+      sha256 = "1lzmlbv5vl656cigjj07hbc0gj6g1i2xqanvnhxj360109kzilf1";
+      name = "kwayland-5.114.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwidgetsaddons-5.113.0.tar.xz";
-      sha256 = "01rabfl2v5l9r3fgwgy75krib1486mdc4k3kfi035s6dvg8iy015";
-      name = "kwidgetsaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwidgetsaddons-5.114.0.tar.xz";
+      sha256 = "1cc8lsk9v0cp2wiy1q26mlkf8np0yj01sq8a7w13ga5s6hv4sh2n";
+      name = "kwidgetsaddons-5.114.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwindowsystem-5.113.0.tar.xz";
-      sha256 = "1hzavawsl14rsl9qb874zahvsvkrbcin7fg1xn1d7ssypphlis51";
-      name = "kwindowsystem-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwindowsystem-5.114.0.tar.xz";
+      sha256 = "03xbsf1pmswd2kpn3pdszp4vndclsh7j02fp22npxaxllmfr4va9";
+      name = "kwindowsystem-5.114.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kxmlgui-5.113.0.tar.xz";
-      sha256 = "022l557z9jgrz2hj8hh9z7cjkvfhl5rdp81jhk2gd3wzmyf5zzmq";
-      name = "kxmlgui-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kxmlgui-5.114.0.tar.xz";
+      sha256 = "0gvjf32ssc0r0bdpb1912ldsr5rjls8vrscwy5gm9g5gw504hmmr";
+      name = "kxmlgui-5.114.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kxmlrpcclient-5.113.0.tar.xz";
-      sha256 = "141vlxxnyll5q0wg2va5prg0wf0hpymlzfkg37h1ngjwjs2x2yc1";
-      name = "kxmlrpcclient-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kxmlrpcclient-5.114.0.tar.xz";
+      sha256 = "1fgjai3vj3yk67ynhd7blilyrdhdn5nvma3v3j1sbdg98pr7qzar";
+      name = "kxmlrpcclient-5.114.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/modemmanager-qt-5.113.0.tar.xz";
-      sha256 = "069irg7ckws06qzq5mwkxvzx4r2xqwagwif6dq284hjihrz38l8b";
-      name = "modemmanager-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/modemmanager-qt-5.114.0.tar.xz";
+      sha256 = "16jqhmcpsffl9a7c0bb4hwjy3bw5rakdsnc5n6y8djc6237jl9pi";
+      name = "modemmanager-qt-5.114.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/networkmanager-qt-5.113.0.tar.xz";
-      sha256 = "03wdbw6dr9a49qcs1j2lm9q894rvdl8xqjpwm3yrrjb866yyhcg1";
-      name = "networkmanager-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/networkmanager-qt-5.114.0.tar.xz";
+      sha256 = "10anjsnrzawrfjlznjvvl2sbxrajl2ddnq2kgl314b5dk7z3yk4n";
+      name = "networkmanager-qt-5.114.0.tar.xz";
     };
   };
   oxygen-icons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/oxygen-icons-5.113.0.tar.xz";
-      sha256 = "0grdn0gz59lfp4n5mmlan71x3iwgm87dnhk8mla02dn7hv0fl0xx";
-      name = "oxygen-icons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/oxygen-icons-5.114.0.tar.xz";
+      sha256 = "0f6hv5g8y2ggagrq9x9b78bqxqg6bqcpm1xxhf69ybgjikrqdf2r";
+      name = "oxygen-icons-5.114.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/plasma-framework-5.113.0.tar.xz";
-      sha256 = "0iijawnh9ri1n6qgdrraf3lq5sy7z0jy5ihmfzk22pn10ba992ky";
-      name = "plasma-framework-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/plasma-framework-5.114.0.tar.xz";
+      sha256 = "058hl76q35bw3rzmv348azk1lmhkpgmfrxr3jd9s1hphijr8sgcx";
+      name = "plasma-framework-5.114.0.tar.xz";
     };
   };
   prison = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/prison-5.113.0.tar.xz";
-      sha256 = "18y4gxj5zml59a8i7gzr5cbbzi5wyknbva2ihfdpqf85vw3x2wdp";
-      name = "prison-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/prison-5.114.0.tar.xz";
+      sha256 = "1wbr1lryxmrx65ilq1bhqsdhhikrih977nhpb02fq0cqnvv7v9i7";
+      name = "prison-5.114.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/purpose-5.113.0.tar.xz";
-      sha256 = "0p5zcvrkaw71w8795x2a4lx3z977j6jcnwbi9wi1956gcx4avhhf";
-      name = "purpose-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/purpose-5.114.0.tar.xz";
+      sha256 = "1lj67f0x4gvbh9by3c3crbbwwnx7b9ifjna9ggziya4m6zj0m4z1";
+      name = "purpose-5.114.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/qqc2-desktop-style-5.113.0.tar.xz";
-      sha256 = "0sk0sk7cq511m0rjmgsg1z8s4sy064qmbql472ljyblafm71wj6p";
-      name = "qqc2-desktop-style-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/qqc2-desktop-style-5.114.0.tar.xz";
+      sha256 = "1y5g91vybjvhwmzpfwrc70q5j7jxf5b972f9fh2vzb930jir6c8g";
+      name = "qqc2-desktop-style-5.114.0.tar.xz";
     };
   };
   solid = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/solid-5.113.0.tar.xz";
-      sha256 = "0vhhkn15axfvlwrf9np91hnipw1lb2x9zh0ajpngvxzcnj6kvn7r";
-      name = "solid-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/solid-5.114.0.tar.xz";
+      sha256 = "1slxlj5jhp8g745l328932934633nl81sq3n8fd73h655hymsk4s";
+      name = "solid-5.114.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/sonnet-5.113.0.tar.xz";
-      sha256 = "17v3a2j0vhx7mzv0wfgqky248m57gasyv1xbjqpzjdr3x2f1zhy6";
-      name = "sonnet-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/sonnet-5.114.0.tar.xz";
+      sha256 = "0zxi96i3gfpx759qc1nyz7jqlswg5ivgr1w9gbbsm1x5fi9ikadx";
+      name = "sonnet-5.114.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/syndication-5.113.0.tar.xz";
-      sha256 = "1nzcfk4qsjvrgci3vk78jjpbig61pm0y73h3qs83yld1zw3az3jx";
-      name = "syndication-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/syndication-5.114.0.tar.xz";
+      sha256 = "13rjb1zm9yd8vbm9h7avqih5v0rr2srqwglm29l7mcnankqlh4n7";
+      name = "syndication-5.114.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/syntax-highlighting-5.113.0.tar.xz";
-      sha256 = "1blifnqikvrlkcskwjdk54mvh8yd4r0vzz282mi64w7alimlilgl";
-      name = "syntax-highlighting-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/syntax-highlighting-5.114.0.tar.xz";
+      sha256 = "1skblg2m0sar63qrgkjsg0w9scixggm5qj7lp4gzjn4hwq6m3n63";
+      name = "syntax-highlighting-5.114.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/threadweaver-5.113.0.tar.xz";
-      sha256 = "1x7i7mdg5v22y04m720k9fqj7xagm8qnlssb1xjs9nj0aqif8jgp";
-      name = "threadweaver-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/threadweaver-5.114.0.tar.xz";
+      sha256 = "1y07g58w6z3i11y3djg3aaxanhp9hzaciq61l4dn1gqwghn09xgh";
+      name = "threadweaver-5.114.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index 076eccb1c26e..232fb29ecbe5 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -22,12 +22,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.0.5";
+  version = "0.1.0";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-rd1YIEosg4+H/FJBYCoxdQlV9F0evU5fckHJrSdVPOE=";
+    hash = "sha256-icHZtv25QvJEv0DlELT3cDxho3Oz2BJAMNKr5W4bshk=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 5cb8f2cbad8e..8d8a932f4994 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.119";
+  version = "2.4.120";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-CknxLwm1tuaOqq/z8Cynz/mqkmk5shLTQxYdPorFYpE=";
+    hash = "sha256-O/VTY/dsclCUZEGrUdOmzArlGAVcD/AXMkq3bN77Mno=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 820f466d8447..8454f3e1e83b 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -9,7 +9,7 @@
 , libjpeg
 , libpng
 , libwebp
-, openexr
+, openexr_3
 , pkg-config
 , zlib
 , buildDocs ? true
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     libjpeg
     libpng
     libwebp
-    openexr
+    openexr_3
     zlib
   ];
 
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 9965771c1531..8ceb1b3b03bf 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -19,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.28.4";
+  version = "1.30.0";
 
   outputs = [ "out" "dev" ]
     ++ lib.optionals withDocs [ "man" ];
@@ -29,27 +28,9 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libmbim";
     rev = version;
-    hash = "sha256-aaYjvJ2OMTzkUyqWCyHdmsKJ3VGqBmKQzb1DWK/1cPU=";
+    hash = "sha256-sHTpu9WeMZroT+1I18ObEHWSzcyj/Relyz8UNe+WawI=";
   };
 
-  patches = [
-    # Intel Mutual Authentication - FCC lock. Part of 1.30, backported to
-    # openSUSE and Fedora and ChromeOS.
-    # https://src.fedoraproject.org/rpms/libmbim/blob/rawhide/f/libmbim.spec
-    (fetchpatch {
-      url = "https://cgit.freedesktop.org/libmbim/libmbim/patch/?id=910db9cb2b6fde303d3b4720890cf6dc6fc00880";
-      hash = "sha256-412sXdWb8WsSexe1scI/C57dwENgNWoREGO1GxSF4hs=";
-    })
-
-    # Intel Tools. Allows tracing various commands. Part of 1.30, backported to
-    # openSUSE, Fedora and ChromeOS.
-    # https://src.fedoraproject.org/rpms/libmbim/blob/rawhide/f/libmbim.spec
-    (fetchpatch {
-      url = "https://cgit.freedesktop.org/libmbim/libmbim/patch/?id=8a6dec6ed11931601e605c9537da9904b3be5bc0";
-      hash = "sha256-tU4zkUl5aZJE+g/qbnWprUHe/PmZvqVKB9qecSaUBhk=";
-    })
-  ];
-
   mesonFlags = [
     "-Dudevdir=${placeholder "out"}/lib/udev"
     (lib.mesonBool "introspection" withIntrospection)
diff --git a/pkgs/development/libraries/libplacebo/5.nix b/pkgs/development/libraries/libplacebo/5.nix
new file mode 100644
index 000000000000..f307a869e940
--- /dev/null
+++ b/pkgs/development/libraries/libplacebo/5.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, python3Packages
+, vulkan-headers
+, vulkan-loader
+, shaderc
+, lcms2
+, libGL
+, libX11
+, libunwind
+, libdovi
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libplacebo";
+  version = "5.264.1";
+
+  src = fetchFromGitLab {
+    domain = "code.videolan.org";
+    owner = "videolan";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-YEefuEfJURi5/wswQKskA/J1UGzessQQkBpltJ0Spq8=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    vulkan-headers
+    python3Packages.jinja2
+    python3Packages.glad2
+  ];
+
+  buildInputs = [
+    vulkan-loader
+    shaderc
+    lcms2
+    libGL
+    libX11
+    libunwind
+    libdovi
+  ];
+
+  mesonFlags = with lib; [
+    (mesonOption "vulkan-registry" "${vulkan-headers}/share/vulkan/registry/vk.xml")
+    (mesonBool "demos" false) # Don't build and install the demo programs
+    (mesonEnable "d3d11" false) # Disable the Direct3D 11 based renderer
+    (mesonEnable "glslang" false) # rely on shaderc for GLSL compilation instead
+  ] ++ optionals stdenv.isDarwin [
+    (mesonEnable "unwind" false) # libplacebo doesn’t build with `darwin.libunwind`
+  ];
+
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace 'python_env.append' '#'
+  '';
+
+  meta = with lib; {
+    description = "Reusable library for GPU-accelerated video/image rendering primitives";
+    longDescription = ''
+      Reusable library for GPU-accelerated image/view processing primitives and
+      shaders, as well a batteries-included, extensible, high-quality rendering
+      pipeline (similar to mpv's vo_gpu). Supports Vulkan, OpenGL and Metal (via
+      MoltenVK).
+    '';
+    homepage = "https://code.videolan.org/videolan/libplacebo";
+    changelog = "https://code.videolan.org/videolan/libplacebo/-/tags/v${version}";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ primeos tadeokondrak ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/libplacebo/default.nix b/pkgs/development/libraries/libplacebo/default.nix
index 60a3f8989578..c303ffb29558 100644
--- a/pkgs/development/libraries/libplacebo/default.nix
+++ b/pkgs/development/libraries/libplacebo/default.nix
@@ -10,21 +10,22 @@
 , shaderc
 , lcms2
 , libGL
-, xorg
+, libX11
 , libunwind
 , libdovi
+, xxHash
 }:
 
 stdenv.mkDerivation rec {
   pname = "libplacebo";
-  version = "5.264.1";
+  version = "6.338.1";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YEefuEfJURi5/wswQKskA/J1UGzessQQkBpltJ0Spq8=";
+    hash = "sha256-NZmwR3+lIC2PF+k+kqCjoMYkMM/PKOJmDwAq7t6YONY=";
   };
 
   nativeBuildInputs = [
@@ -41,18 +42,19 @@ stdenv.mkDerivation rec {
     shaderc
     lcms2
     libGL
-    xorg.libX11
+    libX11
     libunwind
     libdovi
+    xxHash
   ];
 
-  mesonFlags = [
-    "-Dvulkan-registry=${vulkan-headers}/share/vulkan/registry/vk.xml"
-    "-Ddemos=false" # Don't build and install the demo programs
-    "-Dd3d11=disabled" # Disable the Direct3D 11 based renderer
-    "-Dglslang=disabled" # rely on shaderc for GLSL compilation instead
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-Dunwind=disabled" # libplacebo doesn’t build with `darwin.libunwind`
+  mesonFlags = with lib; [
+    (mesonOption "vulkan-registry" "${vulkan-headers}/share/vulkan/registry/vk.xml")
+    (mesonBool "demos" false) # Don't build and install the demo programs
+    (mesonEnable "d3d11" false) # Disable the Direct3D 11 based renderer
+    (mesonEnable "glslang" false) # rely on shaderc for GLSL compilation instead
+  ] ++ optionals stdenv.isDarwin [
+    (mesonEnable "unwind" false) # libplacebo doesn’t build with `darwin.libunwind`
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 6f7583d563b1..58fadd30ee8d 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.32.4";
+  version = "1.34.0";
 
   outputs = [ "out" "dev" ]
     ++ lib.optional withIntrospection "devdoc";
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libqmi";
     rev = version;
-    hash = "sha256-cczGvoD+2+G6uiAt0Iv1BO4/FqzO9bkqhFsEwOfp7qw=";
+    hash = "sha256-l9ev9ZOWicVNZ/Wj//KNd3NHcefIrLVriqJhEpwWvtQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libraw/default.nix b/pkgs/development/libraries/libraw/default.nix
index b03be435aac5..d8e9f1f5a2f5 100644
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , lcms2
 , pkg-config
@@ -16,23 +15,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libraw";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "LibRaw";
     repo = "LibRaw";
     rev = version;
-    sha256 = "sha256-K9mULf6V/TCl5Vu4iuIdSGF9HzQlgNQLRFHIpNbmAlY";
+    hash = "sha256-p9CmOCulvV7+KKn1lXwpcysOo0+mD5UgPqy2ki0cIFE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-1729.patch";
-      url = "https://github.com/LibRaw/LibRaw/commit/9ab70f6dca19229cb5caad7cc31af4e7501bac93.patch";
-      hash = "sha256-OAyqphxvtSM15NI77HwtGTmTmP9YNu3xhZ6D1CceJ7I=";
-    })
-  ];
-
   outputs = [ "out" "lib" "dev" "doc" ];
 
   propagatedBuildInputs = [ lcms2 ];
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 6f05307381a0..7330e42ff323 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -1,22 +1,16 @@
-{ stdenv, lib, fetchurl, fetchpatch, autoreconfHook, xz, buildPackages }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, xz, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
-  version = "1.6.2";
+  version = "1.7.2";
 
-  src = fetchurl {
-    url = "mirror://savannah/libunwind/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SmrsZmmR+0XQiJxErt6K1usQgHHDVU/N/2cfnJR5SXY=";
+  src = fetchFromGitHub {
+    owner = "libunwind";
+    repo = "libunwind";
+    rev = "v${version}";
+    hash = "sha256-z5YCue0zadQnMEbGFniFvDjXNy6dSHQDQnXRXS6Uh/Y=";
   };
 
-  patches = [
-    # Fix for aarch64 and non-4K pages. Remove once upgraded past 1.6.2.
-    (fetchpatch {
-      url = "https://github.com/libunwind/libunwind/commit/e85b65cec757ef589f28957d0c6c21c498a03bdf.patch";
-      sha256 = "1lnlygvhqrdrjgw303pg2k2k4ms4gaghpjsgmhk47q83vy1yjwfg";
-    })
-  ];
-
   postPatch = if (stdenv.cc.isClang || stdenv.hostPlatform.isStatic) then ''
     substituteInPlace configure.ac --replace "-lgcc_s" ""
   '' else lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -46,7 +40,7 @@ stdenv.mkDerivation rec {
     description = "A portable and efficient API to determine the call-chain of a program";
     maintainers = with maintainers; [ orivej ];
     # https://github.com/libunwind/libunwind#libunwind
-    platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd13" "i686-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "x86_64-freebsd13" "x86_64-linux" "x86_64-solaris" ];
+    platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd13" "i686-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "loongarch64-linux" "x86_64-freebsd13" "x86_64-linux" "x86_64-solaris" ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/development/libraries/libxmlb/default.nix b/pkgs/development/libraries/libxmlb/default.nix
index 391874e531d7..522d3546b8e0 100644
--- a/pkgs/development/libraries/libxmlb/default.nix
+++ b/pkgs/development/libraries/libxmlb/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libxmlb";
-  version = "0.3.14";
+  version = "0.3.15";
 
   outputs = [ "out" "lib" "dev" "devdoc" "installedTests" ];
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "libxmlb";
     rev = version;
-    hash = "sha256-lpVXl/n/ecDLbbLQg9T+o4GdGZM7pNXGYTyVogNCl2E=";
+    hash = "sha256-S0wBVhfRa81mAmqpYYAKAyKLnfnVsXJEcGA21i5tdzo=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index dbca7f7fc2b7..95ecbbc44dee 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -60,6 +60,8 @@ stdenv.mkDerivation rec {
     "--without-crypto"
   ];
 
+  enableParallelBuilding = true;
+
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
     moveToOutput lib/xsltConf.sh "$dev"
diff --git a/pkgs/development/libraries/libzip/default.nix b/pkgs/development/libraries/libzip/default.nix
index 14e2f4480824..b34318476033 100644
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , cmake
+, fetchpatch2
 , fetchurl
 , perl
 , zlib
@@ -24,6 +25,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-lmmuXf46xbOJdTbchGaodMjPLA47H90I11snOIQpk2M=";
   };
 
+  patches = [
+    # https://github.com/nih-at/libzip/issues/404
+    (fetchpatch2 {
+      name = "Check-for-zstd_TARGET-before-using-it-in-a-regex.patch";
+      url = "https://github.com/nih-at/libzip/commit/c719428916b4d19e838f873b1a177b126a080d61.patch";
+      hash = "sha256-4ksbXEM8kNvs3wtbIaXLEQNSKaxl0es/sIg0EINaTHE=";
+    })
+  ];
+
   outputs = [ "out" "dev" "man" ];
 
   nativeBuildInputs = [ cmake perl groff ];
diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index 1a135fa6d4a8..6d45ca33e982 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "2.5.8";
+  version = "2.5.10";
 
   outputs = [ "bin" "dev" "out" "doc" ];
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "sha256-N7XdDaDsYdx4TXvHplQDTvhHNUmW5rntdaTKua4C0es=";
+    hash = "sha256-xdC+T79ZQBx/XhuIXtP93Roj0N9lF+E65ReEKQ4kIsg=";
   };
 
   patches = [
@@ -36,8 +36,7 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-DrpldpNgN5pWKzIuuPIrynGX3EpP8YhJlu+lLfNFGxQ=";
     })
 
-    # Backport gcc-13 fix:
-    #   https://github.com/AcademySoftwareFoundation/openexr/pull/1264
+    # GCC 13 fixes
     ./gcc-13.patch
   ];
 
diff --git a/pkgs/development/libraries/openexr/gcc-13.patch b/pkgs/development/libraries/openexr/gcc-13.patch
index d508b6028f76..6264a8df2433 100644
--- a/pkgs/development/libraries/openexr/gcc-13.patch
+++ b/pkgs/development/libraries/openexr/gcc-13.patch
@@ -1,33 +1,25 @@
-https://github.com/AcademySoftwareFoundation/openexr/pull/1264
-https://github.com/AcademySoftwareFoundation/openexr/commit/d0088a3c6943a9a53fc24e29885414d082d531fe.patch
+From 8aa103fe6e815514990e59708468eabc36f7f332 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=A9clairevoyant?=
+ <848000+eclairevoyant@users.noreply.github.com>
+Date: Fri, 5 Jan 2024 18:12:16 -0500
+Subject: [PATCH] gcc13
 
---- a/OpenEXR/IlmImf/ImfDwaCompressor.cpp
-+++ b/OpenEXR/IlmImf/ImfDwaCompressor.cpp
-@@ -159,6 +159,7 @@
- #include <limits>
- 
- #include <cstddef>
-+#include <cstdint>
- 
- 
- // Windows specific addition to prevent the indirect import of the redefined min/max macros
---- a/OpenEXR/IlmImf/ImfHuf.cpp
-+++ b/OpenEXR/IlmImf/ImfHuf.cpp
-@@ -53,6 +53,7 @@
- #include <cstring>
- #include <cassert>
- #include <algorithm>
-+#include <cstdint>
- 
- 
- using namespace std;
---- a/OpenEXR/IlmImf/ImfMisc.cpp
-+++ b/OpenEXR/IlmImf/ImfMisc.cpp
-@@ -52,6 +52,7 @@
- #include <ImfConvert.h>
- #include <ImfPartType.h>
+---
+ OpenEXR/IlmImf/ImfTiledMisc.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/OpenEXR/IlmImf/ImfTiledMisc.cpp b/OpenEXR/IlmImf/ImfTiledMisc.cpp
+index 06ea3144..749537d4 100644
+--- a/OpenEXR/IlmImf/ImfTiledMisc.cpp
++++ b/OpenEXR/IlmImf/ImfTiledMisc.cpp
+@@ -46,6 +46,7 @@
  #include <ImfTileDescription.h>
+ #include <algorithm>
+ #include <limits>
 +#include <cstdint>
+ 
  #include "ImfNamespace.h"
  
- OPENEXR_IMF_INTERNAL_NAMESPACE_SOURCE_ENTER
+-- 
+2.42.0
+
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index fa5cb97b214f..0d1e3b03a09a 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -81,7 +81,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "1.0.0";
+    version = "1.0.1";
 
     outputs = [
       "out"
@@ -97,7 +97,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-mfnMluxJAxDbB6JlIM6HJ0zg7e1q3ia3uFbht6zeHCk=";
+      sha256 = "sha256-rvf0sZRgDDLcqroLg7hcMUqXD/4JT+3lBRX6/m+3Ry8=";
     };
 
     patches = [
diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index 76ec2244c833..121bb03f4cac 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchurl
+, meson
+, ninja
 , pkg-config
 , libpng
 , glib /*just passthru*/
@@ -12,41 +14,57 @@
 , tigervnc
 , wlroots
 , xwayland
+
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "pixman";
-  version = "0.42.2";
+  version = "0.43.0";
 
   src = fetchurl {
     urls = [
       "mirror://xorg/individual/lib/${pname}-${version}.tar.gz"
       "https://cairographics.org/releases/${pname}-${version}.tar.gz"
     ];
-    hash = "sha256-6hSA762i/ZSLx1Nm98NJ4cltMpfQmj/mJibjjiNKYl4=";
+    hash = "sha256-plwoIJhY+xa+5Q2AnID5Co5BXA5P2DIQeKGCJ4WlVgo=";
   };
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [ libpng ];
 
-  configureFlags = lib.optional stdenv.isAarch32 "--disable-arm-iwmmxt"
-    # Disable until https://gitlab.freedesktop.org/pixman/pixman/-/issues/46 is resolved
-    ++ lib.optional (stdenv.isAarch64 && !stdenv.cc.isGNU) "--disable-arm-a64-neon";
+  # Default "enabled" value attempts to enable CPU features on all
+  # architectures and requires used to disable them:
+  #   https://gitlab.freedesktop.org/pixman/pixman/-/issues/88
+  mesonAutoFeatures = "auto";
+  mesonFlags = [
+    "-Diwmmxt=disabled"
+  ]
+  # Disable until https://gitlab.freedesktop.org/pixman/pixman/-/issues/46 is resolved
+  ++ lib.optional (stdenv.isAarch64 && !stdenv.cc.isGNU) "-Da64-neon=disabled";
 
   preConfigure = ''
     # https://gitlab.freedesktop.org/pixman/pixman/-/issues/62
     export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 184 ? 184 : NIX_BUILD_CORES))
   '';
 
+  enableParallelBuilding = true;
+
   doCheck = true;
 
   postInstall = glib.flattenInclude;
 
-  passthru.tests = {
-    inherit cairo qemu scribus tigervnc wlroots xwayland;
+  passthru = {
+    tests = {
+      inherit cairo qemu scribus tigervnc wlroots xwayland;
+    };
+    updateScript = gitUpdater {
+      url = "https://gitlab.freedesktop.org/pixman/pixman.git";
+      rev-prefix = "pixman-";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/qrencode/default.nix b/pkgs/development/libraries/qrencode/default.nix
index a0e23813ade2..83c20fcd5120 100644
--- a/pkgs/development/libraries/qrencode/default.nix
+++ b/pkgs/development/libraries/qrencode/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, SDL2, libpng, libiconv, libobjc }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: rec {
   pname = "qrencode";
   version = "4.1.1";
 
@@ -16,13 +16,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ libiconv libpng ]
     ++ lib.optionals stdenv.isDarwin [ libobjc ];
 
-  configureFlags = [
-    "--with-tests"
-  ];
-
   nativeCheckInputs = [ SDL2 ];
 
-  doCheck = true;
+  doCheck = false;
 
   checkPhase = ''
     runHook preCheck
@@ -34,6 +30,11 @@ stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
+  passthru.tests = finalAttrs.finalPackage.overrideAttrs (_: {
+    configureFlags = [ "--with-tests" ];
+    doCheck = true;
+  });
+
   meta = with lib; {
     homepage = "https://fukuchi.org/works/qrencode/";
     description = "C library for encoding data in a QR Code symbol";
@@ -47,4 +48,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     mainProgram = "qrencode";
   };
-}
+})
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 7a5ff60c9acb..b0e92290fe5b 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -51,6 +51,8 @@ let
       ./qtdeclarative.patch
       # prevent headaches from stale qmlcache data
       ./qtdeclarative-default-disable-qmlcache.patch
+      # add version specific QML import path
+      ./qtdeclarative-qml-paths.patch
     ];
     qtlocation = lib.optionals stdenv.cc.isClang [
       # Fix build with Clang 16
diff --git a/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
new file mode 100644
index 000000000000..2ea3554df7d2
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
@@ -0,0 +1,33 @@
+diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
+index 289f11d006..80c422403c 100644
+--- a/src/qml/qml/qqmlimport.cpp
++++ b/src/qml/qml/qqmlimport.cpp
+@@ -1897,17 +1897,22 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+     addImportPath(installImportsPath);
+ 
+     // env import paths
+-    if (Q_UNLIKELY(!qEnvironmentVariableIsEmpty("QML2_IMPORT_PATH"))) {
+-        const QString envImportPath = qEnvironmentVariable("QML2_IMPORT_PATH");
++    auto addEnvImportPath = [this](const char *var) {
+ #if defined(Q_OS_WIN)
+         QLatin1Char pathSep(';');
+ #else
+         QLatin1Char pathSep(':');
+ #endif
+-        QStringList paths = envImportPath.split(pathSep, Qt::SkipEmptyParts);
+-        for (int ii = paths.count() - 1; ii >= 0; --ii)
+-            addImportPath(paths.at(ii));
+-    }
++        if (Q_UNLIKELY(!qEnvironmentVariableIsEmpty(var))) {
++            const QString envImportPath = qEnvironmentVariable(var);
++            QStringList paths = envImportPath.split(pathSep, Qt::SkipEmptyParts);
++            for (int ii = paths.count() - 1; ii >= 0; --ii)
++                addImportPath(paths.at(ii));
++        }
++    };
++
++    addEnvImportPath("NIXPKGS_QT5_QML_IMPORT_PATH");
++    addEnvImportPath("QML2_IMPORT_PATH");
+ 
+     addImportPath(QStringLiteral("qrc:/qt-project.org/imports"));
+     addImportPath(QCoreApplication::applicationDirPath());
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index 2127be5e0a2a..94df0a1a8e66 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -31,7 +31,7 @@ qtHostPathHook() {
     local qmlDir="$1/${qtQmlPrefix:?}"
     if [ -d "$qmlDir" ]
     then
-        qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
+        qtWrapperArgs+=(--prefix NIXPKGS_QT5_QML_IMPORT_PATH : "$qmlDir")
     fi
 }
 addEnvHooks "$targetOffset" qtHostPathHook
diff --git a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
index 8b135a7d7492..2d858055693c 100644
--- a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
@@ -31,7 +31,7 @@ if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
 
         local qmlDir="$1/${qtQmlPrefix:?}"
         if [ -d "$qmlDir" ]; then
-            qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
+            qtWrapperArgs+=(--prefix NIXPKGS_QT6_QML_IMPORT_PATH : "$qmlDir")
         fi
     }
     addEnvHooks "$targetOffset" qtHostPathHook
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
index afdb24d1d291..697556e30edc 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
@@ -12,5 +12,7 @@ qtModule {
   patches = [
     # prevent headaches from stale qmlcache data
     ../patches/qtdeclarative-default-disable-qmlcache.patch
+    # add version specific QML import path
+    ../patches/qtdeclarative-qml-paths.patch
   ];
 }
diff --git a/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch b/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
new file mode 100644
index 000000000000..7c6694eb48a3
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
@@ -0,0 +1,12 @@
+diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
+index a7d1a3f77f..aac7392d4f 100644
+--- a/src/qml/qml/qqmlimport.cpp
++++ b/src/qml/qml/qqmlimport.cpp
+@@ -1515,6 +1515,7 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+     };
+ 
+     // env import paths
++    addEnvImportPath("NIXPKGS_QT6_QML_IMPORT_PATH");
+     addEnvImportPath("QML_IMPORT_PATH");
+     addEnvImportPath("QML2_IMPORT_PATH");
+ 
diff --git a/pkgs/development/libraries/rapidfuzz-cpp/default.nix b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
index 8375d55e4056..2668025bcbe1 100644
--- a/pkgs/development/libraries/rapidfuzz-cpp/default.nix
+++ b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "2.2.3";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "maxbachmann";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yEDihPvTGGL5gsd4QMYNRyfLucKLItIQM4pm6W0i2W8=";
+    hash = "sha256-N9yGOxlk1+wgRXWLbDIXWQz+/pwbnYVs3ub4/16Nzws=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/readline/readline-8.2-patches.nix b/pkgs/development/libraries/readline/readline-8.2-patches.nix
index bc075df237c7..77d5c495bac1 100644
--- a/pkgs/development/libraries/readline/readline-8.2-patches.nix
+++ b/pkgs/development/libraries/readline/readline-8.2-patches.nix
@@ -8,4 +8,7 @@ patch: [
 (patch "005" "16ac25jz1a1mgkpfp1sydqf6qpsfh0s0dcmrnjpqbhg5va3s6av2")
 (patch "006" "18gmh6y3klh0vv28cyqz4is3rlb32pl7f1kf5r482kfjq3w5zd67")
 (patch "007" "1xmnpahs983n4w0gn3j0wr8nh1dpva33yj7fvfmhm46ph2wsa4ar")
+(patch "008" "0smjjzhwxi2ibpdisnk53lh1pzgka6rhlqyh3662xy69v34ysxx1")
+(patch "009" "05m1fwbs7mbs3pz3pg87gbbayandrrcgaqawzliqb6g1jbk8b61x")
+(patch "010" "0k3vyrjs2g6y2cfs03l2gp37fhxgqpiwvxb1c7z4q88cbb32x3km")
 ]
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index 3bf16057f835..595ba2aa5713 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "liblapack";
-  version = "3.11";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "Reference-LAPACK";
     repo = "lapack";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-AYD78u70y8cY19hmM/aDjQEzxO8u9lPWhCFxRe5cqXI=";
+    sha256 = "sha256-xn9HL4YF8JPka1gwet5bGGo2k505H3RfWpxkUIYNecQ=";
   };
 
   nativeBuildInputs = [ gfortran cmake ];
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 3e18424d6b74..64362243229b 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-uOnSTih14bUPtrJgp7vVb3/UfdKsF6jFQqjlFeJ81AI=";
+    hash = "sha256-/I9dJlBE0kvFvqooKuqMETtOE72Jmva3zIGnq0o4+aE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index 5ba8039ccff8..be81970413b8 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "srt";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${version}";
-    sha256 = "sha256-HW5l26k9w4F6IJrtiahU/8/CPY6M/cKn8AgESsntC6A=";
+    sha256 = "sha256-HmfbBPyR+z5d9/XBvNhosk8pSSPToNtM+V0hEyb2G2w=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index f6c9dcb953e3..dc17404c8480 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-CDjWTXXnUgj9QaLDNuSVy+wf8If5LehwOZ0t0Fuh2Ro=";
+    hash = "sha256-kBOkj7mr4stPXUCBhNJpNL3A+9BebEwrIBEIroxdH8Y=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/development/libraries/vulkan-headers/update.sh b/pkgs/development/libraries/vulkan-headers/update.sh
index da4e42ded84a..dd3fac2ee4dd 100755
--- a/pkgs/development/libraries/vulkan-headers/update.sh
+++ b/pkgs/development/libraries/vulkan-headers/update.sh
@@ -11,6 +11,7 @@ SDK_PACKAGES=(
     "vulkan-tools-lunarg"
     "vulkan-extension-layer"
     "vulkan-utility-libraries"
+    "vulkan-volk"
     "spirv-headers"
     "spirv-cross"
     "spirv-tools"
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 068c1d3d2c2a..958cc2dadc7b 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-TDn8eVz1fhGfvUiGcxqOk2BN9tuIF5+ssIXtOo3weS0=";
+    hash = "sha256-53PUXAWiK38ciV6oMvD7ZHdXi4RU4r0RmDWUUHU3mE0=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/vulkan-utility-libraries/default.nix b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
index 41d1854692fd..301311e12412 100644
--- a/pkgs/development/libraries/vulkan-utility-libraries/default.nix
+++ b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.3.268";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-l6PiHCre/JQg8PSs1k/0Zzfwwv55AqVdZtBbjeKLS6E=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-gvia+Xb9BpOjPARKo3Sgp85Bfh1roFZ2PzCtXVFYeIU=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/libraries/vulkan-volk/default.nix b/pkgs/development/libraries/vulkan-volk/default.nix
new file mode 100644
index 000000000000..1164fd2921e2
--- /dev/null
+++ b/pkgs/development/libraries/vulkan-volk/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, cmake, vulkan-headers }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "volk";
+  version = "1.3.275.0";
+
+  src = fetchFromGitHub {
+    owner = "zeux";
+    repo = "volk";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-uTjLgJMGN8nOVhVIl/GNhO2jXe9ebhc9vzAwCDwfuf4=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ vulkan-headers ];
+
+  cmakeFlags = ["-DVOLK_INSTALL=1"];
+
+  meta = with lib; {
+    description = " Meta loader for Vulkan API";
+    homepage = "https://github.com/zeux/volk";
+    platforms = platforms.all;
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+  };
+})
diff --git a/pkgs/development/libraries/zxing-cpp/default.nix b/pkgs/development/libraries/zxing-cpp/default.nix
index 1c010638693e..cd5d10551192 100644
--- a/pkgs/development/libraries/zxing-cpp/default.nix
+++ b/pkgs/development/libraries/zxing-cpp/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zxing-cpp";
-  version = "2.1.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "zxing-cpp";
     repo = "zxing-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-B/jGsHImRfj0iEio2b6R6laWBI1LL3OI407O7sren8s=";
+    hash = "sha256-teFspdATn9M7Z1vSr/7PdJx/xAv+TVai8rIekxqpBZk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/acme/default.nix b/pkgs/development/python-modules/acme/default.nix
index 538b8dff964a..65e930e07414 100644
--- a/pkgs/development/python-modules/acme/default.nix
+++ b/pkgs/development/python-modules/acme/default.nix
@@ -3,7 +3,7 @@
 , cryptography
 , pyasn1
 , pyopenssl
-, pyRFC3339
+, pyrfc3339
 , josepy
 , pytz
 , requests
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   format = "setuptools";
 
   propagatedBuildInputs = [
-    cryptography pyasn1 pyopenssl pyRFC3339 pytz requests requests-toolbelt six
+    cryptography pyasn1 pyopenssl pyrfc3339 pytz requests requests-toolbelt six
     werkzeug ndg-httpsclient josepy
   ];
 
diff --git a/pkgs/development/python-modules/awslambdaric/default.nix b/pkgs/development/python-modules/awslambdaric/default.nix
index 3e20875ac15d..788148d5e441 100644
--- a/pkgs/development/python-modules/awslambdaric/default.nix
+++ b/pkgs/development/python-modules/awslambdaric/default.nix
@@ -5,7 +5,7 @@
 , fetchpatch
 , isPy27
 , pytestCheckHook
-, autoconf
+, autoconf271
 , automake
 , cmake
 , gcc
@@ -44,7 +44,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ simplejson ];
 
-  nativeBuildInputs = [ autoconf automake cmake libtool perl setuptools ];
+  nativeBuildInputs = [ autoconf271 automake cmake libtool perl setuptools ];
 
   buildInputs = [ gcc ];
 
diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index 621a0f991856..0689319840e6 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -10,7 +10,7 @@
 , distro
 , josepy
 , parsedatetime
-, pyRFC3339
+, pyrfc3339
 , pyopenssl
 , pytz
 , requests
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     distro
     josepy
     parsedatetime
-    pyRFC3339
+    pyrfc3339
     pyopenssl
     pytz
     requests
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index db66e46f3d9d..e07ab3c0d953 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ lib.concatLists (lib.attrVals ([
     "woff"
-    "interpolatable"
+    # "interpolatable" is not included because it only contains 2 tests at the time of writing but adds 270 extra dependencies
     "ufo"
   ] ++ lib.optionals (!skia-pathops.meta.broken) [
     "pathops" # broken
diff --git a/pkgs/development/python-modules/img2pdf/default.nix b/pkgs/development/python-modules/img2pdf/default.nix
index 1a69525d8438..2dc389f70ecc 100644
--- a/pkgs/development/python-modules/img2pdf/default.nix
+++ b/pkgs/development/python-modules/img2pdf/default.nix
@@ -12,7 +12,7 @@
 , exiftool
 , ghostscript
 , imagemagick
-, mupdf
+, mupdf-headless
 , netpbm
 , numpy
 , poppler_utils
@@ -74,7 +74,7 @@ buildPythonPackage rec {
     exiftool
     ghostscript
     imagemagick
-    mupdf
+    mupdf-headless
     netpbm
     numpy
     poppler_utils
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index 1b154f90d386..1c260e37c7b0 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -9,79 +9,83 @@
 , pytestCheckHook
 , sphinxHook
 , pallets-sphinx-themes
+, setuptools
 , sphinxcontrib-log-cabinet
 , sphinx-issues
 }:
 
 buildPythonPackage rec {
-  pname = "Jinja2";
-  version = "3.1.2";
+  pname = "jinja2";
+  version = "3.1.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-MTUacCpAip51laj8YVD8P0O7a/fjGXcMvA2535Q36FI=";
+    pname = "Jinja2";
+    inherit version;
+    hash = "sha256-rIvWVE1Lssl5K/OhWegLuo/afwfoG8Ou1WVDLVklupA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    babel
     markupsafe
   ];
 
+  passthru.optional-dependencies = {
+    i18n = [
+      babel
+    ];
+  };
+
   # Multiple tests run out of stack space on 32bit systems with python2.
   # See https://github.com/pallets/jinja/issues/1158
   doCheck = !stdenv.is32bit;
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
+  ] ++ passthru.optional-dependencies.i18n;
 
-  pytestFlagsArray = [
-    # Avoid failure due to deprecation warning
-    # Fixed in https://github.com/python/cpython/pull/28153
-    # Remove after cpython 3.9.8
-    "-p no:warnings"
-  ];
+  passthru.doc = stdenv.mkDerivation {
+    # Forge look and feel of multi-output derivation as best as we can.
+    #
+    # Using 'outputs = [ "doc" ];' breaks a lot of assumptions.
+    name = "${pname}-${version}-doc";
+    inherit src pname version;
 
-  passthru = {
-    doc = stdenv.mkDerivation {
-      # Forge look and feel of multi-output derivation as best as we can.
-      #
-      # Using 'outputs = [ "doc" ];' breaks a lot of assumptions.
-      name = "${pname}-${version}-doc";
-      inherit src pname version;
+    patches = [
+      # Fix import of "sphinxcontrib-log-cabinet"
+      ./patches/import-order.patch
+    ];
 
-      patches = [
-        # Fix import of "sphinxcontrib-log-cabinet"
-        ./patches/import-order.patch
-      ];
+    postInstallSphinx = ''
+      mv $out/share/doc/* $out/share/doc/python$pythonVersion-$pname-$version
+    '';
 
-      postInstallSphinx = ''
-        mv $out/share/doc/* $out/share/doc/python$pythonVersion-$pname-$version
-      '';
+    nativeBuildInputs = [
+      sphinxHook
+      sphinxcontrib-log-cabinet
+      pallets-sphinx-themes
+      sphinx-issues
+    ];
 
-      nativeBuildInputs = [
-        sphinxHook
-        sphinxcontrib-log-cabinet
-        pallets-sphinx-themes
-        sphinx-issues
-      ];
-
-      inherit (python) pythonVersion;
-      inherit meta;
-    };
+    inherit (python) pythonVersion;
+    inherit meta;
   };
 
   meta = with lib; {
-    homepage = "https://jinja.palletsprojects.com/";
-    description = "Stand-alone template engine";
+    changelog = "https://github.com/pallets/jinja/blob/${version}/CHANGES.rst";
+    description = "Very fast and expressive template engine";
+    downloadPage = "https://github.com/pallets/jinja";
+    homepage = "https://jinja.palletsprojects.com";
     license = licenses.bsd3;
     longDescription = ''
       Jinja is a fast, expressive, extensible templating engine. Special
       placeholders in the template allow writing code similar to Python
       syntax. Then the template is passed data to render the final document.
-      an optional sandboxed environment.
     '';
     maintainers = with maintainers; [ pierron ];
   };
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 1100d1bdbc99..8fb5c7c292cf 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -6,10 +6,8 @@
 , isPyPy
 , pythonOlder
 
-# https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst
 # build-system
 , certifi
-, oldest-supported-numpy
 , pkg-config
 , pybind11
 , setuptools
@@ -109,19 +107,11 @@ buildPythonPackage rec {
       substituteInPlace src/_c_internal_utils.c \
         --replace libX11.so.6 ${libX11}/lib/libX11.so.6 \
         --replace libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
-    '' +
-    # bring our own system libraries
-    # https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst#c-libraries
-    ''
-      echo "[libs]
-      system_freetype=true
-      system_qhull=true" > mplsetup.cfg
     '';
 
   nativeBuildInputs = [
     certifi
     numpy
-    oldest-supported-numpy # TODO remove after updating to 3.8.0
     pkg-config
     pybind11
     setuptools
@@ -184,16 +174,17 @@ buildPythonPackage rec {
     libs = {
       system_freetype = true;
       system_qhull = true;
-    } // lib.optionalAttrs stdenv.isDarwin {
       # LTO not working in darwin stdenv, see #19312
-      enable_lto = false;
+      enable_lto = !stdenv.isDarwin;
     };
   };
 
   env.MPLSETUPCFG = writeText "mplsetup.cfg" (lib.generators.toINI {} passthru.config);
 
-  # Matplotlib needs to be built against a specific version of freetype in
-  # order for all of the tests to pass.
+  # Encountering a ModuleNotFoundError, as describved and investigated at:
+  # https://github.com/NixOS/nixpkgs/issues/255262 . It could be that some of
+  # which may fail due to a freetype version that doesn't match the freetype
+  # version used by upstream.
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 1104bcc02f82..9b4e1d0287eb 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -25,15 +25,14 @@
 , tqdm
 , typing-extensions
 , unpaper
-, wheel
 , installShellFiles
 }:
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "15.4.4";
+  version = "16.0.4";
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   pyproject = true;
 
@@ -47,7 +46,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-Ff0OrSJFglVPpSNB0KvDMnatj+P57zWdcVAFaM+Sg0s=";
+    hash = "sha256-1Bg1R8c5VtJsd8NHd+WWdJRA39Jjgv9JUMcijZm942o=";
   };
 
   patches = [
@@ -64,7 +63,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools
     setuptools-scm
-    wheel
     installShellFiles
   ];
 
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 4ba20f5aef31..386f64718eb0 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -7,7 +7,7 @@
 , jbig2dec
 , deprecated
 , lxml
-, mupdf
+, mupdf-headless
 , numpy
 , packaging
 , pillow
@@ -20,12 +20,11 @@
 , qpdf
 , setuptools
 , substituteAll
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.9.0";
+  version = "8.11.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,14 +39,14 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-ia+D0OeB/MQWRniYkBEWZsDCwEApYGgu0++I/HupK6w=";
+    hash = "sha256-mxUXXD7/ERC6mfmLLo+zdsVblIplrlcnzTNQ7YUk3Q4=";
   };
 
   patches = [
     (substituteAll {
       src = ./paths.patch;
-      jbig2dec = "${lib.getBin jbig2dec}/bin/jbig2dec";
-      mudraw = "${lib.getBin mupdf}/bin/mudraw";
+      jbig2dec = lib.getExe' jbig2dec "jbig2dec";
+      mutool = lib.getExe' mupdf-headless "mutool";
     })
   ];
 
@@ -63,7 +62,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     pybind11
     setuptools
-    wheel
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pikepdf/paths.patch b/pkgs/development/python-modules/pikepdf/paths.patch
index c9c61176aa6f..1bd030c186c2 100644
--- a/pkgs/development/python-modules/pikepdf/paths.patch
+++ b/pkgs/development/python-modules/pikepdf/paths.patch
@@ -1,18 +1,18 @@
 diff --git a/src/pikepdf/_methods.py b/src/pikepdf/_methods.py
-index d27c660..6796984 100644
+index da40043f..4f566f01 100644
 --- a/src/pikepdf/_methods.py
 +++ b/src/pikepdf/_methods.py
-@@ -72,7 +72,7 @@ def _mudraw(buffer, fmt) -> bytes:
+@@ -74,7 +74,7 @@ def _mudraw(buffer, fmt) -> bytes:
          tmp_in.flush()
  
          proc = run(
--            ['mudraw', '-F', fmt, '-o', '-', tmp_in.name],
-+            ['@mudraw@', '-F', fmt, '-o', '-', tmp_in.name],
+-            ['mutool', 'draw', '-F', fmt, '-o', '-', tmp_in.name],
++            ['@mutool@', 'draw', '-F', fmt, '-o', '-', tmp_in.name],
              capture_output=True,
              check=True,
          )
 diff --git a/src/pikepdf/jbig2.py b/src/pikepdf/jbig2.py
-index f89b4f9..f187ebd 100644
+index f89b4f90..f187ebdf 100644
 --- a/src/pikepdf/jbig2.py
 +++ b/src/pikepdf/jbig2.py
 @@ -63,7 +63,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 4b37a0765f0e..444d673100bb 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -10,14 +10,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.19.0";
+  version = "3.19.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Legrandin";
     repo = "pycryptodome";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WD+OEjePVtqlmn7h1CIfraLuEQlodkvjmYQ8q7nNoGU=";
+    hash = "sha256-+m0gF47l3c9gZ9dLdOUNW0I2W1O+OGrmsdysu7QdjvI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 29c4a2034b2f..80a9458e32c6 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -70,6 +70,7 @@ buildPythonPackage rec {
     # https://github.com/pycurl/pycurl/issues/819
     "test_multi_socket_select"
     # https://github.com/pycurl/pycurl/issues/729
+    "test_easy_pause_unpause"
     "test_multi_socket_action"
     # https://github.com/pycurl/pycurl/issues/822
     "test_request_with_verifypeer"
diff --git a/pkgs/development/python-modules/pymemcache/default.nix b/pkgs/development/python-modules/pymemcache/default.nix
index 68925fe7f4a9..74784a35ff95 100644
--- a/pkgs/development/python-modules/pymemcache/default.nix
+++ b/pkgs/development/python-modules/pymemcache/default.nix
@@ -5,6 +5,7 @@
 , mock
 , six
 , pytestCheckHook
+, python-memcached
 , pythonOlder
 , zstd
 , stdenv
@@ -32,6 +33,7 @@ buildPythonPackage rec {
     faker
     mock
     pytestCheckHook
+    python-memcached
     zstd
   ];
 
@@ -39,10 +41,7 @@ buildPythonPackage rec {
     sed -i "/--cov/d" setup.cfg
   '';
 
-  disabledTests = [
-    # python-memcached is not available (last release in 2017)
-    "TestClientSocketConnect"
-  ] ++ lib.optionals stdenv.is32bit [
+  disabledTests = lib.optionals stdenv.is32bit [
     # test_compressed_complex is broken on 32-bit platforms
     # this can be removed on the next version bump
     # see also https://github.com/pinterest/pymemcache/pull/480
diff --git a/pkgs/development/python-modules/pyrfc3339/default.nix b/pkgs/development/python-modules/pyrfc3339/default.nix
index 9345b819f75c..368f3cda24de 100644
--- a/pkgs/development/python-modules/pyrfc3339/default.nix
+++ b/pkgs/development/python-modules/pyrfc3339/default.nix
@@ -14,12 +14,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "pyRFC3339";
+  pname = "pyrfc3339";
   version = "1.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "pyRFC3339";
+    inherit version;
     sha256 = "06jv7ar7lpvvk0dixzwdr3wgm0g1lipxs429s2z7knwwa7hwpf41";
   };
 
diff --git a/pkgs/development/python-modules/python-memcached/default.nix b/pkgs/development/python-modules/python-memcached/default.nix
index 27a9eed537bb..e82b6b51643a 100644
--- a/pkgs/development/python-modules/python-memcached/default.nix
+++ b/pkgs/development/python-modules/python-memcached/default.nix
@@ -1,25 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, six
+, setuptools
 , mock
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "python-memcached";
-  version = "1.59";
-  format = "setuptools";
+  version = "1.61";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "linsomniac";
     repo = "python-memcached";
     rev = version;
-    hash = "sha256-tHqkwNloPTXOrEGtuDLu1cTw4SKJ4auv8UUbqdNp698=";
+    hash = "sha256-7bUCVAmOJ6znVmTZg9AJokOuym07NHL12gZgQ2uhfNo=";
   };
 
-  propagatedBuildInputs = [
-    six
+  nativeBuildInputs = [
+    setuptools
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pythran/default.nix b/pkgs/development/python-modules/pythran/default.nix
index 047a4ea1af07..1851eb3bbf23 100644
--- a/pkgs/development/python-modules/pythran/default.nix
+++ b/pkgs/development/python-modules/pythran/default.nix
@@ -25,14 +25,14 @@ let
 
 in buildPythonPackage rec {
   pname = "pythran";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "serge-sans-paille";
     repo = "pythran";
     rev = version;
-    hash = "sha256-in0ty0aBAIx7Is13hjiHZGS8eKbhxb6TL3bENzfx5vQ=";
+    hash = "sha256-TpD8YZnnv48PKYrUqR0/qvJG1XRbcMBcrkcERh6Q4q0=";
   };
 
   patches = [
@@ -41,17 +41,12 @@ in buildPythonPackage rec {
       src = ./0001-hardcode-path-to-libgomp.patch;
       gomp = "${if stdenv.cc.isClang then openmp else stdenv.cc.cc.lib}/lib/libgomp${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
-    (fetchpatch {
-      # Python 3.12 support
-      url = "https://github.com/serge-sans-paille/pythran/commit/258ab9aaf26172f669eab1bf2a346b5f65db3ac0.patch";
-      hash = "sha256-T+FLptDYIgzHBSXShULqHr/G8ttBFamq1M5JlB2HxDM=";
-    })
   ];
 
   # xsimd: unvendor this header-only C++ lib
   postPatch = ''
-    rm -r third_party/xsimd
-    ln -s '${lib.getDev xsimd}'/include/xsimd third_party/
+    rm -r pythran/xsimd
+    ln -s '${lib.getDev xsimd}'/include/xsimd pythran/
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 97f2a09e55e2..a7c816b4a33f 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.5.2";
+  version = "3.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D7Z0xKqAJAPKSAEK+3Mpz/LaEKqKYczp+m6SqfzufwA=";
+    hash = "sha256-OO8ztnildJ8nmI1crGW4FfA8uKVo7MZPlDguEatOzyA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix b/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
index 3945f8bf4c4f..327ff267eebc 100644
--- a/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
@@ -2,12 +2,13 @@
 , buildPythonPackage
 , fetchPypi
 , pbr
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-apidoc";
   version = "0.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -19,8 +20,9 @@ buildPythonPackage rec {
     rm test-requirements.txt requirements.txt
   '';
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
     pbr
+    setuptools
   ];
 
   # Check is disabled due to circular dependency of sphinx
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 05d1bfbf64e6..d3f66b570019 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.5.3";
-  source.sha256 = "sha256-JJzQdaxPM1rnD3iMm+D0wYgJOk2n0FvVO+K67z8l58s=";
+  version = "2.5.4";
+  source.sha256 = "sha256-97nwjEfoxmVhOmaKobYz32P4GLmRg87kt5dwSoFu3v4=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index 7ae9168975ab..409c2c9d027b 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -34,7 +34,7 @@ lib.makeOverridable (
 , stdenv ? ruby.stdenv
 , namePrefix ? (let
     rubyName = builtins.parseDrvName ruby.name;
-  in "${rubyName.name}${rubyName.version}-")
+  in "${rubyName.name}${lib.versions.majorMinor rubyName.version}-")
 , nativeBuildInputs ? []
 , buildInputs ? []
 , meta ? {}
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index 3b1a1fa0aa1f..ddf27b35dbd0 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -8,18 +8,18 @@
 , qt5
 , CoreServices
 , libiconv
-, withSqlite ? true, sqlite
+, sqlite
 }:
 
 stdenv.mkDerivation rec {
   pname = "doxygen";
-  version = "1.9.8";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "doxygen";
     repo = "doxygen";
     rev = "Release_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-uQ1Fl2kmY7qmzy34NOmZCgPxVGwmqRqDvV6yEab5P4w=";
+    sha256 = "sha256-FPI5ICdn9Tne/g9SP6jAQS813AAyoDNooDR/Hyvq6R4=";
   };
 
   nativeBuildInputs = [
@@ -29,14 +29,14 @@ stdenv.mkDerivation rec {
     bison
   ];
 
-  buildInputs = [ libiconv ]
-    ++ lib.optionals withSqlite [ sqlite ]
+  buildInputs = [ libiconv sqlite ]
     ++ lib.optionals (qt5 != null) (with qt5; [ qtbase wrapQtAppsHook ])
     ++ lib.optionals stdenv.isDarwin [ CoreServices ];
 
-  cmakeFlags = [ "-DICONV_INCLUDE_DIR=${libiconv}/include" ]
-    ++ lib.optional withSqlite "-Duse_sqlite3=ON"
-    ++ lib.optional (qt5 != null) "-Dbuild_wizard=YES";
+  cmakeFlags = [
+    "-DICONV_INCLUDE_DIR=${libiconv}/include"
+    "-Duse_sys_sqlite3=ON"
+  ] ++ lib.optional (qt5 != null) "-Dbuild_wizard=YES";
 
   env.NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
diff --git a/pkgs/development/tools/gocode/default.nix b/pkgs/development/tools/gocode/default.nix
deleted file mode 100644
index 687b69cf2027..000000000000
--- a/pkgs/development/tools/gocode/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
-
-buildGoPackage rec {
-  pname = "gocode-unstable";
-  version = "2020-04-06";
-  rev = "4acdcbdea79de6b3dee1c637eca5cbea0fdbe37c";
-
-  goPackagePath = "github.com/mdempsky/gocode";
-
-  # we must allow references to the original `go` package,
-  # because `gocode` needs to dig into $GOROOT to provide completions for the
-  # standard packages.
-  allowGoReference = true;
-
-  src = fetchFromGitHub {
-    inherit rev;
-
-    owner = "mdempsky";
-    repo = "gocode";
-    sha256 = "0i1hc089gb6a4mcgg56vn5l0q96wrlza2n08l4349s3dc2j559fb";
-  };
-
-  goDeps = ./deps.nix;
-
-  meta = with lib; {
-    description = "An autocompletion daemon for the Go programming language";
-    longDescription = ''
-      Gocode is a helper tool which is intended to be integrated with your
-      source code editor, like vim, neovim and emacs. It provides several
-      advanced capabilities, which currently includes:
-
-        - Context-sensitive autocompletion
-
-      It is called daemon, because it uses client/server architecture for
-      caching purposes. In particular, it makes autocompletions very fast.
-      Typical autocompletion time with warm cache is 30ms, which is barely
-      noticeable.
-    '';
-    homepage = "https://github.com/mdempsky/gocode";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kalbasit ];
-  };
-}
diff --git a/pkgs/development/tools/gocode/deps.nix b/pkgs/development/tools/gocode/deps.nix
deleted file mode 100644
index b2518109171a..000000000000
--- a/pkgs/development/tools/gocode/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "72e4a01eba4315301fd9ce00c8c2f492580ded8a";
-      sha256 = "0a8c7j4w784w441j3j3bh640vy1g6g214641qv485wyi0xj49anf";
-    };
-  }
-]
diff --git a/pkgs/development/tools/gofumpt/default.nix b/pkgs/development/tools/gofumpt/default.nix
index 6becc6f4002d..36e38163e2a7 100644
--- a/pkgs/development/tools/gofumpt/default.nix
+++ b/pkgs/development/tools/gofumpt/default.nix
@@ -21,7 +21,11 @@ buildGoModule rec {
 
   CGO_ENABLED = "0";
 
-  ldflags = "-s -w -X main.version=v${version}";
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
 
   checkFlags = [
     # Requires network access (Error: module lookup disabled by GOPROXY=off).
diff --git a/pkgs/development/tools/kind/default.nix b/pkgs/development/tools/kind/default.nix
index 63f6fff66b62..1f58fd637a6d 100644
--- a/pkgs/development/tools/kind/default.nix
+++ b/pkgs/development/tools/kind/default.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   CGO_ENABLED = 0;
   GOFLAGS = [ "-trimpath" ];
-  ldflags = [ "-buildid=" "-w" ];
+  ldflags = [ "-w" ];
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/autoconf/2.71.nix b/pkgs/development/tools/misc/autoconf/2.71.nix
new file mode 100644
index 000000000000..1fcb819bd4b7
--- /dev/null
+++ b/pkgs/development/tools/misc/autoconf/2.71.nix
@@ -0,0 +1,69 @@
+{ lib, stdenv, fetchurl, m4, perl, texinfo }:
+
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
+stdenv.mkDerivation rec {
+  pname = "autoconf";
+  version = "2.71";
+  outputs = [ "out" "doc" ];
+
+  src = fetchurl {
+    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
+    sha256 = "197sl23irn6s9pd54rxj5vcp5y8dv65jb9yfqgr2g56cxg7q6k7i";
+  };
+  patches = [
+    # fix stale autom4te cache race condition:
+    #  https://savannah.gnu.org/support/index.php?110521
+    ./2.71-fix-race.patch
+  ];
+
+  strictDeps = true;
+  nativeBuildInputs = [ m4 perl texinfo ];
+  buildInputs = [ m4 ];
+  postBuild = "
+    make html
+  ";
+
+  postInstall = "
+    make install-html
+  ";
+
+  # Work around a known issue in Cygwin.  See
+  # http://thread.gmane.org/gmane.comp.sysutils.autoconf.bugs/6822 for
+  # details.
+  # There are many test failures on `i386-pc-solaris2.11'.
+  doCheck = ((!stdenv.isCygwin) && (!stdenv.isSunOS));
+
+  # Don't fixup "#! /bin/sh" in Autoconf, otherwise it will use the
+  # "fixed" path in generated files!
+  dontPatchShebangs = true;
+
+  enableParallelBuilding = true;
+
+  # Make the Autotest test suite run in parallel.
+  preCheck =''
+    export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
+  '';
+
+  meta = {
+    homepage = "https://www.gnu.org/software/autoconf/";
+    description = "Part of the GNU Build System";
+
+    longDescription = ''
+      GNU Autoconf is an extensible package of M4 macros that produce
+      shell scripts to automatically configure software source code
+      packages.  These scripts can adapt the packages to many kinds of
+      UNIX-like systems without manual user intervention.  Autoconf
+      creates a configuration script for a package from a template
+      file that lists the operating system features that the package
+      can use, in the form of M4 macro calls.
+    '';
+
+    license = lib.licenses.gpl3Plus;
+
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix
index 1fcb819bd4b7..8039e36a4f20 100644
--- a/pkgs/development/tools/misc/autoconf/default.nix
+++ b/pkgs/development/tools/misc/autoconf/default.nix
@@ -7,18 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "autoconf";
-  version = "2.71";
+  version = "2.72";
   outputs = [ "out" "doc" ];
 
   src = fetchurl {
     url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
-    sha256 = "197sl23irn6s9pd54rxj5vcp5y8dv65jb9yfqgr2g56cxg7q6k7i";
+    hash = "sha256-uohcExlXjWyU1G6bDc60AUyq/iSQ5Deg28o/JwoiP1o=";
   };
-  patches = [
-    # fix stale autom4te cache race condition:
-    #  https://savannah.gnu.org/support/index.php?110521
-    ./2.71-fix-race.patch
-  ];
 
   strictDeps = true;
   nativeBuildInputs = [ m4 perl texinfo ];
diff --git a/pkgs/development/tools/misc/lttng-ust/default.nix b/pkgs/development/tools/misc/lttng-ust/default.nix
index 0c19b59c5c35..b1fb9c83e8d0 100644
--- a/pkgs/development/tools/misc/lttng-ust/default.nix
+++ b/pkgs/development/tools/misc/lttng-ust/default.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "2.13.6";
-  sha256 = "sha256-5+BFlt1zrHqpnifNAA+UnbsP7VG9KQmfmwiiXB3wztU=";
+  version = "2.13.7";
+  sha256 = "sha256-X7TxfDB8jBt5xoVh6JvpVi0H50Jb9A5yjE1mdVNCpes=";
 }
diff --git a/pkgs/development/tools/misc/ycmd/default.nix b/pkgs/development/tools/misc/ycmd/default.nix
index aeca3c437ff4..ae741234a8e2 100644
--- a/pkgs/development/tools/misc/ycmd/default.nix
+++ b/pkgs/development/tools/misc/ycmd/default.nix
@@ -1,5 +1,4 @@
 { stdenv, lib, fetchFromGitHub, cmake, ninja, python
-, withGocode ? true, gocode
 , withGodef ? true, godef
 , withGotools? true, gotools
 , withTypescript ? true, typescript
@@ -63,10 +62,6 @@ stdenv.mkDerivation {
     mkdir -p $out/lib/ycmd/third_party
     cp -r third_party/* $out/lib/ycmd/third_party/
 
-  '' + lib.optionalString withGocode ''
-    TARGET=$out/lib/ycmd/third_party/gocode
-    mkdir -p $TARGET
-    ln -sf ${gocode}/bin/gocode $TARGET
   '' + lib.optionalString withGodef ''
     TARGET=$out/lib/ycmd/third_party/godef
     mkdir -p $TARGET
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 37cec14ee4c4..fa17f4f03624 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-MVmu9m+9XhWuPBEEoaYmsSbMFziSZaM5Gg5kOr1DT54=";
+    hash = "sha256-mD/7wWeclV5Xqii9hcZMustvR6tf7MoyTZ3WsvEc61U=";
   };
 
-  cargoHash = "sha256-hrdrGFtL2vGczINnvDa4rclkXsNWnEqtTt3NVaRay8w=";
+  cargoHash = "sha256-w8XpCJ8GS2VszW/9/O2suy82zVO1UpWTrU1lFGYwhvw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 8827d6b709e7..648b2615166c 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-Bned5Pa6zCFByfNvqD0M5t3l4uAJYkDlpe6wu8e7a3U=";
+    hash = "sha256-RzGvoDt1Qc+f6mZsfs99MxX4YB3yFc5FP92Yx/WGrsI=";
   };
 
   # The cmake options are sufficient for turning on static building, but not
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 09a11cef84f4..1d0a39fb2b8b 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-DwkSUclStYKe54tC1H3jMv1KOSScgqf25tR5ajQZ6os=";
+    hash = "sha256-hJx8gn0zCN3+DhO6niylZJXPHgQ+VhQV5tL8qAeRaUg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 5868c5d9a990..d1a75dcdf7e5 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -8,8 +8,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.10.0";
-  sha256 = "sha256-MuslbuvYys1VdOZjHlS0K+fsjr4lrUeoymhUA7rRVTU=";
+  version = "20.11.0";
+  sha256 = "sha256-MYB+vu6wScU/F2XkqVrtaUdqS2lt0QDLU5q2aNeVC0A=";
   patches = [
     ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
deleted file mode 100644
index d864f30096d7..000000000000
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ /dev/null
@@ -1,164 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, fetchpatch
-, alsa-lib
-, dbus
-, ell
-, glib
-, json_c
-, libical
-, docutils
-, pkg-config
-, python3
-, readline
-, systemdMinimal
-, udev
-, withExperimental ? false
-}: let
-  pythonPath = with python3.pkgs; [
-    dbus-python
-    pygobject3
-    recursivePthLoader
-  ];
-in stdenv.mkDerivation rec {
-  pname = "bluez";
-  version = "5.70";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-N+Ny6RaVXhRMuIL4iOS+QImPEK47fCE93N1V7pwAkng=";
-  };
-
-  patches = [
-    # replace use of a non-standard symbol to fix build with musl libc (pkgsMusl.bluez)
-    (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/main/bluez/max-input.patch?id=32b31b484cb13009bd8081c4106e4cf064ec2f1f";
-      sha256 = "sha256-SczbXtsxBkCO+izH8XOBcrJEO2f7MdtYVT3+2fCV8wU=";
-    })
-    # Fix device pairing regression
-    # FIXME: remove in next release
-    (fetchpatch {
-      url = "https://github.com/bluez/bluez/commit/3a9c637010f8dc1ba3e8382abe01065761d4f5bb.patch";
-      hash = "sha256-UUmYMHnxYrw663nEEC2mv3zj5e0omkLNejmmPUtgS3c=";
-    })
-    # CVE-2023-45866 / https://github.com/skysafe/reblog/tree/main/cve-2023-45866
-    (fetchpatch {
-      name = "CVE-2023-45866.patch";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675";
-      sha256 = "sha256-IuPQ18yN0EO/PkqdT/JETyOxdZCKewBiDjGN4CG2GLo=";
-    })
-  ];
-
-  buildInputs = [
-    alsa-lib
-    dbus
-    ell
-    glib
-    json_c
-    libical
-    python3
-    readline
-    udev
-  ];
-
-  nativeBuildInputs = [
-    docutils
-    pkg-config
-    python3.pkgs.wrapPython
-  ];
-
-  outputs = [ "out" "dev" "test" ];
-
-  postPatch = ''
-    substituteInPlace tools/hid2hci.rules \
-      --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
-      --replace "hid2hci " "$out/lib/udev/hid2hci "
-    # Disable some tests:
-    # - test-mesh-crypto depends on the following kernel settings:
-    #   CONFIG_CRYPTO_[USER|USER_API|USER_API_AEAD|USER_API_HASH|AES|CCM|AEAD|CMAC]
-    if [[ ! -f unit/test-mesh-crypto.c ]]; then echo "unit/test-mesh-crypto.c no longer exists"; false; fi
-    echo 'int main() { return 77; }' > unit/test-mesh-crypto.c
-  '';
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--enable-library"
-    "--enable-cups"
-    "--enable-pie"
-    "--enable-external-ell"
-    "--with-dbusconfdir=${placeholder "out"}/share"
-    "--with-dbussystembusdir=${placeholder "out"}/share/dbus-1/system-services"
-    "--with-dbussessionbusdir=${placeholder "out"}/share/dbus-1/services"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/etc/systemd/user"
-    "--with-udevdir=${placeholder "out"}/lib/udev"
-    "--enable-health"
-    "--enable-mesh"
-    "--enable-midi"
-    "--enable-nfc"
-    "--enable-sixaxis"
-    "--enable-btpclient"
-    "--enable-hid2hci"
-    "--enable-logger"
-
-    # To provide ciptool, sdptool, and rfcomm (unmaintained)
-    # superseded by new D-Bus APIs
-    "--enable-deprecated"
-  ] ++ lib.optional withExperimental "--enable-experimental";
-
-
-  # Work around `make install' trying to create /var/lib/bluetooth.
-  installFlags = [ "statedir=$(TMPDIR)/var/lib/bluetooth" ];
-
-  makeFlags = [ "rulesdir=${placeholder "out"}/lib/udev/rules.d" ];
-
-  doCheck = stdenv.hostPlatform.isx86_64;
-
-  postInstall = ''
-    mkdir -p $test/{bin,test}
-    cp -a test $test
-    pushd $test/test
-    for a in \
-            simple-agent \
-            test-adapter \
-            test-device \
-            test-thermometer \
-            list-devices \
-            monitor-bluetooth \
-            ; do
-      ln -s ../test/$a $test/bin/bluez-$a
-    done
-    popd
-    wrapPythonProgramsIn $test/test "$test/test ${toString pythonPath}"
-  '' + ''
-    # for bluez4 compatibility for NixOS
-    mkdir $out/sbin
-    ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
-    ln -s ../libexec/bluetooth/obexd $out/sbin/obexd
-
-    # Add extra configuration
-    mkdir $out/etc/bluetooth
-    ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf
-
-    # https://github.com/NixOS/nixpkgs/issues/204418
-    ln -s /etc/bluetooth/input.conf $out/etc/bluetooth/input.conf
-    ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
-
-    # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
-    for files in `find tools/ -type f -perm -755`; do
-      filename=$(basename $files)
-      install -Dm755 tools/$filename $out/bin/$filename
-    done
-    install -Dm755 attrib/gatttool $out/bin/gatttool
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "Bluetooth support for Linux";
-    homepage = "http://www.bluez.org/";
-    license = with licenses; [ gpl2 lgpl21 ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 83dd82e6ab26..a705a9fb5d38 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.377-2";
+  version = "0.378";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-Nh+EIsJ/98NnflndQeSgiV2iOC0icTEfgwAySPbG6Lo=";
+    hash = "sha256-YCx0b4crg8A7mGXwqk1XQZKsm/3TUE8C2bOYKnb/FSA=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2aacb88dc87e..c8ac88c11528 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -381,6 +381,16 @@ let
       DRM_VC4_HDMI_CEC = yes;
     };
 
+    # Enables Rust support in the Linux kernel. This is currently not enabled by default, because it occasionally requires
+    # patching the Linux kernel for the specific Rust toolchain in nixpkgs. These patches usually take a bit
+    # of time to appear and this would hold up Linux kernel and Rust toolchain updates.
+    #
+    # Once Rust in the kernel has more users, we can reconsider enabling it by default.
+    rust = optionalAttrs ((features.rust or false) && versionAtLeast version "6.7") {
+      RUST = yes;
+      GCC_PLUGINS = no;
+    };
+
     sound = {
       SND_DYNAMIC_MINORS  = yes;
       SND_AC97_POWER_SAVE = yes; # AC97 Power-Saving Mode
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index df67005dd816..7fc90ace2624 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -9,6 +9,9 @@
 , pahole
 , lib
 , stdenv
+, rustc
+, rustPlatform
+, rust-bindgen
 
 , # The kernel source tarball.
   src
@@ -117,6 +120,8 @@ let
         map ({extraConfig ? "", ...}: extraConfig) kernelPatches;
     in lib.concatStringsSep "\n" ([baseConfigStr] ++ configFromPatches);
 
+  withRust = ((configfile.moduleStructuredConfig.settings.RUST or {}).tristate or null) == "y";
+
   configfile = stdenv.mkDerivation {
     inherit ignoreConfigErrors autoModules preferBuiltin kernelArch extraMakeFlags;
     pname = "linux-config";
@@ -130,7 +135,11 @@ let
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     nativeBuildInputs = [ perl gmp libmpc mpfr ]
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ lib.optional (lib.versionAtLeast version "5.2") pahole;
+      ++ lib.optional (lib.versionAtLeast version "5.2") pahole
+      ++ lib.optionals withRust [ rust-bindgen rustc ]
+    ;
+
+    RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
 
     platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
@@ -202,7 +211,7 @@ let
     inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile;
     pos = builtins.unsafeGetAttrPos "version" args;
 
-    config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
+    config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; } // lib.optionalAttrs withRust { CONFIG_RUST = "y"; };
   } // lib.optionalAttrs (modDirVersion != null) { inherit modDirVersion; });
 
   passthru = basicArgs // {
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 2ba31fbc9789..baf0231f13e1 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
 , libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
 , fetchpatch
+, rustc, rust-bindgen, rustPlatform
 }:
 
 let
@@ -56,15 +57,6 @@ let
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
-  # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [
-    pahole
-    perl
-    libelf
-    # module makefiles often run uname commands to find out the kernel version
-    (buildPackages.deterministic-uname.override { inherit modDirVersion; })
-  ] ++ optional (lib.versionAtLeast version "5.13") zstd;
-
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
     let
       config = let attrName = attr: "CONFIG_" + attr; in {
@@ -84,14 +76,27 @@ let
       } // config_;
 
       isModular = config.isYes "MODULES";
+      withRust = config.isYes "RUST";
 
       buildDTBs = kernelConf.DTB or false;
 
+      # Dependencies that are required to build kernel modules
+      moduleBuildDependencies = [
+        pahole
+        perl
+        libelf
+        # module makefiles often run uname commands to find out the kernel version
+        (buildPackages.deterministic-uname.override { inherit modDirVersion; })
+      ]
+      ++ optional (lib.versionAtLeast version "5.13") zstd
+      ++ optionals withRust [ rustc rust-bindgen ]
+      ;
+
     in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
       passthru = rec {
         inherit version modDirVersion config kernelPatches configfile
           moduleBuildDependencies stdenv;
-        inherit isZen isHardened isLibre;
+        inherit isZen isHardened isLibre withRust;
         isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
         baseVersion = lib.head (lib.splitString "-rc" version);
         kernelOlder = lib.versionOlder baseVersion;
@@ -100,6 +105,16 @@ let
 
       inherit src;
 
+      depsBuildBuild = [ buildPackages.stdenv.cc ];
+      nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
+                          ++ optional  (lib.versionOlder version "5.8") libelf
+                          ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+                          ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
+                          ++ optional  (lib.versionAtLeast version "5.8")  elfutils
+                          ++ optionals withRust [ rustc rust-bindgen ];
+
+      RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
+
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
@@ -363,14 +378,6 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
 
   enableParallelBuilding = true;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
-      ++ optional  (lib.versionOlder version "5.8") libelf
-      ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
-      ++ optional  (lib.versionAtLeast version "5.8")  elfutils
-      ;
-
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
   # Absolute paths for compilers avoid any PATH-clobbering issues.
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 0f60a8655ced..59aa5bbc0e5d 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
-    sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
+    sha256 = "sha256-aFgdOzjnVTy29t33gTsfyZ5ShW8hQh97R3zlq9JgWoo=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index b2f6b0aa8a23..fa0a2cc8a600 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.22";
-  hash = "sha256-TFppI70aznzgRHRgioSTfOBTupGxrOnwsAFyaOcy3Hw=";
+  version = "2.03.23";
+  hash = "sha256-dOeUqene4bz4ogZfZbkZbET98yHiLWO5jtfejJqhel0=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 7b9cc10be167..97f1eb3a1771 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -103,8 +103,8 @@ stdenv.mkDerivation rec {
     }))
     # Musl fix from Alpine
     ./fix-stdio-usage.patch
-  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
-    ./no-shared.patch
+    # https://gitlab.com/lvmteam/lvm2/-/merge_requests/8
+    ./fix-static.patch
   ];
 
   doCheck = false; # requires root
diff --git a/pkgs/os-specific/linux/lvm2/fix-static.patch b/pkgs/os-specific/linux/lvm2/fix-static.patch
new file mode 100644
index 000000000000..89192744adec
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/fix-static.patch
@@ -0,0 +1,28 @@
+From 0cbe7f0adc86c92c61156c417b27b063f156b31b Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Tue, 2 Jan 2024 18:15:20 +0100
+Subject: [PATCH] makefiles: fix disabling shared link
+
+LIB_SHARED still gets set when shared linking has been disabled, so
+the previous version of this check still attempted to build the
+shared library.
+---
+ libdm/make.tmpl.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
+index 2dd9625d4d..69ba2c35ab 100644
+--- a/libdm/make.tmpl.in
++++ b/libdm/make.tmpl.in
+@@ -436,7 +436,7 @@ DEFS+=-D_FILE_OFFSET_BITS=64
+ 	@echo "    [CC] $(<F)"
+ 	$(Q) $(CC) -c $(CFLAGS) $(CLDFLAGS) $< $(LIBS) -o $@
+ 
+-ifneq (,$(LIB_SHARED))
++ifeq ("@SHARED_LINK@", "yes")
+ 
+ TARGETS += $(LIB_SHARED).$(LIB_VERSION)
+ $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
+-- 
+GitLab
+
diff --git a/pkgs/os-specific/linux/lvm2/no-shared.patch b/pkgs/os-specific/linux/lvm2/no-shared.patch
deleted file mode 100644
index 23a82a0fa294..000000000000
--- a/pkgs/os-specific/linux/lvm2/no-shared.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff --git a/libdm/Makefile.in b/libdm/Makefile.in
-index 2758648e6..f305a12b0 100644
---- a/libdm/Makefile.in
-+++ b/libdm/Makefile.in
-@@ -47,7 +47,6 @@ endif
- 
- LIB_SHARED = $(interface)/libdevmapper.$(LIB_SUFFIX)
- LIB_VERSION = $(LIB_VERSION_DM)
--TARGETS = libdevmapper.$(LIB_SUFFIX) libdevmapper.$(LIB_SUFFIX).$(LIB_VERSION) .symver_check
- 
- CFLOW_LIST = $(SOURCES)
- CFLOW_LIST_TARGET = libdevmapper.cflow
-diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
-index a731687c2..9366cdf1c 100644
---- a/libdm/make.tmpl.in
-+++ b/libdm/make.tmpl.in
-@@ -314,7 +314,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
- SUBDIRS.clean := $(SUBDIRS:=.clean)
- SUBDIRS.distclean := $(SUBDIRS:=.distclean)
- 
--TARGETS += $(LIB_SHARED) $(LIB_STATIC)
-+TARGETS += $(LIB_STATIC)
- 
- all: $(SUBDIRS) $(TARGETS)
- 
-@@ -431,7 +431,6 @@ DEFS+=-D_FILE_OFFSET_BITS=64
- 
- ifneq (,$(LIB_SHARED))
- 
--TARGETS += $(LIB_SHARED).$(LIB_VERSION)
- $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
- 	@echo "    [CC] $@"
- ifeq ("@LIB_SUFFIX@","so")
-diff --git a/make.tmpl.in b/make.tmpl.in
-index b73176f5a..6100d0dfd 100644
---- a/make.tmpl.in
-+++ b/make.tmpl.in
-@@ -368,7 +368,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
- SUBDIRS.clean := $(SUBDIRS:=.clean)
- SUBDIRS.distclean := $(SUBDIRS:=.distclean)
- 
--TARGETS += $(LIB_SHARED) $(LIB_STATIC)
-+TARGETS += $(LIB_STATIC)
- 
- INTERNAL_LIBS = \
- 	$(top_builddir)/libdaemon/client/libdaemonclient.a \
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 10864df2597b..241f33f1e00a 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchurl {
-    url    = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    sha256 = "sha256-5OxxMakdpEUSV0Jo9JPG2MoQXIcJFpG46bVspoXU+U0=";
+    url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
+    hash = "sha256-esS1D+7gBKn6iPHf0tL6c4qCiWdjBQzXc7PFSwqBgoM=";
   };
 
   patches = [
@@ -57,6 +57,9 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--includedir=${placeholder "out"}/include/security"
     "--enable-sconfigdir=/etc/security"
+    # The module is deprecated. We re-enable it explicitly until NixOS
+    # module stops using it.
+    "--enable-lastlog"
   ];
 
   installFlags = [
diff --git a/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
new file mode 100644
index 000000000000..fd6b85a4dbd6
--- /dev/null
+++ b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub, kernel }:
+kernel.stdenv.mkDerivation {
+  name = "rust-out-of-tree-module";
+
+  src = fetchFromGitHub {
+    owner = "Rust-for-linux";
+    repo = "rust-out-of-tree-module";
+
+    rev = "7addf9dafba795524f6179a557f7272ecbe1b165";
+    hash = "sha256-Bj7WonZ499W/FajbxjM7yBkU9iTxTW7CrRbCSzWbsSc=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = {
+    broken = !kernel.withRust;
+    description = "A basic template for an out-of-tree Linux kernel module written in Rust";
+    homepage = "https://github.com/Rust-for-Linux/rust-out-of-tree-module";
+    license = lib.licenses.gpl2Only;
+    maintainers = [ lib.maintainers.blitz ];
+    platforms = lib.platforms.linux;
+  };
+
+}
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index 104a9dad959a..b08026278edb 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,10 +13,10 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index c0defc31de..8f80235731 100644
+index 0d68f31d36..6b52f7ed4b 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
-@@ -20,10 +20,6 @@ SUBSYSTEM=="block", TAG+="systemd"
+@@ -22,10 +22,6 @@ SUBSYSTEM=="block", TAG+="systemd"
  SUBSYSTEM=="block", ENV{DM_SUSPENDED}=="1", IMPORT{db}="SYSTEMD_READY", GOTO="systemd_end"
  SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
  
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index dda8524c498d..8507bb583c8a 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -14,10 +14,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index 4ffec25c75..b99031c54e 100644
+index 55e76b6e16..015a608035 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -43,6 +43,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -66,6 +66,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -27,7 +27,7 @@ index 4ffec25c75..b99031c54e 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 1586c2e214..fcae95f824 100644
+index 1a9b99d761..04ef9af1ea 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
 @@ -170,8 +170,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 2d86d1e6957a..535ca3d86457 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index e170958fc5..898a674631 100644
+index 38196ef3d6..57d1750b00 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5648,6 +5648,7 @@ static int run(int argc, char *argv[]) {
+@@ -5602,6 +5602,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index e170958fc5..898a674631 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5662,6 +5663,7 @@ static int run(int argc, char *argv[]) {
+@@ -5618,6 +5619,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index c905a4d812af..d2232765f71d 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -11,12 +11,12 @@ Also, remove /usr and /lib as these don't exist on NixOS.
 
 Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
 ---
- src/basic/path-lookup.c | 17 ++---------------
+ src/basic/path-lookup.c | 18 ++----------------
  src/core/systemd.pc.in  |  8 ++++----
- 2 files changed, 6 insertions(+), 19 deletions(-)
+ 2 files changed, 6 insertions(+), 20 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 7d158a8295..f9bd62b631 100644
+index 4e3d59fc56..0d18b9a2d0 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
@@ -31,7 +31,7 @@ index 7d158a8295..f9bd62b631 100644
          NULL
  };
  
-@@ -617,15 +613,13 @@ int lookup_paths_init(
+@@ -613,16 +609,13 @@ int lookup_paths_init(
                                          persistent_config,
                                          SYSTEM_CONFIG_UNIT_DIR,
                                          "/etc/systemd/system",
@@ -44,11 +44,12 @@ index 7d158a8295..f9bd62b631 100644
 -                                        "/usr/local/lib/systemd/system",
                                          SYSTEM_DATA_UNIT_DIR,
 -                                        "/usr/lib/systemd/system",
+-                                        /* To be used ONLY for images which might be legacy split-usr */
 -                                        STRV_IFNOTNULL(flags & LOOKUP_PATHS_SPLIT_USR ? "/lib/systemd/system" : NULL),
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -641,14 +635,11 @@ int lookup_paths_init(
+@@ -638,14 +631,11 @@ int lookup_paths_init(
                                          persistent_config,
                                          USER_CONFIG_UNIT_DIR,
                                          "/etc/systemd/user",
@@ -64,7 +65,7 @@ index 7d158a8295..f9bd62b631 100644
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -808,7 +799,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+@@ -805,7 +795,6 @@ char **generator_binary_paths(RuntimeScope scope) {
                  case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-generators",
                                         "/etc/systemd/system-generators",
@@ -72,7 +73,7 @@ index 7d158a8295..f9bd62b631 100644
                                         SYSTEM_GENERATOR_DIR);
                          break;
  
-@@ -816,7 +806,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+@@ -813,7 +802,6 @@ char **generator_binary_paths(RuntimeScope scope) {
                  case RUNTIME_SCOPE_USER:
                          add = strv_new("/run/systemd/user-generators",
                                         "/etc/systemd/user-generators",
@@ -80,7 +81,7 @@ index 7d158a8295..f9bd62b631 100644
                                         USER_GENERATOR_DIR);
                          break;
  
-@@ -855,14 +844,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
+@@ -852,14 +840,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
                  case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-environment-generators",
                                          "/etc/systemd/system-environment-generators",
@@ -96,10 +97,10 @@ index 7d158a8295..f9bd62b631 100644
                          break;
  
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 693433b34b..5932a21b5b 100644
+index f3b85b0190..8ae544b495 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
-@@ -38,10 +38,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
+@@ -43,10 +43,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
  systemd_user_conf_dir=${sysconfdir}/systemd/user
  systemduserconfdir=${systemd_user_conf_dir}
  
@@ -111,8 +112,8 @@ index 693433b34b..5932a21b5b 100644
 +systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
  systemduserunitpath=${systemd_user_unit_path}
  
- systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
-@@ -50,10 +50,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
+ systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
+@@ -55,10 +55,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
  systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
  systemdusergeneratordir=${systemd_user_generator_dir}
  
@@ -124,4 +125,4 @@ index 693433b34b..5932a21b5b 100644
 +systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:${systemd_user_generator_dir}
  systemdusergeneratorpath=${systemd_user_generator_path}
  
- systemd_sleep_dir=${root_prefix}/lib/systemd/system-sleep
+ systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index 0a80d5ac4e83..a0bcc6afaa12 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 22ec6e79b1..771e8e7f16 100644
+index e61ebee253..22cc5cc843 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1559,7 +1559,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1562,7 +1562,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index abc6c24dbf51..b350e36bc5c2 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,7 +11,7 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 9ef45f8e75..99b1ec2e36 100644
+index e1d53f2395..a224e6dadc 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
 @@ -1053,6 +1053,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
@@ -35,7 +35,7 @@ index 9ef45f8e75..99b1ec2e36 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index f544a73580..ce00c262cc 100644
+index 5d96237fae..9af35cd29c 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
 @@ -229,6 +229,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
@@ -69,10 +69,10 @@ index f544a73580..ce00c262cc 100644
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index ad1d492d6b..331af34505 100644
+index c7be30f563..50f8aa8675 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -659,6 +659,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index ad1d492d6b..331af34505 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -743,6 +747,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -737,6 +741,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index ad1d492d6b..331af34505 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -923,6 +930,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -917,6 +924,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
similarity index 86%
rename from pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
rename to pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 3150d97be2e1..30178675f7f9 100644
--- a/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 1db630003a..31744c3e68 100644
+index f9014dc560..3ee0363369 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1350,7 +1350,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1412,7 +1412,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 1db630003a..31744c3e68 100644
          if (!f)
                  return -errno;
  
-@@ -1391,7 +1391,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1453,7 +1453,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 1db630003a..31744c3e68 100644
          if (!f)
                  return -errno;
  
-@@ -1503,7 +1503,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1565,7 +1565,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 1db630003a..31744c3e68 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1563,7 +1563,7 @@ int get_timezone(char **ret) {
+@@ -1625,7 +1625,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -75,10 +75,10 @@ index 1db630003a..31744c3e68 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 1956ab3b13..9ef356f8af 100644
+index f77a5f6266..63bac85b29 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -630,7 +630,7 @@ static int process_timezone(int rfd) {
+@@ -632,7 +632,7 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -88,10 +88,10 @@ index 1956ab3b13..9ef356f8af 100644
          r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
          if (r < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 898a674631..c41a416e04 100644
+index e48ebe8342..41796f3358 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1924,8 +1924,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1845,8 +1845,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,10 +103,10 @@ index 898a674631..c41a416e04 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 331af34505..722c4b5b4f 100644
+index 50f8aa8675..aff156ab42 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -282,7 +282,7 @@ static int context_read_data(Context *c) {
+@@ -276,7 +276,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -115,7 +115,7 @@ index 331af34505..722c4b5b4f 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -306,7 +306,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -300,7 +300,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
@@ -124,7 +124,7 @@ index 331af34505..722c4b5b4f 100644
  
                          if (unlink("/etc/localtime") < 0 && errno != ENOENT)
                                  return -errno;
-@@ -314,9 +314,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -308,9 +308,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
diff --git a/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
deleted file mode 100644
index 7777ba7e4259..000000000000
--- a/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nikolay Amiantov <ab@fmap.me>
-Date: Thu, 7 Jul 2016 02:47:13 +0300
-Subject: [PATCH] Fix hwdb paths
-
-Patch by vcunat.
----
- src/libsystemd/sd-hwdb/hwdb-internal.h | 6 +-----
- 1 file changed, 1 insertion(+), 5 deletions(-)
-
-diff --git a/src/libsystemd/sd-hwdb/hwdb-internal.h b/src/libsystemd/sd-hwdb/hwdb-internal.h
-index 5302679a62..39e59a527f 100644
---- a/src/libsystemd/sd-hwdb/hwdb-internal.h
-+++ b/src/libsystemd/sd-hwdb/hwdb-internal.h
-@@ -83,8 +83,4 @@ struct trie_value_entry2_f {
- } _packed_;
- 
- #define hwdb_bin_paths                          \
--        "/etc/systemd/hwdb/hwdb.bin\0"          \
--        "/etc/udev/hwdb.bin\0"                  \
--        "/usr/lib/systemd/hwdb/hwdb.bin\0"      \
--        _CONF_PATHS_SPLIT_USR_NULSTR("systemd/hwdb/hwdb.bin") \
--        UDEVLIBEXECDIR "/hwdb.bin\0"
-+        "/etc/udev/hwdb.bin\0"
diff --git a/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
similarity index 95%
rename from pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
rename to pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
index c0f6afd7fc7b..fe0dca1863dd 100644
--- a/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,7 +10,7 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index d8db9d9d22..4601bb5431 100644
+index 32354027f1..1d231f1afc 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
 @@ -297,7 +297,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
diff --git a/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
similarity index 77%
rename from pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
rename to pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
index fa201126ae27..15fe403c28fc 100644
--- a/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,16 +12,16 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 3f96786da9..6e8fb40c08 100644
+index 6bb5f3c281..678d13737d 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -74,13 +74,15 @@
+@@ -65,13 +65,15 @@
+         "/etc/" n "\0"                          \
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
-         "/usr/lib/" n "\0"                      \
--        _CONF_PATHS_SPLIT_USR_NULSTR(n)
-+        _CONF_PATHS_SPLIT_USR_NULSTR(n)         \
-+        ROOTPREFIX "/lib/" n "\0"
+-        "/usr/lib/" n "\0"
++        "/usr/lib/" n "\0"                      \
++        PREFIX "/lib/" n "\0"
  
  #define CONF_PATHS_USR(n)                       \
          "/etc/" n,                              \
@@ -29,7 +29,7 @@ index 3f96786da9..6e8fb40c08 100644
          "/usr/local/lib/" n,                    \
 -        "/usr/lib/" n
 +        "/usr/lib/" n,                          \
-+        ROOTPREFIX "/lib/" n
++        PREFIX "/lib/" n
  
  #define CONF_PATHS(n)                           \
-         CONF_PATHS_USR(n)                       \
+         CONF_PATHS_USR(n)
diff --git a/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
deleted file mode 100644
index b8f97308acfb..000000000000
--- a/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Franz Pletz <fpletz@fnordicwalking.de>
-Date: Sun, 11 Feb 2018 04:37:44 +0100
-Subject: [PATCH] build: don't create statedir and don't touch prefixdir
-
----
- meson.build | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 395eca1943..082cd748bb 100644
---- a/meson.build
-+++ b/meson.build
-@@ -4707,9 +4707,6 @@ install_data('LICENSE.GPL2',
- install_subdir('LICENSES',
-                install_dir : docdir)
- 
--meson.add_install_script('sh', '-c', mkdir_p.format(systemdstatedir))
--meson.add_install_script('sh', '-c', 'touch $DESTDIR@0@'.format(prefixdir))
--
- ############################################################
- 
- # Ensure that changes to the docs/ directory do not break the
diff --git a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
similarity index 89%
rename from pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
rename to pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index fde1e2b276c5..6f0b81a32aa7 100644
--- a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 8395bb429d..14fbc85bb4 100644
+index b976b7d8cf..b1c02df6fd 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -334,6 +334,7 @@ static void init_watchdog(void) {
+@@ -336,6 +336,7 @@ static void init_watchdog(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
similarity index 89%
rename from pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
rename to pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index d91150cfc490..a5ed574afa24 100644
--- a/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index de1f6c7ec1..d0cdebd80a 100644
+index 21af3e9e52..6d096e3c78 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -224,6 +224,7 @@ static int execute(
+@@ -215,6 +215,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
similarity index 53%
rename from pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
rename to pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 13dec1070ffc..55e556288c08 100644
--- a/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,21 +10,19 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 97175bee11..3839704901 100644
+index 6d943e967f..d4380aa7e3 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -25,11 +25,11 @@
+@@ -25,9 +25,9 @@
  #  define PATH_SBIN_BIN_NULSTR(x) PATH_NORMAL_SBIN_BIN_NULSTR(x)
  #endif
  
--#define DEFAULT_PATH_NORMAL PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
--#define DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
-+#define DEFAULT_PATH_NORMAL "@defaultPathNormal@"
-+#define DEFAULT_PATH_NORMAL_NULSTR "@defaultPathNormal@\0"
- #define DEFAULT_PATH_SPLIT_USR DEFAULT_PATH_NORMAL ":" PATH_SBIN_BIN("/")
- #define DEFAULT_PATH_SPLIT_USR_NULSTR DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/")
+-#define DEFAULT_PATH PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
+-#define DEFAULT_PATH_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
 -#define DEFAULT_PATH_COMPAT PATH_SPLIT_SBIN_BIN("/usr/local/") ":" PATH_SPLIT_SBIN_BIN("/usr/") ":" PATH_SPLIT_SBIN_BIN("/")
-+#define DEFAULT_PATH_COMPAT DEFAULT_PATH_NORMAL
++#define DEFAULT_PATH "@defaultPathNormal@"
++#define DEFAULT_PATH_NULSTR "@defaultPathNormal@\0"
++#define DEFAULT_PATH_COMPAT DEFAULT_PATH
  
- #if HAVE_SPLIT_USR
- #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
+ #ifndef DEFAULT_USER_PATH
+ #  define DEFAULT_USER_PATH DEFAULT_PATH
diff --git a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
similarity index 94%
rename from pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
rename to pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
index d6640c87454a..8bccf5539058 100644
--- a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 771e8e7f16..acf3ead8d7 100644
+index 22cc5cc843..5dc7d4504f 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3899,9 +3899,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3914,9 +3914,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
similarity index 82%
rename from pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
rename to pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
index 73b237a29602..8b862918500e 100644
--- a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
@@ -13,21 +13,20 @@ so showing the taint isn't really helpful.
 
 See also: https://github.com/systemd/systemd/issues/24191
 ---
- src/core/manager.c | 4 ----
- 1 file changed, 4 deletions(-)
+ src/core/manager.c | 3 ---
+ 1 file changed, 3 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index acf3ead8d7..bdbab16829 100644
+index 5dc7d4504f..6208c9aa31 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4754,10 +4754,6 @@ char* manager_taint_string(const Manager *m) {
-         if (m->taint_usr)
-                 stage[n++] = "split-usr";
+@@ -4800,9 +4800,6 @@ char* manager_taint_string(const Manager *m) {
+         const char* stage[12] = {};
+         size_t n = 0;
  
 -        _cleanup_free_ char *usrbin = NULL;
 -        if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin"))
 -                stage[n++] = "unmerged-usr";
--
+ 
          if (access("/proc/cgroups", F_OK) < 0)
                  stage[n++] = "cgroups-missing";
- 
diff --git a/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch b/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
deleted file mode 100644
index 3fbfd7f10ab4..000000000000
--- a/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Sun, 6 Dec 2020 08:34:19 +0100
-Subject: [PATCH] pkg-config: derive prefix from --prefix
-
-Point prefix to the one configured, instead of `/usr` `systemd` has limited
-support for making the pkgconfig prefix overridable, and interpolates those
-values later down.
-
-So we only need to patch this one value to get the correct paths.
-See systemd/systemd@bc4e6e27922a2873985ab9367d79fb099f70b505 for details.
-
-Co-Authored-By: Florian Klink <flokli@flokli.de>
----
- src/core/systemd.pc.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 5932a21b5b..20bf8e316d 100644
---- a/src/core/systemd.pc.in
-+++ b/src/core/systemd.pc.in
-@@ -11,7 +11,7 @@
- # considered deprecated (though there is no plan to remove them). New names
- # shall have underscores.
- 
--prefix=/usr
-+prefix={{PREFIX}}
- root_prefix={{ROOTPREFIX_NOSLASH}}
- rootprefix=${root_prefix}
- sysconf_dir={{SYSCONF_DIR}}
diff --git a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
similarity index 91%
rename from pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
rename to pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
index 6de01a0ae802..768f57e1335b 100644
--- a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,15 +27,15 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index ae8a8bc073..c284b244f8 100644
+index 5e07b88a89..8dd7315009 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -582,7 +582,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -654,7 +654,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
 -                if (!filename_is_valid(fn))
 +                if (!path_is_valid(fn))
-                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
+                         return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
  
                  context->tcti_dl = dlopen(fn, RTLD_NOW);
diff --git a/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
similarity index 95%
rename from pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
rename to pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
index dd9af6738c4e..96cd420221e5 100644
--- a/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+++ b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -30,10 +30,10 @@ are written into `$XDG_CONFIG_HOME/systemd/user`.
  1 file changed, 3 insertions(+)
 
 diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
-index e3f25d52d5..81c9c6f6b7 100644
+index 367afa20f7..5777154d01 100644
 --- a/src/systemctl/systemctl-edit.c
 +++ b/src/systemctl/systemctl-edit.c
-@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+@@ -322,6 +322,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
          sd_bus *bus;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
new file mode 100644
index 000000000000..fd38aa9a2850
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
@@ -0,0 +1,21 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: nikstur <nikstur@outlook.com>
+Date: Mon, 6 Nov 2023 22:51:38 +0100
+Subject: [PATCH] meson.build: do not create systemdstatedir
+
+---
+ meson.build | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 7419e2b0b0..c82a527976 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2497,7 +2497,6 @@ install_data('LICENSE.GPL2',
+ install_subdir('LICENSES',
+                install_dir : docdir)
+ 
+-install_emptydir(systemdstatedir)
+ 
+ ############################################################
+ 
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
similarity index 100%
rename from pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
rename to pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 23f875d2dc46..a87858ff2027 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,7 +5,6 @@
 , nixosTests
 , pkgsCross
 , fetchFromGitHub
-, fetchpatch
 , fetchzip
 , buildPackages
 , makeBinaryWrapper
@@ -20,7 +19,6 @@
 
   # glib is only used during tests (test-bus-gvariant, test-bus-marshal)
 , glib
-, substituteAll
 , gettext
 , python3Packages
 
@@ -52,7 +50,6 @@
 , intltool
 , bzip2
 , pcre2
-, e2fsprogs
 , elfutils
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
 , gnutls
@@ -68,6 +65,8 @@
 , libmicrohttpd
 , libfido2
 , p11-kit
+, libpwquality
+, qrencode
 
   # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to be available during build time.
   # Only libbpf should be a runtime dependency.
@@ -102,6 +101,7 @@
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
+, withIptables ? true
 , withKmod ? true
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
     && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
@@ -120,10 +120,11 @@
 , withNss ? !stdenv.hostPlatform.isMusl
 , withOomd ? true
 , withPam ? true
-, withPasswordQuality ? false
+, withPasswordQuality ? true
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? !stdenv.hostPlatform.isMusl
+, withQrencode ? true
 , withRemote ? !stdenv.hostPlatform.isMusl
 , withResolved ? true
 , withShellCompletions ? true
@@ -135,6 +136,7 @@
 , withUkify ? false  # adds python to closure which is too much by default
 , withUserDb ? true
 , withUtmp ? !stdenv.hostPlatform.isMusl
+, withVmspawn ? true
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
   # build only libudev and libsystemd
@@ -157,19 +159,17 @@ assert withHomed -> withPam;
 assert withUkify -> (withEfi && withBootloader);
 assert withRepart -> withCryptsetup;
 assert withBootloader -> withEfi;
-# passwdqc is not packaged in nixpkgs yet, if you want to fix this, please submit a PR.
-assert !withPasswordQuality;
 
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "254.6";
+  version = "255.2";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1690536449";
+  releaseTimestamp = "1701895110";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
@@ -180,7 +180,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-Ku24ecDeQt0t7A8/adR3Jm47QZ19+wdMPyJRzCxU4uU=";
+    hash = "sha256-8SfJY/pcH4yrDeJi0GfIUpetTbpMwyswvSu+RSfgqfY=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -195,21 +195,19 @@ stdenv.mkDerivation (finalAttrs: {
     ./0004-Add-some-NixOS-specific-unit-directories.patch
     ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch
     ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
-    ./0007-Fix-hwdb-paths.patch
-    ./0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
-    ./0009-localectl-use-etc-X11-xkb-for-list-x11.patch
-    ./0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0011-add-rootprefix-to-lookup-dir-paths.patch
-    ./0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0015-pkg-config-derive-prefix-from-prefix.patch
-    ./0016-inherit-systemd-environment-when-calling-generators.patch
-    ./0017-core-don-t-taint-on-unmerged-usr.patch
-    ./0018-tpm2_context_init-fix-driver-name-checking.patch
-    ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0008-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0009-add-rootprefix-to-lookup-dir-paths.patch
+    ./0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0013-inherit-systemd-environment-when-calling-generators.patch
+    ./0014-core-don-t-taint-on-unmerged-usr.patch
+    ./0015-tpm2_context_init-fix-driver-name-checking.patch
+    ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0017-meson.build-do-not-create-systemdstatedir.patch
   ] ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
-    ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+    ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -293,14 +291,17 @@ stdenv.mkDerivation (finalAttrs: {
           { name = "libbpf.so.1"; pkg = opt withLibBPF libbpf; }
           { name = "libbpf.so.0"; pkg = null; }
 
-          # We did never provide support for libxkbcommon & qrencode
+          # We did never provide support for libxkbcommon
           { name = "libxkbcommon.so.0"; pkg = null; }
-          { name = "libqrencode.so.4"; pkg = null; }
+
+          # qrencode
+          { name = "libqrencode.so.4"; pkg = opt withQrencode qrencode; }
           { name = "libqrencode.so.3"; pkg = null; }
 
-          # We did not provide libpwquality before so it is safe to disable it for
-          # now.
-          { name = "libpwquality.so.1"; pkg = null; }
+          # Password quality
+          # We currently do not package passwdqc, only libpwquality.
+          { name = "libpwquality.so.1"; pkg = opt withPasswordQuality libpwquality; }
+          { name = "libpasswdqc.so.1"; pkg = null; }
 
           # Only include cryptsetup if it is enabled. We might not be able to
           # provide it during "bootstrap" in e.g. the minimal systemd build as
@@ -332,8 +333,7 @@ stdenv.mkDerivation (finalAttrs: {
           # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
           { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
 
-          # Password quality support
-          { name = "libpasswdqc.so.1"; pkg = opt withPasswordQuality null; }
+          { name = "libip4tc.so.2"; pkg = opt withIptables iptables; }
         ];
 
       patchDlOpen = dl:
@@ -428,14 +428,14 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withApparmor libapparmor
     ++ lib.optional withAudit audit
     ++ lib.optional wantCurl (lib.getDev curl)
-    ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
+    ++ lib.optionals withCompression [ zlib bzip2 lz4 xz zstd ]
     ++ lib.optional withCoredump elfutils
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
     ++ lib.optional withKexectools kexec-tools
     ++ lib.optional withKmod kmod
     ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
-    ++ lib.optional withNetworkd iptables
+    ++ lib.optional withIptables iptables
     ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
@@ -445,132 +445,167 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals withLibBPF [ libbpf ]
     ++ lib.optional withTpm2Tss tpm2-tss
     ++ lib.optional withUkify (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
+    ++ lib.optionals withPasswordQuality [ libpwquality ]
+    ++ lib.optionals withQrencode [ qrencode ]
   ;
 
   mesonBuildType = "release";
 
   mesonFlags = [
-    "-Dversion-tag=${version}"
+    # Options
+
     # We bump this variable on every (major) version change to ensure
     # that we have known-good value for a timestamp that is in the (not so distant) past.
     # This serves as a lower bound for valid system timestamps during startup. Systemd will
     # reset the system timestamp if this date is +- 15 years from the system time.
     # See the systemd v250 release notes for further details:
     # https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
-    "-Dtime-epoch=${releaseTimestamp}"
-
-    "-Dmode=release"
-    "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
-    "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
-    "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
-    "-Dpam=${lib.boolToString withPam}"
-    "-Dpamconfdir=${placeholder "out"}/etc/pam.d"
-    "-Drootprefix=${placeholder "out"}"
-    "-Dpkgconfiglibdir=${placeholder "dev"}/lib/pkgconfig"
-    "-Dpkgconfigdatadir=${placeholder "dev"}/share/pkgconfig"
-    "-Dloadkeys-path=${kbd}/bin/loadkeys"
-    "-Dsetfont-path=${kbd}/bin/setfont"
-    "-Dtty-gid=3" # tty in NixOS has gid 3
-    "-Ddebug-shell=${bashInteractive}/bin/bash"
-    "-Dglib=${lib.boolToString withTests}"
-    # while we do not run tests we should also not build them. Removes about 600 targets
-    "-Dtests=false"
-    "-Dacl=${lib.boolToString withAcl}"
-    "-Danalyze=${lib.boolToString withAnalyze}"
-    "-Daudit=${lib.boolToString withAudit}"
-    "-Dgcrypt=${lib.boolToString wantGcrypt}"
-    "-Dimportd=${lib.boolToString withImportd}"
-    "-Dlz4=${lib.boolToString withCompression}"
-    "-Dhomed=${lib.boolToString withHomed}"
-    "-Dlogind=${lib.boolToString withLogind}"
-    "-Dlocaled=${lib.boolToString withLocaled}"
-    "-Dhostnamed=${lib.boolToString withHostnamed}"
-    "-Dmachined=${lib.boolToString withMachined}"
-    "-Dnetworkd=${lib.boolToString withNetworkd}"
-    "-Doomd=${lib.boolToString withOomd}"
-    "-Dpolkit=${lib.boolToString withPolkit}"
-    "-Dlibcryptsetup=${lib.boolToString withCryptsetup}"
-    "-Dportabled=${lib.boolToString withPortabled}"
-    "-Dhwdb=${lib.boolToString withHwdb}"
-    "-Dremote=${lib.boolToString withRemote}"
-    "-Dtimedated=${lib.boolToString withTimedated}"
-    "-Dtimesyncd=${lib.boolToString withTimesyncd}"
-    "-Duserdb=${lib.boolToString withUserDb}"
-    "-Dcoredump=${lib.boolToString withCoredump}"
-    "-Dfirstboot=false"
-    "-Dresolve=${lib.boolToString withResolved}"
-    "-Dsplit-usr=false"
-    "-Dlibcurl=${lib.boolToString wantCurl}"
-    "-Dlibidn=false"
-    "-Dlibidn2=${lib.boolToString withLibidn2}"
-    "-Dfirstboot=${lib.boolToString withFirstboot}"
-    "-Dsysusers=${lib.boolToString withSysusers}"
-    "-Drepart=${lib.boolToString withRepart}"
-    "-Dsysupdate=${lib.boolToString withSysupdate}"
-    "-Dquotacheck=false"
-    "-Dldconfig=false"
-    "-Dsmack=true"
-    "-Db_pie=true"
-    "-Dinstall-sysconfdir=false"
-    "-Dsbat-distro=nixos"
-    "-Dsbat-distro-summary=NixOS"
-    "-Dsbat-distro-url=https://nixos.org/"
-    "-Dsbat-distro-pkgname=${pname}"
-    "-Dsbat-distro-version=${version}"
-    /*
-      As of now, systemd doesn't allow runtime configuration of these values. So
-      the settings in /etc/login.defs have no effect on it. Many people think this
-      should be supported however, see
-      - https://github.com/systemd/systemd/issues/3855
-      - https://github.com/systemd/systemd/issues/4850
-      - https://github.com/systemd/systemd/issues/9769
-      - https://github.com/systemd/systemd/issues/9843
-      - https://github.com/systemd/systemd/issues/10184
-    */
-    "-Dsystem-uid-max=999"
-    "-Dsystem-gid-max=999"
-
-    "-Dsysvinit-path="
-    "-Dsysvrcnd-path="
-
-    "-Dsulogin-path=${util-linux.login}/bin/sulogin"
-    "-Dnologin-path=${util-linux.login}/bin/nologin"
-    "-Dmount-path=${lib.getOutput "mount" util-linux}/bin/mount"
-    "-Dumount-path=${lib.getOutput "mount" util-linux}/bin/umount"
-    "-Dcreate-log-dirs=false"
+    (lib.mesonOption "time-epoch" releaseTimestamp)
 
+    (lib.mesonOption "version-tag" version)
+    (lib.mesonOption "mode" "release")
+    (lib.mesonOption "tty-gid" "3") # tty in NixOS has gid 3
+    (lib.mesonOption "debug-shell" "${bashInteractive}/bin/bash")
+    (lib.mesonOption "pamconfdir" "${placeholder "out"}/etc/pam.d")
     # Use cgroupsv2. This is already the upstream default, but better be explicit.
-    "-Ddefault-hierarchy=unified"
-    # Upstream defaulted to disable manpages since they optimize for the much
-    # more frequent development builds
-    "-Dman=true"
+    (lib.mesonOption "default-hierarchy" "unified")
+    (lib.mesonOption "kmod-path" "${kmod}/bin/kmod")
 
-    "-Defi=${lib.boolToString withEfi}"
-    "-Dbootloader=${lib.boolToString withBootloader}"
+    # D-Bus
+    (lib.mesonOption "dbuspolicydir" "${placeholder "out"}/share/dbus-1/system.d")
+    (lib.mesonOption "dbussessionservicedir" "${placeholder "out"}/share/dbus-1/services")
+    (lib.mesonOption "dbussystemservicedir" "${placeholder "out"}/share/dbus-1/system-services")
+
+    # pkgconfig
+    (lib.mesonOption "pkgconfiglibdir" "${placeholder "dev"}/lib/pkgconfig")
+    (lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig")
+
+    # Keyboard
+    (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
+    (lib.mesonOption "setfont-path" "${kbd}/bin/setfont")
+
+    # SBAT
+    (lib.mesonOption "sbat-distro" "nixos")
+    (lib.mesonOption "sbat-distro-summary" "NixOS")
+    (lib.mesonOption "sbat-distro-url" "https://nixos.org/")
+    (lib.mesonOption "sbat-distro-pkgname" pname)
+    (lib.mesonOption "sbat-distro-version" version)
+
+    # Users
+    (lib.mesonOption "system-uid-max" "999")
+    (lib.mesonOption "system-gid-max" "999")
+
+    # SysVinit
+    (lib.mesonOption "sysvinit-path" "")
+    (lib.mesonOption "sysvrcnd-path" "")
+
+    # Login
+    (lib.mesonOption "sulogin-path" "${util-linux.login}/bin/sulogin")
+    (lib.mesonOption "nologin-path" "${util-linux.login}/bin/nologin")
+
+    # Mount
+    (lib.mesonOption "mount-path" "${lib.getOutput "mount" util-linux}/bin/mount")
+    (lib.mesonOption "umount-path" "${lib.getOutput "mount" util-linux}/bin/umount")
+
+
+    # Features
+
+    # Tests
+    (lib.mesonBool "tests" withTests)
+    (lib.mesonEnable "glib" withTests)
+    (lib.mesonEnable "dbus" withTests)
+
+    # Compression
+    (lib.mesonEnable "bzip2" withCompression)
+    (lib.mesonEnable "lz4" withCompression)
+    (lib.mesonEnable "xz" withCompression)
+    (lib.mesonEnable "zstd" withCompression)
+    (lib.mesonEnable "zlib" withCompression)
+
+    # NSS
+    (lib.mesonEnable "nss-mymachines" withNss)
+    (lib.mesonEnable "nss-resolve" withNss)
+    (lib.mesonBool "nss-myhostname" withNss)
+    (lib.mesonBool "nss-systemd" withNss)
+
+    # Cryptsetup
+    (lib.mesonEnable "libcryptsetup" withCryptsetup)
+    (lib.mesonEnable "libcryptsetup-plugins" withCryptsetup)
+    (lib.mesonEnable "p11kit" (withHomed || withCryptsetup))
+
+    # FIDO2
+    (lib.mesonEnable "libfido2" withFido2)
+    (lib.mesonEnable "openssl" withFido2)
+
+    # Password Quality
+    (lib.mesonEnable "pwquality" withPasswordQuality)
+    (lib.mesonEnable "passwdqc" false)
+
+    # Remote
+    (lib.mesonEnable "remote" withRemote)
+    (lib.mesonEnable "microhttpd" withRemote)
+
+    (lib.mesonEnable "pam" withPam)
+    (lib.mesonEnable "acl" withAcl)
+    (lib.mesonEnable "audit" withAudit)
+    (lib.mesonEnable "apparmor" withApparmor)
+    (lib.mesonEnable "gcrypt" wantGcrypt)
+    (lib.mesonEnable "importd" withImportd)
+    (lib.mesonEnable "homed" withHomed)
+    (lib.mesonEnable "polkit" withPolkit)
+    (lib.mesonEnable "elfutils" withCoredump)
+    (lib.mesonEnable "libcurl" wantCurl)
+    (lib.mesonEnable "libidn" false)
+    (lib.mesonEnable "libidn2" withLibidn2)
+    (lib.mesonEnable "libiptc" withIptables)
+    (lib.mesonEnable "repart" withRepart)
+    (lib.mesonEnable "sysupdate" withSysupdate)
+    (lib.mesonEnable "selinux" withSelinux)
+    (lib.mesonEnable "tpm2" withTpm2Tss)
+    (lib.mesonEnable "pcre2" withPCRE2)
+    (lib.mesonEnable "bpf-framework" withLibBPF)
+    (lib.mesonEnable "bootloader" withBootloader)
+    (lib.mesonEnable "ukify" withUkify)
+    (lib.mesonEnable "kmod" withKmod)
+    (lib.mesonEnable "qrencode" withQrencode)
+    (lib.mesonEnable "vmspawn" withVmspawn)
+    (lib.mesonEnable "xenctrl" false)
+    (lib.mesonEnable "gnutls" false)
+    (lib.mesonEnable "xkbcommon" false)
+    (lib.mesonEnable "man" true)
+
+    (lib.mesonBool "analyze" withAnalyze)
+    (lib.mesonBool "logind" withLogind)
+    (lib.mesonBool "localed" withLocaled)
+    (lib.mesonBool "hostnamed" withHostnamed)
+    (lib.mesonBool "machined" withMachined)
+    (lib.mesonBool "networkd" withNetworkd)
+    (lib.mesonBool "oomd" withOomd)
+    (lib.mesonBool "portabled" withPortabled)
+    (lib.mesonBool "hwdb" withHwdb)
+    (lib.mesonBool "timedated" withTimedated)
+    (lib.mesonBool "timesyncd" withTimesyncd)
+    (lib.mesonBool "userdb" withUserDb)
+    (lib.mesonBool "coredump" withCoredump)
+    (lib.mesonBool "firstboot" withFirstboot)
+    (lib.mesonBool "resolve" withResolved)
+    (lib.mesonBool "sysusers" withSysusers)
+    (lib.mesonBool "efi" withEfi)
+    (lib.mesonBool "utmp" withUtmp)
+    (lib.mesonBool "log-trace" withLogTrace)
+    (lib.mesonBool "quotacheck" false)
+    (lib.mesonBool "ldconfig" false)
+    (lib.mesonBool "install-sysconfdir" false)
+    (lib.mesonBool "create-log-dirs" false)
+    (lib.mesonBool "smack" true)
+    (lib.mesonBool "b_pie" true)
 
-    "-Dukify=${lib.boolToString withUkify}"
   ] ++ lib.optionals (withShellCompletions == false) [
-    "-Dbashcompletiondir=no"
-    "-Dzshcompletiondir=no"
-  ] ++ lib.optionals (!withNss) [
-    "-Dnss-myhostname=false"
-    "-Dnss-mymachines=false"
-    "-Dnss-resolve=false"
-    "-Dnss-systemd=false"
-  ] ++ lib.optionals withLibBPF [
-    "-Dbpf-framework=true"
-  ] ++ lib.optionals withTpm2Tss [
-    "-Dtpm2=true"
-  ] ++ lib.optionals (!withUtmp) [
-    "-Dutmp=false"
+    (lib.mesonOption "bashcompletiondir" "no")
+    (lib.mesonOption "zshcompletiondir" "no")
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-    "-Dgshadow=false"
-    "-Didn=false"
-  ] ++ lib.optionals withKmod [
-    "-Dkmod=true"
-    "-Dkmod-path=${kmod}/bin/kmod"
-  ] ++ lib.optionals withLogTrace [
-    "-Dlog-trace=true"
+    (lib.mesonBool "gshadow" false)
+    (lib.mesonBool "idn" false)
   ];
   preConfigure =
     let
@@ -747,7 +782,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Wrap in the correct path for LUKS2 tokens.
   postFixup = lib.optionalString withCryptsetup ''
-    for f in lib/systemd/systemd-cryptsetup bin/systemd-cryptenroll; do
+    for f in bin/systemd-cryptsetup bin/systemd-cryptenroll; do
       # This needs to be in LD_LIBRARY_PATH because rpath on a binary is not propagated to libraries using dlopen, in this case `libcryptsetup.so`
       wrapProgram $out/$f --prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib/cryptsetup
     done
@@ -757,7 +792,7 @@ stdenv.mkDerivation (finalAttrs: {
     # To cross compile a derivation that builds a UKI with ukify, we need to wrap
     # ukify with the correct binutils. When wrapping, no splicing happens so we
     # have to explicitly pull binutils from targetPackages.
-    wrapProgram $out/lib/systemd/ukify --prefix PATH : ${lib.makeBinPath [ targetPackages.stdenv.cc.bintools ] }:${placeholder "out"}/lib/systemd
+    wrapProgram $out/bin/ukify --prefix PATH : ${lib.makeBinPath [ targetPackages.stdenv.cc.bintools ] }:${placeholder "out"}/lib/systemd
   '';
 
   disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
diff --git a/pkgs/servers/firebird/default.nix b/pkgs/servers/firebird/default.nix
index e49f683da877..7e7387819ab0 100644
--- a/pkgs/servers/firebird/default.nix
+++ b/pkgs/servers/firebird/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, libedit, autoreconfHook, zlib, unzip, libtommath, libtomcrypt, icu, superServer ? false }:
+{ lib, stdenv, fetchFromGitHub, libedit, autoreconfHook271, zlib, unzip, libtommath, libtomcrypt, icu, superServer ? false }:
 
 let base = {
   pname = "firebird";
@@ -13,7 +13,7 @@ let base = {
     maintainers = with maintainers; [ marcweber ];
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook271 ];
 
   buildInputs = [ libedit icu ];
 
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index c3ac0ebbf969..923de9126b5f 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, lua, jemalloc, pkg-config, nixosTests
+{ lib, stdenv, fetchurl, fetchpatch, lua, jemalloc, pkg-config, nixosTests
 , tcl, which, ps, getconf
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
 # dependency ordering is broken at the moment when building with openssl
@@ -12,14 +12,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "7.2.3";
+  version = "7.2.4";
 
   src = fetchurl {
     url = "https://download.redis.io/releases/redis-${finalAttrs.version}.tar.gz";
-    hash = "sha256-PisZbW603bnnQwiL/CkVzLtC1A9aij7djLaccW7DS+c=";
+    hash = "sha256-jRBMJqFUsp/WfWVotPN1ISISrUHgwsqj1mSA5429O1k=";
   };
 
-  patches = lib.optionals useSystemJemalloc [
+  patches = [
+    # fixes: make test [exception]: Executing test client: permission denied
+    # https://github.com/redis/redis/issues/12792
+    (fetchpatch {
+      url = "https://github.com/redis/redis/pull/12887.diff";
+      hash = "sha256-VZEMShW7Ckn5hLJHffQvE94Uly41WZW1bwvxny+Y3W8=";
+    })
+  ] ++ lib.optionals useSystemJemalloc [
     # use system jemalloc
     (fetchurl {
       url = "https://gitlab.archlinux.org/archlinux/packaging/packages/redis/-/raw/102cc861713c796756abd541bf341a4512eb06e6/redis-5.0-use-system-jemalloc.patch";
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index ec8df76f2c79..efb233312b57 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -815,6 +815,8 @@ fi
 ######################################################################
 # Textual substitution functions.
 
+# only log once, due to max logging limit on hydra
+_substituteStream_has_warned_replace_deprecation=""
 
 substituteStream() {
     local var=$1
@@ -822,8 +824,24 @@ substituteStream() {
     shift 2
 
     while (( "$#" )); do
+        local is_required=1
+        local is_quiet=""
         case "$1" in
+            --replace-quiet)
+                is_quiet=1
+                ;&
             --replace)
+                # deprecated 2023-11-22
+                # this will either get removed, or switch to the behaviour of --replace-fail in the future
+                if [ -z "$_substituteStream_has_warned_replace_deprecation" ]; then
+                    echo "substituteStream(): WARNING: '--replace' is deprecated, use --replace-{fail,warn,quiet}. ($description)" >&2
+                    _substituteStream_has_warned_replace_deprecation=1
+                fi
+                ;&
+            --replace-warn)
+                is_required=""
+                ;&
+            --replace-fail)
                 pattern="$2"
                 replacement="$3"
                 shift 3
@@ -832,7 +850,14 @@ substituteStream() {
                 eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
                 if [ "$pattern" != "$replacement" ]; then
                     if [ "${!var}" == "$savedvar" ]; then
-                        echo "substituteStream(): WARNING: pattern '$pattern' doesn't match anything in $description" >&2
+                        if [ -z "$is_required" ]; then
+                            if [ -z "$is_quiet" ]; then
+                                printf "substituteStream(): WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                            fi
+                        else
+                            printf "substituteStream(): ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                            return 1
+                        fi
                     fi
                 fi
                 ;;
diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index cd7489be9aec..73413c1aee4c 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-UIk5hihUPjXNzEeO2laS4dUef/rEExxXAZjMcftx+3A=";
+    hash = "sha256-Mhr3Yxm5MeLLQFmxWmtXLsq+ZcOE+KMs+3iiTYF8t30=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index dae55225a0b3..336c31811aa2 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-rSKPTeTDOz6IeJGRt9aIu1VH8VfVzXNYZfjdiSXEJxg=";
+    hash = "sha256-zQycF3yKoa54KBUIuG1BqFGB00yc6oZQzdcDel2rXN0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config jq ];
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 0db3cf159771..778b13655886 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
    owner = "LunarG";
    repo = "VulkanTools";
    rev = "vulkan-sdk-${version}";
-   hash = "sha256-2ZUD+RBsl35QV3250JOPCIoJb4sJcBsiRE4SZaS6ROs=";
+   hash = "sha256-MEQX90HL90jyVBWWcvOF7QLzm1+fNE5TW3MWdK4w53M=";
  };
 
   nativeBuildInputs = [ cmake python3 jq which pkg-config libsForQt5.qt5.wrapQtAppsHook ];
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index d590ac7d340c..087326f71322 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -14,6 +14,7 @@
 , libXrandr
 , vulkan-headers
 , vulkan-loader
+, vulkan-volk
 , wayland
 , wayland-protocols
 , moltenvk
@@ -23,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-IsMxiAR4ak6kC3BNYhtI+JVNkEka4ZceSElxk39THXg=";
+    hash = "sha256-0sAwO8gXzpMst+7l7LS1oiDLo9E6otDktCti+v8jwDw=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
     glslang
     vulkan-headers
     vulkan-loader
+    vulkan-volk
   ] ++ lib.optionals (!stdenv.isDarwin) [
     libffi
     libX11
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index c526f6a844d7..ca586a449703 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "m17n-lib";
-  version = "1.8.2";
+  version = "1.8.4";
 
   src = fetchurl {
     url = "https://download.savannah.gnu.org/releases/m17n/m17n-lib-${version}.tar.gz";
-    hash = "sha256-5bA0SvnxFdlJV6P5ud68T45nG2n4wf1eC2iKeU16J/I=";
+    hash = "sha256-xqJYLG5PKowueihE+lx+s2Oq0lOLBS8gPHEGSd1CHMg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 01208f0a121c..d7d78cea11b7 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -15,6 +15,7 @@
   ), libkrb5
 , http2Support ? true, nghttp2
 , http3Support ? false, nghttp3, ngtcp2
+, websocketSupport ? false
 , idnSupport ? false, libidn2
 , ldapSupport ? false, openldap
 , opensslSupport ? zlibSupport, openssl
@@ -47,14 +48,14 @@ assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsS
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.4.0";
+  version = "8.5.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
       "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
+    hash = "sha256-QquNueINgpCjtjPn+7POwV2zTfZf0QFe+KweRyN1Dus=";
   };
 
   patches = [
@@ -111,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.enableFeature c-aresSupport "ares")
       (lib.enableFeature ldapSupport "ldap")
       (lib.enableFeature ldapSupport "ldaps")
+      (lib.enableFeature websocketSupport "websockets")
       # --with-ca-fallback is only supported for openssl and gnutls https://github.com/curl/curl/blame/curl-8_0_1/acinclude.m4#L1640
       (lib.withFeature (opensslSupport || gnutlsSupport) "ca-fallback")
       (lib.withFeature http3Support "nghttp3")
diff --git a/pkgs/tools/networking/inetutils/default.nix b/pkgs/tools/networking/inetutils/default.nix
index 9b1723a4d122..53901be2f592 100644
--- a/pkgs/tools/networking/inetutils/default.nix
+++ b/pkgs/tools/networking/inetutils/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , ncurses
 , perl
 , help2man
@@ -11,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "inetutils";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-F4nWsbGlff4qere1M+6fXf2cv1tZuxuzwmEu0I0PaLI=";
+    hash = "sha256-h2l9YKMeELXLhqnwZR4ex77pgyDQSMBzlDGqw9V2T7Y=";
   };
 
   outputs = ["out" "apparmor"];
@@ -23,11 +22,6 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
     ./inetutils-1_9-PATH_PROCNET_DEV.patch
-    (fetchpatch {
-      name = "CVE-2023-40303.patch";
-      url = "https://git.savannah.gnu.org/cgit/inetutils.git/patch/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6";
-      hash = "sha256-I5skN537owfpFpAZr4vDKPHuERI6+oq5/hFW2RQeUxI=";
-    })
   ];
 
   strictDeps = true;
diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index d66c277f1dac..dd36f4b7465a 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.20.6";
+  version = "1.22.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mobile-broadband";
     repo = "ModemManager";
     rev = version;
-    hash = "sha256-/A4WTsUQVeZDi5ei6qBvqoWYLKdRcZaYZU8/qWOPrvM=";
+    hash = "sha256-/D9b2rCCUhpDCUfSNAWR65+3EyUywzFdH1R17eSKRDo=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/tun2socks/default.nix b/pkgs/tools/networking/tun2socks/default.nix
index 9296b0df0068..37019a38b348 100644
--- a/pkgs/tools/networking/tun2socks/default.nix
+++ b/pkgs/tools/networking/tun2socks/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
   vendorHash = "sha256-zeiOcn33PnyoseYb0wynkn7MfGp3rHEYBStY98C6aR8=";
 
   ldflags = [
-    "-w" "-s" "-buildid="
+    "-w" "-s"
     "-X github.com/xjasonlyu/tun2socks/v2/internal/version.Version=v${version}"
     "-X github.com/xjasonlyu/tun2socks/v2/internal/version.GitCommit=v${version}"
   ];
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index 1da2adba9d54..4d783fb47345 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
   # https://github.com/Mic92/nix-update/pull/95
   vendorHash = "sha256-ZBvHu4BEmQi6PQwRHuVwx/6X4gBqlRR44OktKRBGcs4=";
 
-  ldflags = [ "-s" "-w" "-buildid=" ];
+  ldflags = [ "-s" "-w" ];
 
   subPackages = [ "main" ];
 
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index bb317055dc04..683cd9e48447 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  ldflags = [ "-s" "-w" "-buildid=" ];
+  ldflags = [ "-s" "-w" ];
   subPackages = [ "main" ];
 
    installPhase = ''
diff --git a/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch b/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch
new file mode 100644
index 000000000000..8bc65ede79c0
--- /dev/null
+++ b/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch
@@ -0,0 +1,200 @@
+From 1e4f1550996334d2a631a5d769e937d29ace47bb Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Thu, 9 Feb 2023 16:38:58 +0100
+Subject: [PATCH gnupg] Revert the introduction of the RFC4880bis draft into
+ defaults
+
+This reverts commit 4583f4fe2 (gpg: Merge --rfc4880bis features into
+--gnupg, 2022-10-31).
+---
+ g10/gpg.c    | 35 ++++++++++++++++++++++++++++++++---
+ g10/keygen.c | 30 ++++++++++++++++++------------
+ 2 files changed, 50 insertions(+), 15 deletions(-)
+
+diff --git a/g10/gpg.c b/g10/gpg.c
+index dcab0a11a..796888013 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -247,6 +247,7 @@ enum cmd_and_opt_values
+     oGnuPG,
+     oRFC2440,
+     oRFC4880,
++    oRFC4880bis,
+     oOpenPGP,
+     oPGP7,
+     oPGP8,
+@@ -636,6 +637,7 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"),
+   ARGPARSE_s_n (oRFC2440, "rfc2440", "@"),
+   ARGPARSE_s_n (oRFC4880, "rfc4880", "@"),
++  ARGPARSE_s_n (oRFC4880bis, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")),
+   ARGPARSE_s_n (oPGP7, "pgp6", "@"),
+   ARGPARSE_s_n (oPGP7, "pgp7", "@"),
+@@ -978,7 +980,6 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oNoop, "no-allow-multiple-messages", "@"),
+   ARGPARSE_s_s (oNoop, "aead-algo", "@"),
+   ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
+-  ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
+ 
+ 
+@@ -2227,7 +2228,7 @@ static struct gnupg_compliance_option compliance_options[] =
+   {
+     { "gnupg",      oGnuPG },
+     { "openpgp",    oOpenPGP },
+-    { "rfc4880bis", oGnuPG },
++    { "rfc4880bis", oRFC4880bis },
+     { "rfc4880",    oRFC4880 },
+     { "rfc2440",    oRFC2440 },
+     { "pgp6",       oPGP7 },
+@@ -2243,8 +2244,28 @@ static struct gnupg_compliance_option compliance_options[] =
+ static void
+ set_compliance_option (enum cmd_and_opt_values option)
+ {
++  opt.flags.rfc4880bis = 0;  /* Clear because it is initially set.  */
++
+   switch (option)
+     {
++    case oRFC4880bis:
++      opt.flags.rfc4880bis = 1;
++      opt.compliance = CO_RFC4880;
++      opt.flags.dsa2 = 1;
++      opt.flags.require_cross_cert = 1;
++      opt.rfc2440_text = 0;
++      opt.allow_non_selfsigned_uid = 1;
++      opt.allow_freeform_uid = 1;
++      opt.escape_from = 1;
++      opt.not_dash_escaped = 0;
++      opt.def_cipher_algo = 0;
++      opt.def_digest_algo = 0;
++      opt.cert_digest_algo = 0;
++      opt.compress_algo = -1;
++      opt.s2k_mode = 3; /* iterated+salted */
++      opt.s2k_digest_algo = DIGEST_ALGO_SHA256;
++      opt.s2k_cipher_algo = CIPHER_ALGO_AES256;
++      break;
+     case oOpenPGP:
+     case oRFC4880:
+       /* This is effectively the same as RFC2440, but with
+@@ -2288,6 +2309,7 @@ set_compliance_option (enum cmd_and_opt_values option)
+     case oPGP8:  opt.compliance = CO_PGP8;  break;
+     case oGnuPG:
+       opt.compliance = CO_GNUPG;
++      opt.flags.rfc4880bis = 1;
+       break;
+ 
+     case oDE_VS:
+@@ -2491,6 +2513,7 @@ main (int argc, char **argv)
+     opt.emit_version = 0;
+     opt.weak_digests = NULL;
+     opt.compliance = CO_GNUPG;
++    opt.flags.rfc4880bis = 1;
+ 
+     /* Check special options given on the command line.  */
+     orig_argc = argc;
+@@ -3033,6 +3056,7 @@ main (int argc, char **argv)
+           case oOpenPGP:
+           case oRFC2440:
+           case oRFC4880:
++          case oRFC4880bis:
+           case oPGP7:
+           case oPGP8:
+           case oGnuPG:
+@@ -3862,6 +3886,11 @@ main (int argc, char **argv)
+     if( may_coredump && !opt.quiet )
+ 	log_info(_("WARNING: program may create a core file!\n"));
+ 
++    if (!opt.flags.rfc4880bis)
++      {
++        opt.mimemode = 0; /* This will use text mode instead.  */
++      }
++
+     if (eyes_only) {
+       if (opt.set_filename)
+ 	  log_info(_("WARNING: %s overrides %s\n"),
+@@ -4078,7 +4107,7 @@ main (int argc, char **argv)
+     /* Check our chosen algorithms against the list of legal
+        algorithms. */
+ 
+-    if(!GNUPG)
++    if(!GNUPG && !opt.flags.rfc4880bis)
+       {
+ 	const char *badalg=NULL;
+ 	preftype_t badtype=PREFTYPE_NONE;
+diff --git a/g10/keygen.c b/g10/keygen.c
+index a2cfe3ccf..2a1dd1f81 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -404,7 +404,7 @@ keygen_set_std_prefs (const char *string,int personal)
+ 	      strcat(dummy_string,"S7 ");
+ 	    strcat(dummy_string,"S2 "); /* 3DES */
+ 
+-            if (!openpgp_aead_test_algo (AEAD_ALGO_OCB))
++            if (opt.flags.rfc4880bis && !openpgp_aead_test_algo (AEAD_ALGO_OCB))
+ 	      strcat(dummy_string,"A2 ");
+ 
+             if (personal)
+@@ -889,7 +889,7 @@ keygen_upd_std_prefs (PKT_signature *sig, void *opaque)
+   /* Make sure that the MDC feature flag is set if needed.  */
+   add_feature_mdc (sig,mdc_available);
+   add_feature_aead (sig, aead_available);
+-  add_feature_v5 (sig, 1);
++  add_feature_v5 (sig, opt.flags.rfc4880bis);
+   add_keyserver_modify (sig,ks_modify);
+   keygen_add_keyserver_url(sig,NULL);
+ 
+@@ -3382,7 +3382,10 @@ parse_key_parameter_part (ctrl_t ctrl,
+                 }
+             }
+           else if (!ascii_strcasecmp (s, "v5"))
+-            keyversion = 5;
++            {
++              if (opt.flags.rfc4880bis)
++                keyversion = 5;
++            }
+           else if (!ascii_strcasecmp (s, "v4"))
+             keyversion = 4;
+           else
+@@ -3641,7 +3644,7 @@ parse_key_parameter_part (ctrl_t ctrl,
+  *   ecdsa := Use algorithm ECDSA.
+  *   eddsa := Use algorithm EdDSA.
+  *   ecdh  := Use algorithm ECDH.
+- *   v5    := Create version 5 key
++ *   v5    := Create version 5 key (requires option --rfc4880bis)
+  *
+  * There are several defaults and fallbacks depending on the
+  * algorithm.  PART can be used to select which part of STRING is
+@@ -4513,9 +4516,9 @@ read_parameter_file (ctrl_t ctrl, const char *fname )
+ 	    }
+ 	}
+ 
+-        if ((keywords[i].key == pVERSION
+-             || keywords[i].key == pSUBVERSION))
+-          ; /* Ignore version.  */
++        if (!opt.flags.rfc4880bis && (keywords[i].key == pVERSION
++                                      || keywords[i].key == pSUBVERSION))
++          ; /* Ignore version unless --rfc4880bis is active.  */
+         else
+           {
+             r = xmalloc_clear( sizeof *r + strlen( value ) );
+@@ -4610,11 +4613,14 @@ quickgen_set_para (struct para_data_s *para, int for_subkey,
+       para = r;
+     }
+ 
+-  r = xmalloc_clear (sizeof *r + 20);
+-  r->key = for_subkey? pSUBVERSION : pVERSION;
+-  snprintf (r->u.value, 20, "%d", version);
+-  r->next = para;
+-  para = r;
++  if (opt.flags.rfc4880bis)
++    {
++      r = xmalloc_clear (sizeof *r + 20);
++      r->key = for_subkey? pSUBVERSION : pVERSION;
++      snprintf (r->u.value, 20, "%d", version);
++      r->next = para;
++      para = r;
++    }
+ 
+   if (keytime)
+     {
diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index 2f5c6e2ce428..49beed63b53a 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -13,11 +13,11 @@ assert guiSupport -> enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.4.1";
+  version = "2.4.3";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    hash = "sha256-drceWutEO/2RDOnLyCgbYXyDQWh6+2e65FWHeXK1neg=";
+    hash = "sha256-onGubXMvb02AwlitnuiN2clMj9wzw+RTKMTXwSa9IZ0=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
     ./tests-add-test-cases-for-import-without-uid.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
     ./24-allow-import-of-previously-known-keys-even-without-UI.patch
+    ./24-revert-rfc4880bis-defaults.patch
     # Patch for DoS vuln from https://seclists.org/oss-sec/2022/q3/27
     ./v3-0001-Disallow-compressed-signatures-and-certificates.patch
   ];
diff --git a/pkgs/tools/security/slsa-verifier/default.nix b/pkgs/tools/security/slsa-verifier/default.nix
index d02b574b1563..5a6ab18a49ec 100644
--- a/pkgs/tools/security/slsa-verifier/default.nix
+++ b/pkgs/tools/security/slsa-verifier/default.nix
@@ -27,7 +27,6 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-buildid="
     "-X sigs.k8s.io/release-utils/version.gitVersion=${version}"
   ];
 
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index 5c1463ec117b..6bdbfa02d62a 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -23,10 +23,6 @@ buildGoModule rec {
 
   vendorHash = "sha256-AXMMpzXEhdKSGeVg/KK2NEgalxIXP6DUTcoxOQVqow4=";
 
-  ldflags = [
-    "-buildid="
-  ];
-
   nativeBuildInputs = lib.optionals hsmSupport [
     pkg-config
   ];
diff --git a/pkgs/tools/text/groff/site.tmac b/pkgs/tools/text/groff/site.tmac
index 07923f120009..6f0f18dea6d5 100644
--- a/pkgs/tools/text/groff/site.tmac
+++ b/pkgs/tools/text/groff/site.tmac
@@ -1,13 +1,26 @@
 .
 .if n \{\
-.  \" Character translations for non-keyboard
-.  \" characters - to make them searchable
+.  \" With groff 1.23.0 "[t]he 'utf8' output device now maps the input
+.  \" characters '^' (caret, circumflex accent, or 'hat') and '~' (tilde)
+.  \" to U+02C6 (modifier letter circumflex accent) and U+02DC (small tilde),
+.  \" respectively, for consistency with groff's other output devices.
+.  \" This change is expected to expose glyph usage errors in man pages.
+.  \" See [http://git.savannah.gnu.org/cgit/groff.git/tree/PROBLEMS] for
+.  \" a recipe that will conceal these errors"
+.  \" -- https://lists.gnu.org/archive/html/groff/2023-07/msg00051.html
+.  \"
+.  \" Conceal glyph usage errors in man pages with the following
+.  \" character translations for non-keyboard characters to make them searchable.
 .  if '\*[.T]'utf8' \{\
 .    char \- \N'45'
 .    char - \N'45'
-.    char ' \N'39'
-.    char \' \N'39'
+.    char \' \[aq]
+.    char ' \[aq]
+.    char ` \[ga]
+.    char ^ \[ha]
+.    char ~ \[ti]
 .  \}
+.\}
 .
 .ds doc-default-operating-system Nixpkgs
 .ds doc-volume-operating-system Nixpkgs
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 859e523dfa65..4f62161b0189 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.6.6";
+  version = "0.7.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-urYMT1sJUMBj1L/2Hi+hcYbWbi0ScSls0pm9gLj9H3o=";
+    sha256 = "sha256-Db7qb7HBAy6lniIiN07iEzURmbfNtuhmgJRv7OUagUM=";
   };
 
-  cargoHash = "sha256-qQfEpynhlIEKU1Ptq/jM1Wdtn+BVCZT1lmou2S1GL4I=";
+  cargoHash = "sha256-VyQ6n2kIJ7OjK6Xlf0T0GNsBvgESRETzKZDZzAn8ZuY=";
 
   depsBuildBuild = [ pkg-config ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index dc3373cd02a9..bf2519fd60ed 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -24,7 +24,7 @@ let
   # to appear while listing all the packages available.
   removeRecurseForDerivations = alias: with lib;
     if alias.recurseForDerivations or false
-    then removeAttrs alias ["recurseForDerivations"]
+    then removeAttrs alias [ "recurseForDerivations" ]
     else alias;
 
   # Disabling distribution prevents top-level aliases for non-recursed package
@@ -41,10 +41,11 @@ let
     else alias;
 
   mapAliases = aliases:
-    lib.mapAttrs (n: alias:
-      removeDistribute
-        (removeRecurseForDerivations
-          (checkInPkgs n alias)))
+    lib.mapAttrs
+      (n: alias:
+        removeDistribute
+          (removeRecurseForDerivations
+            (checkInPkgs n alias)))
       aliases;
 in
 
@@ -59,7 +60,7 @@ mapAliases ({
   a4term = a4; # Added 2023-10-06
   aether = throw "aether has been removed from nixpkgs; upstream unmaintained, security issues"; # Added 2023-10-03
   airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
-  alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream" ; # Added 2023-07-28
+  alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream"; # Added 2023-07-28
   alsa-project = throw "alsa-project was removed and its sub-attributes were promoted to top-level."; # Added 2023-11-12
   alsaLib = alsa-lib; # Added 2021-06-09
   alsaOss = alsa-oss; # Added 2021-06-10
@@ -102,7 +103,8 @@ mapAliases ({
   bitwig-studio2 = throw "bitwig-studio2 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
   blender-with-packages = args:
     lib.warn "blender-with-packages is deprecated in favor of blender.withPackages, e.g. `blender.withPackages(ps: [ ps.foobar ])`"
-    (blender.withPackages (_: args.packages)).overrideAttrs (lib.optionalAttrs (args ? name) { pname = "blender-" + args.name; }); # Added 2023-10-30
+      (blender.withPackages (_: args.packages)).overrideAttrs
+      (lib.optionalAttrs (args ? name) { pname = "blender-" + args.name; }); # Added 2023-10-30
   bluezFull = throw "'bluezFull' has been renamed to/replaced by 'bluez'"; # Converted to throw 2023-09-10
   bookletimposer = throw "bookletimposer has been removed from nixpkgs; upstream unmaintained and broke with pypdf3"; # Added 2024-01-01
   boost168 = throw "boost168 has been deprecated in favor of the latest version"; # Added 2023-06-08
@@ -187,10 +189,10 @@ mapAliases ({
   clang16Stdenv = lowPrio llvmPackages_16.stdenv;
   clang17Stdenv = lowPrio llvmPackages_17.stdenv;
 
-  clang-tools_6  = throw "clang-tools_6 has been removed from nixpkgs"; # Added 2024-01-08
-  clang-tools_7  = throw "clang-tools_7 has been removed from nixpkgs"; # Added 2023-11-19
-  clang_6  = throw "clang_6 has been removed from nixpkgs"; # Added 2024-01-08
-  clang_7  = throw "clang_7 has been removed from nixpkgs"; # Added 2023-11-19
+  clang-tools_6 = throw "clang-tools_6 has been removed from nixpkgs"; # Added 2024-01-08
+  clang-tools_7 = throw "clang-tools_7 has been removed from nixpkgs"; # Added 2023-11-19
+  clang_6 = throw "clang_6 has been removed from nixpkgs"; # Added 2024-01-08
+  clang_7 = throw "clang_7 has been removed from nixpkgs"; # Added 2023-11-19
 
   ### D ###
 
@@ -219,8 +221,8 @@ mapAliases ({
   dotnet-sdk_3 = dotnetCorePackages.sdk_3_1; # Added 2020-01-19
   dotnet-sdk_5 = dotnetCorePackages.sdk_5_0; # Added 2020-09-11
   drgeo = throw "'drgeo' has been removed as it is outdated and unmaintained"; # Added 2023-10-15
-  dtv-scan-tables_linuxtv = dtv-scan-tables;  # Added 2023-03-03
-  dtv-scan-tables_tvheadend = dtv-scan-tables;  # Added 2023-03-03
+  dtv-scan-tables_linuxtv = dtv-scan-tables; # Added 2023-03-03
+  dtv-scan-tables_tvheadend = dtv-scan-tables; # Added 2023-03-03
   dylibbundler = macdylibbundler; # Added 2021-04-24
 
   ### E ###
@@ -339,8 +341,14 @@ mapAliases ({
 
   gnuradio-with-packages = gnuradio3_7.override {
     extraPackages = lib.attrVals [
-      "osmosdr" "ais" "gsm" "nacl" "rds" "limesdr"
-    ] gnuradio3_7Packages;
+      "osmosdr"
+      "ais"
+      "gsm"
+      "nacl"
+      "rds"
+      "limesdr"
+    ]
+      gnuradio3_7Packages;
   }; # Added 2020-10-16
 
   gmock = gtest; # moved from top-level 2021-03-14
@@ -366,6 +374,7 @@ mapAliases ({
   google-chrome-dev = throw "'google-chrome-dev' has been removed due to the lack of maintenance in nixpkgs. Consider using 'google-chrome' instead."; # Added 2023-10-18
   google-gflags = throw "'google-gflags' has been renamed to/replaced by 'gflags'"; # Converted to throw 2023-09-10
   go-thumbnailer = thud; # Added 2023-09-21
+  gocode = throw "'gocode' has been removed as the upstream project was archived. 'gopls' is suggested as replacement"; # Added 2023-12-26
   govendor = throw "'govendor' has been removed as it is no longer maintained upstream, please use Go modules instead"; # Added 2023-12-26
   gometer = throw "gometer has been removed from nixpkgs because goLance stopped offering Linux support"; # Added 2023-02-10
 
@@ -466,7 +475,7 @@ mapAliases ({
   kerberos = libkrb5; # moved from top-level 2021-03-14
   kexectools = kexec-tools; # Added 2021-09-03
   keysmith = libsForQt5.kdeGear.keysmith; # Added 2021-07-14
-  kfctl = throw "kfctl is broken and has been archived by upstream" ; # Added 2023-08-21
+  kfctl = throw "kfctl is broken and has been archived by upstream"; # Added 2023-08-21
   kgx = gnome-console; # Added 2022-02-19
   kibana7 = throw "Kibana 7.x has been removed from nixpkgs as it depends on an end of life Node.js version and received no maintenance in time."; # Added 2023-30-10
   kibana = kibana7;
@@ -513,7 +522,7 @@ mapAliases ({
   librewolf-wayland = librewolf; # Added 2022-11-15
   libseat = seatd; # Added 2021-06-24
   libsigcxx12 = throw "'libsigcxx12' has been removed, please use newer versions"; # Added 2023-10-20
-  libsForQt515 = libsForQt5;  # Added 2022-11-24
+  libsForQt515 = libsForQt5; # Added 2022-11-24
   libtensorflow-bin = libtensorflow; # Added 2022-09-25
   libtorrentRasterbar = libtorrent-rasterbar; # Added 2020-12-20
   libtorrentRasterbar-1_2_x = libtorrent-rasterbar-1_2_x; # Added 2020-12-20
@@ -699,12 +708,13 @@ mapAliases ({
   neochat = libsForQt5.kdeGear.neochat; # added 2022-05-10
   nitrokey-udev-rules = libnitrokey; # Added 2023-03-25
   nix-direnv-flakes = nix-direnv;
-  nix-repl = throw ( # Added 2018-08-26
+  nix-repl = throw (
+    # Added 2018-08-26
     "nix-repl has been removed because it's not maintained anymore, " +
     "use `nix repl` instead. Also see https://github.com/NixOS/nixpkgs/pull/44903"
   );
   nix-review = throw "'nix-review' has been renamed to/replaced by 'nixpkgs-review'"; # Converted to throw 2023-09-10
-  nix-template-rpm = throw "'nix-template-rpm' has been removed as it is broken and unmaintained" ; # Added 2023-11-20
+  nix-template-rpm = throw "'nix-template-rpm' has been removed as it is broken and unmaintained"; # Added 2023-11-20
   nixFlakes = nixVersions.stable; # Added 2021-05-21
   nixStable = nixVersions.stable; # Added 2022-01-24
   nixUnstable = nixVersions.unstable; # Added 2022-01-26
@@ -859,7 +869,7 @@ mapAliases ({
   qlandkartegt = throw "'qlandkartegt' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-04-17
   qscintilla = libsForQt5.qscintilla; # Added 2023-09-20
   qscintilla-qt6 = qt6Packages.qscintilla; # Added 2023-09-20
-  qt515 = qt5;  # Added 2022-11-24
+  qt515 = qt5; # Added 2022-11-24
   qt5ct = libsForQt5.qt5ct; # Added 2021-12-27
   qt6ct = qt6Packages.qt6ct; # Added 2023-03-07
   qtcurve = libsForQt5.qtcurve; # Added 2020-11-07
@@ -948,7 +958,7 @@ mapAliases ({
   sgtpuzzles = throw "'sgtpuzzles' has been renamed to 'sgt-puzzles'"; # Added 2023-10-06
   sgtpuzzles-mobile = throw "'sgtpuzzles-mobile' has been renamed to 'sgt-puzzles-mobile'"; # Added 2023-10-06
   inherit (libsForQt5.mauiPackages) shelf; # added 2022-05-17
-  shhgit = throw "shhgit is broken and is no longer maintained. See https://github.com/eth0izzle/shhgit#-shhgit-is-no-longer-maintained-" ; # Added 2023-08-08
+  shhgit = throw "shhgit is broken and is no longer maintained. See https://github.com/eth0izzle/shhgit#-shhgit-is-no-longer-maintained-"; # Added 2023-08-08
   shipyard = jumppad; # Added 2023-06-06
   signumone-ks = throw "signumone-ks has been removed from nixpkgs because the developers stopped offering the binaries"; # Added 2023-08-17
   simplenote = throw "'simplenote' has been removed because it is no longer maintained and insecure"; # Added 2023-10-09
@@ -1065,7 +1075,7 @@ mapAliases ({
   vamp = { vampSDK = vamp-plugin-sdk; }; # Added 2020-03-26
   vaapiIntel = intel-vaapi-driver; # Added 2023-05-31
   vaultwarden-vault = vaultwarden.webvault; # Added 2022-12-13
-  vdirsyncerStable  = vdirsyncer; # Added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
+  vdirsyncerStable = vdirsyncer; # Added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
   ventoy-bin = ventoy; # Added 2023-04-12
   ventoy-bin-full = ventoy-full; # Added 2023-04-12
   ViennaRNA = viennarna; # Added 2023-08-23
@@ -1163,7 +1173,7 @@ mapAliases ({
   });
 
   /* If these are in the scope of all-packages.nix, they cause collisions
-  between mixed versions of qt. See:
+    between mixed versions of qt. See:
   https://github.com/NixOS/nixpkgs/pull/101369 */
 
   inherit (plasma5Packages)
@@ -1186,9 +1196,9 @@ mapAliases ({
     plasma-vault plasma-workspace plasma-workspace-wallpapers polkit-kde-agent
     powerdevil qqc2-breeze-style sddm-kcm skanlite skanpage spectacle
     systemsettings xdg-desktop-portal-kde yakuake zanshin
-  ;
+    ;
 
-  kalendar = merkuro;  # Renamed in 23.08
+  kalendar = merkuro; # Renamed in 23.08
   kfloppy = throw "kfloppy has been removed upstream in KDE Gear 23.08";
 
   inherit (plasma5Packages.thirdParty)
@@ -1199,11 +1209,11 @@ mapAliases ({
     kwin-tiling
     plasma-applet-caffeine-plus
     plasma-applet-virtual-desktop-bar
-  ;
+    ;
 
   inherit (libsForQt5)
     sddm
-  ;
+    ;
 
   inherit (pidginPackages)
     pidgin-indicator
@@ -1231,6 +1241,6 @@ mapAliases ({
     tdlib-purple
     pidgin-opensteamworks
     purple-facebook
-  ;
+    ;
 
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ccc43ee737be..4bf30acaf668 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -184,6 +184,9 @@ with pkgs;
   autoreconfHook269 = autoreconfHook.override {
     autoconf = autoconf269;
   };
+  autoreconfHook271 = autoreconfHook.override {
+    autoconf = autoconf271;
+  };
 
   autorestic = callPackage ../tools/backup/autorestic { };
 
@@ -1424,7 +1427,7 @@ with pkgs;
 
   desktopToDarwinBundle = makeSetupHook {
     name = "desktop-to-darwin-bundle-hook";
-    propagatedBuildInputs = [ writeDarwinBundle librsvg imagemagick python3Packages.icnsutil ];
+    propagatedBuildInputs = [ writeDarwinBundle librsvg imagemagick_light python3Packages.icnsutil ];
   } ../build-support/setup-hooks/desktop-to-darwin-bundle.sh;
 
   keepBuildTree = makeSetupHook {
@@ -7339,6 +7342,7 @@ with pkgs;
     gsaslSupport = true;
     rtmpSupport = true;
     pslSupport = true;
+    websocketSupport = true;
   };
 
   curlHTTP3 = curl.override {
@@ -15815,7 +15819,6 @@ with pkgs;
   default-gcc-version =
     if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
     else if stdenv.buildPlatform.isDarwin  then 12  # unable to test
-    else if stdenv.buildPlatform.isAarch64 then 12  # unable to test
     else 13;
   gcc = pkgs.${"gcc${toString default-gcc-version}"};
   gccFun = callPackage ../development/compilers/gcc;
@@ -18466,14 +18469,13 @@ with pkgs;
 
   autobuild = callPackage ../development/tools/misc/autobuild { };
 
-  autoconf = autoconf271;
-
   autoconf-archive = callPackage ../development/tools/misc/autoconf-archive { };
 
+  autoconf = callPackage ../development/tools/misc/autoconf { };
   autoconf213 = callPackage ../development/tools/misc/autoconf/2.13.nix { };
   autoconf264 = callPackage ../development/tools/misc/autoconf/2.64.nix { };
   autoconf269 = callPackage ../development/tools/misc/autoconf/2.69.nix { };
-  autoconf271 = callPackage ../development/tools/misc/autoconf { };
+  autoconf271 = callPackage ../development/tools/misc/autoconf/2.71.nix { };
 
   acr  = callPackage ../development/tools/misc/acr { };
 
@@ -23362,6 +23364,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Foundation;
   };
 
+  libplacebo_5 = callPackage ../development/libraries/libplacebo/5.nix { };
   libplacebo = callPackage ../development/libraries/libplacebo { };
 
   libpng = callPackage ../development/libraries/libpng { };
@@ -25523,6 +25526,7 @@ with pkgs;
   vulkan-tools-lunarg = callPackage ../tools/graphics/vulkan-tools-lunarg { };
   vulkan-utility-libraries = callPackage ../development/libraries/vulkan-utility-libraries { };
   vulkan-validation-layers = callPackage ../development/tools/vulkan-validation-layers { };
+  vulkan-volk = callPackage ../development/libraries/vulkan-volk { };
 
   vxl = callPackage ../development/libraries/vxl { };
 
@@ -27645,14 +27649,13 @@ with pkgs;
 
   blktrace = callPackage ../os-specific/linux/blktrace { };
 
-  bluez5 = callPackage ../os-specific/linux/bluez { };
+  bluez5 = bluez;
+  bluez5-experimental = bluez-experimental;
 
-  bluez5-experimental = callPackage ../os-specific/linux/bluez {
-    withExperimental = true;
+  bluez-experimental = bluez.override {
+    enableExperimental = true;
   };
 
-  bluez = bluez5;
-
   bolt = callPackage ../os-specific/linux/bolt { };
 
   bpf-linker = callPackage ../development/tools/bpf-linker { };
@@ -28347,8 +28350,6 @@ with pkgs;
 
   go-outline = callPackage ../development/tools/go-outline { };
 
-  gocode = callPackage ../development/tools/gocode { };
-
   gocode-gomod = callPackage ../development/tools/gocode-gomod { };
 
   goconst = callPackage ../development/tools/goconst { };
@@ -28717,6 +28718,7 @@ with pkgs;
     withHomed = false;
     withHwdb = false;
     withImportd = false;
+    withIptables = false;
     withLibBPF = false;
     withLibidn2 = false;
     withLocaled = false;
@@ -28740,6 +28742,9 @@ with pkgs;
     withUserDb = false;
     withUkify = false;
     withBootloader = false;
+    withPasswordQuality = false;
+    withVmspawn = false;
+    withQrencode = false;
   };
   systemdLibs = systemdMinimal.override {
     pname = "systemd-minimal-libs";
@@ -34213,6 +34218,10 @@ with pkgs;
   };
 
   mupdf = callPackage ../applications/misc/mupdf { };
+  mupdf-headless = mupdf.override {
+    enableX11 = false;
+    enableGL = false;
+  };
   mupdf_1_17 = callPackage ../applications/misc/mupdf/1.17 { };
 
   muso = callPackage ../applications/audio/muso {
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index dc71b01f3c26..9017edd70126 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -458,6 +458,8 @@ in {
 
     facetimehd = callPackage ../os-specific/linux/facetimehd { };
 
+    rust-out-of-tree-module = if lib.versionAtLeast kernel.version "6.7" then callPackage ../os-specific/linux/rust-out-of-tree-module { } else null;
+
     tuxedo-keyboard = if lib.versionAtLeast kernel.version "4.14" then callPackage ../os-specific/linux/tuxedo-keyboard { } else null;
 
     jool = callPackage ../os-specific/linux/jool { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 067e702b76d5..8f1880f6bdc8 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -354,6 +354,7 @@ mapAliases ({
   pyramid_multiauth = pyramid-multiauth; # added 2023-08-24
   pyreadability = readability-lxml; # added 2022-05-24
   pyres = throw "pyres has been removed, since it is abandoned and broken"; # added 2023-06-20
+  pyRFC3339 = pyrfc3339; # added 2024-01-07
   pyroute2-core = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
   pyroute2-ethtool = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
   pyroute2-ipdb = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9ddfadf07d4a..4e06813cc393 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2556,10 +2556,10 @@ self: super: with self; {
   cython = callPackage ../development/python-modules/cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.6";
+    version = "3.0.7";
     src = old.src.override {
       inherit version;
-      hash = "sha256-OZ0YVnLGZ7Juq73KQgyYVkWDeYrzvEdnCooJ6fGd1mA=";
+      hash = "sha256-+ymazzpXhXPBkMhY1J4M+ddfS8ScPyTFpjgEmX7wkhM=";
     };
     patches = [ ];
   });
@@ -11141,7 +11141,7 @@ self: super: with self; {
 
   pyrituals = callPackage ../development/python-modules/pyrituals { };
 
-  pyRFC3339 = callPackage ../development/python-modules/pyrfc3339 { };
+  pyrfc3339 = callPackage ../development/python-modules/pyrfc3339 { };
 
   pyrmvtransport = callPackage ../development/python-modules/pyrmvtransport { };
 
diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index 40faa7642129..bcbbd6799d88 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -174,8 +174,8 @@ let
       darwin = pkgs.darwin.basic_cmds;
     };
     xxd = {
-      linux = pkgs.vim;
-      darwin = pkgs.vim;
+      linux = pkgs.vim.xxd;
+      darwin = pkgs.vim.xxd;
     };
   };