diff --git a/nixos/modules/programs/wayland/hyprland.nix b/nixos/modules/programs/wayland/hyprland.nix
index 5891ff25e437..e648eaa1b68e 100644
--- a/nixos/modules/programs/wayland/hyprland.nix
+++ b/nixos/modules/programs/wayland/hyprland.nix
@@ -42,6 +42,15 @@ in
 
     xwayland.enable = mkEnableOption ("XWayland") // { default = true; };
 
+    envVars.enable = mkEnableOption null // {
+      default = true;
+      example = false;
+      description = ''
+        Set environment variables for Hyprland to work properly.
+        Enabled by default.
+      '';
+    };
+
     systemd.setPath.enable = mkEnableOption null // {
       default = true;
       example = false;
@@ -74,6 +83,15 @@ in
       configPackages = mkDefault [ cfg.finalPackage ];
     };
 
+    environment.sessionVariables = mkIf cfg.envVars.enable {
+      XDG_CURRENT_DESKTOP = "Hyprland";
+      XDG_SESSION_DESKTOP = "Hyprland";
+      XDG_SESSION_TYPE = "wayland";
+      GDK_BACKEND = "wayland,x11";
+      QT_QPA_PLATFORM = "wayland;xcb";
+      _JAVA_AWT_WM_NONREPARENTING = "1"; # Fix for Java applications on tiling window managers
+    };
+
     systemd = mkIf cfg.systemd.setPath.enable {
       user.extraConfig = ''
         DefaultEnvironment="PATH=$PATH:/run/current-system/sw/bin:/etc/profiles/per-user/%u/bin:/run/wrappers/bin"
diff --git a/pkgs/applications/audio/sonic-pi/default.nix b/pkgs/applications/audio/sonic-pi/default.nix
index 6635cb4784f9..c35a2a80643c 100644
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@@ -26,6 +26,7 @@
 , aubio
 , jack2
 , jack-example-tools
+, pipewire
 , supercollider-with-sc3-plugins
 , parallel
 
@@ -188,14 +189,14 @@ stdenv.mkDerivation rec {
   preFixup = ''
     # Wrap Qt GUI (distributed binary)
     wrapQtApp $out/bin/sonic-pi \
-      --prefix PATH : ${lib.makeBinPath [ ruby supercollider-with-sc3-plugins jack2 jack-example-tools ]}
+      --prefix PATH : ${lib.makeBinPath [ ruby supercollider-with-sc3-plugins jack2 jack-example-tools pipewire.jack ]}
 
     # If ImGui was built
     if [ -e $out/app/build/gui/imgui/sonic-pi-imgui ]; then
       # Wrap ImGui into bin
       makeWrapper $out/app/build/gui/imgui/sonic-pi-imgui $out/bin/sonic-pi-imgui \
         --inherit-argv0 \
-        --prefix PATH : ${lib.makeBinPath [ ruby supercollider-with-sc3-plugins jack2 jack-example-tools ]}
+        --prefix PATH : ${lib.makeBinPath [ ruby supercollider-with-sc3-plugins jack2 jack-example-tools pipewire.jack ]}
     fi
 
     # Remove runtime Erlang references
diff --git a/pkgs/applications/blockchains/optimism/default.nix b/pkgs/applications/blockchains/optimism/default.nix
index 7e368b3e686a..fcd5245d095d 100644
--- a/pkgs/applications/blockchains/optimism/default.nix
+++ b/pkgs/applications/blockchains/optimism/default.nix
@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "optimism";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "ethereum-optimism";
     repo = "optimism";
     rev = "op-node/v${version}";
-    hash = "sha256-KKCVjGBQeO5K6wq3GV3f7qaGY1uXNPI27w4DEC31pzU=";
+    hash = "sha256-220fnMJDgvdGJtN0XkKtqNP94KfbmN5qhghfjHJaAxQ=";
     fetchSubmodules = true;
   };
 
   subPackages = [ "op-node/cmd" "op-proposer/cmd" "op-batcher/cmd" ];
 
-  vendorHash = "sha256-pQhNXOYohBoV5QsBnNpNjFg+Vvk5jK1zvSKkolp4yiQ=";
+  vendorHash = "sha256-yG910xpk2MHCD2LHh7aD09KMCux1X252fOHCsyUc/ks=";
 
   buildInputs = [
     libpcap
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index 1be9814b5e17..dd4ea3093744 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -85,10 +85,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-psx-libretro",
-            "rev": "ab39d37f868ba8ff3982ce52c4ec22c162888dd7",
-            "hash": "sha256-Ay3wI9WToSsJNjkNFnHXTt9JUQ6nt+S9jI378E/kK8U="
+            "rev": "866df6445c9863ba03395211cd814224a59f7511",
+            "hash": "sha256-D0Qv6EOAOfmoScv8EzqWbr8SLRl8lH5Rqj/BksQe70k="
         },
-        "version": "unstable-2024-04-19"
+        "version": "unstable-2024-04-26"
     },
     "beetle-saturn": {
         "fetcher": "fetchFromGitHub",
@@ -165,10 +165,10 @@
         "src": {
             "owner": "libretro",
             "repo": "bsnes-libretro",
-            "rev": "51b378454e34f7535f8b627de5b81d33b0fa4cb0",
-            "hash": "sha256-oriFvt0RCt9Bd5DjjLSxMuswfazd31isvt5OxwwNuks="
+            "rev": "8767988ec91357f4e66143525b74b5ddbdedda8d",
+            "hash": "sha256-psSCB0A0nB/Rs4V4Yo/cY/BWpXyiCRH3pd6+JKvu6UU="
         },
-        "version": "unstable-2024-03-22"
+        "version": "unstable-2024-04-26"
     },
     "bsnes-hd": {
         "fetcher": "fetchFromGitHub",
@@ -307,11 +307,11 @@
         "src": {
             "owner": "flyinghead",
             "repo": "flycast",
-            "rev": "3c38fc1f16cc6518db46a5ad350e8b3738eefb48",
-            "hash": "sha256-NfJJcu7noefSgFlCFCgovnrb6FSzIXu3MGQHu6TCJWo=",
+            "rev": "8e96590065fd23cd37a0d426d30f4aef6587d860",
+            "hash": "sha256-NUwqrQqrKthxrToGx70uWtSoU0dp2/KlCiinW/fDwnE=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-04-19"
+        "version": "unstable-2024-04-26"
     },
     "fmsx": {
         "fetcher": "fetchFromGitHub",
@@ -358,10 +358,10 @@
         "src": {
             "owner": "libretro",
             "repo": "Genesis-Plus-GX",
-            "rev": "cbacea723690e88e0b11a4b1d0e5b88b1b7eb9d4",
-            "hash": "sha256-7qFBzATlhf89ILHsEoF+SWwD4Pwd5+08VnK5xU1EDuI="
+            "rev": "4e359c1f9c9a77db726c702c073d82905c24da7f",
+            "hash": "sha256-0DpIk+aV0NCkF5XDhO3FwMnV3J/ZERjCcSL7o1CvBuc="
         },
-        "version": "unstable-2024-04-20"
+        "version": "unstable-2024-04-26"
     },
     "gpsp": {
         "fetcher": "fetchFromGitHub",
@@ -408,10 +408,10 @@
         "src": {
             "owner": "libretro",
             "repo": "mame",
-            "rev": "170929e08e13fef6f5284efb0a5ec781a2af08ed",
-            "hash": "sha256-92p6fKN1/kl101qrNMzjOCQJJznTdbteqXpbas36S2c="
+            "rev": "90714f5cdefb2024dc34fdf3a62bd0d3815460ce",
+            "hash": "sha256-5Fd57fLIEKxr5KaHywGyHgA29midWpWEFotvudQKtjs="
         },
-        "version": "unstable-2024-04-10"
+        "version": "unstable-2024-04-26"
     },
     "mame2000": {
         "fetcher": "fetchFromGitHub",
@@ -600,10 +600,10 @@
         "src": {
             "owner": "libretro",
             "repo": "opera-libretro",
-            "rev": "35e16483be900ea8aa20e87d2710b677437f73ce",
-            "hash": "sha256-ZNHSxI8l0KGJ6uAvOsEhNpB0IkBxtb9Imj3tA/LiOto="
+            "rev": "cacba231c3bd71833f06943e230fe03d8ebec0ab",
+            "hash": "sha256-pWLcolQw5ctWrL7YQUaUK04QPS4ReUeJhdig3O5T8BM="
         },
-        "version": "unstable-2024-01-13"
+        "version": "unstable-2024-04-24"
     },
     "parallel-n64": {
         "fetcher": "fetchFromGitHub",
@@ -630,10 +630,10 @@
         "src": {
             "owner": "libretro",
             "repo": "pcsx_rearmed",
-            "rev": "e5cb0939ab32d3c3b90b39e2d49a1652a7cf0db1",
-            "hash": "sha256-K96w3NGXpsnVAmORPdwwhwIJ6PcvaDOEUtLkF4ftX3s="
+            "rev": "87a0a6318564fc171d0b576da8ea7e629aa229e7",
+            "hash": "sha256-quIvyfigl/4itSldj73HpZezeHQwVGlz/jQvwmmsDik="
         },
-        "version": "unstable-2024-04-18"
+        "version": "unstable-2024-04-22"
     },
     "picodrive": {
         "fetcher": "fetchFromGitHub",
@@ -651,11 +651,11 @@
         "src": {
             "owner": "jpd002",
             "repo": "Play-",
-            "rev": "57f8a1389f7f2987ab2ad99fdc846663994603ad",
-            "hash": "sha256-MwqLSTDL6C823grCMRYZrwjhIhbVipAR+4vF5k8UhyE=",
+            "rev": "07c1898303a9af41f5e91172b6b73ddf2f97b984",
+            "hash": "sha256-lOeoIHSahWoLxmLje1XwFc9wOVbDDUwIuE7BuSU5QSU=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-04-15"
+        "version": "unstable-2024-04-17"
     },
     "ppsspp": {
         "fetcher": "fetchFromGitHub",
@@ -753,10 +753,10 @@
         "src": {
             "owner": "snes9xgit",
             "repo": "snes9x",
-            "rev": "8077396d399424de89d0a6cc15134523965658e0",
-            "hash": "sha256-p6apk/8bRKSM3H3hGPr/fYGsDFgMv7syVmTHV0zgmOg="
+            "rev": "af4ec50b16f267245350ab099dde62a38aec66bd",
+            "hash": "sha256-B9F1mn2Hd23OO3bK21Fj5hQXX+fnnoeVJAkE0mO+9jI="
         },
-        "version": "unstable-2024-04-20"
+        "version": "unstable-2024-04-25"
     },
     "snes9x2002": {
         "fetcher": "fetchFromGitHub",
@@ -813,10 +813,10 @@
         "src": {
             "owner": "libretro",
             "repo": "swanstation",
-            "rev": "c7fefb5bfdec2569c2528f8daa6e75b7a3de0880",
-            "hash": "sha256-dE8F/NXGIEMrdmBWUTzanCSlT0ddkwG8RLZFmy1XvzQ="
+            "rev": "6ed491d6ba46ac8ba64a580b3004a163c0725bd2",
+            "hash": "sha256-JRo1+zFBBtO0Ws7x32bltcm5WoDSIZBgLdPl75lpKAo="
         },
-        "version": "unstable-2024-04-18"
+        "version": "unstable-2024-04-26"
     },
     "tgbdual": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/emulators/retroarch/retroarch-assets.nix b/pkgs/applications/emulators/retroarch/retroarch-assets.nix
index eba4a7102196..29f58b99653f 100644
--- a/pkgs/applications/emulators/retroarch/retroarch-assets.nix
+++ b/pkgs/applications/emulators/retroarch/retroarch-assets.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "retroarch-assets";
-  version = "unstable-2024-04-18";
+  version = "unstable-2024-04-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "retroarch-assets";
-    rev = "912f652740986549f41967d615d9da27c325c2b9";
-    hash = "sha256-HpmRnbj6CQp7+rmZY46MyT8Ga6832COm1it2z9rKUEU=";
+    rev = "9c0bd0d1015889592ad4362b800ac90ff4d019e1";
+    hash = "sha256-DB4i4iKx174822OJwJ5QIuMBLywufcR4+4Y+R01W+KQ=";
   };
 
   makeFlags = [
diff --git a/pkgs/applications/graphics/processing/default.nix b/pkgs/applications/graphics/processing/default.nix
index 5f6eb4a67768..d71ded259e83 100644
--- a/pkgs/applications/graphics/processing/default.nix
+++ b/pkgs/applications/graphics/processing/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, ant, unzip, makeWrapper, jdk, jogl, rsync, ffmpeg, batik, wrapGAppsHook3, libGL }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, ant, unzip, makeWrapper, jdk, jogl, rsync, ffmpeg, batik, stripJavaArchivesHook, wrapGAppsHook3, libGL }:
 let
   buildNumber = "1293";
   vaqua = fetchurl {
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-SzQemZ6iZ9o89/doV8YMv7DmyPSDyckJl3oyxJyfrm0=";
   };
 
-  nativeBuildInputs = [ ant unzip makeWrapper wrapGAppsHook3 ];
+  nativeBuildInputs = [ ant unzip makeWrapper stripJavaArchivesHook wrapGAppsHook3 ];
   buildInputs = [ jdk jogl ant rsync ffmpeg batik ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/misc/sweethome3d/default.nix b/pkgs/applications/misc/sweethome3d/default.nix
index bc429817d55a..4745a942304a 100644
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@@ -6,6 +6,7 @@
 , makeDesktopItem
 , jdk
 , ant
+, stripJavaArchivesHook
 , gtk3
 , gsettings-desktop-schemas
 , p7zip
@@ -51,7 +52,7 @@ let
       find . -name '*.so' | xargs strings | { grep '/nix/store' || :; } >> ./.jar-paths
     '';
 
-    nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
+    nativeBuildInputs = [ makeWrapper autoPatchelfHook stripJavaArchivesHook ];
     buildInputs = [ ant jdk p7zip gtk3 gsettings-desktop-schemas libXxf86vm ];
 
     # upstream targets Java 7 by default
diff --git a/pkgs/applications/misc/sweethome3d/editors.nix b/pkgs/applications/misc/sweethome3d/editors.nix
index f4fe14fb6751..a426494b61f6 100644
--- a/pkgs/applications/misc/sweethome3d/editors.nix
+++ b/pkgs/applications/misc/sweethome3d/editors.nix
@@ -5,6 +5,7 @@
 , makeDesktopItem
 , jdk
 , ant
+, stripJavaArchivesHook
 , gtk3
 , gsettings-desktop-schemas
 , sweethome3dApp
@@ -33,7 +34,7 @@ let
       categories = [ "Graphics" "2DGraphics" "3DGraphics" ];
     };
 
-    nativeBuildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper stripJavaArchivesHook ];
     buildInputs = [ ant jdk gtk3 gsettings-desktop-schemas ];
 
     # upstream targets Java 7 by default
diff --git a/pkgs/applications/networking/remote/anydesk/default.nix b/pkgs/applications/networking/remote/anydesk/default.nix
index 08e428b18b07..5053de0ecb35 100644
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@@ -7,14 +7,14 @@ let
   description = "Desktop sharing application, providing remote support and online meetings";
 in stdenv.mkDerivation rec {
   pname = "anydesk";
-  version = "6.3.1";
+  version = "6.3.2";
 
   src = fetchurl {
     urls = [
       "https://download.anydesk.com/linux/anydesk-${version}-amd64.tar.gz"
       "https://download.anydesk.com/linux/generic-linux/anydesk-${version}-amd64.tar.gz"
     ];
-    hash = "sha256-qVksva6+EfAQiOexP8NlDSCR5Ab2WGsuCG4BD87rlag=";
+    hash = "sha256-nSY4qHRsEvQk4M3JDHalAk3C6Y21WlfDQ2Gpp6/jjMs=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/radio/quisk/default.nix b/pkgs/applications/radio/quisk/default.nix
index c5034bd33efc..8fa180e705c6 100644
--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@@ -8,11 +8,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quisk";
-  version = "4.2.31";
+  version = "4.2.32";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-WzB/KAkjJ6zPPfOe35kbT3HbbCNQjm44GL0hInk3TH8=";
+    sha256 = "sha256-zzcygf7oVICO2/wfgyej1GD78fQB1xNRGHq19w6K4uY=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/git-credential-oauth/default.nix b/pkgs/applications/version-management/git-credential-oauth/default.nix
index c818874392af..5672fb95e499 100644
--- a/pkgs/applications/version-management/git-credential-oauth/default.nix
+++ b/pkgs/applications/version-management/git-credential-oauth/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-credential-oauth";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "hickford";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bqyoAAqli0L6Kf+W1sTh2vmmfaIj2OdpQyvQZnYOWWA=";
+    hash = "sha256-dGn1I47/S6DYXva5zjvcQnB+I4Ex354xMmZ/3OkpjMw=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -19,7 +19,7 @@ buildGoModule rec {
     "-X main.version=${version}"
   ];
 
-  vendorHash = "sha256-cCqbEv4kBnF6FWvfaXCOxadPVXR/AxXS3nXHf6WmsSs=";
+  vendorHash = "sha256-nbwrVihcH+ARLHylsjogsv3LVP+0+YtQ+7cozB7pAWo=";
 
   postInstall = ''
     installManPage $src/git-credential-oauth.1
diff --git a/pkgs/applications/video/clapper/default.nix b/pkgs/applications/video/clapper/default.nix
index 6d1539f93575..97285e6e1415 100644
--- a/pkgs/applications/video/clapper/default.nix
+++ b/pkgs/applications/video/clapper/default.nix
@@ -2,9 +2,7 @@
 , lib
 , stdenv
 , fetchFromGitHub
-, glib
 , gobject-introspection
-, python3
 , pkg-config
 , ninja
 , wayland
@@ -14,42 +12,41 @@
 , shared-mime-info
 , wrapGAppsHook4
 , meson
-, gjs
 , gtk4
 , gst_all_1
 , libGL
 , libadwaita
-, appstream-glib
-, libsoup
+, libsoup_3
+, vala
+, cmake
+, libmicrodns
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "clapper";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner  = "Rafostar";
-    repo   = pname;
-    rev    = version;
-    sha256 = "sha256-s+qdTq3/pHHstwr1W3Hs2Zje++iJFHM6hQTFoZD43bY=";
+    repo   = "clapper";
+    rev    = finalAttrs.version;
+    hash = "sha256-5fD1OnVcY3ZC+QfoFqe2jV43/J36r85SpLUYF2ti7dY=";
   };
 
   nativeBuildInputs = [
-    appstream-glib
-    desktop-file-utils # for update-desktop-database
-    glib
     gobject-introspection
     meson
+    cmake
     ninja
     makeWrapper
     pkg-config
-    python3
-    shared-mime-info # for update-mime-database
     wrapGAppsHook4 # for gsettings
+    desktop-file-utils # for update-desktop-database
+    shared-mime-info # for update-mime-database
+    vala
   ];
 
   buildInputs = [
-    gjs
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
@@ -58,29 +55,25 @@ stdenv.mkDerivation rec {
     gtk4
     libGL
     libadwaita
-    libsoup
+    libsoup_3
     wayland
     wayland-protocols
+    libmicrodns
   ];
 
   postPatch = ''
-    patchShebangs build-aux/meson/postinstall.py
-  '';
-
-  postInstall = ''
-    cp ${src}/data/icons/*.svg $out/share/icons/hicolor/scalable/apps/
-    cp ${src}/data/icons/*.svg $out/share/icons/hicolor/symbolic/apps/
+    patchShebangs --build build-aux/meson/postinstall.py
   '';
 
   meta = with lib; {
-    description = "A GNOME media player built using GJS with GTK4 toolkit and powered by GStreamer with OpenGL rendering. ";
+    description = "A GNOME media player built using GTK4 toolkit and powered by GStreamer with OpenGL rendering";
     longDescription = ''
-      Clapper is a GNOME media player build using GJS with GTK4 toolkit.
-      The media player is using GStreamer as a media backend and renders everything via OpenGL.
+      Clapper is a GNOME media player built using the GTK4 toolkit.
+      The media player is using GStreamer as a media backend.
     '';
     homepage = "https://github.com/Rafostar/clapper";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index d98acd70ac5c..f2f340b257db 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -3,13 +3,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.0.5";
+  version = "7.0.6";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-oM1n0Rye2QagxXoAZ/6mXKeGqKjEdewgS79lhp+yCQI=";
+    hash = "sha256-pxW45D/tppUTTgeR5wVteOP2f4TZ4wl/9A5IBhOZhTM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/video/mpv/scripts/mpv-webm.nix b/pkgs/applications/video/mpv/scripts/mpv-webm.nix
index 5645d6a65f6b..e2411264c7b5 100644
--- a/pkgs/applications/video/mpv/scripts/mpv-webm.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-webm.nix
@@ -7,13 +7,13 @@
 
 buildLua {
   pname = "mpv-webm";
-  version = "unstable-2023-11-18";
+  version = "unstable-2024-04-22";
 
   src = fetchFromGitHub {
     owner = "ekisu";
     repo = "mpv-webm";
-    rev = "6b5863f68275b3dc91c2507284c039ec8a4cbd97";
-    hash = "sha256-rJamBm6FyxWcJO7VXXOUTO9piWCkPfEVdqGKGeJ/h0c=";
+    rev = "225e8e53842f7da6f77034309c1e54293dc629a4";
+    hash = "sha256-82xWiuOChxfzX6e0+cGFxTqyuiPefyVwpvLM5ka7nPk=";
   };
   passthru.updateScript = unstableGitUpdater {};
 
diff --git a/pkgs/by-name/ch/chezmoi/package.nix b/pkgs/by-name/ch/chezmoi/package.nix
new file mode 100644
index 000000000000..b808e0920643
--- /dev/null
+++ b/pkgs/by-name/ch/chezmoi/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+
+let
+  argset = {
+    pname = "chezmoi";
+    version = "2.48.0";
+
+    src = fetchFromGitHub {
+      owner = "twpayne";
+      repo = "chezmoi";
+      rev = "v${argset.version}";
+      hash = "sha256-TclY4O5mA14cI7+qvGwt5jSHftxhGaa3ICVn8qdrKqs=";
+    };
+
+    vendorHash = "sha256-qoXfneNEAsvUgaEFHPF1bf/S8feFX+8HtwQy7nzy8Bo=";
+
+    nativeBuildInputs = [
+      installShellFiles
+    ];
+
+    ldflags = [
+      "-s"
+      "-w"
+      "-X main.version=${argset.version}"
+      "-X main.builtBy=nixpkgs"
+    ];
+
+    doCheck = false;
+
+    postInstall = ''
+      installShellCompletion --bash --name chezmoi.bash completions/chezmoi-completion.bash
+      installShellCompletion --fish completions/chezmoi.fish
+      installShellCompletion --zsh completions/chezmoi.zsh
+    '';
+
+    subPackages = [ "." ];
+
+    meta = {
+      homepage = "https://www.chezmoi.io/";
+      description = "Manage your dotfiles across multiple machines, securely";
+      changelog = "https://github.com/twpayne/chezmoi/releases/tag/${argset.src.rev}";
+      license = lib.licenses.mit;
+      mainProgram = "chezmoi";
+      maintainers = with lib.maintainers; [ AndersonTorres ];
+    };
+  };
+in
+buildGoModule argset
diff --git a/pkgs/by-name/cr/crunchy-cli/Cargo.lock b/pkgs/by-name/cr/crunchy-cli/Cargo.lock
index 3e16a615852a..61832fee845b 100644
--- a/pkgs/by-name/cr/crunchy-cli/Cargo.lock
+++ b/pkgs/by-name/cr/crunchy-cli/Cargo.lock
@@ -199,9 +199,9 @@ checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "cc"
-version = "1.0.94"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17f6e324229dc011159fcc089755d1e2e216a90d43a7dea6853ca740b84f35e7"
+checksum = "d32a725bc159af97c3e629873bb9f88fb8cf8a4867175f76dc987815ea07c83b"
 
 [[package]]
 name = "cfg-if"
@@ -354,7 +354,7 @@ checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "crunchy-cli"
-version = "3.5.0"
+version = "3.5.2"
 dependencies = [
  "chrono",
  "clap",
@@ -367,7 +367,7 @@ dependencies = [
 
 [[package]]
 name = "crunchy-cli-core"
-version = "3.5.0"
+version = "3.5.2"
 dependencies = [
  "anyhow",
  "async-speed-limit",
@@ -404,9 +404,9 @@ dependencies = [
 
 [[package]]
 name = "crunchyroll-rs"
-version = "0.10.8"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccd0a624f3f8ec3fb7af8d83b907142aaee1858579ab697f24f05d00736e5bb2"
+checksum = "e63a541bdcf0170a29eab4015943e8a6a09281334b4beacd70ac5cfc1c19496b"
 dependencies = [
  "async-trait",
  "chrono",
@@ -430,9 +430,9 @@ dependencies = [
 
 [[package]]
 name = "crunchyroll-rs-internal"
-version = "0.10.8"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85c3614a871ec25ab17425405b08aea3c5869597e2348302b922c2a077aa9c3a"
+checksum = "3a9e0e09162451565645fdd4dadc6b38e09f3aafcfb477153584bedd8d62a358"
 dependencies = [
  "darling",
  "quote",
@@ -1563,9 +1563,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.32"
+version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
  "bitflags 2.5.0",
  "errno",
@@ -1613,15 +1613,15 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.4.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecd36cc4259e3e4514335c4a138c6b43171a8d61d8f5c9348f9fc7529416f247"
+checksum = "beb461507cee2c2ff151784c52762cf4d9ff6a61f3e80968600ed24fa837fa54"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.102.2"
+version = "0.102.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
+checksum = "f3bce581c0dd41bce533ce695a1437fa16a7ab5ac3ccfa99fe1a620a7885eabf"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -1730,11 +1730,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.7.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee80b0e361bbf88fd2f6e242ccd19cfda072cb0faa6ae694ecee08199938569a"
+checksum = "2c85f8e96d1d6857f13768fcbd895fcb06225510022a2774ed8b5150581847b0"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.0",
  "chrono",
  "hex",
  "indexmap 1.9.3",
@@ -1748,9 +1748,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.7.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6561dc161a9224638a31d876ccdfefbc1df91d3f3a8342eddb35f055d48c7655"
+checksum = "c8b3a576c4eb2924262d5951a3b737ccaf16c931e39a2810c36f9a7e25575557"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -1897,18 +1897,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.58"
+version = "1.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
+checksum = "f0126ad08bff79f29fc3ae6a55cc72352056dfff61e3ff8bb7129476d44b23aa"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.58"
+version = "1.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
+checksum = "d1cd413b5d558b4c5bf3680e324a6fa5014e7b7c067a51e69dbdf47eb7148b66"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2498,9 +2498,9 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
+checksum = "63381fa6624bf92130a6b87c0d07380116f80b565c42cf0d754136f0238359ef"
 
 [[package]]
 name = "zune-core"
diff --git a/pkgs/by-name/cr/crunchy-cli/package.nix b/pkgs/by-name/cr/crunchy-cli/package.nix
index 1573090d58d6..1fc5711ef350 100644
--- a/pkgs/by-name/cr/crunchy-cli/package.nix
+++ b/pkgs/by-name/cr/crunchy-cli/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "crunchy-cli";
-  version = "3.5.0";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "crunchy-labs";
     repo = "crunchy-cli";
     rev = "v${version}";
-    hash = "sha256-ykE4TqsBv6VEOgwKixo8IvgJt8CwCSTl5DcKfNGycdI=";
+    hash = "sha256-20jsBIjl6WOs0X4ancWHUuAe2Qiv8s4w+EpEVE5Psvw=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/gt/gtk-session-lock/package.nix b/pkgs/by-name/gt/gtk-session-lock/package.nix
new file mode 100644
index 000000000000..713c9aa3c760
--- /dev/null
+++ b/pkgs/by-name/gt/gtk-session-lock/package.nix
@@ -0,0 +1,57 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, gobject-introspection
+, vala
+, gtk3
+, wayland-scanner
+, wayland
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtk-session-lock";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "Cu3PO42";
+    repo = "gtk-session-lock";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-SHKAYmdev08oRB/V6UpfSFqYwplF59IaNSOoWcACPig=";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    vala
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    gtk3
+    wayland
+  ];
+
+  # Tests are not fully prepared, but may be enabled in later versions
+  doCheck = false;
+
+  strictDeps = true;
+
+  meta = {
+    description = "A library to use GTK 3 to build screen lockers using ext-session-lock-v1 protocol";
+    homepage = "https://github.com/Cu3PO42/gtk-session-lock";
+    # The author stated "GTK Session Lock is licensed under the GNU General
+    # Public License version 3.0 or any later version approved by me (Cu3PO42)."
+    # Since we don't know if the author will approve later versions, we mark gpl3Only
+    license = with lib.licenses; [ gpl3Only ];
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.unix;
+    badPlatforms = lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/li/livekit/package.nix b/pkgs/by-name/li/livekit/package.nix
index b362366e51f6..74bc3b03e6ce 100644
--- a/pkgs/by-name/li/livekit/package.nix
+++ b/pkgs/by-name/li/livekit/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "livekit";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit";
     rev = "v${version}";
-    hash = "sha256-tgoVHRv8hnDkjFYShZ/3lieknhIobHv27RVvQOCtEWU=";
+    hash = "sha256-i6G221n6wIOYo//+w/4XN4QpTkt7AYwAw6RBYo66vXI=";
   };
 
-  vendorHash = "sha256-TZ435gu5naFi/JLz6B/1fpvGA3diJp4JIWL1zgNlb4Q=";
+  vendorHash = "sha256-7MPjhjTIO7ZKKyc0Du8+0F+8PvpiwiIBMnXZiYX2XyI=";
 
   subPackages = [ "cmd/server" ];
 
diff --git a/pkgs/by-name/mi/mini-calc/package.nix b/pkgs/by-name/mi/mini-calc/package.nix
index 2faa44a33894..fbd92b4177d0 100644
--- a/pkgs/by-name/mi/mini-calc/package.nix
+++ b/pkgs/by-name/mi/mini-calc/package.nix
@@ -1,23 +1,16 @@
-{ lib, rustPlatform, fetchpatch, fetchFromGitHub }:
+{ lib, rustPlatform, fetchFromGitHub }:
 rustPlatform.buildRustPackage rec {
   pname = "mini-calc";
-  version = "2.12.3";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "coco33920";
     repo = "calc";
     rev = version;
-    hash = "sha256-/aTfh3d63wwk3xai2F/D1fMJiDO4mg+OeLIanV4vSuA=";
+    hash = "sha256-rvQXn0VuOjB7CSf+bDTGxjeMKpbJGhVmyDLNYSy/Mlw=";
   };
 
-  cargoHash = "sha256-BfaOhEAKZmTYkzz6rvcSmDPufyQMJFtQO6CRksgA/2U=";
-  cargoPatches = [
-    (fetchpatch {
-      url = "https://github.com/coco33920/calc/commit/a010c72b5c06c75b7f644071f2861394dd5c74b8.patch";
-      sha256 = "sha256-ceyxfgiXHS+oOJ4apM8+cSjMICwGlQHMKjFICATmKTU=";
-    })
-  ];
-
+  cargoHash = "sha256-QFzrJBnGKAgDhjbbik0WP3Y1fNoHMAiWpEHfidFQGPk=";
   meta = {
     description = "A fully-featured minimalistic configurable calculator written in Rust";
     changelog = "https://github.com/coco33920/calc/blob/${version}/CHANGELOG.md";
diff --git a/pkgs/by-name/oe/oelint-adv/package.nix b/pkgs/by-name/oe/oelint-adv/package.nix
index 480d92a161eb..74a1f0c933b4 100644
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@@ -6,13 +6,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "oelint-adv";
-  version = "5.1.3";
+  version = "5.3.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_adv";
-    hash = "sha256-Jo3Z5hhZH0tzu4+RL+ElaenlWCRoIYANWGx5U2u9xy8=";
+    hash = "sha256-EAYHxp7pXXYNYRGsQ3XckRxDM1pFHgiZr+gj8fJLqa0=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/op/openrocket/package.nix b/pkgs/by-name/op/openrocket/package.nix
index 92b179bd36f2..384d84d9fa45 100644
--- a/pkgs/by-name/op/openrocket/package.nix
+++ b/pkgs/by-name/op/openrocket/package.nix
@@ -4,6 +4,7 @@
 , ant
 , jdk17
 , makeWrapper
+, stripJavaArchivesHook
 }:
 
 let
@@ -25,6 +26,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     ant
     jdk
     makeWrapper
+    stripJavaArchivesHook
   ];
 
   buildPhase = ''
diff --git a/pkgs/by-name/sc/scalingo/package.nix b/pkgs/by-name/sc/scalingo/package.nix
index 38f1a8691c51..db17f1fad6eb 100644
--- a/pkgs/by-name/sc/scalingo/package.nix
+++ b/pkgs/by-name/sc/scalingo/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "scalingo";
-  version = "1.31.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "cli";
     rev = version;
-    hash = "sha256-Y162BHTlerTbsRJ1KhT82iBMv+jI7Rq+h8JfBIV0uIs=";
+    hash = "sha256-kursqM0/HxTnEvrVxEd4YUiIG4I974JKZqkQTqP00ko=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/wl/wljoywake/package.nix b/pkgs/by-name/wl/wljoywake/package.nix
new file mode 100644
index 000000000000..209e61e9d184
--- /dev/null
+++ b/pkgs/by-name/wl/wljoywake/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, udev
+, wayland
+, wayland-protocols
+, wayland-scanner
+}:
+
+let
+  version = "0.3";
+in
+stdenv.mkDerivation {
+  pname = "wljoywake";
+  inherit version;
+
+  src = fetchFromGitHub {
+    repo = "wljoywake";
+    owner = "nowrep";
+    rev = "v${version}";
+    hash = "sha256-zSYNfsFjswaSXZPlIDMDC87NK/6AKtArHBeWCWDDR3E=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    udev
+    wayland
+    wayland-protocols
+  ];
+
+  meta = with lib; {
+    description = "Wayland tool for idle inhibit when using joysticks";
+    homepage = "https://github.com/nowrep/wljoywake";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.jtrees ];
+    mainProgram = "wljoywake";
+  };
+}
diff --git a/pkgs/data/fonts/font-awesome/default.nix b/pkgs/data/fonts/font-awesome/default.nix
index dfc808971b67..8705a07d2593 100644
--- a/pkgs/data/fonts/font-awesome/default.nix
+++ b/pkgs/data/fonts/font-awesome/default.nix
@@ -48,7 +48,7 @@ in
     hash = "sha256-gd23ZplNY56sm1lfkU3kPXUOmNmY5SRnT0qlQZRNuBo=";
   };
   v6 = font-awesome {
-    version = "6.4.2";
-    hash = "sha256-/utIhn7CWxlWXshcCUj57WuObRmLTGhTfQo7L6FDHqA=";
+    version = "6.5.2";
+    hash = "sha256-kUa/L/Krxb5v8SmtACCSC6CI3qTTOTr4Ss/FMRBlKuw=";
   };
 }
diff --git a/pkgs/development/embedded/arduino/arduino-core/default.nix b/pkgs/development/embedded/arduino/arduino-core/default.nix
index 965985339057..43e6292143a4 100644
--- a/pkgs/development/embedded/arduino/arduino-core/default.nix
+++ b/pkgs/development/embedded/arduino/arduino-core/default.nix
@@ -4,6 +4,7 @@
 , fetchurl
 , jdk
 , ant
+, stripJavaArchivesHook
 , libusb-compat-0_1
 , libusb1
 , unzip
@@ -112,7 +113,7 @@ stdenv.mkDerivation rec {
   # the glib setup hook will populate GSETTINGS_SCHEMAS_PATH,
   # wrapGAppHooks (among other things) adds it to XDG_DATA_DIRS
   # so 'save as...' works:
-  nativeBuildInputs = [ glib wrapGAppsHook3 unzip ];
+  nativeBuildInputs = [ glib stripJavaArchivesHook wrapGAppsHook3 unzip ];
   buildInputs = [
     jdk
     ant
diff --git a/pkgs/development/libraries/libqb/default.nix b/pkgs/development/libraries/libqb/default.nix
index 8e798e4a38a4..fe54cdf3d338 100644
--- a/pkgs/development/libraries/libqb/default.nix
+++ b/pkgs/development/libraries/libqb/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libxml2 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, libxml2 }:
 
 stdenv.mkDerivation rec {
   pname = "libqb";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ZjxC7W4U8T68mZy/OvWj/e4W9pJIj2lVDoEjxXYr/G8=";
   };
 
+  patches = [
+    # add a declaration of fdatasync, missing on darwin https://github.com/ClusterLabs/libqb/pull/496
+    (fetchpatch {
+      url = "https://github.com/ClusterLabs/libqb/commit/255ccb70ee19cc0c82dd13e4fd5838ca5427795f.patch";
+      hash = "sha256-6x4B3FM0XSRIeAly8JtMOGOdyunTcbaDzUeBZInXR4U=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ libxml2 ];
diff --git a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
index 7f8ab5b19a48..5504636c0443 100644
--- a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
@@ -1,25 +1,29 @@
-{ lib
-, azure-common
-, azure-mgmt-core
-, buildPythonPackage
-, fetchPypi
-, isodate
-, pythonOlder
+{
+  lib,
+  azure-common,
+  azure-mgmt-core,
+  buildPythonPackage,
+  fetchPypi,
+  isodate,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "azure-mgmt-recoveryservicesbackup";
-  version = "9.0.0";
-  format = "setuptools";
+  version = "9.1.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-H/SsO/DnHXSsSyejYX7BFem1GqPh20DRGecrYVkIu1E=";
+    hash = "sha256-Hp/UBsDJ7iYn9aNx8BL4dzQvf8bzOyVk/NFNbwZjzQ8=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     azure-common
     azure-mgmt-core
     isodate
@@ -28,9 +32,7 @@ buildPythonPackage rec {
   # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "azure.mgmt.recoveryservicesbackup"
-  ];
+  pythonImportsCheck = [ "azure.mgmt.recoveryservicesbackup" ];
 
   meta = with lib; {
     description = "This is the Microsoft Azure Recovery Services Backup Management Client Library";
diff --git a/pkgs/development/python-modules/jplephem/default.nix b/pkgs/development/python-modules/jplephem/default.nix
index 5a1a8ab3cb70..ada4c9552e5a 100644
--- a/pkgs/development/python-modules/jplephem/default.nix
+++ b/pkgs/development/python-modules/jplephem/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "jplephem";
-  version = "2.21";
+  version = "2.22";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NBlLYQaV8huJIXuYUrjautvOgISMs2nZVn7xLcSCjVU=";
+    hash = "sha256-DZrMche0gG/rqT5yl0zurVYREEvOZ4mvONTyfc96WSw=";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/kbcstorage/default.nix b/pkgs/development/python-modules/kbcstorage/default.nix
index 2c14e72bcf96..a10b8ddf7316 100644
--- a/pkgs/development/python-modules/kbcstorage/default.nix
+++ b/pkgs/development/python-modules/kbcstorage/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "sapi-python-client";
-  version = "0.7.2";
+  version = "0.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "keboola";
     repo = "sapi-python-client";
     rev = "refs/tags/${version}";
-    hash = "sha256-uZo2kEq7zIMGRlhX36kZyihQPZegw5XgVzgVQQOmpc4=";
+    hash = "sha256-Xc4VD91Nhnj0UyWHpdwEaETJVH8Ue6/kuiKEMaiSR0g=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pymongo/default.nix b/pkgs/development/python-modules/pymongo/default.nix
index c3659dee67db..1ca7ca08ad50 100644
--- a/pkgs/development/python-modules/pymongo/default.nix
+++ b/pkgs/development/python-modules/pymongo/default.nix
@@ -3,6 +3,14 @@
 , fetchPypi
 , pythonOlder
 , dnspython
+
+# for passthru.tests
+, celery  # check-input only
+, flask-pymongo
+, kombu  # check-input only
+, mongoengine
+, motor
+, pymongo-inmemory
 }:
 
 buildPythonPackage rec {
@@ -26,6 +34,17 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pymongo" ];
 
+  passthru.tests = {
+    inherit
+      celery
+      flask-pymongo
+      kombu
+      mongoengine
+      motor
+      pymongo-inmemory
+    ;
+  };
+
   meta = with lib; {
     description = "Python driver for MongoDB";
     homepage = "https://github.com/mongodb/mongo-python-driver";
diff --git a/pkgs/development/python-modules/pystemd/default.nix b/pkgs/development/python-modules/pystemd/default.nix
index 43d51869ffb8..6787c0a89782 100644
--- a/pkgs/development/python-modules/pystemd/default.nix
+++ b/pkgs/development/python-modules/pystemd/default.nix
@@ -30,7 +30,6 @@ buildPythonPackage rec {
   checkPhase = "pytest tests";
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64);
     description = ''
       Thin Cython-based wrapper on top of libsystemd, focused on exposing the
       dbus API via sd-bus in an automated and easy to consume way
diff --git a/pkgs/servers/matrix-synapse/sliding-sync/default.nix b/pkgs/servers/matrix-synapse/sliding-sync/default.nix
index 107f2c1abb8b..c8f545813538 100644
--- a/pkgs/servers/matrix-synapse/sliding-sync/default.nix
+++ b/pkgs/servers/matrix-synapse/sliding-sync/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "matrix-sliding-sync";
-  version = "0.99.15";
+  version = "0.99.16";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "sliding-sync";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9JYR9fBxtv+3E+l+l26jryqEstnOUm657VsKsDRzD9g=";
+    hash = "sha256-RMA6Nwdajd1ABaNGq4iGNhX+/FCVy8HcNPpcW/mWtcc=";
   };
 
   vendorHash = "sha256-THjvc0TepIBFOTte7t63Dmadf3HMuZ9m0YzQMI5e5Pw=";
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 7735f8951e54..3c9da505b607 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HlV+DeLI6/vYAYkp0ZM7z9uWC+nZLso6xlvCQJ2Imjg=";
+    hash = "sha256-9U1PBLAj4oWKyUWrBbrlqM4MldYlYN20W5VAWxQ9nq4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
   # hash mismatch with darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-yXl8f3f3XO8o80PkX6hS/12p80z4LczghdmY1Elp0aE=";
+  vendorHash = "sha256-UuQpO6iZN3ITQLj4xccEmxpmgfKSTigImlTPSvPgFyM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/bootloaders/refind/default.nix b/pkgs/tools/bootloaders/refind/default.nix
index 0a33305d10f7..a481bfdc37ab 100644
--- a/pkgs/tools/bootloaders/refind/default.nix
+++ b/pkgs/tools/bootloaders/refind/default.nix
@@ -24,11 +24,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "refind";
-  version = "0.14.0.2";
+  version = "0.14.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/refind/${version}/refind-src-${version}.tar.gz";
-    hash = "sha256-JqDFXf01ZUmeH4LY/ldGTb7xnKiGzm0BqBUii478iw8=";
+    hash = "sha256-99k86A2na4bFZygeoiW2qHkHzob/dyM8k1elIsEVyPA=";
   };
 
   patches = [
@@ -49,6 +49,9 @@ stdenv.mkDerivation rec {
       "EFICRT0=${gnu-efi}/lib"
       "HOSTARCH=${hostarch}"
       "ARCH=${hostarch}"
+    ] ++ lib.optional stdenv.isAarch64 [
+      # aarch64 is special for GNU-EFI, see BUILDING.txt
+      "GNUEFI_ARM64_TARGET_SUPPORT=y"
     ];
 
   buildFlags = [ "gnuefi" "fs_gnuefi" ];
diff --git a/pkgs/tools/filesystems/xtreemfs/default.nix b/pkgs/tools/filesystems/xtreemfs/default.nix
index 6c02117936da..a92369f49841 100644
--- a/pkgs/tools/filesystems/xtreemfs/default.nix
+++ b/pkgs/tools/filesystems/xtreemfs/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , makeWrapper
+, stripJavaArchivesHook
 , ant
 , attr
 , boost
@@ -28,7 +29,7 @@ stdenv.mkDerivation {
     sha256 = "1hjmd32pla27zf98ghzz6r5ml8ry86m9dsryv1z01kxv5l95b3m0";
   };
 
-  nativeBuildInputs = [ makeWrapper python3 ];
+  nativeBuildInputs = [ makeWrapper python3 stripJavaArchivesHook ];
   buildInputs = [ which attr ];
 
   patches = [
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
deleted file mode 100644
index e5c2e9407c79..000000000000
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, installShellFiles
-}:
-
-buildGoModule rec {
-  pname = "chezmoi";
-  version = "2.47.4";
-
-  src = fetchFromGitHub {
-    owner = "twpayne";
-    repo = "chezmoi";
-    rev = "v${version}";
-    hash = "sha256-clhW/Y+OJ7iQVK8I2xwoVT9rXF2CXRBaUxDZrREAjYc=";
-  };
-
-  vendorHash = "sha256-8Puy1IKLMENduWyOAJtvpd7FV1a0IdmkMYztIJdeaBs=";
-
-  doCheck = false;
-
-  ldflags = [
-    "-s" "-w" "-X main.version=${version}" "-X main.builtBy=nixpkgs"
-  ];
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = ''
-    installShellCompletion --bash --name chezmoi.bash completions/chezmoi-completion.bash
-    installShellCompletion --fish completions/chezmoi.fish
-    installShellCompletion --zsh completions/chezmoi.zsh
-  '';
-
-  subPackages = [ "." ];
-
-  meta = with lib; {
-    homepage = "https://www.chezmoi.io/";
-    description = "Manage your dotfiles across multiple machines, securely";
-    changelog = "https://github.com/twpayne/chezmoi/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ jhillyerd ];
-    mainProgram = "chezmoi";
-  };
-}
diff --git a/pkgs/tools/networking/grpc_cli/default.nix b/pkgs/tools/networking/grpc_cli/default.nix
index 993a0707bc80..9fac34f18bb0 100644
--- a/pkgs/tools/networking/grpc_cli/default.nix
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc_cli";
-  version = "1.62.2";
+  version = "1.63.0";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-LHR29QP0yyfKw9hr3SzkdP0WmHP2b4boBgTXgsiAqjs=";
+    hash = "sha256-xTDHd1VA7xjAnGNNwtk3vZuljVHZsjAzLc/uWdt+2Fs=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [ automake cmake autoconf ];
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index ff03f05ed1a4..4df7399683ed 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -100,27 +100,6 @@ let
     hash = "sha256-f+F0fUO+bqyPXjt+IXJtISVr589hdc3y+Cdrxznb+Nk=";
   };
 
-  # https://github.com/NixOS/nix/pull/7473
-  patch-sqlite-exception = fetchpatch2 {
-    name = "nix-7473-sqlite-exception-add-message.patch";
-    url = "https://github.com/hercules-ci/nix/commit/c965f35de71cc9d88f912f6b90fd7213601e6eb8.patch";
-    hash = "sha256-tI5nKU7SZgsJrxiskJ5nHZyfrWf5aZyKYExM0792N80=";
-  };
-
-  patch-non-existing-output = fetchpatch {
-    # https://github.com/NixOS/nix/pull/7283
-    name = "fix-requires-non-existing-output.patch";
-    url = "https://github.com/NixOS/nix/commit/3ade5f5d6026b825a80bdcc221058c4f14e10a27.patch";
-    hash = "sha256-s1ybRFCjQaSGj7LKu0Z5g7UiHqdJGeD+iPoQL0vaiS0=";
-  };
-
-  patch-rapidcheck-shared = fetchpatch2 {
-    # https://github.com/NixOS/nix/pull/9431
-    name = "fix-missing-librapidcheck.patch";
-    url = "https://github.com/NixOS/nix/commit/46131567da96ffac298b9ec54016b37114b0dfd5.patch";
-    hash = "sha256-lShYxYKRDWwBqCysAFmFBudhhAL1eendWcL8sEFLCGg=";
-  };
-
   # Intentionally does not support overrideAttrs etc
   # Use only for tests that are about the package relation to `pkgs` and/or NixOS.
   addTestsShallowly = tests: pkg: pkg // {
@@ -167,72 +146,6 @@ in lib.makeExtensible (self: ({
     enableParallelChecking = false;
   };
 
-  nix_2_10 = common {
-    version = "2.10.3";
-    hash = "sha256-B9EyDUz/9tlcWwf24lwxCFmkxuPTVW7HFYvp0C4xGbc=";
-    patches = [
-      ./patches/flaky-tests.patch
-      patch-non-existing-output
-      patch-monitorfdhup
-      patch-sqlite-exception
-    ];
-  };
-
-  nix_2_11 = common {
-    version = "2.11.1";
-    hash = "sha256-qCV65kw09AG+EkdchDPq7RoeBznX0Q6Qa4yzPqobdOk=";
-    patches = [
-      ./patches/flaky-tests.patch
-      patch-non-existing-output
-      patch-monitorfdhup
-      patch-sqlite-exception
-    ];
-  };
-
-  nix_2_12 = common {
-    version = "2.12.1";
-    hash = "sha256-GmHKhq0uFtdOiJnuBwj2YwlZjvh6YTkfQZgeu4e0dLU=";
-    patches = [
-      ./patches/flaky-tests.patch
-      patch-monitorfdhup
-      patch-sqlite-exception
-    ];
-  };
-
-  nix_2_13 = common {
-    version = "2.13.6";
-    hash = "sha256-pd2yGmHWn4njfbrSP6cMJx8qL+yeGieqcbLNICzcRFs=";
-  };
-
-  nix_2_14 = common {
-    version = "2.14.1";
-    hash = "sha256-5aCmGZbsFcLIckCDfvnPD4clGPQI7qYAqHYlttN/Wkg=";
-    patches = [
-      patch-rapidcheck-shared
-    ];
-  };
-
-  nix_2_15 = common {
-    version = "2.15.3";
-    hash = "sha256-sfFXbjC5iIdSAbctZIuFozxX0uux/KFBNr9oh33xINs=";
-    patches = [
-      patch-rapidcheck-shared
-    ];
-  };
-
-  nix_2_16 = common {
-    version = "2.16.3";
-    hash = "sha256-/tnjRCk+VaWPThzdn3C0zU1AMON+7AFsHgTTzErFxV4=";
-  };
-
-  nix_2_17 = common {
-    version = "2.17.1";
-    hash = "sha256-Q5L+rHzjp0bYuR2ogg+YPCn6isjmlQ4CJVT0zpn/hFc=";
-    patches = [
-      patch-rapidcheck-shared
-    ];
-  };
-
   nix_2_18 = common {
     version = "2.18.2";
     hash = "sha256-8gNJlBlv2bnffRg0CejiBXc6U/S6YeCLAdHrYvTPyoY=";
@@ -278,16 +191,12 @@ in lib.makeExtensible (self: ({
   stable = addFallbackPathsCheck self.nix_2_18;
 
   unstable = self.nix_2_22;
-} // lib.optionalAttrs config.allowAliases {
-  nix_2_4 = throw "nixVersions.nix_2_4 has been removed";
-
-  nix_2_5 = throw "nixVersions.nix_2_5 has been removed";
-
-  nix_2_6 = throw "nixVersions.nix_2_6 has been removed";
-
-  nix_2_7 = throw "nixVersions.nix_2_7 has been removed";
-
-  nix_2_8 = throw "nixVersions.nix_2_8 has been removed";
-
-  nix_2_9 = throw "nixVersions.nix_2_9 has been removed";
-}))
+} // lib.optionalAttrs config.allowAliases (
+  lib.listToAttrs (map (
+    minor:
+    let
+      attr = "nix_2_${toString minor}";
+    in
+    lib.nameValuePair attr (throw "${attr} has been removed")
+  ) (lib.range 4 17))
+)))
diff --git a/pkgs/tools/security/monsoon/default.nix b/pkgs/tools/security/monsoon/default.nix
index 3341366e47bb..e17081487db2 100644
--- a/pkgs/tools/security/monsoon/default.nix
+++ b/pkgs/tools/security/monsoon/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "monsoon";
-  version = "0.8.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "RedTeamPentesting";
     repo = "monsoon";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7cfy8dYhiReFVz10wui3qqxlXOX7wheREkvSnj2KyOw=";
+    hash = "sha256-5aV4/JEtaUEtE/csvch/JooeWNLpysqrI2hwVWMJhnI=";
   };
 
-  vendorHash = "sha256-SZDX61iPwT/mfxJ+n2nlvzgEvUu6h3wVkmeqZtxQ9KE=";
+  vendorHash = "sha256-gdoOBW5MD94RiKINVtTDvBQRZaJ9tlgu0eh7MxuMezg=";
 
   # Tests fails on darwin
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/tools/wayland/gtklock/default.nix b/pkgs/tools/wayland/gtklock/default.nix
index 18650539d23a..79e3870b81a4 100644
--- a/pkgs/tools/wayland/gtklock/default.nix
+++ b/pkgs/tools/wayland/gtklock/default.nix
@@ -1,45 +1,43 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, wrapGAppsHook3
-, pam
+, meson
+, ninja
 , scdoc
-, gtk3
 , pkg-config
-, gtk-layer-shell
-, glib
-, librsvg
-, wayland
-, wayland-scanner
+, wrapGAppsHook3
+, gtk3
+, pam
+, gtk-session-lock
 }:
 
 stdenv.mkDerivation rec {
   pname = "gtklock";
-  version = "2.1.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "jovanlanik";
-    repo = pname;
+    repo = "gtklock";
     rev = "v${version}";
-    sha256 = "sha256-Jh+BmtKGaLgAcTXc44ydV83dp/W4wzByehUWyeyBoFI=";
+    hash = "sha256-B6pySjiwPBRFb4avE9NHsS1KkWMPW81DAqYro/wtrmQ=";
   };
 
   nativeBuildInputs = [
+    meson
+    ninja
     scdoc
     pkg-config
-    wayland-scanner
-    glib
     wrapGAppsHook3
   ];
 
   buildInputs = [
-    wayland
     gtk3
     pam
-    gtk-layer-shell
-    librsvg
+    gtk-session-lock
   ];
 
+  strictDeps = true;
+
   installFlags = [
     "DESTDIR=$(out)"
     "PREFIX="
@@ -51,8 +49,8 @@ stdenv.mkDerivation rec {
       Important note: for gtklock to work you need to set "security.pam.services.gtklock = {};" manually.
     ''; # Following  nixpkgs/pkgs/applications/window-managers/sway/lock.nix
     homepage = "https://github.com/jovanlanik/gtklock";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ dit7ya ];
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ dit7ya aleksana ];
     platforms = platforms.linux;
     mainProgram = "gtklock";
   };
diff --git a/pkgs/tools/wayland/gtklock/playerctl-module.nix b/pkgs/tools/wayland/gtklock/playerctl-module.nix
index 8d2d760d46a1..5bc5237d75e8 100644
--- a/pkgs/tools/wayland/gtklock/playerctl-module.nix
+++ b/pkgs/tools/wayland/gtklock/playerctl-module.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtklock-playerctl-module";
-  version = "2.0.1";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "jovanlanik";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kzGgqFDTeKL6Pfjram7pqVcIm8Avxsvpn1qFrcpd8dw=";
+    hash = "sha256-eN4E3+jv8IyRvV8pvfCjCc6pl8y7qSLRlj7tYkX0JrE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/wayland/gtklock/powerbar-module.nix b/pkgs/tools/wayland/gtklock/powerbar-module.nix
index ce5c44a41874..5c22d6535795 100644
--- a/pkgs/tools/wayland/gtklock/powerbar-module.nix
+++ b/pkgs/tools/wayland/gtklock/powerbar-module.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtklock-powerbar-module";
-  version = "2.0.1";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "jovanlanik";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Ev6vjtvUSqP/+xTDRAqSYJ436WhZUtFRxSP7LoSK00w=";
+    hash = "sha256-uqGWr3/PaXif+JuxqRDlvfeiVG2nbausfe5dZOHcm7o=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/wayland/gtklock/userinfo-module.nix b/pkgs/tools/wayland/gtklock/userinfo-module.nix
index 0de3f12284af..72e650861cd3 100644
--- a/pkgs/tools/wayland/gtklock/userinfo-module.nix
+++ b/pkgs/tools/wayland/gtklock/userinfo-module.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtklock-userinfo-module";
-  version = "2.1.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "jovanlanik";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-WNUX0wRoh14rZRmiyQEGZPKJRr6oNW8B6LEwhDSPcyY=";
+    hash = "sha256-gZ9TGARuWFGyWLROlJQWwiEtbzQC9rlG8NKxUuGh57c=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7e8e5b094044..7e79b7074776 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3577,8 +3577,6 @@ with pkgs;
 
   changelogger = callPackage ../tools/misc/changelogger { };
 
-  chezmoi = callPackage ../tools/misc/chezmoi { };
-
   chipsec = callPackage ../tools/security/chipsec {
     kernel = null;
     withDriver = false;
@@ -34542,10 +34540,7 @@ with pkgs;
 
   wavebox = libsForQt5.callPackage ../applications/networking/instant-messengers/wavebox { };
 
-  sonic-pi = libsForQt5.callPackage ../applications/audio/sonic-pi {
-    elixir = elixir_1_14;
-    beamPackages = beamPackages.extend (self: super: { elixir = elixir_1_14; });
-  };
+  sonic-pi = libsForQt5.callPackage ../applications/audio/sonic-pi { };
 
   stag = callPackage ../applications/misc/stag {
     curses = ncurses;