diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 43c7e681e6a8..4304a2797b79 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5622,6 +5622,12 @@
     githubId = 2147649;
     name = "Euan Kemp";
   };
+  eureka-cpu = {
+    email = "github.eureka@gmail.com";
+    github = "eureka-cpu";
+    githubId = 57543709;
+    name = "Chris O'Brien";
+  };
   evalexpr = {
     name = "Jonathan Wilkins";
     email = "nixos@wilkins.tech";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 5cce64d1a17c..7658a60660f8 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -37,6 +37,12 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `services.avahi.nssmdns` got split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switch for IPv4 and IPv6 respectively.
   Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.
 
+- `networking.iproute2.enable` now does not set `environment.etc."iproute2/rt_tables".text`.
+
+  Setting `environment.etc."iproute2/{CONFIG_FILE_NAME}".text` will override the whole configuration file instead of appending it to the upstream configuration file.
+
+  `CONFIG_FILE_NAME` includes `bpf_pinning`, `ematch_map`, `group`, `nl_protos`, `rt_dsfield`, `rt_protos`, `rt_realms`, `rt_scopes`, and `rt_tables`.
+
 ## Other Notable Changes {#sec-release-24.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -59,6 +65,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   existing process, but will need to start that process from gdb (so it is a
   child). Or you can set `boot.kernel.sysctl."kernel.yama.ptrace_scope"` to 0.
 
+- [Nginx virtual hosts](#opt-services.nginx.virtualHosts) using `forceSSL` or
+  `globalRedirect` can now have redirect codes other than 301 through
+  `redirectCode`.
+
 - Gitea 1.21 upgrade has several breaking changes, including:
   - Custom themes and other assets that were previously stored in `custom/public/*` now belong in `custom/public/assets/*`
   - New instances of Gitea using MySQL now ignore the `[database].CHARSET` config option and always use the `utf8mb4` charset, existing instances should migrate via the `gitea doctor convert` CLI command.
diff --git a/nixos/modules/config/iproute2.nix b/nixos/modules/config/iproute2.nix
index 78bd07d680e2..0cde57b759be 100644
--- a/nixos/modules/config/iproute2.nix
+++ b/nixos/modules/config/iproute2.nix
@@ -18,10 +18,9 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.etc."iproute2/rt_tables" = {
+    environment.etc."iproute2/rt_tables.d/nixos.conf" = {
       mode = "0644";
-      text = (fileContents "${pkgs.iproute2}/lib/iproute2/rt_tables")
-        + (optionalString (cfg.rttablesExtraConfig != "") "\n\n${cfg.rttablesExtraConfig}");
+      text = cfg.rttablesExtraConfig;
     };
   };
 }
diff --git a/nixos/modules/services/desktops/flatpak.nix b/nixos/modules/services/desktops/flatpak.nix
index d99faf381e01..4c26e6874023 100644
--- a/nixos/modules/services/desktops/flatpak.nix
+++ b/nixos/modules/services/desktops/flatpak.nix
@@ -35,6 +35,7 @@ in {
     services.dbus.packages = [ pkgs.flatpak ];
 
     systemd.packages = [ pkgs.flatpak ];
+    systemd.tmpfiles.packages = [ pkgs.flatpak ];
 
     environment.profiles = [
       "$HOME/.local/share/flatpak/exports"
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index eafaa32f5b9b..6ea24e65f220 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -377,7 +377,7 @@ let
             server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};
             ${acmeLocation}
             location / {
-              return 301 https://$host$request_uri;
+              return ${toString vhost.redirectCode} https://$host$request_uri;
             }
           }
         ''}
@@ -396,7 +396,7 @@ let
           ${optionalString (vhost.root != null) "root ${vhost.root};"}
           ${optionalString (vhost.globalRedirect != null) ''
             location / {
-              return 301 http${optionalString hasSSL "s"}://${vhost.globalRedirect}$request_uri;
+              return ${toString vhost.redirectCode} http${optionalString hasSSL "s"}://${vhost.globalRedirect}$request_uri;
             }
           ''}
           ${optionalString hasSSL ''
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index 9db4c8e23025..64a95afab9f4 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -162,10 +162,11 @@ with lib;
       type = types.bool;
       default = false;
       description = lib.mdDoc ''
-        Whether to add a separate nginx server block that permanently redirects (301)
-        all plain HTTP traffic to HTTPS. This will set defaults for
-        `listen` to listen on all interfaces on the respective default
-        ports (80, 443), where the non-SSL listens are used for the redirect vhosts.
+        Whether to add a separate nginx server block that redirects (defaults
+        to 301, configurable with `redirectCode`) all plain HTTP traffic to
+        HTTPS. This will set defaults for `listen` to listen on all interfaces
+        on the respective default ports (80, 443), where the non-SSL listens
+        are used for the redirect vhosts.
       '';
     };
 
@@ -307,8 +308,20 @@ with lib;
       default = null;
       example = "newserver.example.org";
       description = lib.mdDoc ''
-        If set, all requests for this host are redirected permanently to
-        the given hostname.
+        If set, all requests for this host are redirected (defaults to 301,
+        configurable with `redirectCode`) to the given hostname.
+      '';
+    };
+
+    redirectCode = mkOption {
+      type = types.ints.between 300 399;
+      default = 301;
+      example = 308;
+      description = lib.mdDoc ''
+        HTTP status used by `globalRedirect` and `forceSSL`. Possible usecases
+        include temporary (302, 307) redirects, keeping the request method and
+        body (307, 308), or explicitly resetting the method to GET (303).
+        See <https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections>.
       '';
     };
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ab8fab553cee..6f5ada84701f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -583,6 +583,7 @@ in {
   nginx-njs = handleTest ./nginx-njs.nix {};
   nginx-proxyprotocol = handleTest ./nginx-proxyprotocol {};
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
+  nginx-redirectcode = handleTest ./nginx-redirectcode.nix {};
   nginx-sso = handleTest ./nginx-sso.nix {};
   nginx-status-page = handleTest ./nginx-status-page.nix {};
   nginx-tmpdir = handleTest ./nginx-tmpdir.nix {};
diff --git a/nixos/tests/installed-tests/flatpak.nix b/nixos/tests/installed-tests/flatpak.nix
index 9524d890c402..fa191202f52d 100644
--- a/nixos/tests/installed-tests/flatpak.nix
+++ b/nixos/tests/installed-tests/flatpak.nix
@@ -7,6 +7,7 @@ makeInstalledTest {
   testConfig = {
     xdg.portal.enable = true;
     xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+    xdg.portal.config.common.default = "gtk";
     services.flatpak.enable = true;
     environment.systemPackages = with pkgs; [ gnupg ostree python3 ];
     virtualisation.memorySize = 2047;
diff --git a/nixos/tests/nginx-redirectcode.nix b/nixos/tests/nginx-redirectcode.nix
new file mode 100644
index 000000000000..f60434a21a85
--- /dev/null
+++ b/nixos/tests/nginx-redirectcode.nix
@@ -0,0 +1,25 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "nginx-redirectcode";
+  meta.maintainers = with lib.maintainers; [ misterio77 ];
+
+  nodes = {
+    webserver = { pkgs, lib, ... }: {
+      services.nginx = {
+        enable = true;
+        virtualHosts.localhost = {
+          globalRedirect = "example.com/foo";
+          # With 308 (and 307), the method and body are to be kept when following it
+          redirectCode = 308;
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
+
+    # Check the status code
+    webserver.succeed("curl -si http://localhost | grep '^HTTP/[0-9.]\+ 308 Permanent Redirect'")
+  '';
+})
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index d248b845ddf0..3bc649490ffd 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -49,13 +49,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-21";
+  version = "7.1.1-23";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-DqVonNh6bFNK91Pd6MwIO1yMrshfGAWNWPpHHQUA2sQ=";
+    hash = "sha256-ytDMCZN+vavOtiPju5z87nJmSafRTt1gGycZtl3seGI=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/graphics/fluxus/default.nix b/pkgs/applications/graphics/fluxus/default.nix
index 1ac1666f8f40..5491305fad2c 100644
--- a/pkgs/applications/graphics/fluxus/default.nix
+++ b/pkgs/applications/graphics/fluxus/default.nix
@@ -1,17 +1,14 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitLab
 , alsa-lib
-, bzip2
 , fftw
 , freeglut
 , freetype
 , glew
 , libjack2
-, libGL
-, libGLU
 , libjpeg
 , liblo
-, libpng
 , libsndfile
 , libtiff
 , ode
@@ -19,12 +16,11 @@
 , openssl
 , racket_7_9
 , scons
-, zlib
 }:
 let
   racket = racket_7_9;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "fluxus";
   version = "0.19";
   src = fetchFromGitLab {
@@ -53,6 +49,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ scons ];
 
   patches = [ ./fix-build.patch ];
+  postPatch = ''
+    substituteInPlace src/Unicode.cpp \
+      --replace "(byte)" "(unsigned char)"
+  '';
   sconsFlags = [
     "RacketPrefix=${racket}"
     "RacketInclude=${racket}/include/racket"
@@ -72,6 +72,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     homepage = "http://www.pawfal.org/fluxus/";
     maintainers = [ maintainers.brainrape ];
-    broken = true;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/ericw-tools/default.nix b/pkgs/applications/misc/ericw-tools/default.nix
index dadd235319b3..9e833eafa770 100644
--- a/pkgs/applications/misc/ericw-tools/default.nix
+++ b/pkgs/applications/misc/ericw-tools/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , gtest, fmt
 , cmake, ninja, installShellFiles
 }:
@@ -20,6 +20,13 @@ stdenv.mkDerivation rec {
     popd
   '';
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ericwa/ericw-tools/commit/c9570260fa895dde5a21272d76f9a3b05d59efdd.patch";
+      hash = "sha256-dZr2LWuJBAIT//XHXYEz2vhaK2mxtxkSJ4IQla8OXKI=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ninja installShellFiles ];
 
   outputs = [ "out" "doc" "man" ];
@@ -44,5 +51,6 @@ stdenv.mkDerivation rec {
     description = "Map compile tools for Quake and Hexen 2";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ astro ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index f4e07656752c..9c9e83655419 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: let
 
 in {
   pname = "logseq";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-igZM+kNe1GDPYckXU6fOjyovHe9gwyBWr7Mc3BxAzOA=";
+    hash = "sha256-jDIfOHGki4InGuLvsnxdd2/FMPbT3VyuHtPxA4r3s5c=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index 25abb629cdf0..20c5249ab753 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.54.0";
+  version = "0.54.1";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-PcQuPV0wZa+CgikI9grdsGqNwXlXnu/kM+h4KfPW7SU=";
+    hash = "sha256-BbJ8XJ2zdKm1awDEkWZIZMDku/NWN3Y+nl/GtBBHgBQ=";
   };
 
   vendorHash = "sha256-OIkrDvNk4XD11j/+BdOkzbw86cYUj0Vz7pZ5/vIZopY=";
diff --git a/pkgs/applications/networking/discordo/default.nix b/pkgs/applications/networking/discordo/default.nix
index 8b46e31b7b5c..148ca77a91ae 100644
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "unstable-2023-11-14";
+  version = "unstable-2023-12-11";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "002e382c0de1d87e2ce7fd579346da4f339880ca";
-    hash = "sha256-eOlPc2WDjc73UlFH9d6Kw4/nEbjhBv4xLopxdTnFTYk=";
+    rev = "9c9ea0dc2fdd4ca18c68b08585bcc5b276388d62";
+    hash = "sha256-6gGbro4OsPh+HK9GR01uOUN80lgwMd7oLq9ASWtpNoY=";
   };
 
-  vendorHash = "sha256-1evMzQECqZvKJzNUk9GjrQej9vmnHs9Fm4kXJ0i5gMw=";
+  vendorHash = "sha256-8qr1erKGyJvR4LDKHkZf7nR0tQOcvUHQyJt7OlqNS44=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 6a5cdfd152de..aa8db54725c9 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -1,52 +1,53 @@
 { branch ? "stable", callPackage, fetchurl, lib, stdenv }:
 let
-  versions = if stdenv.isLinux then {
-    stable = "0.0.35";
-    ptb = "0.0.56";
-    canary = "0.0.184";
-    development = "0.0.0";
-  } else {
-    stable = "0.0.284";
-    ptb = "0.0.87";
-    canary = "0.0.340";
-    development = "0.0.2";
-  };
+  versions =
+    if stdenv.isLinux then {
+      stable = "0.0.37";
+      ptb = "0.0.59";
+      canary = "0.0.213";
+      development = "0.0.1";
+    } else {
+      stable = "0.0.287";
+      ptb = "0.0.90";
+      canary = "0.0.365";
+      development = "0.0.10";
+    };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-VcSRV9LDiUXduRt20kVeAnwinl6FmACQgn//W6eFyys=";
+        hash = "sha256-uyflZ1Zks7M1Re6DxuNUAkIuPY4wFSydf2AGMtIube8=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-RDXApmhlu2aQTjWVXMyRp0CL29btsQufIPuxjjtJGIU=";
+        hash = "sha256-WhDEyRMjuy2e1N51tUj3v97Y0qWabCFPThaehadXFWs=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-Pu0kei/ls9yrDEpRQcgDAaEkRbYkFmp/jTwOkljoy18=";
+        hash = "sha256-DGRq58Xj5p/7BunY/vFds9LVmxYOl9LcF8ESHrCLly4=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-/+9NyreRkXu2++uhwCh3/C1Cos39hfzB0Yjf0Otg9pk=";
+        hash = "sha256-unzPakomF2hmiikrNfnOueBdcuZCz2z3oCA7Djn6OmY=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-TTzhc6P0hFG9BFMviNx8CCg1cVEKDiB3gtb8oR/slNA=";
+        hash = "sha256-DTkWrUgSYP98IVFTWcm4muRR91Kfvs5pBxc1tvPmj/s=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-cl6+kTth/7j+HJHPU4Oy1N5EnmMbpdvltKzrU1by+Ik=";
+        hash = "sha256-wOTgcHRUu/CjdnvQVNL+rkazhVbZjwI+UbfmsF6aveg=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-LfixXyCoTnifw2GVAnCDnBla757JyGzbvUJwY4UhgGI=";
+        hash = "sha256-a4MyO2Wst+ZYNSpUaF0TXJKtDQcPRLehapwRzp10R2k=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-iMw61dXtThXvz2GnZiM4+tURMRfXhrN/ze1RTBL6zy8=";
+        hash = "sha256-FoYRW5SaR/53yKs/T2XKVKQevA3MxMWAJFjixtwsEF4=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/radio/qlog/default.nix b/pkgs/applications/radio/qlog/default.nix
index 5a790a12cdae..9c43d40681f0 100644
--- a/pkgs/applications/radio/qlog/default.nix
+++ b/pkgs/applications/radio/qlog/default.nix
@@ -16,22 +16,18 @@
 
 stdenv.mkDerivation rec {
   pname = "qlog";
-  version = "0.29.2";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "foldynl";
     repo = "QLog";
     rev = "v${version}";
-    hash = "sha256-g7WgFQPMOaD+3YllZqpykslmPYT/jNVK7/1xaPdbti4=";
+    hash = "sha256-WgLUIWggUKHPjVa6brkJzeRMZli/qhfu4jatf+JYIRU=";
     fetchSubmodules = true;
   };
 
   env.NIX_LDFLAGS = "-lhamlib";
 
-  patches = [
-    ./mac.patch
-  ];
-
   buildInputs = [
     qtbase
     qtcharts
diff --git a/pkgs/applications/radio/qlog/mac.patch b/pkgs/applications/radio/qlog/mac.patch
deleted file mode 100644
index 661d508ab4e5..000000000000
--- a/pkgs/applications/radio/qlog/mac.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 2b0ed30806b34315962da382cb41edf5f19b231e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
-Date: Sat, 25 Nov 2023 14:22:24 +0100
-Subject: [PATCH] Add installation to PREFIX on mac when set
-
-This allows the app to be shipped in a non-bundeled version
-
-We need this to ship the app on macOS with nix
----
- QLog.pro | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/QLog.pro b/QLog.pro
-index db6686f..576bfe1 100644
---- a/QLog.pro
-+++ b/QLog.pro
-@@ -386,6 +386,12 @@ macx: {
-    equals(QT_MAJOR_VERSION, 6): LIBS += -lqt6keychain
-    equals(QT_MAJOR_VERSION, 5): LIBS += -lqt5keychain
-    DISTFILES +=
-+
-+   # This allows the app to be shipped in a non-bundeled version
-+   !isEmpty(PREFIX) {
-+     target.path = $$PREFIX
-+     INSTALLS += target
-+   }
- }
- 
- win32: {
--- 
-2.42.0
-
diff --git a/pkgs/applications/video/mpv/scripts/cutter.nix b/pkgs/applications/video/mpv/scripts/cutter.nix
index 498fcb530a41..4c385b766c78 100644
--- a/pkgs/applications/video/mpv/scripts/cutter.nix
+++ b/pkgs/applications/video/mpv/scripts/cutter.nix
@@ -1,19 +1,16 @@
-{ lib, stdenvNoCC, fetchFromGitHub, makeWrapper }:
+{ lib, buildLua, fetchFromGitHub, makeWrapper }:
 
-stdenvNoCC.mkDerivation {
+buildLua {
   pname = "video-cutter";
-  version = "unstable-2021-02-03";
+  version = "unstable-2023-11-09";
 
   src = fetchFromGitHub {
     owner = "rushmj";
     repo = "mpv-video-cutter";
-    rev = "718d6ce9356e63fdd47208ec44f575a212b9068a";
-    sha256 = "sha256-ramID1DPl0UqEzevpqdYKb9aaW3CAy3Dy9CPb/oJ4eY=";
+    rev = "01a0396c075d5f8bbd1de5b571e6231f8899ab65";
+    sha256 = "sha256-veoRFzUCRH8TrvR7x+WWoycpDyxqrJZ/bnp61dVc0pE=";
   };
 
-  dontBuild = true;
-  dontCheck = true;
-
   nativeBuildInputs = [ makeWrapper ];
 
   postPatch = ''
@@ -27,21 +24,19 @@ stdenvNoCC.mkDerivation {
       --replace '~/.config/mpv/scripts' "''${XDG_CONFIG_HOME:-~/.config}/mpv/cutter"
   '';
 
-  installPhase = ''
-    install -Dm755 c_concat.sh $out/share/mpv/scripts/c_concat.sh
-    install cutter.lua $out/share/mpv/scripts/cutter.lua
+  passthru.scriptName = "cutter.lua";
+  extraScripts = [ "c_concat.sh" ];
 
+  postInstall = ''
+    chmod 0755 $out/share/mpv/scripts/c_concat.sh
     wrapProgram $out/share/mpv/scripts/c_concat.sh \
       --run "mkdir -p ~/.config/mpv/cutter/"
   '';
 
-  passthru.scriptName = "cutter.lua";
-
   meta = with lib; {
     description = "Cut videos and concat them automatically";
     homepage = "https://github.com/rushmj/mpv-video-cutter";
-    # repo doesn't have a license
-    license = licenses.unfree;
+    license = licenses.mit;
     maintainers = with maintainers; [ lom ];
   };
 }
diff --git a/pkgs/applications/video/mpv/scripts/default.nix b/pkgs/applications/video/mpv/scripts/default.nix
index 4ca70c401fa8..a529bf00ac6b 100644
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@@ -12,6 +12,7 @@ in lib.recurseIntoAttrs
     autoload = callPackage ./autoload.nix { };
     chapterskip = callPackage ./chapterskip.nix { inherit buildLua; };
     convert = callPackage ./convert.nix { inherit buildLua; };
+    cutter = callPackage ./cutter.nix { inherit buildLua; };
     inhibit-gnome = callPackage ./inhibit-gnome.nix { };
     mpris = callPackage ./mpris.nix { };
     mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { inherit buildLua; };
@@ -24,10 +25,9 @@ in lib.recurseIntoAttrs
     thumbfast = callPackage ./thumbfast.nix { inherit buildLua; };
     thumbnail = callPackage ./thumbnail.nix { inherit buildLua; };
     uosc = callPackage ./uosc.nix { inherit buildLua; };
-    visualizer = callPackage ./visualizer.nix { };
+    visualizer = callPackage ./visualizer.nix { inherit buildLua; };
     vr-reversal = callPackage ./vr-reversal.nix { };
     webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
-    cutter = callPackage ./cutter.nix { };
   }
   // (callPackage ./occivink.nix { inherit buildLua; }))
   // lib.optionalAttrs config.allowAliases {
diff --git a/pkgs/applications/video/mpv/scripts/thumbfast.nix b/pkgs/applications/video/mpv/scripts/thumbfast.nix
index 0226074ca31b..4899f556e8b2 100644
--- a/pkgs/applications/video/mpv/scripts/thumbfast.nix
+++ b/pkgs/applications/video/mpv/scripts/thumbfast.nix
@@ -2,22 +2,21 @@
 
 buildLua {
   pname = "mpv-thumbfast";
-  version = "unstable-2023-06-04";
+  version = "unstable-2023-12-08";
 
   src = fetchFromGitHub {
     owner = "po5";
     repo = "thumbfast";
-    rev = "4241c7daa444d3859b51b65a39d30e922adb87e9";
-    hash = "sha256-7EnFJVjEzqhWXAvhzURoOp/kad6WzwyidWxug6u8lVw=";
+    rev = "03e93feee5a85bf7c65db953ada41b4826e9f905";
+    hash = "sha256-5u5WBvWOEydJrnr/vilEgW4+fxkxM6wNjb9Fyyxx/1c=";
   };
 
-  postPatch = ''
-    substituteInPlace thumbfast.lua \
-      --replace 'mpv_path = "mpv"' 'mpv_path = "${lib.getExe mpv-unwrapped}"'
-  '';
-
   scriptPath = "thumbfast.lua";
 
+  passthru.extraWrapperArgs = [
+    "--prefix" "PATH" ":" "${lib.getBin mpv-unwrapped}/bin"
+  ];
+
   meta = {
     description = "High-performance on-the-fly thumbnailer for mpv";
     homepage = "https://github.com/po5/thumbfast";
diff --git a/pkgs/applications/video/mpv/scripts/visualizer.nix b/pkgs/applications/video/mpv/scripts/visualizer.nix
index a248b63d503a..dedc2c62e907 100644
--- a/pkgs/applications/video/mpv/scripts/visualizer.nix
+++ b/pkgs/applications/video/mpv/scripts/visualizer.nix
@@ -1,34 +1,22 @@
 {
   lib,
-  stdenvNoCC,
+  buildLua,
   fetchFromGitHub,
 }:
-stdenvNoCC.mkDerivation {
+buildLua {
   pname = "visualizer";
-  version = "unstable-2021-07-10";
+  version = "unstable-2023-08-13";
 
   src = fetchFromGitHub {
     owner = "mfcc64";
     repo = "mpv-scripts";
-    rev = "a0cd87eeb974a4602c5d8086b4051b5ab72f42e1";
-    sha256 = "1xgd1nd117lpj3ppynhgaa5sbkfm7l8n6c9a2fy8p07is2dkndrq";
+    rev = "7dbbfb283508714b73ead2a57b6939da1d139bd3";
+    sha256 = "zzB4uBc1M2Gdr/JKY2uk8MY0hmQl1XeomkfTzuM45oE=";
   };
 
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/mpv/scripts
-    cp visualizer.lua $out/share/mpv/scripts
-    runHook postInstall
-  '';
-
-  passthru.scriptName = "visualizer.lua";
-
   meta = with lib; {
     description = "various audio visualization";
     homepage = "https://github.com/mfcc64/mpv-scripts";
-    platforms = platforms.all;
     maintainers = with maintainers; [kmein];
   };
 }
diff --git a/pkgs/applications/virtualization/tart/default.nix b/pkgs/applications/virtualization/tart/default.nix
index 6afe021c36c5..a72d7599e203 100644
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchurl {
     url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
-    sha256 = "sha256-dCKUwDC7M3u8/8yJQp/v0zy7GuB7SvjnRmTLtodUz80=";
+    sha256 = "sha256-4G6HAfCx7PzFGN0hc8g5z545ierogNyGwex7/+lDFSQ=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/games/aaaaxy/default.nix b/pkgs/by-name/aa/aaaaxy/package.nix
similarity index 93%
rename from pkgs/games/aaaaxy/default.nix
rename to pkgs/by-name/aa/aaaaxy/package.nix
index 3a5a0ecbbd09..fcd71f6c6615 100644
--- a/pkgs/games/aaaaxy/default.nix
+++ b/pkgs/by-name/aa/aaaaxy/package.nix
@@ -19,17 +19,17 @@
 
 buildGoModule rec {
   pname = "aaaaxy";
-  version = "1.4.101";
+  version = "1.4.119";
 
   src = fetchFromGitHub {
     owner = "divVerent";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Eg8RvViTPqlVmvUX3k+/ph4YYU7xfFQY1Gs/e1at6No=";
+    hash = "sha256-M+HNYQl53vQZdKn/CyF5OZPyKGq/4A9DPoDV3fRdWMY=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-Qd5ytSrW42pDzKt9xg3hWD9rWFvQi1PPYF+m56+/cHE=";
+  vendorHash = "sha256-NoWfCn9P/i/8Xv0w2wqTFG3yoayGzc1TyF02zANP7Rg=";
 
   buildInputs = [
     alsa-lib
diff --git a/pkgs/by-name/gr/gruvbox-plus-icons/package.nix b/pkgs/by-name/gr/gruvbox-plus-icons/package.nix
new file mode 100644
index 000000000000..ffcd8b3f0b89
--- /dev/null
+++ b/pkgs/by-name/gr/gruvbox-plus-icons/package.nix
@@ -0,0 +1,47 @@
+{
+  lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, breeze-icons
+, gnome-icon-theme
+, hicolor-icon-theme
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "gruvbox-plus-icons";
+  version = "unstable-2023-12-07";
+
+  src = fetchFromGitHub {
+    owner = "SylEleuth";
+    repo = "gruvbox-plus-icon-pack";
+    rev = "f3109979fe93b31ea14eb2d5c04247a895302ea0";
+    sha256 = "sha256-EijTEDkPmcDcMhCuL6fOWjU9eXFUwmeOEwfGlxadb1U=";
+  };
+
+  nativeBuildInputs = [ gtk3 ];
+
+  propagatedBuildInputs = [ breeze-icons gnome-icon-theme hicolor-icon-theme ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/icons
+    cp -r Gruvbox-Plus-Dark $out/share/icons/
+    gtk-update-icon-cache $out/share/icons/Gruvbox-Plus-Dark
+
+    runHook postInstall
+  '';
+
+  dontDropIconThemeCache = true;
+  dontBuild = true;
+  dontConfigure = true;
+
+  meta = with lib; {
+    description = "Icon pack for Linux desktops based on the Gruvbox color scheme";
+    homepage = "https://github.com/SylEleuth/gruvbox-plus-icon-pack";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ eureka-cpu RGBCube ];
+  };
+}
diff --git a/pkgs/by-name/me/memtree/package.nix b/pkgs/by-name/me/memtree/package.nix
index 2165b46e2b48..68e990456e75 100644
--- a/pkgs/by-name/me/memtree/package.nix
+++ b/pkgs/by-name/me/memtree/package.nix
@@ -6,18 +6,19 @@
 
 python3Packages.buildPythonApplication {
   pname = "memtree";
-  version = "unstable-2023-11-04";
+  version = "unstable-2023-11-22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nbraud";
     repo = "memtree";
-    rev = "093caeef26ee944b5bf4408710f63494e442b5ff";
-    hash = "sha256-j4LqWy7DxeV7pjwnCfpkHwug4p48kux6BM6oDJmvuUo=";
+    rev = "edc09d91dcd72f175d6adc1d08b261dd95cc4fbf";
+    hash = "sha256-YLZm0wjkjaTw/lHY5k4cqPXCgINe+49SGPLZq+eRdI4=";
   };
 
   nativeBuildInputs = with python3Packages; [
     poetry-core
+    pytestCheckHook
   ];
 
   propagatedBuildInputs = with python3Packages; [
@@ -29,12 +30,7 @@ python3Packages.buildPythonApplication {
     pytest
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    python -m pytest -v
-    runHook postCheck
-  '';
-
+  pytestFlagsArray = [ "-v" ];
   pythonImportChecks = [ "memtree" ];
 
   passthru.updateScript = nix-update-script {
@@ -45,6 +41,7 @@ python3Packages.buildPythonApplication {
     description = "Render cgroups tree annotated by memory usage";
     homepage = "https://github.com/nbraud/memtree";
     maintainers = with maintainers; [ nicoo ];
+    mainProgram = "memtree";
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome/extensions/valent/default.nix b/pkgs/desktops/gnome/extensions/valent/default.nix
index 3813e02ffc03..7bb529b743bb 100644
--- a/pkgs/desktops/gnome/extensions/valent/default.nix
+++ b/pkgs/desktops/gnome/extensions/valent/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-valent";
-  version = "unstable-2023-03-18";
+  version = "unstable-2023-11-10";
 
   src = fetchFromGitHub {
     owner = "andyholmes";
     repo = "gnome-shell-extension-valent";
-    rev = "e7f759047c45833cd211ef18a8554008cb1b8b12";
-    hash = "sha256-ylCyQbFbzCuSM2YrLuI36eXL2qQjTt1mYewJlCywKvI=";
+    rev = "c0fad083db3c23382efca623488834054bbbd5cd";
+    hash = "sha256-H0EjR7sYK0mepT59PoHgecbk4ksQN8Vyisf6Y+2vT8g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 5ecb89a3a264..580821cc0d2c 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -281,7 +281,7 @@ in let
     # Has to be in tools despite mostly being a library,
     # because we use a native helper executable from a
     # non-cross build in cross builds.
-    libclc = callPackage ./libclc {
+    libclc = callPackage ../common/libclc.nix {
       inherit buildLlvmTools;
     };
   });
diff --git a/pkgs/development/compilers/llvm/17/default.nix b/pkgs/development/compilers/llvm/17/default.nix
index 8109f27586cb..2c422da8f9f8 100644
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@@ -269,6 +269,12 @@ in let
       nixSupport.cc-cflags = [ "-fno-exceptions" ];
     });
 
+    # Has to be in tools despite mostly being a library,
+    # because we use a native helper executable from a
+    # non-cross build in cross builds.
+    libclc = callPackage ../common/libclc.nix {
+      inherit buildLlvmTools;
+    };
   });
 
   libraries = lib.makeExtensible (libraries: let
diff --git a/pkgs/development/compilers/llvm/16/libclc/default.nix b/pkgs/development/compilers/llvm/common/libclc.nix
similarity index 93%
rename from pkgs/development/compilers/llvm/16/libclc/default.nix
rename to pkgs/development/compilers/llvm/common/libclc.nix
index 2ceca9aaf7fd..c91930963b20 100644
--- a/pkgs/development/compilers/llvm/16/libclc/default.nix
+++ b/pkgs/development/compilers/llvm/common/libclc.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./libclc-gnu-install-dirs.patch
+    ./libclc/libclc-gnu-install-dirs.patch
   ];
 
   # cmake expects all required binaries to be in the same place, so it will not be able to find clang without the patch
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
       --replace 'find_program( LLVM_OPT opt PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
                 'find_program( LLVM_OPT opt PATHS "${buildLlvmTools.llvm}/bin" NO_DEFAULT_PATH )' \
       --replace 'find_program( LLVM_SPIRV llvm-spirv PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                'find_program( LLVM_SPIRV llvm-spirv PATHS "${buildPackages.spirv-llvm-translator}/bin" NO_DEFAULT_PATH )'
+                'find_program( LLVM_SPIRV llvm-spirv PATHS "${buildPackages.spirv-llvm-translator.override { inherit (buildLlvmTools) llvm; }}/bin" NO_DEFAULT_PATH )'
   '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     substituteInPlace CMakeLists.txt \
       --replace 'COMMAND prepare_builtins' 'COMMAND ${buildLlvmTools.libclc.dev}/bin/prepare_builtins'
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     homepage = "http://libclc.llvm.org/";
     description = "Implementation of the library requirements of the OpenCL C programming language";
     license = licenses.mit;
diff --git a/pkgs/development/compilers/llvm/16/libclc/libclc-gnu-install-dirs.patch b/pkgs/development/compilers/llvm/common/libclc/libclc-gnu-install-dirs.patch
similarity index 100%
rename from pkgs/development/compilers/llvm/16/libclc/libclc-gnu-install-dirs.patch
rename to pkgs/development/compilers/llvm/common/libclc/libclc-gnu-install-dirs.patch
diff --git a/pkgs/development/cuda-modules/README.md b/pkgs/development/cuda-modules/README.md
index f4844c46a2c2..76732c5ddfb3 100644
--- a/pkgs/development/cuda-modules/README.md
+++ b/pkgs/development/cuda-modules/README.md
@@ -1,32 +1,97 @@
-# cuda-modules
+# Cuda modules
 
 > [!NOTE]
-> This document is meant to help CUDA maintainers understand the structure of the CUDA packages in Nixpkgs. It is not meant to be a user-facing document.
+> This document is meant to help CUDA maintainers understand the structure of
+> the CUDA packages in Nixpkgs. It is not meant to be a user-facing document.
 > For a user-facing document, see [the CUDA section of the manual](../../../doc/languages-frameworks/cuda.section.md).
 
-The files in this directory are added (in some way) to the `cudaPackages` package set by [cuda-packages.nix](../../top-level/cuda-packages.nix).
+The files in this directory are added (in some way) to the `cudaPackages`
+package set by [cuda-packages.nix](../../top-level/cuda-packages.nix).
 
 ## Top-level files
 
-Top-level nix files are included in the initial creation of the `cudaPackages` scope. These are typically required for the creation of the finalized `cudaPackages` scope:
+Top-level nix files are included in the initial creation of the `cudaPackages`
+scope. These are typically required for the creation of the finalized
+`cudaPackages` scope:
 
 - `backend-stdenv.nix`: Standard environment for CUDA packages.
 - `flags.nix`: Flags set, or consumed by, NVCC in order to build packages.
 - `gpus.nix`: A list of supported NVIDIA GPUs.
-- `nvcc-compatibilities.nix`: NVCC releases and the version range of GCC/Clang they support.
+- `nvcc-compatibilities.nix`: NVCC releases and the version range of GCC/Clang
+    they support.
 
 ## Top-level directories
 
 - `cuda`: CUDA redistributables! Provides extension to `cudaPackages` scope.
-- `cudatoolkit`: monolothic CUDA Toolkit run-file installer. Provides extension to `cudaPackages` scope.
+- `cudatoolkit`: monolothic CUDA Toolkit run-file installer. Provides extension
+    to `cudaPackages` scope.
 - `cudnn`: NVIDIA cuDNN library.
 - `cutensor`: NVIDIA cuTENSOR library.
 - `generic-builders`:
-  - Contains a builder `manifest.nix` which operates on the `Manifest` type defined in `modules/generic/manifests`. Most packages are built using this builder.
-  - Contains a builder `multiplex.nix` which leverages the Manifest builder. In short, the Multiplex builder adds multiple versions of a single package to single instance of the CUDA Packages package set. It is used primarily for packages like `cudnn` and `cutensor`.
-- `modules`: Nixpkgs modules to check the shape and content of CUDA redistributable and feature manifests. These modules additionally use shims provided by some CUDA packages to allow them to re-use the `genericManifestBuilder`, even if they don't have manifest files of their own. `cudnn` and `tensorrt` are examples of packages which provide such shims. These modules are further described in the [Modules](./modules/README.md) documentation.
+  - Contains a builder `manifest.nix` which operates on the `Manifest` type
+      defined in `modules/generic/manifests`. Most packages are built using this
+      builder.
+  - Contains a builder `multiplex.nix` which leverages the Manifest builder. In
+      short, the Multiplex builder adds multiple versions of a single package to
+      single instance of the CUDA Packages package set. It is used primarily for
+      packages like `cudnn` and `cutensor`.
+- `modules`: Nixpkgs modules to check the shape and content of CUDA
+    redistributable and feature manifests. These modules additionally use shims
+    provided by some CUDA packages to allow them to re-use the
+    `genericManifestBuilder`, even if they don't have manifest files of their
+    own. `cudnn` and `tensorrt` are examples of packages which provide such
+    shims. These modules are further described in the
+    [Modules](./modules/README.md) documentation.
 - `nccl`: NVIDIA NCCL library.
 - `nccl-tests`: NVIDIA NCCL tests.
 - `saxpy`: Example CMake project that uses CUDA.
 - `setup-hooks`: Nixpkgs setup hooks for CUDA.
 - `tensorrt`: NVIDIA TensorRT library.
+
+## Distinguished packages
+
+### Cuda compatibility
+
+[Cuda Compatibility](https://docs.nvidia.com/deploy/cuda-compatibility/),
+available as `cudaPackages.cuda_compat`, is a component which makes it possible
+to run applications built against a newer CUDA toolkit (for example CUDA 12) on
+a machine with an older CUDA driver (for example CUDA 11), which isn't possible
+out of the box. At the time of writing, Cuda Compatibility is only available on
+the Nvidia Jetson architecture, but Nvidia might release support for more
+architectures in the future.
+
+As Cuda Compatibility strictly increases the range of supported applications, we
+try our best to enable it by default on supported platforms.
+
+#### Functioning
+
+`cuda_compat` simply provides a new `libcuda.so` (and associated variants) that
+needs to be used in place of the default CUDA driver's `libcuda.so`. However,
+the other shared libraries of the default driver must still be accessible:
+`cuda_compat` isn't a complete drop-in replacement for the driver (and that's
+the point, otherwise, it would just be a newer driver).
+
+Nvidia's recommendation is to set `LD_LIBRARY_PATH` to points to `cuda_compat`'s
+driver. This is fine for a manual, one-shot usage, but in general setting
+`LD_LIBRARY_PATH` is a red flag. This is global state which short-circuits most
+of other dynamic libraries resolution mechanisms and can break things in
+non-obvious ways, especially with other Nix-built software.
+
+#### Cuda compat with Nix
+
+Since `cuda_compat` is a known derivation, the easy way to do this in Nix would
+be to add `cuda_compat` as a dependency of CUDA libraries and applications and
+let Nix does its magic by filling the `DT_RUNPATH` fields. However,
+`cuda_compat` itself depends on `libnvrm_mem` and `libnvrm_gpu` which are loaded
+dynamically at runtime from `/run/opengl-driver`. This doesn't please the Nix
+sandbox when building, which can't find those (a second minor issue is that
+`addOpenGLRunpathHook` prepends the `/run/opengl-driver` path, so that would
+still take precedence).
+
+The current solution is to do something similar to `addOpenGLRunpathHook`: the
+`addCudaCompatRunpathHook` prepends to the path to `cuda_compat`'s `libcuda.so`
+to the `DT_RUNPATH` of whichever package includes the hook as a dependency, and
+we include the hook by default for packages in `cudaPackages` (by adding it as a
+inputs in `genericManifestBuilder`). We also make sure it's included after
+`addOpenGLRunpathHook`, so that it appears _before_ in the `DT_RUNPATH` and
+takes precedence.
diff --git a/pkgs/development/cuda-modules/cuda/overrides.nix b/pkgs/development/cuda-modules/cuda/overrides.nix
index 061d5da16bb5..fd32978bfb59 100644
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@@ -45,7 +45,7 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
   cuda_compat = prev.cuda_compat.overrideAttrs (
     prevAttrs: {
       env.autoPatchelfIgnoreMissingDeps =
-        prevAttrs.env.autoPatchelfIgnoreMissingDeps + " libnvrm_gpu.so libnvrm_mem.so";
+        prevAttrs.env.autoPatchelfIgnoreMissingDeps + " libnvrm_gpu.so libnvrm_mem.so libnvdla_runtime.so";
       # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
       brokenConditions = prevAttrs.brokenConditions // {
         "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" =
diff --git a/pkgs/development/cuda-modules/generic-builders/manifest.nix b/pkgs/development/cuda-modules/generic-builders/manifest.nix
index 7ddecb7ed723..c7ff0f53bb74 100644
--- a/pkgs/development/cuda-modules/generic-builders/manifest.nix
+++ b/pkgs/development/cuda-modules/generic-builders/manifest.nix
@@ -1,6 +1,7 @@
 {
   # General callPackage-supplied arguments
   autoAddOpenGLRunpathHook,
+  autoAddCudaCompatRunpathHook,
   autoPatchelfHook,
   backendStdenv,
   fetchurl,
@@ -126,6 +127,14 @@ backendStdenv.mkDerivation (
       # Check e.g. with `patchelf --print-rpath path/to/my/binary
       autoAddOpenGLRunpathHook
       markForCudatoolkitRootHook
+    ]
+    # autoAddCudaCompatRunpathHook depends on cuda_compat and would cause
+    # infinite recursion if applied to `cuda_compat` itself (beside the fact
+    # that it doesn't make sense in the first place)
+    ++ lib.optionals (pname != "cuda_compat" && flags.isJetsonBuild) [
+      # autoAddCudaCompatRunpathHook must appear AFTER autoAddOpenGLRunpathHook.
+      # See its documentation in ./setup-hooks/extension.nix.
+      autoAddCudaCompatRunpathHook
     ];
 
     buildInputs =
diff --git a/pkgs/development/cuda-modules/modules/README.md b/pkgs/development/cuda-modules/modules/README.md
index 31aa343bd9d5..7db8435c9dc8 100644
--- a/pkgs/development/cuda-modules/modules/README.md
+++ b/pkgs/development/cuda-modules/modules/README.md
@@ -1,27 +1,56 @@
 # Modules
 
-Modules as they are used in `modules` exist primarily to check the shape and content of CUDA redistributable and feature manifests. They are ultimately meant to reduce the repetitive nature of repackaging CUDA redistributables.
+Modules as they are used in `modules` exist primarily to check the shape and
+content of CUDA redistributable and feature manifests. They are ultimately meant
+to reduce the repetitive nature of repackaging CUDA redistributables.
 
-Building most redistributables follows a pattern of a manifest indicating which packages are available at a location, their versions, and their hashes. To avoid creating builders for each and every derivation, modules serve as a way for us to use a single `genericManifestBuilder` to build all redistributables.
+Building most redistributables follows a pattern of a manifest indicating which
+packages are available at a location, their versions, and their hashes. To avoid
+creating builders for each and every derivation, modules serve as a way for us
+to use a single `genericManifestBuilder` to build all redistributables.
 
 ## `generic`
 
-The modules in `generic` are reusable components meant to check the shape and content of NVIDIA's CUDA redistributable manifests, our feature manifests (which are derived from NVIDIA's manifests), or hand-crafted Nix expressions describing available packages. They are used by the `genericManifestBuilder` to build CUDA redistributables.
+The modules in `generic` are reusable components meant to check the shape and
+content of NVIDIA's CUDA redistributable manifests, our feature manifests (which
+are derived from NVIDIA's manifests), or hand-crafted Nix expressions describing
+available packages. They are used by the `genericManifestBuilder` to build CUDA
+redistributables.
 
-Generally, each package which relies on manifests or Nix release expressions will create an alias to the relevant generic module. For example, the [module for CUDNN](./cudnn/default.nix) aliases the generic module for release expressions, while the [module for CUDA redistributables](./cuda/default.nix) aliases the generic module for manifests.
+Generally, each package which relies on manifests or Nix release expressions
+will create an alias to the relevant generic module. For example, the [module
+for CUDNN](./cudnn/default.nix) aliases the generic module for release
+expressions, while the [module for CUDA redistributables](./cuda/default.nix)
+aliases the generic module for manifests.
 
-Alternatively, additional fields or values may need to be configured to account for the particulars of a package. For example, while the release expressions for [CUDNN](./cudnn/releases.nix) and [TensorRT](./tensorrt/releases.nix) are very close, they differ slightly in the fields they have. The [module for CUDNN](./modules/cudnn/default.nix) is able to use the generic module for release expressions, while the [module for TensorRT](./modules/tensorrt/default.nix) must add additional fields to the generic module.
+Alternatively, additional fields or values may need to be configured to account
+for the particulars of a package. For example, while the release expressions for
+[CUDNN](./cudnn/releases.nix) and [TensorRT](./tensorrt/releases.nix) are very
+close, they differ slightly in the fields they have. The [module for
+CUDNN](./modules/cudnn/default.nix) is able to use the generic module for
+release expressions, while the [module for
+TensorRT](./modules/tensorrt/default.nix) must add additional fields to the
+generic module.
 
 ### `manifests`
 
-The modules in `generic/manifests` define the structure of NVIDIA's CUDA redistributable manifests and our feature manifests.
+The modules in `generic/manifests` define the structure of NVIDIA's CUDA
+redistributable manifests and our feature manifests.
 
-NVIDIA's redistributable manifests are retrieved from their web server, while the feature manifests are produced by [`cuda-redist-find-features`](https://github.com/connorbaker/cuda-redist-find-features).
+NVIDIA's redistributable manifests are retrieved from their web server, while
+the feature manifests are produced by
+[`cuda-redist-find-features`](https://github.com/connorbaker/cuda-redist-find-features).
 
 ### `releases`
 
-The modules in `generic/releases` define the structure of our hand-crafted Nix expressions containing information necessary to download and repackage CUDA redistributables. These expressions are created when NVIDIA-provided manifests are unavailable or otherwise unusable. For example, though CUDNN has manifests, a bug in NVIDIA's CI/CD causes manifests for different versions of CUDA to use the same name, which leads to the manifests overwriting each other.
+The modules in `generic/releases` define the structure of our hand-crafted Nix
+expressions containing information necessary to download and repackage CUDA
+redistributables. These expressions are created when NVIDIA-provided manifests
+are unavailable or otherwise unusable. For example, though CUDNN has manifests,
+a bug in NVIDIA's CI/CD causes manifests for different versions of CUDA to use
+the same name, which leads to the manifests overwriting each other.
 
 ### `types`
 
-The modules in `generic/types` define reusable types used in both `generic/manifests` and `generic/releases`.
+The modules in `generic/types` define reusable types used in both
+`generic/manifests` and `generic/releases`.
diff --git a/pkgs/development/cuda-modules/setup-hooks/auto-add-cuda-compat-runpath.sh b/pkgs/development/cuda-modules/setup-hooks/auto-add-cuda-compat-runpath.sh
new file mode 100644
index 000000000000..537daad2f00e
--- /dev/null
+++ b/pkgs/development/cuda-modules/setup-hooks/auto-add-cuda-compat-runpath.sh
@@ -0,0 +1,27 @@
+# shellcheck shell=bash
+# Patch all dynamically linked, ELF files with the CUDA driver (libcuda.so)
+# coming from the cuda_compat package by adding it to the RUNPATH.
+echo "Sourcing auto-add-cuda-compat-runpath-hook"
+
+elfHasDynamicSection() {
+    patchelf --print-rpath "$1" >& /dev/null
+}
+
+autoAddCudaCompatRunpathPhase() (
+  local outputPaths
+  mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "${!o}"; done)
+  find "${outputPaths[@]}" -type f -executable -print0  | while IFS= read -rd "" f; do
+    if isELF "$f"; then
+      # patchelf returns an error on statically linked ELF files
+      if elfHasDynamicSection "$f" ; then
+        echo "autoAddCudaCompatRunpathHook: patching $f"
+        local origRpath="$(patchelf --print-rpath "$f")"
+        patchelf --set-rpath "@libcudaPath@:$origRpath" "$f"
+      elif (( "${NIX_DEBUG:-0}" >= 1 )) ; then
+        echo "autoAddCudaCompatRunpathHook: skipping a statically-linked ELF file $f"
+      fi
+    fi
+  done
+)
+
+postFixupHooks+=(autoAddCudaCompatRunpathPhase)
diff --git a/pkgs/development/cuda-modules/setup-hooks/extension.nix b/pkgs/development/cuda-modules/setup-hooks/extension.nix
index 762dad9ea876..930730ce6c06 100644
--- a/pkgs/development/cuda-modules/setup-hooks/extension.nix
+++ b/pkgs/development/cuda-modules/setup-hooks/extension.nix
@@ -44,4 +44,26 @@ final: _: {
           ./auto-add-opengl-runpath-hook.sh
       )
       {};
+
+  # autoAddCudaCompatRunpathHook hook must be added AFTER `setupCudaHook`. Both
+  # hooks prepend a path with `libcuda.so` to the `DT_RUNPATH` section of
+  # patched elf files, but `cuda_compat` path must take precedence (otherwise,
+  # it doesn't have any effect) and thus appear first. Meaning this hook must be
+  # executed last.
+  autoAddCudaCompatRunpathHook =
+    final.callPackage
+      (
+        {makeSetupHook, cuda_compat}:
+        makeSetupHook
+          {
+            name = "auto-add-cuda-compat-runpath-hook";
+            substitutions = {
+              # Hotfix Ofborg evaluation
+              libcudaPath = if final.flags.isJetsonBuild then "${cuda_compat}/compat" else null;
+            };
+            meta.broken = !final.flags.isJetsonBuild;
+          }
+          ./auto-add-cuda-compat-runpath.sh
+      )
+      {};
 }
diff --git a/pkgs/development/embedded/xc3sprog/default.nix b/pkgs/development/embedded/xc3sprog/default.nix
index 393a11f8a448..fa9ceffafbbb 100644
--- a/pkgs/development/embedded/xc3sprog/default.nix
+++ b/pkgs/development/embedded/xc3sprog/default.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     # file RPATH_CHANGE could not write new RPATH
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    # fix build with gcc 11+
+    "-DCMAKE_CXX_STANDARD=14"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index 002ce4fa97ff..fb788377107e 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -164,7 +164,7 @@ builder rec {
       foreign function call interface, and powerful string processing.
     '';
     license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ ludo lovek323 vrthra ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 0c44b99db8d9..005890a3d4a6 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -54,14 +54,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak";
-  version = "1.14.4";
+  version = "1.14.5";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [ "out" "dev" "man" "doc" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-ijTb0LZ8Q051mLmOxpCVPQRvDbJuSArq+0bXKuxxZ5k="; # Taken from https://github.com/flatpak/flatpak/releases/
+    sha256 = "sha256-W3DGTOesE04eoIARJW5COuXFTydyl0QVg/d9AT8n/6w="; # Taken from https://github.com/flatpak/flatpak/releases/
   };
 
   patches = [
diff --git a/pkgs/development/libraries/flatpak/fix-test-paths.patch b/pkgs/development/libraries/flatpak/fix-test-paths.patch
index da1475009009..ebbcbde5e951 100644
--- a/pkgs/development/libraries/flatpak/fix-test-paths.patch
+++ b/pkgs/development/libraries/flatpak/fix-test-paths.patch
@@ -63,7 +63,7 @@ index afa11a6b..5b12055f 100755
  flatpak build-finish ${DIR} >&2
  mkdir -p repos
 diff --git a/tests/make-test-runtime.sh b/tests/make-test-runtime.sh
-index 4ba950df..fd50fab3 100755
+index 6345ff58..fd50fab3 100755
 --- a/tests/make-test-runtime.sh
 +++ b/tests/make-test-runtime.sh
 @@ -28,9 +28,10 @@ EOF
@@ -78,7 +78,7 @@ index 4ba950df..fd50fab3 100755
  mkdir -p ${DIR}/usr/bin
  mkdir -p ${DIR}/usr/lib
  ln -s ../lib ${DIR}/usr/lib64
-@@ -40,40 +41,17 @@ if test -f /sbin/ldconfig.real; then
+@@ -40,46 +41,17 @@ if test -f /sbin/ldconfig.real; then
  else
      cp "$(type -P ldconfig)" "${DIR}/usr/bin"
  fi
@@ -89,6 +89,12 @@ index 4ba950df..fd50fab3 100755
 -    local f=$1
 -    shift
 -
+-    # Check if the program is installed
+-    if ! command -v "${f}" &> /dev/null; then
+-        echo "${f} not found"
+-        exit 1
+-    fi
+-
 -    if grep -qFe "${f}" $BINS; then
 -        # Already handled
 -        return 0
@@ -129,7 +135,7 @@ index 4ba950df..fd50fab3 100755
  done
  ln -s bash ${DIR}/usr/bin/sh
  
-@@ -84,11 +62,13 @@ echo "Hello world, from a runtime$EXTRA"
+@@ -90,11 +62,13 @@ echo "Hello world, from a runtime$EXTRA"
  EOF
  chmod a+x ${DIR}/usr/bin/runtime_hello.sh
  
diff --git a/pkgs/development/libraries/flatpak/unset-env-vars.patch b/pkgs/development/libraries/flatpak/unset-env-vars.patch
index fec0573ed950..2a88d24f4916 100644
--- a/pkgs/development/libraries/flatpak/unset-env-vars.patch
+++ b/pkgs/development/libraries/flatpak/unset-env-vars.patch
@@ -1,11 +1,11 @@
 diff --git a/common/flatpak-run.c b/common/flatpak-run.c
-index 8fa8c0e0..e1cdeba0 100644
+index 6f54a9d0..102d9b90 100644
 --- a/common/flatpak-run.c
 +++ b/common/flatpak-run.c
-@@ -1900,6 +1900,7 @@ static const ExportData default_exports[] = {
-   {"XKB_CONFIG_ROOT", NULL},
-   {"GIO_EXTRA_MODULES", NULL},
+@@ -1902,6 +1902,7 @@ static const ExportData default_exports[] = {
    {"GDK_BACKEND", NULL},
+   {"VK_DRIVER_FILES", NULL},
+   {"VK_ICD_FILENAMES", NULL},
 +  {"GDK_PIXBUF_MODULE_FILE", NULL},
  };
  
diff --git a/pkgs/development/libraries/gensio/default.nix b/pkgs/development/libraries/gensio/default.nix
index 3dac6d6804e3..cd20eab42a62 100644
--- a/pkgs/development/libraries/gensio/default.nix
+++ b/pkgs/development/libraries/gensio/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gensio";
-  version = "2.7.7";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "cminyard";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fm850eDqKhvjwU5RwdwAro4R23yRn41ePn5++8MXHZ0=";
+    sha256 = "sha256-SwY9FAUljaxap2ZlPS3JJ8VkYiJFWoSLU1miEQIEerE=";
   };
 
   passthru = {
diff --git a/pkgs/development/libraries/ode/default.nix b/pkgs/development/libraries/ode/default.nix
index d35976932663..6ae60b7b2d3a 100644
--- a/pkgs/development/libraries/ode/default.nix
+++ b/pkgs/development/libraries/ode/default.nix
@@ -1,18 +1,33 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, darwin
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ode";
   version = "0.16.4";
 
   src = fetchurl {
-    url = "https://bitbucket.org/odedevs/${pname}/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-cQN7goHGyGsKVXKfkNXbaXq+TL7B2BGBV+ANSOwlNGc=";
+    url = "https://bitbucket.org/odedevs/ode/downloads/ode-${finalAttrs.version}.tar.gz";
+    hash = "sha256-cQN7goHGyGsKVXKfkNXbaXq+TL7B2BGBV+ANSOwlNGc=";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.GLUT
+  ];
+
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang (toString [
+    "-std=c++14"
+    "-Wno-error=c++11-narrowing"
+  ]);
+
   meta = with lib; {
     description = "Open Dynamics Engine";
     homepage = "https://www.ode.org";
-    platforms = platforms.linux;
-    license = with licenses; [ bsd3 lgpl21 lgpl3 zlib ];
+    license = with licenses; [ bsd3 lgpl21Only lgpl3Only zlib ];
+    maintainers = with maintainers; [ wegank ];
+    platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index edfad3b6c247..3deec8ee65de 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "2.22.6";
+  version = "2.23.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc-data";
     rev = "refs/tags/${version}";
-    hash = "sha256-oHW80TqQe7LCvBpdB0kW8+vKCZ36/zXEssp7+kHUrTA=";
+    hash = "sha256-UsWMlwG1g59I+TIn1uwp6vyzVIBtj1lfchp+3SYognc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/tools/azure-static-sites-client/versions.json b/pkgs/development/tools/azure-static-sites-client/versions.json
index 55c30a12addf..76bdb693e4aa 100644
--- a/pkgs/development/tools/azure-static-sites-client/versions.json
+++ b/pkgs/development/tools/azure-static-sites-client/versions.json
@@ -1,58 +1,58 @@
 [
   {
     "version": "latest",
-    "buildId": "1.0.024941",
-    "publishDate": "2023-10-31T04:54:50.5527205Z",
+    "buildId": "1.0.025241",
+    "publishDate": "2023-11-30T02:51:40.8356813Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/linux/StaticSitesClient",
-        "sha": "bea23499732d615698baf4c9dcafe717fdd4ba8344f2d96740233b0380df79b6"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/linux/StaticSitesClient",
+        "sha": "e4ccb44c516e03e6dcc2a26a35ffd4c84a61dfea581990dd5c0edb7c12662db0"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/windows/StaticSitesClient.exe",
-        "sha": "a93aa5ec2a17280f3c9c8252948f8c68050c8852770322758ffa3187b6bce1dd"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/windows/StaticSitesClient.exe",
+        "sha": "4146ac01a488910d6ea066e1c46505048b0c9af2e74ef273c4236b387796712d"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/macOS/StaticSitesClient",
-        "sha": "57ea66c930aafbf4dea82216e51128b3315ec2db3ab385d41e8d912a3adab2c0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/macOS/StaticSitesClient",
+        "sha": "05b213d7861454368d2c9801b0ccc75cfd13cb48f8e121fffaa2ab7e9b5671cd"
       }
     }
   },
   {
     "version": "stable",
-    "buildId": "1.0.024941",
-    "publishDate": "2023-10-31T04:54:50.5527205Z",
+    "buildId": "1.0.025241",
+    "publishDate": "2023-11-30T02:51:40.8356813Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/linux/StaticSitesClient",
-        "sha": "bea23499732d615698baf4c9dcafe717fdd4ba8344f2d96740233b0380df79b6"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/linux/StaticSitesClient",
+        "sha": "e4ccb44c516e03e6dcc2a26a35ffd4c84a61dfea581990dd5c0edb7c12662db0"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/windows/StaticSitesClient.exe",
-        "sha": "a93aa5ec2a17280f3c9c8252948f8c68050c8852770322758ffa3187b6bce1dd"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/windows/StaticSitesClient.exe",
+        "sha": "4146ac01a488910d6ea066e1c46505048b0c9af2e74ef273c4236b387796712d"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/macOS/StaticSitesClient",
-        "sha": "57ea66c930aafbf4dea82216e51128b3315ec2db3ab385d41e8d912a3adab2c0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/macOS/StaticSitesClient",
+        "sha": "05b213d7861454368d2c9801b0ccc75cfd13cb48f8e121fffaa2ab7e9b5671cd"
       }
     }
   },
   {
     "version": "backup",
-    "buildId": "1.0.024871",
-    "publishDate": "2023-10-24T04:09:23.7109231Z",
+    "buildId": "1.0.025142",
+    "publishDate": "2023-11-20T09:32:48.489649Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/linux/StaticSitesClient",
-        "sha": "13d1c02e43dec373be04152f7f8e71974f080440cb9480c3ccb4f83c8c6f036a"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/linux/StaticSitesClient",
+        "sha": "f36cce34f04b045e3ea5de5c201ce6663925d9680e3b5986b417534898b995b2"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/windows/StaticSitesClient.exe",
-        "sha": "868f221ea77b13cea8c6c41edbecea53bf5171d42dc9376f34615e544a3874f0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/windows/StaticSitesClient.exe",
+        "sha": "1e8932e2c4189d40657db888f82dfb030c2d41951421dd9a68712960e7c7fa7b"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/macOS/StaticSitesClient",
-        "sha": "63c9027a7b5e597ae9e0ad8311b31a587bd977ed758555784d08cc3ff35e80a4"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/macOS/StaticSitesClient",
+        "sha": "891faef16ae06fc609f787ffce7d6a1816e24fddfcaef9bc10e3b50208fe29aa"
       }
     }
   }
diff --git a/pkgs/development/tools/glamoroustoolkit/default.nix b/pkgs/development/tools/glamoroustoolkit/default.nix
index 73c2dab8f342..99b9f528df46 100644
--- a/pkgs/development/tools/glamoroustoolkit/default.nix
+++ b/pkgs/development/tools/glamoroustoolkit/default.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glamoroustoolkit";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchzip {
     url = "https://github.com/feenkcom/gtoolkit-vm/releases/download/v${finalAttrs.version}/GlamorousToolkit-x86_64-unknown-linux-gnu.zip";
     stripRoot = false;
-    hash = "sha256-263Bl5zd2k5DAPB/Ar8QMpthMiAv7BUSZ5+G03ZL5m0=";
+    hash = "sha256-WcAOGPWbY3sCcwmSHTjZvO3ASYYPv1T0iEA5C/VXL9I=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
diff --git a/pkgs/development/tools/language-servers/pylyzer/default.nix b/pkgs/development/tools/language-servers/pylyzer/default.nix
index b00ab1ccf0cf..3f48b0b9d824 100644
--- a/pkgs/development/tools/language-servers/pylyzer/default.nix
+++ b/pkgs/development/tools/language-servers/pylyzer/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pylyzer";
-  version = "0.0.50";
+  version = "0.0.51";
 
   src = fetchFromGitHub {
     owner = "mtshiba";
     repo = "pylyzer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-w6CXKBbELkPNido0bldMDqoLZbqLd0gKBv576uLAX3Y=";
+    hash = "sha256-TKAmIy5dP2m1iokxSqfxTj79UDkW00+se/NDGS3euwA=";
   };
 
-  cargoHash = "sha256-/s6ZXvgFXED17CwdmR8lLZDQ3otV334U4Uly90MPV1Y=";
+  cargoHash = "sha256-035ueF42g6By+6TOGEultc8n350g3mRT00raQgWIcUM=";
 
   nativeBuildInputs = [
     git
diff --git a/pkgs/development/tools/misc/blackfire/php-probe.nix b/pkgs/development/tools/misc/blackfire/php-probe.nix
index 39f5dd5185f4..960928c24552 100644
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -9,6 +9,8 @@
 , common-updater-scripts
 }:
 
+assert lib.assertMsg (!php.ztsSupport) "blackfire only supports non zts versions of PHP";
+
 let
   phpMajor = lib.versions.majorMinor php.version;
 
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index ada98eb33b47..350211001ad9 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.40.4";
+  version = "4.40.5";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-cEOOaQAduL9a+EwWigzPDN1ABM6wEjEc8dV4ESFkMXA=";
+    hash = "sha256-CCgertXgnA6q259Ngmy4EBD6GDuvSb0bREDddR2ht8E=";
   };
 
-  vendorHash = "sha256-kFDW8HrBhSuflAbuC6Zs/61OLXPsfPQfYU7Laa7eK9c=";
+  vendorHash = "sha256-SQGJj5syay4LllqmK/cRoZbprgDQhLGdQM3T1m/dZsI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/os-specific/linux/gasket/default.nix b/pkgs/os-specific/linux/gasket/default.nix
index c0790ae6a278..b9aebacca641 100644
--- a/pkgs/os-specific/linux/gasket/default.nix
+++ b/pkgs/os-specific/linux/gasket/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gasket";
-  version = "1.0-18";
+  version = "1.0-18-unstable-2023-09-05";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "gasket-driver";
-    rev = "97aeba584efd18983850c36dcf7384b0185284b3";
-    sha256 = "pJwrrI7jVKFts4+bl2xmPIAD01VKFta2SRuElerQnTo=";
+    rev = "09385d485812088e04a98a6e1227bf92663e0b59";
+    sha256 = "fcnqCBh04e+w8g079JyuyY2RPu34M+/X+Q8ObE+42i4=";
   };
 
   makeFlags = [
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index 072254bc3336..84813723fb05 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchgit
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , ell
@@ -21,6 +22,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-zePFmcQRFjcH6KToTpBFMQzGY+Eq7jijfn0R/MMKGrw=";
   };
 
+  # Revert test that's broken on aarch64
+  # FIXME: fix this properly
+  patches = [
+    (fetchpatch {
+      url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git/patch/?id=aabedeeb6c20c0c053f11ef53413d542442a8f62";
+      revert = true;
+      hash = "sha256-hO4KzdLzW6Tn/4NNJEQO2OvgjSPVl46cwwZfv53R84U=";
+    })
+  ];
+
   outputs = [ "out" "man" "doc" ]
     ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "test";
 
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index ef29d7317b02..ff2c22881819 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -247,7 +247,10 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace src/ukify/ukify.py \
       --replace \
       "'readelf'" \
-      "'${targetPackages.stdenv.cc.bintools.targetPrefix}readelf'"
+      "'${targetPackages.stdenv.cc.bintools.targetPrefix}readelf'" \
+      --replace \
+      "/usr/lib/systemd/boot/efi" \
+      "$out/lib/systemd/boot/efi"
   '' + (
     let
       # The following patches references to dynamic libraries to ensure that
diff --git a/pkgs/tools/cd-dvd/mkcue/default.nix b/pkgs/tools/cd-dvd/mkcue/default.nix
index 575adecbd521..34893b9f68a5 100644
--- a/pkgs/tools/cd-dvd/mkcue/default.nix
+++ b/pkgs/tools/cd-dvd/mkcue/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0rs897wp08z4hd904bjb5sl4lb8qxj82x5ayklr28bhg9pd5gbra";
   };
 
+  env.CXXFLAGS = "-std=c++98";
+
   preInstall = "mkdir -pv $out/bin";
   postInstall = "chmod -v +w $out/bin/mkcue";
 
diff --git a/pkgs/tools/misc/dotter/default.nix b/pkgs/tools/misc/dotter/default.nix
index 2abe844531b5..bcabb2ef8aac 100644
--- a/pkgs/tools/misc/dotter/default.nix
+++ b/pkgs/tools/misc/dotter/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dotter";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "SuperCuber";
     repo = "dotter";
     rev = "v${version}";
-    hash = "sha256-mAvTy/11a9RGSQpElhpKMzsMC7vA7cbeHsNRy9MnIjw=";
+    hash = "sha256-Xmdg5ITKWhL5AxTS7z4f9ecigQpBqna+kZclA+mDJhA=";
   };
 
-  cargoHash = "sha256-XsDp/ssoNVdTHDTPm2ucgBeYmFgbeBIxQ/NsGjCl5Qg=";
+  cargoHash = "sha256-W8khm9E5f/PROVJDAUr57nAiTEXV4a0fepzV00HoT8c=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 7abb37592c6a..82c99628e1b0 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-An1biuaqPeRniJZroxoT2o9IEA4XFf5l6ut4nmOsQJI=";
+    sha256 = "sha256-4N2MSs4Uhd0NcS57b6qIJd8ovnUVjLiLniMsHTdZHCo=";
   };
 
-  cargoHash = "sha256-gnFu0JsMt1wMfifF6EnjDwwydFnVyqpkHV0cyR5Qt3Y=";
+  cargoHash = "sha256-Y8LfkFPM4MKxwW6xk93+vCASkVfsMp3GugjH/kIAvQ8=";
 
   nativeBuildInputs = [ pandoc installShellFiles copyDesktopItems ];
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/tools/networking/nbd/default.nix b/pkgs/tools/networking/nbd/default.nix
index e0efbe31f8eb..c7cb5632dfe4 100644
--- a/pkgs/tools/networking/nbd/default.nix
+++ b/pkgs/tools/networking/nbd/default.nix
@@ -1,4 +1,15 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, which, bison, nixosTests, linuxHeaders, gnutls }:
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, glib
+, which
+, bison
+, nixosTests
+, libnl
+, linuxHeaders
+, gnutls
+}:
 
 stdenv.mkDerivation rec {
   pname = "nbd";
@@ -9,15 +20,23 @@ stdenv.mkDerivation rec {
     hash = "sha256-9cj9D8tXsckmWU0OV/NWQy7ghni+8dQNCI8IMPDL3Qo=";
   };
 
-  buildInputs = [ glib gnutls ]
-    ++ lib.optionals stdenv.isLinux [ linuxHeaders ];
+  nativeBuildInputs = [
+    pkg-config
+    which
+    bison
+  ];
 
-  nativeBuildInputs = [ pkg-config which bison ];
+  buildInputs = [
+    glib
+    gnutls
+  ] ++ lib.optionals stdenv.isLinux [
+    libnl
+    linuxHeaders
+  ];
 
-  postInstall = ''
-    mkdir -p "$out/share/doc/nbd-${version}"
-    cp README.md "$out/share/doc/nbd-${version}/"
-  '';
+  configureFlags = [
+    "--sysconfdir=/etc"
+  ];
 
   doCheck = !stdenv.isDarwin;
 
@@ -30,5 +49,6 @@ stdenv.mkDerivation rec {
     description = "Map arbitrary files as block devices over the network";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ nickcao ];
   };
 }
diff --git a/pkgs/tools/networking/ngrok/versions.json b/pkgs/tools/networking/ngrok/versions.json
index ef2b4e3d235d..3b52e8f92372 100644
--- a/pkgs/tools/networking/ngrok/versions.json
+++ b/pkgs/tools/networking/ngrok/versions.json
@@ -1,38 +1,38 @@
 {
   "linux-386": {
     "sys": "linux-386",
-    "url": "https://bin.equinox.io/a/3ndXunLZxr9/ngrok-v3-3.4.0-linux-386",
-    "sha256": "96b00658e46ce78226f426642999aec1c5593532ef975ada7b3a88550d5fd462",
-    "version": "3.4.0"
+    "url": "https://bin.equinox.io/a/4gMs8FHXopG/ngrok-v3-3.5.0-linux-386",
+    "sha256": "2ab242193e01222d1c5cbfe85389200b97fc3af91374bd4b9c8d86812db7d589",
+    "version": "3.5.0"
   },
   "linux-amd64": {
     "sys": "linux-amd64",
-    "url": "https://bin.equinox.io/a/8U3NahKrMb7/ngrok-v3-3.4.0-linux-amd64",
-    "sha256": "f84e8e7b22ed5ee07f7256c5811ab154fcc6f4a75607af87fad214cf5d4cc850",
-    "version": "3.4.0"
+    "url": "https://bin.equinox.io/a/7qHLVJPrTcc/ngrok-v3-3.5.0-linux-amd64",
+    "sha256": "bd44f722df4435daf61c4bef4fe45d8abdbbf5ccd6c371b6ab405a07fb469c06",
+    "version": "3.5.0"
   },
   "linux-arm": {
     "sys": "linux-arm",
-    "url": "https://bin.equinox.io/a/jcENzdnK9si/ngrok-v3-3.4.0-linux-arm",
-    "sha256": "dc56d43e353dcea410f30593c858e0240c22c9db1a803e436f8f2540143f9c10",
-    "version": "3.4.0"
+    "url": "https://bin.equinox.io/a/ciuckTnS7RJ/ngrok-v3-3.5.0-linux-arm",
+    "sha256": "ba0ab1d956a0b05e35da6901691bd18166acc6a833c993e8f6b80f6d608e1d8c",
+    "version": "3.5.0"
   },
   "linux-arm64": {
     "sys": "linux-arm64",
-    "url": "https://bin.equinox.io/a/hmadqCe6Lnv/ngrok-v3-3.4.0-linux-arm64",
-    "sha256": "203ac71b0af764438ad6b0fc27df71e2e8c10204eec88d670dc78f4b92dc9116",
-    "version": "3.4.0"
+    "url": "https://bin.equinox.io/a/iutMKiLdVzF/ngrok-v3-3.5.0-linux-arm64",
+    "sha256": "85b5ecc96a56a1d19324acb3ca3a38e11a9075be8cb97ee466a1538f8711a69d",
+    "version": "3.5.0"
   },
   "darwin-amd64": {
     "sys": "darwin-amd64",
-    "url": "https://bin.equinox.io/a/3GTEBnkQhkx/ngrok-v3-3.4.0-darwin-amd64",
-    "sha256": "562384f2eeaa4d1ffedd17599f7ddb7968acd6267b6b06e2a3664e2e61a4dd92",
-    "version": "3.4.0"
+    "url": "https://bin.equinox.io/a/hrb7DpXGSDS/ngrok-v3-3.5.0-darwin-amd64",
+    "sha256": "3380a2e742600fcef21e390291c4224e3e23fb31e832b695f922a24899125808",
+    "version": "3.5.0"
   },
   "darwin-arm64": {
     "sys": "darwin-arm64",
-    "url": "https://bin.equinox.io/a/eFiJHNHzRfi/ngrok-v3-3.4.0-darwin-arm64",
-    "sha256": "9fb23648c449a773eea5c0edf7c35b42b4f6432ad0bae5d7fa7321c71cd0f545",
-    "version": "3.4.0"
+    "url": "https://bin.equinox.io/a/aH6hGnhtNbT/ngrok-v3-3.5.0-darwin-arm64",
+    "sha256": "cbfd0bcd1d53aa1bc3b6afa54e0c8f01d77f6a369727f4f6eb1451b3a1eab3df",
+    "version": "3.5.0"
   }
 }
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index ff1b798a59b3..123c5ba74c32 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-12-07";
+  version = "2023-12-12";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-aN98whcpb3XMXWNFM0ynhcu6CmVdEXNDvtRE98mJSMA=";
+    hash = "sha256-OHx9UV5IhNt9/jKUKAzAUILdjxpQgOe5BQdXz3k38RE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 34088e3afbc6..5fc68c0a1c29 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -30,11 +30,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.8.9";
+  version = "0.4.8.10";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Wbt9iJD2ExtM5TRPPc6l3rIYK39PEP8MtOTYHxGyz2U=";
+    sha256 = "sha256-5ii0+rcO20cncVsjzykxN1qfdoWsCPLFnqSYoXhGOoY=";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e744feaf6361..4ccedcb21216 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8007,7 +8007,7 @@ with pkgs;
 
   eris-go = callPackage ../servers/eris-go { };
 
-  ericw-tools = callPackage ../applications/misc/ericw-tools { stdenv = gcc10StdenvCompat; };
+  ericw-tools = callPackage ../applications/misc/ericw-tools { };
 
   cryfs = callPackage ../tools/filesystems/cryfs { };
 
@@ -8984,7 +8984,7 @@ with pkgs;
   gsmartcontrol = callPackage ../tools/misc/gsmartcontrol { };
 
   gsmlib = callPackage ../development/libraries/gsmlib
-    { stdenv = gcc10StdenvCompat; autoreconfHook = buildPackages.autoreconfHook269; };
+    { autoreconfHook = buildPackages.autoreconfHook269; };
 
   gssdp = callPackage ../development/libraries/gssdp { };
 
@@ -10940,7 +10940,7 @@ with pkgs;
 
   mkclean = callPackage ../applications/video/mkclean { };
 
-  mkcue = callPackage ../tools/cd-dvd/mkcue { stdenv = gcc10StdenvCompat; };
+  mkcue = callPackage ../tools/cd-dvd/mkcue { };
 
   mkp224o = callPackage ../tools/security/mkp224o { };
 
@@ -20397,7 +20397,7 @@ with pkgs;
     lua = lua5_4;
   };
 
-  xc3sprog = callPackage ../development/embedded/xc3sprog { stdenv = gcc10StdenvCompat; };
+  xc3sprog = callPackage ../development/embedded/xc3sprog { };
 
   xcb-imdkit = callPackage ../development/libraries/xcb-imdkit { };
 
@@ -31611,7 +31611,7 @@ with pkgs;
 
   flrig = callPackage ../applications/radio/flrig { };
 
-  fluxus = callPackage ../applications/graphics/fluxus { stdenv = gcc10StdenvCompat; };
+  fluxus = callPackage ../applications/graphics/fluxus { };
 
   flwrap = callPackage ../applications/radio/flwrap { };
 
@@ -37335,8 +37335,6 @@ with pkgs;
 
   _90secondportraits = callPackage ../games/90secondportraits { love = love_0_10; };
 
-  aaaaxy = callPackage ../games/aaaaxy { };
-
   ace-of-penguins = callPackage ../games/ace-of-penguins { };
 
   among-sus = callPackage ../games/among-sus { };
diff --git a/pkgs/top-level/release-python.nix b/pkgs/top-level/release-python.nix
index 33080d5620f0..ec5255362bcc 100644
--- a/pkgs/top-level/release-python.nix
+++ b/pkgs/top-level/release-python.nix
@@ -9,7 +9,16 @@
     "x86_64-linux"
   ]
 , # Attributes passed to nixpkgs. Don't build packages marked as unfree.
-  nixpkgsArgs ? { config = { allowUnfree = false; inHydra = true; }; }
+  nixpkgsArgs ? { config = {
+    allowUnfree = false;
+    inHydra = true;
+    permittedInsecurePackages = [
+      # Keep evaluating home-assistant, which is transitively affected
+      # by home-assistant-chip-core consuming OpenSSL 1.1. Affects roughly
+      # 800 jobs.
+      "openssl-1.1.1w"
+    ];
+  }; }
 }:
 
 with import ./release-lib.nix {inherit supportedSystems nixpkgsArgs; };