diff --git a/nixos/modules/hardware/video/webcam/ipu6.nix b/nixos/modules/hardware/video/webcam/ipu6.nix
index de47fe3f6b5a..ae54e24ee2da 100644
--- a/nixos/modules/hardware/video/webcam/ipu6.nix
+++ b/nixos/modules/hardware/video/webcam/ipu6.nix
@@ -26,9 +26,9 @@ in
 
   config = mkIf cfg.enable {
 
-    boot.extraModulePackages = with config.boot.kernelPackages; [
-      ipu6-drivers
-    ];
+    # Module is upstream as of 6.10
+    boot.extraModulePackages = with config.boot.kernelPackages;
+      optional (kernelOlder "6.10") ipu6-drivers;
 
     hardware.firmware = with pkgs; [
       ipu6-camera-bins
diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix
index 82fbc9b26e2d..6f70738ec3c8 100644
--- a/nixos/modules/programs/tsm-client.nix
+++ b/nixos/modules/programs/tsm-client.nix
@@ -4,7 +4,7 @@ let optionsGlobal = options; in
 let
 
   inherit (lib.attrsets) attrNames attrValues mapAttrsToList removeAttrs;
-  inherit (lib.lists) all allUnique concatLists elem isList map;
+  inherit (lib.lists) all allUnique concatLists concatMap elem isList map;
   inherit (lib.modules) mkDefault mkIf;
   inherit (lib.options) mkEnableOption mkOption mkPackageOption;
   inherit (lib.strings) concatLines match optionalString toLower;
@@ -231,7 +231,7 @@ let
     # Turn a key-value pair from the server options attrset
     # into zero (value==null), one (scalar value) or
     # more (value is list) configuration stanza lines.
-    if isList value then map (makeDsmSysLines key) value else  # recurse into list
+    if isList value then concatMap (makeDsmSysLines key) value else  # recurse into list
     if value == null then [ ] else  # skip `null` value
     [ ("  ${key}${
       if value == true then "" else  # just output key if value is `true`
diff --git a/nixos/modules/services/monitoring/telegraf.nix b/nixos/modules/services/monitoring/telegraf.nix
index 8c51a2838e05..dfff80e1bac2 100644
--- a/nixos/modules/services/monitoring/telegraf.nix
+++ b/nixos/modules/services/monitoring/telegraf.nix
@@ -61,7 +61,8 @@ in {
       wantedBy = [ "multi-user.target" ];
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
-      path = lib.optional (config.services.telegraf.extraConfig.inputs ? procstat) pkgs.procps;
+      path = lib.optional (config.services.telegraf.extraConfig.inputs ? procstat) pkgs.procps
+             ++ lib.optional (config.services.telegraf.extraConfig.inputs ? ping) pkgs.iputils;
       serviceConfig = {
         EnvironmentFile = config.services.telegraf.environmentFiles;
         ExecStartPre = lib.optional (config.services.telegraf.environmentFiles != [])
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 22e019b86505..3e81b9288feb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -185,6 +185,7 @@ in {
   ceph-multi-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-multi-node.nix {};
   ceph-single-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node.nix {};
   ceph-single-node-bluestore = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node-bluestore.nix {};
+  ceph-single-node-bluestore-dmcrypt = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node-bluestore-dmcrypt.nix {};
   certmgr = handleTest ./certmgr.nix {};
   cfssl = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cfssl.nix {};
   cgit = handleTest ./cgit.nix {};
diff --git a/nixos/tests/ceph-single-node-bluestore-dmcrypt.nix b/nixos/tests/ceph-single-node-bluestore-dmcrypt.nix
new file mode 100644
index 000000000000..91840fbb38eb
--- /dev/null
+++ b/nixos/tests/ceph-single-node-bluestore-dmcrypt.nix
@@ -0,0 +1,270 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+
+  let
+    # the single node ipv6 address
+    ip = "2001:db8:ffff::";
+    # the global ceph cluster id
+    cluster = "54465b37-b9d8-4539-a1f9-dd33c75ee45a";
+    # the fsids of OSDs
+    osd-fsid-map = {
+      "0" = "1c1b7ea9-06bf-4d30-9a01-37ac3a0254aa";
+      "1" = "bd5a6f49-69d5-428c-ac25-a99f0c44375c";
+      "2" = "c90de6c7-86c6-41da-9694-e794096dfc5c";
+    };
+
+  in
+  {
+    name = "basic-single-node-ceph-cluster-bluestore-dmcrypt";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ nh2 ];
+    };
+
+    nodes = {
+      ceph =
+        { pkgs, config, ... }:
+        {
+          # disks for bluestore
+          virtualisation.emptyDiskImages = [
+            20480
+            20480
+            20480
+          ];
+
+          # networking setup (no external connectivity required, only local IPv6)
+          networking.useDHCP = false;
+          systemd.network = {
+            enable = true;
+            wait-online.extraArgs = [
+              "-i"
+              "lo"
+            ];
+            networks = {
+              "40-loopback" = {
+                enable = true;
+                name = "lo";
+                DHCP = "no";
+                addresses = [ { addressConfig.Address = "${ip}/128"; } ];
+              };
+            };
+          };
+
+          # do not start the ceph target by default so we can format the disks first
+          systemd.targets.ceph.wantedBy = lib.mkForce [ ];
+
+          # add the packages to systemPackages so the testscript doesn't run into any unexpected issues
+          # this shouldn't be required on production systems which have their required packages in the unit paths only
+          # but it helps in case one needs to actually run the tooling anyway
+          environment.systemPackages = with pkgs; [
+            ceph
+            cryptsetup
+            lvm2
+          ];
+
+          services.ceph = {
+            enable = true;
+            client.enable = true;
+            extraConfig = {
+              public_addr = ip;
+              cluster_addr = ip;
+              # ipv6
+              ms_bind_ipv4 = "false";
+              ms_bind_ipv6 = "true";
+              # msgr2 settings
+              ms_cluster_mode = "secure";
+              ms_service_mode = "secure";
+              ms_client_mode = "secure";
+              ms_mon_cluster_mode = "secure";
+              ms_mon_service_mode = "secure";
+              ms_mon_client_mode = "secure";
+              # less default modules, cuts down on memory and startup time in the tests
+              mgr_initial_modules = "";
+              # distribute by OSD, not by host, as per https://docs.ceph.com/en/reef/cephadm/install/#single-host
+              osd_crush_chooseleaf_type = "0";
+            };
+            client.extraConfig."mon.0" = {
+              host = "ceph";
+              mon_addr = "v2:[${ip}]:3300";
+              public_addr = "v2:[${ip}]:3300";
+            };
+            global = {
+              fsid = cluster;
+              clusterNetwork = "${ip}/64";
+              publicNetwork = "${ip}/64";
+              monInitialMembers = "0";
+            };
+
+            mon = {
+              enable = true;
+              daemons = [ "0" ];
+            };
+
+            osd = {
+              enable = true;
+              daemons = builtins.attrNames osd-fsid-map;
+            };
+
+            mgr = {
+              enable = true;
+              daemons = [ "ceph" ];
+            };
+          };
+
+          systemd.services =
+            let
+              osd-name = id: "ceph-osd-${id}";
+              osd-pre-start = id: [
+                "!${config.services.ceph.osd.package.out}/bin/ceph-volume lvm activate --bluestore ${id} ${osd-fsid-map.${id}} --no-systemd"
+                "${config.services.ceph.osd.package.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${id} --cluster ${config.services.ceph.global.clusterName}"
+              ];
+              osd-post-stop = id: [
+                "!${config.services.ceph.osd.package.out}/bin/ceph-volume lvm deactivate ${id}"
+              ];
+              map-osd = id: {
+                name = osd-name id;
+                value = {
+                  serviceConfig.ExecStartPre = lib.mkForce (osd-pre-start id);
+                  serviceConfig.ExecStopPost = osd-post-stop id;
+                  unitConfig.ConditionPathExists = lib.mkForce [ ];
+                  unitConfig.StartLimitBurst = lib.mkForce 4;
+                  path = with pkgs; [
+                    util-linux
+                    lvm2
+                    cryptsetup
+                  ];
+                };
+              };
+            in
+            lib.pipe config.services.ceph.osd.daemons [
+              (builtins.map map-osd)
+              builtins.listToAttrs
+            ];
+        };
+    };
+
+    testScript =
+      { ... }:
+      ''
+        start_all()
+
+        ceph.wait_for_unit("default.target")
+
+        # Bootstrap ceph-mon daemon
+        ceph.succeed(
+            "mkdir -p /var/lib/ceph/bootstrap-osd",
+            "ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
+            "ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
+            "ceph-authtool --create-keyring /var/lib/ceph/bootstrap-osd/ceph.keyring --gen-key -n client.bootstrap-osd --cap mon 'profile bootstrap-osd' --cap mgr 'allow r'",
+            "ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
+            "ceph-authtool /tmp/ceph.mon.keyring --import-keyring /var/lib/ceph/bootstrap-osd/ceph.keyring",
+            "monmaptool --create --fsid ${cluster} --addv 0 'v2:[${ip}]:3300/0' --clobber /tmp/ceph.initial-monmap",
+            "mkdir -p /var/lib/ceph/mon/ceph-0",
+            "ceph-mon --mkfs -i 0 --monmap /tmp/ceph.initial-monmap --keyring /tmp/ceph.mon.keyring",
+            "chown ceph:ceph -R /tmp/ceph.mon.keyring /var/lib/ceph",
+            "systemctl start ceph-mon-0.service",
+        )
+
+        ceph.wait_for_unit("ceph-mon-0.service")
+        # should the mon not start or bind for some reason this gives us a better error message than the config commands running into a timeout
+        ceph.wait_for_open_port(3300, "${ip}")
+        ceph.succeed(
+            # required for HEALTH_OK
+            "ceph config set mon auth_allow_insecure_global_id_reclaim false",
+            # IPv6
+            "ceph config set global ms_bind_ipv4 false",
+            "ceph config set global ms_bind_ipv6 true",
+            # the new (secure) protocol
+            "ceph config set global ms_bind_msgr1 false",
+            "ceph config set global ms_bind_msgr2 true",
+            # just a small little thing
+            "ceph config set mon mon_compact_on_start true",
+        )
+
+        # Can't check ceph status until a mon is up
+        ceph.succeed("ceph -s | grep 'mon: 1 daemons'")
+
+        # Bootstrap OSDs (do this before starting the mgr because cryptsetup and the mgr both eat a lot of memory)
+        ceph.succeed(
+            # this will automatically do what's required for LVM, cryptsetup, and stores all the data in Ceph's internal databases
+            "ceph-volume lvm prepare --bluestore --data /dev/vdb --dmcrypt --no-systemd --osd-id 0 --osd-fsid ${osd-fsid-map."0"}",
+            "ceph-volume lvm prepare --bluestore --data /dev/vdc --dmcrypt --no-systemd --osd-id 1 --osd-fsid ${osd-fsid-map."1"}",
+            "ceph-volume lvm prepare --bluestore --data /dev/vdd --dmcrypt --no-systemd --osd-id 2 --osd-fsid ${osd-fsid-map."2"}",
+            "sudo ceph-volume lvm deactivate 0",
+            "sudo ceph-volume lvm deactivate 1",
+            "sudo ceph-volume lvm deactivate 2",
+            "chown -R ceph:ceph /var/lib/ceph",
+        )
+
+        # Start OSDs (again, argon2id eats memory, so this happens before starting the mgr)
+        ceph.succeed(
+            "systemctl start ceph-osd-0.service",
+            "systemctl start ceph-osd-1.service",
+            "systemctl start ceph-osd-2.service",
+        )
+        ceph.wait_until_succeeds("ceph -s | grep 'quorum 0'")
+        ceph.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
+
+        # Start the ceph-mgr daemon, after copying in the keyring
+        ceph.succeed(
+            "mkdir -p /var/lib/ceph/mgr/ceph-ceph/",
+            "ceph auth get-or-create -o /var/lib/ceph/mgr/ceph-ceph/keyring mgr.ceph mon 'allow profile mgr' osd 'allow *' mds 'allow *'",
+            "chown -R ceph:ceph /var/lib/ceph/mgr/ceph-ceph/",
+            "systemctl start ceph-mgr-ceph.service",
+        )
+        ceph.wait_for_unit("ceph-mgr-ceph")
+        ceph.wait_until_succeeds("ceph -s | grep 'quorum 0'")
+        ceph.wait_until_succeeds("ceph -s | grep 'mgr: ceph(active,'")
+        ceph.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
+        ceph.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+
+        # test the actual storage
+        ceph.succeed(
+            "ceph osd pool create single-node-test 32 32",
+            "ceph osd pool ls | grep 'single-node-test'",
+
+            # We need to enable an application on the pool, otherwise it will
+            # stay unhealthy in state POOL_APP_NOT_ENABLED.
+            # Creating a CephFS would do this automatically, but we haven't done that here.
+            # See: https://docs.ceph.com/en/reef/rados/operations/pools/#associating-a-pool-with-an-application
+            # We use the custom application name "nixos-test" for this.
+            "ceph osd pool application enable single-node-test nixos-test",
+
+            "ceph osd pool rename single-node-test single-node-other-test",
+            "ceph osd pool ls | grep 'single-node-other-test'",
+        )
+        ceph.wait_until_succeeds("ceph -s | grep '2 pools, 33 pgs'")
+        ceph.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+        ceph.wait_until_succeeds("ceph -s | grep '33 active+clean'")
+        ceph.fail(
+            # the old pool should be gone
+            "ceph osd pool ls | grep 'multi-node-test'",
+            # deleting the pool should fail without setting mon_allow_pool_delete
+            "ceph osd pool delete single-node-other-test single-node-other-test --yes-i-really-really-mean-it",
+        )
+
+        # rebooting gets rid of any potential tmpfs mounts or device-mapper devices
+        ceph.shutdown()
+        ceph.start()
+        ceph.wait_for_unit("default.target")
+
+        # Start it up (again OSDs first due to memory constraints of cryptsetup and mgr)
+        ceph.systemctl("start ceph-mon-0.service")
+        ceph.wait_for_unit("ceph-mon-0")
+        ceph.systemctl("start ceph-osd-0.service")
+        ceph.wait_for_unit("ceph-osd-0")
+        ceph.systemctl("start ceph-osd-1.service")
+        ceph.wait_for_unit("ceph-osd-1")
+        ceph.systemctl("start ceph-osd-2.service")
+        ceph.wait_for_unit("ceph-osd-2")
+        ceph.systemctl("start ceph-mgr-ceph.service")
+        ceph.wait_for_unit("ceph-mgr-ceph")
+
+        # Ensure the cluster comes back up again
+        ceph.succeed("ceph -s | grep 'mon: 1 daemons'")
+        ceph.wait_until_succeeds("ceph -s | grep 'quorum 0'")
+        ceph.wait_until_succeeds("ceph osd stat | grep -E '3 osds: 3 up[^,]*, 3 in'")
+        ceph.wait_until_succeeds("ceph -s | grep 'mgr: ceph(active,'")
+        ceph.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+      '';
+  }
+)
diff --git a/nixos/tests/telegraf.nix b/nixos/tests/telegraf.nix
index c3cdb1645213..2ccad7af3f55 100644
--- a/nixos/tests/telegraf.nix
+++ b/nixos/tests/telegraf.nix
@@ -19,6 +19,12 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         timeout = "5s";
         data_format = "influx";
       };
+      inputs.ping = {
+        urls = ["127.0.0.1"];
+        count = 4;
+        interval = "10s";
+        timeout = 1.0;
+      };
       outputs.file.files = ["/tmp/metrics.out"];
       outputs.file.data_format = "influx";
     };
@@ -29,5 +35,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
     machine.wait_for_unit("telegraf.service")
     machine.wait_until_succeeds("grep -q example /tmp/metrics.out")
+    machine.wait_until_succeeds("grep -q ping /tmp/metrics.out")
   '';
 })
diff --git a/pkgs/applications/blockchains/erigon/default.nix b/pkgs/applications/blockchains/erigon/default.nix
index 4e22796cd6d1..b5fa4dfe134d 100644
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "erigon";
-  version = "2.60.0";
+  version = "2.60.6";
 in
 buildGoModule {
   inherit pname version;
@@ -11,11 +11,11 @@ buildGoModule {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-c0CArubKvdh9xcvBM15O4vGwAsSHzaINtoKd0XczJHU=";
+    hash = "sha256-208gJTLaVEikH92ZDEULPtfnKJyZhZCRCDfCxewABK4=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-38NmSSK3a70WvhZAZ529wdAMlEuk8/4YqtadoLOn1IY=";
+  vendorHash = "sha256-TUK7obI1wOXroI1NE1GfIP+NMW909+z92Wpy9B/soY0=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index c4f352ac67a1..a891660ab95e 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,22 +2,22 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.65";
+      stable = "0.0.66";
       ptb = "0.0.101";
-      canary = "0.0.475";
-      development = "0.0.24";
+      canary = "0.0.479";
+      development = "0.0.25";
     } else {
-      stable = "0.0.316";
-      ptb = "0.0.130";
-      canary = "0.0.583";
-      development = "0.0.46";
+      stable = "0.0.317";
+      ptb = "0.0.131";
+      canary = "0.0.587";
+      development = "0.0.47";
     };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-kzYLZcjuG7k8RSjc5ooDlMKaAlMHvm0yCl5Krnhqq8A=";
+        hash = "sha256-tbpo1+fbziJk2JdaMyAW5Ynb0wuWkLdcDnzQbiZJ47A=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
@@ -25,29 +25,29 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-suVIDCZhI6DwUVizBmTm104Clr6pH/olAIbOMNzFNss=";
+        hash = "sha256-mirioiRpwQB07sL1avGYk2+Cnmdw7PW808AAA6p2Y0U=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-rSlGL2BwtUxLJltSD2Ms94qmZ4kuX5i9jFqyYC30jyQ=";
+        hash = "sha256-9dwZ89YOs2iNOeoVrGfNHwr4mvfXmPk1SrJYoteYakY=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-ZJ2ybvKGGCm8CZhwGxmLXZWNUD1eAyg17zD/sBwViB4=";
+        hash = "sha256-SX6a2qPSFURL00dMLrHSI4+964Xc76ada4PUMlG1V9U=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-mLfeMx5dQNpoLUyoOSCj8XtNxWjsBpVWdFv1obtHJak=";
+        hash = "sha256-/wuYPjGh/RJZSDeo8r78YEbCYj+qZWTaIDIfKuSH+r0=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-eIjkXOW07sR26iBttT0mGDxNnpLFKlVJtzSAtFcicBg=";
+        hash = "sha256-6m6wmGzVOEY2oVAHsSMsAtgQK5zqC0D7U3s28pcH0ss=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-nMihtf/xLIxwqAVrF1BSRewdS2WThx0LZ5HZUI+OzM0=";
+        hash = "sha256-mgVCuTE2zYFRUW6Ukw7mUmPnOR4g/QUFYlWI3bux0es=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
index 2387b6ce5db6..ea86d807aafa 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.75";
+  "version" = "1.11.76";
   "hashes" = {
-    "desktopSrcHash" = "sha256-bO23E1xG3FfizBBAWh0kCN+5JYbiX5V/wxLlY6ljWVQ=";
+    "desktopSrcHash" = "sha256-oG1nzOSXl2vjxvxdVg2o5ssKbAqrYHS4pnLCPJsIBCQ=";
     "desktopYarnHash" = "0bl78yd7apd5qbsqyhxnwj7lwrjx5820zh22rzgn9jqkcv25jwgw";
-    "webSrcHash" = "sha256-cDayCoznbmALOiPg9FUYrfdFjzg0NV1NY9/b2KzTvMs=";
-    "webYarnHash" = "04si1x663z70nxj6nfaq7m2wcd8r4l3vdpirnjhc13wrj1kb8r8x";
+    "webSrcHash" = "sha256-1hmSdefNChRcUnwbxS00NYrEexMyg8FIL0BXdEbwm+s=";
+    "webYarnHash" = "0bnxd7kig2a5scgdsd0yhhmanf7zqi2gd2si6kgnr0v2kc0akc0b";
   };
 }
diff --git a/pkgs/by-name/am/amazon-ssm-agent/package.nix b/pkgs/by-name/am/amazon-ssm-agent/package.nix
index 19728be301a8..1c7cae5f152a 100644
--- a/pkgs/by-name/am/amazon-ssm-agent/package.nix
+++ b/pkgs/by-name/am/amazon-ssm-agent/package.nix
@@ -42,13 +42,13 @@ let
 in
 buildGoModule rec {
   pname = "amazon-ssm-agent";
-  version = "3.3.484.0";
+  version = "3.3.551.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-ssm-agent";
     rev = "refs/tags/${version}";
-    hash = "sha256-zWjV56xw4eVHKx3J2DDq6b+RYjU0EL9ShQmb72SVBVk=";
+    hash = "sha256-ncdLaHsQAdK1vtFzo55yWicKVfQHxpFpXYpODeG5/9I=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ma/mautrix-meta/package.nix b/pkgs/by-name/ma/mautrix-meta/package.nix
index 8a82adf188fd..a698fb6698b9 100644
--- a/pkgs/by-name/ma/mautrix-meta/package.nix
+++ b/pkgs/by-name/ma/mautrix-meta/package.nix
@@ -4,6 +4,12 @@
 , lib
 , nixosTests
 , olm
+# This option enables the use of an experimental pure-Go implementation of the
+# Olm protocol instead of libolm for end-to-end encryption. Using goolm is not
+# recommended by the mautrix developers, but they are interested in people
+# trying it out in non-production-critical environments and reporting any
+# issues they run into.
+, withGoolm ? false
 }:
 
 buildGoModule rec {
@@ -19,7 +25,8 @@ buildGoModule rec {
     hash = "sha256-whBqhdB2FSFfrbtGtq8v3pjXW7QMt+I0baHTXVGPWVg=";
   };
 
-  buildInputs = [ olm ];
+  buildInputs = lib.optional (!withGoolm) olm;
+  tags = lib.optional withGoolm "goolm";
 
   vendorHash = "sha256-rP9wvF6yYW0TdQ+vQV6ZcVMxnCtqz8xRcd9v+4pYYio=";
 
diff --git a/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix b/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix
new file mode 100644
index 000000000000..2a0850069317
--- /dev/null
+++ b/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix
@@ -0,0 +1,117 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  cmark,
+  darwin,
+  extra-cmake-modules,
+  gamemode,
+  ghc_filesystem,
+  jdk17,
+  kdePackages,
+  ninja,
+  nix-update-script,
+  stripJavaArchivesHook,
+  tomlplusplus,
+  zlib,
+
+  msaClientID ? null,
+  gamemodeSupport ? stdenv.isLinux,
+}:
+
+let
+  libnbtplusplus = fetchFromGitHub {
+    owner = "PrismLauncher";
+    repo = "libnbtplusplus";
+    rev = "a5e8fd52b8bf4ab5d5bcc042b2a247867589985f";
+    hash = "sha256-A5kTgICnx+Qdq3Fir/bKTfdTt/T1NQP2SC+nhN1ENug=";
+  };
+in
+
+assert lib.assertMsg (
+  gamemodeSupport -> stdenv.isLinux
+) "gamemodeSupport is only available on Linux.";
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "prismlauncher-unwrapped";
+  version = "8.4";
+
+  src = fetchFromGitHub {
+    owner = "PrismLauncher";
+    repo = "PrismLauncher";
+    rev = finalAttrs.version;
+    hash = "sha256-460hB91M2hZm+uU1tywJEj20oRd5cz/NDvya8/vJdSA=";
+  };
+
+  postUnpack = ''
+    rm -rf source/libraries/libnbtplusplus
+    ln -s ${libnbtplusplus} source/libraries/libnbtplusplus
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    extra-cmake-modules
+    jdk17
+    stripJavaArchivesHook
+  ];
+
+  buildInputs =
+    [
+      cmark
+      ghc_filesystem
+      kdePackages.qtbase
+      kdePackages.quazip
+      tomlplusplus
+      zlib
+    ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ]
+    ++ lib.optional gamemodeSupport gamemode;
+
+  hardeningEnable = lib.optionals stdenv.isLinux [ "pie" ];
+
+  cmakeFlags =
+    [
+      # downstream branding
+      (lib.cmakeFeature "Launcher_BUILD_PLATFORM" "nixpkgs")
+    ]
+    ++ lib.optionals (msaClientID != null) [
+      (lib.cmakeFeature "Launcher_MSA_CLIENT_ID" (toString msaClientID))
+    ]
+    ++ lib.optionals (lib.versionOlder kdePackages.qtbase.version "6") [
+      (lib.cmakeFeature "Launcher_QT_VERSION_MAJOR" "5")
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      # we wrap our binary manually
+      (lib.cmakeFeature "INSTALL_BUNDLE" "nodeps")
+      # disable built-in updater
+      (lib.cmakeFeature "MACOSX_SPARKLE_UPDATE_FEED_URL" "''")
+      (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/Applications/")
+    ];
+
+  dontWrapQtApps = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Free, open source launcher for Minecraft";
+    longDescription = ''
+      Allows you to have multiple, separate instances of Minecraft (each with
+      their own mods, texture packs, saves, etc) and helps you manage them and
+      their associated options with a simple interface.
+    '';
+    homepage = "https://prismlauncher.org/";
+    changelog = "https://github.com/PrismLauncher/PrismLauncher/releases/tag/${finalAttrs.src.rev}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      minion3665
+      Scrumplex
+      getchoo
+    ];
+    mainProgram = "prismlauncher";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/pr/prismlauncher/package.nix b/pkgs/by-name/pr/prismlauncher/package.nix
new file mode 100644
index 000000000000..c6ff6894389d
--- /dev/null
+++ b/pkgs/by-name/pr/prismlauncher/package.nix
@@ -0,0 +1,151 @@
+{
+  lib,
+  stdenv,
+  symlinkJoin,
+  prismlauncher-unwrapped,
+  addOpenGLRunpath,
+  flite,
+  gamemode,
+  glfw,
+  glfw-wayland-minecraft,
+  glxinfo,
+  jdk8,
+  jdk17,
+  jdk21,
+  kdePackages,
+  libGL,
+  libpulseaudio,
+  libusb1,
+  makeWrapper,
+  openal,
+  pciutils,
+  udev,
+  vulkan-loader,
+  xorg,
+
+  additionalLibs ? [ ],
+  additionalPrograms ? [ ],
+  controllerSupport ? stdenv.isLinux,
+  gamemodeSupport ? stdenv.isLinux,
+  jdks ? [
+    jdk21
+    jdk17
+    jdk8
+  ],
+  msaClientID ? null,
+  textToSpeechSupport ? stdenv.isLinux,
+
+  # Adds `glfw-wayland-minecraft` to `LD_LIBRARY_PATH`
+  # when launched on wayland, allowing for the game to be run natively.
+  # Make sure to enable "Use system installation of GLFW" in instance settings
+  # for this to take effect
+  #
+  # Warning: This build of glfw may be unstable, and the launcher
+  # itself can take slightly longer to start
+  withWaylandGLFW ? false,
+}:
+
+assert lib.assertMsg (
+  controllerSupport -> stdenv.isLinux
+) "controllerSupport only has an effect on Linux.";
+
+assert lib.assertMsg (
+  textToSpeechSupport -> stdenv.isLinux
+) "textToSpeechSupport only has an effect on Linux.";
+
+assert lib.assertMsg (
+  withWaylandGLFW -> stdenv.isLinux
+) "withWaylandGLFW is only available on Linux.";
+
+let
+  prismlauncher' = prismlauncher-unwrapped.override { inherit msaClientID gamemodeSupport; };
+in
+
+symlinkJoin {
+  name = "prismlauncher-${prismlauncher'.version}";
+
+  paths = [ prismlauncher' ];
+
+  nativeBuildInputs =
+    [ kdePackages.wrapQtAppsHook ]
+    # purposefully using a shell wrapper here for variable expansion
+    # see https://github.com/NixOS/nixpkgs/issues/172583
+    ++ lib.optional withWaylandGLFW makeWrapper;
+
+  buildInputs =
+    [
+      kdePackages.qtbase
+      kdePackages.qtsvg
+    ]
+    ++ lib.optional (
+      lib.versionAtLeast kdePackages.qtbase.version "6" && stdenv.isLinux
+    ) kdePackages.qtwayland;
+
+  env = {
+    waylandPreExec = lib.optionalString withWaylandGLFW ''
+      if [ -n "$WAYLAND_DISPLAY" ]; then
+        export LD_LIBRARY_PATH=${lib.getLib glfw-wayland-minecraft}/lib:"$LD_LIBRARY_PATH"
+      fi
+    '';
+  };
+
+  postBuild =
+    lib.optionalString withWaylandGLFW ''
+      qtWrapperArgs+=(--run "$waylandPreExec")
+    ''
+    + ''
+      wrapQtAppsHook
+    '';
+
+  qtWrapperArgs =
+    let
+      runtimeLibs =
+        [
+          # lwjgl
+          glfw
+          libpulseaudio
+          libGL
+          openal
+          stdenv.cc.cc.lib
+
+          vulkan-loader # VulkanMod's lwjgl
+
+          udev # oshi
+
+          xorg.libX11
+          xorg.libXext
+          xorg.libXcursor
+          xorg.libXrandr
+          xorg.libXxf86vm
+        ]
+        ++ lib.optional textToSpeechSupport flite
+        ++ lib.optional gamemodeSupport gamemode.lib
+        ++ lib.optional controllerSupport libusb1
+        ++ additionalLibs;
+
+      runtimePrograms = [
+        glxinfo
+        pciutils # need lspci
+        xorg.xrandr # needed for LWJGL [2.9.2, 3) https://github.com/LWJGL/lwjgl/issues/128
+      ] ++ additionalPrograms;
+
+    in
+    [ "--prefix PRISMLAUNCHER_JAVA_PATHS : ${lib.makeSearchPath "bin/java" jdks}" ]
+    ++ lib.optionals stdenv.isLinux [
+      "--set LD_LIBRARY_PATH ${addOpenGLRunpath.driverLink}/lib:${lib.makeLibraryPath runtimeLibs}"
+      "--prefix PATH : ${lib.makeBinPath runtimePrograms}"
+    ];
+
+  meta = {
+    inherit (prismlauncher'.meta)
+      description
+      longDescription
+      homepage
+      changelog
+      license
+      maintainers
+      mainProgram
+      platforms
+      ;
+  };
+}
diff --git a/pkgs/by-name/st/stats/package.nix b/pkgs/by-name/st/stats/package.nix
index b6c38f73d694..a476ce5cfa39 100644
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.11.4";
+  version = "2.11.7";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-Cm5gu+rL3eerAOnNcNUL2MlXsxV2jMiJLwgGtskIVP4=";
+    hash = "sha256-UppO7Cky+9xYg292t/78GPJ822kJ0RMG9yvetxRMVsU=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/xi/xivlauncher/deps.nix b/pkgs/by-name/xi/xivlauncher/deps.nix
index fa156e58d6e8..fa65ff3a7d1f 100644
--- a/pkgs/by-name/xi/xivlauncher/deps.nix
+++ b/pkgs/by-name/xi/xivlauncher/deps.nix
@@ -10,8 +10,6 @@
   (fetchNuGet { pname = "goaaats.Steamworks"; version = "2.3.4"; sha256 = "1khxkkjvh6af60rxc13bacxn85amdfzr8z0b9a6gfg6m1fnmlkss"; })
   (fetchNuGet { pname = "ImGui.NET"; version = "1.87.2"; sha256 = "0rv0n18fvz1gbh45crhzn1f8xw8zkc8qyiyj91vajjcry8mq1x7q"; })
   (fetchNuGet { pname = "KeySharp"; version = "1.0.5"; sha256 = "1ic10v0a174fw6w89iyg4yzji36bsj15573y676cj5n09n6s75d4"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.30"; sha256 = "17k3l8xd5bsyk69bm5q4nxbpb4i0izw1kzmzi7j3p8pmm9prgrpy"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.30"; sha256 = "18v0l07q74m5xxaf6y6dkmr6and8ivya0nslffnr4djrxcbiygdr"; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.3"; sha256 = "09m4cpry8ivm9ga1abrxmvw16sslxhy2k5sl14zckhqb1j164im6"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.BannedApiAnalyzers"; version = "3.3.3"; sha256 = "1z6x0d8lpcfjr3sxy25493i17vvcg5bsay6c03qan6mnj5aqzw2k"; })
@@ -22,9 +20,6 @@
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
   (fetchNuGet { pname = "Microsoft.DotNet.PlatformAbstractions"; version = "2.0.3"; sha256 = "020214swxm0hip1d9gjskrzmqzjnji7c6l5b3xcch8vp166066m9"; })
   (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "2.0.3"; sha256 = "0dpyjp0hy9kkvk2dd4dclfmb10yq5avsw2a6v8nra9g6ii2p1nla"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.30"; sha256 = "0ss3108c2h7afypvliyqixv4dll60sq9iwqy90k1p132znpszrmb"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.30"; sha256 = "1wqqjhhlqz4dmijcx3kg3hnwq0s0jzqsddaksskzhq8avr4ziy18"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.30"; sha256 = "1s81sj8lnb8szqawxh3vc8wi815ln12cyhrl3f7hwcpay57xgswx"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
diff --git a/pkgs/by-name/xi/xivlauncher/package.nix b/pkgs/by-name/xi/xivlauncher/package.nix
index 064bce81d8d9..86fb36532711 100644
--- a/pkgs/by-name/xi/xivlauncher/package.nix
+++ b/pkgs/by-name/xi/xivlauncher/package.nix
@@ -3,7 +3,7 @@
 , useSteamRun ? true }:
 
 let
-  rev = "1.0.9";
+  rev = "1.1.0";
 in
   buildDotnetModule rec {
     pname = "XIVLauncher";
@@ -13,7 +13,7 @@ in
       owner = "goatcorp";
       repo = "XIVLauncher.Core";
       inherit rev;
-      hash = "sha256-UOKJMQPule0swwm5p6OPcOt1SYHji2J4MWvN6nGkj/M=";
+      hash = "sha256-vf9cGY+JvMBpQliS1LDmbWjtAbXByrIeXThKtJGQrO8=";
       fetchSubmodules = true;
     };
 
@@ -26,7 +26,7 @@ in
 
     # please do not unpin these even if they match the defaults, xivlauncher is sensitive to .NET versions
     dotnet-sdk = dotnetCorePackages.sdk_8_0;
-    dotnet-runtime = dotnetCorePackages.runtime_6_0;
+    dotnet-runtime = dotnetCorePackages.runtime_8_0;
 
     dotnetFlags = [
       "-p:BuildHash=${rev}"
@@ -52,7 +52,7 @@ in
       }).run;
     in ''
       substituteInPlace $out/bin/XIVLauncher.Core \
-        --replace 'exec' 'exec ${steam-run}/bin/steam-run'
+        --replace-fail 'exec' 'exec ${steam-run}/bin/steam-run'
     '') + ''
       wrapProgram $out/bin/XIVLauncher.Core --prefix GST_PLUGIN_SYSTEM_PATH_1_0 ":" "$GST_PLUGIN_SYSTEM_PATH_1_0"
       # the reference to aria2 gets mangled as UTF-16LE and isn't detectable by nix: https://github.com/NixOS/nixpkgs/issues/220065
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index f31df964319c..263bfa24d7d3 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -93,9 +93,9 @@ in {
       major = "3";
       minor = "13";
       patch = "0";
-      suffix = "b3";
+      suffix = "rc1";
     };
-    hash = "sha256-O+CUrQixHcKgZUY1JCOceNyfKzQrAdzU4eYG27xceKU=";
+    hash = "sha256-Z4uIR3XuwCJNUVn6kAh5AgusoqNs6UL9lf6/oa20pr0=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 03485e92ea95..41f5d6a53f43 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.2.120";
+  version = "0.2.124";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-n+EWwjz4+zmwqDGzBRi2rtnxe+mxd906JcqtrbGiz4w=";
+    hash = "sha256-l+rq3L4JQcc8mXbBukAOTtoX0Z7fudYxAIPnPFvupjQ=";
   };
 
-  vendorHash = "sha256-RtHTAigoPlmop9XURD1nw1nCkGJCdYwFUnp5AWp3x3M=";
+  vendorHash = "sha256-rFFaRtEXc+rCCxUckrnFq79zIXg2XETa+hPZo1usBrc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/games/prismlauncher/default.nix b/pkgs/games/prismlauncher/default.nix
deleted file mode 100644
index a2aabb72f0d7..000000000000
--- a/pkgs/games/prismlauncher/default.nix
+++ /dev/null
@@ -1,90 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, stripJavaArchivesHook
-, cmake
-, cmark
-, Cocoa
-, ninja
-, jdk17
-, zlib
-, qtbase
-, quazip
-, extra-cmake-modules
-, tomlplusplus
-, ghc_filesystem
-, gamemode
-, msaClientID ? null
-, gamemodeSupport ? stdenv.isLinux
-,
-}:
-let
-  libnbtplusplus = fetchFromGitHub {
-    owner = "PrismLauncher";
-    repo = "libnbtplusplus";
-    rev = "a5e8fd52b8bf4ab5d5bcc042b2a247867589985f";
-    hash = "sha256-A5kTgICnx+Qdq3Fir/bKTfdTt/T1NQP2SC+nhN1ENug=";
-  };
-in
-
-assert lib.assertMsg (stdenv.isLinux || !gamemodeSupport) "gamemodeSupport is only available on Linux";
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "prismlauncher-unwrapped";
-  version = "8.3";
-
-  src = fetchFromGitHub {
-    owner = "PrismLauncher";
-    repo = "PrismLauncher";
-    rev = finalAttrs.version;
-    hash = "sha256-1YGzCgNdzscnOVeNlHMFJa0RbMo6C2qQjtBOeDxHakI=";
-  };
-
-  nativeBuildInputs = [ extra-cmake-modules cmake jdk17 ninja stripJavaArchivesHook ];
-  buildInputs =
-    [
-      qtbase
-      zlib
-      quazip
-      ghc_filesystem
-      tomlplusplus
-      cmark
-    ]
-    ++ lib.optional gamemodeSupport gamemode
-    ++ lib.optionals stdenv.isDarwin [ Cocoa ];
-
-  hardeningEnable = lib.optionals stdenv.isLinux [ "pie" ];
-
-  cmakeFlags = [
-    # downstream branding
-    "-DLauncher_BUILD_PLATFORM=nixpkgs"
-  ] ++ lib.optionals (msaClientID != null) [ "-DLauncher_MSA_CLIENT_ID=${msaClientID}" ]
-  ++ lib.optionals (lib.versionOlder qtbase.version "6") [ "-DLauncher_QT_VERSION_MAJOR=5" ]
-  ++ lib.optionals stdenv.isDarwin [
-    "-DINSTALL_BUNDLE=nodeps"
-    "-DMACOSX_SPARKLE_UPDATE_FEED_URL=''"
-    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/Applications/"
-  ];
-
-  postUnpack = ''
-    rm -rf source/libraries/libnbtplusplus
-    ln -s ${libnbtplusplus} source/libraries/libnbtplusplus
-  '';
-
-  dontWrapQtApps = true;
-
-  meta = {
-    mainProgram = "prismlauncher";
-    homepage = "https://prismlauncher.org/";
-    description = "A free, open source launcher for Minecraft";
-    longDescription = ''
-      Allows you to have multiple, separate instances of Minecraft (each with
-      their own mods, texture packs, saves, etc) and helps you manage them and
-      their associated options with a simple interface.
-    '';
-    platforms = with lib.platforms; linux ++ darwin;
-    changelog = "https://github.com/PrismLauncher/PrismLauncher/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ minion3665 Scrumplex getchoo ];
-  };
-})
diff --git a/pkgs/games/prismlauncher/wrapper.nix b/pkgs/games/prismlauncher/wrapper.nix
deleted file mode 100644
index f5b21d70844f..000000000000
--- a/pkgs/games/prismlauncher/wrapper.nix
+++ /dev/null
@@ -1,130 +0,0 @@
-{ lib
-, stdenv
-, symlinkJoin
-, makeWrapper
-, wrapQtAppsHook
-, addOpenGLRunpath
-
-, prismlauncher-unwrapped
-
-, qtbase  # needed for wrapQtAppsHook
-, qtsvg
-, qtwayland
-, xorg
-, libpulseaudio
-, libGL
-, glfw
-, glfw-wayland-minecraft
-, openal
-, jdk8
-, jdk17
-, jdk21
-, gamemode
-, flite
-, glxinfo
-, pciutils
-, udev
-, vulkan-loader
-, libusb1
-
-, msaClientID ? null
-, gamemodeSupport ? stdenv.isLinux
-, textToSpeechSupport ? stdenv.isLinux
-, controllerSupport ? stdenv.isLinux
-
-  # Adds `glfw-wayland-minecraft` to `LD_LIBRARY_PATH`
-  # when launched on wayland, allowing for the game to be run natively.
-  # Make sure to enable "Use system installation of GLFW" in instance settings
-  # for this to take effect
-  #
-  # Warning: This build of glfw may be unstable, and the launcher
-  # itself can take slightly longer to start
-, withWaylandGLFW ? false
-
-, jdks ? [ jdk21 jdk17 jdk8 ]
-, additionalLibs ? [ ]
-, additionalPrograms ? [ ]
-}:
-
-assert lib.assertMsg (withWaylandGLFW -> stdenv.isLinux) "withWaylandGLFW is only available on Linux";
-
-let
-  prismlauncher' = prismlauncher-unwrapped.override {
-    inherit msaClientID gamemodeSupport;
-  };
-in
-
-symlinkJoin {
-  name = "prismlauncher-${prismlauncher'.version}";
-
-  paths = [ prismlauncher' ];
-
-  nativeBuildInputs = [
-    wrapQtAppsHook
-  ]
-  # purposefully using a shell wrapper here for variable expansion
-  # see https://github.com/NixOS/nixpkgs/issues/172583
-  ++ lib.optional withWaylandGLFW makeWrapper;
-
-  buildInputs = [
-    qtbase
-    qtsvg
-  ]
-  ++ lib.optional (lib.versionAtLeast qtbase.version "6" && stdenv.isLinux) qtwayland;
-
-  waylandPreExec = lib.optionalString withWaylandGLFW ''
-    if [ -n "$WAYLAND_DISPLAY" ]; then
-      export LD_LIBRARY_PATH=${lib.getLib glfw-wayland-minecraft}/lib:"$LD_LIBRARY_PATH"
-    fi
-  '';
-
-  postBuild = ''
-    ${lib.optionalString withWaylandGLFW ''
-      qtWrapperArgs+=(--run "$waylandPreExec")
-    ''}
-
-    wrapQtAppsHook
-  '';
-
-  qtWrapperArgs =
-    let
-      runtimeLibs = [
-        xorg.libX11
-        xorg.libXext
-        xorg.libXcursor
-        xorg.libXrandr
-        xorg.libXxf86vm
-
-        # lwjgl
-        libpulseaudio
-        libGL
-        glfw
-        openal
-        stdenv.cc.cc.lib
-        vulkan-loader # VulkanMod's lwjgl
-
-        # oshi
-        udev
-      ]
-      ++ lib.optional gamemodeSupport gamemode.lib
-      ++ lib.optional textToSpeechSupport flite
-      ++ lib.optional controllerSupport libusb1
-      ++ additionalLibs;
-
-      runtimePrograms = [
-        xorg.xrandr
-        glxinfo
-        pciutils # need lspci
-      ]
-      ++ additionalPrograms;
-
-    in
-    [ "--prefix PRISMLAUNCHER_JAVA_PATHS : ${lib.makeSearchPath "bin/java" jdks}" ]
-    ++ lib.optionals stdenv.isLinux [
-      "--set LD_LIBRARY_PATH ${addOpenGLRunpath.driverLink}/lib:${lib.makeLibraryPath runtimeLibs}"
-      # xorg.xrandr needed for LWJGL [2.9.2, 3) https://github.com/LWJGL/lwjgl/issues/128
-      "--prefix PATH : ${lib.makeBinPath runtimePrograms}"
-    ];
-
-  inherit (prismlauncher') meta;
-}
diff --git a/pkgs/os-specific/linux/zenmonitor/default.nix b/pkgs/os-specific/linux/zenmonitor/default.nix
index 8101f47c6a24..bf9ddbc5fec5 100644
--- a/pkgs/os-specific/linux/zenmonitor/default.nix
+++ b/pkgs/os-specific/linux/zenmonitor/default.nix
@@ -1,14 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook3 }:
+{ lib, stdenv, fetchFromGitea, pkg-config, gtk3, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "zenmonitor";
-  version = "2.0.0";
+  version = "unstable-2024-05-21";
 
-  src = fetchFromGitHub {
-    owner = "Ta180m";
+  src = fetchFromGitea {
+    domain = "git.exozy.me";
+    owner = "a";
     repo = "zenmonitor3";
-    rev = "v${version}";
-    sha256 = "sha256-2EsuSMXnnMg0e0JD1TXJplsi7sOg9em0qqge2WlC6ro=";
+    rev = "a09f0b25d33967fd32f3831304be049b008cdabf";
+    sha256 = "sha256-5N1Hhv2s0cv4Rujw4wFGHyIy7NyKAFThVvAo+xXqSyk=";
   };
 
   buildInputs = [ gtk3 ];
diff --git a/pkgs/servers/mautrix-signal/default.nix b/pkgs/servers/mautrix-signal/default.nix
index 7f9641a74ca9..9fd22d387aa6 100644
--- a/pkgs/servers/mautrix-signal/default.nix
+++ b/pkgs/servers/mautrix-signal/default.nix
@@ -1,4 +1,16 @@
-{ lib, buildGoModule, fetchFromGitHub, olm, libsignal-ffi }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  olm,
+  libsignal-ffi,
+  # This option enables the use of an experimental pure-Go implementation of
+  # the Olm protocol instead of libolm for end-to-end encryption. Using goolm
+  # is not recommended by the mautrix developers, but they are interested in
+  # people trying it out in non-production-critical environments and reporting
+  # any issues they run into.
+  withGoolm ? false,
+}:
 
 buildGoModule rec {
   pname = "mautrix-signal";
@@ -11,12 +23,12 @@ buildGoModule rec {
     hash = "sha256-KBb/rLYM2ne4VD/bPy/lcXD0avCx3J74e3zDcmg+Dzs=";
   };
 
-  buildInputs = [
-    olm
+  buildInputs = (lib.optional (!withGoolm) olm) ++ [
     # must match the version used in https://github.com/mautrix/signal/tree/main/pkg/libsignalgo
     # see https://github.com/mautrix/signal/issues/401
     libsignal-ffi
   ];
+  tags = lib.optional withGoolm "goolm";
 
   vendorHash = "sha256-DDcz4O3RhV6OVI+qC/LkDW/UsE5jOAn5t/gmILxHx1s=";
 
diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index d7bad1c9c79b..b66dad00dad5 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -1,4 +1,15 @@
-{ lib, buildGoModule, fetchFromGitHub, olm }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  olm,
+  # This option enables the use of an experimental pure-Go implementation of
+  # the Olm protocol instead of libolm for end-to-end encryption. Using goolm
+  # is not recommended by the mautrix developers, but they are interested in
+  # people trying it out in non-production-critical environments and reporting
+  # any issues they run into.
+  withGoolm ? false,
+}:
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
@@ -11,7 +22,8 @@ buildGoModule rec {
     hash = "sha256-iVILI6OGndnxIVmgNcIwHA64tkv9V3OTH3YtrCyeYx4=";
   };
 
-  buildInputs = [ olm ];
+  buildInputs = lib.optional (!withGoolm) olm;
+  tags = lib.optional withGoolm "goolm";
 
   vendorHash = "sha256-DpgkSXSLF+U6zIzJ4AF2uTcFWQQYsRgkaUTG9F+bnVk=";
 
diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix
index 6ec9c8c378f2..3052017dd4aa 100644
--- a/pkgs/servers/roundcube/default.nix
+++ b/pkgs/servers/roundcube/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
-  version = "1.6.8";
+  version = "1.6.9";
 
   src = fetchurl {
     url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz";
-    sha256 = "sha256-hGi+AgSnNMV0re9L4BV4x9xPq5wv40ADvzQaK9IO/So=";
+    sha256 = "sha256-thpfXCL4kMKZ6TWqz88IcGdpkNiuv/DWzf8HW/F8708=";
   };
 
   patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index fd0529d46f31..4479c322838d 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -4,6 +4,7 @@
 , fetchurl
 , fetchFromGitHub
 , fetchPypi
+, fetchpatch
 
 # Build time
 , cmake
@@ -318,6 +319,39 @@ in rec {
     pname = "ceph";
     inherit src version;
 
+    patches = [
+      # Fixes mgr not being able to import `packaging` due to autotools >= 70.
+      # Remove once https://github.com/ceph/ceph/pull/58624 is merged, see
+      # https://github.com/NixOS/nixpkgs/pull/330226#issuecomment-2268421031
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/commit/8da2d857fa8fdfedd7aad0ca90e1780a3ed085c9.patch";
+        name = "ceph-mgr-python-fix-packaging-import.patch";
+        hash = "sha256-3Yl1X6UfTf0XCXJxgRnM/Js9sz8tS+hsqViY6gDExoI=";
+      })
+
+      # Fixes cryptesetup version parsing regex, see
+      # * https://github.com/NixOS/nixpkgs/issues/334227
+      # * https://www.mail-archive.com/ceph-users@ceph.io/msg26309.html
+      # * https://github.com/ceph/ceph/pull/58997
+      # Remove once we're on the next version of Ceph 18, when this should be in:
+      # https://github.com/ceph/ceph/pull/58997
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/commit/6ae874902b63652fa199563b6e7950cd75151304.patch";
+        name = "ceph-reef-ceph-volume-fix-set_dmcrypt_no_workqueue.patch";
+        hash = "sha256-r+7hcCz2WF/rJfgKwTatKY9unJlE8Uw3fmOyaY5jVH0=";
+      })
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/commit/607eb34b2c278566c386efcbf3018629cf08ccfd.patch";
+        name = "ceph-volume-fix-set_dmcrypt_no_workqueue-regex.patch";
+        hash = "sha256-q28Q7OIyFoMyMBCPXGA+AdNqp+9/6J/XwD4ODjx+JXY=";
+      })
+    ];
+
+    postPatch = ''
+      substituteInPlace cmake/modules/Finduring.cmake \
+        --replace-fail "liburing.a liburing" "uring"
+    '';
+
     nativeBuildInputs = [
       cmake
       fmt
@@ -474,7 +508,8 @@ in rec {
         inherit (nixosTests)
           ceph-multi-node
           ceph-single-node
-          ceph-single-node-bluestore;
+          ceph-single-node-bluestore
+          ceph-single-node-bluestore-dmcrypt;
       };
     };
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 36168290db68..6b677c743886 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -37070,12 +37070,6 @@ with pkgs;
 
   principia = callPackage ../games/principia { };
 
-  prismlauncher-unwrapped = kdePackages.callPackage ../games/prismlauncher {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
-
-  prismlauncher = kdePackages.callPackage ../games/prismlauncher/wrapper.nix { };
-
   pong3d = callPackage ../games/pong3d { };
 
   pokerth = libsForQt5.callPackage ../games/pokerth {
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index a596da13643e..a606a7886aca 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -356,7 +356,10 @@ in {
 
     intel-speed-select = if lib.versionAtLeast kernel.version "5.3" then callPackage ../os-specific/linux/intel-speed-select { } else null;
 
-    ipu6-drivers = callPackage ../os-specific/linux/ipu6-drivers {};
+    ipu6-drivers =
+      if kernelOlder "6.10"
+      then callPackage ../os-specific/linux/ipu6-drivers {}
+      else null;
 
     ivsc-driver = callPackage ../os-specific/linux/ivsc-driver {};