diff --git a/lib/path/default.nix b/lib/path/default.nix
index 5c6c5f608954..1a55a2a7be8d 100644
--- a/lib/path/default.nix
+++ b/lib/path/default.nix
@@ -121,17 +121,18 @@ let
 
 in /* No rec! Add dependencies on this file at the top. */ {
 
-  /* Append a subpath string to a path.
+  /*
+    Append a subpath string to a path.
 
     Like `path + ("/" + string)` but safer, because it errors instead of returning potentially surprising results.
     More specifically, it checks that the first argument is a [path value type](https://nixos.org/manual/nix/stable/language/values.html#type-path"),
-    and that the second argument is a valid subpath string (see `lib.path.subpath.isValid`).
+    and that the second argument is a [valid subpath string](#function-library-lib.path.subpath.isValid).
 
     Laws:
 
-    - Not influenced by subpath normalisation
+    - Not influenced by subpath [normalisation](#function-library-lib.path.subpath.normalise):
 
-        append p s == append p (subpath.normalise s)
+          append p s == append p (subpath.normalise s)
 
     Type:
       append :: Path -> String -> Path
@@ -175,26 +176,26 @@ in /* No rec! Add dependencies on this file at the top. */ {
     path + ("/" + subpath);
 
   /*
-  Whether the first path is a component-wise prefix of the second path.
+    Whether the first path is a component-wise prefix of the second path.
 
-  Laws:
+    Laws:
 
-  - `hasPrefix p q` is only true if `q == append p s` for some subpath `s`.
+    - `hasPrefix p q` is only true if [`q == append p s`](#function-library-lib.path.append) for some [subpath](#function-library-lib.path.subpath.isValid) `s`.
 
-  - `hasPrefix` is a [non-strict partial order](https://en.wikipedia.org/wiki/Partially_ordered_set#Non-strict_partial_order) over the set of all path values
+    - `hasPrefix` is a [non-strict partial order](https://en.wikipedia.org/wiki/Partially_ordered_set#Non-strict_partial_order) over the set of all path values.
 
-  Type:
-    hasPrefix :: Path -> Path -> Bool
+    Type:
+      hasPrefix :: Path -> Path -> Bool
 
-  Example:
-    hasPrefix /foo /foo/bar
-    => true
-    hasPrefix /foo /foo
-    => true
-    hasPrefix /foo/bar /foo
-    => false
-    hasPrefix /. /foo
-    => true
+    Example:
+      hasPrefix /foo /foo/bar
+      => true
+      hasPrefix /foo /foo
+      => true
+      hasPrefix /foo/bar /foo
+      => false
+      hasPrefix /. /foo
+      => true
   */
   hasPrefix =
     path1:
@@ -219,27 +220,27 @@ in /* No rec! Add dependencies on this file at the top. */ {
         take (length path1Deconstructed.components) path2Deconstructed.components == path1Deconstructed.components;
 
   /*
-  Remove the first path as a component-wise prefix from the second path.
-  The result is a normalised subpath string, see `lib.path.subpath.normalise`.
+    Remove the first path as a component-wise prefix from the second path.
+    The result is a [normalised subpath string](#function-library-lib.path.subpath.normalise).
 
-  Laws:
+    Laws:
 
-  - Inverts `append` for normalised subpaths:
+    - Inverts [`append`](#function-library-lib.path.append) for [normalised subpath string](#function-library-lib.path.subpath.normalise):
 
-        removePrefix p (append p s) == subpath.normalise s
+          removePrefix p (append p s) == subpath.normalise s
 
-  Type:
-    removePrefix :: Path -> Path -> String
+    Type:
+      removePrefix :: Path -> Path -> String
 
-  Example:
-    removePrefix /foo /foo/bar/baz
-    => "./bar/baz"
-    removePrefix /foo /foo
-    => "./."
-    removePrefix /foo/bar /foo
-    => <error>
-    removePrefix /. /foo
-    => "./foo"
+    Example:
+      removePrefix /foo /foo/bar/baz
+      => "./bar/baz"
+      removePrefix /foo /foo
+      => "./."
+      removePrefix /foo/bar /foo
+      => <error>
+      removePrefix /. /foo
+      => "./foo"
   */
   removePrefix =
     path1:
@@ -272,41 +273,43 @@ in /* No rec! Add dependencies on this file at the top. */ {
         joinRelPath components;
 
   /*
-  Split the filesystem root from a [path](https://nixos.org/manual/nix/stable/language/values.html#type-path).
-  The result is an attribute set with these attributes:
-  - `root`: The filesystem root of the path, meaning that this directory has no parent directory.
-  - `subpath`: The [normalised subpath string](#function-library-lib.path.subpath.normalise) that when [appended](#function-library-lib.path.append) to `root` returns the original path.
+    Split the filesystem root from a [path](https://nixos.org/manual/nix/stable/language/values.html#type-path).
+    The result is an attribute set with these attributes:
+    - `root`: The filesystem root of the path, meaning that this directory has no parent directory.
+    - `subpath`: The [normalised subpath string](#function-library-lib.path.subpath.normalise) that when [appended](#function-library-lib.path.append) to `root` returns the original path.
 
-  Laws:
-  - [Appending](#function-library-lib.path.append) the `root` and `subpath` gives the original path:
+    Laws:
+    - [Appending](#function-library-lib.path.append) the `root` and `subpath` gives the original path:
 
-        p ==
-          append
-            (splitRoot p).root
-            (splitRoot p).subpath
+          p ==
+            append
+              (splitRoot p).root
+              (splitRoot p).subpath
 
-  - Trying to get the parent directory of `root` using [`readDir`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-readDir) returns `root` itself:
+    - Trying to get the parent directory of `root` using [`readDir`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-readDir) returns `root` itself:
 
-        dirOf (splitRoot p).root == (splitRoot p).root
+          dirOf (splitRoot p).root == (splitRoot p).root
 
-  Type:
-    splitRoot :: Path -> { root :: Path, subpath :: String }
+    Type:
+      splitRoot :: Path -> { root :: Path, subpath :: String }
 
-  Example:
-    splitRoot /foo/bar
-    => { root = /.; subpath = "./foo/bar"; }
+    Example:
+      splitRoot /foo/bar
+      => { root = /.; subpath = "./foo/bar"; }
 
-    splitRoot /.
-    => { root = /.; subpath = "./."; }
+      splitRoot /.
+      => { root = /.; subpath = "./."; }
 
-    # Nix neutralises `..` path components for all path values automatically
-    splitRoot /foo/../bar
-    => { root = /.; subpath = "./bar"; }
+      # Nix neutralises `..` path components for all path values automatically
+      splitRoot /foo/../bar
+      => { root = /.; subpath = "./bar"; }
 
-    splitRoot "/foo/bar"
-    => <error>
+      splitRoot "/foo/bar"
+      => <error>
   */
-  splitRoot = path:
+  splitRoot =
+    # The path to split the root off of
+    path:
     assert assertMsg
       (isPath path)
       "lib.path.splitRoot: Argument is of type ${typeOf path}, but a path was expected";
@@ -317,46 +320,47 @@ in /* No rec! Add dependencies on this file at the top. */ {
       subpath = joinRelPath deconstructed.components;
     };
 
-  /* Whether a value is a valid subpath string.
+  /*
+    Whether a value is a valid subpath string.
 
-  A subpath string points to a specific file or directory within an absolute base directory.
-  It is a stricter form of a relative path that excludes `..` components, since those could escape the base directory.
+    A subpath string points to a specific file or directory within an absolute base directory.
+    It is a stricter form of a relative path that excludes `..` components, since those could escape the base directory.
 
-  - The value is a string
+    - The value is a string.
 
-  - The string is not empty
+    - The string is not empty.
 
-  - The string doesn't start with a `/`
+    - The string doesn't start with a `/`.
 
-  - The string doesn't contain any `..` path components
+    - The string doesn't contain any `..` path components.
 
-  Type:
-    subpath.isValid :: String -> Bool
+    Type:
+      subpath.isValid :: String -> Bool
 
-  Example:
-    # Not a string
-    subpath.isValid null
-    => false
+    Example:
+      # Not a string
+      subpath.isValid null
+      => false
 
-    # Empty string
-    subpath.isValid ""
-    => false
+      # Empty string
+      subpath.isValid ""
+      => false
 
-    # Absolute path
-    subpath.isValid "/foo"
-    => false
+      # Absolute path
+      subpath.isValid "/foo"
+      => false
 
-    # Contains a `..` path component
-    subpath.isValid "../foo"
-    => false
+      # Contains a `..` path component
+      subpath.isValid "../foo"
+      => false
 
-    # Valid subpath
-    subpath.isValid "foo/bar"
-    => true
+      # Valid subpath
+      subpath.isValid "foo/bar"
+      => true
 
-    # Doesn't need to be normalised
-    subpath.isValid "./foo//bar/"
-    => true
+      # Doesn't need to be normalised
+      subpath.isValid "./foo//bar/"
+      => true
   */
   subpath.isValid =
     # The value to check
@@ -364,15 +368,16 @@ in /* No rec! Add dependencies on this file at the top. */ {
     subpathInvalidReason value == null;
 
 
-  /* Join subpath strings together using `/`, returning a normalised subpath string.
+  /*
+    Join subpath strings together using `/`, returning a normalised subpath string.
 
     Like `concatStringsSep "/"` but safer, specifically:
 
-    - All elements must be valid subpath strings, see `lib.path.subpath.isValid`
+    - All elements must be [valid subpath strings](#function-library-lib.path.subpath.isValid).
 
-    - The result gets normalised, see `lib.path.subpath.normalise`
+    - The result gets [normalised](#function-library-lib.path.subpath.normalise).
 
-    - The edge case of an empty list gets properly handled by returning the neutral subpath `"./."`
+    - The edge case of an empty list gets properly handled by returning the neutral subpath `"./."`.
 
     Laws:
 
@@ -386,12 +391,12 @@ in /* No rec! Add dependencies on this file at the top. */ {
           subpath.join [ (subpath.normalise p) "./." ] == subpath.normalise p
           subpath.join [ "./." (subpath.normalise p) ] == subpath.normalise p
 
-    - Normalisation - the result is normalised according to `lib.path.subpath.normalise`:
+    - Normalisation - the result is [normalised](#function-library-lib.path.subpath.normalise):
 
           subpath.join ps == subpath.normalise (subpath.join ps)
 
-    - For non-empty lists, the implementation is equivalent to normalising the result of `concatStringsSep "/"`.
-      Note that the above laws can be derived from this one.
+    - For non-empty lists, the implementation is equivalent to [normalising](#function-library-lib.path.subpath.normalise) the result of `concatStringsSep "/"`.
+      Note that the above laws can be derived from this one:
 
           ps != [] -> subpath.join ps == subpath.normalise (concatStringsSep "/" ps)
 
@@ -439,108 +444,109 @@ in /* No rec! Add dependencies on this file at the top. */ {
       ) 0 subpaths;
 
   /*
-  Split [a subpath](#function-library-lib.path.subpath.isValid) into its path component strings.
-  Throw an error if the subpath isn't valid.
-  Note that the returned path components are also valid subpath strings, though they are intentionally not [normalised](#function-library-lib.path.subpath.normalise).
+    Split [a subpath](#function-library-lib.path.subpath.isValid) into its path component strings.
+    Throw an error if the subpath isn't valid.
+    Note that the returned path components are also [valid subpath strings](#function-library-lib.path.subpath.isValid), though they are intentionally not [normalised](#function-library-lib.path.subpath.normalise).
 
-  Laws:
+    Laws:
 
-  - Splitting a subpath into components and [joining](#function-library-lib.path.subpath.join) the components gives the same subpath but [normalised](#function-library-lib.path.subpath.normalise):
+    - Splitting a subpath into components and [joining](#function-library-lib.path.subpath.join) the components gives the same subpath but [normalised](#function-library-lib.path.subpath.normalise):
 
-        subpath.join (subpath.components s) == subpath.normalise s
+          subpath.join (subpath.components s) == subpath.normalise s
 
-  Type:
-    subpath.components :: String -> [ String ]
+    Type:
+      subpath.components :: String -> [ String ]
 
-  Example:
-    subpath.components "."
-    => [ ]
+    Example:
+      subpath.components "."
+      => [ ]
 
-    subpath.components "./foo//bar/./baz/"
-    => [ "foo" "bar" "baz" ]
+      subpath.components "./foo//bar/./baz/"
+      => [ "foo" "bar" "baz" ]
 
-    subpath.components "/foo"
-    => <error>
+      subpath.components "/foo"
+      => <error>
   */
   subpath.components =
+    # The subpath string to split into components
     subpath:
     assert assertMsg (isValid subpath) ''
       lib.path.subpath.components: Argument is not a valid subpath string:
           ${subpathInvalidReason subpath}'';
     splitRelPath subpath;
 
-  /* Normalise a subpath. Throw an error if the subpath isn't valid, see
-  `lib.path.subpath.isValid`
+  /*
+    Normalise a subpath. Throw an error if the subpath isn't [valid](#function-library-lib.path.subpath.isValid).
 
-  - Limit repeating `/` to a single one
+    - Limit repeating `/` to a single one.
 
-  - Remove redundant `.` components
+    - Remove redundant `.` components.
 
-  - Remove trailing `/` and `/.`
+    - Remove trailing `/` and `/.`.
 
-  - Add leading `./`
+    - Add leading `./`.
 
-  Laws:
+    Laws:
 
-  - Idempotency - normalising multiple times gives the same result:
+    - Idempotency - normalising multiple times gives the same result:
 
-        subpath.normalise (subpath.normalise p) == subpath.normalise p
+          subpath.normalise (subpath.normalise p) == subpath.normalise p
 
-  - Uniqueness - there's only a single normalisation for the paths that lead to the same file system node:
+    - Uniqueness - there's only a single normalisation for the paths that lead to the same file system node:
 
-        subpath.normalise p != subpath.normalise q -> $(realpath ${p}) != $(realpath ${q})
+          subpath.normalise p != subpath.normalise q -> $(realpath ${p}) != $(realpath ${q})
 
-  - Don't change the result when appended to a Nix path value:
+    - Don't change the result when [appended](#function-library-lib.path.append) to a Nix path value:
 
-        base + ("/" + p) == base + ("/" + subpath.normalise p)
+          append base p == append base (subpath.normalise p)
 
-  - Don't change the path according to `realpath`:
+    - Don't change the path according to `realpath`:
 
-        $(realpath ${p}) == $(realpath ${subpath.normalise p})
+          $(realpath ${p}) == $(realpath ${subpath.normalise p})
 
-  - Only error on invalid subpaths:
+    - Only error on [invalid subpaths](#function-library-lib.path.subpath.isValid):
 
-        builtins.tryEval (subpath.normalise p)).success == subpath.isValid p
+          builtins.tryEval (subpath.normalise p)).success == subpath.isValid p
 
-  Type:
-    subpath.normalise :: String -> String
+    Type:
+      subpath.normalise :: String -> String
 
-  Example:
-    # limit repeating `/` to a single one
-    subpath.normalise "foo//bar"
-    => "./foo/bar"
+    Example:
+      # limit repeating `/` to a single one
+      subpath.normalise "foo//bar"
+      => "./foo/bar"
 
-    # remove redundant `.` components
-    subpath.normalise "foo/./bar"
-    => "./foo/bar"
+      # remove redundant `.` components
+      subpath.normalise "foo/./bar"
+      => "./foo/bar"
 
-    # add leading `./`
-    subpath.normalise "foo/bar"
-    => "./foo/bar"
+      # add leading `./`
+      subpath.normalise "foo/bar"
+      => "./foo/bar"
 
-    # remove trailing `/`
-    subpath.normalise "foo/bar/"
-    => "./foo/bar"
+      # remove trailing `/`
+      subpath.normalise "foo/bar/"
+      => "./foo/bar"
 
-    # remove trailing `/.`
-    subpath.normalise "foo/bar/."
-    => "./foo/bar"
+      # remove trailing `/.`
+      subpath.normalise "foo/bar/."
+      => "./foo/bar"
 
-    # Return the current directory as `./.`
-    subpath.normalise "."
-    => "./."
+      # Return the current directory as `./.`
+      subpath.normalise "."
+      => "./."
 
-    # error on `..` path components
-    subpath.normalise "foo/../bar"
-    => <error>
+      # error on `..` path components
+      subpath.normalise "foo/../bar"
+      => <error>
 
-    # error on empty string
-    subpath.normalise ""
-    => <error>
+      # error on empty string
+      subpath.normalise ""
+      => <error>
 
-    # error on absolute path
-    subpath.normalise "/foo"
-    => <error>
+      # error on absolute path
+      subpath.normalise "/foo"
+      => <error>
   */
   subpath.normalise =
     # The subpath string to normalise
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index cf388d0f7524..6f782c00a011 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -140,6 +140,16 @@
 
 - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.
 
+- GNOME module no longer forces Qt applications to use Adwaita style since it was buggy and is no longer maintained upstream. If you still want it, you can add the following options to your configuration but it will probably be eventually removed:
+
+  ```nix
+  qt = {
+    enable = true;
+    platformTheme = "gnome";
+    style = "adwaita";
+  };
+  ```
+
 - `fontconfig` now defaults to using greyscale antialiasing instead of subpixel antialiasing because of a [recommendation from one of the downstreams](https://gitlab.freedesktop.org/fontconfig/fontconfig/-/issues/337). You can change this value by configuring [](#opt-fonts.fontconfig.subpixel.rgba) accordingly.
 
 - The latest available version of Nextcloud is v27 (available as `pkgs.nextcloud27`). The installation logic is as follows:
diff --git a/nixos/modules/programs/hyprland.nix b/nixos/modules/programs/hyprland.nix
index faeaa8973fa9..e0ee5b6bd2a4 100644
--- a/nixos/modules/programs/hyprland.nix
+++ b/nixos/modules/programs/hyprland.nix
@@ -32,11 +32,10 @@ in
       readOnly = true;
       default = cfg.package.override {
         enableXWayland = cfg.xwayland.enable;
-        hidpiXWayland = cfg.xwayland.hidpi;
-        nvidiaPatches = cfg.nvidiaPatches;
+        enableNvidiaPatches = cfg.enableNvidiaPatches;
       };
       defaultText = literalExpression
-        "`wayland.windowManager.hyprland.package` with applied configuration";
+        "`programs.hyprland.package` with applied configuration";
       description = mdDoc ''
         The Hyprland package after applying configuration.
       '';
@@ -44,17 +43,9 @@ in
 
     portalPackage = mkPackageOptionMD pkgs "xdg-desktop-portal-hyprland" { };
 
-    xwayland = {
-      enable = mkEnableOption (mdDoc "XWayland") // { default = true; };
-      hidpi = mkEnableOption null // {
-        description = mdDoc ''
-          Enable HiDPI XWayland, based on [XWayland MR 733](https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/733).
-          See <https://wiki.hyprland.org/Nix/Options-Overrides/#xwayland-hidpi> for more info.
-        '';
-      };
-    };
+    xwayland.enable = mkEnableOption (mdDoc "XWayland") // { default = true; };
 
-    nvidiaPatches = mkEnableOption (mdDoc "patching wlroots for better Nvidia support");
+    enableNvidiaPatches = mkEnableOption (mdDoc "patching wlroots for better Nvidia support");
   };
 
   config = mkIf cfg.enable {
@@ -77,4 +68,15 @@ in
       extraPortals = [ finalPortalPackage ];
     };
   };
+
+  imports = with lib; [
+    (mkRemovedOptionModule
+      [ "programs" "hyprland" "xwayland" "hidpi" ]
+      "XWayland patches are deprecated. Refer to https://wiki.hyprland.org/Configuring/XWayland"
+    )
+    (mkRenamedOptionModule
+      [ "programs" "hyprland" "nvidiaPatches" ]
+      [ "programs" "hyprland" "enableNvidiaPatches" ]
+    )
+  ];
 }
diff --git a/nixos/modules/services/audio/liquidsoap.nix b/nixos/modules/services/audio/liquidsoap.nix
index 5c10d13af5fd..9e61a7979619 100644
--- a/nixos/modules/services/audio/liquidsoap.nix
+++ b/nixos/modules/services/audio/liquidsoap.nix
@@ -18,6 +18,7 @@ let
           ExecStart = "${pkgs.liquidsoap}/bin/liquidsoap ${stream}";
           User = "liquidsoap";
           LogsDirectory = "liquidsoap";
+          Restart = "always";
         };
       };
     };
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 924abfc2953f..4ec066c2ec97 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -987,7 +987,7 @@ in {
                   } // optionalAttrs (bssCfg.authentication.wpaPassword != null) {
                     wpa_passphrase = bssCfg.authentication.wpaPassword;
                   } // optionalAttrs (bssCfg.authentication.wpaPskFile != null) {
-                    wpa_psk_file = bssCfg.authentication.wpaPskFile;
+                    wpa_psk_file = toString bssCfg.authentication.wpaPskFile;
                   };
 
                   dynamicConfigScripts = let
diff --git a/nixos/modules/services/x11/desktop-managers/gnome.nix b/nixos/modules/services/x11/desktop-managers/gnome.nix
index 5d950f7d7fc5..fecdd86deb86 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@@ -352,13 +352,6 @@ in
         })
       ];
 
-      # Harmonize Qt application style and also make them use the portal for file chooser dialog.
-      qt = {
-        enable = mkDefault true;
-        platformTheme = mkDefault "gnome";
-        style = mkDefault "adwaita";
-      };
-
       networking.networkmanager.enable = mkDefault true;
 
       services.xserver.updateDbusEnvironment = true;
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 0b0739d5ac2b..b1f0451cc174 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -30,21 +30,21 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0hc1pfrhmdydwgyz3mjp45nmzs101iffam7ciximqmnhf1s1x4qf";
-    x86_64-darwin = "1snrr4lsa5qdpdl80wx8ymxp8h1bhd5ablhcgkhzvmj5dh7jrywk";
-    aarch64-linux = "0pm5znbjm79ziwdx37cc75qnbf0jv3yrm2xg7cykavn43gz97abw";
-    aarch64-darwin = "0bq5hvgv228x7vby4475cc65g24kpv9kvj06p6c0y6a2a79j45by";
-    armv7l-linux = "11gxpqflakp4cwzkpqrwsd6m5fls1vnaigppc4bq9flfknwkjfrx";
+    x86_64-linux = "0j3lmyj77qalhn8hrgfg3zgw6jqv8rscfy16vhkl0ir2xnmb19jf";
+    x86_64-darwin = "06dx8lhw1cqignv06pcjjv8v743kr8bck1iqgl1881jmqyhggi4f";
+    aarch64-linux = "0nyd452wcp5qw2cx1zj89v4fgk3jvbk3hhiix9a0gv150q48vyfa";
+    aarch64-darwin = "1yfbsfnkjbf99yl1dcflpyxppa9mhnxigyyplz0jaqgpwmhs2s0b";
+    armv7l-linux = "1miz95rz2fdw7xplflnydzq57hnz894xg29mhpywwiib8kypfrm7";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.81.0";
+    version = "1.81.1";
     pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
     # This is used for VS Code - Remote SSH test
-    rev = "6445d93c81ebe42c4cbd7a60712e0b17d9463e97";
+    rev = "6c3e3dba23e8fadc360aed75ce363ba185c49794";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -68,7 +68,7 @@ in
       src = fetchurl {
         name = "vscode-server-${rev}.tar.gz";
         url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "07x9lmkyhra4hplsgdhh97dixsx92i7lab5z5ihs2wqvvzl69ah2";
+        sha256 = "1xfyl81d5l2bl7k4vz4rnj84j1ijwv90sqgv9lnqzza2dfckfd6m";
       };
     };
 
diff --git a/pkgs/applications/emulators/citra/default.nix b/pkgs/applications/emulators/citra/default.nix
index 56a763b05bba..41a018d9ea92 100644
--- a/pkgs/applications/emulators/citra/default.nix
+++ b/pkgs/applications/emulators/citra/default.nix
@@ -10,7 +10,7 @@ let
   compat-list = fetchurl {
     name = "citra-compat-list";
     url = "https://web.archive.org/web/20230807103651/https://api.citra-emu.org/gamedb/";
-    hash = "sha256-Ma1SXgzhyMHa/MeoYuf8b+QYPjhoQEeKklLbGbkHwEk=";
+    hash = "sha256-J+zqtWde5NgK2QROvGewtXGRAWUTNSKHNMG6iu9m1fU=";
   };
 in {
   nightly = qt6Packages.callPackage ./generic.nix rec {
diff --git a/pkgs/applications/emulators/nuked-md/default.nix b/pkgs/applications/emulators/nuked-md/default.nix
new file mode 100644
index 000000000000..883d62b89832
--- /dev/null
+++ b/pkgs/applications/emulators/nuked-md/default.nix
@@ -0,0 +1,72 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gitUpdater
+, cmake
+, SDL2
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nuked-md";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "nukeykt";
+    repo = "Nuked-MD";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Pe+TSu9FBUhxtACq+6jMbrUxiwKLOJgQbEcmUrcrjMs=";
+  };
+
+  # Interesting detail about our SDL2 packaging:
+  # Because we build it with the configure script instead of CMake, we ship sdl2-config.cmake instead of SDL2Config.cmake
+  # The former doesn't set SDL2_FOUND while the latter does (like CMake config scripts should), which causes this issue:
+  #
+  # CMake Error at CMakeLists.txt:5 (find_package):
+  #   Found package configuration file:
+  #
+  #     <SDL2.dev>/lib/cmake/SDL2/sdl2-config.cmake
+  #
+  #   but it set SDL2_FOUND to FALSE so package "SDL2" is considered to be NOT
+  #   FOUND.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace 'SDL2 REQUIRED' 'SDL2'
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    SDL2
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 Nuked-MD $out/bin/Nuked-MD
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
+  };
+
+  meta = with lib; {
+    description = "Cycle accurate Mega Drive emulator";
+    longDescription = ''
+      Cycle accurate Mega Drive core. The goal of this project is to emulate Sega Mega Drive chipset as accurately as
+      possible using decapped chips photos.
+    '';
+    homepage = "https://github.com/nukeykt/Nuked-MD";
+    license = licenses.gpl2Plus;
+    mainProgram = "Nuked-MD";
+    maintainers = with maintainers; [ OPNA2608 ];
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/applications/graphics/conjure/default.nix b/pkgs/applications/graphics/conjure/default.nix
new file mode 100644
index 000000000000..b0b00369ffde
--- /dev/null
+++ b/pkgs/applications/graphics/conjure/default.nix
@@ -0,0 +1,71 @@
+{ fetchFromGitHub
+, gobject-introspection
+, lib
+, libadwaita
+, python3Packages
+, wrapGAppsHook
+, meson
+, ninja
+, desktop-file-utils
+, pkg-config
+, appstream-glib
+, gtk4
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "conjure";
+  version = "0.1.2";
+
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "nate-xyz";
+    repo = "conjure";
+    rev = "v${version}";
+    hash = "sha256-qWeqUQxTTnmJt40Jm1qDTGGuSQikkurzOux8sZsmDQk=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+    desktop-file-utils
+    appstream-glib
+    meson
+    ninja
+    pkg-config
+    gtk4
+  ];
+
+  buildInputs = [
+    libadwaita
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3
+    loguru
+    wand
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytest
+  ];
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  meta = with lib; {
+    description = "Magically transform your images";
+    longDescription = ''
+      Resize, crop, rotate, flip images, apply various filters and effects,
+      adjust levels and brightness, and much more. An intuitive tool for designers,
+      artists, or just someone who wants to enhance their images.
+      Built on top of the popular image processing library, ImageMagick with python
+      bindings from Wand.
+    '';
+    homepage = "https://github.com/nate-xyz/conjure";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ sund3RRR ];
+  };
+}
diff --git a/pkgs/applications/graphics/krop/default.nix b/pkgs/applications/graphics/krop/default.nix
index ef335cd6be2a..0adcf0b538d2 100644
--- a/pkgs/applications/graphics/krop/default.nix
+++ b/pkgs/applications/graphics/krop/default.nix
@@ -19,6 +19,7 @@ python3Packages.buildPythonApplication rec {
   ];
   buildInputs = [
     libsForQt5.poppler
+    libsForQt5.qtwayland
   ];
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];
diff --git a/pkgs/applications/misc/base16-universal-manager/default.nix b/pkgs/applications/misc/base16-universal-manager/default.nix
index 3d43a2870945..2ecbc5f41809 100644
--- a/pkgs/applications/misc/base16-universal-manager/default.nix
+++ b/pkgs/applications/misc/base16-universal-manager/default.nix
@@ -8,10 +8,10 @@ buildGoModule rec {
     owner = "pinpox";
     repo = "base16-universal-manager";
     rev = "v${version}";
-    sha256 = "11kal7x0lajzydbc2cvbsix9ympinsiqzfib7dg4b3xprqkyb9zl";
+    hash = "sha256-9KflJ863j0VeOyu6j6O28VafetRrM8FW818qCvqhaoY=";
   };
 
-  vendorSha256 = "19rba689319w3wf0b10yafydyz01kqg8b051vnijcyjyk0khwvsk";
+  vendorHash = "sha256-U28OJ5heeiaj3aGAhR6eAXzfvFMehAUcHzyFkZBRK6c=";
 
   meta = with lib; {
     description = "A universal manager to set base16 themes for any supported application";
diff --git a/pkgs/applications/misc/eaglemode/default.nix b/pkgs/applications/misc/eaglemode/default.nix
index 541b18914bf1..414995f0c545 100644
--- a/pkgs/applications/misc/eaglemode/default.nix
+++ b/pkgs/applications/misc/eaglemode/default.nix
@@ -1,14 +1,15 @@
 { lib, stdenv, fetchurl, perl, libX11, libXinerama, libjpeg, libpng, libtiff
 , libwebp, pkg-config, librsvg, glib, gtk2, libXext, libXxf86vm, poppler, vlc
-, ghostscript, makeWrapper, tzdata, makeDesktopItem, copyDesktopItems }:
+, ghostscript, makeWrapper, tzdata, makeDesktopItem, copyDesktopItems
+, directoryListingUpdater }:
 
 stdenv.mkDerivation rec {
   pname = "eaglemode";
-  version = "0.96.0";
+  version = "0.96.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/eaglemode/${pname}-${version}.tar.bz2";
-    hash = "sha256-aMVXJpfws9rh2Eaa/EzSLwtwvn0pVJlEbhxzvXME1hs=";
+    hash = "sha256-FIhCcMghzLg7Odcsou9hBw7kIaqLVUFEAKUk9uwRNNw=";
   };
 
   # Fixes "Error: No time zones found." on the clock
@@ -55,6 +56,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  passthru.updateScript = directoryListingUpdater {
+    url = "https://eaglemode.sourceforge.net/download.html";
+    extraRegex = "(?!.*(x86_64|setup64|livecd)).*";
+  };
+
   meta = with lib; {
     homepage = "https://eaglemode.sourceforge.net";
     description = "Zoomable User Interface";
diff --git a/pkgs/applications/networking/cluster/tanka/default.nix b/pkgs/applications/networking/cluster/tanka/default.nix
index 62d89e78c757..61f56f425216 100644
--- a/pkgs/applications/networking/cluster/tanka/default.nix
+++ b/pkgs/applications/networking/cluster/tanka/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tanka";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LAOcDgosSGE7sLiQYSimz//oZ3FHcx3PTjtG0WdDNmg=";
+    sha256 = "sha256-xKB/SKiw3cKqdpl869Bs/NO1Jbrla8Un0hH4kIGqAPs=";
   };
 
-  vendorHash = "sha256-//uxNK8u7zIVeIUN401DXtkJsX/1iVfDcoFwcs8Y3cg=";
+  vendorHash = "sha256-+BCUQ+czqWkxbDoSvCaAxewTN0SuI+hCHEQpLOvNGj4=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 84ba9c2fbb73..e474a5de9924 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -19,14 +19,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "23.7.3";
+  version = "23.8.0";
 in
 stdenv.mkDerivation {
   inherit pname appname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-Jk0KPYYB+CW60ggVn58JKJ1UX5VXWbSUC+osHG4wjR0=";
+    hash = "sha256-ZvZOUcKtY+V0zhqsOYNi3W8yxRPUdYsp2kSHETRCTLs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index c35c601fe53d..a3332c6d7a74 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "unstable-2023-08-08";
+  version = "unstable-2023-08-10";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "e7ebdbc21e69c0cda99ab1c8bdf873495b6ab9a0";
-    sha256 = "P/ln7JghEP8MdTzPMmPH+0k+aRuOL/m6VkjYrtynUPE=";
+    rev = "18847fc16e05078ff5a8d0106a38ce2059ec497f";
+    sha256 = "bz2dX4CSPOFEg+6LnqcG46jOFCmjgnrhPyaljyVlDY4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index fd11a46dcd2b..bb2c34083515 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, makeWrapper
+, fetchpatch
 , pkg-config, cmake, yasm, python3Packages
 , libxcrypt, libgcrypt, libgpg-error, libunistring
 , boost, avahi, lame
@@ -110,7 +111,15 @@ in stdenv.mkDerivation {
     version = kodiVersion;
 
     src = kodi_src;
-
+    patches = [
+      # Fix compatiblity with fmt 10.0 (from spdlog).
+      # Remove with the next release: https://github.com/xbmc/xbmc/pull/23453
+      (fetchpatch {
+        name = "Fix fmt10 compat";
+        url = "https://github.com/xbmc/xbmc/pull/23453.patch";
+        hash = "sha256-zMUparbQ8gfgeXj8W3MDmPi5OgLNz/zGCJINU7H6Rx0=";
+      })
+    ];
     buildInputs = [
       gnutls libidn2 libtasn1 nasm p11-kit
       libxml2 python3Packages.python
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
index b6af6a34151c..7d611d1f0d50 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@@ -2,8 +2,10 @@
 , stdenv
 , fetchFromGitHub
 , pkg-config
+, makeWrapper
 , meson
 , ninja
+, binutils
 , cairo
 , git
 , hyprland-protocols
@@ -24,34 +26,35 @@
 , xcbutilwm
 , xwayland
 , debug ? false
+, enableNvidiaPatches ? false
 , enableXWayland ? true
-, hidpiXWayland ? false
 , legacyRenderer ? false
-, nvidiaPatches ? false
 , withSystemd ? true
+, wrapRuntimeDeps ? true
+  # deprecated flags
+, nvidiaPatches ? false
+, hidpiXWayland ? false
 }:
-let
-  assertXWayland = lib.assertMsg (hidpiXWayland -> enableXWayland) ''
-    Hyprland: cannot have hidpiXWayland when enableXWayland is false.
-  '';
-in
-assert assertXWayland;
+assert lib.assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been renamed `enableNvidiaPatches`";
+assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.27.0";
+  version = "unstable-2023-08-08";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-mEKF6Wcx+wSF/eos/91A7LxhFLDYhSnQnLpwZF13ntg=";
+    rev = "8e04a80e60983f5def26bdcaea701040fea9a7ae";
+    hash = "sha256-5/vEdU3SzAdeIyPykjks/Zxkvh9luPTIei6oa77OY2Q=";
   };
 
   patches = [
     # make meson use the provided dependencies instead of the git submodules
-    "${finalAttrs.src}/nix/meson-build.patch"
+    "${finalAttrs.src}/nix/patches/meson-build.patch"
     # look into $XDG_DESKTOP_PORTAL_DIR instead of /usr; runtime checks for conflicting portals
-    "${finalAttrs.src}/nix/portals.patch"
+    # NOTE: revert back to the patch inside SRC on the next version bump
+    # "${finalAttrs.src}/nix/patches/portals.patch"
+    ./portals.patch
   ];
 
   postPatch = ''
@@ -64,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     jq
+    makeWrapper
     meson
     ninja
     pkg-config
@@ -90,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
       wayland-protocols
       pango
       pciutils
-      (wlroots.override { inherit enableXWayland hidpiXWayland nvidiaPatches; })
+      (wlroots.override { inherit enableNvidiaPatches; })
     ]
     ++ lib.optionals enableXWayland [ libxcb xcbutilwm xwayland ]
     ++ lib.optionals withSystemd [ systemd ];
@@ -106,6 +110,14 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.optional withSystemd "-Dsystemd=enabled")
   ];
 
+  postInstall = ''
+    ln -s ${wlroots}/include/wlr $dev/include/hyprland/wlroots
+    ${lib.optionalString wrapRuntimeDeps ''
+      wrapProgram $out/bin/Hyprland \
+        --suffix PATH : ${lib.makeBinPath [binutils pciutils]}
+    ''}
+  '';
+
   passthru.providedSessions = [ "hyprland" ];
 
   meta = with lib; {
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/portals.patch b/pkgs/applications/window-managers/hyprwm/hyprland/portals.patch
new file mode 100644
index 000000000000..cb3d97c371ca
--- /dev/null
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/portals.patch
@@ -0,0 +1,28 @@
+diff --git a/src/Compositor.cpp b/src/Compositor.cpp
+index 1d978aed..56665389 100644
+--- a/src/Compositor.cpp
++++ b/src/Compositor.cpp
+@@ -2365,17 +2365,16 @@ void CCompositor::performUserChecks() {
+ 
+     static auto* const    PSUPPRESSPORTAL = &g_pConfigManager->getConfigValuePtr("misc:suppress_portal_warnings")->intValue;
+ 
+-    if (!*PSUPPRESSPORTAL) {
+-        if (std::ranges::any_of(BAD_PORTALS, [&](const std::string& portal) { return std::filesystem::exists("/usr/share/xdg-desktop-portal/portals/" + portal + ".portal"); })) {
++    static auto* const    PORTALDIRENV = getenv("XDG_DESKTOP_PORTAL_DIR");
++
++    static auto const     PORTALDIR = PORTALDIRENV != NULL ? std::string(PORTALDIRENV) : "";
++
++    if (!*PSUPPRESSPORTAL && PORTALDIR != "") {
++        if (std::ranges::any_of(BAD_PORTALS, [&](const std::string& portal) { return std::filesystem::exists(PORTALDIR + "/" + portal + ".portal"); })) {
+             // bad portal detected
+             g_pHyprNotificationOverlay->addNotification("You have one or more incompatible xdg-desktop-portal impls installed. Please remove incompatible ones to avoid issues.",
+                                                         CColor(0), 15000, ICON_ERROR);
+         }
+-
+-        if (std::filesystem::exists("/usr/share/xdg-desktop-portal/portals/hyprland.portal") && std::filesystem::exists("/usr/share/xdg-desktop-portal/portals/wlr.portal")) {
+-            g_pHyprNotificationOverlay->addNotification("You have xdg-desktop-portal-hyprland and -wlr installed simultaneously. Please uninstall one to avoid issues.", CColor(0),
+-                                                        15000, ICON_ERROR);
+-        }
+     }
+ }
+ 
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
index e1d6bfc7e516..7b44e9cf5212 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
@@ -1,15 +1,11 @@
 { fetchFromGitLab
 , hyprland
 , wlroots
-, xwayland
-, fetchpatch
 , lib
 , libdisplay-info
 , libliftoff
 , hwdata
-, hidpiXWayland ? true
-, enableXWayland ? true
-, nvidiaPatches ? false
+, enableNvidiaPatches ? false
 }:
 let
   libdisplay-info-new = libdisplay-info.overrideAttrs (old: {
@@ -38,10 +34,7 @@ let
     ];
   });
 in
-assert (lib.assertMsg (hidpiXWayland -> enableXWayland) ''
-  wlroots-hyprland: cannot have hidpiXWayland when enableXWayland is false.
-'');
-(wlroots.overrideAttrs
+wlroots.overrideAttrs
   (old: {
     version = "0.17.0-dev";
 
@@ -49,65 +42,31 @@ assert (lib.assertMsg (hidpiXWayland -> enableXWayland) ''
       domain = "gitlab.freedesktop.org";
       owner = "wlroots";
       repo = "wlroots";
-      rev = "7e7633abf09b362d0bad9e3fc650fd692369291d";
-      hash = "sha256-KovjVFwcuoUO0eu/UiWrnD3+m/K+SHSAVIz4xF9K1XA=";
+      rev = "e8d545a9770a2473db32e0a0bfa757b05d2af4f3";
+      hash = "sha256-gv5kjss6REeQG0BmvK2gTx7jHLRdCnP25po6It6I6N8=";
     };
 
     pname =
       old.pname
       + "-hyprland"
-      + (
-        if hidpiXWayland
-        then "-hidpi"
-        else ""
-      )
-      + (
-        if nvidiaPatches
-        then "-nvidia"
-        else ""
-      );
+      + lib.optionalString enableNvidiaPatches "-nvidia";
 
     patches =
       (old.patches or [ ])
-      ++ (lib.optionals (enableXWayland && hidpiXWayland) [
-        "${hyprland.src}/nix/wlroots-hidpi.patch"
-        (fetchpatch {
-          url = "https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/18595000f3a21502fd60bf213122859cc348f9af.diff";
-          sha256 = "sha256-jvfkAMh3gzkfuoRhB4E9T5X1Hu62wgUjj4tZkJm0mrI=";
-          revert = true;
-        })
-      ])
-      ++ (lib.optionals nvidiaPatches [
-        (fetchpatch {
-          url = "https://aur.archlinux.org/cgit/aur.git/plain/0001-nvidia-format-workaround.patch?h=hyprland-nvidia-screenshare-git&id=2830d3017d7cdd240379b4cc7e5dd6a49cf3399a";
-          sha256 = "A9f1p5EW++mGCaNq8w7ZJfeWmvTfUm4iO+1KDcnqYX8=";
-        })
+      ++ (lib.optionals enableNvidiaPatches [
+        "${hyprland.src}/nix/patches/nvidia.patch"
       ]);
 
     postPatch =
       (old.postPatch or "")
       + (
-        if nvidiaPatches
-        then ''
-          substituteInPlace render/gles2/renderer.c --replace "glFlush();" "glFinish();"
-        ''
-        else ""
+        lib.optionalString enableNvidiaPatches
+          ''substituteInPlace render/gles2/renderer.c --replace "glFlush();" "glFinish();"''
       );
 
-    buildInputs =
-      old.buildInputs
-      ++ [
-        hwdata
-        libdisplay-info-new
-        libliftoff-new
-      ];
-  })).override {
-  xwayland = xwayland.overrideAttrs (old: {
-    patches =
-      (old.patches or [ ])
-      ++ (lib.optionals hidpiXWayland [
-        "${hyprland.src}/nix/xwayland-vsync.patch"
-        "${hyprland.src}/nix/xwayland-hidpi.patch"
-      ]);
-  });
-}
+    buildInputs = old.buildInputs ++ [
+      hwdata
+      libdisplay-info-new
+      libliftoff-new
+    ];
+  })
diff --git a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
index f329c0ea7fbd..32c2a8085d13 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , cmake
+, file
 , libjpeg
 , mesa
 , pango
@@ -13,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpaper";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/ehJbAtSJS86NlqHVOeR2ViBKlImKH4guFVPacTmCr8=";
+    hash = "sha256-V5ulB9CkGh1ghiC4BKvRdoYKZzpaiOKzAOUmJIFkgM0=";
   };
 
   nativeBuildInputs = [
@@ -29,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    file
     libjpeg
     mesa
     pango
diff --git a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/source.nix b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/source.nix
index 6b26f0eff426..cb4c3efad137 100644
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/source.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/source.nix
@@ -3,7 +3,7 @@
 , wayland
 }:
 let
-  version = "0.4.0";
+  version = "0.5.0";
 in
 {
   inherit version;
@@ -12,7 +12,7 @@ in
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
     rev = "v${version}";
-    hash = "sha256-r+XMyOoRXq+hlfjayb+fyi9kq2JK48TrwuNIAXqlj7U=";
+    hash = "sha256-C5AO0KnyAFJaCkOn+5nJfWm0kyiPn/Awh0lKTjhgr7Y=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index f3fca3c791d2..9e2041be1a47 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     rev = finalAttrs.version;
-    hash = "sha256-5RIjvmoqxMLnSW2P122rEa8MghWfwLHFtYgXwcFPF38=";
+    hash = "sha256-KgdCgKR3KqDf9GONCBRkLpNLoOycE0y4UXxHxBqNudk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/themes/adwaita-qt/default.nix b/pkgs/data/themes/adwaita-qt/default.nix
index 88bec5d09d62..314ad37bc4d8 100644
--- a/pkgs/data/themes/adwaita-qt/default.nix
+++ b/pkgs/data/themes/adwaita-qt/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     description = "A style to bend Qt applications to look like they belong into GNOME Shell";
     homepage = "https://github.com/FedoraQt/adwaita-qt";
     license = licenses.gpl2Plus;
-    maintainers = teams.gnome.members ++ (with maintainers; [ ]);
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/interpreters/luau/default.nix b/pkgs/development/interpreters/luau/default.nix
index e1dab5d17b3b..067e488f739a 100644
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.589";
+  version = "0.590";
 
   src = fetchFromGitHub {
     owner = "Roblox";
     repo = "luau";
     rev = version;
-    hash = "sha256-q36mWkZgzms+dYZ++S9MwnRYxUXBtRxiECOxX886eVw=";
+    hash = "sha256-ZVe4SCx6/IC039CL+ngNIQShNi9V6XQh62gpbcoK/tM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/llhttp/default.nix b/pkgs/development/libraries/llhttp/default.nix
index cba1ddcf2fc3..4a03c9bd0f10 100644
--- a/pkgs/development/libraries/llhttp/default.nix
+++ b/pkgs/development/libraries/llhttp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "llhttp";
-  version = "8.1.1";
+  version = "9.0.0";
 
   src = fetchFromGitHub {
     owner = "nodejs";
     repo = "llhttp";
     rev = "release/v${version}";
-    hash = "sha256-srAHKyYvdEGtjV7BwcKQArwAChRoZqTCfa/RefI/8wQ=";
+    hash = "sha256-mk9tNZJONh1xdZ8lqquMfFDEvEdYRucNlSrR64U8eaA=";
   };
 
   nativeBuildInputs = [
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Port of http_parser to llparse";
     homepage = "https://llhttp.org/";
+    changelog = "https://github.com/nodejs/llhttp/releases/tag/${src.rev}";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
     platforms = platforms.all;
diff --git a/pkgs/development/libraries/qgnomeplatform/default.nix b/pkgs/development/libraries/qgnomeplatform/default.nix
index 8136482d477b..4c75b475c17c 100644
--- a/pkgs/development/libraries/qgnomeplatform/default.nix
+++ b/pkgs/development/libraries/qgnomeplatform/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     description = "QPlatformTheme for a better Qt application inclusion in GNOME";
     homepage = "https://github.com/FedoraQt/QGnomePlatform";
     license = licenses.lgpl21Plus;
-    maintainers = teams.gnome.members ++ (with maintainers; [ ]);
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/python-modules/diofant/default.nix b/pkgs/development/python-modules/diofant/default.nix
index 89cf7d910127..303d00bbff29 100644
--- a/pkgs/development/python-modules/diofant/default.nix
+++ b/pkgs/development/python-modules/diofant/default.nix
@@ -1,39 +1,57 @@
 { lib
 , buildPythonPackage
+, cython
+, fetchpatch
 , fetchPypi
 , gmpy2
-, isort
 , mpmath
 , numpy
 , pythonOlder
 , scipy
 , setuptools-scm
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "diofant";
-  version = "0.13.0";
-  disabled = pythonOlder "3.9";
+  version = "0.14.0";
   format = "pyproject";
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit version;
     pname = "Diofant";
-    sha256 = "bac9e086a7156b20f18e3291d6db34e305338039a3c782c585302d377b74dd3c";
+    hash = "sha256-c886y37xR+4TxZw9+3tb7nkTGxWcS+Ag/ruUUdpf7S4=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "remove-pip-from-build-dependencies.patch";
+      url = "https://github.com/diofant/diofant/commit/117e441808faa7c785ccb81bf211772d60ebdec3.patch";
+      hash = "sha256-MYk1Ku4F3hAv7+jJQLWhXd8qyKRX+QYuBzPfYWT0VbU=";
+    })
+  ];
+
   nativeBuildInputs = [
-    isort
     setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
-    gmpy2
     mpmath
-    numpy
-    scipy
   ];
 
+  passthru.optional-dependencies = {
+    exports = [
+      cython
+      numpy
+      scipy
+    ];
+    gmpy = [
+      gmpy2
+    ];
+  };
+
   # tests take ~1h
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index d1653962294c..9dfcbd400da7 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "2.12.2";
+  version = "2.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-DNFnh+ajfKgsZEj5Vyfk+jqSs9nv/PHIIpkkarxugww=";
+    hash = "sha256-RmUwo7NcbDjRf+sVgthno+ZvxXhMDwmoTfiN7cJM/5s=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/govee-ble/default.nix b/pkgs/development/python-modules/govee-ble/default.nix
index 2678c0120bee..354a1569b002 100644
--- a/pkgs/development/python-modules/govee-ble/default.nix
+++ b/pkgs/development/python-modules/govee-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "govee-ble";
-  version = "0.23.0";
+  version = "0.24.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-/uv4P7wB/5QQW2IA+PT6VMPWd91Aoyxsez+8ptrIa5M=";
+    hash = "sha256-uuC7CVf/KKr36mvd0TqNJd2OtK/xshCGYJXEtllE9is=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyter-packaging/default.nix b/pkgs/development/python-modules/jupyter-packaging/default.nix
index 24ad566b2a2c..38dd7927d1eb 100644
--- a/pkgs/development/python-modules/jupyter-packaging/default.nix
+++ b/pkgs/development/python-modules/jupyter-packaging/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , deprecation
 , hatchling
 , pythonOlder
@@ -23,6 +24,14 @@ buildPythonPackage rec {
     hash = "sha256-nZsrY7l//WeovFORwypCG8QVsmSjLJnk2NjdMdqunPQ=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "setuptools-68-test-compatibility.patch";
+      url = "https://github.com/jupyter/jupyter-packaging/commit/e963fb27aa3b58cd70c5ca61ebe68c222d803b7e.patch";
+      hash = "sha256-NlO07wBCutAJ1DgoT+rQFkuC9Y+DyF1YFlTwWpwsJzo=";
+    })
+  ];
+
   nativeBuildInputs = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/pyrainbird/default.nix b/pkgs/development/python-modules/pyrainbird/default.nix
index 67a57b8c203b..7a4e86c8dd1f 100644
--- a/pkgs/development/python-modules/pyrainbird/default.nix
+++ b/pkgs/development/python-modules/pyrainbird/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "pyrainbird";
-  version = "3.0.1";
+  version = "4.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.10";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Qi0NfLayypi/wKJZB9IOzoeaZsb3oq2JahXWdkwSjeo=";
+    hash = "sha256-VwcYyD9JtLDU2Bgp2hlptDz3vPoX4revTRKTA8OkWEw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index 8b8127a4ba80..6f5107be04e6 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cppcheck";
-  version = "2.11";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "danmar";
     repo = "cppcheck";
     rev = version;
-    hash = "sha256-Zu1Ly5KsgmjtsVQlBzgB/h+varfkyB73t8bxzqB3a3M=";
+    hash = "sha256-ZQ1EgnC2JBc0AvSW8PtgMzJoWSPt04Xfh8dqOU+KMfw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/tools/datree/default.nix b/pkgs/development/tools/datree/default.nix
index 579ca692e780..829de7447c74 100644
--- a/pkgs/development/tools/datree/default.nix
+++ b/pkgs/development/tools/datree/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "1.9.17";
+  version = "1.9.19";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = "refs/tags/${version}";
-    hash = "sha256-vGlvujN9/1e9X/c2WgVSuc+yuqECUF55NLPmBecwvT0=";
+    hash = "sha256-W1eX7eUMdPGbHA/f08xkG2EUeZmaunEAQn7/LRBe2nk=";
   };
 
-  vendorHash = "sha256-ECVKofvmLuFAFvncq63hYUaYW8/2+F4gZr8wIGQyrdU=";
+  vendorHash = "sha256-+PQhuIO4KjXtW/ZcS0OamuOHzK7ZL+nwOBxeCRoXuKE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/language-servers/nixd/default.nix b/pkgs/development/tools/language-servers/nixd/default.nix
index 1f2b45fa16f4..648f20bc7c9e 100644
--- a/pkgs/development/tools/language-servers/nixd/default.nix
+++ b/pkgs/development/tools/language-servers/nixd/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nixd";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nixd";
     rev = version;
-    hash = "sha256-NqRYFaxa6Y4j7IMAxxVKo7o15Xmx0CiyeG71Uf1SLCI=";
+    hash = "sha256-W44orkPZQ9gDUTogb8YVIaw4WHzUA+ExOXhTnZlJ6yY=";
   };
 
   mesonBuildType = "release";
@@ -81,8 +81,9 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Nix language server";
     homepage = "https://github.com/nix-community/nixd";
+    changelog = "https://github.com/nix-community/nixd/releases/tag/${version}";
     license = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ inclyc Ruixi-rebirth ];
+    maintainers = with lib.maintainers; [ inclyc Ruixi-rebirth marsam ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 6c2a95ec26a7..4e3b56624ccf 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "18.1.0";
+  version = "18.3.3";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-qK9hjsWhVTzxFo4SSvKb5IgZteVabWlCtoetu9v9xIE=";
+    hash = "sha256-AJw+NNTbksYSW2VqUzxLwxwd3OjM9uK/ou2CVS2zNvw=";
   };
 
-  vendorHash = "sha256-cATGMi/nL8dvlsR+cuvKH6Y9eR3UqcVjvZAj35Ydn2c=";
+  vendorHash = "sha256-xkguBWk2Nh8w7C7tKbvaP0tRgZO4z08AEsdjNlJYC6Q=";
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2b27d6218214..c8ae911c1287 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1038,7 +1038,7 @@ let
 
       # > CONFIG_KUNIT should not be enabled in a production environment. Enabling KUnit disables Kernel Address-Space Layout Randomization (KASLR), and tests may affect the state of the kernel in ways not suitable for production.
       # https://www.kernel.org/doc/html/latest/dev-tools/kunit/start.html
-      KUNIT = no;
+      KUNIT = whenAtLeast "5.5" no;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Enable CPU/memory hotplug support
       # Allows you to dynamically add & remove CPUs/memory to a VM client running NixOS without requiring a reboot
diff --git a/pkgs/servers/monitoring/grafana-agent/default.nix b/pkgs/servers/monitoring/grafana-agent/default.nix
index e07621e8213d..6034120130ce 100644
--- a/pkgs/servers/monitoring/grafana-agent/default.nix
+++ b/pkgs/servers/monitoring/grafana-agent/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.35.2";
+  version = "0.35.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-jotJe7DIPYNekAxiMdghdykEXVD7Pk/MPWSH2XjhkL8=";
+    hash = "sha256-3JfJISoziIcB2Mx2gSYjegjQwqGipUtvT927QSezuq4=";
   };
 
-  vendorHash = "sha256-MqUkGKOzx8Qo9xbD9GdUryVwKjpVUOXFo2x0/2uz8Uk=";
+  vendorHash = "sha256-vzrp20Mg6AA0h3+5+qbKRa7nhx/hgiIHG6RNXLATpHE=";
   proxyVendor = true; # darwin/linux hash mismatch
 
   ldflags = let
diff --git a/pkgs/tools/X11/caffeine-ng/default.nix b/pkgs/tools/X11/caffeine-ng/default.nix
index 66103ba6f8dc..90292e8beda9 100644
--- a/pkgs/tools/X11/caffeine-ng/default.nix
+++ b/pkgs/tools/X11/caffeine-ng/default.nix
@@ -1,77 +1,63 @@
-{ buildPythonApplication
-, fetchPypi
+{ fetchFromGitea
+, meson
+, ninja
+, pkg-config
+, scdoc
 , gobject-introspection
-, gtk3
 , lib
-, libappindicator-gtk3
+, libayatana-appindicator
 , libnotify
-, click
-, dbus-python
-, ewmh
-, pulsectl
-, pygobject3
-, pyxdg
-, setproctitle
-, python3
+, python3Packages
 , procps
 , xset
 , xautolock
 , xscreensaver
 , xfce
-, glib
-, setuptools-scm
 , wrapGAppsHook
 }:
 
-let
-  click_7 = click.overridePythonAttrs (old: rec {
-    version = "7.1.2";
-    src = old.src.override {
-      inherit version;
-      hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
-    };
-    disabledTests = [ "test_bytes_args" ]; # https://github.com/pallets/click/commit/6e05e1fa1c2804
-  });
-in buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "caffeine-ng";
-  version = "4.0.2";
-  format = "setuptools";
+  version = "4.2.0";
+  format = "other";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-umIjXJ0et6Pi5Ejj96Q+ZhiKS+yj7bsgb4uQW6Ym6rU=";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "WhyNotHugo";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-uYzLRZ+6ZgIwhSuJWRBpLYHgonX7sFXgUZid0V26V0Q=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook glib gobject-introspection setuptools-scm ];
+  nativeBuildInputs = [ gobject-introspection meson ninja pkg-config wrapGAppsHook ];
 
   buildInputs = [
-    libappindicator-gtk3
+    libayatana-appindicator
     libnotify
-    gtk3
   ];
 
-  pythonPath = [
-    click_7
+  pythonPath = with python3Packages; [
+    click
     dbus-python
     ewmh
     pulsectl
     pygobject3
-    pyxdg
+    scdoc
     setproctitle
   ];
 
-  doCheck = false; # There are no tests.
   dontWrapGApps = true;
-  strictDeps = false;
+
+  patches = [
+    ./fix-build.patch
+  ];
+
+  postPatch = ''
+    echo "${version}" > version
+  '';
 
   postInstall = ''
-    cp -r share $out/
-    cp -r caffeine/assets/icons $out/share/
-
-    # autostart file
-    ln -s $out/${python3.sitePackages}/etc $out/etc
-
-    glib-compile-schemas --strict $out/share/glib-2.0/schemas
+    glib-compile-schemas $out/share/glib-2.0/schemas
   '';
 
   preFixup = ''
@@ -86,6 +72,7 @@ in buildPythonApplication rec {
     maintainers = with maintainers; [ marzipankaiser ];
     description = "Status bar application to temporarily inhibit screensaver and sleep mode";
     homepage = "https://codeberg.org/WhyNotHugo/caffeine-ng";
+    changelog = "https://codeberg.org/WhyNotHugo/caffeine-ng/src/tag/v${version}/CHANGELOG.rst";
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/X11/caffeine-ng/fix-build.patch b/pkgs/tools/X11/caffeine-ng/fix-build.patch
new file mode 100644
index 000000000000..cf075451138f
--- /dev/null
+++ b/pkgs/tools/X11/caffeine-ng/fix-build.patch
@@ -0,0 +1,24 @@
+diff --git a/meson.build b/meson.build
+index 3e4f9ea..5b82861 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2,10 +2,6 @@ project(
+     'caffeine-ng',
+     version: run_command('./scripts/read_version.sh', check: true).stdout().strip(),
+     meson_version: '>=0.63.0',
+-    default_options: [
+-      # The default can yield broken results.
+-      'python.install_env=auto'
+-    ]
+ )
+ 
+ dependency('pygobject-3.0')
+@@ -82,7 +78,7 @@ configure_file(
+ 
+ install_data(
+   'share/applications/caffeine.desktop',
+-  install_dir: '/etc/xdg/autostart',
++  install_dir: join_paths(get_option('sysconfdir'), 'xdg/autostart'),
+ )
+ 
+ install_data(
diff --git a/pkgs/tools/admin/credhub-cli/default.nix b/pkgs/tools/admin/credhub-cli/default.nix
index 78d9e1d0fbcd..9483d59846d6 100644
--- a/pkgs/tools/admin/credhub-cli/default.nix
+++ b/pkgs/tools/admin/credhub-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.18";
+  version = "2.9.19";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-Fr9hV8mPBIid/5jR5u6jiGjr7a9HbSVCaReXx9jGo/Q=";
+    sha256 = "sha256-7Bmw3rJbb+Ae6gvVROz7hADDrGr8eiZX6g+ZpWSd99k=";
   };
 
   # these tests require network access that we're not going to give them
diff --git a/pkgs/tools/misc/brotab/default.nix b/pkgs/tools/misc/brotab/default.nix
index 85b630c9d67b..ce2effb25ce7 100644
--- a/pkgs/tools/misc/brotab/default.nix
+++ b/pkgs/tools/misc/brotab/default.nix
@@ -1,8 +1,9 @@
-{ lib, fetchFromGitHub, python }:
+{ lib, fetchFromGitHub, fetchpatch, python }:
 
 python.pkgs.buildPythonApplication rec {
-  version = "1.4.2";
   pname = "brotab";
+  version = "1.4.2";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "balta2ar";
@@ -11,11 +12,19 @@ python.pkgs.buildPythonApplication rec {
     hash = "sha256-HKKjiW++FwjdorqquSCIdi1InE6KbMbFKZFYHBxzg8Q=";
   };
 
+  patches = [
+    # https://github.com/balta2ar/brotab/pull/102
+    (fetchpatch {
+      name = "remove-unnecessary-pip-import.patch";
+      url = "https://github.com/balta2ar/brotab/commit/825cd48f255c911aabbfb495f6b8fc73f27d3fe5.patch";
+      hash = "sha256-IN28AOLPKPUc3KkxIGFMpZNNXA1+O12NxS+Hl4KMXbg=";
+    })
+  ];
+
   propagatedBuildInputs = with python.pkgs; [
-    requests
     flask
     psutil
-    setuptools
+    requests
   ];
 
   postPatch = ''
@@ -25,6 +34,8 @@ python.pkgs.buildPythonApplication rec {
       --replace "requests==2.24.0" "requests>=2.24.0"
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = with python.pkgs; [
     pytestCheckHook
   ];
diff --git a/pkgs/tools/security/terrascan/default.nix b/pkgs/tools/security/terrascan/default.nix
index 8cc4212fbb28..fd8c512837ff 100644
--- a/pkgs/tools/security/terrascan/default.nix
+++ b/pkgs/tools/security/terrascan/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terrascan";
-  version = "1.18.2";
+  version = "1.18.3";
 
   src = fetchFromGitHub {
     owner = "accurics";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZWkuzblPIvYcOllmIjk2RQZdkcPYZLGOuxwgX3NMydg=";
+    hash = "sha256-2jIdKBNn3Ajvq+fQ1OuQ0VB8+S0QYwLZnJMlGqZ7WtE=";
   };
 
-  vendorHash = "sha256-e09F4dA/uT50Cted3HqE08d04+l0V6U95AdKGKBFDpI=";
+  vendorHash = "sha256-PH94le8IwVuinlRsk84HGSxhBSJTTJDrou7nfD1J1JM=";
 
   # Tests want to download a vulnerable Terraform project
   doCheck = false;
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 7ca5e4a634bc..80afa9533084 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook";
-  version = "0.4.32";
+  version = "0.4.34";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "mdBook";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-+Cb4ZFkJu6z2x/HqQkVqb2J0tFuj78TAmzhp2VPiai0=";
+    sha256 = "sha256-QkgsFnX6J0ZgXCzGE/dTNLxdXLhCFwLsZCvmZ4SU4Zs=";
   };
 
-  cargoHash = "sha256-Jj5AWapZUzd/ZZQvvlSWOv2dX4AhJyHKEncIPdLL7cA=";
+  cargoHash = "sha256-Dhblzn7NytYeY76RmvI8cNjChnCSnTPadxPKyU5QT1Q=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0adfa9829cc7..67f96a78472a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2613,6 +2613,8 @@ with pkgs;
 
   np2kai = callPackage ../applications/emulators/np2kai { };
 
+  nuked-md = callPackage ../applications/emulators/nuked-md { };
+
   oberon-risc-emu = callPackage ../applications/emulators/oberon-risc-emu { };
 
   openmsx = callPackage ../applications/emulators/openmsx { };
@@ -3548,6 +3550,8 @@ with pkgs;
 
   codux = callPackage ../applications/editors/codux { };
 
+  conjure = callPackage ../applications/graphics/conjure { };
+
   coolreader = libsForQt5.callPackage ../applications/misc/coolreader { };
 
   corsair = with python3Packages; toPythonApplication corsair-scan;
@@ -39560,7 +39564,7 @@ with pkgs;
 
   caffeWithCuda = caffe.override { cudaSupport = true; };
 
-  caffeine-ng = python3Packages.callPackage ../tools/X11/caffeine-ng { };
+  caffeine-ng = callPackage ../tools/X11/caffeine-ng { };
 
   cntk = callPackage ../applications/science/math/cntk {
     stdenv = gcc7Stdenv;