diff --git a/lib/modules.nix b/lib/modules.nix
index 0c484fa684aa..c51999c2e332 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -81,9 +81,9 @@ let
                 , # `class`:
                   # A nominal type for modules. When set and non-null, this adds a check to
                   # make sure that only compatible modules are imported.
-                  # This would be remove in the future, Prefer _module.args option instead.
                   class ? null
-                , args ? {}
+                , # This would be remove in the future, Prefer _module.args option instead.
+                  args ? {}
                 , # This would be remove in the future, Prefer _module.check option instead.
                   check ? true
                 }:
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 7e74f27174ec..632656ad5795 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -218,6 +218,9 @@ let
         services.dnsmasq.enable = true;
       };
       exporterTest = ''
+        wait_for_unit("dnsmasq.service")
+        wait_for_open_port(53)
+        wait_for_file("/var/lib/dnsmasq/dnsmasq.leases")
         wait_for_unit("prometheus-dnsmasq-exporter.service")
         wait_for_open_port(9153)
         succeed("curl -sSf http://localhost:9153/metrics | grep 'dnsmasq_leases 0'")
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 6dbf3230db54..0c0df699a4e1 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -787,18 +787,36 @@ let
       };
 
       charliermarsh.ruff = buildVscodeMarketplaceExtension {
-        mktplcRef = {
+        mktplcRef = let
+          sources = {
+            "x86_64-linux" = {
+              arch = "linux-x64";
+              sha256 = "sha256-2c0tH/MlDOqeyffcV8ZCy4woogBTcf1GCuPPO8JXaWc=";
+            };
+            "x86_64-darwin" = {
+              arch = "darwin-x64";
+              sha256 = "sha256-euvGIlO7931N56R5BWKu3F9nSEoDgf+DXk7Hgl1qSUw=";
+            };
+            "aarch64-linux" = {
+              arch = "linux-arm64";
+              sha256 = "sha256-dGpIHChnfrQbxRZDuoAi4imgStyyPdxdvTQ3lknMYu0=";
+            };
+            "aarch64-darwin" = {
+              arch = "darwin-arm64";
+              sha256 = "sha256-tElX4C0I5AmpxSHMtqOsxSAUImD1tqArB5fnvhw4LFc=";
+            };
+          };
+        in {
           name = "ruff";
           publisher = "charliermarsh";
-          version = "2023.60.0";
-          sha256 = "sha256-qgwud2gzHLHID45VxDlngFMoks5O3pTHQe+Q7bdf8+I=";
-        };
+          version = "2024.4.0";
+        } // sources.${stdenv.system} or (throw "Unsupported system ${stdenv.system}");
         meta = {
           license = lib.licenses.mit;
-          changelog = "https://github.com/astral-sh/ruff-vscode/releases";
-          description = "Ruff extension for Visual Studio Code";
+          changelog = "https://marketplace.visualstudio.com/items/charliermarsh.ruff/changelog";
+          description = "A Visual Studio Code extension with support for the Ruff linter.";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=charliermarsh.ruff";
-          homepage = "https://github.com/astral-sh/ruff-vscode/";
+          homepage = "https://github.com/astral-sh/ruff-vscode";
           maintainers = [ lib.maintainers.azd325 ];
         };
       };
diff --git a/pkgs/applications/emulators/duckstation/002-hardcode-vars.diff b/pkgs/applications/emulators/duckstation/002-hardcode-vars.diff
index f0b7bb67a0ee..edba33fce7ce 100644
--- a/pkgs/applications/emulators/duckstation/002-hardcode-vars.diff
+++ b/pkgs/applications/emulators/duckstation/002-hardcode-vars.diff
@@ -1,5 +1,5 @@
 diff --git a/src/scmversion/gen_scmversion.sh b/src/scmversion/gen_scmversion.sh
-index 9c1dacab..d1f895ee 100755
+index 9122cd8..50ed8f9 100755
 --- a/src/scmversion/gen_scmversion.sh
 +++ b/src/scmversion/gen_scmversion.sh
 @@ -10,10 +10,10 @@ else
@@ -8,7 +8,7 @@ index 9c1dacab..d1f895ee 100755
  
 -HASH=$(git rev-parse HEAD)
 -BRANCH=$(git rev-parse --abbrev-ref HEAD | tr -d '\r\n')
--TAG=$(git describe --tags --dirty --exclude latest --exclude preview --exclude legacy --exclude previous-latest | tr -d '\r\n')
+-TAG=$(git describe --dirty | tr -d '\r\n')
 -DATE=$(git log -1 --date=iso8601-strict --format=%cd)
 +HASH="@gitHash@"
 +BRANCH="@gitBranch@"
diff --git a/pkgs/applications/emulators/duckstation/default.nix b/pkgs/applications/emulators/duckstation/default.nix
index e7980e20dddd..7e7bfd494600 100644
--- a/pkgs/applications/emulators/duckstation/default.nix
+++ b/pkgs/applications/emulators/duckstation/default.nix
@@ -9,7 +9,7 @@
 , extra-cmake-modules
 , libXrandr
 , libbacktrace
-, makeDesktopItem
+, makeWrapper
 , ninja
 , pkg-config
 , qtbase
@@ -20,18 +20,17 @@
 , vulkan-loader
 , wayland
 , wrapQtAppsHook
-, enableWayland ? true
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "duckstation";
-  version = "unstable-2023-09-30";
+  version = "0.1-6292";
 
   src = fetchFromGitHub {
     owner = "stenzek";
     repo = "duckstation";
-    rev = "d5608bf12df7a7e03750cb94a08a3d7999034ae2";
-    hash = "sha256-ktfZgacjkN6GQb1vLmyTZMr8QmmH12qAvFSIBTjgRSs=";
+    rev = "0bc42c38aab49030118f507c9783de047769148b";
+    hash = "sha256-8OavixSwEWihFY2fEdsepR1lqWlTH+//xZRKwb7lFCQ=";
   };
 
   patches = [
@@ -42,21 +41,19 @@ stdenv.mkDerivation (finalAttrs: {
       src = ./002-hardcode-vars.diff;
       gitHash = finalAttrs.src.rev;
       gitBranch = "master";
-      gitTag = "0.1-5889-gd5608bf1";
-      gitDate = "2023-09-30T23:20:09+10:00";
+      gitTag = "${finalAttrs.version}-g0bc42c38";
+      gitDate = "2024-02-06T22:47:47+09:00";
     })
   ];
 
   nativeBuildInputs = [
     cmake
     copyDesktopItems
+    extra-cmake-modules
     ninja
     pkg-config
     qttools
     wrapQtAppsHook
-  ]
-  ++ lib.optionals enableWayland [
-    extra-cmake-modules
   ];
 
   buildInputs = [
@@ -66,9 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
     libbacktrace
     qtbase
     qtsvg
-    vulkan-loader
-  ]
-  ++ lib.optionals enableWayland [
     qtwayland
     wayland
   ]
@@ -78,21 +72,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeBool "BUILD_TESTS" true)
-    (lib.cmakeBool "ENABLE_WAYLAND" enableWayland)
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "duckstation-qt";
-      desktopName = "DuckStation";
-      genericName = "PlayStation 1 Emulator";
-      icon = "duckstation";
-      tryExec = "duckstation-qt";
-      exec = "duckstation-qt %f";
-      comment = "Fast PlayStation 1 emulator";
-      categories = [ "Game" "Emulator" "Qt" ];
-      type = "Application";
-    })
   ];
 
   doCheck = true;
@@ -110,14 +89,28 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r bin $out/share/duckstation
     ln -s $out/share/duckstation/duckstation-qt $out/bin/
 
-    install -Dm644 bin/resources/images/duck.png $out/share/pixmaps/duckstation.png
+    install -Dm644 $src/scripts/org.duckstation.DuckStation.desktop $out/share/applications/org.duckstation.DuckStation.desktop
+    install -Dm644 $src/scripts/org.duckstation.DuckStation.png $out/share/pixmaps/org.duckstation.DuckStation.png
 
     runHook postInstall
   '';
 
-  qtWrapperArgs = [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ vulkan-loader ] ++ cubeb.passthru.backendLibs)}"
-  ];
+  qtWrapperArgs =
+    let
+      libPath = lib.makeLibraryPath ([
+        vulkan-loader
+      ] ++ cubeb.passthru.backendLibs);
+    in [
+      "--prefix LD_LIBRARY_PATH : ${libPath}"
+    ];
+
+  # https://github.com/stenzek/duckstation/blob/master/scripts/appimage/apprun-hooks/default-to-x11.sh
+  # Can't avoid the double wrapping, the binary wrapper from qtWrapperArgs doesn't support --run
+  postFixup = ''
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram $out/bin/duckstation-qt \
+      --run 'if [[ -z $I_WANT_A_BROKEN_WAYLAND_UI ]]; then export QT_QPA_PLATFORM=xcb; fi'
+  '';
 
   meta = {
     homepage = "https://github.com/stenzek/duckstation";
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 6c3278af0508..08a0ba5b8125 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -13,19 +13,19 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "22.1.18";
+  version = "23.1.5";
 
   src = fetchFromGitHub {
     owner = "jgraph";
     repo = "drawio-desktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-qOZm7XbF8QOx5rD5EJY0lJhaq2Yhp/nppOA4BIWheyE=";
+    hash = "sha256-ThmTahuU0o/vr6h/T/zCyEB5/APJlVA6t1TNfZgqTJ0=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-TwI3NCIn5NnKXuwW5dBl4q6Ma5rZR7NVNb5hoKbmNLM=";
+    hash = "sha256-hL89WVYy/EQe6Zppmr17Q9T2o/UjBvydDIgGpr7AA5M=";
   };
 
   nativeBuildInputs = [
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     sed -i "/afterSign/d" electron-builder-linux-mac.json
   '' + ''
     yarn --offline run electron-builder --dir \
-      --config electron-builder-linux-mac.json \
+      ${if stdenv.isDarwin then "--config electron-builder-linux-mac.json" else ""} \
       -c.electronDist=${if stdenv.isDarwin then "." else "${electron}/libexec/electron"} \
       -c.electronVersion=${electron.version}
 
diff --git a/pkgs/applications/graphics/komikku/default.nix b/pkgs/applications/graphics/komikku/default.nix
index 91c70aa02782..4a4b499ca4d0 100644
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@@ -19,7 +19,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.37.1";
+  version = "1.38.1";
 
   format = "other";
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     rev = "v${version}";
-    hash = "sha256-pGOut63+ST1Yqe1Fj0c4cI0du1q4JW7WVA4h+muWGJQ=";
+    hash = "sha256-eVNW8Iuhee9WBbiXP7ijvd0K44/IpwdrdiT4RkBNcxI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cotp/default.nix b/pkgs/applications/misc/cotp/default.nix
index 38cef65b20f2..71d1c4a81bd6 100644
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cotp";
-  version = "1.4.1";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-NGasyAhODvV/tYifhlkfZ3cEIBDD/3PaASCDbBK3JsI=";
+    hash = "sha256-S2658xkaDshQBYfy8mwuuBAKWGF4j+UYtapqPEf1wP4=";
   };
 
-  cargoHash = "sha256-5olA78kYjeqFMy8ObRkcPOnYjqaTZqVCefmNkTi3VYs=";
+  cargoHash = "sha256-DGx/LsKzoITA4extStjULiuiHJx0sTlPloE8h8MvnXQ=";
 
   buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ AppKit ];
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 772bd2d7a77b..09c0cdd0d1c4 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.26.7";
+  version = "1.26.8";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-+aoXcxJVBp9nXKS+3+CG7XkDMemSgvExMXtnR2FDhYs=";
+    sha256 = "sha256-tfNmKgWKr2TGQNgvC/qo2+Dvij4LUL0Zy77mfTcci2k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/misc/plots/default.nix b/pkgs/applications/misc/plots/default.nix
index 01a60baa2ab3..4e6b9d24a56b 100644
--- a/pkgs/applications/misc/plots/default.nix
+++ b/pkgs/applications/misc/plots/default.nix
@@ -1,12 +1,13 @@
-{ fetchFromGitHub
+{ lib
+, fetchFromGitHub
+, python3Packages
 , gobject-introspection
-, lib
 , libadwaita
-, python3
 , wrapGAppsHook
 , lmmath
 }:
-python3.pkgs.buildPythonApplication rec {
+
+python3Packages.buildPythonApplication rec {
   pname = "plots";
   version = "0.8.5";
 
@@ -17,36 +18,21 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-GjNpaorxkkhZsqrKq4kO5nqF5+4I4tmSc023AZpY8Sw=";
   };
 
-  nativeBuildInputs = [
-    gobject-introspection
-    wrapGAppsHook
+  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+  buildInputs = [ libadwaita ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3
+    numpy
+    lark
+    jinja2
+    freetype-py
+    pyopengl
+    pycairo
+    pyglm
   ];
 
-  propagatedBuildInputs = [
-    libadwaita
-    (python3.withPackages (p: with p; [
-      numpy
-      pygobject3
-      lark
-      jinja2
-      freetype-py
-      pyopengl
-      pycairo
-      pyglm
-    ]))
-  ];
-
-  nativeCheckInputs = [
-    (python3.withPackages (p: with p; [
-      pytest
-    ]))
-  ];
-
-  dontWrapGApps = true;
-
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
+  nativeCheckInputs = with python3Packages; [ pytest ];
 
   postInstall = ''
     install -D ${lmmath}/share/fonts/opentype/latinmodern-math.otf -t $out/share/fonts/
@@ -62,6 +48,12 @@ python3.pkgs.buildPythonApplication rec {
     done
   '';
 
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   meta = with lib; {
     description = "Graph plotting app for GNOME";
     longDescription = ''
diff --git a/pkgs/applications/misc/solaar/default.nix b/pkgs/applications/misc/solaar/default.nix
index 93a6c069f669..f3cd458510b3 100644
--- a/pkgs/applications/misc/solaar/default.nix
+++ b/pkgs/applications/misc/solaar/default.nix
@@ -14,13 +14,13 @@
 # instead of adding this to `services.udev.packages` on NixOS,
 python3Packages.buildPythonApplication rec {
   pname = "solaar";
-  version = "1.1.10";
+  version = "1.1.11";
 
   src = fetchFromGitHub {
     owner = "pwr-Solaar";
     repo = "Solaar";
     rev = "refs/tags/${version}";
-    hash = "sha256-cs1kj/spZtMUL9aUtBHINAH7uyjMSn9jRDF/hRPzIbo=";
+    hash = "sha256-fVWfV7rEu/knysWUrPeokBBlSGnvNlpiptAd1M7ZVd8=";
   };
 
   outputs = [ "out" "udev" ];
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index dbd04f026dfa..bd9d0fece1b5 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -7,7 +7,10 @@
 , which
 , libvirt
 , vmnet
+, withQemu ? false
+, qemu
 , makeWrapper
+, OVMF
 }:
 
 buildGoModule rec {
@@ -24,6 +27,22 @@ buildGoModule rec {
     rev = "v${version}";
     sha256 = "sha256-2EWaMpcr4F1wRzIP1rPg1a/Sjd1x+oo2ee90k4Ie8cU=";
   };
+  postPatch =
+    (
+      lib.optionalString (withQemu && stdenv.isDarwin) ''
+        substituteInPlace \
+          pkg/minikube/registry/drvs/qemu2/qemu2.go \
+          --replace "/usr/local/opt/qemu/share/qemu" "${qemu}/share/qemu" \
+          --replace "/opt/homebrew/opt/qemu/share/qemu" "${qemu}/share/qemu"
+      ''
+    ) + (
+      lib.optionalString (withQemu && stdenv.isLinux) ''
+        substituteInPlace \
+          pkg/minikube/registry/drvs/qemu2/qemu2.go \
+          --replace "/usr/share/OVMF/OVMF_CODE.fd" "${OVMF.firmware}" \
+          --replace "/usr/share/AAVMF/AAVMF_CODE.fd" "${OVMF.firmware}"
+      ''
+    );
 
   nativeBuildInputs = [ installShellFiles pkg-config which makeWrapper ];
 
diff --git a/pkgs/applications/networking/discordo/default.nix b/pkgs/applications/networking/discordo/default.nix
index bb426cbc777c..029ad55ae030 100644
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "unstable-2024-01-25";
+  version = "unstable-2024-02-16";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "301b7c7a792b427595803679e37fe99007de9451";
-    hash = "sha256-ufAlwlH++g9L3aaA5soJ6r2oiJZi8Ny/6P530oV+BiY=";
+    rev = "7476d8b391f23fa576f8f34eef3829c6212c6331";
+    hash = "sha256-x1/CXHqfiT0HgIPsiRluifPOJUrulN+fih0aOrj3us0=";
   };
 
-  vendorHash = "sha256-fy3FI1K57hLAgbw3WfmVNZT9ywCSXwRKSq+ATjG+Qpo=";
+  vendorHash = "sha256-PW0PPMlNB5aa81tsYWUk9mWfSyafI5A0OxqJTCe0OdI=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/applications/networking/instant-messengers/beeper/default.nix b/pkgs/applications/networking/instant-messengers/beeper/default.nix
index 11ca66b3aa69..e555aec38724 100644
--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@@ -11,11 +11,11 @@
 }:
 let
   pname = "beeper";
-  version = "3.95.26";
+  version = "3.96.30";
   name = "${pname}-${version}";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.95.26-build-240213e5u8pwxjw-x86_64.AppImage";
-    hash = "sha256-1jlaY5rkw/dgOboj3iUPEkCVouUTXsbPS9E9xuJn9oU=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.96.30-build-240217e2y4xz3z3-x86_64.AppImage";
+    hash = "sha256-j/ACMLHircmt5yKhQIeZnVaJBDBcB2YYA+XOjcdMjxc=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index 4c547cb4b125..459fc1f48963 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -52,13 +52,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdrangel";
-  version = "7.17.3";
+  version = "7.18.0";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NjahPDHM6qbBXTpDSe8HQPslMO0yTd6/0piNzrFNerM=";
+    hash = "sha256-5+OUOqQb0ekeAVCOr+MftttqTwcDeiV44Oni6i3rO0w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/electronics/qucs-s/default.nix b/pkgs/applications/science/electronics/qucs-s/default.nix
index 593e9d9187b7..4117638a1fda 100644
--- a/pkgs/applications/science/electronics/qucs-s/default.nix
+++ b/pkgs/applications/science/electronics/qucs-s/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qucs-s";
-  version = "2.1.0";
+  version = "24.1.0";
 
   src = fetchFromGitHub {
     owner = "ra3xdh";
     repo = "qucs_s";
     rev = version;
-    sha256 = "sha256-C7TLOuC0CHredDiWFIAFmOlV8ivX0j4bs3b8IB8FsqE=";
+    sha256 = "sha256-ei9CPlJg+Kfjh7vu5VnT6DNLmmnA8wZ2A1jXnm//Fgo=";
   };
 
   nativeBuildInputs = [ flex bison wrapQtAppsHook cmake ];
diff --git a/pkgs/applications/version-management/git-branchless/default.nix b/pkgs/applications/version-management/git-branchless/default.nix
index 6bcfb0a6cdc7..a8041f2698bb 100644
--- a/pkgs/applications/version-management/git-branchless/default.nix
+++ b/pkgs/applications/version-management/git-branchless/default.nix
@@ -37,6 +37,10 @@ rustPlatform.buildRustPackage rec {
     libiconv
   ];
 
+  postInstall = ''
+    $out/bin/git-branchless install-man-pages $out/share/man
+  '';
+
   preCheck = ''
     export TEST_GIT=${git}/bin/git
     export TEST_GIT_EXEC_PATH=$(${git}/bin/git --exec-path)
diff --git a/pkgs/by-name/ad/ad-miner/package.nix b/pkgs/by-name/ad/ad-miner/package.nix
index 549704be72f6..79c01a99ed95 100644
--- a/pkgs/by-name/ad/ad-miner/package.nix
+++ b/pkgs/by-name/ad/ad-miner/package.nix
@@ -5,17 +5,17 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ad-miner";
-  version = "1.0.0";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mazars-Tech";
     repo = "AD_Miner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HM7PR1i7/L3MuUaTBPcDblflCH40NmEYSCTJUB06Fjg=";
+    hash = "sha256-eAcnGS0HLrTqc/WVKNNwYA89GK233QZj4Gfggt4S8R8=";
   };
 
-  # ALl requirements are pinned
+  # All requirements are pinned
   pythonRelaxDeps = true;
 
   nativeBuildInputs = with python3.pkgs; [
@@ -40,7 +40,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Active Directory audit tool that leverages cypher queries to crunch data from Bloodhound";
     homepage = "https://github.com/Mazars-Tech/AD_Miner";
-    changelog = "https://github.com/Mazars-Tech/AD_Miner/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/Mazars-Tech/AD_Miner/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
     mainProgram = "AD-miner";
diff --git a/pkgs/by-name/co/codeium/package.nix b/pkgs/by-name/co/codeium/package.nix
index 69afe48ac940..72a08361028b 100644
--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@@ -13,10 +13,10 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-nyw52kjBC4NCnb/WLkeozjH8A7kL+oRY7ayvGM70I9c=";
-    aarch64-linux = "sha256-GmTAdiOctV2rNwlospYtQmNbspDvdXlV6j/Q5v+GD/k=";
-    x86_64-darwin = "sha256-YMUztQRdjIqpFQqnK9gfZhMSKUAJlKWvcYH3Xns26hQ=";
-    aarch64-darwin = "sha256-cV/ZjmX9DfYyBdrVpbBZxAHfW70FVg+8R0Pxji38lRg=";
+    x86_64-linux = "sha256-lMlJezLLyN3OMtom/opbihUsrkCuWDGXB8j+o53JMBE=";
+    aarch64-linux = "sha256-Ccej0Amq/Yo2F2C21rC0E9rzwE4grvyP+q+QajEg1MA=";
+    x86_64-darwin = "sha256-DFGiYI1hc0GN+A63OWdcCHnwkDQKZ+fhrNozWtlebJs=";
+    aarch64-darwin = "sha256-iuGmmaCc0YbLUO6G8Uyy/DvNgmfV+TzU4j0VPyACQb4=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.6.36";
+  version = "1.6.38";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
diff --git a/pkgs/by-name/ka/kas/package.nix b/pkgs/by-name/ka/kas/package.nix
index d2b062226794..f17b7bfed3b0 100644
--- a/pkgs/by-name/ka/kas/package.nix
+++ b/pkgs/by-name/ka/kas/package.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "kas";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "siemens";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-EYz9V45b7fSKoI8w9X0LcSTojErpJHfzxcdE4I4qD2k=";
+    hash = "sha256-NjNPcCqmjFeydTgNdN8QRrFG5Mys2jL4I8TiznO2rSA=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [ setuptools kconfiglib jsonschema distro pyyaml ];
diff --git a/pkgs/by-name/my/myrescue/0001-darwin-build-fixes.patch b/pkgs/by-name/my/myrescue/0001-darwin-build-fixes.patch
new file mode 100644
index 000000000000..6dee89ab8f80
--- /dev/null
+++ b/pkgs/by-name/my/myrescue/0001-darwin-build-fixes.patch
@@ -0,0 +1,79 @@
+From c8f75fec1e558d1f6d5bbcdd89ac14b10fa370de Mon Sep 17 00:00:00 2001
+From: annalee <150648636+a-n-n-a-l-e-e@users.noreply.github.com>
+Date: Sun, 18 Feb 2024 09:08:12 +0000
+Subject: [PATCH] darwin build fixes
+
+---
+ compat.h              | 9 +++++++++
+ myrescue-bitmap2ppm.c | 1 +
+ myrescue-stat.c       | 1 +
+ myrescue.c            | 5 +++++
+ 4 files changed, 16 insertions(+)
+ create mode 100644 src/compat.h
+
+diff --git a/compat.h b/compat.h
+new file mode 100644
+index 0000000..99b7239
+--- /dev/null
++++ b/compat.h
+@@ -0,0 +1,9 @@
++#pragma once
++
++#ifdef __APPLE__
++#include <unistd.h>
++#include <fcntl.h>
++_Static_assert(sizeof(off_t) == 8, "off_t must be 8 bytes");
++#define lseek64 lseek
++#define open64 open
++#endif
+diff --git a/myrescue-bitmap2ppm.c b/myrescue-bitmap2ppm.c
+index 68ecc29..eb2dd9e 100644
+--- a/myrescue-bitmap2ppm.c
++++ b/myrescue-bitmap2ppm.c
+@@ -25,6 +25,7 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <fcntl.h>
++#include "compat.h"
+ 
+ int main(int argc, char** argv)
+ {
+diff --git a/myrescue-stat.c b/myrescue-stat.c
+index c7a115f..264bd55 100644
+--- a/myrescue-stat.c
++++ b/myrescue-stat.c
+@@ -25,6 +25,7 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <fcntl.h>
++#include "compat.h"
+ 
+ #define BUFFER_SIZE 4096
+ 
+diff --git a/myrescue.c b/myrescue.c
+index 0b119c5..f9b052c 100644
+--- a/myrescue.c
++++ b/myrescue.c
+@@ -21,7 +21,11 @@
+ #define __USE_LARGEFILE64   1
+ #define _LARGEFILE_SOURCE   1
+ #define _LARGEFILE64_SOURCE 1
++#ifdef __linux__
+ #define HAVE_USBRESET       1
++#else
++#define HAVE_USBRESET       0
++#endif
+ 
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -37,6 +41,7 @@
+ #include <signal.h>
+ 
+ #include "permute.h"
++#include "compat.h"
+ 
+ #define LONG_TIME 3
+ #define SLEEP_AFTER_USBRESET 5
+-- 
+2.43.0
+
diff --git a/pkgs/by-name/my/myrescue/package.nix b/pkgs/by-name/my/myrescue/package.nix
new file mode 100644
index 000000000000..1f47499c55bb
--- /dev/null
+++ b/pkgs/by-name/my/myrescue/package.nix
@@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "myrescue";
+  version = "0.9.8";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/myrescue/myrescue/myrescue-${finalAttrs.version}/myrescue-${finalAttrs.version}.tar.gz";
+    hash = "sha256-tO9gkDpEtmySatzV2Ktw3eq5SybCUGAUmKXiSxnkwdc=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  sourceRoot = "./src";
+
+  patches = [
+    ./0001-darwin-build-fixes.patch
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 myrescue -t $out/bin
+    installManPage ../doc/myrescue.1
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Hard disk recovery tool that reads undamaged regions first";
+    mainProgram = "myrescue";
+    homepage = "https://myrescue.sourceforge.net";
+    maintainers = with maintainers; [ d3vil0p3r ];
+    platforms = platforms.unix;
+    license = licenses.gpl2Plus;
+  };
+})
diff --git a/pkgs/by-name/no/normcap/package.nix b/pkgs/by-name/no/normcap/package.nix
index 8db68e9ae7e2..7018cc565780 100644
--- a/pkgs/by-name/no/normcap/package.nix
+++ b/pkgs/by-name/no/normcap/package.nix
@@ -25,7 +25,7 @@ in
 
 ps.buildPythonApplication rec {
   pname = "normcap";
-  version = "0.4.4";
+  version = "0.5.4";
   format = "pyproject";
 
   disabled = ps.pythonOlder "3.9";
@@ -34,20 +34,32 @@ ps.buildPythonApplication rec {
     owner = "dynobo";
     repo = "normcap";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dShtmoqS9TC3PHuwq24OEOhYfBHGhDCma8Du8QCkFuI=";
+    hash = "sha256-bYja05U/JBwSij1J2LxN+c5Syrb4qzWSZY5+HNmC9Zo=";
   };
 
+  postPatch = ''
+    # disable coverage testing
+    substituteInPlace pyproject.toml \
+      --replace "addopts = [" "addopts_ = ["
+  '';
+
   pythonRemoveDeps = [
-    "PySide6-Essentials"
+    "pyside6-essentials"
+  ];
+
+  pythonRelaxDeps = [
+    "shiboken6"
   ];
 
   nativeBuildInputs = [
     ps.pythonRelaxDepsHook
-    ps.poetry-core
+    ps.hatchling
+    ps.babel
   ];
 
   propagatedBuildInputs = [
     ps.pyside6
+    ps.jeepney
   ];
 
   preFixup = ''
@@ -78,6 +90,7 @@ ps.buildPythonApplication rec {
 
   postCheck = lib.optionalString stdenv.isLinux ''
     # cleanup the virtual x11 display
+    sleep 0.5
     kill $xvfb_pid
   '';
 
@@ -90,11 +103,20 @@ ps.buildPythonApplication rec {
     "test_urls_reachable"
     # requires xdg
     "test_synchronized_capture"
+    # flaky
+    "test_normcap_ocr_testcases"
   ] ++ lib.optionals stdenv.isDarwin [
     # requires impure pbcopy
     "test_get_copy_func_with_pbcopy"
     "test_get_copy_func_without_pbcopy"
     "test_perform_pbcopy"
+    # NSXPCSharedListener endpointForReply:withListenerName:replyErrorCode:
+    # while obtaining endpoint 'ClientCallsAuxiliary': Connection interrupted
+    # since v5.0.0
+    "test_introduction_initialize_checkbox_state"
+    "test_introduction_checkbox_sets_return_code"
+    "test_introduction_toggle_checkbox_changes_return_code"
+    "test_show_introduction"
   ];
 
   disabledTestPaths = [
@@ -105,6 +127,9 @@ ps.buildPythonApplication rec {
   ] ++ lib.optionals stdenv.isDarwin [
     # requires a display
     "tests/integration/test_normcap.py"
+    "tests/integration/test_tray_menu.py"
+    # failure unknown, crashes in first test with `.show()`
+    "tests/tests_gui/test_loading_indicator.py"
   ];
 
   meta = with lib; {
@@ -113,5 +138,6 @@ ps.buildPythonApplication rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ cafkafk pbsds ];
     mainProgram = "normcap";
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/by-name/pa/parallel-disk-usage/package.nix b/pkgs/by-name/pa/parallel-disk-usage/package.nix
index ba896d3afb11..f3aa96cbed14 100644
--- a/pkgs/by-name/pa/parallel-disk-usage/package.nix
+++ b/pkgs/by-name/pa/parallel-disk-usage/package.nix
@@ -4,16 +4,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "parallel-disk-usage";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "KSXGitHub";
     repo = pname;
     rev = version;
-    hash = "sha256-Bo2fBOGuAur3dQtBdcbeDRBgp+bFpi86dZQjSuZpEc8=";
+    hash = "sha256-nWn6T1vJ4UANuU5EL5Ws5qT+k8Wd3Cm0SOJEgAbsCvo=";
   };
 
-  cargoHash = "sha256-V7j2dvu7Z3Xq8WGoFxl6DjO8sYU8+ZNC9V6qqdYIuQo=";
+  cargoHash = "sha256-69DwIDGX4b+l2ay+OH3gjHnCj43VXruzBklOkS6M0DY=";
 
   meta = with lib; {
     description = "Highly parallelized, blazing fast directory tree analyzer";
diff --git a/pkgs/by-name/pa/pasco/include-string.h.patch b/pkgs/by-name/pa/pasco/include-string.h.patch
new file mode 100644
index 000000000000..b156a0537071
--- /dev/null
+++ b/pkgs/by-name/pa/pasco/include-string.h.patch
@@ -0,0 +1,10 @@
+--- a/src/pasco.c	2024-02-18 12:43:27.385857649 +0100
++++ b/src/pasco.c	2024-02-18 12:44:00.286087384 +0100
+@@ -36,6 +36,7 @@
+ #include <stdio.h>
+ #include <time.h>
+ #include <math.h>
++#include <string.h>
+ 
+ //
+ /* This is the default block size for an activity record */
diff --git a/pkgs/by-name/pa/pasco/package.nix b/pkgs/by-name/pa/pasco/package.nix
new file mode 100644
index 000000000000..da9343db3930
--- /dev/null
+++ b/pkgs/by-name/pa/pasco/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pasco";
+  version = "20040505_1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/fast/Pasco/Pasco%20v${finalAttrs.version}/pasco_${finalAttrs.version}.tar.gz";
+    hash = "sha256-o7jue+lgVxQQvFZOzJMGd1WihlD7Nb+1WaSutq9vaGg=";
+  };
+
+  patches = [
+    ./include-string.h.patch
+  ];
+
+  makeFlags = [
+    "-C src"
+  ];
+
+  postPatch = ''
+    substituteInPlace src/Makefile \
+      --replace gcc cc
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp bin/pasco $out/bin
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Examine the contents of Internet Explorer's cache files for forensic purposes";
+    mainProgram = "pasco";
+    homepage = "https://sourceforge.net/projects/fast/files/Pasco/";
+    maintainers = with maintainers; [ d3vil0p3r ];
+    platforms = platforms.unix;
+    license = with licenses; [ bsd3 ];
+  };
+})
diff --git a/pkgs/by-name/pd/pdfannots/package.nix b/pkgs/by-name/pd/pdfannots/package.nix
new file mode 100644
index 000000000000..14672b371724
--- /dev/null
+++ b/pkgs/by-name/pd/pdfannots/package.nix
@@ -0,0 +1,34 @@
+{ lib, python3, fetchFromGitHub }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "pdfannots";
+  version = "0.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "0xabu";
+    repo = "pdfannots";
+    rev = "v${version}";
+    hash = "sha256-C0Ss6kZvPx0hHnpBKquEolxeuTfjshhSBSIDXcCKtM8=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.setuptools
+  ];
+
+  propagatedBuildInputs = [
+    python3.pkgs.pdfminer-six
+  ];
+
+  pythonImportsCheck = [
+    "pdfannots"
+  ];
+
+  meta = with lib; {
+    description = "Extracts and formats text annotations from a PDF file";
+    homepage = "https://github.com/0xabu/pdfannots";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+    mainProgram = "pdfannots";
+  };
+}
diff --git a/pkgs/by-name/pd/pdfid/package.nix b/pkgs/by-name/pd/pdfid/package.nix
new file mode 100644
index 000000000000..62e14fa9d226
--- /dev/null
+++ b/pkgs/by-name/pd/pdfid/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, fetchzip
+, python3
+, python3Packages
+, makeBinaryWrapper
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "pdfid";
+  version = "0.2.8";
+  format = "other";
+
+  src = fetchzip {
+    url = "https://didierstevens.com/files/software/pdfid_v0_2_8.zip";
+    hash = "sha256-ZLyhBMF2KMX0c1oCvuSCjEjHTnm2gFhJtasaTD9Q1BI=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,share/pdfid}
+    cp -a * $out/share/pdfid/
+    makeBinaryWrapper ${lib.getExe python3} $out/bin/${meta.mainProgram} \
+      --add-flags "$out/share/pdfid/pdfid.py"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Scan a file to look for certain PDF keywords";
+    homepage = "https://blog.didierstevens.com/programs/pdf-tools/";
+    license = with licenses; [ free ];
+    mainProgram = "pdfid";
+    maintainers = with maintainers; [ d3vil0p3r ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/za/zapzap/package.nix b/pkgs/by-name/za/zapzap/package.nix
index 6c3fcb27fc93..e41a099f4f32 100644
--- a/pkgs/by-name/za/zapzap/package.nix
+++ b/pkgs/by-name/za/zapzap/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "zapzap";
-  version = "5.1.3";
+  version = "5.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "zapzap-linux";
     repo = "zapzap";
     rev = version;
-    hash = "sha256-IxBmtXrRIxUqnhB4OsL+lRIBTISdIqpcbI/uZ31MEBU=";
+    hash = "sha256-vG8yDW0+scImPWHyVJs2QkiSWbjPLR9Z01zkOWZi/BI=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/development/compilers/ispc/default.nix b/pkgs/development/compilers/ispc/default.nix
index d8b8c141042b..0c710b0736a3 100644
--- a/pkgs/development/compilers/ispc/default.nix
+++ b/pkgs/development/compilers/ispc/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "ispc";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner  = pname;
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-NiBwQ7BzNgRdWLvjOi1fQni+vnYwn0nLHxqAVucmb2k=";
+    sha256 = "sha256-zixPt7YICCG0N8t1pcXEu/sPKCVLQVPCiJsQEqEXl+A=";
   };
 
   nativeBuildInputs = [ cmake which m4 bison flex python3 llvmPackages.libllvm.dev tbb ] ++ lib.lists.optionals stdenv.isDarwin [ xcode ];
@@ -55,7 +55,6 @@ stdenv.mkDerivation rec {
     "-DFILE_CHECK_EXECUTABLE=${llvmPackages.llvm}/bin/FileCheck"
     "-DLLVM_AS_EXECUTABLE=${llvmPackages.llvm}/bin/llvm-as"
     "-DLLVM_CONFIG_EXECUTABLE=${llvmPackages.llvm.dev}/bin/llvm-config"
-    "-DLLVM_DIS_EXECUTABLE=${llvmPackages.llvm}/bin/llvm-dis"
     "-DCLANG_EXECUTABLE=${llvmPackages.clang}/bin/clang"
     "-DCLANGPP_EXECUTABLE=${llvmPackages.clang}/bin/clang++"
     "-DISPC_INCLUDE_EXAMPLES=OFF"
diff --git a/pkgs/development/libraries/libgudev/default.nix b/pkgs/development/libraries/libgudev/default.nix
index fd21c9e7f85e..68e3e42476e7 100644
--- a/pkgs/development/libraries/libgudev/default.nix
+++ b/pkgs/development/libraries/libgudev/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./tests-skip-double-test-on-stub-locale-impls.patch
   ];
 
-  postPatch = ''
+  postPatch = lib.optionalString finalAttrs.finalPackage.doCheck ''
     # The relative location of LD_PRELOAD works for Glibc but not for other loaders (e.g. pkgsMusl)
     substituteInPlace tests/meson.build \
       --replace "LD_PRELOAD=libumockdev-preload.so.0" "LD_PRELOAD=${lib.getLib umockdev}/lib/libumockdev-preload.so.0"
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index e2da72982ca8..727cf4992810 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -22,16 +22,16 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.3.0";
+  version = "3.4.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "aiogram";
     repo = "aiogram";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TD4pDmM899zBOxllM0iju2u6IhmXxLYWBpjfWhewVFc=";
+    hash = "sha256-2of4KHdpAATOt0dCqI3AmTJtdeN5SdiWydeGjtagABI=";
   };
 
   nativeBuildInputs = [
@@ -66,7 +66,9 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "aiogram" ];
 
-  passthru.updateScript = gitUpdater { };
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
 
   meta = with lib; {
     description = "Modern and fully asynchronous framework for Telegram Bot API";
diff --git a/pkgs/development/python-modules/django-pattern-library/default.nix b/pkgs/development/python-modules/django-pattern-library/default.nix
index b93df07d2ef5..12a229ce9da8 100644
--- a/pkgs/development/python-modules/django-pattern-library/default.nix
+++ b/pkgs/development/python-modules/django-pattern-library/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "django-pattern-library";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "torchbox";
     repo = "django-pattern-library";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9uuLYwG0/NYGouncuaN8S+3CBABSxSOkcrP59p5v84U=";
+    hash = "sha256-hrdJYVioY6y9D29DuKPMZjdWj92GcbHXANWiEHadimI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/editorconfig/default.nix b/pkgs/development/python-modules/editorconfig/default.nix
index eaca75178474..f55442b2f584 100644
--- a/pkgs/development/python-modules/editorconfig/default.nix
+++ b/pkgs/development/python-modules/editorconfig/default.nix
@@ -1,35 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , cmake
 }:
 
-let
-  tests = fetchFromGitHub {
-    owner = "editorconfig";
-    repo = "editorconfig-core-test";
-    rev = "e407c1592df0f8e91664835324dea85146f20189";
-    hash = "sha256-9WSEkMJOewPqJjB6f7J6Ir0L+U712hkaN+GszjnGw7c=";
-  };
-in
 buildPythonPackage rec {
   pname = "editorconfig";
-  version = "0.12.3";
-  format = "setuptools";
+  version = "0.12.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "editorconfig";
     repo = "editorconfig-core-py";
     rev = "v${version}";
-    hash = "sha256-ZwoTMgk18+BpPNtXKQUMXGcl2Lp+1RQVyPHgk6gHWh8=";
-    # workaround until https://github.com/editorconfig/editorconfig-core-py/pull/40 is merged
-    # fetchSubmodules = true;
+    hash = "sha256-+m674bLj6xs7MWU+8BMixEwy7/TjyES0lvCLLogTDHQ=";
+    fetchSubmodules = true;
   };
 
-  postUnpack = ''
-    cp -r ${tests}/* source/tests
-    chmod +w -R source/tests
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   nativeCheckInputs = [
     cmake
@@ -38,9 +29,12 @@ buildPythonPackage rec {
   dontUseCmakeConfigure = true;
 
   checkPhase = ''
+    runHook preCheck
+
     cmake .
-    # utf_8_char fails with Python 3
-    ctest -E "utf_8_char" .
+    ctest .
+
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "editorconfig" ];
diff --git a/pkgs/development/python-modules/fpyutils/default.nix b/pkgs/development/python-modules/fpyutils/default.nix
index 3ad71f9a2617..a81067e1ffb3 100644
--- a/pkgs/development/python-modules/fpyutils/default.nix
+++ b/pkgs/development/python-modules/fpyutils/default.nix
@@ -5,22 +5,27 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "fpyutils";
-  version = "3.0.1";
-  format = "setuptools";
+  version = "4.0.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "frnmst";
-    repo = pname;
+    repo = "fpyutils";
     rev = "refs/tags/${version}";
-    hash = "sha256-cmCD8uKPX/7Ak6jAqzCvDqR1FgH09GaLfLTZdBQB+bs=";
+    hash = "sha256-VVR1zsejO6kHlMjqqlftDKu3/SyDzgPov9f48HYL/Bk=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     atomicwrites
     requests
diff --git a/pkgs/development/python-modules/md-toc/default.nix b/pkgs/development/python-modules/md-toc/default.nix
index 18aeac19b3ca..7789104db892 100644
--- a/pkgs/development/python-modules/md-toc/default.nix
+++ b/pkgs/development/python-modules/md-toc/default.nix
@@ -5,22 +5,27 @@
 , pyfakefs
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "md-toc";
-  version = "8.2.2";
-  format = "setuptools";
+  version = "8.2.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "frnmst";
-    repo = pname;
-    rev = version;
-    hash = "sha256-fL3JlZWTEEinYILNeHw0cuvVza27atLLxjrBZkVLRiU=";
+    repo = "md-toc";
+    rev = "refs/tags/${version}";
+    hash = "sha256-nKkKtLEW0pohXiMtjWl2Kzh7SRwZJ/yzhXpDyluLodc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     fpyutils
   ];
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 625f87803c2e..bbc125443e3a 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "2.2.21";
+  version = "2.2.22";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-qmzPtHAw4hzHDOLA8RT1VqAOjI287oxYNVT2t8sspVw=";
+    hash = "sha256-bAg7Rr17Q+a+S0ZuHcFmmTM0sRcX2w0zRClKdFwix30=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index 407be029a60b..e8ab9a2802cb 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "3.2.0";
+  version = "3.2.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-RmOKrR89bRzewUwK4oebkM8GmfEcwcx8fKFiChnMD5A=";
+    hash = "sha256-UHBr6O0eV4A2yS04/gtPplp5rI+YfizQhYMUE2AZ41I=";
   };
 
   buildInputs = [ pip ];
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 1ba1e4e94a64..86bcf10bcf3d 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.13.6";
+  version = "1.13.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3kPM9mc18WsO8RJpCCVMeG58AHLwXI/dmQHCjZ6xLj4=";
+    hash = "sha256-wH4LCfjnxAwub/BCe27osyJVUZSOMDjjxItv0aEa8Ic=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 6d0949a96e3f..e1423c9270e7 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.207.1";
+  version = "2.208.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "sagemaker-python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nSFBx2s6vy5Ug2tBiPqNu4Q29LGW2LijoDKlC6m4CL4=";
+    hash = "sha256-9YcYRwwa5P31jZpDrsewBY+r2kjRmoGM8CkXqAMilvE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tplink-omada-client/default.nix b/pkgs/development/python-modules/tplink-omada-client/default.nix
index 4006c002d52c..96f8f31c532c 100644
--- a/pkgs/development/python-modules/tplink-omada-client/default.nix
+++ b/pkgs/development/python-modules/tplink-omada-client/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tplink-omada-client";
-  version = "1.3.7";
+  version = "1.3.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "tplink_omada_client";
     inherit version;
-    hash = "sha256-iSCrFrcj6csslIkd8yt0wvvOSTCHRiMnsMOeUDcsE4U=";
+    hash = "sha256-/hWlBuqj8RuoOfY2qmha3kkqXIixwWTPKi7TjciB6Rk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tuf/default.nix b/pkgs/development/python-modules/tuf/default.nix
index b6965a7f42e2..2572c4ed8cd7 100644
--- a/pkgs/development/python-modules/tuf/default.nix
+++ b/pkgs/development/python-modules/tuf/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "tuf";
-  version = "3.1.0";
+  version = "3.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,12 +20,12 @@ buildPythonPackage rec {
     owner = "theupdateframework";
     repo = "python-tuf";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IGF/8RdX7Oxl6gdqPGN1w/6q4zaei+MnYXBZepB4KUA=";
+    hash = "sha256-HiF/b6aOhDhhQqYx/bjMXHABxmAJY4vkLlTheiL8zEo=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "hatchling==" "hatchling>="
+      --replace-fail "hatchling==" "hatchling>="
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wagtail-localize/default.nix b/pkgs/development/python-modules/wagtail-localize/default.nix
index d90a71ca2582..54e00438c603 100644
--- a/pkgs/development/python-modules/wagtail-localize/default.nix
+++ b/pkgs/development/python-modules/wagtail-localize/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "wagtail-localize";
-  version = "1.7";
+  version = "1.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     repo = pname;
     owner = "wagtail";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Q29Nh/4Z3tYuwoodWKDl5FS+lfl9yDXN7RHn/RReCds=";
+    hash = "sha256-K4TOW4q8vD9vaNJzSEtmQBgO/dOxcWKKUp2FE3JLIbE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zigpy-deconz/default.nix b/pkgs/development/python-modules/zigpy-deconz/default.nix
index 721905fb17b8..930fcf0a7d2b 100644
--- a/pkgs/development/python-modules/zigpy-deconz/default.nix
+++ b/pkgs/development/python-modules/zigpy-deconz/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-deconz";
-  version = "0.23.0";
+  version = "0.23.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-8U/3YzXyrQ6pOklvfuVFAk2r/mpcUM7HokfBJUhtyh4=";
+    hash = "sha256-10EyT3IGdAtF9OUbfZ5OtP+Ot35O0SfMDtsyw5FQ+/8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/cvehound/default.nix b/pkgs/development/tools/analysis/cvehound/default.nix
index d6b08fb06153..96f9b47d17bc 100644
--- a/pkgs/development/tools/analysis/cvehound/default.nix
+++ b/pkgs/development/tools/analysis/cvehound/default.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cvehound";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "evdenis";
     repo = "cvehound";
     rev = "refs/tags/${version}";
-    hash = "sha256-4+0Virpsq4mwOIpostS87VYTX8hsumXEL1w8FiOrNtA=";
+    hash = "sha256-DnrFlDFJT74irvrNs/j7zwO76DYjTOuY0t+mu5c8gpk=";
   };
 
   makeWrapperArgs = [
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index 83346ba9882a..b1098bd32129 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.110.4";
+  version = "0.112.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+RPXzOaOR+LQWS/p19fZKFW3zhzvhhfusB6K5q4Am8Y=";
+    sha256 = "sha256-3ad/2h9rw1BeMcr1lLEZp4fzJHfwl7y3/tTjmKKAvho=";
   };
 
-  vendorHash = "sha256-j7C2pKjTX9EVMRV+D8fNQB2RE3YJ7l/vdwrfjo2TQIM=";
+  vendorHash = "sha256-tHEbHExdbWeZm3+rwRYpRILyPYEYdeVJ91Qr/yNIKV8=";
 
   ldflags = [
     "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${version}"
diff --git a/pkgs/development/tools/gotools/default.nix b/pkgs/development/tools/gotools/default.nix
index bbd77aedef7f..0a31db2779b2 100644
--- a/pkgs/development/tools/gotools/default.nix
+++ b/pkgs/development/tools/gotools/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "gotools";
-  version = "0.16.1";
+  version = "0.18.0";
 
   # using GitHub instead of https://go.googlesource.com/tools because Gitiles UI is to basic to browse
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
     rev = "v${version}";
-    hash = "sha256-qFDi+d+2OuI+mMBceZiN+kJ0gPcfgXXRDrDDwqKeDOM=";
+    hash = "sha256-sOT98DdLYtPXovpcX020BbLSH99ByJSaVQeM10IcKG4=";
   };
 
   postPatch = ''
@@ -20,7 +20,7 @@ buildGoModule rec {
     rm -r cmd/getgo
   '';
 
-  vendorHash = "sha256-oOBdh4mK3x9HbxD00EDKLjFgd/4NQRlQXrnCigGOwLg=";
+  vendorHash = "sha256-gGAEl3yabXy1qbuBJyrpD+TRrKr56cZEOiSaBoBsYc8=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/runme/default.nix b/pkgs/development/tools/misc/runme/default.nix
index c9118df07d5a..39548f7d7d8d 100644
--- a/pkgs/development/tools/misc/runme/default.nix
+++ b/pkgs/development/tools/misc/runme/default.nix
@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "runme";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "stateful";
     repo = "runme";
     rev = "v${version}";
-    hash = "sha256-y8UjSxYHWf+HnSDN7p6Y6iheTFaYXOCYsOImk/BuvKU=";
+    hash = "sha256-yGJqHhqQoG/Oa3/IV+sTdeEJurB8GGvoOxZnSeNkgqA=";
   };
 
   vendorHash = "sha256-QoZzEq1aC7cjY/RVp5Z5HhSuTFf2BSYQnfg0jSaeTJU=";
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index c4779f96f5ea..8a1fc754ebe2 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.26";
+  version = "1.0.27";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-UEYA6q83fxD3yQuHsQiO9bQ5gptQSipFGjE5eGUb+1c=";
+        hash = "sha256-zGc5Y/PNoU1tOHKCH9SiBBWyIxs6gyTNPKwxFhJl3w0=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-H+hmbZdRKjljskwNicLeFguo5STZ8fIxk7FHvOenuRc=";
+        hash = "sha256-IEBCZ7DrWzFs2Z97uRuQ1MsaxGqEz9/+BzTA/Qb4rnI=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-mlKspcFpeYXJuINYDvCoDEuNHJDMcDqngPNIBpD39T4=";
+        hash = "sha256-fiY8cpy8REGOaETScUJpbN0HTJT0gAfjSfGLSDBeUs8=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-mWVe8BFGSXKJYnr2QXZah1XYfir5zN5+2wQ4HfgdOyE=";
+        hash = "sha256-t48K6lueJaNcKPAuahzz2TVomWhv67SlYqeo7EBoqtM=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/os-specific/linux/ethq/default.nix b/pkgs/os-specific/linux/ethq/default.nix
index f966e285471e..d103604294a4 100644
--- a/pkgs/os-specific/linux/ethq/default.nix
+++ b/pkgs/os-specific/linux/ethq/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ethq";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "isc-projects";
     repo = "ethq";
     rev = "refs/tags/v${builtins.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-luvvNdH4kERAMy242kLCqlnGmfPjSjvoHa6J2J7BFi4=";
+    hash = "sha256-dr37KiSnP0S0OjQof242EcbH+y4pCCzu6R9D6fXR9qc=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index 5f32437970c9..54f0cdbd4857 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -6,6 +6,7 @@
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
   version = "5.7";
+  outputs = [ "out" "tools" ];
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
@@ -43,10 +44,18 @@ stdenv.mkDerivation rec {
     nfs-utils
   ];
 
+  postPatch = ''
+    substituteInPlace src/tools/mount.9P --replace "/bin/mount" "/usr/bin/env mount"
+  '';
+
   postFixup = ''
     patchelf --add-rpath $out/lib $out/bin/ganesha.nfsd
   '';
 
+  postInstall = ''
+    install -Dm755 $src/src/tools/mount.9P $tools/bin/mount.9P
+  '';
+
   meta = with lib; {
     description = "NFS server that runs in user space";
     homepage = "https://github.com/nfs-ganesha/nfs-ganesha/wiki";
@@ -54,5 +63,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.lgpl3Plus;
     mainProgram = "ganesha.nfsd";
+    outputsToInstall = [ "out" "tools" ];
   };
 }
diff --git a/pkgs/servers/web-apps/dokuwiki/default.nix b/pkgs/servers/web-apps/dokuwiki/default.nix
index a95a6acdfb7c..00cbbfd0ad24 100644
--- a/pkgs/servers/web-apps/dokuwiki/default.nix
+++ b/pkgs/servers/web-apps/dokuwiki/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dokuwiki";
-  version = "2023-04-04a";
+  version = "2024-02-06a";
 
   src = fetchFromGitHub {
     owner = "dokuwiki";
     repo = pname;
     rev = "release-${version}";
-    sha256 = "sha256-PVfJfGYa2Drf4ljnnhb7kNpjfQlW4dDt5Xd5h+C8tP4=";
+    sha256 = "sha256-gAoEUskTTbcpHgDUBSsAv6QQDvPuxQ1jXZ4TTKrjWIU=";
   };
 
   preload = writeText "preload.php" ''
diff --git a/pkgs/tools/admin/iredis/default.nix b/pkgs/tools/admin/iredis/default.nix
index 95f8a98ed4a4..2c57aa166978 100644
--- a/pkgs/tools/admin/iredis/default.nix
+++ b/pkgs/tools/admin/iredis/default.nix
@@ -6,16 +6,21 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "iredis";
-  version = "1.14.0";
+  version = "1.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "laixintao";
     repo = "iredis";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5TMO1c29ahAQDbAJZb3u2oY0Z8M+6b8hwbNfqMsuPzM=";
+    hash = "sha256-ojS2wtxggZPp73n9SjPRAzBlnF1ScK/pNVGvAYKmQ5Y=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'wcwidth = "0.1.9"' 'wcwidth = "*"'
+  '';
+
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/tools/misc/cfonts/default.nix b/pkgs/tools/misc/cfonts/default.nix
index 244360c99d8b..12d9687c59be 100644
--- a/pkgs/tools/misc/cfonts/default.nix
+++ b/pkgs/tools/misc/cfonts/default.nix
@@ -1,14 +1,14 @@
 { lib, rustPlatform, fetchCrate }:
 rustPlatform.buildRustPackage rec {
   pname = "cfonts";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-bnjrbcQ2MMZsM0rWWk+xkA58rSREHWfSvlGDAHKIPAw=";
+    hash = "sha256-ixxDlHjx5Bi6Wl/kzJ/R7d+jgTDCAti25TV1RlXRPus=";
   };
 
-  cargoHash = "sha256-8NgEsFglt+JyP5D61mT4Z8SIbPATJskiEpn8tWy+yjk=";
+  cargoHash = "sha256-NltvO5ACf8TsE9CgC1jAXx04/T/kHSZLxXJ4zhA5DGo=";
 
   meta = with lib; {
     homepage = "https://github.com/dominikwilkowski/cfonts";
diff --git a/pkgs/tools/misc/goaccess/default.nix b/pkgs/tools/misc/goaccess/default.nix
index ac13cb69370a..774cc18ad801 100644
--- a/pkgs/tools/misc/goaccess/default.nix
+++ b/pkgs/tools/misc/goaccess/default.nix
@@ -10,14 +10,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.8.1";
+  version = "1.9.1";
   pname = "goaccess";
 
   src = fetchFromGitHub {
     owner = "allinurl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GTW7ECSHjFBw8O2NewvMgC+3aheusupDlSBTxZriHHc=";
+    sha256 = "sha256-vfsMyUnhwsI/tY7d/UpDCyG6DmYzWn9qTi2C0icTPpg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/mise/default.nix b/pkgs/tools/misc/mise/default.nix
index cfafe0d4aebc..b0d48fd6fcfb 100644
--- a/pkgs/tools/misc/mise/default.nix
+++ b/pkgs/tools/misc/mise/default.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2024.2.15";
+  version = "2024.2.16";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-vBlO4Xxv5XM5KEZmIplSSb/LgdG485hQkb7RSRrOIyM=";
+    hash = "sha256-SrLgLYe0jeVzLoJZahqVrlYDd2FJ3G1uxrHx2BKjbHM=";
   };
 
-  cargoHash = "sha256-V+j0Z8voDzVdO2fHFw4boUvlFfCrOId7nkTZsZbCcfg=";
+  cargoHash = "sha256-G/NR53u+rX9Q7tJVYi1tlXQL+gxK7wfqN3IpkoXzTRk=";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
diff --git a/pkgs/tools/misc/plantuml-server/default.nix b/pkgs/tools/misc/plantuml-server/default.nix
index 2ef853e0dee6..e0fa8b00db56 100644
--- a/pkgs/tools/misc/plantuml-server/default.nix
+++ b/pkgs/tools/misc/plantuml-server/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchurl, nixosTests }:
 
 let
-  version = "1.2024.2";
+  version = "1.2024.3";
 in
 stdenv.mkDerivation rec {
   pname = "plantuml-server";
   inherit version;
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml-server/releases/download/v${version}/plantuml-v${version}.war";
-    sha256 = "sha256-0OXP61ndJ2PSXJnqn7+vxJgrUqRkYgAmFmGJiaElMmU=";
+    sha256 = "sha256-tuRtQl6tbjrgew6s6OV4EeY+GUo3DPVJJyuoD2vfnoo=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index d4e619f563f6..38fb6a60169b 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    hash = "sha256-vW1Q3pqVXR3yn2wixhDZE1QsMmUfKswaGZ6JbJAZ5VM=";
+    hash = "sha256-q7XtYOBruEmjPC4gx+hBO5oRwbxL7wQJenBS8Pl6yRk=";
   };
 
-  cargoHash = "sha256-cjkt6Ivpn3MpjdiPM/tLm3B+v/+VCJyxiF7x1bob528=";
+  cargoHash = "sha256-av4xUjoUGt53UoEpWULv15JKVWZq1x0YXvF5XFf4meQ=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/package-management/home-manager/default.nix b/pkgs/tools/package-management/home-manager/default.nix
index af9c91135ed2..77498f9538a3 100644
--- a/pkgs/tools/package-management/home-manager/default.nix
+++ b/pkgs/tools/package-management/home-manager/default.nix
@@ -16,14 +16,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "unstable-2024-02-14";
+  version = "unstable-2024-02-15";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "043ba285c6dc20f36441d48525402bcb9743c498";
-    hash = "sha256-qxmBGDzutuJ/tsX4gp+Mr7fjxOZBbeT9ixhS5o4iFOw=";
+    rev = "3d6791b3897b526c82920a2ab5f61d71985b3cf8";
+    hash = "sha256-EH20hJfNnc1/ODdDVat9B7aKm0B95L3YtkIRwKLvQG8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index eceffd9bdecd..dcae1af2bed1 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -1,19 +1,20 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, git
 , installShellFiles
 , openssl
 }:
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.74.5";
+  version = "0.74.6";
 
   src = fetchFromGitHub {
     owner = "anchore";
-    repo = pname;
+    repo = "grype";
     rev = "refs/tags/v${version}";
-    hash = "sha256-h68LfKQG5xgFIFkyuK9Z6tw8+xoimnF2d2QgTjwU74U=";
+    hash = "sha256-2KLVIwiSrs+e0srXkfBdk/RxCIvSq/Lixe83th2KvRA=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,17 +29,20 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-lnOF3Xvjc20aFPOf9of3n+aBHvPrLTTlH7aPPlYA/RA=";
+  vendorHash = "sha256-wgcbP/VbHOMuc0PxWaOsiYTrr77ztLDVaDMhAD50vuQ=";
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
   nativeCheckInputs = [
+    git
     openssl
   ];
 
-  subPackages = [ "cmd/grype" ];
+  subPackages = [
+    "cmd/grype"
+  ];
 
   excludedPackages = "test/integration";
 
@@ -70,23 +74,25 @@ buildGoModule rec {
 
     # remove tests that depend on docker
     substituteInPlace test/cli/cmd_test.go \
-      --replace "TestCmd" "SkipCmd"
+      --replace-fail "TestCmd" "SkipCmd"
     substituteInPlace grype/pkg/provider_test.go \
-      --replace "TestSyftLocationExcludes" "SkipSyftLocationExcludes"
+      --replace-fail "TestSyftLocationExcludes" "SkipSyftLocationExcludes"
     substituteInPlace test/cli/cmd_test.go \
-      --replace "Test_descriptorNameAndVersionSet" "Skip_descriptorNameAndVersionSet"
+      --replace-fail "Test_descriptorNameAndVersionSet" "Skip_descriptorNameAndVersionSet"
     # remove tests that depend on git
     substituteInPlace test/cli/db_validations_test.go \
-      --replace "TestDBValidations" "SkipDBValidations"
+      --replace-fail "TestDBValidations" "SkipDBValidations"
     substituteInPlace test/cli/registry_auth_test.go \
-      --replace "TestRegistryAuth" "SkipRegistryAuth"
+      --replace-fail "TestRegistryAuth" "SkipRegistryAuth"
     substituteInPlace test/cli/sbom_input_test.go \
-      --replace "TestSBOMInput_FromStdin" "SkipSBOMInput_FromStdin" \
-      --replace "TestSBOMInput_AsArgument" "SkipSBOMInput_AsArgument"
+      --replace-fail "TestSBOMInput_FromStdin" "SkipSBOMInput_FromStdin" \
+      --replace-fail "TestSBOMInput_AsArgument" "SkipSBOMInput_AsArgument"
     substituteInPlace test/cli/subprocess_test.go \
-      --replace "TestSubprocessStdin" "SkipSubprocessStdin"
+      --replace-fail "TestSubprocessStdin" "SkipSubprocessStdin"
     substituteInPlace grype/internal/packagemetadata/names_test.go \
-      --replace "TestAllNames" "SkipAllNames"
+      --replace-fail "TestAllNames" "SkipAllNames"
+    substituteInPlace test/cli/version_cmd_test.go \
+      --replace-fail "TestVersionCmdPrintsToStdout" "SkipVersionCmdPrintsToStdout"
 
     # segfault
     rm grype/db/v5/namespace/cpe/namespace_test.go
diff --git a/pkgs/tools/security/sigma-cli/default.nix b/pkgs/tools/security/sigma-cli/default.nix
index 4f12607ff06a..897fdfcb2f29 100644
--- a/pkgs/tools/security/sigma-cli/default.nix
+++ b/pkgs/tools/security/sigma-cli/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = "sigma-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TVsWGExs4diHoAhfbUs2q9Dh9xVr8WyDRMRhhAFpB8A=";
+    hash = "sha256-+6+xTc9XGsPxK3OsiA4dj2ORgC0PQtZsZ5a6STwmfcg=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/system/gdu/default.nix b/pkgs/tools/system/gdu/default.nix
index 97150db3e94c..9e84f2d8edfe 100644
--- a/pkgs/tools/system/gdu/default.nix
+++ b/pkgs/tools/system/gdu/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "gdu";
-  version = "5.26.0";
+  version = "5.27.0";
 
   src = fetchFromGitHub {
     owner = "dundee";
-    repo = pname;
+    repo = "gdu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bbSpU6l5rhBo7jp7E66/ti4r9GJjXtaaDY5GKYGtLYM=";
+    hash = "sha256-hQyvYLegGimYTRz0J/2tmaC6N4LfjB1ivWgN29DwNhA=";
   };
 
-  vendorHash = "sha256-X1xuQiFSCPH10OK5bPcRN5fqMLxyi6y2mJGE9RQ1aJg=";
+  vendorHash = "sha256-weNcJjofI7Aoy0Eya0KprXHAn7aTA0rQJYrJ4+t65hI=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -27,11 +27,12 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/dundee/gdu/v${lib.versions.major version}/build.Version=${version}"
+    "-X=github.com/dundee/gdu/v${lib.versions.major version}/build.Version=${version}"
   ];
 
   postPatch = ''
-    substituteInPlace cmd/gdu/app/app_test.go --replace "development" "${version}"
+    substituteInPlace cmd/gdu/app/app_test.go \
+      --replace-fail "development" "${version}"
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 9ea35d355c72..a04c4289f5c7 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "3.0.7";
+  version = "3.1.0";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-wCCW5yJPbXkwkkDywtIBR7gaJG0nLEHIC4xb1LbPa3w=";
+    hash = "sha256-BWY/a5XFadyeyjtfBv9vVpT/EPYXoL/DqtUVk9nMkQg=";
   };
 
   vendorHash = "sha256-uEuzAMsQHTAbKeAPIWu2yoCLhBrQNEYxdmjfzLLWONQ=";