diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index a60228198fd7..c81febb4156f 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -63,6 +63,16 @@ checkConfigOutput '^"one two"$' config.result ./shorthand-meta.nix
 
 checkConfigOutput '^true$' config.result ./test-mergeAttrDefinitionsWithPrio.nix
 
+# types.pathInStore
+checkConfigOutput '".*/store/5lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./types.nix
+checkConfigOutput '".*/store/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathInStore.ok2 ./types.nix
+checkConfigOutput '".*/store/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash"' config.pathInStore.ok3 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ""' config.pathInStore.bad1 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store"' config.pathInStore.bad2 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store/"' config.pathInStore.bad3 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store/.links"' config.pathInStore.bad4 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: "/foo/bar"' config.pathInStore.bad5 ./types.nix
+
 # Check boolean option.
 checkConfigOutput '^false$' config.enable ./declare-enable.nix
 checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*: true' config.enable ./define-enable.nix
diff --git a/lib/tests/modules/types.nix b/lib/tests/modules/types.nix
new file mode 100644
index 000000000000..576db6b5b9ef
--- /dev/null
+++ b/lib/tests/modules/types.nix
@@ -0,0 +1,24 @@
+{ lib, ... }:
+let
+  inherit (builtins)
+    storeDir;
+  inherit (lib)
+    types
+    mkOption
+    ;
+in
+{
+  options = {
+    pathInStore = mkOption { type = types.lazyAttrsOf types.pathInStore; };
+  };
+  config = {
+    pathInStore.ok1 = "${storeDir}/5lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv";
+    pathInStore.ok2 = "${storeDir}/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15";
+    pathInStore.ok3 = "${storeDir}/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash";
+    pathInStore.bad1 = "";
+    pathInStore.bad2 = "${storeDir}";
+    pathInStore.bad3 = "${storeDir}/";
+    pathInStore.bad4 = "${storeDir}/.links"; # technically true, but not reasonable
+    pathInStore.bad5 = "/foo/bar";
+  };
+}
diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index c3bf58db241f..531986025083 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -38,9 +38,6 @@ let
       export PAGER=cat
       cacheDir=$TEST_ROOT/binary-cache
 
-      mkdir -p $NIX_CONF_DIR
-      echo "experimental-features = nix-command" >> $NIX_CONF_DIR/nix.conf
-
       nix-store --init
 
       cp -r ${../.} lib
diff --git a/lib/types.nix b/lib/types.nix
index 9360d42f5850..638421260bc9 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -461,6 +461,7 @@ rec {
     # - strings with context, e.g. "${pkgs.foo}" or (toString pkgs.foo)
     # - hardcoded store path literals (/nix/store/hash-foo) or strings without context
     #   ("/nix/store/hash-foo"). These get a context added to them using builtins.storePath.
+    # If you don't need a *top-level* store path, consider using pathInStore instead.
     package = mkOptionType {
       name = "package";
       descriptionClass = "noun";
@@ -491,6 +492,14 @@ rec {
       merge = mergeEqualOption;
     };
 
+    pathInStore = mkOptionType {
+      name = "pathInStore";
+      description = "path in the Nix store";
+      descriptionClass = "noun";
+      check = x: isStringLike x && builtins.match "${builtins.storeDir}/[^.].*" (toString x) != null;
+      merge = mergeEqualOption;
+    };
+
     listOf = elemType: mkOptionType rec {
       name = "listOf";
       description = "list of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
diff --git a/nixos/doc/manual/development/option-types.section.md b/nixos/doc/manual/development/option-types.section.md
index 9e156ebff9d3..44bb3b4782e1 100644
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@@ -20,6 +20,11 @@ merging is handled.
     coerced to a string. Even if derivations can be considered as
     paths, the more specific `types.package` should be preferred.
 
+`types.pathInStore`
+
+:   A path that is contained in the Nix store. This can be a top-level store
+    path like `pkgs.hello` or a descendant like `"${pkgs.hello}/bin/hello"`.
+
 `types.package`
 
 :   A top-level store path. This can be an attribute set pointing
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index 1a97cedb2e81..523c16523272 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -855,21 +855,37 @@ class Machine:
         with self.nested(f"waiting for {regex} to appear on screen"):
             retry(screen_matches)
 
-    def wait_for_console_text(self, regex: str) -> None:
+    def wait_for_console_text(self, regex: str, timeout: int | None = None) -> None:
+        """
+        Wait for the provided regex to appear on console.
+        For each reads,
+
+        If timeout is None, timeout is infinite.
+
+        `timeout` is in seconds.
+        """
+        # Buffer the console output, this is needed
+        # to match multiline regexes.
+        console = io.StringIO()
+
+        def console_matches(_: Any) -> bool:
+            nonlocal console
+            try:
+                # This will return as soon as possible and
+                # sleep 1 second.
+                console.write(self.last_lines.get(block=False))
+            except queue.Empty:
+                pass
+            console.seek(0)
+            matches = re.search(regex, console.read())
+            return matches is not None
+
         with self.nested(f"waiting for {regex} to appear on console"):
-            # Buffer the console output, this is needed
-            # to match multiline regexes.
-            console = io.StringIO()
-            while True:
-                try:
-                    console.write(self.last_lines.get())
-                except queue.Empty:
-                    self.sleep(1)
-                    continue
-                console.seek(0)
-                matches = re.search(regex, console.read())
-                if matches is not None:
-                    return
+            if timeout is not None:
+                retry(console_matches, timeout)
+            else:
+                while not console_matches(False):
+                    pass
 
     def send_key(
         self, key: str, delay: Optional[float] = 0.01, log: Optional[bool] = True
diff --git a/nixos/modules/services/mail/exim.nix b/nixos/modules/services/mail/exim.nix
index a9504acee351..1d1258913b67 100644
--- a/nixos/modules/services/mail/exim.nix
+++ b/nixos/modules/services/mail/exim.nix
@@ -116,8 +116,8 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."exim.conf".source ];
       serviceConfig = {
-        ExecStart   = "+${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}";
-        ExecReload  = "+${coreutils}/bin/kill -HUP $MAINPID";
+        ExecStart   = "!${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}";
+        ExecReload  = "!${coreutils}/bin/kill -HUP $MAINPID";
         User        = cfg.user;
       };
       preStart = ''
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 9c18a2eed1c6..8958d375b2b5 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1281,6 +1281,7 @@ in {
       "d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/registry 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/terraform_state 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/ci_secure_files 0750 ${cfg.user} ${cfg.group} -"
       "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
       "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
       "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index c4427149d9c9..68eb0469d8ea 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -260,10 +260,10 @@ in
     };
 
     system.extraDependencies = mkOption {
-      type = types.listOf types.package;
+      type = types.listOf types.pathInStore;
       default = [];
       description = lib.mdDoc ''
-        A list of packages that should be included in the system
+        A list of paths that should be included in the system
         closure but generally not visible to users.
 
         This option has also been used for build-time checks, but the
diff --git a/nixos/tests/systemd-initrd-vconsole.nix b/nixos/tests/systemd-initrd-vconsole.nix
index b74df410c422..d4c2a57680c1 100644
--- a/nixos/tests/systemd-initrd-vconsole.nix
+++ b/nixos/tests/systemd-initrd-vconsole.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
   name = "systemd-initrd-vconsole";
 
   nodes.machine = { pkgs, ... }: {
-    boot.kernelParams = [ "rd.systemd.unit=rescue.target" ];
+    boot.kernelParams = lib.mkAfter [ "rd.systemd.unit=rescue.target" "loglevel=3" "udev.log_level=3" "systemd.log_level=warning" ];
 
     boot.initrd.systemd = {
       enable = true;
@@ -20,14 +20,23 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
     machine.start()
     machine.wait_for_console_text("Press Enter for maintenance")
     machine.send_console("\n")
-    machine.wait_for_console_text("Logging in with home")
+
+    # Wait for shell to become ready
+    for _ in range(300):
+      machine.send_console("printf '%s to receive commands:\\n' Ready\n")
+      try:
+        machine.wait_for_console_text("Ready to receive commands:", timeout=1)
+        break
+      except Exception:
+        continue
+    else:
+      raise RuntimeError("Rescue shell never became ready")
 
     # Check keymap
-    machine.send_console("(printf '%s to receive text: \\n' Ready && read text && echo \"$text\") </dev/tty1\n")
+    machine.send_console("(printf '%s to receive text:\\n' Ready && read text && echo \"$text\") </dev/tty1\n")
     machine.wait_for_console_text("Ready to receive text:")
     for key in "asdfjkl;\n":
       machine.send_key(key)
     machine.wait_for_console_text("arstneio")
-    machine.send_console("systemctl poweroff\n")
   '';
 })
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 235bb9672722..780686df556d 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -9,25 +9,25 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.10.6" else "8.10.7-11.BETA";
+  version = if channel == "stable" then "8.10.7" else "8.10.7-11.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-wCY94x67z+X8l3wr79+BXuu6/UXJldbVIA67AAD9mj0=";
+        sha256 = "sha256-5KMAzstoPmNgFejp21R8PcdrmUtkX3qxHYX3rV5JqyE=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-iLjuudWmkLMuoZSZZo9pRpx0MZludUrGTpTHCTNk4Vo=";
+        sha256 = "sha256-Tmof+ma1SJMQRSV1T5flLeXfe6W1a2U2mYzi+MrxvJM=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-FVj5x1RVBxPsgWhG6R4ykarZdLdJcj6gO5mQy3hHB4M=";
+        sha256 = "sha256-jtqgJJy1ZhyaEUEafT1ywD529aKGDqc0J3mgYSGVTWU=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-ilQP1OF4gydzlLZq3aZzqNbzvacRbruzWS7pVt6DP9g=";
+        sha256 = "sha256-qLqK6CZcqDfIGX0FzEnAZP3Rkxw8CNtT6sFy8u0IqwM=";
       };
     };
     beta = {
diff --git a/pkgs/applications/misc/eos-installer/default.nix b/pkgs/applications/misc/eos-installer/default.nix
index 5200907ff0db..67e6b2bc97ad 100644
--- a/pkgs/applications/misc/eos-installer/default.nix
+++ b/pkgs/applications/misc/eos-installer/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
     description = "Installer UI which writes images to disk";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ qyliss ];
+    mainProgram = "gnome-image-installer";
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/streamdeck-ui/default.nix b/pkgs/applications/misc/streamdeck-ui/default.nix
index 21ac1939f4e9..1c1aa80de79c 100644
--- a/pkgs/applications/misc/streamdeck-ui/default.nix
+++ b/pkgs/applications/misc/streamdeck-ui/default.nix
@@ -7,6 +7,7 @@
 , writeText
 , makeDesktopItem
 , xvfb-run
+, qt5
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -77,6 +78,8 @@ python3Packages.buildPythonApplication rec {
     pyside2
     streamdeck
     xlib
+  ] ++ lib.optionals stdenv.isLinux [
+    qt5.qtwayland
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/applications/networking/browsers/mullvad-browser/default.nix b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
index 753005a118f9..d166f044f7be 100644
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@@ -78,12 +78,12 @@ let
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "12.0.7";
+  version = "12.5";
 
   sources = {
     x86_64-linux = fetchurl {
       url = "https://cdn.mullvad.net/browser/${version}/mullvad-browser-linux64-${version}_ALL.tar.xz";
-      hash = "sha256-8TcC39A9VFyhFb+pfefzvwJqXq1yF7C2YDcbCyEa0yo=";
+      hash = "sha256-RTDFi+vMkzRtDFgv9sP1bfIeWzzXR307aoMhNiT6vRs=";
     };
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 94fe22ea417d..492482eca0d9 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,9 +2,9 @@
 let
   versions = if stdenv.isLinux then {
     stable = "0.0.27";
-    ptb = "0.0.42";
+    ptb = "0.0.43";
     canary = "0.0.161";
-    development = "0.0.216";
+    development = "0.0.217";
   } else {
     stable = "0.0.273";
     ptb = "0.0.59";
@@ -20,7 +20,7 @@ let
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        sha256 = "ZAMyAqyFEBJeTUqQzr5wK+BOFGURqhoHL8w2hJvL0vI=";
+        sha256 = "tG+QR62JcBYrvJS6KU6oAWSfQFdl68AMcU8E9Zahy2A=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
@@ -28,7 +28,7 @@ let
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        sha256 = "sha256-lQnIQC7Wek7OYDzZvLIJfb8I4oATD8pSB+mjQMPyqYQ=";
+        sha256 = "sha256-fzNFKrYo5qckrWZAkkiK337czCt6nOM1O8FeG18Q8Y0=";
       };
     };
     x86_64-darwin = {
diff --git a/pkgs/applications/networking/mailreaders/electron-mail/default.nix b/pkgs/applications/networking/mailreaders/electron-mail/default.nix
index 20f3597b1517..a7b51585e3a0 100644
--- a/pkgs/applications/networking/mailreaders/electron-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/electron-mail/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "electron-mail";
-  version = "5.1.6";
+  version = "5.1.8";
   name = "ElectronMail-${version}";
 
   src = fetchurl {
     url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-    sha256 = "sha256-lsXVsx7U43czWFWxAgwTUYTnUXSL4KPFnXLzUklieAo=";
+    sha256 = "sha256-btqlxFrQUyb728i99IE65A9jwEFNvJ5b6zji0kwwATU=";
   };
 
   appimageContents = appimageTools.extract { inherit name src; };
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 48a59f0c2cfe..488bf1218053 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "16.0.5",
-  "repo_hash": "sha256-hUEPJMdmR+p7nHWjdS+9SXcgm0LciPC9at+GP9UcUvI=",
-  "yarn_hash": "0yy04jnfvn5dgciqd105xiwg7chjwp3w6iqbjpylak9h82ci6wlh",
+  "version": "16.1.0",
+  "repo_hash": "sha256-sRel6okv2NYV4As3+AudqVvJ1/eLQGJGFvs+BA14wis=",
+  "yarn_hash": "1cqyf06810ls94nkys0l4p86ni902q32aqjp66m7j1x6ldh248al",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v16.0.5-ee",
+  "rev": "v16.1.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "16.0.5",
-    "GITLAB_PAGES_VERSION": "16.0.5",
-    "GITLAB_SHELL_VERSION": "14.20.0",
-    "GITLAB_WORKHORSE_VERSION": "16.0.5"
+    "GITALY_SERVER_VERSION": "16.1.0",
+    "GITLAB_PAGES_VERSION": "16.1.0",
+    "GITLAB_SHELL_VERSION": "14.23.0",
+    "GITLAB_WORKHORSE_VERSION": "16.1.0"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 2d44ed033000..38e8a72526f9 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "16.0.5";
+  version = "16.1.0";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -24,10 +24,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      sha256 = "sha256-YhqKMFDjjL2I82m51GdKNVO8vdJPppDKZDBQGskpyA4=";
+      sha256 = "sha256-+Fnj9fgQQtyGMWOL5NkNON/N9p6POjAtpF2O06iKh90=";
     };
 
-    vendorSha256 = "sha256-KBhTI70eReZGSd7RxwGXcUGa0wDo7q5tU9fUhrLeFO0=";
+    vendorSha256 = "sha256-6oOFQGPwiMRQrESXsQsGzvWz9bCb0VTYIyyG/C2b3nA=";
 
     ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];
 
diff --git a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
index 64d8650a0b16..8d96d160f756 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "16.0.5";
+  version = "16.1.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    sha256 = "sha256-bZwq8nG3QmPCgfuBUQW6LQdi7F1+n2JfzfU3oP+QCJw=";
+    sha256 = "sha256-vAprB+pDwpr2Wq4aM0wnHlNzUvc1ajasdORwT0LDTTY=";
   };
 
-  vendorHash = "sha256-s3HHoz9URACuVVhePQQFviTqlQU7vCLOjTJPBlus1Vo=";
+  vendorHash = "sha256-SN4r9hcTTQUr3miv2Cm7iBryyh7yG1xx9lCvq3vQwc0=";
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 5dcb6e88a15c..2d8e52ee66b1 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.20.0";
+  version = "14.23.0";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-5rjrBt0AihSHMYOD6JbXGvvFaUbtYnMHX2Z4K+Svno0=";
+    sha256 = "sha256-nQJq9aPC5YtTbyiwtzKwDG95PnBr6XdNpSIJkfgvnzU=";
   };
 
   buildInputs = [ ruby libkrb5 ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorSha256 = "sha256-kKbTbOCuAGIbnFXTOZyoVRM5PIackbmND6PrryVvLTM=";
+  vendorSha256 = "sha256-JEWgOuWvtuaipF8fFTsFbB+sYfaHEYUl9Z8Q1XAuJuE=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 99fbe221d5d3..1f64e343056b 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "16.0.5";
+  version = "16.1.0";
 
   src = fetchFromGitLab {
     owner = data.owner;
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   sourceRoot = "source/workhorse";
 
-  vendorSha256 = "sha256-B9YZkqAMYvTnnWx2tYEF0VZ/+9LZaWS5euQ9ZX2m49E=";
+  vendorSha256 = "sha256-lKl/V2fti0eqrEoeJNNwvJbZO7z7v+5HlES+dyxxcP4=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
index e7d704237aed..1a468724e354 100644
--- a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@@ -53,7 +53,7 @@ index d096174fca3a..02d0f689c523 100644
  # Important: keep the satellites.path setting until GitLab 9.0 at
  # least. This setting is fed to 'rm -rf' in
 diff --git a/config/puma.rb.example b/config/puma.rb.example
-index 9fc354a8fe8..2352ca9b58c 100644
+index 07a6f6a25015..14a718a43202 100644
 --- a/config/puma.rb.example
 +++ b/config/puma.rb.example
 @@ -5,12 +5,8 @@
@@ -71,7 +71,7 @@ index 9fc354a8fe8..2352ca9b58c 100644
  
  # Configure "min" to be the minimum number of threads to use to answer
  # requests and "max" the maximum.
-@@ -31,12 +27,12 @@ queue_requests false
+@@ -31,11 +27,11 @@ queue_requests false
  
  # Bind the server to "url". "tcp://", "unix://" and "ssl://" are the only
  # accepted protocols.
@@ -81,14 +81,12 @@ index 9fc354a8fe8..2352ca9b58c 100644
  workers 3
  
 -require_relative "/home/git/gitlab/lib/gitlab/cluster/lifecycle_events"
--require_relative "/home/git/gitlab/lib/gitlab/cluster/puma_worker_killer_initializer"
 +require_relative ENV['GITLAB_PATH'] + "lib/gitlab/cluster/lifecycle_events"
-+require_relative ENV['GITLAB_PATH'] + "lib/gitlab/cluster/puma_worker_killer_initializer"
  
  on_restart do
    # Signal application hooks that we're about to restart
-@@ -80,7 +76,7 @@ if defined?(nakayoshi_fork)
- end
+@@ -74,7 +70,7 @@ worker_timeout 60
+ wait_for_less_busy_worker ENV.fetch('PUMA_WAIT_FOR_LESS_BUSY_WORKER', 0.001).to_f
  
  # Use json formatter
 -require_relative "/home/git/gitlab/lib/gitlab/puma_logging/json_formatter"
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index 10c4d6dc8d86..ef5a22d20140 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -25,7 +25,7 @@ gem 'responders', '~> 3.0'
 
 gem 'sprockets', '~> 3.7.0'
 
-gem 'view_component', '~> 2.82.0'
+gem 'view_component', '~> 3.2.0'
 
 # Supported DBs
 gem 'pg', '~> 1.5.3'
@@ -46,9 +46,9 @@ gem 'devise', '~> 4.8.1'
 gem 'devise-pbkdf2-encryptable', '~> 0.0.0', path: 'vendor/gems/devise-pbkdf2-encryptable'
 gem 'bcrypt', '~> 3.1', '>= 3.1.14'
 gem 'doorkeeper', '~> 5.6', '>= 5.6.6'
-gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.6'
+gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.7'
 gem 'rexml', '~> 3.2.5'
-gem 'ruby-saml', '~> 1.13.0'
+gem 'ruby-saml', '~> 1.15.0'
 gem 'omniauth', '~> 2.1.0'
 gem 'omniauth-auth0', '~> 3.1'
 gem 'omniauth-azure-activedirectory-v2', '~> 2.0'
@@ -61,6 +61,7 @@ gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See ven
 gem 'omniauth-google-oauth2', '~> 1.1'
 gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 2.1.0'
+gem 'omniauth-shibboleth-redux', '~> 2.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md
 gem 'omniauth_openid_connect', '~> 0.6.1'
@@ -105,13 +106,13 @@ gem 'gpgme', '~> 2.0.22'
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
 gem 'gitlab_omniauth-ldap', '~> 2.2.0', require: 'omniauth-ldap'
-gem 'net-ldap', '~> 0.17.1'
+gem 'net-ldap', '~> 0.18.0'
 
 # API
-gem 'grape', '~> 1.5.2'
+gem 'grape', '~> 1.7.0'
 gem 'grape-entity', '~> 0.10.0'
 gem 'rack-cors', '~> 1.1.1', require: 'rack/cors'
-gem 'grape-swagger', '~>1.5.0', group: [:development, :test]
+gem 'grape-swagger', '~> 1.6.1', group: [:development, :test]
 gem 'grape-swagger-entity', '~> 0.5.1', group: [:development, :test]
 
 # GraphQL API
@@ -172,9 +173,9 @@ gem 'seed-fu', '~> 2.3.7'
 gem 'elasticsearch-model', '~> 7.2'
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation'
 gem 'elasticsearch-api',   '7.13.3'
-gem 'aws-sdk-core', '~> 3.172.0'
+gem 'aws-sdk-core', '~> 3.175.0'
 gem 'aws-sdk-cloudformation', '~> 1'
-gem 'aws-sdk-s3', '~> 1.122.0'
+gem 'aws-sdk-s3', '~> 1.126.0'
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
 gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections
 
@@ -182,7 +183,7 @@ gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive
 gem 'html-pipeline', '~> 2.14.3'
 gem 'deckar01-task_list', '2.3.2'
 gem 'gitlab-markup', '~> 1.9.0', require: 'github/markup'
-gem 'commonmarker', '~> 0.23.6'
+gem 'commonmarker', '~> 0.23.9'
 gem 'kramdown', '~> 2.3.1'
 gem 'RedCloth', '~> 4.3.2'
 gem 'rdoc', '~> 6.3.2'
@@ -193,9 +194,9 @@ gem 'asciidoctor', '~> 2.0.18'
 gem 'asciidoctor-include-ext', '~> 0.4.0', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.16'
 gem 'asciidoctor-kroki', '~> 0.8.0', require: false
-gem 'rouge', '~> 4.1.0'
+gem 'rouge', '~> 4.1.2'
 gem 'truncato', '~> 0.7.12'
-gem 'nokogiri', '~> 1.14.3'
+gem 'nokogiri', '~> 1.15', '>= 1.15.2'
 
 # Calendar rendering
 gem 'icalendar'
@@ -210,8 +211,7 @@ gem 'rack', '~> 2.2.7'
 gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base'
 
 group :puma do
-  gem 'puma', '~> 5.6.5', require: false
-  gem 'puma_worker_killer', '~> 0.3.1', require: false
+  gem 'puma', '~> 6.3', require: false
   gem 'sd_notify', '~> 0.1.0', require: false
 end
 
@@ -288,10 +288,10 @@ gem 'circuitbox', '2.0.0'
 
 # Sanitize user input
 gem 'sanitize', '~> 6.0'
-gem 'babosa', '~> 1.0.4'
+gem 'babosa', '~> 2.0'
 
 # Sanitizes SVG input
-gem 'loofah', '~> 2.21.0'
+gem 'loofah', '~> 2.21.3'
 
 # Working with license
 # Detects the open source license the repository includes
@@ -323,7 +323,7 @@ gem 'gon', '~> 6.4.0'
 gem 'request_store', '~> 1.5.1'
 gem 'base32', '~> 0.3.0'
 
-gem 'gitlab-license', '~> 2.2.1'
+gem 'gitlab-license', '~> 2.3'
 
 # Protect against bruteforcing
 gem 'rack-attack', '~> 6.6.1'
@@ -336,11 +336,11 @@ gem 'sentry-sidekiq', '~> 5.8.0'
 
 # PostgreSQL query parsing
 #
-gem 'pg_query', '~> 2.2', '>= 2.2.1'
+gem 'pg_query', '~> 4.2.1'
 
 gem 'premailer-rails', '~> 1.10.3'
 
-gem 'gitlab-labkit', '~> 0.32.0'
+gem 'gitlab-labkit', '~> 0.33.0'
 gem 'thrift', '>= 0.16.0'
 
 # I18n
@@ -363,12 +363,12 @@ gem 'snowplow-tracker', '~> 0.8.0'
 
 # Metrics
 gem 'webrick', '~> 1.8.1', require: false
-gem 'prometheus-client-mmap', '~> 0.23', require: 'prometheus/client'
+gem 'prometheus-client-mmap', '~> 0.25', require: 'prometheus/client'
 
 gem 'warning', '~> 1.3.0'
 
 group :development do
-  gem 'lefthook', '~> 1.3.13', require: false
+  gem 'lefthook', '~> 1.4.2', require: false
   gem 'rubocop'
   gem 'solargraph', '~> 0.47.2', require: false
 
@@ -376,7 +376,7 @@ group :development do
   gem 'lookbook', '~> 2.0', '>= 2.0.1'
 
   # Better errors handler
-  gem 'better_errors', '~> 2.10.0'
+  gem 'better_errors', '~> 2.10.1'
 
   gem 'sprite-factory', '~> 1.7'
 
@@ -386,6 +386,7 @@ end
 group :development, :test do
   gem 'deprecation_toolkit', '~> 1.5.1', require: false
   gem 'bullet', '~> 7.0.2'
+  gem 'parser', '~> 3.2', '>= 3.2.2.3'
   gem 'pry-byebug'
   gem 'pry-rails', '~> 0.3.9'
   gem 'pry-shell', '~> 0.6.1'
@@ -453,7 +454,7 @@ group :test do
   gem 'rspec-benchmark', '~> 0.6.0'
   gem 'rspec-parameterized', '~> 1.0', require: false
 
-  gem 'capybara', '~> 3.39'
+  gem 'capybara', '~> 3.39', '>= 3.39.1'
   gem 'capybara-screenshot', '~> 1.0.26'
   # 4.9.1 drops Ruby 2.7 support. We can upgrade further after we drop Ruby 2.7 support.
   gem 'selenium-webdriver', '= 4.9.0'
@@ -472,6 +473,8 @@ group :test do
 
   # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
   gem 'derailed_benchmarks', require: false
+
+  gem 'gitlab_quality-test_tooling', '~> 0.8.1', require: false
 end
 
 gem 'octokit', '~> 4.15'
@@ -506,14 +509,14 @@ gem 'ssh_data', '~> 1.3'
 gem 'spamcheck', '~> 1.3.0'
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 15.9.0-rc3'
+gem 'gitaly', '~> 16.1.0-rc2'
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.1.0'
 
 gem 'grpc', '~> 1.42.0'
 
-gem 'google-protobuf', '~> 3.22', '>= 3.22.3'
+gem 'google-protobuf', '~> 3.23', '>= 3.23.3'
 
 gem 'toml-rb', '~> 2.2.0'
 
@@ -587,7 +590,7 @@ gem 'cvss-suite', '~> 3.0.1', require: 'cvss_suite'
 gem 'arr-pm', '~> 0.0.12'
 
 # Remote Development
-gem 'devfile', '~> 0.0.17.pre.alpha1'
+gem 'devfile', '~> 0.0.19.pre.alpha1'
 
 # Apple plist parsing
 gem 'CFPropertyList', '~> 3.0.0'
@@ -599,5 +602,8 @@ gem 'telesignenterprise', '~> 2.2'
 # BufferedIO patch
 # Updating this version will require updating scripts/allowed_warnings.txt
 gem 'net-protocol', '~> 0.1.3'
+# Lock this until we make DNS rebinding work with the updated net-http:
+# https://gitlab.com/gitlab-org/gitlab/-/issues/413528
+gem 'net-http', '= 0.1.1'
 
 gem 'duo_api', '~> 1.3'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 199c806a854c..3aaf6a459309 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -203,7 +203,7 @@ GEM
     aws-sdk-cloudformation (1.41.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.172.0)
+    aws-sdk-core (3.175.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
@@ -211,8 +211,8 @@ GEM
     aws-sdk-kms (1.64.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.122.0)
-      aws-sdk-core (~> 3, >= 3.165.0)
+    aws-sdk-s3 (1.126.0)
+      aws-sdk-core (~> 3, >= 3.174.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.4)
     aws-sigv4 (1.5.1)
@@ -236,7 +236,7 @@ GEM
       faraday_middleware (~> 1.0, >= 1.0.0.rc1)
       net-http-persistent (~> 4.0)
       nokogiri (~> 1, >= 1.10.8)
-    babosa (1.0.4)
+    babosa (2.0.0)
     backport (1.2.0)
     base32 (0.3.2)
     batch-loader (2.0.1)
@@ -248,7 +248,7 @@ GEM
       memory_profiler (~> 1)
     benchmark-perf (0.6.0)
     benchmark-trend (0.4.0)
-    better_errors (2.10.0)
+    better_errors (2.10.1)
       erubi (>= 1.0.0)
       rack (>= 0.9.0)
       rouge (>= 1.0.0)
@@ -266,7 +266,7 @@ GEM
       bundler (>= 1.2.0, < 3)
       thor (>= 0.18, < 2)
     byebug (11.1.3)
-    capybara (3.39.0)
+    capybara (3.39.1)
       addressable
       matrix
       mini_mime (>= 0.1.3)
@@ -307,7 +307,7 @@ GEM
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
     colored2 (3.1.2)
-    commonmarker (0.23.6)
+    commonmarker (0.23.9)
     concurrent-ruby (1.2.2)
     connection_pool (2.3.0)
     cork (0.3.0)
@@ -367,7 +367,7 @@ GEM
       thor (>= 0.19, < 2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.0.17.pre.alpha1)
+    devfile (0.0.19.pre.alpha1)
     device_detector (1.0.0)
     devise (4.8.1)
       bcrypt (~> 3.0)
@@ -393,30 +393,24 @@ GEM
       unf (>= 0.0.5, < 1.0.0)
     doorkeeper (5.6.6)
       railties (>= 5)
-    doorkeeper-openid_connect (1.8.6)
+    doorkeeper-openid_connect (1.8.7)
       doorkeeper (>= 5.5, < 5.7)
       jwt (>= 2.5)
     dotenv (2.7.6)
-    dry-configurable (0.12.0)
+    dry-core (1.0.0)
       concurrent-ruby (~> 1.0)
-      dry-core (~> 0.5, >= 0.5.0)
-    dry-container (0.7.2)
+      zeitwerk (~> 2.6)
+    dry-inflector (1.0.0)
+    dry-logic (1.5.0)
       concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.1, >= 0.1.3)
-    dry-core (0.5.0)
+      dry-core (~> 1.0, < 2)
+      zeitwerk (~> 2.6)
+    dry-types (1.7.1)
       concurrent-ruby (~> 1.0)
-    dry-equalizer (0.3.0)
-    dry-inflector (0.2.0)
-    dry-logic (1.1.0)
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 0.5, >= 0.5)
-    dry-types (1.4.0)
-      concurrent-ruby (~> 1.0)
-      dry-container (~> 0.3)
-      dry-core (~> 0.4, >= 0.4.4)
-      dry-equalizer (~> 0.3)
-      dry-inflector (~> 0.1, >= 0.1.2)
-      dry-logic (~> 1.0, >= 1.0.2)
+      dry-core (~> 1.0)
+      dry-inflector (~> 1.0)
+      dry-logic (~> 1.4)
+      zeitwerk (~> 2.6)
     dumb_delegator (1.0.0)
     duo_api (1.3.0)
     e2mmap (0.1.0)
@@ -581,7 +575,7 @@ GEM
       rails (>= 3.2.0)
     git (1.11.0)
       rchardet (~> 1.8)
-    gitaly (15.9.0.pre.rc3)
+    gitaly (16.1.0.pre.rc2)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
@@ -602,15 +596,15 @@ GEM
       fog-json (~> 1.2.0)
       mime-types
       ms_rest_azure (~> 0.12.0)
-    gitlab-labkit (0.32.0)
+    gitlab-labkit (0.33.0)
       actionpack (>= 5.0.0, < 8.0.0)
       activesupport (>= 5.0.0, < 8.0.0)
       grpc (>= 1.37)
       jaeger-client (~> 1.1.0)
       opentracing (~> 0.4)
-      pg_query (~> 2.1)
+      pg_query (~> 4.2.1)
       redis (> 3.0.0, < 6.0.0)
-    gitlab-license (2.2.2)
+    gitlab-license (2.3.0)
     gitlab-mail_room (0.0.23)
       jwt (>= 2.0)
       net-imap (>= 0.2.1)
@@ -630,6 +624,15 @@ GEM
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
+    gitlab_quality-test_tooling (0.8.1)
+      activesupport (>= 6.1, < 7.1)
+      gitlab (~> 4.19)
+      http (~> 5.0)
+      nokogiri (~> 1.10)
+      parallel (>= 1, < 2)
+      rainbow (>= 3, < 4)
+      table_print (= 1.5.7)
+      zeitwerk (>= 2, < 3)
     globalid (1.1.0)
       activesupport (>= 5.0)
     gon (6.4.0)
@@ -691,7 +694,7 @@ GEM
       google-cloud-core (~> 1.6)
       googleauth (>= 0.16.2, < 2.a)
       mini_mime (~> 1.0)
-    google-protobuf (3.22.3)
+    google-protobuf (3.23.3)
     googleapis-common-protos (1.4.0)
       google-protobuf (~> 3.14)
       googleapis-common-protos-types (~> 1.2)
@@ -707,7 +710,7 @@ GEM
       signet (>= 0.16, < 2.a)
     gpgme (2.0.22)
       mini_portile2 (~> 2.7)
-    grape (1.5.2)
+    grape (1.7.0)
       activesupport
       builder
       dry-types (>= 1.1)
@@ -722,7 +725,7 @@ GEM
       grape (~> 1.3)
       rake (> 12)
       ruby2_keywords (~> 0.0.2)
-    grape-swagger (1.5.0)
+    grape-swagger (1.6.1)
       grape (~> 1.3)
     grape-swagger-entity (0.5.1)
       grape-entity (>= 0.6.0)
@@ -878,7 +881,7 @@ GEM
       rest-client (~> 2.0)
     launchy (2.5.0)
       addressable (~> 2.7)
-    lefthook (1.3.13)
+    lefthook (1.4.2)
     letter_opener (1.7.0)
       launchy (~> 2.2)
     letter_opener_web (2.0.0)
@@ -913,9 +916,9 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.21.0)
+    loofah (2.21.3)
       crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
+      nokogiri (>= 1.12.0)
     lookbook (2.0.1)
       activemodel
       css_parser
@@ -949,7 +952,7 @@ GEM
     mini_histogram (0.3.1)
     mini_magick (4.10.1)
     mini_mime (1.1.2)
-    mini_portile2 (2.8.1)
+    mini_portile2 (2.8.2)
     minitest (5.11.3)
     mixlib-cli (2.1.8)
     mixlib-config (3.0.9)
@@ -971,20 +974,23 @@ GEM
     multi_xml (0.6.0)
     multipart-post (2.2.3)
     murmurhash3 (0.1.7)
-    mustermann (1.1.1)
+    mustermann (3.0.0)
       ruby2_keywords (~> 0.0.1)
-    mustermann-grape (1.0.1)
+    mustermann-grape (1.0.2)
       mustermann (>= 1.0.0)
     nap (1.1.0)
     neighbor (0.2.3)
       activerecord (>= 5.2)
     nenv (0.3.0)
+    net-http (0.1.1)
+      net-protocol
+      uri
     net-http-persistent (4.0.1)
       connection_pool (~> 2.2)
     net-imap (0.3.4)
       date
       net-protocol
-    net-ldap (0.17.1)
+    net-ldap (0.18.0)
     net-ntp (2.1.3)
     net-pop (0.1.2)
       net-protocol
@@ -998,8 +1004,8 @@ GEM
     netrc (0.11.0)
     nio4r (2.5.8)
     no_proxy_fix (0.1.2)
-    nokogiri (1.14.3)
-      mini_portile2 (~> 2.8.0)
+    nokogiri (1.15.2)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     notiffany (0.1.3)
       nenv (~> 0.1)
@@ -1070,6 +1076,8 @@ GEM
     omniauth-saml (2.1.0)
       omniauth (~> 2.0)
       ruby-saml (~> 1.12)
+    omniauth-shibboleth-redux (2.0.0)
+      omniauth (>= 2.0.0)
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
@@ -1120,16 +1128,17 @@ GEM
       expgen (~> 0.1)
       rainbow (~> 3.1.1)
     parallel (1.22.1)
-    parser (3.2.0.0)
+    parser (3.2.2.3)
       ast (~> 2.4.1)
+      racc
     parslet (1.8.2)
     pastel (0.8.0)
       tty-color (~> 0.5)
     peek (1.1.0)
       railties (>= 4.0.0)
     pg (1.5.3)
-    pg_query (2.2.1)
-      google-protobuf (>= 3.19.2)
+    pg_query (4.2.1)
+      google-protobuf (>= 3.22.3)
     plist (3.6.0)
     png_quantizator (0.2.1)
     po_to_json (1.0.1)
@@ -1145,7 +1154,7 @@ GEM
       coderay
       parser
       unparser
-    prometheus-client-mmap (0.23.1)
+    prometheus-client-mmap (0.25.0)
       rb_sys (~> 0.9)
     pry (0.14.2)
       coderay (~> 1.1)
@@ -1160,11 +1169,8 @@ GEM
       tty-markdown
       tty-prompt
     public_suffix (5.0.0)
-    puma (5.6.5)
+    puma (6.3.0)
       nio4r (~> 2.0)
-    puma_worker_killer (0.3.1)
-      get_process_mem (~> 0.2)
-      puma (>= 2.7)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
     racc (1.6.2)
@@ -1226,7 +1232,7 @@ GEM
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rb_sys (0.9.75)
+    rb_sys (0.9.78)
     rbtrace (0.4.14)
       ffi (>= 1.0.6)
       msgpack (>= 0.4.3)
@@ -1273,7 +1279,7 @@ GEM
     rexml (3.2.5)
     rinku (2.0.0)
     rotp (6.2.0)
-    rouge (4.1.0)
+    rouge (4.1.2)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -1358,8 +1364,8 @@ GEM
     ruby-openai (3.7.0)
       httparty (>= 0.18.1)
     ruby-progressbar (1.11.0)
-    ruby-saml (1.13.0)
-      nokogiri (>= 1.10.5)
+    ruby-saml (1.15.0)
+      nokogiri (>= 1.13.10)
       rexml
     ruby-statistics (3.0.0)
     ruby2_keywords (0.0.5)
@@ -1503,6 +1509,7 @@ GEM
     sys-filesystem (1.4.3)
       ffi (~> 1.1)
     sysexits (1.2.0)
+    table_print (1.5.7)
     tanuki_emoji (0.6.0)
     telesign (2.2.4)
       net-http-persistent (>= 3.0.0, < 5.0)
@@ -1585,6 +1592,7 @@ GEM
     unparser (0.6.7)
       diff-lcs (~> 1.3)
       parser (>= 3.2.0)
+    uri (0.12.1)
     uri_template (0.7.0)
     valid_email (0.1.3)
       activemodel
@@ -1600,7 +1608,7 @@ GEM
       activesupport (>= 3.0)
     version_gem (1.1.0)
     version_sorter (2.3.0)
-    view_component (2.82.0)
+    view_component (3.2.0)
       activesupport (>= 5.2.0, < 8.0)
       concurrent-ruby (~> 1.0)
       method_source (~> 1.0)
@@ -1672,28 +1680,28 @@ DEPENDENCIES
   autoprefixer-rails (= 10.2.5.1)
   awesome_print
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.172.0)
-  aws-sdk-s3 (~> 1.122.0)
+  aws-sdk-core (~> 3.175.0)
+  aws-sdk-s3 (~> 1.126.0)
   axe-core-rspec
-  babosa (~> 1.0.4)
+  babosa (~> 2.0)
   base32 (~> 0.3.0)
   batch-loader (~> 2.0.1)
   bcrypt (~> 3.1, >= 3.1.14)
   benchmark-ips (~> 2.11.0)
   benchmark-memory (~> 0.1)
-  better_errors (~> 2.10.0)
+  better_errors (~> 2.10.1)
   bootsnap (~> 1.16.0)
   browser (~> 5.3.1)
   bullet (~> 7.0.2)
   bundler-audit (~> 0.7.0.1)
   bundler-checksum (~> 0.1.0)!
-  capybara (~> 3.39)
+  capybara (~> 3.39, >= 3.39.1)
   capybara-screenshot (~> 1.0.26)
   carrierwave (~> 1.3)
   charlock_holmes (~> 0.7.7)
   circuitbox (= 2.0.0)
   cloud_profiler_agent (~> 0.0.0)!
-  commonmarker (~> 0.23.6)
+  commonmarker (~> 0.23.9)
   concurrent-ruby (~> 1.1)
   connection_pool (~> 2.0)
   countries (~> 4.0.0)
@@ -1705,7 +1713,7 @@ DEPENDENCIES
   declarative_policy (~> 1.1.0)
   deprecation_toolkit (~> 1.5.1)
   derailed_benchmarks
-  devfile (~> 0.0.17.pre.alpha1)
+  devfile (~> 0.0.19.pre.alpha1)
   device_detector
   devise (~> 4.8.1)
   devise-pbkdf2-encryptable (~> 0.0.0)!
@@ -1714,7 +1722,7 @@ DEPENDENCIES
   diffy (~> 3.4)
   discordrb-webhooks (~> 3.4)
   doorkeeper (~> 5.6, >= 5.6.6)
-  doorkeeper-openid_connect (~> 1.8, >= 1.8.6)
+  doorkeeper-openid_connect (~> 1.8, >= 1.8.7)
   duo_api (~> 1.3)
   ed25519 (~> 1.3.0)
   elasticsearch-api (= 7.13.3)
@@ -1741,13 +1749,13 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 15.9.0.pre.rc3)
+  gitaly (~> 16.1.0.pre.rc2)
   gitlab-chronic (~> 0.10.5)
   gitlab-dangerfiles (~> 3.10.0)
   gitlab-experiment (~> 0.7.1)
   gitlab-fog-azure-rm (~> 1.7.0)
-  gitlab-labkit (~> 0.32.0)
-  gitlab-license (~> 2.2.1)
+  gitlab-labkit (~> 0.33.0)
+  gitlab-license (~> 2.3)
   gitlab-mail_room (~> 0.0.23)
   gitlab-markup (~> 1.9.0)
   gitlab-net-dns (~> 0.9.2)
@@ -1755,6 +1763,7 @@ DEPENDENCIES
   gitlab-styles (~> 10.0.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.2.0)
+  gitlab_quality-test_tooling (~> 0.8.1)
   gon (~> 6.4.0)
   google-apis-androidpublisher_v3 (~> 0.34.0)
   google-apis-cloudbilling_v1 (~> 0.21.0)
@@ -1767,12 +1776,12 @@ DEPENDENCIES
   google-apis-serviceusage_v1 (~> 0.28.0)
   google-apis-sqladmin_v1beta4 (~> 0.41.0)
   google-cloud-storage (~> 1.44.0)
-  google-protobuf (~> 3.22, >= 3.22.3)
+  google-protobuf (~> 3.23, >= 3.23.3)
   gpgme (~> 2.0.22)
-  grape (~> 1.5.2)
+  grape (~> 1.7.0)
   grape-entity (~> 0.10.0)
   grape-path-helpers (~> 1.7.1)
-  grape-swagger (~> 1.5.0)
+  grape-swagger (~> 1.6.1)
   grape-swagger-entity (~> 0.5.1)
   grape_logging (~> 1.8)
   graphiql-rails (~> 1.8)
@@ -1806,14 +1815,14 @@ DEPENDENCIES
   knapsack (~> 1.21.1)
   kramdown (~> 2.3.1)
   kubeclient (~> 4.11.0)
-  lefthook (~> 1.3.13)
+  lefthook (~> 1.4.2)
   letter_opener_web (~> 2.0.0)
   license_finder (~> 7.0)
   licensee (~> 9.15)
   listen (~> 3.7)
   lockbox (~> 1.1.1)
   lograge (~> 0.5)
-  loofah (~> 2.21.0)
+  loofah (~> 2.21.3)
   lookbook (~> 2.0, >= 2.0.1)
   lru_redux
   mail (= 2.8.1)
@@ -1825,10 +1834,11 @@ DEPENDENCIES
   minitest (~> 5.11.0)
   multi_json (~> 1.14.1)
   neighbor (~> 0.2.3)
-  net-ldap (~> 0.17.1)
+  net-http (= 0.1.1)
+  net-ldap (~> 0.18.0)
   net-ntp
   net-protocol (~> 0.1.3)
-  nokogiri (~> 1.14.3)
+  nokogiri (~> 1.15, >= 1.15.2)
   oauth2 (~> 2.0)
   octokit (~> 4.15)
   ohai (~> 17.9)
@@ -1848,6 +1858,7 @@ DEPENDENCIES
   omniauth-oauth2-generic (~> 0.2.2)
   omniauth-salesforce (~> 1.0.5)!
   omniauth-saml (~> 2.1.0)
+  omniauth-shibboleth-redux (~> 2.0)
   omniauth-twitter (~> 1.4)
   omniauth_crowd (~> 2.4.0)!
   omniauth_openid_connect (~> 0.6.1)
@@ -1856,18 +1867,18 @@ DEPENDENCIES
   org-ruby (~> 0.9.12)
   pact (~> 1.63)
   parallel (~> 1.19)
+  parser (~> 3.2, >= 3.2.2.3)
   parslet (~> 1.8)
   peek (~> 1.1)
   pg (~> 1.5.3)
-  pg_query (~> 2.2, >= 2.2.1)
+  pg_query (~> 4.2.1)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
-  prometheus-client-mmap (~> 0.23)
+  prometheus-client-mmap (~> 0.25)
   pry-byebug
   pry-rails (~> 0.3.9)
   pry-shell (~> 0.6.1)
-  puma (~> 5.6.5)
-  puma_worker_killer (~> 0.3.1)
+  puma (~> 6.3)
   rack (~> 2.2.7)
   rack-attack (~> 6.6.1)
   rack-cors (~> 1.1.1)
@@ -1889,7 +1900,7 @@ DEPENDENCIES
   responders (~> 3.0)
   retriable (~> 3.1.2)
   rexml (~> 3.2.5)
-  rouge (~> 4.1.0)
+  rouge (~> 4.1.2)
   rqrcode-rails3 (~> 0.1.7)
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized (~> 1.0)
@@ -1902,7 +1913,7 @@ DEPENDENCIES
   ruby-magic (~> 0.6)
   ruby-openai (~> 3.7)
   ruby-progressbar (~> 1.10)
-  ruby-saml (~> 1.13.0)
+  ruby-saml (~> 1.15.0)
   ruby_parser (~> 3.20)
   rubyzip (~> 2.3.2)
   rugged (~> 1.5)
@@ -1952,7 +1963,7 @@ DEPENDENCIES
   valid_email (~> 0.1)
   validates_hostname (~> 1.0.11)
   version_sorter (~> 2.3)
-  view_component (~> 2.82.0)
+  view_component (~> 3.2.0)
   vmstat (~> 2.3.0)
   warning (~> 1.3.0)
   webauthn (~> 3.0)
@@ -1962,4 +1973,4 @@ DEPENDENCIES
   yajl-ruby (~> 1.4.3)
 
 BUNDLED WITH
-   2.4.13
+   2.4.14
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index ac66421c7094..9c71ff591aad 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -401,10 +401,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06scfn1qjfqvgr05ddrcbihlnfi7bffk8r0m5z536w4mm1s3gh6x";
+      sha256 = "1fbbzcszpdjy2yzxfvl5fzgn0jgznkwxvqpb46nxv69gqhv3dpsg";
       type = "gem";
     };
-    version = "3.172.0";
+    version = "3.175.0";
   };
   aws-sdk-kms = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -423,10 +423,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01cryf8kfkmlsxb327szcwcagsp7lss5gmk6zxlgap65lv8bc7rx";
+      sha256 = "17ya49rwjzimqhzsj6vlc4xfvj2sixy04kr4b6ddg3r6y0jrsixi";
       type = "gem";
     };
-    version = "1.122.0";
+    version = "1.126.0";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
@@ -499,10 +499,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16dwqn33kmxkqkv51cwiikdkbrdjfsymlnc0rgbjwilmym8a9phq";
+      sha256 = "19mqrnyizr1ipdp26vhrg0hwb851bwyvrs6xc29dk3ywljw8s8d6";
       type = "gem";
     };
-    version = "1.0.4";
+    version = "2.0.0";
   };
   backport = {
     groups = ["default" "development"];
@@ -611,10 +611,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fhi891k7c4l967bacahq2jhnxswfmbpmbsg1yapczwpm1ynmaz3";
+      sha256 = "0wqazisnn6hn1wsza412xribpw5wzx6b5z5p4mcpfgizr6xg367p";
       type = "gem";
     };
-    version = "2.10.0";
+    version = "2.10.1";
   };
   bindata = {
     groups = ["default"];
@@ -720,10 +720,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06b4nlhirsq8ny17s8zgz7qyvl9v41rixj1xkviiiwxlnjz982d3";
+      sha256 = "1qhg45jxxy5h90frmajrrh5sirmj29sbfhbf7q0qhjymc0w1p0r5";
       type = "gem";
     };
-    version = "3.39.0";
+    version = "3.39.1";
   };
   capybara-screenshot = {
     dependencies = ["capybara" "launchy"];
@@ -911,10 +911,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0f3v6ffikj694h925zvfzgx995q6l1ixnqpph3qpnjdsyjpsmbn8";
+      sha256 = "074162raa8pc92q6833hgqdlfr3z5jgid9avdz5k25cnls2rqwrf";
       type = "gem";
     };
-    version = "0.23.6";
+    version = "0.23.9";
   };
   concurrent-ruby = {
     groups = ["default" "development" "test"];
@@ -1163,10 +1163,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0v34ivsfpc4d291j89jyg2jz970h94jbz01hdm2jwcmq798yfm98";
+      sha256 = "1n4yxjijplg0klcnjdhk7kxmvlb0szchk1ad8flg5hb2j59c8a6r";
       type = "gem";
     };
-    version = "0.0.17.pre.alpha1";
+    version = "0.0.19.pre.alpha1";
   };
   device_detector = {
     groups = ["default"];
@@ -1300,10 +1300,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00z0n4ix21nvqk74hhz5ab811366pdjx99cn2i26yiwpwr1nbi4d";
+      sha256 = "11p7p3b0yb12xfdhxxsifc2mz0rj1hlgi8sbcwjzxvld24rszvbi";
       type = "gem";
     };
-    version = "1.8.6";
+    version = "1.8.7";
   };
   dotenv = {
     groups = ["default"];
@@ -1315,80 +1315,48 @@ src:
     };
     version = "2.7.6";
   };
-  dry-configurable = {
-    dependencies = ["concurrent-ruby" "dry-core"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rvwvxrvcygvgfc3xjrihvdvnr0dh2144s8x80zfgfnz0jd5gac7";
-      type = "gem";
-    };
-    version = "0.12.0";
-  };
-  dry-container = {
-    dependencies = ["concurrent-ruby" "dry-configurable"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1npnhs3x2xcwwijpys5c8rpcvymrlab0y8806nr4h425ld5q4wd0";
-      type = "gem";
-    };
-    version = "0.7.2";
-  };
   dry-core = {
-    dependencies = ["concurrent-ruby"];
-    groups = ["default"];
+    dependencies = ["concurrent-ruby" "zeitwerk"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "14s45hxcqpp2mbvwlwzn018i8qhcjzgkirigdrv31jd741rpgy9s";
+      sha256 = "01gks2hrp7nl3pzb487azvd25dlbrc40d5cpk4n0szwnf2c0k4ks";
       type = "gem";
     };
-    version = "0.5.0";
-  };
-  dry-equalizer = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rsqpk0gjja6j6pjm0whx2px06cxr3h197vrwxp6k042p52r4v46";
-      type = "gem";
-    };
-    version = "0.3.0";
+    version = "1.0.0";
   };
   dry-inflector = {
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17mkdwglqsd9fg272y3zms7rixjgkb1km1xcb88ir5lxvk1jkky7";
+      sha256 = "09hnvna3lg2x36li63988kv664d0zvy7y0z33803yvrdr9hj7lka";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "1.0.0";
   };
   dry-logic = {
-    dependencies = ["concurrent-ruby" "dry-core"];
-    groups = ["default"];
+    dependencies = ["concurrent-ruby" "dry-core" "zeitwerk"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17dnc3g9y2nj42rdx2bdvsvvms10vgw4qzjb2iw2gln9hj8b797c";
+      sha256 = "05nldkc154r0qzlhss7n5klfiyyz05x2fkq08y13s34py6023vcr";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.5.0";
   };
   dry-types = {
-    dependencies = ["concurrent-ruby" "dry-container" "dry-core" "dry-equalizer" "dry-inflector" "dry-logic"];
-    groups = ["default"];
+    dependencies = ["concurrent-ruby" "dry-core" "dry-inflector" "dry-logic" "zeitwerk"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1px1r5khlf4lw32gsrnnnsx7dvl2d94axx3h0b6zwxrhvfq3n038";
+      sha256 = "1f6dz0hm67rhybh6xq2s3vvr700cp43kf50z2lids62s2i0mh5hj";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.7.1";
   };
   dumb_delegator = {
     groups = ["default" "test"];
@@ -2134,10 +2102,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gja1b2zirv1clavlg6c0c3xc0z2si2xvxcp9cd165q4lwh47ika";
+      sha256 = "1bz3i05lr1nzm35xg11blaq78v96sg49aw1yh4hj7wfk3cbdn1q0";
       type = "gem";
     };
-    version = "15.9.0.pre.rc3";
+    version = "16.1.0.pre.rc2";
   };
   gitlab = {
     dependencies = ["httparty" "terminal-table"];
@@ -2200,20 +2168,20 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vl64blqz850d5vahwpwyrsvw4iarn578p8bzmcw11imqpnk62pk";
+      sha256 = "0nz0g5s65wkicsn9ianqxi7ys2w666n226gfblzllcfy1z9siyyi";
       type = "gem";
     };
-    version = "0.32.0";
+    version = "0.33.0";
   };
   gitlab-license = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07pdi9zcifiw8vjv5zz5jdv2gmaq3rkyxfdkn0j3a0cdh9iwgjrc";
+      sha256 = "0ms1kf5nmclsnmd2xa9k273asmb73ivaykwrb3g7sq263j3y7jk0";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "2.3.0";
   };
   gitlab-mail_room = {
     dependencies = ["jwt" "net-imap" "oauth2"];
@@ -2289,6 +2257,17 @@ src:
     };
     version = "2.2.0";
   };
+  gitlab_quality-test_tooling = {
+    dependencies = ["activesupport" "gitlab" "http" "nokogiri" "parallel" "rainbow" "table_print" "zeitwerk"];
+    groups = ["test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02xwchhhfv8jkypap5pn1wjkdx92jxk4wsp71i2s0ymnqw98y401";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
   globalid = {
     dependencies = ["activesupport"];
     groups = ["default" "development" "test"];
@@ -2535,10 +2514,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xcg53yz44cqhcpb85w3ay80kvnniy0v441c9p08wb6zzia2mnq9";
+      sha256 = "1aczvz5jdslr1bfx08xrycp6ggdpaifdlh5hrdyd774mvcl0mg2d";
       type = "gem";
     };
-    version = "3.22.3";
+    version = "3.23.3";
   };
   googleapis-common-protos = {
     dependencies = ["google-protobuf" "googleapis-common-protos-types" "grpc"];
@@ -2586,14 +2565,14 @@ src:
   };
   grape = {
     dependencies = ["activesupport" "builder" "dry-types" "mustermann-grape" "rack" "rack-accept"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0adf01kihxbmh8q84r6zyfgdmpbyb0lwcar3fi8j6bl6qcsbgwqx";
+      sha256 = "0lbgysx2d64hsck11jajc4gwikj5nd82809bz0jibrnp4yb1lcw8";
       type = "gem";
     };
-    version = "1.5.2";
+    version = "1.7.0";
   };
   grape-entity = {
     dependencies = ["activesupport" "multi_json"];
@@ -2623,10 +2602,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zy84lxrnnslray9rmfgb7ri295wda3cxx3xryz4lr5hd8r5p24w";
+      sha256 = "17y6smk7shplblgic4jvi5njhd0x91n1xrvds3l6cjsjfs2d7lhg";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.6.1";
   };
   grape-swagger-entity = {
     dependencies = ["grape-entity" "grape-swagger"];
@@ -3292,10 +3271,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wnz60wh2yb7s5g7an64cw2brl9vvw960xnq4gs3q6drlgmbjl8g";
+      sha256 = "0hqffqr2krk6gcjapriwwmdrjz56dczshxafnwrkipyxi51vwgvh";
       type = "gem";
     };
-    version = "1.3.13";
+    version = "1.4.2";
   };
   letter_opener = {
     dependencies = ["launchy"];
@@ -3410,10 +3389,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nq23yca06rq8qxxymh4nfbx484k2yll54y780b4ilyvmcipyh7c";
+      sha256 = "1p744kjpb5zk2ihklbykzii77alycjc04vpnm2ch2f3cp65imlj3";
       type = "gem";
     };
-    version = "2.21.0";
+    version = "2.21.3";
   };
   lookbook = {
     dependencies = ["activemodel" "css_parser" "htmlbeautifier" "htmlentities" "marcel" "railties" "redcarpet" "rouge" "view_component" "yard" "zeitwerk"];
@@ -3598,10 +3577,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1af4yarhbbx62f7qsmgg5fynrik0s36wjy3difkawy536xg343mp";
+      sha256 = "0z7f38iq37h376n9xbl4gajdrnwzq284c9v1py4imw3gri2d5cj6";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "2.8.2";
   };
   minitest = {
     groups = ["development" "test"];
@@ -3729,25 +3708,25 @@ src:
   };
   mustermann = {
     dependencies = ["ruby2_keywords"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ccm54qgshr1lq3pr1dfh7gphkilc19dp63rw6fcx7460pjwy88a";
+      sha256 = "0rwbq20s2gdh8dljjsgj5s6wqqfmnbclhvv2c2608brv7jm6jdbd";
       type = "gem";
     };
-    version = "1.1.1";
+    version = "3.0.0";
   };
   mustermann-grape = {
     dependencies = ["mustermann"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0djlbi7nh161a5mwjdm1ya4hc6lyzc493ah48gn37gk6vyri5kh0";
+      sha256 = "1zpmc099rcpxmlfxb71zd6l7f9fcsg1fhi6627r03y1qlgb0jlvg";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.0.2";
   };
   nap = {
     groups = ["default" "development"];
@@ -3780,6 +3759,17 @@ src:
     };
     version = "0.3.0";
   };
+  net-http = {
+    dependencies = ["net-protocol" "uri"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "11mymfxpsgpwr1qbv8vwj8av9kksqj0632p9s3x35bzrnq4y393m";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
   net-http-persistent = {
     dependencies = ["connection_pool"];
     groups = ["default"];
@@ -3807,10 +3797,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ycw0qsw3hap8svakl0i30jkj0ffd4lpyrn17a1j0w8mz5ainmsj";
+      sha256 = "0xqcffn3c1564c4fizp10dzw2v5g2pabdzrcn25hq05bqhsckbar";
       type = "gem";
     };
-    version = "0.17.1";
+    version = "0.18.0";
   };
   net-ntp = {
     groups = ["default"];
@@ -3912,10 +3902,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fnw0z8zl8b5k35g9m5hhc1g4s6ajzjinhyxnqjrx7l7p07fw71v";
+      sha256 = "1mr2ibfk874ncv0qbdkynay738w2mfinlkhnbd5lyk5yiw5q1p10";
       type = "gem";
     };
-    version = "1.14.3";
+    version = "1.15.2";
   };
   notiffany = {
     dependencies = ["nenv" "shellany"];
@@ -4175,6 +4165,17 @@ src:
     };
     version = "2.1.0";
   };
+  omniauth-shibboleth-redux = {
+    dependencies = ["omniauth"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1qgzp0xaka6vqpx69mw6nbqaqmyqrawi11cyak4gq19l23ym7cz9";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
   omniauth-twitter = {
     dependencies = ["omniauth-oauth" "rack"];
     groups = ["default"];
@@ -4344,15 +4345,15 @@ src:
     version = "1.22.1";
   };
   parser = {
-    dependencies = ["ast"];
+    dependencies = ["ast" "racc"];
     groups = ["coverage" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zk8mdyr0322r11d63rcp5jhz4lakxilhvyvdv0ql5dw4lb83623";
+      sha256 = "1swigds85jddb5gshll1g8lkmbcgbcp9bi1d4nigwvxki8smys0h";
       type = "gem";
     };
-    version = "3.2.0.0";
+    version = "3.2.2.3";
   };
   parslet = {
     groups = ["default" "development" "test"];
@@ -4402,10 +4403,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1slcbzzqdv6104l5h8ql6kj43zmnm16g2dav8bc8dasfpwmrg1k0";
+      sha256 = "0cs8c0f903phs3yjjbrhlyaipvmvm95xids06a761hf0s6lj0j5h";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "4.2.1";
   };
   plist = {
     groups = ["default"];
@@ -4477,10 +4478,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h4w0947zwwg6kbdnvg4vbmrsc8yf5ijb37sg758apks44imym28";
+      sha256 = "14m09ysq0l6kih9pdy1mmdabdyjk09hvx4rzqh6phgb34s1w4pfp";
       type = "gem";
     };
-    version = "0.23.1";
+    version = "0.25.0";
   };
   pry = {
     dependencies = ["coderay" "method_source"];
@@ -4542,21 +4543,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qzq0c791kacv68hgk9zqsd1p7zx1y1rr9j10rn9yphibb8jj436";
+      sha256 = "1v7fmv0n4bhdcwh60dgza44iqai5pg34f5pzm4vh4i5fwx7mpqxh";
       type = "gem";
     };
-    version = "5.6.5";
-  };
-  puma_worker_killer = {
-    dependencies = ["get_process_mem" "puma"];
-    groups = ["puma"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0jk1bhmx5px8y1ip4ky80cq5cwdaybdg4y55shd2vsdmjv938mcw";
-      type = "gem";
-    };
-    version = "0.3.1";
+    version = "6.3.0";
   };
   pyu-ruby-sasl = {
     groups = ["default"];
@@ -4797,10 +4787,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zx8v677r2gs050z4cdiflp14kp6nx5z285ynj2ach0w0z7jfm23";
+      sha256 = "09kszvsa9av8yb8pm9nz6p5jgshin3cqvknlvd1m927qfvdpalk3";
       type = "gem";
     };
-    version = "0.9.75";
+    version = "0.9.78";
   };
   rbtrace = {
     dependencies = ["ffi" "msgpack" "optimist"];
@@ -5068,10 +5058,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "046xwhfhi2krmbaqmg9vshf01vzld8smczx6dwppinv61ndc2vqg";
+      sha256 = "0pym2zjwl6dwdfvbn7rbvmds32r70jx9qddhvvi6pqy6987ack1v";
       type = "gem";
     };
-    version = "4.1.0";
+    version = "4.1.2";
   };
   rqrcode = {
     dependencies = ["chunky_png"];
@@ -5363,10 +5353,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1706dyk5jdma75bnl9rhmx8vgzjw12ixnj3y32inmpcgzgsvs76k";
+      sha256 = "18vnbzin5ypxrgcs9lllg7x311b69dyrdw2w1pwz84438hmxm79s";
       type = "gem";
     };
-    version = "1.13.0";
+    version = "1.15.0";
   };
   ruby-statistics = {
     groups = ["default" "test"];
@@ -6022,6 +6012,16 @@ src:
     };
     version = "1.2.0";
   };
+  table_print = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jxmd1yg3h0g27wzfpvq1jnkkf7frwb5wy9m4f47nf4k3wl68rj3";
+      type = "gem";
+    };
+    version = "1.5.7";
+  };
   tanuki_emoji = {
     groups = ["default"];
     platforms = [];
@@ -6463,6 +6463,16 @@ src:
     };
     version = "0.6.7";
   };
+  uri = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vigw7nfszfqgikr6n574k9bfh0rvs74z8xq46rz2zsm8249l8cc";
+      type = "gem";
+    };
+    version = "0.12.1";
+  };
   uri_template = {
     groups = ["default"];
     platforms = [];
@@ -6543,10 +6553,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bwvpkv1iqa8g5cmmllx8fx0nprapzrzfvf1m15rr3wxw5hrbdn8";
+      sha256 = "08jc9k4qqazbf5frhdril5084adm90rs1lqbnqq3yfdm2dgaiyhx";
       type = "gem";
     };
-    version = "2.82.0";
+    version = "3.2.0";
   };
   virtus = {
     dependencies = ["axiom-types" "coercible" "descendants_tracker"];
diff --git a/pkgs/applications/virtualization/stratovirt/default.nix b/pkgs/applications/virtualization/stratovirt/default.nix
index 2c27b2f3cf46..b9fbc191d9c1 100644
--- a/pkgs/applications/virtualization/stratovirt/default.nix
+++ b/pkgs/applications/virtualization/stratovirt/default.nix
@@ -13,6 +13,7 @@ rustPlatform.buildRustPackage rec {
     rev = "v${version}";
     sha256 = "sha256-K99CmaBrJu30/12FxnsNsDKsTyX4f2uQSO7cwHsPuDw=";
   };
+  patches = [ ./micro_vm-allow-SYS_clock_gettime.patch ];
 
   cargoSha256 = "sha256-SFIOGGRzGkVWHIXkviVWuhDN29pa0uD3GqKh+G421xI=";
 
diff --git a/pkgs/applications/virtualization/stratovirt/micro_vm-allow-SYS_clock_gettime.patch b/pkgs/applications/virtualization/stratovirt/micro_vm-allow-SYS_clock_gettime.patch
new file mode 100644
index 000000000000..6aa0da30c44a
--- /dev/null
+++ b/pkgs/applications/virtualization/stratovirt/micro_vm-allow-SYS_clock_gettime.patch
@@ -0,0 +1,25 @@
+From af3001b1b2697ae3165e2fdf47a560fd9ab19a68 Mon Sep 17 00:00:00 2001
+From: Astro <astro@spaceboyz.net>
+Date: Sun, 18 Jun 2023 23:10:23 +0200
+Subject: [PATCH] micro_vm: allow SYS_clock_gettime
+
+---
+ machine/src/micro_vm/syscall.rs | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/machine/src/micro_vm/syscall.rs b/machine/src/micro_vm/syscall.rs
+index 89ce5c29..2a6aa0cc 100644
+--- a/machine/src/micro_vm/syscall.rs
++++ b/machine/src/micro_vm/syscall.rs
+@@ -128,6 +128,8 @@ pub fn syscall_whitelist() -> Vec<BpfRule> {
+         #[cfg(all(target_env = "gnu", target_arch = "x86_64"))]
+         BpfRule::new(libc::SYS_readlink),
+         BpfRule::new(libc::SYS_getrandom),
++        #[cfg(target_env = "gnu")]
++        BpfRule::new(libc::SYS_clock_gettime),
+         madvise_rule(),
+     ]
+ }
+-- 
+2.41.0
+
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index 98d9de9e70b2..421d5f7ffbc0 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -45,6 +45,11 @@ let
       # BEAM-based languages.
       elixir = elixir_1_14;
 
+      elixir_1_15 = lib'.callElixir ../interpreters/elixir/1.15.nix {
+        inherit erlang;
+        debugInfo = true;
+      };
+
       elixir_1_14 = lib'.callElixir ../interpreters/elixir/1.14.nix {
         inherit erlang;
         debugInfo = true;
diff --git a/pkgs/development/interpreters/elixir/1.15.nix b/pkgs/development/interpreters/elixir/1.15.nix
new file mode 100644
index 000000000000..6dada168cc37
--- /dev/null
+++ b/pkgs/development/interpreters/elixir/1.15.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+mkDerivation {
+  version = "1.15.0";
+  sha256 = "sha256-o5MfA0UG8vpnPCH1EYspzcN62yKZQcz5uVUY47hOL9w=";
+  # https://hexdocs.pm/elixir/1.15.0/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
+  minimumOTPVersion = "24";
+  escriptPath = "lib/elixir/scripts/generate_app.escript";
+}
diff --git a/pkgs/development/interpreters/elixir/generic-builder.nix b/pkgs/development/interpreters/elixir/generic-builder.nix
index 5f08386c9f51..af6982156103 100644
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@@ -16,6 +16,7 @@
 , sha256 ? null
 , rev ? "v${version}"
 , src ? fetchFromGitHub { inherit rev sha256; owner = "elixir-lang"; repo = "elixir"; }
+, escriptPath ? "lib/elixir/generate_app.escript"
 } @ args:
 
 let
@@ -38,7 +39,7 @@ stdenv.mkDerivation ({
   buildFlags = optional debugInfo "ERL_COMPILER_OPTIONS=debug_info";
 
   preBuild = ''
-    patchShebangs lib/elixir/generate_app.escript || true
+    patchShebangs ${escriptPath} || true
 
     substituteInPlace Makefile \
       --replace "/usr/local" $out
diff --git a/pkgs/development/ocaml-modules/duff/default.nix b/pkgs/development/ocaml-modules/duff/default.nix
index 99261a5b324e..21e916b55e23 100644
--- a/pkgs/development/ocaml-modules/duff/default.nix
+++ b/pkgs/development/ocaml-modules/duff/default.nix
@@ -17,7 +17,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/duff/releases/download/v${version}/duff-${version}.tbz";
-    sha256 = "sha256-0eqpfPWNOHYjkcjXRnZUTUFF0/L9E+TNoOqKCETN5hI=";
+    sha256 = "sha256-+UU89Ko7aFDv6MxvE/BT6+XyER+vF3zqv7sD5dmtbt4=";
   };
 
   propagatedBuildInputs = [ fmt ];
diff --git a/pkgs/games/maptool/default.nix b/pkgs/games/maptool/default.nix
new file mode 100644
index 000000000000..5cba8c224704
--- /dev/null
+++ b/pkgs/games/maptool/default.nix
@@ -0,0 +1,119 @@
+{ lib
+, copyDesktopItems
+, fetchurl
+, ffmpeg
+, gitUpdater
+, jre
+, libarchive
+, makeDesktopItem
+, openjfx
+, stdenvNoCC
+, wrapGAppsHook
+}:
+let
+  pname = "maptool";
+  version = "1.13.1";
+  repoBase = "https://github.com/RPTools/${pname}";
+  src = fetchurl {
+    url = "${repoBase}/releases/download/${version}/MapTool-${version}.jar";
+    hash = "sha256-EHisFvLaqi8VqIdygf0nxohKLL3c/yE5Y6jAcT0B2q0=";
+  };
+
+  icon = fetchurl {
+    url = "https://raw.githubusercontent.com/RPTools/${pname}/${version}/package/linux/MapTool.png";
+    hash = "sha256-xkVYjMprTanHu8r4b9PHORI8E1aJp+9KDSP5mqCE8ew=";
+  };
+
+  meta = with lib; {
+    description = "Virtual Tabletop for playing roleplaying games with remote players or face to face";
+    homepage = "https://www.rptools.net/toolbox/maptool/";
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
+    license = licenses.agpl3;
+    maintainers = with maintainers; [ rhendric ];
+  };
+
+  javafxModules = [ "base" "controls" "media" "swing" "web" "fxml" "graphics" ];
+
+  classpath =
+    lib.concatMap (mod: [
+      "${openjfx}/modules_src/javafx.${mod}/module-info.java"
+      "${openjfx}/modules/javafx.${mod}"
+      "${openjfx}/modules_libs/javafx.${mod}"
+    ]) javafxModules ++
+    [ src ];
+
+  jvmArgs = [
+    "-cp" (lib.concatStringsSep ":" classpath)
+    "-Xss8M"
+    "-Dsun.java2d.d3d=false"
+    "-Dfile.encoding=UTF-8"
+    "-Dpolyglot.engine.WarnInterpreterOnly=false"
+    "-XX:+ShowCodeDetailsInExceptionMessages"
+    "--add-opens=java.desktop/java.awt=ALL-UNNAMED"
+    "--add-opens=java.desktop/java.awt.geom=ALL-UNNAMED"
+    "--add-opens=java.desktop/sun.awt.geom=ALL-UNNAMED"
+    "--add-opens=java.base/java.util=ALL-UNNAMED"
+    "--add-opens=javafx.web/javafx.scene.web=ALL-UNNAMED"
+    "--add-opens=javafx.web/com.sun.webkit=ALL-UNNAMED"
+    "--add-opens=javafx.web/com.sun.webkit.dom=ALL-UNNAMED"
+    "--add-opens=java.desktop/javax.swing=ALL-UNNAMED"
+    "--add-opens=java.desktop/sun.awt.shell=ALL-UNNAMED"
+    "--add-opens=java.desktop/com.sun.java.swing.plaf.windows=ALL-UNNAMED"
+
+    # disable telemetry (the empty DSN disables the Sentry library, setting the
+    # environment to Development disables some logic inside MapTool)
+    "-Dsentry.dsn"
+    "-Dsentry.environment=Development"
+  ];
+
+  binName = pname;
+  rdnsName = "net.rptools.maptool";
+in
+stdenvNoCC.mkDerivation {
+  inherit pname version src meta;
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontWrapGApps = true;
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    libarchive
+    wrapGAppsHook
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = rdnsName;
+      desktopName = "MapTool";
+      icon = rdnsName;
+      exec = binName;
+      comment = meta.description;
+      categories = [ "Game" ];
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/${binName} \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ ffmpeg ]} \
+      --add-flags '${lib.concatStringsSep " " jvmArgs} net.rptools.maptool.client.LaunchInstructions'
+
+    dest=$out/share/icons/hicolor/256x256/apps
+    mkdir -p "$dest"
+    ln -s ${icon} "$dest/${rdnsName}.png"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater {
+    url = "${repoBase}.git";
+    ignoredVersions = "-";
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 8eaab5a6f8b1..d5be2d43d2c0 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -3,14 +3,14 @@
 let
   # These names are how they are designated in https://xanmod.org.
   ltsVariant = {
-    version = "6.1.31";
-    hash = "sha256-quYsp6h7IV6gUT0e55FeBlS8rH9OGrqdbM1XSIYNRV4=";
+    version = "6.1.35";
+    hash = "sha256-CfrM2CNaGUTfkVteudL8xnAuCdZJxD5pUEC1YW9LiuU=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.3.5";
-    hash = "sha256-2+8WDj1VdmIdC0DjmKyY/fMi5zoiXDAWy7EAmkImvXk=";
+    version = "6.3.9";
+    hash = "sha256-t1fKPZ+giANPmhM4zGoGtYWJF6rDnbpJaoHILl3nyRI=";
     variant = "main";
   };
 
diff --git a/pkgs/servers/fastnetmon-advanced/default.nix b/pkgs/servers/fastnetmon-advanced/default.nix
index 53c1ef11e25c..35c1707a2d5a 100644
--- a/pkgs/servers/fastnetmon-advanced/default.nix
+++ b/pkgs/servers/fastnetmon-advanced/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fastnetmon-advanced";
-  version = "2.0.337";
+  version = "2.0.342";
 
   src = fetchurl {
     url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_jammy/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
-    hash = "sha256-lYXJ0Q0iUiWk/n/I71BsKnnoRJh3a2EJT3EWV4+pQbM=";
+    hash = "sha256-H4e7ftuL39xxDYs2zVhgVI8voDBR2TQLWlWSBg3At2s=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +40,12 @@ stdenv.mkDerivation rec {
     cp -r opt/fastnetmon/app/bin $out/bin
     cp -r opt/fastnetmon/libraries $out/libexec/fastnetmon
 
+    readlink usr/sbin/gobgpd
+    readlink usr/bin/gobgp
+
+    ln -s $(readlink usr/sbin/gobgpd | sed "s:/opt/fastnetmon:$out/libexec/fastnetmon:") $out/bin/fnm-gobgpd
+    ln -s $(readlink usr/bin/gobgp | sed "s:/opt/fastnetmon:$out/libexec/fastnetmon:") $out/bin/fnm-gobgp
+
     addAutoPatchelfSearchPath $out/libexec/fastnetmon/libraries
   '';
 
@@ -48,6 +54,8 @@ stdenv.mkDerivation rec {
     set +o pipefail
     $out/bin/fastnetmon 2>&1 | grep "Can't open log file"
     $out/bin/fcli 2>&1 | grep "Please run this tool with root rights"
+    $out/bin/fnm-gobgp --help 2>&1 | grep "Available Commands"
+    $out/bin/fnm-gobgpd --help 2>&1 | grep "Application Options"
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index c7c0bdfe8704..7173b90626d6 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ferretdb";
-  version = "1.2.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    sha256 = "sha256-j3gEC4/i+C35P8wf/A9lA5rnUB669/J+GpN/iiyjSlU=";
+    sha256 = "sha256-WSjIUnjMdrRsdygDqQaxNosc/XGrSz/Yx3xauDkQDzU=";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ buildGoModule rec {
     echo nixpkgs     > build/version/package.txt
   '';
 
-  vendorSha256 = "sha256-6sddJcNzPxMarP0/QxpeWF0qXR8wT2kU6N6CtGKG1Tk=";
+  vendorSha256 = "sha256-xWmzTqy0yoOZRvMllsVaRkUmAUWE/Nn4UFyT+0JiCFU=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/servers/web-apps/nifi/default.nix b/pkgs/servers/web-apps/nifi/default.nix
index 87cfe7e21f5a..734ced245056 100644
--- a/pkgs/servers/web-apps/nifi/default.nix
+++ b/pkgs/servers/web-apps/nifi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nifi";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchzip {
     url = "mirror://apache/nifi/${version}/nifi-${version}-bin.zip";
-    sha256 = "sha256-AnDvZ9SV+VFdsP6KoqZIPNinAe2erT/IBY4c6i+2iTQ=";
+    hash = "sha256-IzTGsD6nL7UrXuHrJc8Dt1C6r137UjT/V4vES2m/8cg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manual.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manual.py
index 1963989d5365..6a2c28e85d63 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manual.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manual.py
@@ -306,7 +306,8 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"',
             '  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">',
             '<html xmlns="http://www.w3.org/1999/xhtml">',
-            ' <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />',
+            ' <head>',
+            '  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />',
             f' <title>{toc.target.title}</title>',
             "".join((f'<link rel="stylesheet" type="text/css" href="{html.escape(style, True)}" />'
                      for style in self._html_params.stylesheets)),
diff --git a/pkgs/tools/security/semgrep/common.nix b/pkgs/tools/security/semgrep/common.nix
index 48381e9eb0e6..0ad680b0ddee 100644
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@@ -1,54 +1,39 @@
-{ lib, fetchFromGitHub, fetchzip, stdenv }:
+{ lib }:
 
 rec {
-  version = "1.15.0";
+  version = "1.27.0";
 
-  src = fetchFromGitHub {
-    owner = "returntocorp";
-    repo = "semgrep";
-    rev = "v${version}";
-    sha256 = "sha256-x+AOt6nn2hN4MODFZCvlq0kZ3VLoS7rVcFGGCEssIu0=";
-  };
+  srcHash = "sha256-F6n3LQY4a5sO6c8SMQF9YjjgOS+v2SH+UQPwhg2EX7Q=";
 
   # submodule dependencies
   # these are fetched so we:
   #   1. don't fetch the many submodules we don't need
   #   2. avoid fetchSubmodules since it's prone to impurities
   submodules = {
-    "cli/src/semgrep/lang" = fetchFromGitHub {
-      owner = "returntocorp";
-      repo = "semgrep-langs";
-      rev = "08656cdefc9e6818c64e168cf51ee1e76ea8829e";
-      sha256 = "sha256-vYf33JhfvEDmt/VW0hBOmqailIERS0GdUgrPuCxWt9I=";
-    };
-    "cli/src/semgrep/semgrep_interfaces" = fetchFromGitHub {
+    "cli/src/semgrep/semgrep_interfaces" = {
       owner = "returntocorp";
       repo = "semgrep-interfaces";
-      rev = "ba9241ca8f13dea72a4ca5c5eae99f45c071c8b4";
-      sha256 = "sha256-2rcMmN42445AivcyYLPeE+HBYOyxJijQME1UUr9HISA=";
+      rev = "213f67abea73546ca6111e1bbf0ef96aa917c940";
+      hash = "sha256-HeNHJkTje9j16+dwsfyMhoqQn/J18q/7XvQPRwgTw/Y=";
     };
   };
 
   # fetch pre-built semgrep-core since the ocaml build is complex and relies on
   # the opam package manager at some point
-  core = rec {
-    data = {
-      x86_64-linux = {
-        suffix = "-ubuntu-16.04.tgz";
-        sha256 = "sha256-vLtV1WAnOD6HhgrWYIP0NfXHKfvXORksdNp5UTG1QWc=";
-      };
-      x86_64-darwin = {
-        suffix = "-osx.zip";
-        sha256 = "sha256-6+ENjOOIJ5TSjpnJ5pDudblrWj/FLUe66UGr6V9c0HQ=";
-      };
+  # pulling it out of the python wheel as r2c no longer release a built binary
+  # on github releases
+  core = {
+    x86_64-linux = {
+      platform = "any";
+      hash = "sha256-cRj81dXpAE6S0EXajsRikOIAPzlUf42FhiDCWjv+wZQ=";
     };
-    src = let
-      inherit (stdenv.hostPlatform) system;
-      selectSystemData = data: data.${system} or (throw "Unsupported system: ${system}");
-      inherit (selectSystemData data) suffix sha256;
-    in fetchzip {
-      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}${suffix}";
-      inherit sha256;
+    x86_64-darwin = {
+      platform = "macosx_10_14_x86_64";
+      hash = "sha256-jqfGVZGF/DFgXkr7kQg6QyqEELSr8AKE3Ga8kTftnIY=";
+    };
+    aarch64-darwin = {
+      platform = "macosx_11_0_arm64";
+      hash = "sha256-e/uCSRMdbVD0lvc0hukbiUzheqRNIIh1LgMq6Ae7JYI=";
     };
   };
 
@@ -66,7 +51,5 @@ rec {
     '';
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ jk ambroisie ];
-    # limited by semgrep-core
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/tools/security/semgrep/default.nix b/pkgs/tools/security/semgrep/default.nix
index 0e9c3ddc391c..23749643a443 100644
--- a/pkgs/tools/security/semgrep/default.nix
+++ b/pkgs/tools/security/semgrep/default.nix
@@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, callPackage
 , semgrep-core
 , buildPythonApplication
 , pythonPackages
@@ -11,12 +10,20 @@
 }:
 
 let
-  common = callPackage ./common.nix { };
+  common = import ./common.nix { inherit lib; };
 in
 buildPythonApplication rec {
   pname = "semgrep";
-  inherit (common) src version;
+  inherit (common) version;
+  src = fetchFromGitHub {
+    owner = "returntocorp";
+    repo = "semgrep";
+    rev = "v${version}";
+    hash = common.srcHash;
+  };
 
+  # prepare a subset of the submodules as we only need a handful
+  # and there are many many submodules total
   postPatch = (lib.concatStringsSep "\n" (lib.mapAttrsToList
     (
       path: submodule: ''
@@ -27,7 +34,7 @@ buildPythonApplication rec {
         ln -s ${submodule}/ ${path}
       ''
     )
-    common.submodules)) + ''
+    passthru.submodulesSubset)) + ''
     cd cli
   '';
 
@@ -97,10 +104,12 @@ buildPythonApplication rec {
 
   passthru = {
     inherit common;
+    submodulesSubset = lib.mapAttrs (k: args: fetchFromGitHub args) common.submodules;
     updateScript = ./update.sh;
   };
 
   meta = common.meta // {
     description = common.meta.description + " - cli";
+    inherit (semgrep-core.meta) platforms;
   };
 }
diff --git a/pkgs/tools/security/semgrep/semgrep-core.nix b/pkgs/tools/security/semgrep/semgrep-core.nix
index e5ce941298a4..c4846c6d91d5 100644
--- a/pkgs/tools/security/semgrep/semgrep-core.nix
+++ b/pkgs/tools/security/semgrep/semgrep-core.nix
@@ -1,21 +1,52 @@
-{ lib, stdenvNoCC, callPackage }:
+{ lib, stdenvNoCC, fetchPypi, unzip }:
 
 let
-  common = callPackage ./common.nix { };
+  common = import ./common.nix { inherit lib; };
 in
 stdenvNoCC.mkDerivation rec {
   pname = "semgrep-core";
   inherit (common) version;
-  inherit (common.core) src;
+  # fetch pre-built semgrep-core since the ocaml build is complex and relies on
+  # the opam package manager at some point
+  # pulling it out of the python wheel as r2c no longer release a built binary
+  # on github releases
+  src =
+    let
+      inherit (stdenvNoCC.hostPlatform) system;
+      data = common.core.${system} or (throw "Unsupported system: ${system}");
+    in
+    fetchPypi rec {
+      pname = "semgrep";
+      inherit version;
+      format = "wheel";
+      dist = python;
+      python = "cp37.cp38.cp39.py37.py38.py39";
+      inherit (data) platform hash;
+    };
+
+  nativeBuildInputs = [ unzip ];
+
+  # _tryUnzip from unzip's setup-hook doesn't recognise .whl
+  # "do not know how to unpack source archive"
+  # perform unpack by hand
+  unpackPhase = ''
+    runHook preUnpack
+    LANG=en_US.UTF-8 unzip -qq "$src"
+    runHook postUnpack
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
 
   installPhase = ''
     runHook preInstall
-    install -Dm 755 -t $out/bin semgrep-core
+    install -Dm 755 -t $out/bin semgrep-${version}.data/purelib/semgrep/bin/semgrep-core
     runHook postInstall
   '';
 
   meta = common.meta // {
     description = common.meta.description + " - core binary";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = lib.attrNames common.core;
   };
 }
diff --git a/pkgs/tools/security/semgrep/update.sh b/pkgs/tools/security/semgrep/update.sh
index 25b18edd6e2f..090d607a6928 100755
--- a/pkgs/tools/security/semgrep/update.sh
+++ b/pkgs/tools/security/semgrep/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused jq
+#!nix-shell -i bash -p curl gnused jq nix-prefetch
 
 set -euxo pipefail
 
@@ -33,7 +33,7 @@ NEW_VERSION=$(
 )
 # trim v prefix
 NEW_VERSION="${NEW_VERSION:1}"
-OLD_VERSION="$(instantiateClean semgrep.common.version)"
+OLD_VERSION="$(instantiateClean semgrep.passthru.common.version)"
 
 if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
     echo "Already up to date"
@@ -50,43 +50,54 @@ fetchgithub() {
     set -eo pipefail
 }
 
-fetchzip() {
-    set +eo pipefail
-    nix-build -E "with import $NIXPKGS_ROOT {}; fetchzip {url = \"$1\"; sha256 = lib.fakeSha256; }" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
-    set -eo pipefail
+fetch_arch() {
+  VERSION=$1
+  PLATFORM=$2
+  nix-prefetch "{ fetchPypi }:
+fetchPypi rec {
+  pname = \"semgrep\";
+  version = \"$VERSION\";
+  format = \"wheel\";
+  dist = python;
+  python = \"cp37.cp38.cp39.py37.py38.py39\";
+  platform = \"$PLATFORM\";
+}
+"
 }
 
 replace "$OLD_VERSION" "$NEW_VERSION" "$COMMON_FILE"
 
 echo "Updating src"
 
-OLD_HASH="$(instantiateClean semgrep.common.src.outputHash)"
+OLD_HASH="$(instantiateClean semgrep.passthru.common.srcHash)"
 echo "Old hash $OLD_HASH"
 TMP_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
 replace "$OLD_HASH" "$TMP_HASH" "$COMMON_FILE"
-NEW_HASH="$(fetchgithub semgrep.common.src)"
+NEW_HASH="$(fetchgithub semgrep.src)"
 echo "New hash $NEW_HASH"
 replace "$TMP_HASH" "$NEW_HASH" "$COMMON_FILE"
 
 echo "Updated src"
 
-# loop through platforms for core
-nix-instantiate -E "with import $NIXPKGS_ROOT {}; builtins.attrNames semgrep.common.core.data" --eval --strict --json \
-| jq '.[]' -r \
-| while read -r PLATFORM; do
-    echo "Updating core for $PLATFORM"
-    SUFFIX=$(instantiateClean semgrep.common.core.data."$PLATFORM".suffix)
-    OLD_HASH=$(instantiateClean semgrep.common.core.data."$PLATFORM".sha256)
-    echo "Old hash $OLD_HASH"
 
-    NEW_URL="https://github.com/returntocorp/semgrep/releases/download/v$NEW_VERSION/semgrep-v$NEW_VERSION$SUFFIX"
-    NEW_HASH="$(fetchzip "$NEW_URL")"
-    echo "New hash $NEW_HASH"
+update_core_platform() {
+    SYSTEM=$1
+    echo "Updating core src $SYSTEM"
 
+    PLATFORM="$(instantiateClean "semgrep.passthru.common.core.$SYSTEM.platform")"
+
+    OLD_HASH="$(instantiateClean "semgrep.passthru.common.core.$SYSTEM.hash")"
+    echo "Old core hash $OLD_HASH"
+    NEW_HASH="$(fetch_arch "$NEW_VERSION" "$PLATFORM")"
+    echo "New core hash $NEW_HASH"
     replace "$OLD_HASH" "$NEW_HASH" "$COMMON_FILE"
 
-    echo "Updated core for $PLATFORM"
-done
+    echo "Updated core src $SYSTEM"
+}
+
+update_core_platform "x86_64-linux"
+update_core_platform "x86_64-darwin"
+update_core_platform "aarch64-darwin"
 
 OLD_PWD=$PWD
 TMPDIR="$(mktemp -d)"
@@ -109,7 +120,7 @@ nix-instantiate -E "with import $NIXPKGS_ROOT {}; builtins.attrNames semgrep.pas
     echo "Updating $SUBMODULE"
     OLD_REV=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".rev)
     echo "Old commit $OLD_REV"
-    OLD_HASH=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".outputHash)
+    OLD_HASH=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".hash)
     echo "Old hash $OLD_HASH"
 
     NEW_REV=$(get_submodule_commit "$SUBMODULE")
@@ -120,13 +131,12 @@ nix-instantiate -E "with import $NIXPKGS_ROOT {}; builtins.attrNames semgrep.pas
       continue
     fi
 
-    NEW_URL=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".url | sed "s@$OLD_REV@$NEW_REV@g")
-    NEW_HASH=$(nix --experimental-features nix-command hash to-sri "sha256:$(nix-prefetch-url "$NEW_URL")")
+    NEW_URL=$(instantiateClean semgrep.passthru.submodulesSubset."$SUBMODULE".url | sed "s@$OLD_REV@$NEW_REV@g")
 
     TMP_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
     replace "$OLD_REV" "$NEW_REV" "$COMMON_FILE"
     replace "$OLD_HASH" "$TMP_HASH" "$COMMON_FILE"
-    NEW_HASH="$(fetchgithub semgrep.passthru.common.submodules."$SUBMODULE")"
+    NEW_HASH="$(fetchgithub semgrep.passthru.submodulesSubset."$SUBMODULE")"
     echo "New hash $NEW_HASH"
     replace "$TMP_HASH" "$NEW_HASH" "$COMMON_FILE"
 
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 042d7fa44e50..8d50e8c029bc 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "sha256-U4V2+O8//6mkuznSHkPWeeJNK6NtUTEhFk7zz3FEe58=";
+    sha256 = "sha256-/AqUsjZArL4KjAzSkb1sM/xhKCIlg+2uvkV0TVwI1Q4=";
   };
 
-  vendorHash = "sha256-eyXmmhMAbLJiLwQQAR4+baU53n2WY5laUKEGoPjpBg4=";
+  vendorHash = "sha256-Wt5VahshNI/etzQQdcKgD/TBuD4NMi5eVPMHiJYfScY=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ba40e4b6e906..7646828a5937 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16920,7 +16920,7 @@ with pkgs;
   inherit (beam.interpreters)
     erlang erlang_25 erlang_24 erlang_23
     erlang_odbc erlang_javac erlang_odbc_javac
-    elixir elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10
+    elixir elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10
     elixir-ls;
 
   erlang_nox = beam_nox.interpreters.erlang;
@@ -36614,6 +36614,14 @@ with pkgs;
     gtk = gtk2;
   };
 
+  maptool = callPackage ../games/maptool {
+    # MapTool is fussy about which JRE it uses; OpenJDK will leave it hanging
+    # at launch in a class initialization deadlock. MapTool ships Temurin with
+    # their pre-built releases so we might as well use it too.
+    jre = temurin-bin-17;
+    openjfx = openjfx17;
+  };
+
   mari0 = callPackage ../games/mari0 { };
 
   manaplus = callPackage ../games/manaplus { stdenv = gcc11Stdenv; };
diff --git a/pkgs/top-level/beam-packages.nix b/pkgs/top-level/beam-packages.nix
index 3210dddfac96..e64a06cc3eaa 100644
--- a/pkgs/top-level/beam-packages.nix
+++ b/pkgs/top-level/beam-packages.nix
@@ -101,7 +101,7 @@ in
     # access for example elixir built with different version of Erlang, use
     # `beam.packages.erlang_24.elixir`.
     inherit (self.packages.erlang)
-      elixir elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10 elixir-ls lfe lfe_2_1;
+      elixir elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10 elixir-ls lfe lfe_2_1;
   } // interpretersAliases;
 
   # Helper function to generate package set with a specific Erlang version.