diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 98670fbe7b1..4012d856861 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10887,13 +10887,15 @@
     name = "Matthias C. M. Troffaes";
   };
   McSinyx = {
-    email = "mcsinyx@disroot.org";
+    email = "cnx@loang.net";
     github = "McSinyx";
     githubId = 13689192;
+    matrix = "@cnx:loang.net";
     name = "Nguyễn Gia Phong";
-    keys = [{
-      fingerprint = "E90E 11B8 0493 343B 6132  E394 2714 8B2C 06A2 224B";
-    }];
+    keys = [
+      { fingerprint = "E90E 11B8 0493 343B 6132  E394 2714 8B2C 06A2 224B"; }
+      { fingerprint = "838A FE0D 55DC 074E 360F  943A 84B6 9CE6 F3F6 B767"; }
+    ];
   };
   mcwitt = {
     email = "mcwitt@gmail.com";
diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index 24f368b3e96..12255d8392f 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -5,8 +5,8 @@ let
 
   parentWrapperDir = dirOf wrapperDir;
 
-  securityWrapper = sourceProg : pkgs.callPackage ./wrapper.nix {
-    inherit sourceProg;
+  securityWrapper = pkgs.callPackage ./wrapper.nix {
+    inherit parentWrapperDir;
   };
 
   fileModeType =
@@ -91,7 +91,8 @@ let
     , ...
     }:
     ''
-      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"
+      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
+      echo -n "${source}" > "$wrapperDir/${program}.real"
 
       # Prevent races
       chmod 0000 "$wrapperDir/${program}"
@@ -118,7 +119,8 @@ let
     , ...
     }:
     ''
-      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"
+      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
+      echo -n "${source}" > "$wrapperDir/${program}.real"
 
       # Prevent races
       chmod 0000 "$wrapperDir/${program}"
diff --git a/nixos/modules/security/wrappers/wrapper.c b/nixos/modules/security/wrappers/wrapper.c
index 2cf1727a31c..17776a97af8 100644
--- a/nixos/modules/security/wrappers/wrapper.c
+++ b/nixos/modules/security/wrappers/wrapper.c
@@ -17,10 +17,6 @@
 #include <syscall.h>
 #include <byteswap.h>
 
-#ifndef SOURCE_PROG
-#error SOURCE_PROG should be defined via preprocessor commandline
-#endif
-
 // aborts when false, printing the failed expression
 #define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))
 // aborts when returns non-zero, printing the failed expression and errno
@@ -28,6 +24,10 @@
 
 extern char **environ;
 
+// The WRAPPER_DIR macro is supplied at compile time so that it cannot
+// be changed at runtime
+static char *wrapper_dir = WRAPPER_DIR;
+
 // Wrapper debug variable name
 static char *wrapper_debug = "WRAPPER_DEBUG";
 
@@ -151,20 +151,115 @@ static int make_caps_ambient(const char *self_path) {
     return 0;
 }
 
+int readlink_malloc(const char *p, char **ret) {
+    size_t l = FILENAME_MAX+1;
+    int r;
+
+    for (;;) {
+        char *c = calloc(l, sizeof(char));
+        if (!c) {
+            return -ENOMEM;
+        }
+
+        ssize_t n = readlink(p, c, l-1);
+        if (n < 0) {
+            r = -errno;
+            free(c);
+            return r;
+        }
+
+        if ((size_t) n < l-1) {
+            c[n] = 0;
+            *ret = c;
+            return 0;
+        }
+
+        free(c);
+        l *= 2;
+    }
+}
+
 int main(int argc, char **argv) {
     ASSERT(argc >= 1);
+    char *self_path = NULL;
+    int self_path_size = readlink_malloc("/proc/self/exe", &self_path);
+    if (self_path_size < 0) {
+        fprintf(stderr, "cannot readlink /proc/self/exe: %s", strerror(-self_path_size));
+    }
+
+    unsigned int ruid, euid, suid, rgid, egid, sgid;
+    MUSTSUCCEED(getresuid(&ruid, &euid, &suid));
+    MUSTSUCCEED(getresgid(&rgid, &egid, &sgid));
+
+    // If true, then we did not benefit from setuid privilege escalation,
+    // where the original uid is still in ruid and different from euid == suid.
+    int didnt_suid = (ruid == euid) && (euid == suid);
+    // If true, then we did not benefit from setgid privilege escalation
+    int didnt_sgid = (rgid == egid) && (egid == sgid);
+
+
+    // Make sure that we are being executed from the right location,
+    // i.e., `safe_wrapper_dir'.  This is to prevent someone from creating
+    // hard link `X' from some other location, along with a false
+    // `X.real' file, to allow arbitrary programs from being executed
+    // with elevated capabilities.
+    int len = strlen(wrapper_dir);
+    if (len > 0 && '/' == wrapper_dir[len - 1])
+      --len;
+    ASSERT(!strncmp(self_path, wrapper_dir, len));
+    ASSERT('/' == wrapper_dir[0]);
+    ASSERT('/' == self_path[len]);
+
+    // If we got privileges with the fs set[ug]id bit, check that the privilege we
+    // got matches the one one we expected, ie that our effective uid/gid
+    // matches the uid/gid of `self_path`. This ensures that we were executed as
+    // `self_path', and not, say, as some other setuid program.
+    // We don't check that if we did not benefit from the set[ug]id bit, as
+    // can be the case in nosuid mounts or user namespaces.
+    struct stat st;
+    ASSERT(lstat(self_path, &st) != -1);
+
+    // if the wrapper gained privilege with suid, check that we got the uid of the file owner
+    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == euid));
+    // if the wrapper gained privilege with sgid, check that we got the gid of the file group
+    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == egid));
+    // same, but with suid instead of euid
+    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == suid));
+    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == sgid));
+
+    // And, of course, we shouldn't be writable.
+    ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));
+
+    // Read the path of the real (wrapped) program from <self>.real.
+    char real_fn[PATH_MAX + 10];
+    int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);
+    ASSERT(real_fn_size < sizeof(real_fn));
+
+    int fd_self = open(real_fn, O_RDONLY);
+    ASSERT(fd_self != -1);
+
+    char source_prog[PATH_MAX];
+    len = read(fd_self, source_prog, PATH_MAX);
+    ASSERT(len != -1);
+    ASSERT(len < sizeof(source_prog));
+    ASSERT(len > 0);
+    source_prog[len] = 0;
+
+    close(fd_self);
 
     // Read the capabilities set on the wrapper and raise them in to
     // the ambient set so the program we're wrapping receives the
     // capabilities too!
-    if (make_caps_ambient("/proc/self/exe") != 0) {
+    if (make_caps_ambient(self_path) != 0) {
+        free(self_path);
         return 1;
     }
+    free(self_path);
 
-    execve(SOURCE_PROG, argv, environ);
+    execve(source_prog, argv, environ);
     
     fprintf(stderr, "%s: cannot run `%s': %s\n",
-        argv[0], SOURCE_PROG, strerror(errno));
+        argv[0], source_prog, strerror(errno));
 
     return 1;
 }
diff --git a/nixos/modules/security/wrappers/wrapper.nix b/nixos/modules/security/wrappers/wrapper.nix
index aec43412404..e3620fb222d 100644
--- a/nixos/modules/security/wrappers/wrapper.nix
+++ b/nixos/modules/security/wrappers/wrapper.nix
@@ -1,4 +1,4 @@
-{ stdenv, linuxHeaders, sourceProg, debug ? false }:
+{ stdenv, linuxHeaders, parentWrapperDir, debug ? false }:
 # For testing:
 # $ nix-build -E 'with import <nixpkgs> {}; pkgs.callPackage ./wrapper.nix { parentWrapperDir = "/run/wrappers"; debug = true; }'
 stdenv.mkDerivation {
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   dontUnpack = true;
   hardeningEnable = [ "pie" ];
   CFLAGS = [
-    ''-DSOURCE_PROG="${sourceProg}"''
+    ''-DWRAPPER_DIR="${parentWrapperDir}"''
   ] ++ (if debug then [
     "-Werror" "-Og" "-g"
   ] else [
diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix
index bf1688feb19..5172371d0af 100644
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@@ -137,14 +137,8 @@ let
       magicOrExtension = ''\x00asm'';
       mask = ''\xff\xff\xff\xff'';
     };
-    x86_64-windows = {
-      magicOrExtension = "exe";
-      recognitionType = "extension";
-    };
-    i686-windows = {
-      magicOrExtension = "exe";
-      recognitionType = "extension";
-    };
+    x86_64-windows.magicOrExtension = "MZ";
+    i686-windows.magicOrExtension = "MZ";
   };
 
 in {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 4354fb3ad62..19aaac69459 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -434,7 +434,7 @@ in {
   lightdm = handleTest ./lightdm.nix {};
   lighttpd = handleTest ./lighttpd.nix {};
   limesurvey = handleTest ./limesurvey.nix {};
-  listmonk = handleTest ./listmonk.nix {};
+  listmonk = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./listmonk.nix {};
   litestream = handleTest ./litestream.nix {};
   lldap = handleTest ./lldap.nix {};
   locate = handleTest ./locate.nix {};
diff --git a/nixos/tests/listmonk.nix b/nixos/tests/listmonk.nix
index 91003653c09..938c36026a7 100644
--- a/nixos/tests/listmonk.nix
+++ b/nixos/tests/listmonk.nix
@@ -42,20 +42,27 @@ import ./make-test-python.nix ({ lib, ... }: {
     machine.wait_for_open_port(9000)
     machine.succeed("[[ -f /var/lib/listmonk/.db_settings_initialized ]]")
 
+    assert json.loads(machine.succeed(generate_listmonk_request("GET", 'health')))['data'], 'Health endpoint returned unexpected value'
+
+    # A sample subscriber is guaranteed to exist at install-time
+    # A sample transactional template is guaranteed to exist at install-time
+    subscribers = json.loads(machine.succeed(generate_listmonk_request('GET', "subscribers")))['data']['results']
+    templates = json.loads(machine.succeed(generate_listmonk_request('GET', "templates")))['data']
+    tx_template = templates[2]
+
     # Test transactional endpoint
-    # subscriber_id=1 is guaranteed to exist at install-time
-    # template_id=2 is guaranteed to exist at install-time and is a transactional template (1 is a campaign template).
-    machine.succeed(
-      generate_listmonk_request('POST', 'tx', data={'subscriber_id': 1, 'template_id': 2})
-    )
-    assert 'Welcome John Doe' in machine.succeed(
+    print(machine.succeed(
+      generate_listmonk_request('POST', 'tx', data={'subscriber_id': subscribers[0]['id'], 'template_id': tx_template['id']})
+    ))
+
+    assert 'Welcome Anon Doe' in machine.succeed(
         "curl --fail http://localhost:8025/api/v2/messages"
-    )
+    ), "Failed to find Welcome John Doe inside the messages API endpoint"
 
     # Test campaign endpoint
     # Based on https://github.com/knadh/listmonk/blob/174a48f252a146d7e69dab42724e3329dbe25ebe/cmd/campaigns.go#L549 as docs do not exist.
     campaign_data = json.loads(machine.succeed(
-      generate_listmonk_request('POST', 'campaigns/1/test', data={'template_id': 1, 'subscribers': ['john@example.com'], 'name': 'Test', 'subject': 'NixOS is great', 'lists': [1], 'messenger': 'email'})
+      generate_listmonk_request('POST', 'campaigns/1/test', data={'template_id': templates[0]['id'], 'subscribers': ['john@example.com'], 'name': 'Test', 'subject': 'NixOS is great', 'lists': [1], 'messenger': 'email'})
     ))
 
     assert campaign_data['data']  # This is a boolean asserting if the test was successful or not: https://github.com/knadh/listmonk/blob/174a48f252a146d7e69dab42724e3329dbe25ebe/cmd/campaigns.go#L626
diff --git a/nixos/tests/wrappers.nix b/nixos/tests/wrappers.nix
index 1f5f4328638..391e9b42b45 100644
--- a/nixos/tests/wrappers.nix
+++ b/nixos/tests/wrappers.nix
@@ -84,17 +84,6 @@ in
       test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -g', '0')
       test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -rg', '0')
 
-      # Test that in nonewprivs environment the wrappers simply exec their target.
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -u', '${toString userUid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
-
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -g', '${toString usersGid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
-
       # We are only testing the permitted set, because it's easiest to look at with capsh.
       machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
       machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
diff --git a/pkgs/applications/editors/kakoune/default.nix b/pkgs/applications/editors/kakoune/default.nix
index 77d75eb131f..11ed7036399 100644
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "kakoune-unwrapped";
-  version = "2022.10.31";
+  version = "2023.08.05";
   src = fetchFromGitHub {
     repo = "kakoune";
     owner = "mawww";
     rev = "v${version}";
-    sha256 = "sha256-vmzGaGl0KSjseSD/s6DXxvMUTmAle+Iv/ZP9llaFnXk=";
+    sha256 = "sha256-RR3kw39vEjsg+6cIY6cK2i3ecGHlr1yzuBKaDtGlOGo=";
   };
   makeFlags = [ "debug=no" "PREFIX=${placeholder "out"}" ];
 
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 69eae1d73dd..e1a35810de7 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.14.3";
+  version = "0.15.6";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vH+wQ3pPz70jc3QzD/0vbKMqQtYak8UGoQmEgeYbFbk=";
+    hash = "sha256-0y07EPF/1oq4FqiJFNZgnUeesJzU0+jxlQ4zg1M5Xzk=";
   };
 
   vendorHash = null;
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   ldflags = [
     "-s" "-w"
-    "-X github.com/cilium/cilium-cli/internal/cli/cmd.Version=${version}"
+    "-X github.com/cilium/cilium-cli/cli.Version=${version}"
   ];
 
   # Required to workaround install check error:
@@ -41,7 +41,7 @@ buildGoModule rec {
     description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
     license = licenses.asl20;
     homepage = "https://www.cilium.io/";
-    maintainers = with maintainers; [ humancalico bryanasdev000 ];
+    maintainers = with maintainers; [ humancalico bryanasdev000 qjoly ];
     mainProgram = "cilium";
   };
 }
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 1a2ecf37158..39ed7bff43a 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -167,8 +167,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.5.5";
-    hash = "sha256-SBS3a/CIUdyIUJvc+rANIs+oXCQgfZut8b0517QKq64=";
+    version = "1.5.6";
+    hash = "sha256-vbV8Tmas7n1o8Q+DG9RrcfdAMa4bJsVg2SsTFH1TJ5M=";
     vendorHash = "sha256-lQgWNMBf+ioNxzAV7tnTQSIS840XdI9fg9duuwoK+U4=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index 940d6bf2afb..cfc92f26953 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -5,23 +5,23 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.48.6";
+  version = "0.50.6";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-pvDZfKITFrhtLnewAhRGjwu45zj2q3usNSr9U2xb52Y=";
+    hash = "sha256-h6Qz27zWAN0mxDok2dpxlE0qLP2ECwMjiCZxg+9T/dw=";
   };
 
-  vendorHash = "sha256-5Umoqi2D6iUk2Ut7YB/nmkOyA6Rx2qFhy/ZbfqoX5qA=";
+  vendorHash = "sha256-ZpLQcWi3qYTsy6BUZbHFFmhWG6CWqcb/NuzPLOUtKfs=";
 
   doCheck = false;
 
   ldflags = [
     "-s"
     "-w"
-    "-X main.VERSION=v${version}"
+    "-X github.com/gruntwork-io/go-commons/version.Version=v${version}"
   ];
 
   doInstallCheck = true;
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index 3e6fa0d9249..7938708ca6a 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -21,11 +21,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    hash = "sha256-EgH8mt0am2l9z4csGHH6rpLqTzFiBRzOPB4NCEP8TUM=";
+    hash = "sha256-Erh7tR6WX8pt89PRicgbVZd8CLlv18Vyq44O+ZnJVzU=";
   };
 
   format = "pyproject";
diff --git a/pkgs/applications/networking/irc/halloy/Cargo.lock b/pkgs/applications/networking/irc/halloy/Cargo.lock
index d76825a8485..5d545ee3d1f 100644
--- a/pkgs/applications/networking/irc/halloy/Cargo.lock
+++ b/pkgs/applications/networking/irc/halloy/Cargo.lock
@@ -70,6 +70,12 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
+
 [[package]]
 name = "android-activity"
 version = "0.4.1"
@@ -161,13 +167,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "bincode"
-version = "1.3.3"
+name = "base64"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
+checksum = "604178f6c5c21f02dc555784810edfb88d34ac2c73b2eae109655649ee73ce3d"
 
 [[package]]
 name = "bit-set"
@@ -452,8 +455,9 @@ dependencies = [
 
 [[package]]
 name = "cosmic-text"
-version = "0.8.0"
-source = "git+https://github.com/hecrj/cosmic-text.git?rev=e8b10fd675832cb9c1cc9de30922beb4cf883876#e8b10fd675832cb9c1cc9de30922beb4cf883876"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0b68966c2543609f8d92f9d33ac3b719b2a67529b0c6c0b3e025637b477eef9"
 dependencies = [
  "aliasable",
  "fontdb",
@@ -542,7 +546,7 @@ dependencies = [
 name = "data"
 version = "0.1.0"
 dependencies = [
- "bincode",
+ "base64",
  "chrono",
  "dirs-next",
  "flate2",
@@ -556,6 +560,7 @@ dependencies = [
  "rand_chacha",
  "seahash",
  "serde",
+ "serde_json",
  "serde_yaml",
  "thiserror",
  "tokio",
@@ -623,70 +628,6 @@ dependencies = [
  "winreg",
 ]
 
-[[package]]
-name = "encoding"
-version = "0.2.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b0d943856b990d12d3b55b359144ff341533e516d94098b1d3fc1ac666d36ec"
-dependencies = [
- "encoding-index-japanese",
- "encoding-index-korean",
- "encoding-index-simpchinese",
- "encoding-index-singlebyte",
- "encoding-index-tradchinese",
-]
-
-[[package]]
-name = "encoding-index-japanese"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04e8b2ff42e9a05335dbf8b5c6f7567e5591d0d916ccef4e0b1710d32a0d0c91"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding-index-korean"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dc33fb8e6bcba213fe2f14275f0963fd16f0a02c878e3095ecfdf5bee529d81"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding-index-simpchinese"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d87a7194909b9118fc707194baa434a4e3b0fb6a5a757c73c3adb07aa25031f7"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding-index-singlebyte"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3351d5acffb224af9ca265f435b859c7c01537c0849754d3db3fdf2bfe2ae84a"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding-index-tradchinese"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd0e20d5688ce3cab59eb3ef3a2083a5c77bf496cb798dc6fcdb75f323890c18"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding_index_tests"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
-
 [[package]]
 name = "errno"
 version = "0.3.1"
@@ -720,9 +661,9 @@ dependencies = [
 
 [[package]]
 name = "etagere"
-version = "0.2.7"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6301151a318f367f392c31395beb1cfba5ccd9abc44d1db0db3a4b27b9601c89"
+checksum = "fcf22f748754352918e082e0039335ee92454a5d62bcaf69b5e8daf5907d9644"
 dependencies = [
  "euclid",
  "svg_fmt",
@@ -939,9 +880,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c85e1d9ab2eadba7e5040d4e09cbd6d072b76a557ad64e797c2cb9d4da21d7e4"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -986,8 +927,9 @@ dependencies = [
 
 [[package]]
 name = "glyphon"
-version = "0.2.0"
-source = "git+https://github.com/hecrj/glyphon.git?rev=8dbf36020e5759fa9144517b321372266160113e#8dbf36020e5759fa9144517b321372266160113e"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e87caa7459145f5e5f167bf34db4532901404c679e62339fb712a0e3ccf722a"
 dependencies = [
  "cosmic-text",
  "etagere",
@@ -1059,9 +1001,9 @@ dependencies = [
 
 [[package]]
 name = "half"
-version = "2.3.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9906a89f1724975a455316ae0554ceaa45ad83bb336f1125a87bfbdb9197cfa0"
+checksum = "bc52e53916c08643f1b56ec082790d1e86a32e58dc5268f897f313fbae7b4872"
 dependencies = [
  "cfg-if",
  "crunchy",
@@ -1076,7 +1018,9 @@ dependencies = [
  "embed-resource",
  "fern",
  "iced",
+ "image",
  "log",
+ "once_cell",
  "open",
  "palette",
  "thiserror",
@@ -1096,11 +1040,12 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.13.2"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e"
+checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
 dependencies = [
  "ahash 0.8.3",
+ "allocator-api2",
 ]
 
 [[package]]
@@ -1135,9 +1080,9 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
+checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
 
 [[package]]
 name = "hexf-parse"
@@ -1171,7 +1116,7 @@ dependencies = [
 [[package]]
 name = "iced"
 version = "0.9.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "iced_core",
  "iced_futures",
@@ -1185,7 +1130,7 @@ dependencies = [
 [[package]]
 name = "iced_core"
 version = "0.9.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "bitflags 1.3.2",
  "instant",
@@ -1198,7 +1143,7 @@ dependencies = [
 [[package]]
 name = "iced_futures"
 version = "0.6.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "futures",
  "iced_core",
@@ -1211,28 +1156,29 @@ dependencies = [
 [[package]]
 name = "iced_graphics"
 version = "0.8.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "bitflags 1.3.2",
  "bytemuck",
  "glam",
+ "half",
  "iced_core",
  "image",
  "kamadak-exif",
  "log",
  "raw-window-handle",
  "thiserror",
- "tiny-skia 0.9.1",
 ]
 
 [[package]]
 name = "iced_renderer"
 version = "0.1.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "iced_graphics",
  "iced_tiny_skia",
  "iced_wgpu",
+ "log",
  "raw-window-handle",
  "thiserror",
 ]
@@ -1240,7 +1186,7 @@ dependencies = [
 [[package]]
 name = "iced_runtime"
 version = "0.1.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "iced_core",
  "iced_futures",
@@ -1250,7 +1196,7 @@ dependencies = [
 [[package]]
 name = "iced_style"
 version = "0.8.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "iced_core",
  "once_cell",
@@ -1260,7 +1206,7 @@ dependencies = [
 [[package]]
 name = "iced_tiny_skia"
 version = "0.1.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "bytemuck",
  "cosmic-text",
@@ -1270,14 +1216,14 @@ dependencies = [
  "raw-window-handle",
  "rustc-hash",
  "softbuffer",
- "tiny-skia 0.9.1",
+ "tiny-skia 0.10.0",
  "twox-hash",
 ]
 
 [[package]]
 name = "iced_wgpu"
 version = "0.10.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "bitflags 1.3.2",
  "bytemuck",
@@ -1297,7 +1243,7 @@ dependencies = [
 [[package]]
 name = "iced_widget"
 version = "0.1.0"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "iced_renderer",
  "iced_runtime",
@@ -1311,7 +1257,7 @@ dependencies = [
 [[package]]
 name = "iced_winit"
 version = "0.9.1"
-source = "git+https://github.com/tarkah/iced?rev=d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65#d73dba1f1c2dda7f58c9983e7ee8fbac6f563a65"
+source = "git+https://github.com/iced-rs/iced?rev=78dc341ea82449f1e075e37e67c1ccf66b88e8d6#78dc341ea82449f1e075e37e67c1ccf66b88e8d6"
 dependencies = [
  "iced_graphics",
  "iced_runtime",
@@ -1372,44 +1318,31 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
 dependencies = [
- "hermit-abi 0.3.1",
+ "hermit-abi 0.3.2",
  "libc",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "irc"
-version = "0.15.0"
-source = "git+https://github.com/aatxe/irc.git?rev=8eef9c56881670aa614782ab4321fb8ae3975fa0#8eef9c56881670aa614782ab4321fb8ae3975fa0"
+version = "0.1.0"
 dependencies = [
- "chrono",
- "encoding",
- "futures-util",
- "irc-proto",
- "log",
- "native-tls",
- "parking_lot 0.12.1",
- "pin-project",
- "serde",
- "serde_derive",
+ "bytes",
+ "futures",
+ "irc_proto",
  "thiserror",
  "tokio",
  "tokio-native-tls",
- "tokio-stream",
  "tokio-util",
- "toml",
 ]
 
 [[package]]
-name = "irc-proto"
-version = "0.15.0"
-source = "git+https://github.com/aatxe/irc.git?rev=8eef9c56881670aa614782ab4321fb8ae3975fa0#8eef9c56881670aa614782ab4321fb8ae3975fa0"
+name = "irc_proto"
+version = "0.1.0"
 dependencies = [
- "bytes",
- "encoding",
+ "itertools",
+ "nom",
  "thiserror",
- "tokio",
- "tokio-util",
 ]
 
 [[package]]
@@ -1440,6 +1373,12 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itoa"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+
 [[package]]
 name = "jni-sys"
 version = "0.3.0"
@@ -1516,9 +1455,9 @@ checksum = "03087c2bad5e1034e8cace5926dec053fb3790248370865f5117a7d0213354c8"
 
 [[package]]
 name = "libc"
-version = "0.2.144"
+version = "0.2.147"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b00cc1c228a6782d0f076e7b232802e0c5689d41bb5df366f2a6b6621cfdfe1"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
 
 [[package]]
 name = "libloading"
@@ -1576,11 +1515,11 @@ checksum = "518ef76f2f87365916b142844c16d8fefd85039bc5699050210a7778ee1cd1de"
 
 [[package]]
 name = "lru"
-version = "0.9.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e7d46de488603ffdd5f30afbc64fbba2378214a2c3a2fb83abf3d33126df17"
+checksum = "eedb2bdbad7e0634f83989bf596f497b070130daaa398ab22d84c39e266deec5"
 dependencies = [
- "hashbrown 0.13.2",
+ "hashbrown 0.14.0",
 ]
 
 [[package]]
@@ -1991,9 +1930,9 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.54"
+version = "0.10.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69b3f656a17a6cbc115b5c7a40c616947d213ba182135b014d6051b73ab6f019"
+checksum = "345df152bc43501c5eb9e4654ff05f794effb78d4efe3d53abc158baddc0703d"
 dependencies = [
  "bitflags 1.3.2",
  "cfg-if",
@@ -2023,9 +1962,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.88"
+version = "0.9.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2ce0f250f34a308dcfdbb351f511359857d4ed2134ba715a4eadd46e1ffd617"
+checksum = "374533b0e45f3a7ced10fcaeccca020e66656bc03dac384f852e4e5a7a8104a6"
 dependencies = [
  "cc",
  "libc",
@@ -2602,6 +2541,17 @@ dependencies = [
  "syn 2.0.18",
 ]
 
+[[package]]
+name = "serde_json"
+version = "1.0.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46266871c240a00b8f503b877622fe33430b3c7d963bdc0f2adc511e54a1eae3"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
 [[package]]
 name = "serde_spanned"
 version = "0.6.2"
@@ -2900,9 +2850,9 @@ dependencies = [
 
 [[package]]
 name = "tiny-skia"
-version = "0.9.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2986c82f77818c7b9144c70818fdde98db15308e329ae2f7204d767808fd3c"
+checksum = "7db11798945fa5c3e5490c794ccca7c6de86d3afdd54b4eb324109939c6f37bc"
 dependencies = [
  "arrayref",
  "arrayvec",
@@ -2910,7 +2860,7 @@ dependencies = [
  "cfg-if",
  "log",
  "png",
- "tiny-skia-path 0.9.0",
+ "tiny-skia-path 0.10.0",
 ]
 
 [[package]]
@@ -2926,9 +2876,9 @@ dependencies = [
 
 [[package]]
 name = "tiny-skia-path"
-version = "0.9.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7acb0ccda1ac91084353a56d0b69b0e29c311fd809d2088b1ed2f9ae1841c47"
+checksum = "2f60aa35c89ac2687ace1a2556eaaea68e8c0d47408a2e3e7f5c98a489e7281c"
 dependencies = [
  "arrayref",
  "bytemuck",
@@ -2952,21 +2902,35 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.28.2"
+version = "1.29.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94d7b1cfd2aa4011f2de74c2c4c63665e27a71006b0a192dcd2710272e73dfa2"
+checksum = "532826ff75199d5833b9d2c5fe410f29235e25704ee5f0ef599fb51c21f4a4da"
 dependencies = [
  "autocfg",
+ "backtrace",
  "bytes",
  "libc",
  "mio",
  "num_cpus",
+ "parking_lot 0.12.1",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
+ "tokio-macros",
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "tokio-macros"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.18",
+]
+
 [[package]]
 name = "tokio-native-tls"
 version = "0.3.1"
diff --git a/pkgs/applications/networking/irc/halloy/default.nix b/pkgs/applications/networking/irc/halloy/default.nix
index a1d5a38947c..eb54490c60b 100644
--- a/pkgs/applications/networking/irc/halloy/default.nix
+++ b/pkgs/applications/networking/irc/halloy/default.nix
@@ -2,6 +2,8 @@
 , stdenv
 , darwin
 , fetchFromGitHub
+, copyDesktopItems
+, makeDesktopItem
 , libxkbcommon
 , openssl
 , pkg-config
@@ -13,27 +15,25 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "halloy";
-  version = "23.1-alpha1";
+  version = "2023.4";
 
   src = fetchFromGitHub {
     owner = "squidowl";
     repo = "halloy";
     rev = "refs/tags/${version}";
-    hash = "sha256-Aq+mKctmc1RwpnUEIi+Zmr4o8n6wgQchGCunPWouLsE=";
+    hash = "sha256-j5Yw7rXdNd32RnbV2jQ+ZUjbm14AKZ7khQNX6A+qPAM=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "cosmic-text-0.8.0" = "sha256-p8PtXcFH+T3z6wWPFYbHFkxrkJpK4oHJ1aJvq4zld/4=";
-      "glyphon-0.2.0" = "sha256-7h5W82zPMw9PVZiF5HCo7HyRiVhGR8MsfgGuIjo+Kfg=";
-      "iced-0.9.0" = "sha256-KEBm62lDjSKXvXZssLoBfUYDSW+OpTXutxsKZMz8SE0=";
-      "irc-0.15.0" = "sha256-ZlwfyX4tmQr9D+blY4jWl85bwJ2tXUYp3ryLqoungII=";
+      "iced-0.9.0" = "sha256-z/tkUdFXNjxR5Si8dnNrkrvFos0VAqGjnFNSs88D/5w=";
       "winit-0.28.6" = "sha256-szB1LCOPmPqhZNIWbeO8JMfRMcMRr0+Ze0f4uqyR8AE=";
     };
   };
 
   nativeBuildInputs = [
+    copyDesktopItems
     pkg-config
   ];
 
@@ -57,6 +57,25 @@ rustPlatform.buildRustPackage rec {
     wayland
   ];
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = "org.squidowl.halloy";
+      desktopName = "Halloy";
+      comment = "IRC client written in Rust";
+      icon = "org.squidowl.halloy";
+      exec = pname;
+      terminal = false;
+      mimeTypes = [ "x-scheme-handler/irc" "x-scheme-handler/ircs" ];
+      categories = [ "Network" "IRCClient" ];
+      keywords = [ "IM" "Chat" ];
+      startupWMClass = "org.squidowl.halloy";
+    })
+  ];
+
+  postInstall = ''
+    install -Dm644 assets/linux/org.squidowl.halloy.png $out/share/icons/hicolor/128x128/apps/org.squidowl.halloy.png
+  '';
+
   meta = with lib; {
     description = "IRC application";
     homepage = "https://github.com/squidowl/halloy";
diff --git a/pkgs/applications/networking/netmaker/default.nix b/pkgs/applications/networking/netmaker/default.nix
index dab2a9406f9..0c5755d134a 100644
--- a/pkgs/applications/networking/netmaker/default.nix
+++ b/pkgs/applications/networking/netmaker/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "netmaker";
-  version = "0.20.5";
+  version = "0.20.6";
 
   src = fetchFromGitHub {
     owner = "gravitl";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bnYIyYnJhrdI8zfeOBdab8yZuK2rxTO5YO6EKlaRlHo=";
+    hash = "sha256-2NrqplVduDsaLGla1rzLGhX1YgZL6NBFFDVQRen7Pfk=";
   };
 
-  vendorHash = "sha256-Nz1vE3SelUdgJoGQLOBXtFwAtM1VTDL9oKDQqxVi8Vg=";
+  vendorHash = "sha256-TrVtUv1xlz3Wbw4RY4NAzWmPE8JVk+GqPveqvfTe8e4=";
 
   inherit subPackages;
 
@@ -39,6 +39,6 @@ buildGoModule rec {
     homepage = "https://netmaker.io";
     changelog = "https://github.com/gravitl/netmaker/-/releases/v${version}";
     license = licenses.sspl;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ urandom qjoly ];
   };
 }
diff --git a/pkgs/applications/science/math/geogebra/geogebra6.nix b/pkgs/applications/science/math/geogebra/geogebra6.nix
index 4cfcb6debbe..38b668804ad 100644
--- a/pkgs/applications/science/math/geogebra/geogebra6.nix
+++ b/pkgs/applications/science/math/geogebra/geogebra6.nix
@@ -30,7 +30,7 @@ let
     src = fetchurl {
       urls = [
         "https://download.geogebra.org/installers/6.0/GeoGebra-Linux64-Portable-${version}.zip"
-        "https://web.archive.org/web/20230627211859/https://download.geogebra.org/installers/6.0/GeoGebra-Linux64-Portable-${version}.zip"
+        "https://web.archive.org/web/20230824011801/https://download.geogebra.org/installers/6.0/GeoGebra-Linux64-Portable-${version}.zip"
       ];
       hash = "sha256-sNCq1Xcx/Y5r+SIRiqQYcG9dVsfIC2Ef5KJf+tgfxC8=";
     };
@@ -65,9 +65,9 @@ let
     src = fetchurl {
       urls = [
         "https://download.geogebra.org/installers/6.0/GeoGebra-Classic-6-MacOS-Portable-${version}.zip"
-        "https://web.archive.org/web/20230627214413/https://download.geogebra.org/installers/6.0/GeoGebra-Classic-6-MacOS-Portable-${version}.zip"
+        "https://web.archive.org/web/20230824012900/https://download.geogebra.org/installers/6.0/GeoGebra-Classic-6-MacOS-Portable-${version}.zip"
       ];
-      hash = "sha256-HtIhhq8E1Q5B6xZ7q6Ok95Rt53VWLoGf8PbY+UEOSKg=";
+      hash = "sha256-CrSoKAjXiejfJHyv8wIpcRr2d8u/50HnatiDm1CdnGQ=";
     };
 
     dontUnpack = true;
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index f6baa42348a..4ec5531192d 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -494,7 +494,7 @@ rec {
     fi
     diskImage="$1"
     if ! test -e "$diskImage"; then
-      ${qemu}/bin/qemu-img create -b ${image}/disk-image.qcow2 -f qcow2 "$diskImage"
+      ${qemu}/bin/qemu-img create -b ${image}/disk-image.qcow2 -f qcow2 -F qcow2 "$diskImage"
     fi
     export TMPDIR=$(mktemp -d)
     export out=/dummy
diff --git a/pkgs/development/interpreters/mujs/default.nix b/pkgs/development/interpreters/mujs/default.nix
index 881d0bbf1b4..f937a71fbd4 100644
--- a/pkgs/development/interpreters/mujs/default.nix
+++ b/pkgs/development/interpreters/mujs/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "prefix=$(out)" ];
 
+  installFlags = [ "install-shared" ];
+
   passthru.updateScript = gitUpdater {
     # No nicer place to track releases
     url = "git://git.ghostscript.com/mujs.git";
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 3494ce92ddd..227c0f608df 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -2,9 +2,7 @@
 , boto3
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , jsonschema
-, mock
 , parameterized
 , pydantic
 , pytest-env
@@ -18,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.60.1";
+  version = "1.73.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +25,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "serverless-application-model";
     rev = "refs/tags/v${version}";
-    hash = "sha256-exVB1STX8OsFnQ0pzSuR3O/FrvG2GR5MdZa8tZ9IJvI=";
+    hash = "sha256-rj+q/06gIvPYTJP/EH9ZrP0Sp4J3K1aCRyNkgpphWP4=";
   };
 
   propagatedBuildInputs = [
@@ -37,17 +35,8 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
-  patches = [
-    (fetchpatch {
-      # relax typing-extenions dependency
-      url = "https://github.com/aws/serverless-application-model/commit/d1c26f7ad9510a238ba570d511d5807a81379d0a.patch";
-      hash = "sha256-nh6MtRgi0RrC8xLkLbU6/Ec0kYtxIG/fgjn/KLiAM0E=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace requirements/base.txt \
-      --replace "jsonschema~=3.2" "jsonschema>=3.2"
+  preCheck = ''
+    sed -i '2ienv =\n\tAWS_DEFAULT_REGION=us-east-1' pytest.ini
     substituteInPlace pytest.ini \
       --replace " --cov samtranslator --cov-report term-missing --cov-fail-under 95" ""
   '';
@@ -61,15 +50,13 @@ buildPythonPackage rec {
     pyyaml
   ];
 
-  doCheck = false; # tests fail in weird ways
-
   pythonImportsCheck = [
     "samtranslator"
   ];
 
   meta = with lib; {
     description = "Python library to transform SAM templates into AWS CloudFormation templates";
-    homepage = "https://github.com/awslabs/serverless-application-model";
+    homepage = "https://github.com/aws/serverless-application-model";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index f7c9ce32bb8..cdccecf72b0 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -2,17 +2,27 @@
 , amqp
 , azure-identity
 , azure-servicebus
+, azure-storage-queue
 , backports-zoneinfo
+, boto3
 , buildPythonPackage
 , case
+, confluent-kafka
 , fetchPypi
 , hypothesis
-, pyro4
+, kazoo
+, msgpack
+, pycurl
+, pymongo
+  #, pyro4
 , pytestCheckHook
 , pythonOlder
-, pytz
-, vine
+, pyyaml
+, redis
+, sqlalchemy
 , typing-extensions
+, urllib3
+, vine
 }:
 
 buildPythonPackage rec {
@@ -36,24 +46,65 @@ buildPythonPackage rec {
     backports-zoneinfo
   ];
 
+  passthru.optional-dependencies = {
+    msgpack = [
+      msgpack
+    ];
+    yaml = [
+      pyyaml
+    ];
+    redis = [
+      redis
+    ];
+    mongodb = [
+      pymongo
+    ];
+    sqs = [
+      boto3
+      urllib3
+      pycurl
+    ];
+    zookeeper = [
+      kazoo
+    ];
+    sqlalchemy = [
+      sqlalchemy
+    ];
+    azurestoragequeues = [
+      azure-identity
+      azure-storage-queue
+    ];
+    azureservicebus = [
+      azure-servicebus
+    ];
+    confluentkafka = [
+      confluent-kafka
+    ];
+    # pyro4 doesn't suppport Python 3.11
+    #pyro = [
+    #  pyro4
+    #];
+  };
+
   nativeCheckInputs = [
-    azure-identity
-    azure-servicebus
     case
     hypothesis
-    pyro4
     pytestCheckHook
-    pytz
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "kombu"
   ];
 
+  disabledTests = [
+    # Disable pyro4 test
+    "test_driver_version"
+  ];
+
   meta = with lib; {
-    changelog = "https://github.com/celery/kombu/releases/tag/v${version}";
     description = "Messaging library for Python";
     homepage = "https://github.com/celery/kombu";
+    changelog = "https://github.com/celery/kombu/releases/tag/v${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyxlsb/default.nix b/pkgs/development/python-modules/pyxlsb/default.nix
new file mode 100644
index 00000000000..df000db7e25
--- /dev/null
+++ b/pkgs/development/python-modules/pyxlsb/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "pyxlsb";
+  version = "1.0.10";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-gGLR6oYm0/GYDosc/pGkSDdHRJJC7LYQE7wt+FQ19oU=";
+  };
+
+  # package has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "pyxlsb" ];
+
+  meta = with lib; {
+    description = "Excel 2007-2010 Binary Workbook (xlsb) parser";
+    homepage = "https://github.com/willtrnr/pyxlsb";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index f1a61014e49..bcf6f5afa78 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 , cached-property
 , packaging
-, pdm-pep517
+, pdm-backend
 , requests
 , flask
 , pytest-httpserver
@@ -15,18 +15,18 @@
 
 buildPythonPackage rec {
   pname = "unearth";
-  version = "0.9.2";
+  version = "0.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hF9LVzOHTOO0JyEm3kluq+AKSa1nj90E1ILR533u1CU=";
+    hash = "sha256-1bFSpasqo+UUmhHPezulxdSTF23KOPZsqJadrdWo9kU=";
   };
 
   nativeBuildInputs = [
-    pdm-pep517
+    pdm-backend
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/rust/specr-transpile/default.nix b/pkgs/development/tools/rust/specr-transpile/default.nix
index b41e18f565b..e5290700c31 100644
--- a/pkgs/development/tools/rust/specr-transpile/default.nix
+++ b/pkgs/development/tools/rust/specr-transpile/default.nix
@@ -5,14 +5,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "specr-transpile";
-  version = "0.1.21";
+  version = "0.1.22";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-tFiCE6UJ7Jl/KJ7efwcHrX511Rs14ck4a7eY4dpusUc=";
+    hash = "sha256-D3UdQ3L7fSSFWlVSjqjEUqNCQebMHOtZnJqO7sBjm14=";
   };
 
-  cargoHash = "sha256-zBo1tLyfNSt04TuYP/SYmqC0ov9HmuXF013EqvrvY20=";
+  cargoHash = "sha256-f0Gwxr7J56Q11Rv26mycCYbCidr5bXUwo4kmnVWMCz4=";
 
   meta = with lib; {
     description = "Converts Specr lang code to Rust";
diff --git a/pkgs/games/path-of-building/default.nix b/pkgs/games/path-of-building/default.nix
index c4242eb4ea0..f08f4de54bb 100644
--- a/pkgs/games/path-of-building/default.nix
+++ b/pkgs/games/path-of-building/default.nix
@@ -2,13 +2,13 @@
 let
   data = stdenv.mkDerivation(finalAttrs: {
     pname = "path-of-building-data";
-    version = "2.31.2";
+    version = "2.32.2";
 
     src = fetchFromGitHub {
       owner = "PathOfBuildingCommunity";
       repo = "PathOfBuilding";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-E178uYVQ+B08h1lM7h+hwfMb08VZK+r25pD4haT1tc8=";
+      hash = "sha256-1JwnKx5ohwFGdPlgaqXwTIPcfXmH+2GJRBbQhF46mTY=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 6148e5b6f3e..f6ce1b2d61d 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,71 +2,71 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.322-hardened1.patch",
-            "sha256": "1hshlg5b6n4i3zvx8rg3rnn16indg616sa4dy85w4pfcbjdzyzd3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.322-hardened1/linux-hardened-4.14.322-hardened1.patch"
+            "name": "linux-hardened-4.14.323-hardened1.patch",
+            "sha256": "0id59byd331mz8ga02gbs3g1q0y4n2wz6mi9s0dmp1yjagjd9m70",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.323-hardened1/linux-hardened-4.14.323-hardened1.patch"
         },
-        "sha256": "1r71g5p0cnbi0nixv91nyhv24dqmvh49rqb2lnbhsdq81fqm8ssm",
-        "version": "4.14.322"
+        "sha256": "1g2fh0mn1sv0kq2hh3pynmx2fjai7hdwhf4fnaspl7j5n88902kg",
+        "version": "4.14.323"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.291-hardened1.patch",
-            "sha256": "0mjrmgb1hqahk5l3sghyac5vza6my3sjldfh8xn498p5jq4bpdhj",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.291-hardened1/linux-hardened-4.19.291-hardened1.patch"
+            "name": "linux-hardened-4.19.292-hardened1.patch",
+            "sha256": "1na729sricp347jqp3y2j4yxxg84haa62mwmj9zq0pa1k6f037ph",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.292-hardened1/linux-hardened-4.19.292-hardened1.patch"
         },
-        "sha256": "0cxmq8mrkw179jb8sqvad3dskllwn579g2lxcjn21jyqsf85nwz6",
-        "version": "4.19.291"
+        "sha256": "0dr12v4jqmzxcqdghqqjny5zp3g4dx9lxqrl9d4fxz23s79ji5rl",
+        "version": "4.19.292"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.190-hardened1.patch",
-            "sha256": "1w2ncb3ay8kbw7cfb0gm9q01n14npyvy6l9sqcma409hfgjnq7jv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.190-hardened1/linux-hardened-5.10.190-hardened1.patch"
+            "name": "linux-hardened-5.10.191-hardened1.patch",
+            "sha256": "02949v0qrr4b76g9rl1z8lkdfv3mc1pfb4h14z9bd0dqg5shlz0j",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.191-hardened1/linux-hardened-5.10.191-hardened1.patch"
         },
-        "sha256": "15zmz9pg91gph2dhigjf1z3w6gkv1kwslki5dpzhgzs03pq3swi9",
-        "version": "5.10.190"
+        "sha256": "1hk2x5dgvfq9v6161v25wz5qpzgyvqbx34xbm7ww8z4ish76cm6b",
+        "version": "5.10.191"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.126-hardened1.patch",
-            "sha256": "0bm1m5xwrcg0ckg68f70fx29air1bfh3gsaaaz8r29l5j1v1lqfp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.126-hardened1/linux-hardened-5.15.126-hardened1.patch"
+            "name": "linux-hardened-5.15.127-hardened1.patch",
+            "sha256": "13z0x45jig81f3vhb5w3lvb554b78888grp7w60sqgglx7bckspb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.127-hardened1/linux-hardened-5.15.127-hardened1.patch"
         },
-        "sha256": "0vzdncrvwqxzjkpgf3gjxvl8iwz92szfyzc33cayx28ghjwsmx5d",
-        "version": "5.15.126"
+        "sha256": "09lgj9hs1cjxg84hb7avras4rlsx18igr69mx433l9hv6issbl5d",
+        "version": "5.15.127"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.253-hardened1.patch",
-            "sha256": "0rhn107hbabfvxlvnfwakrwc9w7m9m5hvcx03fssalyqd17k8jx1",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.253-hardened1/linux-hardened-5.4.253-hardened1.patch"
+            "name": "linux-hardened-5.4.254-hardened1.patch",
+            "sha256": "0yh5kb23lp89qnk90lz73j101bg20npr7clx0y8zmg6dihls764z",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.254-hardened1/linux-hardened-5.4.254-hardened1.patch"
         },
-        "sha256": "1rr6mnkbw6gwdm9bqjhf4z2xqr458fn2qdv5b4mgm65a15gvmchz",
-        "version": "5.4.253"
+        "sha256": "1iyrm2xql15ifhy2b939ywrrc44yd41b79sjjim4vqxmc6lqsq2i",
+        "version": "5.4.254"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.45-hardened1.patch",
-            "sha256": "153798g37dicz8yhdcl4blsqd7j8sym3zxzkknjk7gldwh0n955m",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.45-hardened1/linux-hardened-6.1.45-hardened1.patch"
+            "name": "linux-hardened-6.1.46-hardened1.patch",
+            "sha256": "1filmigpmn3bly4f08450izq4gabn57xi1fkczcnmkphwp83rk4l",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.46-hardened1/linux-hardened-6.1.46-hardened1.patch"
         },
-        "sha256": "14piy4cwv18a0yqp4gkrvr51z4zccyhab29n9ybxinkxdqwl68xx",
-        "version": "6.1.45"
+        "sha256": "15m228bllks2p8gpsmvplx08yxzp7bij9fnmnafqszylrk7ppxpm",
+        "version": "6.1.46"
     },
     "6.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.4.10-hardened1.patch",
-            "sha256": "1chja2ry1bfl1snxhc1vwpd8p86x94c9kcxf8lbrixky3ff1972y",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.10-hardened1/linux-hardened-6.4.10-hardened1.patch"
+            "name": "linux-hardened-6.4.11-hardened1.patch",
+            "sha256": "15c8fs5dmkm2a9j66gq5c1hcbw95p4d03y71rvh6jhglpna7b3xc",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.11-hardened1/linux-hardened-6.4.11-hardened1.patch"
         },
-        "sha256": "0fgjym6y0zj7wz1byqhxmv3pc3wq412vm1dxbj4gv23pm6r3y2wq",
-        "version": "6.4.10"
+        "sha256": "0609lhgc42j9id2vvdpv8n7djabp46p2mridf9s0sg3x16snhssl",
+        "version": "6.4.11"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index a6376265233..32ce7cb0c98 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.46";
+  version = "6.1.47";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "15m228bllks2p8gpsmvplx08yxzp7bij9fnmnafqszylrk7ppxpm";
+    sha256 = "1azwvlzyp1s2adm17ic0jfmv3ph70wqzycb8s96z9987y1m8pmck";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix
index 796a5772b1b..c1a9d6abff5 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.11";
+  version = "6.4.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0609lhgc42j9id2vvdpv8n7djabp46p2mridf9s0sg3x16snhssl";
+    sha256 = "0x56b4hslm730ghvggz41fjkbzlnxp6k8857dn7iy27yavlipafc";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index e4c8d5eaed5..ae098fb1b94 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19386";
-    sha256 = "1byqf5ih3nissgjl22zs8ggmk1dxdsv6ks9jadcv8f0wn92ddlg0";
+    rev = "19392";
+    sha256 = "09d61yw3jmq1cpzp1kpnmjrnl1gxhp8p0vqnc75j05ikmibqpa4l";
   }
 , ...
 }:
diff --git a/pkgs/servers/mail/listmonk/default.nix b/pkgs/servers/mail/listmonk/default.nix
index 97ec1924c2a..7e55fde4504 100644
--- a/pkgs/servers/mail/listmonk/default.nix
+++ b/pkgs/servers/mail/listmonk/default.nix
@@ -1,17 +1,24 @@
-{ lib, buildGoModule, fetchFromGitHub, callPackage, stuffbin, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, callPackage, stuffbin, nixosTests, fetchpatch }:
 
 buildGoModule rec {
   pname = "listmonk";
-  version = "2.2.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "knadh";
     repo = "listmonk";
     rev = "v${version}";
-    sha256 = "sha256-dtIM0dkr8y+GbyCqrBlR5VRq6qMiZdmQyFvIoVY1eUg=";
+    sha256 = "sha256-gCnIblc83CmG1auvYYxqW/xBl6Oy1KHGkqSY/3yIm3I=";
   };
 
-  vendorSha256 = "sha256-qeBuDM3REUxgu3ty02d7qsULH04USE0JUvBrtVnW8vg=";
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/knadh/listmonk/pull/1479.patch";
+      hash = "sha256-SYACM8r+NgeSWn9VJV4+wkm+6s/MhNGwn5zyc2tw7FU=";
+    })
+  ];
+
+  vendorSha256 = "sha256-0sgC1+ueZTUCP+7JwI/OKLktfMHQq959GEk1mC0TQgE=";
 
   nativeBuildInputs = [
     stuffbin
diff --git a/pkgs/servers/mail/listmonk/frontend.nix b/pkgs/servers/mail/listmonk/frontend.nix
index 81e5afa8fd9..1e5cccc3641 100644
--- a/pkgs/servers/mail/listmonk/frontend.nix
+++ b/pkgs/servers/mail/listmonk/frontend.nix
@@ -5,13 +5,13 @@
 
 yarn2nix-moretea.mkYarnPackage rec {
   pname = "listmonk-frontend";
-  version = "2.2.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "knadh";
     repo = "listmonk";
     rev = "v${version}";
-    sha256 = "sha256-dtIM0dkr8y+GbyCqrBlR5VRq6qMiZdmQyFvIoVY1eUg=";
+    sha256 = "sha256-gCnIblc83CmG1auvYYxqW/xBl6Oy1KHGkqSY/3yIm3I=";
   };
 
   packageJSON = ./package.json;
diff --git a/pkgs/servers/matrix-synapse/sliding-sync/default.nix b/pkgs/servers/matrix-synapse/sliding-sync/default.nix
index bd1f7358b11..80ea7f45ca1 100644
--- a/pkgs/servers/matrix-synapse/sliding-sync/default.nix
+++ b/pkgs/servers/matrix-synapse/sliding-sync/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "matrix-sliding-sync";
-  version = "0.99.5";
+  version = "0.99.6";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "sliding-sync";
     rev = "v${version}";
-    hash = "sha256-L2cWKPVclurOCpyQezHPB+5zYD91EREBXjRYBzjxkII=";
+    hash = "sha256-t0TlmoqXaKR5PrR0vlsLU84yBdXPXmE63n6p4sMvHhs=";
   };
 
-  vendorHash = "sha256-447P2TbBUEHmHubHiiZCrFVCj2/tmEuYFzLo27UyCk4=";
+  vendorHash = "sha256-9bJ6B9/jq7q5oJGULRPoNVJiqoO+2E2QQKORy4rt6Xw=";
 
   subPackages = [ "cmd/syncv3" ];
 
diff --git a/pkgs/tools/misc/SP800-90B_EntropyAssessment/default.nix b/pkgs/tools/misc/SP800-90B_EntropyAssessment/default.nix
new file mode 100644
index 00000000000..dde0bc34924
--- /dev/null
+++ b/pkgs/tools/misc/SP800-90B_EntropyAssessment/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, bzip2
+, libdivsufsort
+, jsoncpp
+, openssl
+, mpfr
+}:
+
+stdenv.mkDerivation rec {
+  pname = "SP800-90B_EntropyAssessment";
+  version = "1.1.6";
+
+  src = fetchFromGitHub {
+    owner = "usnistgov";
+    repo = "SP800-90B_EntropyAssessment";
+    rev = "v${version}";
+    hash = "sha256-KZQ7kC0PbBkjLEQZIqYakQ91OvCxruhdfUwiRHtno3w=";
+  };
+
+  buildInputs = [ bzip2 libdivsufsort jsoncpp openssl mpfr ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace "-march=native" ""
+  '';
+
+  sourceRoot = "source/cpp";
+
+  makeFlags = [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp ea_* $out/bin
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/usnistgov/SP800-90B_EntropyAssessment";
+    description = "Implementation of min-entropy assessment methods included in Special Publication 800-90B.";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.free; #this software uses the NIST software license
+    maintainers = with lib.maintainers; [ orichter thillux ];
+  };
+}
diff --git a/pkgs/tools/misc/timetagger_cli/default.nix b/pkgs/tools/misc/timetagger_cli/default.nix
new file mode 100644
index 00000000000..38b0cc88bb1
--- /dev/null
+++ b/pkgs/tools/misc/timetagger_cli/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "timetagger_cli";
+  version = "23.8.3";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "almarklein";
+    repo = "timetagger_cli";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-vOpwMR7/EGf/l5KvlHn7mQ1vGGZ1Whd5x2uxLV9nCbk=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    requests
+    toml
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Track your time from the command-line ";
+    homepage = "https://github.com/almarklein/timetagger_cli";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ matthiasbeyer ];
+  };
+}
+
diff --git a/pkgs/tools/networking/narrowlink/Cargo.lock.patch b/pkgs/tools/networking/narrowlink/Cargo.lock.patch
new file mode 100644
index 00000000000..71e87a95c93
--- /dev/null
+++ b/pkgs/tools/networking/narrowlink/Cargo.lock.patch
@@ -0,0 +1,170 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 2d5af9d..920b315 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -952,7 +952,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "narrowlink-agent"
+-version = "0.1.3"
++version = "0.1.4"
+ dependencies = [
+  "clap_lex",
+  "dirs",
+@@ -961,8 +961,8 @@ dependencies = [
+  "futures-util",
+  "hmac",
+  "log",
+- "narrowlink-network",
+- "narrowlink-types",
++ "narrowlink-network 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
++ "narrowlink-types 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
+  "serde",
+  "serde_json",
+  "serde_yaml",
+@@ -976,7 +976,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "narrowlink-client"
+-version = "0.1.3"
++version = "0.1.4"
+ dependencies = [
+  "chrono",
+  "clap_lex",
+@@ -988,8 +988,8 @@ dependencies = [
+  "futures-util",
+  "hmac",
+  "log",
+- "narrowlink-network",
+- "narrowlink-types",
++ "narrowlink-network 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
++ "narrowlink-types 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand",
+  "regex",
+  "serde",
+@@ -1006,7 +1006,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "narrowlink-gateway"
+-version = "0.1.3"
++version = "0.1.4"
+ dependencies = [
+  "askama",
+  "async-trait",
+@@ -1016,8 +1016,8 @@ dependencies = [
+  "futures-util",
+  "hyper",
+  "instant-acme",
+- "narrowlink-network",
+- "narrowlink-types",
++ "narrowlink-network 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
++ "narrowlink-types 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
+  "pem 3.0.2",
+  "rcgen",
+  "rustls",
+@@ -1037,7 +1037,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "narrowlink-network"
+-version = "0.1.3"
++version = "0.1.4"
+ dependencies = [
+  "bytes",
+  "chacha20poly1305",
+@@ -1045,7 +1045,30 @@ dependencies = [
+  "futures-util",
+  "hyper",
+  "log",
+- "narrowlink-types",
++ "narrowlink-types 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
++ "serde",
++ "serde_json",
++ "tokio",
++ "tokio-native-tls",
++ "tokio-rustls",
++ "tokio-tungstenite",
++ "tungstenite",
++ "webpki-roots",
++]
++
++[[package]]
++name = "narrowlink-network"
++version = "0.1.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "53a3e0af078492420b410b56ffeccd77e2c0d5ac31d53cc404e6b2f14ebde31b"
++dependencies = [
++ "bytes",
++ "chacha20poly1305",
++ "env_logger",
++ "futures-util",
++ "hyper",
++ "log",
++ "narrowlink-types 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
+  "serde",
+  "serde_json",
+  "tokio",
+@@ -1058,19 +1081,38 @@ dependencies = [
+ 
+ [[package]]
+ name = "narrowlink-token-generator"
+-version = "0.1.3"
++version = "0.1.4"
+ dependencies = [
+  "clap_lex",
+  "dirs",
+  "jsonwebtoken",
+- "narrowlink-types",
++ "narrowlink-types 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
+  "serde",
+  "serde_yaml",
+ ]
+ 
+ [[package]]
+ name = "narrowlink-types"
+-version = "0.1.3"
++version = "0.1.4"
++dependencies = [
++ "chrono",
++ "hmac",
++ "ipnet",
++ "jsonwebtoken",
++ "regex",
++ "serde",
++ "serde_json",
++ "sha3",
++ "uuid",
++ "validator",
++ "wildmatch",
++]
++
++[[package]]
++name = "narrowlink-types"
++version = "0.1.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "06a2e4b95bcc18504b455bff0e8d23321c8fa3bd68526f7bf1567f918f36925f"
+ dependencies = [
+  "chrono",
+  "hmac",
+@@ -1661,18 +1703,18 @@ dependencies = [
+ 
+ [[package]]
+ name = "serde"
+-version = "1.0.185"
++version = "1.0.186"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "be9b6f69f1dfd54c3b568ffa45c310d6973a5e5148fd40cf515acaf38cf5bc31"
++checksum = "9f5db24220c009de9bd45e69fb2938f4b6d2df856aa9304ce377b3180f83b7c1"
+ dependencies = [
+  "serde_derive",
+ ]
+ 
+ [[package]]
+ name = "serde_derive"
+-version = "1.0.185"
++version = "1.0.186"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "dc59dfdcbad1437773485e0367fea4b090a2e0a16d9ffc46af47764536a298ec"
++checksum = "5ad697f7e0b65af4983a4ce8f56ed5b357e8d3c36651bf6a7e13639c17b8e670"
+ dependencies = [
+  "proc-macro2",
+  "quote",
diff --git a/pkgs/tools/networking/narrowlink/default.nix b/pkgs/tools/networking/narrowlink/default.nix
new file mode 100644
index 00000000000..68732b518ca
--- /dev/null
+++ b/pkgs/tools/networking/narrowlink/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "narrowlink";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "narrowlink";
+    repo = "narrowlink";
+    rev = version;
+    hash = "sha256-vef7ctauSl0xfYNqjvl8wLGbqzzkMItz1O7sT1UZ4b0=";
+  };
+
+  # Cargo.lock is outdated
+  cargoPatches = [ ./Cargo.lock.patch ];
+
+  cargoHash = "sha256-craOunscE6o8PXtZFCYpkFH/amkuLOK7SrV+XHbS2GM=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.IOKit
+    darwin.apple_sdk_11_0.frameworks.Security
+  ];
+
+  meta = {
+    description = "Narrowlink securely connects devices and services together, even when both nodes are behind separate NAT";
+    homepage = "https://github.com/narrowlink/narrowlink";
+    license = with lib.licenses; [ agpl3Only mpl20 ]; # the gateway component is AGPLv3, the rest is MPLv2
+    maintainers = with lib.maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/tools/package-management/pdm/default.nix b/pkgs/tools/package-management/pdm/default.nix
index dba9d11b472..41b79f1e017 100644
--- a/pkgs/tools/package-management/pdm/default.nix
+++ b/pkgs/tools/package-management/pdm/default.nix
@@ -30,13 +30,13 @@ in
 with python.pkgs;
 buildPythonApplication rec {
   pname = "pdm";
-  version = "2.8.0";
+  version = "2.8.2";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BgsWKP2kZfLEHgZNISyp66Yww0ajMF4RWuI6TCzwJNo=";
+    hash = "sha256-uUjQC/YgaCsKxMgNIoyzBaKwFQ5JfuaTHaMOPMMFv9w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/plasma-pass/default.nix b/pkgs/tools/security/plasma-pass/default.nix
index f47cd69d43d..da276aef50d 100644
--- a/pkgs/tools/security/plasma-pass/default.nix
+++ b/pkgs/tools/security/plasma-pass/default.nix
@@ -15,12 +15,7 @@ mkDerivation rec {
     owner = "plasma";
     repo = "plasma-pass";
     sha256 = "sha256-lCNskOXkSIcMPcMnTWE37sDCXfmtP0FhyMzxeF6L0iU=";
-
-    # So the tag is actually "v0.2.1" but the released version is later than
-    # 1.2.0 and the "release" on the gitlab page also says "1.2.1".
-    # I guess they just messed up the tag subject and description.
-    # Maintainer of plasma-pass was notified about this 2023-08-13
-    rev = "v0.2.1";
+    rev = "v${version}";
   };
 
   buildInputs  = [
diff --git a/pkgs/tools/text/txr/default.nix b/pkgs/tools/text/txr/default.nix
index 2b9c306406a..dceedbdc510 100644
--- a/pkgs/tools/text/txr/default.nix
+++ b/pkgs/tools/text/txr/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "txr";
-  version = "289";
+  version = "291";
 
   src = fetchurl {
     url = "https://www.kylheku.com/cgit/txr/snapshot/txr-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-1m3QXY1qlVMFpehAYifHkDNQ4hAlO45/6+bbpbMAo3M=";
+    hash = "sha256-Btk3PanJa6hyoM+hfQq+EhIMaL2edyhfxx96Kpy+aaA=";
   };
 
   buildInputs = [ libffi ];
diff --git a/pkgs/tools/typesetting/marp/default.nix b/pkgs/tools/typesetting/marp/default.nix
new file mode 100644
index 00000000000..574159a76fa
--- /dev/null
+++ b/pkgs/tools/typesetting/marp/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchYarnDeps
+, makeWrapper
+, nodejs
+, prefetch-yarn-deps
+, yarn
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "marp-cli";
+  version = "3.2.0";
+
+  src = fetchFromGitHub {
+    owner = "marp-team";
+    repo = "marp-cli";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-bx5mq5KI85qUct/9Hr6mby6dWmRkmpVbiIw+M8PZas8=";
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-BogCt7ezmWxv2YfhljHYoBf47/FHR0qLZosjnoQhqgs=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs
+    prefetch-yarn-deps
+    yarn
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror $offlineCache
+    fixup-yarn-lock yarn.lock
+    yarn --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive install
+    patchShebangs node_modules
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn --offline build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    yarn --offline --production install
+
+    mkdir -p $out/lib/node_modules/@marp-team/marp-cli
+    cp -r lib node_modules marp-cli.js $out/lib/node_modules/@marp-team/marp-cli/
+
+    makeWrapper "${nodejs}/bin/node" "$out/bin/marp" \
+      --add-flags "$out/lib/node_modules/@marp-team/marp-cli/marp-cli.js"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "About A CLI interface for Marp and Marpit based converters";
+    homepage = "https://github.com/marp-team/marp-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ GuillaumeDesforges ];
+    platforms = nodejs.meta.platforms;
+    mainProgram = "marp";
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0143b591e33..da38eb51862 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5861,6 +5861,8 @@ with pkgs;
 
   marlin-calc = callPackage ../tools/misc/marlin-calc { };
 
+  marp-cli = callPackage ../tools/typesetting/marp { };
+
   masscan = callPackage ../tools/security/masscan { };
 
   massren = callPackage ../tools/misc/massren { };
@@ -13738,6 +13740,8 @@ with pkgs;
 
   timetagger = callPackage ../servers/timetagger { };
 
+  timetagger_cli = callPackage ../tools/misc/timetagger_cli { };
+
   timezonemap = callPackage ../development/libraries/timezonemap { };
 
   tzupdate = callPackage ../applications/misc/tzupdate { };
@@ -40568,6 +40572,8 @@ with pkgs;
 
   mysides = callPackage ../os-specific/darwin/mysides { };
 
+  narrowlink = callPackage ../tools/networking/narrowlink { };
+
   nar-serve = callPackage ../tools/nix/nar-serve { };
 
   neo = callPackage ../applications/misc/neo { };
@@ -40875,6 +40881,8 @@ with pkgs;
 
   sndio = callPackage ../misc/sndio { };
 
+  SP800-90B_EntropyAssessment = callPackage ../tools/misc/SP800-90B_EntropyAssessment { };
+
   sticky = callPackage ../applications/misc/sticky { };
 
   stork = darwin.apple_sdk_11_0.callPackage ../applications/misc/stork {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 738a79c8dda..9edc0f6cf56 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10734,6 +10734,8 @@ self: super: with self; {
 
   pyxattr = callPackage ../development/python-modules/pyxattr { };
 
+  pyxlsb = callPackage ../development/python-modules/pyxlsb { };
+
   pyworld = callPackage ../development/python-modules/pyworld { };
 
   pyx = callPackage ../development/python-modules/pyx { };