diff --git a/doc/builders/packages/emacs.section.md b/doc/builders/packages/emacs.section.md
index a202606966c..d46f890858f 100644
--- a/doc/builders/packages/emacs.section.md
+++ b/doc/builders/packages/emacs.section.md
@@ -103,14 +103,14 @@ You can install it like any other packages via `nix-env -iA myEmacs`. However, t
 
 This provides a fairly full Emacs start file. It will load in addition to the user's personal config. You can always disable it by passing `-q` to the Emacs command.
 
-Sometimes `emacs.pkgs.withPackages` is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in `pkgs/top-level/emacs-packages.nix`). But you can't control these priorities when some package is installed as a dependency. You can override it on a per-package-basis, providing all the required dependencies manually, but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package, you can use `overrideScope'`.
+Sometimes `emacs.pkgs.withPackages` is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in `pkgs/top-level/emacs-packages.nix`). But you can't control these priorities when some package is installed as a dependency. You can override it on a per-package-basis, providing all the required dependencies manually, but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package, you can use `overrideScope`.
 
 ```nix
 overrides = self: super: rec {
   haskell-mode = self.melpaPackages.haskell-mode;
   ...
 };
-((emacsPackagesFor emacs).overrideScope' overrides).withPackages
+((emacsPackagesFor emacs).overrideScope overrides).withPackages
   (p: with p; [
     # here both these package will use haskell-mode of our own choice
     ghc-mod
diff --git a/doc/languages-frameworks/cuda.section.md b/doc/languages-frameworks/cuda.section.md
index b7f1f19546a..2d680ea6b3b 100644
--- a/doc/languages-frameworks/cuda.section.md
+++ b/doc/languages-frameworks/cuda.section.md
@@ -30,7 +30,7 @@ package set to make it the default. This guarantees you get a consistent package
 set.
 ```nix
 mypkg = let
-  cudaPackages = cudaPackages_11_5.overrideScope' (final: prev: {
+  cudaPackages = cudaPackages_11_5.overrideScope (final: prev: {
     cudnn = prev.cudnn_8_3;
   }});
 in callPackage { inherit cudaPackages; };
diff --git a/lib/customisation.nix b/lib/customisation.nix
index a9281b1ab69..e1332007602 100644
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -269,10 +269,11 @@ rec {
     let self = f self // {
           newScope = scope: newScope (self // scope);
           callPackage = self.newScope {};
-          overrideScope = g: lib.warn
-            "`overrideScope` (from `lib.makeScope`) is deprecated. Do `overrideScope' (self: super: { … })` instead of `overrideScope (super: self: { … })`. All other overrides have the parameters in that order, including other definitions of `overrideScope`. This was the only definition violating the pattern."
-            (makeScope newScope (lib.fixedPoints.extends (lib.flip g) f));
-          overrideScope' = g: makeScope newScope (lib.fixedPoints.extends g f);
+          overrideScope = g: makeScope newScope (lib.fixedPoints.extends g f);
+          # Remove after 24.11 is released.
+          overrideScope' = g: lib.warnIf (lib.isInOldestRelease 2311)
+            "`overrideScope'` (from `lib.makeScope`) has been renamed to `overrideScope`."
+            (makeScope newScope (lib.fixedPoints.extends g f));
           packages = f;
         };
     in self;
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d73b1ad119d..27325e6132c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16330,6 +16330,12 @@
     github = "sweenu";
     githubId = 7051978;
   };
+  swesterfeld = {
+    email = "stefan@space.twc.de";
+    github = "swesterfeld";
+    githubId = 14840066;
+    name = "Stefan Westerfeld";
+  };
   swflint = {
     email = "swflint@flintfam.org";
     github = "swflint";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index cbe95404728..a387d01a99c 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -68,6 +68,13 @@
 
 - The `services.ananicy.extraRules` option now has the type of `listOf attrs` instead of `string`.
 
+- The `matrix-synapse` package & module have undergone some significant internal changes, for most setups no intervention is needed, though:
+  - The option [`services.matrix-synapse.package`](#opt-services.matrix-synapse.package) is now read-only. For modifying the package, use an overlay which modifies `matrix-synapse-unwrapped` instead. More on that below.
+  - The `enableSystemd` & `enableRedis` arguments have been removed and `matrix-synapse` has been renamed to `matrix-synapse-unwrapped`. Also, several optional dependencies (such as `psycopg2` or `authlib`) have been removed.
+  - These optional dependencies are automatically added via a wrapper (`pkgs.matrix-synapse.override { extras = ["redis"]; }` for `hiredis` & `txredisapi` for instance) if the relevant config section is declared in `services.matrix-synapse.settings`. For instance, if `services.matrix-synapse.settings.redis.enabled` is set to `true`, `"redis"` will be automatically added to the `extras` list of `pkgs.matrix-synapse`.
+  - A list of all extras (and the extras enabled by default) can be found at the [option's reference for `services.matrix-synapse.extras`](#opt-services.matrix-synapse.extras).
+  - In some cases (e.g. for running synapse workers) it was necessary to re-use the `PYTHONPATH` of `matrix-synapse.service`'s environment to have all plugins available. This isn't necessary anymore, instead `config.services.matrix-synapse.package` can be used as it points to the wrapper with properly configured `extras` and also all plugins defined via [`services.matrix-synapse.plugins`](#opt-services.matrix-synapse.plugins) available. This is also the reason for why the option is read-only now, it's supposed to be set by the module only.
+
 - `etcd` has been updated to 3.5, you will want to read the [3.3 to 3.4](https://etcd.io/docs/v3.5/upgrades/upgrade_3_4/) and [3.4 to 3.5](https://etcd.io/docs/v3.5/upgrades/upgrade_3_5/) upgrade guides
 
 - `consul` has been updated to `1.16.0`. See the [release note](https://github.com/hashicorp/consul/releases/tag/v1.16.0) for more details. Once a new Consul version has started and upgraded its data directory, it generally cannot be downgraded to the previous version.
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index 3dca3ff94f2..ef69a8adebb 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -9,11 +9,6 @@ let
   # remove null values from the final configuration
   finalSettings = lib.filterAttrsRecursive (_: v: v != null) cfg.settings;
   configFile = format.generate "homeserver.yaml" finalSettings;
-  logConfigFile = format.generate "log_config.yaml" cfg.logConfig;
-
-  pluginsEnv = cfg.package.python.buildEnv.override {
-    extraLibs = cfg.plugins;
-  };
 
   usePostgresql = cfg.settings.database.name == "psycopg2";
   hasLocalPostgresDB = let args = cfg.settings.database.args; in
@@ -50,6 +45,29 @@ let
             "${bindAddress}"
         }:${builtins.toString listener.port}/"
     '';
+
+  defaultExtras = [
+    "systemd"
+    "postgres"
+    "url-preview"
+    "user-search"
+  ];
+
+  wantedExtras = cfg.extras
+    ++ lib.optional (cfg.settings ? oidc_providers) "oidc"
+    ++ lib.optional (cfg.settings ? jwt_config) "jwt"
+    ++ lib.optional (cfg.settings ? saml2_config) "saml2"
+    ++ lib.optional (cfg.settings ? opentracing) "opentracing"
+    ++ lib.optional (cfg.settings ? redis) "redis"
+    ++ lib.optional (cfg.settings ? sentry) "sentry"
+    ++ lib.optional (cfg.settings ? user_directory) "user-search"
+    ++ lib.optional (cfg.settings.url_preview_enabled) "url-preview"
+    ++ lib.optional (cfg.settings.database.name == "psycopg2") "postgres";
+
+  wrapped = pkgs.matrix-synapse.override {
+    extras = wantedExtras;
+    inherit (cfg) plugins;
+  };
 in {
 
   imports = [
@@ -151,10 +169,53 @@ in {
 
       package = mkOption {
         type = types.package;
-        default = pkgs.matrix-synapse;
-        defaultText = literalExpression "pkgs.matrix-synapse";
+        readOnly = true;
         description = lib.mdDoc ''
-          Overridable attribute of the matrix synapse server package to use.
+          Reference to the `matrix-synapse` wrapper with all extras
+          (e.g. for `oidc` or `saml2`) added to the `PYTHONPATH` of all executables.
+
+          This option is useful to reference the "final" `matrix-synapse` package that's
+          actually used by `matrix-synapse.service`. For instance, when using
+          workers, it's possible to run
+          `''${config.services.matrix-synapse.package}/bin/synapse_worker` and
+          no additional PYTHONPATH needs to be specified for extras or plugins configured
+          via `services.matrix-synapse`.
+
+          However, this means that this option is supposed to be only declared
+          by the `services.matrix-synapse` module itself and is thus read-only.
+          In order to modify `matrix-synapse` itself, use an overlay to override
+          `pkgs.matrix-synapse-unwrapped`.
+        '';
+      };
+
+      extras = mkOption {
+        type = types.listOf (types.enum (lib.attrNames pkgs.matrix-synapse-unwrapped.optional-dependencies));
+        default = defaultExtras;
+        example = literalExpression ''
+          [
+            "cache-memory" # Provide statistics about caching memory consumption
+            "jwt"          # JSON Web Token authentication
+            "opentracing"  # End-to-end tracing support using Jaeger
+            "oidc"         # OpenID Connect authentication
+            "postgres"     # PostgreSQL database backend
+            "redis"        # Redis support for the replication stream between worker processes
+            "saml2"        # SAML2 authentication
+            "sentry"       # Error tracking and performance metrics
+            "systemd"      # Provide the JournalHandler used in the default log_config
+            "url-preview"  # Support for oEmbed URL previews
+            "user-search"  # Support internationalized domain names in user-search
+          ]
+        '';
+        description = lib.mdDoc ''
+          Explicitly install extras provided by matrix-synapse. Most
+          will require some additional configuration.
+
+          Extras will automatically be enabled, when the relevant
+          configuration sections are present.
+
+          Please note that this option is additive: i.e. when adding a new item
+          to this list, the defaults are still kept. To override the defaults as well,
+          use `lib.mkForce`.
         '';
       };
 
@@ -193,7 +254,7 @@ in {
         default = {};
         description = mdDoc ''
           The primary synapse configuration. See the
-          [sample configuration](https://github.com/matrix-org/synapse/blob/v${cfg.package.version}/docs/sample_config.yaml)
+          [sample configuration](https://github.com/matrix-org/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/sample_config.yaml)
           for possible values.
 
           Secrets should be passed in by using the `extraConfigFiles` option.
@@ -706,6 +767,10 @@ in {
     ];
 
     services.matrix-synapse.configFile = configFile;
+    services.matrix-synapse.package = wrapped;
+
+    # default them, so they are additive
+    services.matrix-synapse.extras = defaultExtras;
 
     users.users.matrix-synapse = {
       group = "matrix-synapse";
@@ -729,9 +794,7 @@ in {
           --keys-directory ${cfg.dataDir} \
           --generate-keys
       '';
-      environment = {
-        PYTHONPATH = makeSearchPathOutput "lib" cfg.package.python.sitePackages [ pluginsEnv ];
-      } // optionalAttrs (cfg.withJemalloc) {
+      environment = optionalAttrs (cfg.withJemalloc) {
         LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
       };
       serviceConfig = {
diff --git a/nixos/modules/services/tracing/tempo.nix b/nixos/modules/services/tracing/tempo.nix
index 4a098c31eff..0b9ca2398b1 100644
--- a/nixos/modules/services/tracing/tempo.nix
+++ b/nixos/modules/services/tracing/tempo.nix
@@ -27,6 +27,18 @@ in {
         Specify a path to a configuration file that Tempo should use.
       '';
     };
+
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = lib.literalExpression
+        ''
+          [ "-config.expand-env=true" ]
+        '';
+      description = lib.mdDoc ''
+        Additional flags to pass to the `ExecStart=` in `tempo.service`.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
@@ -54,7 +66,7 @@ in {
                else cfg.configFile;
       in
       {
-        ExecStart = "${pkgs.tempo}/bin/tempo --config.file=${conf}";
+        ExecStart = "${pkgs.tempo}/bin/tempo --config.file=${conf} ${lib.escapeShellArgs cfg.extraFlags}";
         DynamicUser = true;
         Restart = "always";
         ProtectSystem = "full";
diff --git a/nixos/tests/matrix/synapse.nix b/nixos/tests/matrix/synapse.nix
index 698d67c793e..98b07746919 100644
--- a/nixos/tests/matrix/synapse.nix
+++ b/nixos/tests/matrix/synapse.nix
@@ -65,7 +65,7 @@ in {
 
   nodes = {
     # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
-    serverpostgres = { pkgs, nodes, ... }: let
+    serverpostgres = { pkgs, nodes, config, ... }: let
       mailserverIP = nodes.mailserver.config.networking.primaryIPAddress;
     in
     {
@@ -77,6 +77,11 @@ in {
             name = "psycopg2";
             args.password = "synapse";
           };
+          redis = {
+            enabled = true;
+            host = "localhost";
+            port = config.services.redis.servers.matrix-synapse.port;
+          };
           tls_certificate_path = "${cert}";
           tls_private_key_path = "${key}";
           registration_shared_secret = registrationSharedSecret;
@@ -107,6 +112,11 @@ in {
         '';
       };
 
+      services.redis.servers.matrix-synapse = {
+        enable = true;
+        port = 6380;
+      };
+
       networking.extraHosts = ''
         ${mailserverIP} ${mailerDomain}
       '';
@@ -208,6 +218,9 @@ in {
     serverpostgres.wait_until_succeeds(
         "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
     )
+    serverpostgres.wait_until_succeeds(
+        "journalctl -u matrix-synapse.service | grep -q 'Connected to redis'"
+    )
     serverpostgres.require_unit_state("postgresql.service")
     serverpostgres.succeed("register_new_matrix_user -u ${testUser} -p ${testPassword} -a -k ${registrationSharedSecret} https://localhost:8448/")
     serverpostgres.succeed("obtain-token-and-register-email")
diff --git a/pkgs/applications/audio/gst123/default.nix b/pkgs/applications/audio/gst123/default.nix
new file mode 100644
index 00000000000..7262755b80d
--- /dev/null
+++ b/pkgs/applications/audio/gst123/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, wrapGAppsHook
+, gst_all_1
+, gtk3
+, ncurses
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gst123";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "swesterfeld";
+    repo = "gst123";
+    rev = finalAttrs.version;
+    hash = "sha256-7qS7JJ7EY1uFGX3FxBxgH6LzK4XUoTPHR0QVwUWRz+g=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    ncurses
+  ] ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+    gst-plugins-ugly
+    gst-libav
+  ]);
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "GStreamer based command line media player";
+    homepage = "https://space.twc.de/~stefan/gst123.php";
+    license = licenses.lgpl2Plus;
+    maintainers = with maintainers; [ swesterfeld ];
+    inherit (ncurses.meta) platforms;
+    broken = stdenv.isDarwin;
+  };
+})
diff --git a/pkgs/applications/misc/dasel/default.nix b/pkgs/applications/misc/dasel/default.nix
index eb3621735e0..836449b3a95 100644
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@@ -52,6 +52,7 @@ buildGoModule rec {
     homepage = "https://github.com/TomWright/dasel";
     changelog = "https://github.com/TomWright/dasel/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
+    mainProgram = "dasel";
     maintainers = with maintainers; [ _0x4A6F ];
   };
 }
diff --git a/pkgs/applications/misc/hyprdim/default.nix b/pkgs/applications/misc/hyprdim/default.nix
index 8f61623be54..f7cf680ad0d 100644
--- a/pkgs/applications/misc/hyprdim/default.nix
+++ b/pkgs/applications/misc/hyprdim/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprdim";
-  version = "2.1.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "donovanglover";
     repo = pname;
     rev = version;
-    hash = "sha256-EJ+3rmfRJOt9xiuWlR5IBoEzChwp35CUum25lYnFY14=";
+    hash = "sha256-6HeVLgEJDPy4cWL5td3Xl7+a6WUFZWUFynvBzPhItcg=";
   };
 
-  cargoHash = "sha256-Pd7dM+PPI0mwxbdfTu+gZ0tScZDGa2vGqEwuj8gW1Sk=";
+  cargoHash = "sha256-qYX5o64X8PsFcTYuZ82lIShyUN69oTzQIHrQH4B7iIw=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/networking/cluster/eks-node-viewer/default.nix b/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
index be01702cdc9..b4f9ce722e7 100644
--- a/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
+++ b/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eks-node-viewer";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zuez0ELtlphMHP/Pxu5ARnYhkmLJW/ehNrTLXSGmGL8=";
+    sha256 = "sha256-570wOLUtKKzDDLLDrAOPAnAUpZeAqrwKsQWoHCBjKKk=";
   };
 
-  vendorHash = "sha256-n2H6hiKZqujrJyojO2uQTIMLMHaX//t7328GPK6hxH0=";
+  vendorHash = "sha256-kRRUaA/psQDmcM1ZhzdZE3eyw8DWZpesJVA2zVfORGk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 535f9f32df9..3e4e60376c3 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.8.5";
+  version = "3.8.6";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lvZVezg5MORsNkWGo7iqtyRlo68JcVLiG+2hhiSdRZ8=";
+    hash = "sha256-KF5d9SjKUkkHoYWmNWNBMe567w2StgEFsZprS+SFw7Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 3a03a5fce84..66c81f9f6b4 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -45,14 +45,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.33.73";
-  x86_64-darwin-sha256 = "0y8plkl3pm8250xpavc91kn5b9gcdwr7bqzd3i79n48395lx11ka";
+  x86_64-darwin-version = "4.33.84";
+  x86_64-darwin-sha256 = "1qkcj0w5rqfdj8l7p7gv2ck0rgkm5sc8490f8mnbflgvjj9y0gsb";
 
-  x86_64-linux-version = "4.33.73";
-  x86_64-linux-sha256 = "007i8sjnm1ikjxvgw6nisj4nmv99bwk0r4sfpvc2j4w4wk68sx3m";
+  x86_64-linux-version = "4.33.84";
+  x86_64-linux-sha256 = "0cjl3m9gprxkm57889l1avkl21pyc7bzhcgm4j5yf938dp699zhd";
 
-  aarch64-darwin-version = "4.33.73";
-  aarch64-darwin-sha256 = "15s3ss15yawb04dyzn82xmk1gs70sg2i3agsj2aw0xdx73yjl34p";
+  aarch64-darwin-version = "4.33.84";
+  aarch64-darwin-sha256 = "0aw4wn4xx304dyzz7v9lmdgwg1345lhizil8yq9cjqy5kas3zj34";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 9ff9d693a88..d3ca419c48d 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
-, libtiff, ncurses, pango, pcre2, perl, readline, tcl, texLive, tk, xz, zlib
+, libtiff, ncurses, pango, pcre2, perl, readline, tcl, texlive, texLive, tk, xz, zlib
 , less, texinfo, graphviz, icu, pkg-config, bison, imake, which, jdk, blas, lapack
 , curl, Cocoa, Foundation, libobjc, libcxx, tzdata
 , withRecommendedPackages ? true
@@ -24,6 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-jdC/JPECPG9hjDsxc4PSkbSklPQNc7mDrCL/6pnkupk=";
   };
 
+  outputs = [ "out" "tex" ];
+
   dontUseImakeConfigure = true;
 
   nativeBuildInputs = [ pkg-config ];
@@ -89,6 +91,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   installTargets = [ "install" "install-info" "install-pdf" ];
 
+  # move tex files to $tex for use with texlive.combine
+  # add link in $out since ${R_SHARE_DIR}/texmf is hardcoded in several places
+  postInstall = ''
+    mv -T "$out/lib/R/share/texmf" "$tex"
+    ln -s "$tex" "$out/lib/R/share/texmf"
+  '';
+
   # The store path to "which" is baked into src/library/base/R/unix/system.unix.R,
   # but Nix cannot detect it as a run-time dependency because the installed file
   # is compiled and compressed, which hides the store path.
@@ -103,6 +112,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
+  # make tex output available to texlive.combine
+  passthru.pkgs = [ finalAttrs.finalPackage.tex ];
+  passthru.tlType = "run";
+  # dependencies (based on \RequirePackage in jss.cls, Rd.sty, Sweave.sty)
+  passthru.tlDeps = with texlive; [ amsfonts amsmath fancyvrb graphics hyperref iftex jknapltx latex lm tools upquote url ];
+
   meta = with lib; {
     homepage = "http://www.r-project.org/";
     description = "Free software environment for statistical computing and graphics";
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index 93a562d50d7..286a6f74c97 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -145,6 +145,6 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ joamaki ];
+    maintainers = with maintainers; [ joamaki kjeremy ];
   };
 }
diff --git a/pkgs/build-support/emacs/wrapper.nix b/pkgs/build-support/emacs/wrapper.nix
index a3842dec699..ecfcc0cd52c 100644
--- a/pkgs/build-support/emacs/wrapper.nix
+++ b/pkgs/build-support/emacs/wrapper.nix
@@ -21,7 +21,7 @@ set which contains `emacs.pkgs.withPackages`. For example, to override
 `emacs.pkgs.emacs.pkgs.withPackages`,
 ```
 let customEmacsPackages =
-      emacs.pkgs.overrideScope' (self: super: {
+      emacs.pkgs.overrideScope (self: super: {
         # use a custom version of emacs
         emacs = ...;
         # use the unstable MELPA version of magit
diff --git a/pkgs/desktops/plasma-5/plasma-desktop/default.nix b/pkgs/desktops/plasma-5/plasma-desktop/default.nix
index f4ab7969cfe..28dfa434f7b 100644
--- a/pkgs/desktops/plasma-5/plasma-desktop/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-desktop/default.nix
@@ -58,7 +58,14 @@
 , runCommandLocal
 , makeWrapper
 }:
-
+let
+  # run gsettings with desktop schemas for using in "kcm_access" kcm
+  # and in kaccess
+  gsettings-wrapper = runCommandLocal "gsettings-wrapper" { nativeBuildInputs = [ makeWrapper ]; } ''
+    mkdir -p $out/bin
+    makeWrapper ${glib}/bin/gsettings $out/bin/gsettings --prefix XDG_DATA_DIRS : ${gsettings-desktop-schemas.out}/share/gsettings-schemas/${gsettings-desktop-schemas.name}
+  '';
+in
 mkDerivation {
   pname = "plasma-desktop";
   nativeBuildInputs = [ extra-cmake-modules kdoctools wayland-scanner ];
@@ -122,19 +129,16 @@ mkDerivation {
     ./kcm-access.patch
   ];
   CXXFLAGS =
-    let
-      # run gsettings with desktop schemas for using in kcm_accces kcm
-      gsettings-wrapper = runCommandLocal "gsettings-wrapper" { nativeBuildInputs = [ makeWrapper ]; } ''
-        makeWrapper ${glib}/bin/gsettings $out --prefix XDG_DATA_DIRS : ${gsettings-desktop-schemas.out}/share/gsettings-schemas/${gsettings-desktop-schemas.name}
-      '';
-    in
     [
       ''-DNIXPKGS_HWCLOCK=\"${lib.getBin util-linux}/bin/hwclock\"''
-      ''-DNIXPKGS_GSETTINGS=\"${gsettings-wrapper}\"''
+      ''-DNIXPKGS_GSETTINGS=\"${gsettings-wrapper}/bin/gsettings\"''
     ];
   postInstall = ''
     # Display ~/Desktop contents on the desktop by default.
     sed -i "''${!outputBin}/share/plasma/shells/org.kde.plasma.desktop/contents/defaults" \
         -e 's/Containment=org.kde.desktopcontainment/Containment=org.kde.plasma.folder/'
   '';
+
+  # wrap kaccess with wrapped gsettings so it can access accessibility schemas
+  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ gsettings-wrapper ]}" ];
 }
diff --git a/pkgs/development/compilers/ligo/2706.diff b/pkgs/development/compilers/ligo/2706.diff
deleted file mode 100644
index 8eab82e1461..00000000000
--- a/pkgs/development/compilers/ligo/2706.diff
+++ /dev/null
@@ -1,58 +0,0 @@
---- a/src/passes/02-parsing/cameligo/dune
-+++ b/src/passes/02-parsing/cameligo/dune
-@@ -20,7 +20,9 @@
-  (action
-   (with-stdout-to
-    %{targets}
--   (run menhir-recover --external-tokens Lexing_cameligo.Token Parser.cmly))))
-+   (run menhir-recover
-+      --external-tokens Lexing_cameligo.Token.MenhirInterpreter
-+      Parser.cmly))))
- 
- ;; Build of the CameLIGO parser as a library
- 
-diff --git a/src/passes/02-parsing/jsligo/dune b/src/passes/02-parsing/jsligo/dune
-index d691ab0af0fe6ae87119405c19e49e2b5c2d1a23..3b13a06e69737037df0df12aa087506f402d8430 100644
---- a/src/passes/02-parsing/jsligo/dune
-+++ b/src/passes/02-parsing/jsligo/dune
-@@ -20,7 +20,9 @@
-  (action
-   (with-stdout-to
-    %{targets}
--   (run menhir-recover --external-tokens Lexing_jsligo.Token Parser.cmly))))
-+   (run menhir-recover
-+      --external-tokens Lexing_jsligo.Token.MenhirInterpreter
-+      Parser.cmly))))
- 
- ;; Build of the JsLIGO parser as a library
- 
-diff --git a/src/passes/02-parsing/pascaligo/dune b/src/passes/02-parsing/pascaligo/dune
-index 0516a8b790d2eb3ebdb833051bd66241ca44832c..e650decc7ba9907551e1016fee1a53b806fb593e 100644
---- a/src/passes/02-parsing/pascaligo/dune
-+++ b/src/passes/02-parsing/pascaligo/dune
-@@ -20,7 +20,9 @@
-  (action
-   (with-stdout-to
-    %{targets}
--   (run menhir-recover --external-tokens Lexing_pascaligo.Token Parser.cmly))))
-+   (run menhir-recover
-+      --external-tokens Lexing_pascaligo.Token.MenhirInterpreter
-+      Parser.cmly))))
- 
- ;; Build of the PascaLIGO parser as a library
- 
-diff --git a/src/passes/02-parsing/pyligo/dune b/src/passes/02-parsing/pyligo/dune
-index abb0165f6f185d21ea4a52a152cef188ae9dde4b..5930d86ab721e9dd683e5c4f2873b196ac5859b4 100644
---- a/src/passes/02-parsing/pyligo/dune
-+++ b/src/passes/02-parsing/pyligo/dune
-@@ -20,7 +20,9 @@
-  (action
-   (with-stdout-to
-    %{targets}
--   (run menhir-recover --external-tokens Lexing_pyligo.Token Parser.cmly))))
-+   (run menhir-recover
-+      --external-tokens Lexing_pyligo.Token.MenhirInterpreter
-+      Parser.cmly))))
- 
- ;; Build of the PyLIGO parser as a library
- 
diff --git a/pkgs/development/compilers/ligo/default.nix b/pkgs/development/compilers/ligo/default.nix
index 05fea9caddb..ff601131bd2 100644
--- a/pkgs/development/compilers/ligo/default.nix
+++ b/pkgs/development/compilers/ligo/default.nix
@@ -15,18 +15,15 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "ligo";
-  version = "0.69.0";
+  version = "0.71.1";
   src = fetchFromGitLab {
     owner = "ligolang";
     repo = "ligo";
     rev = version;
-    sha256 = "sha256-Swt4uihsAtHVMkc0DxATwB8FvgxwtSJTN3E5cBtyXf8=";
+    sha256 = "sha256-E28/bRtYS57vB3WguUDGmR2ZhXhh/taiZTLa07Hu88g=";
     fetchSubmodules = true;
   };
 
-  # https://gitlab.com/ligolang/ligo/-/merge_requests/2706.diff
-  patches = [ ./2706.diff ];
-
   postPatch = ''
     substituteInPlace "vendors/tezos-ligo/src/lib_hacl/hacl.ml" \
       --replace \
diff --git a/pkgs/development/compilers/odin/default.nix b/pkgs/development/compilers/odin/default.nix
index 340c56284f8..81a7faf7390 100644
--- a/pkgs/development/compilers/odin/default.nix
+++ b/pkgs/development/compilers/odin/default.nix
@@ -12,13 +12,13 @@ let
   inherit (llvmPackages) stdenv;
 in stdenv.mkDerivation rec {
   pname = "odin";
-  version = "dev-2023-07";
+  version = "dev-2023-08";
 
   src = fetchFromGitHub {
     owner = "odin-lang";
     repo = "Odin";
     rev = version;
-    hash = "sha256-ksCK1Qmjbg5ZgFoq0I4cjrWaCxd+UW7f1NLcSjCPMwE=";
+    hash = "sha256-pmgrauhB5/JWBkwrAm7tCml9IYQhXyGXsNVDKTntA0M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/rust/default.nix b/pkgs/development/compilers/rust/default.nix
index 35f5ab79c10..77c8b3d592f 100644
--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@@ -48,7 +48,7 @@ in
       # Like `buildRustPackages`, but may also contain prebuilt binaries to
       # break cycle. Just like `bootstrapTools` for nixpkgs as a whole,
       # nothing in the final package set should refer to this.
-      bootstrapRustPackages = self.buildRustPackages.overrideScope' (_: _:
+      bootstrapRustPackages = self.buildRustPackages.overrideScope (_: _:
         lib.optionalAttrs (stdenv.buildPlatform == stdenv.hostPlatform)
           (selectRustPackage buildPackages).packages.prebuilt);
       bootRustPlatform = makeRustPlatform bootstrapRustPackages;
diff --git a/pkgs/development/interpreters/anko/default.nix b/pkgs/development/interpreters/anko/default.nix
new file mode 100644
index 00000000000..f88534e9ecf
--- /dev/null
+++ b/pkgs/development/interpreters/anko/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "anko";
+  version = "0.1.9";
+
+  src = fetchFromGitHub {
+    owner = "mattn";
+    repo = "anko";
+    rev = "v${version}";
+    hash = "sha256-ZVNkQu5IxBx3f+FkUWc36EOEcY176wQJ2ravLPQAHAA=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [ "-s" "-w" ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = with lib; {
+    description = "Scriptable interpreter written in golang";
+    homepage = "https://github.com/mattn/anko";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/development/interpreters/cyber/default.nix b/pkgs/development/interpreters/cyber/default.nix
new file mode 100644
index 00000000000..9c1d94b0c7f
--- /dev/null
+++ b/pkgs/development/interpreters/cyber/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, zig_0_11
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cyber";
+  version = "unstable-2023-08-11";
+
+  src = fetchFromGitHub {
+    owner = "fubark";
+    repo = "cyber";
+    rev = "242ba2573cbac2acecc8c06878a8d754dd7a8716";
+    hash = "sha256-jArkFdvWnHNouNGsTn8O2lbU7eZdLbPD0xEfkrFH5Aw=";
+  };
+
+  nativeBuildInputs = [
+    zig_0_11.hook
+  ];
+
+  zigBuildFlags = [
+    "cli"
+  ];
+
+  env = {
+    COMMIT = lib.substring 0 7 src.rev;
+  };
+
+  meta = with lib; {
+    description = "A fast, efficient, and concurrent scripting language";
+    homepage = "https://github.com/fubark/cyber";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    inherit (zig_0_11.meta) platforms;
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 4a563d4fd70..d60d0cdf1fd 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -85,7 +85,7 @@ let
 
           php-packages = (callPackage ../../../top-level/php-packages.nix {
             phpPackage = phpWithExtensions;
-          }).overrideScope' packageOverrides;
+          }).overrideScope packageOverrides;
 
           allExtensionFunctions = prevExtensionFunctions ++ [ extensions ];
           enabledExtensions =
diff --git a/pkgs/development/interpreters/yaegi/default.nix b/pkgs/development/interpreters/yaegi/default.nix
new file mode 100644
index 00000000000..dcde678338f
--- /dev/null
+++ b/pkgs/development/interpreters/yaegi/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, testers
+, yaegi
+}:
+
+buildGoModule rec {
+  pname = "yaegi";
+  version = "0.15.1";
+
+  src = fetchFromGitHub {
+    owner = "traefik";
+    repo = "yaegi";
+    rev = "v${version}";
+    hash = "sha256-ZV1HidHJvwum18QIIwQiCcRcitZdHk5+FxkPs6YgDac=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [
+    "cmd/yaegi"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+  ];
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = yaegi;
+      command = "yaegi version";
+    };
+  };
+
+  meta = with lib; {
+    description = "A Go interpreter";
+    homepage = "https://github.com/traefik/yaegi";
+    changelog = "https://github.com/traefik/yaegi/releases/tag/${src.rev}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/development/lisp-modules/nix-cl.nix b/pkgs/development/lisp-modules/nix-cl.nix
index b8e0af0cc2b..3f45f58110e 100644
--- a/pkgs/development/lisp-modules/nix-cl.nix
+++ b/pkgs/development/lisp-modules/nix-cl.nix
@@ -299,7 +299,7 @@ let
   }:
     let
       spec = { inherit pkg faslExt program flags asdf; };
-      pkgs = (commonLispPackagesFor spec).overrideScope' packageOverrides;
+      pkgs = (commonLispPackagesFor spec).overrideScope packageOverrides;
       withPackages = lispWithPackages pkgs;
       withOverrides = packageOverrides:
         wrapLisp {
diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 5d26f33f45e..a10c1201dca 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -50,7 +50,7 @@ let
   # lispLibs ofpackages in this file.
   ql = quicklispPackagesFor spec;
 
-  packages = ql.overrideScope' (self: super: {
+  packages = ql.overrideScope (self: super: {
 
   cffi = let
     jna = pkgs.fetchMavenArtifact {
diff --git a/pkgs/development/lisp-modules/ql.nix b/pkgs/development/lisp-modules/ql.nix
index 33b3753a83e..17e92b75ae5 100644
--- a/pkgs/development/lisp-modules/ql.nix
+++ b/pkgs/development/lisp-modules/ql.nix
@@ -266,4 +266,4 @@ let
     lib.optionalAttrs (builtins.pathExists ./imported.nix)
       (pkgs.callPackage ./imported.nix { inherit build-asdf-system; });
 
-in qlpkgs.overrideScope' overrides
+in qlpkgs.overrideScope overrides
diff --git a/pkgs/development/ocaml-modules/linol/default.nix b/pkgs/development/ocaml-modules/linol/default.nix
index 34f32cf4f7b..9b53cd82eb9 100644
--- a/pkgs/development/ocaml-modules/linol/default.nix
+++ b/pkgs/development/ocaml-modules/linol/default.nix
@@ -3,7 +3,7 @@
 buildDunePackage
 rec {
   pname = "linol";
-  version = "2023-04-25";
+  version = "2023-08-04";
 
   minimalOCamlVersion = "4.14";
   duneVersion = "3";
@@ -12,8 +12,8 @@ rec {
     owner = "c-cube";
     repo = "linol";
     # Brings support for newer LSP
-    rev = "439534e0c5b7a3fbf93ba05fae7d171426153763";
-    sha256 = "sha256-EW35T7KUc/L1Zy4+oaJOC6mlVpbvhTfnU3NNFGoZAJg=";
+    rev = "09311ae258c55c53c62cb5eda3641682e61fe191";
+    sha256 = "sha256-51k+Eo3buzby9cWtbl+/0wbAxa2QSS+Oq0aEao0VBCM=";
   };
 
   propagatedBuildInputs = [ yojson logs lsp ppx_yojson_conv_lib ];
diff --git a/pkgs/development/python-modules/django-classy-tags/default.nix b/pkgs/development/python-modules/django-classy-tags/default.nix
index 06a336be081..a4d363f8bc5 100644
--- a/pkgs/development/python-modules/django-classy-tags/default.nix
+++ b/pkgs/development/python-modules/django-classy-tags/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "django-classy-tags";
-  version = "4.0.0";
+  version = "4.1.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-25/Hxe0I3CYZzEwZsZUUzawT3bYYJ4qwcJTGJtKO7w0=";
+    hash = "sha256-yNnRqi+m5xxNhm303RHSOmm40lu7dQskkKF7Fhd07lk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyterlab-lsp/default.nix b/pkgs/development/python-modules/jupyterlab-lsp/default.nix
index 5ebdb8ae5f5..b7d5ce4cf0c 100644
--- a/pkgs/development/python-modules/jupyterlab-lsp/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-lsp/default.nix
@@ -28,5 +28,8 @@ buildPythonPackage rec {
     license = licenses.bsd3;
     platforms = platforms.all;
     maintainers = with maintainers; [ ];
+    # No support for Jupyterlab > 4
+    # https://github.com/jupyter-lsp/jupyterlab-lsp/pull/949
+    broken = lib.versionAtLeast jupyterlab.version "4.0";
   };
 }
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index d03ce98f2fe..ead028dd94d 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -85,7 +85,7 @@
 
 buildPythonPackage rec {
   pname = "langchain";
-  version = "0.0.254";
+  version = "0.0.263";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -94,7 +94,7 @@ buildPythonPackage rec {
     owner = "hwchase17";
     repo = "langchain";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YQFIF1tA/CjvmD6xGgVre2lbcHR+UYx/sy1dOfpvkPY=";
+    hash = "sha256-/ReuUVSVO/JqfXFmGU/Yk5GAzmSuJvnr8zOTw3qLZvQ=";
   };
 
   sourceRoot = "${src.name}/libs/langchain";
diff --git a/pkgs/development/python-modules/optimum/default.nix b/pkgs/development/python-modules/optimum/default.nix
new file mode 100644
index 00000000000..6f781c3f174
--- /dev/null
+++ b/pkgs/development/python-modules/optimum/default.nix
@@ -0,0 +1,115 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, coloredlogs
+, datasets
+, evaluate
+, h5py
+, huggingface-hub
+, numpy
+, onnx
+, onnxruntime
+, packaging
+, protobuf
+, sympy
+, tensorflow
+, tf2onnx
+, timm
+, torch
+, transformers
+}:
+
+buildPythonPackage rec {
+  pname = "optimum";
+  version = "1.11.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = "optimum";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-J0QcHmR2hVd/Ygi7QFtsObwx/Sm3DCwU+DojzXHokYU=";
+  };
+
+  propagatedBuildInputs = [
+    coloredlogs
+    datasets
+    huggingface-hub
+    numpy
+    packaging
+    sympy
+    torch
+    transformers
+  ] ++ transformers.optional-dependencies.sentencepiece;
+
+  passthru.optional-dependencies = {
+    onnxruntime = [
+      onnx
+      onnxruntime
+      datasets
+      evaluate
+      protobuf
+    ];
+    exporters = [
+      onnx
+      onnxruntime
+      timm
+    ];
+    exporters-tf = [
+      tensorflow
+      tf2onnx
+      onnx
+      onnxruntime
+      timm
+      h5py
+      numpy
+    ];
+    diffusers = [
+      # diffusers
+    ];
+    intel = [
+      # optimum-intel
+    ];
+    openvino = [
+      # optimum-intel
+    ]; # ++ optimum-intel.optional-dependencies.openvino;
+    nncf = [
+      # optimum-intel
+    ]; # ++ optimum-intel.optional-dependencies.nncf;
+    neural-compressor = [
+      # optimum-intel
+    ]; # ++ optimum-intel.optional-dependencies.neural-compressor;
+    graphcore = [
+      # optimum-graphcore
+    ];
+    habana = [
+      transformers
+      # optimum-habana
+    ];
+    neuron = [
+      # optimum-neuron
+    ]; # ++ optimum-neuron.optional-dependencies.neuron;
+    neuronx = [
+      # optimum-neuron
+    ]; # ++ optimum-neuron.optional-dependencies.neuronx;
+    furiosa = [
+      # optimum-furiosa
+    ];
+  };
+
+  # almost all tests try to connect to https://huggingface.co
+  doCheck = false;
+
+  pythonImportsCheck = [ "optimum" ];
+
+  meta = with lib; {
+    description = "Accelerate training and inference of 🤗 Transformers and 🤗 Diffusers with easy to use hardware optimization tools";
+    homepage = "https://github.com/huggingface/optimum";
+    changelog = "https://github.com/huggingface/optimum/releases/tag/${src.rev}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index ba22546099a..307ee7fbfd6 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pymilvus";
-  version = "2.2.13";
+  version = "2.2.15";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "milvus-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-NTzdbmI2vNvNBFhN+xyZewH4b6l1BbKkDDE7rLNJ4IE=";
+    hash = "sha256-wwhgO2iCzPXobyZI0narHPn2WCAB9sS1+AoLrP1Ih6Q=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 287104e5b78..422f90d71f7 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.1.1";
+  version = "3.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nmPOYiozt5mDvFmEkRTIblECcGjV5650wZGGq+iSMPQ=";
+    hash = "sha256-Lt5m1SdZBzId6nvXXrEDQR3ZdA3yjoj15o3/nPeXPPs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/textual/default.nix b/pkgs/development/python-modules/textual/default.nix
index 99b71d27738..9fc1623a39e 100644
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@@ -1,28 +1,28 @@
 { lib
+, aiohttp
 , buildPythonPackage
+, click
 , fetchFromGitHub
-, poetry-core
-, mkdocs-exclude
+, importlib-metadata
+, jinja2
+, linkify-it-py
 , markdown-it-py
 , mdit-py-plugins
-, linkify-it-py
-, importlib-metadata
-, rich
-, typing-extensions
-, aiohttp
-, click
-, jinja2
+, mkdocs-exclude
 , msgpack
+, poetry-core
 , pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
+, rich
 , syrupy
 , time-machine
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "textual";
-  version = "0.28.1";
+  version = "0.32.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "Textualize";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-tSCMKM9Wv4crl6SLcIc2r6QY6U3RBTW8yfAjkYLV3eE=";
+    hash = "sha256-hsqVZoQ3PJm0GD5EVfmtwD/7ZcN+xu3kCBbS1q+atf8=";
   };
 
   nativeBuildInputs = [
@@ -39,15 +39,15 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    rich
-    markdown-it-py
-    mdit-py-plugins
-    linkify-it-py
-    importlib-metadata
     aiohttp
     click
-    msgpack
+    importlib-metadata
+    linkify-it-py
+    markdown-it-py
+    mdit-py-plugins
     mkdocs-exclude
+    msgpack
+    rich
   ] ++ lib.optionals (pythonOlder "3.11") [
     typing-extensions
   ];
@@ -65,6 +65,12 @@ buildPythonPackage rec {
     "tests/snapshot_tests/test_snapshots.py"
   ];
 
+  disabledTests = [
+    # Assertion issues
+    "test_textual_env_var"
+    "test_softbreak_split_links_rendered_correctly"
+  ];
+
   pythonImportsCheck = [
     "textual"
   ];
diff --git a/pkgs/development/tools/analysis/rizin/cutter.nix b/pkgs/development/tools/analysis/rizin/cutter.nix
index bb8ecb6e196..ab4d1289b92 100644
--- a/pkgs/development/tools/analysis/rizin/cutter.nix
+++ b/pkgs/development/tools/analysis/rizin/cutter.nix
@@ -47,8 +47,8 @@ let cutter = mkDerivation rec {
       };
     };
     withPlugins = filter: pkgs.callPackage ./wrapper.nix {
-      unwrapped = cutter;
-      inherit rizin;
+      inherit rizin cutter;
+      isCutter = true;
       plugins = filter plugins;
     };
   };
@@ -57,6 +57,7 @@ let cutter = mkDerivation rec {
     description = "Free and Open Source Reverse Engineering Platform powered by rizin";
     homepage = src.meta.homepage;
     license = licenses.gpl3;
+    mainProgram = "cutter";
     maintainers = with maintainers; [ mic92 dtzWill ];
   };
 }; in cutter
diff --git a/pkgs/development/tools/analysis/rizin/default.nix b/pkgs/development/tools/analysis/rizin/default.nix
index 46fe132a463..cfc24aef979 100644
--- a/pkgs/development/tools/analysis/rizin/default.nix
+++ b/pkgs/development/tools/analysis/rizin/default.nix
@@ -118,7 +118,7 @@ let rizin = stdenv.mkDerivation rec {
       sigdb = pkgs.callPackage ./sigdb.nix { };
     };
     withPlugins = filter: pkgs.callPackage ./wrapper.nix {
-      unwrapped = rizin;
+      inherit rizin;
       plugins = filter plugins;
     };
   };
@@ -127,6 +127,7 @@ let rizin = stdenv.mkDerivation rec {
     description = "UNIX-like reverse engineering framework and command-line toolset.";
     homepage = "https://rizin.re/";
     license = lib.licenses.gpl3Plus;
+    mainProgram = "rizin";
     maintainers = with lib.maintainers; [ raskin makefu mic92 ];
     platforms = with lib.platforms; unix;
   };
diff --git a/pkgs/development/tools/analysis/rizin/wrapper.nix b/pkgs/development/tools/analysis/rizin/wrapper.nix
index 5ddee52f232..11d046c27f6 100644
--- a/pkgs/development/tools/analysis/rizin/wrapper.nix
+++ b/pkgs/development/tools/analysis/rizin/wrapper.nix
@@ -1,20 +1,25 @@
 { lib
 , makeWrapper
 , symlinkJoin
-, unwrapped
 , plugins
-# NIX_RZ_PREFIX only changes where *Rizin* locates files (plugins,
-# themes, etc). But we must change it even for wrapping Cutter, because
-# Cutter plugins often have associated Rizin plugins. This means that
-# NIX_RZ_PREFIX must always contain Rizin files, even if we only wrap
-# Cutter - so for Cutter, include Rizin to symlinkJoin paths.
-, rizin ? null
+, rizin
+, isCutter ? false
+, cutter
 }:
 
+let
+  unwrapped = if isCutter then cutter else rizin;
+in
 symlinkJoin {
   name = "${unwrapped.pname}-with-plugins-${unwrapped.version}";
 
-  paths = [ unwrapped ] ++ lib.optional (rizin != null) rizin ++ plugins;
+  # NIX_RZ_PREFIX only changes where *Rizin* locates files (plugins,
+  # themes, etc). But we must change it even for wrapping Cutter, because
+  # Cutter plugins often have associated Rizin plugins. This means that
+  # $out (which NIX_RZ_PREFIX will be set to) must always contain Rizin
+  # files, even if we only wrap Cutter - so for Cutter, include Rizin to
+  # symlinkJoin paths.
+  paths = [ unwrapped ] ++ lib.optional isCutter rizin ++ plugins;
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -24,23 +29,16 @@ symlinkJoin {
 
   postBuild = ''
     rm $out/bin/*
-    wrapperArgs=(--set NIX_RZ_PREFIX $out)
-    if [ -d $out/share/rizin/cutter ]; then
-      wrapperArgs+=(--prefix XDG_DATA_DIRS : $out/share)
-    fi
+    wrapperArgs=(--set NIX_RZ_PREFIX $out${
+      lib.optionalString isCutter " --prefix XDG_DATA_DIRS : $out/share"
+    })
     for binary in $(ls ${unwrapped}/bin); do
       makeWrapper ${unwrapped}/bin/$binary $out/bin/$binary "''${wrapperArgs[@]}"
     done
-    ${lib.optionalString (rizin != null) ''
-      for binary in $(ls ${rizin}/bin); do
-        makeWrapper ${rizin}/bin/$binary $out/bin/$binary "''${wrapperArgs[@]}"
-      done
-    ''}
   '';
 
   meta = unwrapped.meta // {
-    # prefer wrapped over unwrapped, prefer cutter wrapper over rizin wrapper
-    # (because cutter versions of plugins also contain rizin plugins)
-    priority = (unwrapped.meta.priority or 0) - (if rizin != null then 2 else 1);
+    # prefer wrapped over unwrapped
+    priority = (unwrapped.meta.priority or 0) - 1;
   };
 }
diff --git a/pkgs/development/tools/devbox/default.nix b/pkgs/development/tools/devbox/default.nix
index 5e62da0bafb..54a287c8a2f 100644
--- a/pkgs/development/tools/devbox/default.nix
+++ b/pkgs/development/tools/devbox/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "devbox";
-  version = "0.5.7";
+  version = "0.5.11";
 
   src = fetchFromGitHub {
     owner = "jetpack-io";
     repo = pname;
     rev = version;
-    hash = "sha256-dGBkLWF/lzE1WxC7BG52N2zJZJNL+wZGI/H+9Dy9zZk=";
+    hash = "sha256-eJpB1hZu6AGFE86uj2RAaoKHAwivwQhQNimFMglpBLM=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
   # integration tests want file system access
   doCheck = false;
 
-  vendorHash = "sha256-wsVJZEaLdx/rhVcl0LQwc7fw2H6S336kfP3eFuGd4tA=";
+  vendorHash = "sha256-UTGngCsiqMjxQSdA3QMA/fPC3k+OrjqJ1Q6stXerjQQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/ast-grep/default.nix b/pkgs/development/tools/misc/ast-grep/default.nix
index 47d7db0390a..40924e195de 100644
--- a/pkgs/development/tools/misc/ast-grep/default.nix
+++ b/pkgs/development/tools/misc/ast-grep/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ast-grep";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     rev = version;
-    hash = "sha256-Il7VJyp4iIo8KrFHRoE4QptgzlJGKr+Npp2IkjDx/vc=";
+    hash = "sha256-chx37D0y05nIlXmP4SsWvsO+36BV7drTYpJCgMIl5xA=";
   };
 
-  cargoHash = "sha256-KReLBqdXtef20tULasw47wrm5k+qUBwo8tPiOTvD9cQ=";
+  cargoHash = "sha256-VfuBee2F2FxhcTE1JwosFgQI9+stzDuOHfpLv25rcNw=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
@@ -33,6 +33,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://ast-grep.github.io/";
     changelog = "https://github.com/ast-grep/ast-grep/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ montchr lord-valen ];
+    maintainers = with maintainers; [ montchr lord-valen cafkafk ];
   };
 }
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index a6808c2bb3b..6904414601a 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.28084";
+  version = "0.1.28528";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LyD9zAS/tjI6Ad+tC2mCadOEuXHlhkNpF0M5lzli5Qc=";
+    sha256 = "sha256-y8KpJdJLYSsDLT6/z0/Nx9qByLdtNNBeiwFUupJxxCQ=";
   };
 
-  vendorHash = "sha256-bPi0voXVJPAMWuovDInzk2PzbP0kPFpyOyjYoPZTNLM=";
+  vendorHash = "sha256-OWdJ7nFR5hrKQf2H763ezjXkEh0PvtBcjjeSNvH+ca4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/pscale/default.nix b/pkgs/development/tools/pscale/default.nix
index 87c93e2de84..6550fe0cc42 100644
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.151.0";
+  version = "0.153.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-w5FNZ7oFA+2weZtEsLX6eOwNyqVreDHg+2FApTsV5L0=";
+    sha256 = "sha256-iEn3iF13WSaNTF3+IHB1DlKNDPC1ObLQ2oAzPP8ffRM=";
   };
 
-  vendorHash = "sha256-I/cZa5IDmnYw/MU5h7jarYqbTY+5NrDDj5pz9WTcvGo=";
+  vendorHash = "sha256-hj+uzb1mpFrbbZXozCP9166i0C5pwIKhEtJOxovBCZE=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/os-specific/linux/bpfmon/default.nix b/pkgs/os-specific/linux/bpfmon/default.nix
index c75b9375e3b..f0815376c2a 100644
--- a/pkgs/os-specific/linux/bpfmon/default.nix
+++ b/pkgs/os-specific/linux/bpfmon/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpfmon";
-  version = "2.51";
+  version = "2.52";
 
   src = fetchFromGitHub {
     owner = "bbonev";
     repo = "bpfmon";
     rev = "refs/tags/v${version}";
-    hash = "sha256-EGRxWq94BWceYXunzcOpMQv4g7cMjVCEWMR0ULGN2Jg=";
+    hash = "sha256-W7OnrC+FCxMd4YbYiybjIvO0LT7Hr1/0Y3BQwItaTBs=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/pam_rssh/default.nix b/pkgs/os-specific/linux/pam_rssh/default.nix
index 51cba4d8420..d19457bf376 100644
--- a/pkgs/os-specific/linux/pam_rssh/default.nix
+++ b/pkgs/os-specific/linux/pam_rssh/default.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage {
   pname = "pam_rssh";
-  version = "unstable-2023-03-18";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "z4yx";
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage {
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-/AQqjmAGgvnpVWyoK3ymZ1gNAhTSN30KQEiqv4G+zx8=";
+  cargoHash = "sha256-QMyMqsjZ91WimIaaSCXtbRScS3BoB+yFtHjx3xViq7U=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 56650531a65..2d4455d322a 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -1,7 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, python3, openssl, cargo, rustPlatform, rustc
-, enableSystemd ? lib.meta.availableOn stdenv.hostPlatform python3.pkgs.systemd
+{ lib
+, stdenv
+, fetchFromGitHub
+, python3
+, openssl
+, cargo
+, rustPlatform
+, rustc
 , nixosTests
-, enableRedis ? true
 , callPackage
 }:
 
@@ -9,8 +14,7 @@ let
   plugins = python3.pkgs.callPackage ./plugins { };
   tools = callPackage ./tools { };
 in
-with python3.pkgs;
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
   version = "1.89.0";
   format = "pyproject";
@@ -34,7 +38,7 @@ buildPythonApplication rec {
     sed -i '/^setuptools_rust =/d' pyproject.toml
   '';
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3.pkgs; [
     poetry-core
     rustPlatform.cargoSetupHook
     setuptools-rust
@@ -42,47 +46,90 @@ buildPythonApplication rec {
     rustc
   ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    openssl
+  ];
 
-  propagatedBuildInputs = [
-    authlib
+  propagatedBuildInputs = with python3.pkgs; [
+    attrs
     bcrypt
     bleach
     canonicaljson
-    daemonize
+    cryptography
     ijson
     immutabledict
     jinja2
     jsonschema
-    lxml
     matrix-common
     msgpack
     netaddr
+    packaging
     phonenumbers
     pillow
     prometheus-client
-    psutil
-    psycopg2
     pyasn1
+    pyasn1-modules
     pydantic
-    pyicu
     pymacaroons
-    pynacl
     pyopenssl
-    pysaml2
     pyyaml
-    requests
-    setuptools
+    service-identity
     signedjson
     sortedcontainers
     treq
     twisted
     typing-extensions
     unpaddedbase64
-  ] ++ lib.optional enableSystemd systemd
-    ++ lib.optionals enableRedis [ hiredis txredisapi ];
+  ]
+  ++ twisted.optional-dependencies.tls;
 
-  nativeCheckInputs = [ mock parameterized openssl ];
+  passthru.optional-dependencies = with python3.pkgs; {
+    postgres = if isPyPy then [
+      psycopg2cffi
+    ] else [
+      psycopg2
+    ];
+    saml2 = [
+      pysaml2
+    ];
+    oidc = [
+      authlib
+    ];
+    systemd = [
+      systemd
+    ];
+    url-preview = [
+      lxml
+    ];
+    sentry = [
+      sentry-sdk
+    ];
+    opentracing = [
+      jaeger-client
+      opentracing
+    ];
+    jwt = [
+      authlib
+    ];
+    redis = [
+      hiredis
+      txredisapi
+    ];
+    cache-memory = [
+      pympler
+    ];
+    user-search = [
+      pyicu
+    ];
+  };
+
+  nativeCheckInputs = [
+    openssl
+  ] ++ (with python3.pkgs; [
+    mock
+    parameterized
+  ])
+  ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   doCheck = !stdenv.isDarwin;
 
@@ -112,6 +159,7 @@ buildPythonApplication rec {
 
   meta = with lib; {
     homepage = "https://matrix.org";
+    changelog = "https://github.com/matrix-org/synapse/releases/tag/v${version}";
     description = "Matrix reference homeserver";
     license = licenses.asl20;
     maintainers = teams.matrix.members;
diff --git a/pkgs/servers/matrix-synapse/plugins/ldap3.nix b/pkgs/servers/matrix-synapse/plugins/ldap3.nix
index b29dc21422e..feac6f08472 100644
--- a/pkgs/servers/matrix-synapse/plugins/ldap3.nix
+++ b/pkgs/servers/matrix-synapse/plugins/ldap3.nix
@@ -4,7 +4,7 @@
 , fetchPypi
 , ldap3
 , ldaptor
-, matrix-synapse
+, matrix-synapse-unwrapped
 , pytestCheckHook
 , service-identity
 , setuptools
@@ -33,7 +33,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ service-identity ldap3 twisted ];
 
-  nativeCheckInputs = [ ldaptor matrix-synapse pytestCheckHook ];
+  nativeCheckInputs = [ ldaptor matrix-synapse-unwrapped pytestCheckHook ];
 
   pythonImportsCheck = [ "ldap_auth_provider" ];
 
diff --git a/pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix b/pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix
index 2d0fa4115cc..e1a9f728592 100644
--- a/pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix
+++ b/pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, matrix-synapse }:
+{ lib, stdenv, buildPythonPackage, fetchFromGitHub, matrix-synapse-unwrapped }:
 
 buildPythonPackage rec {
   pname = "matrix-synapse-mjolnir-antispam";
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   sourceRoot = "./${src.name}/synapse_antispam";
 
-  buildInputs = [ matrix-synapse ];
+  buildInputs = [ matrix-synapse-unwrapped ];
 
   doCheck = false; # no tests
   pythonImportsCheck = [ "mjolnir" ];
diff --git a/pkgs/servers/matrix-synapse/plugins/shared-secret-auth.nix b/pkgs/servers/matrix-synapse/plugins/shared-secret-auth.nix
index a6e22db34fe..b5be02a4b21 100644
--- a/pkgs/servers/matrix-synapse/plugins/shared-secret-auth.nix
+++ b/pkgs/servers/matrix-synapse/plugins/shared-secret-auth.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, matrix-synapse, twisted }:
+{ lib, buildPythonPackage, fetchFromGitHub, matrix-synapse-unwrapped, twisted }:
 
 buildPythonPackage rec {
   pname = "matrix-synapse-shared-secret-auth";
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   doCheck = false;
   pythonImportsCheck = [ "shared_secret_authenticator" ];
 
-  buildInputs = [ matrix-synapse ];
+  buildInputs = [ matrix-synapse-unwrapped ];
   propagatedBuildInputs = [ twisted ];
 
   meta = with lib; {
diff --git a/pkgs/servers/matrix-synapse/wrapper.nix b/pkgs/servers/matrix-synapse/wrapper.nix
new file mode 100644
index 00000000000..930142c5f55
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/wrapper.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, makeWrapper
+, matrix-synapse-unwrapped
+, extras ? [
+    "postgres"
+    "url-preview"
+    "user-search"
+  ] ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform matrix-synapse-unwrapped.python.pkgs.systemd) "systemd"
+, plugins ? [ ]
+, ...
+}:
+
+let
+  extraPackages = lib.concatMap (extra: matrix-synapse-unwrapped.optional-dependencies.${extra}) (lib.unique extras);
+
+  pluginsEnv = matrix-synapse-unwrapped.python.buildEnv.override {
+    extraLibs = plugins;
+  };
+
+  searchPath = lib.makeSearchPathOutput "lib" matrix-synapse-unwrapped.python.sitePackages (extraPackages ++ [ pluginsEnv ]);
+in
+stdenv.mkDerivation {
+  name = (lib.appendToName "wrapped" matrix-synapse-unwrapped).name;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildCommand = ''
+    for bin in ${matrix-synapse-unwrapped}/bin/*; do
+      echo $bin
+      makeWrapper "$bin" "$out/bin/$(basename $bin)" \
+        --set PYTHONPATH ${searchPath}
+    done;
+  '';
+
+  passthru = {
+    unwrapped = matrix-synapse-unwrapped;
+
+    # for backward compatibility
+    inherit (matrix-synapse-unwrapped) plugins tools;
+  };
+}
diff --git a/pkgs/tools/inputmethods/touchegg/default.nix b/pkgs/tools/inputmethods/touchegg/default.nix
index ff9786cfe3b..de30b853670 100644
--- a/pkgs/tools/inputmethods/touchegg/default.nix
+++ b/pkgs/tools/inputmethods/touchegg/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "touchegg";
-  version = "2.0.16";
+  version = "2.0.17";
 
   src = fetchFromGitHub {
     owner = "JoseExposito";
     repo = pname;
     rev = version;
-    sha256 = "sha256-/0XeFW0cdS1/UaE/z2FROwk2dTyZMqXjiBzt62x8f8o=";
+    sha256 = "sha256-he6ERl6ZNWuD5StUqQWsUjeJ35nD0b8KddIAvntqlOI=";
   };
 
   patches = lib.optionals withPantheon [
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index 8e66e775c1f..2f8f938051b 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -2,32 +2,39 @@
 , stdenv
 , fetchurl
 , ncurses
-, zig_0_10
+, zig_0_11
+, installShellFiles
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ncdu";
-  version = "2.2.2";
+  version = "2.3";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/ncdu-${finalAttrs.version}.tar.gz";
-    hash = "sha256-kNkgAk51Ixi0aXds5X4Ds8cC1JMprZglruqzbDur+ZM=";
+    hash = "sha256-u84dHHDxJHZxvk6iE12MUs0ppwivXtYs7Np9xqgACjw=";
   };
 
   nativeBuildInputs = [
-    zig_0_10.hook
+    zig_0_11.hook
+    installShellFiles
   ];
 
   buildInputs = [
     ncurses
   ];
 
+  postInstall = ''
+    installManPage ncdu.1
+  '';
+
   meta = {
     homepage = "https://dev.yorhel.nl/ncdu";
     description = "Disk usage analyzer with an ncurses interface";
     changelog = "https://dev.yorhel.nl/ncdu/changes2";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ pSub rodrgz ];
-    inherit (zig_0_10.meta) platforms;
+    inherit (zig_0_11.meta) platforms;
+    mainProgram = "ncdu";
   };
 })
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 1482931bf4d..a6f0ac7be39 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -177,8 +177,8 @@ in lib.makeExtensible (self: ({
   };
 
   nix_2_15 = common {
-    version = "2.15.1";
-    hash = "sha256-o7bxsNeq2LF6/dTl+lT2k50bSItkID80/uoZYVtlxro=";
+    version = "2.15.2";
+    hash = "sha256-0BxVsvp4JfliYu4EdpZ/zPYOt9Qn5w9Ix5r0sagZZ7o=";
   };
 
   nix_2_16 = common {
diff --git a/pkgs/tools/text/coloursum/default.nix b/pkgs/tools/text/coloursum/default.nix
index 8391b75a67b..93ebf6c309e 100644
--- a/pkgs/tools/text/coloursum/default.nix
+++ b/pkgs/tools/text/coloursum/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "coloursum";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "ticky";
     repo = "coloursum";
     rev = "v${version}";
-    sha256 = "1piz0l7qdcvjzfykm6rzqc8s1daxp3cj3923v9cmm41bc2v0p5q0";
+    hash = "sha256-zA2JhSnlFccSY01WMGsgF4AmrF/3BRUCcSMfoEbEPgA=";
   };
 
-  cargoSha256 = "08l01ivmln9gwabwa1p0gk454qyxlcpnlxx840vys476f4pw7vvf";
+  cargoHash = "sha256-dhcTpff4h37MHNbLoYUZiolSclSGcFrMJ3kKLCZAVAw=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/text/morsel/default.nix b/pkgs/tools/text/morsel/default.nix
index dc0fa9ef9b2..b761b03e83d 100644
--- a/pkgs/tools/text/morsel/default.nix
+++ b/pkgs/tools/text/morsel/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "morsel";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "SamLee514";
     repo = "morsel";
     rev = "v${version}";
-    sha256 = "sha256-m4bCni/9rMTPhZSogpd5+ARrW11TPHSvQpdz3wUr9H4=";
+    hash = "sha256-bb+88GIyd92kHJAs25mJ9vmq0Ha2q0fdHnpTXhX2BFE=";
   };
 
-  cargoSha256 = "sha256-2xR2/013ocDKWS1oWitpAbSDPRwEJJqFcCIm6ZQpCoc=";
+  cargoHash = "sha256-XRl71n+rV6MTQMz957K5/25SX9HvYVW6qAuHTdfRLLs=";
 
   meta = with lib; {
     description = "Command line tool to translate morse code input to text in real time";
diff --git a/pkgs/tools/text/sad/default.nix b/pkgs/tools/text/sad/default.nix
index 9225fd98b86..da4ff0804b1 100644
--- a/pkgs/tools/text/sad/default.nix
+++ b/pkgs/tools/text/sad/default.nix
@@ -1,20 +1,23 @@
 { lib
 , fetchFromGitHub
 , rustPlatform
+, python3
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "sad";
-  version = "0.4.22";
+  version = "0.4.23";
 
   src = fetchFromGitHub {
     owner = "ms-jpq";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-v1fXEC+bV561cewH17x+1anhfXstGBOHG5rHvhYIvLo=";
+    hash = "sha256-LNMc+3pXx7VyNq0dws+s13ZA3+f8aJzgbAxzI71NKx0=";
   };
 
-  cargoSha256 = "sha256-krQTa9R3hmMVKLoBgnbCw+aSQu9HUXfA3XflB8AZv6w=";
+  cargoHash = "sha256-UjXJmH4UI5Vey2rBy57CI1r13bpGYhIozEoOoyoRDLQ=";
+
+  nativeBuildInputs = [ python3 ];
 
   # fix for compilation on aarch64
   # see https://github.com/NixOS/nixpkgs/issues/145726
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fa040ea1778..04e9b9defb4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9839,11 +9839,10 @@ with pkgs;
 
   matrix-sliding-sync = callPackage ../servers/matrix-synapse/sliding-sync { };
 
-  matrix-synapse = callPackage ../servers/matrix-synapse { };
-
-  matrix-synapse-plugins = recurseIntoAttrs matrix-synapse.plugins;
-
-  matrix-synapse-tools = recurseIntoAttrs matrix-synapse.tools;
+  matrix-synapse = callPackage ../servers/matrix-synapse/wrapper.nix { };
+  matrix-synapse-unwrapped = callPackage ../servers/matrix-synapse/default.nix { };
+  matrix-synapse-plugins = recurseIntoAttrs matrix-synapse-unwrapped.plugins;
+  matrix-synapse-tools = recurseIntoAttrs matrix-synapse-unwrapped.tools;
 
   matrix-appservice-irc = callPackage ../servers/matrix-synapse/matrix-appservice-irc { };
 
@@ -17452,6 +17451,8 @@ with pkgs;
 
   angelscript = callPackage ../development/interpreters/angelscript { };
 
+  anko = callPackage ../development/interpreters/anko { };
+
   babashka-unwrapped = callPackage ../development/interpreters/babashka { };
   babashka = callPackage ../development/interpreters/babashka/wrapped.nix { };
 
@@ -18094,6 +18095,8 @@ with pkgs;
 
   wasm3 = callPackage ../development/interpreters/wasm3 { };
 
+  yaegi = callPackage ../development/interpreters/yaegi { };
+
   yex-lang = callPackage ../development/interpreters/yex-lang { };
 
   ### DEVELOPMENT / MISC
@@ -19798,7 +19801,7 @@ with pkgs;
 
   cutter = libsForQt5.callPackage ../development/tools/analysis/rizin/cutter.nix { };
 
-  cutterPlugins = recurseIntoAttrs rizin.plugins;
+  cutterPlugins = recurseIntoAttrs cutter.plugins;
 
   ragel = ragelStable;
 
@@ -30893,6 +30896,8 @@ with pkgs;
 
   cwm = callPackage ../applications/window-managers/cwm { };
 
+  cyber = callPackage ../development/interpreters/cyber { };
+
   cyberduck = callPackage ../applications/networking/cyberduck { };
 
   cyclone = callPackage ../applications/audio/pd-plugins/cyclone  { };
@@ -32151,6 +32156,8 @@ with pkgs;
 
   gspell = callPackage ../development/libraries/gspell { };
 
+  gst123 = callPackage ../applications/audio/gst123 { };
+
   gtk2fontsel = callPackage ../applications/misc/gtk2fontsel { };
 
   gtklock = callPackage ../tools/wayland/gtklock { };
diff --git a/pkgs/top-level/cuda-packages.nix b/pkgs/top-level/cuda-packages.nix
index 2044d74cab7..b8e1e5dfc76 100644
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -70,4 +70,4 @@ let
     cutensorExtension
   ]);
 
-in (scope.overrideScope' composedExtension)
+in (scope.overrideScope composedExtension)
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 984c5791ea0..e3b1cad80da 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1803,7 +1803,7 @@ let
 
     ### End ###
 
-  })).overrideScope' liftJaneStreet;
+  })).overrideScope liftJaneStreet;
 
 in let inherit (pkgs) callPackage; in rec
 {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ab505098974..de0c57dc648 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7511,6 +7511,8 @@ self: super: with self; {
 
   optax = callPackage ../development/python-modules/optax { };
 
+  optimum = callPackage ../development/python-modules/optimum { };
+
   optuna = callPackage ../development/python-modules/optuna { };
 
   opuslib = callPackage ../development/python-modules/opuslib { };