diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fb83636ce8af..6c2e79715db5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9255,6 +9255,15 @@
     githubId = 1102396;
     name = "Jussi Maki";
   };
+  joaquintrinanes = {
+    email = "hi@joaquint.io";
+    github = "JoaquinTrinanes";
+    name = "Joaquín Triñanes";
+    githubId = 1385934;
+    keys = [{
+      fingerprint = "3A13 5C15 E1D5 850D 2F90  AB25 6E14 46DD 451C 6BAF";
+    }];
+  };
   jobojeha = {
     email = "jobojeha@jeppener.de";
     github = "jobojeha";
@@ -17159,6 +17168,12 @@
     githubId = 1153271;
     name = "Sander van der Burg";
   };
+  Sanskarzz = {
+    email = "sanskar.gur@gmail.com";
+    github = "Sanskarzz";
+    githubId = 92817635;
+    name = "Sanskar Gurdasani";
+  };
   sarcasticadmin = {
     email = "rob@sarcasticadmin.com";
     github = "sarcasticadmin";
@@ -17824,6 +17839,7 @@
   };
   sikmir = {
     email = "sikmir@disroot.org";
+    matrix = "@sikmir:matrix.org";
     github = "sikmir";
     githubId = 688044;
     name = "Nikolay Korotkiy";
diff --git a/nixos/lib/make-iso9660-image.nix b/nixos/lib/make-iso9660-image.nix
index 2f7dcf519a16..ec520f570682 100644
--- a/nixos/lib/make-iso9660-image.nix
+++ b/nixos/lib/make-iso9660-image.nix
@@ -1,4 +1,4 @@
-{ stdenv, closureInfo, xorriso, syslinux, libossp_uuid
+{ lib, stdenv, callPackage, closureInfo, xorriso, syslinux, libossp_uuid, squashfsTools
 
 , # The file name of the resulting ISO image.
   isoName ? "cd.iso"
@@ -16,6 +16,17 @@
   # symlink to `object' that will be added to the CD.
   storeContents ? []
 
+, # In addition to `contents', the closure of the store paths listed
+  # in `squashfsContents' is compressed as squashfs and the result is
+  # placed in /nix-store.squashfs on the CD.
+  # FIXME: This is a performance optimization to avoid Hydra copying
+  # the squashfs between builders and should be removed when Hydra
+  # is smarter about scheduling.
+  squashfsContents ? []
+
+, # Compression settings for squashfs
+  squashfsCompression ? "xz -Xdict-size 100%"
+
 , # Whether this should be an El-Torito bootable CD.
   bootable ? false
 
@@ -45,12 +56,20 @@ assert bootable -> bootImage != "";
 assert efiBootable -> efiBootImage != "";
 assert usbBootable -> isohybridMbrImage != "";
 
+let
+  needSquashfs = squashfsContents != [];
+  makeSquashfsDrv = callPackage ./make-squashfs.nix {
+    storeContents = squashfsContents;
+    comp = squashfsCompression;
+  };
+in
 stdenv.mkDerivation {
   name = isoName;
   __structuredAttrs = true;
 
   buildCommandPath = ./make-iso9660-image.sh;
-  nativeBuildInputs = [ xorriso syslinux zstd libossp_uuid ];
+  nativeBuildInputs = [ xorriso syslinux zstd libossp_uuid ]
+    ++ lib.optionals needSquashfs makeSquashfsDrv.nativeBuildInputs;
 
   inherit isoName bootable bootImage compressImage volumeID efiBootImage efiBootable isohybridMbrImage usbBootable;
 
@@ -60,6 +79,8 @@ stdenv.mkDerivation {
   objects = map (x: x.object) storeContents;
   symlinks = map (x: x.symlink) storeContents;
 
+  squashfsCommand = lib.optionalString needSquashfs makeSquashfsDrv.buildCommand;
+
   # For obtaining the closure of `storeContents'.
   closureInfo = closureInfo { rootPaths = map (x: x.object) storeContents; };
 }
diff --git a/nixos/lib/make-iso9660-image.sh b/nixos/lib/make-iso9660-image.sh
index 34febe9cfe0e..5881195e461f 100644
--- a/nixos/lib/make-iso9660-image.sh
+++ b/nixos/lib/make-iso9660-image.sh
@@ -68,6 +68,11 @@ for i in $(< $closureInfo/store-paths); do
     addPath "${i:1}" "$i"
 done
 
+# If needed, build a squashfs and add that
+if [[ -n "$squashfsCommand" ]]; then
+    (out="nix-store.squashfs" eval "$squashfsCommand")
+    addPath "nix-store.squashfs" "nix-store.squashfs"
+fi
 
 # Also include a manifest of the closures in a format suitable for
 # nix-store --load-db.
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 6adb94e09aff..f5b6af3a6b7f 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -811,12 +811,6 @@ in
       optional config.isoImage.includeSystemBuildDependencies
         config.system.build.toplevel.drvPath;
 
-    # Create the squashfs image that contains the Nix store.
-    system.build.squashfsStore = pkgs.callPackage ../../../lib/make-squashfs.nix {
-      storeContents = config.isoImage.storeContents;
-      comp = config.isoImage.squashfsCompression;
-    };
-
     # Individual files to be included on the CD, outside of the Nix
     # store on the CD.
     isoImage.contents =
@@ -827,9 +821,6 @@ in
         { source = config.system.build.initialRamdisk + "/" + config.system.boot.loader.initrdFile;
           target = "/boot/" + config.system.boot.loader.initrdFile;
         }
-        { source = config.system.build.squashfsStore;
-          target = "/nix-store.squashfs";
-        }
         { source = pkgs.writeText "version" config.system.nixos.label;
           target = "/version.txt";
         }
@@ -878,6 +869,8 @@ in
       bootable = config.isoImage.makeBiosBootable;
       bootImage = "/isolinux/isolinux.bin";
       syslinux = if config.isoImage.makeBiosBootable then pkgs.syslinux else null;
+      squashfsContents = config.isoImage.storeContents;
+      squashfsCompression = config.isoImage.squashfsCompression;
     } // optionalAttrs (config.isoImage.makeUsbBootable && config.isoImage.makeBiosBootable) {
       usbBootable = true;
       isohybridMbrImage = "${pkgs.syslinux}/share/syslinux/isohdpfx.bin";
diff --git a/nixos/modules/services/x11/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix
similarity index 92%
rename from nixos/modules/services/x11/desktop-managers/plasma6.nix
rename to nixos/modules/services/desktop-managers/plasma6.nix
index a471a48c9002..1710d28954d6 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@@ -5,8 +5,7 @@
   utils,
   ...
 }: let
-  xcfg = config.services.xserver;
-  cfg = xcfg.desktopManager.plasma6;
+  cfg = config.services.desktopManager.plasma6;
 
   inherit (pkgs) kdePackages;
   inherit (lib) literalExpression mkDefault mkIf mkOption mkPackageOptionMD types;
@@ -17,7 +16,7 @@
   '';
 in {
   options = {
-    services.xserver.desktopManager.plasma6 = {
+    services.desktopManager.plasma6 = {
       enable = mkOption {
         type = types.bool;
         default = false;
@@ -44,6 +43,12 @@ in {
     };
   };
 
+  imports = [
+    (lib.mkRenamedOptionModule [ "services" "xserver" "desktopManager" "plasma6" "enable" ] [ "services" "desktopManager" "plasma6" "enable" ])
+    (lib.mkRenamedOptionModule [ "services" "xserver" "desktopManager" "plasma6" "enableQt5Integration" ] [ "services" "desktopManager" "plasma6" "enableQt5Integration" ])
+    (lib.mkRenamedOptionModule [ "services" "xserver" "desktopManager" "plasma6" "notoPackage" ] [ "services" "desktopManager" "plasma6" "notoPackage" ])
+  ];
+
   config = mkIf cfg.enable {
     assertions = [
       {
@@ -161,7 +166,7 @@ in {
     in
       requiredPackages
       ++ utils.removePackagesByName optionalPackages config.environment.plasma6.excludePackages
-      ++ lib.optionals config.services.xserver.desktopManager.plasma6.enableQt5Integration [
+      ++ lib.optionals config.services.desktopManager.plasma6.enableQt5Integration [
         breeze.qt5
         plasma-integration.qt5
         pkgs.plasma5Packages.kwayland-integration
@@ -185,7 +190,7 @@ in {
       "/libexec" # for drkonqi
     ];
 
-    environment.etc."X11/xkb".source = xcfg.xkb.dir;
+    environment.etc."X11/xkb".source = config.services.xserver.xkb.dir;
 
     # Add ~/.config/kdedefaults to XDG_CONFIG_DIRS for shells, since Plasma sets that.
     # FIXME: maybe we should append to XDG_CONFIG_DIRS in /etc/set-environment instead?
diff --git a/nixos/modules/services/x11/desktop-managers/default.nix b/nixos/modules/services/x11/desktop-managers/default.nix
index ecb8d1e91bde..33d0a7b52643 100644
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@@ -18,7 +18,7 @@ in
   # determines the default: later modules (if enabled) are preferred.
   # E.g., if Plasma 5 is enabled, it supersedes xterm.
   imports = [
-    ./none.nix ./xterm.nix ./phosh.nix ./xfce.nix ./plasma5.nix ./plasma6.nix ./lumina.nix
+    ./none.nix ./xterm.nix ./phosh.nix ./xfce.nix ./plasma5.nix ../../desktop-managers/plasma6.nix ./lumina.nix
     ./lxqt.nix ./enlightenment.nix ./gnome.nix ./retroarch.nix ./kodi.nix
     ./mate.nix ./pantheon.nix ./surf-display.nix ./cde.nix
     ./cinnamon.nix ./budgie.nix ./deepin.nix
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 74217b2411ac..da7873c7bec8 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -177,7 +177,7 @@ in
         "network-online.target"
       ];
 
-      path = lib.optional config.boot.zfs.enabled [
+      path = lib.optionals config.boot.zfs.enabled [
         config.boot.zfs.package
         "${config.boot.zfs.package}/lib/udev"
       ]
diff --git a/pkgs/applications/graphics/gthumb/default.nix b/pkgs/applications/graphics/gthumb/default.nix
index 44a86c6447dc..86de9fb2aede 100644
--- a/pkgs/applications/graphics/gthumb/default.nix
+++ b/pkgs/applications/graphics/gthumb/default.nix
@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gthumb";
-  version = "3.12.5";
+  version = "3.12.6";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-9jhd9F/oxyYuw0nhP4FRLpDpl5jdI3eTLkKR1jNZ86s=";
+    sha256 = "sha256-YIdwxsjnMHOh1AS2W9G3YeGsXcJecBMP8HJIj6kvXDM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index 2f54c8d09fe1..8029ff503119 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -47,12 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     qtbase
     qtsvg
-    qtwayland
     cpp-utilities
     qtutilities
     boost
     qtforkawesome
   ] ++ lib.optionals stdenv.isDarwin [ iconv ]
+    ++ lib.optionals stdenv.isLinux [ qtwayland ]
     ++ lib.optionals webviewSupport [ qtwebengine ]
     ++ lib.optionals jsSupport [ qtdeclarative ]
     ++ lib.optionals kioPluginSupport [ kio ]
diff --git a/pkgs/applications/networking/cluster/nomad/default.nix b/pkgs/applications/networking/cluster/nomad/default.nix
index e0181e69c0b9..b0b7fea4ff96 100644
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -81,9 +81,9 @@ rec {
 
   nomad_1_7 = generic {
     buildGoModule = buildGo121Module;
-    version = "1.7.5";
-    sha256 = "sha256-uwPAmmxxlPp5NuuCUTv5VykX+q2vbA0yCRoblrJPP1g=";
-    vendorHash = "sha256-xu1odCHUO3cv0ldXj3T8aM+fqPzc4r1gyFWsiuyzOpU=";
+    version = "1.7.6";
+    sha256 = "sha256-rEWXQwkW/muX3D0An3WmHCoboPACFCrSG7Tyzor2wnQ=";
+    vendorHash = "sha256-95yUtNfN/50LjWHHReaB4/riUqy8J67099bP8Ua7gRw=";
     license = lib.licenses.bsl11;
     passthru.tests.nomad = nixosTests.nomad;
     preCheck = ''
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 7e2f4c577146..0f9581ee78d3 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -9,6 +9,7 @@
 , fetchYarnDeps
 , prefetch-yarn-deps
 , electron
+, libnotify
 , libpulseaudio
 , pipewire
 , alsa-utils
@@ -71,11 +72,11 @@ stdenv.mkDerivation (finalAttrs: {
     done
     popd
 
-    # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, and 'libpipewire' for screen sharing
+    # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, 'libpipewire' for screen sharing and 'libnotify' for notifications
     makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
       ${lib.optionalString stdenv.isLinux ''
         --prefix PATH : ${lib.makeBinPath [ alsa-utils which ]} \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire ]} \
+        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire libnotify ]} \
       ''} \
       --add-flags "$out/share/teams-for-linux/app.asar" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index 6f9e3cab4f59..4f0868730c19 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -118,8 +118,8 @@ in stdenv.mkDerivation rec {
     #ln -s $out/lib/VBoxOGL.so $out/lib/dri/vboxvideo_dri.so
 
     # Install desktop file
-    mkdir -p $out/share/autostart
-    cp -v other/vboxclient.desktop $out/share/autostart
+    mkdir -p $out/etc/xdg/autostart
+    cp -v other/vboxclient.desktop $out/etc/xdg/autostart
 
     # Install Xorg drivers
     mkdir -p $out/lib/xorg/modules/{drivers,input}
diff --git a/pkgs/by-name/at/atuin/package.nix b/pkgs/by-name/at/atuin/package.nix
index 7f4321233125..866b411c46f2 100644
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "atuin";
-  version = "18.0.2";
+  version = "18.1.0";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     rev = "v${version}";
-    hash = "sha256-1ZNp6e2ZjVRU0w9m8YDWOHApu8vRYlcg6MJw03ZV49M=";
+    hash = "sha256-ddj8vHFTRBzeueSvY9kS1ZIcAID8k3MXrQkUVt04rQg=";
   };
 
   # TODO: unify this to one hash because updater do not support this
   cargoHash =
     if stdenv.isLinux
-    then "sha256-1yGv6Tmp7QhxIu3GNyRzK1i9Ghcil30+e8gTvyeKiZs="
-    else "sha256-+QdtQuXTk7Aw7xwelVDp/0T7FAYOnhDqSjazGemzSLw=";
+    then "sha256-LKHBXm9ZThX96JjxJb8d7cRdhWL1t/3aG3Qq1TYBC74="
+    else "sha256-RSkC062XB5zy3lmI0OQhJfJ6FqFWXhpMPNIIqbrrlso=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.
diff --git a/pkgs/by-name/ky/kyverno-chainsaw/package.nix b/pkgs/by-name/ky/kyverno-chainsaw/package.nix
new file mode 100644
index 000000000000..9fb72d1d143b
--- /dev/null
+++ b/pkgs/by-name/ky/kyverno-chainsaw/package.nix
@@ -0,0 +1,38 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kyverno-chainsaw";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "kyverno";
+    repo = "chainsaw";
+    rev = "v${version}";
+    hash = "sha256-v71qAJSpnbHd+jkPkR34IVNvwWLhm04TrPzduB6ZOgA=";
+  };
+
+  vendorHash = "sha256-lHV5Ik/L/Svn9AvcKZupq778ektEsbxfOkCts4Ocx9g=";
+
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/kyverno/chainsaw/pkg/version.BuildVersion=v${version}"
+    "-X github.com/kyverno/chainsaw/pkg/version.BuildHash=${version}"
+    "-X github.com/kyverno/chainsaw/pkg/version.BuildTime=1970-01-01_00:00:00"
+  ];
+
+  doCheck = false; # requires running kubernetes
+
+  meta = {
+    changelog = "https://github.com/kyverno/chainsaw/releases/tag/v${version}";
+    description = "Declarative approach to test Kubernetes operators and controllers";
+    homepage = "https://kyverno.github.io/chainsaw/";
+    license = lib.licenses.asl20;
+    longDescription = ''
+      Chainsaw is meant to test Kubernetes operators work as expected by running a sequence of test steps for:
+      * Creating resources
+      * Asserting operators react (or not) the way they should
+    '';
+    mainProgram = "chainsaw";
+    maintainers = with lib.maintainers; [ Sanskarzz ];
+  };
+}
diff --git a/pkgs/applications/networking/soulseek/nicotine-plus/default.nix b/pkgs/by-name/ni/nicotine-plus/package.nix
similarity index 78%
rename from pkgs/applications/networking/soulseek/nicotine-plus/default.nix
rename to pkgs/by-name/ni/nicotine-plus/package.nix
index 40b8252b47c0..dad01456ba73 100644
--- a/pkgs/applications/networking/soulseek/nicotine-plus/default.nix
+++ b/pkgs/by-name/ni/nicotine-plus/package.nix
@@ -1,11 +1,10 @@
 { lib
-, stdenv
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook4
 , gdk-pixbuf
 , gettext
 , gobject-introspection
-, gtk3
+, gtk4
 , python3Packages
 }:
 
@@ -17,15 +16,15 @@ python3Packages.buildPythonApplication rec {
     owner = "nicotine-plus";
     repo = "nicotine-plus";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-dl4fTa+CXsycC+hhSkIzQQxrSkBDPsdrmKdrHPakGig=";
+    hash = "sha256-dl4fTa+CXsycC+hhSkIzQQxrSkBDPsdrmKdrHPakGig=";
   };
 
-  nativeBuildInputs = [ gettext wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ gettext wrapGAppsHook4 gobject-introspection ];
 
   propagatedBuildInputs = [
     gdk-pixbuf
     gobject-introspection
-    gtk3
+    gtk4
     python3Packages.pygobject3
   ];
 
@@ -35,14 +34,13 @@ python3Packages.buildPythonApplication rec {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}"
+      --prefix XDG_DATA_DIRS : "${gtk4}/share/gsettings-schemas/${gtk4.name}"
     )
   '';
 
   doCheck = false;
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "A graphical client for the SoulSeek peer-to-peer system";
     longDescription = ''
       Nicotine+ aims to be a pleasant, free and open source (FOSS) alternative
diff --git a/pkgs/by-name/pu/pupdate/add-runtime-identifier.patch b/pkgs/by-name/pu/pupdate/add-runtime-identifier.patch
index c70aaad58966..e42677b62572 100644
--- a/pkgs/by-name/pu/pupdate/add-runtime-identifier.patch
+++ b/pkgs/by-name/pu/pupdate/add-runtime-identifier.patch
@@ -1,6 +1,6 @@
-From f56083d95304752c45cc569fe42c3b0d7a2430bd Mon Sep 17 00:00:00 2001
+From 84d8c110882fe23bdd05d9007225b71d4395bbaa Mon Sep 17 00:00:00 2001
 From: Philipp Rintz <git@rintz.net>
-Date: Wed, 24 Jan 2024 22:11:50 +0100
+Date: Sun, 3 Mar 2024 18:05:40 +0100
 Subject: [PATCH] uncommited
 
 ---
@@ -8,17 +8,16 @@ Subject: [PATCH] uncommited
  1 file changed, 1 insertion(+)
 
 diff --git a/pupdate.csproj b/pupdate.csproj
-index a6f59a8..0563137 100644
+index 04fe5e0..962682f 100644
 --- a/pupdate.csproj
 +++ b/pupdate.csproj
 @@ -12,6 +12,7 @@
      <Authors>Matt Pannella</Authors>
      <Product>Pupdate</Product>
-     <RepositoryUrl>https://github.com/mattpannella/pocket-updater-utility</RepositoryUrl>
+     <RepositoryUrl>https://github.com/mattpannella/pupdate</RepositoryUrl>
 +    <RuntimeIdentifier>@RuntimeIdentifier@</RuntimeIdentifier>
+     <RootNamespace>Pannella</RootNamespace>
    </PropertyGroup>
    <ItemGroup>
-     <PackageReference Include="CommandLineParser" Version="2.9.1" />
 -- 
-2.40.1
-
+2.42.0
diff --git a/pkgs/by-name/pu/pupdate/deps.nix b/pkgs/by-name/pu/pupdate/deps.nix
index eea7ea49accb..ddbc8888d1b5 100644
--- a/pkgs/by-name/pu/pupdate/deps.nix
+++ b/pkgs/by-name/pu/pupdate/deps.nix
@@ -7,4 +7,5 @@
   (fetchNuGet { pname = "Crc32.NET"; version = "1.2.0"; sha256 = "0qaj3192k1vfji87zf50rhydn5mrzyzybrs2k4v7ap29k8i0vi5h"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "2.0.0"; sha256 = "1bc4ba8ahgk15m8k4nd7x406nhi0kwqzbgjk2dmw52ss553xz7iy"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
 ]
diff --git a/pkgs/by-name/pu/pupdate/package.nix b/pkgs/by-name/pu/pupdate/package.nix
index 54a979fa6bb1..0a6eb740804f 100644
--- a/pkgs/by-name/pu/pupdate/package.nix
+++ b/pkgs/by-name/pu/pupdate/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule rec {
   pname = "pupdate";
-  version = "3.2.1";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "mattpannella";
     repo = "${pname}";
     rev = "${version}";
-    hash = "sha256-jAZozcCHgKFTPCRktajrI77iH/GBbzhWa+QKZz1w62Y=";
+    hash = "sha256-i9Y0liHeHrVwkYWzC/oRRKK3fu3GVcCfM6jGO9asIdQ=";
   };
 
   buildInputs = [
@@ -43,11 +43,11 @@ buildDotnetModule rec {
   executables = [ "pupdate" ];
 
   dotnetFlags = [
-    "-p:PackageRuntime=${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}"
+    "-p:PackageRuntime=${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system} -p:TrimMode=partial"
   ];
 
-  dotnet-sdk = dotnetCorePackages.sdk_6_0;
-  dotnet-runtime = dotnetCorePackages.runtime_6_0;
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
+  dotnet-runtime = dotnetCorePackages.runtime_7_0;
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/sp/spicetify-cli/package.nix b/pkgs/by-name/sp/spicetify-cli/package.nix
index a593c87c3d46..611ee8b47025 100644
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.33.2";
+  version = "2.34.0";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-GCeauokKzIbWwYrUopvvKEV7OBdoCfzFjHj0YxSuW3U=";
+    hash = "sha256-37bR6Tf6vOrrILb9liyyCYiH6VNnGpQ3yUnQcXA8o14=";
   };
 
-  vendorHash = "sha256-9rYShpUVI3KSY6UgGmoXo899NkUezkAAkTgFPdq094E=";
+  vendorHash = "sha256-axE1SY+UW5oddyhOiktq+vNfhw2/SFX4ut4Hivg6TYQ=";
 
   ldflags = [
     "-s -w"
diff --git a/pkgs/servers/geospatial/t-rex/default.nix b/pkgs/by-name/t-/t-rex/package.nix
similarity index 60%
rename from pkgs/servers/geospatial/t-rex/default.nix
rename to pkgs/by-name/t-/t-rex/package.nix
index c96d8a8247f5..f26592e052d0 100644
--- a/pkgs/servers/geospatial/t-rex/default.nix
+++ b/pkgs/by-name/t-/t-rex/package.nix
@@ -1,21 +1,22 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, gdal, openssl, Security }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, gdal, openssl, darwin }:
 
 rustPlatform.buildRustPackage rec {
   pname = "t-rex";
-  version = "0.14.3";
+  version = "0.15.0-alpha3";
 
   src = fetchFromGitHub {
     owner = "t-rex-tileserver";
-    repo = pname;
+    repo = "t-rex";
     rev = "v${version}";
-    hash = "sha256-LUVk5li2cl/LKbhKOh6Bbwav0GEuI/vUbDPLn7NSRIs=";
+    hash = "sha256-oZZrR86/acoyMX3vC1JGrpc8G+DEuplqfEAnaP+TBGU=";
   };
 
-  cargoHash = "sha256-I4QmjTTKUp9iugEwzM0xCcNLvF5ozeBdYmbi8sytY88=";
+  cargoHash = "sha256-nxq4mX2Sy6Hyi8tA2CQsQwISB/kau4DEkAgIm4SvGns=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
 
-  buildInputs = [ gdal openssl ] ++ lib.optional stdenv.isDarwin Security;
+  buildInputs = [ gdal openssl ]
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
   meta = with lib; {
     description = "Vector tile server specialized on publishing MVT tiles";
@@ -25,6 +26,5 @@ rustPlatform.buildRustPackage rec {
     maintainers = teams.geospatial.members;
     mainProgram = "t_rex";
     platforms = platforms.unix;
-    broken = true;  # https://github.com/t-rex-tileserver/t-rex/issues/302
   };
 }
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index dff6b847fd12..028f3deb2cdd 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.14.183";
+  version = "0.14.184";
 
   src = fetchFromGitHub {
     owner = "tigerbeetle";
     repo = "tigerbeetle";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-vyxuzSTwaXrQKVErxiwxjOQWUnHQMEl+PQGd/HU+noc=";
+    hash = "sha256-7npd5qYrpE1mR/ZiDqH4sxCmjVAvF+R5bnlb3b/8+sk=";
   };
 
   nativeBuildInputs = [ custom_zig_hook ];
diff --git a/pkgs/by-name/yo/youtrack/package.nix b/pkgs/by-name/yo/youtrack/package.nix
index a3897a2a5de9..96cefb69ffc8 100644
--- a/pkgs/by-name/yo/youtrack/package.nix
+++ b/pkgs/by-name/yo/youtrack/package.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "youtrack";
-  version = "2023.3.24329";
+  version = "2024.1.25893";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/charisma/youtrack-${finalAttrs.version}.zip";
-    hash = "sha256-YIqRTCON8S/emj2AChrxhY4dfwtCnXtbiAQCTQ9k54Q=";
+    hash = "sha256-YH+SC2kc4jfW3Tn9pnhROoUHID1JAWF86As5rrU4xlY=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/development/compilers/idris2/build-idris.nix b/pkgs/development/compilers/idris2/build-idris.nix
index 3ad0956e3a08..e66306c4344b 100644
--- a/pkgs/development/compilers/idris2/build-idris.nix
+++ b/pkgs/development/compilers/idris2/build-idris.nix
@@ -18,11 +18,13 @@
 , ... }@attrs:
 
 let
+  propagate = libs: lib.unique (lib.concatMap (nextLib: [nextLib] ++ nextLib.propagatedIdrisLibraries) libs);
   ipkgFileName = ipkgName + ".ipkg";
   idrName = "idris2-${idris2.version}";
   libSuffix = "lib/${idrName}";
+  propagatedIdrisLibraries = propagate idrisLibraries;
   libDirs =
-    (lib.makeSearchPath libSuffix idrisLibraries) +
+    (lib.makeSearchPath libSuffix propagatedIdrisLibraries) +
     ":${idris2}/${idrName}";
   supportDir = "${idris2}/${idrName}/lib";
   drvAttrs = builtins.removeAttrs attrs [
@@ -35,7 +37,7 @@ let
     inherit version;
     src = src;
     nativeBuildInputs = [ idris2 makeWrapper ] ++ attrs.nativeBuildInputs or [];
-    buildInputs = idrisLibraries ++ attrs.buildInputs or [];
+    buildInputs = propagatedIdrisLibraries ++ attrs.buildInputs or [];
 
     IDRIS2_PACKAGE_PATH = libDirs;
 
@@ -44,6 +46,10 @@ let
       idris2 --build ${ipkgFileName}
       runHook postBuild
     '';
+
+    passthru = {
+      inherit propagatedIdrisLibraries;
+    };
   };
 
 in {
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index fee4889e1add..e2fc481d3bc3 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin";
-  version = "1.9.22";
+  version = "1.9.23";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "1rn3rabwyqqhs6xgyfwl326hrzpfpc3qqd2nzwbchck5a09r5cw8";
+    sha256 = "125yb2yzah7laf38m78pysvcd5a16b129a06rckrpylsmcx7s4wk";
   };
 
   propagatedBuildInputs = [ jre ] ;
diff --git a/pkgs/development/compilers/kotlin/native.nix b/pkgs/development/compilers/kotlin/native.nix
index bc2018665ca7..a38daa96cf17 100644
--- a/pkgs/development/compilers/kotlin/native.nix
+++ b/pkgs/development/compilers/kotlin/native.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin-native";
-  version = "1.9.22";
+  version = "1.9.23";
 
   src = let
     getArch = {
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
       "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-native-${arch}-${version}.tar.gz";
 
     getHash = arch: {
-      "macos-aarch64" = "1pf81rplikbp194pjrm2la101iz8vz3jv55109nipd26xghc15ca";
-      "macos-x86_64" = "1r7dmk8cc7f3iwaxamlnlcjl4mbvx443nwvsp8141a21ibrvrmx9";
-      "linux-x86_64" = "1m77qld44gbarjxm99gsdscncx4v0cf6ca3h9bdh2m7d3i4adc62";
+      "macos-aarch64" = "1v1ld4nxa77vjxiz4jw5h29s8i4ghfbmq0d01r15i75pr46md8r7";
+      "macos-x86_64" = "05ywdhagj3qzjaw5sd94sgjk89dysky7d7lfqpwvc8s35v77rv8f";
+      "linux-x86_64" = "1j2lpl1r7r30dgard6ia29n3qrsr98wb3qwpc80z4jh6k42qn6id";
     }.${arch};
   in
     fetchurl {
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index eee140f7b7e2..6ebb2ea9fcc2 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -1,5 +1,5 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, stdenvNoCC, cmake, ninja
-, gccForLibs, preLibcCrossHeaders
+{ lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
+, preLibcCrossHeaders
 , libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -272,6 +272,12 @@ in let
       nixSupport.cc-cflags = [ "-fno-exceptions" ];
     });
 
+    # Has to be in tools despite mostly being a library,
+    # because we use a native helper executable from a
+    # non-cross build in cross builds.
+    libclc = callPackage ../common/libclc.nix {
+      inherit buildLlvmTools;
+    };
   });
 
   libraries = lib.makeExtensible (libraries: let
diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index 0201edd60c7f..d168f40fc478 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -15,7 +15,11 @@ let
 
   # ROCm, if actively updated will always be at the latest version
   branch =
-    if llvmMajor == "17" || isROCm then rec {
+    if llvmMajor == "18" then rec {
+      version = "18.1.0";
+      rev = "v${version}";
+      hash = "sha256-64guZiuO7VpaX01wNIjV7cnjEAe6ineMdY44S6sA33k=";
+    } else if llvmMajor == "17" || isROCm then rec {
       version = "17.0.0";
       rev = "v${version}";
       hash = "sha256-Rzm5Py9IPFtS9G7kME+uSwZ/0gPGW6MlL35ZWk4LfHM=";
@@ -47,7 +51,15 @@ stdenv.mkDerivation {
     inherit (branch) rev hash;
   };
 
-  patches = lib.optionals (lib.versionAtLeast llvmMajor "15") [
+  patches = lib.optionals (llvmMajor == "18") [
+    # Fixes build after SPV_INTEL_maximum_registers breaking change
+    # TODO: remove on next spirv-headers release
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/d970c9126c033ebcbb7187bc705eae2e54726b74.patch";
+      revert = true;
+      hash = "sha256-71sJuGqVjTcB549eIiCO0LoqAgxkdEHCoxh8Pd/Qzz8=";
+    })
+  ] ++ lib.optionals (lib.versionAtLeast llvmMajor "15" && lib.versionOlder llvmMajor "18") [
     # Fixes build after spirv-headers breaking change
     (fetchpatch {
       url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/0166a0fb86dc6c0e8903436bbc3a89bc3273ebc0.patch";
diff --git a/pkgs/development/libraries/intel-gmmlib/default.nix b/pkgs/development/libraries/intel-gmmlib/default.nix
index 58eba3ddc6d9..6d21c7bc6e1a 100644
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.3.17";
+  version = "22.3.18";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-9utlENByIQSayKTdSJapLBWMI2gFpOReNZe7bpbEoj8=";
+    sha256 = "sha256-woEYEgvwf12aWCeYqSiosQAUJErGaEP3q8JER971lys=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/usbredir/default.nix b/pkgs/development/libraries/usbredir/default.nix
index ea69a0577cc4..c7e8a361ee16 100644
--- a/pkgs/development/libraries/usbredir/default.nix
+++ b/pkgs/development/libraries/usbredir/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation rec {
   pname = "usbredir";
-  version = "0.14.0";
+  version = "0.13.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "spice";
     repo = "usbredir";
     rev = "${pname}-${version}";
-    sha256 = "sha256-ShxysMoFSGP/dSIPthwb1Q6htotv7BP9jm09p2Nqdus=";
+    sha256 = "sha256-zehf0DkqSSvmatbk/UB1oySjyqiFUYTuIhqb5xKeK7I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/wlroots/default.nix b/pkgs/development/libraries/wlroots/default.nix
index e9265de54c61..61027c374c11 100644
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@@ -134,8 +134,8 @@ rec {
   };
 
   wlroots_0_17 = generic {
-    version = "0.17.1";
-    hash = "sha256-Z0gWM7AQqJOSr2maUtjdgk/MF6pyeyFMMTaivgt+RMI=";
+    version = "0.17.2";
+    hash = "sha256-Of9qykyVnBURc5A2pvCMm7sLbnuuG7OPWLxodQLN2Xg=";
     extraBuildInputs = [
       ffmpeg
       hwdata
diff --git a/pkgs/development/python-modules/cffconvert/default.nix b/pkgs/development/python-modules/cffconvert/default.nix
new file mode 100644
index 000000000000..9ca8fb492e5e
--- /dev/null
+++ b/pkgs/development/python-modules/cffconvert/default.nix
@@ -0,0 +1,64 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, click
+, requests
+, ruamel-yaml
+, pykwalify
+, jsonschema
+, pytestCheckHook
+, pytest-cov
+}:
+
+buildPythonPackage rec {
+  pname = "cffconvert";
+  version = "2.0.0-unstable-2024-02-12";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "citation-file-format";
+    repo = "cffconvert";
+    rev = "5295f87c0e261da61a7b919fc754e3a77edd98a7";
+    hash = "sha256-/2qhWVNylrqPSf1KmuZQahzq+YH860cohVSfJsDm1BE=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    click
+    requests
+    ruamel-yaml
+    pykwalify
+    jsonschema
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    # addopts uses --no-cov
+    pytest-cov
+  ];
+
+  disabledTestPaths = [
+    # requires network access
+    "tests/cli/test_rawify_url.py"
+  ];
+
+  pythonImportsCheckHook = [
+    "cffconvert"
+  ];
+
+  meta = {
+    changelog = "https://github.com/citation-file-format/cffconvert/blob/${src.rev}/CHANGELOG.md";
+    description = "Command line program to validate and convert CITATION.cff files";
+    homepage = "https://github.com/citation-file-format/cffconvert";
+    license = lib.licenses.asl20;
+    mainProgram = "cffconvert";
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/pkgs/development/tools/earthly/default.nix b/pkgs/development/tools/earthly/default.nix
index ce44264021da..5845586a5b3e 100644
--- a/pkgs/development/tools/earthly/default.nix
+++ b/pkgs/development/tools/earthly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "earthly";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "earthly";
     repo = "earthly";
     rev = "v${version}";
-    hash = "sha256-8grH07Vt6mrsKJ8FsG1yZcfLv5R8UIEBu19f1kal7Us=";
+    hash = "sha256-vNgRI/LQZPILwYdIGk6BB+Yb36rEHv6kHZARq0+TF9Q=";
   };
 
-  vendorHash = "sha256-zYueMiU3eL2vb2fn1dMkbfge+jZzM3Ry/AeLJerlMFg=";
+  vendorHash = "sha256-14aaGrEJBdSo1hZf37xUO2S/q6YlaSqJuQCzP/PVkr8=";
   subPackages = [ "cmd/earthly" "cmd/debugger" ];
 
   CGO_ENABLED = 0;
diff --git a/pkgs/development/tools/misc/astyle/default.nix b/pkgs/development/tools/misc/astyle/default.nix
index 880530511e1b..541c9079db5b 100644
--- a/pkgs/development/tools/misc/astyle/default.nix
+++ b/pkgs/development/tools/misc/astyle/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "astyle";
-  version = "3.4.12";
+  version = "3.4.13";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-B3RZsp9zhvJWnBQsaKW2YHaAsMvaAhAgn/6m/w9atg4=";
+    hash = "sha256-eKYQq9OelOD5E+nuXNoehbtizWM1U97LngDT2SAQGc4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index 9e37ce1713f2..814f6872d3f3 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.32.7";
+  version = "0.32.8";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gH0wJRf64XloBfnvtNdZlONESjxG5mS5Ok9HTX1PJUA=";
+    hash = "sha256-ZXtzQEi5aLiYa4KjH3DkFPFi6EEEjxof6Y+8cRJkSCM=";
   };
 
-  vendorHash = "sha256-YvzUdcCjkCApufLk5CZv6L/mIlOuo9qEBoxHOxv2Ljc=";
+  vendorHash = "sha256-DGomEJ0IGs8uOrn50N+R3tRZJvw7iyHlPVpH3CVvjsU=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index bdc3e1a0da7a..313bc865da28 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -73,7 +73,7 @@ rustPlatform.buildRustPackage {
     description = "A modern shell written in Rust";
     homepage = "https://www.nushell.sh/";
     license = licenses.mit;
-    maintainers = with maintainers; [ Br1ght0ne johntitor marsam ];
+    maintainers = with maintainers; [ Br1ght0ne johntitor marsam joaquintrinanes ];
     mainProgram = "nu";
   };
 }
diff --git a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/cmakelists.patch b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/cmakelists.patch
index faeb65d3b847..19453e8912a9 100644
--- a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/cmakelists.patch
+++ b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/cmakelists.patch
@@ -1,13 +1,15 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 1e7b71a..9db85b1 100644
+index 1e7b71a..e743ab0 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -107,6 +107,8 @@ if(USE_SYSTEM_NCNN)
+@@ -106,9 +106,9 @@ if(USE_SYSTEM_NCNN)
+         message(STATUS "Using glslang install located at ${GLSLANG_TARGET_DIR}")
 
          find_package(Threads)
++        find_package(SPIRV-Tools-opt REQUIRED)
 
-+        include("${GLSLANG_TARGET_DIR}/SPIRV-Tools/SPIRV-ToolsTarget.cmake")
-+        include("${GLSLANG_TARGET_DIR}/SPIRV-Tools-opt/SPIRV-Tools-optTargets.cmake")
          include("${GLSLANG_TARGET_DIR}/OSDependentTargets.cmake")
-         include("${GLSLANG_TARGET_DIR}/OGLCompilerTargets.cmake")
+-        include("${GLSLANG_TARGET_DIR}/OGLCompilerTargets.cmake")
          if(EXISTS "${GLSLANG_TARGET_DIR}/HLSLTargets.cmake")
+             # hlsl support can be optional
+             include("${GLSLANG_TARGET_DIR}/HLSLTargets.cmake")
diff --git a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
index 6a3b66a3548c..c7f9817326b8 100644
--- a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
+++ b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
@@ -50,15 +50,20 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out/bin $out/share
+
     cp realesrgan-ncnn-vulkan $out/bin/
     cp -r ${models}/models $out/share
   '';
 
+  postFixup = ''
+    patchelf $out/bin/realesrgan-ncnn-vulkan --add-needed libvulkan.so
+  '';
+
   meta = with lib; {
     description = "NCNN implementation of Real-ESRGAN. Real-ESRGAN aims at developing Practical Algorithms for General Image Restoration";
     homepage = "https://github.com/xinntao/Real-ESRGAN-ncnn-vulkan";
     license = licenses.mit;
-    maintainers = with maintainers; [ tilcreator ];
+    maintainers = with maintainers; [ tilcreator iynaix ];
     platforms = platforms.all;
     mainProgram = "realesrgan-ncnn-vulkan";
   };
diff --git a/pkgs/tools/text/djot-js/default.nix b/pkgs/tools/text/djot-js/default.nix
index bd8b742cc184..656d7d0f6ba8 100644
--- a/pkgs/tools/text/djot-js/default.nix
+++ b/pkgs/tools/text/djot-js/default.nix
@@ -1,32 +1,21 @@
 { lib
 , buildNpmPackage
 , fetchFromGitHub
-, fetchpatch
 , installShellFiles
 }:
 
 buildNpmPackage rec {
   pname = "djot-js";
-  version = "0.2.3";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "jgm";
     repo = "djot.js";
     rev = "@djot/djot@${version}";
-    hash = "sha256-W/ZQXJXvFEIgj5PeI+jvw4nIkNP4qa1NyQCOv0unIuA=";
+    hash = "sha256-dQfjI+8cKqn4qLT9eUKfCP++BFCWQ/MmrlQNVRNCFuU=";
   };
 
-  npmDepsHash = "sha256-x/Oc39S6XwZ/ZsS/lmMU9OkHLlKuUxETYmD8pdHAIg8=";
-
-  patches = [
-    # djot.js v0.2.3 doesn't include package-lock.json in the repository
-    # remove at next release
-    (fetchpatch {
-      name = "add-package-lock-json-and-yarn-lock-to-repository.patch";
-      url = "https://github.com/jgm/djot.js/commit/15ed52755b2968932d4a9a80805b9ea6183fe539.patch";
-      hash = "sha256-saNmU7z4IOOG3ptXMFDSNci5uu0d2GiVZ/FAlaNccTc=";
-    })
-  ];
+  npmDepsHash = "sha256-FjrjwhVv2WRjbEga9w37lwz7KYgTTHGsoqt496Uq/0c=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/typesetting/tectonic/tests.nix b/pkgs/tools/typesetting/tectonic/tests.nix
index da1961c8e42d..eac66f19599e 100644
--- a/pkgs/tools/typesetting/tectonic/tests.nix
+++ b/pkgs/tools/typesetting/tectonic/tests.nix
@@ -90,4 +90,10 @@ lib.mapAttrs networkRequiringTestPkg {
     tectonic -X new
     cat Tectonic.toml | grep "${tectonic.bundleUrl}"
   '';
+
+  /** test that the `nextonic -> tectonic` symlink is working as intended */
+  nextonic = ''
+    nextonic new 2>&1 \
+      | grep '"version 2" Tectonic command-line interface activated'
+  '';
 }
diff --git a/pkgs/tools/typesetting/tectonic/wrapper.nix b/pkgs/tools/typesetting/tectonic/wrapper.nix
index 42125e7855d8..900c695c9218 100644
--- a/pkgs/tools/typesetting/tectonic/wrapper.nix
+++ b/pkgs/tools/typesetting/tectonic/wrapper.nix
@@ -46,7 +46,8 @@ symlinkJoin {
   + ''
     makeWrapper ${lib.getBin tectonic-unwrapped}/bin/tectonic $out/bin/tectonic \
       --prefix PATH : "${lib.getBin biber-for-tectonic}/bin" \
-      --add-flags "--web-bundle ${tectonic.passthru.bundleUrl}"
+      --add-flags "--web-bundle ${tectonic.passthru.bundleUrl}" \
+      --inherit-argv0 ## make sure binary name e.g. `nextonic` is passed along
     ln -s $out/bin/tectonic $out/bin/nextonic
   '';
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ad904269f811..bb5f139493e1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7094,6 +7094,8 @@ with pkgs;
 
   certstrap = callPackage ../tools/security/certstrap { };
 
+  cffconvert = python3Packages.toPythonApplication python3Packages.cffconvert;
+
   cfssl = callPackage ../tools/security/cfssl { };
 
   cfs-zen-tweaks = callPackage ../os-specific/linux/cfs-zen-tweaks { };
@@ -19978,7 +19980,9 @@ with pkgs;
   terracognita = callPackage ../development/tools/misc/terracognita { };
 
   terraform-lsp = callPackage ../development/tools/misc/terraform-lsp { };
-  terraform-ls = callPackage ../development/tools/misc/terraform-ls { };
+  terraform-ls = callPackage ../development/tools/misc/terraform-ls {
+    buildGoModule = buildGo122Module;
+  };
 
   terraformer = callPackage ../development/tools/misc/terraformer { };
 
@@ -27223,10 +27227,6 @@ with pkgs;
 
   pg_tileserv = callPackage ../servers/geospatial/pg_tileserv { };
 
-  t-rex = callPackage ../servers/geospatial/t-rex {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   tegola = callPackage ../servers/geospatial/tegola { };
 
   tile38 = callPackage ../servers/geospatial/tile38 { };
@@ -33608,8 +33608,6 @@ with pkgs;
     webkitgtk = webkitgtk_6_0;
   };
 
-  nicotine-plus = callPackage ../applications/networking/soulseek/nicotine-plus { };
-
   nice-dcv-client = callPackage ../applications/networking/remote/nice-dcv-client { };
 
   nixos-shell = callPackage ../tools/virtualization/nixos-shell { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 44d0dc3fd64c..597ea2d6cb91 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1987,6 +1987,8 @@ self: super: with self; {
 
   cf-xarray = callPackage ../development/python-modules/cf-xarray { };
 
+  cffconvert = callPackage ../development/python-modules/cffconvert { };
+
   cffi = callPackage ../development/python-modules/cffi { };
 
   cffsubr = callPackage ../development/python-modules/cffsubr { };