diff --git a/lib/meta.nix b/lib/meta.nix
index 5d5f71d6c3cb..675e1912d4be 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -87,6 +87,10 @@ rec {
 
      We can inject these into a pattern for the whole of a structured platform,
      and then match that.
+
+     Example:
+      lib.meta.platformMatch { system = "aarch64-darwin"; } "aarch64-darwin"
+      => true
   */
   platformMatch = platform: elem: (
     # Check with simple string comparison if elem was a string.
@@ -112,6 +116,10 @@ rec {
           platform, or `meta.platforms` is not present.
 
        2. None of `meta.badPlatforms` pattern matches the given platform.
+
+     Example:
+       lib.meta.availableOn { system = "aarch64-darwin"; } pkg.zsh
+       => true
   */
   availableOn = platform: pkg:
     ((!pkg?meta.platforms) || any (platformMatch platform) pkg.meta.platforms) &&
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index fe75373b7f5d..57d9febcd760 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -87,6 +87,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [go-camo](https://github.com/cactus/go-camo), a secure image proxy server. Available as [services.go-camo](#opt-services.go-camo.enable).
 
+- [Monado](https://monado.freedesktop.org/), an open source XR runtime. Available as [services.monado](#opt-services.monado.enable).
+
 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).
 
 - [TuxClocker](https://github.com/Lurkki14/tuxclocker), a hardware control and monitoring program. Available as [programs.tuxclocker](#opt-programs.tuxclocker.enable).
@@ -105,7 +107,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `himalaya` was updated to v1.0.0-beta, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta) for details.
+- `himalaya` was updated to `v1.0.0-beta.3`, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.3) for details.
 
 - The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.
 
diff --git a/nixos/lib/testing/nixos-test-base.nix b/nixos/lib/testing/nixos-test-base.nix
index 5f7564d640f9..d76a25361f8c 100644
--- a/nixos/lib/testing/nixos-test-base.nix
+++ b/nixos/lib/testing/nixos-test-base.nix
@@ -18,6 +18,7 @@ in
       # version number.
       config.system.nixos = {
         revision = mkForce "constant-nixos-revision";
+        versionSuffix = mkForce "test";
         label = mkForce "test";
       };
     }
diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index a50f22cbe471..028a2d74041e 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -62,19 +62,12 @@ with lib;
       };
 
     fileSystems."/nix/store" = mkImageMediaOverride
-      { fsType = "overlay";
-        device = "overlay";
-        options = [
-          "lowerdir=/nix/.ro-store"
-          "upperdir=/nix/.rw-store/store"
-          "workdir=/nix/.rw-store/work"
-        ];
-
-        depends = [
-          "/nix/.ro-store"
-          "/nix/.rw-store/store"
-          "/nix/.rw-store/work"
-        ];
+      { overlay = {
+          lowerdir = [ "/nix/.ro-store" ];
+          upperdir = "/nix/.rw-store/store";
+          workdir = "/nix/.rw-store/work";
+        };
+        neededForBoot = true;
       };
 
     boot.initrd.availableKernelModules = [ "squashfs" "overlay" ];
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1c0d256ea1b2..378921c99694 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -548,6 +548,7 @@
   ./services/hardware/lcd.nix
   ./services/hardware/lirc.nix
   ./services/hardware/nvidia-container-toolkit-cdi-generator
+  ./services/hardware/monado.nix
   ./services/hardware/nvidia-optimus.nix
   ./services/hardware/openrgb.nix
   ./services/hardware/pcscd.nix
diff --git a/nixos/modules/services/hardware/monado.nix b/nixos/modules/services/hardware/monado.nix
new file mode 100644
index 000000000000..9f9c6c39a0b4
--- /dev/null
+++ b/nixos/modules/services/hardware/monado.nix
@@ -0,0 +1,102 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+let
+  inherit (lib) mkDefault mkEnableOption mkIf mkOption mkPackageOption types;
+
+  cfg = config.services.monado;
+
+in
+{
+  options.services.monado = {
+    enable = mkEnableOption "Monado user service";
+
+    package = mkPackageOption pkgs "monado" { };
+
+    defaultRuntime = mkOption {
+      type = types.bool;
+      description = ''
+        Whether to enable Monado as the default OpenXR runtime on the system.
+
+        Note that applications can bypass this option by setting an active
+        runtime in a writable XDG_CONFIG_DIRS location like `~/.config`.
+      '';
+      default = false;
+      example = true;
+    };
+
+    highPriority = mkEnableOption "high priority capability for monado-service"
+      // mkOption { default = true; };
+  };
+
+  config = mkIf cfg.enable {
+    security.wrappers."monado-service" = mkIf cfg.highPriority {
+      setuid = false;
+      owner = "root";
+      group = "root";
+      # cap_sys_nice needed for asynchronous reprojection
+      capabilities = "cap_sys_nice+eip";
+      source = lib.getExe' cfg.package "monado-service";
+    };
+
+    services.udev.packages = with pkgs; [ xr-hardware ];
+
+    systemd.user = {
+      services.monado = {
+        description = "Monado XR runtime service module";
+        requires = [ "monado.socket" ];
+        conflicts = [ "monado-dev.service" ];
+
+        unitConfig.ConditionUser = "!root";
+
+        environment = {
+          # Default options
+          # https://gitlab.freedesktop.org/monado/monado/-/blob/4548e1738591d0904f8db4df8ede652ece889a76/src/xrt/targets/service/monado.in.service#L12
+          XRT_COMPOSITOR_LOG = mkDefault "debug";
+          XRT_PRINT_OPTIONS = mkDefault "on";
+          IPC_EXIT_ON_DISCONNECT = mkDefault "off";
+        };
+
+        serviceConfig = {
+          ExecStart =
+            if cfg.highPriority
+            then "${config.security.wrapperDir}/monado-service"
+            else lib.getExe' cfg.package "monado-service";
+          Restart = "no";
+        };
+
+        restartTriggers = [ cfg.package ];
+      };
+
+      sockets.monado = {
+        description = "Monado XR service module connection socket";
+        conflicts = [ "monado-dev.service" ];
+
+        unitConfig.ConditionUser = "!root";
+
+        socketConfig = {
+          ListenStream = "%t/monado_comp_ipc";
+          RemoveOnStop = true;
+
+          # If Monado crashes while starting up, we want to close incoming OpenXR connections
+          FlushPending = true;
+        };
+
+        restartTriggers = [ cfg.package ];
+
+        wantedBy = [ "sockets.target" ];
+      };
+    };
+
+    environment.systemPackages = [ cfg.package ];
+    environment.pathsToLink = [ "/share/openxr" ];
+
+    environment.etc."xdg/openxr/1/active_runtime.json" = mkIf cfg.defaultRuntime {
+      source = "${cfg.package}/share/openxr/1/openxr_monado.json";
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ Scrumplex ];
+}
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index 266a7ea1435e..8d5ac02ba88b 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -13,6 +13,8 @@ let
   enableDHCP = config.networking.dhcpcd.enable &&
         (config.networking.useDHCP || any (i: i.useDHCP == true) interfaces);
 
+  enableNTPService = (config.services.ntp.enable || config.services.ntpd-rs.enable || config.services.openntpd.enable || config.services.chrony.enable);
+
   # Don't start dhcpcd on explicitly configured interfaces or on
   # interfaces that are part of a bridge, bond or sit device.
   ignoredInterfaces =
@@ -89,20 +91,22 @@ let
       ${cfg.extraConfig}
     '';
 
-  exitHook = pkgs.writeText "dhcpcd.exit-hook"
-    ''
+  exitHook = pkgs.writeText "dhcpcd.exit-hook" ''
+    ${optionalString enableNTPService ''
       if [ "$reason" = BOUND -o "$reason" = REBOOT ]; then
-          # Restart ntpd.  We need to restart it to make sure that it
-          # will actually do something: if ntpd cannot resolve the
-          # server hostnames in its config file, then it will never do
-          # anything ever again ("couldn't resolve ..., giving up on
-          # it"), so we silently lose time synchronisation. This also
-          # applies to openntpd.
-          /run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service ntpd-rs.service || true
+        # Restart ntpd. We need to restart it to make sure that it will actually do something:
+        # if ntpd cannot resolve the server hostnames in its config file, then it will never do
+        # anything ever again ("couldn't resolve ..., giving up on it"), so we silently lose
+        # time synchronisation. This also applies to openntpd.
+        ${optionalString config.services.ntp.enable "/run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd.service || true"}
+        ${optionalString config.services.ntpd-rs.enable "/run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd-rs.service || true"}
+        ${optionalString config.services.openntpd.enable "/run/current-system/systemd/bin/systemctl try-reload-or-restart openntpd.service || true"}
+        ${optionalString config.services.chrony.enable "/run/current-system/systemd/bin/systemctl try-reload-or-restart chronyd.service || true"}
       fi
+    ''}
 
-      ${cfg.runHook}
-    '';
+    ${cfg.runHook}
+  '';
 
 in
 
@@ -232,7 +236,7 @@ in
         wants = [ "network.target" ];
         before = [ "network-online.target" ];
 
-        restartTriggers = [ exitHook ];
+        restartTriggers = optional (enableNTPService || cfg.runHook != "") [ exitHook ];
 
         # Stopping dhcpcd during a reconfiguration is undesirable
         # because it brings down the network interfaces configured by
@@ -261,7 +265,9 @@ in
 
     environment.systemPackages = [ dhcpcd ];
 
-    environment.etc."dhcpcd.exit-hook".source = exitHook;
+    environment.etc."dhcpcd.exit-hook" = mkIf (enableNTPService || cfg.runHook != "") {
+      source = exitHook;
+    };
 
     powerManagement.resumeCommands = mkIf config.systemd.services.dhcpcd.enable
       ''
diff --git a/nixos/modules/system/boot/plymouth.nix b/nixos/modules/system/boot/plymouth.nix
index b041b8951fa3..16bca40993ae 100644
--- a/nixos/modules/system/boot/plymouth.nix
+++ b/nixos/modules/system/boot/plymouth.nix
@@ -186,6 +186,8 @@ in
           # module might come from a theme
           cp ${themesEnv}/lib/plymouth/*.so $out
           cp ${plymouth}/lib/plymouth/renderers/*.so $out/renderers
+          # useless in the initrd, and adds several megabytes to the closure
+          rm $out/renderers/x11.so
         '';
         "/etc/plymouth/themes".source = pkgs.runCommand "plymouth-initrd-themes" {} ''
           # Check if the actual requested theme is here
@@ -271,6 +273,8 @@ in
       # module might come from a theme
       cp ${themesEnv}/lib/plymouth/*.so $out/lib/plymouth
       cp ${plymouth}/lib/plymouth/renderers/*.so $out/lib/plymouth/renderers
+      # useless in the initrd, and adds several megabytes to the closure
+      rm $out/lib/plymouth/renderers/x11.so
 
       mkdir -p $out/share/plymouth/themes
       cp ${plymouth}/share/plymouth/plymouthd.defaults $out/share/plymouth
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a70326a436ef..a5991abbfc88 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -537,6 +537,7 @@ in {
   mobilizon = handleTest ./mobilizon.nix {};
   mod_perl = handleTest ./mod_perl.nix {};
   molly-brown = handleTest ./molly-brown.nix {};
+  monado = handleTest ./monado.nix {};
   monica = handleTest ./web-apps/monica.nix {};
   mongodb = handleTest ./mongodb.nix {};
   moodle = handleTest ./moodle.nix {};
diff --git a/nixos/tests/monado.nix b/nixos/tests/monado.nix
new file mode 100644
index 000000000000..8368950951e7
--- /dev/null
+++ b/nixos/tests/monado.nix
@@ -0,0 +1,39 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "monado";
+
+  nodes.machine =
+    { pkgs, ... }:
+
+    {
+      hardware.opengl.enable = true;
+      users.users.alice = {
+        isNormalUser = true;
+        uid = 1000;
+      };
+
+      services.monado = {
+        enable = true;
+        defaultRuntime = true;
+      };
+      # Stop Monado from probing for any hardware
+      systemd.user.services.monado.environment.SIMULATED_ENABLE = "1";
+
+      environment.systemPackages = with pkgs; [ openxr-loader ];
+    };
+
+  testScript = { nodes, ... }:
+    let
+      userId = toString nodes.machine.users.users.alice.uid;
+      runtimePath = "/run/user/${userId}";
+    in
+    ''
+      machine.succeed("loginctl enable-linger alice")
+      machine.wait_for_unit("user@${userId}.service")
+
+      machine.wait_for_unit("monado.socket", "alice")
+      machine.systemctl("start monado.service", "alice")
+      machine.wait_for_unit("monado.service", "alice")
+
+      machine.succeed("su -- alice -c env XDG_RUNTIME_DIR=${runtimePath} openxr_runtime_list")
+    '';
+})
diff --git a/pkgs/applications/emulators/yuzu/compat-list.nix b/pkgs/applications/emulators/yuzu/compat-list.nix
index 30ff4aded401..79b56948aeab 100644
--- a/pkgs/applications/emulators/yuzu/compat-list.nix
+++ b/pkgs/applications/emulators/yuzu/compat-list.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, unstableGitUpdater }:
 stdenv.mkDerivation {
   pname = "yuzu-compatibility-list";
-  version = "unstable-2024-02-14";
+  version = "unstable-2024-02-26";
 
   src = fetchFromGitHub {
     owner = "flathub";
     repo = "org.yuzu_emu.yuzu";
-    rev = "8ef2f834b7437101d855f49f719474613c6fdfda";
-    hash = "sha256-RGEx7xediERrBW7vFwmecE3tLCo81zhOIVMnWG+XVd8=";
+    rev = "9c2032a3c7e64772a8112b77ed8b660242172068";
+    hash = "sha256-ITh/W4vfC9w9t+TJnPeTZwWifnhTNKX54JSSdpgaoBk=";
   };
 
   buildCommand = ''
diff --git a/pkgs/applications/emulators/yuzu/early-access/sources.nix b/pkgs/applications/emulators/yuzu/early-access/sources.nix
index 9e057a44baf5..c7653444a2e5 100644
--- a/pkgs/applications/emulators/yuzu/early-access/sources.nix
+++ b/pkgs/applications/emulators/yuzu/early-access/sources.nix
@@ -1,7 +1,7 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-02-15
+# Last updated: 2024-02-27
 {
-  version = "4141";
-  distHash = "sha256:0iy2q12fsnkl485ml6s6lh9j5qvwa7v3y2iy2vlps7rygdiaqxc2";
-  fullHash = "sha256:0980s2sxwqblyq936j0s7xz49xkfq1zzk50l5qlm5md5x64amf6r";
+  version = "4174";
+  distHash = "sha256:1hzwfsm4m2q29a2ihipk0ij0qakn4730283d6gwbrgr8lzmj8q49";
+  fullHash = "sha256:1ayn7y595iz4smbxq10jjgip04ss35v4vrn8pa1mpnrmyikv79l9";
 }
diff --git a/pkgs/applications/emulators/yuzu/mainline.nix b/pkgs/applications/emulators/yuzu/mainline.nix
index b2fe6edb41aa..3d89e86340c1 100644
--- a/pkgs/applications/emulators/yuzu/mainline.nix
+++ b/pkgs/applications/emulators/yuzu/mainline.nix
@@ -36,13 +36,13 @@
 }:
 stdenv.mkDerivation(finalAttrs: {
   pname = "yuzu";
-  version = "1715";
+  version = "1727";
 
   src = fetchFromGitHub {
     owner = "yuzu-emu";
     repo = "yuzu-mainline";
     rev = "mainline-0-${finalAttrs.version}";
-    hash = "sha256-ctmySxBLI/1/0ekvqOq+FsWq73iHa/awARtCgZ/ztXs=";
+    hash = "sha256-DKIVXy3OGUfdw/mZtPzom40KU51CvXaV+KqRjQseDyk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/monado/default.nix b/pkgs/applications/graphics/monado/default.nix
index 40e5f916f3f3..7442f192fe24 100644
--- a/pkgs/applications/graphics/monado/default.nix
+++ b/pkgs/applications/graphics/monado/default.nix
@@ -41,6 +41,7 @@
 , wayland-scanner
 , libdrm
 , zlib
+, nixosTests
 # Set as 'false' to build monado without service support, i.e. allow VR
 # applications linking against libopenxr_monado.so to use OpenXR standalone
 # instead of via the monado-service program. For more information see:
@@ -137,6 +138,10 @@ stdenv.mkDerivation {
     ./force-enable-steamvr_lh.patch
   ];
 
+  passthru.tests = {
+    basic-service = nixosTests.monado;
+  };
+
   meta = with lib; {
     description = "Open source XR runtime";
     homepage = "https://monado.freedesktop.org/";
diff --git a/pkgs/applications/kde/arianna.nix b/pkgs/applications/kde/arianna.nix
index e1a099800380..fe3038789a23 100644
--- a/pkgs/applications/kde/arianna.nix
+++ b/pkgs/applications/kde/arianna.nix
@@ -16,6 +16,7 @@
 , kfilemetadata
 , ki18n
 , kirigami-addons
+, kitemmodels
 , kquickcharts
 , kwindowsystem
 , qqc2-desktop-style
@@ -44,6 +45,7 @@ mkDerivation {
     kfilemetadata
     ki18n
     kirigami-addons
+    kitemmodels
     kquickcharts
     kwindowsystem
     qqc2-desktop-style
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index 70ac99f20a49..b7df39ee2b08 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.24.0";
+  version = "2.25.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-wISQ4528+rYxaIvxAa9jrF6E6A3SvMGbLyqB4JO3Mbw=" "zip";
-    i686-linux = fetch "linux_386" "sha256-A+sQY6Q0JfHuusdP96M7BqjMCn2YobAekieN3HdRJac=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-hgMZ3gSqpb04ixTwMnEg0EpYgzuTF1CMEGGl6LbYKjY=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-R0gGUgN+f5DQF57AyAI6P4X3ySktxQ60DCPJPknwxPY=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-Fs7psSWGqQqnUpGtU0nv1Mv+GysL/wD8AeVbMUDJ9pg=" "zip";
+    i686-linux = fetch "linux_386" "sha256-Vqk2COKRtDkOn7960VknyHx7sZVHZ4GP+aaC1rU4eqc=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-rMIZU92A13eiUqr35C+RTg3OTE9u8hcYJRinHoPWYTE=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-JO7Hh8PUnW5D3GCJFPcVfIYXzHV6HkckqFnGK9vH7Qs=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/applications/networking/browsers/librewolf/default.nix b/pkgs/applications/networking/browsers/librewolf/default.nix
index 004746c2166f..0e6ba888015e 100644
--- a/pkgs/applications/networking/browsers/librewolf/default.nix
+++ b/pkgs/applications/networking/browsers/librewolf/default.nix
@@ -16,7 +16,7 @@ in
   meta = {
     description = "A fork of Firefox, focused on privacy, security and freedom";
     homepage = "https://librewolf.net/";
-    maintainers = with lib.maintainers; [ squalus ];
+    maintainers = with lib.maintainers; [ dotlambda squalus ];
     platforms = lib.platforms.unix;
     badPlatforms = lib.platforms.darwin;
     broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index bbc259efc19f..40f22d2096f6 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,15 +1,15 @@
 {
-  "packageVersion": "122.0.1-2",
+  "packageVersion": "123.0-1",
   "source": {
-    "rev": "122.0.1-2",
-    "sha256": "0bp9x5hvjhdvrb5niyx4si7in116l37y5km7a207z7zl1z5d3q16"
+    "rev": "123.0-1",
+    "sha256": "1ic71b9sf6pgvsyinz0r8qhbpkryfdbj7lz6lh02d27xhnw9jd93"
   },
   "settings": {
-    "rev": "c242d6d6c77948451af5bd52125a8a81259a7a77",
-    "sha256": "1s56a4a8wz92gh1cxk8qny3qzvmanl6q34yp049f18c4zrk23lax"
+    "rev": "8a499ecdab8a5136faee50aae1fdd48997711de6",
+    "sha256": "1c12y7b09rrz8zlpar8nnd9k2nvldjqq3cicbc57g6s1npnf8rz6"
   },
   "firefox": {
-    "version": "122.0.1",
-    "sha512": "1d4fe1ed351edd748ede2ef6448798a32de9ed7a075a54a7ed5f7baa7b0c4c7f932c2e29f443c9066829e39f22a1dc94be5d00cc994193e949b72aa4a1c8ba41"
+    "version": "123.0",
+    "sha512": "a19567a13e1b663e538c4af17491146adad1f0ab977995e8da9ce9ed428008ad20902dee4efb82d54e1319a0e31768609696bc822563d75732b622760129d8bb"
   }
 }
diff --git a/pkgs/applications/networking/mailreaders/himalaya/default.nix b/pkgs/applications/networking/mailreaders/himalaya/default.nix
index e200148cc076..02da88ba6a32 100644
--- a/pkgs/applications/networking/mailreaders/himalaya/default.nix
+++ b/pkgs/applications/networking/mailreaders/himalaya/default.nix
@@ -3,6 +3,9 @@
 , fetchFromGitHub
 , stdenv
 , pkg-config
+, AppKit
+, Cocoa
+, Security
 , installShellFiles
 , installShellCompletions ? stdenv.hostPlatform == stdenv.buildPlatform
 , installManPages ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -16,22 +19,23 @@ rustPlatform.buildRustPackage rec {
   inherit buildNoDefaultFeatures buildFeatures;
 
   pname = "himalaya";
-  version = "1.0.0-beta.2";
+  version = "1.0.0-beta.3";
 
   src = fetchFromGitHub {
     owner = "soywod";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dLj/bEPz3SD1v54yXbtVdUJKQsyw0OJxmQh10ql+3iI=";
+    hash = "sha256-B7eswDq4tKyg881i3pLd6h+HsObK0c2dQnYuvPAGJHk=";
   };
 
-  cargoSha256 = "0IYpuKq5amAcYtsDMzJGghbxkuldAulsgUmChTl2DIg=";
+  cargoSha256 = "jOzuCXsrtXp8dmJTBqrEq4nog6smEPbdsFAy+ruPtY8=";
 
   nativeBuildInputs = [ ]
     ++ lib.optional (builtins.elem "pgp-gpg" buildFeatures) pkg-config
     ++ lib.optional (installManPages || installShellCompletions) installShellFiles;
 
   buildInputs = [ ]
+    ++ lib.optionals stdenv.isDarwin [ AppKit Cocoa Security ]
     ++ lib.optional (builtins.elem "notmuch" buildFeatures) notmuch
     ++ lib.optional (builtins.elem "pgp-gpg" buildFeatures) gpgme;
 
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index 704689e20282..db6becac38d1 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -22,13 +22,13 @@
 }:
 
 let
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fZ5grVZjCVkCH6doeqBLHPh9mPvHkiz+QXi/OyoJhR4=";
+    hash = "sha256-F+fZb8Eqw2gHxnv2Zj/xyUOrQu5KIGBIeyhIa1gyayw=";
   };
 
   python = python3;
@@ -53,7 +53,7 @@ let
       cd src-ui
     '';
 
-    npmDepsHash = "sha256-7//VmAgXB4H8hlalfu4JeqFDa8dj1u5Z1kbwp2Wi4cQ=";
+    npmDepsHash = "sha256-GXGYfyWy6g1XWKyu3jdbszYYhEk1TzjQIwMGT8Rc0a0=";
 
     nativeBuildInputs = [
       pkg-config
diff --git a/pkgs/applications/version-management/tortoisehg/default.nix b/pkgs/applications/version-management/tortoisehg/default.nix
index 7e830e1077a5..e4ad91a8713f 100644
--- a/pkgs/applications/version-management/tortoisehg/default.nix
+++ b/pkgs/applications/version-management/tortoisehg/default.nix
@@ -7,11 +7,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "tortoisehg";
-  version = "6.2.2";
+  version = "6.6.3";
 
   src = fetchurl {
     url = "https://www.mercurial-scm.org/release/tortoisehg/targz/tortoisehg-${version}.tar.gz";
-    sha256 = "sha256-Xbvg/FcuX/AL2reWsaM2oaFyLby3+HDCfYtRyswE7DA=";
+    sha256 = "sha256-9pg1N5uj1ZaZCAm4N8toRwfVHme7nAsNMZkXSRgFves=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ad/adwsteamgtk/package.nix b/pkgs/by-name/ad/adwsteamgtk/package.nix
new file mode 100644
index 000000000000..f40843624fa8
--- /dev/null
+++ b/pkgs/by-name/ad/adwsteamgtk/package.nix
@@ -0,0 +1,52 @@
+{ blueprint-compiler
+, desktop-file-utils
+, fetchFromGitHub
+, lib
+, libadwaita
+, libportal-gtk4
+, meson
+, ninja
+, python3Packages
+, wrapGAppsHook4
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "adwsteamgtk";
+  version = "0.6.9";
+  # built with meson, not a python format
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "Foldex";
+    repo = "AdwSteamGtk";
+    rev = "v${version}";
+    hash = "sha256-aHJxgSb7oZTRrfFVYdLimwhSGzdRjGf7dGTRA+ANQiM=";
+  };
+
+  buildInputs = [
+    libadwaita
+    libportal-gtk4
+  ];
+
+  nativeBuildInputs = [
+    blueprint-compiler
+    desktop-file-utils
+    meson
+    ninja
+    wrapGAppsHook4
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    packaging
+    pygobject3
+  ];
+
+  meta = {
+    description = "A simple Gtk wrapper for Adwaita-for-Steam";
+    homepage = "https://github.com/Foldex/AdwSteamGtk";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.reedrw ];
+    mainProgram = "adwaita-steam-gtk";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index e3bc8b234bc2..a9b29a3245d5 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -198,6 +198,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ ttuegel lnl7 AndersonTorres ];
     platforms = lib.platforms.all;
+    mainProgram = "cmake";
     broken = (qt5UI && stdenv.isDarwin);
   };
 })
diff --git a/pkgs/by-name/gp/gpt4all-chat/package.nix b/pkgs/by-name/gp/gpt4all/package.nix
similarity index 89%
rename from pkgs/by-name/gp/gpt4all-chat/package.nix
rename to pkgs/by-name/gp/gpt4all/package.nix
index 8337ad938391..e6119fc9212e 100644
--- a/pkgs/by-name/gp/gpt4all-chat/package.nix
+++ b/pkgs/by-name/gp/gpt4all/package.nix
@@ -10,7 +10,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "gpt4all-chat";
+  pname = "gpt4all";
   version = "2.7.1";
 
   src = fetchFromGitHub {
@@ -63,10 +63,11 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    changelog = "https://github.com/nomic-ai/gpt4all/releases/tag/v${finalAttrs.version}";
     description = "A free-to-use, locally running, privacy-aware chatbot. No GPU or internet required";
-    homepage = "https://github.com/nomic-ai/gpt4all-chat";
+    homepage = "https://github.com/nomic-ai/gpt4all";
     license = lib.licenses.mit;
-    mainProgram = "gpt4all-chat";
+    mainProgram = "gpt4all";
     maintainers = with lib.maintainers; [ drupol polygon ];
   };
 })
diff --git a/pkgs/by-name/wa/wayland-pipewire-idle-inhibit/package.nix b/pkgs/by-name/wa/wayland-pipewire-idle-inhibit/package.nix
index e6f159786210..849b7c7a090e 100644
--- a/pkgs/by-name/wa/wayland-pipewire-idle-inhibit/package.nix
+++ b/pkgs/by-name/wa/wayland-pipewire-idle-inhibit/package.nix
@@ -1,6 +1,4 @@
-{ clang
-, lib
-, libclang
+{ lib
 , fetchFromGitHub
 , pipewire
 , pkg-config
@@ -22,8 +20,8 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "sha256-7XuDZ57+F8Ot5oNO9/BXjFljNmoMgNgURfmPEIy2PHo=";
 
   nativeBuildInputs = [
-    clang
     pkg-config
+    rustPlatform.bindgenHook
   ];
 
   buildInputs = [
@@ -32,8 +30,6 @@ rustPlatform.buildRustPackage rec {
     wayland-protocols
   ];
 
-  LIBCLANG_PATH = "${libclang.lib}/lib";
-
   meta = with lib; {
     description = "Suspends automatic idling of Wayland compositors when media is being played through Pipewire.";
     homepage = "https://github.com/rafaelrc7/wayland-pipewire-idle-inhibit/";
diff --git a/pkgs/by-name/xr/xr-hardware/package.nix b/pkgs/by-name/xr/xr-hardware/package.nix
new file mode 100644
index 000000000000..b2359c2673df
--- /dev/null
+++ b/pkgs/by-name/xr/xr-hardware/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitLab
+}: stdenvNoCC.mkDerivation {
+  pname = "xr-hardware";
+  version = "unstable-2023-11-08";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "monado/utilities";
+    repo = "xr-hardware";
+    rev = "9204de323210d2a5ab8635c2ee52127100de67b1";
+    hash = "sha256-ZS15WODms/WKsPu+WbfILO2BOwnxrhCY/SoF8jzOX5Q=";
+  };
+
+  installTargets = "install_package";
+  installFlagsArray = "DESTDIR=${placeholder "out"}";
+
+  meta = with lib; {
+    description = "Hardware description for XR devices";
+    homepage = "https://gitlab.freedesktop.org/monado/utilities/xr-hardware";
+    license = licenses.boost;
+    maintainers = with maintainers; [ Scrumplex ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/zb/zbus-xmlgen/package.nix b/pkgs/by-name/zb/zbus-xmlgen/package.nix
index 2e0dc5715f51..5e226e3b711e 100644
--- a/pkgs/by-name/zb/zbus-xmlgen/package.nix
+++ b/pkgs/by-name/zb/zbus-xmlgen/package.nix
@@ -2,16 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zbus_xmlgen";
-  version = "3.1.1";
+  version = "4.0.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-vaefyfasOLFFYWPjSJFgjIFkvnRiJVe/GLYUQxUYlt0=";
+    hash = "sha256-GkNxlfwLIBfAAcwQnwJHjcviB8tiNVNDZNDib1FQcvs=";
   };
 
-  cargoHash = "sha256-WXJ49X4B2aNy1zPbTllIzRhZJvF+RwfQ0Hhm/D+LQfk=";
+  cargoHash = "sha256-dKoxLEdLZ8B8kTJj3tHcFJzY/Rv3NvwmZBAmHyNhOg8=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
+  nativeCheckInputs = [ rustfmt ];
 
   postInstall = ''
     wrapProgram $out/bin/zbus-xmlgen \
diff --git a/pkgs/development/libraries/fcft/default.nix b/pkgs/development/libraries/fcft/default.nix
index 37084705d6ee..faf5906f7a98 100644
--- a/pkgs/development/libraries/fcft/default.nix
+++ b/pkgs/development/libraries/fcft/default.nix
@@ -17,14 +17,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fcft";
-  version = "3.1.7";
+  version = "3.1.8";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fcft";
     rev = version;
-    sha256 = "sha256-QS39vbf2JowovTBtT4DKDRbLXieOrzbO4cQObOdE788=";
+    sha256 = "sha256-Wgm2QdW4rg573soF/8HhDmlyN4S2cA0VWOejow464gU=";
   };
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index 914d72a7fe8a..93035b373eb4 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -1,13 +1,10 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch2
 , pkg-config
 , vala
+, gi-docgen
 , gobject-introspection
-, gtk-doc
-, docbook-xsl-nons
-, docbook_xml_dtd_43
 , glib
 , babl
 , libpng
@@ -38,25 +35,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gegl";
-  version = "0.4.46";
+  version = "0.4.48";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor version}/gegl-${version}.tar.xz";
-    hash = "sha256-0LOySBvId0xfPQpIdhGRAWbRju+COoWfuR54Grex6JI=";
+    hash = "sha256-QYwm2UvogF19mPbeDGglyia9dPystsGI2kdTPZ7igkc=";
   };
 
-  patches = [
-    # https://gitlab.gnome.org/GNOME/gegl/-/merge_requests/136
-    # Fix missing libm dependency.
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gegl/-/commit/ee970f10f4fe442cbf8a4f5cb94049deab33e786.patch";
-      hash = "sha256-0LLKH+Gg+1H83kN7hJGK2u+oLrw7Hxed7R4tTwT3C5s=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     gettext
@@ -64,9 +52,7 @@ stdenv.mkDerivation rec {
     ninja
     vala
     gobject-introspection
-    gtk-doc
-    docbook-xsl-nons
-    docbook_xml_dtd_43
+    gi-docgen
   ];
 
   buildInputs = [
@@ -102,7 +88,6 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dgtk-doc=true"
     "-Dmrg=disabled" # not sure what that is
     "-Dsdl2=disabled"
     "-Dpygobject=disabled"
@@ -119,6 +104,11 @@ stdenv.mkDerivation rec {
     patchShebangs tests/ff-load-save/tests_ff_load_save.sh tests/opencl/opencl_test.sh tools/xml_insert.sh
   '';
 
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
   # tests fail to connect to the com.apple.fonts daemon in sandboxed mode
   doCheck = !stdenv.isDarwin;
 
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index f3fda2ef3c8b..14e04b17f604 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.90";
+  version = "0.2.91";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = "boschshcpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-qI8fpQJ7fyZ6CX010cyPuoFj9UQM+jHOJ201GCjIwBU=";
+    hash = "sha256-lQDYJrla2iDk1MbLHjBGP3ZcZ1djD3bWhz15RaBFMgg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fastparquet/default.nix b/pkgs/development/python-modules/fastparquet/default.nix
index 9105fbd40612..1ceeecafb638 100644
--- a/pkgs/development/python-modules/fastparquet/default.nix
+++ b/pkgs/development/python-modules/fastparquet/default.nix
@@ -20,18 +20,27 @@
 
 buildPythonPackage rec {
   pname = "fastparquet";
-  version = "2023.7.0";
-  format = "pyproject";
+  version = "2024.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "dask";
-    repo = pname;
-    rev = version;
-    hash = "sha256-pJ0zK0upEV7TyuNMIcozugkwBlYpK/Dg6BdB0kBpn9k=";
+    repo = "fastparquet";
+    rev = "refs/tags/${version}";
+    hash = "sha256-e0gnC/HMYdrYdEwy6qNOD1J52xgN2x81oCG03YNsYjg=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"pytest-runner"' ""
+
+    sed -i \
+      -e "/pytest-runner/d" \
+      -e '/"git", "status"/d' setup.py
+  '';
+
   nativeBuildInputs = [
     cython
     oldest-supported-numpy
@@ -40,15 +49,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '"pytest-runner"' ""
-
-    sed -i \
-      -e "/pytest-runner/d" \
-      -e '/"git", "status"/d' setup.py
-  '';
-
   propagatedBuildInputs = [
     cramjam
     fsspec
@@ -85,7 +85,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "A python implementation of the parquet format";
+    description = "Implementation of the parquet format";
     homepage = "https://github.com/dask/fastparquet";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ veprbl ];
diff --git a/pkgs/development/python-modules/habluetooth/default.nix b/pkgs/development/python-modules/habluetooth/default.nix
index e37c6a680742..02e336c8bc1f 100644
--- a/pkgs/development/python-modules/habluetooth/default.nix
+++ b/pkgs/development/python-modules/habluetooth/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "habluetooth";
-  version = "2.4.0";
+  version = "2.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "habluetooth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bZtcvidjUhlb9ML1UIP00yqJ+KnJig5i0j/tAZSK7+Y=";
+    hash = "sha256-Ka8WqOYsZFvNl7uOsGR6S4entw7GTnF9MZcOB3uJMvg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/intake-parquet/default.nix b/pkgs/development/python-modules/intake-parquet/default.nix
index 9ef6affb5119..809d9efcc7ca 100644
--- a/pkgs/development/python-modules/intake-parquet/default.nix
+++ b/pkgs/development/python-modules/intake-parquet/default.nix
@@ -5,20 +5,34 @@
 , dask
 , fastparquet
 , pyarrow
+, setuptools
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "intake-parquet";
   version = "0.3.0";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "intake";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-zSwylXBKOM/tG5mwYtc0FmxwcKJ6j+lw1bxJqf57NY8=";
+    repo = "intake-parquet";
+    rev = "refs/tags/${version}";
+    hash = "sha256-zSwylXBKOM/tG5mwYtc0FmxwcKJ6j+lw1bxJqf57NY8=";
   };
 
+  postPatch = ''
+    # Break circular dependency
+    substituteInPlace requirements.txt \
+      --replace-fail "intake" ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pandas
     dask
@@ -26,12 +40,6 @@ buildPythonPackage rec {
     pyarrow
   ];
 
-  postPatch = ''
-    # Break circular dependency
-    substituteInPlace requirements.txt \
-      --replace "intake" ""
-  '';
-
   doCheck = false;
 
   #pythonImportsCheck = [ "intake_parquet" ];
diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index d4f9c66806ce..b15e90cda27f 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , appdirs
 , bokeh
 , buildPythonPackage
@@ -19,14 +20,15 @@
 , pythonOlder
 , pyyaml
 , requests
-, stdenv
+, setuptools
+, setuptools-scm
 , tornado
 }:
 
 buildPythonPackage rec {
   pname = "intake";
-  version = "0.7.0";
-  format = "setuptools";
+  version = "2.0.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -34,9 +36,14 @@ buildPythonPackage rec {
     owner = "intake";
     repo = "intake";
     rev = "refs/tags/${version}";
-    hash = "sha256-LK4abwPViEFJZ10bbRofF2aw2Mj0dliKwX6dFy93RVQ=";
+    hash = "sha256-Fyv85HkoE9OPOoSHR1sgCG0iAFuSiQMT7cyZcQyLvv0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
     appdirs
     dask
@@ -73,11 +80,6 @@ buildPythonPackage rec {
     ];
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'pytest-runner'" ""
-  '';
-
   __darwinAllowLocalNetworking = true;
 
   preCheck = ''
@@ -85,6 +87,20 @@ buildPythonPackage rec {
     export PATH="$PATH:$out/bin";
   '';
 
+  disabledTestPaths = [
+    # Missing plusins
+    "intake/catalog/tests/test_alias.py"
+    "intake/catalog/tests/test_gui.py"
+    "intake/catalog/tests/test_local.py"
+    "intake/catalog/tests/test_reload_integration.py"
+    "intake/source/tests/test_csv.py"
+    "intake/source/tests/test_derived.py"
+    "intake/source/tests/test_npy.py"
+    "intake/source/tests/test_text.py"
+    "intake/tests/test_config.py"
+    "intake/tests/test_top_level.py"
+  ];
+
   disabledTests = [
     # Disable tests which touch network
     "http"
@@ -103,23 +119,10 @@ buildPythonPackage rec {
     "test_remote_cat"
     "test_remote_env"
     # ValueError
-    "test_mlist_parameter"
-    # ImportError
-    "test_dataframe"
-    "test_ndarray"
-    "test_python"
+    "test_datasource_python_to_dask"
+    "test_catalog_passthrough"
     # Timing-based, flaky on darwin and possibly others
     "test_idle_timer"
-    # arrow-cpp-13 related
-    "test_read"
-    "test_pickle"
-    "test_read_dask"
-    "test_read_list"
-    "test_read_list_with_glob"
-    "test_to_dask"
-    "test_columns"
-    "test_df_transform"
-    "test_pipeline_apply"
   ] ++ lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13") [
     # Flaky with older low-res mtime on darwin < 10.13 (#143987)
     "test_second_load_timestamp"
diff --git a/pkgs/development/python-modules/openrazer/common.nix b/pkgs/development/python-modules/openrazer/common.nix
index 5b7a0bc0f8f2..3e801b582797 100644
--- a/pkgs/development/python-modules/openrazer/common.nix
+++ b/pkgs/development/python-modules/openrazer/common.nix
@@ -1,14 +1,14 @@
 { lib
 , fetchFromGitHub
 }: rec {
-  version = "3.6.1";
+  version = "3.7.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "openrazer";
     repo = "openrazer";
     rev = "v${version}";
-    hash = "sha256-bboTRZqJq5tKeBQuiEQAXxTHYvoldDQlwbfehjDA8EE=";
+    hash = "sha256-tjVWvJxcZ2maR99VRwMGCa+IK+1CjCc7jxAj4XkDUEw=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pytraccar/default.nix b/pkgs/development/python-modules/pytraccar/default.nix
index 6bd4c17f50ea..11ceaecf895c 100644
--- a/pkgs/development/python-modules/pytraccar/default.nix
+++ b/pkgs/development/python-modules/pytraccar/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pytraccar";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = "pytraccar";
     rev = "refs/tags/${version}";
-    hash = "sha256-7QGgI+DDYbordBx4LbtCvPWyEh6ur2RrSKMuDlwRlTo=";
+    hash = "sha256-VsZ18zVIO5ps0GIoVwXBuVe20n6Cz6buItgKlzYyjt4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index afbba2d7d4b1..1458d173e3c6 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "19.8.3";
+  version = "19.11.4";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-sYXg/t8U+uu1kYtEH6j7s/dCQJGuG880ruQFrvB5GS8=";
+    hash = "sha256-xViCmfLhvRWi02hFIxKZ+5mrvoSaHRXFj4iLHtVS3uo=";
   };
 
-  vendorHash = "sha256-jJVqIH0Qa9otp2lnYKa7ypqeE01BynR/e852wuhuLuA=";
+  vendorHash = "sha256-OkcwcQfI1CeKIQaaS/Bd1Hct2yebp0TB98lsGAVRWqk=";
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/misc/cups/drivers/foomatic-db-engine/default.nix b/pkgs/misc/cups/drivers/foomatic-db-engine/default.nix
index 7c1bc55d3330..497223c4451e 100644
--- a/pkgs/misc/cups/drivers/foomatic-db-engine/default.nix
+++ b/pkgs/misc/cups/drivers/foomatic-db-engine/default.nix
@@ -17,15 +17,15 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "foomatic-db-engine";
-  version = "unstable-2022-05-03";
+  version = "unstable-2024-02-10";
 
   src = fetchFromGitHub {
     # there is also a daily snapshot at the `downloadPage`,
     # but it gets deleted quickly and would provoke 404 errors
     owner = "OpenPrinting";
     repo = "foomatic-db-engine";
-    rev = "2e6f14b54748fa121a4d2e3d480010e10b070c5a";
-    hash = "sha256-m7FQTxWmawbtm24h8UqznGKXgX41JhOtyyFMRwEhm5k=";
+    rev = "fa91bdfd87da9005591ac2ef2c9c7b8ecdd19511";
+    hash = "sha256-Ufy9BtYMD7sUUVfraTmO5e8+nZ4C4up5a5GXeGTtejg=";
   };
 
   outputs = [ "out" ];
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index bcfbdfa9becb..b3d5b6f1fcbe 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.8.5";
+  version = "2.8.6";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-aIGT2NwtkKJ1uTgy4rvFegzJadRuGkki63gpnVCPKbw=";
+    hash = "sha256-n15p26zZaote8cB0NfBnb69hb27l4hHBZG+3D1yrrCA=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/tools/misc/lesspipe/default.nix b/pkgs/tools/misc/lesspipe/default.nix
index c7978485c7e4..5bc3f97c3c78 100644
--- a/pkgs/tools/misc/lesspipe/default.nix
+++ b/pkgs/tools/misc/lesspipe/default.nix
@@ -1,4 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, perl, procps, file, gnused, bash, binutils }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, perl
+, procps
+, bash
+
+# shell referenced dependencies
+, resholve
+, binutils-unwrapped
+, file
+, gnugrep
+, coreutils
+, gnused
+, gnutar
+, iconv
+, ncurses
+}:
 
 stdenv.mkDerivation rec {
   pname = "lesspipe";
@@ -28,9 +46,65 @@ stdenv.mkDerivation rec {
   installFlags = [ "DESTDIR=$(out)" ];
 
   postInstall = ''
-    for f in lesspipe.sh lesscomplete; do
-      wrapProgram "$out/bin/$f" --prefix-each PATH : "${lib.makeBinPath [ binutils file gnused procps ]}"
-    done
+    # resholve doesn't see strings in an array definition
+    substituteInPlace $out/bin/lesspipe.sh --replace 'nodash strings' "nodash ${binutils-unwrapped}/bin/strings"
+
+    ${resholve.phraseSolution "lesspipe.sh" {
+      scripts = [ "bin/lesspipe.sh" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = [
+        coreutils
+        file
+        gnugrep
+        gnused
+        gnutar
+        iconv
+        procps
+        ncurses
+      ];
+      keep = [ "$prog" "$c1" "$c2" "$c3" "$c4" "$c5" "$cmd" "$colorizer" "$HOME" ];
+      fake = {
+        # script guards usage behind has_cmd test function, it's safe to leave these external and optional
+        external = [
+          "cpio" "isoinfo" "cabextract" "bsdtar" "rpm2cpio" "bsdtar" "unzip" "ar" "unrar" "rar" "7zr" "7za" "isoinfo"
+          "gzip" "bzip2" "lzip" "lzma" "xz" "brotli" "compress" "zstd" "lz4"
+          "archive_color" "bat" "batcat" "pygmentize" "source-highlight" "vimcolor" "code2color"
+
+          "w3m" "lynx" "elinks" "html2text" "dtc" "pdftotext" "pdftohtml" "pdfinfo" "ps2ascii" "procyon" "ccze"
+          "mdcat" "pandoc" "docx2txt" "libreoffice" "pptx2md" "mdcat" "xlscat" "odt2txt" "wvText" "antiword" "catdoc"
+          "broken_catppt" "sxw2txt" "groff" "mandoc" "unrtf" "dvi2tty" "pod2text" "perldoc" "h5dump" "ncdump" "matdump"
+          "djvutxt" "openssl" "gpg" "plistutil" "plutil" "id3v2" "csvlook" "jq" "zlib-flate" "lessfilter"
+        ] ++ lib.optional stdenv.isDarwin [
+          # resholve only identifies this on darwin
+          # call site is gaurded by || so it's safe to leave dynamic
+          "locale"
+        ];
+        builtin = [ "setopt" ];
+      };
+      execer = [
+        "cannot:${iconv}/bin/iconv"
+      ];
+    }}
+    ${resholve.phraseSolution "lesscomplete" {
+      scripts = [ "bin/lesscomplete" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = [
+        coreutils
+        file
+        gnugrep
+        gnused
+        gnutar
+      ];
+      keep = [ "$prog" "$c1" "$c2" "$c3" "$c4" "$c5" "$cmd" ];
+      fake = {
+        # script guards usage behind has_cmd test function, it's safe to leave these external and optional
+        external = [
+          "cpio" "isoinfo" "cabextract" "bsdtar" "rpm2cpio" "bsdtar" "unzip" "ar" "unrar" "rar" "7zr" "7za" "isoinfo"
+          "gzip" "bzip2" "lzip" "lzma" "xz" "brotli" "compress" "zstd" "lz4"
+        ];
+        builtin = [ "setopt" ];
+      };
+    }}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index 675c7d19b65a..ae15785a21ff 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -29,11 +29,11 @@ let
   sslPkg = sslPkgs.${sslLibrary};
 in stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "2.9.5";
+  version = "2.9.6";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-MreFsSiDj0IYuNVGkMhsSHlNA/gXy7Yn+0h2n3nv1Zs=";
+    hash = "sha256-IIrfR8j6g8VJeANLpcARC3RjxHB48Rm9BSNCFxo7mgs=";
   };
 
   buildInputs = [ sslPkg zlib libxcrypt ]
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5d0ef64bf9a6..6398109f67de 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -411,6 +411,9 @@ mapAliases ({
   govendor = throw "'govendor' has been removed as it is no longer maintained upstream, please use Go modules instead"; # Added 2023-12-26
   gometer = throw "gometer has been removed from nixpkgs because goLance stopped offering Linux support"; # Added 2023-02-10
   gprbuild-boot = gnatPackages.gprbuild-boot; # Added 2024-02-25;
+
+  gpt4all-chat = throw "gpt4all-chat has been renamed to gpt4all"; # Added 2024-02-27
+
   graalvm11-ce = throw "graalvm11-ce has been removed because upstream dropped support to different JDK versions for each GraalVM release. Please use graalvm-ce instead"; # Added 2023-09-26
   graalvm17-ce = throw "graalvm17-ce has been removed because upstream dropped support to different JDK versions for each GraalVM release. Please use graalvm-ce instead"; # Added 2023-09-26
   graalvm19-ce = throw "graalvm19-ce has been removed because upstream dropped support to different JDK versions for each GraalVM release. Please use graalvm-ce instead"; # Added 2023-09-26
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e3b4fb515734..90148a2f220a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -32117,7 +32117,9 @@ with pkgs;
 
   hexedit = callPackage ../applications/editors/hexedit { };
 
-  himalaya = callPackage ../applications/networking/mailreaders/himalaya { };
+  himalaya = callPackage ../applications/networking/mailreaders/himalaya {
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Security;
+  };
 
   hydrogen-web-unwrapped = callPackage ../applications/networking/instant-messengers/hydrogen-web/unwrapped.nix { };