diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index daf866b4e852..ba967a2d82ce 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11248,6 +11248,12 @@
     github = "marius851000";
     githubId = 22586596;
   };
+  mariuskimmina = {
+    email = "mar.kimmina@gmail.com";
+    name = "Marius Kimmina";
+    github = "mariuskimmina";
+    githubId = 38843153;
+  };
   markbeep = {
     email = "mrkswrn@gmail.com";
     github = "markbeep";
@@ -20449,6 +20455,15 @@
     githubId = 1557253;
     name = "Lennart Eichhorn";
   };
+  zedseven = {
+    name = "Zacchary Dempsey-Plante";
+    email = "zacc@ztdp.ca";
+    github = "zedseven";
+    githubId = 25164338;
+    keys = [{
+      fingerprint = "065A 0A98 FE61 E1C1 41B0  AFE7 64FA BC62 F457 2875";
+    }];
+  };
   zendo = {
     name = "zendo";
     email = "linzway@qq.com";
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index 38682701ea15..35151ebd6bd7 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -212,7 +212,7 @@ in
 
     services.certmgr = {
       enable = true;
-      package = pkgs.certmgr-selfsigned;
+      package = pkgs.certmgr;
       svcManager = "command";
       specs =
         let
diff --git a/pkgs/applications/audio/jack-passthrough/default.nix b/pkgs/applications/audio/jack-passthrough/default.nix
new file mode 100644
index 000000000000..93f41f1b5952
--- /dev/null
+++ b/pkgs/applications/audio/jack-passthrough/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, libjack2
+, meson
+, ninja
+, fmt_9
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jack-passthrough";
+  version = "2021-9-25";
+
+  # https://github.com/guysherman/jack-passthrough
+  src = fetchFromGitHub {
+    owner = "guysherman";
+    repo = finalAttrs.pname;
+    rev = "aad03b7c5ccc4a4dcb8fa38c49aa64cb9d628660";
+    hash = "sha256-9IsNaLW5dYAqiwe+vX0+D3oIKFP2TIfy1q1YaqmS6wE=";
+  };
+
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [ fmt_9 libjack2 ];
+
+  meta = with lib; {
+    description = "A simple app to help with JACK apps that behave strangely.";
+    longDescription = ''
+      Creates a JACK passthrough client with an arbitrary name and number of
+      ports. Common uses include tricking stubborn applications into creating
+      more ports than they normally would or to prevent them from
+      auto-connecting to certain things.
+    '';
+    # license unknown: https://github.com/guysherman/jack-passthrough/issues/2
+    license = licenses.unfree;
+    maintainers = [ maintainers.PowerUser64 ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/applications/misc/translatelocally/default.nix b/pkgs/applications/misc/translatelocally/default.nix
index 81aa9ec91bcf..1ce54adedc84 100644
--- a/pkgs/applications/misc/translatelocally/default.nix
+++ b/pkgs/applications/misc/translatelocally/default.nix
@@ -1,19 +1,20 @@
 { lib, stdenv, fetchFromGitHub
 , cmake, qt6, libarchive, pcre2, protobuf, gperftools, blas
+, runCommand, translatelocally, translatelocally-models
 }:
 
 let
-  rev = "f8a2dba0a63989c6b3a7be36f736ed478cad1dd2";
+  rev = "a210037760ca3ca9016ca1831c97531318df70fe";
 
 in stdenv.mkDerivation (finalAttrs: {
   pname = "translatelocally";
-  version = "unstable-2023-08-25";
+  version = "unstable-2023-09-20";
 
   src = fetchFromGitHub {
     owner = "XapaJIaMnu";
     repo = "translateLocally";
     inherit rev;
-    hash = "sha256-uUdDi0CwCR/FQjw5D2s088d/Tp7NQOI0ia30oOhlGoc=";
+    hash = "sha256-T7cZdR09yDrPTwYxvDIaKTdV4mrB+gTHYVfch5BQ+PE=";
     fetchSubmodules = true;
   };
 
@@ -26,6 +27,11 @@ in stdenv.mkDerivation (finalAttrs: {
       3rd_party/bergamot-translator/3rd_party/marian-dev/src/common/git_revision.h
   '';
 
+  # https://github.com/XapaJIaMnu/translateLocally/blob/81ed8b9/.github/workflows/build.yml#L330
+  postConfigure = lib.optionalString stdenv.isAarch64 ''
+    bash ../cmake/fix_ruy_build.sh .. .
+  '';
+
   nativeBuildInputs = [
     cmake
     protobuf
@@ -48,6 +54,19 @@ in stdenv.mkDerivation (finalAttrs: {
     "-DCBLAS_LIBRARIES=-lcblas"
   ];
 
+  passthru.tests = {
+    cli-translate = runCommand "${finalAttrs.pname}-test-cli-translate" {
+      nativeBuildInputs = [
+        translatelocally
+        translatelocally-models.fr-en-tiny
+      ];
+    } ''
+      export LC_ALL="C.UTF-8"
+      echo "Bonjour" | translateLocally -m fr-en-tiny > $out
+      diff "$out" <(echo "Hello")
+    '';
+  };
+
   meta = with lib; {
     mainProgram = "translateLocally";
     homepage = "https://translatelocally.com/";
@@ -55,8 +74,5 @@ in stdenv.mkDerivation (finalAttrs: {
     license = licenses.mit;
     maintainers = with maintainers; [ pacien ];
     platforms = platforms.linux;
-
-    # https://github.com/XapaJIaMnu/translateLocally/issues/150
-    broken = stdenv.isAarch64;
   };
 })
diff --git a/pkgs/build-support/fetchgitlab/default.nix b/pkgs/build-support/fetchgitlab/default.nix
index 2ccb81335cc2..749883f2365e 100644
--- a/pkgs/build-support/fetchgitlab/default.nix
+++ b/pkgs/build-support/fetchgitlab/default.nix
@@ -1,9 +1,11 @@
-{ fetchgit, fetchzip, lib }:
+{ lib, fetchgit, fetchzip }:
 
 lib.makeOverridable (
 # gitlab example
 { owner, repo, rev, protocol ? "https", domain ? "gitlab.com", name ? "source", group ? null
-, fetchSubmodules ? false, leaveDotGit ? false, deepClone ? false
+, fetchSubmodules ? false, leaveDotGit ? false
+, deepClone ? false, forceFetchGit ? false
+, sparseCheckout ? []
 , ... # For hash agility
 } @ args:
 
@@ -11,15 +13,15 @@ let
   slug = lib.concatStringsSep "/" ((lib.optional (group != null) group) ++ [ owner repo ]);
   escapedSlug = lib.replaceStrings [ "." "/" ] [ "%2E" "%2F" ] slug;
   escapedRev = lib.replaceStrings [ "+" "%" "/" ] [ "%2B" "%25" "%2F" ] rev;
-  passthruAttrs = removeAttrs args [ "protocol" "domain" "owner" "group" "repo" "rev" "fetchSubmodules" "leaveDotGit" "deepClone" ];
+  passthruAttrs = removeAttrs args [ "protocol" "domain" "owner" "group" "repo" "rev" "fetchSubmodules" "forceFetchGit" "leaveDotGit" "deepClone" ];
 
-  useFetchGit = deepClone || fetchSubmodules || leaveDotGit;
+  useFetchGit = fetchSubmodules || leaveDotGit || deepClone || forceFetchGit || (sparseCheckout != []);
   fetcher = if useFetchGit then fetchgit else fetchzip;
 
   gitRepoUrl = "${protocol}://${domain}/${slug}.git";
 
   fetcherArgs = (if useFetchGit then {
-    inherit rev deepClone fetchSubmodules leaveDotGit;
+    inherit rev deepClone fetchSubmodules sparseCheckout leaveDotGit;
     url = gitRepoUrl;
   } else {
     url = "${protocol}://${domain}/api/v4/projects/${escapedSlug}/repository/archive.tar.gz?sha=${escapedRev}";
diff --git a/pkgs/build-support/fetchzip/default.nix b/pkgs/build-support/fetchzip/default.nix
index 0446851d6409..6e6c5270a750 100644
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@@ -24,7 +24,7 @@
 # the rest are given to fetchurl as is
 , ... } @ args:
 
-assert (extraPostFetch != "") -> lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub'." true;
+assert (extraPostFetch != "") -> lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub' or 'fetchFromGitLab'." true;
 
 let
   tmpFilename =
diff --git a/pkgs/by-name/en/endlines/package.nix b/pkgs/by-name/en/endlines/package.nix
new file mode 100644
index 000000000000..b03a0d733535
--- /dev/null
+++ b/pkgs/by-name/en/endlines/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "endlines";
+  version = "1.9.2";
+
+  src = fetchFromGitHub {
+    owner = "mdolidon";
+    repo = "endlines";
+    rev = finalAttrs.version;
+    hash = "sha256-M0IyY/WXR8qv9/qx5G0pG3EKqMoZAP3fJTZ6sSSMMyQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile --replace "/usr/local" "$out"
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  meta = {
+    homepage = "https://github.com/mdolidon/endlines";
+    description = "Easy conversion between new-line conventions";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ zedseven ];
+    mainProgram = "endlines";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/vi/vinegar/package.nix b/pkgs/by-name/vi/vinegar/package.nix
index 9b2aae176a2e..bee2a13d5027 100644
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@@ -1,54 +1,70 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, wine-staging
-, makeBinaryWrapper
-, pkg-config
-, libGL
-, libxkbcommon
-, xorg
-}:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  pkg-config,
+  libGL,
+  libxkbcommon,
+  xorg,
+  wineWowPackages,
+  fetchpatch,
+}: let
+  # wine-staging doesn't support overrideAttrs for now
+  wine = wineWowPackages.stagingFull.overrideDerivation (oldAttrs: {
+    patches =
+      (oldAttrs.patches or [])
+      ++ [
+        # upstream issue: https://bugs.winehq.org/show_bug.cgi?id=55604
+        # Here are the currently applied patches for Roblox to run under WINE:
+        (fetchpatch {
+          name = "vinegar-wine-segrevert.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/8fc153c492542a522d6cc2dff7d1af0e030a529a/patches/wine/temp.patch";
+          hash = "sha256-AnEBBhB8leKP0xCSr6UsQK7CN0NDbwqhe326tJ9dDjc=";
+        })
+      ];
+  });
+in
+  buildGoModule rec {
+    pname = "vinegar";
+    version = "1.5.9";
 
-buildGoModule rec {
-  pname = "vinegar";
-  version = "1.5.9";
+    src = fetchFromGitHub {
+      owner = "vinegarhq";
+      repo = "vinegar";
+      rev = "v${version}";
+      hash = "sha256-cLzQnNmQYyAIdTGygk/CNU/mxGgcgoFTg5G/0DNwpz4=";
+    };
 
-  src = fetchFromGitHub {
-    owner = "vinegarhq";
-    repo = "vinegar";
-    rev = "v${version}";
-    hash = "sha256-cLzQnNmQYyAIdTGygk/CNU/mxGgcgoFTg5G/0DNwpz4=";
-  };
+    vendorHash = "sha256-DZI4APnrldnwOmLZ9ucFBGQDxzPXTIi44eLu74WrSBI=";
 
-  vendorHash = "sha256-DZI4APnrldnwOmLZ9ucFBGQDxzPXTIi44eLu74WrSBI=";
+    nativeBuildInputs = [pkg-config makeBinaryWrapper];
+    buildInputs = [libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine];
 
-  nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
-  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine-staging ];
+    buildPhase = ''
+      runHook preBuild
+      make PREFIX=$out
+      runHook postBuild
+    '';
 
-  buildPhase = ''
-    runHook preBuild
-    make PREFIX=$out
-    runHook postBuild
-  '';
+    installPhase = ''
+      runHook preInstall
+      make PREFIX=$out install
+      runHook postInstall
+    '';
 
-  installPhase = ''
-    runHook preInstall
-    make PREFIX=$out install
-    runHook postInstall
-  '';
+    postInstall = ''
+      wrapProgram $out/bin/vinegar \
+        --prefix PATH : ${lib.makeBinPath [wine]}
+    '';
 
-  postInstall = ''
-    wrapProgram $out/bin/vinegar \
-      --prefix PATH : ${lib.makeBinPath [ wine-staging ]}
-  '';
-
-  meta = with lib; {
-    description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
-    homepage = "https://github.com/vinegarhq/vinegar";
-    changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
-    mainProgram = "vinegar";
-    license = licenses.gpl3Only;
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ nyanbinary ];
-  };
-}
+    meta = with lib; {
+      description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
+      homepage = "https://github.com/vinegarhq/vinegar";
+      changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
+      mainProgram = "vinegar";
+      license = licenses.gpl3Only;
+      platforms = ["x86_64-linux" "i686-linux"];
+      maintainers = with maintainers; [nyanbinary];
+    };
+  }
diff --git a/pkgs/development/libraries/libebml/default.nix b/pkgs/development/libraries/libebml/default.nix
index 92181db1c7cd..3478217d7f6b 100644
--- a/pkgs/development/libraries/libebml/default.nix
+++ b/pkgs/development/libraries/libebml/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libebml";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner  = "Matroska-Org";
     repo   = "libebml";
     rev    = "release-${version}";
-    sha256 = "sha256-36SfZUHJ2sIvrrHox583cQqfWWcrL2zW1IHzgDchC9g=";
+    sha256 = "sha256-PIVBePTWceMgiENdaL9lvXIL/RQIrtg7l0OG2tO0SU8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/miniaudio/default.nix b/pkgs/development/libraries/miniaudio/default.nix
index 76b77227130b..d8567177be61 100644
--- a/pkgs/development/libraries/miniaudio/default.nix
+++ b/pkgs/development/libraries/miniaudio/default.nix
@@ -4,13 +4,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "miniaudio";
-  version = "0.11.20";
+  version = "0.11.21";
 
   src = fetchFromGitHub {
     owner = "mackron";
     repo = "miniaudio";
     rev = version;
-    hash = "sha256-qIUqHLHTHFMtZU0GMZp5iWnoBJ/+Zv3tbLopSHolB4s=";
+    hash = "sha256-EOIykyUXYcdDeTYb/Mf3xgcxEpKS4us213tEFwm5mEI=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/physics/geant4/datasets.nix b/pkgs/development/libraries/physics/geant4/datasets.nix
index 149f541ee42f..bfe1cf1139ae 100644
--- a/pkgs/development/libraries/physics/geant4/datasets.nix
+++ b/pkgs/development/libraries/physics/geant4/datasets.nix
@@ -42,8 +42,8 @@ in
 
     {
       pname = "G4EMLOW";
-      version = "8.2";
-      sha256 = "sha256-PXdoJk/1pTvLlgh2BLvhHGC3/qkKqsj30SUhg+Go5Cc=";
+      version = "8.5";
+      sha256 = "sha256-ZrrKSaxdReKsEMEltPsmYiXlEYA+ZpgZCc6c0+m873M=";
       envvar = "LE";
     }
 
@@ -77,15 +77,15 @@ in
 
     {
       pname = "G4ABLA";
-      version = "3.1";
-      sha256 = "sha256-dpiwUrWL8bmIa+rNvWr2B63B4Jn8cwq2shz38JDAJ+0=";
+      version = "3.3";
+      sha256 = "sha256-HgQbMlLunO+IbWJPdT5pMwOqMtfl7zu6h7NPNtkuorE=";
       envvar = "ABLA";
     }
 
     {
       pname = "G4INCL";
-      version = "1.0";
-      sha256 = "sha256-cWFhghrp89BWX788LPNPTgLj5RnrQZqCI27vIsLENn0=";
+      version = "1.2";
+      sha256 = "sha256-+ICxYHPuCpLXSU8ydqbVLU3h02d6DUx8WHADlu0OGn4=";
       envvar = "INCL";
     }
 
diff --git a/pkgs/development/libraries/physics/geant4/default.nix b/pkgs/development/libraries/physics/geant4/default.nix
index b2b368f0349e..516d42aa577d 100644
--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@@ -48,12 +48,12 @@ in
 lib.warnIf (enableQT != false) "geant4: enableQT is deprecated, please use enableQt"
 
 stdenv.mkDerivation rec {
-  version = "11.1.3";
+  version = "11.2.0";
   pname = "geant4";
 
   src = fetchurl {
     url = "https://cern.ch/geant4-data/releases/geant4-v${version}.tar.gz";
-    hash = "sha256-TF++pnidjWGe2sygYx1rUhGmDhv5l0w9P6ue+eImkvU=";
+    hash = "sha256-Rq1/qzxctL0L3XfdbT4igxhIGSNby8AbLRF9gbNVlqY=";
   };
 
   # Fix broken paths in a .pc
diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index 97a2e3baf5b2..a1d9686ec757 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -5,10 +5,12 @@
 , lxml
 , pytestCheckHook
 , pythonOlder
+, python
 , pytz
 , recurring-ical-events
 , requests
 , setuptools
+, toPythonModule
 , tzlocal
 , vobject
 , xandikos
@@ -44,7 +46,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    xandikos
+    (toPythonModule (xandikos.override { python3Packages = python.pkgs; }))
   ];
 
   pythonImportsCheck = [ "caldav" ];
diff --git a/pkgs/games/minesweep-rs/default.nix b/pkgs/games/minesweep-rs/default.nix
index 11950a8f7410..034b3107959c 100644
--- a/pkgs/games/minesweep-rs/default.nix
+++ b/pkgs/games/minesweep-rs/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "minesweep-rs";
-  version = "6.0.39";
+  version = "6.0.41";
 
   src = fetchFromGitHub {
     owner = "cpcloud";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gV+16gxXfogHFFAXz/aG+D/uaXbZTgVjYK24QQizQ0c=";
+    hash = "sha256-j72ragB4cwFGX08Zlz8eF3j+3dp7JZ64oJ461JoLIrU=";
   };
 
-  cargoHash = "sha256-D6HnpXxixmVugbjr5pMYZiVeGLgje41k3n3xic6Ecps=";
+  cargoHash = "sha256-QtAuUNhBIMz+j6h2DVLDxxWk8iMXy8G2pinS8115qr4=";
 
   meta = with lib; {
     description = "Sweep some mines for fun, and probably not for profit";
diff --git a/pkgs/games/teeworlds/default.nix b/pkgs/games/teeworlds/default.nix
index bec2b9bc7aa7..30e4833d0666 100644
--- a/pkgs/games/teeworlds/default.nix
+++ b/pkgs/games/teeworlds/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, cmake, pkg-config, python3, alsa-lib
+{ fetchFromGitHub, fetchpatch, lib, stdenv, cmake, pkg-config, python3, alsa-lib
 , libX11, libGLU, SDL2, lua5_3, zlib, freetype, wavpack, icoutils
 , nixosTests
 , Cocoa
@@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
     # Can't use fetchpatch or fetchpatch2 because of https://github.com/NixOS/nixpkgs/issues/32084
     # Using fetchurl instead is also not a good idea, see https://github.com/NixOS/nixpkgs/issues/32084#issuecomment-727223713
     ./rename-VERSION-to-VERSION.txt.patch
+    (fetchpatch {
+      name = "CVE-2021-43518.patch";
+      url = "https://salsa.debian.org/games-team/teeworlds/-/raw/a6c4b23c1ce73466e6d89bccbede70e61e8c9cba/debian/patches/CVE-2021-43518.patch";
+      hash = "sha256-2MmsucaaYjqLgMww1492gNmHmvBJm/NED+VV5pZDnBY=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/misc/translatelocally-models/default.nix b/pkgs/misc/translatelocally-models/default.nix
new file mode 100644
index 000000000000..3c71247d1d9a
--- /dev/null
+++ b/pkgs/misc/translatelocally-models/default.nix
@@ -0,0 +1,43 @@
+{ lib, stdenvNoCC, fetchurl }:
+
+let
+  modelSpecs = (builtins.fromJSON (builtins.readFile ./models.json));
+  withCodeAsKey = f: { code, ... }@attrs: lib.nameValuePair code (f attrs);
+  mkModelPackage = { name, code, version, url, checksum }:
+    stdenvNoCC.mkDerivation {
+      pname = "translatelocally-model-${code}";
+      version = toString version;
+
+      src = fetchurl {
+        inherit url;
+        sha256 = checksum;
+      };
+      dontUnpack = true;
+
+      installPhase = ''
+        TARGET="$out/share/translateLocally/models"
+        mkdir -p "$TARGET"
+        tar -xzf "$src" -C "$TARGET"
+
+        # avoid patching shebangs in inconsistently executable extra files
+        find "$out" -type f -exec chmod -x {} +
+      '';
+
+      meta = {
+        description = "translateLocally model - ${name}";
+        homepage = "https://translatelocally.com/";
+        # https://github.com/browsermt/students/blob/master/LICENSE.md
+        license = lib.licenses.cc-by-sa-40;
+      };
+    };
+  allModelPkgs =
+    lib.listToAttrs (map (withCodeAsKey mkModelPackage) modelSpecs);
+
+in allModelPkgs // {
+  is-en-tiny = allModelPkgs.is-en-tiny.overrideAttrs (super: {
+    # missing model https://github.com/XapaJIaMnu/translateLocally/issues/147
+    meta = super.meta // { broken = true; };
+  });
+} // {
+  passthru.updateScript = ./update.sh;
+}
diff --git a/pkgs/misc/translatelocally-models/models.json b/pkgs/misc/translatelocally-models/models.json
new file mode 100644
index 000000000000..98529a1a9549
--- /dev/null
+++ b/pkgs/misc/translatelocally-models/models.json
@@ -0,0 +1,149 @@
+[
+  {
+    "version": 1,
+    "checksum": "3714539160d5b4dce3ce0d829939315e3daffeaff53647249cc6336d745c09f2",
+    "url": "https://data.statmt.org/bergamot/models/csen/csen.student.base.tar.gz",
+    "name": "Czech-English base",
+    "code": "cs-en-base"
+  },
+  {
+    "version": 1,
+    "checksum": "693aa14ecb86275169ad4b01cbca294f3bd38d8d9bc1fad8dd89fa7e937e7d2c",
+    "url": "https://data.statmt.org/bergamot/models/csen/csen.student.tiny11.tar.gz",
+    "name": "Czech-English tiny",
+    "code": "cs-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "7a57b4e3a11a2c5e03fc6855ffc2b8f61ce3f1a68aeefa4592577a9eebe25031",
+    "url": "https://data.statmt.org/bergamot/models/csen/encs.student.base.tar.gz",
+    "name": "English-Czech base",
+    "code": "en-cs-base"
+  },
+  {
+    "version": 1,
+    "checksum": "f999d6511bdb4f1ff246b0563fdf9b71d836e1c3037fe5306a61836d3b5b8d19",
+    "url": "https://data.statmt.org/bergamot/models/csen/encs.student.tiny11.tar.gz",
+    "name": "English-Czech tiny",
+    "code": "en-cs-tiny"
+  },
+  {
+    "version": 2,
+    "checksum": "e7362faa83c4f61e552adf8fbd4bc528fe706746eb9fc1c286ec9af7566e3daf",
+    "url": "https://data.statmt.org/bergamot/models/deen/deen.student.base.tar.gz",
+    "name": "German-English base",
+    "code": "de-en-base"
+  },
+  {
+    "version": 2,
+    "checksum": "5c11b6ccfa0533fd5632b3cbccbb054972076266e2d1d989d3babb0ec0b10e28",
+    "url": "https://data.statmt.org/bergamot/models/deen/deen.student.tiny11.tar.gz",
+    "name": "German-English tiny",
+    "code": "de-en-tiny"
+  },
+  {
+    "version": 2,
+    "checksum": "cf9ab5a41ce359672ab47579686f9af50fc1fe040552c375ca86912f0fce7827",
+    "url": "https://data.statmt.org/bergamot/models/deen/ende.student.base.tar.gz",
+    "name": "English-German base",
+    "code": "en-de-base"
+  },
+  {
+    "version": 2,
+    "checksum": "0e85d1d7ee4f8a3ec12680696ffc11fa97d67a54d068ceafcf390a87df94877f",
+    "url": "https://data.statmt.org/bergamot/models/deen/ende.student.tiny11.tar.gz",
+    "name": "English-German tiny",
+    "code": "en-de-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "adf49d0e2f21b82414bc353ae1f0904d93360caa92203ae9f2fc209a83882d81",
+    "url": "https://data.statmt.org/bergamot/models/esen/esen.student.tiny11.tar.gz",
+    "name": "Spanish-English tiny",
+    "code": "es-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "6594dda2a4f5d333969c30f8356f4a9f3fe15a9f8a5fd018b0d85b9d9ad2abb0",
+    "url": "https://data.statmt.org/bergamot/models/esen/enes.student.tiny11.tar.gz",
+    "name": "English-Spanish tiny",
+    "code": "en-es-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "05c6525549c9c621e348f8de74533764ad7696aba8245fc9a504116f8ef4053c",
+    "url": "https://data.statmt.org/bergamot/models/eten/eten.student.tiny11.tar.gz",
+    "name": "Estonian-English tiny",
+    "code": "et-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "afce6c566270abdd4db332e8dcf4fe22057ada3b2a1171aab04d0d4817396fb5",
+    "url": "https://data.statmt.org/bergamot/models/eten/enet.student.tiny11.tar.gz",
+    "name": "English-Estonian tiny",
+    "code": "en-et-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "5c1696747590d1a75bef67348dce96bcd3889eb5a06a0f670c3d7232ed79f60e",
+    "url": "https://data.statmt.org/bergamot/models/isen/isen.student.tiny11.tar.gz",
+    "name": "Icelandic-English tiny",
+    "code": "is-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "9f5dde2f4f87438c24c9561990636e624c53b527ddc8505f822b22b073069de8",
+    "url": "https://data.statmt.org/bergamot/models/nben/nben.student.tiny11.tar.gz",
+    "name": "Norwegian (Bokmål)-English tiny",
+    "code": "nb-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "0bb4b83560caaffae95940574d939999092800a7803fae4c79a97e6481887a4f",
+    "url": "https://data.statmt.org/bergamot/models/nnen/nnen.student.tiny11.tar.gz",
+    "name": "Norwegian (Nynorsk)-English tiny",
+    "code": "nn-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "ecfe9c2b0be3406c0205ad2da58f4005893a4ae969e81dd9c523093cf5c7abc3",
+    "url": "https://data.statmt.org/bergamot/models/bgen/bgen.student.tiny11.tar.gz",
+    "name": "Bulgarian-English tiny",
+    "code": "bg-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "eb9a7511ae9c89fb91ab6da1e9d5061946ad752e5801351f39c8eddca9705c74",
+    "url": "https://data.statmt.org/bergamot/models/bgen/enbg.student.tiny11.tar.gz",
+    "name": "English-Bulgarian tiny",
+    "code": "en-bg-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "87148203cbda28421d76fffbd7d3cd6c1fc0d6dae2843c248870274d6512a388",
+    "url": "https://data.statmt.org/bergamot/models/plen/plen.student.tiny11.tar.gz",
+    "name": "Polish-English tiny",
+    "code": "pl-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "c33219daa12e7872cf7ac8a1b86a2f3e0592ebadd7e756bf11d16d9a7725cf9b",
+    "url": "https://data.statmt.org/bergamot/models/plen/enpl.student.tiny11.tar.gz",
+    "name": "English-Polish tiny",
+    "code": "en-pl-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "817a45ed9ec3228bfb797e5e14781ab7fe9f388fe1e834e280031f05089809f8",
+    "url": "https://data.statmt.org/bergamot/models/fren/fren.student.tiny11.tar.gz",
+    "name": "French-English tiny",
+    "code": "fr-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "28deea86d2a02102a7fedf19391a7628386f01f1f532d430306a9728dc5ec2d6",
+    "url": "https://data.statmt.org/bergamot/models/fren/enfr.student.tiny11.tar.gz",
+    "name": "English-French tiny",
+    "code": "en-fr-tiny"
+  }
+]
diff --git a/pkgs/misc/translatelocally-models/update.sh b/pkgs/misc/translatelocally-models/update.sh
new file mode 100755
index 000000000000..4c75508211b6
--- /dev/null
+++ b/pkgs/misc/translatelocally-models/update.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p curl -p jq
+
+set -eu -o pipefail
+
+curl https://translatelocally.com/models.json \
+  | jq '.models | map(with_entries(select([.key] | inside([
+      "name",
+      "code",
+      "version",
+      "url",
+      "checksum"
+    ]))))' \
+  > "$(dirname "$0")/models.json"
diff --git a/pkgs/servers/monitoring/mimir/default.nix b/pkgs/servers/monitoring/mimir/default.nix
index b52ca5a2f1c2..8516d40fdeb4 100644
--- a/pkgs/servers/monitoring/mimir/default.nix
+++ b/pkgs/servers/monitoring/mimir/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests, nix-update-script }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.10.4";
+  version = "2.10.5";
 
   src = fetchFromGitHub {
     rev = "${pname}-${version}";
     owner = "grafana";
     repo = pname;
-    hash = "sha256-0OFuMWoYgo8qCxWk93wOy45diLb2JIBsoxptLKTeOC4=";
+    hash = "sha256-+Xlejvdpum1UMUhELUzcF9bJOXx4tIkDA8wHrE88U5w=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/security/cnquery/default.nix b/pkgs/tools/security/cnquery/default.nix
new file mode 100644
index 000000000000..12a0ed8fb09a
--- /dev/null
+++ b/pkgs/tools/security/cnquery/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "cnquery";
+  version = "9.11.0";
+
+  src = fetchFromGitHub {
+    owner = "mondoohq";
+    repo = "cnquery";
+    rev = "v${version}";
+    hash = "sha256-3fyX6vz3lqnV07gu/H7qeIrLyNSbqhLpICJWqPTv7T0=";
+  };
+
+  subPackages = [ "apps/cnquery" ];
+
+  vendorHash = "sha256-7zZRX0LWDmO7LA0fIjAh8+5kK2dcAV/4HQmKdn9I3Mg=";
+
+  meta = with lib; {
+    description = "cloud-native, graph-based asset inventory";
+    longDescription = ''
+    cnquery is a cloud-native tool for querying your entire fleet. It answers thousands of questions about your infrastructure and integrates with over 300 resources across cloud accounts, Kubernetes, containers, services, VMs, APIs, and more.
+      '';
+    homepage = "https://mondoo.com/cnquery";
+    changelog = "https://github.com/mondoohq/cnquery/releases/tag/v${version}";
+    license = licenses.bsl11;
+    maintainers = with maintainers; [ mariuskimmina ];
+  };
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e5065dce4c45..72060de7496c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1068,7 +1068,7 @@ mapAliases ({
   inherit (stdenv) buildPlatform hostPlatform targetPlatform; # Added 2023-01-09
 
   # LLVM packages for (integration) testing that should not be used inside Nixpkgs:
-  llvmPackages_latest = llvmPackages_16;
+  llvmPackages_latest = llvmPackages_17;
   llvmPackages_git = recurseIntoAttrs (callPackage ../development/compilers/llvm/git {
     inherit (stdenvAdapters) overrideCC;
     buildLlvmTools = buildPackages.llvmPackages_git.tools;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e7d71bfea4d5..9032def7401a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -518,6 +518,8 @@ with pkgs;
 
   cm256cc = callPackage ../development/libraries/cm256cc {  };
 
+  cnquery = callPackage ../tools/security/cnquery { };
+
   cocogitto = callPackage ../development/tools/cocogitto {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -14108,6 +14110,8 @@ with pkgs;
 
   translatelocally = callPackage ../applications/misc/translatelocally { };
 
+  translatelocally-models = recurseIntoAttrs (callPackages ../misc/translatelocally-models { });
+
   translate-shell = callPackage ../applications/misc/translate-shell { };
 
   translatepy = with python3.pkgs; toPythonApplication translatepy;
@@ -32991,6 +32995,8 @@ with pkgs;
 
   jack_oscrolloscope = callPackage ../applications/audio/jack-oscrolloscope { };
 
+  jack-passthrough = callPackage ../applications/audio/jack-passthrough { };
+
   jack_rack = callPackage ../applications/audio/jack-rack { };
 
   jackmeter = callPackage ../applications/audio/jackmeter { };