diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 47506b964af4..a2e141b5bcaf 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -5,7 +5,7 @@
 { nixpkgs ? { outPath = (import ../lib).cleanSource ./..; revCount = 56789; shortRev = "gfedcba"; }
 , stableBranch ? false
 , supportedSystems ? [ "aarch64-linux" "x86_64-linux" ]
-, limitedSupportedSystems ? [ "i686-linux" ]
+, limitedSupportedSystems ? [ ]
 }:
 
 let
@@ -168,6 +168,7 @@ in rec {
         (onFullSupported "nixos.tests.xfce")
         (onFullSupported "nixpkgs.emacs")
         (onFullSupported "nixpkgs.jdk")
+        (onSystems ["x86_64-linux"] "nixpkgs.mesa_i686") # i686 sanity check + useful
         ["nixpkgs.tarball"]
 
         # Ensure that nixpkgs-check-by-name is available in all release channels and nixos-unstable,
diff --git a/nixos/tests/sway.nix b/nixos/tests/sway.nix
index 695d4a770810..185c5b1b0aa9 100644
--- a/nixos/tests/sway.nix
+++ b/nixos/tests/sway.nix
@@ -134,7 +134,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     machine.wait_for_file("/tmp/sway-ipc.sock")
 
     # Test XWayland (foot does not support X):
-    swaymsg("exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY=invalid alacritty")
+    swaymsg("exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty")
     wait_for_window("alice@machine")
     machine.send_chars("test-x11\n")
     machine.wait_for_file("/tmp/test-x11-exit-ok")
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix
index 85bad220bb9c..1a31e8f9a28d 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix
@@ -1,5 +1,6 @@
-{ trivialBuild, fetchFromGitHub, pkgs, lib, }:
-trivialBuild {
+{ fetchFromGitHub, melpaBuild, pkgs, lib, substituteAll, writeText }:
+
+melpaBuild {
   pname = "codeium";
   version = "1.6.13";
   src = fetchFromGitHub {
@@ -8,14 +9,22 @@ trivialBuild {
     rev = "1.6.13";
     hash = "sha256-CjT21GhryO8/iM0Uzm/s/I32WqVo4M3tSlHC06iEDXA=";
   };
-
+  commit = "02f9382c925633a19dc928e99b868fd5f6947e58";
   buildInputs = [ pkgs.codeium ];
 
-  patches = [ ./codeium.el.patch ];
-  postPatch = ''
-    substituteInPlace codeium.el --subst-var-by codeium ${pkgs.codeium}/bin/codeium_language_server
+  recipe = writeText "recipe" ''
+    (codeium
+      :repo "Exafunction/codeium.el"
+      :fetcher github)
   '';
 
+  patches = [
+    (substituteAll {
+      src = ./codeium.el.patch;
+      codeium = "${pkgs.codeium}/bin/codeium_language_server";
+    })
+  ];
+
   meta = {
     description = "Free, ultrafast Copilot alternative for Emacs";
     homepage = "https://github.com/Exafunction/codeium.el";
diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index df78c3108fb8..affa411aaa3c 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -21,6 +21,15 @@ mkDerivation rec {
     inherit hash;
   };
 
+  patches = [
+    # Fixes build with SIP 6.8
+    (fetchpatch {
+      name = "bump-SIP-ABI-version-to-12.8.patch";
+      url = "https://invent.kde.org/graphics/krita/-/commit/2d71c47661d43a4e3c1ab0c27803de980bdf2bb2.diff";
+      hash = "sha256-U3E44nj4vra++PJV20h4YHjES78kgrJtr4ktNeQfOdA=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip makeWrapper ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 27d07e9d57f2..71c913cac33a 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -9,43 +9,43 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.10.20" else "8.10.22-21.BETA";
+  version = if channel == "stable" then "8.10.23" else "8.10.24-6.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-KOKqI64uI454ryLy/zdD0jxgY3GekBFoh028ftt1Twg=";
+        hash = "sha256-TqZ9AffyHl1mAKyZvADVGh5OXKZEGXjKSkXq7ZI/obA=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-8MDJFG5d81Alxs1hqLw7DP+Pte+haGKfiZ/erGvks5A=";
+        hash = "sha256-vEdpqlGXc5gR9kr+iRRvRI4r48H6AWr+sDZt2kNQxB4=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-T+f19Q/pzsC6lh8OF/w/pzRLBfAdlk1gwQz8funkx8Q=";
+        hash = "sha256-1vZbZdAyK/J+lMPwgeyEO5Qvj6nBd0TMkG4Y71Bgfoc=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-kmal5wfqCKAlg7c+xVHM39qrucr+Kaxr4pNBYwKfs5g=";
+        hash = "sha256-SGvzRGfoMrHSYOlJjsjS0ETIZelctzVbd/SyCv40+QI=";
       };
     };
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-R4jj5U2a8AoAs1qVIjMQx6odK0Ks4WeqRURf3pOOduo=";
+        hash = "sha256-vrC+JzcRQnXTB0KDoIpYTJjoQCNFgFaZuV+8BXTwwmk=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-1opo/RZ0aTZn3Jo9XIw/g8WYK2xgRiaRKgd7RstGJ5g=";
+        hash = "sha256-4v5gtaPWjyBs5VV5quuq77MzjcYQN1k/Ju0NYB44gYM=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-jlQgXlLLUF78g2B7KYgTSQZAEe57TRw4vN7MPn3IwwI=";
+        hash = "sha256-SSGg8zLiEaYFTWRb4K145nG/dDQCQw2di8bD59xoTrA=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-nzKESK3QKsi0Xzm3ytXWIH08LV2F6jLKvCLDHzVR9xQ=";
+        hash = "sha256-SgTv1gYPBAr/LPeAtHGBZUw35TegpaVW1M84maT8BdY=";
       };
     };
   };
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 31be230a67ad..5b185b09a4c5 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -52,7 +52,7 @@
     # Except when:
     #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
     #    - static armv7l, where compilation fails.
-    && !(hostPlatform.isAarch && hostPlatform.isStatic)
+    && !(targetPlatform.isAarch && targetPlatform.isStatic)
   ) "pie"
 
 # Darwin code signing support utilities
diff --git a/pkgs/development/libraries/libcifpp/default.nix b/pkgs/development/libraries/libcifpp/default.nix
index 81ceebc5ef73..c98068f2809a 100644
--- a/pkgs/development/libraries/libcifpp/default.nix
+++ b/pkgs/development/libraries/libcifpp/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcifpp";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchFromGitHub {
     owner = "PDB-REDO";
     repo = "libcifpp";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-cj7xhRYTGxQnod/kw02UYiJewPJosxKSwvwDIu6nG0A=";
+    hash = "sha256-MddldYpvZHgAb/ndtWKdAf0TzKIYJalaywmSRZCtBmc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/propka/default.nix b/pkgs/development/python-modules/propka/default.nix
index d9d28cb209de..08a85586411c 100644
--- a/pkgs/development/python-modules/propka/default.nix
+++ b/pkgs/development/python-modules/propka/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pythonOlder
 , setuptools
 , pytestCheckHook
@@ -9,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "propka";
-  version = "3.5.0";
+  version = "3.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,18 +17,9 @@ buildPythonPackage rec {
     owner = "jensengroup";
     repo = "propka";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NbvrlapBALGbUyBqdqDcDG/igDf/xqxC35DzVUrbHlo=";
+    hash = "sha256-EJQqCe4WPOpqsSxxfbTjF0qETpSPYqpixpylweTCjko=";
   };
 
-  patches = [
-    # https://github.com/jensengroup/propka/pull/171
-    (fetchpatch {
-      name = "python312-compatibility.patch";
-      url = "https://github.com/jensengroup/propka/commit/1c8885d4003e5fd8a2921909268001b197066beb.patch";
-      hash = "sha256-fB2WKVHoIgqDA/EYt7369HrIDCEJ1rmKP2tmxAdhCRs=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index b23af850c471..eb85f0d329a8 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -3,10 +3,10 @@
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-ms8zX3Ov/du5J6M0qzmQFlbGaR9S9tQHMwQs+AutF0w=",
+                "hash": "sha256-YUwftKxD+aEJ7jorrJ12q7brfhih8ukChdlVUmnRAEw=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v28.1.0"
+                "rev": "v28.1.1"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -873,7 +873,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "28.1.0",
+        "version": "28.1.1",
         "modules": "119",
         "chrome": "120.0.6099.109",
         "node": "18.18.2",
@@ -888,17 +888,17 @@
                 }
             }
         },
-        "electron_yarn_hash": "0n64fi2s97ly7kl0f8922sgavdm6qh24ms3qwf21663a1igdd4jn",
-        "chromium_npm_hash": "sha256-zexxXAAJDnhMmh7HfBO1V1z1Yds06C3gSpXacsbjUb4="
+        "chromium_npm_hash": "sha256-zexxXAAJDnhMmh7HfBO1V1z1Yds06C3gSpXacsbjUb4=",
+        "electron_yarn_hash": "0n64fi2s97ly7kl0f8922sgavdm6qh24ms3qwf21663a1igdd4jn"
     },
     "27": {
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-bafuK4n9UXZqG1NHBzM5eLQ0PPkQx7CBHQLmShmQHWQ=",
+                "hash": "sha256-695wQ4JKMWTLE/ZNn9LCFkhn2xsn5Roce8AZ1LYEJKI=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v27.2.0"
+                "rev": "v27.2.1"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -1765,7 +1765,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "27.2.0",
+        "version": "27.2.1",
         "modules": "118",
         "chrome": "118.0.5993.159",
         "node": "18.17.1",
@@ -1787,10 +1787,10 @@
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-K14NaU0INgNQP4mD6lXeYRd3COoMvMjRUOtsUZB9KiQ=",
+                "hash": "sha256-BVuGSlIH2iuCGV8P6TvesEx92dgJAMevHHXELKwWWk8=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v26.6.3"
+                "rev": "v26.6.4"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -2609,7 +2609,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "26.6.3",
+        "version": "26.6.4",
         "modules": "116",
         "chrome": "116.0.5845.228",
         "node": "18.16.1",
diff --git a/pkgs/development/tools/ocaml/ocamlbuild/default.nix b/pkgs/development/tools/ocaml/ocamlbuild/default.nix
index e2e3f07d58eb..7ce9a59866be 100644
--- a/pkgs/development/tools/ocaml/ocamlbuild/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlbuild/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, ocaml, findlib }:
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-ocamlbuild";
-  version = "0.14.2";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "ocaml";
     repo = "ocamlbuild";
     rev = version;
-    sha256 = "sha256-QAqIMdi6M9V7RIX0kppKPSkCJE/pLx2iMdh5XYXQCJs=";
+    sha256 = "sha256-dfcNu4ugOYu/M0rRQla7lXum/g1UzncdLGmpPYo0QUM=";
   };
 
   createFindlibDestdir = true;
diff --git a/pkgs/os-specific/linux/tbs/default.nix b/pkgs/os-specific/linux/tbs/default.nix
index 54268693454c..5805a400c1e2 100644
--- a/pkgs/os-specific/linux/tbs/default.nix
+++ b/pkgs/os-specific/linux/tbs/default.nix
@@ -1,31 +1,38 @@
-{ stdenv, lib, fetchFromGitHub, kernel, kmod, perl, patchutils, perlPackages }:
+{ stdenv, lib, fetchFromGitHub, kernel, kmod, patchutils, perlPackages }:
 let
 
   media = fetchFromGitHub rec {
     name = repo;
     owner = "tbsdtv";
     repo = "linux_media";
-    rev = "efe31531b77efd3a4c94516504a5823d31cdc776";
-    sha256 = "1533qi3sb91v00289hl5zaj4l35r2sf9fqc6z5ky1vbb7byxgnlr";
+    rev = "d0a7e44358f28064697e0eed309db03166dcd83b";
+    hash = "sha256-BTHlnta5qv2bdPjD2bButwYGpwR/bq99/AUoZqTHHYw=";
   };
 
   build = fetchFromGitHub rec {
     name = repo;
     owner = "tbsdtv";
     repo = "media_build";
-    rev = "a0d62eba4d429e0e9d2c2f910fb203e817cac84b";
-    sha256 = "1329s7w9xlqjqwkpaqsd6b5dmzhm97jw0c7c7zzmmbdkl289i4i4";
+    rev = "88764363a3e3d36b3c59a0a2bf2244e262035d47";
+    hash = "sha256-LFTxYVPudflxqYTSBIDNkTrGs09MOuYBXwpGYqWfEFQ=";
   };
 
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
   pname = "tbs";
-  version = "2018.04.18-${kernel.version}";
+  version = "20231210-${kernel.version}";
 
   srcs = [ media build ];
   sourceRoot = build.name;
 
+  # https://github.com/tbsdtv/linux_media/wiki
   preConfigure = ''
     make dir DIR=../${media.name}
+    make allyesconfig
+    sed --regexp-extended --in-place v4l/.config \
+      -e 's/(^CONFIG.*_RC.*=)./\1n/g' \
+      -e 's/(^CONFIG.*_IR.*=)./\1n/g' \
+      -e 's/(^CONFIG_VIDEO_VIA_CAMERA=)./\1n/g'
   '';
 
   postPatch = ''
@@ -44,12 +51,12 @@ in stdenv.mkDerivation {
   buildFlags = [ "VER=${kernel.modDirVersion}" ];
   installFlags = [ "DESTDIR=$(out)" ];
 
-  hardeningDisable = [ "all" ];
+  hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ patchutils kmod perl perlPackages.ProcProcessTable ]
-  ++ kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ patchutils kmod perlPackages.ProcProcessTable ]
+    ++ kernel.moduleBuildDependencies;
 
-   postInstall = ''
+  postInstall = ''
     find $out/lib/modules/${kernel.modDirVersion} -name "*.ko" -exec xz {} \;
   '';
 
@@ -59,6 +66,6 @@ in stdenv.mkDerivation {
     license = licenses.gpl2;
     maintainers = with maintainers; [ ck3d ];
     priority = -1;
-    broken = true;
+    broken = kernel.kernelOlder "4.14" || kernel.kernelAtLeast "6.6";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bdcd6215c2e9..74cb7324459b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23981,6 +23981,7 @@ with pkgs;
     inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
     inherit (darwin.apple_sdk_11_0.libs) Xplugin;
   };
+  mesa_i686 = pkgsi686Linux.mesa; # make it build on Hydra
 
   mesa_glu =  callPackage ../development/libraries/mesa-glu {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 6e5c982f5728..940a5e154562 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -29,6 +29,8 @@ makeScopeWithSplicing' {
   inherit stdenv;
 
   # LIBRARIES
+  appstream-qt = callPackage ../development/libraries/appstream/qt.nix { };
+
   kdsoap = callPackage ../development/libraries/kdsoap { };
 
   futuresql = callPackage ../development/libraries/futuresql { };