diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 78845ffe371d..f1a5dece6d88 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -446,6 +446,13 @@
     githubId = 25236206;
     name = "Adrian Dole";
   };
+  adriangl = {
+    email = "adrian@lauterer.it";
+    matrix = "@adriangl:pvv.ntnu.no";
+    github = "adrlau";
+    githubId = 25004152;
+    name = "Adrian Gunnar Lauterer";
+  };
   AdsonCicilioti = {
     name = "Adson Cicilioti";
     email = "adson.cicilioti@live.com";
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 9b8bd62809c5..1e0a8d0f928e 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -332,12 +332,28 @@ in
       # during migrations
       bindsTo = [ "paperless-scheduler.service" ];
       after = [ "paperless-scheduler.service" ];
+      # Setup PAPERLESS_SECRET_KEY.
+      # If this environment variable is left unset, paperless-ngx defaults
+      # to a well-known value, which is insecure.
+      script = let
+        secretKeyFile = "${cfg.dataDir}/nixos-paperless-secret-key";
+      in ''
+        if [[ ! -f '${secretKeyFile}' ]]; then
+          (
+            umask 0377
+            tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge '${secretKeyFile}'
+          )
+        fi
+        export PAPERLESS_SECRET_KEY=$(cat '${secretKeyFile}')
+        if [[ ! $PAPERLESS_SECRET_KEY ]]; then
+          echo "PAPERLESS_SECRET_KEY is empty, refusing to start."
+          exit 1
+        fi
+        exec ${pkg.python.pkgs.gunicorn}/bin/gunicorn \
+          -c ${pkg}/lib/paperless-ngx/gunicorn.conf.py paperless.asgi:application
+      '';
       serviceConfig = defaultServiceConfig // {
         User = cfg.user;
-        ExecStart = ''
-          ${pkg.python.pkgs.gunicorn}/bin/gunicorn \
-            -c ${pkg}/lib/paperless-ngx/gunicorn.conf.py paperless.asgi:application
-        '';
         Restart = "on-failure";
 
         # gunicorn needs setuid, liblapack needs mbind
@@ -349,7 +365,6 @@ in
         CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
       };
       environment = env // {
-        PATH = mkForce pkg.path;
         PYTHONPATH = "${pkg.python.pkgs.makePythonPath pkg.propagatedBuildInputs}:${pkg}/lib/paperless-ngx/src";
       };
       # Allow the web interface to access the private /tmp directory of the server.
diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
index be3845be6563..50993b056a84 100644
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.72.1";
+  version = "1.73";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    hash = "sha256-dGoldr0JvXri4XfSn/DKeJw/wsBaj+AKoKWdbEgo8lg=";
+    hash = "sha256-f5deXMSyZIDKPO7hsNONes/kTFLFodx4nuEjZzkR5Aw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index 940a281a1ce4..276fdbf32e2c 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.64";
+  version = "1.65.1";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "sha256-b/1YksgXKXi6Tyntd03yWKZAAjvmG4HxsVYLVXoiMaA=";
+    sha256 = "sha256-0bZGiulLeAZ8bR0lj0Bm7te3T3YhxSOBFgMgWADRkIY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/visidata/default.nix b/pkgs/applications/misc/visidata/default.nix
index 7eaef8b202e7..93062a7c9a58 100644
--- a/pkgs/applications/misc/visidata/default.nix
+++ b/pkgs/applications/misc/visidata/default.nix
@@ -45,13 +45,13 @@
 }:
 buildPythonApplication rec {
   pname = "visidata";
-  version = "2.11";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "saulpw";
     repo = "visidata";
     rev = "v${version}";
-    hash = "sha256-G/9paJFJsRfIxMJ2hbuVS7pxCfSUCK69DNV2DHi60qA=";
+    hash = "sha256-A8iYFdW30Em5pjGn3DRpaV0A7ixwfSzmIp8AgtPkBCI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/science/biology/mmseqs2/default.nix b/pkgs/applications/science/biology/mmseqs2/default.nix
index 253f4a43a81c..3e39fcb2918b 100644
--- a/pkgs/applications/science/biology/mmseqs2/default.nix
+++ b/pkgs/applications/science/biology/mmseqs2/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mmseqs2";
-  version = "14-7e284";
+  version = "15-6f452";
 
   src = fetchFromGitHub {
     owner = "soedinglab";
     repo = pname;
     rev = version;
-    sha256 = "sha256-pVryZGblgMEqJl5M20CHxav269yGY6Y4ci+Gxt6SHOU=";
+    sha256 = "sha256-L+zOWrGkCLz/wqpBuji8H4/93sDFpcfnDOE8FHq1j84=";
   };
 
   nativeBuildInputs = [ cmake xxd perl installShellFiles ];
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index 70ed0976f7e9..96c4113f4bfc 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "79.0";
+  version = "80.0";
 
   src = fetchFromGitLab {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "sha256-M+CST7A/obfuGH4lyV68vrhmzEIFCa7DRgApKbPh/uQ=";
+    hash = "sha256-/RqTfnxivghViFryCvj5RXSBziztb1Drb7tT89cGZ3o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ci/circom/package.nix b/pkgs/by-name/ci/circom/package.nix
new file mode 100644
index 000000000000..6d74c5e268e3
--- /dev/null
+++ b/pkgs/by-name/ci/circom/package.nix
@@ -0,0 +1,27 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "circom";
+  version = "2.1.6";
+
+  src = fetchFromGitHub {
+    owner = "iden3";
+    repo = "circom";
+    rev = "v${version}";
+    hash = "sha256-2YusBWAYDrTvFHYIjKpALphhmtsec7jjKHb1sc9lt3Q=";
+  };
+
+  cargoHash = "sha256-G6z+DxIhmm1Kzv8EQCqvfGAhQn5Vrx9LXrl+bWBVKaM=";
+  doCheck = false;
+
+  meta = with lib; {
+    description = "zkSnark circuit compiler";
+    homepage = "https://github.com/iden3/circom";
+    changelog = "https://github.com/iden3/circom/blob/${src.rev}/RELEASES.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/by-name/li/libaribcaption/package.nix b/pkgs/by-name/li/libaribcaption/package.nix
new file mode 100644
index 000000000000..7d39841ec6fe
--- /dev/null
+++ b/pkgs/by-name/li/libaribcaption/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+
+, fontconfig
+, freetype
+
+, ApplicationServices
+, CoreFoundation
+, CoreGraphics
+, CoreText
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libaribcaption";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "xqq";
+    repo = "libaribcaption";
+    rev = "v${version}";
+    hash = "sha256-x6l0ZrTktSsqfDLVRXpQtUOruhfc8RF3yT991UVZiKA=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+
+  buildInputs = lib.optionals (!stdenv.isDarwin) [
+    fontconfig
+    freetype
+  ] ++ lib.optionals stdenv.isDarwin [
+    ApplicationServices
+    CoreFoundation
+    CoreGraphics
+    CoreText
+  ];
+
+  meta = with lib; {
+    description = "Portable ARIB STD-B24 Caption Decoder/Renderer";
+    homepage = "https://github.com/xqq/libaribcaption";
+    changelog = "https://github.com/xqq/libaribcaption/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ chayleaf ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/zp/zpix-pixel-font/package.nix b/pkgs/by-name/zp/zpix-pixel-font/package.nix
new file mode 100644
index 000000000000..6a785c9d8fac
--- /dev/null
+++ b/pkgs/by-name/zp/zpix-pixel-font/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "zpix-pixel-font";
+  version = "3.1.8";
+
+  srcs = [
+    (fetchurl {
+      name = "zpix-pixel-font.bdf";
+      url = "https://github.com/SolidZORO/zpix-pixel-font/releases/download/v${version}/zpix.bdf";
+      hash = "sha256-qE6YPKuk1FRRrTvmy4YIDuxRfslma264piUDj1FWtk4=";
+    })
+    (fetchurl {
+      name = "zpix-pixel-font.ttf";
+      url = "https://github.com/SolidZORO/zpix-pixel-font/releases/download/v${version}/zpix.ttf";
+      hash = "sha256-UIgLGsVTbyhYMKfTYiA+MZmV4dFT9HX3sxTdrcc4vE0=";
+    })
+  ];
+
+  dontUnpack = true;
+  __structuredAttrs = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm444 ''${srcs[0]} $out/share/fonts/misc/zpix.bdf
+    install -Dm444 ''${srcs[1]} $out/share/fonts/truetype/zpix.ttf
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A pixel font supporting multiple languages like English, Chinese and Japanese";
+    homepage = "https://github.com/SolidZORO/zpix-pixel-font/";
+    changelog = "https://github.com/SolidZORO/zpix-pixel-font/blob/master/CHANGELOG.md";
+    license = licenses.unfree;
+    maintainers = [ maintainers.adriangl ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/12/openmp/default.nix b/pkgs/development/compilers/llvm/12/openmp/default.nix
index e0bcf03e00e3..6040f3d1621a 100644
--- a/pkgs/development/compilers/llvm/12/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/12/openmp/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , llvm_meta
 , fetch
+, fetchpatch
 , cmake
 , llvm
 , targetLlvm
@@ -15,6 +16,16 @@ stdenv.mkDerivation rec {
 
   src = fetch pname "14dh0r6h2xh747ffgnsl4z08h0ri04azi9vf79cbz7ma1r27kzk0";
 
+  patches = [
+    # Fix cross.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5e2358c781b85a18d1463fd924d2741d4ae5e42e.patch";
+      hash = "sha256-UxIlAifXnexF/MaraPW0Ut6q+sf3e7y1fMdEv1q103A=";
+    })
+  ];
+
+  patchFlags = [ "-p2" ];
+
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [
     (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
diff --git a/pkgs/development/compilers/llvm/13/openmp/default.nix b/pkgs/development/compilers/llvm/13/openmp/default.nix
index 8eca980d601c..7b461df438f9 100644
--- a/pkgs/development/compilers/llvm/13/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/13/openmp/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , llvm_meta
 , src
+, fetchpatch
 , cmake
 , llvm
 , targetLlvm
@@ -16,6 +17,16 @@ stdenv.mkDerivation rec {
   inherit src;
   sourceRoot = "${src.name}/${pname}";
 
+  patches = [
+    # Fix cross.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5e2358c781b85a18d1463fd924d2741d4ae5e42e.patch";
+      hash = "sha256-UxIlAifXnexF/MaraPW0Ut6q+sf3e7y1fMdEv1q103A=";
+    })
+  ];
+
+  patchFlags = [ "-p2" ];
+
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [
     (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
diff --git a/pkgs/development/coq-modules/VST/default.nix b/pkgs/development/coq-modules/VST/default.nix
index 72d88dec6f1d..150148cfe00d 100644
--- a/pkgs/development/coq-modules/VST/default.nix
+++ b/pkgs/development/coq-modules/VST/default.nix
@@ -23,11 +23,12 @@ mkCoqDerivation {
   repo = "VST";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.15" "8.16"; out = "2.11.1"; }
+    { case = range "8.15" "8.17"; out = "2.12"; }
     { case = range "8.14" "8.16"; out = "2.10"; }
     { case = range "8.13" "8.15"; out = "2.9"; }
     { case = range "8.12" "8.13"; out = "2.8"; }
   ] null;
+  release."2.12".sha256 = "sha256-4HL0U4HA5/usKNXC0Dis1UZY/Hb/LRd2IGOrqrvdWkw=";
   release."2.11.1".sha256 = "sha256-unpNstZBnRT4dIqAYOv9n1J0tWJMeRuaaa2RG1U0Xs0=";
   release."2.10".sha256 = "sha256-RIxfPWoHnV1CFkpxCusoGY/LIk07TgC7wWGRP4BSq8w=";
   release."2.9".sha256 = "sha256:1adwzbl1pprrrwrm7cm493098fizxanxpv7nyfbvwdhgbhcnv6qf";
@@ -39,7 +40,7 @@ mkCoqDerivation {
   preConfigure = ''
     patchShebangs util
     substituteInPlace Makefile \
-      --replace 'COQVERSION= ' 'COQVERSION= 8.16.1 or-else 8.16.0 or-else 8.15.2 or-else 8.15.1 or-else '\
+      --replace 'COQVERSION= ' 'COQVERSION= 8.17.1 or-else 8.16.1 or-else 8.16.0 or-else 8.15.2 or-else 8.15.1 or-else '\
       --replace 'FLOYD_FILES=' 'FLOYD_FILES= ${toString extra_floyd_files}'
   '';
 
diff --git a/pkgs/development/libraries/gspell/default.nix b/pkgs/development/libraries/gspell/default.nix
index fa7eb93fe0c6..c4d15352020a 100644
--- a/pkgs/development/libraries/gspell/default.nix
+++ b/pkgs/development/libraries/gspell/default.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gtk3
     icu
+    vala # for share/vala/Makefile.vapigen (PKG_CONFIG_VAPIGEN_VAPIGEN)
   ];
 
   propagatedBuildInputs = [
@@ -56,6 +57,9 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "GLIB_COMPILE_RESOURCES=${lib.getDev buildPackages.glib}/bin/glib-compile-resources"
     "GLIB_MKENUMS=${lib.getDev buildPackages.glib}/bin/glib-mkenums"
+    "PKG_CONFIG_VAPIGEN_VAPIGEN=${lib.getBin buildPackages.vala}/bin/vapigen"
+    "--enable-introspection=yes"
+    "--enable-vala=yes"
   ];
 
   passthru = {
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index 7fd4572e0b7c..b88daae22db8 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -5,6 +5,7 @@
 , meson
 , ninja
 , pkg-config
+, substituteAll
 , gettext
 , dbus
 , glib
@@ -53,12 +54,9 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Hardcode the ssh path again.
-    # https://gitlab.gnome.org/GNOME/gvfs/-/issues/465
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gvfs/-/commit/8327383e262e1e7f32750a8a2d3dd708195b0f53.patch";
-      hash = "sha256-ReD7qkezGeiJHyo9jTqEQNBjECqGhV9nSD+dYYGZWJ8=";
-      revert = true;
+    (substituteAll {
+      src = ./hardcode-ssh-path.patch;
+      ssh_program = "${lib.getBin openssh}/bin/ssh";
     })
   ];
 
@@ -76,7 +74,6 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     wrapGAppsHook
-    libxml2
     libxslt
     docbook_xsl
     docbook_xml_dtd_42
@@ -92,7 +89,7 @@ stdenv.mkDerivation rec {
     libimobiledevice
     libbluray
     libnfs
-    openssh
+    libxml2
     gsettings-desktop-schemas
     libsoup_3
   ] ++ lib.optionals udevSupport [
diff --git a/pkgs/development/libraries/gvfs/hardcode-ssh-path.patch b/pkgs/development/libraries/gvfs/hardcode-ssh-path.patch
new file mode 100644
index 000000000000..aaf8e291aa8b
--- /dev/null
+++ b/pkgs/development/libraries/gvfs/hardcode-ssh-path.patch
@@ -0,0 +1,13 @@
+diff --git a/daemon/meson.build b/daemon/meson.build
+index 72a16890..718944e1 100644
+--- a/daemon/meson.build
++++ b/daemon/meson.build
+@@ -256,7 +256,7 @@ if enable_sftp
+     '-DDEFAULT_BACKEND_TYPE=sftp',
+     '-DBACKEND_TYPES="sftp", G_VFS_TYPE_BACKEND_SFTP,',
+     '-DMAX_JOB_THREADS=1',
+-    '-DSSH_PROGRAM="ssh"',
++    '-DSSH_PROGRAM="@ssh_program@"',
+   ]
+
+   programs += {'gvfsd-sftp': {'sources': sources, 'dependencies': deps, 'c_args': cflags}}
diff --git a/pkgs/development/libraries/lief/default.nix b/pkgs/development/libraries/lief/default.nix
index 44f82f15852a..4b691ba3d888 100644
--- a/pkgs/development/libraries/lief/default.nix
+++ b/pkgs/development/libraries/lief/default.nix
@@ -33,14 +33,16 @@ stdenv.mkDerivation rec {
     python
   ];
 
+  env.CXXFLAGS = toString (lib.optional stdenv.isDarwin [ "-faligned-allocation" "-fno-aligned-new" "-fvisibility=hidden" ]);
+
   postBuild = ''
-    pushd /build/source/api/python
+    pushd ../api/python
     ${pyEnv.interpreter} setup.py build --parallel=$NIX_BUILD_CORES
     popd
   '';
 
   postInstall = ''
-    pushd /build/source/api/python
+    pushd ../api/python
     ${pyEnv.interpreter} setup.py install --skip-build --root=/ --prefix=$py
     popd
   '';
diff --git a/pkgs/development/libraries/mvapich/default.nix b/pkgs/development/libraries/mvapich/default.nix
index 9c5046415e64..2182c4083376 100644
--- a/pkgs/development/libraries/mvapich/default.nix
+++ b/pkgs/development/libraries/mvapich/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     "FFLAGS=-fallow-argument-mismatch" # fix build with gfortran 10
   ] ++ optional useSlurm "--with-pm=slurm"
     ++ optional (network == "ethernet") "--with-device=ch3:sock"
-    ++ optionals (network == "infiniband") [ "--with-device=ch3:mrail" "--with-rdma=gen2" ]
+    ++ optionals (network == "infiniband") [ "--with-device=ch3:mrail" "--with-rdma=gen2" "--disable-ibv-dlopen" ]
     ++ optionals (network == "omnipath") ["--with-device=ch3:psm" "--with-psm2=${libpsm2}"];
 
   doCheck = true;
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     # /tmp/nix-build... ends up in the RPATH, fix it manually
     for entry in $out/bin/mpichversion $out/bin/mpivars; do
       echo "fix rpath: $entry"
-      patchelf --set-rpath "$out/lib" $entry
+      patchelf --allowed-rpath-prefixes ${builtins.storeDir} --shrink-rpath $entry
     done
 
     # Ensure the default compilers are the ones mvapich was built with
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index a62031c079d9..4b301548b43c 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lZJLYIZ44FXGavDCrO90DYSl4yaNDpAYeIIihk5Bk14=";
+    hash = "sha256-k3CX0ntqbKBL9xLTPifwjTqwYEDLlNdEHlIPiokkkPA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioelectricitymaps/default.nix b/pkgs/development/python-modules/aioelectricitymaps/default.nix
index 502363de13c3..8aca66a80b4c 100644
--- a/pkgs/development/python-modules/aioelectricitymaps/default.nix
+++ b/pkgs/development/python-modules/aioelectricitymaps/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aioelectricitymaps";
-  version = "0.1.3";
+  version = "0.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "jpbede";
     repo = "aioelectricitymaps";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2Ou3obpGRJ/iUPuaoBGlmDTJLx6+S8ivK9PbrbSvYyg=";
+    hash = "sha256-Whg3F4Oyfqn2Lod44e15Pxc3m0dEB2F+MK0bvEM7c7w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index de5d1184b2b7..ca577acc2834 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "18.2.0";
+  version = "18.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-uOF9VSASzGA4pVW3puQtGrr2dy7sRESa1a6DPUsMmL4=";
+    hash = "sha256-PW3/V4PTm+UxTsfSSvOEX+FGcuF4m+mDOz6Z/AzB2qk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index a4bd117d8e67..5b142f2be1ea 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8t7S+VR9AqYpaAP772Wn1foVy/XN9MiEUZb5+u47G+k=";
+    hash = "sha256-tDOO0wn5gYxK1CuMWhu/i4Xk3CfcuhPvxsG0LI7BlA4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 1e059d7c82bc..14fea5e4835a 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-n/51N1D5UI2FTKv7GBN/iPYE/+/o/2JnFTRee+1FVWg=";
+    hash = "sha256-t8kxGwLEVVp1WMFA+yFLMAPJBT46m0ZFG2lhWMxoolw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/asana/default.nix b/pkgs/development/python-modules/asana/default.nix
index f3b6787dd66b..87a996a45523 100644
--- a/pkgs/development/python-modules/asana/default.nix
+++ b/pkgs/development/python-modules/asana/default.nix
@@ -6,6 +6,7 @@
 , requests
 , requests-oauthlib
 , responses
+, six
 }:
 
 buildPythonPackage rec {
@@ -25,6 +26,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     requests
     requests-oauthlib
+    six
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 14e6cbd811fa..8907b8b8ac26 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TNnv2V8QtSA5oiCHVqIuvbgGNTjfIw4WS1K2MxXfJIw=";
+    hash = "sha256-ErPk93hDKV1QyGOjxYNaLzNuq6Od374G8qOxWiJwpuo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 6dbaac73b6bd..3f4e7addb778 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,14 +16,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.74";
+  version = "9.2.75";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KaHAgGPspFGFPNULfXcVwXpl5RdkKHAQV/coJeMSGLQ=";
+    hash = "sha256-xiYkXC3/JPgXJ23ISl0LVrdm368hDPCG5NqQM6lDXf4=";
   };
 
 in
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-e13tsrLAZu67eyUvBYtfkBASEsxdcVwJmKCHBiU78Dg=";
+    hash = "sha256-F2kgEffFWK7i1BgU5ulsNJitGcGcEziYRU+y86wKgXU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index 0966ba8ae28c..36e7a2744685 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -9,18 +9,19 @@
 , fastavro
 , importlib-metadata
 , requests
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "4.26.1";
+  version = "4.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kiU5VooOWhqnjdhSHAIGV+D4pm9Qupz2oo0TZz9ASY8=";
+    hash = "sha256-OAd0e+mE8hHc6RHBM1vXE68qwrcPcpZ4OB5v9uRQ5oE=";
   };
 
   patches = [
@@ -42,6 +43,7 @@ buildPythonPackage rec {
     fastavro
     importlib-metadata
     requests
+    urllib3
   ];
 
   # tests require CO_API_KEY
diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index d3fc32ab01d9..a7fbfd1b3783 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , numpy
 , packaging
 , pandas
@@ -23,6 +24,21 @@ buildPythonPackage rec {
     hash = "sha256-OAVHx/a4uupVGXSWN2/3uem9/4i+TUkzTX4kp0uLY44=";
   };
 
+  patches = [
+    # on master branch, to be released as 1.1.2
+    (fetchpatch {
+      name = "xfail-tests-that-are-known-to-fail.patch";
+      url = "https://github.com/googleapis/python-db-dtypes-pandas/commit/4a56b766b0ccba900a555167863f1081a76c4c0d.patch";
+      hash = "sha256-ra1d8Vewvwhkr7PBHc3KM6IUCWsHxE+B7UP2duTgjew=";
+    })
+    # on master branch, to be released as 1.1.2
+    (fetchpatch {
+      name = "add-import-and-object-reference-due-to-upstream-changes.patch";
+      url = "https://github.com/googleapis/python-db-dtypes-pandas/commit/8a7b25f3e708df5cd32afcb702fe16130846b165.patch";
+      hash = "sha256-JVbhiOIr5gKMSQpIQ+DgIRqq8V5x5ClQhkQzAmIYqEU=";
+    })
+  ];
+
   propagatedBuildInputs = [
     numpy
     packaging
diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index 6990105b757e..bab6cd3f6c7b 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -3,7 +3,7 @@
 , chardet
 , fetchPypi
 , jinja2
-, jinja2_pluralize
+, jinja2-pluralize
 , pluggy
 , pycodestyle
 , pyflakes
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     chardet
     jinja2
-    jinja2_pluralize
+    jinja2-pluralize
     pluggy
     pygments
     tomli
diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index 0dcee5eea4eb..bc5ab67b018c 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-translate";
-  version = "3.12.0";
+  version = "3.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-l0I8HDv2FBAvHUJ4F1oDxSPltKzWSLAKNAfQIwKqzNk=";
+    hash = "sha256-Zhy4h5qjxjovclo+po+QGZvTVMlcoWnMLoOlEFmH0p4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jinja2_pluralize/default.nix b/pkgs/development/python-modules/jinja2-pluralize/default.nix
similarity index 51%
rename from pkgs/development/python-modules/jinja2_pluralize/default.nix
rename to pkgs/development/python-modules/jinja2-pluralize/default.nix
index db196403822a..2187c1a24147 100644
--- a/pkgs/development/python-modules/jinja2_pluralize/default.nix
+++ b/pkgs/development/python-modules/jinja2-pluralize/default.nix
@@ -1,12 +1,19 @@
-{ lib, buildPythonPackage, fetchPypi, jinja2, inflect }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, jinja2
+, inflect
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
-  pname = "jinja2_pluralize";
+  pname = "jinja2-pluralize";
   version = "0.3.0";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "071wnzzz20wjb0iw7grxgj1lb2f0kz50qyfbcq54rddr2x82sp6z";
+    pname = "jinja2_pluralize";
+    inherit version;
+    hash = "sha256-31wtUBe5tUwKZst5DMqfwIlFg3w9v8MjWJID8f+3PBw=";
   };
 
   propagatedBuildInputs = [
@@ -14,6 +21,14 @@ buildPythonPackage rec {
     inflect
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "jinja2_pluralize"
+  ];
+
   meta = with lib; {
     description = "Jinja2 pluralize filters";
     homepage = "https://github.com/audreyr/jinja2_pluralize";
diff --git a/pkgs/development/python-modules/localstack/default.nix b/pkgs/development/python-modules/localstack/default.nix
index e44f6e609d21..03af7530a26b 100644
--- a/pkgs/development/python-modules/localstack/default.nix
+++ b/pkgs/development/python-modules/localstack/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "localstack";
-  version = "2.3.0";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "localstack";
     repo = "localstack";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Sdyl/ccyhKRP5eb866ly1ZJrrFSQMLdX22R7UNRfDCA=";
+    hash = "sha256-8HrPnMmzoxgAhu3Qm18FBJ3kNoGOD7bGmI1t7tcETwM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index b41e21c83e0c..63a5a15e2593 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.3.6";
+  version = "0.3.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     rev = "refs/tags/${version}";
-    hash = "sha256-s5+hfn/NfuL7B5c1LElZ10B+O5xr98D0eBYfLhPt6uU=";
+    hash = "sha256-iiGxAIHZcq3VaSSmGrB16IutJf8JEAeFkvZsEuIbR3g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index 62af8da7eb62..150b323d0f29 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     rev = "refs/tags/${version}";
-    hash = "sha256-xXVur2ibctRCfQ1zKnPeLrNoukTmFT8exTbm2ukByYY=";
+    hash = "sha256-+UWHYhPX54Jc9gnrb2Az5Nc3/kt42/wa+zhUnCWdVU4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/praw/default.nix b/pkgs/development/python-modules/praw/default.nix
index 0ce6027c1bfe..0243ef1bd1b4 100644
--- a/pkgs/development/python-modules/praw/default.nix
+++ b/pkgs/development/python-modules/praw/default.nix
@@ -42,6 +42,11 @@ buildPythonPackage rec {
     requests-toolbelt
   ];
 
+  disabledTestPaths = [
+    # tests requiring network
+    "tests/integration"
+  ];
+
   pythonImportsCheck = [
     "praw"
   ];
diff --git a/pkgs/development/python-modules/prawcore/default.nix b/pkgs/development/python-modules/prawcore/default.nix
index 9a8ecea7b3c2..6231ff2b8127 100644
--- a/pkgs/development/python-modules/prawcore/default.nix
+++ b/pkgs/development/python-modules/prawcore/default.nix
@@ -45,6 +45,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTestPaths = [
+    # tests requiring network
+    "tests/integration"
+  ];
+
   pythonImportsCheck = [
     "prawcore"
   ];
diff --git a/pkgs/development/python-modules/pyftpdlib/default.nix b/pkgs/development/python-modules/pyftpdlib/default.nix
index f40dc187124c..2ada48a2be0d 100644
--- a/pkgs/development/python-modules/pyftpdlib/default.nix
+++ b/pkgs/development/python-modules/pyftpdlib/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyftpdlib";
-  version = "1.5.8";
+  version = "1.5.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v22rtn3/MrP/BA4oJf/7xrjecDc7ydm1U0gMxNdQTWw=";
+    hash = "sha256-Mj1MQvFAau203xj69oD2TzLAgP9m9sJgkLpZL1v8Sg8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index db2d65450f8e..c19e16cae96e 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-49Vcm6JkIpOm+U1Q/BrTi8jiEWZdaNs77TaCMjOLpyw=";
+    hash = "sha256-8P8xOb4P1JsbPZya8s1Bl16VsYtHQdAD05sc8EAcEpM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index 93492852d02d..f773c33307ae 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.7.11";
+  version = "0.7.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     rev = "refs/tags/${version}";
-    hash = "sha256-SPmLzTJQNDaQ6AofIET7eZkxJxxfJ00/wNpInXo0u2I=";
+    hash = "sha256-molHdZ51irWEE3OHywP5n0bCClK8z67JGiYRwvHAOxs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 031c44ebb2e3..83980ecdcd0a 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.6.2";
+  version = "0.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-Z3vFQB6/z3dWtYikN02QviG+0aDRzt8kk6IOpl/VmF0=";
+    hash = "sha256-3pcQsSUBHlgHKuZt5kb4ozvIujP6dsaYMab/+fri4a4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlite-migrate/default.nix b/pkgs/development/python-modules/sqlite-migrate/default.nix
new file mode 100644
index 000000000000..b19d3e590f52
--- /dev/null
+++ b/pkgs/development/python-modules/sqlite-migrate/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, sqlite-utils
+}:
+
+buildPythonPackage rec {
+  pname = "sqlite-migrate";
+  version = "0.1a2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-wztAqe3TW0SQ4JX1XPWeA4KNJci5c3fNih97cmlPwRE=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    sqlite-utils
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sqlite_migrate"
+  ];
+
+  meta = with lib; {
+    description = "A simple database migration system for SQLite, based on sqlite-utils";
+    homepage = "https://github.com/simonw/sqlite-migrate";
+    changelog = "https://github.com/simonw/sqlite-migrate/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ aldoborrero ];
+  };
+}
diff --git a/pkgs/development/python-modules/yattag/default.nix b/pkgs/development/python-modules/yattag/default.nix
index 9fd5e993ec98..c66f85cc1583 100644
--- a/pkgs/development/python-modules/yattag/default.nix
+++ b/pkgs/development/python-modules/yattag/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "yattag";
-  version = "1.15.1";
+  version = "1.15.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lg+lS+EinZb0MXgTPgsZXAAzkf3Ens22tptzdNtr5BY=";
+    hash = "sha256-qtn1QL0i3FA+W1UGzEeFb6zwgapx/TX3JzcbY+HkAr8=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/os-specific/linux/nct6687d/default.nix b/pkgs/os-specific/linux/nct6687d/default.nix
new file mode 100644
index 000000000000..493d0e6af101
--- /dev/null
+++ b/pkgs/os-specific/linux/nct6687d/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nct6687d";
+  version = "unstable-2023-09-22";
+
+  src = fetchFromGitHub {
+    owner = "Fred78290";
+    repo = "nct6687d";
+    rev = "cdfe855342a9383a9c4c918d51576c36d989070d";
+    hash = "sha256-iOLWxj4I6oYkNXFSkmw7meTQEnrIfb4Mw+/LkzgzDxM=";
+  };
+
+  setSourceRoot = ''
+    export sourceRoot=$(pwd)/source
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "-C" "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(sourceRoot)"
+  ];
+
+  buildFlags = [ "modules" ];
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = with lib; {
+    description = "Kernel module for the Nuvoton NCT6687-R chipset found on many B550/B650 motherboards from ASUS and MSI";
+    license = with licenses; [ gpl2Only ];
+    homepage = "https://github.com/Fred78290/nct6687d/";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ atemu ];
+  };
+}
diff --git a/pkgs/tools/filesystems/9pfs/default.nix b/pkgs/tools/filesystems/9pfs/default.nix
index abb8f695ebcc..7b652bd68aa0 100644
--- a/pkgs/tools/filesystems/9pfs/default.nix
+++ b/pkgs/tools/filesystems/9pfs/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ywWG/H2ilt36mjlDSgIzYpardCFXpmbLiml6wy47XuA=";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile --replace "pkg-config" "$PKG_CONFIG"
+  '';
+
   makeFlags = [ "BIN=$(out)/bin" "MAN=$(out)/share/man/man1" ];
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ fuse ];
diff --git a/pkgs/tools/filesystems/duperemove/default.nix b/pkgs/tools/filesystems/duperemove/default.nix
index f32d026ac1cf..b13f216b8dbf 100644
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -1,6 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, libgcrypt
-, pkg-config, glib, linuxHeaders ? stdenv.cc.libc.linuxHeaders, sqlite
-, util-linux, testers, duperemove }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch2
+, libgcrypt
+, pkg-config
+, glib
+, linuxHeaders ? stdenv.cc.libc.linuxHeaders
+, sqlite
+, util-linux
+, testers
+, duperemove
+}:
 
 stdenv.mkDerivation rec {
   pname = "duperemove";
@@ -13,6 +23,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-D3+p8XgokKIHEwZnvOkn7cionVH1gsypcURF+PBpugY=";
   };
 
+  patches = [
+    # Use variable instead of hardcoding pkg-config
+    # https://github.com/markfasheh/duperemove/pull/315
+    (fetchpatch2 {
+      url = "https://github.com/markfasheh/duperemove/commit/0e1c62d79a9a79d7bb3e80f1bd528dbf7cb75e22.patch";
+      hash = "sha256-YMMu6LCkBlipEJALukQMwIMcjQEAG5pjGEGeTW9OEJk=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace util.c --replace \
       "lscpu" "${lib.getBin util-linux}/bin/lscpu"
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index b41dd7616619..52b50b7cbb41 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -13,13 +13,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.24.2";
+  version = "2.24.4";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-h/8fFo7X5p6loDKxcPjOYWg1P0m0tVqR2IX/QSfvrzQ=";
+    hash = "sha256-f/KtHm8R1MJORWKmv487hm80MeX2l0Ybd1ZjKHGFq0A=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook gobject-introspection ];
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index 39790d653813..de0fd1a11559 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.26.1";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IqDcE6P4DSH/A4TKzPoLZsO00t0zGPCutM0yVI41nrM=";
+    hash = "sha256-yZsb/G+8XoJS4Fg6WFuEk1v3Ht5i3G3p+sKi+Z3jeGU=";
   };
 
-  cargoHash = "sha256-Lo/O/q2kGioWxkRJ/c9jWAHSm2Y839RsK4NM4qP576c=";
+  cargoHash = "sha256-xHmrFIXXkuhYGApgNoJxcL1Kpf8ellwQgiH8AEZvDRU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index 2188cf99a3c9..3f0daa8d945c 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clamav";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/${pname}-${version}.tar.gz";
-    hash = "sha256-l6GS3/4UFIC1bKvxBj15qfxVzVkgMkH6Qb/HqYpUgCA=";
+    hash = "sha256-mhT+hwy7j1959mi3idyg8lzGviKr4y9PfTZ35O45NbA=";
   };
 
   patches = [
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 4212d86afb98..7ffb834279ce 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-10-26";
+  version = "2023-11-01";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-P+T3TM2MeHaN+ApgOMEFmyWv+AzQshVUfhbI+n/vozs=";
+    hash = "sha256-nejoCvmhxkCkF1UpRTHioP2g0jaegNpAzAZbX9s/6cE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index dfa556b29485..424f5811a486 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.62.0";
+  version = "3.62.1";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lG3gU5cDbrvYejLC4YFAHwBne7OicGCY5XPJtte7rGo=";
+    hash = "sha256-dDz8czTYRxmhyFaYuSoqnBwT7lMZDENBuH+F0HpaouE=";
   };
 
-  vendorHash = "sha256-jdJ0Avh1wNisO6f3qvUV1rNX5nKnmP7EHVTL79sE4A0=";
+  vendorHash = "sha256-+Boe/bzCsmihspGqmiJ3jOcRJ9KPjkzu6MBmgtAgwjE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/wayland/sov/default.nix b/pkgs/tools/wayland/sov/default.nix
index 31451d82d4b5..c8ddc6524f28 100644
--- a/pkgs/tools/wayland/sov/default.nix
+++ b/pkgs/tools/wayland/sov/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , meson
 , ninja
 , pkg-config
@@ -23,13 +24,28 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-1L5D0pzcXbkz3VS7VB6ID8BJEbGeNxjo3xCr71CGcIo=";
   };
 
+  patches = [
+    # mark wayland-scanner as build-time dependency
+    # https://github.com/milgra/sov/pull/45
+    (fetchpatch2 {
+      url = "https://github.com/milgra/sov/commit/8677dcfc47e440157388a8f15bdda9419d84db04.patch";
+      hash = "sha256-P1k1zosHcVO7hyhD1JWbj07h7pQ7ybgDHfoufBinEys=";
+    })
+  ];
+
   strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     wayland-scanner
   ];
+
   buildInputs = [
     freetype
     libglvnd
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5acdcb72b0a9..c55a0ea582a6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22460,6 +22460,10 @@ with pkgs;
 
   libarchive-qt = libsForQt5.callPackage ../development/libraries/libarchive-qt { };
 
+  libaribcaption = callPackage ../by-name/li/libaribcaption/package.nix {
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices CoreFoundation CoreGraphics CoreText;
+  };
+
   libasn1c = callPackage ../servers/osmocom/libasn1c/default.nix { };
 
   libasr = callPackage ../development/libraries/libasr { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 078bbb80942a..5ca5e3867d5c 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -125,7 +125,13 @@ let
       Verdi = callPackage ../development/coq-modules/Verdi {};
       VST = callPackage ../development/coq-modules/VST ((lib.optionalAttrs
         (lib.versionAtLeast self.coq.version "8.14") {
-          compcert = self.compcert.override { version = "3.11"; };
+          compcert = self.compcert.override {
+            version = with lib.versions; lib.switch self.coq.version [
+              { case = isEq "8.17"; out = "3.13"; }
+              { case = range "8.15" "8.16"; out = "3.12"; }
+              { case = isEq "8.14"; out = "3.11"; }
+            ] null;
+          };
         }) // (lib.optionalAttrs (lib.versions.isEq self.coq.coq-version "8.13") {
           ITree = self.ITree.override {
             version = "4.0.0";
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index e3ced10620b7..1666964ca63e 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -387,6 +387,8 @@ in {
 
     mbp2018-bridge-drv = callPackage ../os-specific/linux/mbp-modules/mbp2018-bridge-drv { };
 
+    nct6687d = callPackage ../os-specific/linux/nct6687d { };
+
     new-lg4ff = callPackage ../os-specific/linux/new-lg4ff { };
 
     nvidiabl = callPackage ../os-specific/linux/nvidiabl { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index d6c794de8b5b..3b71e907a66d 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -203,6 +203,7 @@ mapAliases ({
   jaraco_text = jaraco-text; # added 2023-07-14
   jaraco_stream = jaraco-stream; # added 2023-07-14
   JayDeBeApi = jaydebeapi; # added 2023-02-19
+  jinja2_pluralize = jinja2-pluralize; # added 2023-11-01
   jinja2_time = jinja2-time; # added 2022-11-07
   JPype1 = jpype1; # added 2023-02-19
   jsonschema_3 = throw "jsonschema 3 is neither the latest version nor needed inside nixpkgs anymore"; # added 2023-06-28
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fe2c5b56fe3e..a0cc58529fb5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5637,7 +5637,7 @@ self: super: with self; {
 
   jinja2-git = callPackage ../development/python-modules/jinja2-git { };
 
-  jinja2_pluralize = callPackage ../development/python-modules/jinja2_pluralize { };
+  jinja2-pluralize = callPackage ../development/python-modules/jinja2-pluralize { };
 
   jinja2-time = callPackage ../development/python-modules/jinja2-time { };
 
@@ -13330,6 +13330,8 @@ self: super: with self; {
 
   sqlitedict = callPackage ../development/python-modules/sqlitedict { };
 
+  sqlite-migrate = callPackage ../development/python-modules/sqlite-migrate { };
+
   sqlite-fts4 = callPackage ../development/python-modules/sqlite-fts4 { };
 
   sqlite-utils = callPackage ../development/python-modules/sqlite-utils { };