diff --git a/doc/build-helpers/images/appimagetools.section.md b/doc/build-helpers/images/appimagetools.section.md
index 0c72315a26e8..4d00e49c397d 100644
--- a/doc/build-helpers/images/appimagetools.section.md
+++ b/doc/build-helpers/images/appimagetools.section.md
@@ -1,48 +1,167 @@
 # pkgs.appimageTools {#sec-pkgs-appimageTools}
 
-`pkgs.appimageTools` is a set of functions for extracting and wrapping [AppImage](https://appimage.org/) files. They are meant to be used if traditional packaging from source is infeasible, or it would take too long. To quickly run an AppImage file, `pkgs.appimage-run` can be used as well.
+`pkgs.appimageTools` is a set of functions for extracting and wrapping [AppImage](https://appimage.org/) files.
+They are meant to be used if traditional packaging from source is infeasible, or if it would take too long.
+To quickly run an AppImage file, `pkgs.appimage-run` can be used as well.
 
 ::: {.warning}
 The `appimageTools` API is unstable and may be subject to backwards-incompatible changes in the future.
 :::
 
-## AppImage formats {#ssec-pkgs-appimageTools-formats}
-
-There are different formats for AppImages, see [the specification](https://github.com/AppImage/AppImageSpec/blob/74ad9ca2f94bf864a4a0dac1f369dd4f00bd1c28/draft.md#image-format) for details.
-
-- Type 1 images are ISO 9660 files that are also ELF executables.
-- Type 2 images are ELF executables with an appended filesystem.
-
-They can be told apart with `file -k`:
-
-```ShellSession
-$ file -k type1.AppImage
-type1.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) ISO 9660 CD-ROM filesystem data 'AppImage' (Lepton 3.x), scale 0-0,
-spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000, dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=d629f6099d2344ad82818172add1d38c5e11bc6d, stripped\012- data
-
-$ file -k type2.AppImage
-type2.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) (Lepton 3.x), scale 232-60668, spot sensor temperature -4.187500, color scheme 15, show scale bar, calibration: offset -0.000000, slope 0.000000 (Lepton 2.x), scale 4111-45000, spot sensor temperature 412442.250000, color scheme 3, minimum point enabled, calibration: offset -75402534979642766821519867692934234112.000000, slope 5815371847733706829839455140374904832.000000, dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=79dcc4e55a61c293c5e19edbd8d65b202842579f, stripped\012- data
-```
-
-Note how the type 1 AppImage is described as an `ISO 9660 CD-ROM filesystem`, and the type 2 AppImage is not.
-
 ## Wrapping {#ssec-pkgs-appimageTools-wrapping}
 
-Depending on the type of AppImage you're wrapping, you'll have to use `wrapType1` or `wrapType2`.
+Use `wrapType2` to wrap any AppImage.
+This will create a FHS environment with many packages [expected to exist](https://github.com/AppImage/pkg2appimage/blob/master/excludelist) for the AppImage to work.
+`wrapType2` expects an argument with the `src` attribute, and either a `name` attribute or `pname` and `version` attributes.
+
+It will eventually call into [`buildFHSEnv`](#sec-fhs-environments), and any extra attributes in the argument to `wrapType2` will be passed through to it.
+This means that you can pass the `extraInstallCommands` attribute, for example, and it will have the same effect as described in [`buildFHSEnv`](#sec-fhs-environments).
+
+::: {.note}
+In the past, `appimageTools` provided both `wrapType1` and `wrapType2`, to be used depending on the type of AppImage that was being wrapped.
+However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/81833), meaning that both `wrapType1` and `wrapType2` have the same behaviour now.
+:::
+
+:::{.example #ex-wrapping-appimage-from-github}
+
+# Wrapping an AppImage from GitHub
 
 ```nix
-appimageTools.wrapType2 { # or wrapType1
-  name = "patchwork";
+{ appimageTools, fetchurl }:
+let
+  pname = "nuclear";
+  version = "0.6.30";
+
   src = fetchurl {
-    url = "https://github.com/ssbc/patchwork/releases/download/v3.11.4/Patchwork-3.11.4-linux-x86_64.AppImage";
-    hash = "sha256-OqTitCeZ6xmWbqYTXp8sDrmVgTNjPZNW0hzUPW++mq4=";
+    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${pname}-v${version}.AppImage";
+    hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
   };
-  extraPkgs = pkgs: with pkgs; [ ];
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
 }
 ```
 
-- `name` specifies the name of the resulting image.
-- `src` specifies the AppImage file to extract.
-- `extraPkgs` allows you to pass a function to include additional packages inside the FHS environment your AppImage is going to run in. There are a few ways to learn which dependencies an application needs:
-  - Looking through the extracted AppImage files, reading its scripts and running `patchelf` and `ldd` on its executables. This can also be done in `appimage-run`, by setting `APPIMAGE_DEBUG_EXEC=bash`.
+:::
+
+The argument passed to `wrapType2` can also contain an `extraPkgs` attribute, which allows you to include additional packages inside the FHS environment your AppImage is going to run in.
+`extraPkgs` must be a function that returns a list of packages.
+There are a few ways to learn which dependencies an application needs:
+
+  - Looking through the extracted AppImage files, reading its scripts and running `patchelf` and `ldd` on its executables.
+    This can also be done in `appimage-run`, by setting `APPIMAGE_DEBUG_EXEC=bash`.
   - Running `strace -vfefile` on the wrapped executable, looking for libraries that can't be found.
+
+:::{.example #ex-wrapping-appimage-with-extrapkgs}
+
+# Wrapping an AppImage with extra packages
+
+```nix
+{ appimageTools, fetchurl }:
+let
+  pname = "irccloud";
+  version = "0.16.0";
+
+  src = fetchurl {
+    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+  };
+in appimageTools.wrapType2 {
+  inherit pname version src;
+  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
+}
+```
+
+:::
+
+## Extracting {#ssec-pkgs-appimageTools-extracting}
+
+Use `extract` if you need to extract the contents of an AppImage.
+This is usually used in Nixpkgs to install extra files in addition to [wrapping](#ssec-pkgs-appimageTools-wrapping) the AppImage.
+`extract` expects an argument with the `src` attribute, and either a `name` attribute or `pname` and `version` attributes.
+
+::: {.note}
+In the past, `appimageTools` provided both `extractType1` and `extractType2`, to be used depending on the type of AppImage that was being extracted.
+However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/81572), meaning that both `extractType1` and `extractType2` have the same behaviour as `extract` now.
+:::
+
+:::{.example #ex-extracting-appimage}
+
+# Extracting an AppImage to install extra files
+
+This example was adapted from a real package in Nixpkgs to show how `extract` is usually used in combination with `wrapType2`.
+Note how `appimageContents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
+
+```nix
+{ appimageTools, fetchurl }:
+let
+  pname = "irccloud";
+  version = "0.16.0";
+
+  src = fetchurl {
+    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
+  };
+in appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+      $out/share/icons/hicolor/512x512/apps/irccloud.png
+    substituteInPlace $out/share/applications/irccloud.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';
+}
+```
+
+:::
+
+The argument passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
+`postExtract` must be a string with commands to run.
+
+:::{.example #ex-extracting-appimage-with-postextract}
+
+# Extracting an AppImage to install extra files, using `postExtract`
+
+This is a rewrite of [](#ex-extracting-appimage) to use `postExtract`.
+
+```nix
+{ appimageTools, fetchurl }:
+let
+  pname = "irccloud";
+  version = "0.16.0";
+
+  src = fetchurl {
+    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
+    postExtract = ''
+      substituteInPlace $out/irccloud.desktop --replace 'Exec=AppRun' 'Exec=${pname}'
+    '';
+  };
+in appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+      $out/share/icons/hicolor/512x512/apps/irccloud.png
+  '';
+}
+```
+
+:::
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index fd6ec3c35577..ba2f0ecb51b5 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -41,6 +41,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `k9s` was updated to v0.29. There have been breaking changes in the config file format, check out the [changelog](https://github.com/derailed/k9s/releases/tag/v0.29.0) for details.
 
+- `idris2` was updated to v0.7.0. This version introduces breaking changes. Check out the [changelog](https://github.com/idris-lang/Idris2/blob/v0.7.0/CHANGELOG.md#v070) for details.
+
 - `nitter` requires a `guest_accounts.jsonl` to be provided as a path or loaded into the default location at `/var/lib/nitter/guest_accounts.jsonl`. See [Guest Account Branch Deployment](https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment) for details.
 
 - Invidious has changed its default database username from `kemal` to `invidious`. Setups involving an externally provisioned database (i.e. `services.invidious.database.createLocally == false`) should adjust their configuration accordingly. The old `kemal` user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857)
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 7e640353b998..68335257aabe 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1,23 +1,20 @@
 { lib
 , stdenv
-
-  # nixpkgs functions
-, buildGoModule
+, # nixpkgs functions
+  buildGoModule
 , buildVimPlugin
 , fetchFromGitHub
 , fetchFromSourcehut
 , fetchpatch
 , fetchurl
 , substituteAll
-
-  # Language dependencies
-, fetchYarnDeps
+, # Language dependencies
+  fetchYarnDeps
 , mkYarnModules
 , python3
 , rustPlatform
-
-  # Misc dependencies
-, Cocoa
+, # Misc dependencies
+  Cocoa
 , code-minimap
 , dasht
 , deno
@@ -34,7 +31,7 @@
 , languagetool
 , llvmPackages
 , meson
-, nim
+, nim1
 , nodePackages
 , openscad
 , pandoc
@@ -60,50 +57,40 @@
 , xxd
 , zathura
 , zsh
-
-  # command-t dependencies
-, getconf
+, # command-t dependencies
+  getconf
 , ruby
-
-  # cpsm dependencies
-, boost
+, # cpsm dependencies
+  boost
 , cmake
 , icu
 , ncurses
-
-  # LanguageClient-neovim dependencies
-, CoreFoundation
+, # LanguageClient-neovim dependencies
+  CoreFoundation
 , CoreServices
-
-  # nvim-treesitter dependencies
-, callPackage
-
-  # sg.nvim dependencies
-, darwin
-
-  # sved dependencies
-, glib
+, # nvim-treesitter dependencies
+  callPackage
+, # sg.nvim dependencies
+  darwin
+, # sved dependencies
+  glib
 , gobject-introspection
 , wrapGAppsHook
-
-  # sniprun dependencies
-, bashInteractive
+, # sniprun dependencies
+  bashInteractive
 , coreutils
 , curl
 , gnugrep
 , gnused
 , makeWrapper
 , procps
-
-  # sg-nvim dependencies
-, openssl
+, # sg-nvim dependencies
+  openssl
 , pkg-config
-
-  # vim-agda dependencies
-, agda
-
-  # vim-go dependencies
-, asmfmt
+, # vim-agda dependencies
+  agda
+, # vim-go dependencies
+  asmfmt
 , delve
 , errcheck
 , go-motion
@@ -121,16 +108,14 @@
 , iferr
 , impl
 , reftools
-
-# hurl dependencies
-, hurl
-
-  # must be lua51Packages
-, luaPackages
+, # hurl dependencies
+  hurl
+, # must be lua51Packages
+  luaPackages
 , luajitPackages
-}:
-
-self: super: {
+,
+}: self: super:
+{
   alpha-nvim = super.alpha-nvim.overrideAttrs {
     dependencies = [
       self.nvim-web-devicons # required by the startify theme
@@ -179,11 +164,12 @@ self: super: {
   };
 
   chadtree = super.chadtree.overrideAttrs {
-    passthru.python3Dependencies = ps: with ps; [
-      pynvim-pp
-      pyyaml
-      std2
-    ];
+    passthru.python3Dependencies = ps:
+      with ps; [
+        pynvim-pp
+        pyyaml
+        std2
+      ];
 
     # We need some patches so it stops complaining about not being in a venv
     patches = [ ./patches/chadtree/emulate-venv.patch ];
@@ -199,13 +185,16 @@ self: super: {
     # These usually implicitly set by cc-wrapper around clang (pkgs/build-support/cc-wrapper).
     # The linked ruby code shows generates the required '.clang_complete' for cmake based projects
     # https://gist.github.com/Mic92/135e83803ed29162817fce4098dec144
-    preFixup = ''
-      substituteInPlace "$out"/plugin/clang_complete.vim \
-        --replace "let g:clang_library_path = '' + "''" + ''" "let g:clang_library_path='${llvmPackages.libclang.lib}/lib/libclang.so'"
+    preFixup =
+      ''
+        substituteInPlace "$out"/plugin/clang_complete.vim \
+          --replace "let g:clang_library_path = ''
+      + "''"
+      + ''        " "let g:clang_library_path='${llvmPackages.libclang.lib}/lib/libclang.so'"
 
-      substituteInPlace "$out"/plugin/libclang.py \
-        --replace "/usr/lib/clang" "${llvmPackages.clang.cc}/lib/clang"
-    '';
+              substituteInPlace "$out"/plugin/libclang.py \
+                --replace "/usr/lib/clang" "${llvmPackages.clang.cc}/lib/clang"
+      '';
   };
 
   clighter8 = super.clighter8.overrideAttrs {
@@ -374,11 +363,12 @@ self: super: {
   };
 
   coq_nvim = super.coq_nvim.overrideAttrs {
-    passthru.python3Dependencies = ps: with ps; [
-      pynvim-pp
-      pyyaml
-      std2
-    ];
+    passthru.python3Dependencies = ps:
+      with ps; [
+        pynvim-pp
+        pyyaml
+        std2
+      ];
 
     # We need some patches so it stops complaining about not being in a venv
     patches = [ ./patches/coq_nvim/emulate-venv.patch ];
@@ -469,11 +459,14 @@ self: super: {
   };
 
   direnv-vim = super.direnv-vim.overrideAttrs (old: {
-    preFixup = old.preFixup or "" + ''
-      substituteInPlace $out/autoload/direnv.vim \
-        --replace "let s:direnv_cmd = get(g:, 'direnv_cmd', 'direnv')" \
-          "let s:direnv_cmd = get(g:, 'direnv_cmd', '${lib.getBin direnv}/bin/direnv')"
-    '';
+    preFixup =
+      old.preFixup
+        or ""
+      + ''
+        substituteInPlace $out/autoload/direnv.vim \
+          --replace "let s:direnv_cmd = get(g:, 'direnv_cmd', 'direnv')" \
+            "let s:direnv_cmd = get(g:, 'direnv_cmd', '${lib.getBin direnv}/bin/direnv')"
+      '';
   });
 
   executor-nvim = super.executor-nvim.overrideAttrs {
@@ -513,7 +506,7 @@ self: super: {
       };
     in
     super.fruzzy.overrideAttrs (old: {
-      buildInputs = [ nim ];
+      buildInputs = [ nim1 ];
       patches = [
         (substituteAll {
           src = ./patches/fruzzy/get_version.patch;
@@ -544,7 +537,6 @@ self: super: {
   };
 
   fzf-hoogle-vim = super.fzf-hoogle-vim.overrideAttrs {
-
     # add this to your lua config to prevent the plugin from trying to write in the
     # nix store:
     # vim.g.hoogle_fzf_cache_file = vim.fn.stdpath('cache')..'/hoogle_cache.json'
@@ -621,7 +613,6 @@ self: super: {
     # dontUnpack = true;
 
     src = "${hurl.src}/contrib/vim";
-
   };
 
   image-nvim = super.image-nvim.overrideAttrs {
@@ -737,48 +728,51 @@ self: super: {
       rev = "5d916c39c1852e09fcd39eab174b8e5bbdb25f8f";
       sha256 = "10d6dh0czdpgfpzqs5vzxfffkm0460qjzi2mfkacgghqf3iwkbja";
     };
-    passthru.python3Dependencies = ps: with ps; [
-      pynvim
-      jupyter-client
-      ueberzug
-      pillow
-      cairosvg
-      plotly
-      ipykernel
-      pyperclip
-      pnglatex
-    ];
+    passthru.python3Dependencies = ps:
+      with ps; [
+        pynvim
+        jupyter-client
+        ueberzug
+        pillow
+        cairosvg
+        plotly
+        ipykernel
+        pyperclip
+        pnglatex
+      ];
     meta.homepage = "https://github.com/WhiteBlackGoose/magma-nvim-goose/";
   };
 
-  markdown-preview-nvim =  let
-    # We only need its dependencies `node-modules`.
-    nodeDep = mkYarnModules rec {
-      inherit (super.markdown-preview-nvim) pname version;
-      packageJSON = ./markdown-preview-nvim/package.json;
-      yarnLock = "${super.markdown-preview-nvim.src}/yarn.lock";
-      offlineCache = fetchYarnDeps {
-        inherit yarnLock;
-        hash = "sha256-kzc9jm6d9PJ07yiWfIOwqxOTAAydTpaLXVK6sEWM8gg=";
+  markdown-preview-nvim =
+    let
+      # We only need its dependencies `node-modules`.
+      nodeDep = mkYarnModules rec {
+        inherit (super.markdown-preview-nvim) pname version;
+        packageJSON = ./markdown-preview-nvim/package.json;
+        yarnLock = "${super.markdown-preview-nvim.src}/yarn.lock";
+        offlineCache = fetchYarnDeps {
+          inherit yarnLock;
+          hash = "sha256-kzc9jm6d9PJ07yiWfIOwqxOTAAydTpaLXVK6sEWM8gg=";
+        };
       };
-    };
-  in super.markdown-preview-nvim.overrideAttrs {
-    patches = [
-      (substituteAll {
-        src = ./markdown-preview-nvim/fix-node-paths.patch;
-        node = "${nodejs}/bin/node";
-      })
-    ];
-    postInstall = ''
-      ln -s ${nodeDep}/node_modules $out/app
-    '';
+    in
+    super.markdown-preview-nvim.overrideAttrs {
+      patches = [
+        (substituteAll {
+          src = ./markdown-preview-nvim/fix-node-paths.patch;
+          node = "${nodejs}/bin/node";
+        })
+      ];
+      postInstall = ''
+        ln -s ${nodeDep}/node_modules $out/app
+      '';
 
-    nativeBuildInputs = [ nodejs ];
-    doInstallCheck = true;
-    installCheckPhase = ''
-      node $out/app/index.js --version
-    '';
-  };
+      nativeBuildInputs = [ nodejs ];
+      doInstallCheck = true;
+      installCheckPhase = ''
+        node $out/app/index.js --version
+      '';
+    };
 
   mason-lspconfig-nvim = super.mason-lspconfig-nvim.overrideAttrs {
     dependencies = with self; [ mason-nvim nvim-lspconfig ];
@@ -1019,10 +1013,12 @@ self: super: {
 
         nativeBuildInputs = [ pkg-config ];
 
-        buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [
-          darwin.apple_sdk.frameworks.Security
-          darwin.apple_sdk.frameworks.SystemConfiguration
-        ];
+        buildInputs =
+          [ openssl ]
+          ++ lib.optionals stdenv.isDarwin [
+            darwin.apple_sdk.frameworks.Security
+            darwin.apple_sdk.frameworks.SystemConfiguration
+          ];
 
         prePatch = ''
           rm .cargo/config.toml
@@ -1077,7 +1073,7 @@ self: super: {
 
         postInstall = ''
           wrapProgram $out/bin/sniprun \
-            --prefix PATH ${lib.makeBinPath [ bashInteractive coreutils curl gnugrep gnused procps ]}
+            --prefix PATH ${lib.makeBinPath [bashInteractive coreutils curl gnugrep gnused procps]}
         '';
 
         doCheck = false;
@@ -1109,12 +1105,14 @@ self: super: {
   };
 
   sqlite-lua = super.sqlite-lua.overrideAttrs {
-    postPatch = let
-      libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
-    in ''
-      substituteInPlace lua/sqlite/defs.lua \
-        --replace "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or ${lib.escapeShellArg libsqlite}"
-    '';
+    postPatch =
+      let
+        libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
+      in
+      ''
+        substituteInPlace lua/sqlite/defs.lua \
+          --replace "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or ${lib.escapeShellArg libsqlite}"
+      '';
   };
 
   ssr = super.ssr-nvim.overrideAttrs {
@@ -1203,17 +1201,16 @@ self: super: {
     preFixup =
       let
         fzy-lua-native-path = "deps/fzy-lua-native";
-        fzy-lua-native =
-          stdenv.mkDerivation {
-            name = "fzy-lua-native";
-            src = "${old.src}/${fzy-lua-native-path}";
-            # remove pre-compiled binaries
-            preBuild = "rm -rf static/*";
-            installPhase = ''
-              install -Dm 444 -t $out/static static/*
-              install -Dm 444 -t $out/lua lua/*
-            '';
-          };
+        fzy-lua-native = stdenv.mkDerivation {
+          name = "fzy-lua-native";
+          src = "${old.src}/${fzy-lua-native-path}";
+          # remove pre-compiled binaries
+          preBuild = "rm -rf static/*";
+          installPhase = ''
+            install -Dm 444 -t $out/static static/*
+            install -Dm 444 -t $out/lua lua/*
+          '';
+        };
       in
       ''
         rm -rf $target/${fzy-lua-native-path}/*
@@ -1269,7 +1266,7 @@ self: super: {
         cp "${ftdetect}" vim-plugin/ftdetect/tup.vim
         cd vim-plugin
       '';
-      meta.maintainers = with lib.maintainers; [enderger];
+      meta.maintainers = with lib.maintainers; [ enderger ];
     };
 
   typescript-tools-nvim = super.typescript-tools-nvim.overrideAttrs {
@@ -1284,7 +1281,6 @@ self: super: {
       };
     in
     super.unicode-vim.overrideAttrs {
-
       # redirect to /dev/null else changes terminal color
       buildPhase = ''
         cp "${unicode-data}" autoload/unicode/UnicodeData.txt
@@ -1387,9 +1383,11 @@ self: super: {
   # https://github.com/NixOS/nixpkgs/issues/157609
   vim-colorschemes = super.vim-colorschemes.overrideAttrs (old: {
     src = old.src.overrideAttrs (srcOld: {
-      postFetch = (srcOld.postFetch or "") + lib.optionalString (!stdenv.isDarwin) ''
-        rm $out/colors/darkBlue.vim
-      '';
+      postFetch =
+        (srcOld.postFetch or "")
+        + lib.optionalString (!stdenv.isDarwin) ''
+          rm $out/colors/darkBlue.vim
+        '';
     });
   });
 
@@ -1539,11 +1537,14 @@ self: super: {
   };
 
   vim-stylish-haskell = super.vim-stylish-haskell.overrideAttrs (old: {
-    postPatch = old.postPatch or "" + ''
-      substituteInPlace ftplugin/haskell/stylish-haskell.vim --replace \
-        'g:stylish_haskell_command = "stylish-haskell"' \
-        'g:stylish_haskell_command = "${stylish-haskell}/bin/stylish-haskell"'
-    '';
+    postPatch =
+      old.postPatch
+        or ""
+      + ''
+        substituteInPlace ftplugin/haskell/stylish-haskell.vim --replace \
+          'g:stylish_haskell_command = "stylish-haskell"' \
+          'g:stylish_haskell_command = "${stylish-haskell}/bin/stylish-haskell"'
+      '';
   });
 
   vim-surround = super.vim-surround.overrideAttrs {
@@ -1699,8 +1700,8 @@ self: super: {
     '';
     stripDebugList = [ "autoload/leaderf/python" ];
   };
-
-} // (
+}
+  // (
   let
     nodePackageNames = [
       "coc-clangd"
@@ -1753,11 +1754,12 @@ self: super: {
       "coc-yaml"
       "coc-yank"
     ];
-    nodePackage2VimPackage = name: buildVimPlugin {
-      pname = name;
-      inherit (nodePackages.${name}) version meta;
-      src = "${nodePackages.${name}}/lib/node_modules/${name}";
-    };
+    nodePackage2VimPackage = name:
+      buildVimPlugin {
+        pname = name;
+        inherit (nodePackages.${name}) version meta;
+        src = "${nodePackages.${name}}/lib/node_modules/${name}";
+      };
   in
   lib.genAttrs nodePackageNames nodePackage2VimPackage
 )
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index c8d1fea0b78c..20ff949a3540 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -1,7 +1,7 @@
 { callPackage, ... }:
 
 callPackage ./generic.nix {
-  version = "5.2.0";
+  version = "5.2.2";
   kde-channel = "stable";
-  hash = "sha256-02oZc4pZw2dQucx1IuPJslWQGjOqwGmgeDgnUIqKkpc=";
+  hash = "sha256-wdLko219iqKW0CHlK+STzGedP+Xoqk/BPENNM+gVTOI=";
 }
diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index 6846997a05df..df78c3108fb8 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -21,15 +21,6 @@ mkDerivation rec {
     inherit hash;
   };
 
-  patches = [
-    (fetchpatch {
-      name = "krita-opencolorio-2.3-compat.patch";
-      url = "https://invent.kde.org/graphics/krita/-/commit/520c633c2c868f2236d8e56eefecdcb6e3ebd840.patch";
-      hash = "sha256-eXsgBN8OnKjZOQsOxViPypts6CVh3L+IYKMB/mDUcfQ=";
-      includes = [ "plugins/dockers/lut/ocio_display_filter_vfx2021.cpp" ];
-    })
-  ];
-
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip makeWrapper ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/photoqt/default.nix b/pkgs/applications/graphics/photoqt/default.nix
index 0135e692888d..21febdc02b7e 100644
--- a/pkgs/applications/graphics/photoqt/default.nix
+++ b/pkgs/applications/graphics/photoqt/default.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "photoqt";
-  version = "4.0.1";
+  version = "4.1";
 
   src = fetchurl {
     url = "https://photoqt.org/pkgs/photoqt-${version}.tar.gz";
-    hash = "sha256-nmEipzatselwtBR//ayajqgmhaUnAMKW7JBLKdzutHg=";
+    hash = "sha256-vxQZFlS4C+Dg9I6BKeMUFOYHz74d28gbhJlIpxSKTvs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/wallust/default.nix b/pkgs/applications/misc/wallust/default.nix
index 4155c912c638..c88dab646c74 100644
--- a/pkgs/applications/misc/wallust/default.nix
+++ b/pkgs/applications/misc/wallust/default.nix
@@ -4,7 +4,7 @@
 , nix-update-script
 }:
 let
-  version = "2.7.1";
+  version = "2.8.0";
 in
 rustPlatform.buildRustPackage {
   pname = "wallust";
@@ -15,10 +15,14 @@ rustPlatform.buildRustPackage {
     owner = "explosion-mental";
     repo = "wallust";
     rev = version;
-    hash = "sha256-WhL2HWM1onRrCqWJPLnAVMd/f/xfLrK3mU8jFSLFjAM=";
+    hash = "sha256-qX+pU/ovRV7dA35qSA724vV9azz7dMbEyMVBzqS47Ps=";
   };
 
-  cargoSha256 = "sha256-pR2vdqMGJZ6zvXwwKUIPjb/lWzVgYqQ7C7/sk/+usc4=";
+  cargoHash = "sha256-PAO7qxaKrRKYoC5RElNCylqRzOgvzPyxb6tTzW4jNi4=";
+
+  # temporarily skip tests for args due to a string formatting conflict
+  # https://codeberg.org/explosion-mental/wallust/issues/30
+  cargoTestFlags = [ "--test config" "--test cache" "--test template" ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index b8dd53383c98..2b0495c31a50 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -92,11 +92,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.61.101";
+  version = "1.61.109";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-s+YjTZs+dT/T/MSzOAvXMHzd3pWMbLa8v9amnd2sqns=";
+    hash = "sha256-vIi205FqgoQEZCV4iWCFxjH2hJNWH9HjRU94jt7Ee8A=";
   };
 
   dontConfigure = true;
@@ -205,7 +205,7 @@ stdenv.mkDerivation rec {
     '';
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mpl20;
-    maintainers = with maintainers; [ uskudnik rht jefflabonte nasirhm ];
+    maintainers = with maintainers; [ uskudnik rht jefflabonte nasirhm buckley310 ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/sniffers/sngrep/default.nix b/pkgs/applications/networking/sniffers/sngrep/default.nix
index 36084ae3acda..1e27a01fa5e6 100644
--- a/pkgs/applications/networking/sniffers/sngrep/default.nix
+++ b/pkgs/applications/networking/sniffers/sngrep/default.nix
@@ -12,23 +12,15 @@
 
 stdenv.mkDerivation rec {
   pname = "sngrep";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "irontec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gFba2wOU4GwpOZTo5A2QpBgnC6OgDJEeyaPGHbA+7tA=";
+    sha256 = "sha256-9ccp5Pxhs7jOQuWHCmU9yvzLKeOAN8lEaieCIvnXJRA=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-36192.patch";
-      url = "https://github.com/irontec/sngrep/commit/ad1daf15c8387bfbb48097c25197bf330d2d98fc.patch";
-      hash = "sha256-g8fxvxi3d7jmZEKTbxqw29hJbm/ShsKKxstsOUGxTug=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoconf
     automake
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 1303afb9d66d..7a714d6f3008 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -19,14 +19,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "23.11.1";
+  version = "23.12.3";
 in
 stdenv.mkDerivation {
   inherit pname appname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-rsYB8aLVVpGGbiEDWCpGCPdZEsOajoGfoh6YYxilxpg=";
+    hash = "sha256-cQjO5LgGDU9ZHnvKniFMBzcxgWRFfS+PQ0OSe+NFv+c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ra/raft-cowsql/package.nix b/pkgs/by-name/ra/raft-cowsql/package.nix
index 307c3ea8117e..1731a4eeebd6 100644
--- a/pkgs/by-name/ra/raft-cowsql/package.nix
+++ b/pkgs/by-name/ra/raft-cowsql/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "raft-cowsql";
-  version = "0.18.2";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "cowsql";
     repo = "raft";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CMcKXX2u+qiroleg5GIovTOVAg9ycXBsRDqfsOCL3yo=";
+    hash = "sha256-lfmn+GfdgZ5fdp3Y6ROzEuXsrLNlH/qA98Ni5QAv0oQ=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/by-name/sa/satty/package.nix b/pkgs/by-name/sa/satty/package.nix
index e358397a48b3..e9b9c1746a87 100644
--- a/pkgs/by-name/sa/satty/package.nix
+++ b/pkgs/by-name/sa/satty/package.nix
@@ -15,16 +15,16 @@
 rustPlatform.buildRustPackage rec {
 
   pname = "satty";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "gabm";
     repo = "Satty";
     rev = "v${version}";
-    hash = "sha256-w2kosnPDWUZqp6iyj6ypAGRlmYSby+9B6epsAkFK6eY=";
+    hash = "sha256-5FKEQUH43qx8w7s7lW8EDOWtWCUJTbWlXcMQazR8Thk=";
   };
 
-  cargoHash = "sha256-XeuzoHXSiKtA9ofCBOMHnKKzcmur+/TS96DnzIfpqUA=";
+  cargoHash = "sha256-FpCmzU2C+5+5eSB5Mno+lOFd4trHXmfp6e5oV+CvU1c=";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index b7b2cc9c7dcf..791f596be416 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -45,6 +45,11 @@ let
       # BEAM-based languages.
       elixir = elixir_1_15;
 
+      elixir_1_16 = lib'.callElixir ../interpreters/elixir/1.16.nix {
+        inherit erlang;
+        debugInfo = true;
+      };
+
       elixir_1_15 = lib'.callElixir ../interpreters/elixir/1.15.nix {
         inherit erlang;
         debugInfo = true;
diff --git a/pkgs/development/compilers/idris2/default.nix b/pkgs/development/compilers/idris2/default.nix
index 2760eb268c19..4bac5d33b1eb 100644
--- a/pkgs/development/compilers/idris2/default.nix
+++ b/pkgs/development/compilers/idris2/default.nix
@@ -23,13 +23,13 @@ let
 # Uses scheme to bootstrap the build of idris2
 in stdenv.mkDerivation rec {
   pname = "idris2";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "idris-lang";
     repo = "Idris2";
     rev = "v${version}";
-    sha256 = "sha256-80MAGM1IEtI09h5aCYfDL4PRrjGq2gT8OUEibOVk8H4=";
+    sha256 = "sha256-VwveX3fZfrxEsytpbOc5Tm6rySpLFhTt5132J6rmrmM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index 425eda585c27..70d46dc46061 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -76,12 +76,12 @@ in {
 
   nim-unwrapped-2 = stdenv.mkDerivation (finalAttrs: {
     pname = "nim-unwrapped";
-    version = "2.0.0";
+    version = "2.0.2";
     strictDeps = true;
 
     src = fetchurl {
       url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-vWEB2EADb7eOk6ad9s8/n9DCHNdUtpX/hKO0rdjtCvc=";
+      hash = "sha256-ZPUdO/Vt6dDueeLKapzpRFSvmmOhQaaWnOjFmmC4LM8=";
     };
 
     buildInputs = [ boehmgc openssl pcre readline sqlite ]
@@ -161,10 +161,10 @@ in {
   });
 
   nim-unwrapped-1 = nim-unwrapped-2.overrideAttrs (finalAttrs: prevAttrs: {
-    version = "1.6.14";
+    version = "1.6.18";
     src = fetchurl {
       url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-0HDS8oriQA33/kpJ7OufRc1TmQaxB0gYVqCveo+oLck=";
+      hash = "sha256-UCQaxyIpG6ljdT8EWqo1h7c8GqKK4pxXPBWluKYCoss=";
     };
 
     patches = [
diff --git a/pkgs/development/interpreters/elixir/1.16.nix b/pkgs/development/interpreters/elixir/1.16.nix
new file mode 100644
index 000000000000..8a320eae7bb2
--- /dev/null
+++ b/pkgs/development/interpreters/elixir/1.16.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+mkDerivation {
+  version = "1.16.0";
+  sha256 = "sha256-nM3TpX18zdjDAFkljsAqwKx/1AQmwDMIQCeL75etTQc=";
+  # https://hexdocs.pm/elixir/1.16.0/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
+  minimumOTPVersion = "24";
+  escriptPath = "lib/elixir/scripts/generate_app.escript";
+}
diff --git a/pkgs/development/python-modules/approvaltests/default.nix b/pkgs/development/python-modules/approvaltests/default.nix
index 289755c5ddc6..6c078914cd93 100644
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "approvaltests";
-  version = "10.1.0";
+  version = "10.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-t+Vxo6Pn3b2H3yAg5LGsGTjrZr4MXeGOY2BF9eFFAdE=";
+    hash = "sha256-2NaqqgrHXJovoVExvbr0s86eRbcxy+DUrsdRH/vak3E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-restx/default.nix b/pkgs/development/python-modules/flask-restx/default.nix
index 6fd8b6b7330b..106f6cc82165 100644
--- a/pkgs/development/python-modules/flask-restx/default.nix
+++ b/pkgs/development/python-modules/flask-restx/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "flask-restx";
-  version = "1.2.0";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "python-restx";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-9o0lgDtjsZta9fVJnD02In6wvxNwPA667WeIkpRv8Z4=";
+    hash = "sha256-CBReP/u96fsr28lMV1BfLjjdBMXEvsD03wvsxkIcteI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index c9be85e7d223..2c0d2ca65266 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
 
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KLXDzXpT9F/JqA8Jeo8AF/eTD3hHXQQcTrblQJ4BHug=";
+    hash = "sha256-bRnsUpHhi+CAzUQSqMFmVWItn6KIKaXMjggxNixaY6Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-external-toc/default.nix b/pkgs/development/python-modules/sphinx-external-toc/default.nix
index 921669d4ca71..9812768a5de8 100644
--- a/pkgs/development/python-modules/sphinx-external-toc/default.nix
+++ b/pkgs/development/python-modules/sphinx-external-toc/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sphinx-external-toc";
-  version = "1.0.0";
+  version = "1.0.1";
 
   format = "pyproject";
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "sphinx_external_toc";
-    sha256 = "sha256-990JX/OrD7dKMQ1BCwo2GPwd3G8s5DWJfWWayqSj6yQ=";
+    sha256 = "sha256-p9LGPMR+xohUZEOyi8TvRmEhgn7z3Hu1Cd41S61OouA=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index 48297d6747e3..e87694dfe50e 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "weaviate-client";
-  version = "3.25.3";
+  version = "3.26.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iU33APwfCpMvo3ACn2RK9AYvhxgCb9pa0HZH01fZUWc=";
+    hash = "sha256-7oCb8tH1pQDJpoxe3C6xdKtRQqNoAuJ0qySv5nX/sos=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/rain/default.nix b/pkgs/development/tools/rain/default.nix
index 2943d45e26ac..a07f09a060c7 100644
--- a/pkgs/development/tools/rain/default.nix
+++ b/pkgs/development/tools/rain/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "rain";
-  version = "1.6.0";
+  version = "1.7.5";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sAqWVGzEQJwf7ioQjOFs+1hAn69LmDCMSu0ym59aDsU=";
+    sha256 = "sha256-UAh84LM7QbIdxuPGN+lsbjVLd+hk8NXqwDxcRv5FAdY=";
   };
 
-  vendorHash = "sha256-xmpjoNfz+4d7Un0J6yEhkQG2Ax8hL0dw4OQmwrKq3QI=";
+  vendorHash = "sha256-kd820Qe/0gN34VnX9Ge4BLeI3yySunJNjOVJXBe/M58=";
 
   subPackages = [ "cmd/rain" ];
 
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 314a95bd5548..195d6ba7651d 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "19.1.1-54734";
+  version = "19.2.0-54827";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-02YxBkV9pZGfXuK6GvUDTgE9U5H2MOMk24h9qGJdFTM=";
+    hash = "sha256-iVrI7ZM/tY5ZumTnQHhGizmdNDJ9I8sP/EOVFcpCQ48=";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index ca8d54d6006d..4278abfb8248 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -25,11 +25,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "postfix";
-  version = "3.8.3";
+  version = "3.8.4";
 
   src = fetchurl {
-    url = "http://cdn.postfix.johnriley.me/mirrors/postfix-release/official/${pname}-${version}.tar.gz";
-    hash = "sha256-FpRsmHSnhqCfU7F9HIPcH6rjXL+AurNKsBeYtwQglos=";
+    url = "https://de.postfix.org/ftpmirror/official/${pname}-${version}.tar.gz";
+    hash = "sha256-b1hIxdi2p9LFrwqfdbC9PxA0UekSWRRkq4Z/3gheYjY=";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index 3387ef3c6f11..0d293dbf1f0f 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -7,12 +7,12 @@
 , stdenv
 }:
 let
-  version = "23.2.14";
+  version = "23.3.1";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-VvbyVAcNPe1UOEfX+HSY4OaOBS78YZuFgpIYo2s1kXo=";
+    sha256 = "sha256-xYUL681Ek3eJw5SPdMjlIjt7T87d09+xfJNCcC9tTpE=";
   };
   server = callPackage ./server.nix { inherit src version; };
 in
@@ -21,7 +21,7 @@ buildGoModule rec {
   inherit doCheck src version;
   modRoot = "./src/go/rpk";
   runVend = false;
-  vendorHash = "sha256-mLMMw48d1FOvIIjDNza0rZSWP55lP1AItR/hT3lYXDg=";
+  vendorHash = "sha256-nXAjtRhiLmzgb6OVerX2liCinstsnxeBBpxSAQoLrjg=";
 
   ldflags = [
     ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
diff --git a/pkgs/servers/web-apps/mediawiki/default.nix b/pkgs/servers/web-apps/mediawiki/default.nix
index 8ba18acf9cac..23f0e6c2153c 100644
--- a/pkgs/servers/web-apps/mediawiki/default.nix
+++ b/pkgs/servers/web-apps/mediawiki/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mediawiki";
-  version = "1.40.1";
+  version = "1.41.0";
 
   src = fetchurl {
     url = "https://releases.wikimedia.org/mediawiki/${lib.versions.majorMinor version}/mediawiki-${version}.tar.gz";
-    hash = "sha256-4F1BneQMatAxRaygfgjPmV0coWZ9l3k7tzlw4sEbCgQ=";
+    hash = "sha256-84Qrcqp6JYiPHsYyMj3YkEF3OaEg2VHEhfhQ4MzLQhs=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/admin/qovery-cli/default.nix b/pkgs/tools/admin/qovery-cli/default.nix
index 966809e4256a..2b45bcf5853e 100644
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.75.3";
+  version = "0.75.5";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+7rjr6CbUFeEqAfCGooY5dyeP+V5eRlwm3UQeJln6as=";
+    hash = "sha256-dmdyKMmIi09AG7deI20cYukUuT6485B5xNhpHk14zC8=";
   };
 
-  vendorHash = "sha256-gIqLyGc4ik7cv2U4WS3Wy8BnIpK5NdjWSH0Z58AiVPE=";
+  vendorHash = "sha256-R1CAB42moobsYuXNTtZXNLcCpSp8jfSt2FQi5fRnEdI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/graphics/netpbm/default.nix b/pkgs/tools/graphics/netpbm/default.nix
index 105169c5e030..79194304dc62 100644
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@@ -20,14 +20,14 @@ stdenv.mkDerivation {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.4.4";
+  version = "11.4.5";
 
   outputs = [ "bin" "out" "dev" ];
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "4784";
-    sha256 = "GoO32AWu2s/s1IzehPynCJctc1F98dQhz5cQSXQhu2A=";
+    rev = "4800";
+    sha256 = "ftMw2N63iEsf8GPuuXLe/hw+LN0lAUKyhk7wGZMboHY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/bitwarden/cli.nix b/pkgs/tools/security/bitwarden/cli.nix
index 0ff814617429..b51dd1e9e8c2 100644
--- a/pkgs/tools/security/bitwarden/cli.nix
+++ b/pkgs/tools/security/bitwarden/cli.nix
@@ -10,18 +10,18 @@
 
 buildNpmPackage rec {
   pname = "bitwarden-cli";
-  version = "2023.12.0";
+  version = "2023.12.1";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "cli-v${version}";
-    hash = "sha256-WYhLKV3j3Ktite5u1H4fSku38hCCrMzKoxtjq6aT9yo=";
+    hash = "sha256-WHI1AfliJa1wAbN1Heto28WlM7uX51SSV4YndAZii1Y=";
   };
 
   nodejs = nodejs_18;
 
-  npmDepsHash = "sha256-bnYpvHO9Pnob+MbrSshv03mSwXCADH/2xw33nLVKMdg=";
+  npmDepsHash = "sha256-18OaRCys+HaCZ5/ZLeugqW0jWKSQkfvnBGx8aVAdezQ=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index d8a48cf65abc..afc07a63d603 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -4,13 +4,13 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "1.3.3";
+      version = "1.3.4";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        hash = "sha256-CFavEtv6wL6jiUayjyU27OkdToXIM4EP7v5ONFdAJ5w=";
+        hash = "sha256-vU/qxCMCC2XWH79Z7cGhMlqMeQOMghTPDfROWdusKX4=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -23,7 +23,7 @@ let
         '';
       };
 
-      vendorHash = "sha256-BLK8IJWL2sZ5bdnJU48/XhplSGUOL8gE7pY8rL+rVFk=";
+      vendorHash = "sha256-qhBbzYYayRktBQi9HtzuxBIlSdNIOD/agCFFNEvlcBc=";
 
       nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6fd6949ba7c7..00d71dbec605 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17649,7 +17649,7 @@ with pkgs;
   inherit (beam.interpreters)
     erlang erlang_26 erlang_25 erlang_24
     erlang_odbc erlang_javac erlang_odbc_javac
-    elixir elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10
+    elixir elixir_1_16 elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10
     elixir-ls;
 
   erlang_nox = beam_nox.interpreters.erlang;
diff --git a/pkgs/top-level/beam-packages.nix b/pkgs/top-level/beam-packages.nix
index 62ab2a63ae74..13c72324f9d6 100644
--- a/pkgs/top-level/beam-packages.nix
+++ b/pkgs/top-level/beam-packages.nix
@@ -85,7 +85,7 @@ in
     # access for example elixir built with different version of Erlang, use
     # `beam.packages.erlang_24.elixir`.
     inherit (self.packages.erlang)
-      elixir elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10 elixir-ls lfe lfe_2_1;
+      elixir elixir_1_16 elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10 elixir-ls lfe lfe_2_1;
   } // interpretersAliases;
 
   # Helper function to generate package set with a specific Erlang version.