diff --git a/nixos/modules/services/games/openarena.nix b/nixos/modules/services/games/openarena.nix
index 89e30d7c12af..8f6d4986903f 100644
--- a/nixos/modules/services/games/openarena.nix
+++ b/nixos/modules/services/games/openarena.nix
@@ -1,14 +1,14 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
+  inherit (lib) concatStringsSep mkEnableOption mkIf mkOption types;
   cfg = config.services.openarena;
 in
 {
   options = {
     services.openarena = {
       enable = mkEnableOption (lib.mdDoc "OpenArena");
+      package = lib.mkPackageOptionMD pkgs "openarena" { };
 
       openPorts = mkOption {
         type = types.bool;
@@ -43,7 +43,7 @@ in
       serviceConfig = {
         DynamicUser = true;
         StateDirectory = "openarena";
-        ExecStart = "${pkgs.openarena}/bin/oa_ded +set fs_basepath ${pkgs.openarena}/openarena-0.8.8 +set fs_homepath /var/lib/openarena ${concatStringsSep " " cfg.extraFlags}";
+        ExecStart = "${cfg.package}/bin/oa_ded +set fs_basepath ${cfg.package}/share/openarena +set fs_homepath /var/lib/openarena ${concatStringsSep " " cfg.extraFlags}";
         Restart = "on-failure";
 
         # Hardening
diff --git a/nixos/modules/services/games/quake3-server.nix b/nixos/modules/services/games/quake3-server.nix
index 2d2148237da1..e51830c12e78 100644
--- a/nixos/modules/services/games/quake3-server.nix
+++ b/nixos/modules/services/games/quake3-server.nix
@@ -1,13 +1,15 @@
 { config, pkgs, lib, ... }:
-with lib;
 
 let
+  inherit (lib) literalMD mkEnableOption mkIf mkOption types;
   cfg = config.services.quake3-server;
+
   configFile = pkgs.writeText "q3ds-extra.cfg" ''
     set net_port ${builtins.toString cfg.port}
 
     ${cfg.extraConfig}
   '';
+
   defaultBaseq3 = pkgs.requireFile rec {
     name = "baseq3";
     hashMode = "recursive";
@@ -25,6 +27,7 @@ let
       $services.quake3-server.baseq3/.q3a/
     '';
   };
+
   home = pkgs.runCommand "quake3-home" {} ''
       mkdir -p $out/.q3a/baseq3
 
@@ -38,6 +41,7 @@ in {
   options = {
     services.quake3-server = {
       enable = mkEnableOption (lib.mdDoc "Quake 3 dedicated server");
+      package = lib.mkPackageOptionMD pkgs "ioquake3" { };
 
       port = mkOption {
         type = types.port;
@@ -103,10 +107,10 @@ in {
         ReadOnlyPaths = if baseq3InStore then home else cfg.baseq3;
         ExecStartPre = optionalString (!baseq3InStore) "+${pkgs.coreutils}/bin/cp ${configFile} ${cfg.baseq3}/.q3a/baseq3/nix.cfg";
 
-        ExecStart = "${pkgs.ioquake3}/ioq3ded.x86_64 +exec nix.cfg";
+        ExecStart = "${cfg.package}/bin/ioq3ded +exec nix.cfg";
       };
     };
   };
 
-  meta.maintainers = with maintainers; [ f4814n ];
+  meta.maintainers = with lib.maintainers; [ f4814n ];
 }
diff --git a/nixos/modules/services/web-apps/grocy.nix b/nixos/modules/services/web-apps/grocy.nix
index 688367cafaf5..b0d3c44cea81 100644
--- a/nixos/modules/services/web-apps/grocy.nix
+++ b/nixos/modules/services/web-apps/grocy.nix
@@ -115,10 +115,8 @@ in {
       user = "grocy";
       group = "nginx";
 
-      # PHP 8.0 is the only version which is supported/tested by upstream:
-      # https://github.com/grocy/grocy/blob/v3.3.0/README.md#how-to-install
-      # Compatibility with PHP 8.1 is available on their development branch:
-      # https://github.com/grocy/grocy/commit/38a4ad8ec480c29a1bff057b3482fd103b036848
+      # PHP 8.1 is the only version which is supported/tested by upstream:
+      # https://github.com/grocy/grocy/blob/v4.0.0/README.md#platform-support
       phpPackage = pkgs.php81;
 
       inherit (cfg.phpfpm) settings;
@@ -168,7 +166,7 @@ in {
   };
 
   meta = {
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ n0emis ];
     doc = ./grocy.md;
   };
 }
diff --git a/pkgs/applications/audio/butt/default.nix b/pkgs/applications/audio/butt/default.nix
index 2c1deb452bef..04f5c8535843 100644
--- a/pkgs/applications/audio/butt/default.nix
+++ b/pkgs/applications/audio/butt/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "butt";
-  version = "0.1.37";
+  version = "0.1.38";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-FI8xRCaGSMC6KEf5v87Q4syO3kVPWXYXgnL24+myRKo=";
+    hash = "sha256-6c4BknAh+XPaKrEfCz0oHm7lWOLV+9jiJbQx9vvtI4I=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 5d9e4c838ddb..9c8f07d79253 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -91,11 +91,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.56.20";
+  version = "1.57.47";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-ub44AI0Fu3V8SRhiBrQueJZaSdl4/cI6DQ3QYJfGseo=";
+    sha256 = "sha256-u2xC+Q6tcg989S0zM2flRRiCu7kLSv1/y3N2EvFxiwM=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/cluster/k0sctl/default.nix b/pkgs/applications/networking/cluster/k0sctl/default.nix
index eb3847845d04..b8eb1a79bfe4 100644
--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "k0sctl";
-  version = "0.15.4";
+  version = "0.15.5";
 
   src = fetchFromGitHub {
     owner = "k0sproject";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sMMYuE/KIWScZTCuzW9WQpCDHI+Og1zRxGlZzOuHgNo=";
+    sha256 = "sha256-ntjrk2OEIkAmNpf9Ag6HkSIOSA3NtO9hSJOBgvne4b0=";
   };
 
-  vendorSha256 = "sha256-6UWRh0NHFr7adJJSmrfTjzXH75Dmjed/+KxH6Kz//jk=";
+  vendorSha256 = "sha256-JlaXQqDO/b1xe9NA2JtuB1DZZlphWu3Mo/Mf4lhmKNo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/data/misc/clash-geoip/default.nix b/pkgs/data/misc/clash-geoip/default.nix
index 8faeef9d0045..3488bfc0a5f9 100644
--- a/pkgs/data/misc/clash-geoip/default.nix
+++ b/pkgs/data/misc/clash-geoip/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "clash-geoip";
-  version = "20230712";
+  version = "20230812";
 
   src = fetchurl {
     url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-QXxY/WruYY09LL+OEKhd/EUb+GOI49KFnG75mbwMWoU=";
+    sha256 = "sha256-yO8zSQjNYGxaSXcOhFOIE4HsiMnCm3ZVYfVZg5xO96s=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
index 55b55b931aab..b96bd24deddb 100644
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -142,14 +142,7 @@ in lib.makeScope pkgs.newScope (self: with self; {
 
   elm-test-rs = callPackage ./packages/elm-test-rs.nix { };
 
-  elm-test = nodePkgs.elm-test // {
-    meta = with lib; nodePkgs.elm-test.meta // {
-      description = "Runs elm-test suites from Node.js";
-      homepage = "https://github.com/rtfeldman/node-test-runner";
-      license = licenses.bsd3;
-      maintainers = [ maintainers.turbomack ];
-    };
-  };
+  elm-test = callPackage ./packages/elm-test.nix { };
 } // (hs810Pkgs self).elmPkgs // (hs92Pkgs self).elmPkgs // (with elmLib; with (hs810Pkgs self).elmPkgs; {
   elm-verify-examples = let
     patched = patchBinwrap [elmi-to-json] nodePkgs.elm-verify-examples // {
diff --git a/pkgs/development/compilers/elm/packages/elm-test.nix b/pkgs/development/compilers/elm/packages/elm-test.nix
new file mode 100644
index 000000000000..fc943a80a3fa
--- /dev/null
+++ b/pkgs/development/compilers/elm/packages/elm-test.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "elm-test";
+  version = "0.19.1-revision12";
+
+  src = fetchFromGitHub {
+    owner = "rtfeldman";
+    repo = "node-test-runner";
+    rev = version;
+    hash = "sha256-cnxAOFcPTJjtHi4VYCO9oltb5iOeDnLvRgnuJnNzjsY=";
+  };
+
+  npmDepsHash = "sha256-QljHVrmF6uBem9sW67CYduCro3BqF34EPGn1BtKqom0=";
+
+  postPatch = ''
+    sed -i '/elm-tooling install/d' package.json
+  '';
+
+  dontNpmBuild = true;
+
+  meta = {
+    changelog = "https://github.com/rtfeldman/node-test-runner/blob/${src.rev}/CHANGELOG.md";
+    description = "Runs elm-test suites from Node.js";
+    homepage = "https://github.com/rtfeldman/node-test-runner";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ turbomack ];
+  };
+}
diff --git a/pkgs/development/compilers/fstar/default.nix b/pkgs/development/compilers/fstar/default.nix
index a21aa31ef407..ee45e1e9ab1e 100644
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fstar";
-  version = "2023.02.01";
+  version = "2023.04.25";
 
   src = fetchFromGitHub {
     owner = "FStarLang";
     repo = "FStar";
     rev = "v${version}";
-    hash = "sha256-sLhbIGF7j1tH8zKsPq1qOSwHvYDrVCyfln9UbE3IYv0=";
+    hash = "sha256-LF8eXi/es337QJ2fs5u9pLqegJkh1kDLjK8p4CcSGGc=";
   };
 
   strictDeps = true;
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
     removeReferencesTo
   ] ++ (with ocamlPackages; [
     ocaml
+    dune_3
     findlib
     ocamlbuild
     menhir
@@ -45,8 +46,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postPatch = ''
-    patchShebangs ulib/gen_mllib.sh
-    substituteInPlace src/ocaml-output/Makefile --replace '$(COMMIT)' 'v${version}'
+    patchShebangs ulib/install-ulib.sh
   '';
 
   preInstall = ''
diff --git a/pkgs/development/interpreters/python/tests.nix b/pkgs/development/interpreters/python/tests.nix
index 4ba1b757c3f6..d2bab1b0c8d3 100644
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@@ -114,6 +114,10 @@ let
       nix-pythonprefix-mypy = callPackage ./tests/test_nix_pythonprefix {
         interpreter = python;
       };
+      # Make sure tkinter is importable. See https://github.com/NixOS/nixpkgs/issues/238990
+      tkinter = callPackage ./tests/test_tkinter {
+        interpreter = python;
+      };
     }
   );
 
diff --git a/pkgs/development/interpreters/python/tests/test_tkinter/default.nix b/pkgs/development/interpreters/python/tests/test_tkinter/default.nix
new file mode 100644
index 000000000000..67e67d2d1e97
--- /dev/null
+++ b/pkgs/development/interpreters/python/tests/test_tkinter/default.nix
@@ -0,0 +1,17 @@
+{ interpreter, writeText, runCommand }:
+
+let
+
+  pythonEnv = interpreter.withPackages(ps: [
+    ps.tkinter
+  ]);
+
+  pythonScript = writeText "myscript.py" ''
+    import tkinter
+    print(tkinter)
+  '';
+
+in runCommand "${interpreter.name}-tkinter-test" {} ''
+  ${pythonEnv}/bin/python ${pythonScript}
+  touch $out
+''
diff --git a/pkgs/development/interpreters/racket/default.nix b/pkgs/development/interpreters/racket/default.nix
index eac454d39005..9b0bb014e1ef 100644
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -50,7 +50,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "racket";
-  version = "8.9"; # always change at once with ./minimal.nix
+  version = "8.10"; # always change at once with ./minimal.nix
 
   src = (lib.makeOverridable ({ name, sha256 }:
     fetchurl {
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     }
   )) {
     name = "${pname}-${version}";
-    sha256 = "sha256-OuIl6E4Rn0zRpH8bFhM1aPx9NcKQxQVJVWbZ3M78UiQ=";
+    sha256 = "sha256-Dklj2iwX5/bVdCi9odz2Ttp0N+Lya7bMSLR/QXo9k6M=";
   };
 
   FONTCONFIG_FILE = fontsConf;
@@ -149,6 +149,7 @@ stdenv.mkDerivation rec {
       GUIs and charts.
     '';
     homepage = "https://racket-lang.org/";
+    changelog = "https://github.com/racket/racket/releases/tag/v${version}";
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ henrytill vrthra ];
     platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-linux" "aarch64-darwin" ];
diff --git a/pkgs/development/interpreters/racket/minimal.nix b/pkgs/development/interpreters/racket/minimal.nix
index 29baef2087f1..ce58aec92108 100644
--- a/pkgs/development/interpreters/racket/minimal.nix
+++ b/pkgs/development/interpreters/racket/minimal.nix
@@ -6,7 +6,7 @@ racket.overrideAttrs (oldAttrs: rec {
   version = oldAttrs.version;
   src = oldAttrs.src.override {
     name = "${pname}-${version}";
-    sha256 = "sha256-mAvwer///Oz2w/Sf4tIo+DyS6wib8P85G+q9waDri3Q=";
+    sha256 = "sha256-k1NzmkiYgPkP42U+08Ljjb3FEU7OM3lEaXsLH29hveA=";
   };
 
   meta = oldAttrs.meta // {
diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index a10c1201dca8..a56dfc2f5e9a 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -269,15 +269,15 @@ let
 
   njson = build-asdf-system {
     pname = "njson";
-    version = "1.0.0";
+    version = "1.1.0";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "njson";
-      rev = "1.0.0";
-      sha256 = "sha256-zeOxkoi5cPl1sw1oEOaMsKhhs3Pb8EzzKTjvuDNj/Ko=";
+      rev = "1.1.0";
+      sha256 = "sha256-hVo5++QCns7Mv3zATpAP3EVz1pbj+jbQmzSLqs6hqQo=";
     };
-    lispLibs = [ self.nasdf super.cl-json ];
-    systems = [ "njson" "njson/cl-json" ];
+    lispLibs = [ self.nasdf super.cl-json super.com_dot_inuoe_dot_jzon];
+    systems = [ "njson" "njson/cl-json" "njson/jzon"];
   };
 
   nsymbols = build-asdf-system {
@@ -370,7 +370,7 @@ let
 
   nyxt-gtk = build-asdf-system {
     pname = "nyxt";
-    version = "3.5.0";
+    version = "3.6.0";
 
     lispLibs = (with super; [
       alexandria
@@ -420,6 +420,7 @@ let
       cl-cffi-gtk
       cl-gobject-introspection
       quri
+      sqlite
     ]) ++ (with self; [
       history-tree
       nhooks
@@ -439,8 +440,8 @@ let
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nyxt";
-      rev = "3.5.0";
-      sha256 = "sha256-/x3S4qAvvHxUxDcs6MAuZvAtqLTQdwlH7r4zFlKIjY4=";
+      rev = "3.6.0";
+      sha256 = "sha256-DaPEKdYf5R+RS7VQzbdLSqZvEQfxjeGEdX8rwmHRLrY=";
     };
 
     nativeBuildInputs = [ pkgs.makeWrapper ];
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index 1de90bcb0463..cd8acfebf450 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -51,6 +51,7 @@ mapAliases {
   bitwarden-cli = pkgs.bitwarden-cli; # added 2023-07-25
   castnow = pkgs.castnow; # added 2023-07-30
   eask = pkgs.eask; # added 2023-08-17
+  inherit (pkgs.elmPackages) elm-test;
   eslint_d = pkgs.eslint_d; # Added 2023-05-26
   flood = pkgs.flood; # Added 2023-07-25
   gtop = pkgs.gtop; # added 2023-07-31
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 61c70c09bd5f..1729c5d14d90 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -122,7 +122,6 @@
 , "@electron-forge/cli"
 , "eas-cli"
 , "elm-oracle"
-, "elm-test"
 , "emoj"
 , "emojione"
 , "escape-string-regexp"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index e930cbb8f9c0..cd407488070b 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -98676,68 +98676,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  elm-test = nodeEnv.buildNodePackage {
-    name = "elm-test";
-    packageName = "elm-test";
-    version = "0.19.1-revision12";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/elm-test/-/elm-test-0.19.1-revision12.tgz";
-      sha512 = "5GV3WkJ8R/faOP1hwElQdNuCt8tKx2+1lsMrdeIYWSFz01Kp9gJl/R6zGtp4QUyrUtO8KnHsxjHrQNUf2CHkrg==";
-    };
-    dependencies = [
-      sources."ansi-styles-4.3.0"
-      sources."anymatch-3.1.3"
-      sources."balanced-match-1.0.2"
-      sources."binary-extensions-2.2.0"
-      sources."brace-expansion-2.0.1"
-      sources."braces-3.0.2"
-      sources."chalk-4.1.2"
-      sources."chokidar-3.5.3"
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      sources."commander-9.5.0"
-      sources."cross-spawn-7.0.3"
-      sources."elm-solve-deps-wasm-1.0.2"
-      sources."fill-range-7.0.1"
-      sources."fs.realpath-1.0.0"
-      sources."fsevents-2.3.2"
-      sources."glob-8.1.0"
-      sources."glob-parent-5.1.2"
-      sources."graceful-fs-4.2.11"
-      sources."has-flag-4.0.0"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      sources."is-binary-path-2.1.0"
-      sources."is-extglob-2.1.1"
-      sources."is-glob-4.0.3"
-      sources."is-number-7.0.0"
-      sources."isexe-2.0.0"
-      sources."minimatch-5.1.6"
-      sources."normalize-path-3.0.0"
-      sources."once-1.4.0"
-      sources."path-key-3.1.1"
-      sources."picomatch-2.3.1"
-      sources."readdirp-3.6.0"
-      sources."shebang-command-2.0.0"
-      sources."shebang-regex-3.0.0"
-      sources."split-1.0.1"
-      sources."supports-color-7.2.0"
-      sources."through-2.3.8"
-      sources."to-regex-range-5.0.1"
-      sources."which-2.0.2"
-      sources."wrappy-1.0.2"
-      sources."xmlbuilder-15.1.1"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Run elm-test suites.";
-      homepage = "https://github.com/rtfeldman/node-test-runner#readme";
-      license = "BSD-3-Clause";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   emoj = nodeEnv.buildNodePackage {
     name = "emoj";
     packageName = "emoj";
diff --git a/pkgs/development/python-modules/blosc2/default.nix b/pkgs/development/python-modules/blosc2/default.nix
index 87f23b04dcf0..80cec5ca1ec3 100644
--- a/pkgs/development/python-modules/blosc2/default.nix
+++ b/pkgs/development/python-modules/blosc2/default.nix
@@ -3,11 +3,13 @@
 , fetchFromGitHub
 
 # build-system
-, setuptools
-, scikit-build
-, cython
 , cmake
+, cython
 , ninja
+, oldest-supported-numpy
+, scikit-build
+, setuptools
+, wheel
 
 # propagates
 , msgpack
@@ -44,9 +46,10 @@ buildPythonPackage rec {
     cmake
     cython
     ninja
-    numpy
+    oldest-supported-numpy
     scikit-build
     setuptools
+    wheel
   ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/cffsubr/default.nix b/pkgs/development/python-modules/cffsubr/default.nix
index 05d4c115085d..e86277cf2782 100644
--- a/pkgs/development/python-modules/cffsubr/default.nix
+++ b/pkgs/development/python-modules/cffsubr/default.nix
@@ -1,25 +1,36 @@
 { stdenv
 , lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , fonttools
 , pytestCheckHook
 , setuptools-scm
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "cffsubr";
   version = "0.2.9.post1";
-
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "azFBLc9JyPqEZkvahn4u3cVbb+b6aW/yU8TxOp/y/Fw=";
+    hash = "sha256-azFBLc9JyPqEZkvahn4u3cVbb+b6aW/yU8TxOp/y/Fw=";
   };
 
+  patches = [
+    # https://github.com/adobe-type-tools/cffsubr/pull/23
+    (fetchpatch {
+      name = "remove-setuptools-git-ls-files.patch";
+      url = "https://github.com/adobe-type-tools/cffsubr/commit/887a6a03b1e944b82fcb99b797fbc2f3a64298f0.patch";
+      hash = "sha256-LuyqBtDrKWwCeckr+YafZ5nfVw1XnELwFI6X8bGomhs=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/compreffor/default.nix b/pkgs/development/python-modules/compreffor/default.nix
index e08c348f384c..0b5e684fdf91 100644
--- a/pkgs/development/python-modules/compreffor/default.nix
+++ b/pkgs/development/python-modules/compreffor/default.nix
@@ -1,15 +1,17 @@
 { lib
 , buildPythonPackage
+, cython
+, fetchpatch
 , fetchPypi
 , setuptools-scm
 , fonttools
 , pytestCheckHook
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "compreffor";
   version = "0.5.4";
-
   format = "pyproject";
 
   src = fetchPypi {
@@ -17,8 +19,19 @@ buildPythonPackage rec {
     hash = "sha256-MGulQEUGPrQ30T3VYzwRRlvzvWkFqNzqsNzAjtjX9xU=";
   };
 
+  patches = [
+    # https://github.com/googlefonts/compreffor/pull/153
+    (fetchpatch {
+      name = "remove-setuptools-git-ls-files.patch";
+      url = "https://github.com/googlefonts/compreffor/commit/10f563564390568febb3ed1d0f293371cbd86953.patch";
+      hash = "sha256-wNQMJFJXTFILGzAgzUXzz/rnK67/RU+exYP6MhEQAkA=";
+    })
+  ];
+
   nativeBuildInputs = [
+    cython
     setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 3b4063518cfd..b56c44579df4 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , anytree
 , buildPythonPackage
 , cached-property
@@ -18,8 +19,8 @@
 , pytest-xdist
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , scipy
-, stdenv
 , sympy
 }:
 
@@ -37,20 +38,18 @@ buildPythonPackage rec {
     hash = "sha256-LzqY//205XEOd3/f8k1g4OYndRHMTVplBogGJf5Forw=";
   };
 
-  postPatch = ''
-    # Removing unecessary dependencies
-    sed -e "s/flake8.*//g" \
-        -e "s/codecov.*//g" \
-        -e "s/pytest.*//g" \
-        -e "s/pytest-runner.*//g" \
-        -e "s/pytest-cov.*//g" \
-        -i requirements.txt
+  pythonRemoveDeps = [
+    "codecov"
+    "flake8"
+    "pytest-runner"
+    "pytest-cov"
+  ];
 
-    # Relaxing dependencies requirements
-    sed -e "s/>.*//g" \
-        -e "s/<.*//g" \
-        -i requirements.txt
-  '';
+  pythonRelaxDeps = true;
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
 
   propagatedBuildInputs = [
     anytree
@@ -71,31 +70,35 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-    pytest-xdist
-    matplotlib
     gcc
+    matplotlib
+    pytest-xdist
+    pytestCheckHook
   ];
 
+  pytestFlagsArray = [ "-x" ];
+
   # I've had to disable the following tests since they fail while using nix-build, but they do pass
   # outside the build. They mostly related to the usage of MPI in a sandboxed environment.
   disabledTests = [
     "test_assign_parallel"
-    "test_gs_parallel"
-    "test_if_parallel"
-    "test_if_halo_mpi"
     "test_cache_blocking_structure_distributed"
-    "test_mpi"
     "test_codegen_quality0"
-    "test_new_distributor"
-    "test_subdomainset_mpi"
-    "test_init_omp_env_w_mpi"
-    "test_mpi_nocomms"
-    "test_shortcuts"
-    "est_docstrings"
-    "test_docstrings[finite_differences.coefficients]"
     "test_coefficients_w_xreplace"
+    "test_docstrings"
+    "test_docstrings[finite_differences.coefficients]"
+    "test_gs_parallel"
+    "test_if_halo_mpi"
+    "test_if_parallel"
+    "test_init_omp_env_w_mpi"
     "test_loop_bounds_forward"
+    "test_mpi_nocomms"
+    "test_mpi"
+    "test_index_derivative"
+    "test_new_distributor"
+    "test_setupWOverQ"
+    "test_shortcuts"
+    "test_subdomainset_mpi"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/m2crypto/default.nix b/pkgs/development/python-modules/m2crypto/default.nix
index 350f081db8ba..f8ec95604542 100644
--- a/pkgs/development/python-modules/m2crypto/default.nix
+++ b/pkgs/development/python-modules/m2crypto/default.nix
@@ -1,52 +1,48 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, swig2
 , openssl
-, typing
 , parameterized
+, pytestCheckHook
+, pythonOlder
+, swig2
 }:
 
-
 buildPythonPackage rec {
-  version = "0.38.0";
-  pname = "M2Crypto";
+  pname = "m2crypto";
+  version = "0.39.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-mfImCjCQHJSajcbV+CzVMS/7iryS52YzuvIxu7yy3ss=";
+    pname = "M2Crypto";
+    inherit version;
+    hash = "sha256-JMD0cTWLixmtTIqp2hLoaAMLZcH9syedAG32DJUBM4o=";
   };
 
-  patches = [
-    # Use OpenSSL_version_num() instead of unrealiable parsing of .h file.
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-MR271-opensslversion.patch";
-      hash = "sha256-e1/NHgWza+kum76MUFSofq9Ko3pML67PUfqWjcwIl+A=";
-    })
-    # Changed required to pass tests on OpenSSL 3.0
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-0.38-ossl3-tests.patch";
-      hash = "sha256-B6JKoPh76+CIna6zmrvFj50DIp3pzg8aKyzz+Q5hqQ0=";
-    })
-    # Allow EVP tests fail on non-FIPS algorithms
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-0.38-ossl3-tests-evp.patch";
-      hash = "sha256-jMUAphVBQMFaOJSeYUCQMV3WSe9VDQqG6GY5fDQXZnA=";
-    })
-    # Fix the readline test https://gitlab.com/m2crypto/m2crypto/-/issues/286
-    (fetchpatch {
-      url = "https://gitlab.com/m2crypto/m2crypto/-/commit/b8addc7ad9990d1ba3786830ebd74aa8c939849d.patch";
-      hash = "sha256-M5mrmJVCT0fASvERLKa/MR+EY2hzRGIkyUfguVBPKNk=";
-    })
+  nativeBuildInputs = [
+    swig2
+    openssl
   ];
 
-  nativeBuildInputs = [ swig2 openssl ];
-  buildInputs = [ openssl parameterized ];
+  buildInputs = [
+    openssl
+    parameterized
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "M2Crypto"
+  ];
 
   meta = with lib; {
     description = "A Python crypto and SSL toolkit";
     homepage = "https://gitlab.com/m2crypto/m2crypto";
+    changelog = "https://gitlab.com/m2crypto/m2crypto/-/blob/${version}/CHANGES";
     license = licenses.mit;
     maintainers = with maintainers; [ andrew-d ];
   };
diff --git a/pkgs/development/python-modules/pyprusalink/default.nix b/pkgs/development/python-modules/pyprusalink/default.nix
index 7336dafe88df..97fff5b0687c 100644
--- a/pkgs/development/python-modules/pyprusalink/default.nix
+++ b/pkgs/development/python-modules/pyprusalink/default.nix
@@ -2,8 +2,10 @@
 , aiohttp
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -20,8 +22,18 @@ buildPythonPackage rec {
     hash = "sha256-XRtbb7kceiqi8pioTWStRo0drCtQfy1t62jCMihlIec=";
   };
 
+  patches = [
+    # https://github.com/home-assistant-libs/pyprusalink/pull/55
+    (fetchpatch {
+      name = "unpin-setuptools-dependency.patch";
+      url = "https://github.com/home-assistant-libs/pyprusalink/commit/8efc3229c491a1763456f0f4017251d5789c6d0a.patch";
+      hash = "sha256-kTu1+IwDrcdqelyK/vfhxw8MQBis5I1jag7YTytKQhs=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index 3005c3b18d8a..f952cb475eb9 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.38.0";
+  version = "0.39.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     rev = "refs/tags/${version}";
-    hash = "sha256-0BlrrrOvMHBH+w7r1lzvXg2Lq84XZFfSRheBaDmCpc4=";
+    hash = "sha256-CswgfEmKaQvhDXizpcu6d8JMYtJSgNQ3L4+63ee58eE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index 3a1fb4db881e..847fcd435525 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -1,5 +1,4 @@
 { lib
-, appdirs
 , buildPythonPackage
 , defusedxml
 , fetchFromGitHub
@@ -33,26 +32,22 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    semver
-  ];
-
-  buildInputs = [
-    appdirs
     defusedxml
     marshmallow
     python-box
     python-dateutil
     requests
-    requests-pkcs12
     restfly
+    semver
     typing-extensions
   ];
 
   nativeCheckInputs = [
-    responses
     pytest-datafiles
     pytest-vcr
     pytestCheckHook
+    requests-pkcs12
+    responses
   ];
 
   disabledTests = [
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index df3fbbf4c626..eff472c69aa1 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl, bash }:
 
 let
-  version = "16.2.0";
+  version = "16.2.1";
 in
 buildGoModule rec {
   inherit version;
@@ -17,18 +17,19 @@ buildGoModule rec {
   # For patchShebangs
   buildInputs = [ bash ];
 
-  vendorHash = "sha256-sP9lboy1M4+AB1Z0VsX5eNxZ9ckuJBgEPxavAbOSk8g=";
+  vendorHash = "sha256-Rzy4R4QR+rPqzhjZlqcuiP3DDLOu9Z2fb42WPaSPR/4=";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "sha256-gTjGf/WuMoGNvsiWWj3Y7l2MvSzBM12RY/Odolm4fNw=";
+    sha256 = "sha256-GMvBZ3H29F4XyisAt3J4VWRwaEIF7ZQ/tI0gKbDTS/E=";
   };
 
   patches = [
     ./fix-shell-path.patch
     ./remove-bash-test.patch
+    ./fix-invalid-host-header.patch # see https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/4249
   ];
 
   prePatch = ''
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/fix-invalid-host-header.patch b/pkgs/development/tools/continuous-integration/gitlab-runner/fix-invalid-host-header.patch
new file mode 100644
index 000000000000..291e94378a9a
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/fix-invalid-host-header.patch
@@ -0,0 +1,58 @@
+From 0087ed1e060cab8341f20a4342c0f750d5bb328b Mon Sep 17 00:00:00 2001
+From: Michael Adler <therisen06@gmail.com>
+Date: Fri, 18 Aug 2023 14:42:49 +0200
+Subject: [PATCH] Backport fix for invalid Host header
+
+---
+ go.mod | 4 ++--
+ go.sum | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/go.mod b/go.mod
+index d93029df7..23e8fd707 100644
+--- a/go.mod
++++ b/go.mod
+@@ -15,12 +15,12 @@ require (
+ 	github.com/bmatcuk/doublestar/v4 v4.4.0
+ 	github.com/creack/pty v1.1.17
+ 	github.com/denisbrodbeck/machineid v1.0.1
+-	github.com/docker/cli v23.0.1+incompatible
++	github.com/docker/cli v24.0.5+incompatible
+ 	github.com/docker/distribution v2.8.2+incompatible
+ 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0
+ 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0
+ 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets v0.11.0
+-	github.com/docker/docker v23.0.6+incompatible
++	github.com/docker/docker v24.0.5+incompatible
+ 	github.com/docker/go-connections v0.4.0
+ 	github.com/docker/go-units v0.5.0
+ 	github.com/docker/machine v0.7.1-0.20170120224952-7b7a141da844
+diff --git a/go.sum b/go.sum
+index fba5228da..0a9d36bef 100644
+--- a/go.sum
++++ b/go.sum
+@@ -497,8 +497,8 @@ github.com/dnaeon/go-vcr v1.1.0/go.mod h1:M7tiix8f0r6mKKJ3Yq/kqU1OYf3MnfmBWVbPx/
+ github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
+ github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
+ github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+-github.com/docker/cli v23.0.1+incompatible h1:LRyWITpGzl2C9e9uGxzisptnxAn1zfZKXy13Ul2Q5oM=
+-github.com/docker/cli v23.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
++github.com/docker/cli v24.0.5+incompatible h1:WeBimjvS0eKdH4Ygx+ihVq1Q++xg36M/rMi4aXAvodc=
++github.com/docker/cli v24.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+ github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
+ github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+ github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+@@ -507,8 +507,8 @@ github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4Kfc
+ github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+ github.com/docker/docker v20.10.14+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+ github.com/docker/docker v20.10.17+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+-github.com/docker/docker v23.0.6+incompatible h1:aBD4np894vatVX99UTx/GyOUOK4uEcROwA3+bQhEcoU=
+-github.com/docker/docker v23.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
++github.com/docker/docker v24.0.5+incompatible h1:WmgcE4fxyI6EEXxBRxsHnZXrO1pQ3smi0k/jho4HLeY=
++github.com/docker/docker v24.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+ github.com/docker/docker-credential-helpers v0.6.3 h1:zI2p9+1NQYdnG6sMU26EX4aVGlqbInSQxQXLvzJ4RPQ=
+ github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
+ github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
+-- 
+2.41.0
+
diff --git a/pkgs/games/blobby/default.nix b/pkgs/games/blobby/default.nix
index c5c6ed01ecc5..27371b905417 100644
--- a/pkgs/games/blobby/default.nix
+++ b/pkgs/games/blobby/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "blobby-volley";
-  version = "1.1";
+  version = "1.1.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/blobby/Blobby%20Volley%202%20%28Linux%29/1.1/blobby2-linux-1.1.tar.gz";
-    sha256 = "sha256-1WJ59Fhb1opXjOci+nAx/F2w5TnBaRhxQuPKgmmLfvQ=";
+    url = "mirror://sourceforge/blobby/Blobby%20Volley%202%20%28Linux%29/1.1.1/blobby2-linux-1.1.1.tar.gz";
+    sha256 = "sha256-NX7lE+adO1D2f8Bj1Ky3lZpf6Il3gX8KqxTMxw2yFLo=";
   };
 
   nativeBuildInputs = [ cmake pkg-config zip ];
diff --git a/pkgs/games/openarena/default.nix b/pkgs/games/openarena/default.nix
index 7b1f793895ed..a90a6752ac8b 100644
--- a/pkgs/games/openarena/default.nix
+++ b/pkgs/games/openarena/default.nix
@@ -1,43 +1,122 @@
-{ lib, fetchurl, makeWrapper, patchelf, pkgs, stdenv, SDL, libglvnd, libogg, libvorbis, curl, openal }:
+{ lib
+, fetchzip
+, fetchFromGitHub
+, stdenv
+, fetchpatch
+, copyDesktopItems
+, curl
+, makeBinaryWrapper
+, pkg-config
+, which
+, freetype
+, libglvnd
+, libogg
+, libvorbis
+, libxmp
+, openal
+, SDL2
+, speex
+, makeDesktopItem
+}:
 
-stdenv.mkDerivation {
-  pname = "openarena";
-  version = "0.8.8";
-
-  src = fetchurl {
-    name = "openarena.zip";
-    url = "http://openarena.ws/request.php?4";
-    sha256 = "0jmc1cmdz1rcvqc9ilzib1kilpwap6v0d331l6q53wsibdzsz3ss";
+let
+  openarena-maps = fetchzip {
+    name = "openarena-maps";
+    url = "https://download.tuxfamily.org/openarena/rel/088/openarena-0.8.8.zip";
+    hash = "sha256-Rup1n14k9sKcyVFYzFqPYV+BEBCnUNwpnFsnyGrhl20=";
   };
 
-  nativeBuildInputs = [ pkgs.unzip patchelf makeWrapper];
+  openarena-source = fetchFromGitHub {
+    name = "openarena-source";
+    owner = "OpenArena";
+    repo = "engine";
+    rev = "075cb860a4d2bc43e75e5f506eba7da877708aba";
+    hash = "sha256-ofQKQyS3ti5TSN+zqwPFYuJiB9kvdER6zTWn8yrOpQU=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openarena";
+  version = "unstable-2023-03-02";
 
-  installPhase = let
-    gameDir = "$out/openarena-$version";
-    interpreter = "$(< \"$NIX_CC/nix-support/dynamic-linker\")";
-    libPath = lib.makeLibraryPath [ SDL libglvnd libogg libvorbis curl openal ];
-    arch = {
-      "x86_64-linux" = "x86_64";
-      "i386-linux" = "i386";
-    }.${stdenv.hostPlatform.system};
-  in ''
-    mkdir -pv $out/bin
-    cd $out
-    unzip $src
+  srcs = [
+    openarena-source
+    openarena-maps
+  ];
 
-    patchelf --set-interpreter "${interpreter}" "${gameDir}/openarena.${arch}"
-    patchelf --set-interpreter "${interpreter}" "${gameDir}/oa_ded.${arch}"
+  sourceRoot = "openarena-source";
 
-    makeWrapper "${gameDir}/openarena.${arch}" "$out/bin/openarena" \
-      --prefix LD_LIBRARY_PATH : "${libPath}"
-    makeWrapper "${gameDir}/oa_ded.${arch}" "$out/bin/oa_ded"
+  patches = [
+    # Fix Makefile `copyFiles` target
+    # Related upstream issue: https://github.com/OpenArena/engine/issues/83
+    (fetchpatch {
+      url = "https://github.com/OpenArena/engine/commit/f2b424bd332e90a1e2592edd21c62bdb8cd05214.patch";
+      hash = "sha256-legiXLtZAeG2t1esiBa37qkAgxPJVM7JLhjpxGUmWCo=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    curl
+    makeBinaryWrapper
+    pkg-config
+    which
+  ];
+
+  buildInputs = [
+    freetype
+    libglvnd
+    libogg
+    libvorbis
+    libxmp
+    openal
+    SDL2
+    speex
+  ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "USE_INTERNAL_LIBS=0"
+    "USE_FREETYPE=1"
+    "USE_OPENAL_DLOPEN=0"
+    "USE_CURL_DLOPEN=0"
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+  ];
+
+  installTargets = [ "copyfiles" ];
+  installFlags = [ "COPYDIR=$(out)/share/openarena" ];
+
+  preInstall = ''
+    mkdir -p $out/share/openarena
   '';
 
+  postInstall = ''
+    install -Dm644 misc/quake3.svg $out/share/icons/hicolor/scalable/apps/openarena.svg
+
+    makeWrapper $out/share/openarena/openarena.* $out/bin/openarena
+    makeWrapper $out/share/openarena/oa_ded.* $out/bin/oa_ded
+
+    ln -s ${openarena-maps}/baseoa $out/share/openarena/baseoa
+    ln -s ${openarena-maps}/missionpack $out/share/openarena/missionpack
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "OpenArena";
+      exec = "openarena";
+      icon = "openarena";
+      comment = "A fast-paced 3D first-person shooter, similar to id Software Inc.'s Quake III Arena";
+      desktopName = "openarena";
+      categories = [ "Game" "ActionGame" ];
+    })
+  ];
+
   meta = {
-    description = "Crossplatform openarena client";
+    description = "A fast-paced 3D first-person shooter, similar to id Software Inc.'s Quake III Arena";
     homepage = "http://openarena.ws/";
-    maintainers = [ lib.maintainers.wyvie ];
-    platforms = [ "i386-linux" "x86_64-linux" ];
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "openarena";
+    maintainers = with lib.maintainers; [ drupol wyvie ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/games/quake3/ioquake/default.nix b/pkgs/games/quake3/ioquake/default.nix
index f0d8ea56693b..73ee3bbb86a8 100644
--- a/pkgs/games/quake3/ioquake/default.nix
+++ b/pkgs/games/quake3/ioquake/default.nix
@@ -1,47 +1,52 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, which
 , pkg-config
+, which
+, copyDesktopItems
+, makeBinaryWrapper
 , SDL2
 , libGL
-, openalSoft
+, openal
 , curl
 , speex
 , opusfile
 , libogg
 , libvorbis
-, libopus
 , libjpeg
-, mumble
+, makeDesktopItem
 , freetype
 }:
 
 stdenv.mkDerivation {
   pname = "ioquake3";
-  version = "unstable-2022-11-24";
+  version = "unstable-2023-08-13";
 
   src = fetchFromGitHub {
     owner = "ioquake";
     repo = "ioq3";
-    rev = "70d07d91d62dcdd2f2268d1ac401bfb697b4c991";
-    sha256 = "sha256-WDjR0ik+xAs6OA1DNbUGIF1MXSuEoy8nNkPiHaegfF0=";
+    rev = "ee950eb7b0e41437cc23a9943254c958da8a61ab";
+    sha256 = "sha256-NfhInwrtw85i2mnv7EtBrrpNaslaQaVhLNlK0I9aYto=";
   };
 
-  nativeBuildInputs = [ which pkg-config ];
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeBinaryWrapper
+    pkg-config
+    which
+  ];
+
   buildInputs = [
     SDL2
     libGL
-    openalSoft
+    openal
     curl
     speex
     opusfile
     libogg
     libvorbis
-    libopus
     libjpeg
     freetype
-    mumble
   ];
 
   enableParallelBuilding = true;
@@ -50,17 +55,32 @@ stdenv.mkDerivation {
 
   installTargets = [ "copyfiles" ];
 
-  installFlags = [ "COPYDIR=$(out)" "COPYBINDIR=$(out)/bin" ];
+  installFlags = [ "COPYDIR=$(out)/share/ioquake3" ];
 
-  preInstall = ''
-    mkdir -p $out/baseq3 $out/bin
+  postInstall = ''
+    install -Dm644 misc/quake3.svg $out/share/icons/hicolor/scalable/apps/ioquake3.svg
+
+    makeWrapper $out/share/ioquake3/ioquake3.* $out/bin/ioquake3
+    makeWrapper $out/share/ioquake3/ioq3ded.* $out/bin/ioq3ded
   '';
 
-  meta = with lib; {
+  desktopItems = [
+    (makeDesktopItem {
+      name = "IOQuake3";
+      exec = "ioquake3";
+      icon = "ioquake3";
+      comment = "A fast-paced 3D first-person shooter, a community effort to continue supporting/developing id's Quake III Arena";
+      desktopName = "ioquake3";
+      categories = [ "Game" "ActionGame" ];
+    })
+  ];
+
+  meta = {
     homepage = "https://ioquake3.org/";
-    description = "First person shooter engine based on the Quake 3: Arena and Quake 3: Team Arena";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ rvolosatovs eelco abbradar ];
+    description = "A fast-paced 3D first-person shooter, a community effort to continue supporting/developing id's Quake III Arena";
+    license = lib.licenses.gpl2Only;
+    mainProgram = "ioquake3";
+    maintainers = with lib.maintainers; [ abbradar drupol eelco rvolosatovs ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
index 4429a804e80d..cc7c45e5e27f 100644
--- a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
+++ b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
@@ -1,21 +1,21 @@
-From 05b762c6ca58ecb5fd631a019fbda69b0647785f Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Tue, 22 Dec 2020 15:38:56 +0100
-Subject: [PATCH] Define configs with env vars
+From 3ec6fce101083d4f23641fd015cbe4ade317ad59 Mon Sep 17 00:00:00 2001
+From: Ember Keske <git@n0emis.eu>
+Date: Wed, 2 Aug 2023 06:36:02 +0200
+Subject: [PATCH 1/2] Define configs with env vars
 
 ---
- app.php                      | 4 ++--
+ app.php                      | 6 +++---
  services/DatabaseService.php | 2 +-
  services/FilesService.php    | 2 +-
- services/StockService.php    | 3 +--
- 4 files changed, 5 insertions(+), 6 deletions(-)
+ services/StockService.php    | 2 +-
+ 4 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/app.php b/app.php
-index 17ba6a99..89f48089 100644
+index 31905be6..30b3eb82 100644
 --- a/app.php
 +++ b/app.php
-@@ -11,7 +11,7 @@ use Slim\Views\Blade;
- require_once __DIR__ . '/vendor/autoload.php';
+@@ -12,7 +12,7 @@ use Slim\Views\Blade;
+ require_once __DIR__ . '/packages/autoload.php';
  
  // Load config files
 -require_once GROCY_DATAPATH . '/config.php';
@@ -23,7 +23,7 @@ index 17ba6a99..89f48089 100644
  require_once __DIR__ . '/config-dist.php'; // For not in own config defined values we use the default ones
  require_once __DIR__ . '/helpers/ConfigurationValidator.php';
  
-@@ -62,7 +62,7 @@ $app = AppFactory::create();
+@@ -63,7 +63,7 @@ $app = AppFactory::create();
  
  $container = $app->getContainer();
  $container->set('view', function (Container $container) {
@@ -32,11 +32,20 @@ index 17ba6a99..89f48089 100644
  });
  
  $container->set('UrlManager', function (Container $container) {
+@@ -103,7 +103,7 @@ $errorMiddleware->setDefaultErrorHandler(
+ 
+ $app->add(new CorsMiddleware($app->getResponseFactory()));
+ 
+-$app->getRouteCollector()->setCacheFile(GROCY_DATAPATH . '/viewcache/route_cache.php');
++$app->getRouteCollector()->setCacheFile(getenv('GROCY_CACHE_DIR') . '/route_cache.php');
+ 
+ ob_clean(); // No response output before here
+ $app->run();
 diff --git a/services/DatabaseService.php b/services/DatabaseService.php
-index c093f361..0894791f 100644
+index be5486b6..b6091ee7 100644
 --- a/services/DatabaseService.php
 +++ b/services/DatabaseService.php
-@@ -114,6 +114,6 @@ class DatabaseService
+@@ -104,6 +104,6 @@ class DatabaseService
  			return GROCY_DATAPATH . '/grocy_' . $dbSuffix . '.db';
  		}
  
@@ -58,19 +67,18 @@ index 7d070350..a6dd4b08 100644
  		{
  			mkdir($this->StoragePath);
 diff --git a/services/StockService.php b/services/StockService.php
-index 85f57803..15556112 100644
+index 16cb468c..23228803 100644
 --- a/services/StockService.php
 +++ b/services/StockService.php
-@@ -1704,8 +1704,7 @@ class StockService extends BaseService
+@@ -1769,7 +1769,7 @@ class StockService extends BaseService
  			throw new \Exception('No barcode lookup plugin defined');
  		}
  
 -		$path = GROCY_DATAPATH . "/plugins/$pluginName.php";
--
 +		$path = getenv('GROCY_PLUGIN_DIR') . "/$pluginName.php";
+ 
  		if (file_exists($path))
  		{
- 			require_once $path;
 -- 
-2.38.1
+2.41.0
 
diff --git a/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
index b065ca801d5f..5b6ae862dcb6 100644
--- a/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
+++ b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
@@ -1,6 +1,6 @@
-From c46323dfc4a3d5bf17f7508f5b5f223858a598c3 Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Tue, 22 Dec 2020 15:39:15 +0100
+From 0e834aa0ef712ce97acf24c05c43a04387fda18c Mon Sep 17 00:00:00 2001
+From: Ember Keske <git@n0emis.eu>
+Date: Wed, 2 Aug 2023 06:36:46 +0200
 Subject: [PATCH 2/2] Remove check for config-file as it's stored in /etc/grocy
 
 ---
@@ -8,17 +8,17 @@ Subject: [PATCH 2/2] Remove check for config-file as it's stored in /etc/grocy
  1 file changed, 1 deletion(-)
 
 diff --git a/helpers/PrerequisiteChecker.php b/helpers/PrerequisiteChecker.php
-index cbe0a3a..a484db2 100644
+index da431b4b..6b878627 100644
 --- a/helpers/PrerequisiteChecker.php
 +++ b/helpers/PrerequisiteChecker.php
-@@ -11,7 +11,6 @@ class PrerequisiteChecker
- {
+@@ -17,7 +17,6 @@ class PrerequisiteChecker
  	public function checkRequirements()
  	{
+ 		self::checkForPhpVersion();
 -		self::checkForConfigFile();
  		self::checkForConfigDistFile();
  		self::checkForComposer();
  		self::checkForPhpExtensions();
 -- 
-2.29.2
+2.41.0
 
diff --git a/pkgs/servers/grocy/default.nix b/pkgs/servers/grocy/default.nix
index bbae0f8f248f..5777245d6780 100644
--- a/pkgs/servers/grocy/default.nix
+++ b/pkgs/servers/grocy/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grocy";
-  version = "3.3.2";
+  version = "4.0.0";
 
   src = fetchurl {
     url = "https://github.com/grocy/grocy/releases/download/v${version}/grocy_${version}.zip";
-    sha256 = "sha256-KF4zxrC8rlRUaBKc4iLIt6TSAHMJ+tOWptMsVcixVWs=";
+    sha256 = "sha256-Sei+UYM5azzSWgnmgufxDl5ySbYJ52DBGPc0nTjnqqc=";
   };
 
   nativeBuildInputs = [ unzip ];
@@ -33,9 +33,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     license = licenses.mit;
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ n0emis ];
     description = "ERP beyond your fridge - grocy is a web-based self-hosted groceries & household management solution for your home";
     homepage = "https://grocy.info/";
-    broken = true; # Not compatible with PHP 8.1
   };
 }
diff --git a/pkgs/servers/honk/default.nix b/pkgs/servers/honk/default.nix
index cdcc0ddb63ac..8b968dc49eea 100644
--- a/pkgs/servers/honk/default.nix
+++ b/pkgs/servers/honk/default.nix
@@ -1,21 +1,35 @@
-{ lib, buildGoModule, fetchurl, installShellFiles, sqlite }:
+{ lib
+, buildGoModule
+, fetchurl
+, sqlite
+, installShellFiles
+}:
 
 buildGoModule rec {
   pname = "honk";
-  version = "0.9.91";
+  version = "1.0.0";
 
   src = fetchurl {
     url = "https://humungus.tedunangst.com/r/honk/d/honk-${version}.tgz";
-    hash = "sha256-+NFWTTMVdngWsC8/EIN2xJC/5C4naaAekk/YoA17wFk=";
+    hash = "sha256-+0W9HncN+51dRE9bWJU4cAfYOc5bxNAqPe4xY+4UFg0=";
   };
   vendorHash = null;
 
-  buildInputs = [ sqlite ];
-  nativeBuildInputs = [ installShellFiles ];
+  buildInputs = [
+    sqlite
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   subPackages = [ "." ];
 
+  # This susbtitution is not mandatory. It is only existing to have something
+  # working out of the box. This value can be overriden by the user, by
+  # providing the `-viewdir` parameter in the command line.
   postPatch = ''
-    substituteInPlace honk.go --replace \
+    substituteInPlace main.go --replace \
       "var viewDir = \".\"" \
       "var viewDir = \"$out/share/honk\""
   '';
@@ -35,10 +49,12 @@ buildGoModule rec {
     mv views $out/share/${pname}
   '';
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://humungus.tedunangst.com/r/honk/v/v${version}/f/docs/changelog.txt";
     description = "An ActivityPub server with minimal setup and support costs.";
     homepage = "https://humungus.tedunangst.com/r/honk";
-    license = licenses.isc;
-    maintainers = with maintainers; [ huyngo ];
+    license = lib.licenses.isc;
+    mainProgram = "honk";
+    maintainers = with lib.maintainers; [ huyngo ];
   };
 }
diff --git a/pkgs/servers/monitoring/prometheus/bind-exporter.nix b/pkgs/servers/monitoring/prometheus/bind-exporter.nix
index 8610a888c48a..1ee84e5e703a 100644
--- a/pkgs/servers/monitoring/prometheus/bind-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/bind-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bind_exporter";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "prometheus-community";
     repo = "bind_exporter";
-    sha256 = "sha256-qyTfo4Pkp07v575p7SePwe/OfCZRVuHKGyaEQQOkYjk=";
+    sha256 = "sha256-x/XGatlXCKo9cI92JzFItApsjuZAfZX+8IZRpy7PVUo=";
   };
 
-  vendorHash = "sha256-ZQKQY7budLH6eAusLMwSF5cLJ6QdiXLJc29xJk+XBxI=";
+  vendorHash = "sha256-f0ei/zotOj5ebURAOWUox/7J3jS2abQ5UgjninI9nRk=";
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) bind; };
 
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index c2c28812a401..a7c136ba691f 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.11.1";
+  version = "2.11.2";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl libkrb5 ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "timescale";
     repo = "timescaledb";
     rev = version;
-    sha256 = "sha256-nThflLfHvcEqJo1dz8PVca0ux7KJOW66nZ3dV1yTOCM=";
+    sha256 = "sha256-c2fztGtl2cLThT0JhHCM0UaYkiWTp5T6TUZ3Au7CG7c=";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" "-DTAP_CHECKS=OFF" ]
diff --git a/pkgs/servers/web-apps/dolibarr/default.nix b/pkgs/servers/web-apps/dolibarr/default.nix
index c2e0bfd238e7..9c94ad3bd545 100644
--- a/pkgs/servers/web-apps/dolibarr/default.nix
+++ b/pkgs/servers/web-apps/dolibarr/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dolibarr";
-  version = "16.0.4";
+  version = "16.0.5";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
     rev = version;
-    sha256 = "sha256-H0f12pEsRxq6cYrcCjjQF1b5PFQEPBfYhZ5YnBfIbHk=";
+    sha256 = "sha256-+OAkUMwLXZGFPQocJARIG//+0V1Dv5MdZvythbp4KPw=";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index 46bce07f3e66..402af6119636 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.170";
+  version = "3.0.177";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-PHrut4w66v/TBFZqFoopNJTDhuIjaKdiqA6pHxMKEC0=";
+    sha256 = "sha256-A63cRbIEXsX8mmbbXqsT7athWN8vrZLRnUyurb0HNDA=";
   };
 
-  vendorHash = "sha256-XM/ATJVTyhv85KI2aUTufVDzYZMLTegtNuT3JEsU5vM=";
+  vendorHash = "sha256-81z4bflVzDCl6IiYnTwFPsLHXq87OiKv4aDmZq05Nqc=";
 
   subPackages = [ "main" ];
 
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index 67e7f453eb5c..e7b1727c1603 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -30,13 +30,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.22.4";
+  version = "0.22.6";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-t5uD/1SryxlCA1IPYPTL2nTov+cDzGdprs+J06vpLKI=";
+    sha256 = "sha256-/7iJbl9MFe5D9g+4a8nFavZG3jXIiEgKU3toGpx0hyM=";
   };
 
   vendorHash = "sha256-CwozOBAPFSsa1XzDOHBgmFSwGiNekWT8t7KGR2KOOX4=";
diff --git a/pkgs/tools/security/argocd-vault-plugin/default.nix b/pkgs/tools/security/argocd-vault-plugin/default.nix
index 6dab3a98d9ab..d2557b36dc2e 100644
--- a/pkgs/tools/security/argocd-vault-plugin/default.nix
+++ b/pkgs/tools/security/argocd-vault-plugin/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd-vault-plugin";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "argoproj-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9gM4CD3MbZX3ZCZ3XCAkdOkE381jgGvg/swto4B74g8=";
+    hash = "sha256-7bUpshg+OqlS5wvFkZkovQVaLglvSpp7FsVA9qNOk1U=";
   };
 
   vendorHash = "sha256-r9Pcm95gU0QTiREdiQiyJMOKZb5Lt2bIJywLerzgbdg=";
diff --git a/pkgs/tools/security/buttercup-desktop/default.nix b/pkgs/tools/security/buttercup-desktop/default.nix
index f3cb86b6ba7b..4138acb2cedf 100644
--- a/pkgs/tools/security/buttercup-desktop/default.nix
+++ b/pkgs/tools/security/buttercup-desktop/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "buttercup-desktop";
-  version = "2.20.2";
+  version = "2.20.3";
   src = fetchurl {
     url = "https://github.com/buttercup/buttercup-desktop/releases/download/v${version}/Buttercup-linux-x86_64.AppImage";
-    sha256 = "sha256-fcWLnJUvsSwDLHL8TiYEGnQQ+KgkmZIGuWG4Xavbx5I=";
+    sha256 = "sha256-e7CZjJSkAAkNn73Z3cg+D5SUdReBp6pqz7zKrbkHs38=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname src version; };
 
diff --git a/pkgs/tools/security/faraday-agent-dispatcher/default.nix b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
index dc05255bc7ed..39f9398260f1 100644
--- a/pkgs/tools/security/faraday-agent-dispatcher/default.nix
+++ b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
@@ -5,16 +5,21 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "faraday-agent-dispatcher";
-  version = "2.4.0";
+  version = "2.6.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "infobyte";
     repo = "faraday_agent_dispatcher";
     rev = "refs/tags/${version}";
-    hash = "sha256-gZXA+2zW25Dl8JmBgg7APZt6ZdpFOEFZXAkiZ+tn/4g=";
+    hash = "sha256-+lsejepg/iBHo6CRAGNHjiUC7ZgboHbKu7EDmlN3lVk=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace '"pytest-runner",' ""
+  '';
+
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
   ];
@@ -26,6 +31,7 @@ python3.pkgs.buildPythonApplication rec {
     faraday-plugins
     itsdangerous
     psutil
+    pytenable
     python-gvm
     python-owasp-zap-v2-4
     pyyaml
@@ -39,11 +45,6 @@ python3.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"pytest-runner",' ""
-  '';
-
   preCheck = ''
     export HOME=$(mktemp -d);
   '';
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 9fc66896ef59..6383d0f51d7c 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.9.10";
+  version = "2.9.11";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FpgKOUycSiA0llEvJK71+LnITSTxPkP+Wt5a14Vfwas=";
+    hash = "sha256-OZAHB1QmdZSARHF7Nd8SzmTGfRk4Wi/89nVYjW0Cpso=";
   };
 
-  vendorHash = "sha256-g8+tkGqsXROj157sdUMfZMh7+5+dxd3mIxr5KY/mWO8=";
+  vendorHash = "sha256-L8EwfyYtsnQChs0KQW2e/tU3zKua1HdDX91YX5ay9qo=";
 
   modRoot = "./v2";
   subPackages = [