diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 7d46bdbd4d48..2f65afc796c5 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage rec {
     description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = "https://github.com/BurntSushi/ripgrep";
     license = licenses.unlicense;
-    maintainers = [ maintainers.tailhook ];
+    maintainers = [];
   };
 }
 ```
@@ -926,7 +926,7 @@ rustPlatform.buildRustPackage rec {
     description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = "https://github.com/BurntSushi/ripgrep";
     license = with licenses; [ mit unlicense ];
-    maintainers = with maintainers; [ tailhook ];
+    maintainers = with maintainers; [];
   };
 }
 ```
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 7668abe6174f..52147129adda 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -18,6 +18,8 @@
 
 - [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable).
 
+- [Typesense](https://github.com/typesense/typesense), a fast, typo-tolerant search engine for building delightful search experiences. Available as [services.typesense](#opt-services.typesense.enable).
+
 - [Anuko Time Tracker](https://github.com/anuko/timetracker), a simple, easy to use, open source time tracking system. Available as [services.anuko-time-tracker](#opt-services.anuko-time-tracker.enable).
 
 - [sitespeed-io](https://sitespeed.io), a tool that can generate metrics (timings, diagnostics) for websites. Available as [services.sitespeed-io](#opt-services.sitespeed-io.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 06a84abbdfb7..e6b6d2487d98 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1110,6 +1110,7 @@
   ./services/search/meilisearch.nix
   ./services/search/opensearch.nix
   ./services/search/qdrant.nix
+  ./services/search/typesense.nix
   ./services/security/aesmd.nix
   ./services/security/authelia.nix
   ./services/security/certmgr.nix
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 1005e34d379f..b8d2bfe0ffca 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -577,7 +577,7 @@ in
       '';
 
       serviceConfig = {
-        Type = "notify";
+        Type = "simple";
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.stateDir;
diff --git a/nixos/modules/services/search/typesense.nix b/nixos/modules/services/search/typesense.nix
new file mode 100644
index 000000000000..856c3cad22df
--- /dev/null
+++ b/nixos/modules/services/search/typesense.nix
@@ -0,0 +1,125 @@
+{ config, lib, pkgs, ... }: let
+  inherit
+    (lib)
+    concatMapStringsSep
+    generators
+    mdDoc
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalString
+    types
+    ;
+
+  cfg = config.services.typesense;
+  settingsFormatIni = pkgs.formats.ini {
+    listToValue = concatMapStringsSep " " (generators.mkValueStringDefault { });
+    mkKeyValue = generators.mkKeyValueDefault
+      {
+        mkValueString = v:
+          if v == null then ""
+          else generators.mkValueStringDefault { } v;
+      }
+      "=";
+  };
+  configFile = settingsFormatIni.generate "typesense.ini" cfg.settings;
+in {
+  options.services.typesense = {
+    enable = mkEnableOption "typesense";
+    package = mkPackageOption pkgs "typesense" {};
+
+    apiKeyFile = mkOption {
+      type = types.path;
+      description = ''
+        Sets the admin api key for typesense. Always use this option
+        instead of {option}`settings.server.api-key` to prevent the key
+        from being written to the world-readable nix store.
+      '';
+    };
+
+    settings = mkOption {
+      description = mdDoc "Typesense configuration. Refer to [the documentation](https://typesense.org/docs/0.24.1/api/server-configuration.html) for supported values.";
+      default = {};
+      type = types.submodule {
+        freeformType = settingsFormatIni.type;
+        options.server = {
+          data-dir = mkOption {
+            type = types.str;
+            default = "/var/lib/typesense";
+            description = mdDoc "Path to the directory where data will be stored on disk.";
+          };
+
+          api-address = mkOption {
+            type = types.str;
+            description = mdDoc "Address to which Typesense API service binds.";
+          };
+
+          api-port = mkOption {
+            type = types.port;
+            default = 8108;
+            description = mdDoc "Port on which the Typesense API service listens.";
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.typesense = {
+      description = "Typesense search engine";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      script = ''
+        export TYPESENSE_API_KEY=$(cat ${cfg.apiKeyFile})
+        exec ${cfg.package}/bin/typesense-server --config ${configFile}
+      '';
+
+      serviceConfig = {
+        Restart = "on-failure";
+        DynamicUser = true;
+        User = "typesense";
+        Group = "typesense";
+
+        StateDirectory = "typesense";
+        StateDirectoryMode = "0700";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 66d7d064291b..521e12d4b86c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -808,6 +808,7 @@ in {
   turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix {};
   tuxguitar = handleTest ./tuxguitar.nix {};
   twingate = runTest ./twingate.nix;
+  typesense = handleTest ./typesense.nix {};
   ucarp = handleTest ./ucarp.nix {};
   udisks2 = handleTest ./udisks2.nix {};
   ulogd = handleTest ./ulogd.nix {};
diff --git a/nixos/tests/typesense.nix b/nixos/tests/typesense.nix
new file mode 100644
index 000000000000..4f07a2e194be
--- /dev/null
+++ b/nixos/tests/typesense.nix
@@ -0,0 +1,23 @@
+import ./make-test-python.nix ({ pkgs, ... }: let
+  testPort = 8108;
+in {
+  name = "typesense";
+  meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
+
+  nodes.machine = { ... }: {
+    services.typesense = {
+      enable = true;
+      apiKeyFile = pkgs.writeText "typesense-api-key" "dummy";
+      settings.server = {
+        api-port = testPort;
+        api-address = "0.0.0.0";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("typesense.service")
+    machine.wait_for_open_port(${toString testPort})
+    assert machine.succeed("curl --fail http://localhost:${toString testPort}/health") == '{"ok":true}'
+  '';
+})
diff --git a/pkgs/applications/editors/codux/default.nix b/pkgs/applications/editors/codux/default.nix
index 9a5c3c290111..ff068b259353 100644
--- a/pkgs/applications/editors/codux/default.nix
+++ b/pkgs/applications/editors/codux/default.nix
@@ -5,11 +5,11 @@
 
 let
   pname = "codux";
-  version = "15.4.4";
+  version = "15.6.1";
 
   src = fetchurl {
     url = "https://github.com/wixplosives/codux-versions/releases/download/${version}/Codux-${version}.x86_64.AppImage";
-    sha256 = "sha256-6XLKXw+e/310mCQxM/X/kzok562vGjEhmF1eLfakB4Q=";
+    sha256 = "sha256-a8zv5pVtS80J2PTrUiW8AA3rJ+rPAAzaaT5DVBLK5JE=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/applications/emulators/cemu/default.nix b/pkgs/applications/emulators/cemu/default.nix
index 7e28602bd4fb..49d9779c4095 100644
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cemu";
-  version = "2.0-44";
+  version = "2.0-45";
 
   src = fetchFromGitHub {
     owner = "cemu-project";
     repo = "Cemu";
     rev = "v${version}";
-    hash = "sha256-tvdQZ8FOoB2/+JBA41dpZYJnkBxQMX8ZfBQJ7B6NjYk=";
+    hash = "sha256-Bi2ws08e+6rNv83ypLrgB/KZWt95i7UkFrqhCr/0Zko=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/browsers/netsurf/browser.nix b/pkgs/applications/networking/browsers/netsurf/browser.nix
index 72eeda815295..d529ba2f9380 100644
--- a/pkgs/applications/networking/browsers/netsurf/browser.nix
+++ b/pkgs/applications/networking/browsers/netsurf/browser.nix
@@ -55,6 +55,17 @@ stdenv.mkDerivation rec {
   ++ optional (uilib == "gtk3") gtk3
   ;
 
+  # Since at least 2018 AD, GCC and other compilers run in `-fno-common` mode as
+  # default, in order to comply with C standards and also get rid of some bad
+  # quality code. Because of this, many codebases that weren't updated need to
+  # be patched -- or the `-fcommon` flag should be explicitly passed to the
+  # compiler
+
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85678
+  # https://github.com/NixOS/nixpkgs/issues/54506
+
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
+
   preConfigure = ''
     cat <<EOF > Makefile.conf
     override NETSURF_GTK_RES_PATH  := $out/share/
diff --git a/pkgs/applications/networking/cluster/docker-machine/default.nix b/pkgs/applications/networking/cluster/docker-machine/default.nix
index e6a907347ce4..7fd163f6968a 100644
--- a/pkgs/applications/networking/cluster/docker-machine/default.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/default.nix
@@ -27,7 +27,7 @@ buildGoPackage rec {
     homepage = "https://docs.docker.com/machine/";
     description = "Docker Machine is a tool that lets you install Docker Engine on virtual hosts, and manage Docker Engine on the hosts";
     license = licenses.asl20;
-    maintainers = with maintainers; [ offline tailhook ];
+    maintainers = with maintainers; [ offline ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 29059d74b7c7..bb696b4087fc 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -20,12 +20,12 @@
 
 buildGoModule rec {
   pname = "gitea";
-  version = "1.20.0";
+  version = "1.20.1";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://dl.gitea.com/gitea/${version}/gitea-src-${version}.tar.gz";
-    hash = "sha256-ME2ZYSeaHru/7wBFBmXLpf9dKpl0WrtrmAqmzw37tq4=";
+    hash = "sha256-LYOCNZJiGuMM1ly1Sp+0F8Us8LtAXzH5NzJf2CLcHck=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index ce5bc9793805..79f39f949ece 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -265,7 +265,7 @@ rec {
         To enable the docker daemon on NixOS, set the `virtualisation.docker.enable` option to `true`.
       '';
       license = licenses.asl20;
-      maintainers = with maintainers; [ offline tailhook vdemeester periklis mikroskeem maxeaubrey ];
+      maintainers = with maintainers; [ offline vdemeester periklis mikroskeem maxeaubrey ];
     };
   });
 
diff --git a/pkgs/desktops/xfce/applications/mousepad/default.nix b/pkgs/desktops/xfce/applications/mousepad/default.nix
index d78a51660f64..47c84b036eeb 100644
--- a/pkgs/desktops/xfce/applications/mousepad/default.nix
+++ b/pkgs/desktops/xfce/applications/mousepad/default.nix
@@ -5,6 +5,7 @@
 , gtk3
 , gtksourceview4
 , gspell
+, enablePolkit ? true
 , polkit
 }:
 
@@ -23,7 +24,8 @@ mkXfceDerivation {
     gtk3
     gtksourceview4
     gspell
-    polkit # optional polkit support
+  ] ++ lib.optionals enablePolkit [
+    polkit
   ];
 
   # Use the GSettings keyfile backend rather than DConf
diff --git a/pkgs/development/coq-modules/coq-lsp/default.nix b/pkgs/development/coq-modules/coq-lsp/default.nix
index 00a56496a2d7..1a015ce83d20 100644
--- a/pkgs/development/coq-modules/coq-lsp/default.nix
+++ b/pkgs/development/coq-modules/coq-lsp/default.nix
@@ -7,13 +7,13 @@ mkCoqDerivation rec {
 
   useDune = true;
 
-  release."0.1.6.1+8.16".sha256 = "sha256-aX8/pN4fVYaF7ZEPYfvYpEZLiQM++ZG1fAhiLftQ9Aw=";
-  release."0.1.6.1+8.17".sha256 = "sha256-je+OlKM7x3vYB36sl406GREAWB4ePmC0ewHS6rCmWfk=";
+  release."0.1.7+8.16".sha256 = "sha256-ZBxwrnnCmT5q4C7ocQ+M+aSJQNnEjeN2HFw4bzPozYs=";
+  release."0.1.7+8.17".sha256 = "sha256-f671wzGQannGjRbmBRHFKXz24BTPX7oVeHUxnv4Vd6Y=";
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = isEq "8.16"; out = "0.1.6.1+8.16"; }
-    { case = isEq "8.17"; out = "0.1.6.1+8.17"; }
+    { case = isEq "8.16"; out = "0.1.7+8.16"; }
+    { case = isEq "8.17"; out = "0.1.7+8.17"; }
   ] null;
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/libraries/libcef/default.nix b/pkgs/development/libraries/libcef/default.nix
index e648492b55c9..a5e6bf40de03 100644
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@@ -66,16 +66,16 @@ let
       projectArch = "x86_64";
     };
   };
-  platforms."aarch64-linux".sha256 = "1lymwdc0199nx46ah617hig85nghjwp4m97rcagfjb490rsn4kpg";
-  platforms."x86_64-linux".sha256 = "0nh3rknnirm59ppcndifpzmay16018ahp2vxmfbkyx54pl10n3d9";
+  platforms."aarch64-linux".sha256 = "0px1v7gcfxrad8ap1g93nx3aqx9yklz385yaciki5s9hnjr3rwpr";
+  platforms."x86_64-linux".sha256 = "134cvgdklybf15msdbjxpcpsl06s8w91px530241yhhrx4jvzj51";
 
   platformInfo = builtins.getAttr stdenv.targetPlatform.system platforms;
 in
 stdenv.mkDerivation rec {
   pname = "cef-binary";
-  version = "114.2.12";
-  gitRevision = "7c09f21";
-  chromiumVersion = "114.0.5735.199";
+  version = "114.2.13";
+  gitRevision = "6792e13";
+  chromiumVersion = "114.0.5735.200";
 
   src = fetchurl {
     url = "https://cef-builds.spotifycdn.com/cef_binary_${version}+g${gitRevision}+chromium-${chromiumVersion}_${platformInfo.platformStr}_minimal.tar.bz2";
diff --git a/pkgs/development/libraries/libglibutil/default.nix b/pkgs/development/libraries/libglibutil/default.nix
index 29543cae2e12..6cba6bcf8a16 100644
--- a/pkgs/development/libraries/libglibutil/default.nix
+++ b/pkgs/development/libraries/libglibutil/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libglibutil";
-  version = "1.0.69";
+  version = "1.0.71";
 
   src = fetchFromGitHub {
     owner = "sailfishos";
     repo = pname;
     rev = version;
-    sha256 = "sha256-+4aAujSmdrcRMnTd6wHHbyQBfC1LRskZ+8MA2d3hDnI=";
+    sha256 = "sha256-I58XN1Ku5VVmxuTZ6yPm8jWGKscwLOhetWC+6B6EZRE=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index df6e87d5a5e4..00086dfedcec 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -2,14 +2,14 @@
 
 let
   pname = "phpstan";
-  version = "1.10.15";
+  version = "1.10.26";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "sha256-zGrAgQttAvGdRpuOB3V/GprMzc2NMya4d3MY1SIfYOQ=";
+    sha256 = "sha256-YDRUVctcUs9wUyL/rCUT9W9at+0118VpbV371+amyvg=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/anthropic/default.nix b/pkgs/development/python-modules/anthropic/default.nix
index c1812f33271b..b9248fcb8716 100644
--- a/pkgs/development/python-modules/anthropic/default.nix
+++ b/pkgs/development/python-modules/anthropic/default.nix
@@ -1,43 +1,55 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, setuptools
+, fetchFromGitHub
+, poetry-core
+, anyio
+, distro
 , httpx
-, importlib-metadata
-, requests
+, pydantic
+, pytest-asyncio
+, respx
 , tokenizers
-, aiohttp
+, typing-extensions
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "anthropic";
-  version = "0.2.10";
+  version = "0.3.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-5NoGGobY/7hgcsCw/q8hmjpPff3dQiTfm6dp5GlJjBk=";
+  src = fetchFromGitHub {
+    owner = "anthropics";
+    repo = "anthropic-sdk-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dfMlM7IRP1PG7Ynr+MR4OPeKnHBbhhWKSug7UQ4/4rI=";
   };
 
   nativeBuildInputs = [
-    setuptools
+    poetry-core
   ];
 
   propagatedBuildInputs = [
+    anyio
+    distro
     httpx
-    requests
+    pydantic
     tokenizers
-    aiohttp
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
+    typing-extensions
   ];
 
-  # try downloading tokenizer in tests
-  # relates https://github.com/anthropics/anthropic-sdk-python/issues/24
-  doCheck = false;
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    respx
+  ];
+
+  disabledTests = [
+    "api_resources"
+  ];
 
   pythonImportsCheck = [
     "anthropic"
@@ -49,5 +61,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/anthropics/anthropic-sdk-python/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ natsukium ];
+    broken = lib.versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index 5ab6dc145f9f..edbd9433fb09 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "fiona";
-  version = "1.9.4";
+  version = "1.9.4.post1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "Toblerity";
     repo = "Fiona";
     rev = "refs/tags/${version}";
-    hash = "sha256-v4kTjoGu4AiEepBrGyY1e1OFC1eCk/U6f8XA/vtfY0E=";
+    hash = "sha256-CeGdWAmWteVtL0BoBQ1sB/+1AWkmxogtK99bL5Fpdbw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/galois/default.nix b/pkgs/development/python-modules/galois/default.nix
index f0e07e6e2923..4012144710c8 100644
--- a/pkgs/development/python-modules/galois/default.nix
+++ b/pkgs/development/python-modules/galois/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "galois";
-  version = "0.3.4";
+  version = "0.3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mhostetter";
     repo = "galois";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yvF57ErcaknKcK6UgINt65uASNZpEtXk+LOizYDH1Bo=";
+    hash = "sha256-4eYDaQwjnYCTnobXRtFrToRyxxH2N2n9sh8z7oPC2Wc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -50,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python package that extends NumPy arrays to operate over finite fields";
     homepage = "https://github.com/mhostetter/galois";
+    changelog = "https://github.com/mhostetter/galois/releases/tag/v${version}";
     downloadPage = "https://github.com/mhostetter/galois/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ chrispattison ];
diff --git a/pkgs/development/python-modules/peft/default.nix b/pkgs/development/python-modules/peft/default.nix
index 54b93e69f11e..8bd8b1a924f6 100644
--- a/pkgs/development/python-modules/peft/default.nix
+++ b/pkgs/development/python-modules/peft/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, pytestCheckHook
 , setuptools
 , numpy
 , packaging
@@ -15,16 +14,16 @@
 
 buildPythonPackage rec {
   pname = "peft";
-  version = "0.3.0";
+  version = "0.4.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7j//SDuld2ANxEcG4R0rK5vEaTX7gQwWRH56PO2KqAY=";
+    hash = "sha256-riOCe43/2xUpE6TTCEpMndeFTbaBN4JFDlv90tqVO4Y=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -39,7 +38,7 @@ buildPythonPackage rec {
     accelerate
   ];
 
-  doCheck = false;  # tried to download pretrained model
+  doCheck = false;  # tries to download pretrained models
   pythonImportsCheck = [
     "peft"
   ];
diff --git a/pkgs/development/python-modules/pysnooper/default.nix b/pkgs/development/python-modules/pysnooper/default.nix
index e8a6727ae694..9cebc9d7bc7a 100644
--- a/pkgs/development/python-modules/pysnooper/default.nix
+++ b/pkgs/development/python-modules/pysnooper/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pysnooper";
-  version = "1.1.1";
+  version = "1.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "PySnooper";
-    hash = "sha256-0X3JHMoVk8ECMNzkXkax0/8PiRDww46UHt9roSYLOCA=";
+    hash = "sha256-gQZp4WKiUKBm2GYuVzrbxa93DpN8W1V48ou3NV0chZs=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/sshfs/default.nix b/pkgs/development/python-modules/sshfs/default.nix
index 4653189fbf63..653b30f14d0c 100644
--- a/pkgs/development/python-modules/sshfs/default.nix
+++ b/pkgs/development/python-modules/sshfs/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "sshfs";
-  version = "2023.4.1";
+  version = "2023.7.0";
 
   src = fetchFromGitHub {
     owner = "fsspec";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-qoOqKXtmavKgfbg6bBEeZb+n1RVyZSxqhKIQsToxDUU=";
+    hash = "sha256-XKBpB3ackquVKsdF8b/45Kaz5Y2ussOl0o0HkD+k9tM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/torchvision/bin.nix b/pkgs/development/python-modules/torchvision/bin.nix
index bc33961c097b..e1ec53671141 100644
--- a/pkgs/development/python-modules/torchvision/bin.nix
+++ b/pkgs/development/python-modules/torchvision/bin.nix
@@ -28,13 +28,14 @@ in buildPythonPackage {
 
   disabled = (pythonOlder "3.8") || (pythonAtLeast "3.12");
 
-  buildInputs = with cudaPackages; [
+  # Note that we don't rely on config.cudaSupport here, because the Linux wheels all come built with CUDA support.
+  buildInputs = with cudaPackages; lib.optionals stdenv.isLinux [
     # $out/${sitePackages}/torchvision/_C.so wants libcudart.so.11.0 but torchvision.libs only ships
     # libcudart.$hash.so.11.0
     cuda_cudart
   ];
 
-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals stdenv.isLinux [
     autoPatchelfHook
     addOpenGLRunpath
   ];
@@ -49,7 +50,7 @@ in buildPythonPackage {
 
   pythonImportsCheck = [ "torchvision" ];
 
-  preInstall = ''
+  preInstall = lib.optionalString stdenv.isLinux ''
     addAutoPatchelfSearchPath "${torch-bin}/${python.sitePackages}/torch"
   '';
 
@@ -62,7 +63,7 @@ in buildPythonPackage {
     # https://www.intel.com/content/www/us/en/developer/articles/license/onemkl-license-faq.html
     license = licenses.bsd3;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" ];
     maintainers = with maintainers; [ junjihashimoto ];
   };
 }
diff --git a/pkgs/development/python-modules/turnt/default.nix b/pkgs/development/python-modules/turnt/default.nix
index 9a327f344fba..1fe1d303856d 100644
--- a/pkgs/development/python-modules/turnt/default.nix
+++ b/pkgs/development/python-modules/turnt/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "turnt";
-  version = "1.10.0";
+  version = "1.11.0";
   format = "flit";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pwUNmUvyUYxke39orGkziL3DVRWoJY5AQLz/pTyf3M8=";
+    hash = "sha256-XN+qzRgZMSdeBmW0OM36mQ79sRCuP8E++SqH8FOoEq0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index c6aeeebc8d23..47ee7bc3fc29 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.212.0";
+  version = "0.213.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "sha256-0ratY4ZR+OD7lbf0fKJXrGFKzXgp+GRDS+WsJeb7gIU=";
+    sha256 = "sha256-6w09lo1+gBiFU481a6wYGQmJ61yVwQhMOll7QUeXy0U=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/dprint/default.nix b/pkgs/development/tools/dprint/default.nix
index 533c9a5f70ce..a1cf5f02783f 100644
--- a/pkgs/development/tools/dprint/default.nix
+++ b/pkgs/development/tools/dprint/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dprint";
-  version = "0.37.1";
+  version = "0.39.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-iDLydTwMJHalqtPLdSirr11AoVsdR+0er0kfB2+C1MA=";
+    sha256 = "sha256-aJHNVhZ1pWnPErPmFXy2AfZNtGWcYjuGChJ3fGsAOSA=";
   };
 
-  cargoHash = "sha256-z1DYbxeif4UJXRwEnEWfgALHR/iyVfQ2vD8AWEsC/2U=";
+  cargoHash = "sha256-9uZm0jCl9Bu2GNEa1lphQLzMEOWzkWlb6OESPm14AJ4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index 6dec4e64543b..283949b3617e 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.27054";
+  version = "0.1.27660";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-t273BD2plrsBKQqYg1EHdPIXR3qs9coHhTc/k5297cw=";
+    sha256 = "sha256-bor2rQfyvUD6SYSxYYTTL7TvvFuZ0oZdN0E+HoVCo28=";
   };
 
-  vendorHash = "sha256-IUDiKAwhJdDkp7qXPMcP6+QjEZvevBH0IFKFPAsHKio=";
+  vendorHash = "sha256-Tbce59lQsj6Db0B734PAWiAz9NbLCp43it28j5IJf68=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 7d91bd83927d..08dfc02cbd15 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "17.11.2";
+  version = "17.12.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-cDuHjkbsX8YmAHCchgLEY2B81f3qtrm6DVcee+z4KfQ=";
+    hash = "sha256-evZ8o6KMbnhVGY7gGicvs5hYxxHGxfkGAtcZPQd0Bvc=";
   };
 
-  vendorHash = "sha256-FDVzJQuxrzypqke9gbDdQfMR3dM/y8msAvZYyrlMv+o=";
+  vendorHash = "sha256-sdUvtp/qXneP1z2MnV2XNGbBV/LXgAug5ueO83foNCA=";
 
   sourceRoot = "source/src";
 
diff --git a/pkgs/development/tools/rust/dioxus-cli/default.nix b/pkgs/development/tools/rust/dioxus-cli/default.nix
index b1756e62ee6e..def31b1ce478 100644
--- a/pkgs/development/tools/rust/dioxus-cli/default.nix
+++ b/pkgs/development/tools/rust/dioxus-cli/default.nix
@@ -1,17 +1,24 @@
-{ lib, fetchCrate, rustPlatform, openssl, pkg-config, stdenv, CoreServices }:
+{ lib, fetchCrate, rustPlatform, openssl, pkg-config, cacert, stdenv, CoreServices }:
 rustPlatform.buildRustPackage rec {
   pname = "dioxus-cli";
-  version = "0.1.4";
+  version = "0.3.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-SnmDOMxc+39LX6kOzma2zA6T91UGCnvr7WWhX+wXnLo=";
+    sha256 = "sha256-8S8zUOb2oiXbJQRgY/g9H2+EW+wWOQugr8+ou34CYPg=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config cacert ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
 
-  cargoSha256 = "sha256-Mf/WtOO/vFuhg90DoPDwOZ6XKj423foHZ8vHugXakb0=";
+  cargoSha256 = "sha256-sCP8njwYA29XmYu2vfuog0NCL1tZlsZiupkDVImrYCE=";
+
+  checkFlags = [
+    # these tests require dioxous binary in PATH,
+    # can be removed after: https://github.com/DioxusLabs/dioxus/pull/1138
+    "--skip=cli::autoformat::spawn_properly"
+    "--skip=cli::translate::generates_svgs"
+  ];
 
   meta = with lib; {
     description = "CLI tool for developing, testing, and publishing Dioxus apps";
diff --git a/pkgs/games/gambit/default.nix b/pkgs/games/gambit/default.nix
new file mode 100644
index 000000000000..4bcd329171cc
--- /dev/null
+++ b/pkgs/games/gambit/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+, testers
+, gambit-chess
+}:
+
+buildGoModule rec {
+  pname = "gambit";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "maaslalani";
+    repo = "gambit";
+    rev = "v${version}";
+    hash = "sha256-RLbD9JK1yJn30WWg7KWDjJoj4WXIoy3Kb8t2F8rFPuk=";
+  };
+
+  vendorHash = "sha256-d9fPlv+ZAzQA42I61B5JEzfYpfJc9vWBcLYTX/s5dhs=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.Version=v${version}"
+    "-X=main.CommitSHA=${src.rev}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd gambit \
+      --bash <($out/bin/gambit completion bash) \
+      --fish <($out/bin/gambit completion fish) \
+      --zsh <($out/bin/gambit completion zsh)
+  '';
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = gambit-chess;
+      version = "v${version}";
+    };
+  };
+
+  meta = with lib; {
+    description = "Play chess in your terminal";
+    homepage = "https://github.com/maaslalani/gambit";
+    changelog = "https://github.com/maaslalani/gambit/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/hexfiend/default.nix b/pkgs/os-specific/darwin/hexfiend/default.nix
index c35de6666fbe..29767a1154d5 100644
--- a/pkgs/os-specific/darwin/hexfiend/default.nix
+++ b/pkgs/os-specific/darwin/hexfiend/default.nix
@@ -21,7 +21,8 @@ stdenv.mkDerivation rec {
     homepage = "http://hexfiend.com/";
     changelog = "https://hexfiend.github.io/HexFiend/ReleaseNotes.html";
     license = licenses.bsd2;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ eliandoran ];
-    platforms = [ "x86_64-darwin" ];
+    platforms = platforms.darwin;
   };
 }
diff --git a/pkgs/servers/mastodon/source.nix b/pkgs/servers/mastodon/source.nix
index 966e7c9ea462..0d0656c3a39a 100644
--- a/pkgs/servers/mastodon/source.nix
+++ b/pkgs/servers/mastodon/source.nix
@@ -3,8 +3,8 @@
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
-    rev = "v4.1.4";
-    hash = "sha256-8ULBO8IdwBzC5dgX3netTHbbRrODX4CropWZWtqWHZw=";
+    rev = "v4.1.5";
+    hash = "sha256-1bWrKcw+EQyu7WBujR5sptiUOjbhJvIM76h9jcX24jw=";
   };
 in applyPatches {
   inherit src;
diff --git a/pkgs/servers/mastodon/update.sh b/pkgs/servers/mastodon/update.sh
index 4a7e6e178730..babc06204851 100755
--- a/pkgs/servers/mastodon/update.sh
+++ b/pkgs/servers/mastodon/update.sh
@@ -76,7 +76,7 @@ function cleanup {
 trap cleanup EXIT
 
 echo "Fetching source code $REVISION"
-JSON=$(nix-prefetch-github "$OWNER" "$REPO" --rev "$REVISION"  2> $WORK_DIR/nix-prefetch-git.out)
+JSON=$(nix-prefetch-github "$OWNER" "$REPO" --rev "$REVISION" 2> $WORK_DIR/nix-prefetch-git.out)
 HASH=$(echo "$JSON" | jq -r .hash)
 
 echo "Creating version.nix"
diff --git a/pkgs/servers/mastodon/version.nix b/pkgs/servers/mastodon/version.nix
index 6ee44f9ea9dd..6240cd822c75 100644
--- a/pkgs/servers/mastodon/version.nix
+++ b/pkgs/servers/mastodon/version.nix
@@ -1 +1 @@
-"4.1.4"
+"4.1.5"
diff --git a/pkgs/servers/search/typesense/default.nix b/pkgs/servers/search/typesense/default.nix
new file mode 100644
index 000000000000..b78c5d083847
--- /dev/null
+++ b/pkgs/servers/search/typesense/default.nix
@@ -0,0 +1,64 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, nixosTests
+}:
+let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  sources = lib.importJSON ./sources.json;
+  platform = sources.platforms.${system} or throwSystem;
+  inherit (sources) version;
+  inherit (platform) arch hash;
+in
+stdenv.mkDerivation {
+  pname = "typesense";
+  inherit version;
+  src = fetchurl {
+    url = "https://dl.typesense.org/releases/${version}/typesense-server-${version}-${arch}.tar.gz";
+    inherit hash;
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  # The tar.gz contains no subdirectory
+  sourceRoot = ".";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $sourceRoot/typesense-server $out/bin
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) typesense; };
+    updateScript = ./update.sh;
+  };
+
+  meta = with lib; {
+    homepage = "https://typesense.org";
+    description = "Typesense is a fast, typo-tolerant search engine for building delightful search experiences.";
+    license = licenses.gpl3;
+    # There has been an attempt at building this from source, which were deemed
+    # unfeasible at the time of writing this (July 2023) for the following reasons.
+    # - Pre 0.25 would have been possible, but typesense has switched to bazel for 0.25+,
+    #   so the build would break immediately next version
+    # - The new bazel build has many issues, only some of which were fixable:
+    #   - preBuild requires export LANG="C.UTF-8", since onxxruntime contains a
+    #     unicode file path that is handled incorrectly and otherwise leads to a build failure
+    #   - bazel downloads extensions to the build systems at build time which have
+    #     invalid shebangs that need to be fixed by patching rules_foreign_cc through
+    #     bazel (so a patch in nix that adds a patch to the bazel WORKSPACE)
+    #   - WORKSPACE has to be patched to use system cmake and ninja instead of downloaded toolchains
+    #   - The cmake dependencies that are pulled in via bazel at build time will
+    #     try to download stuff via cmake again, which is not possible in the sandbox.
+    #     This is where I stopped trying for now.
+    # XXX: retry once typesense has officially released their bazel based build.
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+    maintainers = with maintainers; [ oddlama ];
+  };
+}
diff --git a/pkgs/servers/search/typesense/sources.json b/pkgs/servers/search/typesense/sources.json
new file mode 100644
index 000000000000..a4f44552504f
--- /dev/null
+++ b/pkgs/servers/search/typesense/sources.json
@@ -0,0 +1,17 @@
+{
+  "version": "0.24.1",
+  "platforms": {
+    "aarch64-linux": {
+      "arch": "linux-arm64",
+      "hash": "sha256-TI/bjGqyEZpGDq1F9MBaDypm5XDTlsw9OGd3lIn7JCI="
+    },
+    "x86_64-linux": {
+      "arch": "linux-amd64",
+      "hash": "sha256-bmvje439QYivV96fjnEXblYJnSk8C916OwVeK2n/QR8="
+    },
+    "x86_64-darwin": {
+      "arch": "darwin-amd64",
+      "hash": "sha256-24odPFqHWQoGXXXDLxvMDjCRu81Y+I5QOdK/KLdeH5o="
+    }
+  }
+}
diff --git a/pkgs/servers/search/typesense/update.sh b/pkgs/servers/search/typesense/update.sh
new file mode 100755
index 000000000000..c6d733181cd3
--- /dev/null
+++ b/pkgs/servers/search/typesense/update.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-prefetch common-updater-scripts nix coreutils
+# shellcheck shell=bash
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+old_version=$(jq -r ".version" sources.json || echo -n "0.0.1")
+version=$(curl -s "https://api.github.com/repos/typesense/typesense/releases/latest" | jq -r ".tag_name")
+version="${version#v}"
+
+if [[ "$old_version" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+declare -A platforms=(
+    [aarch64-linux]="linux-arm64"
+    [x86_64-darwin]="darwin-amd64"
+    [x86_64-linux]="linux-amd64"
+)
+
+sources_tmp="$(mktemp)"
+cat <<EOF > "$sources_tmp"
+{
+  "version": "$version",
+  "platforms": {}
+}
+EOF
+
+for platform in "${!platforms[@]}"; do
+    arch="${platforms[$platform]}"
+    url="https://dl.typesense.org/releases/${version}/typesense-server-${version}-${arch}.tar.gz"
+    sha256hash="$(nix-prefetch-url --type sha256 "$url")"
+    hash="$(nix hash to-sri --type sha256 "$sha256hash")"
+    echo "$(jq --arg arch "$arch" \
+      --arg platform "$platform" \
+      --arg hash "$hash" \
+      '.platforms += {($platform): {arch: $arch, hash: $hash}}' \
+      "$sources_tmp")" > "$sources_tmp"
+done
+
+cp "$sources_tmp" sources.json
diff --git a/pkgs/servers/web-apps/pict-rs/default.nix b/pkgs/servers/web-apps/pict-rs/default.nix
index 30d9c002ca3c..d569fdfbb594 100644
--- a/pkgs/servers/web-apps/pict-rs/default.nix
+++ b/pkgs/servers/web-apps/pict-rs/default.nix
@@ -4,7 +4,7 @@
 , rustPlatform
 , makeWrapper
 , protobuf
-, Security
+, darwin
 , imagemagick
 , ffmpeg
 , exiftool
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {
   PROTOC_INCLUDE = "${protobuf}/include";
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks ];
 
   postInstall = ''
     wrapProgram "$out/bin/pict-rs" \
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index ca0805371af4..746b1ed6b091 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -18,14 +18,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.12.7"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.13.3"; # N.B: if you change this, check if overrides are still up-to-date
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     rev = version;
-    hash = "sha256-XVJ+qiM+iQZjFJNgybb2AzvYJTKlWOLR+4Pm03QrpGo=";
+    hash = "sha256-+2+7eoe9cNBe9IjfAkAH6vXZ071k59keqFwo9M6tl9s=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index a53b833d7d10..0bf96a6d63bc 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.23.0";
+  version = "1.24.2";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OoZO6YZ0ysPS4ZXh/AnYIo24J4cBlRxi5sIWWYrpR7c=";
+    hash = "sha256-SdQOoixfSQdSS9SOc/U0Ay9VIRfsrgALhLT4cESgSLo=";
   };
 
-  cargoHash = "sha256-kcfBjQckFv0KhfXvGz3fimCSfLD9n1yGI7azmobG6Kw=";
+  cargoHash = "sha256-MZyNSgsz1pngEuYxmG/GUqQeTmA5D6Y0tcToafFu1F8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index 364ce66de8c5..ceb83ff202fc 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -61,11 +61,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rsyslog";
-  version = "8.2304.0";
+  version = "8.2306.0";
 
   src = fetchurl {
     url = "https://www.rsyslog.com/files/download/rsyslog/${pname}-${version}.tar.gz";
-    hash = "sha256-0JDpAoPrS4Dei0Pl/8bktZxOOXDyqpHmO+7woRcg100=";
+    hash = "sha256-9ig++q3GCVQKVua+yIo2LJZud/Kf5I5rc0vWwRI+C+U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/system/testdisk/default.nix b/pkgs/tools/system/testdisk/default.nix
index 8bc290d6a673..9fe76c59052f 100644
--- a/pkgs/tools/system/testdisk/default.nix
+++ b/pkgs/tools/system/testdisk/default.nix
@@ -26,6 +26,11 @@ assert enableQt -> qwt != null;
     sha256 = "1zlh44w67py416hkvw6nrfmjickc2d43v51vcli5p374d5sw84ql";
   };
 
+  postPatch = ''
+    substituteInPlace linux/qphotorec.desktop \
+      --replace "/usr" "$out"
+  '';
+
   enableParallelBuilding = true;
 
   buildInputs = [
diff --git a/pkgs/tools/text/languagetool/default.nix b/pkgs/tools/text/languagetool/default.nix
index c567968ca507..65fcb5b71e7b 100644
--- a/pkgs/tools/text/languagetool/default.nix
+++ b/pkgs/tools/text/languagetool/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "LanguageTool";
-  version = "6.1";
+  version = "6.2";
 
   src = fetchzip {
     url = "https://www.languagetool.org/download/${pname}-${version}.zip";
-    sha256 = "sha256-4icKkcTKwaD3C8doxwdhsro+YIB6MCUj6POjRhg2YJM=";
+    sha256 = "sha256-I0Blp3o+NVL0b/86UTztufwKVkgO9KNXtBuUrUnbWco=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre ];
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index 022f8bd25bb7..456956986cb4 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -50,7 +50,7 @@ rustPlatform.buildRustPackage rec {
     description = "A utility that combines the usability of The Silver Searcher with the raw speed of grep";
     homepage = "https://github.com/BurntSushi/ripgrep";
     license = with licenses; [ unlicense /* or */ mit ];
-    maintainers = with maintainers; [ tailhook globin ma27 zowoq ];
+    maintainers = with maintainers; [ globin ma27 zowoq ];
     mainProgram = "rg";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4544a13f83da..bba6de46aa58 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13746,6 +13746,8 @@ with pkgs;
 
   tydra = callPackage ../tools/misc/tydra { };
 
+  typesense = callPackage ../servers/search/typesense { };
+
   typos = callPackage ../development/tools/typos { };
 
   typst = callPackage ../tools/typesetting/typst { };
@@ -26437,10 +26439,7 @@ with pkgs;
 
   petidomo = callPackage ../servers/mail/petidomo { };
 
-  pict-rs = callPackage ../servers/web-apps/pict-rs {
-    inherit (darwin.apple_sdk.frameworks) Security;
-    ffmpeg = ffmpeg_4;
-  };
+  pict-rs = callPackage ../servers/web-apps/pict-rs { };
 
   pict-rs_0_3 = callPackage ../servers/web-apps/pict-rs/0.3.nix {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -37241,6 +37240,8 @@ with pkgs;
 
   gambatte = callPackage ../games/gambatte { };
 
+  gambit-chess = callPackage ../games/gambit { };
+
   garden-of-coloured-lights = callPackage ../games/garden-of-coloured-lights { allegro = allegro4; };
 
   gargoyle = callPackage ../games/gargoyle {