diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4f97af1314a8..61ae0f9be923 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6945,6 +6945,12 @@
     email = "nix@quidecco.pl";
     name = "Isidor Zeuner";
   };
+  gmacon = {
+    name = "George Macon";
+    matrix = "@gmacon:matrix.org";
+    github = "gmacon";
+    githubId = 238853;
+  };
   gmemstr = {
     email = "git@gmem.ca";
     github = "gmemstr";
diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix
index 72d31246b75d..34c04e8351ce 100644
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@@ -32,6 +32,7 @@ let
       linux_6_1_hardened
       linux_6_5_hardened
       linux_6_6_hardened
+      linux_6_7_hardened
       linux_rt_5_4
       linux_rt_5_10
       linux_rt_5_15
diff --git a/pkgs/applications/audio/monkeys-audio/default.nix b/pkgs/applications/audio/monkeys-audio/default.nix
index bee339aba1f7..f1e351294fa6 100644
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@@ -5,13 +5,13 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "10.43";
+  version = "10.44";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${
       builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    sha256 = "sha256-Y1X0KWf87L8Qjx/G6/RV37iiN7enwXTAaqQ+45FfTT4=";
+    sha256 = "sha256-1JuzlCp9CI979ZT3a3zYfJIowrtQ42p1f9PPG6clQ4s=";
     stripRoot = false;
   };
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/tauon/default.nix b/pkgs/applications/audio/tauon/default.nix
index 47c2297274c8..979907202835 100644
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tauon";
-  version = "7.7.0";
+  version = "7.7.1";
 
   src = fetchFromGitHub {
     owner = "Taiko2k";
     repo = "TauonMusicBox";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FNRG0NKHQpPHb3P1M0eshFuGu9lyWFgmufFC5aqr7n0=";
+    hash = "sha256-rRYM8wdvwfetoIpS/lzAV/uV5XVpXyXsHSrClPWcsCo=";
   };
 
   postUnpack = ''
diff --git a/pkgs/applications/backup/unifi-protect-backup/default.nix b/pkgs/applications/backup/unifi-protect-backup/default.nix
index 4bf36e164896..ee8ca7e486d7 100644
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "unifi-protect-backup";
-  version = "0.10.3";
+  version = "0.10.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ep1cman";
     repo = "unifi-protect-backup";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jICnm9EfPyOLVbZfF+TYcQJo0ZXUDpFgYpL5Zf9b8Bc=";
+    hash = "sha256-KT2saPpkAS/6X491i0Y8+jr8JPD51iQx+YGT5zRTtcU=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/misc/nwg-look/default.nix b/pkgs/applications/misc/nwg-look/default.nix
index a9aceb33c391..5ce8ad87ba37 100644
--- a/pkgs/applications/misc/nwg-look/default.nix
+++ b/pkgs/applications/misc/nwg-look/default.nix
@@ -15,16 +15,16 @@
 
 buildGoModule rec {
   pname = "nwg-look";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-look";
     rev = "v${version}";
-    hash = "sha256-Gw0C5PCVwXuwXWF39P7pc8KdnmCYRH24zizShmniynM=";
+    hash = "sha256-kOoYhJKt7/BsQ0/RuVhj0bWnX9GU8ET3MSq6NMCOw5E=";
   };
 
-  vendorHash = "sha256-vHqnIkzsoQHiP6mmrwNetq6Pp5UB1CmX7mYvgsbvb0s=";
+  vendorHash = "sha256-V0KXK6jxBYI+tixBLq24pJJcnu4gDF6nfyns2IBTss4=";
 
   # Replace /usr/ directories with the packages output location
   # This means it references the correct path
diff --git a/pkgs/applications/networking/cluster/hubble/default.nix b/pkgs/applications/networking/cluster/hubble/default.nix
index 7160da0f63e8..ecbe56d09885 100644
--- a/pkgs/applications/networking/cluster/hubble/default.nix
+++ b/pkgs/applications/networking/cluster/hubble/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hubble";
-  version = "0.12.3";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GVfPrKPX/y/trtZjIftUW1bH5Z/O/oIUoIjjEET38Mk=";
+    sha256 = "sha256-jFzxAzLv3EfqWgbXsN8d0OPY8pDy7OBjJIzr+x5yFF0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/gnmic/default.nix b/pkgs/applications/networking/gnmic/default.nix
index 4fa9ca102bdf..37d22d3e32d6 100644
--- a/pkgs/applications/networking/gnmic/default.nix
+++ b/pkgs/applications/networking/gnmic/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gnmic";
-  version = "0.35.0";
+  version = "0.35.1";
 
   src = fetchFromGitHub {
     owner = "openconfig";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PGhU8u2dYo9S0yv8/F7YBSHUZWxxFUXIbjQIjsX6AGw=";
+    hash = "sha256-1Rtq/tRDU8hwrEYhP2/2qPWAYeCPL03m4NpXO3sGUdo=";
   };
 
   vendorHash = "sha256-HoOjVfpowb5jvAYdQ3cbCQmSl1RJKPDjvOaOGfhe5TY=";
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 1307e8e3f68b..e0cbd90c13e0 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,52 +2,52 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.40";
-      ptb = "0.0.64";
-      canary = "0.0.248";
-      development = "0.0.8";
+      stable = "0.0.41";
+      ptb = "0.0.66";
+      canary = "0.0.257";
+      development = "0.0.11";
     } else {
-      stable = "0.0.291";
-      ptb = "0.0.94";
-      canary = "0.0.394";
-      development = "0.0.18";
+      stable = "0.0.292";
+      ptb = "0.0.96";
+      canary = "0.0.401";
+      development = "0.0.27";
     };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-kKWbD2fvRq+7VnOE3tEQ1LeGneZOQfD/79bG2uElYSw=";
+        hash = "sha256-yzCOlYIDvbhJRbiqf5NC2iBT2ezlJP81O/wtkWIEp+U=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-loA/RdT6Y5c6Upius+vO/383FrutsJEYS/1uiR0gfqo=";
+        hash = "sha256-3ocygqp8eiF3n/BVlTp1T1CRsGj56MGp1yPsvBE7/H4=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-4BjlvunODUSNq2uBiC82FTlNRO3ByLJzwMsB3LirNIw=";
+        hash = "sha256-2AUCTWKEB4cy2tFfnJMn8Ywz1B8a3H6yhkVIcB0fLME=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-FD0qozLyNMPVpdD42A/pziwX7tKP3/9mFDIqdf4lopE=";
+        hash = "sha256-bN77yfmz/W3ohSKHV4pwnKEET6yi3p29ZfqH1BvFqXs=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-k0A5xBWG8cXhDp/d3dw5Eu1cpqayfOzrnwXK8i2CtVE=";
+        hash = "sha256-1BKMIWSb7+oQ+B80GUCslKn5VNdM0hPTNyZkI/RsxhM=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-SUCVLCorwqQTkJs3UJguBYZwE1lrJgmZ9BU8fHIRgLE=";
+        hash = "sha256-dG0Wcx8X2+kzrpacFZmMCXfLsuLOLbDK4qVLAMzd4RA=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-lgnZEkXxfn1L5QUBGXcKrIEL5kEehRIc0HF3WXgB8yo=";
+        hash = "sha256-fz/LDQJ/B8luN6Ffobp82hnycBOLg9Kdi0kXLGltCDc=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-q/8hHRBK9Quj2S1n5QQC3u3yF9OvxqWrC+ge4Jh9i0U=";
+        hash = "sha256-MRCBPe98Czm1OG2l3c1GAW4a27fV8XMtQ9pPIJMgqzA=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
index 5d27f8adf244..ced76131e45b 100644
--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@@ -11,7 +11,7 @@
 , configText ? ""
 }:
 let
-  version = "2309.1";
+  version = "2312";
 
   sysArch =
     if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
@@ -36,8 +36,8 @@ let
     pname = "vmware-horizon-files";
     inherit version;
     src = fetchurl {
-      url = "https://download3.vmware.com/software/CART24FQ4_LIN_2309.1_TARBALL/VMware-Horizon-Client-Linux-2309.1-8.11.1-22775487.tar.gz";
-      sha256 = "3f66d21c0e97324d1cb85ac75132a69768e8e7ff57da33841e4e8bd37089d245";
+      url = "https://download3.vmware.com/software/CART24FQ4_LIN_2312_TARBALL/VMware-Horizon-Client-Linux-2312-8.12.0-23149323.tar.gz";
+      sha256 = "15ca1d6028b9ca88e23fa363a2942fd76456c19e95ced4734595c3dc44db38d8";
     };
     nativeBuildInputs = [ makeWrapper ];
     installPhase = ''
diff --git a/pkgs/applications/radio/gnuradio/shared.nix b/pkgs/applications/radio/gnuradio/shared.nix
index fbb4960dc8fa..cd674e41815e 100644
--- a/pkgs/applications/radio/gnuradio/shared.nix
+++ b/pkgs/applications/radio/gnuradio/shared.nix
@@ -104,6 +104,8 @@ in {
       featuresInfo
       python
     ;
+    gnuradioOlder = lib.versionOlder versionAttr.major;
+    gnuradioAtLeast = lib.versionAtLeast versionAttr.major;
   } // lib.optionalAttrs (hasFeature "gr-qtgui") {
     inherit qt;
   } // lib.optionalAttrs (hasFeature "gnuradio-companion") {
diff --git a/pkgs/applications/science/chemistry/jmol/default.nix b/pkgs/applications/science/chemistry/jmol/default.nix
index 2d41342ff585..73ee9a3996da 100644
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "16.1.49";
+  version = "16.1.51";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    hash = "sha256-rzW0dB6LkKnbqHMLII6u3a6iJ1nz6gys/TN0fZFcrBk=";
+    hash = "sha256-7YOBpUeGutFPbMlQ1NnJ6BNyLbw54Meezwfs6mL71BQ=";
   };
 
   patchPhase = ''
diff --git a/pkgs/applications/science/logic/easycrypt/default.nix b/pkgs/applications/science/logic/easycrypt/default.nix
index 36ff9f2046f8..2869bcd6e1e3 100644
--- a/pkgs/applications/science/logic/easycrypt/default.nix
+++ b/pkgs/applications/science/logic/easycrypt/default.nix
@@ -22,11 +22,12 @@ stdenv.mkDerivation rec {
     batteries
     dune-build-info
     inifiles
+    why3
     yojson
     zarith
   ];
 
-  propagatedBuildInputs = [ why3 ];
+  propagatedBuildInputs = [ why3.out ];
 
   strictDeps = true;
 
diff --git a/pkgs/applications/science/logic/why3/default.nix b/pkgs/applications/science/logic/why3/default.nix
index f0567fdda3b6..1676ca4c2a4f 100644
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@@ -1,6 +1,8 @@
 { callPackage, fetchurl, lib, stdenv
 , ocamlPackages, coqPackages, rubber, hevea, emacs
-, version ? "1.7.0"
+, version ? "1.7.1"
+, ideSupport ? true
+, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -10,15 +12,18 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://why3.gitlabpages.inria.fr/releases/${pname}-${version}.tar.gz";
     hash = {
-      "1.7.0" = "sha256-rygrjzuJVukOvpuXTG/yeoEP98ZFkLQHObgc3My1PVY=";
+      "1.7.1" = "sha256-rG1hcxFhQ2PlE9RTz9ELliDjCuSzLnJ1togRY637cU4=";
       "1.6.0" = "sha256-hFvM6kHScaCtcHCc6Vezl9CR7BFbiKPoTEh7kj0ZJxw=";
     }."${version}";
   };
 
   strictDeps = true;
 
-  nativeBuildInputs = with ocamlPackages;  [
+  nativeBuildInputs = lib.optional ideSupport
+    wrapGAppsHook
+  ++ (with ocamlPackages;  [
     ocaml findlib menhir
+  ]) ++ [
     # Coq Support
     coqPackages.coq
   ];
@@ -29,8 +34,10 @@ stdenv.mkDerivation rec {
     emacs
     # Documentation
     rubber hevea
+  ] ++ lib.optional ideSupport
     # GUI
     lablgtk3-sourceview3
+  ++ [
     # WebIDE
     js_of_ocaml js_of_ocaml-ppx
     # S-expression output for why3pp
@@ -44,10 +51,19 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  configureFlags = [ "--enable-verbose-make" ];
+  configureFlags = [ "--enable-verbose-make"
+    (lib.enableFeature ideSupport "ide")
+  ];
+
+  outputs = [ "out" "dev" ];
 
   installTargets = [ "install" "install-lib" ];
 
+  postInstall = ''
+    mkdir -p $dev/lib
+    mv $out/lib/ocaml $dev/lib/
+  '';
+
   passthru.withProvers = callPackage ./with-provers.nix {};
 
   meta = with lib; {
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index aadc42643577..44b9a150a1a0 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.24.0";
+  version = "2.24.3";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-6wa4kIl65z3kk+wzDX+WhS50J+e0AZ+W8A++bdnRc2M=";
+    hash = "sha256-B6hJXm4SABYTIFPd9unTNkDtQxeMPBk98/2Q1TQedEA=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -rf e2e/
   '';
 
-  vendorHash = "sha256-03jlomVb3jS+SkmIxRtPsaMx2VKLYX/Lp9JH/mlJvK4=";
+  vendorHash = "sha256-ymNd8DMkttSiF167RSIWQbL8RHPYXp4D8ctFoSPC0io=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/virtualization/virt-viewer/default.nix b/pkgs/applications/virtualization/virt-viewer/default.nix
index 58d9edb269a4..1aca58af5c77 100644
--- a/pkgs/applications/virtualization/virt-viewer/default.nix
+++ b/pkgs/applications/virtualization/virt-viewer/default.nix
@@ -5,6 +5,7 @@
 , fetchpatch
 , gdbm
 , glib
+, gst_all_1
 , gsettings-desktop-schemas
 , gtk-vnc
 , gtk3
@@ -64,6 +65,8 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
     bash-completion
     glib
     gsettings-desktop-schemas
diff --git a/pkgs/by-name/bo/bobcat/package.nix b/pkgs/by-name/bo/bobcat/package.nix
new file mode 100644
index 000000000000..b873862fe7ed
--- /dev/null
+++ b/pkgs/by-name/bo/bobcat/package.nix
@@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, icmake
+, yodl
+, libmilter
+, libX11
+, openssl
+, readline
+, util-linux
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bobcat";
+  version = "5.11.01";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.com";
+    owner = "fbb-git";
+    repo = "bobcat";
+    rev = version;
+    hash = "sha256-JLJKaJmztputIon9JkKzpm3Ch60iwm4Imh9p42crYzA=";
+  };
+
+  sourceRoot = "${src.name}/bobcat";
+
+  postPatch = ''
+    substituteInPlace INSTALL.im \
+      --replace "/usr" "$out"
+    sed -i "6i #include <cstdint>" logbuf/logbuf
+    patchShebangs .
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    icmake
+    yodl
+  ];
+
+  buildInputs = [
+    libmilter
+    libX11
+    openssl
+    readline
+    util-linux
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    ./build libraries all
+    ./build man
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preBuild
+
+    ./build install x
+
+    runHook postBuild
+  '';
+
+  meta = with lib; {
+    description = "Brokken's Own Base Classes And Templates";
+    homepage = "https://fbb-git.gitlab.io/bobcat/";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index c9c23690d1c4..09c08ca1b39a 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.328";
+  version = "0.0.332";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-M6hX+muUC4v7Nmu2N8cONCLPJc6pVv6UJ1WO/uSDYnM=";
+    hash = "sha256-6pTL3mvW8O3vly1a+LUTMBnD5D907CfQIqDwTnUqT1s=";
   };
 
-  vendorHash = "sha256-AVbRqgk5UldpaqyEmdYDpwzaZEo5r+M3Kwxb3Sh1jLQ=";
+  vendorHash = "sha256-DcGp/5Ohk9gbviA31a1FTu/xglLjrz2S50A5DBAE+lc=";
 
   subPackages = ["cmd/nsc" "cmd/ns" "cmd/docker-credential-nsc"];
 
diff --git a/pkgs/by-name/ni/nimlsp/package.nix b/pkgs/by-name/ni/nimlsp/package.nix
index 589e08290d58..78d015cc7b8f 100644
--- a/pkgs/by-name/ni/nimlsp/package.nix
+++ b/pkgs/by-name/ni/nimlsp/package.nix
@@ -2,7 +2,7 @@
 
 buildNimPackage (finalAttrs: {
   pname = "nimlsp";
-  version = "0.4.4";
+  version = "0.4.6";
 
   requiredNimVersion = 1;
 
@@ -10,7 +10,7 @@ buildNimPackage (finalAttrs: {
     owner = "PMunch";
     repo = "nimlsp";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Z67iKlL+dnRbxdFt/n/fsUcb2wpZwzPpL/G29jfCaMY=";
+    hash = "sha256-MCtpCx8jMQp0VXuMowh69d1DQreU5cDftBf0lww7PUM=";
   };
 
   lockFile = ./lock.json;
diff --git a/pkgs/by-name/pr/prowler/package.nix b/pkgs/by-name/pr/prowler/package.nix
new file mode 100644
index 000000000000..466732634cd6
--- /dev/null
+++ b/pkgs/by-name/pr/prowler/package.nix
@@ -0,0 +1,69 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "prowler";
+  version = "3.12.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "prowler-cloud";
+    repo = "prowler";
+    rev = "refs/tags/${version}";
+    hash = "sha256-QauDqeCa499AcZurGjn2Yv4GH04F/pahAH2ms7gAca4=";
+  };
+
+  pythonRelaxDeps = [
+    "azure-mgmt-security"
+    "boto3"
+    "botocore"
+    "google-api-python-client"
+    "slack-sdk"
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    alive-progress
+    awsipranges
+    azure-identity
+    azure-mgmt-authorization
+    azure-mgmt-security
+    azure-mgmt-sql
+    azure-mgmt-storage
+    azure-mgmt-subscription
+    azure-storage-blob
+    boto3
+    botocore
+    colorama
+    detect-secrets
+    google-api-python-client
+    google-auth-httplib2
+    jsonschema
+    msgraph-core
+    msrestazure
+    pydantic_1
+    schema
+    shodan
+    slack-sdk
+    tabulate
+  ];
+
+  pythonImportsCheck = [
+    "prowler"
+  ];
+
+  meta = with lib; {
+    description = "Security tool for AWS, Azure and GCP to perform Cloud Security best practices assessments";
+    homepage = "https://github.com/prowler-cloud/prowler";
+    changelog = "https://github.com/prowler-cloud/prowler/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "prowler";
+  };
+}
diff --git a/pkgs/by-name/sn/snicat/deps.nix b/pkgs/by-name/sn/snicat/deps.nix
new file mode 100644
index 000000000000..dca575f88344
--- /dev/null
+++ b/pkgs/by-name/sn/snicat/deps.nix
@@ -0,0 +1,12 @@
+[
+  {
+    goPackagePath = "github.com/therootcompany/sclient";
+    fetch = {
+      type = "FromGitHub";
+      owner = "therootcompany";
+      repo = "sclient";
+      rev = "v1.5.0";
+      sha256 = "sha256-NAFTOx2sm92K+d746Z5UpB1HGsJI6cJgmh+YTyVkJ0w=";
+    };
+  }
+]
diff --git a/pkgs/by-name/sn/snicat/package.nix b/pkgs/by-name/sn/snicat/package.nix
new file mode 100644
index 000000000000..e7e9e6f3ab53
--- /dev/null
+++ b/pkgs/by-name/sn/snicat/package.nix
@@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, buildGoPackage
+, fetchFromGitHub
+}:
+buildGoPackage rec {
+  pname = "snicat";
+  version = "0.0.1";
+
+  src = fetchFromGitHub {
+    owner = "CTFd";
+    repo = "snicat";
+    rev = version;
+    hash = "sha256-fFlTBOz127le2Y7F9KKhbcldcyFEpAU5QiJ4VCAPs9Y=";
+  };
+
+  patchPhase = ''
+    runHook prePatch
+
+    substituteInPlace snicat.go \
+      --replace-warn "v0.0.0" "v${version}"
+
+    runHook postPatch
+  '';
+
+  goPackagePath = "github.com/CTFd/snicat";
+
+  goDeps = ./deps.nix;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 go/bin/snicat $out/bin/sc
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "TLS & SNI aware netcat";
+    homepage = "https://github.com/CTFd/snicat";
+    license = licenses.asl20;
+    mainProgram = "sc";
+    maintainers = with maintainers; [ felixalbrigtsen ];
+  };
+}
diff --git a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
index aebaab0c7627..304e94f5ed67 100644
--- a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
+++ b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 let
-  version = "1.58.0";
+  version = "1.58.2";
 in
 buildGoModule {
   pname = "tailscale-nginx-auth";
@@ -11,7 +11,7 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-ue1opjT8wkL+hYzMxU/GtOrJd3/KPSOptU8A8nklacY=";
+    hash = "sha256-FiFFfUtse0CKR4XJ82HEjpZNxCaa4FnwSJfEzJ5kZgk=";
   };
   vendorHash = "sha256-BK1zugKGtx2RpWHDvFZaFqz/YdoewsG8SscGt25uwtQ=";
 
diff --git a/pkgs/development/gnuradio-modules/ais/default.nix b/pkgs/development/gnuradio-modules/ais/default.nix
index 92abb23a5c57..1376fbe657a8 100644
--- a/pkgs/development/gnuradio-modules/ais/default.nix
+++ b/pkgs/development/gnuradio-modules/ais/default.nix
@@ -14,6 +14,7 @@
 , icu
 , gnuradio
 , thrift
+, gnuradioAtLeast
 }:
 
 mkDerivation rec {
@@ -25,7 +26,7 @@ mkDerivation rec {
     rev = "2162103226f3dae43c8c2ab23b79483b84346665";
     sha256 = "1vackka34722d8pcspfwj0j6gc9ic7dqq64sgkrpjm94sh3bmb0b";
   };
-  disabledForGRafter = "3.9";
+  disabled = gnuradioAtLeast "3.9";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/gnuradio-modules/grnet/default.nix b/pkgs/development/gnuradio-modules/grnet/default.nix
index 817205cc0ca6..77390e52340b 100644
--- a/pkgs/development/gnuradio-modules/grnet/default.nix
+++ b/pkgs/development/gnuradio-modules/grnet/default.nix
@@ -15,6 +15,7 @@
 , libpcap
 , icu
 , thrift
+, gnuradioAtLeast
 }:
 
 let
@@ -53,7 +54,7 @@ mkDerivation {
   pname = "gr-grnet";
   version = version.name;
   inherit src;
-  disabledForGRafter = "3.10";
+  disabled = gnuradioAtLeast "3.10";
 
   patches = [
     # Use cross platform struct ip instead of iphdr
@@ -73,7 +74,7 @@ mkDerivation {
     gmp
     libpcap
     icu
-  ] ++ (if lib.versionAtLeast gnuradio.versionAttr.major "3.9" then with python.pkgs; [
+  ] ++ (if gnuradioAtLeast "3.9" then with python.pkgs; [
     pybind11
     numpy
   ] else [
diff --git a/pkgs/development/gnuradio-modules/gsm/default.nix b/pkgs/development/gnuradio-modules/gsm/default.nix
index aef853943123..9f184b7be7fb 100644
--- a/pkgs/development/gnuradio-modules/gsm/default.nix
+++ b/pkgs/development/gnuradio-modules/gsm/default.nix
@@ -10,6 +10,7 @@
 , python
 , libosmocore
 , osmosdr
+, gnuradioAtLeast
 }:
 
 mkDerivation {
@@ -21,7 +22,7 @@ mkDerivation {
     rev = "3ca05e6914ef29eb536da5dbec323701fbc2050d";
     sha256 = "13nnq927kpf91iqccr8db9ripy5czjl5jiyivizn6bia0bam2pvx";
   };
-  disabledForGRafter = "3.8";
+  disabled = gnuradioAtLeast "3.8";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/gnuradio-modules/limesdr/default.nix b/pkgs/development/gnuradio-modules/limesdr/default.nix
index a9ed621cdf11..bdd541f04432 100644
--- a/pkgs/development/gnuradio-modules/limesdr/default.nix
+++ b/pkgs/development/gnuradio-modules/limesdr/default.nix
@@ -14,6 +14,7 @@
 , gmp
 , icu
 , limesuite
+, gnuradioAtLeast
 }:
 
 let
@@ -33,7 +34,7 @@ let
 in mkDerivation {
   pname = "gr-limesdr";
   inherit version src;
-  disabledForGRafter = "3.9";
+  disabled = gnuradioAtLeast "3.9";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/gnuradio-modules/mkDerivation.nix b/pkgs/development/gnuradio-modules/mkDerivation.nix
index 014968f82cc6..b35c93f90abd 100644
--- a/pkgs/development/gnuradio-modules/mkDerivation.nix
+++ b/pkgs/development/gnuradio-modules/mkDerivation.nix
@@ -7,12 +7,18 @@ mkDerivation:
 args:
 
 # Check if it's supposed to not get built for the current gnuradio version
-if (builtins.hasAttr "disabledForGRafter" args) &&
-(lib.versionAtLeast unwrapped.versionAttr.major args.disabledForGRafter) then
+if (builtins.hasAttr "disabled" args) && args.disabled then
 let name = args.name or "${args.pname}"; in
 throw "Package ${name} is incompatible with GNURadio ${unwrapped.versionAttr.major}"
 else
 
+if builtins.hasAttr "disabledForGRafter" args then
+throw ''
+  `disabledForGRafter` is superseded by `disabled`.
+  Use `disabled = gnuradioAtLeast "${unwrapped.versionAttr.major}";` instead.
+''
+else
+
 let
   args_ = {
     enableParallelBuilding = args.enableParallelBuilding or true;
diff --git a/pkgs/development/gnuradio-modules/nacl/default.nix b/pkgs/development/gnuradio-modules/nacl/default.nix
index 9f9175eae058..0900ca943b97 100644
--- a/pkgs/development/gnuradio-modules/nacl/default.nix
+++ b/pkgs/development/gnuradio-modules/nacl/default.nix
@@ -9,6 +9,7 @@
 , logLib
 , python
 , libsodium
+, gnuradioAtLeast
 }:
 
 mkDerivation {
@@ -20,7 +21,7 @@ mkDerivation {
     rev = "15276bb0fcabf5fe4de4e58df3d579b5be0e9765";
     sha256 = "018np0qlk61l7mlv3xxx5cj1rax8f1vqrsrch3higsl25yydbv7v";
   };
-  disabledForGRafter = "3.8";
+  disabled = gnuradioAtLeast "3.8";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/gnuradio-modules/osmosdr/default.nix b/pkgs/development/gnuradio-modules/osmosdr/default.nix
index 18b8229cebcc..8e46ac561493 100644
--- a/pkgs/development/gnuradio-modules/osmosdr/default.nix
+++ b/pkgs/development/gnuradio-modules/osmosdr/default.nix
@@ -22,6 +22,7 @@
 , libbladeRF
 , rtl-sdr
 , soapysdr-with-plugins
+, gnuradioAtLeast
 }:
 
 let
@@ -44,7 +45,7 @@ let
 in mkDerivation {
   pname = "gr-osmosdr";
   inherit version src;
-  disabledForGRafter = "3.11";
+  disabled = gnuradioAtLeast "3.11";
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/gnuradio-modules/rds/default.nix b/pkgs/development/gnuradio-modules/rds/default.nix
index 7ffdd206474a..9a6f2ccbbad4 100644
--- a/pkgs/development/gnuradio-modules/rds/default.nix
+++ b/pkgs/development/gnuradio-modules/rds/default.nix
@@ -12,6 +12,7 @@
 , boost
 , gmp
 , icu
+, gnuradioAtLeast
 }:
 
 let
@@ -33,7 +34,7 @@ let
 in mkDerivation {
   pname = "gr-rds";
   inherit version src;
-  disabledForGRafter = "3.9";
+  disabled = gnuradioAtLeast "3.9";
 
   buildInputs = [
     logLib
diff --git a/pkgs/development/interpreters/j/default.nix b/pkgs/development/interpreters/j/default.nix
index 2da499352b3e..97a8064cc60d 100644
--- a/pkgs/development/interpreters/j/default.nix
+++ b/pkgs/development/interpreters/j/default.nix
@@ -1,37 +1,34 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, bc
-, libedit
-, readline
-, avxSupport ? stdenv.hostPlatform.avxSupport
+, which
+, gmp
+, avx2Support ? stdenv.hostPlatform.avx2Support
 }:
 
 stdenv.mkDerivation rec {
   pname = "j";
-  version = "904-beta-c";
+  version = "9.5.1";
 
   src = fetchFromGitHub {
-    name = "${pname}-source";
     owner = "jsoftware";
     repo = "jsource";
-    rev = "j${version}";
-    hash = "sha256-MzEO/saHEBl1JwVlFC6P2UKm9RZnV7KVrNd9h4cPV/w=";
+    rev = "${version}";
+    hash = "sha256-QRQhE8138+zaGQOdq9xUOrifkVIprzbJWbmMK+WhEOU=";
   };
 
-  buildInputs = [
-    readline
-    libedit
-    bc
-  ];
+  nativeBuildInputs = [ which ];
+  buildInputs = [ gmp ];
 
   patches = [
     ./fix-install-path.patch
   ];
 
+  enableParallelBuilding = true;
+
   dontConfigure = true;
 
-  # emulating build_all.sh configuration variables
+  # Emulate jplatform64.sh configuration variables
   jplatform =
     if stdenv.isDarwin then "darwin"
     else if stdenv.hostPlatform.isAarch then "raspberry"
@@ -41,62 +38,39 @@ stdenv.mkDerivation rec {
   j64x =
     if stdenv.is32bit then "j32"
     else if stdenv.isx86_64 then
-      if (stdenv.isLinux && avxSupport) then "j64avx" else "j64"
+      if stdenv.isLinux && avx2Support then "j64avx2" else "j64"
     else if stdenv.isAarch64 then
       if stdenv.isDarwin then "j64arm" else "j64"
     else "unsupported";
 
+  env.NIX_LDFLAGS = "-lgmp";
+
   buildPhase = ''
     runHook preBuild
-
-    export SRCDIR=$(pwd)
-    export HOME=$TMPDIR
-    export JLIB=$SRCDIR/jlibrary
-    export CC=cc
-
-    cd make2
-
-    patchShebangs .
-
-    j64x="${j64x}" jplatform="${jplatform}" ./build_all.sh
-
-    cp -v $SRCDIR/bin/${jplatform}/${j64x}/* "$JLIB/bin"
-
+    MAKEFLAGS+=" ''${enableParallelBuilding:+-j$NIX_BUILD_CORES}" \
+      jplatform=${jplatform} j64x=${j64x} make2/build_all.sh
+    cp -v bin/${jplatform}/${j64x}/* jlibrary/bin/
     runHook postBuild
   '';
 
-  doCheck = true;
-
-  checkPhase = ''
-    runHook preCheck
-
-    echo "Smoke test"
-    echo 'i. 10' | $JLIB/bin/jconsole | fgrep "0 1 2 3 4 5 6 7 8 9"
-
-    # Now run the real tests
-    pushd $SRCDIR/test
-    for f in *.ijs
-    do
-      echo -n "test $f: "
-      $JLIB/bin/jconsole < $f > /dev/null || echo FAIL && echo PASS
-    done
-    popd
-
-    runHook postCheck
-  '';
-
   installPhase = ''
     runHook preInstall
-
-    mkdir -p "$out/share/j/"
-    cp -r $JLIB/{addons,system} "$out/share/j"
-    cp -r $JLIB/bin "$out"
-
+    mkdir -p $out/share/j
+    cp -r jlibrary/{addons,system} $out/share/j/
+    cp -r jlibrary/bin $out/
     runHook postInstall
   '';
 
+  doInstallCheck = false; # The "gregex" test fails due to not finding PCRE2
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    HOME="$TMPDIR" $out/bin/jconsole -lib $out/bin/libj* script/testga.ijs
+    runHook postInstallCheck
+  '';
+
   meta = with lib; {
-    homepage = "http://jsoftware.com/";
+    homepage = "https://jsoftware.com/";
     description = "J programming language, an ASCII-based APL successor";
     longDescription = ''
       J is a high-level, general-purpose programming language that is
@@ -104,8 +78,10 @@ stdenv.mkDerivation rec {
       of data. It is a powerful tool for developing algorithms and exploring
       problems that are not already well understood.
     '';
-    license = licenses.gpl3Plus;
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ raskin synthetica AndersonTorres ];
-    platforms = with platforms; unix;
+    broken = stdenv.isDarwin;
+    platforms = platforms.all;
+    mainProgram = "jconsole";
   };
 }
diff --git a/pkgs/development/libraries/bobcat/default.nix b/pkgs/development/libraries/bobcat/default.nix
deleted file mode 100644
index 4e328fe2b2a9..000000000000
--- a/pkgs/development/libraries/bobcat/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ lib, stdenv, fetchFromGitLab, icmake
-, libmilter, libX11, openssl, readline
-, util-linux, yodl }:
-
-stdenv.mkDerivation rec {
-  pname = "bobcat";
-  version = "5.11.01";
-
-  src = fetchFromGitLab {
-    sha256 = "sha256-JLJKaJmztputIon9JkKzpm3Ch60iwm4Imh9p42crYzA=";
-    domain = "gitlab.com";
-    rev = version;
-    repo = "bobcat";
-    owner = "fbb-git";
-  };
-
-  buildInputs = [ libmilter libX11 openssl readline util-linux ];
-  nativeBuildInputs = [ icmake yodl ];
-
-  setSourceRoot = ''
-    sourceRoot=$(echo */bobcat)
-  '';
-
-  postPatch = ''
-    substituteInPlace INSTALL.im --replace /usr $out
-    patchShebangs .
-  '';
-
-  buildPhase = ''
-    ./build libraries all
-    ./build man
-  '';
-
-  installPhase = ''
-    ./build install x
-  '';
-
-  meta = with lib; {
-    description = "Brokken's Own Base Classes And Templates";
-    homepage = "https://fbb-git.gitlab.io/bobcat/";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
index b2f32cbe7252..664378d42b6d 100644
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -4,6 +4,7 @@
 , ninja
 , gtest
 , fetchFromGitHub
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -17,6 +18,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-Z+mAR9nSAbCskUvo6oK79Yd85bu0HtI2aR5THS1EozM=";
   };
 
+  patches = lib.optional stdenv.hostPlatform.isRiscV
+    # Adds CMake option HWY_CMAKE_RVV
+    # https://github.com/google/highway/pull/1743
+    (fetchpatch {
+      name = "libhwy-add-rvv-optout.patch";
+      url = "https://github.com/google/highway/commit/5d58d233fbcec0c6a39df8186a877329147324b3.patch";
+      hash = "sha256-ileSNYddOt1F5rooRB0fXT20WkVlnG+gP5w7qJdBuww=";
+    });
+
   nativeBuildInputs = [ cmake ninja ];
 
   # Required for case-insensitive filesystems ("BUILD" exists)
@@ -43,6 +53,11 @@ stdenv.mkDerivation rec {
     #   HwyMathTestGroup/HwyMathTest.TestAllAtanh/EMU128
     #   HwyMathTestGroup/HwyMathTest.TestAllLog1p/EMU128
     "-DHWY_CMAKE_SSE2=ON"
+  ] ++ lib.optionals stdenv.hostPlatform.isRiscV [
+    # Runtime dispatch is not implemented https://github.com/google/highway/issues/838
+    # so tests (and likely normal operation) fail with SIGILL on processors without V.
+    # Until the issue is resolved, we disable RVV completely.
+    "-DHWY_CMAKE_RVV=OFF"
   ];
 
   # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
diff --git a/pkgs/development/libraries/maplibre-gl-native/default.nix b/pkgs/development/libraries/maplibre-gl-native/default.nix
index 65a5c266ee6a..3b2e988d4795 100644
--- a/pkgs/development/libraries/maplibre-gl-native/default.nix
+++ b/pkgs/development/libraries/maplibre-gl-native/default.nix
@@ -2,6 +2,7 @@
 , mkDerivation
 , fetchFromGitHub
 , fetchpatch
+, fetchpatch2
 , cmake
 , pkg-config
 , qtbase
@@ -30,6 +31,11 @@ mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/testing/mapbox-gl-native/0002-skip-license-check.patch?id=6751a93dca26b0b3ceec9eb151272253a2fe497e";
       sha256 = "1yybwzxbvn0lqb1br1fyg7763p2h117s6mkmywkl4l7qg9daa7ba";
     })
+    (fetchpatch2 {
+      name = "cstdint.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/maplibre-gl-native/cstdint.patch?id=ae8edc6b02df388ef37a69c12a5df25dd8550238";
+      hash = "sha256-o7wT/rk5vgwxEutAyIEAxwfKNxCoBtkhVcLjc7uTsYc=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/protobuf/25.nix b/pkgs/development/libraries/protobuf/25.nix
index b994f6060942..0b05e81cc029 100644
--- a/pkgs/development/libraries/protobuf/25.nix
+++ b/pkgs/development/libraries/protobuf/25.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix ({
-  version = "25.1";
-  hash = "sha256-w6556kxftVZ154LrZB+jv9qK+QmMiUOGj6EcNwiV+yo=";
+  version = "25.2";
+  hash = "sha256-Bw7xOgcGLshFppH4qD8E48D8v21ZJRaRkK19LPSATMg=";
 } // args)
diff --git a/pkgs/development/ocaml-modules/lambdapi/default.nix b/pkgs/development/ocaml-modules/lambdapi/default.nix
index ddb428f720ee..f4d1cdb717b7 100644
--- a/pkgs/development/ocaml-modules/lambdapi/default.nix
+++ b/pkgs/development/ocaml-modules/lambdapi/default.nix
@@ -19,8 +19,7 @@ buildDunePackage rec {
   pname = "lambdapi";
   version = "2.3.1";
 
-  minimalOCamlVersion = "4.08";
-  duneVersion = "3";
+  minimalOCamlVersion = "4.12";
 
   src = fetchurl {
     url = "https://github.com/Deducteam/lambdapi/releases/download/${version}/lambdapi-${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/tiny_httpd/default.nix b/pkgs/development/ocaml-modules/tiny_httpd/default.nix
index cb407ef585d9..2e8e537cba80 100644
--- a/pkgs/development/ocaml-modules/tiny_httpd/default.nix
+++ b/pkgs/development/ocaml-modules/tiny_httpd/default.nix
@@ -5,15 +5,15 @@
 
 buildDunePackage rec {
   pname = "tiny_httpd";
-  version = "0.12";
+  version = "0.16";
 
-  minimalOCamlVersion = "4.04";
+  minimalOCamlVersion = "4.08";
 
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256:1z9hzc0ib7pg9fsjmpggjqwrnip57izr2v0na7vc7s25lxsiag6a";
+    sha256 = "sha256-9L4WCduQNj5Jd/u3SozuXiGTkgojwfGIP5KgQmnWgQw=";
   };
 
   buildInputs = [ result ];
@@ -24,5 +24,6 @@ buildDunePackage rec {
     inherit (src.meta) homepage;
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vbgl ];
+    mainProgram = "http_of_dir";
   };
 }
diff --git a/pkgs/development/python-modules/alive-progress/default.nix b/pkgs/development/python-modules/alive-progress/default.nix
index b10b056f292a..58ccedd26d6c 100644
--- a/pkgs/development/python-modules/alive-progress/default.nix
+++ b/pkgs/development/python-modules/alive-progress/default.nix
@@ -5,20 +5,28 @@
 , fetchFromGitHub
 , grapheme
 , pytestCheckHook
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "alive-progress";
-  version = "3.1.4";
-  format = "setuptools";
+  version = "3.1.5";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "rsalmei";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-27PgxQ9nw8p5hfaSf/jPYG7419o3i8B8R09o93szSOk=";
+    repo = "alive-progress";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-yJhl0QrMHET9ISDc/D5AEQ7dTJkmcV2SWqy/xmG18uY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     about-time
     grapheme
@@ -36,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A new kind of Progress Bar, with real-time throughput, ETA, and very cool animations";
     homepage = "https://github.com/rsalmei/alive-progress";
+    changelog = "https://github.com/rsalmei/alive-progress/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ thiagokokada ];
   };
diff --git a/pkgs/development/python-modules/approvaltests/default.nix b/pkgs/development/python-modules/approvaltests/default.nix
index 49e61e87731c..53ad86c4ea37 100644
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@@ -19,16 +19,16 @@
 
 buildPythonPackage rec {
   pname = "approvaltests";
-  version = "10.2.0";
+  version = "10.3.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2NaqqgrHXJovoVExvbr0s86eRbcxy+DUrsdRH/vak3E=";
+    hash = "sha256-1f0iTwLREF20Khkd4/xEfxXINJIpc4LfszsvCblS/yM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/awsipranges/default.nix b/pkgs/development/python-modules/awsipranges/default.nix
new file mode 100644
index 000000000000..036639c3cdb7
--- /dev/null
+++ b/pkgs/development/python-modules/awsipranges/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pyopenssl
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "awsipranges";
+  version = "0.3.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "aws-samples";
+    repo = "awsipranges";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ve1+0zkDDUGswtQoXhfESMcBzoNgUutxEhz43HXL4H8=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  nativeCheckInputs = [
+    pyopenssl
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "awsipranges"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/data/test_syntax_and_semantics.py"
+    "tests/integration/test_package_apis.py"
+    "tests/unit/test_data_loading.py"
+  ];
+
+  meta = with lib; {
+    description = "Module to work with the AWS IP address ranges";
+    homepage = "https://github.com/aws-samples/awsipranges";
+    changelog = "https://github.com/aws-samples/awsipranges/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/awswrangler/default.nix b/pkgs/development/python-modules/awswrangler/default.nix
index d3eee65f576a..274b88a9811b 100644
--- a/pkgs/development/python-modules/awswrangler/default.nix
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "awswrangler";
-  version = "3.5.1";
+  version = "3.5.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "aws-sdk-pandas";
     rev = "refs/tags/${version}";
-    hash = "sha256-USHRs/NRCPACvVxsQyRF1yQsQefAXSTwdHJqQqKe6bQ=";
+    hash = "sha256-lIEitS/pyOq4RjyUqPzfKOcNtAIWp14sQcLfQ1FwEoE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-ai-generativelanguage/default.nix b/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
index ac6dfc171933..69a56b278358 100644
--- a/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
+++ b/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-ai-generativelanguage";
-  version = "0.4.0";
+  version = "0.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yBmQZsCPdMTpEpB3gym7nzV7oepdb4LeK8DRBVK/T4w=";
+    hash = "sha256-fF7pjNpfSeCnhbDUz+gVn+NKBQKdCEAVLzlRQUEpXX8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-swagger-ui-tag/default.nix b/pkgs/development/python-modules/mkdocs-swagger-ui-tag/default.nix
index 85687b1882ba..60fe20c468af 100644
--- a/pkgs/development/python-modules/mkdocs-swagger-ui-tag/default.nix
+++ b/pkgs/development/python-modules/mkdocs-swagger-ui-tag/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-swagger-ui-tag";
-  version = "0.6.7";
+  version = "0.6.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Blueswen";
     repo = "mkdocs-swagger-ui-tag";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lvE/mN56X2fx835GFNDYQc7ptxBYqwjrJ9Z6Flcvufg=";
+    hash = "sha256-TV7V1PttzyLeVQ/Ag/tMV2aqtCys1mlYpj6i0x+ko/w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nibabel/default.nix b/pkgs/development/python-modules/nibabel/default.nix
index 34066a583646..3bccab344741 100644
--- a/pkgs/development/python-modules/nibabel/default.nix
+++ b/pkgs/development/python-modules/nibabel/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "nibabel";
-  version = "5.1.0";
-  format = "pyproject";
+  version = "5.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-znPKXpVyCechmiI8tx93I1yd8qz00/J/hhujjpSBrFM=";
+    hash = "sha256-Pfjxq5gdG9kvQzHVZVKNEmq5cX/b1M/mj0P80cK/P1I=";
   };
 
   nativeBuildInputs = [
@@ -77,13 +77,9 @@ buildPythonPackage rec {
     export PATH=$out/bin:$PATH
   '';
 
-  disabledTests = [
-    # https://github.com/nipy/nibabel/issues/951
-    "test_filenames"
-  ];
-
   meta = with lib; {
     homepage = "https://nipy.org/nibabel";
+    changelog = "https://github.com/nipy/nibabel/blob/${version}/Changelog";
     description = "Access a multitude of neuroimaging data formats";
     license = licenses.mit;
     maintainers = with maintainers; [ ashgillman ];
diff --git a/pkgs/development/python-modules/pytrafikverket/default.nix b/pkgs/development/python-modules/pytrafikverket/default.nix
index 9a60920dd7b8..d880602a5123 100644
--- a/pkgs/development/python-modules/pytrafikverket/default.nix
+++ b/pkgs/development/python-modules/pytrafikverket/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pytrafikverket";
-  version = "0.3.9.2";
+  version = "0.3.10";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NxxuyLnzJ8T2jaQ761O943rpBbNwp/F4PygyQULkXzw=";
+    hash = "sha256-B3K9wDFj7uSgs6BsJUnD6r2JVcH7u7UrbVXUTMGqmQE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/reptor/default.nix b/pkgs/development/python-modules/reptor/default.nix
index 94d3058a8a15..1f35854766f0 100644
--- a/pkgs/development/python-modules/reptor/default.nix
+++ b/pkgs/development/python-modules/reptor/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "reptor";
-  version = "0.8";
+  version = "0.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "Syslifters";
     repo = "reptor";
     rev = "refs/tags/${version}";
-    hash = "sha256-YnDAjbj3TTr+WajuW6Dq3f+fjeJxrWk7VNWKhh9O7Zw=";
+    hash = "sha256-CjTedIl7ZkSFfKKhHmCadTd7zdz3gP7Q4uCscv5An38=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
index d014d0441975..961d967b31e6 100644
--- a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
@@ -41,24 +41,9 @@ buildPythonPackage rec {
     robotstatuschecker
   ];
 
-  disabledTestPaths = [
-    # https://github.com/robotframework/SeleniumLibrary/issues/1804
-    "utest/test/keywords/test_webdrivercache.py"
-  ];
-
-  disabledTests = [
-    "test_create_opera_executable_path_not_set"
-    "test_create_opera_executable_path_set"
-    "test_create_opera_with_options"
-    "test_create_opera_with_service_log_path_real_path"
-    "test_get_executable_path"
-    "test_get_ff_profile_instance_FirefoxProfile"
-    "test_has_options"
-    "test_importer"
-    "test_log_file_with_index_exist"
-    "test_opera"
-    "test_single_method"
-  ];
+  preCheck = ''
+    mkdir utest/output_dir
+  '';
 
   meta = with lib; {
     changelog = "https://github.com/robotframework/SeleniumLibrary/blob/${src.rev}/docs/SeleniumLibrary-${version}.rst";
diff --git a/pkgs/development/python-modules/tables/default.nix b/pkgs/development/python-modules/tables/default.nix
index 56cb2898bf1f..70a6f86231e8 100644
--- a/pkgs/development/python-modules/tables/default.nix
+++ b/pkgs/development/python-modules/tables/default.nix
@@ -1,6 +1,5 @@
 { lib
 , fetchPypi
-, fetchpatch
 , buildPythonPackage
 , pythonOlder
 , blosc2
@@ -23,7 +22,7 @@
 buildPythonPackage rec {
   pname = "tables";
   version = "3.9.2";
-  pyproject = true;
+  format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
@@ -32,20 +31,6 @@ buildPythonPackage rec {
     hash = "sha256-1HAmPC5QxLfIY1oNmawf8vnnBMJNceX6M8RSnn0K2cM=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "numpy-1.25-compatibility.patch";
-      url = "https://github.com/PyTables/PyTables/commit/337792561e5924124efd20d6fea6bbbd2428b2aa.patch";
-      hash = "sha256-pz3A/jTPWXXlzr+Yl5PRUvdSAinebFsoExfek4RUHkc=";
-    })
-    (fetchpatch {
-      name = "numexpr-2.8.5-compatibility.patch";
-      url = "https://github.com/PyTables/PyTables/commit/1a235490ebe1a138da1139cfa19829b5f0a2af37.patch";
-      includes = [ "tables/tests/test_queries.py" ];
-      hash = "sha256-uMS+Z2Zcz68ILMQaBdIDMnCyasozCaCGOiGIyw0+Evc=";
-    })
-  ];
-
   nativeBuildInputs = [
     blosc2
     cython
diff --git a/pkgs/development/python-modules/types-docutils/default.nix b/pkgs/development/python-modules/types-docutils/default.nix
index 8ed9bc0c1998..61184260dde2 100644
--- a/pkgs/development/python-modules/types-docutils/default.nix
+++ b/pkgs/development/python-modules/types-docutils/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-docutils";
-  version = "0.20.0.20240125";
+  version = "0.20.0.20240126";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-r3YOMR2Jrz+PtiVD6FCZ1v2dwDttGjva9mlXNnXVitg=";
+    hash = "sha256-zFp+7UY6CZH44K/7/een2JoxopbmhzLLOzHPLLRO6o0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 94eb10e0d103..99de7b6021f0 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.1.70";
+  version = "3.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-6HR6Hfv8dAo3/GT1OZQmH7yq4fY9Xi8SKkGUjG9914I=";
+    hash = "sha256-mNmOU64UyvHSM7Jo9d4plgT1hcLM156CZk36iHDMZN8=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/analysis/frama-c/default.nix b/pkgs/development/tools/analysis/frama-c/default.nix
index 0ff3e6ad1af6..1bf477cf3d16 100644
--- a/pkgs/development/tools/analysis/frama-c/default.nix
+++ b/pkgs/development/tools/analysis/frama-c/default.nix
@@ -20,7 +20,7 @@ let
     ppx_deriving_yojson
     ppx_import
     stdlib-shims
-    why3
+    why3.dev
     re
     result
     seq
diff --git a/pkgs/development/tools/continuous-integration/woodpecker-plugin-git/default.nix b/pkgs/development/tools/continuous-integration/woodpecker-plugin-git/default.nix
index a3f27e533e7d..c05800237637 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker-plugin-git/default.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker-plugin-git/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "woodpecker-plugin-git";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "woodpecker-ci";
     repo = "plugin-git";
     rev = "refs/tags/${version}";
-    hash = "sha256-9aK6c2uUBhTzBni6S4XwevdVRxswiMYGJKwmKOGHIbg=";
+    hash = "sha256-vQcHEsOJFMbrt5KpoHB59g5gIxwXQuJpudhu2qbgCY8=";
   };
 
-  vendorHash = "sha256-ol5k37gGFsyeEnGOVcJaerkIejShHyNCBu4RZ8WyHvU=";
+  vendorHash = "sha256-nPeF6Z+d69o1JwCUlzVREx8DyIqokHIfTRC1/S5XG6A=";
 
   CGO_ENABLED = "0";
 
diff --git a/pkgs/development/tools/uftrace/default.nix b/pkgs/development/tools/uftrace/default.nix
index 0ccc51c50579..26bb1cf60e00 100644
--- a/pkgs/development/tools/uftrace/default.nix
+++ b/pkgs/development/tools/uftrace/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "uftrace";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "namhyung";
     repo = "uftrace";
     rev = "v${version}";
-    sha256 = "sha256-5P8CshSCK1Ugkg9+MJB8G31n4iyhZF0oVayouQU0CaA=";
+    sha256 = "sha256-FfTt1S7X7FakKXWbmJJ1HMYcu/tG/UFknz8XmEPbPUo=";
   };
 
   postUnpack = ''
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 918d8e8f16fb..e057d8376609 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,52 +2,52 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.305-hardened1.patch",
-            "sha256": "1lrz04mxcp82qmfmwsahi5amv9j5j5qv7xjq9jcrycwcj0ljrfcv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.305-hardened1/linux-hardened-4.19.305-hardened1.patch"
+            "name": "linux-hardened-4.19.306-hardened1.patch",
+            "sha256": "0g38iy5vw9glqmqhmj5y8nnx8gbdj312yb14qnwcl21m78k63mxk",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.306-hardened1/linux-hardened-4.19.306-hardened1.patch"
         },
-        "sha256": "1s6srmhd3visqchshg566c7gq5wnxr3m74854kxksqhhfif450ns",
-        "version": "4.19.305"
+        "sha256": "06dy270xw4frnrc9p2qjh8chgp02fr5ll5g2b0lx9xqzlq7y86xr",
+        "version": "4.19.306"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.208-hardened1.patch",
-            "sha256": "0aniccfyi81wwfzva3i2vxairnkdwrypislphf8r9wg49sya2z7f",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.208-hardened1/linux-hardened-5.10.208-hardened1.patch"
+            "name": "linux-hardened-5.10.209-hardened1.patch",
+            "sha256": "1vccxrwi8a8fz3fcjxxqbkdbfjjhzwqpcibfg0nrydcix79ixgyw",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.209-hardened1/linux-hardened-5.10.209-hardened1.patch"
         },
-        "sha256": "0vpvy47cmcinhs76cjl2n81zrlhbqgpi4v29izn2hzsl15x189ch",
-        "version": "5.10.208"
+        "sha256": "1mc8rssk5aypgb58jz6i2bbflfr6qh1kgqpam0k8fqvwcjnjzqj4",
+        "version": "5.10.209"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.147-hardened1.patch",
-            "sha256": "1z37g4gwxhdsbqh0yy7m9wlglayrmypsrdjgx0vk3shgvaiwx2il",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.147-hardened1/linux-hardened-5.15.147-hardened1.patch"
+            "name": "linux-hardened-5.15.148-hardened1.patch",
+            "sha256": "0pryxvr058fisns01w52xsfbx4aqx2ssfk9n1r575lgywp6q03fj",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.148-hardened1/linux-hardened-5.15.148-hardened1.patch"
         },
-        "sha256": "1m7wznqiakarpar4a0nbwxql0hkvds0s79zx3r1xn0fj4mbfdhan",
-        "version": "5.15.147"
+        "sha256": "1n75lrck581mppx84cds1a1l5vj05cdkp8ahpry7dx6rgz4pb1f4",
+        "version": "5.15.148"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.267-hardened1.patch",
-            "sha256": "12jyk0dmrs8kmmh8ca4s3jr2pk6m0izhm5yvncgjwff3xybzyj5p",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.267-hardened1/linux-hardened-5.4.267-hardened1.patch"
+            "name": "linux-hardened-5.4.268-hardened1.patch",
+            "sha256": "1lz9i5iaa6pchnk1bw9dg85n82j9hvjdh8pb7vxjg05fxvwgn7jh",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.268-hardened1/linux-hardened-5.4.268-hardened1.patch"
         },
-        "sha256": "0hqw8ww7y9mjrh1wgdkiwk8llxpf4lxwmsmzxm8j4l615kpqvlj2",
-        "version": "5.4.267"
+        "sha256": "081695lgkdwlrp6gpp6pyflgh76zax1w52shys4s9zjnrfkarj5g",
+        "version": "5.4.268"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.74-hardened1.patch",
-            "sha256": "0j7qbbf5s1khzbmsjh5i0nskj9nlw5224sz6zrvv5a1aw6bad976",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.74-hardened1/linux-hardened-6.1.74-hardened1.patch"
+            "name": "linux-hardened-6.1.75-hardened1.patch",
+            "sha256": "157fl991y8fsllwa0ny851vij3418fcs4nng02qzkc1rqzj625dz",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.75-hardened1/linux-hardened-6.1.75-hardened1.patch"
         },
-        "sha256": "08i0pgmmdnrmlha6ncl6if39rqg44c9dqyggf0swxlmfkzbx3yxp",
-        "version": "6.1.74"
+        "sha256": "0mis14ll6xmhw71vfpw1aahi5z207qysha7x316fq4qc6c899lbc",
+        "version": "6.1.75"
     },
     "6.5": {
         "patch": {
@@ -62,11 +62,21 @@
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.6.13-hardened1.patch",
-            "sha256": "108cpr6nidjha98g0x05vsqmdidjb9ikx4ggxjric76c5dsddg2l",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.13-hardened1/linux-hardened-6.6.13-hardened1.patch"
+            "name": "linux-hardened-6.6.14-hardened1.patch",
+            "sha256": "1r8aw6lb43fgayhdnk10hkllh8kanfww5xzfi5qzkbly28wr8abv",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.14-hardened1/linux-hardened-6.6.14-hardened1.patch"
         },
-        "sha256": "1g60hblf4mywq3rivkqmz2n7a9arinxwh4g4n4x4xb8ysiyrxf48",
-        "version": "6.6.13"
+        "sha256": "110mz8fjlg1j9wnhhq2ik5alayhf61adajd8jqmcsqprncnnpsgv",
+        "version": "6.6.14"
+    },
+    "6.7": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-6.7.2-hardened1.patch",
+            "sha256": "1mkmqf8fc3dg77an9fkqp41141m01x93rydfmdn5ys5336mix8pi",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.7.2-hardened1/linux-hardened-6.7.2-hardened1.patch"
+        },
+        "sha256": "0wd6pxh7wy9bzjzwd0rdsdnghpr53qbs722fhg07bi19m8dy8kf3",
+        "version": "6.7.2"
     }
 }
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index abbdd71694d2..7014e3b095f4 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "49.1";
+  version = "50.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fAEHugGRlrn0rRazyeC649H4vc0V3dqTTSDAo1HY22A=";
+    hash = "sha256-PJlbY7QR9b2eVaALpuq/67kRTc91HEhs9Wl7WXtSLmA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/servers/osmocom/osmo-pcu/default.nix b/pkgs/servers/osmocom/osmo-pcu/default.nix
index becbf8a04916..7349e03d9722 100644
--- a/pkgs/servers/osmocom/osmo-pcu/default.nix
+++ b/pkgs/servers/osmocom/osmo-pcu/default.nix
@@ -13,13 +13,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "osmo-pcu";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "osmocom";
     repo = "osmo-pcu";
     rev = version;
-    hash = "sha256-p5gBOHw/3NJ482EX5LcmaWkwz/ikcK7EEeio/puNTFo=";
+    hash = "sha256-rE5/wtzABEd6OVSRVrBvIJuo/CSfK19nf7tm+QQzljY=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/readarr/default.nix b/pkgs/servers/readarr/default.nix
index c7dacb2ced50..67f24ed9204b 100644
--- a/pkgs/servers/readarr/default.nix
+++ b/pkgs/servers/readarr/default.nix
@@ -8,13 +8,13 @@ let
     x86_64-darwin = "x64";
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash = {
-    x64-linux_hash = "sha256-i5ZlLHTV44hia3Vkm8Ht0vEN5XWjd9KJ4xOVNxrNxVE=";
-    arm64-linux_hash = "sha256-sX2Dn5/PfWdxh2qPDm2UbkqBIVpk+mb5CfuBwdPwloU=";
-    x64-osx_hash = "sha256-pBw0MnzxQ+dmRKARKB/Flr4ILS37Y2TVgIkRkjZyITo=";
+    x64-linux_hash = "sha256-Li8q1JY9e7NkNUMly+hCLAHPibqIdVO9Eijcsc0YKEc=";
+    arm64-linux_hash = "sha256-kPZ5seqYzHjINzFzUbZm7L5Uh5saa+WDSwNpmcYnYX0=";
+    x64-osx_hash = "sha256-R2WZAAJs/XG8C0DTvSEZ2c9ao78FTS9B7lieOKkUWRs=";
   }."${arch}-${os}_hash";
 in stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.3.14.2358";
+  version = "0.3.17.2409";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/tools/backup/tarsnapper/default.nix b/pkgs/tools/backup/tarsnapper/default.nix
index 447057448f87..b4d731984f71 100644
--- a/pkgs/tools/backup/tarsnapper/default.nix
+++ b/pkgs/tools/backup/tarsnapper/default.nix
@@ -1,20 +1,35 @@
 { lib
 , python3Packages
 , fetchFromGitHub
+, fetchpatch
 , tarsnap
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "tarsnapper";
-  version = "0.4";
+  version = "0.5";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "miracle2k";
     repo = pname;
     rev = version;
-    sha256 = "03db49188f4v1946c8mqqj30ah10x68hbg3a58js0syai32v12pm";
+    hash = "sha256-5i9eum9hbh6VFhvEIDq5Uapy6JtIbf9jZHhRYZVoC1w=";
   };
 
+  patches = [
+    # Fix failing tests when default_deltas is None
+    (fetchpatch {
+      url = "https://github.com/miracle2k/tarsnapper/commit/2ee33ce748b9bb42d559cc2c0104115732cb4150.patch";
+      hash = "sha256-fEXGhzlfB+J5lw1pcsC5Ne7I8UMnDzwyyCx/zm15+fU=";
+    })
+  ];
+
+  nativeBuildInputs = with python3Packages; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     pyyaml
     python-dateutil
@@ -22,28 +37,22 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
     nose
   ];
 
-  patches = [
-    # Remove standard module argparse from requirements
-    ./remove-argparse.patch
-  ];
+  # Remove standard module argparse from requirements
+  pythonRemoveDeps = [ "argparse" ];
 
   makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ tarsnap ]}" ];
 
-  checkPhase = ''
-    runHook preCheck
-    nosetests tests
-    runHook postCheck
-  '';
-
   pythonImportsCheck = [ "tarsnapper" ];
 
   meta = with lib; {
     description = "Wrapper which expires backups using a gfs-scheme";
     homepage = "https://github.com/miracle2k/tarsnapper";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ gmacon ];
+    mainProgram = "tarsnapper";
   };
 }
diff --git a/pkgs/tools/backup/tarsnapper/remove-argparse.patch b/pkgs/tools/backup/tarsnapper/remove-argparse.patch
deleted file mode 100644
index 19c7f9f172e2..000000000000
--- a/pkgs/tools/backup/tarsnapper/remove-argparse.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- tarsnapper-0.4-src.org/setup.py	1980-01-02 00:00:00.000000000 +0000
-+++ tarsnapper-0.4-src/setup.py	2017-07-16 10:54:36.596499451 +0100
-@@ -45,6 +45,6 @@
-       url='https://github.com/miracle2k/tarsnapper',
-       license='BSD',
-       packages=['tarsnapper'],
--      install_requires = ['argparse>=1.1', 'pyyaml>=3.09', 'python-dateutil>=2.4.0', 'pexpect>=3.1'],
-+      install_requires = ['pyyaml>=3.09', 'python-dateutil>=2.4.0', 'pexpect>=3.1'],
-       **kw
- )
diff --git a/pkgs/tools/games/minecraft/mcaselector/default.nix b/pkgs/tools/games/minecraft/mcaselector/default.nix
index 0cf48dbe0b6b..395be450f65c 100644
--- a/pkgs/tools/games/minecraft/mcaselector/default.nix
+++ b/pkgs/tools/games/minecraft/mcaselector/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mcaselector";
-  version = "2.2.2";
+  version = "2.3";
 
   src = fetchurl {
     url = "https://github.com/Querz/mcaselector/releases/download/${finalAttrs.version}/mcaselector-${finalAttrs.version}.jar";
-    hash = "sha256-tOSdzLFxvEJ9LXliwfosMkgcrQLsrW7qDS8vrgPzQoI=";
+    hash = "sha256-8ivqTqgO6hvEgwnAfnPXuruFGS3s/wD/WKt+5Bg/5Z0=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/misc/asdf-vm/default.nix b/pkgs/tools/misc/asdf-vm/default.nix
index 1247039e8c64..c9b7f27c42b0 100644
--- a/pkgs/tools/misc/asdf-vm/default.nix
+++ b/pkgs/tools/misc/asdf-vm/default.nix
@@ -37,13 +37,13 @@ ${asdfReshimFile}
   '';
 in stdenv.mkDerivation rec {
   pname = "asdf-vm";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "asdf-vm";
     repo = "asdf";
     rev = "v${version}";
-    sha256 = "sha256-9Levs1Wr7Lohhvpy+1Xq3AYyf7+VsBalvAAA7qq6heI=";
+    sha256 = "sha256-DmwKzW0oHjokMxj2RMT4iogurEMKeAcl7MWlPTOqMmg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/mise/default.nix b/pkgs/tools/misc/mise/default.nix
index cb7e54647e14..12acc61f9e24 100644
--- a/pkgs/tools/misc/mise/default.nix
+++ b/pkgs/tools/misc/mise/default.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2024.1.24";
+  version = "2024.1.30";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-Lp1TGY6Ct4LHSsvhF/58NrO/whxiMOH1YjsBbGWDhh4=";
+    hash = "sha256-1MvnxH+6xN7uQAhf2OEO+OjBISUSiTrYtfdulSe8Cxg=";
   };
 
-  cargoHash = "sha256-sEnO8uKaPXFUMmIR0VJESQWITwxh68/+R4kqJYx/boA=";
+  cargoHash = "sha256-Hm8cpj0tk5bQ4NBHPGf6Fwpwq6zGJEwfE6psDkenxCQ=";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 1a83209aefd4..46fa0be29c70 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , fetchurl
 , pkg-config
-, iproute2
 , libcap_ng
 , libnl
 , lz4
@@ -18,73 +17,51 @@
 }:
 
 let
-  inherit (lib) versionOlder optional optionals optionalString;
-
-  generic = { version, sha256, extraBuildInputs ? [ ] }:
-    let
-      withIpRoute = stdenv.isLinux && (versionOlder version "2.5.4");
-    in
-    stdenv.mkDerivation
-      rec {
-        pname = "openvpn";
-        inherit version;
-
-        src = fetchurl {
-          url = "https://swupdate.openvpn.net/community/releases/${pname}-${version}.tar.gz";
-          inherit sha256;
-        };
-
-        nativeBuildInputs = [ pkg-config ];
-
-        buildInputs = [ lz4 lzo ]
-          ++ optionals stdenv.isLinux [ libcap_ng libnl pam ]
-          ++ optional withIpRoute iproute2
-          ++ optional useSystemd systemd
-          ++ optional pkcs11Support pkcs11helper
-          ++ extraBuildInputs;
-
-        configureFlags = optionals withIpRoute [
-          "--enable-iproute2"
-          "IPROUTE=${iproute2}/sbin/ip"
-        ]
-        ++ optional useSystemd "--enable-systemd"
-        ++ optional pkcs11Support "--enable-pkcs11"
-        ++ optional stdenv.isDarwin "--disable-plugin-auth-pam";
-
-        # We used to vendor the update-systemd-resolved script inside libexec,
-        # but a separate package was made, that uses libexec/openvpn. Copy it
-        # into libexec in case any consumers expect it to be there even though
-        # they should use the update-systemd-resolved package instead.
-        postInstall = ''
-          mkdir -p $out/share/doc/openvpn/examples
-          cp -r sample/sample-{config-files,keys,scripts}/ $out/share/doc/openvpn/examples
-        '' + optionalString useSystemd ''
-          install -Dm555 -t $out/libexec ${update-systemd-resolved}/libexec/openvpn/*
-        '';
-
-        enableParallelBuilding = true;
-
-        meta = with lib; {
-          description = "A robust and highly flexible tunneling application";
-          mainProgram = "openvpn";
-          downloadPage = "https://openvpn.net/community-downloads/";
-          homepage = "https://openvpn.net/";
-          license = licenses.gpl2Only;
-          maintainers = with maintainers; [ viric peterhoeg ];
-          platforms = platforms.unix;
-        };
-      };
-
+  inherit (lib) optional optionals optionalString;
 in
-{
-  openvpn = (generic {
-    version = "2.6.8";
-    sha256 = "sha256-Xt4VZcim2IAQD38jUxen7p7qg9UFLbVUfxOp52r3gF0=";
-    extraBuildInputs = [ openssl ];
-  }).overrideAttrs
-    (_: {
-      passthru.tests = {
-        inherit (nixosTests) initrd-network-openvpn systemd-initrd-networkd-openvpn;
-      };
-    });
-}
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openvpn";
+  version = "2.6.8";
+
+  src = fetchurl {
+    url = "https://swupdate.openvpn.net/community/releases/openvpn-${finalAttrs.version}.tar.gz";
+    hash = "sha256-Xt4VZcim2IAQD38jUxen7p7qg9UFLbVUfxOp52r3gF0=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ lz4 lzo openssl ]
+    ++ optionals stdenv.isLinux [ libcap_ng libnl pam ]
+    ++ optional useSystemd systemd
+    ++ optional pkcs11Support pkcs11helper;
+
+  configureFlags = optional useSystemd "--enable-systemd"
+    ++ optional pkcs11Support "--enable-pkcs11"
+    ++ optional stdenv.isDarwin "--disable-plugin-auth-pam";
+
+  # We used to vendor the update-systemd-resolved script inside libexec,
+  # but a separate package was made, that uses libexec/openvpn. Copy it
+  # into libexec in case any consumers expect it to be there even though
+  # they should use the update-systemd-resolved package instead.
+  postInstall = ''
+    mkdir -p $out/share/doc/openvpn/examples
+    cp -r sample/sample-{config-files,keys,scripts}/ $out/share/doc/openvpn/examples
+  '' + optionalString useSystemd ''
+    install -Dm555 -t $out/libexec ${update-systemd-resolved}/libexec/openvpn/*
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru.tests = {
+    inherit (nixosTests) initrd-network-openvpn systemd-initrd-networkd-openvpn;
+  };
+
+  meta = with lib; {
+    description = "A robust and highly flexible tunneling application";
+    downloadPage = "https://openvpn.net/community-downloads/";
+    homepage = "https://openvpn.net/";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ viric peterhoeg ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/tools/security/tlsx/default.nix b/pkgs/tools/security/tlsx/default.nix
index 10915cad9ecd..2ba9be6315b7 100644
--- a/pkgs/tools/security/tlsx/default.nix
+++ b/pkgs/tools/security/tlsx/default.nix
@@ -5,16 +5,21 @@
 
 buildGoModule rec {
   pname = "tlsx";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-lS/D3p8Q6Zu3/XxwkC77fPS9cXVrUTkDPGd46Y+krbo=";
+    repo = "tlsx";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-FF5/STjf8joyJM6qPds1wFeRfncSamy/wWfNRZcG5kc=";
   };
 
-  vendorHash = "sha256-aEsq9LwU/ZWvuZGGzZ4NEvMWFk1m/Sr9LOXiCA/X388=";
+  vendorHash = "sha256-sJravmpvwOSZiVNWFUTLlTA4xk6drItDj4JzR8JNrOo=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
 
   # Tests require network access
   doCheck = false;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d486529af2fb..84bb3a5ac223 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5197,7 +5197,9 @@ with pkgs;
 
   easyabc = callPackage ../applications/audio/easyabc { };
 
-  easycrypt = callPackage ../applications/science/logic/easycrypt { };
+  easycrypt = callPackage ../applications/science/logic/easycrypt {
+    why3 = pkgs.why3.override { ideSupport = false; };
+  };
 
   easycrypt-runtest = callPackage ../applications/science/logic/easycrypt/runtest.nix { };
 
@@ -11670,8 +11672,7 @@ with pkgs;
 
   opentsdb = callPackage ../tools/misc/opentsdb { };
 
-  inherit (callPackages ../tools/networking/openvpn {})
-    openvpn;
+  openvpn = callPackage ../tools/networking/openvpn {};
 
   openvpn3 = callPackage ../tools/networking/openvpn3 { };
 
@@ -17634,9 +17635,7 @@ with pkgs;
 
   ivy = callPackage ../development/interpreters/ivy { };
 
-  j = callPackage ../development/interpreters/j {
-    stdenv = clangStdenv;
-  };
+  j = callPackage ../development/interpreters/j { };
 
   jacinda = haskell.lib.compose.justStaticExecutables haskellPackages.jacinda;
 
@@ -20644,8 +20643,6 @@ with pkgs;
     else callPackage ../os-specific/linux/bionic-prebuilt { };
 
 
-  bobcat = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/bobcat { });
-
   boehmgc = callPackage ../development/libraries/boehm-gc { };
 
   boolstuff = callPackage ../development/libraries/boolstuff { };
@@ -28105,6 +28102,8 @@ with pkgs;
   linux_6_5_hardened = linuxKernel.kernels.linux_6_5_hardened;
   linuxPackages_6_6_hardened = linuxKernel.packages.linux_6_6_hardened;
   linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;
+  linuxPackages_6_7_hardened = linuxKernel.packages.linux_6_7_hardened;
+  linux_6_7_hardened = linuxKernel.kernels.linux_6_7_hardened;
 
   # GNU Linux-libre kernels
   linuxPackages-libre = linuxKernel.packages.linux_libre;
diff --git a/pkgs/top-level/gnuradio-packages.nix b/pkgs/top-level/gnuradio-packages.nix
index 08cc25980240..5adac2cf98e6 100644
--- a/pkgs/top-level/gnuradio-packages.nix
+++ b/pkgs/top-level/gnuradio-packages.nix
@@ -24,6 +24,7 @@ let
     ;
     inherit mkDerivationWith mkDerivation;
     inherit gnuradio;
+    inherit (gnuradio) gnuradioOlder gnuradioAtLeast;
   } // lib.optionalAttrs (gnuradio.hasFeature "gr-uhd") {
     inherit (gnuradio) uhd;
   });
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 88eeef3bc9cb..26fe5c042b91 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -260,6 +260,7 @@ in {
     linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };
     linux_6_5_hardened = hardenedKernelFor kernels.linux_6_5 { };
     linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };
+    linux_6_7_hardened = hardenedKernelFor kernels.linux_6_7 { };
 
   } // lib.optionalAttrs config.allowAliases {
     linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11";
@@ -635,6 +636,7 @@ in {
     linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);
     linux_6_5_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_5_hardened);
     linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);
+    linux_6_7_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_7_hardened);
 
     linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
     linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index bd8204ae10cb..ea09cd090fb2 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -922,7 +922,9 @@ let
 
     lambda-term = callPackage ../development/ocaml-modules/lambda-term { };
 
-    lambdapi = callPackage ../development/ocaml-modules/lambdapi { };
+    lambdapi = callPackage ../development/ocaml-modules/lambdapi {
+      why3 = pkgs.why3.override { ocamlPackages = self; };
+    };
 
     lambdasoup = callPackage ../development/ocaml-modules/lambdasoup { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 378daa302667..d871fbcf2a1c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1016,6 +1016,8 @@ self: super: with self; {
 
   awsiotpythonsdk = callPackage ../development/python-modules/awsiotpythonsdk { };
 
+  awsipranges = callPackage ../development/python-modules/awsipranges { };
+
   awslambdaric = callPackage ../development/python-modules/awslambdaric { };
 
   awswrangler = callPackage ../development/python-modules/awswrangler { };