diff --git a/nixos/modules/tasks/auto-upgrade.nix b/nixos/modules/tasks/auto-upgrade.nix
index 21a25cbfa964..54eee19dc771 100644
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@@ -21,6 +21,17 @@ in {
         '';
       };
 
+      operation = mkOption {
+        type = types.enum ["switch" "boot"];
+        default = "switch";
+        example = "boot";
+        description = ''
+          Whether to run
+          <literal>nixos-rebuild switch --upgrade</literal> or run
+          <literal>nixos-rebuild boot --upgrade</literal>
+        '';
+      };
+
       flake = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -223,7 +234,7 @@ in {
         ''}
 
         if [ "''${booted}" = "''${built}" ]; then
-          ${nixos-rebuild} switch ${toString cfg.flags}
+          ${nixos-rebuild} ${cfg.operation} ${toString cfg.flags}
         ${optionalString (cfg.rebootWindow != null) ''
           elif [ "''${do_reboot}" != true ]; then
             echo "Outside of configured reboot window, skipping."
@@ -232,7 +243,7 @@ in {
           ${shutdown} -r +1
         fi
       '' else ''
-        ${nixos-rebuild} switch ${toString (cfg.flags ++ upgradeFlag)}
+        ${nixos-rebuild} ${cfg.operation} ${toString (cfg.flags ++ upgradeFlag)}
       '';
 
       startAt = cfg.dates;
diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index ce0c56a360e9..d4a23877aa4c 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -32,7 +32,6 @@ import ./make-test-python.nix (
       # use networkd to obtain systemd network setup
       networking.useNetworkd = true;
       networking.useDHCP = false;
-      services.resolved.enable = false;
 
       # open DHCP server on interface to container
       networking.firewall.trustedInterfaces = [ "ve-+" ];
@@ -64,7 +63,7 @@ import ./make-test-python.nix (
       machine.succeed("ping -n -c 1 ${containerName}");
 
       # Test systemd-nspawn uses a user namespace
-      machine.succeed("test `stat ${containerRoot}/var/empty -c %u%g` != 00");
+      machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
 
       # Test systemd-nspawn reboot
       machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");
@@ -76,6 +75,7 @@ import ./make-test-python.nix (
 
       # Test machinectl stop
       machine.succeed("machinectl stop ${containerName}");
+      machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
 
       # Show to to delete the container
       machine.succeed("chattr -i ${containerRoot}/var/empty");
diff --git a/pkgs/applications/blockchains/dogecoin/default.nix b/pkgs/applications/blockchains/dogecoin/default.nix
index 8094959a248d..d4121b65f50e 100644
--- a/pkgs/applications/blockchains/dogecoin/default.nix
+++ b/pkgs/applications/blockchains/dogecoin/default.nix
@@ -1,8 +1,10 @@
 { lib, stdenv , fetchFromGitHub
 , pkg-config, autoreconfHook
 , db5, openssl, boost, zlib, miniupnpc, libevent
-, protobuf, util-linux, qt4, qrencode
-, withGui }:
+, protobuf, qtbase ? null
+, wrapQtAppsHook ? null, qttools, qmake ? null, qrencode
+, withGui, withUpnp ? true, withUtils ? true, withWallet ? true
+, withZmq ? true, zeromq, util-linux ? null, Cocoa ? null }:
 
 with lib;
 stdenv.mkDerivation rec {
@@ -16,14 +18,30 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Ewefy6sptSQDJVbvQqFoawhA/ujKEn9W2JWyoPYD7d0=";
   };
 
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
-  buildInputs = [ openssl db5 openssl util-linux
-                  protobuf boost zlib miniupnpc libevent ]
-                  ++ optionals withGui [ qt4 qrencode ];
+  preConfigure = optionalString withGui ''
+    export LRELEASE=${getDev qttools}/bin/lrelease
+  '';
 
-  configureFlags = [ "--with-incompatible-bdb"
-                     "--with-boost-libdir=${boost.out}/lib" ]
-                     ++ optionals withGui [ "--with-gui" ];
+  nativeBuildInputs = [ pkg-config autoreconfHook util-linux ]
+    ++ optionals withGui [ wrapQtAppsHook qttools ];
+
+  buildInputs = [ openssl protobuf boost zlib libevent ]
+    ++ optionals withGui [ qtbase qrencode ]
+    ++ optionals withUpnp [ miniupnpc ]
+    ++ optionals withWallet [ db5 ]
+    ++ optionals withZmq [ zeromq ]
+    ++ optionals stdenv.isDarwin [ Cocoa ];
+
+  configureFlags = [
+    "--with-incompatible-bdb"
+    "--with-boost-libdir=${boost.out}/lib"
+  ] ++ optionals (!withGui) [ "--with-gui=no" ]
+    ++ optionals (!withUpnp) [ "--without-miniupnpc" ]
+    ++ optionals (!withUtils) [ "--without-utils" ]
+    ++ optionals (!withWallet) [ "--disable-wallet" ]
+    ++ optionals (!withZmq) [ "--disable-zmq" ];
+
+  enableParallelBuilding = true;
 
   meta = {
     description = "Wow, such coin, much shiba, very rich";
@@ -33,9 +51,9 @@ stdenv.mkDerivation rec {
       internet currency."
       It is named after a famous Internet meme, the "Doge" - a Shiba Inu dog.
     '';
-    homepage = "http://www.dogecoin.com/";
+    homepage = "https://www.dogecoin.com/";
     license = licenses.mit;
     maintainers = with maintainers; [ edwtjo offline ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/browsers/links2/default.nix b/pkgs/applications/networking/browsers/links2/default.nix
index 02b3f88d1e14..e01131e193e0 100644
--- a/pkgs/applications/networking/browsers/links2/default.nix
+++ b/pkgs/applications/networking/browsers/links2/default.nix
@@ -8,12 +8,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.25";
+  version = "2.27";
   pname = "links2";
 
   src = fetchurl {
     url = "${meta.homepage}/download/links-${version}.tar.bz2";
-    sha256 = "sha256-LdeFCGmOgnnvTwmjoqIelZUEARNALabFU5dEFPtJ3Sw=";
+    sha256 = "sha256-2N3L/O3nzd6Aq+sKI2NY9X+mvrK8+S4QliTpuJb567Q=";
   };
 
   buildInputs = with lib;
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index c7f1f605f249..2a00811a449b 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -3,10 +3,10 @@
 
 stdenv.mkDerivation rec {
   pname = "homebank";
-  version = "5.5.5";
+  version = "5.5.6";
   src = fetchurl {
     url = "http://homebank.free.fr/public/homebank-${version}.tar.gz";
-    sha256 = "sha256-vs4F7LUjkhR0JKoeWheTiXd7gr9Gir69c+twsq+cnmc=";
+    sha256 = "sha256-Rg6OjHLkwVIDnXqzqPXA8DxqSdrh2T6V/gLBND8vx9o=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
diff --git a/pkgs/applications/science/chemistry/jmol/default.nix b/pkgs/applications/science/chemistry/jmol/default.nix
index ba93e174e405..052cf68eaba6 100644
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.45";
+  version = "14.32.66";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-9bcOwORHLZfn95RFur4JdP3Djpq8K8utnWIsniqKAI4=";
+    sha256 = "sha256-6L5hsJKiLnFKBtLJZnNxmnVcZTdu8Pmj5Md5QIoRxdU=";
   };
 
   patchPhase = ''
diff --git a/pkgs/applications/science/geometry/gama/default.nix b/pkgs/applications/science/geometry/gama/default.nix
index 1e8c25098912..20d2513b877e 100644
--- a/pkgs/applications/science/geometry/gama/default.nix
+++ b/pkgs/applications/science/geometry/gama/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, lib, expat, octave, libxml2, texinfo, zip }:
 stdenv.mkDerivation rec {
   pname = "gama";
-  version = "2.19";
+  version = "2.21";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-OCyUcKkQzp1nz9lgGSR4MRrP7XBR1kpIfPEA7PdSA1I=";
+    sha256 = "sha256-h+Mo+j/Kr7jmMY9fy4hHwn0FM1C9hMI7f7XY/xjBzHY=";
   };
 
   buildInputs = [ expat ];
diff --git a/pkgs/development/libraries/hwloc/default.nix b/pkgs/development/libraries/hwloc/default.nix
index 1544bb946ea5..308120f194d9 100644
--- a/pkgs/development/libraries/hwloc/default.nix
+++ b/pkgs/development/libraries/hwloc/default.nix
@@ -8,11 +8,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "hwloc";
-  version = "2.7.1";
+  version = "2.8.0";
 
   src = fetchurl {
     url = "https://www.open-mpi.org/software/hwloc/v${versions.majorMinor version}/downloads/hwloc-${version}.tar.bz2";
-    sha256 = "sha256-DU4dNsOnLF1hkBv9R3M39aTH4Kl12lcWUjfQDjXvUo0=";
+    sha256 = "sha256-NIpy/NSMMqgj7h2hSa6ZIgPnrQM1SeZK7W6m7rAfQsE=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/ocaml-modules/biocaml/default.nix b/pkgs/development/ocaml-modules/biocaml/default.nix
index b82ec7361791..f60a2c24ef9f 100644
--- a/pkgs/development/ocaml-modules/biocaml/default.nix
+++ b/pkgs/development/ocaml-modules/biocaml/default.nix
@@ -6,9 +6,7 @@ buildDunePackage rec {
   pname = "biocaml";
   version = "0.11.2";
 
-  useDune2 = true;
-
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.11";
 
   src = fetchFromGitHub {
     owner = "biocaml";
diff --git a/pkgs/development/tools/remodel/default.nix b/pkgs/development/tools/remodel/default.nix
new file mode 100644
index 000000000000..4f3eb67b7fef
--- /dev/null
+++ b/pkgs/development/tools/remodel/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, openssl
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "remodel";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "rojo-rbx";
+    repo = "remodel";
+    rev = "v${version}";
+    sha256 = "sha256-bUwTryGc4Y614nXKToPXp5KZqO12MmtdT3FUST4OvQY=";
+  };
+
+  cargoSha256 = "sha256-b9+eV2co4hcKLZxJRqDIX2U0O25Ba5UHQiNpfjE4fN4=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];
+
+  meta = with lib; {
+    description = "Roblox file manipulation tool";
+    longDescription = ''
+      Remodel is a command line tool for manipulating Roblox files and the instances contained within them.
+    '';
+    homepage = "https://github.com/rojo-rbx/remodel";
+    downloadPage = "https://github.com/rojo-rbx/remodel/releases/tag/v${version}";
+    changelog = "https://github.com/rojo-rbx/remodel/raw/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wackbyte ];
+  };
+}
diff --git a/pkgs/tools/filesystems/nilfs-utils/default.nix b/pkgs/tools/filesystems/nilfs-utils/default.nix
index fe2047a6f139..fbb1532f3e6d 100644
--- a/pkgs/tools/filesystems/nilfs-utils/default.nix
+++ b/pkgs/tools/filesystems/nilfs-utils/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nilfs-utils";
-  version = "2.2.8";
+  version = "2.2.9";
 
   src = fetchFromGitHub {
     owner = "nilfs-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "094mw7dsyppyiyzfdnf3f5hlkrh4bidk1kvvpn1kcvw5vn2xpfk7";
+    sha256 = "sha256-XqViUvPj2BHO3bGs9xBO3VpRq9XqnwBptHvMwBOntqo=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 3deda8d7c5da..dce0b2a94238 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib
 , pkg-config, autoreconfHook
 , fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libgcrypt, libarchive, nspr, nss, popt, db, xz, python, lua, llvmPackages
-, sqlite, zstd, fetchpatch
+, sqlite, zstd, fetchpatch, libcap
 }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ cpio zlib zstd bzip2 file libarchive libgcrypt nspr nss db xz python lua sqlite ]
-                ++ lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
+                ++ lib.optional stdenv.cc.isClang llvmPackages.openmp
+                ++ lib.optional stdenv.isLinux libcap;
 
   # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
   propagatedBuildInputs = [ popt nss db bzip2 libarchive libbfd ]
@@ -35,7 +36,7 @@ stdenv.mkDerivation rec {
     "--enable-zstd"
     "--localstatedir=/var"
     "--sharedstatedir=/com"
-  ];
+  ] ++ lib.optional stdenv.isLinux "--with-cap";
 
   patches = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [ # Fix build for macOS aarch64
     (fetchpatch {
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index 8253d73e3dbb..c2d9238bdd69 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hevea";
-  version = "2.35";
+  version = "2.36";
 
   src = fetchurl {
     url = "https://pauillac.inria.fr/~maranget/hevea/distri/hevea-${version}.tar.gz";
-    sha256 = "sha256-8Ym62l0+WzWFXf39tbJwyZT8eiNmsBJQ12E1mtZsnss=";
+    sha256 = "sha256-XWdZ13AqKVx2oSwbKhoWdUqw7B/+1z/J0LE4tB5yBkg=";
   };
 
   buildInputs = with ocamlPackages; [ ocaml ocamlbuild ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f3463db4ed60..8ff947b3a212 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20864,6 +20864,10 @@ with pkgs;
 
   randomx = callPackage ../development/libraries/randomx { };
 
+  remodel = callPackage ../development/tools/remodel {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   retro-gtk = callPackage ../development/libraries/retro-gtk { };
 
   resolv_wrapper = callPackage ../development/libraries/resolv_wrapper { };
@@ -31883,7 +31887,7 @@ with pkgs;
     boost = boost170;
   };
 
-  dogecoin  = callPackage ../applications/blockchains/dogecoin {
+  dogecoin  = libsForQt5.callPackage ../applications/blockchains/dogecoin {
     boost = boost165;
     withGui = true;
   };