diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix
index 7b9e31a8d990..18d981cdb0d2 100644
--- a/nixos/modules/services/security/vault.nix
+++ b/nixos/modules/services/security/vault.nix
@@ -221,6 +221,7 @@ in
         ProtectHome = "read-only";
         AmbientCapabilities = "cap_ipc_lock";
         NoNewPrivileges = true;
+        LimitCORE = 0;
         KillSignal = "SIGINT";
         TimeoutStopSec = "30s";
         Restart = "on-failure";
diff --git a/pkgs/applications/audio/easyabc/default.nix b/pkgs/applications/audio/easyabc/default.nix
new file mode 100644
index 000000000000..9f45d0452413
--- /dev/null
+++ b/pkgs/applications/audio/easyabc/default.nix
@@ -0,0 +1,65 @@
+{ lib, fetchFromGitHub, substituteAll, makeWrapper, python39, fluidsynth, soundfont-fluid, wrapGAppsHook, abcmidi, abcm2ps, ghostscript }:
+
+# requires python39 due to https://stackoverflow.com/a/71902541 https://github.com/jwdj/EasyABC/issues/52
+python39.pkgs.buildPythonApplication {
+  pname = "easyabc";
+  version = "1.3.8.6";
+
+  src = fetchFromGitHub {
+    owner = "jwdj";
+    repo = "easyabc";
+    rev = "6461b2c14280cb64224fc5299c31cfeef9b7d43c";
+    hash = "sha256-leC3A4HQMeJNeZXArb3YAYr2mddGPcws618NrRh2Q1Y=";
+  };
+
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  propagatedBuildInputs = with python39.pkgs; [
+    cx_Freeze
+    wxPython_4_2
+    pygame
+  ];
+
+  # apparently setup.py only supports Windows and Darwin
+  # everything is very non-standard in this project
+  dontBuild = true;
+  format = "other";
+
+  # https://discourse.nixos.org/t/packaging-mcomix3-python-gtk-missing-gsettings-schemas-issue/10190/2
+  strictDeps = false;
+
+  patches = [
+    (substituteAll {
+      src = ./hardcoded-paths.patch;
+      fluidsynth = "${fluidsynth}/lib/libfluidsynth.so";
+      soundfont = "${soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2";
+      ghostscript = "${ghostscript}/bin/gs";
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/easyabc
+    mv * $out/share/easyabc
+
+    ln -s ${abcmidi}/bin/abc2midi $out/share/easyabc/bin/abc2midi
+    ln -s ${abcmidi}/bin/midi2abc $out/share/easyabc/bin/midi2abc
+    ln -s ${abcmidi}/bin/abc2abc $out/share/easyabc/bin/abc2abc
+    ln -s ${abcm2ps}/bin/abcm2ps $out/share/easyabc/bin/abcm2ps
+
+    makeWrapper ${python39.interpreter} $out/bin/easyabc \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/easyabc" \
+      --add-flags "-O $out/share/easyabc/easy_abc.py"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "ABC music notation editor";
+    homepage = "https://easyabc.sourceforge.net/";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ mausch ];
+  };
+}
diff --git a/pkgs/applications/audio/easyabc/hardcoded-paths.patch b/pkgs/applications/audio/easyabc/hardcoded-paths.patch
new file mode 100644
index 000000000000..e3ac1e58d7a9
--- /dev/null
+++ b/pkgs/applications/audio/easyabc/hardcoded-paths.patch
@@ -0,0 +1,43 @@
+---
+ easy_abc.py   | 4 ++++
+ fluidsynth.py | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/easy_abc.py b/easy_abc.py
+index 5be3e6a..40c999a 100644
+--- a/easy_abc.py
++++ b/easy_abc.py
+@@ -3960,6 +3960,8 @@ class MainFrame(wx.Frame):
+         else:
+             default_soundfont_path = '/usr/share/sounds/sf2/FluidR3_GM.sf2'
+
++        default_soundfont_path = '@soundfont@'
++
+         soundfont_path = settings.get('soundfont_path', default_soundfont_path)
+         self.uses_fluidsynth = False
+         if fluidsynth_available and soundfont_path and os.path.exists(soundfont_path):
+@@ -8367,6 +8369,8 @@ class MainFrame(wx.Frame):
+                 gs_path = '/usr/bin/pstopdf'
+                 settings['gs_path'] = gs_path
+
++            settings['gs_path'] = '@ghostscript@'
++
+         # 1.3.6.1 [SS] 2015-01-12 2015-01-22
+         gs_path = settings['gs_path'] #eliminate trailing \n
+         if gs_path and (os.path.exists(gs_path) == False):
+diff --git a/fluidsynth.py b/fluidsynth.py
+index 529ebbf..b5d9377 100644
+--- a/fluidsynth.py
++++ b/fluidsynth.py
+@@ -44,6 +44,8 @@ if platform.system() == 'Windows':
+ else:
+     lib_locations = ['./libfluidsynth.so.3', 'libfluidsynth.so.3', './libfluidsynth.so.2', 'libfluidsynth.so.2']
+
++lib_locations = ['@fluidsynth@']
++
+ i = 0
+ while i < len(lib_locations):
+     try:
+--
+2.38.5
+
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 68e0ce879882..9dadb938610b 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-0ZsimNRCQRklAaq0oYx4gPAOmz2V+a8tqbszSaa3BOU=",
+    "hash": "sha256-3tJoKGjsBb80Z+2XSLvUKcKApDNY+wmVbq4Qb45r1uo=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.4.0",
+    "rev": "v5.5.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-kzyaT64pwoRIW9ZJ7+BsU6bx2+36dkZD3S8Mram6qO0="
+    "vendorHash": "sha256-4bQ0GRcbIRk240BSccQ5SZBDDLmJGRs4r9ZzATfjp60="
   },
   "azuread": {
     "hash": "sha256-wBNS2a6O1QJgssbAWhSRSfxaVZ35zgT/qNdpE++NQ8U=",
@@ -128,11 +128,11 @@
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-YrAEwWHlxh8e0uH9UEy7F5wZkOzbqXUfy2g2uVwBrxA=",
+    "hash": "sha256-mpCd1POtIN/gaiXdL832UK6a1XoaUYHpS6shD8WXA88=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.61.0",
+    "rev": "v3.62.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -381,11 +381,11 @@
     "vendorHash": "sha256-E1gzdES/YVxQq2J47E2zosvud2C/ViBeQ8+RfNHMBAg="
   },
   "fastly": {
-    "hash": "sha256-ZskfmyYqUFa848uAl+ejBUaYiD0dWdwUyWBw5TKRrHg=",
+    "hash": "sha256-vQ9SXWVr7eAg0SvwR5t5CvAllD6wG4aqmleMFYoREfE=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v5.1.0",
+    "rev": "v5.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -399,13 +399,13 @@
     "vendorHash": "sha256-DSdE0CkAIJje71/S64no9fMJMUhAnFiK3lWewvcyE14="
   },
   "fly": {
-    "hash": "sha256-houGmQPvoOI2We6blMRuGrcuK7M9qLbB7XhvvHR9JZY=",
+    "hash": "sha256-9QB2fbggCKcJz8tkSYgq/X8r+MB2M76VCWXgsHARTkU=",
     "homepage": "https://registry.terraform.io/providers/fly-apps/fly",
     "owner": "fly-apps",
     "repo": "terraform-provider-fly",
-    "rev": "v0.0.22",
+    "rev": "v0.0.23",
     "spdx": "BSD-3-Clause",
-    "vendorHash": "sha256-Z6PAMT2AyTWJr7FmZ1LcIRRK9KQB4MihBz/Vwefu/58="
+    "vendorHash": "sha256-f+Z6Y2WPxqJoHoCwuK6sgFa8nUnkW/WwrD55dtU0wtM="
   },
   "fortios": {
     "deleteVendor": true,
@@ -428,22 +428,22 @@
     "vendorHash": "sha256-uWTY8cFztXFrQQ7GW6/R+x9M6vHmsb934ldq+oeW5vk="
   },
   "github": {
-    "hash": "sha256-12DVzeH+peamZ0GtnjGh6Bn+YdGALtrbYTqMtZC0Z6U=",
+    "hash": "sha256-xJ2mmlZZAd/a6eQ3yfu3OhZU1eq5qODgvMwjpZNfSUQ=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v5.28.0",
+    "rev": "v5.28.1",
     "spdx": "MIT",
     "vendorHash": null
   },
   "gitlab": {
-    "hash": "sha256-zNwjTIt7ngDkHd3VpHkA4xKDjsxQ7vJaWtLH4pMl3S0=",
+    "hash": "sha256-SHc1Mz1JsmNqTjfuJ4Ncll7fh5ruoRXNUAQRfFlibog=",
     "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
     "owner": "gitlabhq",
     "repo": "terraform-provider-gitlab",
-    "rev": "v16.0.3",
+    "rev": "v16.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-KD9X7EOH1btgLtssuz1FFOGtmfNao8HBcKJDty1wtpY="
+    "vendorHash": "sha256-XgGNz+yP+spRA2+qFxwiZFcBRv2GQWhiYY9zoC8rZPc="
   },
   "google": {
     "hash": "sha256-a0ReG2hwsPG6h93df+yRrhFSNXv0EOsxoSU7B+S90jA=",
@@ -493,13 +493,13 @@
     "vendorHash": null
   },
   "hcloud": {
-    "hash": "sha256-PAsXAZMCo4mXLLh2h40xN9SuTnCnScwdjAT2j5HvNrI=",
+    "hash": "sha256-gb5Mp9LI0wb+oA+lfkEmrVEIJzCRoAhugFfJaOkvLVw=",
     "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
     "owner": "hetznercloud",
     "repo": "terraform-provider-hcloud",
-    "rev": "v1.40.0",
+    "rev": "v1.41.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-dORrQ0gmSLOfyPOuFE84h9OkFI9yslRBfYhwnZM3iQc="
+    "vendorHash": "sha256-jEzCvhfQTK/1MCODUN4tNrtnNE0yR23QI5Vnx1kYr4E="
   },
   "helm": {
     "hash": "sha256-mGrQ5YKNsv1+Vkan5ohMXnTYofhCQPuTFjemXF/g+tA=",
@@ -1035,11 +1035,11 @@
     "vendorHash": null
   },
   "snowflake": {
-    "hash": "sha256-0TnsoK1B6npf4zkaG2hkE8WVXgrI7DsFZFuqFd8kz/4=",
+    "hash": "sha256-QxqzIaDzVxvxnf10rLWl4CUUIvzWLsSyWHXBg5S1608=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.66.2",
+    "rev": "v0.67.0",
     "spdx": "MIT",
     "vendorHash": "sha256-ZNkZ2GMSBZHz+L626VqT7pTeb8fSYkaCi84O5ggd1FM="
   },
@@ -1080,11 +1080,11 @@
     "vendorHash": "sha256-fgvNdBwkz+YHOrLRQSe1D+3/VUhttKkJGzV6cg57g8s="
   },
   "sumologic": {
-    "hash": "sha256-+9xH/cr+PMU3zd+WcfawVA0YsmOi9kc5pAe/YTsLoVw=",
+    "hash": "sha256-v4CnT51YUN7p0PdfiUJf7YAlI2pz/zkzTiNFsIWhwUU=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v2.23.0",
+    "rev": "v2.24.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-iNBM4Y24vDGPKyb5cppSogk145F0/pAFmOzEeiWgfLI="
   },
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index de94a1c3bf76..7195bcc571e1 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20230614081211";
+    version = "20230621141418";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-hNFp5vBnFD/vBL6+kYYUaquQanr53ZvvuFP2WYj+mDg=";
+      hash = "sha256-2RUnE96CYZD/0BixdO/2APnjhOAw12lW+XpktfN3B+U=";
     };
     vendorHash = "sha256-lPOn296ngMCYdXoGNDG9okkLC5ryjKIL+UP98lyaKcg=";
     meta = with lib; {
diff --git a/pkgs/development/compilers/abcl/default.nix b/pkgs/development/compilers/abcl/default.nix
index e9b2ef03ce54..7d8e043101fb 100644
--- a/pkgs/development/compilers/abcl/default.nix
+++ b/pkgs/development/compilers/abcl/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     description = "A JVM-based Common Lisp implementation";
     license = lib.licenses.gpl3 ;
     maintainers = lib.teams.lisp.members;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.darwin ++ lib.platforms.linux;
     homepage = "https://common-lisp.net/project/armedbear/";
   };
 }
diff --git a/pkgs/development/compilers/djgpp/default.nix b/pkgs/development/compilers/djgpp/default.nix
index 51b3eb8964e5..25d1e0773cc0 100644
--- a/pkgs/development/compilers/djgpp/default.nix
+++ b/pkgs/development/compilers/djgpp/default.nix
@@ -41,12 +41,15 @@ stdenv.mkDerivation rec {
     runHook postPatch
   '';
 
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
   buildInputs = [
     bison
     curl
     file
     flex
-    makeWrapper
     perl
     texinfo
     unzip
diff --git a/pkgs/development/compilers/opensmalltalk-vm/default.nix b/pkgs/development/compilers/opensmalltalk-vm/default.nix
index 3ee6953ba4de..a049e3e8abec 100644
--- a/pkgs/development/compilers/opensmalltalk-vm/default.nix
+++ b/pkgs/development/compilers/opensmalltalk-vm/default.nix
@@ -71,7 +71,7 @@ let
 
       configureFlags = [ "--with-scriptname=${scriptName}" ] ++ configureFlags;
 
-      buildFlags = "all";
+      buildFlags = [ "all" ];
 
       enableParallelBuilding = true;
 
diff --git a/pkgs/development/python-modules/amply/default.nix b/pkgs/development/python-modules/amply/default.nix
index 64aa0ad76b7b..235a697d2af4 100644
--- a/pkgs/development/python-modules/amply/default.nix
+++ b/pkgs/development/python-modules/amply/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "amply";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rXF7SQtrcFWQn6oZXoKkQytwb4+VhUBQFy9Ckx5HhCY=";
+    hash = "sha256-YUIRA8z44QZnFxFf55F2ENgx1VHGjTGhEIdqW2x4rqQ=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/aranet4/default.nix b/pkgs/development/python-modules/aranet4/default.nix
index 6ea81a8347a3..6e3b1f0e571b 100644
--- a/pkgs/development/python-modules/aranet4/default.nix
+++ b/pkgs/development/python-modules/aranet4/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aranet4";
-  version = "2.1.3";
+  version = "2.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Anrijs";
     repo = "Aranet4-Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5q4eOC9iuN8pUmDsiQ7OwEXkxi4KdL+bhGVjlQlTBAg=";
+    hash = "sha256-u2KLs+j8MvJhyX8rpMjd1uwPSD8hkCbhOL7Y/FqbwTM=";
   };
 
   propagatedBuildInputs = [
@@ -34,6 +34,11 @@ buildPythonPackage rec {
     "aranet4"
   ];
 
+  disabledTests = [
+    # Test compares rendered output
+    "test_current_values"
+  ];
+
   meta = with lib; {
     description = "Module to interact with Aranet4 devices";
     homepage = "https://github.com/Anrijs/Aranet4-Python";
diff --git a/pkgs/development/python-modules/arcam-fmj/default.nix b/pkgs/development/python-modules/arcam-fmj/default.nix
index adc187fdc544..df5bcc40836f 100644
--- a/pkgs/development/python-modules/arcam-fmj/default.nix
+++ b/pkgs/development/python-modules/arcam-fmj/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "arcam-fmj";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "elupus";
     repo = "arcam_fmj";
     rev = "refs/tags/${version}";
-    hash = "sha256-TFZoWni33dzioADpTt50fqwBlZ/rdUergGs3s3d0504=";
+    hash = "sha256-/A3Fs0JyzW05L80CtI07Y/kTTrIC6yqubJfYO0kAEf0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bimmer-connected/default.nix b/pkgs/development/python-modules/bimmer-connected/default.nix
index b809249fbfe8..90278ad928d7 100644
--- a/pkgs/development/python-modules/bimmer-connected/default.nix
+++ b/pkgs/development/python-modules/bimmer-connected/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "bimmer-connected";
-  version = "0.13.6";
+  version = "0.13.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "bimmerconnected";
     repo = "bimmer_connected";
     rev = "refs/tags/${version}";
-    hash = "sha256-MQYS7EEBGgvIBjSQ80a49SQv1GNVgeriBtQn+O7hMtg=";
+    hash = "sha256-JnrM2LuvqGHxec2C8eYjO++ejZ2jXIi8XmxpIw/tSxs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/graphtage/default.nix b/pkgs/development/python-modules/graphtage/default.nix
index 53418f486da2..9307da850590 100644
--- a/pkgs/development/python-modules/graphtage/default.nix
+++ b/pkgs/development/python-modules/graphtage/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "graphtage";
-  version = "0.2.7";
+  version = "0.2.8";
 
   disabled = pythonOlder "3.6";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "trailofbits";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-3PJSjK8citdsfTyTLtDOlLeXWhkOW/4ajLC+j8F0BZw=";
+    hash = "sha256-qp3NMN/aeWhr4z6qqh/s4OHebQccyIjSzWIy7P1RruI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/language-servers/typst-lsp/Cargo.lock b/pkgs/development/tools/language-servers/typst-lsp/Cargo.lock
index 5210422f1973..aa07359c6cc2 100644
--- a/pkgs/development/tools/language-servers/typst-lsp/Cargo.lock
+++ b/pkgs/development/tools/language-servers/typst-lsp/Cargo.lock
@@ -1953,7 +1953,7 @@ dependencies = [
 
 [[package]]
 name = "typst-lsp"
-version = "0.7.0"
+version = "0.7.1"
 dependencies = [
  "anyhow",
  "chrono",
diff --git a/pkgs/development/tools/language-servers/typst-lsp/default.nix b/pkgs/development/tools/language-servers/typst-lsp/default.nix
index 1ec17c194d06..bca3371dca85 100644
--- a/pkgs/development/tools/language-servers/typst-lsp/default.nix
+++ b/pkgs/development/tools/language-servers/typst-lsp/default.nix
@@ -5,13 +5,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typst-lsp";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "nvarner";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-t8ho2dX8ulDQI0FME3xF+Fq9A6xYKsujfcXNkw1k7e4=";
+    hash = "sha256-to+M/1TcQTeojwVMuXR2moyZ0L3vhGiokJrWustF/go=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/tools/ruff/Cargo.lock b/pkgs/development/tools/ruff/Cargo.lock
index e171d287d286..43e96c3a5a11 100644
--- a/pkgs/development/tools/ruff/Cargo.lock
+++ b/pkgs/development/tools/ruff/Cargo.lock
@@ -733,7 +733,7 @@ dependencies = [
 
 [[package]]
 name = "flake8-to-ruff"
-version = "0.0.274"
+version = "0.0.275"
 dependencies = [
  "anyhow",
  "clap",
@@ -1793,7 +1793,7 @@ dependencies = [
 
 [[package]]
 name = "ruff"
-version = "0.0.274"
+version = "0.0.275"
 dependencies = [
  "annotate-snippets 0.9.1",
  "anyhow",
@@ -1889,7 +1889,7 @@ dependencies = [
 
 [[package]]
 name = "ruff_cli"
-version = "0.0.274"
+version = "0.0.275"
 dependencies = [
  "annotate-snippets 0.9.1",
  "anyhow",
@@ -2105,7 +2105,7 @@ dependencies = [
 [[package]]
 name = "ruff_text_size"
 version = "0.0.0"
-source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=08ebbe40d7776cac6e3ba66277d435056f2b8dca#08ebbe40d7776cac6e3ba66277d435056f2b8dca"
+source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=f60e204b73b95bdb6ce87ccd0de34081b4a17c11#f60e204b73b95bdb6ce87ccd0de34081b4a17c11"
 dependencies = [
  "schemars",
  "serde",
@@ -2183,7 +2183,7 @@ dependencies = [
 [[package]]
 name = "rustpython-ast"
 version = "0.2.0"
-source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=08ebbe40d7776cac6e3ba66277d435056f2b8dca#08ebbe40d7776cac6e3ba66277d435056f2b8dca"
+source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=f60e204b73b95bdb6ce87ccd0de34081b4a17c11#f60e204b73b95bdb6ce87ccd0de34081b4a17c11"
 dependencies = [
  "is-macro",
  "num-bigint",
@@ -2194,7 +2194,7 @@ dependencies = [
 [[package]]
 name = "rustpython-format"
 version = "0.2.0"
-source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=08ebbe40d7776cac6e3ba66277d435056f2b8dca#08ebbe40d7776cac6e3ba66277d435056f2b8dca"
+source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=f60e204b73b95bdb6ce87ccd0de34081b4a17c11#f60e204b73b95bdb6ce87ccd0de34081b4a17c11"
 dependencies = [
  "bitflags 2.3.1",
  "itertools",
@@ -2206,7 +2206,7 @@ dependencies = [
 [[package]]
 name = "rustpython-literal"
 version = "0.2.0"
-source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=08ebbe40d7776cac6e3ba66277d435056f2b8dca#08ebbe40d7776cac6e3ba66277d435056f2b8dca"
+source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=f60e204b73b95bdb6ce87ccd0de34081b4a17c11#f60e204b73b95bdb6ce87ccd0de34081b4a17c11"
 dependencies = [
  "hexf-parse",
  "is-macro",
@@ -2218,7 +2218,7 @@ dependencies = [
 [[package]]
 name = "rustpython-parser"
 version = "0.2.0"
-source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=08ebbe40d7776cac6e3ba66277d435056f2b8dca#08ebbe40d7776cac6e3ba66277d435056f2b8dca"
+source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=f60e204b73b95bdb6ce87ccd0de34081b4a17c11#f60e204b73b95bdb6ce87ccd0de34081b4a17c11"
 dependencies = [
  "anyhow",
  "is-macro",
@@ -2241,7 +2241,7 @@ dependencies = [
 [[package]]
 name = "rustpython-parser-core"
 version = "0.2.0"
-source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=08ebbe40d7776cac6e3ba66277d435056f2b8dca#08ebbe40d7776cac6e3ba66277d435056f2b8dca"
+source = "git+https://github.com/astral-sh/RustPython-Parser.git?rev=f60e204b73b95bdb6ce87ccd0de34081b4a17c11#f60e204b73b95bdb6ce87ccd0de34081b4a17c11"
 dependencies = [
  "is-macro",
  "memchr",
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 5222abdb9a46..73e903230bb2 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.274";
+  version = "0.0.275";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0JaeLvc6pwvt9a7wAbah6sVgmHf6GParwdkiW3jQPaQ=";
+    hash = "sha256-HsoycugHzgudY3Aixv5INlOLTjLMzP+gKMMKIreiODs=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "libcst-0.1.0" = "sha256-jG9jYJP4reACkFLrQBWOYH6nbKniNyFVItD0cTZ+nW0=";
-      "ruff_text_size-0.0.0" = "sha256-qMJ29bkET3JNPeggcA91sXSw2r4bY7rzXtJfY3uy/ws=";
+      "ruff_text_size-0.0.0" = "sha256-oIMZ+7oCID0Ud9Ss6hZjJDvAv7wepyODU31Pb3EOxiM=";
       "unicode_names2-0.6.0" = "sha256-eWg9+ISm/vztB0KIdjhq5il2ZnwGJQCleCYfznCI3Wg=";
     };
   };
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index 33b0c7d9dab9..5e196e4c307a 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.15.3";
+  version = "1.15.5";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zT8+teKDnjvgJNVMpK5b0c6EH1BugVgl0QGVidpxoso=";
+    hash = "sha256-5QrUB7p78HmwTUagYKNbFxndUKdeGd51gpqIO1O/8H4=";
   };
 
-  cargoHash = "sha256-2AZSJSAjxdUrt9W3xOVNOWhjJrbuvAw0/aO9YWmNDJA=";
+  cargoHash = "sha256-ZNWG3eKnT2LFywIQO1iLIhaUKrINdwbCsSbC55wFrF4=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/development/tools/yaml2json/default.nix b/pkgs/development/tools/yaml2json/default.nix
index 543ed7fc3eaf..09476976ecde 100644
--- a/pkgs/development/tools/yaml2json/default.nix
+++ b/pkgs/development/tools/yaml2json/default.nix
@@ -1,18 +1,22 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-
-buildGoPackage rec {
+buildGoModule rec {
   pname = "yaml2json";
-  version = "1.3";
-  goPackagePath = "github.com/bronze1man/yaml2json";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "bronze1man";
     repo = "yaml2json";
     rev = "v${version}";
-    sha256 = "0bhjzl4qibiyvn56wcsm85f3vwnlzf4gywy2gq9mrnbrl629amq1";
+    hash = "sha256-yVA5eV+/TxWN3wzsHy5++IGMAopkCz+PBfjSD+TNKc8=";
   };
 
+  vendorHash = "sha256-g+yaVIx4jxpAQ/+WrGKxhVeliYx7nLQe/zsGpxV4Fn4=";
+
+  subPackages = [ "." ];
+
+  ldflags = [ "-s" "-w" ];
+
   meta = with lib; {
     homepage = "https://github.com/bronze1man/yaml2json";
     description = "Convert yaml to json";
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index deb48cea78d4..4e1c34d6ae4b 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4-rc6";
+  version = "6.4-rc7";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchzip {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    hash = "sha256-gJSVjuYoA5k7XuxRirS/ac770ZfXqIUvI7BUPwxvN1g=";
+    hash = "sha256-UDhLrKe8yMvmWbS19Xt1G3SQpAUWyKrfV3v1MJ5Vep8=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index d5271cadd24a..9f568dec5d71 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.21.258";
+  version = "0.21.275";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-Y+vYh6T1NvOGGyZwzFY+h24CWhRtKGQSxTTqWL3xMQC6YB74W1I7hnQPz+X4Gae9/5ozShOzBzpcsMOvUQWl5Q==";
+    hash = "sha512-MQrIzt/V6MWhRvdpBFR1sg8CeJNE3r05+DdxVYssRjFSqDOLTAOoL8Dd0S2upuzFTBcxB2dIYDYfdKrtUT8suA==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 01ccb843b124..3af5e5b6f551 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -1,16 +1,19 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, makeWrapper, iptables, iproute2, procps, shadow, getent }:
 
-buildGoModule rec {
+let
+  version = "1.44.0";
+in
+buildGoModule {
   pname = "tailscale";
-  version = "1.42.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-J7seajRoUOG/nm5iYuiv3lcS5vTT1XxZTxiSmf/TjGI=";
+    hash = "sha256-/SiQFkhVseLkjK7ePNzNyBs0r3XE3kHJ6CDTFjdCXec=";
   };
-  vendorHash = "sha256-7L+dvS++UNfMVcPUCbK/xuBPwtrzW4RpZTtcl7VCwQs=";
+  vendorHash = "sha256-fgCrmtJs1svFz0Xn7iwLNrbBNlcO6V0yqGPMY0+V1VQ=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 474253722661..a59ba30b35d7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4823,6 +4823,8 @@ with pkgs;
 
   earlyoom = callPackage ../os-specific/linux/earlyoom { };
 
+  easyabc = callPackage ../applications/audio/easyabc { };
+
   easycrypt = callPackage ../applications/science/logic/easycrypt { };
 
   easycrypt-runtest = callPackage ../applications/science/logic/easycrypt/runtest.nix { };
diff --git a/pkgs/top-level/emacs-packages.nix b/pkgs/top-level/emacs-packages.nix
index f7e614c8b3d6..3f61bc2229d0 100644
--- a/pkgs/top-level/emacs-packages.nix
+++ b/pkgs/top-level/emacs-packages.nix
@@ -100,6 +100,9 @@ in makeScope pkgs'.newScope (self: makeOverridable ({
 
     # Package specific priority overrides goes here
 
+    # EXWM is not tagged very often, prefer it from elpa devel.
+    inherit (elpaDevelPackages) exwm;
+
     # Telega uploads packages incompatible with stable tdlib to melpa
     # Prefer the one from melpa stable
     inherit (melpaStablePackages) telega;