Merge release-24.05 into staging-next-24.05

44 files changed, 311 insertions, 318 deletions

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index eaa434d3d0bf..ea3d88678851 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -11,11 +11,14 @@
 # This also holds true for GitHub teams. Since almost none of our teams have write
 # permissions, you need to list all members of the team with commit access individually.
 
-# GitHub actions
+# CI
 /.github/workflows @NixOS/Security @Mic92 @zowoq
+/.github/workflows/check-nix-format.yml @infinisil
+/ci @infinisil
 
-# EditorConfig
+# Develompent support
 /.editorconfig @Mic92 @zowoq
+/shell.nix @infinisil @NixOS/Security
 
 # Libraries
 /lib                        @infinisil
diff --git a/.github/workflows/check-nix-format.yml b/.github/workflows/check-nix-format.yml
index 131803213cb5..5459240766a1 100644
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@@ -19,13 +19,18 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - name: Get Nixpkgs revision for nixfmt
+        run: |
+          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt
+          # from staging
+          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
+          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
+          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
       - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
-          # fix a commit from nixpkgs-unstable to avoid e.g. building nixfmt
-          # from staging
-          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/4b455dc2048f73a79eb3713f342369ff58f93e0b.tar.gz
+          nix_path: nixpkgs=${{ env.url }}
       - name: Install nixfmt
         run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
       - name: Check that Nix files are formatted according to the RFC style
@@ -35,14 +40,14 @@ jobs:
           NIX_FMT_PATHS_BSD: pkgs/os-specific/bsd
           NIX_FMT_PATHS_MPVSCRIPTS: pkgs/applications/video/mpv/scripts
           # Format paths related to the Nixpkgs CUDA ecosystem.
-          NIX_FMT_PATHS_CUDA: |
+          NIX_FMT_PATHS_CUDA: |-
             pkgs/development/cuda-modules
             pkgs/test/cuda
             pkgs/top-level/cuda-packages.nix
-          NIX_FMT_PATHS_MAINTAINERS: |
+          NIX_FMT_PATHS_MAINTAINERS: |-
             maintainers/maintainer-list.nix
             maintainers/team-list.nix
-          NIX_FMT_PATHS_K3S: |
+          NIX_FMT_PATHS_K3S: |-
             nixos/modules/services/cluster/k3s
             nixos/tests/k3s
             pkgs/applications/networking/cluster/k3s
@@ -51,6 +56,7 @@ jobs:
           NIX_FMT_PATHS_BUILD_SUPPORT_PHP: pkgs/build-support/php
         # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
         run: |
+          unformattedPaths=()
           for env_var in "${!NIX_FMT_PATHS_@}"; do
             readarray -t paths <<< "${!env_var}"
             if [[ "${paths[*]}" == "" ]]; then
@@ -59,7 +65,12 @@ jobs:
             fi
             echo "Checking paths: ${paths[@]}"
             if ! nixfmt --check "${paths[@]}"; then
-              echo "Error: nixfmt failed."
-              exit 1
+              unformattedPaths+=("${paths[@]}")
             fi
           done
+          if (( "${#unformattedPaths[@]}" > 0 )); then
+            echo "Some required Nix files are not properly formatted"
+            echo "Please run the following in \`nix-shell\`:"
+            echo "nixfmt ${unformattedPaths[*]@Q}"
+            exit 1
+          fi
diff --git a/.github/workflows/check-shell.yml b/.github/workflows/check-shell.yml
new file mode 100644
index 000000000000..01ea97dfff20
--- /dev/null
+++ b/.github/workflows/check-shell.yml
@@ -0,0 +1,29 @@
+name: "Check shell"
+
+on:
+  pull_request_target:
+
+permissions: {}
+
+jobs:
+  x86_64-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      - name: Build shell
+        run: nix-build shell.nix
+
+  aarch64-darwin:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      - name: Build shell
+        run: nix-build shell.nix
diff --git a/ci/README.md b/ci/README.md
new file mode 100644
index 000000000000..64cd8e5bcea9
--- /dev/null
+++ b/ci/README.md
@@ -0,0 +1,12 @@
+# CI support files
+
+This directory contains files to support CI, such as [GitHub Actions](https://github.com/NixOS/nixpkgs/tree/master/.github/workflows) and [Ofborg](https://github.com/nixos/ofborg).
+This is in contrast with [`maintainers/scripts`](`../maintainers/scripts`) which is for human use instead.
+
+## Pinned Nixpkgs
+
+CI may need certain packages from Nixpkgs.
+In order to ensure that the needed packages are generally available without building,
+[`pinned-nixpkgs.json`](./pinned-nixpkgs.json) contains a pinned Nixpkgs version tested by Hydra.
+
+Run [`update-pinned-nixpkgs.sh`](./update-pinned-nixpkgs.sh) to update it.
diff --git a/ci/pinned-nixpkgs.json b/ci/pinned-nixpkgs.json
new file mode 100644
index 000000000000..29af1b022581
--- /dev/null
+++ b/ci/pinned-nixpkgs.json
@@ -0,0 +1,4 @@
+{
+  "rev": "cfb89a95f19bea461fc37228dc4d07b22fe617c2",
+  "sha256": "1yhsacvry6j8r02lk70p9dphjpi8lpzgq2qay8hiy4nqlys0mrch"
+}
diff --git a/ci/update-pinned-nixpkgs.sh b/ci/update-pinned-nixpkgs.sh
new file mode 100755
index 000000000000..776558130057
--- /dev/null
+++ b/ci/update-pinned-nixpkgs.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq
+
+set -euo pipefail
+
+# https://stackoverflow.com/a/246128
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+repo=https://github.com/nixos/nixpkgs
+branch=nixpkgs-unstable
+file=$SCRIPT_DIR/pinned-nixpkgs.json
+
+rev=$(git ls-remote "$repo" refs/heads/"$branch" | cut -f1)
+sha256=$(nix-prefetch-url --unpack "$repo/archive/$rev.tar.gz" --name source)
+
+jq -n --arg rev "$rev" --arg sha256 "$sha256" '$ARGS.named' | tee /dev/stderr > $file
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 54d3a107d627..67508cf32eef 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/1w4b47zhp33md29wjhgg549pc281vv02-nix-2.18.4";
-  i686-linux = "/nix/store/hz02kn0ffn3wdi2xs7lndpr88v4v4fp2-nix-2.18.4";
-  aarch64-linux = "/nix/store/90zwqa9z2fgldc7ki1p5gfvglchjh9r6-nix-2.18.4";
-  x86_64-darwin = "/nix/store/bd1ix5mj9lj2yh7bqnmdjc24zlg5jivk-nix-2.18.4";
-  aarch64-darwin = "/nix/store/5hvsmklhqiay5i4q5vdkg60p8qpc69rz-nix-2.18.4";
+  x86_64-linux = "/nix/store/4rs65bbl7x7ba8xi65x3j9zfc219vp8j-nix-2.18.5";
+  i686-linux = "/nix/store/qfzjbq958jnscjl1k8wr6gmpi5876dw6-nix-2.18.5";
+  aarch64-linux = "/nix/store/ns0ir4zmhn4bj55h3vvjcx1y3h5f6gy5-nix-2.18.5";
+  x86_64-darwin = "/nix/store/h8pgzxglir6jdpv07plxz01z9ak7m9md-nix-2.18.5";
+  aarch64-darwin = "/nix/store/8grhqqmsmpsvn7d4m30g3jgwn5ik9i7k-nix-2.18.5";
 }
diff --git a/pkgs/applications/editors/ldtk/default.nix b/pkgs/applications/editors/ldtk/default.nix
index f93e0c62e385..4e05fc2b3911 100644
--- a/pkgs/applications/editors/ldtk/default.nix
+++ b/pkgs/applications/editors/ldtk/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm644 'LDtk ${finalAttrs.version} installer.AppImage' $out/share/ldtk.AppImage
     makeWrapper ${appimage-run}/bin/appimage-run $out/bin/ldtk \
       --add-flags $out/share/ldtk.AppImage
-    install -Dm644 src/ldtk.png $out/share/icons/hicolor/1024x1024/apps/ldtk.png
+    install -Dm644 src/ldtk.png $out/share/icons/hicolor/512x512/apps/ldtk.png
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index f76f82856055..c23bc5a9baa9 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -77,14 +77,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.34.7";
+  version = "3.34.8";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-6fIBmIoCVo0AtkjC4Vn3jMjz93gZmvkFAgo+KnasyXo=";
+    hash = "sha256-UeyGx+C7szXv++hXFV006Xk4oSKfSj4teJIwaD4ODVk=";
   };
 
   passthru = {
@@ -147,9 +147,7 @@ in mkDerivation rec {
 
   # Add path to Qt platform plugins
   # (offscreen is needed by "${APIS_SRC_DIR}/generate_console_pap.py")
-  preBuild = ''
-    export QT_QPA_PLATFORM_PLUGIN_PATH=${qtbase.bin}/lib/qt-${qtbase.version}/plugins/platforms
-  '';
+  env.QT_QPA_PLATFORM_PLUGIN_PATH="${qtbase}/${qtbase.qtPluginPrefix}/platforms";
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=Release"
@@ -164,7 +162,7 @@ in mkDerivation rec {
     );
 
   qtWrapperArgs = [
-    "--set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-${qtbase.version}/plugins/platforms"
+    "--set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase}/${qtbase.qtPluginPrefix}/platforms"
   ];
 
   dontWrapGApps = true; # wrapper params passed below
diff --git a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
index 1778aa32efa9..b75eb6296138 100644
--- a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.28.10+k3s1";
-  k3sCommit = "a4c5612ea3dd202135e7c691c534c671a7d43690";
-  k3sRepoSha256 = "00r06kc98nvbmaai8m2pbqsl0v6y3kbc3rz3l7lb9wy4qhiyxrww";
-  k3sVendorHash = "sha256-8PbpjPVX+Yimhwbydu9YOTIMRTf/iLG21Ee/QMowp5Y=";
+  k3sVersion = "1.28.11+k3s1";
+  k3sCommit = "617b0e84f419e37ba995c6dec06ccfbb24bd649c";
+  k3sRepoSha256 = "04pmg0qx1sidpkv72vllmnk82v4fg490gvppp79m3jc931v059w9";
+  k3sVendorHash = "sha256-6uCzObYCIETT/aswsHR9hOzUPNZe8GJbLWfNqOKWyag=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.12.2";
   k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.15-k3s1";
-  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
+  containerdVersion = "1.7.17-k3s1.28";
+  containerdSha256 = "0nhhx932j551ran3kkvyp4nmsg5c71mq0g6jrcbs2j4nn7yqdkhm";
   criCtlVersion = "1.26.0-rc.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
index e06f394df94a..73d9f0587e73 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.29.5+k3s1";
-  k3sCommit = "4e53a32306759581f4ed938bcd18b6fa20b83230";
-  k3sRepoSha256 = "169hzl23chs4qblicmqj3j10jg1xdq8s9717bd3pzx7wzz9s9mqw";
-  k3sVendorHash = "sha256-QreiB4JMtfBjHlkAyflQAW2rnfgay62UD6emx8TgUpM=";
+  k3sVersion = "1.29.6+k3s2";
+  k3sCommit = "b4b156d9d14eeb475e789718b3a6b78aba00019e";
+  k3sRepoSha256 = "0wagfh4vbvyi62np6zx7b4p6myn0xavw691y78rnbl32jckiy14f";
+  k3sVendorHash = "sha256-o36gf3q7Vv+RoY681cL44rU2QFrdFW3EbRpw3dLcVTI=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.13.0";
   k3sRootSha256 = "1jq5f0lm08abx5ikarf92z56fvx4kjpy2nmzaazblb34lajw87vj";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.15-k3s1";
-  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
+  containerdVersion = "1.7.17-k3s1";
+  containerdSha256 = "1j61mbgx346ydvnjd8b07wf7nmvvplx28wi5jjdzi1k688r2hxpf";
   criCtlVersion = "1.29.0-k3s1";
 }
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 81dd459f5cb0..46b30dea7aff 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -54,7 +54,7 @@ assert withQt -> qt6 != null;
 
 stdenv.mkDerivation rec {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.2.5";
+  version = "4.2.6";
 
   outputs = [ "out" "dev" ];
 
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     repo = "wireshark";
     owner = "wireshark";
     rev = "v${version}";
-    hash = "sha256-g0b0YGWQzWsALVnNJl/WQGl9J2QjaLnry2VL6qvN1FQ=";
+    hash = "sha256-zlFTUgsEKraE9crS5SZ13r93JJzUb6eyBhusJbbGwsE=";
   };
 
   patches = [
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index f03bdf9631c5..6237db9cd699 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -9,14 +9,14 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "apptainer";
-        version = "1.3.2";
+        version = "1.3.3";
         projectName = "apptainer";
 
         src = fetchFromGitHub {
           owner = "apptainer";
           repo = "apptainer";
           rev = "refs/tags/v${version}";
-          hash = "sha256-NseigaPmRKDsBk8v7RpYf+uoEGvQHVnqOMO49kP0mQ8=";
+          hash = "sha256-xQZCQa9z1aJ2tVtxMlwcNhlm0EV/nn8OnbfaVZRm4JI=";
         };
 
         # Update by running
@@ -47,20 +47,20 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "singularity-ce";
-        version = "4.1.3";
+        version = "4.1.4";
         projectName = "singularity";
 
         src = fetchFromGitHub {
           owner = "sylabs";
           repo = "singularity";
           rev = "refs/tags/v${version}";
-          hash = "sha256-pR8zyMr23wcbDCXAysVEgGUDHkrfhLoVF3fjMLgZFYs=";
+          hash = "sha256-+qwPzgwfF6A1c/rmSM/5T2N9/wVeWhMoAthj3eSQmh8=";
         };
 
         # Update by running
         # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).goModules"
         # at the root directory of the Nixpkgs repository
-        vendorHash = "sha256-332GFL04aE6B6vxgtJJH4TeI6YJCDBpCClJ3sc5gN3A=";
+        vendorHash = "sha256-dTqOSk8APLOsqwEiZ/IL8Zu1SR48MyEYPgRe6PC2nd8=";
 
         # Do not build conmon and squashfuse from the Git submodule sources,
         # Use Nixpkgs provided version
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 9690ee757c0d..1edbddc8ea72 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -32,11 +32,11 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  virtualboxVersion = "7.0.14";
-  virtualboxSha256 = "45860d834804a24a163c1bb264a6b1cb802a5bc7ce7e01128072f8d6a4617ca9";
+  virtualboxVersion = "7.0.18";
+  virtualboxSha256 = "d999513533631674a024762668de999411d8197060c51e68c5faf0a2c0eea1a5";
 
-  kvmPatchVersion = "20240502";
-  kvmPatchHash = "sha256-KokIrrAoJutHzPg6e5YAJgDGs+nQoVjapmyn9kG5tV0=";
+  kvmPatchVersion = "20240515";
+  kvmPatchHash = "sha256-Kh/tlPScdf7CbEEpL54iqMpeUIdmnJL2r/mxnlEzLd0=";
 
   # The KVM build is not compatible to VirtualBox's kernel modules. So don't export
   # modsrc at all.
@@ -135,8 +135,6 @@ in stdenv.mkDerivation (finalAttrs: {
     ./qt-dependency-paths.patch
     # https://github.com/NixOS/nixpkgs/issues/123851
     ./fix-audio-driver-loading.patch
-    ./libxml-2.12.patch
-    ./gcc-13.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/virtualbox/extpack.nix b/pkgs/applications/virtualization/virtualbox/extpack.nix
index fad5aa6e10fb..089ab4856c0d 100644
--- a/pkgs/applications/virtualization/virtualbox/extpack.nix
+++ b/pkgs/applications/virtualization/virtualbox/extpack.nix
@@ -12,7 +12,7 @@ fetchurl rec {
     # Manually sha256sum the extensionPack file, must be hex!
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://www.virtualbox.org/download/hashes/${version}/SHA256SUMS
-    let value = "42cb36fbf439a9ed28c95d2bbc718a0eac902225eb579c884c549af2e94be633";
+    let value = "cab1abad478679fc34a0c5cb4a6d3566edc20e3c54cbed39c8e895d8cfad3ee2";
     in assert (builtins.stringLength value) == 64; value;
 
   meta = {
diff --git a/pkgs/applications/virtualization/virtualbox/gcc-13.patch b/pkgs/applications/virtualization/virtualbox/gcc-13.patch
deleted file mode 100644
index c06780299f95..000000000000
--- a/pkgs/applications/virtualization/virtualbox/gcc-13.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-diff --git a/src/VBox/Additions/common/VBoxGuest/lib/VBoxGuestR3LibRuntimeXF86.cpp b/src/VBox/Additions/common/VBoxGuest/lib/VBoxGuestR3LibRuntimeXF86.cpp
-index 8a9d15c0..260ebc5c 100644
---- a/src/VBox/Additions/common/VBoxGuest/lib/VBoxGuestR3LibRuntimeXF86.cpp
-+++ b/src/VBox/Additions/common/VBoxGuest/lib/VBoxGuestR3LibRuntimeXF86.cpp
-@@ -46,6 +46,9 @@
- #if defined(VBOX_VBGLR3_XFREE86)
- extern "C" {
- # define XFree86LOADER
-+# ifdef RT_GNUC_PREREQ(13,0) /* cmath gets dragged in and the c++/13/cmath header is allergic to -ffreestanding.  */
-+#  define _GLIBCXX_INCLUDE_NEXT_C_HEADERS
-+# endif
- # include <xf86_ansic.h>
- # undef size_t
- }
-diff --git a/src/libs/dxvk-native-1.9.2a/src/util/util_matrix.cpp b/src/libs/dxvk-native-1.9.2a/src/util/util_matrix.cpp
-index 2c5e9314..64890169 100644
---- a/src/libs/dxvk-native-1.9.2a/src/util/util_matrix.cpp
-+++ b/src/libs/dxvk-native-1.9.2a/src/util/util_matrix.cpp
-@@ -1,3 +1,5 @@
-+#include <cstdint>
-+
- #include "util_matrix.h"
- 
- namespace dxvk {
-diff --git a/src/libs/dxvk-native-1.9.2a/src/util/util_vector.h b/src/libs/dxvk-native-1.9.2a/src/util/util_vector.h
-index 77cdf294..9dcb4bf9 100644
---- a/src/libs/dxvk-native-1.9.2a/src/util/util_vector.h
-+++ b/src/libs/dxvk-native-1.9.2a/src/util/util_vector.h
-@@ -1,5 +1,6 @@
- #pragma once
- 
-+#include <cstdint>
- #include <iostream>
- 
- #include "util_bit.h"
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix
index cd2f58afc92a..9529c980475d 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix
@@ -5,7 +5,7 @@ let
 in
 fetchurl {
   url = "http://download.virtualbox.org/virtualbox/${version}/VBoxGuestAdditions_${version}.iso";
-  sha256 = "0efbcb9bf4722cb19292ae00eba29587432e918d3b1f70905deb70f7cf78e8ce";
+  sha256 = "4469bab0f59c62312b0a1b67dcf9c07a8a971afad339fa2c3eb80e209e099ef9";
   meta = {
     description = "Guest additions ISO for VirtualBox";
     longDescription = ''
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix
index f070f0df4322..72c0af9626f7 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix
@@ -10,11 +10,11 @@ let
 
 in stdenv.mkDerivation (finalAttrs: {
   pname = "VirtualBox-GuestAdditions-builder-${kernel.version}";
-  version = "7.0.14";
+  version = "7.0.18";
 
   src = fetchurl {
     url = "https://download.virtualbox.org/virtualbox/${finalAttrs.version}/VirtualBox-${finalAttrs.version}.tar.bz2";
-    sha256 = "45860d834804a24a163c1bb264a6b1cb802a5bc7ce7e01128072f8d6a4617ca9";
+    sha256 = "d999513533631674a024762668de999411d8197060c51e68c5faf0a2c0eea1a5";
   };
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
@@ -37,13 +37,9 @@ in stdenv.mkDerivation (finalAttrs: {
   '';
 
   patches = [
-    ../gcc-13.patch
-    # https://www.virtualbox.org/changeset/100258/vbox
+    #../gcc-13.patch
+    ## https://www.virtualbox.org/changeset/100258/vbox
     ./no-legacy-xorg.patch
-    # https://www.virtualbox.org/changeset/102989/vbox
-    ./strlcpy-1.patch
-    # https://www.virtualbox.org/changeset/102990/vbox
-    ./strlcpy-2.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/strlcpy-1.patch b/pkgs/applications/virtualization/virtualbox/guest-additions/strlcpy-1.patch
deleted file mode 100644
index 642f5864d208..000000000000
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/strlcpy-1.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-# https://www.virtualbox.org/changeset/102989/vbox
---- a/include/iprt/string.h
-+++ b/include/iprt/string.h
-@@ -244,4 +244,26 @@
- #else  /* !RT_OS_LINUX && !__KERNEL__ */
- # define RT_BCOPY_UNFORTIFIED(a_pDst, a_pSrc, a_cbToCopy)   memcpy((a_pDst), (a_pSrc), (a_cbToCopy))
-+#endif /* !RT_OS_LINUX && !__KERNEL__ */
-+
-+/** @def RT_STRSCPY
-+ * Copy string and NULL-terminate output buffer.
-+ *
-+ * This macro should mostly be used in Linux kernel code. This is
-+ * the replacement for deprecated strlcpy. It was deprecated since 3.16.60
-+ * when strscpy was introduced as an alternative. Finally, strlcpy was
-+ * completely removed from kernel code in 6.8.0.
-+ *
-+ * @param   a_pDst          Pointer to the destination string buffer.
-+ * @param   a_pSrc          Pointer to the source NULL-terminated string buffer.
-+ * @param   a_cbToCopy      Size of destination buffer..
-+ */
-+#if defined(RT_OS_LINUX) && defined(__KERNEL__)
-+# if (RTLNX_VER_MIN(3,16,60))
-+#  define RT_STRSCPY(a_pDst, a_pSrc, a_cbToCopy)    strscpy((a_pDst), (a_pSrc), (a_cbToCopy))
-+# else /* < 3.16.60 */
-+#  define RT_STRSCPY(a_pDst, a_pSrc, a_cbToCopy)    strlcpy((a_pDst), (a_pSrc), (a_cbToCopy))
-+# endif
-+#else  /* !RT_OS_LINUX && !__KERNEL__ */
-+# define RT_STRSCPY(a_pDst, a_pSrc, a_cbToCopy)    strscpy((a_pDst), (a_pSrc), (a_cbToCopy))
- #endif /* !RT_OS_LINUX && !__KERNEL__ */
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/strlcpy-2.patch b/pkgs/applications/virtualization/virtualbox/guest-additions/strlcpy-2.patch
deleted file mode 100644
index 15e546f89e79..000000000000
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/strlcpy-2.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-# https://www.virtualbox.org/changeset/102990/vbox
---- a/src/VBox/Additions/common/VBoxGuest/VBoxGuest-linux.c
-+++ b/src/VBox/Additions/common/VBoxGuest/VBoxGuest-linux.c
-@@ -1411,5 +1411,5 @@
-     }
-     else if (pParam->name[0] != 'd')
--        strlcpy(&g_szLogGrp[0], pszValue, sizeof(g_szLogGrp));
-+        RT_STRSCPY(&g_szLogGrp[0], pszValue, sizeof(g_szLogGrp));
- 
-     return 0;
-@@ -1437,5 +1437,5 @@
-     }
-     else if (pParam->name[0] != 'd')
--        strlcpy(&g_szLogFlags[0], pszValue, sizeof(g_szLogFlags));
-+        RT_STRSCPY(&g_szLogFlags[0], pszValue, sizeof(g_szLogFlags));
-     return 0;
- }
-@@ -1462,5 +1462,5 @@
-     }
-     else if (pParam->name[0] != 'd')
--        strlcpy(&g_szLogDst[0], pszValue, sizeof(g_szLogDst));
-+        RT_STRSCPY(&g_szLogDst[0], pszValue, sizeof(g_szLogDst));
-     return 0;
- }
-
-# https://www.virtualbox.org/changeset/102990/vbox
---- a/src/VBox/Additions/linux/drm/vbox_drv.h
-+++ b/src/VBox/Additions/linux/drm/vbox_drv.h
-@@ -539,7 +539,5 @@
- void vbox_irq_fini(struct vbox_private *vbox);
- void vbox_report_hotplug(struct vbox_private *vbox);
--#if RTLNX_VER_MAX(5,15,0) && !RTLNX_RHEL_MAJ_PREREQ(9,1) && !RTLNX_SUSE_MAJ_PREREQ(15,5)
- irqreturn_t vbox_irq_handler(int irq, void *arg);
--#endif
- 
- /* vbox_hgsmi.c */
-
-# https://www.virtualbox.org/changeset/102990/vbox
---- a/src/VBox/Additions/linux/sharedfolders/regops.c
-+++ b/src/VBox/Additions/linux/sharedfolders/regops.c
-@@ -3506,5 +3506,5 @@
- 
- /** file_operations::mmap wrapper for logging purposes. */
--extern int vbsf_reg_mmap(struct file *file, struct vm_area_struct *vma)
-+static int vbsf_reg_mmap(struct file *file, struct vm_area_struct *vma)
- {
-     int rc;
-@@ -3787,5 +3787,5 @@
- 
- # if RTLNX_VER_MIN(5,19,0) || RTLNX_RHEL_RANGE(9,3, 9,99)
--int vbsf_write_begin(struct file *file, struct address_space *mapping, loff_t pos,
-+static int vbsf_write_begin(struct file *file, struct address_space *mapping, loff_t pos,
-                      unsigned len, struct page **pagep, void **fsdata)
- {
-@@ -3794,5 +3794,5 @@
- }
- # else
--int vbsf_write_begin(struct file *file, struct address_space *mapping, loff_t pos,
-+static int vbsf_write_begin(struct file *file, struct address_space *mapping, loff_t pos,
-                      unsigned len, unsigned flags, struct page **pagep, void **fsdata)
- {
-
-# https://www.virtualbox.org/changeset/102990/vbox
---- a/src/VBox/Additions/linux/sharedfolders/vfsmod.c
-+++ b/src/VBox/Additions/linux/sharedfolders/vfsmod.c
-@@ -1409,5 +1409,5 @@
-     case Opt_iocharset:
-     case Opt_nls:
--        strlcpy(info->nls_name, param->string, sizeof(info->nls_name));
-+        RT_STRSCPY(info->nls_name, param->string, sizeof(info->nls_name));
-         break;
-     case Opt_uid:
-@@ -1470,5 +1470,5 @@
-         break;
-     case Opt_tag:
--        strlcpy(info->szTag, param->string, sizeof(info->szTag));
-+        RT_STRSCPY(info->szTag, param->string, sizeof(info->szTag));
-         break;
-     default:
-@@ -1529,5 +1529,5 @@
- 
-     /* fc->source (the shared folder name) is set after vbsf_init_fs_ctx() */
--    strlcpy(info->name, fc->source, sizeof(info->name));
-+    RT_STRSCPY(info->name, fc->source, sizeof(info->name));
- 
- # if RTLNX_VER_MAX(5,3,0)
diff --git a/pkgs/applications/virtualization/virtualbox/libxml-2.12.patch b/pkgs/applications/virtualization/virtualbox/libxml-2.12.patch
deleted file mode 100644
index 4631f304735c..000000000000
--- a/pkgs/applications/virtualization/virtualbox/libxml-2.12.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-diff --git a/include/iprt/cpp/xml.h b/include/iprt/cpp/xml.h
-index 40975e86..7639c281 100644
---- a/include/iprt/cpp/xml.h
-+++ b/include/iprt/cpp/xml.h
-@@ -113,9 +113,9 @@ public:
- class RT_DECL_CLASS XmlError : public RuntimeError
- {
- public:
--    XmlError(xmlErrorPtr aErr);
-+    XmlError(const xmlError *aErr);
- 
--    static char* Format(xmlErrorPtr aErr);
-+    static char* Format(const xmlError *aErr);
- };
- 
- // Logical errors
-diff --git a/src/VBox/Runtime/r3/xml.cpp b/src/VBox/Runtime/r3/xml.cpp
-index a6661760..b301a6c6 100644
---- a/src/VBox/Runtime/r3/xml.cpp
-+++ b/src/VBox/Runtime/r3/xml.cpp
-@@ -131,7 +131,7 @@ LogicError::LogicError(RT_SRC_POS_DECL)
-     RTStrFree(msg);
- }
- 
--XmlError::XmlError(xmlErrorPtr aErr)
-+XmlError::XmlError(const xmlError *aErr)
- {
-     if (!aErr)
-         throw EInvalidArg(RT_SRC_POS);
-@@ -145,7 +145,7 @@ XmlError::XmlError(xmlErrorPtr aErr)
-  * Composes a single message for the given error. The caller must free the
-  * returned string using RTStrFree() when no more necessary.
-  */
--/* static */ char *XmlError::Format(xmlErrorPtr aErr)
-+/* static */ char *XmlError::Format(const xmlError *aErr)
- {
-     const char *msg = aErr->message ? aErr->message : "<none>";
-     size_t msgLen = strlen(msg);
-@@ -1856,7 +1856,7 @@ static void xmlParserBaseGenericError(void *pCtx, const char *pszMsg, ...) RT_NO
-     va_end(args);
- }
- 
--static void xmlParserBaseStructuredError(void *pCtx, xmlErrorPtr error) RT_NOTHROW_DEF
-+static void xmlParserBaseStructuredError(void *pCtx, const xmlError *error) RT_NOTHROW_DEF
- {
-     NOREF(pCtx);
-     /* we expect that there is always a trailing NL */
diff --git a/pkgs/by-name/ar/arc-browser/package.nix b/pkgs/by-name/ar/arc-browser/package.nix
index dfa2ff46745f..a3b7f014473d 100644
--- a/pkgs/by-name/ar/arc-browser/package.nix
+++ b/pkgs/by-name/ar/arc-browser/package.nix
@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-browser";
-  version = "1.49.1-51495";
+  version = "1.51.0-51691";
 
   src = fetchurl {
     url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-9wuZQgf8uta0ynMRe3GKqORZsCuwhvxjSpGLajCp7N8=";
+    hash = "sha256-d1dCx9knh7LqtRWzDsuPW1OD65CuZ9SPkOvyoDT4Q6c=";
   };
 
   nativeBuildInputs = [ undmg ];
diff --git a/pkgs/by-name/st/stats/package.nix b/pkgs/by-name/st/stats/package.nix
index d03e07ffc12e..21590c5b9ef8 100644
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.10.19";
+  version = "2.11.1";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-1mmKpcJJdEiX/KZkE/VnL/xMrNzlq1LSAr5z3CdoPMI=";
+    hash = "sha256-/6QFchDpWrJZEKuIsQi6FcGprVOa8J8THJ9Kt3ESrwY=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/us/username-anarchy/package.nix b/pkgs/by-name/us/username-anarchy/package.nix
new file mode 100644
index 000000000000..ed2271e0df69
--- /dev/null
+++ b/pkgs/by-name/us/username-anarchy/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ruby,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "username-anarchy";
+  version = "0.5";
+
+  src = fetchFromGitHub {
+    rev = "d5e653f0ab31d8d3fff79b2986f6ef9624d80fba";
+    owner = "urbanadventurer";
+    repo = "username-anarchy";
+    hash = "sha256-1he1FzNc6y7jm/UwedG81z5QGehh2qsd1QkAsIXwrag=";
+  };
+
+  buildInputs = [ ruby ];
+
+  preInstall = ''
+    mkdir -p $out/bin
+    install -Dm 555 format-plugins.rb $out/bin/
+    install -Dm 555 username-anarchy $out/bin/
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/urbanadventurer/username-anarchy/";
+    description = "Username generator tool for penetration testing";
+    license = licenses.mit;
+    maintainers = [ maintainers.akechishiro ];
+    platforms = platforms.unix;
+    mainProgram = "username-anarchy";
+  };
+}
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 18904753ae59..f8e8d51256b8 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,10 +1,10 @@
 {
   "darwin": {
-    "hash": "sha256-vogQAVbtiw2/U3oJrTj8SUexkEsEfYvmGq50nzy5aYo=",
-    "version": "0.2024.06.25.08.02.stable_01"
+    "hash": "sha256-ku1zQLrRDCvw8RJueWQb8rFJneW943mcPUJ5QB4SXzg=",
+    "version": "0.2024.07.09.08.01.stable_00"
   },
   "linux": {
-    "hash": "sha256-Fc48bZzFBw9p636Mr8R+W/d1B3kIcOAu/Gd17nbzNfI=",
-    "version": "0.2024.06.25.08.02.stable_01"
+    "hash": "sha256-EZrANAhkXukquQuCmfA/bIhQnJExE003WZuKU/axr98=",
+    "version": "0.2024.07.09.08.01.stable_00"
   }
 }
diff --git a/pkgs/by-name/xc/xcbeautify/package.nix b/pkgs/by-name/xc/xcbeautify/package.nix
index 5ad33771d358..fb0cea984670 100644
--- a/pkgs/by-name/xc/xcbeautify/package.nix
+++ b/pkgs/by-name/xc/xcbeautify/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xcbeautify";
-  version = "1.4.0";
+  version = "2.4.1";
 
   src = fetchurl {
     url = "https://github.com/cpisciotta/xcbeautify/releases/download/${version}/xcbeautify-${version}-${stdenv.hostPlatform.darwinArch}-apple-macosx.zip";
     hash = lib.getAttr stdenv.hostPlatform.darwinArch {
-      arm64 = "sha256-4b4mXT5IfNOS8iOrZASDhTrmOehG4mePcoiKxR+IdZk=";
-      x86_64 = "sha256-adEfAK7n3Q/Yd1deyJx7htX7hZaGDztEeBv4z2A0wzg=";
+      arm64 = "sha256-EjBhpw9qsOEweXOepQVPNL/hCxj12Z5gyvv7neNEeMU=";
+      x86_64 = "sha256-Zb54g0cMWB6ouzLPUd+VTCicp+bVb5aDKxNSB3eGaZU=";
     };
   };
 
@@ -30,12 +30,13 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Little beautifier tool for xcodebuild";
     homepage = "https://github.com/cpisciotta/xcbeautify";
-    license = licenses.mit;
-    platforms = platforms.darwin;
+    license = lib.licenses.mit;
+    platforms = lib.platforms.darwin;
     mainProgram = "xcbeautify";
-    maintainers = with maintainers; [ siddarthkay ];
+    maintainers = with lib.maintainers; [ siddarthkay ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 }
diff --git a/pkgs/development/compilers/unison/default.nix b/pkgs/development/compilers/unison/default.nix
index 587ca9d7f35e..67dbb9e57677 100644
--- a/pkgs/development/compilers/unison/default.nix
+++ b/pkgs/development/compilers/unison/default.nix
@@ -13,17 +13,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unison-code-manager";
-  version = "0.5.22";
+  version = "0.5.24";
 
   src = if stdenv.isDarwin then
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos.tar.gz";
-      hash = "sha256-Exgi0eKk+ZngpnbfY/btHf+uiXcmummnWKfmCUESWgc=";
+      hash = "sha256-5LVcN7ly0n68DFqIjA8EJabZa3WwJf1ueqgJ+gPHNbA=";
     }
   else
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux.tar.gz";
-      hash = "sha256-EWfyqaFtGJJ5GE0mRTtNC9hHOzbqG9MsvRh5sFq5pRY=";
+      hash = "sha256-nCNmUYkBWhXL2eN+uQblf7oPkiVwfAKi6v+Cb9Co19g=";
     };
 
   # The tarball is just the prebuilt binary, in the archive root.
diff --git a/pkgs/development/libraries/pdal/default.nix b/pkgs/development/libraries/pdal/default.nix
index 86d976531cb3..3f4933e0fc91 100644
--- a/pkgs/development/libraries/pdal/default.nix
+++ b/pkgs/development/libraries/pdal/default.nix
@@ -19,6 +19,7 @@
 , pkg-config
 , postgresql
 , proj
+, sqlite
 , tiledb
 , xercesc
 , zlib
@@ -27,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdal";
-  version = "2.7.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "PDAL";
     repo = "PDAL";
     rev = finalAttrs.version;
-    sha256 = "sha256-JoHBxJ0hCWH7ZhmeJk4huT2k0AK5CzIV58NWCjWj5T0=";
+    sha256 = "sha256-ukBZLr/iyYQ68sv9JWrR4YP0ahHfGhytgcWKPzrF3Ps=";
   };
 
   nativeBuildInputs = [
@@ -52,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     openscenegraph
     postgresql
     proj
+    sqlite
     tiledb
     xercesc
     zlib
diff --git a/pkgs/games/dwarf-fortress/default.nix b/pkgs/games/dwarf-fortress/default.nix
index acf50d650c49..e5bbf60e1550 100644
--- a/pkgs/games/dwarf-fortress/default.nix
+++ b/pkgs/games/dwarf-fortress/default.nix
@@ -49,7 +49,9 @@ let
   # The latest Dwarf Fortress version. Maintainers: when a new version comes
   # out, ensure that (unfuck|dfhack|twbt) are all up to date before changing
   # this. Note that unfuck and twbt are not required for 50.
-  latestVersion = "50.13";
+  latestVersion = if stdenv.isLinux then "50.13"
+                  else if stdenv.isDarwin then "0.47.05"
+                  else throw "Unsupported system";
 
   # Converts a version to a package name.
   versionToName = version: "dwarf-fortress_${replaceStrings ["."] ["_"] version}";
@@ -62,7 +64,7 @@ let
         let
           isAtLeast50 = versionAtLeast dfVersion "50.0";
 
-          dwarf-fortress-unfuck = optionalAttrs (!isAtLeast50) (callPackage ./unfuck.nix { inherit dfVersion; });
+          dwarf-fortress-unfuck = optionalAttrs (!isAtLeast50 && stdenv.isLinux) (callPackage ./unfuck.nix { inherit dfVersion; });
 
           dwarf-fortress = callPackage ./game.nix {
             inherit dfVersion;
diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index 96a5dac52540..cb0e1e529637 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -90,9 +90,9 @@ let
       xmlRev = "980b1af13acc31660dce632f913c968f52e2b275";
     };
     "50.13" = {
-      dfHackRelease = "50.13-r1.1";
-      hash = "sha256-FiXanXflszTr4ogz+EoDAUxzE2U9ODeZIJJ1u6Xm4Mo=";
-      xmlRev = "3507715fd07340de5a6c47064220f6e17343e5d5";
+      dfHackRelease = "50.13-r3";
+      hash = "sha256-WbkJ8HmLT5GdZgDmcuFh+1uzhloKM9um0b9YO//uR7Y=";
+      xmlRev = "f0530a22149606596e97e3e17d941df3aafe29b9";
     };
   };
 
diff --git a/pkgs/games/dwarf-fortress/game.nix b/pkgs/games/dwarf-fortress/game.nix
index 9cf7847d1489..22bf7bb439fa 100644
--- a/pkgs/games/dwarf-fortress/game.nix
+++ b/pkgs/games/dwarf-fortress/game.nix
@@ -53,7 +53,7 @@ let
   patchVersion = elemAt dfVersionTuple (dfVersionBaseIndex + 1);
 
   isAtLeast50 = baseVersion >= 50;
-  enableUnfuck = !isAtLeast50 && dwarf-fortress-unfuck != null;
+  enableUnfuck = !isAtLeast50 && dwarf-fortress-unfuck != null && (dwarf-fortress-unfuck.dfVersion or null) == dfVersion;
 
   game =
     if hasAttr dfVersion df-hashes
@@ -84,7 +84,7 @@ stdenv.mkDerivation {
 
   sourceRoot = ".";
 
-  postUnpack = optionalString stdenv.isLinux ''
+  postUnpack = ''
     directory=${
       if stdenv.isLinux then "df_linux"
       else if stdenv.isDarwin then "df_osx"
@@ -95,7 +95,7 @@ stdenv.mkDerivation {
     fi
   '';
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = optional stdenv.isLinux autoPatchelfHook;
   buildInputs = optionals isAtLeast50 [ SDL2 SDL2_image SDL2_mixer ]
     ++ optional (!isAtLeast50) SDL
     ++ optional enableUnfuck dwarf-fortress-unfuck
@@ -108,6 +108,9 @@ stdenv.mkDerivation {
     mkdir -p $out
     cp -r * $out
 
+    # Clean up OS X detritus in the tarball.
+    find $out -type f -name '._*' -exec rm -rf {} \;
+
     # Lots of files are +x in the newer releases...
     find $out -type d -exec chmod 0755 {} \;
     find $out -type f -exec chmod 0644 {} \;
@@ -116,7 +119,7 @@ stdenv.mkDerivation {
     [ -f $out/run_df ] && chmod +x $out/run_df
 
     # We don't need any of these since they will just break autoPatchelf on <version 50.
-    [ -d $out/libs ] && rm -f $out/libs/*.so $out/libs/*.so.*
+    [ -d $out/libs ] && rm -rf $out/libs/*.so $out/libs/*.so.* $out/libs/*.dylib
 
     # Store the original hash
     md5sum $exe | awk '{ print $1 }' > $out/hash.md5.orig
@@ -129,6 +132,7 @@ stdenv.mkDerivation {
 
     ln -s ${getLib ncurses}/lib/libncurses.dylib $out/libs
     ln -s ${getLib gcc.cc}/lib/libstdc++.6.dylib $out/libs
+    ln -s ${getLib gcc.cc}/lib/libgcc_s.1.dylib $out/libs
     ln -s ${getLib fmodex}/lib/libfmodex.dylib $out/libs
 
     install_name_tool \
diff --git a/pkgs/games/dwarf-fortress/wrapper/default.nix b/pkgs/games/dwarf-fortress/wrapper/default.nix
index 2dd771ee922d..daa27ce5dc00 100644
--- a/pkgs/games/dwarf-fortress/wrapper/default.nix
+++ b/pkgs/games/dwarf-fortress/wrapper/default.nix
@@ -197,8 +197,8 @@ stdenv.mkDerivation rec {
     chmod 755 $out/bin/soundsense
   '';
 
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [ expect xvfb-run ];
+  doInstallCheck = stdenv.isLinux;
+  nativeInstallCheckInputs = lib.optionals stdenv.isLinux [ expect xvfb-run ];
 
   installCheckPhase = let
     commonExpectStatements = fmod: lib.optionalString isAtLeast50 ''
diff --git a/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in b/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in
index 61b1b4da6168..1c739a1afbbf 100644
--- a/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in
+++ b/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in
@@ -4,18 +4,6 @@ shopt -s extglob
 
 export NIXPKGS_DF_ENV="@env@"
 
-if [[ -v DF_DIR ]] && [ -n "$DF_DIR" ] && { [[ ! -v NIXPKGS_DF_HOME ]] || [ -z "$NIXPKGS_DF_HOME" ]; }; then
-  # Compatibility for users that were using DF_DIR, since the dfhack script clobbers this variable.
-  export NIXPKGS_DF_HOME="$DF_DIR"
-fi
-
-if [[ ! -v NIXPKGS_DF_HOME ]] || [ -z "$NIXPKGS_DF_HOME" ]; then
-  export NIXPKGS_DF_HOME="${XDG_DATA_HOME:-$HOME/.local/share}/df_linux"
-fi
-
-# Compatibility.
-export DF_DIR="$NIXPKGS_DF_HOME"
-
 ### BEGIN: Default DF options
 declare -A _NIXPKGS_DF_OPTS
 _NIXPKGS_DF_OPTS[fmod]=0    # Don't use fmod by default.
@@ -131,6 +119,30 @@ go() {
   exit 1
 }
 
+os_name="$(@uname@)"
+os_rev="$(@uname@ -r)"
+
+if [ "$os_name" == Linux ]; then
+  df_dir="df_linux"
+elif [ "$os_name" == Darwin ]; then
+  df_dir="df_osx"
+else
+  log "Unknown platform: $os_name"
+  exit 1
+fi
+
+if [[ -v DF_DIR ]] && [ -n "$DF_DIR" ] && { [[ ! -v NIXPKGS_DF_HOME ]] || [ -z "$NIXPKGS_DF_HOME" ]; }; then
+  # Compatibility for users that were using DF_DIR, since the dfhack script clobbers this variable.
+  export NIXPKGS_DF_HOME="$DF_DIR"
+fi
+
+if [[ ! -v NIXPKGS_DF_HOME ]] || [ -z "$NIXPKGS_DF_HOME" ]; then
+  export NIXPKGS_DF_HOME="${XDG_DATA_HOME:-$HOME/.local/share}/$df_dir"
+fi
+
+# Compatibility.
+export DF_DIR="$NIXPKGS_DF_HOME"
+
 @mkdir@ -p "$NIXPKGS_DF_HOME"
 
 @cat@ <<EOF >&2
@@ -156,7 +168,7 @@ EOF
 cd "$NIXPKGS_DF_ENV"
 
 # All potential important files in DF 50 and below.
-for path in dwarfort *.so libs raw data/init/* data/!(init|index|announcement); do
+for path in dwarfort dwarfort.exe df *.so libs raw data/init/* data/!(init|index|announcement); do
   force_delete=0
   if [[ "$path" == libfmod*.so* ]] && [ "${_NIXPKGS_DF_OPTS[fmod]}" -eq 0 ]; then
     force_delete=1
@@ -175,7 +187,12 @@ for path in index announcement help dipscript; do
 done
 
 # Handle library paths on Darwin.
-if [ "$(@uname@)" == Darwin ]; then
-  export DYLD_LIBRARY_PATH="$NIXPKGS_DF_ENV/libs"
-  export DYLD_FRAMEWORK_PATH="$NIXPKGS_DF_ENV/libs"
+if [ "$os_name" == Darwin ]; then
+  if [ "${os_rev%%.*}" -ge 11 ]; then
+    export DYLD_LIBRARY_PATH="$NIXPKGS_DF_ENV/libs"
+    export DYLD_FRAMEWORK_PATH="$NIXPKGS_DF_ENV/libs"
+  else
+    export DYLD_FALLBACK_LIBRARY_PATH="$NIXPKGS_DF_ENV/libs"
+    export DYLD_FALLBACK_FRAMEWORK_PATH="$NIXPKGS_DF_ENV/libs"
+  fi
 fi
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index c64356df9c08..3891333d959d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,8 +4,8 @@
         "hash": "sha256:0i29ga9lzqd4zcsbr4bbb122i8nyfhcalihnq3bgsg04dwb36s19"
     },
     "6.1": {
-        "version": "6.1.98",
-        "hash": "sha256:01ilkykg65590f1gndhnp3s75wscqah6f4l9l1p5a03pgh9ckkcp"
+        "version": "6.1.99",
+        "hash": "sha256:1lsdwdx7i7xw1rzq88k3bz8sar77gb4rnmjx11pbmvmiwaffx1n0"
     },
     "5.15": {
         "version": "5.15.162",
@@ -24,8 +24,8 @@
         "hash": "sha256:109mk4zscm8611xs3bchnr94gasvw3vxsi6zhp3f2y132g670aq6"
     },
     "6.6": {
-        "version": "6.6.39",
-        "hash": "sha256:0svpgakk81082mhhq17r8nlbz36zavq23d71232rapq928hx90r7"
+        "version": "6.6.40",
+        "hash": "sha256:0f7mmw5pzd174376m7r928xbi9mdcla0vy6plq0xdf2mq01kqfjw"
     },
     "6.8": {
         "version": "6.8.12",
@@ -34,5 +34,9 @@
     "6.9": {
         "version": "6.9.9",
         "hash": "sha256:1f8y88rif3z5lp1bq00g66fd0xs1227qlqkxd2zs6fdjgr45pq1b"
+    },
+    "6.10": {
+        "version": "6.10",
+        "hash": "sha256:09p2z3z8c3aq6ipqdc58x6s52sy0cmyg6mj4f0g5yk755r19hikp"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 280b8cdb879f..639038ad3902 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19597";
-    sha256 = "0bxljx9dgz23ax2pjvx07sqks4s7al2qhn3zcjyxfqv69a0awa8w";
+    rev = "19607";
+    sha256 = "1kf1hm553g8sh7wyh0jw7nl2nmrzg74b62z1q17bznq5a7qf87pn";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index ad920e2b7355..4168442456cd 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.220-rt112"; # updated by ./update-rt.sh
+  version = "5.10.221-rt113"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "16z1xqm7djm8pl15s5wvgc4pwq81gydcf00jpxfplw794kwszhvw";
+    sha256 = "09975sby114mwfb8x2rlpaps6vb60dvs8f20cmb7hkxcxdzx87fs";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "149m51kkzhx9fhqdf6k7chi38rm2iw3ld18qzh8afmq8dc1dcimq";
+      sha256 = "1aaamfnlhzhi4lj1sk2m082fpgr3qxs3b3a1ikh8zwmy89kw9i9x";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/os-specific/linux/kernel/perf/default.nix
index 02f0407425d1..4b3440ad4090 100644
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -61,6 +61,23 @@ stdenv.mkDerivation {
 
   inherit (kernel) src;
 
+  # Fix 6.10.0 holding pkg-config completely wrong.
+  # Patches from perf-tools-next, should be in 6.11 or hopefully backported.
+  patches = lib.optionals (lib.versionAtLeast kernel.version "6.10") [
+    (fetchpatch {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/patch/?id=0f0e1f44569061e3dc590cd0b8cb74d8fd53706b";
+      hash = "sha256-9u/zhbsDgwOr4T4k9td/WJYRuSHIfbtfS+oNx8nbOlM=";
+    })
+    (fetchpatch {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/patch/?id=366e17409f1f17ad872259ce4a4f8a92beb4c4ee";
+      hash = "sha256-NZK1u40qvMwWcgkgJPGpEax2eMo9xHrCQxSYYOK0rbo=";
+    })
+    (fetchpatch {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/patch/?id=1d302f626c2a23e4fd05bb810eff300e8f2174fd";
+      hash = "sha256-KhCmof8LkyTcBBpfMEtolL3m3kmC5rukKzQvufVKCdI=";
+    })
+  ];
+
   postPatch = ''
     # Linux scripts
     patchShebangs scripts
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index ed78c5d231e3..0a4fe87104cd 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -46,13 +46,13 @@
 }@args:
 
 let
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-ehv81trN8eG7QRAD5ERiSql6ZRCJK9cz6VOT9OzjZhg=";
+    sha256 = "sha256-bwYMLkBtdfgfAX8vKpsFRg5tpBtoaURKGF0rs/CtJ2U=";
   };
 
   ruby = ruby_3_2;
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
index ee3910b8e0ab..eb4e2861ed55 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-docs";
-    rev = "94c7b7da216c66d773f800a714493f087affaac9";
-    sha256 = "sha256-4ZPv42fw5YdJ3+QUGOh5CJMWkXoUVs4bTVd9zuFekQM=";
+    rev = "11dcab84669462b05eba3f1a59401727cafe8188";
+    sha256 = "sha256-zVzmEfaANwX24rMq91gom6XmhKsEGraWon8vJu8j7iY=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-docs";
diff --git a/pkgs/servers/web-apps/discourse/update.py b/pkgs/servers/web-apps/discourse/update.py
index 9d922de7c9cc..972054904b29 100755
--- a/pkgs/servers/web-apps/discourse/update.py
+++ b/pkgs/servers/web-apps/discourse/update.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i python3 -p bundix bundler nix-update nurl "python3.withPackages (ps: with ps; [ requests click click-log packaging ])" prefetch-yarn-deps
+#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ requests click click-log packaging ])" bundix bundler nix-update nurl prefetch-yarn-deps
 from __future__ import annotations
 
 import click
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index a5901f92cb1b..e7e9e20fc72a 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -147,8 +147,8 @@ in lib.makeExtensible (self: ({
   };
 
   nix_2_18 = common {
-    version = "2.18.4";
-    hash = "sha256-tebjp83ABKrBW3d/6n/Irr1+xhtw8qIkqHZHJOoJaLk=";
+    version = "2.18.5";
+    hash = "sha256-xEcYQuJz6DjdYfS6GxIYcn8U+3Hgopne3CvqrNoGguQ=";
     self_attribute_name = "nix_2_18";
   };
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c7a934c3389b..a992d4307703 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -692,6 +692,7 @@ mapAliases ({
   linuxPackages_6_7 = linuxKernel.packages.linux_6_7;
   linuxPackages_6_8 = linuxKernel.packages.linux_6_8;
   linuxPackages_6_9 = linuxKernel.packages.linux_6_9;
+  linuxPackages_6_10 = linuxKernel.packages.linux_6_10;
   linuxPackages_rpi0 = linuxKernel.packages.linux_rpi1;
   linuxPackages_rpi02w = linuxKernel.packages.linux_rpi3;
   linuxPackages_rpi1 = linuxKernel.packages.linux_rpi1;
@@ -720,6 +721,7 @@ mapAliases ({
   linux_6_7 = linuxKernel.kernels.linux_6_7;
   linux_6_8 = linuxKernel.kernels.linux_6_8;
   linux_6_9 = linuxKernel.kernels.linux_6_9;
+  linux_6_10 = linuxKernel.kernels.linux_6_10;
   linux_rpi0 = linuxKernel.kernels.linux_rpi1;
   linux_rpi02w = linuxKernel.kernels.linux_rpi3;
   linux_rpi1 = linuxKernel.kernels.linux_rpi1;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 0a248521a437..96efcc94621c 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -205,6 +205,14 @@ in {
       ];
     };
 
+    linux_6_10 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "6.10";
+      kernelPatches = [
+        kernelPatches.bridge_stp_helper
+        kernelPatches.request_key_helper
+      ];
+    };
+
     linux_testing = let
       testing = callPackage ../os-specific/linux/kernel/mainline.nix {
         # A special branch that tracks the kernel under the release process
@@ -613,6 +621,7 @@ in {
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
     linux_6_8 = recurseIntoAttrs (packagesFor kernels.linux_6_8);
     linux_6_9 = recurseIntoAttrs (packagesFor kernels.linux_6_9);
+    linux_6_10 = recurseIntoAttrs (packagesFor kernels.linux_6_10);
     __attrsFailEvaluation = true;
   } // lib.optionalAttrs config.allowAliases {
     linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11"; # Added 2022-11-08
@@ -682,7 +691,7 @@ in {
   packageAliases = {
     linux_default = packages.linux_6_6;
     # Update this when adding the newest kernel major version!
-    linux_latest = packages.linux_6_9;
+    linux_latest = packages.linux_6_10;
     linux_mptcp = throw "'linux_mptcp' has been moved to https://github.com/teto/mptcp-flake";
     linux_rt_default = packages.linux_rt_5_15;
     linux_rt_latest = packages.linux_rt_6_6;
diff --git a/shell.nix b/shell.nix
new file mode 100644
index 000000000000..d9e94eb2816d
--- /dev/null
+++ b/shell.nix
@@ -0,0 +1,30 @@
+# A shell to get tooling for Nixpkgs development
+#
+# Note: We intentionally don't use Flakes here,
+# because every time you change any file and do another `nix develop`,
+# it would create another copy of the entire ~500MB tree in the store.
+# See https://github.com/NixOS/nix/pull/6530 for the future
+{
+  system ? builtins.currentSystem,
+}:
+let
+  pinnedNixpkgs = builtins.fromJSON (builtins.readFile ci/pinned-nixpkgs.json);
+
+  nixpkgs = fetchTarball {
+    url = "https://github.com/NixOS/nixpkgs/archive/${pinnedNixpkgs.rev}.tar.gz";
+    sha256 = pinnedNixpkgs.sha256;
+  };
+
+  pkgs = import nixpkgs {
+    inherit system;
+    config = {};
+    overlays = [];
+  };
+in
+pkgs.mkShellNoCC {
+  packages = [
+    # The default formatter for Nix code
+    # https://github.com/NixOS/nixfmt
+    pkgs.nixfmt-rfc-style
+  ];
+}