Merge master into haskell-updates

291 files changed, 7189 insertions, 2683 deletions

diff --git a/doc/build-helpers/trivial-build-helpers.chapter.md b/doc/build-helpers/trivial-build-helpers.chapter.md
index 6d14db6399384..c9985bda79238 100644
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@@ -488,7 +488,7 @@ writeTextFile {
     echo "hi"
   '';
   executable = true;
-  destination = "bin/my-script"
+  destination = "bin/my-script";
 }
 ```
 
@@ -576,7 +576,7 @@ writeTextFile {
     echo "hi"
   '';
   executable = true;
-  destination = "bin/my-script"
+  destination = "bin/my-script";
 }
 ```
 
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 75e57a8bb5746..274ee9ce9cc4a 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -651,6 +651,66 @@ buildPythonPackage rec {
 }
 ```
 
+#### Rust package built with `meson` {#rust-package-built-with-meson}
+
+Some projects, especially GNOME applications, are built with the Meson Build System instead of calling Cargo directly. Using `rustPlatform.buildRustPackage` may successfully build the main program, but related files will be missing. Instead, you need to set up Cargo dependencies with `fetchCargoTarball` and `cargoSetupHook` and leave the rest to Meson. `rust` and `cargo` are still needed in `nativeBuildInputs` for Meson to use.
+
+```nix
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, rustPlatform
+, rustc
+, cargo
+, wrapGAppsHook4
+, blueprint-compiler
+, libadwaita
+, libsecret
+, tracker
+}:
+
+stdenv.mkDerivation rec {
+  pname = "health";
+  version = "0.95.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "health";
+    rev = version;
+    hash = "sha256-PrNPprSS98yN8b8yw2G6hzTSaoE65VbsM3q7FVB4mds=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-8fa3fa+sFi5H+49B5sr2vYPkp9C9s6CcE0zv4xB8gww=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    cargo
+    wrapGAppsHook4
+    blueprint-compiler
+  ];
+
+  buildInputs = [
+    libadwaita
+    libsecret
+    tracker
+  ];
+
+  # ...
+}
+```
+
 ## `buildRustCrate`: Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
 
 ### Simple operation {#simple-operation}
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 4cda7e5c01a30..358b77117a362 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -392,6 +392,12 @@ in mkLicense lset) ({
     fullName = "Common Public Attribution License 1.0";
   };
 
+  commons-clause = {
+    fullName = "Commons Clause License";
+    url = "https://commonsclause.com/";
+    free = false;
+  };
+
   cpl10 = {
     spdxId = "CPL-1.0";
     fullName = "Common Public License 1.0";
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index a71ea9209cb88..83ed32ed3275b 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -1,7 +1,25 @@
 { lib }:
-  let inherit (lib.attrsets) mapAttrs; in
 
-rec {
+let
+  inherit (lib)
+    any
+    filterAttrs
+    foldl
+    hasInfix
+    isFunction
+    isList
+    isString
+    mapAttrs
+    optional
+    optionalAttrs
+    optionalString
+    removeSuffix
+    replaceStrings
+    toUpper
+    ;
+
+  inherit (lib.strings) toJSON;
+
   doubles = import ./doubles.nix { inherit lib; };
   parse = import ./parse.nix { inherit lib; };
   inspect = import ./inspect.nix { inherit lib; };
@@ -24,7 +42,7 @@ rec {
     both arguments have been `elaborate`-d.
   */
   equals =
-    let removeFunctions = a: lib.filterAttrs (_: v: !builtins.isFunction v) a;
+    let removeFunctions = a: filterAttrs (_: v: !isFunction v) a;
     in a: b: removeFunctions a == removeFunctions b;
 
   /* List of all Nix system doubles the nixpkgs flake will expose the package set
@@ -41,7 +59,7 @@ rec {
   # clearly preferred, and to prevent cycles. A simpler fixed point where the RHS
   # always just used `final.*` would fail on both counts.
   elaborate = args': let
-    args = if lib.isString args' then { system = args'; }
+    args = if isString args' then { system = args'; }
            else args';
 
     # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
@@ -96,7 +114,7 @@ rec {
         then "lib64"
         else "lib"
       else null;
-      extensions = lib.optionalAttrs final.hasSharedLibraries {
+      extensions = optionalAttrs final.hasSharedLibraries {
         sharedLibrary =
           if      final.isDarwin  then ".dylib"
           else if final.isWindows then ".dll"
@@ -134,9 +152,9 @@ rec {
          # uname -m
          processor =
            if final.isPower64
-           then "ppc64${lib.optionalString final.isLittleEndian "le"}"
+           then "ppc64${optionalString final.isLittleEndian "le"}"
            else if final.isPower
-           then "ppc${lib.optionalString final.isLittleEndian "le"}"
+           then "ppc${optionalString final.isLittleEndian "le"}"
            else if final.isMips64
            then "mips64"  # endianness is *not* included on mips64
            else final.parsed.cpu.name;
@@ -202,8 +220,8 @@ rec {
         else if final.isS390 && !final.isS390x then null
         else if final.isx86_64 then "x86_64"
         else if final.isx86 then "i386"
-        else if final.isMips64n32 then "mipsn32${lib.optionalString final.isLittleEndian "el"}"
-        else if final.isMips64 then "mips64${lib.optionalString final.isLittleEndian "el"}"
+        else if final.isMips64n32 then "mipsn32${optionalString final.isLittleEndian "el"}"
+        else if final.isMips64 then "mips64${optionalString final.isLittleEndian "el"}"
         else final.uname.processor;
 
       # Name used by UEFI for architectures.
@@ -259,7 +277,7 @@ rec {
           if pkgs.stdenv.hostPlatform.canExecute final
           then "${pkgs.runtimeShell} -c '\"$@\"' --"
           else if final.isWindows
-          then "${wine}/bin/wine${lib.optionalString (final.parsed.cpu.bits == 64) "64"}"
+          then "${wine}/bin/wine${optionalString (final.parsed.cpu.bits == 64) "64"}"
           else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null
           then "${qemu-user}/bin/qemu-${final.qemuArch}"
           else if final.isWasi
@@ -310,10 +328,10 @@ rec {
                   let
                     f = args.rustc.platform.target-family;
                   in
-                    if builtins.isList f then f else [ f ]
+                    if isList f then f else [ f ]
                 )
-              else lib.optional final.isUnix "unix"
-                   ++ lib.optional final.isWindows "windows";
+              else optional final.isUnix "unix"
+                   ++ optional final.isWindows "windows";
 
             # https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
             vendor = let
@@ -337,13 +355,13 @@ rec {
             vendor_ = final.rust.platform.vendor;
           # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
           in args.rust.rustcTarget or args.rustc.config
-            or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
+            or "${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi.name}"}";
 
           # The name of the rust target if it is standard, or the json file
           # containing the custom target spec.
           rustcTargetSpec = rust.rustcTargetSpec or (
             /**/ if rust ? platform
-            then builtins.toFile (final.rust.rustcTarget + ".json") (builtins.toJSON rust.platform)
+            then builtins.toFile (final.rust.rustcTarget + ".json") (toJSON rust.platform)
             else final.rust.rustcTarget);
 
           # The name of the rust target if it is standard, or the
@@ -352,7 +370,7 @@ rec {
           #
           # This is the name used by Cargo for target subdirectories.
           cargoShortTarget =
-            lib.removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
+            removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
 
           # When used as part of an environment variable name, triples are
           # uppercased and have all hyphens replaced by underscores:
@@ -360,17 +378,17 @@ rec {
           # https://github.com/rust-lang/cargo/pull/9169
           # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
           cargoEnvVarTarget =
-            lib.strings.replaceStrings ["-"] ["_"]
-              (lib.strings.toUpper final.rust.cargoShortTarget);
+            replaceStrings ["-"] ["_"]
+              (toUpper final.rust.cargoShortTarget);
 
           # True if the target is no_std
           # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
           isNoStdTarget =
-            builtins.any (t: lib.hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
+            any (t: hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
         };
       };
   in assert final.useAndroidPrebuilt -> final.isAndroid;
-     assert lib.foldl
+     assert foldl
        (pass: { assertion, message }:
          if assertion final
          then pass
@@ -378,4 +396,20 @@ rec {
        true
        (final.parsed.abi.assertions or []);
     final;
+
+in
+
+# Everything in this attrset is the public interface of the file.
+{
+  inherit
+    architectures
+    doubles
+    elaborate
+    equals
+    examples
+    flakeExposed
+    inspect
+    parse
+    platforms
+    ;
 }
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index c6a33781ae287..ebc7ab3668763 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -1,10 +1,31 @@
 { lib }:
-with import ./parse.nix { inherit lib; };
-with lib.attrsets;
-with lib.lists;
 
-let abis_ = abis; in
-let abis = lib.mapAttrs (_: abi: builtins.removeAttrs abi [ "assertions" ]) abis_; in
+let
+  inherit (lib)
+    any
+    attrValues
+    concatMap
+    filter
+    hasPrefix
+    isList
+    mapAttrs
+    matchAttrs
+    recursiveUpdateUntil
+    toList
+    ;
+
+  inherit (lib.strings) toJSON;
+
+  inherit (lib.systems.parse)
+    kernels
+    kernelFamilies
+    significantBytes
+    cpuTypes
+    execFormats
+    ;
+
+  abis = mapAttrs (_: abi: removeAttrs abi [ "assertions" ]) lib.systems.parse.abis;
+in
 
 rec {
   # these patterns are to be matched against {host,build,target}Platform.parsed
@@ -32,8 +53,8 @@ rec {
     isx86          = { cpu = { family = "x86"; }; };
     isAarch32      = { cpu = { family = "arm"; bits = 32; }; };
     isArmv7        = map ({ arch, ... }: { cpu = { inherit arch; }; })
-                       (lib.filter (cpu: lib.hasPrefix "armv7" cpu.arch or "")
-                         (lib.attrValues cpuTypes));
+                       (filter (cpu: hasPrefix "armv7" cpu.arch or "")
+                         (attrValues cpuTypes));
     isAarch64      = { cpu = { family = "arm"; bits = 64; }; };
     isAarch        = { cpu = { family = "arm"; }; };
     isMicroBlaze   = { cpu = { family = "microblaze"; }; };
@@ -111,19 +132,19 @@ rec {
     let
       # patterns can be either a list or a (bare) singleton; turn
       # them into singletons for uniform handling
-      pat1 = lib.toList pat1_;
-      pat2 = lib.toList pat2_;
+      pat1 = toList pat1_;
+      pat2 = toList pat2_;
     in
-      lib.concatMap (attr1:
+      concatMap (attr1:
         map (attr2:
-          lib.recursiveUpdateUntil
+          recursiveUpdateUntil
             (path: subattr1: subattr2:
               if (builtins.intersectAttrs subattr1 subattr2) == {} || subattr1 == subattr2
               then true
               else throw ''
                 pattern conflict at path ${toString path}:
-                  ${builtins.toJSON subattr1}
-                  ${builtins.toJSON subattr2}
+                  ${toJSON subattr1}
+                  ${toJSON subattr2}
                 '')
             attr1
             attr2
@@ -132,7 +153,7 @@ rec {
         pat1;
 
   matchAnyAttrs = patterns:
-    if builtins.isList patterns then attrs: any (pattern: matchAttrs pattern attrs) patterns
+    if isList patterns then attrs: any (pattern: matchAttrs pattern attrs) patterns
     else matchAttrs patterns;
 
   predicates = mapAttrs (_: matchAnyAttrs) patterns;
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index b69ad669e1874..191e9734b879a 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -15,14 +15,45 @@
 # systems that overlap with existing ones and won't notice something amiss.
 #
 { lib }:
-with lib.lists;
-with lib.types;
-with lib.attrsets;
-with lib.strings;
-with (import ./inspect.nix { inherit lib; }).predicates;
 
 let
-  inherit (lib.options) mergeOneOption;
+  inherit (lib)
+    all
+    any
+    attrValues
+    elem
+    elemAt
+    hasPrefix
+    id
+    length
+    mapAttrs
+    mergeOneOption
+    optionalString
+    splitString
+    versionAtLeast
+    ;
+
+  inherit (lib.strings) match;
+
+  inherit (lib.systems.inspect.predicates)
+    isAarch32
+    isBigEndian
+    isDarwin
+    isLinux
+    isPower64
+    isWindows
+    ;
+
+  inherit (lib.types)
+    enum
+    float
+    isType
+    mkOptionType
+    number
+    setType
+    string
+    types
+    ;
 
   setTypes = type:
     mapAttrs (name: value:
@@ -33,10 +64,10 @@ let
   # regex `e?abi.*$` when determining the validity of a triple.  In
   # other words, `i386-linuxabichickenlips` is a valid triple.
   removeAbiSuffix = x:
-    let match = builtins.match "(.*)e?abi.*" x;
-    in if match==null
+    let found = match "(.*)e?abi.*" x;
+    in if found == null
        then x
-       else lib.elemAt match 0;
+       else elemAt found 0;
 
 in
 
@@ -76,7 +107,7 @@ rec {
 
   types.cpuType = enum (attrValues cpuTypes);
 
-  cpuTypes = with significantBytes; setTypes types.openCpuType {
+  cpuTypes = let inherit (significantBytes) bigEndian littleEndian; in setTypes types.openCpuType {
     arm      = { bits = 32; significantByte = littleEndian; family = "arm"; };
     armv5tel = { bits = 32; significantByte = littleEndian; family = "arm"; version = "5"; arch = "armv5t"; };
     armv6m   = { bits = 32; significantByte = littleEndian; family = "arm"; version = "6"; arch = "armv6-m"; };
@@ -166,7 +197,7 @@ rec {
   # Note: Since 22.11 the archs of a mode switching CPU are no longer considered
   # pairwise compatible. Mode switching implies that binaries built for A
   # and B respectively can't be executed at the same time.
-  isCompatible = a: b: with cpuTypes; lib.any lib.id [
+  isCompatible = with cpuTypes; a: b: any id [
     # x86
     (b == i386 && isCompatible a i486)
     (b == i486 && isCompatible a i586)
@@ -287,7 +318,10 @@ rec {
 
   types.kernel = enum (attrValues kernels);
 
-  kernels = with execFormats; with kernelFamilies; setTypes types.openKernel {
+  kernels = let
+    inherit (execFormats) elf pe wasm unknown macho;
+    inherit (kernelFamilies) bsd darwin;
+  in setTypes types.openKernel {
     # TODO(@Ericson2314): Don't want to mass-rebuild yet to keeping 'darwin' as
     # the normalized name for macOS.
     macos    = { execFormat = macho;   families = { inherit darwin; }; name = "darwin"; };
@@ -359,7 +393,7 @@ rec {
             The "gnu" ABI is ambiguous on 32-bit ARM. Use "gnueabi" or "gnueabihf" instead.
           '';
         }
-        { assertion = platform: with platform; !(isPower64 && isBigEndian);
+        { assertion = platform: !(platform.isPower64 && platform.isBigEndian);
           message = ''
             The "gnu" ABI is ambiguous on big-endian 64-bit PowerPC. Use "gnuabielfv2" or "gnuabielfv1" instead.
           '';
@@ -480,7 +514,7 @@ rec {
         /**/ if args ? abi       then getAbi args.abi
         else if isLinux parsed || isWindows parsed then
           if isAarch32 parsed then
-            if lib.versionAtLeast (parsed.cpu.version or "0") "6"
+            if versionAtLeast (parsed.cpu.version or "0") "6"
             then abis.gnueabihf
             else abis.gnueabi
           # Default ppc64 BE to ELFv2
@@ -491,7 +525,7 @@ rec {
 
   in mkSystem parsed;
 
-  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (lib.splitString "-" s));
+  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s));
 
   kernelName = kernel:
     kernel.name + toString (kernel.version or "");
@@ -503,10 +537,10 @@ rec {
 
   tripleFromSystem = { cpu, vendor, kernel, abi, ... } @ sys: assert isSystem sys; let
     optExecFormat =
-      lib.optionalString (kernel.name == "netbsd" &&
+      optionalString (kernel.name == "netbsd" &&
                           gnuNetBSDDefaultExecFormat cpu != kernel.execFormat)
         kernel.execFormat.name;
-    optAbi = lib.optionalString (abi != abis.unknown) "-${abi.name}";
+    optAbi = optionalString (abi != abis.unknown) "-${abi.name}";
   in "${cpu.name}-${vendor.name}-${kernelName kernel}${optExecFormat}${optAbi}";
 
   ################################################################################
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f2f0adf7cbab5..029397c5bac55 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2959,6 +2959,12 @@
     githubId = 8891115;
     name = "Brian Choy";
   };
+   ByteSudoer = {
+    email = "bytesudoer@gmail.com";
+    github = "bytesudoer";
+    githubId = 88513682;
+    name = "ByteSudoer";
+  };
   bzizou = {
     email = "Bruno@bzizou.net";
     github = "bzizou";
@@ -8642,6 +8648,12 @@
     github = "j0xaf";
     githubId = 932697;
   };
+  j1nxie = {
+    email = "rylie@rylie.moe";
+    name = "Nguyen Pham Quoc An";
+    github = "j1nxie";
+    githubId = 52886388;
+  };
   j4m3s = {
     name = "James Landrein";
     email = "github@j4m3s.eu";
@@ -12550,6 +12562,15 @@
     githubId = 15093162;
     name = "Melanie B. Sigl";
   };
+  melvyn2 = {
+    email = "melvyn2@dnsense.pub";
+    github = "melvyn2";
+    githubId = 9157412;
+    name = "melvyn";
+    keys = [{
+      fingerprint = "232B 9F00 2153 CA86 849C  9224 25A2 B728 0CE3 AFF6";
+    }];
+  };
   mephistophiles = {
     email = "mussitantesmortem@gmail.com";
     name = "Maxim Zhukov";
@@ -16535,6 +16556,11 @@
     githubId = 61013287;
     name = "Ricardo Steijn";
   };
+  richar = {
+    github = "ri-char";
+    githubId = 17962023;
+    name = "richar";
+  };
   richardipsum = {
     email = "richardipsum@fastmail.co.uk";
     github = "richardipsum";
@@ -18782,6 +18808,16 @@
     githubId = 39732259;
     name = "Justus K";
   };
+  stv0g = {
+    name = "Steffen Vogel";
+    email = "post@steffenvogel.de";
+    matrix = "@stv0ge:matrix.org";
+    github = "stv0g";
+    githubId = 285829;
+    keys = [{
+      fingerprint = "09BE 3BAE 8D55 D4CD 8579  285A 9675 EAC3 4897 E6E2";
+    }];
+  };
   SubhrajyotiSen = {
     email = "subhrajyoti12@gmail.com";
     github = "SubhrajyotiSen";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 4b8ae20e0f11f..f4b1cc0609ad1 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -330,6 +330,9 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   - The `erlang_node_short_name`, `erlang_node_name`, `port` and `options` configuration parameters are gone, and have been replaced with an `environment` parameter.
     Use the appropriate [environment variables](https://hexdocs.pm/livebook/readme.html#environment-variables) inside `environment` to configure the service instead.
 
+- The `crystal` package has been updated to 1.11.x, which has some breaking changes.
+  Refer to crystal's changelog for more information. ([v1.10](https://github.com/crystal-lang/crystal/blob/master/CHANGELOG.md#1100-2023-10-09), [v1.11](https://github.com/crystal-lang/crystal/blob/master/CHANGELOG.md#1110-2024-01-08))
+
 ## Other Notable Changes {#sec-release-24.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -450,6 +453,12 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - The module `services.github-runner` has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
 
+- The `services.slskd` has been refactored to include more configuation options in
+  the freeform `services.slskd.settings` option, and some defaults (including listen ports)
+  have been changed to match the upstream defaults. Additionally, disk logging is now
+  disabled by default, and the log rotation timer has been removed.
+  The nginx virtualhost option is now of the `vhost-options` type.
+
 - The `btrbk` module now automatically selects and provides required compression
   program depending on the configured `stream_compress` option. Since this
   replaces the need for the `extraPackages` option, this option will be
diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix
index 6c2602881d6b5..786e26cf98f7f 100644
--- a/nixos/modules/profiles/macos-builder.nix
+++ b/nixos/modules/profiles/macos-builder.nix
@@ -145,6 +145,8 @@ in
         # This installCredentials script is written so that it's as easy as
         # possible for a user to audit before confirming the `sudo`
         installCredentials = hostPkgs.writeShellScript "install-credentials" ''
+          set -euo pipefail
+
           KEYS="''${1}"
           INSTALL=${hostPkgs.coreutils}/bin/install
           "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
@@ -154,6 +156,9 @@ in
         hostPkgs = config.virtualisation.host.pkgs;
 
         script = hostPkgs.writeShellScriptBin "create-builder" (
+          ''
+            set -euo pipefail
+          '' +
           # When running as non-interactively as part of a DarwinConfiguration the working directory
           # must be set to a writeable directory.
         (if cfg.workingDirectory != "." then ''
diff --git a/nixos/modules/services/desktops/flatpak.nix b/nixos/modules/services/desktops/flatpak.nix
index 4c26e6874023a..62ef38a3d5548 100644
--- a/nixos/modules/services/desktops/flatpak.nix
+++ b/nixos/modules/services/desktops/flatpak.nix
@@ -32,6 +32,8 @@ in {
 
     security.polkit.enable = true;
 
+    fonts.fontDir.enable = true;
+
     services.dbus.packages = [ pkgs.flatpak ];
 
     systemd.packages = [ pkgs.flatpak ];
diff --git a/nixos/modules/services/web-apps/slskd.nix b/nixos/modules/services/web-apps/slskd.nix
index 580f66ec3ac90..15a5fd1177adf 100644
--- a/nixos/modules/services/web-apps/slskd.nix
+++ b/nixos/modules/services/web-apps/slskd.nix
@@ -2,120 +2,248 @@
 
 let
   settingsFormat = pkgs.formats.yaml {};
+  defaultUser = "slskd";
 in {
   options.services.slskd = with lib; with types; {
     enable = mkEnableOption "enable slskd";
 
-    rotateLogs = mkEnableOption "enable an unit and timer that will rotate logs in /var/slskd/logs";
+    package = mkPackageOptionMD pkgs "slskd" { };
 
-    package = mkPackageOption pkgs "slskd" { };
+    user = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = "User account under which slskd runs.";
+    };
 
-    nginx = mkOption {
-      description = lib.mdDoc "options for nginx";
-      example = {
-        enable = true;
-        domain = "example.com";
-        contextPath = "/slskd";
-      };
-      type = submodule ({name, config, ...}: {
-        options = {
-          enable = mkEnableOption "enable nginx as a reverse proxy";
+    group = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = "Group under which slskd runs.";
+    };
 
-          domainName = mkOption {
-            type = str;
-            description = "Domain you want to use";
-          };
-          contextPath = mkOption {
-            type = types.path;
-            default = "/";
-            description = lib.mdDoc ''
-              The context path, i.e., the last part of the slskd
-              URL. Typically '/' or '/slskd'. Default '/'
-            '';
-          };
-        };
-      });
+    domain = mkOption {
+      type = types.nullOr types.str;
+      description = ''
+        If non-null, enables an nginx reverse proxy virtual host at this FQDN,
+        at the path configurated with `services.slskd.web.url_base`.
+      '';
+      example = "slskd.example.com";
+    };
+
+    nginx = mkOption {
+      type = types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+      default = {};
+      example = lib.literalExpression ''
+        {
+          enableACME = true;
+          forceHttps = true;
+        }
+      '';
+      description = ''
+        This option customizes the nginx virtual host set up for slskd.
+      '';
     };
 
     environmentFile = mkOption {
       type = path;
       description = ''
-        Path to a file containing secrets.
-        It must at least contain the variable `SLSKD_SLSK_PASSWORD`
+        Path to the environment file sourced on startup.
+        It must at least contain the variables `SLSKD_SLSK_USERNAME` and `SLSKD_SLSK_PASSWORD`.
+        Web interface credentials should also be set here in `SLSKD_USERNAME` and `SLSKD_PASSWORD`.
+        Other, optional credentials like SOCKS5 with `SLSKD_SLSK_PROXY_USERNAME` and `SLSKD_SLSK_PROXY_PASSWORD`
+        should all reside here instead of in the world-readable nix store.
+        Variables are documented at https://github.com/slskd/slskd/blob/master/docs/config.md
       '';
     };
 
     openFirewall = mkOption {
       type = bool;
-      description = ''
-        Whether to open the firewall for services.slskd.settings.listen_port";
-      '';
+      description = "Whether to open the firewall for the soulseek network listen port (not the web interface port).";
       default = false;
     };
 
     settings = mkOption {
-      description = lib.mdDoc ''
-        Configuration for slskd, see
-        [available options](https://github.com/slskd/slskd/blob/master/docs/config.md)
-        `APP_DIR` is set to /var/lib/slskd, where default download & incomplete directories,
-        log and databases will be created.
+      description = ''
+        Application configuration for slskd. See
+        [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md).
       '';
       default = {};
       type = submodule {
         freeformType = settingsFormat.type;
         options = {
+          remote_file_management = mkEnableOption "modification of share contents through the web ui";
+
+          flags = {
+            force_share_scan = mkOption {
+              type = bool;
+              description = "Force a rescan of shares on every startup.";
+            };
+            no_version_check = mkOption {
+              type = bool;
+              default = true;
+              visible = false;
+              description = "Don't perform a version check on startup.";
+            };
+          };
+
+          directories = {
+            incomplete = mkOption {
+              type = nullOr path;
+              description = "Directory where incomplete downloading files are stored.";
+              defaultText = "/var/lib/slskd/incomplete";
+              default = null;
+            };
+            downloads = mkOption {
+              type = nullOr path;
+              description = "Directory where downloaded files are stored.";
+              defaultText = "/var/lib/slskd/downloads";
+              default = null;
+            };
+          };
+
+          shares = {
+            directories = mkOption {
+              type = listOf str;
+              description = ''
+                Paths to shared directories. See
+                [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md#directories)
+                for advanced usage.
+              '';
+              example = lib.literalExpression ''[ "/home/John/Music" "!/home/John/Music/Recordings" "[Music Drive]/mnt" ]'';
+            };
+            filters = mkOption {
+              type = listOf str;
+              example = lib.literalExpression ''[ "\.ini$" "Thumbs.db$" "\.DS_Store$" ]'';
+              description = "Regular expressions of files to exclude from sharing.";
+            };
+          };
+
+          rooms = mkOption {
+            type = listOf str;
+            description = "Chat rooms to join on startup.";
+          };
 
           soulseek = {
-            username = mkOption {
+            description = mkOption {
               type = str;
-              description = "Username on the Soulseek Network";
+              description = "The user description for the Soulseek network.";
+              defaultText = "A slskd user. https://github.com/slskd/slskd";
             };
             listen_port = mkOption {
               type = port;
-              description = "Port to use for communication on the Soulseek Network";
-              default = 50000;
+              description = "The port on which to listen for incoming connections.";
+              default = 50300;
             };
           };
 
+          global = {
+            # TODO speed units
+            upload = {
+              slots = mkOption {
+                type = ints.unsigned;
+                description = "Limit of the number of concurrent upload slots.";
+              };
+              speed_limit = mkOption {
+                type = ints.unsigned;
+                description = "Total upload speed limit.";
+              };
+            };
+            download = {
+              slots = mkOption {
+                type = ints.unsigned;
+                description = "Limit of the number of concurrent download slots.";
+              };
+              speed_limit = mkOption {
+                type = ints.unsigned;
+                description = "Total upload download limit";
+              };
+            };
+          };
+
+          filters.search.request = mkOption {
+            type = listOf str;
+            example = lib.literalExpression ''[ "^.{1,2}$" ]'';
+            description = "Incoming search requests which match this filter are ignored.";
+          };
+
           web = {
             port = mkOption {
               type = port;
-              default = 5001;
-              description = "The HTTP listen port";
+              default = 5030;
+              description = "The HTTP listen port.";
             };
             url_base = mkOption {
               type = path;
-              default = config.services.slskd.nginx.contextPath;
-              defaultText = "config.services.slskd.nginx.contextPath";
-              description = lib.mdDoc ''
-                The context path, i.e., the last part of the slskd URL
-              '';
+              default = "/";
+              description = "The base path in the url for web requests.";
+            };
+            # Users should use a reverse proxy instead for https
+            https.disabled = mkOption {
+              type = bool;
+              default = true;
+              description = "Disable the built-in HTTPS server";
             };
           };
 
-          shares = {
-            directories = mkOption {
-              type = listOf str;
-              description = lib.mdDoc ''
-                Paths to your shared directories. See
-                [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md#directories)
-                for advanced usage
-              '';
+          retention = {
+            transfers = {
+              upload = {
+                succeeded = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of succeeded upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+                errored = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of errored upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+                cancelled = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of cancelled upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+              };
+              download = {
+                succeeded = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of succeeded download tasks.";
+                  defaultText = "(indefinite)";
+                };
+                errored = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of errored download tasks.";
+                  defaultText = "(indefinite)";
+                };
+                cancelled = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of cancelled download tasks.";
+                  defaultText = "(indefinite)";
+                };
+              };
+            };
+            files = {
+              complete = mkOption {
+                type = ints.unsigned;
+                description = "Lifespan of completely downloaded files in minutes.";
+                example = 20160;
+                defaultText = "(indefinite)";
+              };
+              incomplete = mkOption {
+                type = ints.unsigned;
+                description = "Lifespan of incomplete downloading files in minutes.";
+                defaultText = "(indefinite)";
+              };
             };
           };
 
-          directories = {
-            incomplete = mkOption {
-              type = nullOr path;
-              description = "Directory where downloading files are stored";
-              defaultText = "<APP_DIR>/incomplete";
-              default = null;
-            };
-            downloads = mkOption {
-              type = nullOr path;
-              description = "Directory where downloaded files are stored";
-              defaultText = "<APP_DIR>/downloads";
-              default = null;
+          logger = {
+            # Disable by default, journald already retains as needed
+            disk = mkOption {
+              type = bool;
+              description = "Whether to log to the application directory.";
+              default = false;
+              visible = false;
             };
           };
         };
@@ -126,51 +254,42 @@ in {
   config = let
     cfg = config.services.slskd;
 
-    confWithoutNullValues = (lib.filterAttrs (key: value: value != null) cfg.settings);
+    confWithoutNullValues = (lib.filterAttrsRecursive (key: value: (builtins.tryEval value).success && value != null) cfg.settings);
 
     configurationYaml = settingsFormat.generate "slskd.yml" confWithoutNullValues;
 
   in lib.mkIf cfg.enable {
 
-    users = {
-      users.slskd = {
+    # Force off, configuration file is in nix store and is immutable
+    services.slskd.settings.remote_configuration = lib.mkForce false;
+
+    users.users = lib.optionalAttrs (cfg.user == defaultUser) {
+      "${defaultUser}" = {
+        group = cfg.group;
         isSystemUser = true;
-        group = "slskd";
       };
-      groups.slskd = {};
     };
 
-    # Reverse proxy configuration
-    services.nginx.enable = true;
-    services.nginx.virtualHosts."${cfg.nginx.domainName}" = {
-      forceSSL = true;
-      enableACME = true;
-      locations = {
-        "${cfg.nginx.contextPath}" = {
-          proxyPass = "http://localhost:${toString cfg.settings.web.port}";
-          proxyWebsockets = true;
-        };
-      };
+    users.groups = lib.optionalAttrs (cfg.group == defaultUser) {
+      "${defaultUser}" = {};
     };
 
-    # Hide state & logs
-    systemd.tmpfiles.rules = [
-      "d /var/lib/slskd/data 0750 slskd slskd - -"
-      "d /var/lib/slskd/logs 0750 slskd slskd - -"
-    ];
-
     systemd.services.slskd = {
       description = "A modern client-server application for the Soulseek file sharing network";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "simple";
-        User = "slskd";
+        User = cfg.user;
+        Group = cfg.group;
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        StateDirectory = "slskd";
+        StateDirectory = "slskd";  # Creates /var/lib/slskd and manages permissions
         ExecStart = "${cfg.package}/bin/slskd --app-dir /var/lib/slskd --config ${configurationYaml}";
         Restart = "on-failure";
         ReadOnlyPaths = map (d: builtins.elemAt (builtins.split "[^/]*(/.+)" d) 1) cfg.settings.shares.directories;
+        ReadWritePaths =
+          (lib.optional (cfg.settings.directories.incomplete != null) cfg.settings.directories.incomplete) ++
+          (lib.optional (cfg.settings.directories.downloads != null) cfg.settings.directories.downloads);
         LockPersonality = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
@@ -194,18 +313,21 @@ in {
 
     networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.settings.soulseek.listen_port;
 
-    systemd.services.slskd-rotatelogs = lib.mkIf cfg.rotateLogs {
-      description = "Rotate slskd logs";
-      serviceConfig = {
-        Type = "oneshot";
-        User = "slskd";
-        ExecStart = [
-          "${pkgs.findutils}/bin/find /var/lib/slskd/logs/ -type f -mtime +10 -delete"
-          "${pkgs.findutils}/bin/find /var/lib/slskd/logs/ -type f -mtime +1  -exec ${pkgs.gzip}/bin/gzip -q {} ';'"
-        ];
-      };
-      startAt = "daily";
+    services.nginx = lib.mkIf (cfg.domain != null) {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.domain}" = lib.mkMerge [
+        cfg.nginx
+        {
+          locations."${cfg.settings.web.url_base}" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.settings.web.port}";
+            proxyWebsockets = true;
+          };
+        }
+      ];
     };
+  };
 
+  meta = {
+    maintainers = with lib.maintainers; [ ppom melvyn2 ];
   };
 }
diff --git a/nixos/modules/tasks/filesystems/envfs.nix b/nixos/modules/tasks/filesystems/envfs.nix
index 365cb46ff2fe3..6719a03610d10 100644
--- a/nixos/modules/tasks/filesystems/envfs.nix
+++ b/nixos/modules/tasks/filesystems/envfs.nix
@@ -7,6 +7,7 @@ let
       device = "none";
       fsType = "envfs";
       options = [
+        "bind-mount=/bin"
         "fallback-path=${pkgs.runCommand "fallback-path" {} (''
           mkdir -p $out
           ln -s ${config.environment.usrbinenv} $out/env
@@ -15,6 +16,9 @@ let
         "nofail"
       ];
     };
+    # We need to bind-mount /bin to /usr/bin, because otherwise upgrading
+    # from envfs < 1.0.5 will cause having the old envs with no /bin bind mount.
+    # Systemd is smart enough to not mount /bin if it's already mounted.
     "/bin" = {
       device = "/usr/bin";
       fsType = "none";
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index da7873c7bec86..a89d000ed299b 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -1,8 +1,80 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.virtualisation.incus;
   preseedFormat = pkgs.formats.yaml { };
+
+  serverBinPath = ''${pkgs.qemu_kvm}/libexec:${
+    lib.makeBinPath (
+      with pkgs;
+      [
+        cfg.package
+
+        acl
+        attr
+        bash
+        btrfs-progs
+        cdrkit
+        coreutils
+        criu
+        dnsmasq
+        e2fsprogs
+        findutils
+        getent
+        gnugrep
+        gnused
+        gnutar
+        gptfdisk
+        gzip
+        iproute2
+        iptables
+        kmod
+        lvm2
+        minio
+        nftables
+        qemu_kvm
+        qemu-utils
+        rsync
+        squashfsTools
+        systemd
+        thin-provisioning-tools
+        util-linux
+        virtiofsd
+        xz
+
+        (writeShellScriptBin "apparmor_parser" ''
+          exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
+        '')
+      ]
+      ++ lib.optionals config.boot.zfs.enabled [
+        config.boot.zfs.package
+        "${config.boot.zfs.package}/lib/udev"
+      ]
+      ++ lib.optionals config.virtualisation.vswitch.enable [ config.virtualisation.vswitch.package ]
+    )
+  }'';
+
+  # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
+  ovmf-prefix = if pkgs.stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
+  ovmf = pkgs.linkFarm "incus-ovmf" [
+    {
+      name = "OVMF_CODE.4MB.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.ms.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+  ];
 in
 {
   meta = {
@@ -11,26 +83,29 @@ in
 
   options = {
     virtualisation.incus = {
-      enable = lib.mkEnableOption (lib.mdDoc ''
+      enable = lib.mkEnableOption ''
         incusd, a daemon that manages containers and virtual machines.
 
         Users in the "incus-admin" group can interact with
         the daemon (e.g. to start or stop containers) using the
         {command}`incus` command line tool, among others.
-      '');
+      '';
 
       package = lib.mkPackageOption pkgs "incus" { };
 
       lxcPackage = lib.mkPackageOption pkgs "lxc" { };
 
+      clientPackage = lib.mkPackageOption pkgs [
+        "incus"
+        "client"
+      ] { };
+
       preseed = lib.mkOption {
-        type = lib.types.nullOr (
-          lib.types.submodule { freeformType = preseedFormat.type; }
-        );
+        type = lib.types.nullOr (lib.types.submodule { freeformType = preseedFormat.type; });
 
         default = null;
 
-        description = lib.mdDoc ''
+        description = ''
           Configuration for Incus preseed, see
           <https://linuxcontainers.org/incus/docs/main/howto/initialize/#non-interactive-configuration>
           for supported values.
@@ -80,18 +155,16 @@ in
         };
       };
 
-      socketActivation = lib.mkEnableOption (
-        lib.mdDoc ''
-          socket-activation for starting incus.service. Enabling this option
-          will stop incus.service from starting automatically on boot.
-        ''
-      );
+      socketActivation = lib.mkEnableOption (''
+        socket-activation for starting incus.service. Enabling this option
+        will stop incus.service from starting automatically on boot.
+      '');
 
       startTimeout = lib.mkOption {
         type = lib.types.ints.unsigned;
         default = 600;
         apply = toString;
-        description = lib.mdDoc ''
+        description = ''
           Time to wait (in seconds) for incusd to become ready to process requests.
           If incusd does not reply within the configured time, `incus.service` will be
           considered failed and systemd will attempt to restart it.
@@ -99,9 +172,12 @@ in
       };
 
       ui = {
-        enable = lib.mkEnableOption (lib.mdDoc "(experimental) Incus UI");
+        enable = lib.mkEnableOption "(experimental) Incus UI";
 
-        package = lib.mkPackageOption pkgs [ "incus" "ui" ] { };
+        package = lib.mkPackageOption pkgs [
+          "incus"
+          "ui"
+        ] { };
       };
     };
   };
@@ -109,7 +185,12 @@ in
   config = lib.mkIf cfg.enable {
     assertions = [
       {
-        assertion = !(config.networking.firewall.enable && !config.networking.nftables.enable && config.virtualisation.incus.enable);
+        assertion =
+          !(
+            config.networking.firewall.enable
+            && !config.networking.nftables.enable
+            && config.virtualisation.incus.enable
+          );
         message = "Incus on NixOS is unsupported using iptables. Set `networking.nftables.enable = true;`";
       }
     ];
@@ -137,7 +218,12 @@ in
       "vhost_vsock"
     ] ++ lib.optionals (!config.networking.nftables.enable) [ "iptable_mangle" ];
 
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [
+      cfg.clientPackage
+
+      # gui console support
+      pkgs.spice-gtk
+    ];
 
     # Note: the following options are also declared in virtualisation.lxc, but
     # the latter can't be simply enabled to reuse the formers, because it
@@ -164,31 +250,23 @@ in
         "network-online.target"
         "lxcfs.service"
         "incus.socket"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable "ovs-vswitchd.service";
+      ] ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ];
 
       requires = [
         "lxcfs.service"
         "incus.socket"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable "ovs-vswitchd.service";
-
-      wants = [
-        "network-online.target"
-      ];
+      ] ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ];
 
-      path = lib.optionals config.boot.zfs.enabled [
-        config.boot.zfs.package
-        "${config.boot.zfs.package}/lib/udev"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable config.virtualisation.vswitch.package;
+      wants = [ "network-online.target" ];
 
-      environment = lib.mkMerge [ {
-        # Override Path to the LXC template configuration directory
-        INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
-      } (lib.mkIf (cfg.ui.enable) {
-        "INCUS_UI" = cfg.ui.package;
-      }) ];
+      environment = lib.mkMerge [
+        {
+          INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
+          INCUS_OVMF_PATH = ovmf;
+          PATH = lib.mkForce serverBinPath;
+        }
+        (lib.mkIf (cfg.ui.enable) { "INCUS_UI" = cfg.ui.package; })
+      ];
 
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/incusd --group incus-admin";
@@ -222,15 +300,13 @@ in
     systemd.services.incus-preseed = lib.mkIf (cfg.preseed != null) {
       description = "Incus initialization with preseed file";
 
-      wantedBy = ["incus.service"];
-      after = ["incus.service"];
-      bindsTo = ["incus.service"];
-      partOf = ["incus.service"];
+      wantedBy = [ "incus.service" ];
+      after = [ "incus.service" ];
+      bindsTo = [ "incus.service" ];
+      partOf = [ "incus.service" ];
 
       script = ''
-        ${cfg.package}/bin/incus admin init --preseed <${
-          preseedFormat.generate "incus-preseed.yaml" cfg.preseed
-        }
+        ${cfg.package}/bin/incus admin init --preseed <${preseedFormat.generate "incus-preseed.yaml" cfg.preseed}
       '';
 
       serviceConfig = {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index d9e9108079322..69d340bae2774 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -309,6 +309,7 @@ in {
   firefox-devedition = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-devedition; };
   firefox-esr    = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr; }; # used in `tested` job
   firefox-esr-115 = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr-115; };
+  firefoxpwa = handleTest ./firefoxpwa.nix {};
   firejail = handleTest ./firejail.nix {};
   firewall = handleTest ./firewall.nix { nftables = false; };
   firewall-nftables = handleTest ./firewall.nix { nftables = true; };
diff --git a/nixos/tests/firefoxpwa.nix b/nixos/tests/firefoxpwa.nix
new file mode 100644
index 0000000000000..374d67b01ac60
--- /dev/null
+++ b/nixos/tests/firefoxpwa.nix
@@ -0,0 +1,36 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+{
+  name = "firefoxpwa";
+  meta.maintainers = with lib.maintainers; [ camillemndn ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      environment.systemPackages = with pkgs; [ firefoxpwa jq ];
+
+      programs.firefox = {
+        enable = true;
+        nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
+      };
+
+      services.jellyfin.enable = true;
+    };
+
+  enableOCR = true;
+
+  testScript = ''
+    machine.start()
+
+    with subtest("Install a progressive web app"):
+        machine.wait_for_unit("jellyfin.service")
+        machine.wait_for_open_port(8096)
+        machine.succeed("firefoxpwa site install http://localhost:8096/web/manifest.json >&2")
+
+    with subtest("Launch the progressive web app"):
+        machine.succeed("firefoxpwa site launch $(jq -r < ~/.local/share/firefoxpwa/config.json '.sites | keys[0]') >&2")
+        machine.wait_for_window("Jellyfin")
+        machine.wait_for_text("Jellyfin")
+  '';
+})
diff --git a/nixos/tests/incus/container.nix b/nixos/tests/incus/container.nix
index 9260f70da98c2..a71c5355046a5 100644
--- a/nixos/tests/incus/container.nix
+++ b/nixos/tests/incus/container.nix
@@ -1,20 +1,21 @@
-import ../make-test-python.nix ({ pkgs, lib, extra ? {}, ... } :
+import ../make-test-python.nix ({ pkgs, lib, extra ? {}, name ? "incus-container", ... } :
 
 let
   releases = import ../../release.nix {
-    configuration = {
-      # Building documentation makes the test unnecessarily take a longer time:
-      documentation.enable = lib.mkForce false;
+    configuration = lib.recursiveUpdate {
+        # Building documentation makes the test unnecessarily take a longer time:
+        documentation.enable = lib.mkForce false;
 
-      boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
-    } // extra;
+        boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
+    }
+    extra;
   };
 
   container-image-metadata = releases.lxdContainerMeta.${pkgs.stdenv.hostPlatform.system};
   container-image-rootfs = releases.lxdContainerImage.${pkgs.stdenv.hostPlatform.system};
 in
 {
-  name = "incus-container";
+  inherit name;
 
   meta = {
     maintainers = lib.teams.lxc.members;
diff --git a/nixos/tests/incus/default.nix b/nixos/tests/incus/default.nix
index 32bc5396a1647..b850c4fba018d 100644
--- a/nixos/tests/incus/default.nix
+++ b/nixos/tests/incus/default.nix
@@ -5,16 +5,22 @@
   handleTestOn,
 }:
 {
-  container-old-init = import ./container.nix { inherit system pkgs; };
-  container-new-init = import ./container.nix { inherit system pkgs; extra = {
-    # Enable new systemd init
-    boot.initrd.systemd.enable = true;
-  }; };
+  container-legacy-init = import ./container.nix {
+    name = "container-legacy-init";
+    inherit system pkgs;
+  };
+  container-systemd-init = import ./container.nix {
+    name = "container-systemd-init";
+    inherit system pkgs;
+    extra = {
+      boot.initrd.systemd.enable = true;
+    };
+  };
   lxd-to-incus = import ./lxd-to-incus.nix { inherit system pkgs; };
   openvswitch = import ./openvswitch.nix { inherit system pkgs; };
   preseed = import ./preseed.nix { inherit system pkgs; };
   socket-activated = import ./socket-activated.nix { inherit system pkgs; };
   storage = import ./storage.nix { inherit system pkgs; };
-  ui = import ./ui.nix {inherit system pkgs;};
+  ui = import ./ui.nix { inherit system pkgs; };
   virtual-machine = handleTestOn [ "x86_64-linux" ] ./virtual-machine.nix { inherit system pkgs; };
 }
diff --git a/nixos/tests/incus/lxd-to-incus.nix b/nixos/tests/incus/lxd-to-incus.nix
index 262f63c0f26fb..e93b76591eca4 100644
--- a/nixos/tests/incus/lxd-to-incus.nix
+++ b/nixos/tests/incus/lxd-to-incus.nix
@@ -95,7 +95,7 @@ import ../make-test-python.nix (
       machine.wait_for_unit("incus.service")
 
       with machine.nested("run migration"):
-          machine.succeed("lxd-to-incus --yes")
+          machine.succeed("${pkgs.incus}/bin/lxd-to-incus --yes")
 
       with machine.nested("verify resources migrated to incus"):
           machine.succeed("incus config show container")
diff --git a/nixos/tests/k3s/multi-node.nix b/nixos/tests/k3s/multi-node.nix
index 932b4639b39c8..20279f3ca4b93 100644
--- a/nixos/tests/k3s/multi-node.nix
+++ b/nixos/tests/k3s/multi-node.nix
@@ -128,9 +128,7 @@ import ../make-test-python.nix ({ pkgs, lib, k3s, ... }:
       };
     };
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ euank ];
-    };
+    meta.maintainers = k3s.meta.maintainers;
 
     testScript = ''
       machines = [server, server2, agent]
diff --git a/nixos/tests/k3s/single-node.nix b/nixos/tests/k3s/single-node.nix
index e059603b9c9d7..fd64a050e61ef 100644
--- a/nixos/tests/k3s/single-node.nix
+++ b/nixos/tests/k3s/single-node.nix
@@ -25,9 +25,7 @@ import ../make-test-python.nix ({ pkgs, lib, k3s, ... }:
   in
   {
     name = "${k3s.name}-single-node";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ euank ];
-    };
+    meta.maintainers = k3s.meta.maintainers;
 
     nodes.machine = { pkgs, ... }: {
       environment.systemPackages = with pkgs; [ k3s gzip ];
diff --git a/nixos/tests/nix-ld.nix b/nixos/tests/nix-ld.nix
index 8733f5b0c3978..9b851f88617a0 100644
--- a/nixos/tests/nix-ld.nix
+++ b/nixos/tests/nix-ld.nix
@@ -1,17 +1,39 @@
-import ./make-test-python.nix ({ lib, pkgs, ...} :
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  shared =
+    { config, pkgs, ... }:
+    {
+      programs.nix-ld.enable = true;
+      environment.systemPackages = [
+        (pkgs.runCommand "patched-hello" { } ''
+          install -D -m755 ${pkgs.hello}/bin/hello $out/bin/hello
+          patchelf $out/bin/hello --set-interpreter $(cat ${config.programs.nix-ld.package}/nix-support/ldpath)
+        '')
+      ];
+    };
+in
 {
-  name = "nix-ld";
-  nodes.machine = { pkgs, ... }: {
-    programs.nix-ld.enable = true;
-    environment.systemPackages = [
-      (pkgs.runCommand "patched-hello" {} ''
-        install -D -m755 ${pkgs.hello}/bin/hello $out/bin/hello
-        patchelf $out/bin/hello --set-interpreter $(cat ${pkgs.nix-ld}/nix-support/ldpath)
-      '')
-    ];
+  nix-ld = makeTest {
+    name = "nix-ld";
+    nodes.machine = shared;
+    testScript = ''
+      start_all()
+      machine.succeed("hello")
+    '';
   };
-  testScript = ''
-    start_all()
-    machine.succeed("hello")
- '';
-})
+  nix-ld-rs = makeTest {
+    name = "nix-ld-rs";
+    nodes.machine = {
+      imports = [ shared ];
+      programs.nix-ld.package = pkgs.nix-ld-rs;
+    };
+    testScript = ''
+      start_all()
+      machine.succeed("hello")
+    '';
+  };
+}
diff --git a/nixos/tests/tracee.nix b/nixos/tests/tracee.nix
index 3dadc0f9fdb33..1c241f3ec4983 100644
--- a/nixos/tests/tracee.nix
+++ b/nixos/tests/tracee.nix
@@ -1,7 +1,13 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: rec {
   name = "tracee-integration";
   meta.maintainers = pkgs.tracee.meta.maintainers;
 
+  passthru.hello-world-builder = pkgs: pkgs.dockerTools.buildImage {
+    name = "hello-world";
+    tag = "latest";
+    config.Cmd = [ "${pkgs.hello}/bin/hello" ];
+  };
+
   nodes = {
     machine = { config, pkgs, ... }: {
       # EventFilters/trace_only_events_from_new_containers and
@@ -12,57 +18,48 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       environment.systemPackages = with pkgs; [
         # required by Test_EventFilters/trace_events_from_ls_and_which_binary_in_separate_scopes
         which
-        # build the go integration tests as a binary
-        (tracee.overrideAttrs (oa: {
-          pname = oa.pname + "-integration";
-          postPatch = oa.postPatch or "" + ''
-            # prepare tester.sh (which will be embedded in the test binary)
-            patchShebangs tests/integration/tester.sh
-
-            # fix the test to look at nixos paths for running programs
-            substituteInPlace tests/integration/integration_test.go \
-              --replace "bin=/usr/bin/" "comm=" \
-              --replace "binary=/usr/bin/" "comm=" \
-              --replace "/usr/bin/dockerd" "dockerd" \
-              --replace "/usr/bin" "/run/current-system/sw/bin"
-          '';
-          nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ makeWrapper ];
-          buildPhase = ''
-            runHook preBuild
-            # just build the static lib we need for the go test binary
-            make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES} bpf-core ./dist/btfhub
-
-            # then compile the tests to be ran later
-            CGO_LDFLAGS="$(pkg-config --libs libbpf)" go test -tags core,ebpf,integration -p 1 -c -o $GOPATH/tracee-integration ./tests/integration/...
-            runHook postBuild
-          '';
-          doCheck = false;
-          outputs = [ "out" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            mv $GOPATH/tracee-integration $out/bin/
-          '';
-          doInstallCheck = false;
-
-          meta = oa.meta // {
-            outputsToInstall = [];
-          };
-        }))
+        # the go integration tests as a binary
+        tracee.passthru.tests.integration-test-cli
       ];
     };
   };
 
-  testScript = ''
-    machine.wait_for_unit("docker.service")
+  testScript =
+    let
+      skippedTests = [
+        # these comm tests for some reason do not resolve.
+        # something about the test is different as it works fine if I replicate
+        # the policies and run tracee myself but doesn't work in the integration
+        # test either with the automatic run or running the commands by hand
+        # while it's searching.
+        "Test_EventFilters/comm:_event:_args:_trace_event_set_in_a_specific_policy_with_args_from_ls_command"
+        "Test_EventFilters/comm:_event:_trace_events_set_in_two_specific_policies_from_ls_and_uname_commands"
+
+        # worked at some point, seems to be flakey
+        "Test_EventFilters/pid:_event:_args:_trace_event_sched_switch_with_args_from_pid_0"
+      ];
+    in
+    ''
+      with subtest("prepare for integration tests"):
+        machine.wait_for_unit("docker.service")
+        machine.succeed('which bash')
+
+        # EventFilters/trace_only_events_from_new_containers also requires a container called "hello-world"
+        machine.succeed('docker load < ${passthru.hello-world-builder pkgs}')
 
-    with subtest("run integration tests"):
-      # EventFilters/trace_only_events_from_new_containers also requires a container called "alpine"
-      machine.succeed('tar c -C ${pkgs.pkgsStatic.busybox} . | docker import - alpine --change "ENTRYPOINT [\"sleep\"]"')
+        # exec= needs fully resolved paths
+        machine.succeed(
+          'mkdir /tmp/testdir',
+          'cp $(which who) /tmp/testdir/who',
+          'cp $(which uname) /tmp/testdir/uname',
+        )
 
-      # Test_EventFilters/trace_event_set_in_a_specific_scope expects to be in a dir that includes "integration"
-      print(machine.succeed(
-        'mkdir /tmp/integration',
-        'cd /tmp/integration && tracee-integration -test.v'
-      ))
-  '';
+      with subtest("run integration tests"):
+        # Test_EventFilters/trace_event_set_in_a_specific_scope expects to be in a dir that includes "integration"
+        # tests must be ran with 1 process
+        print(machine.succeed(
+          'mkdir /tmp/integration',
+          'cd /tmp/integration && export PATH="/tmp/testdir:$PATH" && integration.test -test.v -test.parallel 1 -test.skip="^${builtins.concatStringsSep "$|^" skippedTests}$"'
+        ))
+    '';
 })
diff --git a/pkgs/applications/audio/geonkick/default.nix b/pkgs/applications/audio/geonkick/default.nix
index 011f06fd3ad5c..0f8bf17c68e85 100644
--- a/pkgs/applications/audio/geonkick/default.nix
+++ b/pkgs/applications/audio/geonkick/default.nix
@@ -1,22 +1,23 @@
 { lib, stdenv, fetchFromGitLab, cmake, pkg-config, libsndfile, rapidjson
-, libjack2, lv2, libX11, cairo }:
+, libjack2, lv2, libX11, cairo, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "geonkick";
-  version = "2.9.1";
+  version = "3.3.1";
 
   src = fetchFromGitLab {
-    owner = "iurie-sw";
+    owner = "Geonkick-Synthesizer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XSqcj8+X6QMBnIusPB9VNrgcbdiWhNMOYeFyKklGmO8=";
+    sha256 = "sha256-fsDoqQqZsoeQa66dxb8JC2ywUFmBf6b2J+/ixWZTzfU=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ libsndfile rapidjson libjack2 lv2 libX11 cairo ];
+  buildInputs = [ libsndfile rapidjson libjack2 lv2 libX11 cairo openssl ];
 
-  # https://github.com/iurie-sw/geonkick/issues/120
+  # Without this, the lv2 ends up in
+  # /nix/store/$HASH/nix/store/$HASH/lib/lv2
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
diff --git a/pkgs/applications/audio/tidal-hifi/default.nix b/pkgs/applications/audio/tidal-hifi/default.nix
index bb3986dd88aa7..d9d14b9670db7 100644
--- a/pkgs/applications/audio/tidal-hifi/default.nix
+++ b/pkgs/applications/audio/tidal-hifi/default.nix
@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tidal-hifi";
-  version = "5.9.0";
+  version = "5.10.0";
 
   src = fetchurl {
     url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${finalAttrs.version}/tidal-hifi_${finalAttrs.version}_amd64.deb";
-    sha256 = "sha256-t79GNCqY99JfCT+4wO3CTtLXFdKQudMw4pZNiJzOufo=";
+    sha256 = "sha256-+sRXpRAtbLpQlyJUhbc1Cuzh6aV8HRvYH/ja9sfvKoA=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];
diff --git a/pkgs/applications/audio/waylyrics/Cargo.lock b/pkgs/applications/audio/waylyrics/Cargo.lock
index 2c87d54dd27aa..601514f02cf93 100644
--- a/pkgs/applications/audio/waylyrics/Cargo.lock
+++ b/pkgs/applications/audio/waylyrics/Cargo.lock
@@ -127,6 +127,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+
+[[package]]
 name = "bitflags"
 version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -432,17 +438,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "derivative"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
-dependencies = [
- "proc-macro2",
- "quote 1.0.35",
- "syn 1.0.109",
-]
-
-[[package]]
 name = "derive_is_enum_variant"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -964,9 +959,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.24"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+checksum = "51ee2dd2e4f378392eeff5d51618cd9a63166a2513846bbc55f21cfacd9199d4"
 dependencies = [
  "bytes",
  "fnv",
@@ -1034,9 +1029,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
-version = "0.2.11"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
 dependencies = [
  "bytes",
  "fnv",
@@ -1045,12 +1040,24 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.6"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
 dependencies = [
  "bytes",
+ "futures-core",
  "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -1061,46 +1068,59 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
 [[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
 name = "hyper"
-version = "0.14.28"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
+checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
 dependencies = [
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "h2",
  "http",
  "http-body",
  "httparse",
- "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2",
+ "smallvec",
  "tokio",
- "tower-service",
- "tracing",
  "want",
 ]
 
 [[package]]
 name = "hyper-tls"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
+ "http-body-util",
  "hyper",
+ "hyper-util",
  "native-tls",
  "tokio",
  "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -1328,9 +1348,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "wasi",
@@ -1371,9 +1391,9 @@ dependencies = [
 [[package]]
 name = "ncmapi"
 version = "0.1.13"
-source = "git+https://github.com/waylyrics/ncmapi-rs.git?rev=51b4d121#51b4d121235823e8040feb3a9c9052da0559fe75"
+source = "git+https://github.com/waylyrics/ncmapi-rs.git?rev=590f280#590f280458e1826df0af0f0f624c2222448a7dee"
 dependencies = [
- "base64",
+ "base64 0.22.0",
  "cookie 0.18.0",
  "hex",
  "openssl",
@@ -1639,6 +1659,26 @@ dependencies = [
 ]
 
 [[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.35",
+ "syn 2.0.50",
+]
+
+[[package]]
 name = "pin-project-lite"
 version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1871,11 +1911,11 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.11.24"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6920094eb85afde5e4a138be3f2de8bbdf28000f0029e72c45025a56b042251"
+checksum = "58b48d98d932f4ee75e541614d32a7f44c889b72bd9c2e04d95edd135989df88"
 dependencies = [
- "base64",
+ "base64 0.21.7",
  "bytes",
  "cookie 0.17.0",
  "cookie_store",
@@ -1885,8 +1925,10 @@ dependencies = [
  "h2",
  "http",
  "http-body",
+ "http-body-util",
  "hyper",
  "hyper-tls",
+ "hyper-util",
  "ipnet",
  "js-sys",
  "log",
@@ -2000,7 +2042,7 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
 dependencies = [
- "base64",
+ "base64 0.21.7",
 ]
 
 [[package]]
@@ -2536,6 +2578,28 @@ dependencies = [
 ]
 
 [[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project",
+ "pin-project-lite",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+
+[[package]]
 name = "tower-service"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2547,6 +2611,7 @@ version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -2788,14 +2853,13 @@ checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
 
 [[package]]
 name = "waylyrics"
-version = "0.2.12"
+version = "0.2.13"
 dependencies = [
  "anyhow",
  "async-channel",
  "async-trait",
  "dbus",
  "dbus-dummy",
- "derivative",
  "documented",
  "gettext-rs",
  "glib-macros",
diff --git a/pkgs/applications/audio/waylyrics/default.nix b/pkgs/applications/audio/waylyrics/default.nix
index 9f55645a56bbc..d698b4b6f016f 100644
--- a/pkgs/applications/audio/waylyrics/default.nix
+++ b/pkgs/applications/audio/waylyrics/default.nix
@@ -9,19 +9,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "waylyrics";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "poly000";
     repo = "waylyrics";
     rev = "v${version}";
-    hash = "sha256-sUhFT3Vq/IjbMir7/AVCU8FyfmoNiZsn2zkqdJkOMFo=";
+    hash = "sha256-522NdpGj0oh2SbWa4GFCFpqNFRhqQxfZ1ZRuS9jUj7Y=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "ncmapi-0.1.13" = "sha256-NxgF1TV+3hK5oE/DfJnWyc+XmPX3U1UeD+xTkcvDzIA=";
+      "ncmapi-0.1.13" = "sha256-qu89qf4IPM14V+oE4QQr/SsXSTx3vQbyfzD+Pihcd3E=";
       "qqmusic-rs-0.1.0" = "sha256-woLsO0n+m3EBUI+PRLio7iLp0UPQSliWK0djCSZEaZc=";
     };
   };
@@ -51,6 +51,14 @@ rustPlatform.buildRustPackage rec {
     # Install icons
     install -d $out/share/icons
     cp -vr res/icons/hicolor $out/share/icons/hicolor
+    # Install translations
+    pushd locales
+    for po in $(find . -type f -name '*.po')
+    do
+      install -d $(dirname "$out/share/locale/$po")
+      msgfmt -o $out/share/locale/''${po%.po}.mo $po
+    done
+    popd
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/blockchains/trezor-suite/default.nix b/pkgs/applications/blockchains/trezor-suite/default.nix
index 328e423535f34..a633694df2e0b 100644
--- a/pkgs/applications/blockchains/trezor-suite/default.nix
+++ b/pkgs/applications/blockchains/trezor-suite/default.nix
@@ -53,6 +53,9 @@ appimageTools.wrapType2 rec {
   '';
 
   meta = with lib; {
+    # trezor-suite fails to detect a connected hardware wallet
+    # ref: https://github.com/NixOS/nixpkgs/issues/281975
+    broken = true;
     description = "Trezor Suite - Desktop App for managing crypto";
     homepage = "https://suite.trezor.io";
     changelog = "https://github.com/trezor/trezor-suite/releases/tag/v${version}";
diff --git a/pkgs/applications/editors/gedit/default.nix b/pkgs/applications/editors/gedit/default.nix
index d7e5ac0ba1ebe..eb985016b1783 100644
--- a/pkgs/applications/editors/gedit/default.nix
+++ b/pkgs/applications/editors/gedit/default.nix
@@ -4,6 +4,7 @@
 , mesonEmulatorHook
 , fetchurl
 , python3
+, python3Packages
 , pkg-config
 , gtk3
 , gtk-mac-integration
@@ -53,6 +54,7 @@ stdenv.mkDerivation rec {
     perl
     pkg-config
     python3
+    python3Packages.wrapPython
     vala
     wrapGAppsHook
     gtk-doc
@@ -85,6 +87,16 @@ stdenv.mkDerivation rec {
   # Reliably fails to generate gedit-file-browser-enum-types.h in time
   enableParallelBuilding = false;
 
+  pythonPath = with python3Packages; [
+    # https://github.com/NixOS/nixpkgs/issues/298716
+    pycairo
+  ];
+
+  postFixup = ''
+    buildPythonPath "$pythonPath"
+    patchPythonScript $out/lib/gedit/plugins/snippets/document.py
+  '';
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "gedit";
diff --git a/pkgs/applications/editors/xedit/default.nix b/pkgs/applications/editors/xedit/default.nix
index 679d64d6cca4b..6fa4a67dfd6bc 100644
--- a/pkgs/applications/editors/xedit/default.nix
+++ b/pkgs/applications/editors/xedit/default.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xedit";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "xorg/app";
     repo = "xedit";
     rev = "${pname}-${version}";
-    sha256 = "sha256-WF+4avzRRL0+OA3KxzK7JwmArkPu9fEl+728R6ouXmg=";
+    sha256 = "sha256-0vP+aR8QBXAqbULOLEs7QXsehk18BJ405qoelrcepwE=";
   };
 
   # ./lisp/mathimp.c:493:10: error: implicitly declaring library function 'finite' with type 'int (double)'
diff --git a/pkgs/applications/file-managers/clifm/default.nix b/pkgs/applications/file-managers/clifm/default.nix
index 72e363b8b3c24..026c6f52d0207 100644
--- a/pkgs/applications/file-managers/clifm/default.nix
+++ b/pkgs/applications/file-managers/clifm/default.nix
@@ -1,22 +1,36 @@
-{ stdenv, lib, fetchFromGitHub, libcap, acl, file, readline, python3 }:
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  libcap,
+  acl,
+  file,
+  readline,
+  python3,
+}:
 
 stdenv.mkDerivation rec {
   pname = "clifm";
-  version = "1.17";
+  version = "1.18";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-plJ2iKloRGtBSa1upSo675bMj6qczR6TQ043UQboxQE=";
+    hash = "sha256-tgCGZCLCWcF7ktXqDHjoUkeVqxg6QVOkZb7pbk3nA+U=";
   };
 
-  buildInputs = [ libcap acl file readline python3];
+  buildInputs = [
+    libcap
+    acl
+    file
+    readline
+    python3
+  ];
 
   makeFlags = [
-    "DESTDIR=${placeholder "out"}"
-    "DATADIR=/share"
-    "PREFIX=/"
+    "PREFIX=${placeholder "out"}"
+    "DATADIR=${placeholder "out"}/share"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/graphicsmagick/compat.nix b/pkgs/applications/graphics/graphicsmagick/compat.nix
deleted file mode 100644
index b715093308fab..0000000000000
--- a/pkgs/applications/graphics/graphicsmagick/compat.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, stdenv, graphicsmagick }:
-
-stdenv.mkDerivation {
-  pname = "graphicsmagick-imagemagick-compat";
-  inherit (graphicsmagick) version;
-
-  dontUnpack = true;
-  buildPhase = "true";
-
-  utils = [
-    "composite"
-    "conjure"
-    "convert"
-    "identify"
-    "mogrify"
-    "montage"
-    "animate"
-    "display"
-    "import"
-  ];
-
-  # TODO: symlink libraries?
-  installPhase = ''
-    mkdir -p "$out"/bin
-    mkdir -p "$out"/share/man/man1
-    for util in ''${utils[@]}; do
-      ln -s ${graphicsmagick}/bin/gm "$out/bin/$util"
-      ln -s ${graphicsmagick}/share/man/man1/gm.1.gz "$out/share/man/man1/$util.1.gz"
-    done
-  '';
-
-  meta = {
-    description = "ImageMagick interface for GraphicsMagick";
-    license = lib.licenses.free;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/applications/graphics/graphicsmagick/default.nix b/pkgs/applications/graphics/graphicsmagick/default.nix
deleted file mode 100644
index 893d2cebb6010..0000000000000
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{ lib, stdenv, fetchurl, bzip2, freetype, graphviz, ghostscript
-, libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
-, libwebp, quantumdepth ? 8, fixDarwinDylibNames, nukeReferences
-, coreutils
-, runCommand
-, graphicsmagick  # for passthru.tests
-}:
-
-stdenv.mkDerivation rec {
-  pname = "graphicsmagick";
-  version = "1.3.42";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "sha256-SE/M/Ssvr2wrqRUUaezlByvLkbpO1z517T2ORsdZ1Vc=";
-  };
-
-  patches = [
-    ./disable-popen.patch
-  ];
-
-  configureFlags = [
-    # specify delegates explicitly otherwise `gm` will invoke the build
-    # coreutils for filetypes it doesn't natively support.
-    "MVDelegate=${lib.getExe' coreutils "mv"}"
-    "--enable-shared"
-    "--with-frozenpaths"
-    "--with-quantum-depth=${toString quantumdepth}"
-    "--with-gslib=yes"
-  ];
-
-  buildInputs =
-    [ bzip2 freetype ghostscript graphviz libjpeg libpng libtiff libX11 libxml2
-      zlib libtool libwebp
-    ];
-
-  nativeBuildInputs = [ xz nukeReferences ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-
-  # Remove CFLAGS from the binaries to avoid closure bloat.
-  # In the past we have had -dev packages in the closure of the binaries soley due to the string references.
-  postConfigure = ''
-    nuke-refs -e $out ./magick/magick_config.h
-  '';
-
-  postInstall = ''
-    sed -i 's/-ltiff.*'\'/\'/ $out/bin/*
-  '';
-
-  passthru = {
-    tests = {
-      issue-157920 = runCommand "issue-157920-regression-test" {
-        buildInputs = [ graphicsmagick ];
-      } ''
-        gm convert ${graphviz}/share/doc/graphviz/neatoguide.pdf jpg:$out
-      '';
-    };
-  };
-
-  meta = {
-    homepage = "http://www.graphicsmagick.org";
-    description = "Swiss army knife of image processing";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    mainProgram = "gm";
-  };
-}
diff --git a/pkgs/applications/graphics/graphicsmagick/disable-popen.patch b/pkgs/applications/graphics/graphicsmagick/disable-popen.patch
deleted file mode 100644
index 2cdb1f7e90f72..0000000000000
--- a/pkgs/applications/graphics/graphicsmagick/disable-popen.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-http://permalink.gmane.org/gmane.comp.security.oss.general/19669
-
---- a/magick/blob.c Sat Nov 07 14:49:16 2015 -0600
-+++ b/magick/blob.c Sun May 29 14:12:57 2016 -0500
-@@ -68,6 +68,7 @@
- */
- #define DefaultBlobQuantum  65541
- 
-+#undef HAVE_POPEN
- 
- /*
-   Enum declarations.
diff --git a/pkgs/applications/misc/gramps/check-locale-hasattr-textdomain.patch b/pkgs/applications/misc/gramps/check-locale-hasattr-textdomain.patch
new file mode 100644
index 0000000000000..e1573ba5de33e
--- /dev/null
+++ b/pkgs/applications/misc/gramps/check-locale-hasattr-textdomain.patch
@@ -0,0 +1,19 @@
+diff --git a/gramps/gen/utils/grampslocale.py b/gramps/gen/utils/grampslocale.py
+index f25030e..59c1c90 100644
+--- a/gramps/gen/utils/grampslocale.py
++++ b/gramps/gen/utils/grampslocale.py
+@@ -370,8 +370,12 @@ class GrampsLocale:
+                 )
+             else:
+                 # bug12278, _build_popup_ui() under linux and macOS
+-                locale.textdomain(self.localedomain)
+-                locale.bindtextdomain(self.localedomain, self.localedir)
++                if hasattr(locale, 'textdomain'):
++                    locale.textdomain(self.localedomain)
++                    locale.bindtextdomain(self.localedomain, self.localedir)
++                else:
++                    gettext.textdomain(self.localedomain)
++                    gettext.bindtextdomain(self.localedomain, self.localedir)
+ 
+         self.rtl_locale = False
+         if self.language[0] in _RTL_LOCALES:
diff --git a/pkgs/applications/misc/gramps/default.nix b/pkgs/applications/misc/gramps/default.nix
index bd0690b381a95..a24cff0942e1e 100644
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@@ -1,5 +1,4 @@
 { lib
-, fetchpatch
 , fetchFromGitHub
 , gtk3
 , pythonPackages
@@ -10,8 +9,8 @@
 , gobject-introspection
 , wrapGAppsHook
 , gettext
-, # Optional packages:
-  enableOSM ? true
+  # Optional packages:
+, enableOSM ? true
 , osm-gps-map
 , glib-networking
 , enableGraphviz ? true
@@ -21,13 +20,29 @@
 }:
 
 let
-  inherit (pythonPackages) python buildPythonApplication;
+  inherit (pythonPackages) buildPythonApplication pythonOlder;
 in
 buildPythonApplication rec {
-  version = "5.1.6";
+  version = "5.2.0";
   pname = "gramps";
   pyproject = true;
 
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "gramps-project";
+    repo = "gramps";
+    rev = "v${version}";
+    hash = "sha256-8iQcaWLiBegVjcV16TfZbp8/4N/9f5pEl7mdV78CeEY=";
+  };
+
+  patches = [
+    # textdomain doesn't exist as a property on locale when running on Darwin
+    ./check-locale-hasattr-textdomain.patch
+    # disables the startup warning about bad GTK installation
+    ./disable-gtk-warning-dialog.patch
+  ];
+
   nativeBuildInputs = [
     wrapGAppsHook
     intltool
@@ -38,6 +53,7 @@ buildPythonApplication rec {
 
   nativeCheckInputs = [
     glibcLocales
+    pythonPackages.unittestCheckHook
     pythonPackages.jsonschema
     pythonPackages.mock
     pythonPackages.lxml
@@ -52,55 +68,25 @@ buildPythonApplication rec {
     ++ lib.optional enableGhostscript ghostscript
   ;
 
-  src = fetchFromGitHub {
-    owner = "gramps-project";
-    repo = "gramps";
-    rev = "v${version}";
-    hash = "sha256-BerkDXdFYfZ3rV5AeMo/uk53IN2U5z4GFs757Ar26v0=";
-  };
-
-  pythonPath = with pythonPackages; [
+  propagatedBuildInputs = with pythonPackages; [
     bsddb3
     pyicu
     pygobject3
     pycairo
   ];
 
-  patches = [
-    # fix for running tests with a temporary home - remove next release
-    # https://gramps-project.org/bugs/view.php?id=12577
-    (fetchpatch {
-      url = "https://github.com/gramps-project/gramps/commit/1e95d8a6b5193d655d8caec1e6ab13628ad123db.patch";
-      hash = "sha256-2riWB13Yl+tk9+Tuo0YDLoxY2Rc0xrJKfb+ZU7Puzxk=";
-    })
-  ];
-
-  # Same installPhase as in buildPythonApplication but without --old-and-unmanageble
-  # install flag.
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/${python.sitePackages}"
-
-    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
 
-    ${python}/bin/${python.executable} setup.py install \
-      --install-lib=$out/${python.sitePackages} \
-      --prefix="$out"
-
-    eapth="$out/${python.sitePackages}/easy-install.pth"
-    if [ -e "$eapth" ]; then
-        # move colliding easy_install.pth to specifically named one
-        mv "$eapth" $(dirname "$eapth")/${pname}-${version}.pth
-    fi
-
-    rm -f "$out/${python.sitePackages}"/site.py*
-
-    runHook postInstall
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    mkdir .git # Make gramps think that it's not in an installed state
   '';
 
-  preCheck = ''
-    export HOME=$TMPDIR
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+    )
   '';
 
   # https://github.com/NixOS/nixpkgs/issues/149812
@@ -111,8 +97,8 @@ buildPythonApplication rec {
     description = "Genealogy software";
     mainProgram = "gramps";
     homepage = "https://gramps-project.org";
-    maintainers = with maintainers; [ jk pinpox ];
-    changelog = "https://github.com/gramps-project/gramps/blob/v${version}/ChangeLog";
+    maintainers = with maintainers; [ jk pinpox tomasajt ];
+    changelog = "https://github.com/gramps-project/gramps/blob/${src.rev}/ChangeLog";
     longDescription = ''
       Every person has their own story but they are also part of a collective
       family history. Gramps gives you the ability to record the many details of
diff --git a/pkgs/applications/misc/gramps/disable-gtk-warning-dialog.patch b/pkgs/applications/misc/gramps/disable-gtk-warning-dialog.patch
new file mode 100644
index 0000000000000..c97fe9dde9f41
--- /dev/null
+++ b/pkgs/applications/misc/gramps/disable-gtk-warning-dialog.patch
@@ -0,0 +1,14 @@
+diff --git a/gramps/gui/grampsgui.py b/gramps/gui/grampsgui.py
+index 0c0d4c3..522f65a 100644
+--- a/gramps/gui/grampsgui.py
++++ b/gramps/gui/grampsgui.py
+@@ -573,9 +573,6 @@ class Gramps:
+         dbstate = DbState()
+         self._vm = ViewManager(app, dbstate, config.get("interface.view-categories"))
+ 
+-        if lin() and glocale.lang != "C" and not gettext.find(GTK_GETTEXT_DOMAIN):
+-            _display_gtk_gettext_message(parent=self._vm.window)
+-
+         _display_translator_message(parent=self._vm.window)
+ 
+         self._vm.init_interface()
diff --git a/pkgs/applications/misc/nwg-displays/default.nix b/pkgs/applications/misc/nwg-displays/default.nix
index f2d4461d4c086..66bc1d838de12 100644
--- a/pkgs/applications/misc/nwg-displays/default.nix
+++ b/pkgs/applications/misc/nwg-displays/default.nix
@@ -14,13 +14,13 @@
 
 python310Packages.buildPythonApplication rec {
   pname = "nwg-displays";
-  version = "0.3.14";
+  version = "0.3.16";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-displays";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jSL+ig1mNJrnHli8B+BqvEG8jcC0gnxzbukiYgt3nP0=";
+    hash = "sha256-rnaBYDGEsc8oGw4yZ60NQFbNf+L0tmHYDYf+UDoDmSI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 0f62075439c5d..15c8ffc3b22d6 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -67,7 +67,7 @@ let
       deprecatedNativeMessagingHost = option: pkg:
         if (cfg.${option} or false)
           then
-            lib.warn "The cfg.${option} argument for `firefox.override` is deprecated, please add `pkgs.${pkg.pname}` to `nativeMessagingHosts.packages` instead"
+            lib.warn "The cfg.${option} argument for `firefox.override` is deprecated, please add `pkgs.${pkg.pname}` to `nativeMessagingHosts` instead"
             [pkg]
           else [];
 
diff --git a/pkgs/applications/networking/cluster/civo/default.nix b/pkgs/applications/networking/cluster/civo/default.nix
index d2f913a765ed7..cacdf46f74c3f 100644
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.0.76";
+  version = "1.0.77";
 
   src = fetchFromGitHub {
     owner  = "civo";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-Bk0YfW9KDliaJIqpVxCXTy7EiGGJPZTXcn6SFEmywRE=";
+    sha256 = "sha256-W9CJAFLGarDG/Y8g2Whoh4v9hxqb8txuLfAkooW8PNM=";
   };
 
-  vendorHash = "sha256-22n+ks1D65Gk2acCMHxgj19VHDf4B23ivqHfo3J45j0=";
+  vendorHash = "sha256-Uh2/4qdJQfqQdjXbOBkUVv2nF1AN+QRKRI0+yta+G5Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/glooctl/default.nix b/pkgs/applications/networking/cluster/glooctl/default.nix
index ffe98a73c9048..446d0e8ca7c11 100644
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.16.8";
+  version = "1.16.9";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-M8ZNDt+sO8ZtVM1PyISOsFwXrD6q9ACPG0T99bqwk1c=";
+    hash = "sha256-9zGtMfVZL+VIpEw2D5n4LzyTYNLCJFKf7Q++QiUKPxA=";
   };
 
   vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index 01659d9236c82..b5f017b85b053 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -83,7 +83,7 @@ let
     description = "A lightweight Kubernetes distribution";
     license = licenses.asl20;
     homepage = "https://k3s.io";
-    maintainers = with maintainers; [ euank mic92 yajo ];
+    maintainers = with maintainers; [ euank mic92 superherointj yajo ];
     platforms = platforms.linux;
 
     # resolves collisions with other installations of kubectl, crictl, ctr
diff --git a/pkgs/applications/networking/cluster/vcluster/default.nix b/pkgs/applications/networking/cluster/vcluster/default.nix
index 540e203fea74b..f475ba4fbd0c5 100644
--- a/pkgs/applications/networking/cluster/vcluster/default.nix
+++ b/pkgs/applications/networking/cluster/vcluster/default.nix
@@ -2,27 +2,27 @@
 
 buildGoModule rec {
   pname = "vcluster";
-  version = "0.19.4";
+  version = "0.19.5";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = "vcluster";
     rev = "v${version}";
-    hash = "sha256-fzHaB+EeS8Gr1EVlxAZzKDYgv3Jij4LwmYaXN4tjYBg=";
+    hash = "sha256-V+Y2LekBYlKZU53BsYCW6ADSMJOxkwSK9hbFGXBaa9o=";
   };
 
   vendorHash = null;
 
   subPackages = [ "cmd/vclusterctl" ];
 
-  nativeBuildInputs = [ installShellFiles ];
-
   ldflags = [
     "-s" "-w"
     "-X main.version=${version}"
     "-X main.goVersion=${lib.getVersion go}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
   # Test is disabled because e2e tests expect k8s.
   doCheck = false;
 
@@ -48,10 +48,10 @@ buildGoModule rec {
   meta = {
     changelog = "https://github.com/loft-sh/vcluster/releases/tag/v${version}";
     description = "Create fully functional virtual Kubernetes clusters";
-    mainProgram = "vcluster";
     downloadPage = "https://github.com/loft-sh/vcluster";
     homepage = "https://www.vcluster.com/";
     license = lib.licenses.asl20;
+    mainProgram = "vcluster";
     maintainers = with lib.maintainers; [ berryp peterromfeldhk qjoly superherointj ];
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/beeper/default.nix b/pkgs/applications/networking/instant-messengers/beeper/default.nix
index ce49c9e8c29a9..f36dd6b829661 100644
--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@@ -11,11 +11,11 @@
 }:
 let
   pname = "beeper";
-  version = "3.100.26";
+  version = "3.101.24";
   name = "${pname}-${version}";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.100.26-build-240314pjsp57xom-x86_64.AppImage";
-    hash = "sha256-KYjB7ZfjoVf6UoXQvmtAqtD23JNQGqboNzXekAiJF7k=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.101.24-build-240322frr3t3orv-x86_64.AppImage";
+    hash = "sha256-yfkWvPYQhI8cfXfmmyi2LoSro1jxJRWy9phycv5TUL8=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;
diff --git a/pkgs/applications/networking/instant-messengers/qq/default.nix b/pkgs/applications/networking/instant-messengers/qq/default.nix
index 0f02f0413506d..7f940312a991c 100644
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@@ -19,7 +19,7 @@
 , vips
 , at-spi2-core
 , autoPatchelfHook
-, wrapGAppsHook
+, makeWrapper
 }:
 
 let
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    makeWrapper
     dpkg
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/zulip/default.nix b/pkgs/applications/networking/instant-messengers/zulip/default.nix
index 3b12634b0caa1..81c6a39e27d18 100644
--- a/pkgs/applications/networking/instant-messengers/zulip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip/default.nix
@@ -5,11 +5,11 @@
 
 let
   pname = "zulip";
-  version = "5.10.5";
+  version = "5.11.0";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    hash = "sha256-dWTczjE6QAW26bGTIeFTuXl1JwYr3Ma+8Ab6MjeDr78=";
+    hash = "sha256-snxeMgcLFMYDEsog7Xqeybw8GkU4kPqHMds1174bPd0=";
     name="${pname}-${version}.AppImage";
   };
 
@@ -20,7 +20,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname version src;
 
-  runScript = "appimage-exec.sh -w ${appimageContents} -- \${NIXOS_OZONE_WL:+\${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}";
+  runScript = "appimage-exec.sh -w ${appimageContents} -- \${NIXOS_OZONE_WL:+\${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}";
 
   extraInstallCommands = ''
     mv "$out/bin/${pname}-${version}" "$out/bin/${pname}"
diff --git a/pkgs/applications/networking/irc/thelounge/default.nix b/pkgs/applications/networking/irc/thelounge/default.nix
index eff1458e07e34..f309da11df854 100644
--- a/pkgs/applications/networking/irc/thelounge/default.nix
+++ b/pkgs/applications/networking/irc/thelounge/default.nix
@@ -4,7 +4,7 @@
 , fetchYarnDeps
 , nodejs
 , yarn
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , python3
 , npmHooks
 , darwin
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-MM6SgVT7Pjdu96A4eWRucEzT7uNPxBqUDgHKl8mH2C0=";
   };
 
-  nativeBuildInputs = [ nodejs yarn fixup_yarn_lock python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;
+  nativeBuildInputs = [ nodejs yarn prefetch-yarn-deps python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;
   buildInputs = [ sqlite ];
 
   configurePhase = ''
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     export HOME="$PWD"
 
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index a6f0cf62b5037..f97f96d74f14c 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.12.1";
+  version = "3.12.2";
 
   outputs = [ "out" "dev" ];
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    hash = "sha256-WGmabfOuEs9WRq1Ta7ZiZQuscoEdxhaFhuppE7MpZfk=";
+    hash = "sha256-qVb0omSWzwkbqdtYXy8VWYyCM0CDCAW9L78pli9TbO4=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
index 9b184a8fa13d9..3d675d04d58f7 100644
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -29,12 +29,12 @@
 }:
 
 let
-  version = "2.6.1";
+  version = "2.6.2";
   src = fetchFromGitHub {
     owner = "onionshare";
     repo = "onionshare";
     rev = "v${version}";
-    sha256 = "sha256-LR3Ao4Q8kEDwrFV+gYdMSEeYF4hDtEa1rJgvRRrJMwc=";
+    hash = "sha256-J8Hdriy8eWpHuMCI87a9a/zCR6xafM3A/Tkyom0Ktko=";
   };
   meta = with lib; {
     description = "Securely and anonymously send and receive files";
diff --git a/pkgs/applications/networking/trayscale/default.nix b/pkgs/applications/networking/trayscale/default.nix
index 023b72b88837e..329491fd82304 100644
--- a/pkgs/applications/networking/trayscale/default.nix
+++ b/pkgs/applications/networking/trayscale/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "trayscale";
-  version = "0.10.4";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "DeedleFake";
     repo = "trayscale";
     rev = "v${version}";
-    hash = "sha256-/31QKCyMeEdpP59B+iXS5hL9W5sWz7R/I2nxBtj+0s4=";
+    hash = "sha256-qSrt94hEJosdvs2N6rbcJLpjqvMPkY20dIKV3jtjFlg=";
   };
 
-  vendorHash = "sha256-xYBiO6Zm32Do19I/cm4T6fubXY++Bhkn+RNAmKzM5cY=";
+  vendorHash = "sha256-eIakjEYfVp2wfXu0oqBmd5hJZTp0xgYKNNbtpRBnT2w=";
 
   subPackages = [ "cmd/trayscale" ];
 
diff --git a/pkgs/applications/networking/xpipe/default.nix b/pkgs/applications/networking/xpipe/default.nix
index 7221687ae7145..002ab4319e98f 100644
--- a/pkgs/applications/networking/xpipe/default.nix
+++ b/pkgs/applications/networking/xpipe/default.nix
@@ -33,14 +33,14 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-L76UTgy1tGxj5KVXefz2uj2M/sse2n0byqRtW/wvwz8=";
+    x86_64-linux = "sha256-GcFds6PCEuvZ7oIfWMEkRIWMWU/jmCsj4zCkMe3+QM0=";
   }.${system} or throwSystem;
 
   displayname = "XPipe";
 
 in stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "8.4";
+  version = "8.5";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
diff --git a/pkgs/applications/radio/qlog/default.nix b/pkgs/applications/radio/qlog/default.nix
index a752592d412da..48116beb3e3b5 100644
--- a/pkgs/applications/radio/qlog/default.nix
+++ b/pkgs/applications/radio/qlog/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qlog";
-  version = "0.33.1";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "foldynl";
     repo = "QLog";
     rev = "v${version}";
-    hash = "sha256-stPzkCLcjzQT0n1NRGT7YN625RPYhJ9FuMkjtFZwtbA=";
+    hash = "sha256-zPIGqVfpd7Gkm3Ify+AwiCSWQ67ybv9BmuolSu9WzHM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/science/biology/messer-slim/default.nix b/pkgs/applications/science/biology/messer-slim/default.nix
index d4ce4071a274e..2e4911d829d13 100644
--- a/pkgs/applications/science/biology/messer-slim/default.nix
+++ b/pkgs/applications/science/biology/messer-slim/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, gcc, gcc-unwrapped }:
 
 stdenv.mkDerivation rec {
-  version = "4.1";
+  version = "4.2";
   pname = "messer-slim";
 
   src = fetchFromGitHub {
     owner = "MesserLab";
     repo = "SLiM";
     rev = "v${version}";
-    sha256 = "sha256-mb6xcu28QYAFm2906lRNY0zciQBKSGcz3q/cvOEh/VE=";
+    sha256 = "sha256-PDIaOMA1QHrJC5xVW+Mzx8ja/YvZBMKvV88MjSoSpfM=";
   };
 
   nativeBuildInputs = [ cmake gcc gcc-unwrapped ];
diff --git a/pkgs/applications/science/electronics/dataexplorer/default.nix b/pkgs/applications/science/electronics/dataexplorer/default.nix
index aa471d2bfcafc..224d804ee1f69 100644
--- a/pkgs/applications/science/electronics/dataexplorer/default.nix
+++ b/pkgs/applications/science/electronics/dataexplorer/default.nix
@@ -1,26 +1,32 @@
 { lib
 , stdenv
 , fetchurl
-, jdk
 , ant
+, jdk
 , makeWrapper
+, strip-nondeterminism
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dataexplorer";
   version = "3.8.5";
 
   src = fetchurl {
-    url = "mirror://savannah/dataexplorer/dataexplorer-${version}-src.tar.gz";
-    sha256 = "sha256-b68xIZNbzHdPyZwLngcnjcoBtI6AeTdrblz/qx/HbGQ=";
+    url = "mirror://savannah/dataexplorer/dataexplorer-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-b68xIZNbzHdPyZwLngcnjcoBtI6AeTdrblz/qx/HbGQ=";
   };
 
-  nativeBuildInputs = [ ant makeWrapper ];
-
-  buildInputs = [ jdk ];
+  nativeBuildInputs = [
+    ant
+    jdk
+    makeWrapper
+    strip-nondeterminism
+  ];
 
   buildPhase = ''
+    runHook preBuild
     ant -f build/build.xml dist
+    runHook postBuild
   '';
 
   doCheck = false;
@@ -30,6 +36,8 @@ stdenv.mkDerivation rec {
   #'';
 
   installPhase = ''
+    runHook preInstall
+
     ant -Dprefix=$out/share/ -f build/build.xml install
 
     # The sources contain a wrapper script in $out/share/DataExplorer/DataExplorer
@@ -49,6 +57,14 @@ stdenv.mkDerivation rec {
       $out/etc/udev/rules.d/50-Junsi-iCharger-USB.rules
     install -Dvm644 build/misc/GNU_LINUX_SKYRC_UDEV_RULE/50-SkyRC-Charger.rules \
       $out/etc/udev/rules.d/50-SkyRC-Charger.rules
+
+    runHook postInstall
+  '';
+
+  # manually call strip-nondeterminism because using stripJavaArchivesHook takes
+  # too long to strip bundled jars
+  postFixup = ''
+    strip-nondeterminism --type jar $out/share/DataExplorer/{DataExplorer.jar,devices/*.jar}
   '';
 
   meta = with lib; {
@@ -63,4 +79,4 @@ stdenv.mkDerivation rec {
       binaryBytecode    # contains thirdparty jar files, e.g. javax.json, org.glassfish.json
     ];
   };
-}
+})
diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index 2141d9246daeb..16f46cb0f8ada 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -49,16 +49,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "alacritty";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Nn/G7SkRuHXRSRgNjlmdX1G07sp7FPx8UyAn63Nivfg=";
+    hash = "sha256-MrlzAZWLgfwIoTdxY+fjWbrv7tygAjnxXebiEgwOM9A=";
   };
 
-  cargoHash = "sha256-vCoKaDd0mQRF6NNfK679FhEXuAdn/1o3F1gTfT8NK+0=";
+  cargoHash = "sha256-7HPTELRlmyjj7CXNbgqrzxW548BgbxybWi+tT3rOCX0=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/version-management/gerrit/default.nix b/pkgs/applications/version-management/gerrit/default.nix
index 6883196756270..7a9a01ea255bc 100644
--- a/pkgs/applications/version-management/gerrit/default.nix
+++ b/pkgs/applications/version-management/gerrit/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
-  version = "3.9.1";
+  version = "3.9.2";
 
   src = fetchurl {
     url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    hash = "sha256-WQjzkykKtrXfkNSWcM9GWy8LPMwxJpSbnWjpmslP0HA=";
+    hash = "sha256-KsuuwFKdpXHDVAZZ2JiX781mgqDQyyEILo4lmNn+8YE=";
   };
 
   buildCommand = ''
diff --git a/pkgs/applications/video/dra-cla/default.nix b/pkgs/applications/video/dra-cla/default.nix
index 27b745a403d4b..00bf2c642b2d1 100644
--- a/pkgs/applications/video/dra-cla/default.nix
+++ b/pkgs/applications/video/dra-cla/default.nix
@@ -8,18 +8,19 @@
 , mpv
 , aria2
 , ffmpeg
+, fzf
 , openssl
 }:
 
 stdenvNoCC.mkDerivation {
   pname = "dra-cla";
-  version = "unstable-2023-10-10";
+  version = "unstable-2024-02-07";
 
   src = fetchFromGitHub {
     owner = "CoolnsX";
     repo = "dra-cla";
-    rev = "12e9557fb8dfdff7350e0102a625170bb69acf01";
-    hash = "sha256-cGY/FRV2BAS4fzJqIfD7FlIPIS0fCIIBenQYjB2dEsc=";
+    rev = "cf8a90c0c68338404e8a1434af0a6e65fc5d0a08";
+    hash = "sha256-3cz1VeDM0NHdYMiCDVnIq6Y/7rFSijhNrnxC36Yixxc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -30,7 +31,7 @@ stdenvNoCC.mkDerivation {
     install -Dm755 dra-cla $out/bin/dra-cla
 
     wrapProgram $out/bin/dra-cla \
-      --prefix PATH : ${lib.makeBinPath [ gnugrep gnused curl mpv aria2 ffmpeg openssl ]}
+      --prefix PATH : ${lib.makeBinPath [ gnugrep gnused curl mpv aria2 ffmpeg fzf openssl ]}
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 54216cf73ad68..da7170ca5f381 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -26,7 +26,7 @@
 , numactl
 , writeText
   # Processing, video codecs, containers
-, ffmpeg_5-full
+, ffmpeg-full
 , nv-codec-headers
 , libogg
 , x264
@@ -69,6 +69,10 @@
   # for now we disable GTK GUI support on Darwin. (It may be possible to remove
   # this restriction later.)
 , useGtk ? !stdenv.isDarwin
+, bzip2
+, desktop-file-utils
+, meson
+, ninja
 , wrapGAppsHook
 , intltool
 , glib
@@ -86,64 +90,70 @@
 }:
 
 let
-  version = "1.6.1";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "HandBrake";
     repo = "HandBrake";
     rev = version;
-    sha256 = "sha256-0MJ1inMNA6s8l2S0wnpM2c7FxOoOHxs9u4E/rgKfjJo=";
+    hash = "sha256-4Q//UU/CPgWvhtpROfNPLzBvZlB02hbFe9Z9FA7mX04=";
   };
 
   # Handbrake maintains a set of ffmpeg patches. In particular, these
   # patches are required for subtitle timing to work correctly. See:
   # https://github.com/HandBrake/HandBrake/issues/4029
-  ffmpeg-version = "5.1.2";
-  ffmpeg-hb = ffmpeg_5-full.overrideAttrs (old: {
+  # base ffmpeg version is specified in:
+  # https://github.com/HandBrake/HandBrake/blob/master/contrib/ffmpeg/module.defs
+  ffmpeg-version = "6.1";
+  ffmpeg-hb = ffmpeg-full.overrideAttrs (old: {
     version = ffmpeg-version;
     src = fetchurl {
       url = "https://www.ffmpeg.org/releases/ffmpeg-${ffmpeg-version}.tar.bz2";
-      hash = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
+      hash = "sha256-632j3n3TzkiplGq0R6c0a9EaOoXm77jyws5jfn9UdhE=";
     };
-    patches = old.patches or [ ] ++ [
-      "${src}/contrib/ffmpeg/A01-qsv-libavfilter-qsvvpp-change-the-output-frame-s-width-a.patch"
-      "${src}/contrib/ffmpeg/A02-qsv-configure-ensure-enable-libmfx-uses-libmfx-1.x.patch"
-      "${src}/contrib/ffmpeg/A03-qsv-configure-fix-the-check-for-MFX_CODEC_VP9.patch"
-      "${src}/contrib/ffmpeg/A04-qsv-remove-mfx-prefix-from-mfx-headers.patch"
-      "${src}/contrib/ffmpeg/A05-qsv-load-user-plugin-for-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A06-qsv-build-audio-related-code-when-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A07-qsvenc-support-multi-frame-encode-when-MFX_VERSION-2.patch"
-      "${src}/contrib/ffmpeg/A08-qsvenc-support-MFX_RATECONTROL_LA_EXT-when-MFX_VERSI.patch"
-      "${src}/contrib/ffmpeg/A09-qsv-support-OPAQUE-memory-when-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A10-qsv-configure-add-enable-libvpl-option.patch"
-      "${src}/contrib/ffmpeg/A11-qsv-use-a-new-method-to-create-mfx-session-when-usin.patch"
-      "${src}/contrib/ffmpeg/A12-qsv-fix-decode-10bit-hdr.patch"
-      "${src}/contrib/ffmpeg/A13-mov-read-name-track-tag-written-by-movenc.patch"
-      "${src}/contrib/ffmpeg/A14-movenc-write-3gpp-track-titl-tag.patch"
-      "${src}/contrib/ffmpeg/A15-mov-read-3gpp-udta-tags.patch"
-      "${src}/contrib/ffmpeg/A16-movenc-write-3gpp-track-names-tags-for-all-available.patch"
-      "${src}/contrib/ffmpeg/A17-FFmpeg-devel-amfenc-Add-support-for-pict_type-field.patch"
-      "${src}/contrib/ffmpeg/A18-dvdsubdec-fix-processing-of-partial-packets.patch"
-      "${src}/contrib/ffmpeg/A19-ccaption_dec-return-number-of-bytes-used.patch"
-      "${src}/contrib/ffmpeg/A20-dvdsubdec-return-number-of-bytes-used.patch"
-      "${src}/contrib/ffmpeg/A21-dvdsubdec-use-pts-of-initial-packet.patch"
-      "${src}/contrib/ffmpeg/A22-matroskaenc-aac-extradata-updated.patch"
-      "${src}/contrib/ffmpeg/A23-ccaption_dec-fix-pts-in-real_time-mode.patch"
-      "${src}/contrib/ffmpeg/A24-fix-eac3-dowmix.patch"
-      "${src}/contrib/ffmpeg/A25-enable-truehd-pass.patch"
-      "${src}/contrib/ffmpeg/A26-Update-the-min-version-to-1.4.23.0-for-AMF-SDK.patch"
-      "${src}/contrib/ffmpeg/A27-avcodec-amfenc-Fixes-the-color-information-in-the-ou.patch"
-      "${src}/contrib/ffmpeg/A28-avcodec-amfenc-HDR-metadata.patch"
-      # This patch is not applying since ffmpeg 5.1.1, probably it was backported by upstream
-      # "${src}/contrib/ffmpeg/A30-svt-av1-backports.patch"
-      (fetchpatch {
-        name = "vulkan-remove-extensions.patch";
-        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/eb0455d64690";
-        hash = "sha256-qvLrb7b+9/bel8A2lZuSmBiJtHXsABw0Lvgn1ggnmCU=";
-      })
+    patches = (old.patches or [ ]) ++ [
+      "${src}/contrib/ffmpeg/A01-mov-read-name-track-tag-written-by-movenc.patch"
+      "${src}/contrib/ffmpeg/A02-movenc-write-3gpp-track-titl-tag.patch"
+      "${src}/contrib/ffmpeg/A03-mov-read-3gpp-udta-tags.patch"
+      "${src}/contrib/ffmpeg/A04-movenc-write-3gpp-track-names-tags-for-all-available.patch"
+      "${src}/contrib/ffmpeg/A05-dvdsubdec-fix-processing-of-partial-packets.patch"
+      "${src}/contrib/ffmpeg/A06-dvdsubdec-return-number-of-bytes-used.patch"
+      "${src}/contrib/ffmpeg/A07-dvdsubdec-use-pts-of-initial-packet.patch"
+      "${src}/contrib/ffmpeg/A08-ccaption_dec-fix-pts-in-real_time-mode.patch"
+      "${src}/contrib/ffmpeg/A09-matroskaenc-aac-extradata-updated.patch"
+      "${src}/contrib/ffmpeg/A10-amfenc-Add-support-for-pict_type-field.patch"
+      "${src}/contrib/ffmpeg/A11-amfenc-Fixes-the-color-information-in-the-ou.patch"
+      "${src}/contrib/ffmpeg/A12-amfenc-HDR-metadata.patch"
+      "${src}/contrib/ffmpeg/A13-libavcodec-amfenc-Fix-issue-with-missing-headers-in-.patch"
+      "${src}/contrib/ffmpeg/A14-avcodec-add-ambient-viewing-environment-packet-side-.patch"
+      "${src}/contrib/ffmpeg/A15-avformat-mov-add-support-for-amve-ambient-viewing-en.patch"
+      "${src}/contrib/ffmpeg/A16-videotoolbox-dec-h264.patch"
+
+      # patch to fix <https://github.com/HandBrake/HandBrake/issues/5011>
+      # commented out because it causes ffmpeg's filter-pixdesc-p010le test to fail.
+      # "${src}/contrib/ffmpeg/A17-libswscale-fix-yuv420p-to-p01xle-color-conversion-bu.patch"
+
+      "${src}/contrib/ffmpeg/A18-qsv-fix-decode-10bit-hdr.patch"
+      "${src}/contrib/ffmpeg/A19-ffbuild-common-use-gzip-n-flag-for-cuda.patch"
     ];
   });
 
+  x265-hb = x265.overrideAttrs (old: {
+    # nixpkgs' x265 sourceRoot is x265-.../source whereas handbrake's x265 patches
+    # are written with respect to the parent directory instead of that source directory.
+    # patches which don't cleanly apply are commented out.
+    postPatch = (old.postPatch or "") + ''
+      pushd ..
+      # patch -p1 < ${src}/contrib/x265/A00-crosscompile-fix.patch
+      patch -p1 < ${src}/contrib/x265/A01-threads-priority.patch
+      patch -p1 < ${src}/contrib/x265/A02-threads-pool-adjustments.patch
+      patch -p1 < ${src}/contrib/x265/A03-sei-length-crash-fix.patch
+      patch -p1 < ${src}/contrib/x265/A04-ambient-viewing-enviroment-sei.patch
+      # patch -p1 < ${src}/contrib/x265/A05-memory-leaks.patch
+      popd
+    '';
+  });
+
   versionFile = writeText "version.txt" ''
     BRANCH=${versions.majorMinor version}.x
     DATE=1970-01-01 00:00:01 +0000
@@ -189,6 +199,17 @@ let
       # Use the Nix-provided libxml2 instead of the system-provided one.
       substituteInPlace libhb/module.defs \
         --replace /usr/include/libxml2 ${libxml2.dev}/include/libxml2
+    '' + optionalString useGtk ''
+      substituteInPlace gtk/module.rules \
+        --replace-fail '$(MESON.exe)' 'meson' \
+        --replace-fail '$(NINJA.exe)' 'ninja' \
+      # Force using nixpkgs dependencies
+      substituteInPlace gtk/meson.build \
+        --replace-fail "cc.find_library('bz2', dirs: hb_libdirs)" "cc.find_library('bz2')" \
+        --replace-fail "cc.find_library('mp3lame', dirs: hb_libdirs)" "cc.find_library('mp3lame')" \
+        --replace-fail \
+          "hb_incdirs = include_directories(hb_dir / 'libhb', hb_dir / 'contrib/include')" \
+          "hb_incdirs = include_directories(hb_dir / 'libhb')" \
     '';
 
     nativeBuildInputs = [
@@ -199,7 +220,7 @@ let
       pkg-config
       python3
     ]
-    ++ optionals useGtk [ intltool wrapGAppsHook ];
+    ++ optionals useGtk [ desktop-file-utils intltool meson ninja wrapGAppsHook ];
 
     buildInputs = [
       a52dec
@@ -228,12 +249,13 @@ let
       speex
       svt-av1
       x264
-      x265
+      x265-hb
       xz
       zimg
     ]
     ++ optional (!stdenv.isDarwin) numactl
     ++ optionals useGtk [
+      bzip2
       dbus-glib
       glib
       gst_all_1.gst-plugins-base
@@ -254,7 +276,6 @@ let
     configureFlags = [
       "--disable-df-fetch"
       "--disable-df-verify"
-      "--disable-gtk-update-checks"
     ]
     ++ optional (!useGtk) "--disable-gtk"
     ++ optional useFdk "--enable-fdk-aac"
@@ -264,10 +285,19 @@ let
     # NOTE: 2018-12-27: Check NixOS HandBrake test if changing
     NIX_LDFLAGS = [ "-lx265" ];
 
+    # meson/ninja are used only for the subprojects, not the toplevel
+    dontUseMesonConfigure = true;
+    dontUseMesonInstall = true;
+    dontUseNinjaBuild = true;
+    dontUseNinjaInstall = true;
+
     makeFlags = [ "--directory=build" ];
 
-    passthru.tests = {
-      basic-conversion =
+    passthru = {
+      # for convenience
+      inherit ffmpeg-hb x265-hb;
+
+      tests.basic-conversion =
         let
           # Big Buck Bunny example, licensed under CC Attribution 3.0.
           testMkv = fetchurl {
@@ -283,7 +313,8 @@ let
           HandBrakeCLI -i ${testMkv} -o test.mkv -e x264 -q 20 -B 160
           test -e test.mkv
         '';
-      version = testers.testVersion { package = self; command = "HandBrakeCLI --version"; };
+
+      tests.version = testers.testVersion { package = self; command = "HandBrakeCLI --version"; };
     };
 
     meta = with lib; {
@@ -300,7 +331,7 @@ let
       license = licenses.gpl2Only;
       maintainers = with maintainers; [ Anton-Latukha wmertens ];
       platforms = with platforms; unix;
-      broken = stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13";
+      broken = stdenv.isDarwin;  # https://github.com/NixOS/nixpkgs/pull/297984#issuecomment-2016503434
     };
   };
 in
diff --git a/pkgs/applications/video/kodi/addons/trakt/default.nix b/pkgs/applications/video/kodi/addons/trakt/default.nix
index 64113cb0139ba..4967a5cd8fba3 100644
--- a/pkgs/applications/video/kodi/addons/trakt/default.nix
+++ b/pkgs/applications/video/kodi/addons/trakt/default.nix
@@ -2,11 +2,11 @@
 buildKodiAddon rec {
   pname = "trakt";
   namespace = "script.trakt";
-  version = "3.5.0";
+  version = "3.6.1";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-OyU6S5r/y3vqW6Wg6OP0+Zn4YchBy8x1i++hzCQHyx0=";
+    sha256 = "sha256-ZlBucYYRA1cL5c0H1jhXeKE1itReZe2gAJYFFxuUebo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix b/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix
index 7850d0229f245..bc27eca43d03f 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix
@@ -5,22 +5,22 @@
 , obs-studio
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "obs-source-clone";
-  version = "0.1.4";
+  version = "0.1.4-unstable-2024-02-19";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-source-clone";
-    rev = version;
-    sha256 = "sha256-E2pHJO3cdOXmSlTVGsz4tncm9fMaa8Rhsq9YZDNidjs=";
+    rev = "d1524d5d932d6841a1fbd6061cc4a0033fb615b7";
+    hash = "sha256-W9IIIGQdreI2FQGii5NUB5tVHcqsiYAKTutOHEPCyms=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ obs-studio ];
 
   cmakeFlags = [
-    "-DBUILD_OUT_OF_TREE=On"
+    (lib.cmakeBool "BUILD_OUT_OF_TREE" true)
   ];
 
   postInstall = ''
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/exeldro/obs-source-clone";
     maintainers = with maintainers; [ flexiondotorg ];
     license = licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index a82a00fd5412e..f91f7d6df3dff 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -12,7 +12,7 @@ rec {
       # package dependencies
       , stdenv, fetchFromGitHub, fetchpatch, buildGoPackage
       , makeWrapper, installShellFiles, pkg-config, glibc
-      , go-md2man, go, containerd, runc, docker-proxy, tini, libtool
+      , go-md2man, go, containerd, runc, tini, libtool
       , sqlite, iproute2, docker-buildx, docker-compose, docker-sbom
       , iptables, e2fsprogs, xz, util-linux, xfsprogs, git
       , procps, rootlesskit, slirp4netns, fuse-overlayfs, nixosTests
@@ -137,6 +137,7 @@ rec {
       installPhase = ''
         cd ./go/src/${goPackagePath}
         install -Dm755 ./bundles/dynbinary-daemon/dockerd $out/libexec/docker/dockerd
+        install -Dm755 ./bundles/dynbinary-daemon/docker-proxy $out/libexec/docker/docker-proxy
 
         makeWrapper $out/libexec/docker/dockerd $out/bin/dockerd \
           --prefix PATH : "$out/libexec/docker:$extraPath"
@@ -144,7 +145,6 @@ rec {
         ln -s ${docker-containerd}/bin/containerd $out/libexec/docker/containerd
         ln -s ${docker-containerd}/bin/containerd-shim $out/libexec/docker/containerd-shim
         ln -s ${docker-runc}/bin/runc $out/libexec/docker/runc
-        ln -s ${docker-proxy}/bin/docker-proxy $out/libexec/docker/docker-proxy
         ln -s ${docker-tini}/bin/tini-static $out/libexec/docker/docker-init
 
         # systemd
@@ -172,7 +172,7 @@ rec {
   buildGoPackage (lib.optionalAttrs (!clientOnly) {
     # allow overrides of docker components
     # TODO: move packages out of the let...in into top-level to allow proper overrides
-    inherit docker-runc docker-containerd docker-proxy docker-tini moby;
+    inherit docker-runc docker-containerd docker-tini moby;
   } // rec {
     pname = "docker";
     inherit version;
diff --git a/pkgs/applications/virtualization/docker/proxy.nix b/pkgs/applications/virtualization/docker/proxy.nix
deleted file mode 100644
index e4f5435247643..0000000000000
--- a/pkgs/applications/virtualization/docker/proxy.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
-
-buildGoPackage rec {
-  pname = "docker-proxy";
-  version = "unstable-2020-12-15";
-
-  src = fetchFromGitHub {
-    owner = "docker";
-    repo = "libnetwork";
-    rev = "fa125a3512ee0f6187721c88582bf8c4378bd4d7";
-    sha256 = "1r47y0gww3j7fas4kgiqbhrz5fazsx1c6sxnccdfhj8fzik77s9y";
-  };
-
-  goPackagePath = "github.com/docker/libnetwork";
-
-  installPhase = ''
-    install -m755 -D ./go/bin/proxy $out/bin/docker-proxy
-  '';
-
-  meta = with lib; {
-    description = "Docker proxy binary to forward traffic between host and containers";
-    mainProgram = "docker-proxy";
-    license = licenses.asl20;
-    homepage = "https://github.com/docker/libnetwork";
-    maintainers = with maintainers; [vdemeester];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index df2094c3b1fca..b75a5afdbde4b 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -116,11 +116,11 @@ in stdenv.mkDerivation {
      # we don't take any chances and only apply it if people actually want to use KVM support.
   ++ optional enableKvm (fetchpatch
     (let
-      patchVersion = "20240226";
+      patchVersion = "20240325";
     in {
       name = "virtualbox-${version}-kvm-dev-${patchVersion}.patch";
-      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${patchVersion}/virtualbox-${version}-kvm-dev-${patchVersion}.patch";
-      hash = "sha256-3YT1ZN/TwoNWNb2eqOcPF8GTrVGfOPaPb8vpGoPNISY=";
+      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${patchVersion}/kvm-backend-${version}-dev-${patchVersion}.patch";
+      hash = "sha256-D1ua8X5Iyw/I89PtskiGdnGr4NhdFtI93ThltiOcu8w=";
     }))
   ++ [
     ./qt-dependency-paths.patch
@@ -281,7 +281,7 @@ in stdenv.mkDerivation {
     ];
     license = licenses.gpl2;
     homepage = "https://www.virtualbox.org/";
-    maintainers = with maintainers; [ sander friedrichaltheide ];
+    maintainers = with maintainers; [ sander friedrichaltheide blitz ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "VirtualBox";
   };
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
index 3292f4039a637..5b4de2dd04cab 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@@ -123,6 +123,8 @@ let
     ro_mounts=()
     symlinks=()
     etc_ignored=()
+
+    # loop through all entries of root in the fhs environment, except its /etc.
     for i in ${fhsenv}/*; do
       path="/''${i##*/}"
       if [[ $path == '/etc' ]]; then
@@ -136,6 +138,7 @@ let
       fi
     done
 
+    # loop through the entries of /etc in the fhs environment.
     if [[ -d ${fhsenv}/etc ]]; then
       for i in ${fhsenv}/etc/*; do
         path="/''${i##*/}"
@@ -144,7 +147,11 @@ let
         if [[ $path == '/fonts' || $path == '/ssl' ]]; then
           continue
         fi
-        ro_mounts+=(--ro-bind "$i" "/etc$path")
+        if [[ -L $i ]]; then
+          symlinks+=(--symlink "$i" "/etc$path")
+        else
+          ro_mounts+=(--ro-bind "$i" "/etc$path")
+        fi
         etc_ignored+=("/etc$path")
       done
     fi
@@ -156,6 +163,7 @@ let
       ro_mounts+=(--ro-bind /etc /.host-etc)
     fi
 
+    # link selected etc entries from the actual root
     for i in ${lib.escapeShellArgs etcBindEntries}; do
       if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
         continue
diff --git a/pkgs/by-name/af/affine/package.nix b/pkgs/by-name/af/affine/package.nix
new file mode 100644
index 0000000000000..5b8b3e41e8722
--- /dev/null
+++ b/pkgs/by-name/af/affine/package.nix
@@ -0,0 +1,68 @@
+{ lib
+, writeText
+, fetchurl
+, stdenvNoCC
+, copyDesktopItems
+, makeDesktopItem
+, makeWrapper
+, unzip
+, bash
+, electron
+, commandLineArgs ? ""
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: let
+  icon = fetchurl {
+    url = "https://raw.githubusercontent.com/toeverything/AFFiNE/v${finalAttrs.version}/packages/frontend/core/public/favicon-192.png";
+    hash = "sha256-smZ5W7fy3TK3bvjwV4i71j2lVmKSZcyhMhcWfPxNnN4=";
+  };
+in {
+  pname = "affine";
+  version = "0.13.1";
+  src = fetchurl {
+    url = "https://github.com/toeverything/AFFiNE/releases/download/v${finalAttrs.version}/affine-${finalAttrs.version}-stable-linux-x64.zip";
+    hash = "sha256-2Du5g/I82iTr8Bwb+qkLzyfbk1OrOlXqx6FHImVoAoE=";
+  };
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+    unzip
+  ];
+  postInstall = ''
+    mkdir -p $out/lib
+    cp -r ./resources/* -t $out/lib/
+    cp LICENSE* $out/
+    install -Dm644 ${icon} $out/share/pixmaps/affine.png
+    makeWrapper "${electron}/bin/electron" $out/bin/affine \
+      --inherit-argv0 \
+      --add-flags $out/lib/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags ${lib.escapeShellArg commandLineArgs}
+  '';
+  desktopItems = [
+    (makeDesktopItem {
+      name = "affine";
+      desktopName = "AFFiNE";
+      exec = "affine %U";
+      terminal = false;
+      icon = "affine";
+      startupWMClass = "affine";
+      categories = ["Utility"];
+    })
+  ];
+  meta = with lib; {
+    description = "A workspace with fully merged docs, whiteboards and databases";
+    longDescription = ''
+      AFFiNE is an open-source, all-in-one workspace and an operating
+      system for all the building blocks that assemble your knowledge
+      base and much more -- wiki, knowledge management, presentation
+      and digital assets
+    '';
+    homepage = "https://affine.pro/";
+    downloadPage = "https://affine.pro/download";
+    license = licenses.mit;
+    maintainers = with maintainers; [richar];
+    mainProgram = "affine";
+    platforms = ["x86_64-linux"];
+  };
+})
diff --git a/pkgs/by-name/at/atari800/package.nix b/pkgs/by-name/at/atari800/package.nix
index 7e57a192a697c..808b1d3538dcb 100644
--- a/pkgs/by-name/at/atari800/package.nix
+++ b/pkgs/by-name/at/atari800/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atari800";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "atari800";
     repo = "atari800";
     rev = "ATARI800_${lib.replaceStrings ["."] ["_"] finalAttrs.version}";
-    hash = "sha256-OZj0x9+M3jkiXUWgB93JTQzi4OUSBCZ3KtniwcZeVB0=";
+    hash = "sha256-D66YRRTqdoV9TqDFonJ9XNpfP52AicuYgdiW27RCIuQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/at/atlauncher/package.nix b/pkgs/by-name/at/atlauncher/package.nix
index c9fef19a0455b..316e77748b97f 100644
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.35.4";
+  version = "3.4.35.9";
 
   src = fetchurl {
     url = "https://github.com/ATLauncher/ATLauncher/releases/download/v${finalAttrs.version}/ATLauncher-${finalAttrs.version}.jar";
-    hash = "sha256-M8ygN70yizJM6VEffBh/lH/DneKAzQ5UFzc3g51dja0=";
+    hash = "sha256-Y2MGhzq4IbtjEG+CER+FWU8CY+hn5ehjMOcP02zIsR4=";
   };
 
   env.ICON = fetchurl {
diff --git a/pkgs/os-specific/linux/autosuspend/default.nix b/pkgs/by-name/au/autosuspend/package.nix
index 5abacf966b9e1..a39d3ec782c14 100644
--- a/pkgs/os-specific/linux/autosuspend/default.nix
+++ b/pkgs/by-name/au/autosuspend/package.nix
@@ -1,31 +1,13 @@
 { lib
+, dbus
 , fetchFromGitHub
 , fetchPypi
 , python3
 }:
 
-let
-  python = python3.override {
-    packageOverrides = self: super: {
-      # autosuspend is incompatible with tzlocal v5
-      # See https://github.com/regebro/tzlocal#api-change
-      tzlocal = super.tzlocal.overridePythonAttrs (prev: rec {
-        version = "4.3.1";
-        src = fetchPypi {
-          inherit (prev) pname;
-          inherit version;
-          hash = "sha256-7jLvjCCAPBmpbtNmrd09SnKe9jCctcc1mgzC7ut/pGo=";
-        };
-        propagatedBuildInputs = with self; [
-          pytz-deprecation-shim
-        ];
-      });
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "autosuspend";
-  version = "6.0.0";
+  version = "6.1.1";
 
   disabled = python3.pythonOlder "3.8";
 
@@ -33,15 +15,15 @@ python.pkgs.buildPythonApplication rec {
     owner = "languitar";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-gS8NNks4GaIGl7cEqWSP53I4/tIV4LypkmZ5vNOjspY=";
+    hash = "sha256-LGU/yhwuc6BuctCibm0AaRheQkuSIgEVXzcWQHCJ/8Y=";
   };
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace '--cov-config=setup.cfg' ""
+      --replace-fail '--cov-config=setup.cfg' ""
   '';
 
-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python3.pkgs; [
     dbus-python
     icalendar
     jsonpath-ng
@@ -56,7 +38,8 @@ python.pkgs.buildPythonApplication rec {
     tzlocal
   ];
 
-  nativeCheckInputs = with python.pkgs; [
+  nativeCheckInputs = with python3.pkgs; [
+    dbus
     freezegun
     pytest-datadir
     pytest-httpserver
diff --git a/pkgs/by-name/ba/backgroundremover/package.nix b/pkgs/by-name/ba/backgroundremover/package.nix
new file mode 100644
index 0000000000000..e6303bb377b7b
--- /dev/null
+++ b/pkgs/by-name/ba/backgroundremover/package.nix
@@ -0,0 +1,92 @@
+{ python3
+, lib
+, runCommand
+, fetchFromGitHub
+, fetchurl
+}:
+
+let
+  p = python3.pkgs;
+  self = p.buildPythonApplication rec {
+    pname = "backgroundremover";
+    version = "0.2.6";
+    pyproject = true;
+
+    src = fetchFromGitHub {
+      owner = "nadermx";
+      repo = "backgroundremover";
+      rev = "v${version}";
+      hash = "sha256-dDOo7NPwvdfV+ae2oMUytCGC+2HF6xUI7dyKk2we23w=";
+    };
+
+    models = runCommand "background-remover-models" {} ''
+      mkdir $out
+      cat ${src}/models/u2a{a,b,c,d} > $out/u2net.pth
+      cat ${src}/models/u2ha{a,b,c,d} > $out/u2net_human_seg.pth
+      cp ${src}/models/u2netp.pth $out
+    '';
+
+    postPatch = ''
+      substituteInPlace backgroundremover/bg.py backgroundremover/u2net/detect.py \
+        --replace 'os.path.expanduser(os.path.join("~", ".u2net", model_name + ".pth"))' "os.path.join(\"$models\", model_name + \".pth\")"
+    '';
+
+    nativeBuildInputs = [ p.setuptools p.wheel ];
+
+    propagatedBuildInputs = [
+      p.certifi
+      p.charset-normalizer
+      p.ffmpeg-python
+      p.filelock
+      p.filetype
+      p.hsh
+      p.idna
+      p.more-itertools
+      p.moviepy
+      p.numpy
+      p.pillow
+      p.pymatting
+      p.pysocks
+      p.requests
+      p.scikit-image
+      p.scipy
+      p.six
+      p.torch
+      p.torchvision
+      p.tqdm
+      p.urllib3
+      p.waitress
+    ];
+
+    pythonImportsCheck = [ "backgroundremover" ];
+
+    passthru = {
+      inherit models;
+      tests = {
+        image = let
+          # random no copyright car image from the internet
+          demoImage = fetchurl {
+            url = "https://pics.craiyon.com/2023-07-16/38653769ac3b4e068181cb5ab1e542a1.webp";
+            hash = "sha256-Kvd06eZdibgDbabVVe0+cNTeS1rDnMXIZZpPlHIlfBo=";
+          };
+        in runCommand "backgroundremover-image-test.png" {
+          buildInputs = [ self ];
+        } ''
+          export NUMBA_CACHE_DIR=$(mktemp -d)
+          backgroundremover -i ${demoImage} -o $out
+        '';
+      };
+    };
+
+    doCheck = false; # no tests
+
+    meta = with lib; {
+      mainProgram = "backgroundremover";
+      description = "Command line tool to remove background from image and video, made by nadermx to power";
+      homepage = "https://BackgroundRemoverAI.com";
+      downloadPage = "https://github.com/nadermx/backgroundremover/releases";
+      license = licenses.mit;
+      maintainers = [ maintainers.lucasew ];
+    };
+  };
+in self
diff --git a/pkgs/by-name/ba/backgroundremover/test-script.py b/pkgs/by-name/ba/backgroundremover/test-script.py
new file mode 100644
index 0000000000000..29af6fd76e80b
--- /dev/null
+++ b/pkgs/by-name/ba/backgroundremover/test-script.py
@@ -0,0 +1,20 @@
+from argparse import ArgumentParser
+from pathlib import Path
+
+import backgroundremover.utilities as utilities
+from backgroundremover import bg
+
+parser = ArgumentParser()
+
+parser.add_argument('input', type=Path)
+parser.add_argument('output', type=Path)
+
+args = parser.parse_args()
+
+input_bytes = args.input.read_bytes()
+
+output_bytes = bg.remove(
+  input_bytes,
+)
+
+args.output.write_bytes(output_bytes)
diff --git a/pkgs/by-name/bi/bibata-cursors/package.nix b/pkgs/by-name/bi/bibata-cursors/package.nix
new file mode 100644
index 0000000000000..d3749c14a6c27
--- /dev/null
+++ b/pkgs/by-name/bi/bibata-cursors/package.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, fetchzip
+, clickgen
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "bibata-cursors";
+  version = "2.0.6";
+
+  src = fetchFromGitHub {
+    owner = "ful1e5";
+    repo = "Bibata_Cursor";
+    rev = "v${version}";
+    hash = "sha256-iLBgQ0reg8HzUQMUcZboMYJxqpKXks5vJVZMHirK48k=";
+  };
+
+  bitmaps = fetchzip {
+    url = "https://github.com/ful1e5/Bibata_Cursor/releases/download/v${version}/bitmaps.zip";
+    hash = "sha256-8ujkyqby5sPcnscIPkay1gvd/1CH4R9yMJs1nH/mx8M=";
+  };
+
+  nativeBuildInputs = [
+    clickgen
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Amber -n 'Bibata-Modern-Amber' -c 'Yellowish and rounded edge bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Classic -n 'Bibata-Modern-Classic' -c 'Black and rounded edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Ice -n 'Bibata-Modern-Ice' -c 'White and rounded edge Bibata cursors.'
+
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Amber -n 'Bibata-Original-Amber' -c 'Yellowish and sharp edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Classic -n 'Bibata-Original-Classic' -c 'Black and sharp edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Ice -n 'Bibata-Original-Ice' -c 'White and sharp edge Bibata cursors.'
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm 0755 $out/share/icons
+    cp -rf themes/* $out/share/icons/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Material Based Cursor Theme";
+    homepage = "https://github.com/ful1e5/Bibata_Cursor";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ rawkode AdsonCicilioti ];
+  };
+}
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 9c4069b41bc86..6cfc191f895f2 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -16,6 +16,7 @@
 , npm-lockfile-fix
 , overrideSDK
 , darwin
+, fetchpatch
 }:
 
 let
@@ -24,23 +25,31 @@ let
     buildNpmPackage.override {
       stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
     };
+  # update package-lock to fix build errors. this will be resolved in the
+  # next patch version of Bruno at which point the patch can be removed entirely.
+  # upstream PR: https://github.com/usebruno/bruno/pull/1894
+  brunoLockfilePatch_1_12_2 = fetchpatch {
+    url = "https://github.com/usebruno/bruno/pull/1894/commits/e3bab23446623315ee674283285a86e210778fe7.patch";
+    hash = "sha256-8rYBvgu9ZLXjb9AFyk4yMBVjcyFPmlNi66YEaQGQaKw=";
+  };
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.11.0";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-Urskhzs00OEucoR17NDXNtnrcXk9h75E806Re0HvYyw=";
+    hash = "sha256-C/WeEloUGF0PEfeanm6lHe/MgpcF+g/ZY2tnqXFl9LA=";
 
     postFetch = ''
+      patch -d $out <${brunoLockfilePatch_1_12_2}
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-48xzx7dTalceXzjFBHIkkUS83pqP/OQ0L2tnMESpHII=";
+  npmDepsHash = "sha256-Zt5cVB1S86iPYKOUj7FwyR97lwmnFz6sZ+S3Ms/b9+o=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/de/decker/package.nix b/pkgs/by-name/de/decker/package.nix
index e5b0d2f88673c..4ce73c54b7a58 100644
--- a/pkgs/by-name/de/decker/package.nix
+++ b/pkgs/by-name/de/decker/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "decker";
-  version = "1.39";
+  version = "1.41";
 
   src = fetchFromGitHub {
     owner = "JohnEarnest";
     repo = "Decker";
     rev = "v${version}";
-    hash = "sha256-77x+LT+oTDtK4jszL3A9MAv9Hakovz47yFaiu8kFtTg=";
+    hash = "sha256-AnWFAa96/lO5to7mVzHGkyzJ8U+2A9u9N1w91vHDsFo=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/de/delfin/package.nix b/pkgs/by-name/de/delfin/package.nix
index cdb73e2d8c791..d46e5a94a614c 100644
--- a/pkgs/by-name/de/delfin/package.nix
+++ b/pkgs/by-name/de/delfin/package.nix
@@ -21,20 +21,20 @@
 
 stdenv.mkDerivation rec {
   pname = "delfin";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "avery42";
     repo = "delfin";
     rev = "v${version}";
-    hash = "sha256-QwxdNPLL7PBokq5WaPylD4bBmXmJWyEQsWKN7DM2utk=";
+    hash = "sha256-7GHwwwFibmwBcrlC2zSpEUZ2dca14wZFU6PJWjincPQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-ElB9TbfmYn/A1Y3+oQ752zHqkC+f2RJPxfGXH0m5C/E=";
+    hash = "sha256-zlecw6230AC/+y537iEhJU+BgWRs2WCFP0AIcxchZBA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 17755df44b315..2d482956eed4a 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -1,14 +1,18 @@
-{ stdenv
-, lib
-, openssl
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, rustPlatform
+, testers
+
+, cachix
 , darwin
 , libgit2
-, makeWrapper
 , nix
+, openssl
 , pkg-config
-, rustPlatform
-, cachix
-, fetchFromGitHub
+
+, devenv  # required to run version test
 }:
 
 let
@@ -25,7 +29,7 @@ let
     doInstallCheck = false;
   });
 
-  version = "1.0.1";
+  version = "1.0.2";
 in rustPlatform.buildRustPackage {
   pname = "devenv";
   inherit version;
@@ -34,12 +38,10 @@ in rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-9LnGe0KWqXj18IV+A1panzXQuTamrH/QcasaqnuqiE0=";
+    hash = "sha256-JCxjmWr2+75KMPOoVybNZhy9zhhrg9BAKA8D+J6MNBc=";
   };
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
+  cargoHash = "sha256-FGB8p9ClGokYDrV0b47PnjeSlOv7p+IgThNajve3yms=";
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
 
@@ -51,6 +53,13 @@ in rustPlatform.buildRustPackage {
     wrapProgram $out/bin/devenv --set DEVENV_NIX ${devenv_nix} --prefix PATH ":" "$out/bin:${cachix}/bin"
   '';
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = devenv;
+      command = "export XDG_DATA_HOME=$PWD; devenv version";
+    };
+  };
+
   meta = {
     changelog = "https://github.com/cachix/devenv/releases/tag/v${version}";
     description = "Fast, Declarative, Reproducible, and Composable Developer Environments";
diff --git a/pkgs/by-name/di/disko/package.nix b/pkgs/by-name/di/disko/package.nix
index 0d03005736a54..20048c763bdc6 100644
--- a/pkgs/by-name/di/disko/package.nix
+++ b/pkgs/by-name/di/disko/package.nix
@@ -9,12 +9,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   name = "disko";
-  version = "1.4.1";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "disko";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HeWFrRuHpnAiPmIr26OKl2g142HuGerwoO/XtW53pcI=";
+    hash = "sha256-5DUNQl9BSmLxgGLbF05G7hi/UTk9DyZq8AuEszhQA7Q=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ bash ];
diff --git a/pkgs/by-name/ep/epub-thumbnailer/package.nix b/pkgs/by-name/ep/epub-thumbnailer/package.nix
new file mode 100644
index 0000000000000..b1e45ff99b37e
--- /dev/null
+++ b/pkgs/by-name/ep/epub-thumbnailer/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, python3
+, fetchFromGitHub
+, unstableGitUpdater
+}:
+
+python3.pkgs.buildPythonApplication {
+  pname = "epub-thumbnailer";
+  version = "0-unstable-2024-03-16";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "marianosimone";
+    repo = "epub-thumbnailer";
+    rev = "035c31e9269bcb30dcc20fed31b6dc54e9bfed63";
+    hash = "sha256-G/CeYmr+wgJidbavfvIuCbRLJGQzoxAnpo3t4YFJq0c=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pillow
+  ];
+
+  postInstall = ''
+    mv $out/bin/epub-thumbnailer.py $out/bin/epub-thumbnailer
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Script to extract the cover of an epub book and create a thumbnail for it";
+    homepage = "https://github.com/marianosimone/epub-thumbnailer";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "epub-thumbnailer";
+  };
+}
diff --git a/pkgs/by-name/de/devenv/Cargo.lock b/pkgs/by-name/fi/firefoxpwa/Cargo.lock
index c7c39688f5c70..191f6d2a5ab6f 100644
--- a/pkgs/by-name/de/devenv/Cargo.lock
+++ b/pkgs/by-name/fi/firefoxpwa/Cargo.lock
@@ -3,6 +3,22 @@
 version = 3
 
 [[package]]
+name = "ab_glyph"
+version = "0.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80179d7dd5d7e8c285d67c4a1e652972a92de7475beddfb92028c76463b13225"
+dependencies = [
+ "ab_glyph_rasterizer",
+ "owned_ttf_parser",
+]
+
+[[package]]
+name = "ab_glyph_rasterizer"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c71b1793ee61086797f5c80b6efa2b8ffa6d5dd703f118545808a7f2e27f7046"
+
+[[package]]
 name = "addr2line"
 version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -18,6 +34,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
+name = "adler32"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
+
+[[package]]
 name = "aho-corasick"
 version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -27,19 +49,40 @@ dependencies = [
 ]
 
 [[package]]
-name = "ansiterm"
-version = "0.12.2"
+name = "alloc-no-stdlib"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ab587f5395da16dd2e6939adf53dede583221b320cadfb94e02b5b7b9bf24cc"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
 dependencies = [
- "winapi",
+ "alloc-no-stdlib",
+]
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
 ]
 
 [[package]]
 name = "anstream"
-version = "0.6.13"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
+checksum = "6e2e1ebcb11de5c03c67de28a7df593d32191b44939c482e97702baaaa6ab6a5"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -51,9 +94,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.6"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"
 
 [[package]]
 name = "anstyle-parse"
@@ -84,14 +127,35 @@ dependencies = [
 ]
 
 [[package]]
-name = "atty"
-version = "0.2.14"
+name = "anyhow"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "080e9890a082662b09c1ad45f567faeeb47f22b5fb23895fbe1e651e718e25ca"
+
+[[package]]
+name = "arrayref"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b4930d2cb77ce62f89ee5d5289b4ac049559b1c45539271f5ed4fdc7db34545"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
+name = "async-compression"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+checksum = "a116f46a969224200a0a97f29cfd4c50e7534e4b4826bd23ea2c3c533039c82c"
 dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
+ "brotli",
+ "flate2",
+ "futures-core",
+ "memchr",
+ "pin-project-lite",
+ "tokio",
 ]
 
 [[package]]
@@ -110,27 +174,24 @@ dependencies = [
  "cc",
  "cfg-if",
  "libc",
- "miniz_oxide",
+ "miniz_oxide 0.7.1",
  "object",
  "rustc-demangle",
 ]
 
 [[package]]
-name = "backtrace-ext"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "537beee3be4a18fb023b570f80e3ae28003db9167a751266b259926e25539d50"
-dependencies = [
- "backtrace",
-]
-
-[[package]]
 name = "base64"
 version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
+name = "bit_field"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc827186963e592360843fb5ba4b973e145841266c1357f7180c43526f2e5b61"
+
+[[package]]
 name = "bitflags"
 version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -143,10 +204,43 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 
 [[package]]
+name = "brotli"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "516074a47ef4bce09577a3b379392300159ce5b1ba2e501ff1c819950066100f"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
+[[package]]
 name = "bumpalo"
-version = "3.15.3"
+version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea184aa71bb362a1157c896979544cc23974e08fd265f29ea96b59f0b4a555b"
+checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
+
+[[package]]
+name = "bytemuck"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
@@ -155,19 +249,34 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
 
 [[package]]
-name = "castaway"
-version = "0.2.2"
+name = "bzip2"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8"
+dependencies = [
+ "bzip2-sys",
+ "libc",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.11+1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a17ed5635fc8536268e5d4de1e22e81ac34419e5f052d4d51f4e01dcc263fcc"
+checksum = "736a955f3fa7875102d57c82b8cac37ec45224a07fd32d58f9f7a186b6cd4cdc"
 dependencies = [
- "rustversion",
+ "cc",
+ "libc",
+ "pkg-config",
 ]
 
 [[package]]
 name = "cc"
-version = "1.0.88"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02f341c093d19155a6e41631ce5971aac4e9a868262212153124c15fa22d1cdc"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "cfg-if"
@@ -177,111 +286,77 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
+checksum = "77e53693616d3075149f4ead59bdeecd204ac6b8192d8969757601b74bddf00f"
 
 [[package]]
-name = "clap"
-version = "3.2.25"
+name = "chrono"
+version = "0.4.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
 dependencies = [
- "atty",
- "bitflags 1.3.2",
- "clap_derive 3.2.25",
- "clap_lex 0.2.4",
- "indexmap 1.9.3",
- "once_cell",
- "strsim 0.10.0",
- "termcolor",
- "textwrap",
+ "android-tzdata",
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
 name = "clap"
-version = "4.5.1"
+version = "4.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c918d541ef2913577a0f9566e9ce27cb35b6df072075769e0b26cb5a554520da"
+checksum = "1e578d6ec4194633722ccf9544794b71b1385c3c027efe0c55db226fc880865c"
 dependencies = [
  "clap_builder",
- "clap_derive 4.5.0",
+ "clap_derive",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.1"
+version = "4.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f3e7391dad68afb0c2ede1bf619f579a3dc9c2ec67f089baa397123a2f3d1eb"
+checksum = "4df4df40ec50c46000231c914968278b1eb05098cf8f1b3a518a95030e71d1c7"
 dependencies = [
  "anstream",
  "anstyle",
- "clap_lex 0.7.0",
- "strsim 0.11.0",
+ "clap_lex",
+ "strsim",
 ]
 
 [[package]]
-name = "clap_derive"
-version = "3.2.25"
+name = "clap_complete"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae6371b8bdc8b7d3959e9cf7b22d4435ef3e79e138688421ec654acf8c81b008"
+checksum = "eaf7dcb7c21d8ca1a2482ee0f1d341f437c9a7af6ca6da359dc5e1b164e98215"
 dependencies = [
- "heck",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
+ "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.5.0"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "307bc0538d5f0f83b8248db3087aa92fe504e4691294d0c96c0eabc33f47ba47"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
-dependencies = [
- "os_str_bytes",
+ "syn",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
 
 [[package]]
-name = "cli-table"
-version = "0.4.7"
+name = "color_quant"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adfbb116d9e2c4be7011360d0c0bee565712c11e969c9609b25b619366dc379d"
-dependencies = [
- "cli-table-derive",
- "csv",
- "termcolor",
- "unicode-width",
-]
-
-[[package]]
-name = "cli-table-derive"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2af3bfb9da627b0a6c467624fb7963921433774ed435493b5c08a3053e829ad4"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
+checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "colorchoice"
@@ -290,25 +365,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
 
 [[package]]
-name = "compact_str"
-version = "0.7.1"
+name = "configparser"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f86b9c4c00838774a6d902ef931eff7470720c51d90c2e32cfe15dc304737b3f"
+checksum = "4ec6d3da8e550377a85339063af6e3735f4b1d9392108da4e083a1b3b9820288"
+
+[[package]]
+name = "const_format"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a214c7af3d04997541b18d432afaff4c455e79e2029079647e72fc2bd27673"
 dependencies = [
- "castaway",
- "cfg-if",
- "itoa",
- "ryu",
- "static_assertions",
+ "const_format_proc_macros",
 ]
 
 [[package]]
-name = "convert_case"
-version = "0.6.0"
+name = "const_format_proc_macros"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
+checksum = "c7f6ff08fd20f4f299298a28e2dfa8a8ba1036e6cd2460ac1de7b425d76f2500"
 dependencies = [
- "unicode-segmentation",
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
 ]
 
 [[package]]
@@ -328,31 +407,60 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
-name = "csv"
-version = "1.3.0"
+name = "crc32fast"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
 dependencies = [
- "csv-core",
- "itoa",
- "ryu",
- "serde",
+ "cfg-if",
 ]
 
 [[package]]
-name = "csv-core"
-version = "0.1.11"
+name = "crossbeam-deque"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "memchr",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
+
+[[package]]
+name = "crunchy"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
+
+[[package]]
+name = "csscolorparser"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb2a7d3066da2de787b7f032c736763eb7ae5d355f81a68bab2675a96008b0bf"
+dependencies = [
+ "phf",
+ "serde",
 ]
 
 [[package]]
 name = "darling"
-version = "0.20.8"
+version = "0.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
+checksum = "0209d94da627ab5605dcccf08bb18afa5009cfbef48d8a8b7d7bdbc79be25c5e"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -360,67 +468,60 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.20.8"
+version = "0.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
+checksum = "177e3443818124b357d8e76f53be906d60937f0d3a90773a664fa63fa253e621"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim 0.10.0",
- "syn 2.0.51",
+ "strsim",
+ "syn",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.20.8"
+version = "0.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
+checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
-name = "devenv"
-version = "1.0.1"
+name = "data-url"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c297a1c74b71ae29df00c3e22dd9534821d60eb9af5a0192823fa2acea70c2a"
+
+[[package]]
+name = "deflate"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73770f8e1fe7d64df17ca66ad28994a0a623ea497fa69486e14984e715c5d174"
 dependencies = [
- "ansiterm",
- "clap 4.5.1",
- "cli-table",
- "dotlock",
- "fs2",
- "include_dir",
- "indoc",
- "miette",
- "nix",
- "regex",
- "reqwest",
- "schematic",
- "serde",
- "serde_json",
- "serde_yaml",
- "tempdir",
- "tracing",
- "which",
- "whoami",
- "xdg",
+ "adler32",
+ "byteorder",
 ]
 
 [[package]]
-name = "devenv-run-tests"
-version = "0.1.0"
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
 dependencies = [
- "clap 3.2.25",
+ "powerfmt",
+ "serde",
 ]
 
 [[package]]
-name = "dirs"
+name = "directories"
 version = "5.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+checksum = "9a49173b84e034382284f27f1af4dcbbd231ffa358c0fe316541a7337f376a35"
 dependencies = [
  "dirs-sys",
 ]
@@ -438,25 +539,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "dotlock"
-version = "0.5.0"
+name = "dmg"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30c541575b952e53113caddb5be24869705052591b534ea11a81a3d4743416a3"
+checksum = "abc28c350337837f23b4750f774371f63db232338c9f89bdb9eb48523a7c4722"
 dependencies = [
- "tempfile",
+ "log",
+ "plist",
 ]
 
 [[package]]
-name = "dyn-clone"
-version = "1.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
-
-[[package]]
 name = "either"
-version = "1.10.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "encoding_rs"
@@ -484,18 +580,158 @@ dependencies = [
 ]
 
 [[package]]
+name = "exr"
+version = "1.71.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "832a761f35ab3e6664babfbdc6cef35a4860e816ec3916dcfd0882954e98a8a8"
+dependencies = [
+ "bit_field",
+ "flume",
+ "half",
+ "lebe",
+ "miniz_oxide 0.7.1",
+ "rayon-core",
+ "smallvec",
+ "zune-inflate",
+]
+
+[[package]]
 name = "fastrand"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
 
 [[package]]
+name = "fdeflate"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f9bfee30e4dedf0ab8b422f03af778d9612b63f502710fc500a334ebe2de645"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "filedescriptor"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7199d965852c3bac31f779ef99cbb4537f80e952e2d6aa0ffeb30cce00f4f46e"
+dependencies = [
+ "libc",
+ "thiserror",
+ "winapi",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ee447700ac8aa0b2f2bd7bc4462ad686ba06baa6727ac149a2d6277f0d240fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "firefoxpwa"
+version = "0.0.0"
+dependencies = [
+ "ab_glyph",
+ "anyhow",
+ "byteorder",
+ "bzip2",
+ "cfg-if",
+ "cfg_aliases",
+ "clap",
+ "clap_complete",
+ "configparser",
+ "const_format",
+ "data-url",
+ "directories",
+ "dmg",
+ "fs_extra",
+ "gag",
+ "glob",
+ "icns",
+ "image",
+ "log",
+ "phf",
+ "pix",
+ "plist",
+ "reqwest",
+ "resvg",
+ "sanitize-filename",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "simplelog",
+ "smart-default",
+ "tar",
+ "tempfile",
+ "ulid",
+ "url",
+ "urlencoding",
+ "web_app_manifest",
+ "windows",
+ "winreg",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide 0.7.1",
+]
+
+[[package]]
+name = "float-cmp"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98de4bbd547a563b716d8dfa9aad1cb19bfab00f4fa09a6a4ed21dbcf44ce9c4"
+
+[[package]]
+name = "flume"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55ac459de2512911e4b674ce33cf20befaba382d05b62b008afc1c8b57cbf181"
+dependencies = [
+ "spin",
+]
+
+[[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
+name = "fontconfig-parser"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "674e258f4b5d2dcd63888c01c68413c51f565e8af99d2f7701c7b81d79ef41c4"
+dependencies = [
+ "roxmltree 0.18.1",
+]
+
+[[package]]
+name = "fontdb"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b88c54a38407f7352dd2c4238830115a6377741098ffd1f997c813d0e088a6"
+dependencies = [
+ "fontconfig-parser",
+ "log",
+ "memmap2",
+ "slotmap",
+ "tinyvec",
+ "ttf-parser",
+]
+
+[[package]]
 name = "foreign-types"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -520,20 +756,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "fs2"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "fuchsia-cprng"
-version = "0.1.1"
+name = "fs_extra"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
 [[package]]
 name = "futures-channel"
@@ -584,28 +810,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "garde"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fa8fb3ffe035745c6194540b2064b2fe275f32367fbb4eb026024b7921e2e5"
-dependencies = [
- "compact_str",
- "garde_derive",
- "once_cell",
- "regex",
- "smallvec",
-]
-
-[[package]]
-name = "garde_derive"
-version = "0.18.0"
+name = "gag"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf62650515830c41553b72bd49ec20fb120226f9277c7f2847f071cf998325b"
+checksum = "a713bee13966e9fbffdf7193af71d54a6b35a0bb34997cd6c9519ebeb5005972"
 dependencies = [
- "proc-macro2",
- "quote",
- "regex",
- "syn 2.0.51",
+ "filedescriptor",
+ "tempfile",
 ]
 
 [[package]]
@@ -620,12 +831,28 @@ dependencies = [
 ]
 
 [[package]]
+name = "gif"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80792593675e051cf94a4b111980da2ba60d4a83e43e0048c5693baab3977045"
+dependencies = [
+ "color_quant",
+ "weezl",
+]
+
+[[package]]
 name = "gimli"
 version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
+name = "glob"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+
+[[package]]
 name = "h2"
 version = "0.3.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -637,7 +864,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap 2.2.3",
+ "indexmap 2.1.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -645,6 +872,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "half"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b4af3693f1b705df946e9fe5631932443781d0aabb423b62fcd4d73f6d2fd0"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
 name = "hashbrown"
 version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -664,21 +900,15 @@ checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
-version = "0.1.19"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
+checksum = "5d3d0e0f38255e7fa3cf31335b3a56f05febd18025f4db5ef7a0cfb4f8da651f"
 
 [[package]]
-name = "home"
-version = "0.5.9"
+name = "hex"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
-dependencies = [
- "windows-sys 0.52.0",
-]
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
@@ -752,6 +982,39 @@ dependencies = [
 ]
 
 [[package]]
+name = "iana-time-zone"
+version = "0.1.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6a67363e2aa4443928ce15e57ebae94fd8949958fd1223c4cfc0cd473ad7539"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icns"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5ccfbad7e08da70a5b48a924994a5afd93125ce5d45a3b0ba0b8da7bda59a40"
+dependencies = [
+ "byteorder",
+ "png 0.16.8",
+]
+
+[[package]]
 name = "ident_case"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -768,23 +1031,28 @@ dependencies = [
 ]
 
 [[package]]
-name = "include_dir"
-version = "0.7.3"
+name = "image"
+version = "0.24.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18762faeff7122e89e0857b02f7ce6fcc0d101d5e9ad2ad7846cc01d61b7f19e"
+checksum = "034bbe799d1909622a74d1193aa50147769440040ff36cb2baa947609b0a4e23"
 dependencies = [
- "include_dir_macros",
+ "bytemuck",
+ "byteorder",
+ "color_quant",
+ "exr",
+ "gif",
+ "jpeg-decoder",
+ "num-traits",
+ "png 0.17.11",
+ "qoi",
+ "tiff",
 ]
 
 [[package]]
-name = "include_dir_macros"
-version = "0.7.3"
+name = "imagesize"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b139284b5cf57ecfa712bcc66950bb635b31aff41c188e8a4cfc758eca374a3f"
-dependencies = [
- "proc-macro2",
- "quote",
-]
+checksum = "029d73f573d8e8d63e6d5020011d3255b28c3ba85d6cf870a07184ed23de9284"
 
 [[package]]
 name = "indexmap"
@@ -794,13 +1062,14 @@ checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
 dependencies = [
  "autocfg",
  "hashbrown 0.12.3",
+ "serde",
 ]
 
 [[package]]
 name = "indexmap"
-version = "2.2.3"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233cf39063f058ea2caae4091bf4a3ef70a653afbc026f5c4a4135d114e3c177"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
  "hashbrown 0.14.3",
@@ -808,49 +1077,70 @@ dependencies = [
 ]
 
 [[package]]
-name = "indoc"
-version = "2.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
-
-[[package]]
 name = "ipnet"
 version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
-name = "is_ci"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7655c9839580ee829dfacba1d1278c2b7883e50a277ff7541299489d6bdfdc45"
-
-[[package]]
 name = "itoa"
 version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
 
 [[package]]
+name = "jpeg-decoder"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5d4a7da358eff58addd2877a45865158f0d78c911d43a5784ceb7bbf52833b0"
+dependencies = [
+ "rayon",
+]
+
+[[package]]
 name = "js-sys"
-version = "0.3.68"
+version = "0.3.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "406cda4b368d531c842222cf9d2600a9a4acce8d29423695379c6868a143a9ee"
+checksum = "9a1d36f1235bc969acba30b7f5990b864423a6068a10f7c90ae8f0112e3a59d1"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
+name = "kurbo"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd85a5776cd9500c2e2059c8c76c3b01528566b7fcbaf8098b55a33fc298849b"
+dependencies = [
+ "arrayvec",
+]
+
+[[package]]
+name = "language-tags"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4345964bb142484797b161f473a503a434de77149dd8c7427788c6e13379388"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
+name = "lebe"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03087c2bad5e1034e8cace5926dec053fb3790248370865f5117a7d0213354c8"
+
+[[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
 
 [[package]]
 name = "libredox"
@@ -864,25 +1154,35 @@ dependencies = [
 ]
 
 [[package]]
+name = "line-wrap"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f30344350a2a51da54c1d53be93fade8a237e545dbcc4bdbe635413f2117cab9"
+dependencies = [
+ "safemem",
+]
+
+[[package]]
 name = "linux-raw-sys"
 version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
-name = "log"
-version = "0.4.20"
+name = "lock_api"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
 
 [[package]]
-name = "markdown"
-version = "1.0.0-alpha.16"
+name = "log"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0f0025e8c0d89b84d6dc63e859475e40e8e82ab1a08be0a93ad5731513a508"
-dependencies = [
- "unicode-id",
-]
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "memchr"
@@ -891,55 +1191,59 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
 
 [[package]]
-name = "miette"
-version = "7.1.0"
+name = "memmap2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baed61d13cc3723ee6dbed730a82bfacedc60a85d81da2d77e9c3e8ebc0b504a"
+checksum = "45fd3a57831bf88bc63f8cebc0cf956116276e97fef3966103e96416209f7c92"
 dependencies = [
- "backtrace",
- "backtrace-ext",
- "miette-derive",
- "owo-colors",
- "supports-color",
- "supports-hyperlinks",
- "supports-unicode",
- "terminal_size",
- "textwrap",
- "thiserror",
- "unicode-width",
+ "libc",
 ]
 
 [[package]]
-name = "miette-derive"
-version = "7.1.0"
+name = "mime"
+version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f301c3f54f98abc6c212ee722f5e5c62e472a334415840669e356f04850051ec"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime"
+version = "0.4.0-a.0"
+source = "git+https://github.com/filips123/mime?branch=implement-eq-partialeq#57416f447a10c3343df7fe80deb0ae8a7c77cf0a"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.51",
+ "mime-parse",
+ "quoted-string",
+ "serde",
 ]
 
 [[package]]
-name = "mime"
-version = "0.3.17"
+name = "mime-parse"
+version = "0.0.0"
+source = "git+https://github.com/filips123/mime?branch=implement-eq-partialeq#57416f447a10c3343df7fe80deb0ae8a7c77cf0a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+checksum = "791daaae1ed6889560f8c4359194f56648355540573244a5448a83ba1ecc7435"
+dependencies = [
+ "adler32",
+]
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.2"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
 dependencies = [
  "adler",
+ "simd-adler32",
 ]
 
 [[package]]
 name = "mio"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "wasi",
@@ -965,14 +1269,30 @@ dependencies = [
 ]
 
 [[package]]
-name = "nix"
-version = "0.28.0"
+name = "num-traits"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "num_threads"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2819ce041d2ee131036f4fc9d6ae7ae125a3a40e97ba64d04fe799ad9dabbb44"
 dependencies = [
- "bitflags 2.4.2",
- "cfg-if",
- "cfg_aliases",
  "libc",
 ]
 
@@ -993,9 +1313,9 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "openssl"
-version = "0.10.64"
+version = "0.10.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
+checksum = "15c9d69dd87a29568d4d017cfe8ec518706046a05184e5aea92d0af890b803c8"
 dependencies = [
  "bitflags 2.4.2",
  "cfg-if",
@@ -1014,7 +1334,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -1024,13 +1344,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
+name = "openssl-src"
+version = "300.2.1+3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fe476c29791a5ca0d1273c697e96085bbabbbea2ef7afd5617e78a4b40332d3"
+dependencies = [
+ "cc",
+]
+
+[[package]]
 name = "openssl-sys"
-version = "0.9.101"
+version = "0.9.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda2b0f344e78efc2facf7d195d098df0dd72151b26ab98da807afc26c198dff"
+checksum = "22e1bf214306098e4832460f797824c05d25aacdf896f64a985fb0fd992454ae"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -1042,16 +1372,39 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
 [[package]]
-name = "os_str_bytes"
-version = "6.6.1"
+name = "owned_ttf_parser"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+checksum = "d4586edfe4c648c71797a74c84bacb32b52b212eff5dfe2bb9f2c599844023e7"
+dependencies = [
+ "ttf-parser",
+]
+
+[[package]]
+name = "parse-display"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6509d08722b53e8dafe97f2027b22ccbe3a5db83cb352931e9716b0aa44bc5c"
+dependencies = [
+ "once_cell",
+ "parse-display-derive",
+ "regex",
+]
 
 [[package]]
-name = "owo-colors"
-version = "4.0.0"
+name = "parse-display-derive"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caff54706df99d2a78a5a4e3455ff45448d81ef1bb63c22cd14052ca0e993a3f"
+checksum = "68517892c8daf78da08c0db777fcc17e07f2f63ef70041718f8a7630ad84f341"
+dependencies = [
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "regex-syntax 0.7.5",
+ "structmeta",
+ "syn",
+]
 
 [[package]]
 name = "percent-encoding"
@@ -1060,6 +1413,54 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
+name = "phf"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ade2d8b8f33c7333b51bcf0428d37e217e9f32192ae4772156f65063b8ce03dc"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e4cc64c2ad9ebe670cb8fd69dd50ae301650392e81c05f9bfcb2d5bdbc24b0"
+dependencies = [
+ "phf_shared",
+ "rand",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3444646e286606587e49f3bcf1679b8cef1dc2c5ecc29ddacaffc305180d464b"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90fcb95eef784c2ac79119d1dd819e162b5da872ce6f3c3abe1e8ca1c082f72b"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pico-args"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
+
+[[package]]
 name = "pin-project-lite"
 version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1072,36 +1473,69 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
+name = "pix"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de5067af0cd27add969cdb4ef2eecc955f59235f3b7a75a3c6ac9562cfb6b81"
+
+[[package]]
 name = "pkg-config"
-version = "0.3.30"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+checksum = "2900ede94e305130c13ddd391e0ab7cbaeb783945ae07a279c268cb05109c6cb"
 
 [[package]]
-name = "proc-macro-error"
-version = "1.0.4"
+name = "plist"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+checksum = "e5699cc8a63d1aa2b1ee8e12b9ad70ac790d65788cd36101fa37f87ea46c4cef"
 dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
+ "base64",
+ "indexmap 2.1.0",
+ "line-wrap",
+ "quick-xml",
+ "serde",
+ "time",
 ]
 
 [[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
+name = "png"
+version = "0.16.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+checksum = "3c3287920cb847dee3de33d301c463fba14dda99db24214ddf93f83d3021f4c6"
 dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
+ "bitflags 1.3.2",
+ "crc32fast",
+ "deflate",
+ "miniz_oxide 0.3.7",
 ]
 
 [[package]]
+name = "png"
+version = "0.17.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f6c3c3e617595665b8ea2ff95a86066be38fb121ff920a9c0eb282abcd1da5a"
+dependencies = [
+ "bitflags 1.3.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide 0.7.1",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
 name = "proc-macro2"
 version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1111,6 +1545,30 @@ dependencies = [
 ]
 
 [[package]]
+name = "qoi"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f6d64c71eb498fe9eae14ce4ec935c555749aef511cca85b5568910d6e48001"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quick-xml"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1004a344b30a54e2ee58d66a71b32d2db2feb0a31f9a2d302bf0536f15de2a33"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
 name = "quote"
 version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1120,43 +1578,71 @@ dependencies = [
 ]
 
 [[package]]
+name = "quoted-string"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9586f8867f39941d8e796c18340a9cb5221a018df021169dc3e61c87d9f5f567"
+dependencies = [
+ "quick-error",
+]
+
+[[package]]
 name = "rand"
-version = "0.4.6"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
- "fuchsia-cprng",
  "libc",
- "rand_core 0.3.1",
- "rdrand",
- "winapi",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
-name = "rand_core"
+name = "rand_chacha"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
- "rand_core 0.4.2",
+ "ppv-lite86",
+ "rand_core",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.4.2"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
 
 [[package]]
-name = "rdrand"
-version = "0.4.0"
+name = "rayon"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
 dependencies = [
- "rand_core 0.3.1",
+ "either",
+ "rayon-core",
 ]
 
 [[package]]
+name = "rayon-core"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "rctree"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b42e27ef78c35d3998403c1d26f3efd9e135d3e5121b0a4845cc5cc27547f4f"
+
+[[package]]
 name = "redox_syscall"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1178,48 +1664,46 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.10.3"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.4.5"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bb987efffd3c6d0d8f5f89510bb458559eab11e4f869acb20bf845e016259cd"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.2"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
 
 [[package]]
-name = "remove_dir_all"
-version = "0.5.3"
+name = "regex-syntax"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
-dependencies = [
- "winapi",
-]
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "reqwest"
-version = "0.11.26"
+version = "0.11.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bf93c4af7a8bb7d879d51cebe797356ff10ae8516ace542b5182d9dcac10b2"
+checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
 dependencies = [
+ "async-compression",
  "base64",
  "bytes",
  "encoding_rs",
@@ -1233,19 +1717,19 @@ dependencies = [
  "ipnet",
  "js-sys",
  "log",
- "mime",
+ "mime 0.3.17",
  "native-tls",
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper",
  "system-configuration",
  "tokio",
  "tokio-native-tls",
+ "tokio-socks",
+ "tokio-util",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -1255,106 +1739,117 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustc-demangle"
-version = "0.1.23"
+name = "resvg"
+version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+checksum = "cadccb3d99a9efb8e5e00c16fbb732cbe400db2ec7fc004697ee7d97d86cf1f4"
+dependencies = [
+ "gif",
+ "jpeg-decoder",
+ "log",
+ "pico-args",
+ "png 0.17.11",
+ "rgb",
+ "svgtypes",
+ "tiny-skia",
+ "usvg",
+]
 
 [[package]]
-name = "rustix"
-version = "0.38.31"
+name = "rgb"
+version = "0.8.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+checksum = "05aaa8004b64fd573fc9d002f4e632d51ad4f026c2b5ba95fcb6c2f32c2c47d8"
 dependencies = [
- "bitflags 2.4.2",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.52.0",
+ "bytemuck",
 ]
 
 [[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
+name = "roxmltree"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+checksum = "862340e351ce1b271a378ec53f304a5558f7db87f3769dc655a8f6ecbb68b302"
 dependencies = [
- "base64",
+ "xmlparser",
 ]
 
 [[package]]
-name = "rustversion"
-version = "1.0.14"
+name = "roxmltree"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
+checksum = "3cd14fd5e3b777a7422cca79358c57a8f6e3a703d9ac187448d0daf220c2407f"
 
 [[package]]
-name = "ryu"
-version = "1.0.17"
+name = "rustc-demangle"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
-name = "schannel"
-version = "0.1.23"
+name = "rustix"
+version = "0.38.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
+checksum = "322394588aaf33c24007e8bb3238ee3e4c5c09c084ab32bc73890b99ff326bca"
 dependencies = [
+ "bitflags 2.4.2",
+ "errno",
+ "libc",
+ "linux-raw-sys",
  "windows-sys 0.52.0",
 ]
 
 [[package]]
-name = "schemars"
-version = "0.8.16"
+name = "rustybuzz"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45a28f4c49489add4ce10783f7911893516f15afe45d015608d41faca6bc4d29"
+checksum = "f0ae5692c5beaad6a9e22830deeed7874eae8a4e3ba4076fb48e12c56856222c"
 dependencies = [
- "dyn-clone",
- "serde",
- "serde_json",
+ "bitflags 2.4.2",
+ "bytemuck",
+ "smallvec",
+ "ttf-parser",
+ "unicode-bidi-mirroring",
+ "unicode-ccc",
+ "unicode-properties",
+ "unicode-script",
 ]
 
 [[package]]
-name = "schematic"
-version = "0.14.3"
+name = "ryu"
+version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709e1f0b0a3db267a98da09c89a7818e307cc8daea841e1079eb5f5a02591d54"
+checksum = "f98d2aa92eebf49b69786be48e4477826b256916e84a57ff2a4f21923b48eb4c"
+
+[[package]]
+name = "safemem"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072"
+
+[[package]]
+name = "sanitize-filename"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ed72fbaf78e6f2d41744923916966c4fbe3d7c74e3037a8ee482f1115572603"
 dependencies = [
- "garde",
- "indexmap 2.2.3",
- "markdown",
- "miette",
- "reqwest",
- "schemars",
- "schematic_macros",
- "schematic_types",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_yaml",
- "starbase_styles",
- "thiserror",
- "tracing",
+ "lazy_static",
+ "regex",
 ]
 
 [[package]]
-name = "schematic_macros"
-version = "0.14.1"
+name = "schannel"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31af7347544d97d00870a5865d2077dac07c069a5290c26215ddd1138b302590"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
 dependencies = [
- "convert_case",
- "darling",
- "proc-macro2",
- "quote",
- "syn 2.0.51",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
-name = "schematic_types"
-version = "0.6.0"
+name = "scopeguard"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3adfbe1c90a6a9643433e490ef1605c6a99f93be37e4c83fe5149fca9698c6"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "security-framework"
@@ -1381,47 +1876,36 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.197"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+checksum = "63261df402c67811e9ac6def069e4786148c4563f4b50fd4bf30aa370d626b02"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.197"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+checksum = "46fe8f8603d81ba86327b23a2e9cdf49e1255fb94a4c5f297f6ee0547178ea2c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.114"
+version = "1.0.111"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
+checksum = "176e46fa42316f18edd598015a5166857fc835ec732f5215eac6b7bdbf0a84f4"
 dependencies = [
- "indexmap 2.2.3",
  "itoa",
  "ryu",
  "serde",
 ]
 
 [[package]]
-name = "serde_path_to_error"
-version = "0.1.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebd154a240de39fdebcf5775d2675c204d7c13cf39a4c697be6493c8e734337c"
-dependencies = [
- "itoa",
- "serde",
-]
-
-[[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1434,19 +1918,67 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde_yaml"
-version = "0.9.32"
+name = "serde_with"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd075d994154d4a774f95b51fb96bdc2832b0ea48425c92546073816cda1f2f"
+checksum = "f58c3a1b3e418f61c25b2aeb43fc6c95eaa252b8cecdda67f401943e9e08d33f"
 dependencies = [
- "indexmap 2.2.3",
- "itoa",
- "ryu",
+ "base64",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.1.0",
  "serde",
- "unsafe-libyaml",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2068b437a31fc68f25dd7edc296b078f04b45145c199d8eed9866e45f1ff274"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+
+[[package]]
+name = "simplecss"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a11be7c62927d9427e9f40f3444d5499d868648e2edbc4e2116de69e7ec0e89d"
+dependencies = [
+ "log",
 ]
 
 [[package]]
+name = "simplelog"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acee08041c5de3d5048c8b3f6f13fafb3026b24ba43c6a695a0c76179b844369"
+dependencies = [
+ "log",
+ "termcolor",
+ "time",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
 name = "slab"
 version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1456,43 +1988,58 @@ dependencies = [
 ]
 
 [[package]]
+name = "slotmap"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbff4acf519f630b3a3ddcfaea6c06b42174d9a44bc70c620e9ed1649d58b82a"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
 name = "smallvec"
 version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
 
 [[package]]
-name = "smawk"
-version = "0.3.2"
+name = "smart-default"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c388c1b5e93756d0c740965c41e8822f866621d41acbdf6336a6a168f8840c"
+checksum = "0eb01866308440fc64d6c44d9e86c5cc17adfe33c4d6eed55da9145044d0ffc1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
 
 [[package]]
 name = "socket2"
-version = "0.5.6"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
+checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
-name = "starbase_styles"
-version = "0.3.0"
+name = "spin"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e06fa37c027e48ef341787d8c3d26cfbe8507aa4e2e8c61fcba82fe931bb598"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 dependencies = [
- "dirs",
- "owo-colors",
- "supports-color",
+ "lock_api",
 ]
 
 [[package]]
-name = "static_assertions"
-version = "1.1.0"
+name = "strict-num"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+checksum = "6637bab7722d379c8b41ba849228d680cc12d0a45ba1fa2b48f2a30577a06731"
+dependencies = [
+ "float-cmp",
+]
 
 [[package]]
 name = "strsim"
@@ -1501,48 +2048,43 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
-name = "strsim"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
-
-[[package]]
-name = "supports-color"
-version = "3.0.0"
+name = "structmeta"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9829b314621dfc575df4e409e79f9d6a66a3bd707ab73f23cb4aa3a854ac854f"
+checksum = "78ad9e09554f0456d67a69c1584c9798ba733a5b50349a6c0d0948710523922d"
 dependencies = [
- "is_ci",
+ "proc-macro2",
+ "quote",
+ "structmeta-derive",
+ "syn",
 ]
 
 [[package]]
-name = "supports-hyperlinks"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c0a1e5168041f5f3ff68ff7d95dcb9c8749df29f6e7e89ada40dd4c9de404ee"
-
-[[package]]
-name = "supports-unicode"
-version = "3.0.0"
+name = "structmeta-derive"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7401a30af6cb5818bb64852270bb722533397edcfc7344954a38f420819ece2"
+checksum = "a60bcaff7397072dca0017d1db428e30d5002e00b6847703e2e42005c95fbe00"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
 
 [[package]]
-name = "syn"
-version = "1.0.109"
+name = "svgtypes"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+checksum = "6e44e288cd960318917cbd540340968b90becc8bc81f171345d706e7a89d9d70"
 dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
+ "kurbo",
+ "siphasher",
 ]
 
 [[package]]
 name = "syn"
-version = "2.0.51"
+version = "2.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab617d94515e94ae53b8406c628598680aa0c9587474ecbe58188f7b345d66c"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1550,12 +2092,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "sync_wrapper"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
-
-[[package]]
 name = "system-configuration"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1577,75 +2113,124 @@ dependencies = [
 ]
 
 [[package]]
-name = "tempdir"
-version = "0.3.7"
+name = "tar"
+version = "0.4.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
+checksum = "b16afcea1f22891c49a00c751c7b63b2233284064f11a200fc624137c51e2ddb"
 dependencies = [
- "rand",
- "remove_dir_all",
+ "filetime",
+ "libc",
+ "xattr",
 ]
 
 [[package]]
 name = "tempfile"
-version = "3.10.1"
+version = "3.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
+checksum = "01ce4141aa927a6d1bd34a041795abd0db1cccba5d5f24b009f694bdf3a1f3fa"
 dependencies = [
  "cfg-if",
  "fastrand",
+ "redox_syscall",
  "rustix",
  "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "termcolor"
-version = "1.4.1"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
 dependencies = [
  "winapi-util",
 ]
 
 [[package]]
-name = "terminal_size"
-version = "0.3.0"
+name = "thiserror"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21bebf2b7c9e0a515f6e0f8c51dc0f8e4696391e6f1ff30379559f8365fb0df7"
+checksum = "d54378c645627613241d077a3a79db965db602882668f9136ac42af9ecb730ad"
 dependencies = [
- "rustix",
- "windows-sys 0.48.0",
+ "thiserror-impl",
 ]
 
 [[package]]
-name = "textwrap"
-version = "0.16.1"
+name = "thiserror-impl"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
+checksum = "fa0faa943b50f3db30a20aa7e265dbc66076993efed8463e8de414e5d06d3471"
 dependencies = [
- "smawk",
- "unicode-linebreak",
- "unicode-width",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
-name = "thiserror"
-version = "1.0.57"
+name = "tiff"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e45bcbe8ed29775f228095caf2cd67af7a4ccf756ebff23a306bf3e8b47b24b"
+checksum = "ba1310fcea54c6a9a4fd1aad794ecc02c31682f6bfbecdf460bf19533eed1e3e"
 dependencies = [
- "thiserror-impl",
+ "flate2",
+ "jpeg-decoder",
+ "weezl",
 ]
 
 [[package]]
-name = "thiserror-impl"
-version = "1.0.57"
+name = "time"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a953cb265bef375dae3de6663da4d3804eee9682ea80d8e2542529b73c531c81"
+checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.51",
+ "deranged",
+ "itoa",
+ "libc",
+ "num_threads",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+[[package]]
+name = "time-macros"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+dependencies = [
+ "time-core",
+]
+
+[[package]]
+name = "tiny-skia"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6a067b809476893fce6a254cf285850ff69c847e6cfbade6a20b655b6c7e80d"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "bytemuck",
+ "cfg-if",
+ "log",
+ "png 0.17.11",
+ "tiny-skia-path",
+]
+
+[[package]]
+name = "tiny-skia-path"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de35e8a90052baaaf61f171680ac2f8e925a1e43ea9d2e3a00514772250e541"
+dependencies = [
+ "arrayref",
+ "bytemuck",
+ "strict-num",
 ]
 
 [[package]]
@@ -1665,14 +2250,15 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.36.0"
+version = "1.35.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
+checksum = "c89b4efa943be685f629b149f53829423f8f5531ea21249408e8e2f8671ec104"
 dependencies = [
  "backtrace",
  "bytes",
  "libc",
  "mio",
+ "num_cpus",
  "pin-project-lite",
  "socket2",
  "windows-sys 0.48.0",
@@ -1689,6 +2275,18 @@ dependencies = [
 ]
 
 [[package]]
+name = "tokio-socks"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51165dfa029d2a65969413a6cc96f354b86b464498702f174a4efa13608fd8c0"
+dependencies = [
+ "either",
+ "futures-util",
+ "thiserror",
+ "tokio",
+]
+
+[[package]]
 name = "tokio-util"
 version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1715,22 +2313,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
  "pin-project-lite",
- "tracing-attributes",
  "tracing-core",
 ]
 
 [[package]]
-name = "tracing-attributes"
-version = "0.1.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.51",
-]
-
-[[package]]
 name = "tracing-core"
 version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1746,55 +2332,77 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
+name = "ttf-parser"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17f77d76d837a7830fe1d4f12b7b4ba4192c1888001c7164257e4bc6d21d96b4"
+
+[[package]]
+name = "ulid"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e37c4b6cbcc59a8dcd09a6429fbc7890286bcbb79215cea7b38a3c4c0921d93"
+dependencies = [
+ "rand",
+ "serde",
+]
+
+[[package]]
 name = "unicode-bidi"
 version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
-name = "unicode-id"
-version = "0.3.4"
+name = "unicode-bidi-mirroring"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1b6def86329695390197b82c1e244a54a131ceb66c996f2088a3876e2ae083f"
+checksum = "56d12260fb92d52f9008be7e4bca09f584780eb2266dc8fecc6a192bec561694"
 
 [[package]]
-name = "unicode-ident"
-version = "1.0.12"
+name = "unicode-ccc"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "cc2520efa644f8268dce4dcd3050eaa7fc044fca03961e9998ac7e2e92b77cf1"
 
 [[package]]
-name = "unicode-linebreak"
-version = "0.1.5"
+name = "unicode-ident"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.23"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
 dependencies = [
  "tinyvec",
 ]
 
 [[package]]
-name = "unicode-segmentation"
-version = "1.11.0"
+name = "unicode-properties"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4c87d22b6e3f4a18d4d40ef354e97c90fcb14dd91d7dc0aa9d8a1172ebf7202"
+checksum = "e4259d9d4425d9f0661581b804cb85fe66a4c631cadd8f490d1c13a35d5d9291"
 
 [[package]]
-name = "unicode-width"
-version = "0.1.11"
+name = "unicode-script"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+checksum = "7d817255e1bed6dfd4ca47258685d14d2bdcfbc64fdc9e3819bd5848057b8ecc"
 
 [[package]]
-name = "unsafe-libyaml"
-version = "0.2.10"
+name = "unicode-vo"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab4c90930b95a82d00dc9e9ac071b4991924390d46cbd0dfe566148667605e4b"
+checksum = "b1d386ff53b415b7fe27b50bb44679e2cc4660272694b7b6f3326d8480823a94"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
 
 [[package]]
 name = "url"
@@ -1805,6 +2413,74 @@ dependencies = [
  "form_urlencoded",
  "idna",
  "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
+name = "usvg"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b0a51b72ab80ca511d126b77feeeb4fb1e972764653e61feac30adc161a756"
+dependencies = [
+ "base64",
+ "log",
+ "pico-args",
+ "usvg-parser",
+ "usvg-text-layout",
+ "usvg-tree",
+ "xmlwriter",
+]
+
+[[package]]
+name = "usvg-parser"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bd4e3c291f45d152929a31f0f6c819245e2921bfd01e7bd91201a9af39a2bdc"
+dependencies = [
+ "data-url",
+ "flate2",
+ "imagesize",
+ "kurbo",
+ "log",
+ "roxmltree 0.19.0",
+ "simplecss",
+ "siphasher",
+ "svgtypes",
+ "usvg-tree",
+]
+
+[[package]]
+name = "usvg-text-layout"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d383a3965de199d7f96d4e11a44dd859f46e86de7f3dca9a39bf82605da0a37c"
+dependencies = [
+ "fontdb",
+ "kurbo",
+ "log",
+ "rustybuzz",
+ "unicode-bidi",
+ "unicode-script",
+ "unicode-vo",
+ "usvg-tree",
+]
+
+[[package]]
+name = "usvg-tree"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee3d202ebdb97a6215604b8f5b4d6ef9024efd623cf2e373a6416ba976ec7d3"
+dependencies = [
+ "rctree",
+ "strict-num",
+ "svgtypes",
+ "tiny-skia-path",
 ]
 
 [[package]]
@@ -1841,16 +2517,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
-name = "wasite"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
-
-[[package]]
 name = "wasm-bindgen"
-version = "0.2.91"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f"
+checksum = "b1223296a201415c7fad14792dbefaace9bd52b62d33453ade1c5b5f07555406"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -1858,24 +2528,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.91"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b"
+checksum = "fcdc935b63408d58a32f8cc9738a0bffd8f05cc7c002086c6ef20b7312ad9dcd"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.41"
+version = "0.4.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877b9c3f61ceea0e56331985743b13f3d25c406a7098d45180fb5f09bc19ed97"
+checksum = "bde2032aeb86bdfaecc8b261eef3cba735cc426c1f3a3416d1e0791be95fc461"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -1885,9 +2555,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.91"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed"
+checksum = "3e4c238561b2d428924c49815533a8b9121c664599558a5d9ec51f8a1740a999"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1895,56 +2565,54 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.91"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66"
+checksum = "bae1abb6806dc1ad9e560ed242107c0f6c84335f1749dd4e8ddb012ebd5e25a7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.91"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
+checksum = "4d91413b1c31d7539ba5ef2451af3f0b833a005eb27a631cec32bc0635a8602b"
 
 [[package]]
 name = "web-sys"
-version = "0.3.68"
+version = "0.3.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96565907687f7aceb35bc5fc03770a8a0471d82e479f25832f54a0e3f4b28446"
+checksum = "58cd2333b6e0be7a39605f0e255892fd7418a682d8da8fe042fe25128794d2ed"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
 ]
 
 [[package]]
-name = "which"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fa5e0c10bf77f44aac573e498d1a82d5fbd5e91f6fc0a99e7be4b38e85e101c"
+name = "web_app_manifest"
+version = "0.0.0"
+source = "git+https://github.com/filips123/WebAppManifestRS?branch=main#477c5bbc7406eec01aea40e18338dafcec78c917"
 dependencies = [
- "either",
- "home",
- "once_cell",
- "rustix",
- "windows-sys 0.52.0",
+ "csscolorparser",
+ "language-tags",
+ "mime 0.4.0-a.0",
+ "parse-display",
+ "serde",
+ "serde_with",
+ "smart-default",
+ "thiserror",
+ "url",
 ]
 
 [[package]]
-name = "whoami"
-version = "1.5.1"
+name = "weezl"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a44ab49fad634e88f55bf8f9bb3abd2f27d7204172a112c7c9987e01c1c94ea9"
-dependencies = [
- "redox_syscall",
- "wasite",
- "web-sys",
-]
+checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"
 
 [[package]]
 name = "winapi"
@@ -1978,6 +2646,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
+name = "windows"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
+dependencies = [
+ "windows-core",
+ "windows-targets 0.52.0",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets 0.52.0",
+]
+
+[[package]]
 name = "windows-sys"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1992,7 +2679,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.3",
+ "windows-targets 0.52.0",
 ]
 
 [[package]]
@@ -2012,17 +2699,17 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.3"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d380ba1dc7187569a8a9e91ed34b8ccfc33123bbacb8c0aed2d1ad7f3ef2dc5f"
+checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.3",
- "windows_aarch64_msvc 0.52.3",
- "windows_i686_gnu 0.52.3",
- "windows_i686_msvc 0.52.3",
- "windows_x86_64_gnu 0.52.3",
- "windows_x86_64_gnullvm 0.52.3",
- "windows_x86_64_msvc 0.52.3",
+ "windows_aarch64_gnullvm 0.52.0",
+ "windows_aarch64_msvc 0.52.0",
+ "windows_i686_gnu 0.52.0",
+ "windows_i686_msvc 0.52.0",
+ "windows_x86_64_gnu 0.52.0",
+ "windows_x86_64_gnullvm 0.52.0",
+ "windows_x86_64_msvc 0.52.0",
 ]
 
 [[package]]
@@ -2033,9 +2720,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.3"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68e5dcfb9413f53afd9c8f86e56a7b4d86d9a2fa26090ea2dc9e40fba56c6ec6"
+checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -2045,9 +2732,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.3"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dab469ebbc45798319e69eebf92308e541ce46760b49b18c6b3fe5e8965b30f"
+checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -2057,9 +2744,9 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.3"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4e9b6a7cac734a8b4138a4e1044eac3404d8326b6c0f939276560687a033fb"
+checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -2069,9 +2756,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.3"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b0ec9c422ca95ff34a78755cfa6ad4a51371da2a5ace67500cf7ca5f232c58"
+checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -2081,9 +2768,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.3"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "704131571ba93e89d7cd43482277d6632589b18ecf4468f591fbae0a8b101614"
+checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -2093,9 +2780,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.3"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42079295511643151e98d61c38c0acc444e52dd42ab456f7ccfd5152e8ecf21c"
+checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -2105,9 +2792,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.3"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0770833d60a970638e989b3fa9fd2bb1aaadcf88963d1659fd7d9990196ed2d6"
+checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
 
 [[package]]
 name = "winreg"
@@ -2120,7 +2807,33 @@ dependencies = [
 ]
 
 [[package]]
-name = "xdg"
-version = "2.5.2"
+name = "xattr"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8da84f1a25939b27f6820d92aed108f83ff920fdf11a7b19366c27c4cda81d4f"
+dependencies = [
+ "libc",
+ "linux-raw-sys",
+ "rustix",
+]
+
+[[package]]
+name = "xmlparser"
+version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "213b7324336b53d2414b2db8537e56544d981803139155afa84f76eeebb7a546"
+checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
+
+[[package]]
+name = "xmlwriter"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
+
+[[package]]
+name = "zune-inflate"
+version = "0.2.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73ab332fe2f6680068f3582b16a24f90ad7096d5d39b974d1c0aff0125116f02"
+dependencies = [
+ "simd-adler32",
+]
diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
new file mode 100644
index 0000000000000..971d5ac16fdea
--- /dev/null
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -0,0 +1,133 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, makeWrapper
+, pkg-config
+, installShellFiles
+, firefox-unwrapped
+, openssl
+, stdenv
+, udev
+, libva
+, mesa
+, libnotify
+, xorg
+, cups
+, pciutils
+, libcanberra-gtk3
+, extraLibs ? [ ]
+, nixosTests
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "firefoxpwa";
+  version = "2.11.1";
+
+  src = fetchFromGitHub {
+    owner = "filips123";
+    repo = "PWAsForFirefox";
+    rev = "v${version}";
+    hash = "sha256-ZD/bTziVmHtQVKejzj+fUXVazCm2PaulS2NZjTribSk=";
+  };
+
+  sourceRoot = "${src.name}/native";
+  buildFeatures = [ "immutable-runtime" ];
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "mime-0.4.0-a.0" = "sha256-LjM7LH6rL3moCKxVsA+RUL9lfnvY31IrqHa9pDIAZNE=";
+      "web_app_manifest-0.0.0" = "sha256-G+kRN8AEmAY1TxykhLmgoX8TG8y2lrv7SCRJlNy0QzA=";
+    };
+  };
+
+  preConfigure = ''
+    sed -i 's;version = "0.0.0";version = "${version}";' Cargo.toml
+    sed -zi 's;name = "firefoxpwa"\nversion = "0.0.0";name = "firefoxpwa"\nversion = "${version}";' Cargo.lock
+    sed -i $'s;DISTRIBUTION_VERSION = \'0.0.0\';DISTRIBUTION_VERSION = \'${version}\';' userchrome/profile/chrome/pwa/chrome.jsm
+  '';
+
+  nativeBuildInputs = [ makeWrapper pkg-config installShellFiles ];
+  buildInputs = [ openssl ];
+
+  FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
+  FFPWA_SYSDATA = "${placeholder "out"}/share/firefoxpwa";
+  completions = "target/${stdenv.targetPlatform.config}/release/completions";
+
+  gtk_modules = map (x: x + x.gtkModule) [ libcanberra-gtk3 ];
+  libs = let libs = lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils ] ++ gtk_modules ++ extraLibs; in lib.makeLibraryPath libs + ":" + lib.makeSearchPathOutput "lib" "lib64" libs;
+
+  postInstall = ''
+    # Runtime
+    mkdir -p $out/share/firefoxpwa
+    cp -Lr ${firefox-unwrapped}/lib/firefox $out/share/firefoxpwa/runtime
+    chmod -R +w $out/share/firefoxpwa
+
+    # UserChrome
+    cp -r userchrome $out/share/firefoxpwa
+
+    # Runtime patching
+    FFPWA_USERDATA=$out/share/firefoxpwa $out/bin/firefoxpwa runtime patch
+
+    # Manifest
+    sed -i "s!/usr/libexec!$out/bin!" manifests/linux.json
+    install -Dm644 manifests/linux.json $out/lib/mozilla/native-messaging-hosts/firefoxpwa.json
+
+    installShellCompletion --cmd firefoxpwa \
+      --bash $completions/firefoxpwa.bash \
+      --fish $completions/firefoxpwa.fish \
+      --zsh $completions/_firefoxpwa
+
+    # AppStream Metadata
+    install -Dm644 packages/appstream/si.filips.FirefoxPWA.metainfo.xml $out/share/metainfo/si.filips.FirefoxPWA.metainfo.xml
+    install -Dm644 packages/appstream/si.filips.FirefoxPWA.svg $out/share/icons/hicolor/scalable/apps/si.filips.FirefoxPWA.svg
+
+    wrapProgram $out/bin/firefoxpwa \
+      --prefix FFPWA_SYSDATA : "$out/share/firefoxpwa" \
+      --prefix LD_LIBRARY_PATH : "$libs" \
+      --suffix-each GTK_PATH : "$gtk_modules"
+
+    wrapProgram $out/bin/firefoxpwa-connector \
+      --prefix FFPWA_SYSDATA : "$out/share/firefoxpwa" \
+      --prefix LD_LIBRARY_PATH : "$libs" \
+      --suffix-each GTK_PATH : "$gtk_modules"
+  '';
+
+  passthru.tests.firefoxpwa = nixosTests.firefoxpwa;
+
+  meta = with lib; {
+    description = "A tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)";
+    longDescription = ''
+      Progressive Web Apps (PWAs) are web apps that use web APIs and features along
+      with progressive enhancement strategy to bring a native app-like user experience
+      to cross-platform web applications. Although Firefox supports many of Progressive
+      Web App APIs, it does not support functionality to install them as a standalone
+      system app with an app-like experience.
+
+      This project creates a custom modified Firefox runtime to allow websites to be
+      installed as standalone apps and provides a console tool and browser extension
+      to install, manage and use them.
+
+      This package contains only the native part of the PWAsForFirefox project. You
+      should also install the browser extension if you haven't already. You can download
+      it from the [Firefox Add-ons](https://addons.mozilla.org/firefox/addon/pwas-for-firefox/)
+      website.
+
+      To install the package on NixOS, you need to add the following options:
+
+      ```
+      programs.firefox.nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
+      environment.systemPackages = [ pkgs.firefoxpwa ];
+      ```
+
+      As it needs to be both in the `PATH` and in the `nativeMessagingHosts` to make it
+      possible for the extension to detect and use it.
+    '';
+    homepage = "https://pwasforfirefox.filips.si/";
+    changelog = "https://github.com/filips123/PWAsForFirefox/releases/tag/v${version}";
+    license = licenses.mpl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ camillemndn pasqui23 ];
+    mainProgram = "firefoxpwa";
+  };
+}
diff --git a/pkgs/by-name/fo/forbidden/package.nix b/pkgs/by-name/fo/forbidden/package.nix
new file mode 100644
index 0000000000000..adbd83ada4b08
--- /dev/null
+++ b/pkgs/by-name/fo/forbidden/package.nix
@@ -0,0 +1,51 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "forbidden";
+  version = "10.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ivan-sincek";
+    repo = "forbidden";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-jitmgN+We6m5CTgRc1NYwZkg5GYvD6ZlJ8FKtTa+rAY=";
+  };
+
+  pythonRemoveDeps = [
+    # https://github.com/ivan-sincek/forbidden/pull/3
+    "argparse"
+  ];
+
+  build-system = with python3.pkgs; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
+    colorama
+    datetime
+    pycurl
+    pyjwt
+    regex
+    requests
+    tabulate
+    termcolor
+  ];
+
+  pythonImportsCheck = [
+    "forbidden"
+  ];
+
+  meta = with lib; {
+    description = "Tool to bypass 4xx HTTP response status code";
+    homepage = "https://github.com/ivan-sincek/forbidden";
+    changelog = "https://github.com/ivan-sincek/forbidden/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "forbidden";
+  };
+}
diff --git a/pkgs/by-name/fr/frankenphp/package.nix b/pkgs/by-name/fr/frankenphp/package.nix
index 90d10fc87f40f..e6ce4c97d2b08 100644
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@@ -26,13 +26,13 @@ let
   pieBuild = stdenv.hostPlatform.isMusl;
 in buildGoModule rec {
   pname = "frankenphp";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "dunglas";
     repo = "frankenphp";
     rev = "v${version}";
-    hash = "sha256-tQ35GZuw7Ag1YfmOUarVY45yk4yugNLJetEV4m2w3GE=";
+    hash = "sha256-r6BMlcjvRbVnBHsfRhJyMiyZzH2Z+FLOYz6ik4I8p+A=";
   };
 
   sourceRoot = "${src.name}/caddy";
@@ -40,7 +40,7 @@ in buildGoModule rec {
   # frankenphp requires C code that would be removed with `go mod tidy`
   # https://github.com/golang/go/issues/26366
   proxyVendor = true;
-  vendorHash = "sha256-sv3IcNj1rjolgF0HZZnJ3dLV9+QeRw3ItRguz6Un9CY=";
+  vendorHash = "sha256-gxBD2KPkWtAM0MsaQ9Ed4QDjJCg1uJQpXvnCOnAsZTw=";
 
   buildInputs = [ phpUnwrapped brotli ] ++ phpUnwrapped.buildInputs;
   nativeBuildInputs = [ makeBinaryWrapper ] ++ lib.optionals stdenv.isDarwin [ pkg-config darwin.cctools darwin.autoSignDarwinBinariesHook ];
diff --git a/pkgs/by-name/ga/gat/package.nix b/pkgs/by-name/ga/gat/package.nix
new file mode 100644
index 0000000000000..bfa31daee5f3a
--- /dev/null
+++ b/pkgs/by-name/ga/gat/package.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "gat";
+  version = "0.17.0";
+
+  src = fetchFromGitHub {
+    owner = "koki-develop";
+    repo = "gat";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-aQ7EEB+yJ78vT/LskYsnUya6rIID1AvdaUWzr1oWV3k=";
+  };
+
+  vendorHash = "sha256-q6g3pXWKIWanGPxOxsKUEuP8Hcc31GCm64RbOAhQTfE=";
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/koki-develop/gat/cmd.version=v${version}"
+  ];
+
+  meta = with lib; {
+    description = "Cat alternative written in Go";
+    license = licenses.mit;
+    homepage = "https://github.com/koki-develop/gat";
+    maintainers = with maintainers; [ themaxmur ];
+    mainProgram = "gat";
+  };
+}
diff --git a/pkgs/by-name/gn/gnucap/package.nix b/pkgs/by-name/gn/gnucap/package.nix
index d50e6eb8712d1..b80e46b42d51a 100644
--- a/pkgs/by-name/gn/gnucap/package.nix
+++ b/pkgs/by-name/gn/gnucap/package.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
         propagatedBuildInputs = selectedPlugins;
 
-        phases = [ "installPhase" "fixupPhase" ];
+        dontUnpack = true;
 
         installPhase = ''
           mkdir -p $out/bin
diff --git a/pkgs/by-name/gr/graphicsmagick/imagemagick-compat.nix b/pkgs/by-name/gr/graphicsmagick/imagemagick-compat.nix
new file mode 100644
index 0000000000000..9e278da037bc8
--- /dev/null
+++ b/pkgs/by-name/gr/graphicsmagick/imagemagick-compat.nix
@@ -0,0 +1,48 @@
+{ lib
+, graphicsmagick
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "graphicsmagick-imagemagick-compat";
+  inherit (graphicsmagick) version;
+
+  outputs = [ "out" "man" ];
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  # TODO: symlink libraries?
+  installPhase = let
+    utilities = [
+      "animate"
+      "composite"
+      "conjure"
+      "convert"
+      "display"
+      "identify"
+      "import"
+      "mogrify"
+      "montage"
+    ];
+    linkUtilityBin = utility: ''
+      ln -s ${lib.getExe graphicsmagick} "$out/bin/${utility}"
+    '';
+    linkUtilityMan = utility: ''
+      ln -s ${lib.getMan graphicsmagick}/share/man/man1/gm.1.gz "$man/share/man/man1/${utility}.1.gz"
+    '';
+  in ''
+    runHook preInstall
+
+    mkdir -p "$out"/bin
+    ${lib.concatStringsSep "\n" (map linkUtilityBin utilities)}
+    mkdir -p "$man"/share/man/man1
+    ${lib.concatStringsSep "\n" (map linkUtilityMan utilities)}
+
+    runHook postInstall
+  '';
+
+  meta = graphicsmagick.meta // {
+    description = "A repack of GraphicsMagick that provides compatibility with ImageMagick interfaces";
+  };
+}
diff --git a/pkgs/by-name/gr/graphicsmagick/package.nix b/pkgs/by-name/gr/graphicsmagick/package.nix
new file mode 100644
index 0000000000000..fb6a9fbd29af0
--- /dev/null
+++ b/pkgs/by-name/gr/graphicsmagick/package.nix
@@ -0,0 +1,105 @@
+{ lib
+, bzip2
+, callPackage
+, coreutils
+, fetchurl
+, fixDarwinDylibNames
+, freetype
+, ghostscript
+, graphviz
+, libX11
+, libjpeg
+, libpng
+, libtiff
+, libtool
+, libwebp
+, libxml2
+, nukeReferences
+, quantumdepth ? 8
+, runCommand
+, stdenv
+, xz
+, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "graphicsmagick";
+  version = "1.3.43";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${finalAttrs.version}.tar.xz";
+    hash = "sha256-K4hYBzLNfkCdniLGEWI4vvSuBvzaEUUb8z0ln5y/OZ8=";
+  };
+
+  outputs = [ "out" "man" ];
+
+  buildInputs = [
+    bzip2
+    freetype
+    ghostscript
+    graphviz
+    libX11
+    libjpeg
+    libpng
+    libtiff
+    libtool
+    libwebp
+    libxml2
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    nukeReferences
+    xz
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+
+  configureFlags = [
+    # specify delegates explicitly otherwise `gm` will invoke the build
+    # coreutils for filetypes it doesn't natively support.
+    "MVDelegate=${lib.getExe' coreutils "mv"}"
+    (lib.enableFeature true "shared")
+    (lib.withFeature true "frozenpaths")
+    (lib.withFeatureAs true "quantum-depth" (toString quantumdepth))
+    (lib.withFeatureAs true "gslib" "yes")
+  ];
+
+  # Remove CFLAGS from the binaries to avoid closure bloat.
+  # In the past we have had -dev packages in the closure of the binaries soley
+  # due to the string references.
+  postConfigure = ''
+    nuke-refs -e $out ./magick/magick_config.h
+  '';
+
+  postInstall = ''
+    sed -i 's/-ltiff.*'\'/\'/ $out/bin/*
+  '';
+
+  passthru = {
+    imagemagick-compat = callPackage ./imagemagick-compat.nix {
+      graphicsmagick = finalAttrs.finalPackage;
+    };
+    tests = {
+      issue-157920 = runCommand "issue-157920-regression-test" {
+        buildInputs = [ finalAttrs.finalPackage ];
+      } ''
+        gm convert ${graphviz}/share/doc/graphviz/neatoguide.pdf jpg:$out
+      '';
+    };
+  };
+
+  meta = {
+    homepage = "http://www.graphicsmagick.org";
+    description = "Swiss army knife of image processing";
+    longDescription = ''
+      GraphicsMagick is the swiss army knife of image processing, providing a
+      robust and efficient collection of tools and libraries which support
+      reading, writing, and manipulating an image in over 92 major formats
+      including important formats like DPX, GIF, JPEG, JPEG-2000, JXL, PNG, PDF,
+      PNM, TIFF, and WebP.
+    '';
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    mainProgram = "gm";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/hy/hyprcursor/package.nix b/pkgs/by-name/hy/hyprcursor/package.nix
index 37add539a5304..fa86f0f0f2f20 100644
--- a/pkgs/by-name/hy/hyprcursor/package.nix
+++ b/pkgs/by-name/hy/hyprcursor/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprcursor";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprcursor";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-m5I69a5t+xXxNMQrFuzKgPR6nrFiWDEDnEqlVwTy4C4=";
+    hash = "sha256-e6+fu30inlTIdflotS6l7qYusslKMNkhZVNLn9ZSogg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/incus/529.patch b/pkgs/by-name/in/incus/529.patch
new file mode 100644
index 0000000000000..5e4156b907ca3
--- /dev/null
+++ b/pkgs/by-name/in/incus/529.patch
@@ -0,0 +1,29 @@
+From 32a4beecbf8098fdbb15ef5f36088956922630f7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber@stgraber.org>
+Date: Fri, 23 Feb 2024 18:47:15 -0500
+Subject: [PATCH] incusd/device/disk: Fix incorrect block volume usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
+---
+ internal/server/device/disk.go | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/internal/server/device/disk.go b/internal/server/device/disk.go
+index 0d19e21139..4f9a3e7c1b 100644
+--- a/internal/server/device/disk.go
++++ b/internal/server/device/disk.go
+@@ -339,6 +339,11 @@ func (d *disk) validateConfig(instConf instance.ConfigReader) error {
+ 				var usedBy []string
+ 
+ 				err = storagePools.VolumeUsedByInstanceDevices(d.state, d.pool.Name(), storageProjectName, &dbVolume.StorageVolume, true, func(inst db.InstanceArgs, project api.Project, usedByDevices []string) error {
++					// Don't count the current instance.
++					if d.inst != nil && d.inst.Project().Name == inst.Project && d.inst.Name() == inst.Name {
++						return nil
++					}
++
+ 					usedBy = append(usedBy, inst.Name)
+ 
+ 					return nil
diff --git a/pkgs/by-name/in/incus/client.nix b/pkgs/by-name/in/incus/client.nix
index 76f792377b100..5d69725ba59dd 100644
--- a/pkgs/by-name/in/incus/client.nix
+++ b/pkgs/by-name/in/incus/client.nix
@@ -1,28 +1,28 @@
 {
   lts ? false,
+  meta,
+  patches,
+  src,
+  vendorHash,
+  version,
 
   lib,
   buildGoModule,
-  fetchpatch,
-  fetchFromGitHub,
   installShellFiles,
 }:
 let
-  releaseFile = if lts then ./lts.nix else ./latest.nix;
-  inherit (import releaseFile { inherit fetchpatch; }) version hash vendorHash;
+  pname = "incus${lib.optionalString lts "-lts"}-client";
 in
 
-buildGoModule rec {
-  pname = "incus-client";
-
-  inherit vendorHash version;
-
-  src = fetchFromGitHub {
-    owner = "lxc";
-    repo = "incus";
-    rev = "refs/tags/v${version}";
-    inherit hash;
-  };
+buildGoModule {
+  inherit
+    meta
+    patches
+    pname
+    src
+    vendorHash
+    version
+    ;
 
   CGO_ENABLED = 0;
 
@@ -41,14 +41,4 @@ buildGoModule rec {
 
   # don't run the full incus test suite
   doCheck = false;
-
-  meta = {
-    description = "Powerful system container and virtual machine manager";
-    homepage = "https://linuxcontainers.org/incus";
-    changelog = "https://github.com/lxc/incus/releases/tag/v${version}";
-    license = lib.licenses.asl20;
-    maintainers = lib.teams.lxc.members;
-    platforms = lib.platforms.unix;
-    mainProgram = "incus";
-  };
 }
diff --git a/pkgs/by-name/in/incus/unwrapped.nix b/pkgs/by-name/in/incus/generic.nix
index 7a28737ea3905..f6a8954066c39 100644
--- a/pkgs/by-name/in/incus/unwrapped.nix
+++ b/pkgs/by-name/in/incus/generic.nix
@@ -1,10 +1,18 @@
 {
+  hash,
   lts ? false,
+  patches,
+  updateScriptArgs ? "",
+  vendorHash,
+  version,
+}:
 
+{
+  callPackage,
   lib,
   buildGoModule,
-  fetchpatch,
   fetchFromGitHub,
+  writeScript,
   writeShellScript,
   acl,
   cowsql,
@@ -19,31 +27,28 @@
 }:
 
 let
-  releaseFile = if lts then ./lts.nix else ./latest.nix;
-  inherit (import releaseFile { inherit fetchpatch; })
-    version
-    hash
+  pname = "incus${lib.optionalString lts "-lts"}";
+in
+
+buildGoModule rec {
+  inherit
     patches
+    pname
     vendorHash
+    version
     ;
-  name = "incus${lib.optionalString lts "-lts"}";
-in
-
-buildGoModule {
-  pname = "${name}-unwrapped";
-
-  inherit patches vendorHash version;
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "incus";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     inherit hash;
   };
 
+  # replace with env var > 0.6 https://github.com/lxc/incus/pull/610
   postPatch = ''
     substituteInPlace internal/usbid/load.go \
-      --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
+      --replace-fail "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
   '';
 
   excludedPackages = [
@@ -107,12 +112,23 @@ buildGoModule {
   '';
 
   passthru = {
-    tests.incus = nixosTests.incus;
-
-    updateScript = writeShellScript "update-incus" ''
-      nix-update ${name}.unwrapped -vr 'v(.*)' --override-filename pkgs/by-name/in/incus/${
-        if lts then "lts" else "latest"
-      }.nix
+    client = callPackage ./client.nix {
+      inherit
+        lts
+        meta
+        patches
+        src
+        vendorHash
+        version
+        ;
+    };
+
+    tests = nixosTests.incus;
+
+    ui = callPackage ./ui.nix { };
+
+    updateScript = writeScript "ovs-update.nu" ''
+      ${./update.nu} ${updateScriptArgs}
     '';
   };
 
@@ -123,5 +139,6 @@ buildGoModule {
     license = lib.licenses.asl20;
     maintainers = lib.teams.lxc.members;
     platforms = lib.platforms.linux;
+    mainProgram = "incus";
   };
 }
diff --git a/pkgs/by-name/in/incus/latest.nix b/pkgs/by-name/in/incus/latest.nix
deleted file mode 100644
index 78c09a857488f..0000000000000
--- a/pkgs/by-name/in/incus/latest.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ fetchpatch }:
-{
-  hash = "sha256-tGuAS0lZvoYb+TvmCklQ8TADZhbm4w/lhdI0ycS4/0o=";
-  version = "0.6.0";
-  vendorHash = "sha256-+WmgLOEBJ/7GF596iiTgyTPxn8l+hE6RVqjLKfCi5rs=";
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/lxc/incus/pull/529.patch";
-      hash = "sha256-2aaPrzW/LVJidWeom0rqYOGpT2gvuV1yHLJN/TwQ1fk=";
-    })
-  ];
-}
diff --git a/pkgs/by-name/in/incus/lts.nix b/pkgs/by-name/in/incus/lts.nix
index a78deb48e23b0..1537d4d99bc6f 100644
--- a/pkgs/by-name/in/incus/lts.nix
+++ b/pkgs/by-name/in/incus/lts.nix
@@ -1,3 +1,3 @@
 # this release doesn't exist yet, but satisfay the by-name checks
 # will be added as incus-lts in all-packages.nix once ready
-_: { }
+import ./generic.nix { }
diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix
index 2958ab036ac9f..40fd52de86179 100644
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@@ -1,157 +1,9 @@
-{
-  lts ? false,
-
-  lib,
-  callPackage,
-  linkFarm,
-  makeWrapper,
-  stdenv,
-  symlinkJoin,
-  writeShellScriptBin,
-  acl,
-  apparmor-parser,
-  apparmor-profiles,
-  attr,
-  bash,
-  btrfs-progs,
-  cdrkit,
-  criu,
-  dnsmasq,
-  e2fsprogs,
-  getent,
-  gnutar,
-  gptfdisk,
-  gzip,
-  iproute2,
-  iptables,
-  kmod,
-  lvm2,
-  minio,
-  nftables,
-  OVMF,
-  qemu_kvm,
-  qemu-utils,
-  rsync,
-  spice-gtk,
-  squashfsTools,
-  thin-provisioning-tools,
-  util-linux,
-  virtiofsd,
-  xz,
-}:
-let
-  unwrapped = callPackage ./unwrapped.nix { inherit lts; };
-  client = callPackage ./client.nix { inherit lts; };
-  name = "incus${lib.optionalString lts "-lts"}";
-
-  binPath = lib.makeBinPath [
-    acl
-    attr
-    bash
-    btrfs-progs
-    cdrkit
-    criu
-    dnsmasq
-    e2fsprogs
-    getent
-    gnutar
-    gptfdisk
-    gzip
-    iproute2
-    iptables
-    kmod
-    lvm2
-    minio
-    nftables
-    qemu_kvm
-    qemu-utils
-    rsync
-    squashfsTools
-    thin-provisioning-tools
-    util-linux
-    virtiofsd
-    xz
-
-    (writeShellScriptBin "apparmor_parser" ''
-      exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
-    '')
+import ./generic.nix {
+  hash = "sha256-tGuAS0lZvoYb+TvmCklQ8TADZhbm4w/lhdI0ycS4/0o=";
+  version = "0.6.0";
+  vendorHash = "sha256-+WmgLOEBJ/7GF596iiTgyTPxn8l+hE6RVqjLKfCi5rs=";
+  patches = [
+    # fix storage bug, fixed in > 0.6
+    ./529.patch
   ];
-
-  clientBinPath = [ spice-gtk ];
-
-  ovmf-2mb = OVMF.override {
-    secureBoot = true;
-    fdSize2MB = true;
-  };
-
-  ovmf-4mb = OVMF.override {
-    secureBoot = true;
-    fdSize4MB = true;
-  };
-
-  ovmf-prefix = if stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
-
-  # mimic ovmf from https://github.com/canonical/incus-pkg-snap/blob/3abebe1dfeb20f9b7729556960c7e9fe6ad5e17c/snapcraft.yaml#L378
-  # also found in /snap/incus/current/share/qemu/ on a snap install
-  ovmf = linkFarm "incus-ovmf" [
-    {
-      name = "OVMF_CODE.2MB.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-    {
-      name = "OVMF_CODE.4MB.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-    {
-      name = "OVMF_CODE.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-
-    {
-      name = "OVMF_VARS.2MB.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.2MB.ms.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.4MB.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.4MB.ms.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.ms.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-  ];
-in
-symlinkJoin {
-  name = "${name}-${unwrapped.version}";
-
-  paths = [ unwrapped ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/incusd --prefix PATH : ${lib.escapeShellArg binPath}:${qemu_kvm}/libexec:$out/bin --set INCUS_OVMF_PATH ${ovmf}
-
-    wrapProgram $out/bin/incus --prefix PATH : ${lib.makeBinPath clientBinPath}
-  '';
-
-  passthru = {
-    inherit client unwrapped;
-    ui = callPackage ./ui.nix {};
-
-    inherit (unwrapped) tests;
-  };
-
-  inherit (unwrapped) meta pname version;
 }
diff --git a/pkgs/by-name/in/incus/update.nu b/pkgs/by-name/in/incus/update.nu
new file mode 100755
index 0000000000000..1a0755e8f32d8
--- /dev/null
+++ b/pkgs/by-name/in/incus/update.nu
@@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell common-updater-scripts gnused
+
+def main [--lts = false, --regex: string] {
+  let attr = $"incus(if $lts {"-lts"})"
+  let file = $"(pwd)/pkgs/by-name/in/incus/(if $lts { "lts" } else { "package" }).nix"
+
+  let tags = list-git-tags --url=https://github.com/lxc/incus | lines | sort --natural | str replace v ''
+  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
+  let current_version = nix eval --raw -f default.nix $"($attr).version" | str trim
+
+  if $latest_tag != $current_version {
+    update-source-version $attr $latest_tag $"--file=($file)"
+
+    let oldVendorHash = nix-instantiate . --eval --strict -A $"($attr).goModules.drvAttrs.outputHash" --json | from json
+    let vendorHash = do { nix-build -A $"($attr).goModules" } | complete | get stderr | lines | str trim | find --regex 'got:[[:space:]]*sha256' | split row ' ' | last
+    open $file | str replace $oldVendorHash $vendorHash | save --force $file
+
+  }
+
+  {"lts?": $lts, before: $current_version, after: $latest_tag}
+}
diff --git a/pkgs/applications/networking/insync/default.nix b/pkgs/by-name/in/insync/package.nix
index 844b8648d6c85..b8206c38ce907 100644
--- a/pkgs/applications/networking/insync/default.nix
+++ b/pkgs/by-name/in/insync/package.nix
@@ -1,22 +1,27 @@
 { lib
 , writeShellScript
-, buildFHSEnvBubblewrap
+, buildFHSEnv
 , stdenvNoCC
 , fetchurl
 , autoPatchelfHook
 , dpkg
 , nss
+, cacert
+, alsa-lib
 , libvorbis
 , libdrm
 , libGL
 , wayland
 , xkeyboard_config
 , libthai
+, libsForQt5
 }:
 
 let
   pname = "insync";
-  version = "3.8.6.50504";
+  # Find a binary from https://www.insynchq.com/downloads/linux#ubuntu.
+  version = "3.8.7.50516";
+  ubuntu-dist = "mantic_amd64";
   meta = with lib; {
     platforms = ["x86_64-linux"];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
@@ -35,7 +40,6 @@ let
      Known bug(s):
 
      1) Currently the system try icon does not render correctly.
-     2) libqtvirtualkeyboardplugin does not have necessary Qt library shipped from vendor.
     '';
     mainProgram = "insync";
   };
@@ -45,22 +49,27 @@ let
     inherit version meta;
 
     src = fetchurl {
-      # Find a binary from https://www.insynchq.com/downloads/linux#ubuntu.
-      url = "https://cdn.insynchq.com/builds/linux/insync_${version}-lunar_amd64.deb";
-      sha256 = "sha256-BxTFtQ1rAsOuhKnH5vsl3zkM7WOd+vjA4LKZGxl4jk0=";
+      url = "https://cdn.insynchq.com/builds/linux/insync_${version}-${ubuntu-dist}.deb";
+      sha256 = "sha256-U7BcgghbdR7r9WiZpEOka+BzXwnxrzL6p4imGESuB/k=";
     };
 
+    nativeBuildInputs = [
+      dpkg
+      autoPatchelfHook
+      libsForQt5.qt5.wrapQtAppsHook
+    ];
+
     buildInputs = [
       nss
+      alsa-lib
       libvorbis
       libdrm
       libGL
       wayland
       libthai
+      libsForQt5.qt5.qtvirtualkeyboard
     ];
 
-    nativeBuildInputs = [ autoPatchelfHook dpkg ];
-
     unpackPhase = ''
       dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner
     '';
@@ -71,15 +80,6 @@ let
       mkdir -p $out
       cp -R usr/* $out/
 
-      # use system glibc
-      rm $out/lib/insync/{libgcc_s.so.1,libstdc++.so.6}
-
-      # remove badly packaged plugins
-      rm $out/lib/insync/PySide2/plugins/platforminputcontexts/libqtvirtualkeyboardplugin.so
-
-      # remove the unused vendor wrapper
-      rm $out/bin/insync
-
       runHook postInstall
     '';
 
@@ -87,29 +87,25 @@ let
     dontStrip = true;
   };
 
-in buildFHSEnvBubblewrap {
+in buildFHSEnv {
   name = pname;
   inherit meta;
 
   targetPkgs = pkgs: with pkgs; [
-    insync-pkg
     libudev0-shim
+    insync-pkg
   ];
 
-  runScript = writeShellScript "insync-wrapper.sh" ''
-    # QT_STYLE_OVERRIDE was used to suppress a QT warning, it should have no actual effect for this binary.
-    echo Unsetting QT_STYLE_OVERRIDE=$QT_STYLE_OVERRIDE
-    echo Unsetting QT_QPA_PLATFORMTHEME=$QT_QPA_PLATFORMTHEME
-    unset QT_STYLE_OVERRIDE
-    unset QPA_PLATFORMTHEME
+  extraInstallCommands = ''
+    cp -rsHf "${insync-pkg}"/share $out
+  '';
 
+  runScript = writeShellScript "insync-wrapper.sh" ''
     # xkb configuration needed: https://github.com/NixOS/nixpkgs/issues/236365
     export XKB_CONFIG_ROOT=${xkeyboard_config}/share/X11/xkb/
-    echo XKB_CONFIG_ROOT=$XKB_CONFIG_ROOT
 
-    # For debuging:
+    # For debugging:
     # export QT_DEBUG_PLUGINS=1
-    # find -L /usr/share -name "*insync*"
 
     exec /usr/lib/insync/insync "$@"
     '';
@@ -121,6 +117,6 @@ in buildFHSEnvBubblewrap {
   unshareNet    = false;
   unshareUts    = false;
   unshareCgroup = false;
-  # Since "insync start" command starts a daemon, this daemon should die with it.
-  dieWithParent = false;
+
+  dieWithParent = true;
 }
diff --git a/pkgs/by-name/ko/kor/package.nix b/pkgs/by-name/ko/kor/package.nix
index 7fe5937dfba84..ee9d43af7c592 100644
--- a/pkgs/by-name/ko/kor/package.nix
+++ b/pkgs/by-name/ko/kor/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kor";
-  version = "0.3.6";
+  version = "0.3.7";
 
   src = fetchFromGitHub {
     owner = "yonahd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Q2VUc91ecBRr/m9DGYWwuSsH2prB+EKmBoQrekgPvTE=";
+    hash = "sha256-wjq4IkF3agmculIH+WfBAGd0ciJBX9aj4EsmUvje9Aw=";
   };
 
-  vendorHash = "sha256-DRbwM6fKTIlefD0rUmNLlUXrK+t3vNCl4rxHF7m8W10=";
+  vendorHash = "sha256-UN3Zf8eo6kMNNzkGsnqyDVMgE2QXRn4wg+XULu/uBGE=";
 
   preCheck = ''
     HOME=$(mktemp -d)
diff --git a/pkgs/by-name/li/lib60870/package.nix b/pkgs/by-name/li/lib60870/package.nix
new file mode 100644
index 0000000000000..96a062af50a6e
--- /dev/null
+++ b/pkgs/by-name/li/lib60870/package.nix
@@ -0,0 +1,35 @@
+{ cmake
+, lib
+, stdenv
+, fetchFromGitHub
+, gitUpdater
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lib60870";
+  version = "2.3.2";
+
+  src = fetchFromGitHub {
+    owner = "mz-automation";
+    repo = "lib60870";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9o+gWQbpCJb+UZzPNmzGqpWD0QbGjg41is/f1POUEQs=";
+  };
+
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  preConfigure = "cd lib60870-C";
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
+  meta = with lib; {
+    description = "Implementation of the IEC 60870-5-101/104 protocol";
+    homepage = "https://libiec61850.com/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ stv0g ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/li/libation/deps.nix b/pkgs/by-name/li/libation/deps.nix
index b377707cf3348..ef9c17b06974f 100644
--- a/pkgs/by-name/li/libation/deps.nix
+++ b/pkgs/by-name/li/libation/deps.nix
@@ -4,7 +4,7 @@
 { fetchNuGet }: [
   (fetchNuGet { pname = "AAXClean"; version = "1.1.2"; sha256 = "0hxn1giq99rcd6z43ar79awlzyv0mnxpvmarsl2ypi52d3dizf01"; })
   (fetchNuGet { pname = "AAXClean.Codecs"; version = "1.1.3"; sha256 = "0hqj9hslscl110h2mr7mf0lb0s7dczx73mplkpgx1gpshyfg5xj8"; })
-  (fetchNuGet { pname = "AudibleApi"; version = "9.0.0.1"; sha256 = "1j6bigvvldg4m82vb7ry8y06sh3a0q4mdshlsrppq6bivwsalazc"; })
+  (fetchNuGet { pname = "AudibleApi"; version = "9.1.0.1"; sha256 = "131ibkglq5x72lfblbk4d50mmah8iwhws30va8v7qazaxy5rdbm3"; })
   (fetchNuGet { pname = "Avalonia"; version = "11.0.5"; sha256 = "1l8vpw7dmkgll197i42r98ikkl0g08469wkl1kxkcv8f0allgah6"; })
   (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
   (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; sha256 = "05mm7f0jssih3gbzqfgjnfq5cnqa85ihsg0z1897ciihv8qd3waq"; })
@@ -24,7 +24,7 @@
   (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.5"; sha256 = "1bixdr5yzd9spyjc4n2kf1bwg52q3p5akj9xsr25xp310j3kgyxf"; })
   (fetchNuGet { pname = "BouncyCastle.Cryptography"; version = "2.2.1"; sha256 = "13fx7cg5hmk2y33438wjz0c74c0lvbmh8fa33gwldldmf72mwcr8"; })
   (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; sha256 = "1sldkj8lakggn4hnyabjj1fppqh50fkdrr1k99d4gswpbk5kv582"; })
-  (fetchNuGet { pname = "CsvHelper"; version = "30.0.1"; sha256 = "0v01s672zcrd3fjwzh14dihbal3apzyg3dc80k05a90ljk8yh9wl"; })
+  (fetchNuGet { pname = "CsvHelper"; version = "31.0.2"; sha256 = "14x5a81yc3psz5lsafknafbbs19kd05s80lpnyrr225q0w7vfqlk"; })
   (fetchNuGet { pname = "Dinah.Core"; version = "8.0.0.1"; sha256 = "1kfnc7bfs6bmy41rvnybhpfwrd2p4rjgg8jzzajk7v7smci1m04d"; })
   (fetchNuGet { pname = "Dinah.EntityFrameworkCore"; version = "8.0.0.1"; sha256 = "1125s6lypmk447d6pba6kn5r82c552l6ck54a7mgaa9n2448lcn5"; })
   (fetchNuGet { pname = "DynamicData"; version = "7.9.5"; sha256 = "1m9qx8g6na5ka6kd9vhg8gjmxrnkzb6v5cl5yqp1kdjsw4rcwy6x"; })
@@ -51,15 +51,19 @@
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.8.0"; sha256 = "0hjgxcsj5zy27lqk0986m59n5dbplx2vjjla2lsvg4bwg8qa7bpk"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Workspaces.Common"; version = "4.5.0"; sha256 = "1wjwsrnn5frahqciwaxsgalv80fs6xhqy6kcqy7hcsh7jrfc1kjq"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
-  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.0"; sha256 = "05qjnzk1fxybks92y93487l3mj5nghjcwiy360xjgk3jykz3rv39"; })
+  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.2"; sha256 = "1p8fnnkgcvqnszp2ym4cn9ysa3c409yqnq3nrpnwldz6zi42jdgz"; })
   (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.0"; sha256 = "1xhmax0xrvw4lyz1868f1sr3nbrcv3ckr5qnf61c8q9bwj06b9v7"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.2"; sha256 = "09qdjvb2prlhkb08nzdjabwj43wrsc4b83spmig2qj65jp10pgiw"; })
   (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.0"; sha256 = "019r991228nxv1fibsxg5z81rr7ydgy77c9v7yvlx35kfppxq4s3"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.2"; sha256 = "10qsmgh2fbrkikvahgyfs9kvvq7jd648nz169gv9fh92k8rz01ww"; })
   (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.0"; sha256 = "1vcbad0pzkx5wadnd5inglx56x0yybdlxgknbhifdga0bx76j9sa"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.0"; sha256 = "0pa1v87q4hzphv0h020adw7hn84803lrrxylk8h57j93axm5kmm0"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.2"; sha256 = "1j7jvza125nfjzlnyk1kc4w7qqlw1imp47f1zrxfxvwdy51nfsik"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.2"; sha256 = "1i9qyamizqha69x4pcmdr8rjy8pmdmnjcbb3xmlb7jwwzrzjvjhj"; })
   (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.0"; sha256 = "0ngsxk717si11g4a01ah2np8gp8b3k09y23229anr9jrhykr1bw1"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.0"; sha256 = "156v8xr5xk9b7a9ncxjpv30hp0nfgbb0plzd3709sa8g0a7dvi53"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.0"; sha256 = "0jg524cr8j779av1whwk120xajymb8086abn5wzdb4fyrc0ivf8l"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Tools"; version = "8.0.0"; sha256 = "1qm8qscp4g4y4mg5z9i9zp4b17wlhndh4isy78ajw9891yp3cxll"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.2"; sha256 = "1qnb33mqnhbx8r0sn2kj32idv7yzrgnapkh39is8m1qhfp6gmaih"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.2"; sha256 = "0jj4pgmapab646k57587w8byzsdknfpwjqw93m91q5h0carqax6j"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.2"; sha256 = "1wvp7r8nxfj5wlba8qkyfspz5gcj4d8d946s39qifdbasnfa0sv9"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Tools"; version = "8.0.2"; sha256 = "086n9n8hqssmxlyx8449r9pd4jj1pw55d6w9qli3ii1355l0cmr4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "8.0.0"; sha256 = "04m6ywsf9731z24nfd14z0ah8xl06619ba7mkdb4vg8h5jpllsn4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Memory"; version = "8.0.0"; sha256 = "0bv8ihd5i2gwr97qljwf56h8mdwspmlw0zs64qyk608fb3ciwi25"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "8.0.0"; sha256 = "080kab87qgq2kh0ijry5kfdiq9afyzb8s0k3jqi5zbbi540yq4zl"; })
@@ -88,10 +92,10 @@
   (fetchNuGet { pname = "NAudio.Core"; version = "2.2.1"; sha256 = "0ivki33p5mcm7iigya22llgk0p6m4j99sbfmcc38ir1hzpdlaikr"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
   (fetchNuGet { pname = "NPOI"; version = "2.6.2"; sha256 = "19jc9fzbwgs8hydvgbn9qnkncifx9lz0qgrq4jfqv9q1yynh27q2"; })
-  (fetchNuGet { pname = "Octokit"; version = "9.1.0"; sha256 = "02qd23zsr8pffkznb7znq1n2bz9x8y3b6kcz0xp9z98wqxpb9y2k"; })
+  (fetchNuGet { pname = "Octokit"; version = "10.0.0"; sha256 = "19crbmzkqx8bbl6a55n2b9k4ljyml0h6nq78nayz1vl2ji2f0r23"; })
   (fetchNuGet { pname = "Pluralize.NET"; version = "1.0.2"; sha256 = "0187adfnl288v7izgwx1iskgi024nm4l83s898x6pg2j79h8gxdv"; })
-  (fetchNuGet { pname = "Polly"; version = "8.2.0"; sha256 = "0gxdi4sf60vpxsb258v592ykkq9a3dq2awayp99yy9djys8bglks"; })
-  (fetchNuGet { pname = "Polly.Core"; version = "8.2.0"; sha256 = "00b4jbyiyslqvswy4j2lfw0rl0gq8m4v5fj2asb96i6l224bs7d3"; })
+  (fetchNuGet { pname = "Polly"; version = "8.3.0"; sha256 = "1pmh6iwkzgbxn62k1g1agwzgqdbq8g0yj5wslyxknpri6pyx9y5c"; })
+  (fetchNuGet { pname = "Polly.Core"; version = "8.3.0"; sha256 = "16bkagvrpfr58lfmzyxic1dzmxxbi0vkgd8jfyfbaa6nscadf8xb"; })
   (fetchNuGet { pname = "ReactiveUI"; version = "18.3.1"; sha256 = "1lxkc8yk9glj0w9n5vry2dnwwvh8152ad2c5bivk8aciq64zidyn"; })
   (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
   (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
@@ -123,7 +127,6 @@
   (fetchNuGet { pname = "runtime.win.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "16fbn4bcynad1ygdq0yk1wmckvs8jvrrf104xa5dc2hlc8y3x58f"; })
   (fetchNuGet { pname = "runtime.win.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1700famsxndccfbcdz9q14qb20p49lax67mqwpgy4gx3vja1yczr"; })
   (fetchNuGet { pname = "Serilog"; version = "2.10.0"; sha256 = "08bih205i632ywryn3zxkhb15dwgyaxbhmm1z3b5nmby9fb25k7v"; })
-  (fetchNuGet { pname = "Serilog"; version = "2.12.0"; sha256 = "0lqxpc96qcjkv9pr1rln7mi4y7n7jdi4vb36c2fv3845w1vswgr4"; })
   (fetchNuGet { pname = "Serilog"; version = "2.8.0"; sha256 = "0fnrs05yjnni06mbax7ig74wiiqjyyhrxmr1hrhlpwcmc40zs4ih"; })
   (fetchNuGet { pname = "Serilog"; version = "3.1.0"; sha256 = "1fd3hwhsicjmav56ff6d8x6lmalggy52kvw2mb85hz13w2kw086l"; })
   (fetchNuGet { pname = "Serilog"; version = "3.1.1"; sha256 = "0ck51ndmaqflsri7yyw5792z42wsp91038rx2i6vg7z4r35vfvig"; })
@@ -131,7 +134,7 @@
   (fetchNuGet { pname = "Serilog.Settings.Configuration"; version = "8.0.0"; sha256 = "0245gvndwbj4nbp8q09vp7w4i9iddxr0vzda2c3ja5afz1zgs395"; })
   (fetchNuGet { pname = "Serilog.Sinks.Console"; version = "5.0.0"; sha256 = "0qk5b9vfgzx00a1c2rnih2p3jlcc88vdi9ar5cpwv1jb09x6brah"; })
   (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
-  (fetchNuGet { pname = "Serilog.Sinks.ZipFile"; version = "1.0.1"; sha256 = "18swb04gk0hxwcbc4gndkpl8jgj643f8fga3w26sjkx6r2nhg35q"; })
+  (fetchNuGet { pname = "Serilog.Sinks.ZipFile"; version = "3.1.1"; sha256 = "0m7a8ygfwx90n86qmkpfdgn4wvi94vwxi6m9mhx8gy25wsw1g2jv"; })
   (fetchNuGet { pname = "SharpZipLib"; version = "1.3.3"; sha256 = "1gij11wfj1mqm10631cjpnhzw882bnzx699jzwhdqakxm1610q8x"; })
   (fetchNuGet { pname = "SixLabors.Fonts"; version = "1.0.0"; sha256 = "1lsc789fqsnh3jx5w0g5k2n1wlww58zyzrcf5rs3wx2fjrqi084k"; })
   (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "2.1.4"; sha256 = "0rbv3a20ar73vy6mnj10s245lpninvjz7rhrmqz9vxq42k6g8diy"; })
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index 5a54f2d30a825..cad371b8919f2 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -19,13 +19,13 @@
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "11.3.1";
+  version = "11.3.6";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     rev = "v${version}";
-    hash = "sha256-oTqV1pmjjxzLdvEIUmg3cRFhnPG69yHMbSd9ZBv+XVE=";
+    hash = "sha256-LH8p14oMjqo648h0TYClutPx19v5cWa9ffUlxuPWX5o=";
   };
 
   sourceRoot = "${src.name}/Source";
diff --git a/pkgs/by-name/li/libhttpserver/package.nix b/pkgs/by-name/li/libhttpserver/package.nix
new file mode 100644
index 0000000000000..d8e6ce8c3ab5a
--- /dev/null
+++ b/pkgs/by-name/li/libhttpserver/package.nix
@@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, autoconf
+, automake
+, libtool
+, gnutls
+, libmicrohttpd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libhttpserver";
+  version = "0.19.0";
+
+  src = fetchFromGitHub {
+    owner = "etr";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Pc3Fvd8D4Ymp7dG9YgU58mDceOqNfhWE1JtnpVaNx/Y=";
+  };
+
+  nativeBuildInputs = [ autoconf automake libtool ];
+
+  buildInputs = [ gnutls libmicrohttpd ];
+
+  enableParallelBuilding = true;
+
+  postPatch = ''
+    patchShebangs ./bootstrap
+  '';
+
+  preConfigure = ''
+    ./bootstrap
+  '';
+
+  configureFlags = [ "--enable-same-directory-build" ];
+
+  meta = with lib; {
+    description = "C++ library for creating an embedded Rest HTTP server (and more)";
+    homepage = "https://github.com/etr/libhttpserver";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ pongo1231 ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin; # configure: error: cannot find required auxiliary files: ltmain.sh
+  };
+}
diff --git a/pkgs/by-name/li/libiec61850/package.nix b/pkgs/by-name/li/libiec61850/package.nix
new file mode 100644
index 0000000000000..890f9f746914b
--- /dev/null
+++ b/pkgs/by-name/li/libiec61850/package.nix
@@ -0,0 +1,33 @@
+{ cmake
+, lib
+, stdenv
+, fetchFromGitHub
+, gitUpdater
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libiec61850";
+  version = "1.5.3";
+
+  src = fetchFromGitHub {
+    owner = "mz-automation";
+    repo = "libiec61850";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-SwJjjSapNaVOH5g46MiS9BkzI0fKm/P1xYug3OX5XbA=";
+  };
+
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
+  meta = with lib; {
+    description = "Open-source library for the IEC 61850 protocols";
+    homepage = "https://libiec61850.com/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ stv0g ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/li/libisoburn/package.nix b/pkgs/by-name/li/libisoburn/package.nix
index 03db8b4d39f44..cc870b72a8a85 100644
--- a/pkgs/by-name/li/libisoburn/package.nix
+++ b/pkgs/by-name/li/libisoburn/package.nix
@@ -1,12 +1,16 @@
 { lib
-, stdenv
-, fetchFromGitea
 , acl
 , attr
 , autoreconfHook
+, bzip2
+, fetchFromGitea
 , libburn
+, libcdio
+, libiconv
 , libisofs
 , pkg-config
+, readline
+, stdenv
 , zlib
 }:
 
@@ -28,13 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    attr
+    bzip2
+    libcdio
+    libiconv
+    readline
     zlib
     libburn
     libisofs
+  ] ++ lib.optionals stdenv.isLinux [
+    acl
+    attr
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = lib.optionals stdenv.isLinux [
     acl
   ];
 
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 43ff55742ca16..ca2f4d5149d63 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -16,6 +16,8 @@
 , clblast
 
 , blasSupport ? builtins.all (x: !x) [ cudaSupport metalSupport openclSupport rocmSupport vulkanSupport ]
+, blas
+
 , pkg-config
 , metalSupport ? stdenv.isDarwin && stdenv.isAarch64 && !openclSupport
 , vulkanSupport ? false
@@ -91,9 +93,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
 
   buildInputs = optionals effectiveStdenv.isDarwin darwinBuildInputs
     ++ optionals cudaSupport cudaBuildInputs
-    ++ optionals mpiSupport mpi
+    ++ optionals mpiSupport [ mpi ]
     ++ optionals openclSupport [ clblast ]
     ++ optionals rocmSupport rocmBuildInputs
+    ++ optionals blasSupport [ blas ]
     ++ optionals vulkanSupport vulkanBuildInputs;
 
   cmakeFlags = [
@@ -128,8 +131,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
         # Should likely use `rocmPackages.clr.gpuTargets`.
         "-DAMDGPU_TARGETS=gfx803;gfx900;gfx906:xnack-;gfx908:xnack-;gfx90a:xnack+;gfx90a:xnack-;gfx940;gfx941;gfx942;gfx1010;gfx1012;gfx1030;gfx1100;gfx1101;gfx1102"
       ]
-      ++ optionals metalSupport [ (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1") ]
-      ++ optionals blasSupport [ (cmakeFeature "LLAMA_BLAS_VENDOR" "OpenBLAS") ];
+      ++ optionals metalSupport [ (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1") ];
 
   # upstream plans on adding targets at the cmakelevel, remove those
   # additional steps after that
diff --git a/pkgs/by-name/mi/minijinja/package.nix b/pkgs/by-name/mi/minijinja/package.nix
index 7f1b547c65490..50cc95e53366c 100644
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "minijinja";
-  version = "1.0.13";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "minijinja";
     rev = version;
-    hash = "sha256-VVd90j8ZOubtHX15jMGAIA3LF4tg4SzFxO046QVwDjc=";
+    hash = "sha256-ync0MkLi+CV1g9eBDLcV1dnV101H5Gc6K0NrnVeh8Jw=";
   };
 
-  cargoHash = "sha256-f9hXH0c8vVpexYyuQuS0D8jzEqJSrHOwp/FropTKTJg=";
+  cargoHash = "sha256-j8GLpMU7xwc3BWkjcFmGODiKieedNIB8VbHjJcrq8z4=";
 
   # The tests relies on the presence of network connection
   doCheck = false;
diff --git a/pkgs/by-name/ni/nix-ld-rs/package.nix b/pkgs/by-name/ni/nix-ld-rs/package.nix
new file mode 100644
index 0000000000000..d6514033741ab
--- /dev/null
+++ b/pkgs/by-name/ni/nix-ld-rs/package.nix
@@ -0,0 +1,54 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  nixosTests,
+  rustPlatform,
+  lib,
+}:
+
+rustPlatform.buildRustPackage {
+  name = "nix-ld-rs";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "nix-ld-rs";
+    rev = "f7154a6aedba4917c8cc72b805b79444b5bfafca";
+    sha256 = "sha256-tx6gO6NR4BnYVhoskyvQY9l6/8sK0HwoDHvsYcvIlgo=";
+  };
+
+  cargoHash = "sha256-4IDu5qAgF4Zq4GOsimuy8NiRCN9PXM+8oVzD2GO3QmM=";
+
+  hardeningDisable = [ "stackprotector" ];
+
+  NIX_SYSTEM = stdenv.system;
+  RUSTC_BOOTSTRAP = "1";
+
+  preCheck = ''
+    export NIX_LD=${stdenv.cc.bintools.dynamicLinker}
+  '';
+
+  postInstall = ''
+    mkdir -p $out/libexec
+    ln -s $out/bin/nix-ld-rs $out/libexec/nix-ld-rs
+    ln -s $out/bin/nix-ld-rs $out/libexec/nix-ld
+
+    mkdir -p $out/nix-support
+
+    ldpath=/${stdenv.hostPlatform.libDir}/$(basename ${stdenv.cc.bintools.dynamicLinker})
+    echo "$ldpath" > $out/nix-support/ldpath
+    mkdir -p $out/lib/tmpfiles.d/
+    cat > $out/lib/tmpfiles.d/nix-ld.conf <<EOF
+      L+ $ldpath - - - - $out/libexec/nix-ld-rs
+    EOF
+  '';
+
+  passthru.tests = nixosTests.nix-ld;
+
+  meta = with lib; {
+    description = "Run unpatched dynamic binaries on NixOS (rust version)";
+    homepage = "https://github.com/nix-community/nix-ld-rs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mic92 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/nix-ld/default.nix b/pkgs/by-name/ni/nix-ld/package.nix
index 208c59ab7576e..09b555b077d5d 100644
--- a/pkgs/os-specific/linux/nix-ld/default.nix
+++ b/pkgs/by-name/ni/nix-ld/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/nix-support
 
-    ldpath=/${stdenv.hostPlatform.libDir}/$(basename $(< ${stdenv.cc}/nix-support/dynamic-linker))
+    ldpath=/${stdenv.hostPlatform.libDir}/$(basename ${stdenv.cc.bintools.dynamicLinker})
     echo "$ldpath" > $out/nix-support/ldpath
     mkdir -p $out/lib/tmpfiles.d/
     cat > $out/lib/tmpfiles.d/nix-ld.conf <<EOF
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
-  passthru.tests.nix-ld = nixosTests.nix-ld;
+  passthru.tests = nixosTests.nix-ld;
 
   meta = with lib; {
     description = "Run unpatched dynamic binaries on NixOS";
diff --git a/pkgs/by-name/no/normaliz/package.nix b/pkgs/by-name/no/normaliz/package.nix
index be30696ab8fd2..69755e56b8fa7 100644
--- a/pkgs/by-name/no/normaliz/package.nix
+++ b/pkgs/by-name/no/normaliz/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "normaliz";
-  version = "3.10.1";
+  version = "3.10.2";
 
   src = fetchFromGitHub {
     owner = "normaliz";
     repo = "normaliz";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nnSauTlS5R6wbaoGxR6HFacFYm5r4DAhoP9IVe4ajdc=";
+    hash = "sha256-Q4OktVvFobP25fYggIqBGtSJu2HsYz9Tm+QbEAz0fMg=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/nt/ntfs2btrfs/package.nix b/pkgs/by-name/nt/ntfs2btrfs/package.nix
new file mode 100644
index 0000000000000..fc16e67f850ad
--- /dev/null
+++ b/pkgs/by-name/nt/ntfs2btrfs/package.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, cmake, fmt, lzo, pkg-config, zlib, zstd }:
+
+stdenv.mkDerivation rec {
+  pname = "ntfs2btrfs";
+  version = "20240115";
+
+  src = fetchFromGitHub {
+    owner = "maharmstone";
+    repo = "ntfs2btrfs";
+    rev = "refs/tags/${version}";
+    hash = "sha256-sZ8AWREe2jasy3hqLTjaLcOMCNsrDjz2eIuknA2TsEs=";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  buildInputs = [ fmt lzo zlib zstd ];
+
+  meta = {
+    description = "A CLI tool which does in-place conversion of Microsoft's NTFS filesystem to the open-source filesystem Btrfs";
+    homepage = "https://github.com/maharmstone/ntfs2btrfs";
+    license = with lib.licenses; [ gpl2Only ];
+    maintainers = with lib.maintainers; [ j1nxie ];
+    mainProgram = "ntfs2btrfs";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/om/omniorbpy/package.nix b/pkgs/by-name/om/omniorbpy/package.nix
new file mode 100644
index 0000000000000..66254cdaba21d
--- /dev/null
+++ b/pkgs/by-name/om/omniorbpy/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  omniorb,
+  pkg-config,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "omniorbpy";
+  version = "4.3.2";
+
+  src = fetchurl {
+    url = "http://downloads.sourceforge.net/omniorb/omniORBpy-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-y1cX1BKhAbr0MPWYysfWkjGITa5DctjirfPd7rxffrs=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    omniorb
+  ];
+
+  configureFlags = [
+    "--with-omniorb=${omniorb}"
+    "PYTHON_PREFIX=$out"
+    "PYTHON=${lib.getExe python3}"
+  ];
+
+  # Transform omniidl_be into a PEP420 namespace
+  postInstall = ''
+    rm $out/${python3.sitePackages}/omniidl_be/__init__.py
+    rm $out/${python3.sitePackages}/omniidl_be/__pycache__/__init__.*.pyc
+  '';
+
+  # Ensure both python & cxx backends are available
+  doInstallCheck = true;
+  postInstallCheck = ''
+    export PYTHONPATH=$out/${python3.sitePackages}:${omniorb}/${python3.sitePackages}:$PYTHONPATH
+    ${lib.getExe python3} -c "import omniidl_be.cxx; import omniidl_be.python"
+  '';
+
+
+  meta = with lib; {
+    description = "The python backend for omniorb";
+    homepage = "http://omniorb.sourceforge.net";
+    license = with licenses; [ gpl2Plus lgpl21Plus ];
+    maintainers = with maintainers; [ nim65s ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/pr/primecount/package.nix b/pkgs/by-name/pr/primecount/package.nix
index 791acca6ae5d5..84b67e106ffd4 100644
--- a/pkgs/by-name/pr/primecount/package.nix
+++ b/pkgs/by-name/pr/primecount/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "primecount";
-  version = "7.10";
+  version = "7.11";
 
   src = fetchFromGitHub {
     owner = "kimwalisch";
     repo = "primecount";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-z7sHGR6zZSTV1PbL0WPGHf52CYQ572KC1yznCuIEJbQ=";
+    hash = "sha256-rk2aN56gcrR7Rt3hIQun179YNWqnW/g6drB2ldBpoE4=";
   };
 
   outputs = [ "out" "dev" "lib" "man" ];
diff --git a/pkgs/by-name/pu/puncia/package.nix b/pkgs/by-name/pu/puncia/package.nix
new file mode 100644
index 0000000000000..89e0850e0f54f
--- /dev/null
+++ b/pkgs/by-name/pu/puncia/package.nix
@@ -0,0 +1,42 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "puncia";
+  version = "0.15-unstable-2024-03-23";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ARPSyndicate";
+    repo = "puncia";
+    # https://github.com/ARPSyndicate/puncia/issues/5
+    rev = "c70ed93ea1e7e42e12dd9c14713cab71bb0e0fe9";
+    hash = "sha256-xGJk8y26tluHUPm9ikrBBiWGuzq6MKl778BF8wNDmps=";
+  };
+
+  build-system = with python3.pkgs; [
+    setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
+    requests
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "puncia"
+  ];
+
+  meta = with lib; {
+    description = "CLI utility for Subdomain Center & Exploit Observer";
+    homepage = "https://github.com/ARPSyndicate/puncia";
+    # https://github.com/ARPSyndicate/puncia/issues/6
+    license = licenses.unfree;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "puncia";
+  };
+}
diff --git a/pkgs/by-name/ri/ricochet-refresh/package.nix b/pkgs/by-name/ri/ricochet-refresh/package.nix
index 384932ed7c857..4d753b760d696 100644
--- a/pkgs/by-name/ri/ricochet-refresh/package.nix
+++ b/pkgs/by-name/ri/ricochet-refresh/package.nix
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ricochet-refresh";
-  version = "3.0.18";
+  version = "3.0.22";
 
   src = fetchFromGitHub {
     owner = "blueprint-freespeech";
     repo = "ricochet-refresh";
     rev = "v${finalAttrs.version}-release";
-    hash = "sha256-QN2cxcYWGoszPdrWv+4FoTGNjQViK/OwxbBC6uoDhfA=";
+    hash = "sha256-xPOAtH+K3WTPjbDw4ZhwpO2+wUYe5JdqKdtfNKQbgSM=";
     fetchSubmodules = true;
   };
 
@@ -75,6 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.ricochetrefresh.net/";
     downloadPage = "https://github.com/blueprint-freespeech/ricochet-refresh/releases";
     license = lib.licenses.bsd3;
-    platforms = lib.platforms.unix;
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/sc/screenly-cli/package.nix b/pkgs/by-name/sc/screenly-cli/package.nix
index 3c18ef4f809c2..b2f0cf70ccf7b 100644
--- a/pkgs/by-name/sc/screenly-cli/package.nix
+++ b/pkgs/by-name/sc/screenly-cli/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "screenly-cli";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "screenly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DSeI7ddsdsb+DLVPRyqpvz6WIRFBBaWjYJHlFpN8SrY=";
+    hash = "sha256-lRvJuoGxuKeijdFkJp6Gm+zXAhomYdSKCt8ng0cPjZg=";
   };
 
-  cargoHash = "sha256-W8xFOotHxFlBZhEUDRTJGsbr+GjG3ALynaoMgTxPPmM=";
+  cargoHash = "sha256-7hgm5i3Wr0qX+l3OihlxgBz6UO975bfC9mMXsYJ9Qhw=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index 8504a28a22a96..107e6ee1fc22d 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.4.29";
+  version = "0.4.30";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-gAn/AkubIwcNBrqBWggVXEmqXuXxjt1xZop0dQ291pA=";
+    hash = "sha256-QfeQ73nTvLavUIpHlTBTkY1GGqZCednlXRBigwPCt48=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
   nativeCheckInputs = [ git dart-sass ];
 
-  vendorHash = "sha256-S7M7B4jtAe1jD6W5q2UewgwG++ecE46Rrp2Qt6kCDeQ=";
+  vendorHash = "sha256-dhOw/38FRQCA90z0DdyIPLrYiQ/tutGsdCb108ZLliU=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"
diff --git a/pkgs/by-name/st/stats/package.nix b/pkgs/by-name/st/stats/package.nix
index 4da58eed1ce1c..76bc6b84735b1 100644
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.10.3";
+  version = "2.10.5";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-PSRK9YihiIHKHade3XE/OnAleBhmu71CNFyzJ/Upx/A=";
+    hash = "sha256-IBliS0RSWlCSLYeSHTapW9B2mPJtZqL7k8jskpXy1F4=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
index 304e94f5ed679..cfdc17ae95f1a 100644
--- a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
+++ b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 let
-  version = "1.58.2";
+  version = "1.62.0";
 in
 buildGoModule {
   pname = "tailscale-nginx-auth";
@@ -11,9 +11,9 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-FiFFfUtse0CKR4XJ82HEjpZNxCaa4FnwSJfEzJ5kZgk=";
+    hash = "sha256-qotoCKUb5INgdSELvJpDaDvCuzVqet5zeIazzRnYoqo=";
   };
-  vendorHash = "sha256-BK1zugKGtx2RpWHDvFZaFqz/YdoewsG8SscGt25uwtQ=";
+  vendorHash = "sha256-jyRjT/CQBlmjHzilxJvMuzZQlGyJB4X/yISgWjBVDxc=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/tu/tunnelgraf/package.nix b/pkgs/by-name/tu/tunnelgraf/package.nix
new file mode 100644
index 0000000000000..d7f2c77dab0a8
--- /dev/null
+++ b/pkgs/by-name/tu/tunnelgraf/package.nix
@@ -0,0 +1,52 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "tunnelgraf";
+  version = "0.6.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "denniswalker";
+    repo = "tunnelgraf";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-CsrbSpp1VszEAKpmHx8GbB7vfZCOvB+tDFNFwWKexEw=";
+  };
+
+  pythonRelaxDeps = [
+    "click"
+    "pydantic"
+  ];
+
+  build-system = with python3.pkgs; [
+    hatchling
+    pythonRelaxDepsHook
+  ];
+
+  dependencies = with python3.pkgs; [
+    click
+    deepmerge
+    paramiko
+    pydantic
+    python-hosts
+    pyyaml
+    sshtunnel
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "tunnelgraf"
+  ];
+
+  meta = with lib; {
+    description = "Tool to manage SSH tunnel hops to many endpoints";
+    homepage = "https://github.com/denniswalker/tunnelgraf";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "tunnelgraf";
+  };
+}
diff --git a/pkgs/by-name/uv/uv/Cargo.lock b/pkgs/by-name/uv/uv/Cargo.lock
index c9f0be4d721f5..35b14d51a7a14 100644
--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@@ -226,9 +226,9 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.77"
+version = "0.1.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c980ee35e870bd1a4d2c8294d4c04d0499e67bca1e4b5cefcc693c2fa00caea9"
+checksum = "461abc97219de0eaaf81fe3ef974a540158f3d079c2ab200f891f1a2ef201e85"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -276,6 +276,52 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
+name = "axoasset"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dce2f189800bafe8322ef3a4d361ee7373bfc2f8fe052afda404230166dc45f"
+dependencies = [
+ "camino",
+ "image",
+ "miette",
+ "mime",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "url",
+ "walkdir",
+]
+
+[[package]]
+name = "axoprocess"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4de46920588aef95658797996130bacd542436aee090084646521260a74bda7d"
+dependencies = [
+ "miette",
+ "thiserror",
+ "tracing",
+]
+
+[[package]]
+name = "axoupdater"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e18b628756d7e73bcd3b7330e5834a44f841b115e92bad8563c3dc616a64131"
+dependencies = [
+ "axoasset",
+ "axoprocess",
+ "camino",
+ "homedir",
+ "miette",
+ "reqwest",
+ "serde",
+ "temp-dir",
+ "thiserror",
+ "tokio",
+]
+
+[[package]]
 name = "backoff"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -470,6 +516,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "camino"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59e92b5a388f549b863a7bea62612c09f24c8393560709a54558a9abdfb3b9c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "cargo-util"
 version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -574,9 +629,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.2"
+version = "4.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b230ab84b0ffdf890d5a10abdbc8b83ae1c4918275daea1ab8801f71536b2651"
+checksum = "949626d00e063efc93b6dca932419ceb5432f99769911c0b995f7e884c778813"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -637,11 +692,11 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.0"
+version = "4.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "307bc0538d5f0f83b8248db3087aa92fe504e4691294d0c96c0eabc33f47ba47"
+checksum = "90239a040c80f5e14809ca132ddc4176ab33d5e17e49691793296e3fcb34d72f"
 dependencies = [
- "heck",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
  "syn 2.0.52",
@@ -838,7 +893,7 @@ version = "3.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "672465ae37dc1bc6380a6547a8883d5dd397b0f1faaad4f265726cc7042a5345"
 dependencies = [
- "nix",
+ "nix 0.28.0",
  "windows-sys 0.52.0",
 ]
 
@@ -886,15 +941,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63dfa964fe2a66f3fde91fc70b267fe193d822c7e603e2a675a49a7f46ad3f49"
 
 [[package]]
-name = "deranged"
-version = "0.3.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
-dependencies = [
- "powerfmt",
-]
-
-[[package]]
 name = "derivative"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -963,8 +1009,6 @@ version = "0.0.1"
 dependencies = [
  "anyhow",
  "cache-key",
- "chrono",
- "data-encoding",
  "distribution-filename",
  "fs-err",
  "itertools 0.12.1",
@@ -977,12 +1021,10 @@ dependencies = [
  "rustc-hash",
  "serde",
  "serde_json",
- "sha2",
  "thiserror",
  "tracing",
  "url",
  "urlencoding",
- "uv-auth",
  "uv-fs",
  "uv-git",
  "uv-normalize",
@@ -1380,7 +1422,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 0.2.12",
- "indexmap 2.2.5",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
@@ -1399,7 +1441,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 1.1.0",
- "indexmap 2.2.5",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
@@ -1438,6 +1480,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
 name = "hermit-abi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1468,6 +1516,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "homedir"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22074da8bba2ef26fc1737ae6c777b5baab5524c2dc403b5c6a76166766ccda5"
+dependencies = [
+ "cfg-if",
+ "nix 0.26.4",
+ "serde",
+ "widestring",
+ "windows-sys 0.48.0",
+ "wmi",
+]
+
+[[package]]
 name = "html-escape"
 version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1675,20 +1737,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "imagesize"
-version = "0.11.0"
+name = "image"
+version = "0.24.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b72ad49b554c1728b1e83254a1b1565aea4161e28dabbfa171fc15fe62299caf"
+checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+ "color_quant",
+ "num-traits",
+]
 
 [[package]]
-name = "indexmap"
-version = "1.9.3"
+name = "imagesize"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
-]
+checksum = "b72ad49b554c1728b1e83254a1b1565aea4161e28dabbfa171fc15fe62299caf"
 
 [[package]]
 name = "indexmap"
@@ -1763,8 +1827,6 @@ dependencies = [
  "tempfile",
  "thiserror",
  "tracing",
- "tracing-subscriber",
- "url",
  "uv-fs",
  "uv-normalize",
  "walkdir",
@@ -1966,15 +2028,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "line-wrap"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30344350a2a51da54c1d53be93fade8a237e545dbcc4bdbe635413f2117cab9"
-dependencies = [
- "safemem",
-]
-
-[[package]]
 name = "linked-hash-map"
 version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2048,6 +2101,15 @@ dependencies = [
 
 [[package]]
 name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
@@ -2057,14 +2119,15 @@ dependencies = [
 
 [[package]]
 name = "miette"
-version = "6.0.1"
+version = "7.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "337e1043bbc086dac9d9674983bef52ac991ce150e09b5b8e35c5a73dd83f66c"
+checksum = "4edc8853320c2a0dab800fbda86253c8938f6ea88510dc92c5f1ed20e794afc1"
 dependencies = [
  "backtrace",
  "backtrace-ext",
+ "cfg-if",
  "miette-derive",
- "owo-colors 3.5.0",
+ "owo-colors",
  "supports-color",
  "supports-hyperlinks",
  "supports-unicode",
@@ -2076,9 +2139,9 @@ dependencies = [
 
 [[package]]
 name = "miette-derive"
-version = "6.0.1"
+version = "7.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e622f2a0dd84cbca79bc6c3c33f4fd7dc69faf992216516aacc1d136102800"
+checksum = "dcf09caffaac8068c346b6df2a7fc27a177fd20b39421a39ce0a211bde679a6c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2151,6 +2214,19 @@ dependencies = [
 
 [[package]]
 name = "nix"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "pin-utils",
+]
+
+[[package]]
+name = "nix"
 version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
@@ -2187,12 +2263,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "num-conv"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-
-[[package]]
 name = "num-traits"
 version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2298,12 +2368,6 @@ checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
 name = "owo-colors"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1b04fb49957986fdce4d6ee7a65027d55d4b6d2265e5848bbb507b58ccfdb6f"
-
-[[package]]
-name = "owo-colors"
 version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "caff54706df99d2a78a5a4e3455ff45448d81ef1bb63c22cd14052ca0e993a3f"
@@ -2401,7 +2465,6 @@ dependencies = [
  "pyo3",
  "pyo3-log",
  "regex",
- "rkyv",
  "serde",
  "serde_json",
  "testing_logger",
@@ -2426,7 +2489,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
 dependencies = [
  "fixedbitset",
- "indexmap 2.2.5",
+ "indexmap",
 ]
 
 [[package]]
@@ -2494,20 +2557,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "plist"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5699cc8a63d1aa2b1ee8e12b9ad70ac790d65788cd36101fa37f87ea46c4cef"
-dependencies = [
- "base64 0.21.7",
- "indexmap 2.2.5",
- "line-wrap",
- "quick-xml",
- "serde",
- "time",
-]
-
-[[package]]
 name = "png"
 version = "0.17.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2536,12 +2585,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
 
 [[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
 name = "ppv-lite86"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2579,12 +2622,13 @@ dependencies = [
 
 [[package]]
 name = "priority-queue"
-version = "1.4.0"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0bda9164fe05bc9225752d54aae413343c36f684380005398a6a8fde95fe785"
+checksum = "509354d8a769e8d0b567d6821b84495c60213162761a732d68ce87c964bd347f"
 dependencies = [
  "autocfg",
- "indexmap 1.9.3",
+ "equivalent",
+ "indexmap",
 ]
 
 [[package]]
@@ -2619,9 +2663,9 @@ dependencies = [
 [[package]]
 name = "pubgrub"
 version = "0.2.1"
-source = "git+https://github.com/astral-sh/pubgrub?rev=addbaf184891d66a2dfd93d241a66d13bfe5de86#addbaf184891d66a2dfd93d241a66d13bfe5de86"
+source = "git+https://github.com/astral-sh/pubgrub?rev=e981e4dfe315582e84e2fd724832fb0e0c50b7aa#e981e4dfe315582e84e2fd724832fb0e0c50b7aa"
 dependencies = [
- "indexmap 2.2.5",
+ "indexmap",
  "log",
  "priority-queue",
  "rustc-hash",
@@ -2637,7 +2681,7 @@ dependencies = [
  "cfg-if",
  "indoc",
  "libc",
- "memoffset",
+ "memoffset 0.9.0",
  "parking_lot 0.12.1",
  "portable-atomic",
  "pyo3-build-config",
@@ -2695,7 +2739,7 @@ version = "0.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c7e9b68bb9c3149c5b0cade5d07f953d6d125eb4337723c4ccdb665f1f96185"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro2",
  "pyo3-build-config",
  "quote",
@@ -2707,8 +2751,6 @@ name = "pypi-types"
 version = "0.0.1"
 dependencies = [
  "chrono",
- "indoc",
- "insta",
  "mailparse",
  "once_cell",
  "pep440_rs",
@@ -2716,9 +2758,6 @@ dependencies = [
  "regex",
  "rkyv",
  "serde",
- "serde_json",
- "tempfile",
- "test-case",
  "thiserror",
  "tracing",
  "url",
@@ -2731,7 +2770,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b80f889b6d413c3f8963a2c7db03f95dd6e1d85e1074137cb2013ea2faa8898"
 dependencies = [
- "indexmap 2.2.5",
+ "indexmap",
  "pep440_rs",
  "pep508_rs",
  "serde",
@@ -2739,15 +2778,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "quick-xml"
-version = "0.31.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1004a344b30a54e2ee58d66a71b32d2db2feb0a31f9a2d302bf0536f15de2a33"
-dependencies = [
- "memchr",
-]
-
-[[package]]
 name = "quote"
 version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2870,7 +2900,7 @@ checksum = "52b1349400e2ffd64a9fb5ed9008e33c0b8ef86bd5bae8f73080839c7082f1d5"
 dependencies = [
  "cfg-if",
  "rustix",
- "windows",
+ "windows 0.54.0",
 ]
 
 [[package]]
@@ -2937,16 +2967,13 @@ dependencies = [
  "indoc",
  "insta",
  "itertools 0.12.1",
- "once_cell",
- "pep440_rs",
  "pep508_rs",
  "regex",
  "reqwest",
+ "reqwest-middleware",
  "serde",
- "serde_json",
  "tempfile",
  "test-case",
- "thiserror",
  "tokio",
  "tracing",
  "unscanny",
@@ -3005,9 +3032,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest-middleware"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88a3e86aa6053e59030e7ce2d2a3b258dd08fc2d337d52f73f6cb480f5858690"
+checksum = "5a735987236a8e238bf0296c7e351b999c188ccc11477f311b82b55c93984216"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3274,12 +3301,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
-name = "safemem"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072"
-
-[[package]]
 name = "same-file"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3675,6 +3696,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "temp-dir"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd16aa9ffe15fe021c6ee3766772132c6e98dfa395a167e16864f61a9cfb71d6"
+
+[[package]]
 name = "tempfile"
 version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3806,37 +3833,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "time"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
-dependencies = [
- "deranged",
- "itoa",
- "num-conv",
- "powerfmt",
- "serde",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
-
-[[package]]
-name = "time-macros"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
 name = "tiny-skia"
 version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3903,6 +3899,7 @@ dependencies = [
  "libc",
  "mio",
  "num_cpus",
+ "parking_lot 0.12.1",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
@@ -3975,9 +3972,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.11"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af06656561d28735e9c1cd63dfd57132c8155426aa6af24f36a00a351f88c48e"
+checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -3996,11 +3993,11 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.22.7"
+version = "0.22.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18769cd1cec395d70860ceb4d932812a0b4d06b1a4bb336745a4d21b9496e992"
+checksum = "c12219811e0c1ba077867254e5ad62ee2c9c190b0d957110750ac0cda1ae96cd"
 dependencies = [
- "indexmap 2.2.5",
+ "indexmap",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -4303,33 +4300,28 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"
+checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
 
 [[package]]
 name = "uv"
-version = "0.1.22"
+version = "0.1.24"
 dependencies = [
  "anstream",
  "anyhow",
  "assert_cmd",
  "assert_fs",
+ "axoupdater",
  "base64 0.21.7",
  "byteorder",
  "chrono",
  "clap",
  "clap_complete_command",
- "console",
- "ctrlc",
- "distribution-filename",
  "distribution-types",
- "dunce",
  "filetime",
  "flate2",
  "fs-err",
- "futures",
- "indexmap 2.2.5",
  "indicatif",
  "indoc",
  "insta",
@@ -4337,18 +4329,14 @@ dependencies = [
  "itertools 0.12.1",
  "miette",
  "mimalloc",
- "owo-colors 4.0.0",
- "pep440_rs",
+ "owo-colors",
  "pep508_rs",
  "platform-tags",
  "predicates",
- "pubgrub",
  "pypi-types",
- "pyproject-toml",
  "regex",
  "requirements-txt",
  "reqwest",
- "rustc-hash",
  "serde",
  "serde_json",
  "tempfile",
@@ -4356,7 +4344,6 @@ dependencies = [
  "thiserror",
  "tikv-jemallocator",
  "tokio",
- "toml",
  "tracing",
  "tracing-durations-export",
  "tracing-subscriber",
@@ -4364,7 +4351,6 @@ dependencies = [
  "unicode-width",
  "url",
  "uv-auth",
- "uv-build",
  "uv-cache",
  "uv-client",
  "uv-dispatch",
@@ -4373,12 +4359,11 @@ dependencies = [
  "uv-installer",
  "uv-interpreter",
  "uv-normalize",
+ "uv-requirements",
  "uv-resolver",
  "uv-traits",
- "uv-version",
  "uv-virtualenv",
  "uv-warnings",
- "which",
 ]
 
 [[package]]
@@ -4398,6 +4383,7 @@ dependencies = [
  "tokio",
  "tracing",
  "url",
+ "urlencoding",
  "wiremock",
 ]
 
@@ -4414,8 +4400,6 @@ dependencies = [
  "once_cell",
  "pep440_rs",
  "pep508_rs",
- "pypi-types",
- "pyproject-toml",
  "regex",
  "rustc-hash",
  "serde",
@@ -4443,6 +4427,8 @@ dependencies = [
  "fs-err",
  "nanoid",
  "pypi-types",
+ "rmp-serde",
+ "rustc-hash",
  "serde",
  "tempfile",
  "tracing",
@@ -4475,7 +4461,6 @@ dependencies = [
  "pep440_rs",
  "pep508_rs",
  "platform-tags",
- "plist",
  "pypi-types",
  "reqwest",
  "reqwest-middleware",
@@ -4487,7 +4472,6 @@ dependencies = [
  "rustls-native-certs",
  "serde",
  "serde_json",
- "sha2",
  "sys-info",
  "task-local-extensions",
  "tempfile",
@@ -4501,7 +4485,6 @@ dependencies = [
  "uv-auth",
  "uv-cache",
  "uv-fs",
- "uv-interpreter",
  "uv-normalize",
  "uv-version",
  "uv-warnings",
@@ -4524,26 +4507,23 @@ dependencies = [
  "install-wheel-rs",
  "itertools 0.12.1",
  "mimalloc",
- "owo-colors 4.0.0",
+ "owo-colors",
  "pep440_rs",
  "pep508_rs",
  "petgraph",
  "platform-tags",
  "poloto",
- "pypi-types",
  "resvg",
  "rustc-hash",
  "serde",
  "serde_json",
  "tagu",
- "tempfile",
  "tikv-jemallocator",
  "tokio",
  "tracing",
  "tracing-durations-export",
  "tracing-indicatif",
  "tracing-subscriber",
- "url",
  "uv-build",
  "uv-cache",
  "uv-client",
@@ -4554,9 +4534,7 @@ dependencies = [
  "uv-normalize",
  "uv-resolver",
  "uv-traits",
- "uv-virtualenv",
  "walkdir",
- "which",
 ]
 
 [[package]]
@@ -4565,25 +4543,18 @@ version = "0.0.1"
 dependencies = [
  "anyhow",
  "distribution-types",
- "fs-err",
  "futures",
  "itertools 0.12.1",
  "pep508_rs",
- "platform-tags",
- "pypi-types",
  "rustc-hash",
- "tempfile",
- "tokio",
  "tracing",
  "uv-build",
  "uv-cache",
  "uv-client",
- "uv-distribution",
  "uv-installer",
  "uv-interpreter",
  "uv-resolver",
  "uv-traits",
- "uv-virtualenv",
 ]
 
 [[package]]
@@ -4603,6 +4574,7 @@ dependencies = [
  "platform-tags",
  "pypi-types",
  "reqwest",
+ "reqwest-middleware",
  "rmp-serde",
  "rustc-hash",
  "serde",
@@ -4628,7 +4600,6 @@ version = "0.0.1"
 dependencies = [
  "async-compression",
  "async_zip",
- "flate2",
  "fs-err",
  "futures",
  "rayon",
@@ -4651,6 +4622,7 @@ dependencies = [
  "fs-err",
  "fs2",
  "junction",
+ "once_cell",
  "tempfile",
  "tokio",
  "tracing",
@@ -4669,13 +4641,10 @@ dependencies = [
  "fs-err",
  "git2",
  "glob",
- "hex",
  "hmac",
  "home",
- "once_cell",
  "rand",
  "reqwest",
- "serde",
  "sha1",
  "tokio",
  "tracing",
@@ -4689,12 +4658,10 @@ version = "0.0.1"
 dependencies = [
  "anyhow",
  "async-channel",
- "distribution-filename",
  "distribution-types",
  "fs-err",
  "futures",
  "install-wheel-rs",
- "once-map",
  "pep440_rs",
  "pep508_rs",
  "platform-tags",
@@ -4715,7 +4682,6 @@ dependencies = [
  "uv-distribution",
  "uv-extract",
  "uv-fs",
- "uv-git",
  "uv-interpreter",
  "uv-normalize",
  "uv-traits",
@@ -4747,7 +4713,6 @@ dependencies = [
  "serde_json",
  "tempfile",
  "thiserror",
- "tokio",
  "tracing",
  "uv-cache",
  "uv-fs",
@@ -4764,6 +4729,36 @@ dependencies = [
 ]
 
 [[package]]
+name = "uv-requirements"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "configparser",
+ "console",
+ "ctrlc",
+ "distribution-filename",
+ "distribution-types",
+ "fs-err",
+ "futures",
+ "indexmap",
+ "pep508_rs",
+ "pypi-types",
+ "pyproject-toml",
+ "requirements-txt",
+ "rustc-hash",
+ "serde",
+ "toml",
+ "tracing",
+ "uv-client",
+ "uv-distribution",
+ "uv-fs",
+ "uv-normalize",
+ "uv-resolver",
+ "uv-traits",
+ "uv-warnings",
+]
+
+[[package]]
 name = "uv-resolver"
 version = "0.0.1"
 dependencies = [
@@ -4777,43 +4772,34 @@ dependencies = [
  "distribution-filename",
  "distribution-types",
  "either",
- "fs-err",
  "futures",
- "indexmap 2.2.5",
+ "indexmap",
  "insta",
- "install-wheel-rs",
  "itertools 0.12.1",
  "once-map",
  "once_cell",
- "owo-colors 4.0.0",
+ "owo-colors",
  "pep440_rs",
  "pep508_rs",
  "petgraph",
  "platform-tags",
  "pubgrub",
  "pypi-types",
- "reqwest",
+ "requirements-txt",
  "rkyv",
  "rustc-hash",
- "serde_json",
- "sha2",
- "tempfile",
  "thiserror",
  "tokio",
  "tokio-stream",
- "tokio-util",
  "tracing",
  "url",
  "uv-cache",
  "uv-client",
  "uv-distribution",
- "uv-git",
  "uv-interpreter",
  "uv-normalize",
  "uv-traits",
- "uv-virtualenv",
  "uv-warnings",
- "zip",
 ]
 
 [[package]]
@@ -4821,13 +4807,11 @@ name = "uv-traits"
 version = "0.0.1"
 dependencies = [
  "anyhow",
- "clap",
  "distribution-types",
  "once-map",
  "pep508_rs",
  "serde",
  "serde_json",
- "tokio",
  "uv-cache",
  "uv-interpreter",
  "uv-normalize",
@@ -4835,7 +4819,7 @@ dependencies = [
 
 [[package]]
 name = "uv-version"
-version = "0.1.22"
+version = "0.1.24"
 
 [[package]]
 name = "uv-virtualenv"
@@ -4849,16 +4833,12 @@ dependencies = [
  "pathdiff",
  "platform-tags",
  "pypi-types",
- "serde",
- "serde_json",
- "tempfile",
  "thiserror",
  "tracing",
  "tracing-subscriber",
  "uv-cache",
  "uv-fs",
  "uv-interpreter",
- "which",
 ]
 
 [[package]]
@@ -4867,7 +4847,7 @@ version = "0.0.1"
 dependencies = [
  "anstream",
  "once_cell",
- "owo-colors 4.0.0",
+ "owo-colors",
  "rustc-hash",
 ]
 
@@ -5086,6 +5066,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "widestring"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
+
+[[package]]
 name = "winapi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5118,6 +5104,18 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
+dependencies = [
+ "windows-core 0.52.0",
+ "windows-implement",
+ "windows-interface",
+ "windows-targets 0.52.4",
+]
+
+[[package]]
+name = "windows"
 version = "0.54.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9252e5725dbed82865af151df558e754e4a3c2c30818359eb17465f1346a1b49"
@@ -5146,6 +5144,28 @@ dependencies = [
 ]
 
 [[package]]
+name = "windows-implement"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12168c33176773b86799be25e2a2ba07c7aab9968b37541f1094dbd7a60c8946"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.52",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d8dc32e0095a7eeccebd0e3f09e9509365ecb3fc6ac4d6f5f14a3f6392942d1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.52",
+]
+
+[[package]]
 name = "windows-result"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5330,6 +5350,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "wmi"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc2f0a4062ca522aad4705a2948fd4061b3857537990202a8ddd5af21607f79a"
+dependencies = [
+ "chrono",
+ "futures",
+ "log",
+ "serde",
+ "thiserror",
+ "windows 0.52.0",
+]
+
+[[package]]
 name = "wyz"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 322a47bb761f1..454ffb1503081 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -11,20 +11,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uv";
-  version = "0.1.22";
+  version = "0.1.24";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     rev = version;
-    hash = "sha256-AbixSkwyhj3eBMLvGlodpz7XE3ln0IokNMdu5SOZjOE=";
+    hash = "sha256-XsBTfe2+J5CGdjYZjhgxiP20OA7+VTCvD9JniLOjhKs=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "async_zip-0.0.16" = "sha256-M94ceTCtyQc1AtPXYrVGplShQhItqZZa/x5qLiL+gs0=";
-      "pubgrub-0.2.1" = "sha256-Pn60v5tfpGrssCeuaUcxw5eJ1g8Dk/+un0s8+k4abpo=";
+      "pubgrub-0.2.1" = "sha256-SdgxoJ37cs+XwWRCFX4uKhJ9Juu9R/jENb6tzUMam4k=";
     };
   };
 
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index 26c9efec448ae..17fb994f2ba47 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -24,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vesktop";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "Vencord";
     repo = "Vesktop";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-27998q9wbaNP1xYY+KHTBeJRfR6Q/K0LNdbRb3YHC6c=";
+    hash = "sha256-OyAGzlwwdEKBbJJ7h3glwx/THy2VvUn/kA/Df3arWQU=";
   };
 
   # NOTE: This requires pnpm 8.10.0 or newer
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
       dontBuild = true;
       dontFixup = true;
       outputHashMode = "recursive";
-      outputHash = "sha256-cnk+KFdvsgG1wGDib7zgIS6/RkrR5EYAHtHcrFSU0Es=";
+      outputHash = "sha256-JLjJZYFMH4YoIFuyXbGUp6lIy+VlYZtmwk2+oUwtTxQ=";
     };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/vidmerger/Cargo.lock b/pkgs/by-name/vi/vidmerger/Cargo.lock
new file mode 100644
index 0000000000000..1d9d03a4cd901
--- /dev/null
+++ b/pkgs/by-name/vi/vidmerger/Cargo.lock
@@ -0,0 +1,750 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+
+[[package]]
+name = "anyhow"
+version = "1.0.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
+
+[[package]]
+name = "assert_cmd"
+version = "2.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed72493ac66d5804837f480ab3766c72bdfab91a65e565fc54fa9e42db0073a8"
+dependencies = [
+ "anstyle",
+ "bstr",
+ "doc-comment",
+ "predicates",
+ "predicates-core",
+ "predicates-tree",
+ "wait-timeout",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+
+[[package]]
+name = "bstr"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05efc5cfd9110c8416e471df0e96702d58690178e206e61b7173706673c93706"
+dependencies = [
+ "memchr",
+ "regex-automata",
+ "serde",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+dependencies = [
+ "atty",
+ "bitflags 1.3.2",
+ "clap_derive",
+ "clap_lex",
+ "indexmap",
+ "once_cell",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae6371b8bdc8b7d3959e9cf7b22d4435ef3e79e138688421ec654acf8c81b008"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "colored"
+version = "1.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f741c91823341bebf717d4c71bda820630ce065443b58bd1b7451af008355"
+dependencies = [
+ "is-terminal",
+ "lazy_static",
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "ctor"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d2301688392eb071b0bf1a37be05c469d3cc4dbbd95df672fe28ab021e6a096"
+dependencies = [
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "diff"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
+
+[[package]]
+name = "difflib"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "either"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+
+[[package]]
+name = "errno"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+
+[[package]]
+name = "home"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "is-terminal"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
+dependencies = [
+ "hermit-abi 0.3.9",
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "k9"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32ddb58b0079a063218472916af599f2753ccb40942cdaba9d1f3fefccef17a9"
+dependencies = [
+ "anyhow",
+ "colored",
+ "diff",
+ "lazy_static",
+ "libc",
+ "proc-macro2",
+ "regex",
+ "syn 1.0.109",
+ "term_size",
+]
+
+[[package]]
+name = "kernel32-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7507624b29483431c0ba2d82aece8ca6cdba9382bff4ddd0f7490560c056098d"
+dependencies = [
+ "winapi 0.2.8",
+ "winapi-build",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.153"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
+
+[[package]]
+name = "memchr"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+
+[[package]]
+name = "nanoid"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ffa00dec017b5b1a8b7cf5e2c008bfda1aa7e0697ac1508b491fdf2622fb4d8"
+dependencies = [
+ "rand",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "os_str_bytes"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+
+[[package]]
+name = "path-slash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498a099351efa4becc6a19c72aa9270598e8fd274ca47052e37455241c88b696"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "predicates"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68b87bfd4605926cdfefc1c3b5f8fe560e3feca9d5552cf68c466d3d8236c7e8"
+dependencies = [
+ "anstyle",
+ "difflib",
+ "predicates-core",
+]
+
+[[package]]
+name = "predicates-core"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b794032607612e7abeb4db69adb4e33590fa6cf1149e95fd7cb00e634b92f174"
+
+[[package]]
+name = "predicates-tree"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "368ba315fb8c5052ab692e68a0eefec6ec57b23a36959c14496f0b0df2c0cecf"
+dependencies = [
+ "predicates-core",
+ "termtree",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "regex"
+version = "1.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+
+[[package]]
+name = "rustix"
+version = "0.38.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+dependencies = [
+ "bitflags 2.4.2",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.53",
+]
+
+[[package]]
+name = "stdext"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a61b4ae487cb43d0479907e74d36f8813e9940bd3b1adcbecc69fe8a0cee3ec"
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7383cd0e49fff4b6b90ca5670bfd3e9d6a733b3f90c686605aa7eec8c4996032"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "system_shutdown"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "035e081d603551d8d78db27d2232913269c749ea67648c369100049820406a14"
+dependencies = [
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "term"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa63644f74ce96fbeb9b794f66aff2a52d601cbd5e80f4b97123e3899f4570f1"
+dependencies = [
+ "kernel32-sys",
+ "winapi 0.2.8",
+]
+
+[[package]]
+name = "term-painter"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcaa948f0e3e38470cd8dc8dcfe561a75c9e43f28075bb183845be2b9b3c08cf"
+dependencies = [
+ "term",
+]
+
+[[package]]
+name = "term_size"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e4129646ca0ed8f45d09b929036bafad5377103edd06e50bf574b353d2b08d9"
+dependencies = [
+ "libc",
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "termtree"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
+
+[[package]]
+name = "textwrap"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "vidmerger"
+version = "0.3.2"
+dependencies = [
+ "assert_cmd",
+ "clap",
+ "ctor",
+ "k9",
+ "nanoid",
+ "path-slash",
+ "regex",
+ "stdext",
+ "system_shutdown",
+ "term-painter",
+ "which",
+]
+
+[[package]]
+name = "wait-timeout"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f200f5b12eb75f8c1ed65abd4b2db8a6e1b138a20de009dacee265a2498f3f6"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
+[[package]]
+name = "winapi"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167dc9d6949a9b857f3451275e911c3f44255842c1f7a76f33c55103a909087a"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-build"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d315eee3b34aca4797b2da6b13ed88266e6d612562a0c46390af8299fc699bc"
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+dependencies = [
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
diff --git a/pkgs/by-name/vi/vidmerger/package.nix b/pkgs/by-name/vi/vidmerger/package.nix
new file mode 100644
index 0000000000000..7cdfaf2944d8e
--- /dev/null
+++ b/pkgs/by-name/vi/vidmerger/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, ffmpeg
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "vidmerger";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "TGotwig";
+    repo = "vidmerger";
+    rev = version;
+    hash = "sha256-E3Y1UaYXl6NdCMM7IepqFzWNuHaMGLCN5BvQ/lxjFoc=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';
+
+  # Running cargo test -- . fails because it expects to have two mp4 files so that it can test the video merging functionalities
+  doCheck = false;
+
+  buildInputs = [
+    ffmpeg
+  ];
+
+  meta = with lib; {
+    description = "Merge video & audio files via CLI ";
+    homepage = "https://github.com/TGotwig/vidmerger";
+    license = with licenses; [ mit commons-clause ];
+    maintainers = with maintainers; [ ByteSudoer ];
+    mainProgram = "vidmerger";
+  };
+}
diff --git a/pkgs/by-name/wh/whistle/package.nix b/pkgs/by-name/wh/whistle/package.nix
index 9f1adad1ef72c..4e423177551cc 100644
--- a/pkgs/by-name/wh/whistle/package.nix
+++ b/pkgs/by-name/wh/whistle/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "whistle";
-  version = "2.9.66";
+  version = "2.9.67";
 
   src = fetchFromGitHub {
     owner = "avwo";
     repo = "whistle";
     rev = "v${version}";
-    hash = "sha256-bKHpbTdKFbeQGPl2HFcXi6y27s0JylyUXKg9oAcuSXo=";
+    hash = "sha256-wGfKgVbjVrR/GNVLqZtIydsolz14J8YsUU5Oyb7NDL0=";
   };
 
-  npmDepsHash = "sha256-34KrqF534igGsLfOUxJN5dhtj2rrKGbkUUWr6p7V/Go=";
+  npmDepsHash = "sha256-+7xdvWS92dij4fpQLnp1pjVN+uQNok205EAXGnD/wxY=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/applications/emulators/xemu/default.nix b/pkgs/by-name/xe/xemu/package.nix
index 08cac956b5a1d..7fc390049cb9e 100644
--- a/pkgs/applications/emulators/xemu/default.nix
+++ b/pkgs/by-name/xe/xemu/package.nix
@@ -1,9 +1,8 @@
 { lib
-, stdenv
-, fetchFromGitHub
 , SDL2
 , SDL2_image
 , copyDesktopItems
+, fetchFromGitHub
 , gettext
 , glib
 , gtk3
@@ -20,7 +19,8 @@
 , openssl
 , perl
 , pkg-config
-, python3
+, python3Packages
+, stdenv
 , vte
 , which
 , wrapGAppsHook
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "xemu-project";
     repo = "xemu";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FFxYp53LLDOPZ1Inr70oyQXhNjJO23G+gNmXd/lvrYs=";
     fetchSubmodules = true;
+    hash = "sha256-FFxYp53LLDOPZ1Inr70oyQXhNjJO23G+gNmXd/lvrYs=";
   };
 
   nativeBuildInputs = [
@@ -44,11 +44,12 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     perl
     pkg-config
-    python3
-    python3.pkgs.pyyaml
     which
     wrapGAppsHook
-  ];
+  ] ++ (with python3Packages; [
+    python
+    pyyaml
+  ]);
 
   buildInputs = [
     SDL2
@@ -91,13 +92,18 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  preConfigure = ''
+  postPatch = ''
     patchShebangs .
-    configureFlagsArray+=("--extra-cflags=-DXBOX=1 -Wno-error=redundant-decls")
     substituteInPlace ./scripts/xemu-version.sh \
       --replace 'date -u' "date -d @$SOURCE_DATE_EPOCH '+%Y-%m-%d %H:%M:%S'"
-    # When the data below can't be obtained through git, the build process tries
-    # to run `XEMU_COMMIT=$(cat XEMU_COMMIT)` (and similar)
+  '';
+
+  preConfigure = ''
+    configureFlagsArray+=("--extra-cflags=-DXBOX=1 -Wno-error=redundant-decls")
+  '' +
+  # When the data below can't be obtained through git, the build process tries
+  # to run `XEMU_COMMIT=$(cat XEMU_COMMIT)` (and similar)
+  ''
     echo '${finalAttrs.version}' > XEMU_VERSION
   '';
 
@@ -106,18 +112,19 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace ./build.ninja --replace /usr/bin/env $(which env)
   '';
 
-  installPhase = ''
+  installPhase = let
+    installIcon = resolution: ''
+      install -Dm644 -T ../ui/icons/xemu_${resolution}.png \
+        $out/share/icons/hicolor/${resolution}/apps/xemu.png
+    '';
+  in ''
     runHook preInstall
 
     install -Dm755 -T qemu-system-i386 $out/bin/xemu
   '' +
-  # Generate code to install the icons
-  (lib.concatMapStringsSep ";\n"
-    (res:
-      "install -Dm644 -T ../ui/icons/xemu_${res}.png $out/share/icons/hicolor/${res}/apps/xemu.png")
-    [ "16x16" "24x24" "32x32" "48x48" "128x128" "256x256" "512x512" ]) +
+  (lib.concatMapStringsSep "\n" installIcon
+    [ "16x16" "24x24" "32x32" "48x48" "128x128" "256x256" "512x512" ]) + "\n" +
   ''
-
     runHook postInstall
   '';
 
@@ -131,8 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     changelog = "https://github.com/xemu-project/xemu/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ AndersonTorres genericnerdyusername ];
-    platforms = lib.platforms.linux;
     mainProgram = "xemu";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/xo/xorriso/package.nix b/pkgs/by-name/xo/xorriso/package.nix
deleted file mode 100644
index 9fba38fb9044a..0000000000000
--- a/pkgs/by-name/xo/xorriso/package.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, acl
-, attr
-, bzip2
-, libcdio
-, libiconv
-, readline
-, zlib
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "xorriso";
-  version = "1.5.7-unstable-2023-12-06";
-
-  src = fetchurl {
-    url = "https://web.archive.org/web/20231206123448/https://www.gnu.org/software/xorriso/xorriso-1.5.7.tar.gz";
-    hash = "sha256-B7lV3n3e1aF7yJsLxwi8C8m3sBmUUePpCV9KfWRuTm0=";
-  };
-
-  buildInputs = [
-    bzip2
-    libcdio
-    libiconv
-    readline
-    zlib
-  ]
-  ++ lib.optionals stdenv.isLinux [
-    acl
-    attr
-  ];
-
-  outputs = [ "out" "man" ];
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-include unistd.h";
-
-  doCheck = true;
-
-  strictDeps = true;
-
-  meta = {
-    homepage = "https://www.gnu.org/software/xorriso/";
-    description = "ISO 9660 Rock Ridge file system manipulator";
-    longDescription = ''
-      GNU xorriso copies file objects from POSIX compliant filesystems into Rock
-      Ridge enhanced ISO 9660 filesystems and allows session-wise manipulation
-      of such filesystems. It can load the management information of existing
-      ISO images and it writes the session results to optical media or to
-      filesystem objects.
-      Vice versa xorriso is able to copy file objects out of ISO 9660
-      filesystems.
-    '';
-    license = lib.licenses.gpl3Plus;
-    mainProgram = "xorriso";
-    maintainers = [ lib.maintainers.AndersonTorres ];
-    platforms = lib.platforms.unix;
-  };
-})
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index c379fe7ebb3bf..a44fe0a09737b 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "28.1.0";
+  version = "29.0.3";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-cYnGJ7Z0PDRZtC/vz8hX/+mqk7iVkajFTfNGgRW+edQ=";
+    hash = "sha256-7vNfmrQ/B+T9hF5/ikIU1RvBcSRStnEmOY7VPbrll6s=";
   };
 
-  npmDepsHash = "sha256-bzQ7dc7UiC++0DxnQHusu6Ym7rd7GgeA6bGSnnla1nk=";
+  npmDepsHash = "sha256-FGGhuMlDhXd97AY23/ZPlrcrmirZIooAYJaskn2aM6w=";
 
   nativeBuildInputs = [
     remarshal
@@ -110,7 +110,7 @@ buildNpmPackage rec {
   buildPhase = ''
     export HOME=$TMPDIR
     runHook preBuild
-    npm run build --no-update-notifier -- --jCmd=$NIX_BUILD_CORES --verbose=9 ttf::$pname
+    npm run build --no-update-notifier --targets ttf::$pname -- --jCmd=$NIX_BUILD_CORES --verbose=9
     runHook postBuild
   '';
 
diff --git a/pkgs/data/fonts/material-icons/default.nix b/pkgs/data/fonts/material-icons/default.nix
index f03e8683e5097..993e25ba2cd33 100644
--- a/pkgs/data/fonts/material-icons/default.nix
+++ b/pkgs/data/fonts/material-icons/default.nix
@@ -1,25 +1,33 @@
-{ lib, stdenvNoCC, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub, nix-update-script }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "material-icons";
-  version = "3.0.1";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "material-design-icons";
-    rev = version;
-    hash = "sha256-4FphNJCsaLWzlVR4TmXnDBid0EVj39fkeoh5j1leBZ8=";
+    rev = finalAttrs.version;
+    hash = "sha256-wX7UejIYUxXOnrH2WZYku9ljv4ZAlvgk8EEJJHOCCjE=";
   };
 
+  dontConfigure = true;
+  dontBuild = true;
+
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/share/fonts/truetype
-    cp iconfont/*.ttf $out/share/fonts/truetype
+    cp font/*.ttf $out/share/fonts/truetype
+
+    mkdir -p $out/share/fonts/opentype
+    cp font/*.otf $out/share/fonts/opentype
 
     runHook postInstall
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "System status icons by Google, featuring material design";
     homepage = "https://material.io/icons";
@@ -27,4 +35,4 @@ stdenvNoCC.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ mpcsh ];
   };
-}
+})
diff --git a/pkgs/data/icons/bibata-cursors/default.nix b/pkgs/data/icons/bibata-cursors/default.nix
deleted file mode 100644
index 06c8becd64e51..0000000000000
--- a/pkgs/data/icons/bibata-cursors/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-, fetchurl
-, clickgen
-, attrs
-}:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "bibata-cursors";
-  version = "2.0.3";
-
-  src = fetchFromGitHub {
-    owner = "ful1e5";
-    repo = "Bibata_Cursor";
-    rev = "v${version}";
-    sha256 = "zCk7qgPeae0BfzhxxU2Dk1SOWJQOxiWyJuzH/ri+Gq4=";
-  };
-
-  buildInputs = [ clickgen attrs ];
-
-  buildPhase = ''
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Modern-Amber' -n 'Bibata-Modern-Amber' -c 'Yellowish and rounded edge bibata cursors.'
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Modern-Classic' -n 'Bibata-Modern-Classic' -c 'Black and rounded edge Bibata cursors.'
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Modern-Ice' -n 'Bibata-Modern-Ice' -c 'White and rounded edge Bibata cursors.'
-
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Original-Amber' -n 'Bibata-Original-Amber' -c 'Yellowish and sharp edge Bibata cursors.'
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Original-Classic' -n 'Bibata-Original-Classic' -c 'Black and sharp edge Bibata cursors.'
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Original-Ice' -n 'Bibata-Original-Ice' -c 'White and sharp edge Bibata cursors.'
-  '';
-
-  installPhase = ''
-    install -dm 0755 $out/share/icons
-    cp -rf themes/* $out/share/icons/
-  '';
-
-  meta = with lib; {
-    description = "Material Based Cursor Theme";
-    homepage = "https://github.com/ful1e5/Bibata_Cursor";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ rawkode AdsonCicilioti ];
-  };
-}
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 5d6895da7125e..5d6b512e6d7de 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20240310062737";
+    version = "20240316051411";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-KJSa5qDNGokNin0M2BppRks1qyMg19o+EOxu5OsCeOg=";
+      hash = "sha256-wao//QAdEqxkyKSVgC2eJqtQlPQ7IXG88atUSjQIGcI=";
     };
     vendorHash = "sha256-azvMUi8eLNoNofRa2X4SKTTiMd6aOyO6H/rOiKjkpIY=";
     meta = with lib; {
diff --git a/pkgs/desktops/budgie/budgie-desktop/default.nix b/pkgs/desktops/budgie/budgie-desktop/default.nix
index 71e69a5223e46..50068621be34a 100644
--- a/pkgs/desktops/budgie/budgie-desktop/default.nix
+++ b/pkgs/desktops/budgie/budgie-desktop/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , accountsservice
 , alsa-lib
 , budgie-screensaver
@@ -49,6 +50,27 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./plugins.patch
+
+    # Fix workspace applet window icon click not performing workspace switch
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/524
+    (fetchpatch2 {
+      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/9b775d613ad0c324db628ed5a32d3fccc90f82d6.patch";
+      hash = "sha256-QtPviPW7pJYZIs28CYwE3N8vcDswqnjD6d0WVPFchL4=";
+    })
+
+    # Work around even more SNI noncompliance
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/539
+    (fetchpatch2 {
+      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/84269e2fcdcac6d737ee5100881e8b306eaae570.patch";
+      hash = "sha256-1Uj+6GZ9/oDQOt+5P8UYiVP3P0BrsJe3HqXVLkWCkAM=";
+    })
+
+    # vapi: Update libxfce4windowing to 4.19.3
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/546
+    (fetchpatch2 {
+      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/a040ccb96094f1d3a1ee81a6733c9434722bdf6c.patch";
+      hash = "sha256-9eMYB5Zyn3BDYvAwORXTHaPGYDP7LnqHAwp+6Wy6XLk=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/xfce/core/libxfce4windowing/default.nix b/pkgs/desktops/xfce/core/libxfce4windowing/default.nix
index 621115616e5c0..d18419968b2c4 100644
--- a/pkgs/desktops/xfce/core/libxfce4windowing/default.nix
+++ b/pkgs/desktops/xfce/core/libxfce4windowing/default.nix
@@ -1,14 +1,35 @@
-{ lib, mkXfceDerivation, gobject-introspection, glib, gtk3, libwnck, wayland }:
+{ lib
+, mkXfceDerivation
+, gobject-introspection
+, wayland-scanner
+, glib
+, gtk3
+, libwnck
+, libX11
+, wayland
+, wlr-protocols
+}:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "libxfce4windowing";
-  version = "4.19.2";
+  version = "4.19.3";
 
-  sha256 = "sha256-mXxxyfwZB/AJFVVGFAAXLqC5p7pZAeqmhljQym55hyM=";
+  sha256 = "sha256-nsobRyGeagUq1WHzYBq6vd9g5A65KEQC4cX+m7w0pqg=";
 
-  nativeBuildInputs = [ gobject-introspection ];
-  buildInputs = [ glib gtk3 libwnck wayland ];
+  nativeBuildInputs = [
+    gobject-introspection
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libwnck
+    libX11
+    wayland
+    wlr-protocols
+  ];
 
   meta = {
     description = "Windowing concept abstraction library for X11 and Wayland";
diff --git a/pkgs/development/compilers/crystal/default.nix b/pkgs/development/compilers/crystal/default.nix
index fb031eba18cbf..f36ce4c258536 100644
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@@ -268,6 +268,16 @@ rec {
     };
   };
 
+  binaryCrystal_1_10 = genericBinary {
+    version = "1.10.1";
+    sha256s = {
+      x86_64-linux = "sha256-F0LjdV02U9G6B8ApHxClF/o5KvhxMNukSX7Z2CwSNIs=";
+      aarch64-darwin = "sha256-5kkObQl0VIO6zqQ8TYl0JzYyUmwfmPE9targpfwseSQ=";
+      x86_64-darwin = "sha256-5kkObQl0VIO6zqQ8TYl0JzYyUmwfmPE9targpfwseSQ=";
+      aarch64-linux = "sha256-AzFz+nrU/HJmCL1hbCKXf5ej/uypqV1GJPVLQ4J3778=";
+    };
+  };
+
   crystal_1_2 = generic {
     version = "1.2.2";
     sha256 = "sha256-nyOXhsutVBRdtJlJHe2dALl//BUXD1JeeQPgHU4SwiU=";
@@ -297,5 +307,12 @@ rec {
     llvmPackages = llvmPackages_15;
   };
 
-  crystal = crystal_1_9;
+  crystal_1_11 = generic {
+    version = "1.11.2";
+    sha256 = "sha256-BBEDWqFtmFUNj0kuGBzv71YHO3KjxV4d2ySTCD4HhLc=";
+    binary = binaryCrystal_1_10;
+    llvmPackages = llvmPackages_15;
+  };
+
+  crystal = crystal_1_11;
 }
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index 03c2968f4ab9a..bce45f200c2d8 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -82,6 +82,10 @@ let
           "dartSdkVersion": "${dart.version}"
         }
         EOF
+
+        # Suppress a small error now that `.gradle`'s location changed.
+        # Location changed because of the patch "gradle-flutter-tools-wrapper.patch".
+        mkdir -p "$out/packages/flutter_tools/gradle/.gradle"
       '';
 
       installPhase = ''
diff --git a/pkgs/development/compilers/flutter/versions/3_19/patches/gradle-flutter-tools-wrapper.patch b/pkgs/development/compilers/flutter/versions/3_19/patches/gradle-flutter-tools-wrapper.patch
new file mode 100644
index 0000000000000..de6080efbba8d
--- /dev/null
+++ b/pkgs/development/compilers/flutter/versions/3_19/patches/gradle-flutter-tools-wrapper.patch
@@ -0,0 +1,44 @@
+This patch introduces an intermediate Gradle build step to alter the behavior
+of flutter_tools' Gradle project, specifically moving the creation of `build`
+and `.gradle` directories from within the Nix Store to somewhere in `$HOME/.cache/flutter/nix-flutter-tools-gradle/$engineShortRev`.
+
+Without this patch, flutter_tools' Gradle project tries to generate `build` and `.gradle`
+directories within the Nix Store. Resulting in read-only errors when trying to build a
+Flutter Android app at runtime.
+
+This patch takes advantage of the fact settings.gradle takes priority over settings.gradle.kts to build the intermediate Gradle project
+when a Flutter app runs `includeBuild("${settings.ext.flutterSdkPath}/packages/flutter_tools/gradle")`
+
+`rootProject.buildFileName = "/dev/null"` so that the intermediate project doesn't use `build.gradle.kts` that's in the same directory.
+
+The intermediate project makes a `settings.gradle` file in `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/` and `includeBuild`s it.
+This Gradle project will build the actual `packages/flutter_tools/gradle` project by setting
+`rootProject.projectDir = new File("$settingsDir")` and `apply from: new File("$settingsDir/settings.gradle.kts")`.
+
+Now the `.gradle` will be built in `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/`, but `build` doesn't.
+To move `build` to `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/` as well, we need to set `buildDirectory`.
+diff --git a/packages/flutter_tools/gradle/settings.gradle b/packages/flutter_tools/gradle/settings.gradle
+new file mode 100644
+index 0000000000..b2485c94b4
+--- /dev/null
++++ b/packages/flutter_tools/gradle/settings.gradle
+@@ -0,0 +1,19 @@
++rootProject.buildFileName = "/dev/null"
++
++def engineShortRev = (new File("$settingsDir/../../../bin/internal/engine.version")).text.take(10)
++def dir = new File("$System.env.HOME/.cache/flutter/nix-flutter-tools-gradle/$engineShortRev")
++dir.mkdirs()
++def file = new File(dir, "settings.gradle")
++
++file.text = """
++rootProject.projectDir = new File("$settingsDir")
++apply from: new File("$settingsDir/settings.gradle.kts")
++
++gradle.allprojects { project ->
++  project.beforeEvaluate {
++    project.layout.buildDirectory = new File("$dir/build")
++  }
++}
++"""
++
++includeBuild(dir)
diff --git a/pkgs/development/compilers/openjdk/22.nix b/pkgs/development/compilers/openjdk/22.nix
new file mode 100644
index 0000000000000..bef62b6755a26
--- /dev/null
+++ b/pkgs/development/compilers/openjdk/22.nix
@@ -0,0 +1,260 @@
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, fetchFromGitHub
+, bash
+, pkg-config
+, autoconf
+, cpio
+, file
+, which
+, unzip
+, zip
+, perl
+, cups
+, freetype
+, alsa-lib
+, libjpeg
+, giflib
+, libpng
+, zlib
+, lcms2
+, libX11
+, libICE
+, libXrender
+, libXext
+, libXt
+, libXtst
+, libXi
+, libXinerama
+, libXcursor
+, libXrandr
+, fontconfig
+, openjdk22-bootstrap
+, ensureNewerSourcesForZipFilesHook
+, setJavaClassPath
+  # TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
+  # which should be fixable, this is a no-rebuild workaround for GHC.
+, headless ? stdenv.targetPlatform.isGhcjs
+, enableJavaFX ? false
+, openjfx
+, enableGnome2 ? true
+, gtk3
+, gnome_vfs
+, glib
+, GConf
+}:
+
+let
+  version = {
+    feature = "22";
+    interim = "";
+    build = "36";
+  };
+
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk22-bootstrap.override { gtkSupport = !headless; };
+
+  openjdk = stdenv.mkDerivation {
+    pname = "openjdk" + lib.optionalString headless "-headless";
+    version = "${version.feature}${version.interim}+${version.build}";
+
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jdk${version.feature}u";
+      rev = "jdk-${version.feature}${version.interim}+${version.build}";
+      hash = "sha256-itjvIedPwJl/l3a2gIVpNMs1zkbrjioVqbCj1Z1nCJE=";
+    };
+
+    nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
+    buildInputs = [
+      cpio
+      file
+      which
+      zip
+      perl
+      zlib
+      cups
+      freetype
+      alsa-lib
+      libjpeg
+      giflib
+      libpng
+      zlib
+      lcms2
+      libX11
+      libICE
+      libXrender
+      libXext
+      libXtst
+      libXt
+      libXtst
+      libXi
+      libXinerama
+      libXcursor
+      libXrandr
+      fontconfig
+      openjdk-bootstrap
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      gtk3
+      gnome_vfs
+      GConf
+      glib
+    ];
+
+    patches = [
+      ./fix-java-home-jdk21.patch
+      ./read-truststore-from-env-jdk10.patch
+      ./currency-date-range-jdk10.patch
+      ./increase-javadoc-heap-jdk13.patch
+      ./ignore-LegalNoticeFilePlugin-jdk18.patch
+
+      # -Wformat etc. are stricter in newer gccs, per
+      # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79677
+      # so grab the work-around from
+      # https://src.fedoraproject.org/rpms/java-openjdk/pull-request/24
+      (fetchurl {
+        url = "https://src.fedoraproject.org/rpms/java-openjdk/raw/06c001c7d87f2e9fe4fedeef2d993bcd5d7afa2a/f/rh1673833-remove_removal_of_wformat_during_test_compilation.patch";
+        sha256 = "082lmc30x64x583vqq00c8y0wqih3y4r0mp1c4bqq36l22qv6b6r";
+      })
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
+      })
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      ./swing-use-gtk-jdk13.patch
+    ];
+
+    postPatch = ''
+      chmod +x configure
+      patchShebangs --build configure
+    '';
+
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = [ "build" "host" ];
+
+
+    # https://openjdk.org/groups/build/doc/building.html
+    configureFlags = [
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
+      "--with-version-build=${version.build}"
+      "--with-version-opt=nixos"
+      "--with-version-pre="
+      "--enable-unlimited-crypto"
+      "--with-native-debug-symbols=internal"
+      "--with-libjpeg=system"
+      "--with-giflib=system"
+      "--with-libpng=system"
+      "--with-zlib=system"
+      "--with-lcms=system"
+      "--with-stdc++lib=dynamic"
+    ]
+    ++ lib.optional headless "--enable-headless-only"
+    ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
+
+    separateDebugInfo = true;
+
+    env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+      "-lfontconfig"
+      "-lcups"
+      "-lXinerama"
+      "-lXrandr"
+      "-lmagic"
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      "-lgtk-3"
+      "-lgio-2.0"
+      "-lgnomevfs-2"
+      "-lgconf-2"
+    ]);
+
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
+    buildFlags = [ "images" ];
+
+    installPhase = ''
+      mkdir -p $out/lib
+
+      mv build/*/images/jdk $out/lib/openjdk
+
+      # Remove some broken manpages.
+      rm -rf $out/lib/openjdk/man/ja*
+
+      # Mirror some stuff in top-level.
+      mkdir -p $out/share
+      ln -s $out/lib/openjdk/include $out/include
+      ln -s $out/lib/openjdk/man $out/share/man
+
+      # IDEs use the provided src.zip to navigate the Java codebase (https://github.com/NixOS/nixpkgs/pull/95081)
+      ln -s $out/lib/openjdk/lib/src.zip $out/lib/src.zip
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/linux/*_md.h $out/include/
+
+      # Remove crap from the installation.
+      rm -rf $out/lib/openjdk/demo
+      ${lib.optionalString headless ''
+        rm $out/lib/openjdk/lib/{libjsound,libfontmanager}.so
+      ''}
+
+      ln -s $out/lib/openjdk/bin $out/bin
+    '';
+
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook so that any package
+      # that depends on the JDK has $CLASSPATH set up properly.
+      mkdir -p $out/nix-support
+      #TODO or printWords?  cf https://github.com/NixOS/nixpkgs/pull/27427#issuecomment-317293040
+      echo -n "${setJavaClassPath}" > $out/nix-support/propagated-build-inputs
+
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat <<EOF > $out/nix-support/setup-hook
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      EOF
+    '';
+
+    postFixup = ''
+      # Build the set of output library directories to rpath against
+      LIBDIRS=""
+      for output in $(getAllOutputNames); do
+        if [ "$output" = debug ]; then continue; fi
+        LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
+      done
+      # Add the local library paths to remove dependencies on the bootstrap
+      for output in $(getAllOutputNames); do
+        if [ "$output" = debug ]; then continue; fi
+        OUTPUTDIR=$(eval echo \$$output)
+        BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
+        echo "$BINLIBS" | while read i; do
+          patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+          patchelf --shrink-rpath "$i" || true
+        done
+      done
+    '';
+
+    disallowedReferences = [ openjdk-bootstrap ];
+
+    pos = builtins.unsafeGetAttrPos "feature" version;
+    meta = import ./meta.nix lib version.feature;
+
+    passthru = {
+      architecture = "";
+      home = "${openjdk}/lib/openjdk";
+      inherit gtk3;
+    };
+  };
+in
+openjdk
diff --git a/pkgs/development/compilers/openjdk/openjfx/22.nix b/pkgs/development/compilers/openjdk/openjfx/22.nix
new file mode 100644
index 0000000000000..89908779c9094
--- /dev/null
+++ b/pkgs/development/compilers/openjdk/openjfx/22.nix
@@ -0,0 +1,126 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, writeText
+, openjdk21_headless
+, gradle
+, pkg-config
+, perl
+, cmake
+, gperf
+, gtk2
+, gtk3
+, libXtst
+, libXxf86vm
+, glib
+, alsa-lib
+, ffmpeg_4
+, python3
+, ruby
+, icu68
+, withMedia ? true
+, withWebKit ? false
+}:
+
+let
+  major = "22";
+  update = "";
+  build = "+30";
+  repover = "${major}${update}${build}";
+
+  makePackage = args: stdenv.mkDerivation ({
+    version = "${major}${update}${build}";
+
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jfx";
+      rev = repover;
+      hash = "sha256-sZF7ZPC0kgTTxWgtkxmGtOlfroGPGVZcMw0/wSTJUxQ=";
+    };
+
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    nativeBuildInputs = [ gradle perl pkg-config cmake gperf python3 ruby ];
+
+    dontUseCmakeConfigure = true;
+
+    config = writeText "gradle.properties" (''
+      CONF = Release
+      JDK_HOME = ${openjdk21_headless.home}
+    '' + args.gradleProperties or "");
+
+    buildPhase = ''
+      runHook preBuild
+
+      export NUMBER_OF_PROCESSORS=$NIX_BUILD_CORES
+      export GRADLE_USER_HOME=$(mktemp -d)
+      ln -s $config gradle.properties
+      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
+      gradle --no-daemon $gradleFlags sdk
+
+      runHook postBuild
+    '';
+  } // args);
+
+  # Fake build to pre-download deps into fixed-output derivation.
+  # We run nearly full build because I see no other way to download everything that's needed.
+  # Anyone who knows a better way?
+  deps = makePackage {
+    pname = "openjfx-deps";
+
+    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
+    installPhase = ''
+      find $GRADLE_USER_HOME -type f -regex '.*/modules.*\.\(jar\|pom\)' \
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
+        | sh
+      rm -rf $out/tmp
+    '';
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = "sha256-2I7LvYcudlB4DKJ/wEiTjY6nICUxUY52euosUqOA+Bs=";
+  };
+
+in
+makePackage {
+  pname = "openjfx-modular-sdk";
+
+  gradleProperties = ''
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
+  '';
+
+  preBuild = ''
+    swtJar="$(find ${deps} -name org.eclipse.swt\*.jar)"
+    substituteInPlace build.gradle \
+      --replace 'mavenCentral()' 'mavenLocal(); maven { url uri("${deps}") }' \
+      --replace 'name: SWT_FILE_NAME' "files('$swtJar')"
+  '';
+
+  installPhase = ''
+    cp -r build/modular-sdk $out
+  '';
+
+  stripDebugList = [ "." ];
+
+  postFixup = ''
+    # Remove references to bootstrap.
+    export openjdkOutPath='${openjdk21_headless.outPath}'
+    find "$out" -name \*.so | while read lib; do
+      new_refs="$(patchelf --print-rpath "$lib" | perl -pe 's,:?\Q$ENV{openjdkOutPath}\E[^:]*,,')"
+      patchelf --set-rpath "$new_refs" "$lib"
+    done
+  '';
+
+  disallowedReferences = [ openjdk21_headless openjdk21_headless ];
+
+  passthru.deps = deps;
+
+  meta = with lib; {
+    homepage = "https://openjdk.org/projects/openjfx/";
+    license = licenses.gpl2Classpath;
+    description = "The next-generation Java client toolkit";
+    maintainers = with maintainers; [ abbradar ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/compilers/zulu/22.nix b/pkgs/development/compilers/zulu/22.nix
new file mode 100644
index 0000000000000..96b0e6805a5af
--- /dev/null
+++ b/pkgs/development/compilers/zulu/22.nix
@@ -0,0 +1,42 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-22-lts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-linux = {
+      zuluVersion = "22.28.91";
+      jdkVersion = "22.0.0";
+      hash =
+        if enableJavaFX then "sha256-HvMiODsz+puu1xtxG2RRXH/PWCk91PGNZ7UcOd9orqQ="
+        else "sha256-HvMiODsz+puu1xtxG2RRXH/PWCk91PGNZ7UcOd9orqQ=";
+    };
+
+    aarch64-linux = {
+      zuluVersion = "22.28.91";
+      jdkVersion = "22.0.0";
+      hash =
+        if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
+        else "sha256-3RLNNEbMk5wAZsQmbQj/jpx9iTL/yr9N3wL4t7m6c+s=";
+    };
+
+    x86_64-darwin = {
+      zuluVersion = "22.28.91";
+      jdkVersion = "22.0.0";
+      hash =
+        if enableJavaFX then "sha256-Y6PSNQjHRXukwux2sVbvpTIqT+Cg+KeG1C0iSEwyKZw="
+        else "sha256-Y6PSNQjHRXukwux2sVbvpTIqT+Cg+KeG1C0iSEwyKZw=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = "22.28.91";
+      jdkVersion = "22.0.0";
+      hash =
+        if enableJavaFX then "sha256-o0VkWB4+PzBmNNWy+FZlyjTgukBTe6owfydb3YNfEE0="
+        else "sha256-o0VkWB4+PzBmNNWy+FZlyjTgukBTe6owfydb3YNfEE0=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 005890a3d4a6a..1786d84e7a4ba 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -97,6 +97,10 @@ stdenv.mkDerivation (finalAttrs: {
     # The icon validator needs to access the gdk-pixbuf loaders in the Nix store
     # and cannot bind FHS paths since those are not available on NixOS.
     finalAttrs.passthru.icon-validator-patch
+
+    # Try mounting fonts and icons from NixOS locations if FHS locations don't exist.
+    # https://github.com/NixOS/nixpkgs/issues/119433
+    ./fix-fonts-icons.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/flatpak/fix-fonts-icons.patch b/pkgs/development/libraries/flatpak/fix-fonts-icons.patch
new file mode 100644
index 0000000000000..31a96d88b7dd5
--- /dev/null
+++ b/pkgs/development/libraries/flatpak/fix-fonts-icons.patch
@@ -0,0 +1,87 @@
+diff --git a/common/flatpak-run.c b/common/flatpak-run.c
+index 94ad013..5c9f55e 100644
+--- a/common/flatpak-run.c
++++ b/common/flatpak-run.c
+@@ -871,6 +871,49 @@ out:
+   return res;
+ }
+ 
++static void
++get_nix_closure (GHashTable *closure, const gchar *source_path)
++{
++  if (g_file_test (source_path, G_FILE_TEST_IS_SYMLINK))
++    {
++      g_autofree gchar *path = g_malloc(PATH_MAX);
++      realpath(source_path, path);
++      if (g_str_has_prefix(path, "/nix/store/"))
++        {
++          *strchr(path + strlen("/nix/store/"), '/') = 0;
++          g_hash_table_add(closure, g_steal_pointer (&path));
++        }
++    }
++  else if (g_file_test (source_path, G_FILE_TEST_IS_DIR))
++    {
++      g_autoptr(GDir) dir = g_dir_open(source_path, 0, NULL);
++      const gchar *file_name;
++      while ((file_name = g_dir_read_name(dir)))
++        {
++          g_autofree gchar *path = g_build_filename (source_path, file_name, NULL);
++          get_nix_closure (closure, path);
++        }
++    }
++}
++
++static void
++add_nix_store_symlink_targets (FlatpakBwrap *bwrap, const gchar *source_path)
++{
++  GHashTable *closure = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, NULL);
++
++  get_nix_closure(closure, source_path);
++
++  GHashTableIter iter;
++  gpointer path;
++  g_hash_table_iter_init(&iter, closure);
++  while (g_hash_table_iter_next(&iter, &path, NULL))
++    {
++      flatpak_bwrap_add_args (bwrap, "--ro-bind", path, path, NULL);
++    }
++
++  g_hash_table_destroy(closure);
++}
++
+ static void
+ add_font_path_args (FlatpakBwrap *bwrap)
+ {
+@@ -898,6 +946,18 @@ add_font_path_args (FlatpakBwrap *bwrap)
+                               "\t<remap-dir as-path=\"%s\">/run/host/fonts</remap-dir>\n",
+                               SYSTEM_FONTS_DIR);
+     }
++  else if (g_file_test ("/run/current-system/sw/share/X11/fonts", G_FILE_TEST_EXISTS))
++    {
++      add_nix_store_symlink_targets (bwrap, "/run/current-system/sw/share/X11/fonts");
++      flatpak_bwrap_add_args (bwrap,
++                              "--ro-bind",
++                              "/run/current-system/sw/share/X11/fonts",
++                              "/run/host/fonts",
++                              NULL);
++      g_string_append_printf (xml_snippet,
++                              "\t<remap-dir as-path=\"%s\">/run/host/fonts</remap-dir>\n",
++                              "/run/current-system/sw/share/X11/fonts");
++    }
+ 
+   if (g_file_test ("/usr/local/share/fonts", G_FILE_TEST_EXISTS))
+     {
+@@ -998,6 +1058,13 @@ add_icon_path_args (FlatpakBwrap *bwrap)
+                               "--ro-bind", "/usr/share/icons", "/run/host/share/icons",
+                               NULL);
+     }
++  else if (g_file_test ("/run/current-system/sw/share/icons", G_FILE_TEST_IS_DIR))
++    {
++      add_nix_store_symlink_targets (bwrap, "/run/current-system/sw/share/icons");
++      flatpak_bwrap_add_args (bwrap,
++                              "--ro-bind", "/run/current-system/sw/share/icons", "/run/host/share/icons",
++                              NULL);
++    }
+ 
+   user_icons_path = g_build_filename (g_get_user_data_dir (), "icons", NULL);
+   user_icons = g_file_new_for_path (user_icons_path);
diff --git a/pkgs/development/libraries/gfxstream/default.nix b/pkgs/development/libraries/gfxstream/default.nix
index 196bca7cdc5f7..e3164c95a4c64 100644
--- a/pkgs/development/libraries/gfxstream/default.nix
+++ b/pkgs/development/libraries/gfxstream/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchFromGitiles, meson, ninja, pkg-config, python3
-, aemu, libdrm, libglvnd, vulkan-headers, vulkan-loader, xorg
+{ lib, stdenv, fetchFromGitiles, fetchpatch, meson, ninja, pkg-config, python3
+, aemu, darwin, libdrm, libglvnd, vulkan-headers, vulkan-loader, xorg
 }:
 
 stdenv.mkDerivation {
@@ -12,14 +12,45 @@ stdenv.mkDerivation {
     hash = "sha256-IYXkaHZPEYIE9KW731GN6x6yRS+FYtP1zyHcaSofhIM=";
   };
 
+  patches = [
+    # Make libdrm an optional dependency, which is required to build on Darwin.
+    (fetchpatch {
+      url = "https://android.googlesource.com/platform/hardware/google/gfxstream/+/a8df2a3eb099b419a7b3638e68ea30b4cffb751b%5E%21/?format=TEXT";
+      decode = "base64 -d";
+      hash = "sha256-shjeNuxtQokscCGBKEUbOPKOWRELBAnHFNj3Y5w87Nw=";
+    })
+  ];
+
+  # Ensure that meson can find an Objective-C compiler on Darwin.
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace meson.build \
+      --replace-fail "project('gfxstream_backend', 'cpp', 'c'" "project('gfxstream_backend', 'cpp', 'c', 'objc'"
+  '';
+
   nativeBuildInputs = [ meson ninja pkg-config python3 ];
   buildInputs = [ aemu libglvnd vulkan-headers vulkan-loader xorg.libX11 ]
-    ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform libdrm) libdrm;
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform libdrm) [ libdrm ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Cocoa
+      darwin.apple_sdk.frameworks.CoreGraphics
+      darwin.apple_sdk.frameworks.IOKit
+      darwin.apple_sdk.frameworks.IOSurface
+      darwin.apple_sdk.frameworks.OpenGL
+      darwin.apple_sdk.frameworks.QuartzCore
+    ];
+
+  env = lib.optionalAttrs stdenv.isDarwin {
+    NIX_LDFLAGS = toString [
+      "-framework Cocoa"
+      "-framework IOKit"
+      "-framework IOSurface"
+      "-framework OpenGL"
+      "-framework QuartzCore"
+      "-needed-lvulkan"
+    ];
+  };
 
   # dlopens libvulkan.
-  #
-  # XXX: Unsure if this is required on Darwin.  If it is, it probably
-  #      needs to be done using install_name_tool.
   preConfigure = lib.optionalString (!stdenv.isDarwin) ''
     mesonFlagsArray=(-Dcpp_link_args="-Wl,--push-state -Wl,--no-as-needed -lvulkan -Wl,--pop-state")
   '';
diff --git a/pkgs/development/libraries/java/jffi/default.nix b/pkgs/development/libraries/java/jffi/default.nix
index 3ba336aa18e94..46f2701635498 100644
--- a/pkgs/development/libraries/java/jffi/default.nix
+++ b/pkgs/development/libraries/java/jffi/default.nix
@@ -1,40 +1,66 @@
-{ lib, stdenv, fetchFromGitHub, jdk, jre, ant, libffi, texinfo, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, ant
+, jdk
+, libffi
+, pkg-config
+, texinfo
+, stripJavaArchivesHook
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jffi";
   version = "1.3.13";
 
   src = fetchFromGitHub {
     owner = "jnr";
     repo = "jffi";
-    rev = "jffi-${version}";
-    sha256 = "sha256-aBQkkZyXZkaJc4sr/jHnIRaJYP116u4Jqsr9XXzfOBA=";
+    rev = "jffi-${finalAttrs.version}";
+    hash = "sha256-aBQkkZyXZkaJc4sr/jHnIRaJYP116u4Jqsr9XXzfOBA=";
   };
 
-  nativeBuildInputs = [ jdk ant texinfo pkg-config ];
-  buildInputs = [ libffi ] ;
+  nativeBuildInputs = [
+    ant
+    jdk
+    pkg-config
+    texinfo
+    stripJavaArchivesHook
+  ];
 
-  buildPhase = ''
-    # The pkg-config script in the build.xml doesn't work propery
-    # set the lib path manually to work around this.
-    export LIBFFI_LIBS="${libffi}/lib/libffi.so"
+  buildInputs = [ libffi ];
 
-    ant -Duse.system.libffi=1 jar
-    ant -Duse.system.libffi=1 archive-platform-jar
-  '';
+  # The pkg-config script in the build.xml doesn't work propery
+  # set the lib path manually to work around this.
+  env.LIBFFI_LIBS = "${libffi}/lib/libffi${stdenv.hostPlatform.extensions.sharedLibrary}";
+  env.ANT_ARGS = "-Duse.system.libffi=1";
 
-  installPhase = ''
-    mkdir -p $out/share/java
-    cp -r dist/* $out/share/java
+  buildPhase = ''
+    runHook preBuild
+    ant jar
+    ant archive-platform-jar
+    runHook postBuild
   '';
 
   doCheck = true;
+
   checkPhase = ''
-    # The pkg-config script in the build.xml doesn't work propery
-    # set the lib path manually to work around this.
-    export LIBFFI_LIBS="${libffi}/lib/libffi.so"
+    runHook preCheck
+    ant test
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 dist/*.jar -t $out/share/java
+    runHook postInstall
+  '';
 
-    ant -Duse.system.libffi=1 test
+  # nix can't detect libffi as a dependency inside the jar file, so we create
+  # a dummy file with the path to libffi, to make sure that nix knows about it
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo ${libffi} > $out/nix-support/depends
   '';
 
   meta = with lib; {
@@ -45,4 +71,4 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ bachp ];
   };
-}
+})
diff --git a/pkgs/development/libraries/libck/default.nix b/pkgs/development/libraries/libck/default.nix
index cc53d4957eb41..71937b2a658ec 100644
--- a/pkgs/development/libraries/libck/default.nix
+++ b/pkgs/development/libraries/libck/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ck";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "concurrencykit";
     repo = pname;
     rev = version;
-    sha256 = "sha256-HUC+8Vd0koAmumRZ8gS5u6LVa7fUfkIYRaxVv6/7Hgg=";
+    sha256 = "sha256-lxJ8WsZ3pBGf4sFYj5+tR37EYDZqpksaoohiIKA4pRI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/nco/default.nix b/pkgs/development/libraries/nco/default.nix
index 74f6c21d86e96..a14a7267a1874 100644
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nco";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchFromGitHub {
     owner = "nco";
     repo = "nco";
     rev = finalAttrs.version;
-    hash = "sha256-6j9gBvhNTww9nOKMcCvOxoLJwU/3RtS6OvofjrpZhmk=";
+    hash = "sha256-d90088MKliM90KSbL0TNEafhfvLQlD/stO5V83fTXO0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/opencsg/default.nix b/pkgs/development/libraries/opencsg/default.nix
index 4adebaf72b163..a2675b2d79dc6 100644
--- a/pkgs/development/libraries/opencsg/default.nix
+++ b/pkgs/development/libraries/opencsg/default.nix
@@ -2,11 +2,11 @@
 , qmake, GLUT, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.2";
+  version = "1.6.0";
   pname = "opencsg";
   src = fetchurl {
     url = "http://www.opencsg.org/OpenCSG-${version}.tar.gz";
-    sha256 = "1ysazynm759gnw1rdhn9xw9nixnzrlzrc462340a6iif79fyqlnr";
+    hash = "sha256-v4+4Dj4M4R2H3XjdFaDehy27iXLYf1+Jz/xGHvrUe+g=";
   };
 
   nativeBuildInputs = [ qmake ]
@@ -18,15 +18,13 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
-  patches = [ ./fix-pro-files.patch ];
-
   preConfigure = ''
     rm example/Makefile src/Makefile
     qmakeFlags=("''${qmakeFlags[@]}" "INSTALLDIR=$out")
   '';
 
   postInstall = ''
-    install -D license.txt "$out/share/doc/opencsg/license.txt"
+    install -D copying.txt "$out/share/doc/opencsg/copying.txt"
   '' + lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv $out/bin/*.app $out/Applications
@@ -49,7 +47,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.opencsg.org/";
     platforms = platforms.unix;
     maintainers = [ maintainers.raskin ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
   };
 }
 
diff --git a/pkgs/development/libraries/opencsg/fix-pro-files.patch b/pkgs/development/libraries/opencsg/fix-pro-files.patch
deleted file mode 100644
index 462b44c8f40cf..0000000000000
--- a/pkgs/development/libraries/opencsg/fix-pro-files.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -ur OpenCSG-1.4.2-pristine/example/example.pro OpenCSG-1.4.2/example/example.pro
---- OpenCSG-1.4.2-pristine/example/example.pro	2016-09-27 06:11:16.000000000 +0900
-+++ OpenCSG-1.4.2/example/example.pro	2019-05-07 10:45:18.785251737 +0900
-@@ -6,7 +6,9 @@
- INCLUDEPATH += ../include
- LIBS += -L../lib -lopencsg -lGLEW
- 
--INSTALLDIR = /usr/local
-+isEmpty(INSTALLDIR) {
-+  INSTALLDIR = /usr/local
-+}
- INSTALLS += target
- target.path = $$INSTALLDIR/bin
- 
-diff -ur OpenCSG-1.4.2-pristine/opencsg.pro OpenCSG-1.4.2/opencsg.pro
---- OpenCSG-1.4.2-pristine/opencsg.pro	2016-09-27 06:11:16.000000000 +0900
-+++ OpenCSG-1.4.2/opencsg.pro	2019-05-07 10:44:50.578698165 +0900
-@@ -1,2 +1,3 @@
- TEMPLATE = subdirs
- SUBDIRS  = src example
-+CONFIG   += ordered
diff --git a/pkgs/development/libraries/physics/pythia/default.nix b/pkgs/development/libraries/physics/pythia/default.nix
index a0daa91a1b54a..52138a8d50eaa 100644
--- a/pkgs/development/libraries/physics/pythia/default.nix
+++ b/pkgs/development/libraries/physics/pythia/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pythia";
-  version = "8.310";
+  version = "8.311";
 
   src = fetchurl {
     url = "https://pythia.org/download/pythia83/pythia${builtins.replaceStrings ["."] [""] version}.tgz";
-    sha256 = "sha256-kMgRq+ej0v/b+bSuq1HPbgpai++04++oBvPVucMR4ic=";
+    sha256 = "sha256-J4LV5CnBVDxnN1r+VH/UxMoHIDCd6wCPfbeGJtx9FGQ=";
   };
 
   nativeBuildInputs = [ rsync ]
diff --git a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
index 64f3b81edde98..63e02e98ff747 100644
--- a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
+, cmake
 , qmake
 , qtbase
 , qtsvg
@@ -14,23 +15,24 @@
 , wrapQtAppsHook
 , gitUpdater
 
-, qt5Kvantum ? null
+, qt6Kvantum ? null
 }:
 let
-  isQt6 = lib.versionAtLeast qtbase.version "6";
+  isQt5 = lib.versionOlder qtbase.version "6";
 in
-stdenv.mkDerivation rec {
-  pname = "qtstyleplugin-kvantum${lib.optionalString isQt6 "6"}";
-  version = "1.0.10";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qtstyleplugin-kvantum${lib.optionalString isQt5 "5"}";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "tsujan";
     repo = "Kvantum";
-    rev = "V${version}";
-    sha256 = "48Blio8qHLmXSKG0c1tphXSfiwQXs0Xqwxe187nM3Ro=";
+    rev = "V${finalAttrs.version}";
+    hash = "sha256-i+QjVPSzWNPVQmQkB+u/3Wrvqqoz5OIjRdyZKXzxZh4=";
   };
 
   nativeBuildInputs = [
+    cmake
     qmake
     qttools
     wrapQtAppsHook
@@ -41,10 +43,11 @@ stdenv.mkDerivation rec {
     qtsvg
     libX11
     libXext
-  ] ++ lib.optionals (!isQt6) [ qtx11extras kwindowsystem ]
-    ++ lib.optional isQt6 qtwayland;
+    kwindowsystem
+  ] ++ lib.optionals isQt5 [ qtx11extras ]
+    ++ lib.optionals (!isQt5) [ qtwayland ];
 
-  sourceRoot = "${src.name}/Kvantum";
+  sourceRoot = "${finalAttrs.src.name}/Kvantum";
 
   patches = [
     (fetchpatch {
@@ -56,15 +59,19 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    # Fix plugin dir
-    substituteInPlace style/style.pro \
-      --replace "\$\$[QT_INSTALL_PLUGINS]" "$out/$qtPluginPrefix"
+    substituteInPlace style/CMakeLists.txt \
+      --replace-fail '"''${_Qt6_PLUGIN_INSTALL_DIR}/' "\"$out/$qtPluginPrefix/" \
+      --replace-fail '"''${_Qt5_PLUGIN_INSTALL_DIR}/' "\"$out/$qtPluginPrefix/"
   '';
 
-  postInstall = lib.optionalString isQt6 ''
-    # make default Kvantum themes available for Qt 6 apps
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_QT5" isQt5)
+  ];
+
+  postInstall = lib.optionalString isQt5 ''
+    # make default Kvantum themes available for Qt 5 apps
     mkdir -p "$out/share"
-    ln -s "${qt5Kvantum}/share/Kvantum" "$out/share/Kvantum"
+    ln -s "${qt6Kvantum}/share/Kvantum" "$out/share/Kvantum"
   '';
 
   passthru.updateScript = gitUpdater {
@@ -78,4 +85,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = with maintainers; [ romildo Scrumplex ];
   };
-}
+})
diff --git a/pkgs/development/libraries/raylib/default.nix b/pkgs/development/libraries/raylib/default.nix
index e655645cd866d..bb59eb9d654c1 100644
--- a/pkgs/development/libraries/raylib/default.nix
+++ b/pkgs/development/libraries/raylib/default.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "raylib";
-  version = "4.5.0";
+  version = "5.0";
 
   src = fetchFromGitHub {
     owner = "raysan5";
     repo = "raylib";
     rev = finalAttrs.version;
-    hash = "sha256-Uqqzq5shDp0AgSBT5waHBNUkEu0LRj70SNOlR5R2yAM=";
+    hash = "sha256-gEstNs3huQ1uikVXOW4uoYnIDr5l8O9jgZRTX1mkRww=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -56,20 +56,17 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests = [ raylib-games ];
 
   patches = [
-    # Patch version in CMakeList to 4.5.0
-    # Remove this when updating to a new revision
+    # Patch version in CMakeLists.txt to 5.0.0
+    # The library author doesn't use cmake, so when updating this package please
+    # check that the resulting library extension matches the version
+    # and remove/update this patch (resulting library name should match
+    # libraylib.so.${finalAttrs.version}
     (fetchpatch {
-      url = "https://github.com/raysan5/raylib/commit/0d4db7ad7f6fd442ed165ebf8ab8b3f4033b04e7.patch";
-      hash = "sha256-RGokbQAwJAZm2FU2VNwraE3xko8E+RLLFjUfDRXeKhA=";
+      url = "https://github.com/raysan5/raylib/commit/032cc497ca5aaca862dc926a93c2a45ed8017737.patch";
+      hash = "sha256-qsX5AwyQaGoRsbdszOO7tUF9dR+AkEFi4ebNkBVHNEY=";
     })
   ];
 
-  # fix libasound.so/libpulse.so not being found
-  preFixup = ''
-    ${lib.optionalString alsaSupport "patchelf --add-needed ${alsa-lib}/lib/libasound.so $out/lib/libraylib.so.${finalAttrs.version}"}
-    ${lib.optionalString pulseSupport "patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/libraylib.so.${finalAttrs.version}"}
-  '';
-
   meta = with lib; {
     description = "A simple and easy-to-use library to enjoy videogames programming";
     homepage = "https://www.raylib.com/";
diff --git a/pkgs/development/libraries/rutabaga_gfx/darwin-install.patch b/pkgs/development/libraries/rutabaga_gfx/darwin-install.patch
new file mode 100644
index 0000000000000..0b68ec2beb852
--- /dev/null
+++ b/pkgs/development/libraries/rutabaga_gfx/darwin-install.patch
@@ -0,0 +1,31 @@
+diff --git a/rutabaga_gfx/ffi/Makefile b/rutabaga_gfx/ffi/Makefile
+index f8c7820bf..e88a6c308 100644
+--- a/rutabaga_gfx/ffi/Makefile
++++ b/rutabaga_gfx/ffi/Makefile
+@@ -47,24 +47,16 @@ build:
+ 	cargo build $(gfxstream_feature) $(release)
+ 
+ install: build
+-ifeq ($(UNAME), Linux)
+ 	install -D -m 755 $(OUT)/$(LIB_NAME) $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION)
+-endif
+ ifeq ($(UNAME), Darwin)
+-	install_name_tool -id $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION) $(DESTDIR)$(libdir)/$(LIB_NAME)
++	install_name_tool -id $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION) $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION)
+ endif
+ 
+ 	ln -sf $(LIB_NAME).$(RUTABAGA_VERSION) $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION_MAJOR)
+ 	ln -sf $(LIB_NAME).$(RUTABAGA_VERSION) $(DESTDIR)$(libdir)/$(LIB_NAME)
+ 
+-ifeq ($(UNAME), Linux)
+ 	install -D -m 0644 $(SRC)/share/rutabaga_gfx_ffi.pc $(DESTDIR)$(libdir)/pkgconfig/rutabaga_gfx_ffi.pc
+ 	install -D -m 0644 $(SRC)/include/rutabaga_gfx_ffi.h $(DESTDIR)$(includedir)/rutabaga_gfx_ffi.h
+-endif
+-ifeq ($(UNAME), Darwin)
+-	install -m 0644 $(SRC)/share/rutabaga_gfx_ffi.pc $(DESTDIR)$(libdir)/pkgconfig/rutabaga_gfx_ffi.pc
+-	install -m 0644 $(SRC)/include/rutabaga_gfx_ffi.h $(DESTDIR)$(includedir)/rutabaga_gfx_ffi.h
+-endif
+ 
+ clean:
+ 	cargo clean $(release)
+
diff --git a/pkgs/development/libraries/rutabaga_gfx/default.nix b/pkgs/development/libraries/rutabaga_gfx/default.nix
index 63f1ed88ae6c1..6875002727357 100644
--- a/pkgs/development/libraries/rutabaga_gfx/default.nix
+++ b/pkgs/development/libraries/rutabaga_gfx/default.nix
@@ -8,6 +8,7 @@
 , aemu
 , gfxstream
 , libdrm
+, libiconv
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,10 +30,19 @@ stdenv.mkDerivation (finalAttrs: {
       decode = "base64 -d";
       hash = "sha256-Ji1bK7jnRlg0OpDfCLcTHfPSiz3zYcdgsWL4n3EoIYI=";
     })
+    # Fix error in Makefile where it uses eight spaces instead of a tab
+    # https://chromium-review.googlesource.com/c/crosvm/crosvm/+/4863380
+    (fetchpatch {
+      url = "https://chromium.googlesource.com/crosvm/crosvm/+/fc415bccc43d36f63a2fd4c28878591bb1053450%5E%21/?format=TEXT";
+      decode = "base64 -d";
+      hash = "sha256-SLzlZ4o1+R2bGTPvA0a5emq97hOIIIHrubFhcQjqYwg=";
+    })
+    # Install the dylib on Darwin.
+    ./darwin-install.patch
   ];
 
   nativeBuildInputs = [ cargo pkg-config rustPlatform.cargoSetupHook ];
-  buildInputs = lib.optionals (lib.meta.availableOn stdenv.hostPlatform gfxstream) ([
+  buildInputs = [ libiconv ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform gfxstream) ([
     aemu
     gfxstream
   ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform libdrm) [
diff --git a/pkgs/development/ocaml-modules/topkg/default.nix b/pkgs/development/ocaml-modules/topkg/default.nix
index a62cd9152ae6b..0baa38c806ef6 100644
--- a/pkgs/development/ocaml-modules/topkg/default.nix
+++ b/pkgs/development/ocaml-modules/topkg/default.nix
@@ -10,8 +10,8 @@ build system is required, the attribute `run` can be used.
 let
   param =
   if lib.versionAtLeast ocaml.version "4.05" then {
-    version = "1.0.5";
-    sha256 = "sha256-RSCCYm5lGsSxYzwrSuTK16vrH7ahMEbmmfle7Fi10cc=";
+    version = "1.0.7";
+    sha256 = "sha256-X8Iq0/OtbRJ8sSRdGFgIgUeNotbeULIxXm3UWGxSvhk=";
   } else if lib.versionAtLeast ocaml.version "4.03" then {
     version = "1.0.3";
     sha256 = "0b77gsz9bqby8v77kfi4lans47x9p2lmzanzwins5r29maphb8y6";
diff --git a/pkgs/development/python-modules/aiopvpc/default.nix b/pkgs/development/python-modules/aiopvpc/default.nix
index 853d012577404..19baf29f55c5c 100644
--- a/pkgs/development/python-modules/aiopvpc/default.nix
+++ b/pkgs/development/python-modules/aiopvpc/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiopvpc";
-  version = "4.3.0";
+  version = "4.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "azogue";
     repo = "aiopvpc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8CNmrE3EMFg/bCrdI+K/8f0MRzKtGI74ILFMuSg1Ivo=";
+    hash = "sha256-1xeXfhoXRfJ7vrpRPeYmwcAGjL09iNCOm/f4pPvuZLU=";
   };
 
   postPatch = ''
@@ -31,11 +31,11 @@ buildPythonPackage rec {
       --replace-fail " --cov --cov-report term --cov-report html" ""
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     async-timeout
   ] ++ lib.optionals (pythonOlder "3.9") [
diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index a3af5ba33b864..7dc1c65349eaf 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "app-model";
-  version = "0.2.5";
+  version = "0.2.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pyapp-kit";
     repo = "app-model";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lnsaplJJk+c0hdHyQPH98ssppxBXqj/O0K6xlRfk+Oc=";
+    hash = "sha256-EMlxY9Xna9e3kWJ7X8oRuLHEmivwVFcEXRDvZfN2rNY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bc-detect-secrets/default.nix b/pkgs/development/python-modules/bc-detect-secrets/default.nix
index e15cae2562407..df19afca09d5a 100644
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.5.4";
+  version = "1.5.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,14 +25,14 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     rev = "refs/tags/${version}";
-    hash = "sha256-Gm8PYN9vqYkGaGKpLZkx0Ehd1P3G2d5LkSjWXxpPerI=";
+    hash = "sha256-05hxc34ecSoAp0GBVf9yq2BC928wxZOLZJHAbJ7cdtk=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     pyyaml
     requests
     unidiff
diff --git a/pkgs/development/python-modules/cjkwrap/default.nix b/pkgs/development/python-modules/cjkwrap/default.nix
index 43e5909ec47b5..83f487a2af140 100644
--- a/pkgs/development/python-modules/cjkwrap/default.nix
+++ b/pkgs/development/python-modules/cjkwrap/default.nix
@@ -1,10 +1,11 @@
 { lib, buildPythonPackage, fetchPypi }:
 
 buildPythonPackage rec {
-  pname = "CJKwrap";
+  pname = "cjkwrap";
   version = "2.2";
   src = fetchPypi {
-    inherit pname version;
+    pname = "CJKwrap";
+    inherit version;
     sha256 = "1b603sg6c2gv9vmlxwr6r1qvhadqk3qp6vifmijris504zjx5ix2";
   };
 
diff --git a/pkgs/development/python-modules/clickhouse-connect/default.nix b/pkgs/development/python-modules/clickhouse-connect/default.nix
index 5be944efdb1d3..277216a3f9685 100644
--- a/pkgs/development/python-modules/clickhouse-connect/default.nix
+++ b/pkgs/development/python-modules/clickhouse-connect/default.nix
@@ -23,7 +23,7 @@
 }:
 buildPythonPackage rec {
   pname = "clickhouse-connect";
-  version = "0.7.3";
+  version = "0.7.4";
 
   format = "setuptools";
 
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     repo = "clickhouse-connect";
     owner = "ClickHouse";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MA902Dyx3a8GTZ52LYY0UrWqNEFmibqIsdz6PFZIkIY=";
+    hash = "sha256-YEtcM9+GO8mYv2pyaBYmXdmWLXVuteKtQIJR4H+Xsd4=";
   };
 
   nativeBuildInputs = [ cython_3 ];
diff --git a/pkgs/development/python-modules/cppheaderparser/default.nix b/pkgs/development/python-modules/cppheaderparser/default.nix
index bf2c696f2841e..cb834b1d48a18 100644
--- a/pkgs/development/python-modules/cppheaderparser/default.nix
+++ b/pkgs/development/python-modules/cppheaderparser/default.nix
@@ -5,11 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "CppHeaderParser";
+  pname = "cppheaderparser";
   version = "2.7.4";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "CppHeaderParser";
+    inherit version;
     hash = "sha256-OCswQW2VsKXoUCshSBDcrCpWQykX4mUUR9Or4lPjzEI=";
   };
 
diff --git a/pkgs/development/python-modules/cypari2/default.nix b/pkgs/development/python-modules/cypari2/default.nix
index cf808fe263a4e..f93e046297281 100644
--- a/pkgs/development/python-modules/cypari2/default.nix
+++ b/pkgs/development/python-modules/cypari2/default.nix
@@ -12,12 +12,12 @@
 buildPythonPackage rec {
   pname = "cypari2";
   # upgrade may break sage, please test the sage build or ping @timokau on upgrade
-  version = "2.1.4";
+  version = "2.1.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-76SkTZb2k8sRVtof1vzMEw2vz5wZr0GFz3cL9E0A2/w=";
+    sha256 = "sha256-GiWGXDTyCx3JWDB5jjSrZDbieLjgyA3HvwqzTF2wOrg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/delorean/default.nix b/pkgs/development/python-modules/delorean/default.nix
index 8573dc7095f5a..81f1a1e44469c 100644
--- a/pkgs/development/python-modules/delorean/default.nix
+++ b/pkgs/development/python-modules/delorean/default.nix
@@ -9,12 +9,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Delorean";
+  pname = "delorean";
   version = "1.0.0";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Delorean";
+    inherit version;
     hash = "sha256-/md4bhIzhSOEi+xViKZYxNQl4S1T61HP74cL7I9XYTQ=";
   };
 
diff --git a/pkgs/development/python-modules/django-auth-ldap/default.nix b/pkgs/development/python-modules/django-auth-ldap/default.nix
index 3fa84658b6d02..3983cf3f3661a 100644
--- a/pkgs/development/python-modules/django-auth-ldap/default.nix
+++ b/pkgs/development/python-modules/django-auth-ldap/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "django-auth-ldap";
-  version = "4.6.0";
+  version = "4.7.0";
   format = "pyproject";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-muK/h/m2Nnts/ZSgRRiWy8co5UAO2By/vVjOdDwJCaI=";
+    hash = "sha256-jeplN2uLL6G+7lI0h2DjCC5kKTmlA4y+iBpeY4G2W4o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dnfile/default.nix b/pkgs/development/python-modules/dnfile/default.nix
index 232927aace707..40b97b6b6d8ac 100644
--- a/pkgs/development/python-modules/dnfile/default.nix
+++ b/pkgs/development/python-modules/dnfile/default.nix
@@ -9,8 +9,8 @@
 
 buildPythonPackage rec {
   pname = "dnfile";
-  version = "0.14.1";
-  format = "pyproject";
+  version = "0.15.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -18,15 +18,15 @@ buildPythonPackage rec {
     owner = "malwarefrank";
     repo = "dnfile";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5xkoG7c9Piwrv+9qour7MZ+rabdngtd05b0T+AU8tSo=";
+    hash = "sha256-HzlMJ4utBHyLLhO+u0uiTfqtk8jX80pEyO75QvpJ3yg=";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     pefile
   ];
 
diff --git a/pkgs/development/python-modules/ecpy/default.nix b/pkgs/development/python-modules/ecpy/default.nix
index 37bbb183ff40c..5f18e814cfe7f 100644
--- a/pkgs/development/python-modules/ecpy/default.nix
+++ b/pkgs/development/python-modules/ecpy/default.nix
@@ -1,11 +1,12 @@
 { lib, fetchPypi, buildPythonPackage, isPy3k, future }:
 
 buildPythonPackage rec {
-  pname = "ECPy";
+  pname = "ecpy";
   version = "1.2.5";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ECPy";
+    inherit version;
     sha256 = "9635cffb9b6ecf7fd7f72aea1665829ac74a1d272006d0057d45a621aae20228";
   };
 
diff --git a/pkgs/development/python-modules/enterpriseattack/default.nix b/pkgs/development/python-modules/enterpriseattack/default.nix
new file mode 100644
index 0000000000000..745cc331c6043
--- /dev/null
+++ b/pkgs/development/python-modules/enterpriseattack/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, requests
+, setuptools
+, ujson
+}:
+
+buildPythonPackage rec {
+  pname = "enterpriseattack";
+  version = "0.1.8";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "xakepnz";
+    repo = "enterpriseattack";
+    rev = "refs/tags/v.${version}";
+    hash = "sha256-cxbGc9iQe94Th6MSUldI17oVCclFhUM78h1w+6KXzm4=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    requests
+    ujson
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "enterpriseattack"
+  ];
+
+  meta = with lib; {
+    description = "Module to interact with the Mitre Att&ck Enterprise dataset";
+    homepage = "https://github.com/xakepnz/enterpriseattack";
+    changelog = "https://github.com/xakepnz/enterpriseattack/releases/tag/v.${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/findpython/default.nix b/pkgs/development/python-modules/findpython/default.nix
index a405ab3d6ec09..78875b6db2c8f 100644
--- a/pkgs/development/python-modules/findpython/default.nix
+++ b/pkgs/development/python-modules/findpython/default.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "findpython";
-  version = "0.4.1";
+  version = "0.5.1";
 in
 buildPythonPackage {
   inherit pname version;
@@ -25,7 +25,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-19AUVYaBs3YdV6WyNCpxOovzAvbB/J2Z+Budi9FoGwQ=";
+    hash = "sha256-UGSjA5PFLvyMajV5DDdbiwAF1vdPFykDW0tCZHNH4T0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index dae2aae43bf21..1ff20bf488738 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -66,6 +66,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/danielperna84/hahomematic";
     changelog = "https://github.com/danielperna84/hahomematic/releases/tag/${version}";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    maintainers = with maintainers; [ dotlambda fab ];
   };
 }
diff --git a/pkgs/development/python-modules/heapdict/default.nix b/pkgs/development/python-modules/heapdict/default.nix
index 61cbe39a256a1..44852a3bf4bde 100644
--- a/pkgs/development/python-modules/heapdict/default.nix
+++ b/pkgs/development/python-modules/heapdict/default.nix
@@ -1,11 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, isPy3k }:
 
 buildPythonPackage rec {
-  pname = "HeapDict";
+  pname = "heapdict";
   version = "1.0.1";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "HeapDict";
+    inherit version;
     sha256 = "8495f57b3e03d8e46d5f1b2cc62ca881aca392fd5cc048dc0aa2e1a6d23ecdb6";
   };
 
diff --git a/pkgs/development/python-modules/hsh/default.nix b/pkgs/development/python-modules/hsh/default.nix
new file mode 100644
index 0000000000000..2bc68d3aac9d4
--- /dev/null
+++ b/pkgs/development/python-modules/hsh/default.nix
@@ -0,0 +1,42 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, commandlines
+, unittestCheckHook
+, pexpect
+, naked
+, nix-update-script
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "hsh";
+  version = "1.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "chrissimpkins";
+    repo = "hsh";
+    rev = "v${version}";
+    hash = "sha256-bAAytoidFHH2dSXqN9aqBd2H4p/rwTWXIZa1t5Djdz0=";
+  };
+
+  propagatedBuildInputs = [ commandlines ];
+
+  nativeBuildInputs = [ setuptools wheel ];
+
+  nativeCheckInputs = [ unittestCheckHook pexpect naked ];
+
+  preCheck = "cd tests";
+
+  pythonImportsCheck = [ "hsh" ];
+
+  meta = with lib; {
+    description = "Cross-platform command line application that generates file hash digests and performs file integrity checks via file hash digest comparisons";
+    homepage = "https://github.com/chrissimpkins/hsh";
+    downloadPage = "https://github.com/chrissimpkins/hsh/releases";
+    license = licenses.mit;
+    maintainers = [ maintainers.lucasew ];
+  };
+}
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index 22e4c5aa838d8..e160eec612cf1 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "google";
     repo = "jax";
     # google/jax contains tags for jax and jaxlib. Only use jax tags!
-    rev = "refs/tags/jaxlib-v${version}";
+    rev = "refs/tags/jax-v${version}";
     hash = "sha256-poQQo2ZgEhPYzK3aCs+BjaHTNZbezJAECd+HOdY1Yok=";
   };
 
@@ -144,6 +144,9 @@ buildPythonPackage rec {
     };
   };
 
+  # updater fails to pick the correct branch
+  passthru.skipBulkUpdate = true;
+
   meta = with lib; {
     description = "Differentiate, compile, and transform Numpy code";
     homepage = "https://github.com/google/jax";
diff --git a/pkgs/development/python-modules/keras-applications/default.nix b/pkgs/development/python-modules/keras-applications/default.nix
index 82ee6803d4bf3..fdfbdba89cb8b 100644
--- a/pkgs/development/python-modules/keras-applications/default.nix
+++ b/pkgs/development/python-modules/keras-applications/default.nix
@@ -1,11 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, numpy, h5py }:
 
 buildPythonPackage rec {
-  pname = "Keras_Applications";
+  pname = "keras-applications";
   version = "1.0.8";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Keras_Applications";
+    inherit version;
     sha256 = "5579f9a12bcde9748f4a12233925a59b93b73ae6947409ff34aa2ba258189fe5";
   };
 
diff --git a/pkgs/development/python-modules/keras-preprocessing/default.nix b/pkgs/development/python-modules/keras-preprocessing/default.nix
index 49bc63a5db08e..833a01c0f2546 100644
--- a/pkgs/development/python-modules/keras-preprocessing/default.nix
+++ b/pkgs/development/python-modules/keras-preprocessing/default.nix
@@ -1,11 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, numpy, six, scipy, pillow, pytest, keras }:
 
 buildPythonPackage rec {
-  pname = "Keras_Preprocessing";
+  pname = "keras-preprocessing";
   version = "1.1.2";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Keras_Preprocessing";
+    inherit version;
     sha256 = "add82567c50c8bc648c14195bf544a5ce7c1f76761536956c3d2978970179ef3";
   };
 
diff --git a/pkgs/development/python-modules/llama-index-cli/default.nix b/pkgs/development/python-modules/llama-index-cli/default.nix
index de4aacdd5adcd..a82dc25e1cd0c 100644
--- a/pkgs/development/python-modules/llama-index-cli/default.nix
+++ b/pkgs/development/python-modules/llama-index-cli/default.nix
@@ -1,34 +1,50 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
+, fetchPypi
 , llama-index-core
 , llama-index-embeddings-openai
 , llama-index-llms-openai
 , llama-index-vector-stores-chroma
 , poetry-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "llama-index-cli";
-
-  inherit (llama-index-core) version src meta;
-
+  version = "0.1.11";
   pyproject = true;
 
-  sourceRoot = "${src.name}/${pname}";
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    pname = "llama_index_cli";
+    inherit version;
+    hash = "sha256-XecH4SWqh31wxh2nDMRP6nKp9623f0E7Ufc7He/911A=";
+  };
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     llama-index-core
     llama-index-embeddings-openai
     llama-index-llms-openai
     llama-index-vector-stores-chroma
   ];
 
+  # Tests are only available in the mono repo
+  doCheck = false;
+
   pythonImportsCheck = [
     "llama_index.cli"
   ];
+
+  meta = with lib; {
+    description = "LlamaIndex CLI";
+    homepage = "https://github.com/run-llama/llama_index/tree/main/llama-index-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+
 }
diff --git a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
index 6b371c8169834..21b9f3bc3f02a 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
@@ -1,36 +1,52 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
+, fetchPypi
 , google-generativeai
 , llama-index-core
 , poetry-core
 , pytestCheckHook
+, pythonRelaxDepsHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "llama-index-embeddings-gemini";
-  version = "0.1.3";
+  version = "0.1.5";
+  pyproject = true;
 
-  inherit (llama-index-core) src meta;
+  disabled = pythonOlder "3.9";
 
-  pyproject = true;
+  src = fetchPypi {
+    pname = "llama_index_embeddings_gemini";
+    inherit version;
+    hash = "sha256-FQzZ+MjuAApOImpxQhuaCFDIKdojzD5zqDOepo8fCNo=";
+  };
 
-  sourceRoot = "${src.name}/llama-index-integrations/embeddings/${pname}";
+  pythonRelaxDeps = [
+    "google-generativeai"
+  ];
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
+    pythonRelaxDepsHook
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     google-generativeai
     llama-index-core
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  # Tests are only available in the mono repo
+  doCheck = false;
 
   pythonImportsCheck = [
     "llama_index.embeddings.gemini"
   ];
+
+  meta = with lib; {
+    description = "LlamaIndex Llms Integration for Gemini";
+    homepage = "https://github.com/run-llama/llama_index/tree/main/llama-index-integrations/embeddings/llama-index-embeddings-gemini";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
 }
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index 4c5503c66071f..f4b441142bfb9 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -1,27 +1,30 @@
 { lib
 , beautifulsoup4
 , buildPythonPackage
-, fetchFromGitHub
+, fetchPypi
 , llama-index-core
 , poetry-core
 , pymupdf
 , pypdf
-, pytestCheckHook
+, pythonOlder
 , pythonRelaxDepsHook
+, striprtf
 }:
 
 buildPythonPackage rec {
   pname = "llama-index-readers-file";
-  version = "0.1.7";
-
-  inherit (llama-index-core) src meta;
-
+  version = "0.1.12";
   pyproject = true;
 
-  sourceRoot = "${src.name}/llama-index-integrations/readers/${pname}";
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    pname = "llama_index_readers_file";
+    inherit version;
+    hash = "sha256-YGXL+AsPtdGJVYuLkK273JKsuGFH/KGS2I/MJwStKvM=";
+  };
 
   pythonRelaxDeps = [
-    "beautifulsoup4"
     "pymupdf"
     "pypdf"
   ];
@@ -30,23 +33,30 @@ buildPythonPackage rec {
     "bs4"
   ];
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
     pythonRelaxDepsHook
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     beautifulsoup4
     llama-index-core
     pymupdf
     pypdf
+    striprtf
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  # Tests are only available in the mono repo
+  doCheck = false;
 
   pythonImportsCheck = [
     "llama_index.readers.file"
   ];
+
+  meta = with lib; {
+    description = "LlamaIndex Readers Integration for files";
+    homepage = "https://github.com/run-llama/llama_index/tree/main/llama-index-integrations/readers/llama-index-readers-file";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
 }
diff --git a/pkgs/development/python-modules/llama-index-readers-json/default.nix b/pkgs/development/python-modules/llama-index-readers-json/default.nix
index c29dcd78c4337..4b1d670818b68 100644
--- a/pkgs/development/python-modules/llama-index-readers-json/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-json/default.nix
@@ -1,34 +1,43 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
+, fetchPypi
 , llama-index-core
 , poetry-core
-, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "llama-index-readers-json";
-  version = "0.1.2";
-
-  inherit (llama-index-core) src meta;
-
+  version = "0.1.5";
   pyproject = true;
 
-  sourceRoot = "${src.name}/llama-index-integrations/readers/${pname}";
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    pname = "llama_index_readers_json";
+    inherit version;
+    hash = "sha256-H+CG+2FtoOF/DUG6EuAWzY2xe1upLX0pakVutJTZFE0=";
+  };
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     llama-index-core
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  # Tests are only available in the mono repo
+  doCheck = false;
 
   pythonImportsCheck = [
     "llama_index.readers.json"
   ];
+
+  meta = with lib; {
+    description = "LlamaIndex Readers Integration for Json";
+    homepage = "https://github.com/run-llama/llama_index/tree/main/llama-index-integrations/readers/llama-index-readers-json";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
 }
diff --git a/pkgs/development/python-modules/lupa/default.nix b/pkgs/development/python-modules/lupa/default.nix
index b2123b92eb1fd..c79f0de9dd893 100644
--- a/pkgs/development/python-modules/lupa/default.nix
+++ b/pkgs/development/python-modules/lupa/default.nix
@@ -1,24 +1,26 @@
 { lib
 , buildPythonPackage
-, cython
+, cython_3
 , fetchPypi
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "lupa";
-  version = "2.0";
-  format = "setuptools";
+  version = "2.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rT/vSGvnrd3TSf6anDk3iQYTEs+Y68UztIm+NPSEy3k=";
+    hash = "sha256-dgAwcS1SczlvXpY92HMa77WsZdku/4v4/UEkwWMP6VA=";
   };
 
-  nativeBuildInputs = [
-    cython
+  build-system = [
+    cython_3
+    setuptools
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/mkdocs-swagger-ui-tag/default.nix b/pkgs/development/python-modules/mkdocs-swagger-ui-tag/default.nix
index 60fe20c468af1..62f5286747f0a 100644
--- a/pkgs/development/python-modules/mkdocs-swagger-ui-tag/default.nix
+++ b/pkgs/development/python-modules/mkdocs-swagger-ui-tag/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-swagger-ui-tag";
-  version = "0.6.8";
+  version = "0.6.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Blueswen";
     repo = "mkdocs-swagger-ui-tag";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TV7V1PttzyLeVQ/Ag/tMV2aqtCys1mlYpj6i0x+ko/w=";
+    hash = "sha256-4cRElwF8AOvTLZJq1NF9Yqa7g44uiT96giyhqKZKp5M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/modestmaps/default.nix b/pkgs/development/python-modules/modestmaps/default.nix
index 202589b7435c6..180baaefce778 100644
--- a/pkgs/development/python-modules/modestmaps/default.nix
+++ b/pkgs/development/python-modules/modestmaps/default.nix
@@ -6,12 +6,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "ModestMaps";
+  pname = "modestmaps";
   version = "1.4.7";
   disabled = !isPy27;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ModestMaps";
+    inherit version;
     sha256 = "698442a170f02923f8ea55f18526b56c17178162e44304f896a8a5fd65ab4457";
   };
 
diff --git a/pkgs/development/python-modules/mutatormath/default.nix b/pkgs/development/python-modules/mutatormath/default.nix
index 1fdb937e33ea7..27e92103c5a96 100644
--- a/pkgs/development/python-modules/mutatormath/default.nix
+++ b/pkgs/development/python-modules/mutatormath/default.nix
@@ -4,11 +4,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "MutatorMath";
+  pname = "mutatormath";
   version = "3.0.1";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "MutatorMath";
+    inherit version;
     sha256 = "0r1qq45np49x14zz1zwkaayqrn7m8dn2jlipjldg2ihnmpzw29w1";
     extension = "zip";
   };
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index fa22b57526a1b..74b48b53458ee 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -21,11 +21,11 @@ let
         inherit pname version hash;
       };
 
-      nativeBuildInputs = [
+      build-system = [
         setuptools
       ];
 
-      propagatedBuildInputs = [
+      dependencies = [
         boto3
       ] ++ lib.optionals (pythonOlder "3.12") [
         typing-extensions
@@ -159,7 +159,7 @@ rec {
 
   mypy-boto3-cloudwatch = buildMypyBoto3Package "cloudwatch" "1.34.40" "sha256-M/C3Rzie5dcv6TGVl7ilI5WiT1uYFrCGL+7Fga+xSLw=";
 
-  mypy-boto3-codeartifact = buildMypyBoto3Package "codeartifact" "1.34.0" "sha256-iUgoanqMSyxRopVctyFLiu+otFSgRvdgQPw4mKX3QIk=";
+  mypy-boto3-codeartifact = buildMypyBoto3Package "codeartifact" "1.34.68" "sha256-Ey0cmx0OxN1/VXIyvn0EOBP9qYIuc/XyFVZniHLaNEY=";
 
   mypy-boto3-codebuild = buildMypyBoto3Package "codebuild" "1.34.67" "sha256-Kvd8zAHfepA4dulpiQCaT2pfKCH567d6CYd5QlweXIY=";
 
@@ -295,7 +295,7 @@ rec {
 
   mypy-boto3-finspace-data = buildMypyBoto3Package "finspace-data" "1.34.0" "sha256-8mND5BbdKY5srFwdpxSyfCUTIP4fa9hztP4daUJOB8k=";
 
-  mypy-boto3-firehose = buildMypyBoto3Package "firehose" "1.34.46" "sha256-Fgs7wrwKPK79cYduCR/RYQ2FEZvghDuWI1hXKzFLfJo=";
+  mypy-boto3-firehose = buildMypyBoto3Package "firehose" "1.34.69" "sha256-GCMH/XA9ETSuo39OnlvyhfHDKylsTeLO1R1+7tl2S/E=";
 
   mypy-boto3-fis = buildMypyBoto3Package "fis" "1.34.63" "sha256-TJnzgQGDcybpVqg+p7Tuvw/RoY79cQPPChyHWlMxhiY=";
 
@@ -393,7 +393,7 @@ rec {
 
   mypy-boto3-kafkaconnect = buildMypyBoto3Package "kafkaconnect" "1.34.50" "sha256-frPPAQeFyO92uMqqzBcSC3MVK4V4hbdO9tx4awAKAUU=";
 
-  mypy-boto3-kendra = buildMypyBoto3Package "kendra" "1.34.0" "sha256-j1fph9WwqBns2BpZjoKTpXC9gUJ4lu+poPBV6LIOusM=";
+  mypy-boto3-kendra = buildMypyBoto3Package "kendra" "1.34.69" "sha256-OKUSsCfv2X9ad5XUSwm0KRwW++qb+AVtvCOurlRM/bo=";
 
   mypy-boto3-kendra-ranking = buildMypyBoto3Package "kendra-ranking" "1.34.0" "sha256-hbemz5ECtfP3oi645lZT7CCx31yg8MNqbAD32Am6l1U=";
 
@@ -565,7 +565,7 @@ rec {
 
   mypy-boto3-polly = buildMypyBoto3Package "polly" "1.34.43" "sha256-rx5sW32N6H47fpy5yGvwlKKVKS/uIKOtLfsjoGoNPJg=";
 
-  mypy-boto3-pricing = buildMypyBoto3Package "pricing" "1.34.39" "sha256-SdIK9pWjyY6rcK9Kak5r66hP6tc/OVp+gQ9wo7HKVms=";
+  mypy-boto3-pricing = buildMypyBoto3Package "pricing" "1.34.69" "sha256-0+bak3+4FQK0vAjI1r7uKvhwspZxt/zLCJRVMvH41qs=";
 
   mypy-boto3-privatenetworks = buildMypyBoto3Package "privatenetworks" "1.34.0" "sha256-WFX0KaJRo0LCPKEAq8LES0P3WJkt6ywLXqTlOFZyZ1w=";
 
@@ -603,7 +603,7 @@ rec {
 
   mypy-boto3-robomaker = buildMypyBoto3Package "robomaker" "1.34.0" "sha256-dAL2P2bxhSc5oLZXhhekrt9y4bWXg7kIr+/FVbkFTww=";
 
-  mypy-boto3-rolesanywhere = buildMypyBoto3Package "rolesanywhere" "1.34.0" "sha256-U/j/u6pqoHpfNP3GbQ8SZb+qIL842ZcwwdBr1QQhlj0=";
+  mypy-boto3-rolesanywhere = buildMypyBoto3Package "rolesanywhere" "1.34.69" "sha256-wuPEIXHDNvPOWIKLRx5ZR/SgQaWEYqA+IHNR3NZDhIs=";
 
   mypy-boto3-route53 = buildMypyBoto3Package "route53" "1.34.31" "sha256-MtmEtt57vhFRG1O+VnFXFUhSWAQ7JrnV3hBZx4TpOh8=";
 
@@ -649,7 +649,7 @@ rec {
 
   mypy-boto3-secretsmanager = buildMypyBoto3Package "secretsmanager" "1.34.63" "sha256-oZM3PXGPdH1Th4tcx/7y6bj944kuR4isaQ/SsWo1Vkw=";
 
-  mypy-boto3-securityhub = buildMypyBoto3Package "securityhub" "1.34.20" "sha256-EcLY5SXSN2kJEuo8s2sYJJfq/X78BM1msyI9TfYD7Xw=";
+  mypy-boto3-securityhub = buildMypyBoto3Package "securityhub" "1.34.69" "sha256-2fJx1VaOhYSjTXAEboBhHhMdTH697zcGHmrJsGknDTI=";
 
   mypy-boto3-securitylake = buildMypyBoto3Package "securitylake" "1.34.53" "sha256-O/RHRoeUYT5DerEXIQ1NL288bcgA6bGdI29sN7WoQac=";
 
diff --git a/pkgs/development/python-modules/naked/default.nix b/pkgs/development/python-modules/naked/default.nix
new file mode 100644
index 0000000000000..7a37d66861aa5
--- /dev/null
+++ b/pkgs/development/python-modules/naked/default.nix
@@ -0,0 +1,103 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, requests
+, pyyaml
+, setuptools
+, wheel
+, nodejs
+, ruby
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "naked";
+  version = "0.1.32";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "chrissimpkins";
+    repo = "naked";
+    rev = "v${version}";
+    hash = "sha256-KhygnURFggvUTR9wwWtORtfQES8ANd5sIaCONvIhfRM=";
+  };
+
+  postPatch = ''
+    # fix hardcoded absolute paths
+    substituteInPlace **/*.* \
+      --replace /Users/ces/Desktop/code/naked /build/source
+  '';
+
+  nativeBuildInputs = [ wheel setuptools ];
+
+  propagatedBuildInputs = [
+    requests
+    pyyaml
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook nodejs ruby ];
+
+  preCheck =''
+    cd tests
+
+    PATH=$PATH:$out/bin
+  '';
+
+  disabledTestPaths = [ "testfiles" ];
+
+  disabledTests = [
+    # test_NETWORK.py
+    "test_http_get"
+    "test_http_get_binary_file_absent"
+    "test_http_get_binary_file_exists"
+    "test_http_get_bin_type"
+    "test_http_get_follow_redirects"
+    "test_http_get_follow_redirects_false_content"
+    "test_http_get_follow_redirects_false_on_nofollow_arg"
+    "test_http_get_response_check_200"
+    "test_http_get_response_check_301"
+    "test_http_get_response_check_404"
+    "test_http_get_response_obj_present"
+    "test_http_get_ssl"
+    "test_http_get_status_check_true"
+    "test_http_get_status_ssl"
+    "test_http_get_status_ssl_redirect"
+    "test_http_get_text_absent"
+    "test_http_get_text_exists_request_overwrite"
+    "test_http_get_type"
+    "test_http_post"
+    "test_http_post_binary_file_absent"
+    "test_http_post_binary_file_present"
+    "test_http_post_binary_file_present_request_overwrite"
+    "test_http_post_reponse_status_200"
+    "test_http_post_response_status_200_ssl"
+    "test_http_post_ssl"
+    "test_http_post_status_check_true"
+    "test_http_post_text_file_absent"
+    "test_http_post_text_file_present_request_overwrite"
+    "test_http_post_type"
+    # test_SHELL.py
+    "test_muterun_missing_option_exitcode"
+    # test_SYSTEM.py
+    "test_sys_list_all_files"
+    "test_sys_list_all_files_cwd"
+    "test_sys_list_all_files_emptydir"
+    "test_sys_list_filter_files"
+    "test_sys_match_files"
+    "test_sys_match_files_fullpath"
+    "test_sys_meta_file_mod"
+    # test_TYPES.py
+    "test_xdict_key_random"
+    "test_xdict_key_random_sample"
+  ];
+
+  pythonImportsCheck = [ "Naked" ];
+
+  meta = with lib; {
+    description = "A Python command line application framework";
+    homepage = "https://github.com/chrissimpkins/naked";
+    downloadPage = "https://github.com/chrissimpkins/naked/tags";
+    license = licenses.mit;
+    maintainers = [ maintainers.lucasew ];
+  };
+}
diff --git a/pkgs/development/python-modules/netcdf4/default.nix b/pkgs/development/python-modules/netcdf4/default.nix
index f181a7d4c4fed..39994519db17b 100644
--- a/pkgs/development/python-modules/netcdf4/default.nix
+++ b/pkgs/development/python-modules/netcdf4/default.nix
@@ -18,14 +18,15 @@
 }:
 
 buildPythonPackage rec {
-  pname = "netCDF4";
+  pname = "netcdf4";
   version = "1.6.2";
   format = "pyproject";
 
   disabled = isPyPy;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "netCDF4";
+    inherit version;
     hash = "sha256-A4KwL/aiiEGfb/7IXexA9FH0G4dVVHFUxXXd2fD0rlM=";
   };
 
diff --git a/pkgs/development/python-modules/niaclass/default.nix b/pkgs/development/python-modules/niaclass/default.nix
index eca766c67a0f0..796bb17063f97 100644
--- a/pkgs/development/python-modules/niaclass/default.nix
+++ b/pkgs/development/python-modules/niaclass/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "niaclass";
-  version = "0.1.4";
+  version = "0.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "lukapecnik";
     repo = "NiaClass";
     rev = "refs/tags/${version}";
-    hash = "sha256-md1e/cOIOQKoB760E5hjzjCsC5tS1CzgqAPTeVtrmuo=";
+    hash = "sha256-C3EF18lzheE+dXHJA6WJNFECAH4HfPiCDo7QxtHvOLI=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/oracledb/default.nix b/pkgs/development/python-modules/oracledb/default.nix
index 2fe7db175ff84..da45e616b42c4 100644
--- a/pkgs/development/python-modules/oracledb/default.nix
+++ b/pkgs/development/python-modules/oracledb/default.nix
@@ -10,23 +10,23 @@
 
 buildPythonPackage rec {
   pname = "oracledb";
-  version = "2.1.0";
+  version = "2.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HJpEjJhD2zPxC3d9aSD7k5XqsLD9wX8WIPrHw+7NtXo=";
+    hash = "sha256-4ugXz6bf82xxMXNvNOKq7HXXJv040ZENgxgGGieCKPo=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     cython_3
     setuptools
     wheel
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cryptography
   ];
 
diff --git a/pkgs/development/python-modules/pinecone-client/default.nix b/pkgs/development/python-modules/pinecone-client/default.nix
index 86edb6e597cb8..c846603e8ca52 100644
--- a/pkgs/development/python-modules/pinecone-client/default.nix
+++ b/pkgs/development/python-modules/pinecone-client/default.nix
@@ -16,13 +16,13 @@
 }:
 buildPythonPackage rec {
   pname = "pinecone-client";
-  version = "3.1.0";
+  version = "3.2.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pinecone_client";
     inherit version;
-    hash = "sha256-RbggYBP5GpgrmU8fuqOefoyZ0w7zd4qfMZxDuMmS/EI=";
+    hash = "sha256-hWD/r7E7nEWpLrnrd6LbMtWh+nkDodsX969Y7hBYu2A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyaudio/default.nix b/pkgs/development/python-modules/pyaudio/default.nix
index 2cab06e7c7862..d9d4aa7b70e73 100644
--- a/pkgs/development/python-modules/pyaudio/default.nix
+++ b/pkgs/development/python-modules/pyaudio/default.nix
@@ -6,12 +6,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyAudio";
+  pname = "pyaudio";
   version = "0.2.14";
   disabled = isPyPy;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyAudio";
+    inherit version;
     hash = "sha256-eN//OHm0mU0fT8ZIVkald1XG7jwZZHpJH3kKCJW9L4c=";
   };
 
diff --git a/pkgs/development/python-modules/pybrowserid/default.nix b/pkgs/development/python-modules/pybrowserid/default.nix
index 23906cbd2e4e8..1a4cd7c43058c 100644
--- a/pkgs/development/python-modules/pybrowserid/default.nix
+++ b/pkgs/development/python-modules/pybrowserid/default.nix
@@ -2,11 +2,12 @@
 , requests, mock }:
 
 buildPythonPackage rec {
-  pname = "PyBrowserID";
+  pname = "pybrowserid";
   version = "0.14.0";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyBrowserID";
+    inherit version;
     sha256 = "1qvi79kfb8x9kxkm5lw2mp42hm82cpps1xknmsb5ghkwx1lpc8kc";
   };
 
@@ -21,4 +22,3 @@ buildPythonPackage rec {
     maintainers = with maintainers; [ ];
   };
 }
-
diff --git a/pkgs/development/python-modules/pygithub/default.nix b/pkgs/development/python-modules/pygithub/default.nix
index c207ef8b12a1a..926f16c46af37 100644
--- a/pkgs/development/python-modules/pygithub/default.nix
+++ b/pkgs/development/python-modules/pygithub/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pygithub";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "PyGithub";
     repo = "PyGithub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RNv/6Rs7NapP/XOdBFIWPg+/BmaK1+OY0+bP/i2YKaA=";
+    hash = "sha256-ccAbn9x1r+wBIAK66ur8+2Op9ij09rQvHumq5Wh7TUU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pymeeus/default.nix b/pkgs/development/python-modules/pymeeus/default.nix
index 92451d351a917..821ad49e8206b 100644
--- a/pkgs/development/python-modules/pymeeus/default.nix
+++ b/pkgs/development/python-modules/pymeeus/default.nix
@@ -1,11 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, pytest }:
 
 buildPythonPackage rec {
-  pname = "PyMeeus";
+  pname = "pymeeus";
   version = "0.5.12";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyMeeus";
+    inherit version;
     hash = "sha256-VI9xhr2LlsvAac9kmo6ON33OSax0SGcJhJ/mOpnK1oQ=";
   };
 
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index bf40f44732d3b..f225524e7e18b 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -30,7 +30,12 @@
 
 let
   # PyMuPDF needs the C++ bindings generated
-  mupdf-cxx = mupdf.override { enableOcr = true; enableCxx = true; enablePython = true; python3 = python; };
+  mupdf-cxx = mupdf.override {
+    enableOcr = true;
+    enableCxx = true;
+    enablePython = true;
+    python3 = python;
+  };
 in buildPythonPackage rec {
   pname = "pymupdf";
   version = "1.23.26";
@@ -45,12 +50,12 @@ in buildPythonPackage rec {
     hash = "sha256-m2zq04+PDnlzFuqeSt27UhdHXTHxpHdMPIg5RQl/5bQ=";
   };
 
-  # swig is not wrapped as python package
+  # swig is not wrapped as Python package
   # libclang calls itself just clang in wheel metadata
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace '"swig",' "" \
-      --replace "libclang" "clang"
+      --replace-fail '"swig",' "" \
+      --replace-fail "libclang" "clang"
   '';
 
   nativeBuildInputs = [
@@ -95,16 +100,79 @@ in buildPythonPackage rec {
     fonttools
   ];
 
+  preCheck = ''
+    export PATH="$PATH:$out/bin";
+  '';
+
   disabledTests = [
     # fails for indeterminate reasons
-    "test_color_count"
-    "test_2753"
     "test_2548"
+    "test_2753"
+    "test_3020"
+    "test_3050"
+    "test_3058"
+    "test_3177"
+    "test_3186"
+    "test_color_count"
+    "test_pilsave"
+    "test_fz_write_pixmap_as_jpeg"
+    # NotImplementedError
+    "test_1824"
+    "test_2093"
+    "test_2093"
+    "test_2108"
+    "test_2182"
+    "test_2182"
+    "test_2246"
+    "test_2270"
+    "test_2270"
+    "test_2391"
+    "test_2788"
+    "test_2861"
+    "test_2871"
+    "test_2886"
+    "test_2904"
+    "test_2922"
+    "test_2934"
+    "test_2957"
+    "test_2969"
+    "test_3070"
+    "test_3131"
+    "test_3140"
+    "test_3209"
+    "test_3209"
+    "test_caret"
+    "test_deletion"
+    "test_file_info"
+    "test_line"
+    "test_page_links_generator"
+    "test_polyline"
+    "test_redact"
+    "test_techwriter_append"
+    "test_text2"
+    # Issue with FzArchive
+    "test_htmlbox"
+    "test_2246"
+    "test_3140"
+    "test_fit_springer"
+    "test_write_stabilized_with_links"
+    "test_textbox"
+    "test_delete_image"
+    # Fonts not available
+    "test_fontarchive"
+    "test_subset_fonts"
+    # Exclude lint tests
+    "test_flake8"
   ] ++ lib.optionals stdenv.isDarwin [
     # darwin does not support OCR right now
     "test_tesseract"
   ];
 
+  disabledTestPaths = [
+    # Issue with FzArchive
+    "tests/test_docs_samples.py"
+  ];
+
   pythonImportsCheck = [
     "fitz"
     "fitz_old"
diff --git a/pkgs/development/python-modules/pynamecheap/default.nix b/pkgs/development/python-modules/pynamecheap/default.nix
index 84c13b9d1caaa..3c05dd30eb1ea 100644
--- a/pkgs/development/python-modules/pynamecheap/default.nix
+++ b/pkgs/development/python-modules/pynamecheap/default.nix
@@ -5,7 +5,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyNamecheap";
+  pname = "pynamecheap";
   version = "0.0.3";
 
   propagatedBuildInputs = [ requests ];
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "Bemmu";
-    repo = pname;
+    repo = "PyNamecheap";
     rev = "v${version}";
     sha256 = "1g1cd2yc6rpdsc5ax7s93y5nfkf91gcvbgcaqyl9ida6srd9hr97";
   };
diff --git a/pkgs/development/python-modules/pyogg/default.nix b/pkgs/development/python-modules/pyogg/default.nix
index 3edf3768956f1..22a602df273a3 100644
--- a/pkgs/development/python-modules/pyogg/default.nix
+++ b/pkgs/development/python-modules/pyogg/default.nix
@@ -1,11 +1,12 @@
 { stdenv, lib, fetchPypi, buildPythonPackage, libvorbis, flac, libogg, libopus, opusfile, substituteAll }:
 
 buildPythonPackage rec {
-    pname = "PyOgg";
+    pname = "pyogg";
     version = "0.6.9a1";
 
     src = fetchPypi {
-      inherit pname version;
+      pname = "PyOgg";
+      inherit version;
       sha256 = "0xabqwyknpvfc53s7il5pq6b07fcaqvz5bi5vbs3pbaw8602qvim";
     };
 
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index bf1efac9de74f..0b22058a8463b 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.13.8";
+  version = "1.13.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tvS7aPfBTs75Rq1WGslWDMv1pOTVt7MtwpXPRJtqbuk=";
+    hash = "sha256-J1nsRB9KYg3yUuxQV79/Udjjkux+BE4YcawpRJcSYHI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pypdf2/default.nix b/pkgs/development/python-modules/pypdf2/default.nix
index 9708ee4c69258..34087d582667a 100644
--- a/pkgs/development/python-modules/pypdf2/default.nix
+++ b/pkgs/development/python-modules/pypdf2/default.nix
@@ -8,13 +8,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyPDF2";
+  pname = "pypdf2";
   version = "3.0.1";
 
   format = "pyproject";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyPDF2";
+    inherit version;
     hash = "sha256-p0QI9pumJx9xuTUu9O0D3FOjGqQE0ptdMfU7/s/uFEA=";
   };
 
diff --git a/pkgs/development/python-modules/pyplatec/default.nix b/pkgs/development/python-modules/pyplatec/default.nix
index 209c0d587eb51..6a4e46f5c1c6f 100644
--- a/pkgs/development/python-modules/pyplatec/default.nix
+++ b/pkgs/development/python-modules/pyplatec/default.nix
@@ -5,11 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyPlatec";
+  pname = "pyplatec";
   version = "1.4.0";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyPlatec";
+    inherit version;
     sha256 = "0kqx33flcrrlipccmqs78d14pj5749bp85b6k5fgaq2c7yzz02jg";
   };
 
diff --git a/pkgs/development/python-modules/pyprind/default.nix b/pkgs/development/python-modules/pyprind/default.nix
index 4dc25322863de..58a508adf7951 100644
--- a/pkgs/development/python-modules/pyprind/default.nix
+++ b/pkgs/development/python-modules/pyprind/default.nix
@@ -3,11 +3,12 @@
 , pytest }:
 
 buildPythonPackage rec {
-  pname = "PyPrind";
+  pname = "pyprind";
   version = "2.11.3";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyPrind";
+    inherit version;
     sha256 = "e37dcab6e1a9c8e0a7f0fce65fde7a79e2deda1c75aa015910a49e2137b54cbf";
   };
 
diff --git a/pkgs/development/python-modules/pyreaderwriterlock/default.nix b/pkgs/development/python-modules/pyreaderwriterlock/default.nix
index 378be471aef00..a9771f6698712 100644
--- a/pkgs/development/python-modules/pyreaderwriterlock/default.nix
+++ b/pkgs/development/python-modules/pyreaderwriterlock/default.nix
@@ -11,7 +11,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "pyReaderWriterLock";
+  pname = "pyreaderwriterlock";
   version = "1.0.9";
   format = "setuptools";
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "elarivie";
-    repo = pname;
+    repo = "pyReaderWriterLock";
     rev = "refs/tags/v${version}";
     hash = "sha256-8FC+4aDgGpF1BmOdlkFtMy7OfWdSmvn9fjKXSmmeJlg=";
   };
diff --git a/pkgs/development/python-modules/pysc2/default.nix b/pkgs/development/python-modules/pysc2/default.nix
index 10040928ad244..b45c955416094 100644
--- a/pkgs/development/python-modules/pysc2/default.nix
+++ b/pkgs/development/python-modules/pysc2/default.nix
@@ -17,7 +17,7 @@
 }:
 
 buildPythonPackage {
-  pname = "PySC2";
+  pname = "pysc2";
   version = "1.2";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/pyscss/default.nix b/pkgs/development/python-modules/pyscss/default.nix
index 21b0f169cd798..912b4acc14e99 100644
--- a/pkgs/development/python-modules/pyscss/default.nix
+++ b/pkgs/development/python-modules/pyscss/default.nix
@@ -9,7 +9,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "pyScss";
+  pname = "pyscss";
   version = "1.4.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/pyspice/default.nix b/pkgs/development/python-modules/pyspice/default.nix
index 0119c38099ccb..94fa032085c9d 100644
--- a/pkgs/development/python-modules/pyspice/default.nix
+++ b/pkgs/development/python-modules/pyspice/default.nix
@@ -14,12 +14,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PySpice";
+  pname = "pyspice";
   version = "1.5";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PySpice";
+    inherit version;
     sha256 = "d28448accad98959e0f5932af8736e90a1f3f9ff965121c6881d24cdfca23d22";
   };
 
diff --git a/pkgs/development/python-modules/pysychonaut/default.nix b/pkgs/development/python-modules/pysychonaut/default.nix
index ae05070e76d79..0962ee9b9db1c 100644
--- a/pkgs/development/python-modules/pysychonaut/default.nix
+++ b/pkgs/development/python-modules/pysychonaut/default.nix
@@ -1,11 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, requests, requests-cache, beautifulsoup4 }:
 
 buildPythonPackage rec {
-  pname = "PySychonaut";
+  pname = "pysychonaut";
   version = "0.6.0";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PySychonaut";
+    inherit version;
     sha256 = "1wgk445gmi0x7xmd8qvnyxy1ka0n72fr6nrhzdm29q6687dqyi7h";
   };
 
diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index 4a455fa79800b..efe048a33d1fc 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -9,11 +9,12 @@
 , pontos
 , pytestCheckHook
 , pythonOlder
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "24.1.0";
+  version = "24.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,17 +23,18 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = "python-gvm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1MJajawm/QdioZM+/efnXOAFcuDOk/xJ1acPrxKp700=";
+    hash = "sha256-GIEsP8+RJMIehsBbZWpIRXCdqxm042lPbYTHY7/fknM=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     defusedxml
     lxml
     paramiko
+    typing-extensions
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 60900c8ce1780..5a1a6296b48d2 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.6.2";
+  version = "3.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rezyw0v1VijMe78ip3U+Jd+NQExW+gQXjs8qkcPNcUk=";
+    hash = "sha256-BwU9Ti35Dsaa+kT78h3lsjw4sI1RQdhukTPTeJDyBw0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/robotframework-tidy/default.nix b/pkgs/development/python-modules/robotframework-tidy/default.nix
new file mode 100644
index 0000000000000..f89e7c88c78ad
--- /dev/null
+++ b/pkgs/development/python-modules/robotframework-tidy/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  robotframework,
+  click,
+  colorama,
+  pathspec,
+  tomli,
+  rich-click,
+  jinja2,
+}:
+
+buildPythonPackage rec {
+  pname = "robotframework-tidy";
+  version = "4.11.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "MarketSquare";
+    repo = "robotframework-tidy";
+    rev = "${version}";
+    hash = "sha256-pWW7Ex184WgnPfqHg5qQjfE+9UPvCmE5pwkY8jrp9bI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    robotframework
+    click
+    colorama
+    pathspec
+    tomli
+    rich-click
+    jinja2
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/MarketSquare/robotframework-tidy/blob/main/docs/releasenotes/${version}.rst";
+    description = "Code autoformatter for Robot Framework";
+    homepage = "https://robotidy.readthedocs.io";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ otavio ];
+  };
+}
diff --git a/pkgs/development/python-modules/rope/default.nix b/pkgs/development/python-modules/rope/default.nix
index ad5cad2dd8cb3..e027b1922ec9c 100644
--- a/pkgs/development/python-modules/rope/default.nix
+++ b/pkgs/development/python-modules/rope/default.nix
@@ -10,23 +10,23 @@
 
 buildPythonPackage rec {
   pname = "rope";
-  version = "1.12.0";
+  version = "1.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "python-rope";
-    repo = pname;
+    repo = "rope";
     rev = "refs/tags/${version}";
-    hash = "sha256-j/9q2S2B3DzmEqMOBLG9iHwnLqZipcPxLaKppysJffA=";
+    hash = "sha256-g/fta5gW/xPs3VaVuLtikfLhqCKyy1AKRnOcOXjQ8bA=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     pytoolconfig
   ] ++ pytoolconfig.optional-dependencies.global;
 
diff --git a/pkgs/development/python-modules/scapy/default.nix b/pkgs/development/python-modules/scapy/default.nix
index 970d355fff06b..dede907418e3f 100644
--- a/pkgs/development/python-modules/scapy/default.nix
+++ b/pkgs/development/python-modules/scapy/default.nix
@@ -44,10 +44,11 @@ buildPythonPackage rec {
     substituteInPlace scapy/data.py --replace "/opt/wireshark" "${wireshark}"
   '';
 
+  buildInputs = lib.optional withVoipSupport sox;
+
   propagatedBuildInputs = [ pycrypto ecdsa ]
     ++ lib.optionals withOptionalDeps [ tcpdump ipython ]
     ++ lib.optional withCryptography cryptography
-    ++ lib.optional withVoipSupport sox
     ++ lib.optional withPlottingSupport matplotlib
     ++ lib.optionals withGraphicsSupport [ pyx texliveBasic graphviz imagemagick ];
 
diff --git a/pkgs/development/python-modules/shapely/1.8.nix b/pkgs/development/python-modules/shapely/1.8.nix
index 28a248af0bed9..0e1c3135ab997 100644
--- a/pkgs/development/python-modules/shapely/1.8.nix
+++ b/pkgs/development/python-modules/shapely/1.8.nix
@@ -15,14 +15,15 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Shapely";
+  pname = "shapely";
   version = "1.8.5";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Shapely";
+    inherit version;
     hash = "sha256-6CttYOz7EkEgyI/hBqR4WWu+qxQhFtfn9ko2TayQKpI=";
   };
 
diff --git a/pkgs/development/python-modules/stim/default.nix b/pkgs/development/python-modules/stim/default.nix
index 46aba99fb178e..3e95b74ef9ef4 100644
--- a/pkgs/development/python-modules/stim/default.nix
+++ b/pkgs/development/python-modules/stim/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "stim";
-  version = "1.12.1";
+  version = "1.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "quantumlib";
     repo = "Stim";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vDpW8cn1JPARDIXpLyK9uenhHmva0FwnWIDV7dSHbIY=";
+    hash = "sha256-anJvDHLZ470iNw0U7hq9xGBacDgqYO9ZcmmdCt9pefg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 34ce22a461364..7e34e8b17a2dc 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1114";
+  version = "3.0.1115";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,14 +18,14 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-OqkXHnXoQE2BF2Lon9+3pPVvqXK9YQnoDewoQ13Aa1Q=";
+    hash = "sha256-3tkkLB27R4trvS3LY0tRv0+q37SfT7S6gr9i1OWaNUU=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     requests
   ];
 
diff --git a/pkgs/development/python-modules/twiggy/default.nix b/pkgs/development/python-modules/twiggy/default.nix
index 748d45176613b..d25fd36a0d919 100644
--- a/pkgs/development/python-modules/twiggy/default.nix
+++ b/pkgs/development/python-modules/twiggy/default.nix
@@ -5,11 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Twiggy";
+  pname = "twiggy";
   version = "0.5.1";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Twiggy";
+    inherit version;
     sha256 = "7938840275972f6ce89994a5bdfb0b84f0386301a043a960af6364952e78ffe4";
   };
 
diff --git a/pkgs/development/python-modules/txamqp/default.nix b/pkgs/development/python-modules/txamqp/default.nix
index cc66e041ae38a..935ef043f22fa 100644
--- a/pkgs/development/python-modules/txamqp/default.nix
+++ b/pkgs/development/python-modules/txamqp/default.nix
@@ -5,11 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "txAMQP";
+  pname = "txamqp";
   version = "0.8.2";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "txAMQP";
+    inherit version;
     sha256 = "0jd9864k3csc06kipiwzjlk9mq4054s8kzk5q1cfnxj8572s4iv4";
   };
 
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index b2f22092638b9..61f32785757d8 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -55,7 +55,7 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.16.4";
+  version = "0.16.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -64,7 +64,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Q4NHUHay1/xb+V494n96jxE1VyAP7uVyQbIbS0/E85c=";
+    hash = "sha256-XXs9KjiAPzZ932r4UJ87RpM+qhg/bNDWEYsq2Ua6SRw=";
   };
 
   patches = [
@@ -302,6 +302,9 @@ buildPythonPackage rec {
     "wandb"
   ];
 
+  # unmaintainable list of disabled tests
+  passthru.skipBulkUpdate = true;
+
   meta = with lib; {
     description = "A CLI and library for interacting with the Weights and Biases API";
     homepage = "https://github.com/wandb/wandb";
diff --git a/pkgs/development/python-modules/webhelpers/default.nix b/pkgs/development/python-modules/webhelpers/default.nix
index dcb2bd3817d7e..c9dc7159f2f82 100644
--- a/pkgs/development/python-modules/webhelpers/default.nix
+++ b/pkgs/development/python-modules/webhelpers/default.nix
@@ -8,11 +8,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "WebHelpers";
+  pname = "webhelpers";
   version = "1.3";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "WebHelpers";
+    inherit version;
     sha256 = "ea86f284e929366b77424ba9a89341f43ae8dee3cbeb8702f73bcf86058aa583";
   };
 
diff --git a/pkgs/development/python-modules/wsgidav/default.nix b/pkgs/development/python-modules/wsgidav/default.nix
index e9f65687a3ee2..132af924c3d25 100644
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@@ -16,23 +16,23 @@
 
 buildPythonPackage rec {
   pname = "wsgidav";
-  version = "4.3.0";
-  format = "pyproject";
+  version = "4.3.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "mar10";
-    repo = pname;
+    repo = "wsgidav";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DEUoKoFELIOg5KX6hL1VgR18dtsery4ZzKksrxl0D7Q=";
+    hash = "sha256-jgn4bculVIXfMx3Or3pKF478UOzCL8nhEeNvOeGyjPI=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     defusedxml
     jinja2
     json5
@@ -55,10 +55,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Generic and extendable WebDAV server based on WSGI";
-    mainProgram = "wsgidav";
     homepage = "https://wsgidav.readthedocs.io/";
     changelog = "https://github.com/mar10/wsgidav/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "wsgidav";
   };
 }
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 548609caaaa23..221346d2c76aa 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.27.1";
+  version = "0.28.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "xiaomi-ble";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/LOq35YrGacXXP1Izl9xoF5rrCQGONPGj/u2zGOqbt0=";
+    hash = "sha256-Va/fzGDjBR/h1lUN47AixZnDYzEPNXQKTVXILKayhBc=";
   };
 
   postPatch = ''
@@ -34,7 +34,7 @@ buildPythonPackage rec {
       --replace-fail " --cov=xiaomi_ble --cov-report=term-missing:skip-covered" ""
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
     pythonRelaxDepsHook
   ];
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     "pycryptodomex"
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bleak
     bleak-retry-connector
     bluetooth-data-tools
diff --git a/pkgs/development/tools/algolia-cli/default.nix b/pkgs/development/tools/algolia-cli/default.nix
index a7216cbfbe317..c00a01ac02f15 100644
--- a/pkgs/development/tools/algolia-cli/default.nix
+++ b/pkgs/development/tools/algolia-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "algolia-cli";
-  version = "1.6.3";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "algolia";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-xRGWPJx4AVdUT9f7L2B5SHEOneuIlscFTHIk7XtPzS8=";
+    hash = "sha256-bS/xSrb1vCeYuDZj8NwEyclbYMXlejAxIoItEX8YnOs=";
   };
 
   vendorHash = "sha256-cNuBTH7L2K4TgD0H9FZ9CjhE5AGXADaniGLD9Lhrtrk=";
diff --git a/pkgs/development/tools/ameba/default.nix b/pkgs/development/tools/ameba/default.nix
index adf392669635e..f98ec6183f997 100644
--- a/pkgs/development/tools/ameba/default.nix
+++ b/pkgs/development/tools/ameba/default.nix
@@ -1,14 +1,14 @@
-{ lib, fetchFromGitHub, fetchpatch, crystal }:
+{ lib, fetchFromGitHub, crystal }:
 
 crystal.buildCrystalPackage rec {
   pname = "ameba";
-  version = "1.5.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "crystal-ameba";
     repo = "ameba";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TdyEnTloaciSpkPmnm+OM75sz9jaCaQ3VoDEepfescU=";
+    hash = "sha256-NwmsNz9YfHDk0hVwVb5zczuzvErrwPhd3rs75t/Fj+I=";
   };
 
   format = "make";
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index c1732d180d5a3..a29cd3f894ed5 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.43";
+  version = "3.2.45";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-XzkMhI/+dOU0NJs9XW+jwbI6fZfC6cHFq0xFNw57kc8=";
+    hash = "sha256-mVGfWBQEWKS5WsWQUi8NdsR1bX21MbUnNDijZ/l/ksY=";
   };
 
   patches = [
@@ -39,12 +39,12 @@ python3.pkgs.buildPythonApplication rec {
     "pycep-parser"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
     pythonRelaxDepsHook
     setuptools-scm
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     aiodns
     aiohttp
     aiomultiprocess
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index a82b19a9d299d..b1a4f042d5bfc 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.16.4";
+  version = "2.16.5";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-wpiySSAs4x0KfzBLHzP4YC2GB1NpeEHQlbfAWCUaV90=";
+    hash = "sha256-p6jTGf8A1ENKxZryfHpdPxisQ4GuuYOP2tThj1MAEn4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-google.nix b/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-google.nix
index 646cb81d102d4..a1382df1c4f0e 100644
--- a/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-google.nix
+++ b/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-google.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "tflint-ruleset-google";
-  version = "0.26.0";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VQm7pvZCfkZR54UeaPuKogEqhQOy5BAV7WkfwCW3C7c=";
+    hash = "sha256-APdAm7gBEA6LHYV3u7j3HtFmzkUqeABqOj5q3rwPO40=";
   };
 
-  vendorHash = "sha256-C52b11cJE2Bu785SNlTsbgNR6Wt/YeY8l1U/9anXrMo=";
+  vendorHash = "sha256-n+nnftyNvCGVgEkYQIfVL7TS2QP8WpKb7l9jfeutJxw=";
 
   # upstream Makefile also does a go test $(go list ./... | grep -v integration)
   preCheck = ''
diff --git a/pkgs/development/tools/detekt/default.nix b/pkgs/development/tools/detekt/default.nix
index 5881997e6dbe9..9b51881e5c2bf 100644
--- a/pkgs/development/tools/detekt/default.nix
+++ b/pkgs/development/tools/detekt/default.nix
@@ -1,13 +1,13 @@
 { detekt, lib, stdenv, fetchurl, makeWrapper, jre_headless, testers }:
 stdenv.mkDerivation rec {
   pname = "detekt";
-  version = "1.23.5";
+  version = "1.23.6";
 
   jarfilename = "${pname}-${version}-executable.jar";
 
   src = fetchurl {
     url = "https://github.com/detekt/detekt/releases/download/v${version}/detekt-cli-${version}-all.jar";
-    sha256 = "sha256-Pz+MaZimJMCjtGPy7coi6SSE7IdAQhtp2u8YV4s7KLY=";
+    sha256 = "sha256-iY3PgQ6JH0SeTj+fSk4tx1rs+OEInfQaQqaa2yy7z/o=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/ginkgo/default.nix b/pkgs/development/tools/ginkgo/default.nix
index b5472d796e7a2..549b0f14c392d 100644
--- a/pkgs/development/tools/ginkgo/default.nix
+++ b/pkgs/development/tools/ginkgo/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "2.17.0";
+  version = "2.17.1";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-g34kXd2Xcw7+iyS5F6fiMbyUbKLTUxFUrpxl+ueyl1U=";
+    sha256 = "sha256-fxP4+YqhYPeGVpW6VkSm3+FGnmgbKx77anSYUv41PSE=";
   };
   vendorHash = "sha256-XtO7HiaE/xCT3tjVZzzMcO9y8Yk8Wyy1S3S1qioMaQU=";
 
diff --git a/pkgs/development/tools/goresym/default.nix b/pkgs/development/tools/goresym/default.nix
index feec2b1aecb10..7eb473ad77917 100644
--- a/pkgs/development/tools/goresym/default.nix
+++ b/pkgs/development/tools/goresym/default.nix
@@ -1,19 +1,31 @@
-{ stdenv, lib, fetchFromGitHub, buildGoModule }:
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, unzip
+}:
 
 buildGoModule rec {
   pname = "goresym";
-  version = "2.3";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "mandiant";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-o2t542q6UGjWdhJkcAm34kGhPUGNsvZKf940T+vydoE=";
+    sha256 = "sha256-bZOq3GvGRyeIyN/CEuMA6mQjjrRvoVU9fUEUptd6NH0=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-ElV5edbe1LQWbA1NKv52/rLZJeOLBahE4YBKg9OA7YY=";
+  vendorHash = "sha256-pjkBrHhIqLmSzwi1dKS5+aJrrAAIzNATOt3LgLsMtx0=";
+
+  nativeCheckInputs = [ unzip ];
+
+  preCheck = ''
+    cd test
+    unzip weirdbins.zip
+    cd ..
+  '';
 
   doCheck = true;
 
@@ -21,6 +33,7 @@ buildGoModule rec {
     description = "Go symbol recovery tool";
     mainProgram = "GoReSym";
     homepage = "https://github.com/mandiant/GoReSym";
+    changelog = "https://github.com/mandiant/GoReSym/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ thehedgeh0g ];
   };
diff --git a/pkgs/development/tools/language-servers/crystalline/default.nix b/pkgs/development/tools/language-servers/crystalline/default.nix
index 7e0bc27faceb7..779bb27f99764 100644
--- a/pkgs/development/tools/language-servers/crystalline/default.nix
+++ b/pkgs/development/tools/language-servers/crystalline/default.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "0.10.0";
+  version = "0.12.1";
 in
 crystal.buildCrystalPackage {
   pname = "crystalline";
@@ -17,7 +17,7 @@ crystal.buildCrystalPackage {
     owner = "elbywan";
     repo = "crystalline";
     rev = "v${version}";
-    hash = "sha256-g4k/vP7yYbTAy2bTAfr6HQhkskWfI6Zv2lxP+AZf6yw=";
+    hash = "sha256-b/j1V5JlT+rjWYAA8nrE0PWHrzQq4rUZxZlADMmtpBk=";
   };
 
   format = "crystal";
diff --git a/pkgs/development/tools/nufmt/default.nix b/pkgs/development/tools/nufmt/default.nix
new file mode 100644
index 0000000000000..e753c134d1abc
--- /dev/null
+++ b/pkgs/development/tools/nufmt/default.nix
@@ -0,0 +1,27 @@
+
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  ...
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "nufmt";
+  version = "unstable-2023-09-25";
+
+  src = fetchFromGitHub {
+    owner = "nushell";
+    repo = "nufmt";
+    rev = "796ee834c1e31ead4c5479bf2827a4339c5d61d1";
+    hash = "sha256-BwKLl8eMCrqVt9PA5SHAXxu3ypP2ePcSuljKL+wSkvw=";
+  };
+
+  cargoSha256 = "sha256-16Z20opeZpoa7h258um+grL3ktPmY4P0M/tqMTr5hYc=";
+
+  meta = with lib; {
+    description = "The nushell formatter";
+    homepage = "https://github.com/nushell/nufmt";
+    license = licenses.mit;
+    maintainers = with maintainers; [iogamaster];
+  };
+}
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
index 5af30cc255068..5e82fafd129cd 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
@@ -5,12 +5,12 @@
 
 buildDunePackage rec {
   pname = "js_of_ocaml-compiler";
-  version = "5.6.0";
+  version = "5.7.1";
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
-    hash = "sha256-hDXwJjOhfvbIoaMXGmU3/bIGwAxPt9TKVCUN9tr2wj8=";
+    hash = "sha256-DqSOKqiQTsVi8iX6CT/2dLVODnUU2uhie4/Y93IQOD0=";
   };
 
   nativeBuildInputs = [ menhir ];
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 13a8de6550b29..60e4c3a43c269 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "19.13.0";
+  version = "19.18.1";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nQJs+Kj0sxEI15QPLVFyVQWcM6HU6KzsSpW0ogYMzpQ=";
+    hash = "sha256-Y20PsyXSNu6U1v1OhBX0vGtg9UkuTVqZ1KYUYkRMcWg=";
   };
 
-  vendorHash = "sha256-LIxOlU9YRA3xdHoilOBpo7P68ThVDOdiqXt47du/20g=";
+  vendorHash = "sha256-WuPEoDmp/SSf3AqHtYTtMb56PnjZLWr3weZQXEF7pbg=";
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/development/tools/omniorb/default.nix b/pkgs/development/tools/omniorb/default.nix
index d9bca7061c1ad..acc1dd1403ddd 100644
--- a/pkgs/development/tools/omniorb/default.nix
+++ b/pkgs/development/tools/omniorb/default.nix
@@ -21,6 +21,21 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   hardeningDisable = [ "format" ];
 
+  # Transform omniidl_be into a PEP420 namespace to allow other projects to define
+  # their omniidl backends. Especially useful for omniorbpy, the python backend.
+  postInstall = ''
+    rm $out/${python3.sitePackages}/omniidl_be/__init__.py
+    rm $out/${python3.sitePackages}/omniidl_be/__pycache__/__init__.*.pyc
+  '';
+
+  # Ensure postInstall didn't break cxx backend
+  # Same as 'pythonImportsCheck = ["omniidl_be.cxx"];', but outside buildPythonPackage
+  doInstallCheck = true;
+  postInstallCheck = ''
+    export PYTHONPATH=$out/${python3.sitePackages}:$PYTHONPATH
+    ${lib.getExe python3} -c "import omniidl_be.cxx"
+  '';
+
   meta = with lib; {
     description = "A robust high performance CORBA ORB for C++ and Python";
     longDescription = ''
diff --git a/pkgs/development/tools/pscale/default.nix b/pkgs/development/tools/pscale/default.nix
index ec8e0c6447322..189d7eea042ee 100644
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.185.0";
+  version = "0.186.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-UzNfNuOt6ZmzxVx/H8aEmQL6b4PPyNkQzxSqhBtoLT8=";
+    sha256 = "sha256-LXUvVctOFreDlIozA17pfDblZ6QugVA/dJ+IKE3fBeY=";
   };
 
-  vendorHash = "sha256-oENe7OGAW/i5LJbqPn7PJDemdxfSsLwmpER28R6zza4=";
+  vendorHash = "sha256-ubMr2gm4t0731niC2Mx1Lcmdl48SUVjfoIWbtgt3X+I=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/development/tools/regclient/default.nix b/pkgs/development/tools/regclient/default.nix
index bb8d79b6c44f6..9016f4704bc5b 100644
--- a/pkgs/development/tools/regclient/default.nix
+++ b/pkgs/development/tools/regclient/default.nix
@@ -1,4 +1,12 @@
-{ stdenv, lib, buildGoModule, fetchFromGitHub }:
+{ stdenv
+, lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+, lndir
+, testers
+, regclient
+}:
 
 let bins = [ "regbot" "regctl" "regsync" ]; in
 
@@ -20,22 +28,48 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.VCSTag=${tag}"
+    "-X github.com/regclient/regclient/internal/version.vcsTag=${tag}"
   ];
 
-  postInstall =
-    lib.concatStringsSep "\n" (
-      map (bin: ''
-        mkdir -p ''$${bin}/bin &&
-        mv $out/bin/${bin} ''$${bin}/bin/ &&
-        ln -s ''$${bin}/bin/${bin} $out/bin/
-      '') bins
-    );
+  nativeBuildInputs = [ installShellFiles lndir ];
+
+  postInstall = lib.concatMapStringsSep "\n"
+    (bin: ''
+      export bin=''$${bin}
+      export outputBin=bin
+
+      mkdir -p $bin/bin
+      mv $out/bin/${bin} $bin/bin
+
+      installShellCompletion --cmd ${bin} \
+        --bash <($bin/bin/${bin} completion bash) \
+        --fish <($bin/bin/${bin} completion fish) \
+        --zsh <($bin/bin/${bin} completion zsh)
+
+      lndir -silent $bin $out
+
+      unset bin outputBin
+    '')
+    bins;
+
+  passthru.tests = lib.mergeAttrsList (
+    map
+      (bin: {
+        "${bin}Version" = testers.testVersion {
+          package = regclient;
+          command = "${bin} version";
+          version = tag;
+        };
+      })
+      bins
+  );
+
+  __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
     description = "Docker and OCI Registry Client in Go and tooling using those libraries";
     homepage = "https://github.com/regclient/regclient";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ maxbrunet ];
   };
 }
diff --git a/pkgs/development/tools/rust/cargo-expand/default.nix b/pkgs/development/tools/rust/cargo-expand/default.nix
index 86c322f7116cb..15c8706601f57 100644
--- a/pkgs/development/tools/rust/cargo-expand/default.nix
+++ b/pkgs/development/tools/rust/cargo-expand/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.79";
+  version = "1.0.80";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-P0pwQSKkQI/hIaCxU9a3BMdFaBtY4GtB38vqDOvdbaU=";
+    sha256 = "sha256-qK3ZpcY/kxOaRcmlD6AUkd4BVjX8ZcFz8NG60oHh5qo=";
   };
 
-  cargoHash = "sha256-G0JNTZZMe4V1o/7KqhlubNczSemIPvrPeH5KQ1oNYWY=";
+  cargoHash = "sha256-c2h/ij2fWpJMoq8d60l2Ujw7Xnw8q39GmDlcPffpjMU=";
 
   meta = with lib; {
     description = "A utility and Cargo subcommand designed to let people expand macros in their Rust source code";
diff --git a/pkgs/development/tools/rust/cargo-machete/default.nix b/pkgs/development/tools/rust/cargo-machete/default.nix
index 9bd05294bec79..a94272f958085 100644
--- a/pkgs/development/tools/rust/cargo-machete/default.nix
+++ b/pkgs/development/tools/rust/cargo-machete/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-machete";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "bnjbvr";
     repo = "cargo-machete";
     rev = "v${version}";
-    hash = "sha256-xLquursKMpV6ZELCRBrAEZ40Ypx2+vtpTVmVvOPdYS4=";
+    hash = "sha256-8ktiBnlcnC4QD3rIox8rfxhF0ZWOlbok8rK7fnqeZOM=";
   };
 
-  cargoHash = "sha256-F0pNAZ5ZcpGrfYt1TqtBcC2WUwjOEYf/yHero250fl0=";
+  cargoHash = "sha256-emW/TDpeh/7hgqTgXAZeQwzkSIktDxk3Lp3JyhdTSRo=";
 
   # tests require internet access
   doCheck = false;
diff --git a/pkgs/development/tools/rust/cargo-mutants/default.nix b/pkgs/development/tools/rust/cargo-mutants/default.nix
index ba54eeb56bd7f..33204d80b9d23 100644
--- a/pkgs/development/tools/rust/cargo-mutants/default.nix
+++ b/pkgs/development/tools/rust/cargo-mutants/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-mutants";
-  version = "24.2.1";
+  version = "24.3.0";
 
   src = fetchFromGitHub {
     owner = "sourcefrog";
     repo = "cargo-mutants";
     rev = "v${version}";
-    hash = "sha256-sZI3Y4wsToDt1fF8ZT494V3q5LwHZ+7uU6of7LOWu3M=";
+    hash = "sha256-FlD2bSCNToyXLiMb4c2tJYJxHN4QORMJPeFPuFpjMEM=";
   };
 
-  cargoHash = "sha256-zCuNvhZ2CvsdG1CiQJ9fXFBTQxybqz/lk85lX5WrpG4=";
+  cargoHash = "sha256-GJFUSOAY6F0ZmqF/9SHOGMNFssfHUdFIcsgz6JwZuqE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/development/tools/rust/cargo-update/default.nix b/pkgs/development/tools/rust/cargo-update/default.nix
index 986f705455c6f..c27c3e0e7572b 100644
--- a/pkgs/development/tools/rust/cargo-update/default.nix
+++ b/pkgs/development/tools/rust/cargo-update/default.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-update";
-  version = "13.3.0";
+  version = "13.4.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-owiMVeH7m4LoM8c4qjLyFx3v/+Flzt+C+O8qEuXazvc=";
+    sha256 = "sha256-/9igT1/3ck8Roy2poq1urf+cLblentOB7S9Hh6uqIEw=";
   };
 
-  cargoHash = "sha256-WtNH62DBo6WFOUcHnZxn0Jco4SUmhO0+1wXPRB2wxic=";
+  cargoHash = "sha256-pdWVp9+CLnNO7+U0a8WXWHZ+EeGNYx9J7WWAI1MTDvc=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/tools/semantic-release/default.nix b/pkgs/development/tools/semantic-release/default.nix
index 7f55da0e2ff7c..9aa371c07e329 100644
--- a/pkgs/development/tools/semantic-release/default.nix
+++ b/pkgs/development/tools/semantic-release/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "23.0.5";
+  version = "23.0.6";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-/VOa/V6kly92JjhW5a0b9xNdxVYCPYRJx5IiwmQ2d1U=";
+    hash = "sha256-saWKx7OnKRT1zonaSRaLXUoL7XI6YaeKogdTuxDN6eo=";
   };
 
-  npmDepsHash = "sha256-CG2LcIAfX5dfJz0oSMwt83ra804U/qLpnNDilSEgRSI=";
+  npmDepsHash = "sha256-OvH568kJP0tdK6y2TmMRAyVZ4LgY9+Y4AF39jXk4dq4=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/development/tools/sqldef/default.nix b/pkgs/development/tools/sqldef/default.nix
index 4141cd4f91766..aa93085f7c0b1 100644
--- a/pkgs/development/tools/sqldef/default.nix
+++ b/pkgs/development/tools/sqldef/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "sqldef";
-  version = "0.16.15";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "k0kubun";
     repo = "sqldef";
     rev = "v${version}";
-    hash = "sha256-srwCSALP+xtccMnIOpsErn4hk83grXyOMEA2Hwsvjv0=";
+    hash = "sha256-S2hXwIQU9iKSN9nYG6KacO+bZtgNtMnPQoQaS6DNH30=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-VM50tJxChGU1lGol4HUKB5Zp0c2F8D9+NhrW6XK7i+g=";
+  vendorHash = "sha256-8fKJxnjLIWzWsLx/p9tRb/un63/QgJJzMb4/Y4DSZdY=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/development/tools/turso-cli/default.nix b/pkgs/development/tools/turso-cli/default.nix
index 9414d1114bcbc..c68b1a3010a88 100644
--- a/pkgs/development/tools/turso-cli/default.nix
+++ b/pkgs/development/tools/turso-cli/default.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "turso-cli";
-  version = "0.89.0";
+  version = "0.90.3";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-BFL5D4GkcYdHkEc5448jgQflhhncePYfHMTprPynvmU=";
+    hash = "sha256-NkCkInQLwGwb8bFeRTSk2rpuPBOkMvWBgVx2IFFyRFQ=";
   };
 
   vendorHash = "sha256-oxlIaSSLZ6JirvUPOIHirp43G5qrDFJhNd6HjA9UYKo=";
diff --git a/pkgs/games/path-of-building/default.nix b/pkgs/games/path-of-building/default.nix
index 88c52fbf166f0..2e996f9754870 100644
--- a/pkgs/games/path-of-building/default.nix
+++ b/pkgs/games/path-of-building/default.nix
@@ -2,13 +2,13 @@
 let
   data = stdenv.mkDerivation(finalAttrs: {
     pname = "path-of-building-data";
-    version = "2.40.1";
+    version = "2.41.0";
 
     src = fetchFromGitHub {
       owner = "PathOfBuildingCommunity";
       repo = "PathOfBuilding";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-ZrnD3KX8pn14sKB3FzhNhxHChAKA5pHkWdn7576XjwE=";
+      hash = "sha256-XoRoKvlfBtlKyur1AZ+VjYc5URyX2/fof05h6Vs+vok=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/games/space-cadet-pinball/default.nix b/pkgs/games/space-cadet-pinball/default.nix
index 3957bf4fc1bc3..20016809f255d 100644
--- a/pkgs/games/space-cadet-pinball/default.nix
+++ b/pkgs/games/space-cadet-pinball/default.nix
@@ -15,24 +15,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "SpaceCadetPinball";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "k4zmu2a";
     repo = pname;
     rev = "Release_${version}";
-    sha256 = "sha256-LmYplJr1Mg4yNg9eP02FXf9mL1FnzNBhpted3GpmlQ0=";
+    hash = "sha256-W2P7Txv3RtmKhQ5c0+b4ghf+OMsN+ydUZt+6tB+LClM=";
   };
 
-  patches = [
-    # remove when updating past 2.0.1
-    (fetchpatch {
-      name = "fix-install-directories";
-      url = "https://github.com/k4zmu2a/SpaceCadetPinball/commit/d8ee1b9bfeee21d3981a40e735411393392bc1f6.patch";
-      sha256 = "sha256-BtCDJ+a9AFaOM8nyId0eU9GN/gUQT2kFCO4RIVTzZlE=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [
     SDL2
diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
index e45188f3e2cd2..59c60b320f689 100644
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -6,12 +6,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.66.2";
+  version = "1.70.2";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-HV3urzJX33dQjzUxtQhVgMaguGk8nqtXJJBXjHwaqC0=";
+    hash = "sha256-t0lc59RcOF7umUjyxQll4RZNyboiuMaP8dZ15vcuaAE=";
   };
 
   dontPatch = true;
diff --git a/pkgs/os-specific/darwin/yabai/default.nix b/pkgs/os-specific/darwin/yabai/default.nix
index fa8067d8d478e..052e064276a6e 100644
--- a/pkgs/os-specific/darwin/yabai/default.nix
+++ b/pkgs/os-specific/darwin/yabai/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, stdenvNoCC
 , fetchFromGitHub
 , fetchzip
 , installShellFiles
@@ -8,23 +7,90 @@
 , yabai
 , xxd
 , xcodebuild
-  # These all need to be from SDK 11.0 or later starting with yabai 5.0.0
 , Carbon
 , Cocoa
 , ScriptingBridge
 , SkyLight
 }:
 
-let
+stdenv.mkDerivation (finalAttrs: {
   pname = "yabai";
   version = "7.0.2";
 
-  test-version = testers.testVersion {
+  src =
+    # Unfortunately compiling yabai from source on aarch64-darwin is a bit complicated. We use the precompiled binary instead for now.
+    # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
+    if stdenv.isAarch64 then
+      (fetchzip {
+        url = "https://github.com/koekeishiya/yabai/releases/download/v${finalAttrs.version}/yabai-v${finalAttrs.version}.tar.gz";
+        hash = "sha256-FeNiJJM5vdzFT9s7N9cTjLYxKEfzZnKE9br13lkQhJo=";
+      })
+    else if stdenv.isx86_64 then
+      (fetchFromGitHub {
+        owner = "koekeishiya";
+        repo = "yabai";
+        rev = "v${finalAttrs.version}";
+        hash = "sha256-/MOAKsY7MlRWdvUQwHeITTeGJbCUdX7blZZAl2zXuic=";
+      })
+    else (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  env = {
+    # silence service.h error
+    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals stdenv.isx86_64 [
+    xcodebuild
+    xxd
+  ];
+
+  buildInputs = [ ] ++ lib.optionals stdenv.isx86_64 [
+    Carbon
+    Cocoa
+    ScriptingBridge
+    SkyLight
+  ];
+
+  dontConfigure = true;
+  dontBuild = stdenv.isAarch64;
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/icons/hicolor/scalable/apps}
+
+    cp ./bin/yabai $out/bin/yabai
+    ${lib.optionalString stdenv.isx86_64 "cp ./assets/icon/icon.svg $out/share/icons/hicolor/scalable/apps/yabai.svg"}
+    installManPage ./doc/yabai.1
+
+    runHook postInstall
+  '';
+
+  postPatch = lib.optionalString stdenv.isx86_64 /* bash */ ''
+    # aarch64 code is compiled on all targets, which causes our Apple SDK headers to error out.
+    # Since multilib doesnt work on darwin i dont know of a better way of handling this.
+    substituteInPlace makefile \
+    --replace "-arch arm64e" "" \
+    --replace "-arch arm64" "" \
+    --replace "clang" "${stdenv.cc.targetPrefix}clang"
+
+    # `NSScreen::safeAreaInsets` is only available on macOS 12.0 and above, which frameworks arent packaged.
+    # When a lower OS version is detected upstream just returns 0, so we can hardcode that at compiletime.
+    # https://github.com/koekeishiya/yabai/blob/v4.0.2/src/workspace.m#L109
+    substituteInPlace src/workspace.m \
+    --replace 'return screen.safeAreaInsets.top;' 'return 0;'
+  '';
+
+  passthru.tests.version = testers.testVersion {
     package = yabai;
-    version = "yabai-v${version}";
+    version = "yabai-v${finalAttrs.version}";
   };
 
-  _meta = with lib; {
+  meta = {
     description = "A tiling window manager for macOS based on binary space partitioning";
     longDescription = ''
       yabai is a window management utility that is designed to work as an extension to the built-in
@@ -33,119 +99,22 @@ let
       using skhd and other third-party software.
     '';
     homepage = "https://github.com/koekeishiya/yabai";
-    changelog = "https://github.com/koekeishiya/yabai/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    platforms = platforms.darwin;
+    changelog = "https://github.com/koekeishiya/yabai/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.darwin;
     mainProgram = "yabai";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       cmacrae
       shardy
       ivar
       khaneliman
     ];
-  };
-in
-{
-  # Unfortunately compiling yabai from source on aarch64-darwin is a bit complicated. We use the precompiled binary instead for now.
-  # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
-  aarch64-darwin = stdenvNoCC.mkDerivation {
-    inherit pname version;
-
-    src = fetchzip {
-      url = "https://github.com/koekeishiya/yabai/releases/download/v${version}/yabai-v${version}.tar.gz";
-      hash = "sha256-FeNiJJM5vdzFT9s7N9cTjLYxKEfzZnKE9br13lkQhJo=";
-    };
-
-    nativeBuildInputs = [
-      installShellFiles
+    sourceProvenance = with lib.sourceTypes; [ ]
+      ++ lib.optionals stdenv.isx86_64 [
+      fromSource
+    ] ++ lib.optionals stdenv.isAarch64 [
+      binaryNativeCode
     ];
-
-    dontConfigure = true;
-    dontBuild = true;
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out
-      cp -r ./bin $out
-      installManPage ./doc/yabai.1
-
-      runHook postInstall
-    '';
-
-    passthru.tests.version = test-version;
-
-    meta = _meta // {
-      sourceProvenance = with lib.sourceTypes; [
-        binaryNativeCode
-      ];
-    };
   };
+})
 
-  x86_64-darwin = stdenv.mkDerivation {
-    inherit pname version;
-
-    src = fetchFromGitHub {
-      owner = "koekeishiya";
-      repo = "yabai";
-      rev = "v${version}";
-      hash = "sha256-/MOAKsY7MlRWdvUQwHeITTeGJbCUdX7blZZAl2zXuic=";
-    };
-
-    nativeBuildInputs = [
-      installShellFiles
-      xcodebuild
-      xxd
-    ];
-
-    buildInputs = [
-      Carbon
-      Cocoa
-      ScriptingBridge
-      SkyLight
-    ];
-
-    dontConfigure = true;
-    enableParallelBuilding = true;
-
-    env = {
-      # silence service.h error
-      NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
-    };
-
-    postPatch = ''
-      # aarch64 code is compiled on all targets, which causes our Apple SDK headers to error out.
-      # Since multilib doesnt work on darwin i dont know of a better way of handling this.
-      substituteInPlace makefile \
-        --replace "-arch arm64e" "" \
-        --replace "-arch arm64" "" \
-        --replace "clang" "${stdenv.cc.targetPrefix}clang"
-
-      # `NSScreen::safeAreaInsets` is only available on macOS 12.0 and above, which frameworks arent packaged.
-      # When a lower OS version is detected upstream just returns 0, so we can hardcode that at compiletime.
-      # https://github.com/koekeishiya/yabai/blob/v4.0.2/src/workspace.m#L109
-      substituteInPlace src/workspace.m \
-        --replace 'return screen.safeAreaInsets.top;' 'return 0;'
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/{bin,share/icons/hicolor/scalable/apps}
-
-      cp ./bin/yabai $out/bin/yabai
-      cp ./assets/icon/icon.svg $out/share/icons/hicolor/scalable/apps/yabai.svg
-      installManPage ./doc/yabai.1
-
-      runHook postInstall
-    '';
-
-    passthru.tests.version = test-version;
-
-    meta = _meta // {
-      sourceProvenance = with lib.sourceTypes; [
-        fromSource
-      ];
-    };
-  };
-}.${stdenv.hostPlatform.system} or (throw "Unsupported platform ${stdenv.hostPlatform.system}")
diff --git a/pkgs/servers/etcd/3.5.nix b/pkgs/servers/etcd/3.5/default.nix
index 530df4476ecbf..43f47aa0eaa15 100644
--- a/pkgs/servers/etcd/3.5.nix
+++ b/pkgs/servers/etcd/3.5/default.nix
@@ -2,12 +2,16 @@
 
 let
   version = "3.5.12";
+  etcdSrcHash = "sha256-Z2WXNzFJYfRQCldUspQjUR5NyUzCCINycuEXWaTn4vU=";
+  etcdServerVendorHash = "sha256-S5cEIV4hKRjn9JFEKWBiSEPytHtVacsSnG6T8dofgyk=";
+  etcdUtlVendorHash = "sha256-Vgp44Kg6zUDYVJU6SiYd8ZEcAWqKPPTsqYafcfk89Cc=";
+  etcdCtlVendorHash = "sha256-PZLsekZzwlGzccCirNk9uUj70Ue5LMDs6LMWBI9yivs=";
 
   src = fetchFromGitHub {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    hash = "sha256-Z2WXNzFJYfRQCldUspQjUR5NyUzCCINycuEXWaTn4vU=";
+    hash = etcdSrcHash;
   };
 
   CGO_ENABLED = 0;
@@ -16,7 +20,7 @@ let
     description = "Distributed reliable key-value store for the most critical data of a distributed system";
     license = licenses.asl20;
     homepage = "https://etcd.io/";
-    maintainers = with maintainers; [ offline endocrimes ];
+    maintainers = with maintainers; [ endocrimes offline superherointj ];
     platforms = platforms.darwin ++ platforms.linux;
   };
 
@@ -25,7 +29,7 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorHash = "sha256-S5cEIV4hKRjn9JFEKWBiSEPytHtVacsSnG6T8dofgyk=";
+    vendorHash = etcdServerVendorHash;
 
     modRoot = "./server";
 
@@ -45,7 +49,7 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorHash = "sha256-Vgp44Kg6zUDYVJU6SiYd8ZEcAWqKPPTsqYafcfk89Cc=";
+    vendorHash = etcdUtlVendorHash;
 
     modRoot = "./etcdutl";
   };
@@ -55,7 +59,7 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorHash = "sha256-PZLsekZzwlGzccCirNk9uUj70Ue5LMDs6LMWBI9yivs=";
+    vendorHash = etcdCtlVendorHash;
 
     modRoot = "./etcdctl";
   };
@@ -71,6 +75,7 @@ symlinkJoin {
       inherit (nixosTests) etcd etcd-cluster;
       k3s = k3s.passthru.tests.etcd;
     };
+    updateScript = ./update.sh;
   };
 
   paths = [
diff --git a/pkgs/servers/etcd/3.5/update.sh b/pkgs/servers/etcd/3.5/update.sh
new file mode 100755
index 0000000000000..329161188e397
--- /dev/null
+++ b/pkgs/servers/etcd/3.5/update.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep gnused jq nix-prefetch
+
+set -x -eu -o pipefail
+
+ETCD_VERSION_MAJOR_MINOR=`basename "$PWD"`
+
+ETCD_PKG_NAME=etcd_$(echo $ETCD_VERSION_MAJOR_MINOR | sed 's/[.]/_/g')
+NIXPKGS_PATH="$(git rev-parse --show-toplevel)"
+ETCD_PATH="$(dirname "$0")"
+
+OLD_VERSION="$(nix-instantiate --eval -E "with import $NIXPKGS_PATH {}; \
+    $ETCD_PKG_NAME.version or (builtins.parseDrvName $ETCD_PKG_NAME.name).version" | tr -d '"')"
+
+LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/etcd-io/etcd/releases \
+    | jq -r 'map(.tag_name)' | grep $ETCD_VERSION_MAJOR_MINOR | sed 's|[", ]||g' | sort -rV | head -n1)
+
+LATEST_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')
+
+if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
+    echo "Attempting to update etcd from $OLD_VERSION to $LATEST_VERSION"
+    ETCD_SRC_HASH=$(nix-prefetch-url --quiet --unpack https://github.com/etcd-io/etcd/archive/refs/tags/${LATEST_TAG}.tar.gz)
+    ETCD_SRC_HASH=$(nix hash to-sri --type sha256 $ETCD_SRC_HASH)
+
+    setKV () {
+        sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "$ETCD_PATH/default.nix"
+    }
+
+    setKV version $LATEST_VERSION
+    setKV etcdSrcHash $ETCD_SRC_HASH
+
+    getAndSetVendorHash () {
+        local EMPTY_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # Hash from lib.fakeHash
+        local VENDOR_HASH=$EMPTY_HASH
+        local PKG_KEY=$1
+        local INNER_PKG=$2
+
+        setKV $PKG_KEY $EMPTY_HASH
+
+        set +e
+        VENDOR_HASH=$(nix-prefetch -I nixpkgs=$NIXPKGS_PATH "{ sha256 }: \
+            (import $NIXPKGS_PATH/. {}).$ETCD_PKG_NAME.passthru.$INNER_PKG.goModules.overrideAttrs (_: { vendorHash = sha256; })")
+        set -e
+
+        if [ -n "${VENDOR_HASH:-}" ]; then
+            setKV $PKG_KEY $VENDOR_HASH
+        else
+            echo "Update failed. $PKG_KEY is empty."
+            exit 1
+        fi
+    }
+
+    getAndSetVendorHash etcdServerVendorHash etcdserver
+    getAndSetVendorHash etcdUtlVendorHash etcdutl
+    getAndSetVendorHash etcdCtlVendorHash etcdctl
+
+    # `git` flag here is to be used by local maintainers to speed up the bump process
+    if [ $# -eq 1 ] && [ "$1" = "git" ]; then
+        git switch -c "package-$ETCD_PKG_NAME-$LATEST_VERSION"
+        git add "$ETCD_PATH"/default.nix
+        git commit -m "$ETCD_PKG_NAME: $OLD_VERSION -> $LATEST_VERSION
+
+Release: https://github.com/etcd-io/etcd/releases/tag/v$LATEST_VERSION"
+    fi
+
+else
+    echo "etcd is already up-to-date at $OLD_VERSION"
+fi
diff --git a/pkgs/servers/geospatial/geoserver/default.nix b/pkgs/servers/geospatial/geoserver/default.nix
index 1ad28bfd5d1e7..b171161d40895 100644
--- a/pkgs/servers/geospatial/geoserver/default.nix
+++ b/pkgs/servers/geospatial/geoserver/default.nix
@@ -9,11 +9,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "geoserver";
-  version = "2.24.2";
+  version = "2.25.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/geoserver/GeoServer/${version}/geoserver-${version}-bin.zip";
-    sha256 = "sha256-1ArG7CneJRY9y6rYaVjNU6L6RsUgVvjpwt07Rd+WGrE=";
+    sha256 = "sha256-maWDRRIo5Mqjb6K1NWFplmQwvJ9fLXGnelZcslwp4Oo=";
   };
 
   patches = [
diff --git a/pkgs/servers/home-assistant/custom-components/README.md b/pkgs/servers/home-assistant/custom-components/README.md
index 888ea97e45535..ccb8062200f85 100644
--- a/pkgs/servers/home-assistant/custom-components/README.md
+++ b/pkgs/servers/home-assistant/custom-components/README.md
@@ -11,7 +11,7 @@ Python runtime dependencies can be directly consumed as unqualified
 function arguments. Pass them into `propagatedBuildInputs`, for them to
 be available to Home Assistant.
 
-Out-of-tree components need to use python packages from
+Out-of-tree components need to use Python packages from
 `home-assistant.python.pkgs` as to not introduce conflicting package
 versions into the Python environment.
 
@@ -58,7 +58,7 @@ domain in the `manifest.json` as well as the module name are
 
 The `pname` attribute is a composition of both `owner` and `domain`.
 
-Don't set `pname`, set `owner and `domain` instead.
+Don't set `pname`, set `owner` and `domain` instead.
 
 Exposing the `domain` attribute separately allows checking for
 conflicting components at eval time.
diff --git a/pkgs/servers/home-assistant/custom-components/default.nix b/pkgs/servers/home-assistant/custom-components/default.nix
index fb558e3432207..ad63a4bdc0b6f 100644
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@@ -18,6 +18,8 @@
 
   gpio = callPackage ./gpio {};
 
+  homematicip_local = callPackage ./homematicip_local { };
+
   localtuya = callPackage ./localtuya {};
 
   miele = callPackage ./miele {};
diff --git a/pkgs/servers/home-assistant/custom-components/homematicip_local/default.nix b/pkgs/servers/home-assistant/custom-components/homematicip_local/default.nix
new file mode 100644
index 0000000000000..26b9f85e1d790
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/homematicip_local/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildHomeAssistantComponent
+, fetchFromGitHub
+, hahomematic
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "danielperna84";
+  domain = "homematicip_local";
+  version = "1.58.0";
+
+  src = fetchFromGitHub {
+    owner = "danielperna84";
+    repo = "custom_homematic";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ianM29eF2MN2THS3CTg4tBkd+8pV/m1fg8VvMDhhadg=";
+  };
+
+  dependencies = [
+    hahomematic
+  ];
+
+  meta = {
+    changelog = "https://github.com/danielperna84/custom_homematic/blob/${version}/changelog.md";
+    description = "Custom Home Assistant Component for HomeMatic";
+    homepage = "https://github.com/danielperna84/custom_homematic";
+    maintainers = with lib.maintainers; [ dotlambda ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index dc9cbd9e8d3c1..cefdc1f8746a0 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.3.0";
+  version = "2024.3.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-4K/JrmNcvRzso9NgFuh3fThcEQS+Ydk4II6xrWv2KdM=";
+    hash = "sha256-Qc+pwG87R57wGyCujMQ6qygDOhRh/FoDf1HTRZS3M6s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/homepage-dashboard/default.nix b/pkgs/servers/homepage-dashboard/default.nix
index 85147507420d2..c4eec239b96be 100644
--- a/pkgs/servers/homepage-dashboard/default.nix
+++ b/pkgs/servers/homepage-dashboard/default.nix
@@ -29,13 +29,13 @@ let
 in
 buildNpmPackage rec {
   pname = "homepage-dashboard";
-  version = "0.8.9";
+  version = "0.8.10";
 
   src = fetchFromGitHub {
     owner = "gethomepage";
     repo = "homepage";
     rev = "v${version}";
-    hash = "sha256-wG7+w6Hsqs1skxUyEMx2j3R8qh3dHXtBg2ADdWBPc/g=";
+    hash = "sha256-mWUjBRepV7RjX4aPzRks/7NUbPyhaxSqarqnIM0NDQs=";
   };
 
   npmDepsHash = "sha256-ZpH9rVe3bAhVbq7uTVDvaPpA6XRRKT/ySdytZMlemCE=";
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index c0c93f2cf736c..a7e7b3d8c0772 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
   '';
 in stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "24.0.1";
+  version = "24.0.2";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    hash = "sha256-d7bITeukqoLwEPQrUn01arXf8j7L8gM47wzHMsBvz2M=";
+    hash = "sha256-YC/fa1yxm3lMmEOZXcTOMX2F7Y5yolLKm89cGfEagH4=";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
diff --git a/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix b/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
index 8e86aa10b671b..42cb8e2e0db28 100644
--- a/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gitlab-ci-pipelines-exporter";
-  version = "0.5.6";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "mvisonneau";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SbFaB808Xa7XvHR8ruu9wADVPUVwe5ogA+L+PSYb7kQ=";
+    sha256 = "sha256-zJCvjgymwFUDOl3ubrTdaX0KpzzR+fzUIiCkRmZNUOE=";
   };
 
   subPackages = [ "cmd/${pname}" ];
@@ -17,7 +17,7 @@ buildGoModule rec {
     "-X main.version=v${version}"
   ];
 
-  vendorHash = "sha256-qZ9Ph8YZBBGS3dFlk3zTynU9WuRUHl2fVSPtd7hUB8E=";
+  vendorHash = "sha256-Wnn2KIz4XtdJ6JoYLkGnykgc+MLstHS7s8MegSAQbiQ=";
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/servers/nosql/apache-jena/binary.nix b/pkgs/servers/nosql/apache-jena/binary.nix
index 2b7e3c04735d6..a991f3fa40e70 100644
--- a/pkgs/servers/nosql/apache-jena/binary.nix
+++ b/pkgs/servers/nosql/apache-jena/binary.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-jena";
-  version = "4.10.0";
+  version = "5.0.0";
   src = fetchurl {
     url = "mirror://apache/jena/binaries/apache-jena-${version}.tar.gz";
-    hash = "sha256-G2kCh5F2WfrSOCr+fEO02mlOSVfV2Oy3uZGNEarLR+M=";
+    hash = "sha256-Se47rsgp8V6Ypv0QHrwjIXrDPchM1nSl/GmUWMEvLIo=";
   };
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index b00b67449ace7..3dfc16a48c1fd 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "ferretdb";
-  version = "1.20.1";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    hash = "sha256-joLl0LTDGP2FVYcUIknrLPYorfIlMXli+igV/Z4P0BI=";
+    hash = "sha256-wTnVZ2C6edXy7+DV5w9Ny1Ry8yKQtahS2AIjFkaJhm8=";
   };
 
   postPatch = ''
@@ -20,7 +20,7 @@ buildGoModule rec {
     echo nixpkgs     > build/version/package.txt
   '';
 
-  vendorHash = "sha256-lkJagsagJT8qP3/cd6Rfe2mqjOmDK7R+we0eblyT9rw=";
+  vendorHash = "sha256-1Al7Dxw6EkGZpjmxQWbRU4uV0KT1emNI3YNGbiX87Yc=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/servers/openafs/1.8/bosserver.patch b/pkgs/servers/openafs/1.8/bosserver.patch
index 094d9871f64f5..247e3476eb130 100644
--- a/pkgs/servers/openafs/1.8/bosserver.patch
+++ b/pkgs/servers/openafs/1.8/bosserver.patch
@@ -1,17 +1,14 @@
-diff -u openafs-1.8.0/src/bozo/bosserver.c /tmp/buffer-content-13110-gd
---- openafs-1.8.0/src/bozo/bosserver.c
-+++ #<buffer bosserver.c>
-@@ -244,24 +244,6 @@
+diff --git a/src/bozo/bosserver.c b/src/bozo/bosserver.c
+index 371cb638e4..e4d58c3562 100644
+--- a/src/bozo/bosserver.c
++++ b/src/bozo/bosserver.c
+@@ -246,20 +246,6 @@ MakeDir(const char *adir)
  static int
  CreateDirs(const char *coredir)
  {
--    if ((!strncmp
--	 (AFSDIR_USR_DIRPATH, AFSDIR_CLIENT_ETC_DIRPATH,
--	  strlen(AFSDIR_USR_DIRPATH)))
--	||
--	(!strncmp
+-    if (!strncmp
 -	 (AFSDIR_USR_DIRPATH, AFSDIR_SERVER_BIN_DIRPATH,
--	  strlen(AFSDIR_USR_DIRPATH)))) {
+-	  strlen(AFSDIR_USR_DIRPATH))) {
 -	if (MakeDir(AFSDIR_USR_DIRPATH))
 -	    return errno;
 -    }
@@ -26,5 +23,3 @@ diff -u openafs-1.8.0/src/bozo/bosserver.c /tmp/buffer-content-13110-gd
      if (MakeDir(AFSDIR_SERVER_ETC_DIRPATH))
  	return errno;
      if (MakeDir(AFSDIR_SERVER_LOCAL_DIRPATH))
-
-Diff finished.  Fri Jun 29 15:45:46 2018
diff --git a/pkgs/servers/openafs/1.8/module.nix b/pkgs/servers/openafs/1.8/module.nix
index 99c25d0ab1e62..bdb4286afa850 100644
--- a/pkgs/servers/openafs/1.8/module.nix
+++ b/pkgs/servers/openafs/1.8/module.nix
@@ -33,80 +33,150 @@ stdenv.mkDerivation {
   inherit src;
 
   patches = [
-    # cf: Fix cast-function-type err w/disable-checking
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=6867a3e8429f37fb748575df52256227ae9e5b53";
-      hash = "sha256-FDvOFDzl2eFN7ZKUqQBQSWGo0ntayc8NCYh/haVi8Ng=";
-    })
-    # LINUX: Make 'fs flush*' invalidate dentry
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=898098e01e19970f80f60a0551252b2027246038";
-      hash = "sha256-ehwRrzpqB8iJKuZ/18oJsrHVlKQs6EzCNaPtSG1m0sw=";
-    })
-    # Linux 6.5: Replace generic_file_splice_read
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=fef245769366efe8694ddadd1e1f2ed5ef8608f4";
-      hash = "sha256-TD1xYvlc9aJyravNZLPhceeOwBawvn0Ndxd50rszTJU=";
-    })
-    # LINUX: Make sysctl definitions more concise
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=d15c7ab50c92671052cbe9a93b0440c81156d8aa";
-      hash = "sha256-6K593AJvgC34RfnIqW8+0A/v9cF6tsbVMeKpCv+QrK4=";
-    })
-    # Linux 6.5: Use register_sysctl()
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=63801cfd1fc06ec3259fcfd67229f3a3c70447ed";
-      hash = "sha256-eoQxaZ28OanSoaHRJcfvXQORbe21YLhwPLoJUILjMkU=";
-    })
-    # hcrypto: rename abort to _afscrypto_abort
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=538f450033a67e251b473ff92238b3124b85fc72";
-      hash = "sha256-ztfJQKvGHGdWQe/0+BGkgRFxOi3n4YY+EFxgbD3DO1E=";
-    })
-    # cf: Avoid nested C functions built by autoconf
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=d50ced2a17e05884ea18bb3dfcde6378b2531dc7";
-      hash = "sha256-dK2/9bGhlXCPCB9t9T/K2dKdRBShVKXtYXWPttsOhAM=";
-    })
-    # cf: Use static allocated structs for cf tests
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=00f13c45d637249a0d698458e08c1b8e2da8e219";
-      hash = "sha256-YNszJIxBDIsl3RgBcHEpNtYIrNLC0tnSbIOQvX0oZ+s=";
-    })
-    # LINUX: Pass an array of structs to register_sysctl
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=5b647bf17a878271e1ce9882e41663770ee73528";
-      hash = "sha256-9o4cr/KORtanTfuKMAMAOvePB+vK579rR85rY+m8VNM=";
-    })
-    # linux: Replace fop iterate with fop iterate_shared
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=6de0a646036283266e1d4aeb583e426005ca5ad4";
-      hash = "sha256-cL3ByjUS3QU8fSbuN7ZEEKyjb+6TbbZL10UKbSgNl6c=";
-    })
-    # Linux 6.6: convert to ctime accessor functions
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=6413fdbc913834f2884989e5811841f4ccea2b5f";
-      hash = "sha256-vdK25vfS5Yr0xQufzUk431FXHwMIWlP2UpLjqnobJWI=";
-    })
-    # Linux 6.6: Pass request_mask to generic_fillattr
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=4f1d8104d17d2b4e95c7abaf5498db6b80aefa8f";
-      hash = "sha256-XJpqbDB/LOuqZj3gPHlcLeGzAQCGvPH8ArgWf+sbBJU=";
-    })
-    # Linux: Fix to use time_t instead of time64_t
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=56763a199f92101c35d6b9b733302cb08fe0cdbe";
-      hash = "sha256-A2z+smBLQg6k+cHPpNr2s/SgoYuCOMNLcvm5LFRiqeM=";
-    })
-    # dir: Introduce struct DirEntryFlex
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=fd527549c2d2b29a955f8c0427ac67c5d49ef38c";
-      hash = "sha256-jblsaJuTt3BsW5MG69ETcao/ZzSuh9aKRZyTIxZ7Ty4=";
-    })
-    # Linux 6.7: convert to inode a/mtime accessor funcs
-    (fetchpatch {
-      url = "https://git.openafs.org?p=openafs.git;a=patch;h=6edf9d350c6ffd9d5e51fb8106701c1bc2f6a4d9";
-      hash = "sha256-oQVyKzIcqzYDZHSut9Mw1t3kcEC5HGUX6eGlGJ9fZYo=";
+    # afs: Make afs_AllocDCache static
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15679/revisions/889d335497aa9f5ee38789fb50fc15694b8e17f8/patch";
+      hash = "sha256-XJAiZ7XL+QFk3l0CUSzudUSGC+oC7v4Kew9TWmEKvNg=";
+    })
+    # LINUX: Minor osi_vfsop.c cleanup
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15680/revisions/342e9cbad84c762934787106a4a8baab7cd7f5aa/patch";
+      hash = "sha256-kw8CQrpK9caq8eXrCEbk2zTSb727d8NmaSQg0Bg/TAM=";
+    })
+    # afs: Remove SRXAFSCB_GetDE
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15681/revisions/27e7adf192a1dd07505e0b3d0c89426910f7daa4/patch";
+      hash = "sha256-3AMq5fAUt/HAIRuh/GAWPov3gwvMzVAqzmvpIKZLbBo=";
+    })
+    # afs: remove dead ICL (fstrace) code
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15682/revisions/61d3bef0ded0999366e6487d39ab6aabaaceeb71/patch";
+      hash = "sha256-4LnNwJ7xZAoPqHnyKai4kCEGiG037rlZwkEjmD6xBeM=";
+    })
+    # cf: Add function prototypes for linux conftest
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15683/revisions/f7f37de075700bda5f75c405f0f775ea4e118089/patch";
+      hash = "sha256-6tceVLqrhdo5QWjOCvutvZmetopz+tyP5AtJUh7Kkkc=";
+    })
+    # afs: Remove DFlushDCache()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15684/revisions/e0f425a3d8bccb48a69f27dff209e32cf05f4305/patch";
+      hash = "sha256-/S4uZj+cScPFihvJDW49dQ2awrt7Thx7tIpoImIl/kg=";
+    })
+    # afs: Remove afs_MemExtendEntry()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15685/revisions/aae8b00d97585b60702151c6f28ff7ec4d65c2d9/patch";
+      hash = "sha256-9CA0lwiNjzeteAPXh/Yyu3gqZBSi2b9XBrl43w2VzSs=";
+    })
+    # afs: Remove afs_osi_UnmaskUserLoop()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15686/revisions/5312d069bc57d200ff65bf968c9bdff0f38fe653/patch";
+      hash = "sha256-jBwd0zFidIfNx6csPSNp1RGCq1JKmXNXWbQnG2pIgvM=";
+    })
+    # afs: Remove dummy_PSetAcl()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15687/revisions/056a7a8005a68cf2fb8be80668b139aa87a0de0b/patch";
+      hash = "sha256-ExvIzyyqPijf5c1T3mpSqFefvbd42FpLIFYUpcc5fyk=";
+    })
+    # afs: Remove SRXAFSCB_FetchData/StoreData
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15688/revisions/073adec17a9b7b55d3672b17f7faa4a122ce6e9d/patch";
+      hash = "sha256-dMVeHTdLde22cxtRzSJLI0MUKgZRYzVRjAeuKgMKFtQ=";
+    })
+    # afs: Remove afs_DbgDisconFiles()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15689/revisions/db913849047d0ec77e735f14dbbce63652209cc1/patch";
+      hash = "sha256-v0kWFBEFdfpNQWzs4vA0Pu25ZR/nC36x6mqP3rOujxY=";
+    })
+    # afs: Add declaration for RXAFS_ResidencyCmd()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15690/revisions/67e48c84b9971e6b865274408080fbf5ec7ba1ac/patch";
+      hash = "sha256-jzZG7w0tOxkrcphiITHrfodCZ6wyGp1NVARLI/tfN3c=";
+    })
+    # roken: Declare ct_memcmp in hcrypto kernel roken.h
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15691/revisions/d1c89acf70a794b78c5daaff206d734e36bbec6d/patch";
+      hash = "sha256-OrkUiybGI2jOsEqQFeGXTQqWvgp1NwttuPvokNkwxHw=";
+    })
+    # Linux 6.8: Add function prototypes for krb5
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15692/revisions/a14a9add73341bc3c355250bc43282e022bff95c/patch";
+      hash = "sha256-PMnW4H/s2uKda3xbka2+2nz422pksttrYvsTf+omzrc=";
+    })
+    # afs: Declare init_hckernel_mutex()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15693/revisions/112fb94a608a9a810cc9b43fdf762f15277d9eaa/patch";
+      hash = "sha256-73zpSSF2yfbA7wxZVdKWnOqkMtdi/EkT8IjpXIMNUnc=";
+    })
+    # afs: Add includes to pick up function prototypes
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15694/revisions/87ab04acc921794f49084548cf5fc94f6f37f10e/patch";
+      hash = "sha256-KCBjBLBH530+vr5hmA/r6RK7VYpoiJYgkks1pQplYXU=";
+    })
+    # afs: Move function prototypes into headers
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15695/revisions/0d9f6cf121e49cfe1a2047b98d4c30b82a1898bd/patch";
+      hash = "sha256-WrfPZvNNVN3VuuBGH4sshpJOoPP2hwVitQW8PqQCBRA=";
+    })
+    # afs: Add afs_xioctl prototyes to afs_prototypes.h
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15696/revisions/dffd0e1475f9fb346a146607335c9f9d847d4429/patch";
+      hash = "sha256-HJzTJlKNGjuXALXoaUjuQEr5Us2KLM9Exuj7jGqvHyg=";
+    })
+    # afs: Remove SRXAFSCB* protos from afs_prototypes.h
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15697/revisions/a87845d40aac04ff12dde369753c9472a8e4808d/patch";
+      hash = "sha256-XO8+aL/yTkMdUT4sDRTFO3CspvO6nmF8M4Y/V0Y+dww=";
+    })
+    # rx: Add function prototypes to rx_prototypes.h
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15698/revisions/f5bafb0680a063d710b6e5e8ccf833f1dd371896/patch";
+      hash = "sha256-KYGehW48hw71dAIdd5Z5U5Kvp72Gk4Tu2q+VA50LL7A=";
+    })
+    # afs: fix 'ops' variable may be used uninitialized
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15699/revisions/6b207567af7244a4fc6c314fdc815aa14c4eae09/patch";
+      hash = "sha256-IIjuY9LL2BjnUh8W8n5ohUVY7RNk5qoH58JpimXqrNo=";
+    })
+    # afs: Add static attribute to internal functions
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15700/revisions/e157f8f39bd367151f5a9264c7d4ce8bcbed08fb/patch";
+      hash = "sha256-LKBYqorko5HmaigKWFiIiYHgVnyc03UcQX6p8CjfYrs=";
+    })
+    # rx: Add static attribute to internal functions
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15701/revisions/2056ce8ae0d617d663e6181573c982994a1836db/patch";
+      hash = "sha256-+Oq8CFI3+29WdCabrHV4+AU3U3fuyIUO+wYzy/QJ/24=";
+    })
+    # rxgen: Declare generated PKG_TranslateOpCode()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15702/revisions/b77b304bb58f472e8a9d2f3b6d47fffd38d0c905/patch";
+      hash = "sha256-iErcC/J9L7TrjnbkJw9yHXR4wHCM+KHai0vzs+KEgfo=";
+    })
+    # rxgen: Declare generated PKG_OpCodeStats()
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15703/revisions/e428053b5bc1250fdcc3ed8ac52ee798d96ad284/patch";
+      hash = "sha256-copfhVvIa6zScehQm6gZ5FaIT42wr+YoFdhPCN50xn4=";
+    })
+    # Linux 6.8: use hlist iteration for dentry children
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15704/revisions/7cae97b86fbcc4a53967927d6c2cae9dcbc6ac4d/patch";
+      hash = "sha256-NwF1CvdI9ZjISc1A/nJP4Ea1LJY4lBnsbkRqvQFo5Wc=";
+    })
+    # Linux 6.8: Remove ctl_table sentinels
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15705/revisions/81b910ab4a0ef0d0b6cd3a1a636fcbcd050c0245/patch";
+      hash = "sha256-g8acwb7bGF+LjQN8tVKFLXvATddN+8gSepVoM28AehA=";
+    })
+    # Linux 6.8: Use roken's strlcpy() in kernel module
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15706/revisions/d9f3a2c6639e694c8d6fc4ad00d6a37d6e1f9bf6/patch";
+      hash = "sha256-4P+9VkDhMezPHa47a5L92Rh+6PMGxF54Agdx4uAU63Y=";
+    })
+    # afs: Drop GLOCK for various Rx calls
+    (fetchBase64Patch {
+      url = "https://gerrit.openafs.org/changes/15707/revisions/0e983a9a7e010a4e7c8a4c60cf313e566323bbf1/patch";
+      hash = "sha256-uHYuCxC0xAd8BQmNbTFGfVstq8LC2PM2aZ0EcWfRIJM=";
     })
   ];
 
diff --git a/pkgs/servers/openafs/1.8/srcs.nix b/pkgs/servers/openafs/1.8/srcs.nix
index a80ad726dbe5b..3eaefba8d70d4 100644
--- a/pkgs/servers/openafs/1.8/srcs.nix
+++ b/pkgs/servers/openafs/1.8/srcs.nix
@@ -1,16 +1,16 @@
 { fetchurl }:
 rec {
-  version = "1.8.10";
+  version = "1.8.11";
   src = fetchurl {
     url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2";
-    hash = "sha256-n+wRNkYjVJ6NtzdAcvXI8BuEH2v+foVnPLzjX/Q/+wc=";
+    hash = "sha256-4u+0cQmWt9IxmLU8Vilaj54k6KVVMXxfxjuBJaNxTs0=";
   };
 
   srcs = [
     src
     (fetchurl {
       url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-doc.tar.bz2";
-      hash = "sha256-nDgJ6K/qAX2K8lKPYM8OD5+oRU+shlM6PmciHy61+10=";
+      hash = "sha256-OsarP52T1V3hd1eQOwST/JAg8eBALqMZ5hIIs5ALYHw=";
     })
   ];
 }
diff --git a/pkgs/servers/roadrunner/default.nix b/pkgs/servers/roadrunner/default.nix
index 0f47c6ebeb3a3..c1754e3ac9587 100644
--- a/pkgs/servers/roadrunner/default.nix
+++ b/pkgs/servers/roadrunner/default.nix
@@ -6,12 +6,12 @@
 
 buildGoModule rec {
   pname = "roadrunner";
-  version = "2023.3.10";
+  version = "2023.3.12";
   src = fetchFromGitHub {
     repo = "roadrunner";
     owner = "roadrunner-server";
     rev = "v${version}";
-    hash = "sha256-8wcZWnRi+wIg78VdGV/38Oldwjry7QXxmdacjYfe3sw=";
+    hash = "sha256-d/GXZ0rQ8prkOgvkx8/TBwP2zwISef5ClMGy1pkW7g4=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +44,7 @@ buildGoModule rec {
       --replace "127.0.0.1:0" "127.0.0.1:55554"
   '';
 
-  vendorHash = "sha256-xAzZdElu0rzoWnEQbhMO7DhQx3P7241yMy/Gvk9jnCA=";
+  vendorHash = "sha256-GNWd+SFjAeIkIkPSh+UtQwoWfQ9lUATXfnkWbqwQfsY=";
 
   meta = {
     changelog = "https://github.com/roadrunner-server/roadrunner/blob/v${version}/CHANGELOG.md";
diff --git a/pkgs/servers/sslh/default.nix b/pkgs/servers/sslh/default.nix
index ba02f33cee629..49610ddd9bc16 100644
--- a/pkgs/servers/sslh/default.nix
+++ b/pkgs/servers/sslh/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sslh";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "yrutschle";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fIKiUrpHn2VcUFH6WblZDDpa+AenC2qtgrQ6uUUIyoQ=";
+    hash = "sha256-NCjLqYSPHukY11URQ/n+33Atzl4DhPDbNOEDaP6bQlg=";
   };
 
   postPatch = "patchShebangs *.sh";
diff --git a/pkgs/servers/sunshine/default.nix b/pkgs/servers/sunshine/default.nix
index a4fd4abc109c7..a401f318a9110 100644
--- a/pkgs/servers/sunshine/default.nix
+++ b/pkgs/servers/sunshine/default.nix
@@ -160,6 +160,10 @@ stdenv'.mkDerivation rec {
       --subst-var-by PROJECT_NAME 'Sunshine' \
       --subst-var-by PROJECT_DESCRIPTION 'Self-hosted game stream host for Moonlight' \
       --replace-fail '/usr/bin/env systemctl start --u sunshine' 'sunshine'
+
+    substituteInPlace packaging/linux/sunshine.service.in \
+      --subst-var-by PROJECT_DESCRIPTION 'Self-hosted game stream host for Moonlight' \
+      --subst-var-by SUNSHINE_EXECUTABLE_PATH $out/bin/sunshine
   '';
 
   preBuild = ''
diff --git a/pkgs/servers/web-apps/pict-rs/default.nix b/pkgs/servers/web-apps/pict-rs/default.nix
index fdd975e3682c9..9d710b6f78959 100644
--- a/pkgs/servers/web-apps/pict-rs/default.nix
+++ b/pkgs/servers/web-apps/pict-rs/default.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pict-rs";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchFromGitea {
     domain = "git.asonix.dog";
     owner = "asonix";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZRT382ClImnlwvWyA1w7ZIIF4PXr3rWmeIsqJYngkfM=";
+    sha256 = "sha256-SxGgj4yRtMcRKIQMVhRaeK2NudU581RDYLmAecWyxak=";
   };
 
-  cargoHash = "sha256-FTb8VoQJFS55CKlQvoWkBQEBUCvUnFaUAxIW22zEIHI=";
+  cargoHash = "sha256-T8L6geDOF8qBZYABtJX+MBhwYFyZwT7PCMigk0vuuDc=";
 
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";
diff --git a/pkgs/servers/web-apps/slskd/default.nix b/pkgs/servers/web-apps/slskd/default.nix
index 7a2a388086c17..0a69acb5e08c9 100644
--- a/pkgs/servers/web-apps/slskd/default.nix
+++ b/pkgs/servers/web-apps/slskd/default.nix
@@ -21,7 +21,7 @@ let
     description = "A modern client-server application for the Soulseek file sharing network";
     homepage = "https://github.com/slskd/slskd";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ ppom ];
+    maintainers = with maintainers; [ ppom melvyn2 ];
     platforms = platforms.linux;
   };
 
diff --git a/pkgs/shells/hishtory/default.nix b/pkgs/shells/hishtory/default.nix
index 83b7191641235..8f3f8ddde564c 100644
--- a/pkgs/shells/hishtory/default.nix
+++ b/pkgs/shells/hishtory/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "hishtory";
-  version = "0.277";
+  version = "0.282";
 
   src = fetchFromGitHub {
     owner = "ddworken";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Gb2E9IlXU+3WuEDIh/McwoHPEUqVAxMeaGVmers5Hvw=";
+    hash = "sha256-vuIeNa2Kr19L2lHTtsamjvnMsNNPQYU0yOPXXtXAOvA=";
   };
 
-  vendorHash = "sha256-qWKLYGDbL5LL3CjD2yz9CjwAM6lL9Pjnbk+ERCmW94c=";
+  vendorHash = "sha256-MUE6cq3mTRUcxO+lhAWr73wAzSYv9eMmv9Twpq/QHTc=";
 
   ldflags = [ "-X github.com/ddworken/hishtory/client/lib.Version=${version}" ];
 
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 321bccd3862df..4404fed5b09e7 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -59,14 +59,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.15.31"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.15.32"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     rev = "refs/tags/${version}";
-    hash = "sha256-7qeB3NCYQi7Mke/ZCGe8QUS5qy26btpGjhY/FMNhdkE=";
+    hash = "sha256-EdS8nsSlFtCvHn6Aysj8C5tmdBBRUtbTEVqkYex5vgc=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/admin/oci-cli/default.nix b/pkgs/tools/admin/oci-cli/default.nix
index 1d09e02b6ba68..a84c62ca63302 100644
--- a/pkgs/tools/admin/oci-cli/default.nix
+++ b/pkgs/tools/admin/oci-cli/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchPypi
 , python3
+, installShellFiles
 }:
 
 let
@@ -46,6 +47,8 @@ buildPythonApplication rec {
     hash = "sha256-yooEZuSIw2EMJVyT/Z/x4hJi8a1F674CtsMMGkMAYLg=";
   };
 
+  nativeBuildInputs = [ installShellFiles ];
+
   propagatedBuildInputs = [
     arrow
     certifi
@@ -73,6 +76,24 @@ buildPythonApplication rec {
       --replace "oci==2.78.0" "oci"
   '';
 
+  postInstall = ''
+    cat >oci.zsh <<EOF
+    #compdef oci
+    zmodload -i zsh/parameter
+    autoload -U +X bashcompinit && bashcompinit
+    if ! (( $+functions[compdef] )) ; then
+        autoload -U +X compinit && compinit
+    fi
+
+    EOF
+    cat src/oci_cli/bin/oci_autocomplete.sh >>oci.zsh
+
+    installShellCompletion \
+      --cmd oci \
+      --bash src/oci_cli/bin/oci_autocomplete.sh \
+      --zsh oci.zsh
+  '';
+
   # https://github.com/oracle/oci-cli/issues/187
   doCheck = false;
 
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 3f57ea9982fef..ef916f88e4fa8 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2024.03.13";
+  version = "2024.03.21";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-lhnCf4Il3pRNY6tfb19qyRDbeuWSPK6JEmOrcG92MeI=";
+    hash = "sha256-tK7+09vCZXj79jEY3Zxz1cdt5UdfOVy4gjqewdAMiP4=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/backup/zfs-replicate/default.nix b/pkgs/tools/backup/zfs-replicate/default.nix
index 0c9e2b0998a83..5a377d8cae28e 100644
--- a/pkgs/tools/backup/zfs-replicate/default.nix
+++ b/pkgs/tools/backup/zfs-replicate/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonApplication rec {
   pname = "zfs_replicate";
-  version = "3.2.10";
+  version = "3.2.11";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LEBCdrJZLddJm2nz2JLfwskU8roN/MZlr79exFEWnRI=";
+    hash = "sha256-8u65Ht7s2RqBYetKf/3erb6B2+/iZgnqHBogYa4J/rs=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/filesystems/envfs/default.nix b/pkgs/tools/filesystems/envfs/default.nix
index e91df03f7da1e..c5de89fdfffd6 100644
--- a/pkgs/tools/filesystems/envfs/default.nix
+++ b/pkgs/tools/filesystems/envfs/default.nix
@@ -1,14 +1,14 @@
 { rustPlatform, lib, fetchFromGitHub, nixosTests }:
 rustPlatform.buildRustPackage rec {
   pname = "envfs";
-  version = "1.0.3";
+  version = "1.0.6";
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "envfs";
     rev = version;
-    hash = "sha256-WbMqh/MzEMfZmKl/DNBGnzG3l8unFmAYbG6feSiMz+Y=";
+    hash = "sha256-kOfnKguvJQHW/AfQOetxVefjoEj7ec5ew6fumhOwP08=";
   };
-  cargoHash = "sha256-RoreNBZvTsVY87nbVibJBy4gsafFwAMctVncAhhiaP8=";
+  cargoHash = "sha256-isx4jBsA3HX6124R3qtwTqH5fLTAP7xdQD5bTzCAybo=";
 
   passthru.tests = {
     envfs = nixosTests.envfs;
diff --git a/pkgs/tools/misc/cf-terraforming/default.nix b/pkgs/tools/misc/cf-terraforming/default.nix
index d272309061571..5ec67c40f1d83 100644
--- a/pkgs/tools/misc/cf-terraforming/default.nix
+++ b/pkgs/tools/misc/cf-terraforming/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cf-terraforming";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cf-terraforming";
     rev = "v${version}";
-    sha256 = "sha256-U6xYJWVf1O/DLtC6J3b+DL97QYUW6ObRh/9EKXhi/j4=";
+    sha256 = "sha256-eGfPk3qptNf6QfVKDT4MwJav7z+ri+eEiB7KHGRxzOE=";
   };
 
-  vendorHash = "sha256-r5qlnY3gIigjbFUj9ZVY9WTQM4aYNlTv3HHpc2r/+Rw=";
+  vendorHash = "sha256-cWFCEC20D2nhVeW7P/w5YSt1tQbWTPDWF/eaxEvWoLo=";
   ldflags = [ "-X github.com/cloudflare/cf-terraforming/internal/app/cf-terraforming/cmd.versionString=${version}" ];
 
   # The test suite insists on downloading a binary release of Terraform from
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 7e65fe68dfd5f..774fe78ec6056 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -4,6 +4,8 @@
 , rustPlatform
 , darwin
 , pandoc
+, pkg-config
+, openssl
 , installShellFiles
 , copyDesktopItems
 , makeDesktopItem
@@ -16,19 +18,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "1.4.3";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = "fend";
     rev = "v${version}";
-    hash = "sha256-X96r5wN5eq1PZD/JGqnG/0kg6PYEdnj5h9zc+GXQjQM=";
+    hash = "sha256-l4AZpvLMmNuUWHqm5b0ngBxSHh5CV0SMOyKSF4LaxSI=";
   };
 
-  cargoHash = "sha256-UIZs45OQ1j57VEb6g4P0AwjmEsjMt0am5FUXXDODaWI=";
+  cargoHash = "sha256-mx0KXGbSxn54JUyLVJms/AdPseKA9QH1Ixi7XKydf2w=";
 
-  nativeBuildInputs = [ pandoc installShellFiles copyDesktopItems ];
-  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  nativeBuildInputs = [ pandoc installShellFiles pkg-config copyDesktopItems ];
+  buildInputs = [ pkg-config openssl ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
   postBuild = ''
     patchShebangs --build ./documentation/build.sh
@@ -82,7 +84,7 @@ rustPlatform.buildRustPackage rec {
     description = "Arbitrary-precision unit-aware calculator";
     homepage = "https://github.com/printfn/fend";
     changelog = "https://github.com/printfn/fend/releases/tag/v${version}";
-    license = licenses.gpl3Plus;
+    license = licenses.mit;
     maintainers = with maintainers; [ djanatyn liff ];
     mainProgram = "fend";
   };
diff --git a/pkgs/tools/misc/hdfview/default.nix b/pkgs/tools/misc/hdfview/default.nix
index 23995e65859a5..b559a494d456f 100644
--- a/pkgs/tools/misc/hdfview/default.nix
+++ b/pkgs/tools/misc/hdfview/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ant, jdk, hdf4, hdf5, makeDesktopItem, copyDesktopItems }:
+{ lib, stdenv, fetchurl, ant, jdk, hdf4, hdf5, makeDesktopItem, copyDesktopItems, strip-nondeterminism, stripJavaArchivesHook }:
 
 stdenv.mkDerivation rec {
   pname = "hdfview";
@@ -14,12 +14,16 @@ stdenv.mkDerivation rec {
     ./0001-Hardcode-isUbuntu-false-to-avoid-hostname-dependency.patch
     # Disable signing on macOS
     ./disable-mac-signing.patch
+    # Remove timestamp comment from generated versions.properties file
+    ./remove-properties-timestamp.patch
   ];
 
   nativeBuildInputs = [
     ant
     jdk
     copyDesktopItems
+    strip-nondeterminism
+    stripJavaArchivesHook
   ];
 
   HDFLIBS = (hdf4.override { javaSupport = true; }).out;
@@ -64,6 +68,11 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  preFixup = ''
+    # Remove build timestamp from javadoc files
+    find $out/lib/app{,/mods}/doc/javadocs -name "*.html" -exec strip-nondeterminism --type javadoc {} +
+  '';
+
   meta = {
     description = "A visual tool for browsing and editing HDF4 and HDF5 files";
     license = lib.licenses.free; # BSD-like
diff --git a/pkgs/tools/misc/hdfview/remove-properties-timestamp.patch b/pkgs/tools/misc/hdfview/remove-properties-timestamp.patch
new file mode 100644
index 0000000000000..8e3790487f2d0
--- /dev/null
+++ b/pkgs/tools/misc/hdfview/remove-properties-timestamp.patch
@@ -0,0 +1,14 @@
+diff --git a/build.xml b/build.xml
+index fcc4931..2afeb6c 100644
+--- a/build.xml
++++ b/build.xml
+@@ -345,6 +345,9 @@
+             <entry key="HDF5_VERSION" value="${hdf5.version}"/>
+             <entry key="HDFVIEW_VERSION" value="${app.version}"/>
+         </propertyfile>
++        <exec executable="sed" failonerror="true">
++            <arg line="-i /#/d ${classes.dir}/hdf/versions.properties" />
++        </exec>
+     </target>
+ 
+     <target name="compile" depends="clean, create-property-file, compileobj, compilehdf4, compilefits, compilenc2, compilehdf5">
diff --git a/pkgs/tools/misc/tmux-sessionizer/default.nix b/pkgs/tools/misc/tmux-sessionizer/default.nix
index 11dedf8e599d7..207962a82e358 100644
--- a/pkgs/tools/misc/tmux-sessionizer/default.nix
+++ b/pkgs/tools/misc/tmux-sessionizer/default.nix
@@ -7,28 +7,29 @@
 , Security
 , testers
 , tmux-sessionizer
-}: let
+}:
+let
 
   name = "tmux-sessionizer";
-  # v0.4.1 is not released yet, but v0.4.0 has version discrepancy between Cargo.toml and Cargo.lock and does not build
-  version = "0.4.0-unstable-2024-02-06";
+  version = "0.4.2";
 
-in rustPlatform.buildRustPackage {
+in
+rustPlatform.buildRustPackage {
   pname = name;
   inherit version;
 
   src = fetchFromGitHub {
     owner = "jrmoulton";
     repo = name;
-    rev = "79ab43a4087aa7e4e865cab6a181dfd24c6e7a90";
-    hash = "sha256-gzbCeNZML2ygIy/H3uT9apahqI+4hmrTwgXvcZq4Xog=";
+    rev = "v${version}";
+    hash = "sha256-n6DXqsq3TsNob/fEqeOwNTVLPAvCr7CDN9qtXAiOMWQ=";
   };
 
-  cargoHash = "sha256-Zvr2OH2pKtX60EApUSWhBV4cACMLl750UOiS3nN3J3Q=";
+  cargoHash = "sha256-e2U6x7HFoFbZxtJvY/ZpgEWagIrdRxPVZw2rP5aDIqg=";
 
   passthru.tests.version = testers.testVersion {
     package = tmux-sessionizer;
-    version = "0.4.1";
+    version = version;
   };
 
   # Needed to get openssl-sys to use pkg-config.
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 15bf69ad6efe4..804def68c25fc 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.65.2";
+  version = "0.66.0";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "dnsproxy";
     rev = "v${version}";
-    hash = "sha256-+82dYFk5mN1p17++2Yg3GCLe8Ud4KbZIGgdfaTepEBw=";
+    hash = "sha256-6cTqAKhPtSNlUHe/DqzrxjjxwfRc4Zn79h5CBLgqchA=";
   };
 
-  vendorHash = "sha256-kBf32hXZ5fpu2ME30t5FmYwGMnD6Jp6owGnjUL9CViY=";
+  vendorHash = "sha256-98fwlPbOuCUBHR1xsp5Ff6AO89zYVTUYbhYOfQ/+AZU=";
 
   ldflags = [ "-s" "-w" "-X" "github.com/AdguardTeam/dnsproxy/internal/version.version=${version}" ];
 
diff --git a/pkgs/tools/networking/nexttrace/default.nix b/pkgs/tools/networking/nexttrace/default.nix
index 2ad7764b1452a..f492f5a803d1f 100644
--- a/pkgs/tools/networking/nexttrace/default.nix
+++ b/pkgs/tools/networking/nexttrace/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "nexttrace";
-  version = "1.2.8";
+  version = "1.2.9";
 
   src = fetchFromGitHub {
     owner = "nxtrace";
     repo = "NTrace-core";
     rev = "v${version}";
-    sha256 = "sha256-fd6d9wtapztPZpbRn73q35D6LfHpfjF4KRBgokWIWYc=";
+    sha256 = "sha256-cnFFlEgq3zYIvVAe7ocw4oiqZQHINvrquBfylm2+dCw=";
   };
-  vendorHash = "sha256-xGE2iUCWMNfiI18N8dyubuhhaY5JD/sy1uRSDyTSqVA=";
+  vendorHash = "sha256-eNRJxz/rbqf1mVRvE83JXUR3/F7XmBhfsOvxaSgDRjc=";
 
   doCheck = false; # Tests require a network connection.
 
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 091bec29da080..2a725496e81c2 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -21,11 +21,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openvpn";
-  version = "2.6.9";
+  version = "2.6.10";
 
   src = fetchurl {
     url = "https://swupdate.openvpn.net/community/releases/openvpn-${finalAttrs.version}.tar.gz";
-    hash = "sha256-4I0UfhW0UI380dZhih8h8UlfmBeo2twe3fBTL6EW1+M=";
+    hash = "sha256-GZO7t7nttDBibqokVz+IH9PfZC9Cf8uCSxrtH8obzJs=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/networking/sing-box/default.nix b/pkgs/tools/networking/sing-box/default.nix
index d7e456f3effff..8552476e7df22 100644
--- a/pkgs/tools/networking/sing-box/default.nix
+++ b/pkgs/tools/networking/sing-box/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "sing-box";
-  version = "1.8.9";
+  version = "1.8.10";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8t+AOTlX34BIftRTZgHwUW3nCPxy8NtbIIocT9YlLbU=";
+    hash = "sha256-HKiTFDNzu42JNra7g+AyTxJ3RuHpvK7ONmKgk2nItT4=";
   };
 
-  vendorHash = "sha256-7FHosBMB5pzsvpHXhWEo8fgD4Rn6+CFoBNFHA+V1e6o=";
+  vendorHash = "sha256-px90sebov5BbInJtRCGS30fyK3TThNN4XTMtdJhm0Uc=";
 
   tags = [
     "with_quic"
diff --git a/pkgs/tools/networking/tun2socks/default.nix b/pkgs/tools/networking/tun2socks/default.nix
index dc7cdd243fec5..a26c2e3f93774 100644
--- a/pkgs/tools/networking/tun2socks/default.nix
+++ b/pkgs/tools/networking/tun2socks/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "tun2socks";
-  version = "2.5.2";
+  version = "2.5.2-unstable-2024-02-28";
 
   src = fetchFromGitHub {
     owner = "xjasonlyu";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-siAengVJXusQ5o9cTaADeRn5eW4IoCHkMMf6Bx8iWws=";
+    rev = "8c7c9085c21d8be8d18bf79ff547e1f2225842a9";
+    hash = "sha256-LdiCVp6w5yGbFnbArUcjPIwbqFk3zgbbZO1rQNW4w0M=";
   };
 
-  vendorHash = "sha256-zeiOcn33PnyoseYb0wynkn7MfGp3rHEYBStY98C6aR8=";
+  vendorHash = "sha256-7x3vVRFFxWhwwelPJ2EV78UTSXIo6bMj3ljVIPTPteg=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/tools/package-management/nixpkgs-review/default.nix b/pkgs/tools/package-management/nixpkgs-review/default.nix
index 5e57c69642384..3c3956bb94cc1 100644
--- a/pkgs/tools/package-management/nixpkgs-review/default.nix
+++ b/pkgs/tools/package-management/nixpkgs-review/default.nix
@@ -16,14 +16,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "nixpkgs-review";
-  version = "2.10.3";
+  version = "2.10.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nixpkgs-review";
     rev = version;
-    hash = "sha256-iO+B/4UsMi+vf85oyLwZTigZ+mmt7Sk3qGba20/0XBs=";
+    hash = "sha256-+4T6Mm4YfH0wWlkNYS03H9Z9oNlYQnVUncvWGA0CKIQ=";
   };
 
   nativeBuildInputs = [
@@ -53,9 +53,9 @@ python3.pkgs.buildPythonApplication rec {
   postInstall = lib.optionalString withAutocomplete ''
     for cmd in nix-review nixpkgs-review; do
       installShellCompletion --cmd $cmd \
-        --bash <(register-python-argcomplete $out/bin/$cmd) \
-        --fish <(register-python-argcomplete $out/bin/$cmd -s fish) \
-        --zsh <(register-python-argcomplete $out/bin/$cmd -s zsh)
+        --bash <(register-python-argcomplete $cmd) \
+        --fish <(register-python-argcomplete $cmd -s fish) \
+        --zsh <(register-python-argcomplete $cmd -s zsh)
     done
   '';
 
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index 36f1245de43ed..5a330c7126fab 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -16,6 +16,7 @@
 , openssl
 , p11-kit
 , pcsclite
+, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -36,7 +37,7 @@ stdenv.mkDerivation rec {
   '';
 
 
-  nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config makeWrapper ];
+  nativeBuildInputs = [ wrapGAppsHook autoreconfHook autoconf-archive pkg-config makeWrapper ];
   buildInputs = [ curl gtk3 libassuan libbsd libproxy libxml2 openssl p11-kit pcsclite ];
 
   preConfigure = ''
diff --git a/pkgs/tools/security/swtpm/default.nix b/pkgs/tools/security/swtpm/default.nix
index 8c4785dee62b2..b39c43a8e1b69 100644
--- a/pkgs/tools/security/swtpm/default.nix
+++ b/pkgs/tools/security/swtpm/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "swtpm";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "stefanberger";
     repo = "swtpm";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-QKR5S7FlMFDw4+VpyRdqixMWyzLpQkf3QCUceQvsliU=";
+    hash = "sha256-48/BOzGPoKr/BGEXFo3FXWr6ZoPB+ixZIvv78g6L294=";
   };
 
   nativeBuildInputs = [
@@ -101,5 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd3;
     maintainers = [ maintainers.baloo ];
     mainProgram = "swtpm";
+    platforms = platforms.all;
   };
 })
diff --git a/pkgs/tools/security/tracee/default.nix b/pkgs/tools/security/tracee/default.nix
index c1615c1ddf563..315ec08116afe 100644
--- a/pkgs/tools/security/tracee/default.nix
+++ b/pkgs/tools/security/tracee/default.nix
@@ -12,22 +12,28 @@
 , nixosTests
 , testers
 , tracee
+, makeWrapper
 }:
 
 buildGoModule rec {
   pname = "tracee";
-  version = "0.13.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-YO5u/hE5enoqh8niV4Zi+NFUsU+UXCCxdqvxolZImGk=";
+    # project has branches and tags of the same name
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OnOayDxisvDd802kDKGctaQc5LyoyFfdfvC+2JpRjHY=";
   };
-  vendorHash = "sha256-swMvJe+Dz/kwPIStPlQ7d6U/UwXSMcJ3eONxjzebXCc=";
+  vendorHash = "sha256-26sAKTJQ7Rf5KRlu7j5XiZVr6CkAC6fm60Pam7KH0uA=";
 
   patches = [
     ./use-our-libbpf.patch
+    # can not vendor dependencies with old pyroscope
+    # remove once https://github.com/aquasecurity/tracee/pull/3927
+    # makes it to a release
+    ./update-pyroscope.patch
   ];
 
   enableParallelBuilding = true;
@@ -47,7 +53,7 @@ buildGoModule rec {
   buildPhase = ''
     runHook preBuild
     mkdir -p ./dist
-    make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES} bpf-core all
+    make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES} bpf all
     runHook postBuild
   '';
 
@@ -63,29 +69,20 @@ buildGoModule rec {
 
     mkdir -p $out/bin $lib/lib/tracee $share/share/tracee
 
-    mv ./dist/tracee $out/bin/
-    mv ./dist/tracee.bpf.core.o $lib/lib/tracee/
+    mv ./dist/{tracee,signatures} $out/bin/
+    mv ./dist/tracee.bpf.o $lib/lib/tracee/
     mv ./cmd/tracee-rules/templates $share/share/tracee/
 
     runHook postInstall
   '';
 
-  doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/bin/tracee --help
-    $out/bin/tracee --version | grep "v${version}"
-
-    runHook postInstallCheck
-  '';
-
   passthru.tests = {
     integration = nixosTests.tracee;
+    integration-test-cli = import ./integration-tests.nix { inherit lib tracee makeWrapper; };
     version = testers.testVersion {
       package = tracee;
       version = "v${version}";
-      command = "tracee --version";
+      command = "tracee version";
     };
   };
 
diff --git a/pkgs/tools/security/tracee/integration-tests.nix b/pkgs/tools/security/tracee/integration-tests.nix
new file mode 100644
index 0000000000000..fd3feb69f5648
--- /dev/null
+++ b/pkgs/tools/security/tracee/integration-tests.nix
@@ -0,0 +1,42 @@
+{ lib, tracee, makeWrapper }:
+tracee.overrideAttrs (oa: {
+  pname = oa.pname + "-integration";
+  postPatch = oa.postPatch or "" + ''
+    # fix the test to look at nixos paths for running programs
+      # --replace-fail '"integration.tes"' '"tracee-integrat"' \
+    substituteInPlace tests/integration/event_filters_test.go \
+      --replace-fail "exec=/usr/bin/dockerd" "comm=dockerd" \
+      --replace-fail "exec=/usr/bin" "exec=/tmp/testdir" \
+      --replace-fail "/usr/bin/tee" "tee" \
+      --replace-fail "/usr/bin" "/run/current-system/sw/bin" \
+      --replace-fail 'syscallerAbsPath := filepath.Join("..", "..", "dist", "syscaller")' "syscallerAbsPath := filepath.Join(\"$out/bin/syscaller\")"
+    substituteInPlace tests/integration/exec_test.go \
+      --replace-fail "/usr/bin" "/run/current-system/sw/bin"
+  '';
+  nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ makeWrapper ];
+  buildPhase = ''
+    runHook preBuild
+    # copy existing built object to dist
+    mkdir -p dist/btfhub
+    touch dist/btfhub/.placeholder
+    cp ${lib.getOutput "lib" tracee}/lib/tracee/tracee.bpf.o ./dist/
+
+    # then compile the tests to be ran later
+    mkdir -p $GOPATH/tracee-integration
+    CGO_LDFLAGS="$(pkg-config --libs libbpf)" go build -o $GOPATH/tracee-integration/syscaller ./tests/integration/syscaller/cmd
+    CGO_LDFLAGS="$(pkg-config --libs libbpf)" go test -tags core,ebpf,integration -c -o $GOPATH/tracee-integration/ ./tests/integration/...
+    runHook postBuild
+  '';
+  doCheck = false;
+  installPhase = ''
+    mkdir -p $out/bin
+    mv $GOPATH/tracee-integration/{integration.test,syscaller} $out/bin/
+    # cp -r ${tracee}/bin/signatures $out/bin/
+  '';
+  doInstallCheck = false;
+
+  outputs = [ "out" ];
+  meta = oa.meta // {
+    outputsToInstall = [ "out" ];
+  };
+})
diff --git a/pkgs/tools/security/tracee/update-pyroscope.patch b/pkgs/tools/security/tracee/update-pyroscope.patch
new file mode 100644
index 0000000000000..17f27e6b88dda
--- /dev/null
+++ b/pkgs/tools/security/tracee/update-pyroscope.patch
@@ -0,0 +1,229 @@
+diff --git a/go.mod b/go.mod
+index 8288d7d0a..0ac753fa1 100644
+--- a/go.mod
++++ b/go.mod
+@@ -16,6 +16,7 @@ require (
+ 	github.com/docker/docker v24.0.7+incompatible
+ 	github.com/golang/protobuf v1.5.3
+ 	github.com/google/gopacket v1.1.19
++	github.com/grafana/pyroscope-go v1.1.1
+ 	github.com/hashicorp/golang-lru v0.5.4
+ 	github.com/hashicorp/golang-lru/v2 v2.0.2
+ 	github.com/mennanov/fmutils v0.2.0
+@@ -23,7 +24,6 @@ require (
+ 	github.com/mitchellh/mapstructure v1.5.0
+ 	github.com/open-policy-agent/opa v0.52.0
+ 	github.com/prometheus/client_golang v1.16.0
+-	github.com/pyroscope-io/pyroscope v0.37.2
+ 	github.com/sashabaranov/go-gpt3 v1.4.0
+ 	github.com/spf13/cobra v1.7.0
+ 	github.com/spf13/viper v1.15.0
+@@ -57,15 +57,14 @@ require (
+ 	github.com/go-logr/logr v1.2.4 // indirect
+ 	github.com/go-logr/stdr v1.2.2 // indirect
+ 	github.com/go-logr/zapr v1.2.4 // indirect
+-	github.com/go-ole/go-ole v1.2.6 // indirect
+ 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+ 	github.com/go-openapi/jsonreference v0.20.2 // indirect
+ 	github.com/go-openapi/swag v0.22.3 // indirect
+ 	github.com/google/gnostic-models v0.6.8 // indirect
+ 	github.com/google/gofuzz v1.2.0 // indirect
++	github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 // indirect
+ 	github.com/gorilla/websocket v1.5.0 // indirect
+-	github.com/hashicorp/errwrap v1.1.0 // indirect
+-	github.com/hashicorp/go-multierror v1.1.1 // indirect
++	github.com/grafana/pyroscope-go/godeltaprof v0.1.6 // indirect
+ 	github.com/hashicorp/hcl v1.0.0 // indirect
+ 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+ 	github.com/josharian/intern v1.0.0 // indirect
+@@ -73,24 +72,18 @@ require (
+ 	github.com/magiconair/properties v1.8.7 // indirect
+ 	github.com/mailru/easyjson v0.7.7 // indirect
+ 	github.com/mattn/go-runewidth v0.0.10 // indirect
+-	github.com/mitchellh/go-ps v1.0.0 // indirect
+ 	github.com/moby/sys/sequential v0.5.0 // indirect
+ 	github.com/moby/term v0.5.0 // indirect
++	github.com/morikuni/aec v1.0.0 // indirect
+ 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+ 	github.com/pelletier/go-toml/v2 v2.0.7 // indirect
+ 	github.com/philhofer/fwd v1.1.2 // indirect
+-	github.com/pyroscope-io/dotnetdiag v1.2.1 // indirect
+ 	github.com/rivo/uniseg v0.2.0 // indirect
+-	github.com/shirou/gopsutil v3.21.11+incompatible // indirect
+ 	github.com/spf13/afero v1.9.5 // indirect
+ 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+ 	github.com/spf13/pflag v1.0.5 // indirect
+ 	github.com/subosito/gotenv v1.4.2 // indirect
+ 	github.com/tinylib/msgp v1.1.8 // indirect
+-	github.com/tklauser/go-sysconf v0.3.11 // indirect
+-	github.com/tklauser/numcpus v0.6.0 // indirect
+-	github.com/valyala/bytebufferpool v1.0.0 // indirect
+-	github.com/yusufpapurcu/wmi v1.2.2 // indirect
+ 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 // indirect
+ 	go.opentelemetry.io/otel v1.19.0 // indirect
+ 	go.opentelemetry.io/otel/metric v1.19.0 // indirect
+@@ -145,7 +138,7 @@ require (
+ 	github.com/huandu/xstrings v1.4.0 // indirect
+ 	github.com/imdario/mergo v0.3.15 // indirect
+ 	github.com/json-iterator/go v1.1.12 // indirect
+-	github.com/klauspost/compress v1.16.5 // indirect
++	github.com/klauspost/compress v1.17.3 // indirect
+ 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+ 	github.com/mitchellh/copystructure v1.2.0 // indirect
+ 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+diff --git a/go.sum b/go.sum
+index 2ecdafafc..598416eeb 100644
+--- a/go.sum
++++ b/go.sum
+@@ -53,7 +53,6 @@ github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0
+ github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+ github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
+ github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
+-github.com/Microsoft/go-winio v0.5.0/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+ github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+ github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+ github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
+@@ -144,8 +143,6 @@ github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCv
+ github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+ github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
+ github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
+-github.com/felixge/fgprof v0.9.1 h1:E6FUJ2Mlv043ipLOCFqo8+cHo9MhQ203E2cdEK/isEs=
+-github.com/felixge/fgprof v0.9.1/go.mod h1:7/HK6JFtFaARhIljgP2IV8rJLIoHDoOYoUphsnGvqxE=
+ github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
+ github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+ github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
+@@ -169,8 +166,6 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+ github.com/go-logr/zapr v1.2.4 h1:QHVo+6stLbfJmYGkQ7uGHUCu5hnAFAj6mDe6Ea0SeOo=
+ github.com/go-logr/zapr v1.2.4/go.mod h1:FyHWQIzQORZ0QVE1BtVHv3cKtNLuXsbNLtpuhNapBOA=
+-github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+ github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
+ github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+ github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+@@ -266,11 +261,10 @@ github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5m
+ github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+ github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
+ github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+-github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+-github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
++github.com/grafana/pyroscope-go v1.1.1 h1:PQoUU9oWtO3ve/fgIiklYuGilvsm8qaGhlY4Vw6MAcQ=
++github.com/grafana/pyroscope-go v1.1.1/go.mod h1:Mw26jU7jsL/KStNSGGuuVYdUq7Qghem5P8aXYXSXG88=
++github.com/grafana/pyroscope-go/godeltaprof v0.1.6 h1:nEdZ8louGAplSvIJi1HVp7kWvFvdiiYg3COLlTwJiFo=
++github.com/grafana/pyroscope-go/godeltaprof v0.1.6/go.mod h1:Tk376Nbldo4Cha9RgiU7ik8WKFkNpfds98aUzS8omLE=
+ github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+ github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
+@@ -300,8 +294,8 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
+ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+-github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
+-github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
++github.com/klauspost/compress v1.17.3 h1:qkRjuerhUU1EmXLYGkSH6EZL+vPSxIrYjLNAK4slzwA=
++github.com/klauspost/compress v1.17.3/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+ github.com/klauspost/cpuid/v2 v2.2.3 h1:sxCkb+qR91z4vsqw4vGGZlDgPz3G7gjaLyK3V8y70BU=
+ github.com/klauspost/cpuid/v2 v2.2.3/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
+ github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+@@ -331,8 +325,6 @@ github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5
+ github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
+ github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+ github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+-github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
+-github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
+ github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+ github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+ github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+@@ -397,10 +389,6 @@ github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO
+ github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+ github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
+ github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
+-github.com/pyroscope-io/dotnetdiag v1.2.1 h1:3XEMrfFJnZ87BiEhozyQKmCUAuMd/Spq7KChPuD2Cf0=
+-github.com/pyroscope-io/dotnetdiag v1.2.1/go.mod h1:eFUEHCp4eD1TgcXMlJihC+R4MrqGf7nTRdWxNADbDHA=
+-github.com/pyroscope-io/pyroscope v0.37.2 h1:MOgLU/oO7VfV6jWqb0xoFH/YPSVbWD5pGsX+tZVGh98=
+-github.com/pyroscope-io/pyroscope v0.37.2/go.mod h1:r4wq4ajJvN7g1OeXGyNvmwzBfQ+Tm5alYvmxqEQSTsc=
+ github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
+ github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+ github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+@@ -414,13 +402,10 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
+ github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+ github.com/sashabaranov/go-gpt3 v1.4.0 h1:UqHYdXgJNtNvTtbzDnnQgkQ9TgTnHtCXx966uFTYXvU=
+ github.com/sashabaranov/go-gpt3 v1.4.0/go.mod h1:BIZdbwdzxZbCrcKGMGH6u2eyGe1xFuX9Anmh3tCP8lQ=
+-github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI=
+-github.com/shirou/gopsutil v3.21.11+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
+ github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+ github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
+ github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+ github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+-github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+ github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+ github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+@@ -456,14 +441,8 @@ github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BG
+ github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
+ github.com/tinylib/msgp v1.1.8 h1:FCXC1xanKO4I8plpHGH2P7koL/RzZs12l/+r7vakfm0=
+ github.com/tinylib/msgp v1.1.8/go.mod h1:qkpG+2ldGg4xRFmx+jfTvZPxfGFhi64BcnL9vkCm/Tw=
+-github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM=
+-github.com/tklauser/go-sysconf v0.3.11/go.mod h1:GqXfhXY3kiPa0nAXPDIQIWzJbMCB7AmcWpGR8lSZfqI=
+-github.com/tklauser/numcpus v0.6.0 h1:kebhY2Qt+3U6RNK7UqpYNA+tJ23IBEGKkB7JQBfDYms=
+-github.com/tklauser/numcpus v0.6.0/go.mod h1:FEZLMke0lhOUG6w2JadTzp0a+Nl8PF/GFkQ5UVIcaL4=
+ github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
+ github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
+-github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
+-github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
+ github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+ github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+@@ -476,8 +455,6 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
+ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+-github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
+-github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+ go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+ go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
+ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+@@ -629,7 +606,6 @@ golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7w
+ golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+diff --git a/pkg/server/http/server.go b/pkg/server/http/server.go
+index 898344591..85ccc68ed 100644
+--- a/pkg/server/http/server.go
++++ b/pkg/server/http/server.go
+@@ -7,7 +7,7 @@ import (
+ 	"net/http/pprof"
+ 
+ 	"github.com/prometheus/client_golang/prometheus/promhttp"
+-	"github.com/pyroscope-io/pyroscope/pkg/agent/profiler"
++	"github.com/grafana/pyroscope-go"
+ 
+ 	"github.com/aquasecurity/tracee/pkg/logger"
+ )
+@@ -17,7 +17,7 @@ type Server struct {
+ 	hs             *http.Server
+ 	mux            *http.ServeMux // just an exposed copy of hs.Handler
+ 	metricsEnabled bool
+-	pyroProfiler   *profiler.Profiler
++	pyroProfiler   *pyroscope.Profiler
+ }
+ 
+ // New creates a new server
+@@ -90,8 +90,8 @@ func (s *Server) EnablePProfEndpoint() {
+ // EnablePyroAgent enables pyroscope agent in golang push mode
+ // TODO: make this configurable
+ func (s *Server) EnablePyroAgent() error {
+-	p, err := profiler.Start(
+-		profiler.Config{
++	p, err := pyroscope.Start(
++		pyroscope.Config{
+ 			ApplicationName: "tracee",
+ 			ServerAddress:   "http://localhost:4040",
+ 		},
diff --git a/pkgs/tools/security/tracee/use-our-libbpf.patch b/pkgs/tools/security/tracee/use-our-libbpf.patch
index 00d91ca6e3b38..4f6dc5957a773 100644
--- a/pkgs/tools/security/tracee/use-our-libbpf.patch
+++ b/pkgs/tools/security/tracee/use-our-libbpf.patch
@@ -1,8 +1,8 @@
 diff --git a/Makefile b/Makefile
-index d7596a1a..dd7b97b6 100644
+index 29be1ae71..b88f31cba 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -50,6 +50,7 @@ CMD_STATICCHECK ?= staticcheck
+@@ -54,6 +54,7 @@ CMD_CONTROLLER_GEN ?= controller-gen
  # libs
  #
  
@@ -10,26 +10,26 @@ index d7596a1a..dd7b97b6 100644
  LIB_ELF ?= libelf
  LIB_ZLIB ?= zlib
  
-@@ -279,8 +280,6 @@ OUTPUT_DIR = ./dist
+@@ -299,8 +300,6 @@ OUTPUT_DIR = ./dist
  $(OUTPUT_DIR):
  #
  	@$(CMD_MKDIR) -p $@
--	@$(CMD_MKDIR) -p $@/libbpf
--	@$(CMD_MKDIR) -p $@/libbpf/obj
+-	$(CMD_MKDIR) -p $@/libbpf
+-	$(CMD_MKDIR) -p $@/libbpf/obj
  
  #
  # embedded btfhub
-@@ -418,7 +417,6 @@ TRACEE_EBPF_OBJ_CORE_HEADERS = $(shell find pkg/ebpf/c -name *.h)
- bpf-core: $(OUTPUT_DIR)/tracee.bpf.core.o
+@@ -353,7 +352,6 @@ TRACEE_EBPF_OBJ_HEADERS = $(shell find pkg/ebpf/c -name *.h)
+ bpf: $(OUTPUT_DIR)/tracee.bpf.o
  
- $(OUTPUT_DIR)/tracee.bpf.core.o: \
+ $(OUTPUT_DIR)/tracee.bpf.o: \
 -	$(OUTPUT_DIR)/libbpf/libbpf.a \
  	$(TRACEE_EBPF_OBJ_SRC) \
- 	$(TRACEE_EBPF_OBJ_CORE_HEADERS)
+ 	$(TRACEE_EBPF_OBJ_HEADERS)
  #
-@@ -453,8 +451,8 @@ ifeq ($(STATIC), 1)
-     GO_TAGS_EBPF := $(GO_TAGS_EBPF),netgo
- endif
+@@ -391,8 +389,8 @@ endif
+ TRACEE_SRC_DIRS = ./cmd/ ./pkg/ ./signatures/
+ TRACEE_SRC = $(shell find $(TRACEE_SRC_DIRS) -type f -name '*.go' ! -name '*_test.go')
  
 -CUSTOM_CGO_CFLAGS = "-I$(abspath $(OUTPUT_DIR)/libbpf)"
 -CUSTOM_CGO_LDFLAGS = "$(shell $(call pkg_config, $(LIB_ELF))) $(shell $(call pkg_config, $(LIB_ZLIB))) $(abspath $(OUTPUT_DIR)/libbpf/libbpf.a)"
@@ -38,11 +38,11 @@ index d7596a1a..dd7b97b6 100644
  
  GO_ENV_EBPF =
  GO_ENV_EBPF += GOOS=linux
-@@ -474,6 +472,7 @@ $(OUTPUT_DIR)/tracee-ebpf: \
- 	$(TRACEE_EBPF_SRC) \
- 	./embedded-ebpf.go \
+@@ -437,6 +435,7 @@ $(OUTPUT_DIR)/tracee: \
+ 	$(OUTPUT_DIR)/tracee.bpf.o \
+ 	$(TRACEE_SRC) \
  	| .checkver_$(CMD_GO) \
 +	.checklib_$(LIB_BPF) \
  	.checklib_$(LIB_ELF) \
  	.checklib_$(LIB_ZLIB) \
- 	btfhub
+ 	btfhub \
diff --git a/pkgs/tools/security/trueseeing/default.nix b/pkgs/tools/security/trueseeing/default.nix
index 182f33138b95a..e5d89ab3ac0cc 100644
--- a/pkgs/tools/security/trueseeing/default.nix
+++ b/pkgs/tools/security/trueseeing/default.nix
@@ -5,28 +5,30 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "trueseeing";
-  version = "2.2.1";
+  version = "2.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alterakey";
     repo = "trueseeing";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bgvnzCcxRiJnjcHVbcIA6YfpCOIDTLD5tQae/0Tqk4E=";
+    hash = "sha256-5IHJXlpHZJFKj7rdmRsWA5FXZFJf3usGsLgXx1cYEmU=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
     flit-core
     pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
+    aiohttp
     asn1crypto
     attrs
     importlib-metadata
     jinja2
+    lief
     lxml
     progressbar2
     pypubsub
@@ -44,10 +46,10 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Non-decompiling Android vulnerability scanner";
-    mainProgram = "trueseeing";
     homepage = "https://github.com/alterakey/trueseeing";
     changelog = "https://github.com/alterakey/trueseeing/releases/tag/v${version}";
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "trueseeing";
   };
 }
diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix
index ec93f40e3040c..a4ee5f4309621 100644
--- a/pkgs/tools/security/vaultwarden/default.nix
+++ b/pkgs/tools/security/vaultwarden/default.nix
@@ -20,6 +20,9 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-K0T0uTERjxlI3bGG/Tz6sJ0A08J0ROAhpppdZcdQPB8=";
 
+  # used for "Server Installed" version in admin panel
+  env.VW_VERSION = version;
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = with lib; [ openssl ]
     ++ optionals stdenv.isDarwin [ libiconv Security CoreServices SystemConfiguration ]
diff --git a/pkgs/tools/text/asciigraph/default.nix b/pkgs/tools/text/asciigraph/default.nix
index 518d7ce549c7b..f7e066ea3cd47 100644
--- a/pkgs/tools/text/asciigraph/default.nix
+++ b/pkgs/tools/text/asciigraph/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "asciigraph";
-  version = "0.5.6";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "guptarohit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZmH0+UXPUyO90ZI6YsKiTd6Nf8dgZAgm7Qx8PVUkHAU=";
+    sha256 = "sha256-tImHxTVKFFE5RcHCyJ3dyV6kGp3keZzDRhpHsp+IGB0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index fc6b12fa6b169..d26d4fcc84238 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -3,13 +3,13 @@
 let
   self = stdenv.mkDerivation rec {
     pname = "highlight";
-    version = "4.10";
+    version = "4.11";
 
     src = fetchFromGitLab {
       owner = "saalen";
       repo = "highlight";
       rev = "v${version}";
-      sha256 = "sha256-WBX5WQXGgB7n7htxHxpBNIE1wFCFht6sMy5lkqeieqM=";
+      sha256 = "sha256-8QWcpSYkzw62XFyIqisM2x1AOqzVUPUYgs5bPA4liSw=";
     };
 
     enableParallelBuilding = true;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 10ff3ca04a37f..40fe47de03887 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -237,6 +237,7 @@ mapAliases ({
   docker-machine = throw "'docker-machine' has been removed, because the upstream project was archived"; # Added 2023-12-27
   docker-machine-kvm = throw "'docker-machine-kvm' has been removed, because 'docker-machine' was archived upstream and removed"; # Added 2023-12-27
   docker-machine-xhyve = throw "'docker-machine-xhyve' has been removed, because 'docker-machine' was archived upstream and removed"; # Added 2023-12-27
+  docker-proxy = throw "`docker-proxy` has been merged to the main repo of Moby since Docker 22.06"; # Added 2024-03-14
   dogecoin = throw "'dogecoin' has been removed, as it was broken and unmaintained"; # Added 2024-03-11
   dogecoind = throw "'dogecoind' has been removed, as it was broken and unmaintained"; # Added 2024-03-11
   dolphin-emu-beta = dolphin-emu; # Added 2023-02-11
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e53b8b8c9bf90..00ccbf8ad4ef8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2835,8 +2835,6 @@ with pkgs;
 
   xcpc = callPackage ../applications/emulators/xcpc { };
 
-  xemu = callPackage ../applications/emulators/xemu { };
-
   yapesdl = callPackage ../applications/emulators/yapesdl { };
 
   zsnes = pkgsi686Linux.callPackage ../applications/emulators/zsnes { };
@@ -3338,8 +3336,6 @@ with pkgs;
 
   autospotting = callPackage ../applications/misc/autospotting { };
 
-  autosuspend = callPackage ../os-specific/linux/autosuspend { };
-
   avfs = callPackage ../tools/filesystems/avfs { };
 
   aliyun-cli = callPackage ../tools/admin/aliyun-cli { };
@@ -14957,6 +14953,8 @@ with pkgs;
     boost = boost179;
   };
 
+  xorriso = libisoburn;
+
   xurls = callPackage ../tools/text/xurls { };
 
   xxv = callPackage ../tools/misc/xxv { };
@@ -16254,7 +16252,7 @@ with pkgs;
 
   hugs = callPackage ../development/interpreters/hugs { };
 
-  inherit (javaPackages) openjfx11 openjfx15 openjfx17 openjfx19 openjfx20 openjfx21;
+  inherit (javaPackages) openjfx11 openjfx15 openjfx17 openjfx19 openjfx20 openjfx21 openjfx22;
   openjfx = openjfx17;
 
   openjdk8-bootstrap = javaPackages.compiler.openjdk8-bootstrap;
@@ -16294,6 +16292,11 @@ with pkgs;
   jdk21 = openjdk21;
   jdk21_headless = openjdk21_headless;
 
+  openjdk22 = javaPackages.compiler.openjdk22;
+  openjdk22_headless = javaPackages.compiler.openjdk22.headless;
+  jdk22 = openjdk22;
+  jdk22_headless = openjdk22_headless;
+
   /* default JDK */
   jdk = jdk21;
   jdk_headless = jdk21_headless;
@@ -25882,7 +25885,7 @@ with pkgs;
 
   etcd = etcd_3_5;
   etcd_3_4 = callPackage ../servers/etcd/3.4.nix { };
-  etcd_3_5 = callPackage ../servers/etcd/3.5.nix { };
+  etcd_3_5 = callPackage ../servers/etcd/3.5 { };
 
   ejabberd = callPackage ../servers/xmpp/ejabberd { erlang = erlang_24; };
 
@@ -28577,7 +28580,6 @@ with pkgs;
 
   bgnet = callPackage ../data/documentation/bgnet { };
 
-  bibata-cursors = callPackage ../data/icons/bibata-cursors { attrs = python3Packages.attrs; };
   bibata-extra-cursors = callPackage ../data/icons/bibata-cursors/extra.nix { };
   bibata-cursors-translucent = callPackage ../data/icons/bibata-cursors/translucent.nix { };
 
@@ -30612,8 +30614,6 @@ with pkgs;
   docker = docker_24;
   docker-client = docker.override { clientOnly = true; };
 
-  docker-proxy = callPackage ../applications/virtualization/docker/proxy.nix { };
-
   docker-gc = callPackage ../applications/virtualization/docker/gc.nix { };
   docker-machine-hyperkit = callPackage ../applications/networking/cluster/docker-machine/hyperkit.nix { };
   docker-machine-kvm2 = callPackage ../applications/networking/cluster/docker-machine/kvm2.nix { };
@@ -31667,10 +31667,8 @@ with pkgs;
         pythonPackages = python3Packages;
   };
 
-  graphicsmagick = callPackage ../applications/graphics/graphicsmagick { };
   graphicsmagick_q16 = graphicsmagick.override { quantumdepth = 16; };
-
-  graphicsmagick-imagemagick-compat = callPackage ../applications/graphics/graphicsmagick/compat.nix { };
+  graphicsmagick-imagemagick-compat = graphicsmagick.imagemagick-compat;
 
   grisbi = callPackage ../applications/office/grisbi { gtk = gtk3; };
 
@@ -33425,8 +33423,6 @@ with pkgs;
 
   nixos-shell = callPackage ../tools/virtualization/nixos-shell { };
 
-  nix-ld = callPackage ../os-specific/linux/nix-ld { };
-
   noaa-apt = callPackage ../applications/radio/noaa-apt { };
 
   node-problem-detector = callPackage ../applications/networking/cluster/node-problem-detector { };
@@ -34743,8 +34739,6 @@ with pkgs;
 
   myfitnesspal = with python3Packages; toPythonApplication myfitnesspal;
 
-  insync = callPackage ../applications/networking/insync { };
-
   lemurs = callPackage ../applications/display-managers/lemurs { };
 
   libstrangle = callPackage ../tools/X11/libstrangle {
@@ -41300,6 +41294,8 @@ with pkgs;
 
   treefmt = callPackage ../development/tools/treefmt { };
 
+  nufmt = callPackage ../development/tools/nufmt { };
+
   bottom = darwin.apple_sdk_11_0.callPackage ../tools/system/bottom { };
 
   cagebreak = callPackage ../applications/window-managers/cagebreak {
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index 6cfd785de1f71..1028c2f62bae8 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -9,9 +9,10 @@ let
   openjfx19 = callPackage ../development/compilers/openjdk/openjfx/19.nix { };
   openjfx20 = callPackage ../development/compilers/openjdk/openjfx/20.nix { };
   openjfx21 = callPackage ../development/compilers/openjdk/openjfx/21.nix { };
+  openjfx22 = callPackage ../development/compilers/openjdk/openjfx/22.nix { };
 
 in {
-  inherit openjfx11 openjfx15 openjfx17 openjfx19 openjfx20 openjfx21;
+  inherit openjfx11 openjfx15 openjfx17 openjfx19 openjfx20 openjfx21 openjfx22;
 
   compiler = let
 
@@ -221,6 +222,14 @@ in {
         openjfx = openjfx21;
       };
 
+    openjdk22 = mkOpenjdk
+      ../development/compilers/openjdk/22.nix
+      ../development/compilers/zulu/22.nix
+      {
+        openjdk22-bootstrap = temurin-bin.jdk-21;
+        openjfx = openjfx22;
+      };
+
     temurin-bin = recurseIntoAttrs (callPackage (
       if stdenv.isLinux
       then ../development/compilers/temurin-bin/jdk-linux.nix
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7197a85ef1387..dc44a98191ce2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3755,6 +3755,8 @@ self: super: with self; {
 
   enrich = callPackage ../development/python-modules/enrich { };
 
+  enterpriseattack = callPackage ../development/python-modules/enterpriseattack { };
+
   entrance = callPackage ../development/python-modules/entrance {
     routerFeatures = false;
   };
@@ -5374,6 +5376,8 @@ self: super: with self; {
 
   hsaudiotag3k = callPackage ../development/python-modules/hsaudiotag3k { };
 
+  hsh = callPackage ../development/python-modules/hsh { };
+
   hsluv = callPackage ../development/python-modules/hsluv { };
 
   hstspreload = callPackage ../development/python-modules/hstspreload { };
@@ -8389,6 +8393,8 @@ self: super: with self; {
 
   nagiosplugin = callPackage ../development/python-modules/nagiosplugin { };
 
+  naked = callPackage ../development/python-modules/naked { };
+
   namedlist = callPackage ../development/python-modules/namedlist { };
 
   nameparser = callPackage ../development/python-modules/nameparser { };
@@ -13093,6 +13099,8 @@ self: super: with self; {
 
   robotframework-sshlibrary = callPackage ../development/python-modules/robotframework-sshlibrary { };
 
+  robotframework-tidy = callPackage ../development/python-modules/robotframework-tidy { };
+
   robotframework-tools = callPackage ../development/python-modules/robotframework-tools { };
 
   robotstatuschecker = callPackage ../development/python-modules/robotstatuschecker { };
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index 0cf6ab88c323b..7c861a3300320 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -251,7 +251,9 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   qtstyleplugins = callPackage ../development/libraries/qtstyleplugins { };
 
-  qtstyleplugin-kvantum = callPackage ../development/libraries/qtstyleplugin-kvantum { };
+  qtstyleplugin-kvantum = callPackage ../development/libraries/qtstyleplugin-kvantum {
+    qt6Kvantum = pkgs.qt6Packages.qtstyleplugin-kvantum;
+  };
 
   quazip = callPackage ../development/libraries/quazip { };
 
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index b7e6b00c2a34e..70e4212cfdc52 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -79,9 +79,7 @@ makeScopeWithSplicing' {
 
   qtpbfimageplugin = callPackage ../development/libraries/qtpbfimageplugin { };
 
-  qtstyleplugin-kvantum = callPackage ../development/libraries/qtstyleplugin-kvantum {
-    qt5Kvantum = pkgs.libsForQt5.qtstyleplugin-kvantum;
-  };
+  qtstyleplugin-kvantum = kdePackages.callPackage ../development/libraries/qtstyleplugin-kvantum { };
 
   qtutilities = callPackage ../development/libraries/qtutilities { };