about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
authorVladimír Čunát2024-07-06 09:03:01 +0200
committerVladimír Čunát2024-07-06 09:03:01 +0200
commit91594d11a2248ebe00f45f6b9be63fe264bb74e1 (patch)
tree07151dc0ca7e8437d07115c165b530e42292ee39 /pkgs
parent5041afcd2b075aad48f4336668b129cd318edc8b (diff)
parent25c945df289dbb064a9afc96ac1b665dd08d6b7a (diff)
Merge #322145: staging-next 2024-06-24
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/ledfx/default.nix1
-rw-r--r--pkgs/applications/audio/pd-plugins/gem/default.nix4
-rw-r--r--pkgs/applications/audio/puddletag/default.nix1
-rw-r--r--pkgs/applications/audio/sndpeek/default.nix4
-rw-r--r--pkgs/applications/backup/unifi-protect-backup/default.nix1
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix3
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix3
-rw-r--r--pkgs/applications/editors/emacs/sources.nix6
-rw-r--r--pkgs/applications/editors/neovim/tests/default.nix20
-rw-r--r--pkgs/applications/editors/neovim/utils.nix24
-rw-r--r--pkgs/applications/editors/neovim/wrapper.nix27
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/emulators/wine/base.nix2
-rw-r--r--pkgs/applications/emulators/yabause/default.nix4
-rw-r--r--pkgs/applications/file-managers/browsr/default.nix1
-rw-r--r--pkgs/applications/graphics/ImageMagick/6.x.nix2
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix2
-rw-r--r--pkgs/applications/graphics/fluxus/default.nix12
-rw-r--r--pkgs/applications/graphics/freepv/default.nix4
-rw-r--r--pkgs/applications/graphics/opentoonz/default.nix4
-rw-r--r--pkgs/applications/misc/archivy/default.nix1
-rw-r--r--pkgs/applications/misc/blender/default.nix6
-rw-r--r--pkgs/applications/misc/dbx/default.nix1
-rw-r--r--pkgs/applications/misc/icesl/default.nix4
-rw-r--r--pkgs/applications/misc/lutris/fhsenv.nix2
-rw-r--r--pkgs/applications/misc/mupdf/1.17/default.nix6
-rw-r--r--pkgs/applications/misc/pagefind/default.nix4
-rw-r--r--pkgs/applications/misc/pysentation/default.nix1
-rw-r--r--pkgs/applications/misc/rusty-psn/default.nix1
-rw-r--r--pkgs/applications/misc/shell-genie/default.nix4
-rw-r--r--pkgs/applications/misc/snagboot/default.nix2
-rw-r--r--pkgs/applications/misc/yubioath-flutter/helper.nix2
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix6
-rw-r--r--pkgs/applications/networking/browsers/firefox/packages.nix9
-rw-r--r--pkgs/applications/networking/cluster/tftui/default.nix1
-rw-r--r--pkgs/applications/networking/dyndns/dyndnsc/default.nix1
-rw-r--r--pkgs/applications/networking/errbot/default.nix4
-rw-r--r--pkgs/applications/networking/ids/suricata/default.nix3
-rw-r--r--pkgs/applications/networking/instant-messengers/pantalaimon/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/teamspeak/client5.nix1
-rw-r--r--pkgs/applications/networking/mailreaders/alot/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/packages.nix4
-rw-r--r--pkgs/applications/networking/p2p/pyrosimple/default.nix1
-rw-r--r--pkgs/applications/office/libreoffice/default.nix13
-rw-r--r--pkgs/applications/science/astronomy/celestia/default.nix4
-rw-r--r--pkgs/applications/science/biology/macs2/default.nix15
-rw-r--r--pkgs/applications/science/geometry/antiprism/default.nix4
-rw-r--r--pkgs/applications/science/math/glsurf/default.nix4
-rw-r--r--pkgs/applications/science/math/sage/sagelib.nix2
-rw-r--r--pkgs/applications/science/misc/boinc/default.nix4
-rw-r--r--pkgs/applications/science/misc/foldingathome/viewer.nix4
-rw-r--r--pkgs/applications/terminal-emulators/rio/default.nix6
-rw-r--r--pkgs/applications/terminal-emulators/xterm/default.nix16
-rw-r--r--pkgs/applications/version-management/commitizen/default.nix2
-rw-r--r--pkgs/applications/version-management/git/default.nix4
-rwxr-xr-xpkgs/applications/version-management/git/update.sh2
-rw-r--r--pkgs/applications/version-management/gitless/default.nix1
-rw-r--r--pkgs/applications/version-management/mercurial/default.nix6
-rw-r--r--pkgs/applications/video/animdl/default.nix2
-rw-r--r--pkgs/applications/video/kodi/no-python-lib.patch13
-rw-r--r--pkgs/applications/video/kodi/unwrapped.nix7
-rw-r--r--pkgs/applications/window-managers/herbstluftwm/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/default.nix4
-rw-r--r--pkgs/build-support/appimage/default.nix2
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix1
-rw-r--r--pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh2
-rw-r--r--pkgs/build-support/cc-wrapper/add-hardening.sh6
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix77
-rw-r--r--pkgs/build-support/emacs/melpa.nix24
-rw-r--r--pkgs/build-support/go/module.nix8
-rw-r--r--pkgs/build-support/rust/hooks/maturin-build-hook.sh8
-rw-r--r--pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh5
-rw-r--r--pkgs/build-support/setup-hooks/install-shell-files.sh5
-rw-r--r--pkgs/by-name/ad/ad-miner/package.nix4
-rw-r--r--pkgs/by-name/ai/airlift/package.nix1
-rw-r--r--pkgs/by-name/al/alsa-plugins/package.nix4
-rw-r--r--pkgs/by-name/au/audible-cli/package.nix1
-rw-r--r--pkgs/by-name/au/audiness/package.nix1
-rw-r--r--pkgs/by-name/aw/aws-gate/package.nix1
-rw-r--r--pkgs/by-name/ba/backgroundremover/package.nix2
-rw-r--r--pkgs/by-name/ch/charmcraft/package.nix1
-rw-r--r--pkgs/by-name/ch/chow-kick/package.nix4
-rw-r--r--pkgs/by-name/ch/chow-phaser/package.nix4
-rw-r--r--pkgs/by-name/ch/chow-tape-model/package.nix4
-rw-r--r--pkgs/by-name/cm/cmake/package.nix6
-rw-r--r--pkgs/by-name/co/corrscope/package.nix1
-rw-r--r--pkgs/by-name/co/cosmic-edit/package.nix2
-rw-r--r--pkgs/by-name/co/cosmic-store/package.nix1
-rw-r--r--pkgs/by-name/co/cosmic-term/package.nix1
-rw-r--r--pkgs/by-name/cu/cups-printers/package.nix1
-rw-r--r--pkgs/by-name/do/donpapi/package.nix1
-rw-r--r--pkgs/by-name/do/dooit/package.nix1
-rw-r--r--pkgs/by-name/f2/f2fs-tools/f2fs-tools-cross-fix.patch (renamed from pkgs/tools/filesystems/f2fs-tools/f2fs-tools-cross-fix.patch)0
-rw-r--r--pkgs/by-name/f2/f2fs-tools/package.nix (renamed from pkgs/tools/filesystems/f2fs-tools/default.nix)36
-rw-r--r--pkgs/by-name/fl/flite/package.nix74
-rw-r--r--pkgs/by-name/fl/flye/aarch64-fix.patch15
-rw-r--r--pkgs/by-name/fl/flye/package.nix42
-rw-r--r--pkgs/by-name/fr/fritz-exporter/package.nix4
-rw-r--r--pkgs/by-name/gc/gcp-scanner/package.nix1
-rw-r--r--pkgs/by-name/gh/ghunt/package.nix1
-rw-r--r--pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix1
-rw-r--r--pkgs/by-name/ha/hatch/package.nix35
-rw-r--r--pkgs/by-name/he/hekatomb/package.nix1
-rw-r--r--pkgs/by-name/ho/homeassistant-satellite/package.nix1
-rw-r--r--pkgs/by-name/ic/icloudpd/package.nix4
-rw-r--r--pkgs/by-name/ir/irrd/package.nix1
-rw-r--r--pkgs/by-name/ja/jasper/package.nix18
-rw-r--r--pkgs/by-name/ki/kikit/solidpython/default.nix2
-rw-r--r--pkgs/by-name/ko/koodousfinder/package.nix1
-rw-r--r--pkgs/by-name/kr/krbjack/package.nix1
-rw-r--r--pkgs/by-name/li/libcamera/package.nix7
-rw-r--r--pkgs/by-name/li/linux-wallpaperengine/package.nix4
-rw-r--r--pkgs/by-name/ma/malwoverview/package.nix4
-rw-r--r--pkgs/by-name/me/mealie/package.nix1
-rw-r--r--pkgs/by-name/me/mednafen/package.nix4
-rw-r--r--pkgs/by-name/mo/mokuro/package.nix1
-rw-r--r--pkgs/by-name/mo/mov-cli/package.nix4
-rw-r--r--pkgs/by-name/ng/nginx-language-server/package.nix1
-rw-r--r--pkgs/by-name/no/normcap/package.nix3
-rw-r--r--pkgs/by-name/on/onthespot/package.nix1
-rw-r--r--pkgs/by-name/op/open-webui/package.nix1
-rw-r--r--pkgs/by-name/op/opencomposite/package.nix1
-rw-r--r--pkgs/by-name/op/openctm/package.nix4
-rw-r--r--pkgs/by-name/op/openscad-unstable/package.nix9
-rw-r--r--pkgs/by-name/op/opensplat/package.nix37
-rw-r--r--pkgs/by-name/ot/oterm/package.nix1
-rw-r--r--pkgs/by-name/pa/pacu/package.nix1
-rw-r--r--pkgs/by-name/pi/picocrypt/package.nix22
-rw-r--r--pkgs/by-name/pr/pre2k/package.nix1
-rw-r--r--pkgs/by-name/pr/pretalx/package.nix1
-rw-r--r--pkgs/by-name/pr/prowler/package.nix4
-rw-r--r--pkgs/by-name/py/pysqlrecon/package.nix1
-rw-r--r--pkgs/by-name/ra/rabbit/package.nix1
-rw-r--r--pkgs/by-name/rc/rclip/package.nix2
-rw-r--r--pkgs/by-name/rd/rdwatool/package.nix1
-rw-r--r--pkgs/by-name/re/rerun/package.nix3
-rw-r--r--pkgs/by-name/re/retool/package.nix1
-rw-r--r--pkgs/by-name/ro/route-graph/package.nix4
-rw-r--r--pkgs/by-name/se/selenium-manager/package.nix6
-rw-r--r--pkgs/by-name/sh/shell-gpt/package.nix1
-rw-r--r--pkgs/by-name/sm/smassh/package.nix1
-rw-r--r--pkgs/by-name/sn/snapcraft/package.nix1
-rw-r--r--pkgs/by-name/st/streamdeck-ui/package.nix1
-rw-r--r--pkgs/by-name/st/strictdoc/package.nix1
-rw-r--r--pkgs/by-name/tb/tbump/package.nix1
-rw-r--r--pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix3
-rw-r--r--pkgs/by-name/tr/troubadix/package.nix1
-rw-r--r--pkgs/by-name/tu/tunnelgraf/package.nix1
-rw-r--r--pkgs/by-name/tw/twitch-dl/package.nix1
-rw-r--r--pkgs/by-name/un/unsilence/package.nix1
-rw-r--r--pkgs/by-name/up/upiano/package.nix1
-rw-r--r--pkgs/by-name/uw/uwhoisd/package.nix1
-rw-r--r--pkgs/by-name/vu/vunnel/package.nix1
-rw-r--r--pkgs/by-name/wa/waf/package.nix4
-rw-r--r--pkgs/by-name/wi/witnessme/package.nix4
-rw-r--r--pkgs/by-name/ws/wsrepl/package.nix4
-rw-r--r--pkgs/by-name/wt/wtfis/package.nix4
-rw-r--r--pkgs/by-name/wy/wyoming-satellite/package.nix1
-rw-r--r--pkgs/by-name/xs/xsimd/disable-test_error_gamma.patch (renamed from pkgs/development/libraries/xsimd/disable-test_error_gamma.patch)0
-rw-r--r--pkgs/by-name/xs/xsimd/package.nix (renamed from pkgs/development/libraries/xsimd/default.nix)13
-rw-r--r--pkgs/data/fonts/iwona/default.nix3
-rw-r--r--pkgs/data/icons/hicolor-icon-theme/default.nix38
-rw-r--r--pkgs/data/misc/cacert/default.nix4
-rw-r--r--pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix2
-rw-r--r--pkgs/development/compilers/dtc/default.nix46
-rw-r--r--pkgs/development/compilers/gcc/default.nix5
-rw-r--r--pkgs/development/compilers/gcc/patches/12/lambda-ICE-PR109241.patch77
-rw-r--r--pkgs/development/compilers/gcc/patches/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/versions.nix6
-rw-r--r--pkgs/development/compilers/go/1.22.nix4
-rw-r--r--pkgs/development/compilers/llvm/17/default.nix8
-rw-r--r--pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch8
-rw-r--r--pkgs/development/compilers/llvm/18/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/common/clang/default.nix26
-rw-r--r--pkgs/development/compilers/llvm/common/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/common/libcxx/default.nix10
-rw-r--r--pkgs/development/compilers/llvm/common/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/openjdk/21.nix6
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/21.nix6
-rw-r--r--pkgs/development/compilers/rust/1_78.nix1
-rw-r--r--pkgs/development/compilers/rust/binary.nix5
-rwxr-xr-xpkgs/development/compilers/rust/print-hashes.sh1
-rw-r--r--pkgs/development/compilers/rust/rustc.nix20
-rw-r--r--pkgs/development/compilers/swift/compiler/default.nix3
-rw-r--r--pkgs/development/compilers/swift/wrapper/wrapper.sh2
-rwxr-xr-xpkgs/development/compilers/temurin-bin/generate-sources.py4
-rw-r--r--pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix13
-rw-r--r--pkgs/development/compilers/temurin-bin/jdk-darwin.nix23
-rw-r--r--pkgs/development/compilers/temurin-bin/jdk-linux-base.nix24
-rw-r--r--pkgs/development/compilers/temurin-bin/jdk-linux.nix23
-rw-r--r--pkgs/development/compilers/temurin-bin/sources.json524
-rw-r--r--pkgs/development/compilers/vyper/default.nix2
-rw-r--r--pkgs/development/cuda-modules/cuda/overrides.nix4
-rw-r--r--pkgs/development/cuda-modules/cudatoolkit/default.nix4
-rw-r--r--pkgs/development/embedded/platformio/core.nix4
-rw-r--r--pkgs/development/interpreters/io/default.nix4
-rw-r--r--pkgs/development/interpreters/lua-5/interpreter.nix2
-rw-r--r--pkgs/development/interpreters/lua-5/tests/default.nix13
-rw-r--r--pkgs/development/interpreters/lua-5/utils.sh83
-rw-r--r--pkgs/development/interpreters/lua-5/wrap.sh44
-rw-r--r--pkgs/development/interpreters/lua-5/wrapper.nix2
-rw-r--r--pkgs/development/interpreters/luajit/default.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix3
-rw-r--r--pkgs/development/interpreters/python/default.nix30
-rw-r--r--pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh9
-rw-r--r--pkgs/development/interpreters/python/mk-python-derivation.nix3
-rwxr-xr-xpkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py17
-rw-r--r--pkgs/development/libraries/SDL2/default.nix4
-rw-r--r--pkgs/development/libraries/SDL_compat/default.nix3
-rw-r--r--pkgs/development/libraries/aubio/default.nix4
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix4
-rw-r--r--pkgs/development/libraries/audio/suil/default.nix68
-rw-r--r--pkgs/development/libraries/box2d/default.nix4
-rw-r--r--pkgs/development/libraries/bullet/default.nix4
-rw-r--r--pkgs/development/libraries/bullet/roboschool-fork.nix4
-rw-r--r--pkgs/development/libraries/chipmunk/default.nix4
-rw-r--r--pkgs/development/libraries/enchant/2.x.nix26
-rw-r--r--pkgs/development/libraries/ffmpeg/5.1.4-CVE-2023-49502.patch26
-rw-r--r--pkgs/development/libraries/ffmpeg/default.nix1
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix116
-rw-r--r--pkgs/development/libraries/flite/default.nix51
-rw-r--r--pkgs/development/libraries/fox/default.nix7
-rw-r--r--pkgs/development/libraries/freeglut/default.nix8
-rw-r--r--pkgs/development/libraries/freenect/default.nix4
-rw-r--r--pkgs/development/libraries/fribidi/default.nix4
-rw-r--r--pkgs/development/libraries/ftgl/default.nix4
-rw-r--r--pkgs/development/libraries/gdal/default.nix13
-rw-r--r--pkgs/development/libraries/gl2ps/default.nix4
-rw-r--r--pkgs/development/libraries/gle/default.nix4
-rw-r--r--pkgs/development/libraries/glfw/3.x.nix6
-rw-r--r--pkgs/development/libraries/glib/default.nix28
-rw-r--r--pkgs/development/libraries/glib/gdb_script.patch23
-rw-r--r--pkgs/development/libraries/glib/gmodule-rtld_local.patch13
-rw-r--r--pkgs/development/libraries/glm/default.nix47
-rw-r--r--pkgs/development/libraries/glui/default.nix4
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix1
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/good/souploader-darwin.diff128
-rw-r--r--pkgs/development/libraries/gstreamer/good/souploader.diff13
-rw-r--r--pkgs/development/libraries/hamlib/4.nix6
-rw-r--r--pkgs/development/libraries/hamlib/default.nix6
-rw-r--r--pkgs/development/libraries/icu/default.nix4
-rw-r--r--pkgs/development/libraries/icu/make-icu.nix10
-rw-r--r--pkgs/development/libraries/irrlichtmt/default.nix9
-rw-r--r--pkgs/development/libraries/libass/default.nix4
-rw-r--r--pkgs/development/libraries/libdc1394/default.nix5
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libevent/default.nix4
-rw-r--r--pkgs/development/libraries/libftdi/1.x.nix6
-rw-r--r--pkgs/development/libraries/libhwy/default.nix6
-rw-r--r--pkgs/development/libraries/libimobiledevice-glue/default.nix17
-rw-r--r--pkgs/development/libraries/libimobiledevice/default.nix34
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/liblouis/default.nix7
-rw-r--r--pkgs/development/libraries/libsurvive/default.nix4
-rw-r--r--pkgs/development/libraries/libtiff/default.nix10
-rw-r--r--pkgs/development/libraries/libtorrent-rasterbar/default.nix7
-rw-r--r--pkgs/development/libraries/libtorrent-rasterbar/distutils.patch20
-rw-r--r--pkgs/development/libraries/libunistring/default.nix3
-rw-r--r--pkgs/development/libraries/liburing/default.nix60
-rw-r--r--pkgs/development/libraries/libva/1.nix2
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libvdpau/default.nix3
-rw-r--r--pkgs/development/libraries/libvpx/default.nix13
-rw-r--r--pkgs/development/libraries/libwacom/default.nix9
-rw-r--r--pkgs/development/libraries/libwacom/surface.nix4
-rw-r--r--pkgs/development/libraries/libwebp/default.nix4
-rw-r--r--pkgs/development/libraries/libxkbcommon/default.nix4
-rw-r--r--pkgs/development/libraries/libxslt/default.nix12
-rw-r--r--pkgs/development/libraries/mesa-glu/default.nix7
-rw-r--r--pkgs/development/libraries/mesa/common.nix31
-rw-r--r--pkgs/development/libraries/mesa/darwin.nix53
-rw-r--r--pkgs/development/libraries/mesa/darwin.patch17
-rw-r--r--pkgs/development/libraries/mesa/default.nix337
-rw-r--r--pkgs/development/libraries/mesa/llvmpipe-hook.sh14
-rw-r--r--pkgs/development/libraries/mesa/stubs.nix88
-rw-r--r--pkgs/development/libraries/nettle/default.nix4
-rw-r--r--pkgs/development/libraries/ogre/default.nix4
-rw-r--r--pkgs/development/libraries/opencolorio/default.nix17
-rw-r--r--pkgs/development/libraries/opencsg/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix12
-rw-r--r--pkgs/development/libraries/partio/default.nix4
-rw-r--r--pkgs/development/libraries/pcre2/default.nix16
-rw-r--r--pkgs/development/libraries/physics/geant4/default.nix8
-rw-r--r--pkgs/development/libraries/pipewire/default.nix5
-rw-r--r--pkgs/development/libraries/plib/default.nix4
-rw-r--r--pkgs/development/libraries/py3c/default.nix4
-rw-r--r--pkgs/development/libraries/qpdf/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix8
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json4
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtbase.nix4
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebengine.nix16
-rw-r--r--pkgs/development/libraries/re2/default.nix89
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix6
-rw-r--r--pkgs/development/libraries/rocksdb/fix-findliburing.patch29
-rw-r--r--pkgs/development/libraries/science/biology/bicgl/default.nix6
-rw-r--r--pkgs/development/libraries/science/biology/mirtk/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix4
-rw-r--r--pkgs/development/libraries/simgear/default.nix4
-rw-r--r--pkgs/development/libraries/snappy/default.nix4
-rw-r--r--pkgs/development/libraries/spdlog/default.nix4
-rw-r--r--pkgs/development/libraries/thrift/default.nix7
-rw-r--r--pkgs/development/libraries/wolfssl/default.nix3
-rw-r--r--pkgs/development/libraries/zlib-ng/default.nix4
-rw-r--r--pkgs/development/lisp-modules/ql.nix2
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix10
-rw-r--r--pkgs/development/ocaml-modules/lablgl/Makefile.config.patch67
-rw-r--r--pkgs/development/ocaml-modules/lablgl/default.nix28
-rw-r--r--pkgs/development/python-modules/accelerate/default.nix4
-rw-r--r--pkgs/development/python-modules/accessible-pygments/default.nix17
-rw-r--r--pkgs/development/python-modules/aio-geojson-generic-client/default.nix2
-rw-r--r--pkgs/development/python-modules/aioautomower/default.nix6
-rw-r--r--pkgs/development/python-modules/aioazuredevops/default.nix5
-rw-r--r--pkgs/development/python-modules/aiobiketrax/default.nix2
-rw-r--r--pkgs/development/python-modules/aioboto3/default.nix2
-rw-r--r--pkgs/development/python-modules/aiobotocore/default.nix4
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix8
-rw-r--r--pkgs/development/python-modules/aiogram/default.nix2
-rw-r--r--pkgs/development/python-modules/aiomisc-pytest/default.nix2
-rw-r--r--pkgs/development/python-modules/aioopenexchangerates/default.nix2
-rw-r--r--pkgs/development/python-modules/aiooss2/default.nix2
-rw-r--r--pkgs/development/python-modules/aiooui/default.nix4
-rw-r--r--pkgs/development/python-modules/aiormq/default.nix2
-rw-r--r--pkgs/development/python-modules/aioshelly/default.nix4
-rw-r--r--pkgs/development/python-modules/aiosmtpd/default.nix4
-rw-r--r--pkgs/development/python-modules/aiowebostv/default.nix4
-rw-r--r--pkgs/development/python-modules/aioxmpp/default.nix2
-rw-r--r--pkgs/development/python-modules/aiozoneinfo/default.nix4
-rw-r--r--pkgs/development/python-modules/airtouch5py/default.nix2
-rw-r--r--pkgs/development/python-modules/albumentations/default.nix6
-rw-r--r--pkgs/development/python-modules/alexapy/default.nix2
-rw-r--r--pkgs/development/python-modules/aliyun-python-sdk-core/default.nix2
-rw-r--r--pkgs/development/python-modules/altair/default.nix9
-rw-r--r--pkgs/development/python-modules/amazon-kclpy/default.nix4
-rw-r--r--pkgs/development/python-modules/ancp-bids/default.nix4
-rw-r--r--pkgs/development/python-modules/angr/default.nix2
-rw-r--r--pkgs/development/python-modules/annotated-types/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-navigator/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-pylibssh/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-runner/default.nix38
-rw-r--r--pkgs/development/python-modules/ansible/core.nix3
-rw-r--r--pkgs/development/python-modules/ansible/default.nix4
-rw-r--r--pkgs/development/python-modules/anthropic/default.nix6
-rw-r--r--pkgs/development/python-modules/anyio/default.nix7
-rw-r--r--pkgs/development/python-modules/apache-beam/default.nix6
-rw-r--r--pkgs/development/python-modules/appthreat-vulnerability-db/default.nix12
-rw-r--r--pkgs/development/python-modules/argcomplete/default.nix4
-rw-r--r--pkgs/development/python-modules/argilla/default.nix6
-rw-r--r--pkgs/development/python-modules/arsenic/default.nix2
-rw-r--r--pkgs/development/python-modules/asana/default.nix4
-rw-r--r--pkgs/development/python-modules/ase/default.nix6
-rw-r--r--pkgs/development/python-modules/asf-search/default.nix6
-rw-r--r--pkgs/development/python-modules/astroid/default.nix4
-rw-r--r--pkgs/development/python-modules/astropy-iers-data/default.nix4
-rw-r--r--pkgs/development/python-modules/astropy/default.nix20
-rw-r--r--pkgs/development/python-modules/async-interrupt/default.nix4
-rw-r--r--pkgs/development/python-modules/async-tkinter-loop/default.nix2
-rw-r--r--pkgs/development/python-modules/async-upnp-client/default.nix6
-rw-r--r--pkgs/development/python-modules/asyncclick/default.nix4
-rw-r--r--pkgs/development/python-modules/atlassian-python-api/default.nix4
-rw-r--r--pkgs/development/python-modules/atomman/default.nix2
-rw-r--r--pkgs/development/python-modules/audio-metadata/default.nix2
-rw-r--r--pkgs/development/python-modules/autarco/default.nix2
-rw-r--r--pkgs/development/python-modules/auth0-python/default.nix2
-rw-r--r--pkgs/development/python-modules/autofaiss/default.nix2
-rw-r--r--pkgs/development/python-modules/avro/default.nix4
-rw-r--r--pkgs/development/python-modules/aw-core/default.nix2
-rw-r--r--pkgs/development/python-modules/aws-adfs/default.nix2
-rw-r--r--pkgs/development/python-modules/aws-sam-translator/default.nix4
-rw-r--r--pkgs/development/python-modules/aws-xray-sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/awscrt/default.nix4
-rw-r--r--pkgs/development/python-modules/awslambdaric/default.nix4
-rw-r--r--pkgs/development/python-modules/awswrangler/default.nix6
-rw-r--r--pkgs/development/python-modules/axis/default.nix4
-rw-r--r--pkgs/development/python-modules/axisregistry/default.nix2
-rw-r--r--pkgs/development/python-modules/azure-core/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-eventhub/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-identity/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-cdn/default.nix7
-rw-r--r--pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-datafactory/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-web/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-storage-blob/default.nix4
-rw-r--r--pkgs/development/python-modules/b2sdk/default.nix8
-rw-r--r--pkgs/development/python-modules/babel/default.nix25
-rw-r--r--pkgs/development/python-modules/babelfish/default.nix16
-rw-r--r--pkgs/development/python-modules/babelfont/default.nix19
-rw-r--r--pkgs/development/python-modules/backports-tarfile/default.nix65
-rw-r--r--pkgs/development/python-modules/barectf/default.nix2
-rw-r--r--pkgs/development/python-modules/basemap/default.nix2
-rw-r--r--pkgs/development/python-modules/bcrypt/default.nix6
-rw-r--r--pkgs/development/python-modules/beaker/default.nix6
-rw-r--r--pkgs/development/python-modules/beancount/default.nix4
-rw-r--r--pkgs/development/python-modules/beautysh/default.nix4
-rw-r--r--pkgs/development/python-modules/bids-validator/default.nix7
-rw-r--r--pkgs/development/python-modules/biliass/default.nix4
-rw-r--r--pkgs/development/python-modules/biopandas/default.nix2
-rw-r--r--pkgs/development/python-modules/bip32/default.nix6
-rw-r--r--pkgs/development/python-modules/bitlist/default.nix10
-rw-r--r--pkgs/development/python-modules/bitsandbytes/default.nix4
-rw-r--r--pkgs/development/python-modules/bitstring/default.nix26
-rw-r--r--pkgs/development/python-modules/black/default.nix4
-rw-r--r--pkgs/development/python-modules/bleak/default.nix4
-rw-r--r--pkgs/development/python-modules/blinker/default.nix4
-rw-r--r--pkgs/development/python-modules/blinkpy/default.nix4
-rw-r--r--pkgs/development/python-modules/bluetooth-adapters/default.nix4
-rw-r--r--pkgs/development/python-modules/bluetooth-data-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/bme680/default.nix32
-rw-r--r--pkgs/development/python-modules/boiboite-opener-framework/default.nix1
-rw-r--r--pkgs/development/python-modules/borb/default.nix4
-rw-r--r--pkgs/development/python-modules/bork/default.nix2
-rw-r--r--pkgs/development/python-modules/boto3/default.nix2
-rw-r--r--pkgs/development/python-modules/botocore/default.nix6
-rw-r--r--pkgs/development/python-modules/botorch/default.nix6
-rw-r--r--pkgs/development/python-modules/bottleneck/default.nix7
-rw-r--r--pkgs/development/python-modules/brian2/default.nix15
-rw-r--r--pkgs/development/python-modules/btrees/default.nix4
-rw-r--r--pkgs/development/python-modules/btsocket/default.nix6
-rw-r--r--pkgs/development/python-modules/cachier/default.nix2
-rw-r--r--pkgs/development/python-modules/cairocffi/default.nix4
-rw-r--r--pkgs/development/python-modules/cairocffi/dlopen-paths.patch31
-rw-r--r--pkgs/development/python-modules/can/default.nix4
-rw-r--r--pkgs/development/python-modules/canopen/default.nix4
-rw-r--r--pkgs/development/python-modules/case/default.nix2
-rw-r--r--pkgs/development/python-modules/catppuccin/default.nix6
-rw-r--r--pkgs/development/python-modules/cbor2/default.nix4
-rw-r--r--pkgs/development/python-modules/censys/default.nix2
-rw-r--r--pkgs/development/python-modules/certbot/default.nix4
-rw-r--r--pkgs/development/python-modules/cffi/default.nix21
-rw-r--r--pkgs/development/python-modules/cfn-lint/default.nix4
-rw-r--r--pkgs/development/python-modules/cftime/default.nix4
-rw-r--r--pkgs/development/python-modules/chameleon/default.nix4
-rw-r--r--pkgs/development/python-modules/cherrypy/default.nix23
-rw-r--r--pkgs/development/python-modules/chromadb/default.nix2
-rw-r--r--pkgs/development/python-modules/cirq-core/default.nix6
-rw-r--r--pkgs/development/python-modules/cirq-google/default.nix2
-rw-r--r--pkgs/development/python-modules/ciscoconfparse/default.nix2
-rw-r--r--pkgs/development/python-modules/clarifai/default.nix16
-rw-r--r--pkgs/development/python-modules/claripy/default.nix2
-rw-r--r--pkgs/development/python-modules/cle/default.nix2
-rw-r--r--pkgs/development/python-modules/cleo/default.nix2
-rw-r--r--pkgs/development/python-modules/cli-ui/default.nix2
-rw-r--r--pkgs/development/python-modules/clickhouse-cli/default.nix2
-rw-r--r--pkgs/development/python-modules/clickhouse-connect/default.nix4
-rw-r--r--pkgs/development/python-modules/clustershell/default.nix2
-rw-r--r--pkgs/development/python-modules/cmdstanpy/default.nix6
-rw-r--r--pkgs/development/python-modules/coconut/default.nix4
-rw-r--r--pkgs/development/python-modules/cohere/default.nix4
-rw-r--r--pkgs/development/python-modules/coincurve/default.nix49
-rw-r--r--pkgs/development/python-modules/coinmetrics-api-client/default.nix2
-rw-r--r--pkgs/development/python-modules/comicon/default.nix2
-rw-r--r--pkgs/development/python-modules/commoncode/default.nix17
-rw-r--r--pkgs/development/python-modules/conda-libmamba-solver/default.nix2
-rw-r--r--pkgs/development/python-modules/conda-package-handling/default.nix6
-rw-r--r--pkgs/development/python-modules/conda-package-streaming/default.nix6
-rw-r--r--pkgs/development/python-modules/conda/default.nix6
-rw-r--r--pkgs/development/python-modules/connexion/default.nix4
-rw-r--r--pkgs/development/python-modules/container-inspector/default.nix4
-rw-r--r--pkgs/development/python-modules/contourpy/default.nix4
-rw-r--r--pkgs/development/python-modules/convertertools/default.nix51
-rw-r--r--pkgs/development/python-modules/conway-polynomials/default.nix11
-rw-r--r--pkgs/development/python-modules/coverage/default.nix4
-rw-r--r--pkgs/development/python-modules/coveralls/default.nix67
-rw-r--r--pkgs/development/python-modules/craft-application/default.nix6
-rw-r--r--pkgs/development/python-modules/craft-providers/default.nix8
-rw-r--r--pkgs/development/python-modules/craft-store/default.nix6
-rw-r--r--pkgs/development/python-modules/cryptodatahub/default.nix4
-rw-r--r--pkgs/development/python-modules/cryptolyzer/default.nix7
-rw-r--r--pkgs/development/python-modules/cryptoparser/default.nix4
-rw-r--r--pkgs/development/python-modules/cssutils/default.nix4
-rw-r--r--pkgs/development/python-modules/ctap-keyring-device/default.nix2
-rw-r--r--pkgs/development/python-modules/cupy/default.nix4
-rw-r--r--pkgs/development/python-modules/cx-freeze/default.nix6
-rw-r--r--pkgs/development/python-modules/cyclonedx-python-lib/default.nix2
-rw-r--r--pkgs/development/python-modules/cypherpunkpay/default.nix2
-rw-r--r--pkgs/development/python-modules/dask-awkward/default.nix2
-rw-r--r--pkgs/development/python-modules/databricks-sql-connector/default.nix6
-rw-r--r--pkgs/development/python-modules/dataprep-ml/default.nix2
-rw-r--r--pkgs/development/python-modules/datasets/default.nix4
-rw-r--r--pkgs/development/python-modules/datashader/default.nix4
-rw-r--r--pkgs/development/python-modules/dbt-adapters/default.nix52
-rw-r--r--pkgs/development/python-modules/dbt-bigquery/default.nix6
-rw-r--r--pkgs/development/python-modules/dbt-common/default.nix65
-rw-r--r--pkgs/development/python-modules/dbt-core/default.nix27
-rw-r--r--pkgs/development/python-modules/dbt-postgres/default.nix25
-rw-r--r--pkgs/development/python-modules/dbt-redshift/default.nix6
-rw-r--r--pkgs/development/python-modules/dbt-semantic-interfaces/default.nix6
-rw-r--r--pkgs/development/python-modules/dbt-snowflake/default.nix4
-rw-r--r--pkgs/development/python-modules/dbus-fast/default.nix4
-rw-r--r--pkgs/development/python-modules/deal-solver/default.nix2
-rw-r--r--pkgs/development/python-modules/deepdiff/default.nix4
-rw-r--r--pkgs/development/python-modules/defusedxml/default.nix23
-rw-r--r--pkgs/development/python-modules/demetriek/default.nix2
-rw-r--r--pkgs/development/python-modules/denonavr/default.nix2
-rw-r--r--pkgs/development/python-modules/detect-secrets/default.nix6
-rw-r--r--pkgs/development/python-modules/detectron2/default.nix2
-rw-r--r--pkgs/development/python-modules/devito/default.nix2
-rw-r--r--pkgs/development/python-modules/devpi-common/default.nix7
-rw-r--r--pkgs/development/python-modules/diffsync/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect/default.nix2
-rw-r--r--pkgs/development/python-modules/distributed/default.nix2
-rw-r--r--pkgs/development/python-modules/dj-database-url/default.nix23
-rw-r--r--pkgs/development/python-modules/django-admin-sortable2/default.nix7
-rw-r--r--pkgs/development/python-modules/django-cacheops/default.nix2
-rw-r--r--pkgs/development/python-modules/django-compressor/default.nix2
-rw-r--r--pkgs/development/python-modules/django-debug-toolbar/default.nix4
-rw-r--r--pkgs/development/python-modules/django-extensions/default.nix35
-rw-r--r--pkgs/development/python-modules/django-haystack/default.nix23
-rw-r--r--pkgs/development/python-modules/django-health-check/default.nix8
-rw-r--r--pkgs/development/python-modules/django-import-export/default.nix2
-rw-r--r--pkgs/development/python-modules/django-leaflet/default.nix14
-rw-r--r--pkgs/development/python-modules/django-modeltranslation/default.nix6
-rw-r--r--pkgs/development/python-modules/django-oauth-toolkit/default.nix2
-rw-r--r--pkgs/development/python-modules/django-simple-history/default.nix17
-rw-r--r--pkgs/development/python-modules/django-stubs-ext/default.nix7
-rw-r--r--pkgs/development/python-modules/django-stubs/default.nix7
-rw-r--r--pkgs/development/python-modules/django-two-factor-auth/default.nix2
-rw-r--r--pkgs/development/python-modules/django-webpush/default.nix2
-rw-r--r--pkgs/development/python-modules/djangorestframework-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/djangorestframework/default.nix5
-rw-r--r--pkgs/development/python-modules/dm-control/default.nix2
-rw-r--r--pkgs/development/python-modules/dploot/default.nix2
-rw-r--r--pkgs/development/python-modules/dropbox/default.nix2
-rw-r--r--pkgs/development/python-modules/duckdb-engine/default.nix6
-rw-r--r--pkgs/development/python-modules/duckduckgo-search/default.nix2
-rw-r--r--pkgs/development/python-modules/dulwich/default.nix54
-rw-r--r--pkgs/development/python-modules/dunamai/default.nix6
-rw-r--r--pkgs/development/python-modules/dvc-azure/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-gs/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-http/default.nix1
-rw-r--r--pkgs/development/python-modules/dvc-s3/default.nix9
-rw-r--r--pkgs/development/python-modules/dvc-ssh/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc/default.nix6
-rw-r--r--pkgs/development/python-modules/e3-core/default.nix6
-rw-r--r--pkgs/development/python-modules/elastic-apm/default.nix2
-rw-r--r--pkgs/development/python-modules/elasticsearch-dsl/default.nix4
-rw-r--r--pkgs/development/python-modules/elasticsearch/default.nix4
-rw-r--r--pkgs/development/python-modules/email-validator/default.nix4
-rw-r--r--pkgs/development/python-modules/embedding-reader/default.nix2
-rw-r--r--pkgs/development/python-modules/emborg/default.nix4
-rw-r--r--pkgs/development/python-modules/emoji/default.nix12
-rw-r--r--pkgs/development/python-modules/es-client/default.nix6
-rw-r--r--pkgs/development/python-modules/evdev/default.nix4
-rw-r--r--pkgs/development/python-modules/evtx/default.nix6
-rw-r--r--pkgs/development/python-modules/exceptiongroup/default.nix14
-rw-r--r--pkgs/development/python-modules/executing/default.nix5
-rw-r--r--pkgs/development/python-modules/explorerscript/default.nix2
-rw-r--r--pkgs/development/python-modules/extract-msg/default.nix2
-rw-r--r--pkgs/development/python-modules/extruct/default.nix1
-rw-r--r--pkgs/development/python-modules/fairseq/default.nix2
-rw-r--r--pkgs/development/python-modules/faker/default.nix4
-rw-r--r--pkgs/development/python-modules/farm-haystack/default.nix6
-rw-r--r--pkgs/development/python-modules/fastapi-cli/default.nix58
-rw-r--r--pkgs/development/python-modules/fastapi/default.nix21
-rw-r--r--pkgs/development/python-modules/fastembed/default.nix2
-rw-r--r--pkgs/development/python-modules/faster-whisper/default.nix2
-rw-r--r--pkgs/development/python-modules/filelock/default.nix4
-rw-r--r--pkgs/development/python-modules/finvizfinance/default.nix4
-rw-r--r--pkgs/development/python-modules/fire/default.nix19
-rw-r--r--pkgs/development/python-modules/firebase-messaging/default.nix12
-rw-r--r--pkgs/development/python-modules/flake8/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-appbuilder/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-caching/default.nix6
-rw-r--r--pkgs/development/python-modules/flask-cors/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-login/default.nix19
-rw-r--r--pkgs/development/python-modules/flask-mailman/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-openid/default.nix14
-rw-r--r--pkgs/development/python-modules/flask-session/default.nix55
-rw-r--r--pkgs/development/python-modules/flax/default.nix2
-rw-r--r--pkgs/development/python-modules/flet-runtime/default.nix2
-rw-r--r--pkgs/development/python-modules/flet/default.nix2
-rw-r--r--pkgs/development/python-modules/flexcache/default.nix30
-rw-r--r--pkgs/development/python-modules/flexparser/default.nix32
-rw-r--r--pkgs/development/python-modules/fluent-logger/default.nix4
-rw-r--r--pkgs/development/python-modules/flufl/bounce.nix9
-rw-r--r--pkgs/development/python-modules/folium/default.nix4
-rw-r--r--pkgs/development/python-modules/fontbakery/default.nix6
-rw-r--r--pkgs/development/python-modules/fonttools/default.nix4
-rw-r--r--pkgs/development/python-modules/fpdf2/default.nix4
-rw-r--r--pkgs/development/python-modules/freebox-api/default.nix2
-rw-r--r--pkgs/development/python-modules/freezegun/default.nix12
-rw-r--r--pkgs/development/python-modules/freud/default.nix6
-rw-r--r--pkgs/development/python-modules/furl/default.nix6
-rw-r--r--pkgs/development/python-modules/furo/default.nix6
-rw-r--r--pkgs/development/python-modules/galois/default.nix2
-rw-r--r--pkgs/development/python-modules/garth/default.nix2
-rw-r--r--pkgs/development/python-modules/gbulb/default.nix4
-rw-r--r--pkgs/development/python-modules/gcal-sync/default.nix4
-rw-r--r--pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix1
-rw-r--r--pkgs/development/python-modules/gekko/default.nix4
-rw-r--r--pkgs/development/python-modules/genshi/default.nix4
-rw-r--r--pkgs/development/python-modules/gflanguages/default.nix2
-rw-r--r--pkgs/development/python-modules/gfsubsets/default.nix4
-rw-r--r--pkgs/development/python-modules/gitdb/default.nix2
-rw-r--r--pkgs/development/python-modules/githubkit/default.nix6
-rw-r--r--pkgs/development/python-modules/glueviz/default.nix4
-rw-r--r--pkgs/development/python-modules/glyphsets/default.nix15
-rw-r--r--pkgs/development/python-modules/gnureadline/default.nix4
-rw-r--r--pkgs/development/python-modules/google-api-core/default.nix4
-rw-r--r--pkgs/development/python-modules/google-auth/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-kms/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-storage/default.nix6
-rw-r--r--pkgs/development/python-modules/google-generativeai/default.nix2
-rw-r--r--pkgs/development/python-modules/google-re2/default.nix23
-rw-r--r--pkgs/development/python-modules/google-resumable-media/default.nix4
-rw-r--r--pkgs/development/python-modules/googleapis-common-protos/default.nix4
-rw-r--r--pkgs/development/python-modules/gophish/default.nix2
-rw-r--r--pkgs/development/python-modules/gpsoauth/default.nix2
-rw-r--r--pkgs/development/python-modules/gpustat/default.nix2
-rw-r--r--pkgs/development/python-modules/gpy/default.nix6
-rw-r--r--pkgs/development/python-modules/gpytorch/default.nix11
-rw-r--r--pkgs/development/python-modules/grad-cam/default.nix2
-rw-r--r--pkgs/development/python-modules/gradio/client.nix2
-rw-r--r--pkgs/development/python-modules/gradio/default.nix2
-rw-r--r--pkgs/development/python-modules/graspologic/default.nix4
-rw-r--r--pkgs/development/python-modules/greatfet/default.nix6
-rw-r--r--pkgs/development/python-modules/greenlet/default.nix5
-rw-r--r--pkgs/development/python-modules/greenlet/python-3.13-compat.patch313
-rw-r--r--pkgs/development/python-modules/gridnet/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-channelz/default.nix21
-rw-r--r--pkgs/development/python-modules/grpcio-health-checking/default.nix9
-rw-r--r--pkgs/development/python-modules/grpcio-reflection/default.nix21
-rw-r--r--pkgs/development/python-modules/grpcio-status/default.nix7
-rw-r--r--pkgs/development/python-modules/grpcio-testing/default.nix16
-rw-r--r--pkgs/development/python-modules/grpcio-tools/default.nix7
-rw-r--r--pkgs/development/python-modules/grpcio/default.nix4
-rw-r--r--pkgs/development/python-modules/gruut/default.nix25
-rw-r--r--pkgs/development/python-modules/gruut/language-pack.nix5
-rw-r--r--pkgs/development/python-modules/gsd/default.nix4
-rw-r--r--pkgs/development/python-modules/gunicorn/default.nix19
-rw-r--r--pkgs/development/python-modules/ha-mqtt-discoverable/default.nix2
-rw-r--r--pkgs/development/python-modules/habluetooth/default.nix10
-rw-r--r--pkgs/development/python-modules/hass-nabucasa/default.nix2
-rw-r--r--pkgs/development/python-modules/hatasmota/default.nix4
-rw-r--r--pkgs/development/python-modules/hatchling/default.nix4
-rw-r--r--pkgs/development/python-modules/hdate/default.nix1
-rw-r--r--pkgs/development/python-modules/hdbscan/default.nix2
-rw-r--r--pkgs/development/python-modules/hg-git/default.nix17
-rw-r--r--pkgs/development/python-modules/hikari/default.nix2
-rw-r--r--pkgs/development/python-modules/hologram/default.nix2
-rw-r--r--pkgs/development/python-modules/holoviews/default.nix4
-rw-r--r--pkgs/development/python-modules/home-assistant-bluetooth/default.nix17
-rw-r--r--pkgs/development/python-modules/home-assistant-bluetooth/habluetooth-3.0-compat.patch50
-rw-r--r--pkgs/development/python-modules/home-assistant-chip-clusters/default.nix4
-rw-r--r--pkgs/development/python-modules/home-assistant-chip-core/default.nix6
-rw-r--r--pkgs/development/python-modules/httpbin/default.nix2
-rw-r--r--pkgs/development/python-modules/huey/default.nix4
-rw-r--r--pkgs/development/python-modules/hvac/default.nix4
-rw-r--r--pkgs/development/python-modules/hvplot/default.nix4
-rw-r--r--pkgs/development/python-modules/i3ipc/default.nix4
-rw-r--r--pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix4
-rw-r--r--pkgs/development/python-modules/ical/default.nix4
-rw-r--r--pkgs/development/python-modules/icalevents/default.nix2
-rw-r--r--pkgs/development/python-modules/ifcopenshell/default.nix4
-rw-r--r--pkgs/development/python-modules/ihm/default.nix4
-rw-r--r--pkgs/development/python-modules/ijson/default.nix4
-rw-r--r--pkgs/development/python-modules/image-go-nord/default.nix4
-rw-r--r--pkgs/development/python-modules/imageio-ffmpeg/default.nix46
-rw-r--r--pkgs/development/python-modules/imageio-ffmpeg/ffmpeg-path.patch9
-rw-r--r--pkgs/development/python-modules/imap-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/import-expression/default.nix4
-rw-r--r--pkgs/development/python-modules/importlib-resources/default.nix6
-rw-r--r--pkgs/development/python-modules/incomfort-client/default.nix4
-rw-r--r--pkgs/development/python-modules/inflect/default.nix4
-rw-r--r--pkgs/development/python-modules/inform/default.nix6
-rw-r--r--pkgs/development/python-modules/inquirer/default.nix4
-rw-r--r--pkgs/development/python-modules/instructor/default.nix11
-rw-r--r--pkgs/development/python-modules/intensity-normalization/default.nix2
-rw-r--r--pkgs/development/python-modules/ipwhois/default.nix2
-rw-r--r--pkgs/development/python-modules/ipython/default.nix4
-rw-r--r--pkgs/development/python-modules/irc/default.nix4
-rw-r--r--pkgs/development/python-modules/jaraco-abode/default.nix4
-rw-r--r--pkgs/development/python-modules/jaraco-classes/default.nix4
-rw-r--r--pkgs/development/python-modules/jaraco-context/default.nix7
-rw-r--r--pkgs/development/python-modules/jaraco-text/default.nix6
-rw-r--r--pkgs/development/python-modules/jaxtyping/default.nix2
-rw-r--r--pkgs/development/python-modules/jdatetime/default.nix4
-rw-r--r--pkgs/development/python-modules/jedi/default.nix9
-rw-r--r--pkgs/development/python-modules/jellyfish/default.nix6
-rw-r--r--pkgs/development/python-modules/jinja2/default.nix9
-rw-r--r--pkgs/development/python-modules/jiter/Cargo.lock588
-rw-r--r--pkgs/development/python-modules/jiter/default.nix51
-rw-r--r--pkgs/development/python-modules/jiwer/default.nix2
-rw-r--r--pkgs/development/python-modules/joblib/default.nix4
-rw-r--r--pkgs/development/python-modules/joserfc/default.nix6
-rw-r--r--pkgs/development/python-modules/json-schema-for-humans/default.nix2
-rw-r--r--pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix4
-rw-r--r--pkgs/development/python-modules/jsonconversion/default.nix2
-rw-r--r--pkgs/development/python-modules/jsonpickle/default.nix4
-rw-r--r--pkgs/development/python-modules/jsonpointer/default.nix4
-rw-r--r--pkgs/development/python-modules/jsonschema-path/default.nix2
-rw-r--r--pkgs/development/python-modules/jsonschema-spec/default.nix2
-rw-r--r--pkgs/development/python-modules/jsonschema/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyterlab/default.nix4
-rw-r--r--pkgs/development/python-modules/justext/default.nix8
-rw-r--r--pkgs/development/python-modules/karton-dashboard/default.nix2
-rw-r--r--pkgs/development/python-modules/kbcstorage/default.nix4
-rw-r--r--pkgs/development/python-modules/keyring/default.nix13
-rw-r--r--pkgs/development/python-modules/khanaa/default.nix4
-rw-r--r--pkgs/development/python-modules/kserve/default.nix2
-rw-r--r--pkgs/development/python-modules/kubernetes/default.nix17
-rw-r--r--pkgs/development/python-modules/kurbopy/default.nix6
-rw-r--r--pkgs/development/python-modules/labelbox/default.nix6
-rw-r--r--pkgs/development/python-modules/labgrid/default.nix6
-rw-r--r--pkgs/development/python-modules/lacuscore/default.nix2
-rw-r--r--pkgs/development/python-modules/langchain-chroma/default.nix6
-rw-r--r--pkgs/development/python-modules/langchain-community/default.nix6
-rw-r--r--pkgs/development/python-modules/langchain-core/default.nix8
-rw-r--r--pkgs/development/python-modules/langchain-text-splitters/default.nix6
-rw-r--r--pkgs/development/python-modules/langchain/default.nix6
-rw-r--r--pkgs/development/python-modules/langcodes/default.nix13
-rw-r--r--pkgs/development/python-modules/langfuse/default.nix2
-rw-r--r--pkgs/development/python-modules/langsmith/default.nix7
-rw-r--r--pkgs/development/python-modules/lazy-loader/default.nix12
-rw-r--r--pkgs/development/python-modules/leb128/default.nix4
-rw-r--r--pkgs/development/python-modules/ledgerblue/default.nix2
-rw-r--r--pkgs/development/python-modules/lexilang/default.nix6
-rw-r--r--pkgs/development/python-modules/libcst/default.nix16
-rw-r--r--pkgs/development/python-modules/libmambapy/default.nix6
-rw-r--r--pkgs/development/python-modules/librespot/default.nix2
-rw-r--r--pkgs/development/python-modules/libretranslate/default.nix2
-rw-r--r--pkgs/development/python-modules/librosa/default.nix14
-rw-r--r--pkgs/development/python-modules/lightgbm/default.nix4
-rw-r--r--pkgs/development/python-modules/limnoria/default.nix4
-rw-r--r--pkgs/development/python-modules/linear-operator/default.nix2
-rw-r--r--pkgs/development/python-modules/linien-common/default.nix4
-rw-r--r--pkgs/development/python-modules/linode-api/default.nix4
-rw-r--r--pkgs/development/python-modules/lit/default.nix4
-rw-r--r--pkgs/development/python-modules/litellm/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-agent-openai/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-embeddings-google/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-llms-openai/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-program-openai/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-readers-file/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-google/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix2
-rw-r--r--pkgs/development/python-modules/llvmlite/default.nix4
-rw-r--r--pkgs/development/python-modules/lmcloud/default.nix6
-rw-r--r--pkgs/development/python-modules/localstack-ext/default.nix7
-rw-r--r--pkgs/development/python-modules/localstack/default.nix4
-rw-r--r--pkgs/development/python-modules/lsassy/default.nix2
-rw-r--r--pkgs/development/python-modules/lxml/default.nix4
-rw-r--r--pkgs/development/python-modules/lzallright/default.nix6
-rw-r--r--pkgs/development/python-modules/m3u8/default.nix4
-rw-r--r--pkgs/development/python-modules/maison/default.nix2
-rw-r--r--pkgs/development/python-modules/makefun/default.nix6
-rw-r--r--pkgs/development/python-modules/mako/default.nix4
-rw-r--r--pkgs/development/python-modules/mandown/default.nix6
-rw-r--r--pkgs/development/python-modules/manifest-ml/default.nix2
-rw-r--r--pkgs/development/python-modules/manim-slides/default.nix6
-rw-r--r--pkgs/development/python-modules/manim/default.nix2
-rw-r--r--pkgs/development/python-modules/marisa-trie/default.nix15
-rw-r--r--pkgs/development/python-modules/markdown-it-py/default.nix2
-rw-r--r--pkgs/development/python-modules/mashumaro/default.nix4
-rw-r--r--pkgs/development/python-modules/material-color-utilities/default.nix2
-rw-r--r--pkgs/development/python-modules/matplotlib/darwin-sandbox-crash.patch14
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix88
-rw-r--r--pkgs/development/python-modules/maxminddb/default.nix4
-rw-r--r--pkgs/development/python-modules/mayavi/default.nix4
-rw-r--r--pkgs/development/python-modules/mdit-py-plugins/default.nix4
-rw-r--r--pkgs/development/python-modules/mdtraj/default.nix4
-rw-r--r--pkgs/development/python-modules/mesa/default.nix4
-rw-r--r--pkgs/development/python-modules/meshtastic/default.nix4
-rw-r--r--pkgs/development/python-modules/meteofrance-api/default.nix2
-rw-r--r--pkgs/development/python-modules/miauth/default.nix15
-rw-r--r--pkgs/development/python-modules/mido/default.nix2
-rw-r--r--pkgs/development/python-modules/minichain/default.nix2
-rw-r--r--pkgs/development/python-modules/miniupnpc/default.nix4
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-autolinks-plugin/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-get-deps/default.nix43
-rw-r--r--pkgs/development/python-modules/mkdocs-jupyter/default.nix2
-rw-r--r--pkgs/development/python-modules/mkdocs-material/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs/default.nix10
-rw-r--r--pkgs/development/python-modules/mlflow/default.nix14
-rw-r--r--pkgs/development/python-modules/mlx/default.nix4
-rw-r--r--pkgs/development/python-modules/mobi/default.nix2
-rw-r--r--pkgs/development/python-modules/mocket/default.nix4
-rw-r--r--pkgs/development/python-modules/mockupdb/default.nix4
-rw-r--r--pkgs/development/python-modules/moddb/default.nix2
-rw-r--r--pkgs/development/python-modules/model-checker/default.nix2
-rw-r--r--pkgs/development/python-modules/moderngl-window/default.nix2
-rw-r--r--pkgs/development/python-modules/molbar/default.nix2
-rw-r--r--pkgs/development/python-modules/molecule/plugins.nix2
-rw-r--r--pkgs/development/python-modules/more-itertools/default.nix4
-rw-r--r--pkgs/development/python-modules/moto/default.nix13
-rw-r--r--pkgs/development/python-modules/moviepy/default.nix2
-rw-r--r--pkgs/development/python-modules/mpris-server/default.nix2
-rw-r--r--pkgs/development/python-modules/multipart/default.nix17
-rw-r--r--pkgs/development/python-modules/mwcli/default.nix2
-rw-r--r--pkgs/development/python-modules/myjwt/default.nix2
-rw-r--r--pkgs/development/python-modules/mypy-boto3-builder/default.nix4
-rw-r--r--pkgs/development/python-modules/mypy-protobuf/default.nix2
-rw-r--r--pkgs/development/python-modules/myst-parser/default.nix34
-rw-r--r--pkgs/development/python-modules/nbdev/default.nix2
-rw-r--r--pkgs/development/python-modules/nbmake/default.nix2
-rw-r--r--pkgs/development/python-modules/netaddr/default.nix4
-rw-r--r--pkgs/development/python-modules/nethsm/default.nix2
-rw-r--r--pkgs/development/python-modules/netio/default.nix2
-rw-r--r--pkgs/development/python-modules/nettigo-air-monitor/default.nix4
-rw-r--r--pkgs/development/python-modules/nextdns/default.nix14
-rw-r--r--pkgs/development/python-modules/nh3/default.nix6
-rw-r--r--pkgs/development/python-modules/niaaml/default.nix6
-rw-r--r--pkgs/development/python-modules/niaclass/default.nix2
-rw-r--r--pkgs/development/python-modules/niapy/default.nix5
-rw-r--r--pkgs/development/python-modules/nikola/default.nix4
-rw-r--r--pkgs/development/python-modules/nipype/default.nix2
-rw-r--r--pkgs/development/python-modules/nitime/default.nix4
-rw-r--r--pkgs/development/python-modules/nitransforms/default.nix2
-rw-r--r--pkgs/development/python-modules/norfair/default.nix2
-rw-r--r--pkgs/development/python-modules/nose2/default.nix4
-rw-r--r--pkgs/development/python-modules/notify-py/default.nix6
-rw-r--r--pkgs/development/python-modules/nototools/default.nix4
-rw-r--r--pkgs/development/python-modules/notus-scanner/default.nix2
-rw-r--r--pkgs/development/python-modules/ntc-templates/default.nix4
-rw-r--r--pkgs/development/python-modules/numba-scipy/default.nix2
-rw-r--r--pkgs/development/python-modules/numba/default.nix24
-rw-r--r--pkgs/development/python-modules/numpy/1.nix (renamed from pkgs/development/python-modules/numpy/default.nix)0
-rw-r--r--pkgs/development/python-modules/numpy/2.nix180
-rw-r--r--pkgs/development/python-modules/nutils/default.nix4
-rw-r--r--pkgs/development/python-modules/oci/default.nix2
-rw-r--r--pkgs/development/python-modules/odp-amsterdam/default.nix5
-rw-r--r--pkgs/development/python-modules/okta/default.nix4
-rw-r--r--pkgs/development/python-modules/ollama/default.nix2
-rw-r--r--pkgs/development/python-modules/onnx/default.nix19
-rw-r--r--pkgs/development/python-modules/onnxruntime/default.nix3
-rw-r--r--pkgs/development/python-modules/open-interpreter/default.nix2
-rw-r--r--pkgs/development/python-modules/openai-triton/bin.nix3
-rw-r--r--pkgs/development/python-modules/openai-triton/default.nix2
-rw-r--r--pkgs/development/python-modules/openapi-core/default.nix8
-rw-r--r--pkgs/development/python-modules/openhomedevice/default.nix4
-rw-r--r--pkgs/development/python-modules/openllm-core/default.nix14
-rw-r--r--pkgs/development/python-modules/openllm/default.nix2
-rw-r--r--pkgs/development/python-modules/opensearch-py/default.nix4
-rw-r--r--pkgs/development/python-modules/opentelemetry-api/default.nix6
-rw-r--r--pkgs/development/python-modules/opentelemetry-instrumentation/default.nix4
-rw-r--r--pkgs/development/python-modules/opentelemetry-semantic-conventions/default.nix3
-rw-r--r--pkgs/development/python-modules/openusd/default.nix4
-rw-r--r--pkgs/development/python-modules/orange-canvas-core/default.nix4
-rw-r--r--pkgs/development/python-modules/orange-widget-base/default.nix4
-rw-r--r--pkgs/development/python-modules/orange3/default.nix6
-rw-r--r--pkgs/development/python-modules/orbax-checkpoint/default.nix4
-rw-r--r--pkgs/development/python-modules/orjson/default.nix6
-rw-r--r--pkgs/development/python-modules/ormar/default.nix6
-rw-r--r--pkgs/development/python-modules/osqp/default.nix2
-rw-r--r--pkgs/development/python-modules/oss2/default.nix2
-rw-r--r--pkgs/development/python-modules/ossfs/default.nix2
-rw-r--r--pkgs/development/python-modules/outlines/default.nix4
-rw-r--r--pkgs/development/python-modules/ovh/default.nix4
-rw-r--r--pkgs/development/python-modules/packageurl-python/default.nix7
-rw-r--r--pkgs/development/python-modules/packaging/default.nix4
-rw-r--r--pkgs/development/python-modules/paddle2onnx/default.nix4
-rw-r--r--pkgs/development/python-modules/paddleocr/default.nix8
-rw-r--r--pkgs/development/python-modules/pallets-sphinx-themes/default.nix4
-rw-r--r--pkgs/development/python-modules/panasonic-viera/default.nix12
-rw-r--r--pkgs/development/python-modules/pandas/default.nix7
-rw-r--r--pkgs/development/python-modules/pandoc-xnos/default.nix2
-rw-r--r--pkgs/development/python-modules/panel/default.nix2
-rw-r--r--pkgs/development/python-modules/parse/default.nix4
-rw-r--r--pkgs/development/python-modules/parsedmarc/default.nix6
-rw-r--r--pkgs/development/python-modules/parts/default.nix4
-rw-r--r--pkgs/development/python-modules/pathy/default.nix2
-rw-r--r--pkgs/development/python-modules/pdb2pqr/default.nix2
-rw-r--r--pkgs/development/python-modules/pdf2docx/default.nix2
-rw-r--r--pkgs/development/python-modules/pdm-backend/default.nix4
-rw-r--r--pkgs/development/python-modules/pelican/default.nix3
-rw-r--r--pkgs/development/python-modules/persistent/default.nix27
-rw-r--r--pkgs/development/python-modules/pg8000/default.nix4
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/phonopy/default.nix4
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix10
-rw-r--r--pkgs/development/python-modules/pinecone-client/default.nix6
-rw-r--r--pkgs/development/python-modules/pint/default.nix5
-rw-r--r--pkgs/development/python-modules/pip/default.nix39
-rw-r--r--pkgs/development/python-modules/pipx/default.nix16
-rw-r--r--pkgs/development/python-modules/pixel-font-builder/default.nix4
-rw-r--r--pkgs/development/python-modules/pkginfo/default.nix4
-rw-r--r--pkgs/development/python-modules/pkutils/default.nix2
-rw-r--r--pkgs/development/python-modules/plaid-python/default.nix14
-rw-r--r--pkgs/development/python-modules/platformdirs/default.nix4
-rw-r--r--pkgs/development/python-modules/playwright/default.nix10
-rw-r--r--pkgs/development/python-modules/playwright/driver-location.patch20
-rw-r--r--pkgs/development/python-modules/playwrightcapture/default.nix2
-rw-r--r--pkgs/development/python-modules/pluggy/default.nix6
-rw-r--r--pkgs/development/python-modules/plugincode/default.nix3
-rw-r--r--pkgs/development/python-modules/plux/default.nix12
-rw-r--r--pkgs/development/python-modules/poetry-dynamic-versioning/default.nix4
-rw-r--r--pkgs/development/python-modules/polyswarm-api/default.nix2
-rw-r--r--pkgs/development/python-modules/pooch/default.nix4
-rw-r--r--pkgs/development/python-modules/ppscore/default.nix2
-rw-r--r--pkgs/development/python-modules/prettytable/default.nix8
-rw-r--r--pkgs/development/python-modules/private-gpt/default.nix2
-rw-r--r--pkgs/development/python-modules/prometrix/default.nix2
-rw-r--r--pkgs/development/python-modules/prompt-toolkit/default.nix4
-rw-r--r--pkgs/development/python-modules/prov/default.nix4
-rw-r--r--pkgs/development/python-modules/psutil/default.nix4
-rw-r--r--pkgs/development/python-modules/psycopg/ctypes.patch9
-rw-r--r--pkgs/development/python-modules/psycopg/default.nix4
-rw-r--r--pkgs/development/python-modules/psygnal/default.nix4
-rw-r--r--pkgs/development/python-modules/ptyprocess/default.nix4
-rw-r--r--pkgs/development/python-modules/pulsectl/default.nix4
-rw-r--r--pkgs/development/python-modules/pulumi-aws/default.nix4
-rw-r--r--pkgs/development/python-modules/pwndbg/default.nix2
-rw-r--r--pkgs/development/python-modules/py-pdf-parser/default.nix2
-rw-r--r--pkgs/development/python-modules/py-serializable/default.nix2
-rw-r--r--pkgs/development/python-modules/py-vapid/default.nix7
-rw-r--r--pkgs/development/python-modules/pyannote-audio/default.nix6
-rw-r--r--pkgs/development/python-modules/pyasn1-modules/default.nix23
-rw-r--r--pkgs/development/python-modules/pyatmo/default.nix2
-rw-r--r--pkgs/development/python-modules/pyatv/default.nix2
-rw-r--r--pkgs/development/python-modules/pybids/default.nix2
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix9
-rw-r--r--pkgs/development/python-modules/pycardano/default.nix2
-rw-r--r--pkgs/development/python-modules/pycatch22/default.nix4
-rw-r--r--pkgs/development/python-modules/pycddl/default.nix14
-rw-r--r--pkgs/development/python-modules/pycfmodel/default.nix2
-rw-r--r--pkgs/development/python-modules/pycocotools/default.nix4
-rw-r--r--pkgs/development/python-modules/pycodestyle/default.nix4
-rw-r--r--pkgs/development/python-modules/pycookiecheat/default.nix2
-rw-r--r--pkgs/development/python-modules/pydantic-core/default.nix6
-rw-r--r--pkgs/development/python-modules/pydantic-extra-types/default.nix4
-rw-r--r--pkgs/development/python-modules/pydantic-settings/default.nix4
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix21
-rw-r--r--pkgs/development/python-modules/pydevd/default.nix5
-rw-r--r--pkgs/development/python-modules/pydicom-seg/default.nix2
-rw-r--r--pkgs/development/python-modules/pydiscovergy/default.nix2
-rw-r--r--pkgs/development/python-modules/pydyf/default.nix4
-rw-r--r--pkgs/development/python-modules/pyecoforest/default.nix9
-rw-r--r--pkgs/development/python-modules/pyefergy/default.nix2
-rw-r--r--pkgs/development/python-modules/pyfakefs/default.nix4
-rw-r--r--pkgs/development/python-modules/pyfritzhome/default.nix4
-rw-r--r--pkgs/development/python-modules/pyftgl/default.nix5
-rw-r--r--pkgs/development/python-modules/pyfume/default.nix13
-rw-r--r--pkgs/development/python-modules/pygitguardian/default.nix5
-rw-r--r--pkgs/development/python-modules/pygls/default.nix2
-rw-r--r--pkgs/development/python-modules/pygments/default.nix9
-rw-r--r--pkgs/development/python-modules/pyicu/default.nix4
-rw-r--r--pkgs/development/python-modules/pykoplenti/default.nix2
-rw-r--r--pkgs/development/python-modules/pylint/default.nix4
-rw-r--r--pkgs/development/python-modules/pylitterbot/default.nix2
-rw-r--r--pkgs/development/python-modules/pylxd/default.nix2
-rw-r--r--pkgs/development/python-modules/pymdown-extensions/default.nix19
-rw-r--r--pkgs/development/python-modules/pymilvus/default.nix2
-rw-r--r--pkgs/development/python-modules/pymongo/default.nix4
-rw-r--r--pkgs/development/python-modules/pymysql/default.nix6
-rw-r--r--pkgs/development/python-modules/pyngo/default.nix2
-rw-r--r--pkgs/development/python-modules/pynitrokey/default.nix2
-rw-r--r--pkgs/development/python-modules/pynndescent/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopencl/default.nix38
-rw-r--r--pkgs/development/python-modules/pyopengl/default.nix6
-rw-r--r--pkgs/development/python-modules/pyowm/default.nix2
-rw-r--r--pkgs/development/python-modules/pyperclip/default.nix14
-rw-r--r--pkgs/development/python-modules/pyqt-builder/default.nix8
-rw-r--r--pkgs/development/python-modules/pyquil/default.nix2
-rw-r--r--pkgs/development/python-modules/pyreaderwriterlock/default.nix15
-rw-r--r--pkgs/development/python-modules/pyrisco/default.nix4
-rw-r--r--pkgs/development/python-modules/pyro-ppl/default.nix37
-rw-r--r--pkgs/development/python-modules/pysaml2/default.nix2
-rw-r--r--pkgs/development/python-modules/pysequoia/default.nix6
-rw-r--r--pkgs/development/python-modules/pysigma-backend-insightidr/default.nix2
-rw-r--r--pkgs/development/python-modules/pysigma-backend-opensearch/default.nix2
-rw-r--r--pkgs/development/python-modules/pysigma-backend-qradar/default.nix2
-rw-r--r--pkgs/development/python-modules/pysigma/default.nix2
-rw-r--r--pkgs/development/python-modules/pysilero-vad/default.nix2
-rw-r--r--pkgs/development/python-modules/pysimplegui/default.nix4
-rw-r--r--pkgs/development/python-modules/pysolcast/default.nix2
-rw-r--r--pkgs/development/python-modules/pytenable/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-astropy/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-cov/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-cram/default.nix19
-rw-r--r--pkgs/development/python-modules/pytest-examples/default.nix5
-rw-r--r--pkgs/development/python-modules/pytest-golden/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-httpx/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-lazy-fixtures/default.nix32
-rw-r--r--pkgs/development/python-modules/pytest-md-report/default.nix16
-rw-r--r--pkgs/development/python-modules/pytest-mpl/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-notebook/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-openfiles/default.nix51
-rw-r--r--pkgs/development/python-modules/pytest-regressions/default.nix5
-rw-r--r--pkgs/development/python-modules/pytest-rerunfailures/default.nix18
-rw-r--r--pkgs/development/python-modules/pytest-xdist/default.nix17
-rw-r--r--pkgs/development/python-modules/pytest-xprocess/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest/8.2.2-unittest-testcase-regression.patch72
-rw-r--r--pkgs/development/python-modules/pytest/default.nix11
-rw-r--r--pkgs/development/python-modules/python-benedict/default.nix2
-rw-r--r--pkgs/development/python-modules/python-dbusmock/default.nix60
-rw-r--r--pkgs/development/python-modules/python-docx/default.nix16
-rw-r--r--pkgs/development/python-modules/python-fx/default.nix2
-rw-r--r--pkgs/development/python-modules/python-gitlab/default.nix7
-rw-r--r--pkgs/development/python-modules/python-gvm/default.nix2
-rw-r--r--pkgs/development/python-modules/python-jenkins/default.nix2
-rw-r--r--pkgs/development/python-modules/python-kasa/default.nix12
-rw-r--r--pkgs/development/python-modules/python-lsp-server/default.nix1
-rw-r--r--pkgs/development/python-modules/python-lzf/default.nix20
-rw-r--r--pkgs/development/python-modules/python-matter-server/default.nix6
-rw-r--r--pkgs/development/python-modules/python-miio/default.nix2
-rw-r--r--pkgs/development/python-modules/python-ndn/default.nix2
-rw-r--r--pkgs/development/python-modules/python-nomad/default.nix14
-rw-r--r--pkgs/development/python-modules/python-roborock/default.nix2
-rw-r--r--pkgs/development/python-modules/python-sql/default.nix7
-rw-r--r--pkgs/development/python-modules/pytools/default.nix4
-rw-r--r--pkgs/development/python-modules/pyudev/default.nix4
-rw-r--r--pkgs/development/python-modules/pyzmq/default.nix28
-rw-r--r--pkgs/development/python-modules/qcs-api-client/default.nix2
-rw-r--r--pkgs/development/python-modules/qcs-sdk-python/Cargo.lock55
-rw-r--r--pkgs/development/python-modules/qcs-sdk-python/default.nix6
-rw-r--r--pkgs/development/python-modules/qdldl/default.nix4
-rw-r--r--pkgs/development/python-modules/qtconsole/default.nix2
-rw-r--r--pkgs/development/python-modules/qudida/default.nix2
-rw-r--r--pkgs/development/python-modules/questionary/default.nix2
-rw-r--r--pkgs/development/python-modules/quil/default.nix6
-rw-r--r--pkgs/development/python-modules/r2pipe/default.nix4
-rw-r--r--pkgs/development/python-modules/radios/default.nix2
-rw-r--r--pkgs/development/python-modules/ray/default.nix2
-rw-r--r--pkgs/development/python-modules/readability-lxml/default.nix2
-rw-r--r--pkgs/development/python-modules/redis-om/default.nix2
-rw-r--r--pkgs/development/python-modules/redis/default.nix4
-rw-r--r--pkgs/development/python-modules/regex/default.nix4
-rw-r--r--pkgs/development/python-modules/remarshal/default.nix2
-rw-r--r--pkgs/development/python-modules/renault-api/default.nix4
-rw-r--r--pkgs/development/python-modules/reptor/default.nix2
-rw-r--r--pkgs/development/python-modules/reqif/default.nix2
-rw-r--r--pkgs/development/python-modules/requests-ntlm/default.nix4
-rw-r--r--pkgs/development/python-modules/requests-oauthlib/default.nix7
-rw-r--r--pkgs/development/python-modules/respx/default.nix23
-rw-r--r--pkgs/development/python-modules/rich-pixels/default.nix4
-rw-r--r--pkgs/development/python-modules/ring-doorbell/default.nix2
-rw-r--r--pkgs/development/python-modules/riscv-config/default.nix2
-rw-r--r--pkgs/development/python-modules/rising/default.nix2
-rw-r--r--pkgs/development/python-modules/rmrl/default.nix2
-rw-r--r--pkgs/development/python-modules/rmscene/default.nix2
-rw-r--r--pkgs/development/python-modules/rnginline/default.nix2
-rw-r--r--pkgs/development/python-modules/roadrecon/default.nix2
-rw-r--r--pkgs/development/python-modules/robomachine/default.nix2
-rw-r--r--pkgs/development/python-modules/roombapy/default.nix2
-rw-r--r--pkgs/development/python-modules/rpds-py/default.nix6
-rw-r--r--pkgs/development/python-modules/rst2pdf/default.nix4
-rw-r--r--pkgs/development/python-modules/rtoml/default.nix36
-rw-r--r--pkgs/development/python-modules/s3fs/default.nix4
-rw-r--r--pkgs/development/python-modules/sabctools/default.nix4
-rw-r--r--pkgs/development/python-modules/safety-schemas/default.nix2
-rw-r--r--pkgs/development/python-modules/safety/default.nix2
-rw-r--r--pkgs/development/python-modules/sagemaker/default.nix2
-rw-r--r--pkgs/development/python-modules/sarif-tools/default.nix2
-rw-r--r--pkgs/development/python-modules/scalene/default.nix4
-rw-r--r--pkgs/development/python-modules/schema-salad/default.nix1
-rw-r--r--pkgs/development/python-modules/schema/default.nix6
-rw-r--r--pkgs/development/python-modules/schwifty/default.nix14
-rw-r--r--pkgs/development/python-modules/scikit-build-core/default.nix5
-rw-r--r--pkgs/development/python-modules/scikit-fmm/default.nix29
-rw-r--r--pkgs/development/python-modules/scikit-learn/default.nix24
-rw-r--r--pkgs/development/python-modules/scikits-odes/default.nix4
-rw-r--r--pkgs/development/python-modules/scipy/default.nix19
-rw-r--r--pkgs/development/python-modules/scmrepo/default.nix4
-rw-r--r--pkgs/development/python-modules/scramp/default.nix19
-rw-r--r--pkgs/development/python-modules/scrapy/default.nix5
-rw-r--r--pkgs/development/python-modules/selenium/default.nix6
-rw-r--r--pkgs/development/python-modules/setuptools-scm/default.nix13
-rw-r--r--pkgs/development/python-modules/setuptools/default.nix4
-rw-r--r--pkgs/development/python-modules/sev-snp-measure/default.nix2
-rw-r--r--pkgs/development/python-modules/sfrbox-api/default.nix8
-rw-r--r--pkgs/development/python-modules/signalslot/default.nix2
-rw-r--r--pkgs/development/python-modules/sigstore-protobuf-specs/default.nix4
-rw-r--r--pkgs/development/python-modules/sisyphus-control/default.nix2
-rw-r--r--pkgs/development/python-modules/skl2onnx/default.nix2
-rw-r--r--pkgs/development/python-modules/skorch/default.nix4
-rw-r--r--pkgs/development/python-modules/snowflake-connector-python/default.nix9
-rw-r--r--pkgs/development/python-modules/sockjs/default.nix4
-rw-r--r--pkgs/development/python-modules/sopel/default.nix4
-rw-r--r--pkgs/development/python-modules/soundcloud-v2/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy-transformers/default.nix2
-rw-r--r--pkgs/development/python-modules/spacy/default.nix6
-rw-r--r--pkgs/development/python-modules/sphinx-autoapi/default.nix13
-rw-r--r--pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx-mdinclude/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx-prompt/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx-rtd-theme/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix14
-rw-r--r--pkgs/development/python-modules/sphinxawesome-theme/default.nix3
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-katex/default.nix18
-rw-r--r--pkgs/development/python-modules/spsdk/default.nix2
-rw-r--r--pkgs/development/python-modules/sqlalchemy-continuum/default.nix23
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/starlette/default.nix8
-rw-r--r--pkgs/development/python-modules/steamship/default.nix2
-rw-r--r--pkgs/development/python-modules/streamlit/default.nix2
-rw-r--r--pkgs/development/python-modules/stripe/default.nix4
-rw-r--r--pkgs/development/python-modules/subprocess-tee/default.nix21
-rw-r--r--pkgs/development/python-modules/succulent/default.nix2
-rw-r--r--pkgs/development/python-modules/sunpy/default.nix4
-rw-r--r--pkgs/development/python-modules/svg2tikz/default.nix2
-rw-r--r--pkgs/development/python-modules/sympy/default.nix4
-rw-r--r--pkgs/development/python-modules/syncedlyrics/default.nix2
-rw-r--r--pkgs/development/python-modules/synologydsm-api/default.nix2
-rw-r--r--pkgs/development/python-modules/tabcmd/default.nix2
-rw-r--r--pkgs/development/python-modules/tableauserverclient/default.nix6
-rw-r--r--pkgs/development/python-modules/tago/default.nix2
-rw-r--r--pkgs/development/python-modules/tagoio-sdk/default.nix2
-rw-r--r--pkgs/development/python-modules/taskw-ng/default.nix2
-rw-r--r--pkgs/development/python-modules/tbm-utils/default.nix2
-rw-r--r--pkgs/development/python-modules/tempora/default.nix4
-rw-r--r--pkgs/development/python-modules/tenacity/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorboard/default.nix6
-rw-r--r--pkgs/development/python-modules/terminaltexteffects/default.nix4
-rw-r--r--pkgs/development/python-modules/tesserocr/default.nix4
-rw-r--r--pkgs/development/python-modules/testtools/default.nix6
-rw-r--r--pkgs/development/python-modules/textnets/default.nix2
-rw-r--r--pkgs/development/python-modules/tf-keras/default.nix2
-rw-r--r--pkgs/development/python-modules/tf2onnx/default.nix2
-rw-r--r--pkgs/development/python-modules/thelogrus/default.nix2
-rw-r--r--pkgs/development/python-modules/tifffile/default.nix4
-rw-r--r--pkgs/development/python-modules/tilequant/default.nix2
-rw-r--r--pkgs/development/python-modules/tinycss2/default.nix10
-rw-r--r--pkgs/development/python-modules/tlslite-ng/default.nix4
-rw-r--r--pkgs/development/python-modules/tomlkit/default.nix4
-rw-r--r--pkgs/development/python-modules/torch/default.nix2
-rw-r--r--pkgs/development/python-modules/torchdiffeq/default.nix4
-rw-r--r--pkgs/development/python-modules/tornado/default.nix10
-rw-r--r--pkgs/development/python-modules/trafilatura/default.nix4
-rw-r--r--pkgs/development/python-modules/traitlets/default.nix4
-rw-r--r--pkgs/development/python-modules/treex/default.nix2
-rw-r--r--pkgs/development/python-modules/trezor/default.nix35
-rw-r--r--pkgs/development/python-modules/trove-classifiers/default.nix7
-rw-r--r--pkgs/development/python-modules/tubeup/default.nix2
-rw-r--r--pkgs/development/python-modules/tuya-device-sharing-sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/twill/default.nix2
-rw-r--r--pkgs/development/python-modules/twine/default.nix4
-rw-r--r--pkgs/development/python-modules/twisted/default.nix4
-rw-r--r--pkgs/development/python-modules/txtai/default.nix2
-rw-r--r--pkgs/development/python-modules/typed-settings/default.nix4
-rw-r--r--pkgs/development/python-modules/typeguard/default.nix16
-rw-r--r--pkgs/development/python-modules/typer-shell/default.nix2
-rw-r--r--pkgs/development/python-modules/types-protobuf/default.nix4
-rw-r--r--pkgs/development/python-modules/types-psutil/default.nix4
-rw-r--r--pkgs/development/python-modules/types-setuptools/default.nix4
-rw-r--r--pkgs/development/python-modules/typical/default.nix2
-rw-r--r--pkgs/development/python-modules/typing-extensions/default.nix4
-rw-r--r--pkgs/development/python-modules/ufo2ft/default.nix6
-rw-r--r--pkgs/development/python-modules/uiprotect/default.nix11
-rw-r--r--pkgs/development/python-modules/ujson/default.nix4
-rw-r--r--pkgs/development/python-modules/uncertainties/default.nix22
-rw-r--r--pkgs/development/python-modules/unidata-blocks/default.nix4
-rw-r--r--pkgs/development/python-modules/universal-silabs-flasher/default.nix2
-rw-r--r--pkgs/development/python-modules/uplc/default.nix2
-rw-r--r--pkgs/development/python-modules/urllib3/default.nix4
-rw-r--r--pkgs/development/python-modules/vallox-websocket-api/default.nix6
-rw-r--r--pkgs/development/python-modules/vdirsyncer/default.nix2
-rw-r--r--pkgs/development/python-modules/vector/default.nix4
-rw-r--r--pkgs/development/python-modules/vega/default.nix2
-rw-r--r--pkgs/development/python-modules/velbus-aio/default.nix4
-rw-r--r--pkgs/development/python-modules/versioningit/default.nix4
-rw-r--r--pkgs/development/python-modules/virtualenv/default.nix4
-rw-r--r--pkgs/development/python-modules/vispy/default.nix6
-rw-r--r--pkgs/development/python-modules/vivisect/default.nix2
-rw-r--r--pkgs/development/python-modules/vt-py/default.nix2
-rw-r--r--pkgs/development/python-modules/vulcan-api/default.nix2
-rw-r--r--pkgs/development/python-modules/wagtail/default.nix4
-rw-r--r--pkgs/development/python-modules/wandb/default.nix2
-rw-r--r--pkgs/development/python-modules/wasmer/default.nix10
-rw-r--r--pkgs/development/python-modules/watchdog/default.nix4
-rw-r--r--pkgs/development/python-modules/watchfiles/default.nix6
-rw-r--r--pkgs/development/python-modules/weasel/default.nix2
-rw-r--r--pkgs/development/python-modules/weasyprint/default.nix6
-rw-r--r--pkgs/development/python-modules/weasyprint/library-paths.patch9
-rw-r--r--pkgs/development/python-modules/weaviate-client/default.nix2
-rw-r--r--pkgs/development/python-modules/websocket-client/default.nix7
-rw-r--r--pkgs/development/python-modules/weconnect-mqtt/default.nix2
-rw-r--r--pkgs/development/python-modules/wheel-inspect/default.nix2
-rw-r--r--pkgs/development/python-modules/willow/default.nix2
-rw-r--r--pkgs/development/python-modules/woob/default.nix2
-rw-r--r--pkgs/development/python-modules/wurlitzer/default.nix4
-rw-r--r--pkgs/development/python-modules/xarray-dataclasses/default.nix2
-rw-r--r--pkgs/development/python-modules/xarray/default.nix4
-rw-r--r--pkgs/development/python-modules/xcffib/default.nix2
-rw-r--r--pkgs/development/python-modules/xhtml2pdf/default.nix2
-rw-r--r--pkgs/development/python-modules/xiaomi-ble/default.nix2
-rw-r--r--pkgs/development/python-modules/xlib/default.nix2
-rw-r--r--pkgs/development/python-modules/xmlschema/default.nix7
-rw-r--r--pkgs/development/python-modules/xvfbwrapper/default.nix4
-rw-r--r--pkgs/development/python-modules/xyzservices/default.nix4
-rw-r--r--pkgs/development/python-modules/yangson/default.nix8
-rw-r--r--pkgs/development/python-modules/yark/default.nix2
-rw-r--r--pkgs/development/python-modules/ypy-websocket/default.nix2
-rw-r--r--pkgs/development/python-modules/z3c-checkversions/default.nix5
-rw-r--r--pkgs/development/python-modules/zarr/default.nix4
-rw-r--r--pkgs/development/python-modules/zeroc-ice/default.nix9
-rw-r--r--pkgs/development/python-modules/zha/default.nix2
-rw-r--r--pkgs/development/python-modules/zigpy-deconz/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy-znp/default.nix4
-rw-r--r--pkgs/development/python-modules/zipp/default.nix4
-rw-r--r--pkgs/development/python-modules/zodbpickle/default.nix4
-rw-r--r--pkgs/development/python-modules/zope-exceptions/default.nix4
-rw-r--r--pkgs/development/python-modules/zope-interface/default.nix13
-rw-r--r--pkgs/development/python-modules/zope-testbrowser/default.nix4
-rw-r--r--pkgs/development/r-modules/default.nix2
-rw-r--r--pkgs/development/rocm-modules/5/clr/test-opencl-example.nix4
-rw-r--r--pkgs/development/rocm-modules/6/clr/test-opencl-example.nix4
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix1
-rw-r--r--pkgs/development/tools/boost-build/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/conan/default.nix1
-rw-r--r--pkgs/development/tools/circup/default.nix1
-rw-r--r--pkgs/development/tools/continuous-integration/buildbot/master.nix2
-rw-r--r--pkgs/development/tools/djlint/default.nix1
-rw-r--r--pkgs/development/tools/documentation/gi-docgen/default.nix4
-rw-r--r--pkgs/development/tools/enochecker-test/default.nix2
-rw-r--r--pkgs/development/tools/fdroidserver/default.nix2
-rw-r--r--pkgs/development/tools/jq/default.nix5
-rw-r--r--pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch51
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix20
-rw-r--r--pkgs/development/tools/misc/distcc/default.nix7
-rw-r--r--pkgs/development/tools/misc/luarocks/default.nix8
-rw-r--r--pkgs/development/tools/misc/unixbench/default.nix4
-rw-r--r--pkgs/development/tools/prospector/default.nix1
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/tools/simavr/default.nix4
-rw-r--r--pkgs/development/tools/skjold/default.nix1
-rw-r--r--pkgs/development/web/nodejs/bin-sh-node-run-v22.patch14
-rw-r--r--pkgs/development/web/nodejs/nodejs.nix18
-rw-r--r--pkgs/development/web/nodejs/use-correct-env-in-tests.patch24
-rw-r--r--pkgs/development/web/nodejs/v18-openssl-3.0.14.patch24
-rw-r--r--pkgs/development/web/nodejs/v18.nix10
-rw-r--r--pkgs/development/web/nodejs/v20.nix16
-rw-r--r--pkgs/development/web/nodejs/v22.nix10
-rw-r--r--pkgs/games/chromium-bsu/default.nix4
-rw-r--r--pkgs/games/construo/default.nix4
-rw-r--r--pkgs/games/crack-attack/default.nix4
-rw-r--r--pkgs/games/ddnet/default.nix3
-rw-r--r--pkgs/games/empty-epsilon/default.nix22
-rw-r--r--pkgs/games/extremetuxracer/default.nix4
-rw-r--r--pkgs/games/flightgear/default.nix4
-rw-r--r--pkgs/games/frogatto/engine.nix2
-rw-r--r--pkgs/games/gl-117/default.nix4
-rw-r--r--pkgs/games/gl-gsync-demo/default.nix4
-rw-r--r--pkgs/games/hedgewars/default.nix6
-rw-r--r--pkgs/games/katago/default.nix2
-rw-r--r--pkgs/games/mar1d/default.nix16
-rw-r--r--pkgs/games/methane/default.nix4
-rw-r--r--pkgs/games/minetest/default.nix5
-rw-r--r--pkgs/games/newtonwars/default.nix6
-rw-r--r--pkgs/games/solarus/default.nix4
-rw-r--r--pkgs/games/space-orbit/default.nix4
-rw-r--r--pkgs/games/speed-dreams/default.nix4
-rw-r--r--pkgs/games/steam/fhsenv.nix2
-rw-r--r--pkgs/games/torcs/default.nix4
-rw-r--r--pkgs/games/xonotic/default.nix4
-rw-r--r--pkgs/misc/drivers/hplip/default.nix2
-rw-r--r--pkgs/misc/flashfocus/default.nix1
-rw-r--r--pkgs/misc/ghostscript/default.nix6
-rw-r--r--pkgs/misc/jackaudio/default.nix11
-rw-r--r--pkgs/misc/lilypond/default.nix2
-rw-r--r--pkgs/misc/rich-cli/default.nix1
-rw-r--r--pkgs/misc/screensavers/electricsheep/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix4
-rw-r--r--pkgs/os-specific/darwin/binutils/default.nix190
-rw-r--r--pkgs/os-specific/darwin/cctools/port.nix8
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix6
-rw-r--r--pkgs/os-specific/linux/audit/default.nix18
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix4
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix71
-rw-r--r--pkgs/os-specific/linux/ffado/fix-build.patch54
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix17
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix19
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix5
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/linux/trace-cmd/kernelshark.nix4
-rw-r--r--pkgs/os-specific/windows/mingw-w64/default.nix1
-rw-r--r--pkgs/servers/apache-airflow/default.nix1
-rw-r--r--pkgs/servers/apache-airflow/python-package.nix2
-rw-r--r--pkgs/servers/gpsd/default.nix7
-rw-r--r--pkgs/servers/home-assistant/appdaemon.nix1
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix73
-rw-r--r--pkgs/servers/home-assistant/default.nix98
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rw-r--r--pkgs/servers/home-assistant/intents.nix4
-rw-r--r--pkgs/servers/home-assistant/stubs.nix4
-rwxr-xr-xpkgs/servers/home-assistant/update-component-packages.py2
-rw-r--r--pkgs/servers/ldap/lldap/default.nix4
-rw-r--r--pkgs/servers/memcached/default.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix1
-rw-r--r--pkgs/servers/pinnwand/default.nix1
-rw-r--r--pkgs/servers/web-apps/hedgedoc/default.nix4
-rw-r--r--pkgs/servers/x11/xorg/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix33
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list2
-rw-r--r--pkgs/stdenv/darwin/default.nix347
-rw-r--r--pkgs/stdenv/darwin/make-bootstrap-tools.nix4
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix1
-rw-r--r--pkgs/stdenv/generic/setup.sh82
-rw-r--r--pkgs/stdenv/linux/bootstrap-tools/default.nix7
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix7
-rw-r--r--pkgs/tools/admin/ansible/doctor.nix1
-rw-r--r--pkgs/tools/admin/ansible/later.nix1
-rw-r--r--pkgs/tools/admin/ansible/lint.nix1
-rw-r--r--pkgs/tools/admin/awscli/default.nix16
-rw-r--r--pkgs/tools/admin/gimme-aws-creds/default.nix1
-rw-r--r--pkgs/tools/admin/gixy/default.nix4
-rw-r--r--pkgs/tools/admin/turbovnc/default.nix2
-rw-r--r--pkgs/tools/archivers/7zz/default.nix23
-rw-r--r--pkgs/tools/audio/spotdl/default.nix2
-rw-r--r--pkgs/tools/audio/wyoming/faster-whisper.nix1
-rw-r--r--pkgs/tools/audio/wyoming/openwakeword.nix1
-rw-r--r--pkgs/tools/audio/wyoming/piper.nix1
-rw-r--r--pkgs/tools/backup/tarsnapper/default.nix1
-rw-r--r--pkgs/tools/backup/zfs-autobackup/default.nix1
-rw-r--r--pkgs/tools/compression/lz4/0001-Create-a-unified-lz4-target.patch34
-rw-r--r--pkgs/tools/compression/lz4/default.nix70
-rw-r--r--pkgs/tools/compression/xz/default.nix18
-rw-r--r--pkgs/tools/filesystems/rmfuse/default.nix1
-rw-r--r--pkgs/tools/games/steamback/default.nix2
-rw-r--r--pkgs/tools/graphics/asymptote/default.nix6
-rw-r--r--pkgs/tools/graphics/enblend-enfuse/default.nix4
-rw-r--r--pkgs/tools/graphics/mesa-demos/default.nix12
-rw-r--r--pkgs/tools/graphics/nifskope/default.nix2
-rw-r--r--pkgs/tools/graphics/pfstools/default.nix4
-rw-r--r--pkgs/tools/graphics/piglit/default.nix4
-rw-r--r--pkgs/tools/graphics/twilight/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-cts/default.nix6
-rw-r--r--pkgs/tools/misc/csvs-to-sqlite/default.nix1
-rw-r--r--pkgs/tools/misc/cyclonedx-python/default.nix1
-rw-r--r--pkgs/tools/misc/esphome/default.nix1
-rw-r--r--pkgs/tools/misc/expect/0004-enable-cross-compilation.patch295
-rw-r--r--pkgs/tools/misc/expect/default.nix12
-rw-r--r--pkgs/tools/misc/expect/fix-build-time-run-tcl.patch (renamed from pkgs/tools/misc/expect/fix-cross-compilation.patch)0
-rw-r--r--pkgs/tools/misc/expect/fix-darwin-bsd-clang16.patch (renamed from pkgs/tools/misc/expect/fix-darwin-clang16.patch)13
-rw-r--r--pkgs/tools/misc/expect/freebsd-unversioned.patch14
-rw-r--r--pkgs/tools/misc/findutils/default.nix4
-rw-r--r--pkgs/tools/misc/fontforge/default.nix3
-rw-r--r--pkgs/tools/misc/fontforge/replace-distutils.patch13
-rw-r--r--pkgs/tools/misc/hdaps-gl/default.nix4
-rw-r--r--pkgs/tools/misc/hdf5/default.nix20
-rw-r--r--pkgs/tools/misc/nanoemoji/default.nix1
-rw-r--r--pkgs/tools/misc/parquet-tools/default.nix1
-rw-r--r--pkgs/tools/misc/piston-cli/default.nix1
-rw-r--r--pkgs/tools/misc/pricehist/default.nix2
-rw-r--r--pkgs/tools/misc/sqlite3-to-mysql/default.nix1
-rw-r--r--pkgs/tools/misc/system-config-printer/default.nix6
-rw-r--r--pkgs/tools/misc/system-config-printer/pep517.patch16
-rw-r--r--pkgs/tools/misc/xvfb-run/default.nix4
-rw-r--r--pkgs/tools/misc/yubikey-manager/default.nix1
-rw-r--r--pkgs/tools/networking/burpsuite/default.nix1
-rw-r--r--pkgs/tools/networking/cloud-custodian/default.nix1
-rw-r--r--pkgs/tools/networking/offlineimap/default.nix35
-rw-r--r--pkgs/tools/package-management/poetry/unwrapped.nix5
-rw-r--r--pkgs/tools/security/amoco/default.nix1
-rw-r--r--pkgs/tools/security/cfripper/default.nix1
-rw-r--r--pkgs/tools/security/chipsec/default.nix5
-rw-r--r--pkgs/tools/security/coercer/default.nix1
-rw-r--r--pkgs/tools/security/crackmapexec/default.nix1
-rw-r--r--pkgs/tools/security/crackql/default.nix1
-rw-r--r--pkgs/tools/security/enpass/default.nix1
-rw-r--r--pkgs/tools/security/expliot/default.nix1
-rw-r--r--pkgs/tools/security/faraday-agent-dispatcher/default.nix1
-rw-r--r--pkgs/tools/security/gallia/default.nix1
-rw-r--r--pkgs/tools/security/ggshield/default.nix1
-rw-r--r--pkgs/tools/security/gnupg/22.nix2
-rw-r--r--pkgs/tools/security/ioccheck/default.nix1
-rw-r--r--pkgs/tools/security/knockpy/default.nix6
-rw-r--r--pkgs/tools/security/knowsmore/default.nix1
-rw-r--r--pkgs/tools/security/ldeep/default.nix1
-rw-r--r--pkgs/tools/security/maigret/default.nix1
-rw-r--r--pkgs/tools/security/mitmproxy2swagger/default.nix1
-rw-r--r--pkgs/tools/security/netexec/default.nix1
-rw-r--r--pkgs/tools/security/ospd-openvas/default.nix1
-rw-r--r--pkgs/tools/security/quark-engine/default.nix1
-rw-r--r--pkgs/tools/security/semgrep/default.nix2
-rw-r--r--pkgs/tools/security/tell-me-your-secrets/default.nix1
-rw-r--r--pkgs/tools/security/trueseeing/default.nix1
-rw-r--r--pkgs/tools/security/wapiti/default.nix1
-rw-r--r--pkgs/tools/security/yaralyzer/default.nix1
-rw-r--r--pkgs/tools/system/nvitop/default.nix1
-rw-r--r--pkgs/tools/system/pciutils/default.nix14
-rw-r--r--pkgs/tools/text/frogmouth/default.nix1
-rw-r--r--pkgs/tools/typesetting/tex/dblatex/default.nix6
-rw-r--r--pkgs/tools/typesetting/tex/nix/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix2
-rw-r--r--pkgs/tools/virtualization/awsebcli/default.nix5
-rw-r--r--pkgs/top-level/all-packages.nix121
-rw-r--r--pkgs/top-level/darwin-packages.nix36
-rw-r--r--pkgs/top-level/haskell-packages.nix24
-rw-r--r--pkgs/top-level/java-packages.nix2
-rw-r--r--pkgs/top-level/perl-packages.nix9
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix34
-rw-r--r--pkgs/top-level/stage.nix2
1390 files changed, 7983 insertions, 5468 deletions
diff --git a/pkgs/applications/audio/ledfx/default.nix b/pkgs/applications/audio/ledfx/default.nix
index f45c7dc3af55..593fd72c6d0c 100644
--- a/pkgs/applications/audio/ledfx/default.nix
+++ b/pkgs/applications/audio/ledfx/default.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonPackage rec {
     poetry-core
   ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     aiohttp
diff --git a/pkgs/applications/audio/pd-plugins/gem/default.nix b/pkgs/applications/audio/pd-plugins/gem/default.nix
index 7bfdb1bd8a8a..5cb308988a4f 100644
--- a/pkgs/applications/audio/pd-plugins/gem/default.nix
+++ b/pkgs/applications/audio/pd-plugins/gem/default.nix
@@ -7,7 +7,7 @@
 , libGL
 , libGLU
 , glew
-, freeglut
+, libglut
 , libv4l
 , libX11
 , file
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     libGL
     libGLU
     glew
-    freeglut
+    libglut
     libv4l
     libX11
   ];
diff --git a/pkgs/applications/audio/puddletag/default.nix b/pkgs/applications/audio/puddletag/default.nix
index 97ea40d7438b..09ed89bb2ba2 100644
--- a/pkgs/applications/audio/puddletag/default.nix
+++ b/pkgs/applications/audio/puddletag/default.nix
@@ -45,7 +45,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    python3.pkgs.pythonRelaxDepsHook
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/audio/sndpeek/default.nix b/pkgs/applications/audio/sndpeek/default.nix
index c65208343aff..7cf8636ad107 100644
--- a/pkgs/applications/audio/sndpeek/default.nix
+++ b/pkgs/applications/audio/sndpeek/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libsndfile, freeglut, alsa-lib, mesa, libGLU, libX11, libXmu
+{ lib, stdenv, fetchurl, libsndfile, libglut, alsa-lib, mesa, libGLU, libX11, libXmu
 , libXext, libXi }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   patches = [ ./pthread.patch ];
 
   buildInputs = [
-    freeglut
+    libglut
     alsa-lib
     mesa
     libGLU
diff --git a/pkgs/applications/backup/unifi-protect-backup/default.nix b/pkgs/applications/backup/unifi-protect-backup/default.nix
index 4981d509e236..fdac36e492f2 100644
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@@ -40,7 +40,6 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python.pkgs; [
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 6af16ffac8a4..9b18e6d13de1 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -92,8 +92,5 @@ rustPlatform.buildRustPackage rec {
     maintainers = with maintainers; [ akru andresilva FlorianFranzen RaghavSood ];
     # See Iso::from_arch in src/isa/mod.rs in cranelift-codegen-meta.
     platforms = intersectLists platforms.unix (platforms.aarch64 ++ platforms.s390x ++ platforms.riscv64 ++ platforms.x86);
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
   };
 }
diff --git a/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix b/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
index 36576f7c1239..391065ccfb20 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
@@ -79,7 +79,8 @@ in {
         lib.nameValuePair ename (
           self.callPackage ({ melpaBuild, fetchurl, ... }@pkgargs:
           melpaBuild {
-            inherit pname ename commit;
+            inherit pname ename;
+            inherit (sourceArgs) commit;
             version = lib.optionalString (version != null)
               (lib.concatStringsSep "." (map toString
                 # Hack: Melpa archives contains versions with parse errors such as [ 4 4 -4 413 ] which should be 4.4-413
diff --git a/pkgs/applications/editors/emacs/sources.nix b/pkgs/applications/editors/emacs/sources.nix
index 487d8a3680a6..da243044b689 100644
--- a/pkgs/applications/editors/emacs/sources.nix
+++ b/pkgs/applications/editors/emacs/sources.nix
@@ -104,10 +104,10 @@ in
 
   emacs29 = import ./make-emacs.nix (mkArgs {
     pname = "emacs";
-    version = "29.3";
+    version = "29.4";
     variant = "mainline";
-    rev = "29.3";
-    hash = "sha256-4yN81djeKb9Hlr6MvaDdXqf4XOl0oolXEYGqkA+KUO0=";
+    rev = "29.4";
+    hash = "sha256-FCP6ySkN9mAdp2T09n6foS2OciqZXc/54guRZ0B4Z2s=";
   });
 
   emacs28-macport = import ./make-emacs.nix (mkArgs {
diff --git a/pkgs/applications/editors/neovim/tests/default.nix b/pkgs/applications/editors/neovim/tests/default.nix
index b07f517ea474..c2e6b565de28 100644
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@@ -43,6 +43,14 @@ let
     '';
   };
 
+  nvim-with-luasnip = wrapNeovim2 "-with-lua-packages" (makeNeovimConfig {
+    plugins = [ {
+        plugin = vimPlugins.luasnip;
+
+      }
+    ];
+  });
+
   nvimAutoDisableWrap = makeNeovimConfig { };
 
   wrapNeovim2 = suffix: config:
@@ -281,4 +289,16 @@ rec {
     export HOME=$TMPDIR
     ${nvim_with_opt_plugin}/bin/nvim -i NONE +quit! -e
   '';
+
+  inherit nvim-with-luasnip;
+
+  # check that bringing in one plugin with lua deps makes those deps visible from wrapper
+  # for instance luasnip has a dependency on jsregexp
+  can_require_transitive_deps =
+    runTest nvim-with-luasnip ''
+    export HOME=$TMPDIR
+    cat ${nvim-with-luasnip}/bin/nvim
+    ${nvim-with-luasnip}/bin/nvim -i NONE --cmd "lua require'jsregexp'" -e
+  '';
+
 })
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index 438c9904829c..9f0aa86de48c 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -245,12 +245,36 @@ let
         fi
       '');
 
+  /*
+    Fork of vimUtils.packDir that additionnally generates a propagated-build-inputs-file that
+    can be used by the lua hooks to generate a proper LUA_PATH
+
+    Generates a packpath folder as expected by vim
+       Example:
+       packDir ( {myVimPackage = { start = [ vimPlugins.vim-fugitive ]; opt = []; }; })
+       => "/nix/store/xxxxx-pack-dir"
+  */
+  packDir = packages:
+  let
+    rawPackDir = vimUtils.packDir packages;
+
+  in
+    rawPackDir.override ({
+    postBuild = ''
+      mkdir $out/nix-support
+      for i in $(find -L $out -name propagated-build-inputs ); do
+        cat "$i" >> $out/nix-support/propagated-build-inputs
+      done
+      '';});
+
+
 in
 {
   inherit makeNeovimConfig;
   inherit generateProviderRc;
   inherit legacyWrapper;
   inherit grammarToPlugin;
+  inherit packDir;
 
   inherit buildNeovimPlugin;
   buildNeovimPluginFrom2Nix = lib.warn "buildNeovimPluginFrom2Nix was renamed to buildNeovimPlugin" buildNeovimPlugin;
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index e877f1e1f764..d86de46c8738 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -13,6 +13,9 @@
 neovim-unwrapped:
 
 let
+  # inherit interpreter from neovim
+  lua = neovim-unwrapped.lua;
+
   wrapper = {
       extraName ? ""
     # should contain all args but the binary. Can be either a string or list
@@ -24,6 +27,8 @@ let
     , withNodeJs ? false
     , withPerl ? false
     , rubyEnv ? null
+
+    # wether to create symlinks in $out/bin/vi(m) -> $out/bin/nvim
     , vimAlias ? false
     , viAlias ? false
 
@@ -45,6 +50,8 @@ let
   stdenv.mkDerivation (finalAttrs:
   let
 
+    finalPackdir = neovimUtils.packDir packpathDirs;
+
     rcContent = ''
       ${luaRcContent}
     '' + lib.optionalString (!isNull neovimRcContent) ''
@@ -57,10 +64,10 @@ let
       # vim accepts a limited number of commands so we join them all
           [
             "--add-flags" ''--cmd "lua ${providerLuaRc}"''
-            # (lib.intersperse "|" hostProviderViml)
-          ] ++ lib.optionals (packpathDirs.myNeovimPackages.start != [] || packpathDirs.myNeovimPackages.opt != []) [
-            "--add-flags" ''--cmd "set packpath^=${vimUtils.packDir packpathDirs}"''
-            "--add-flags" ''--cmd "set rtp^=${vimUtils.packDir packpathDirs}"''
+          ]
+          ++ lib.optionals (packpathDirs.myNeovimPackages.start != [] || packpathDirs.myNeovimPackages.opt != []) [
+            "--add-flags" ''--cmd "set packpath^=${finalPackdir}"''
+            "--add-flags" ''--cmd "set rtp^=${finalPackdir}"''
           ]
           ;
 
@@ -160,7 +167,17 @@ let
       + ''
         rm $out/bin/nvim
         touch $out/rplugin.vim
-        makeWrapper ${lib.escapeShellArgs finalMakeWrapperArgs} ${wrapperArgsStr}
+
+        echo "Looking for lua dependencies..."
+        source ${lua}/nix-support/utils.sh
+
+        _addToLuaPath "${finalPackdir}"
+
+        echo "LUA_PATH towards the end of packdir: $LUA_PATH"
+
+        makeWrapper ${lib.escapeShellArgs finalMakeWrapperArgs} ${wrapperArgsStr} \
+            --prefix LUA_PATH ';' "$LUA_PATH" \
+            --prefix LUA_CPATH ';' "$LUA_CPATH"
       '';
 
     buildPhase = ''
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index d2e3013a782d..50de9c6bfb79 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0412";
+  version = "9.1.0509";
 
   outputs = [ "out" "xxd" ];
 
@@ -8,7 +8,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-uLdXFZ8eW+iMXrvkaEkArZmRfAiyORaEZxFFPt0TrdI=";
+    hash = "sha256-CATjUalRjvVjEfWT5evFAk//Oj4iB1fDBsRU5MhDyn4=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index dfc72683d7d3..54fea4cc901e 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -176,7 +176,7 @@ lib.optionalAttrs (buildScript != null) { builder = buildScript; }
 
   # https://bugs.winehq.org/show_bug.cgi?id=43530
   # https://github.com/NixOS/nixpkgs/issues/31989
-  hardeningDisable = [ "bindnow" ]
+  hardeningDisable = [ "bindnow" "stackclashprotection" ]
     ++ lib.optional (stdenv.hostPlatform.isDarwin) "fortify"
     ++ lib.optional (supportFlags.mingwSupport) "format";
 
diff --git a/pkgs/applications/emulators/yabause/default.nix b/pkgs/applications/emulators/yabause/default.nix
index 53fcc870f1a1..7623cc49efb9 100644
--- a/pkgs/applications/emulators/yabause/default.nix
+++ b/pkgs/applications/emulators/yabause/default.nix
@@ -1,5 +1,5 @@
 { mkDerivation, lib, fetchurl, cmake, pkg-config, qtbase, qt5, libGLU, libGL
-, freeglut ? null, openal ? null, SDL2 ? null }:
+, libglut ? null, openal ? null, SDL2 ? null }:
 
 mkDerivation rec {
   pname = "yabause";
@@ -11,7 +11,7 @@ mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ qtbase qt5.qtmultimedia libGLU libGL freeglut openal SDL2 ];
+  buildInputs = [ qtbase qt5.qtmultimedia libGLU libGL libglut openal SDL2 ];
 
   patches = [
     ./linkage-rwx-linux-elf.patch
diff --git a/pkgs/applications/file-managers/browsr/default.nix b/pkgs/applications/file-managers/browsr/default.nix
index ba88f782ef65..92895378c355 100644
--- a/pkgs/applications/file-managers/browsr/default.nix
+++ b/pkgs/applications/file-managers/browsr/default.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index 99810a8d496f..722363a9b070 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeatureAs (arch != null) "gcc-arch" arch)
     (lib.withFeature librsvgSupport "rsvg")
     (lib.withFeature liblqr1Support "lqr")
-    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript}/share/ghostscript/fonts")
+    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript.fonts}/share/fonts")
     (lib.withFeature ghostscriptSupport "gslib")
   ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
     # due to libxml2 being without DLLs ATM
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 671affec32d5..0819a314bd27 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature librsvgSupport "pango")
     (lib.withFeature liblqr1Support "lqr")
     (lib.withFeature libjxlSupport "jxl")
-    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript}/share/ghostscript/fonts")
+    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript.fonts}/share/fonts")
     (lib.withFeature ghostscriptSupport "gslib")
   ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
     # due to libxml2 being without DLLs ATM
diff --git a/pkgs/applications/graphics/fluxus/default.nix b/pkgs/applications/graphics/fluxus/default.nix
index 5491305fad2c..dfa518c5c574 100644
--- a/pkgs/applications/graphics/fluxus/default.nix
+++ b/pkgs/applications/graphics/fluxus/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitLab
 , alsa-lib
 , fftw
-, freeglut
+, libglut
 , freetype
 , glew
 , libjack2
@@ -33,17 +33,17 @@ stdenv.mkDerivation {
   buildInputs = [
     alsa-lib
     fftw
-    freeglut.dev
+    libglut
     freetype
     glew
     libjack2
-    libjpeg.dev
+    libjpeg
     liblo
-    libsndfile.dev
-    libtiff.dev
+    libsndfile
+    libtiff
     ode
     openal
-    openssl.dev
+    openssl
     racket_7_9
   ];
   nativeBuildInputs = [ scons ];
diff --git a/pkgs/applications/graphics/freepv/default.nix b/pkgs/applications/graphics/freepv/default.nix
index def7e3e9dd86..1ff0fd5146df 100644
--- a/pkgs/applications/graphics/freepv/default.nix
+++ b/pkgs/applications/graphics/freepv/default.nix
@@ -4,7 +4,7 @@
 , libjpeg
 , libGLU
 , libGL
-, freeglut
+, libglut
 , zlib
 , cmake
 , libX11
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ libjpeg libGLU libGL freeglut zlib libX11 libxml2 libpng libXxf86vm ];
+  buildInputs = [ libjpeg libGLU libGL libglut zlib libX11 libxml2 libpng libXxf86vm ];
 
   postPatch = ''
     sed -i -e '/GECKO/d' CMakeLists.txt
diff --git a/pkgs/applications/graphics/opentoonz/default.nix b/pkgs/applications/graphics/opentoonz/default.nix
index 1dd460c2e1d2..a474550820ba 100644
--- a/pkgs/applications/graphics/opentoonz/default.nix
+++ b/pkgs/applications/graphics/opentoonz/default.nix
@@ -1,7 +1,7 @@
 { boost
 , cmake
 , fetchFromGitHub
-, freeglut
+, libglut
 , freetype
 , glew
 , libjpeg
@@ -93,7 +93,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     boost
-    freeglut
+    libglut
     freetype
     glew
     libjpeg
diff --git a/pkgs/applications/misc/archivy/default.nix b/pkgs/applications/misc/archivy/default.nix
index c81d4f65d785..0bb9a89325e5 100644
--- a/pkgs/applications/misc/archivy/default.nix
+++ b/pkgs/applications/misc/archivy/default.nix
@@ -32,7 +32,6 @@ buildPythonApplication rec {
     hash = "sha256-ns1Y0DqqnTAQMEt+oBJ/P2gqKqPsX9P3/Z4561qzuns";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = true;
 
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 3d044abaad6d..0033d3e1bd2a 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -342,10 +342,10 @@ stdenv.mkDerivation (finalAttrs: {
       };
 
     tests = {
-      render = runCommand "${finalAttrs.pname}-test" { } ''
+      render = runCommand "${finalAttrs.pname}-test" {
+        nativeBuildInputs = [ mesa.llvmpipeHook ];
+      } ''
         set -euo pipefail
-        export LIBGL_DRIVERS_PATH=${mesa.drivers}/lib/dri
-        export __EGL_VENDOR_LIBRARY_FILENAMES=${mesa.drivers}/share/glvnd/egl_vendor.d/50_mesa.json
         cat <<'PYTHON' > scene-config.py
         import bpy
         bpy.context.scene.eevee.taa_render_samples = 32
diff --git a/pkgs/applications/misc/dbx/default.nix b/pkgs/applications/misc/dbx/default.nix
index 9dc19941a072..95fd50b1e241 100644
--- a/pkgs/applications/misc/dbx/default.nix
+++ b/pkgs/applications/misc/dbx/default.nix
@@ -30,7 +30,6 @@ python.pkgs.buildPythonApplication rec {
 
   build-system = with python.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs =
     with python.pkgs;
diff --git a/pkgs/applications/misc/icesl/default.nix b/pkgs/applications/misc/icesl/default.nix
index 1a079ab8274c..aeeb82ba581f 100644
--- a/pkgs/applications/misc/icesl/default.nix
+++ b/pkgs/applications/misc/icesl/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, lib, fetchzip, freeglut, libXmu, libXi, libX11, libICE, libGLU, libGL, libSM
+{ stdenv, lib, fetchzip, libglut, libXmu, libXi, libX11, libICE, libGLU, libGL, libSM
 , libXext, glibc, lua, luabind, glfw, libgccjit, dialog, makeWrapper
 }:
 let
-  lpath = lib.makeLibraryPath [ libXmu libXi libX11 freeglut libICE libGLU libGL libSM libXext  glibc lua glfw luabind libgccjit ];
+  lpath = lib.makeLibraryPath [ libXmu libXi libX11 libglut libICE libGLU libGL libSM libXext  glibc lua glfw luabind libgccjit ];
 in
 stdenv.mkDerivation rec {
   pname = "iceSL";
diff --git a/pkgs/applications/misc/lutris/fhsenv.nix b/pkgs/applications/misc/lutris/fhsenv.nix
index c1beb102cdd6..0f2f1e9c0860 100644
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@@ -62,7 +62,7 @@ in buildFHSEnv {
     fontconfig SDL2_ttf
 
     # Mednafen
-    freeglut mesa_glu
+    libglut mesa_glu
 
     # MESS
     expat
diff --git a/pkgs/applications/misc/mupdf/1.17/default.nix b/pkgs/applications/misc/mupdf/1.17/default.nix
index b8cb75b057fd..a3848ccc078b 100644
--- a/pkgs/applications/misc/mupdf/1.17/default.nix
+++ b/pkgs/applications/misc/mupdf/1.17/default.nix
@@ -2,7 +2,7 @@
 , jbig2dec, libjpeg , darwin
 , enableX11 ? true, libX11, libXext, libXi, libXrandr
 , enableCurl ? true, curl, openssl
-, enableGL ? true, freeglut, libGLU
+, enableGL ? true, libglut, libGLU
 }:
 
 let
@@ -33,14 +33,14 @@ in stdenv.mkDerivation rec {
 
   makeFlags = [ "prefix=$(out) USE_SYSTEM_LIBS=yes" ];
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ freetype harfbuzz openjpeg jbig2dec libjpeg freeglut libGLU ]
+  buildInputs = [ freetype harfbuzz openjpeg jbig2dec libjpeg libglut libGLU ]
                 ++ lib.optionals enableX11 [ libX11 libXext libXi libXrandr ]
                 ++ lib.optionals enableCurl [ curl openssl ]
                 ++ lib.optionals enableGL (
                   if stdenv.isDarwin then
                     with darwin.apple_sdk.frameworks; [ GLUT OpenGL ]
                   else
-                    [ freeglut libGLU ])
+                    [ libglut libGLU ])
                 ;
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
diff --git a/pkgs/applications/misc/pagefind/default.nix b/pkgs/applications/misc/pagefind/default.nix
index aa0fb08984ed..2da4e5eb7eb1 100644
--- a/pkgs/applications/misc/pagefind/default.nix
+++ b/pkgs/applications/misc/pagefind/default.nix
@@ -8,7 +8,6 @@
 , gzip
 , nodejs
 , rustc
-, stdenv
 , wasm-bindgen-cli
 , wasm-pack
 }:
@@ -121,9 +120,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ pbsds ];
     platforms = platforms.unix;
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
     mainProgram = "pagefind";
   };
 }
diff --git a/pkgs/applications/misc/pysentation/default.nix b/pkgs/applications/misc/pysentation/default.nix
index ad2d9c02e683..41568d0295b3 100644
--- a/pkgs/applications/misc/pysentation/default.nix
+++ b/pkgs/applications/misc/pysentation/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/misc/rusty-psn/default.nix b/pkgs/applications/misc/rusty-psn/default.nix
index 058e4a9c028a..d72905fe094f 100644
--- a/pkgs/applications/misc/rusty-psn/default.nix
+++ b/pkgs/applications/misc/rusty-psn/default.nix
@@ -56,7 +56,6 @@ rustPlatform.buildRustPackage rec {
     xorg.libXi
     xorg.libxcb
     libGL
-    libGL.dev
   ];
 
   buildNoDefaultFeatures = true;
diff --git a/pkgs/applications/misc/shell-genie/default.nix b/pkgs/applications/misc/shell-genie/default.nix
index 728a4aabed38..df4833199d8c 100644
--- a/pkgs/applications/misc/shell-genie/default.nix
+++ b/pkgs/applications/misc/shell-genie/default.nix
@@ -25,10 +25,6 @@ buildPythonPackage rec {
     poetry-core
   ];
 
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
-
   dependencies = [
     colorama
     openai
diff --git a/pkgs/applications/misc/snagboot/default.nix b/pkgs/applications/misc/snagboot/default.nix
index 353712d5ba89..11f49d8506b5 100644
--- a/pkgs/applications/misc/snagboot/default.nix
+++ b/pkgs/applications/misc/snagboot/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, pythonRelaxDepsHook
 , python3
 , snagboot
 , testers
@@ -21,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/applications/misc/yubioath-flutter/helper.nix b/pkgs/applications/misc/yubioath-flutter/helper.nix
index 2fe6bd7904d7..378981ae8410 100644
--- a/pkgs/applications/misc/yubioath-flutter/helper.nix
+++ b/pkgs/applications/misc/yubioath-flutter/helper.nix
@@ -4,7 +4,6 @@
 , zxing-cpp
 , pillow
 , poetry-core
-, pythonRelaxDepsHook
 
 , src
 , version
@@ -21,7 +20,6 @@ buildPythonApplication {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 3616189374d3..fab1bbdff39e 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -199,7 +199,7 @@ let
       pciutils protobuf speechd libXdamage at-spi2-core
       pipewire
       libva
-      libdrm wayland mesa.drivers libxkbcommon
+      libdrm wayland libxkbcommon
       curl
       libepoxy
       libffi
@@ -227,7 +227,7 @@ let
       pciutils protobuf speechd libXdamage at-spi2-core
       pipewire
       libva
-      libdrm wayland mesa.drivers libxkbcommon
+      libdrm wayland libxkbcommon
       curl
       libepoxy
       libffi
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 81ab6cd1fa17..4d28004a0d0d 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -62,8 +62,8 @@ in
 , glib
 , gnum4
 , gtk3
-, icu
 , icu72
+, icu73
 , libGL
 , libGLU
 , libevent
@@ -487,7 +487,9 @@ buildStdenv.mkDerivation {
   ]
   # icu73 changed how it follows symlinks which breaks in the firefox sandbox
   # https://bugzilla.mozilla.org/show_bug.cgi?id=1839287
-  ++ [ (if (lib.versionAtLeast version "115") then icu else icu72) ]
+  # icu74 fails to build on 127 and older
+  # https://bugzilla.mozilla.org/show_bug.cgi?id=1862601
+  ++ [ (if (lib.versionAtLeast version "115") then icu73 else icu72) ]
   ++ [ (if (lib.versionAtLeast version "116") then nss_latest else nss_esr/*3.90*/) ]
   ++ lib.optional  alsaSupport alsa-lib
   ++ lib.optional  jackSupport libjack2
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 1207a7f02404..c5ee95a8bf1d 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, callPackage, fetchurl, fetchpatch, nixosTests, buildMozillaMach }:
+{ stdenv, lib, callPackage, fetchurl, fetchpatch, nixosTests, buildMozillaMach
+, python311
+}:
 
 {
   firefox = buildMozillaMach rec {
@@ -92,7 +94,7 @@
     };
   };
 
-  firefox-esr-115 = buildMozillaMach rec {
+  firefox-esr-115 = (buildMozillaMach rec {
     pname = "firefox-esr-115";
     version = "115.12.0esr";
     applicationName = "Mozilla Firefox ESR";
@@ -119,5 +121,6 @@
       versionPrefix = "115";
       versionSuffix = "esr";
     };
-  };
+  })
+   .override { python3 = python311; };
 }
diff --git a/pkgs/applications/networking/cluster/tftui/default.nix b/pkgs/applications/networking/cluster/tftui/default.nix
index 9af694c683fd..097476446676 100644
--- a/pkgs/applications/networking/cluster/tftui/default.nix
+++ b/pkgs/applications/networking/cluster/tftui/default.nix
@@ -24,7 +24,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     makeWrapper
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/networking/dyndns/dyndnsc/default.nix b/pkgs/applications/networking/dyndns/dyndnsc/default.nix
index 930fc3460319..18e5847e6709 100644
--- a/pkgs/applications/networking/dyndns/dyndnsc/default.nix
+++ b/pkgs/applications/networking/dyndns/dyndnsc/default.nix
@@ -24,7 +24,6 @@ python3Packages.buildPythonApplication rec {
 
   build-system = with python3Packages; [ setuptools ];
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   dependencies = with python3Packages; [
     daemonocle
diff --git a/pkgs/applications/networking/errbot/default.nix b/pkgs/applications/networking/errbot/default.nix
index c94bbc878018..c635c6fefb2a 100644
--- a/pkgs/applications/networking/errbot/default.nix
+++ b/pkgs/applications/networking/errbot/default.nix
@@ -16,10 +16,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-BmHChLWWnrtg0p4WH8bANwpo+p4RTwjYbXfyPnz6mp8=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   pythonRelaxDeps = true;
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/networking/ids/suricata/default.nix b/pkgs/applications/networking/ids/suricata/default.nix
index 1d1fd579ab73..63a13a26923c 100644
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@@ -125,7 +125,8 @@ stdenv.mkDerivation rec {
     sed -i 's|${builtins.storeDir}/\(.\{8\}\)[^-]*-|${builtins.storeDir}/\1...-|g' ./src/build-info.h
   '';
 
-  hardeningDisable = [ "stackprotector" ];
+  # zerocallusedregs interferes during BPF compilation; TODO: perhaps improve
+  hardeningDisable = [ "stackprotector" "zerocallusedregs" ];
 
   installFlags = [
     "e_datadir=\${TMPDIR}"
diff --git a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
index f12a51d75191..f5118bb96863 100644
--- a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
@@ -24,7 +24,6 @@ python3Packages.buildPythonApplication rec {
     installShellFiles
   ] ++ (with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ]);
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client5.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client5.nix
index 86136dbb36d6..e577aa110fc9 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client5.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client5.nix
@@ -52,7 +52,6 @@ stdenv.mkDerivation rec {
     libnotify
     libpulseaudio
     libxkbcommon
-    mesa.drivers
     nss
     xorg.libX11
     xorg.libXScrnSaver
diff --git a/pkgs/applications/networking/mailreaders/alot/default.nix b/pkgs/applications/networking/mailreaders/alot/default.nix
index cc3273dcdca9..878ecbf4ee5d 100644
--- a/pkgs/applications/networking/mailreaders/alot/default.nix
+++ b/pkgs/applications/networking/mailreaders/alot/default.nix
@@ -1,5 +1,5 @@
 { lib
-, python3
+, python311
 , fetchFromGitHub
 , file
 , gnupg
@@ -9,7 +9,7 @@
 , withManpage ? false
 }:
 
-with python3.pkgs; buildPythonApplication rec {
+with python311.pkgs; buildPythonApplication rec {
   pname = "alot";
   version = "0.10";
 
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index e4da05046a9a..817860120b55 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildMozillaMach, callPackage, fetchurl, fetchpatch, nixosTests, icu, fetchpatch2, config }:
+{ stdenv, lib, buildMozillaMach, callPackage, fetchurl, fetchpatch, nixosTests, icu73, fetchpatch2, config }:
 
 rec {
   thunderbird = thunderbird-115;
@@ -40,7 +40,7 @@ rec {
 
     pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
 
-    icu = icu.overrideAttrs (attrs: {
+    icu73 = icu73.overrideAttrs (attrs: {
       # standardize vtzone output
       # Work around ICU-22132 https://unicode-org.atlassian.net/browse/ICU-22132
       # https://bugzilla.mozilla.org/show_bug.cgi?id=1790071
diff --git a/pkgs/applications/networking/p2p/pyrosimple/default.nix b/pkgs/applications/networking/p2p/pyrosimple/default.nix
index c08f6ae4b64b..21448538edf6 100644
--- a/pkgs/applications/networking/p2p/pyrosimple/default.nix
+++ b/pkgs/applications/networking/p2p/pyrosimple/default.nix
@@ -27,7 +27,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 30e5f7864cd0..b48bd3347ead 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -1,8 +1,9 @@
 { stdenv
 , fetchurl
+, fetchpatch2
 , lib
 , pam
-, python3
+, python311
 , libxslt
 , perl
 , perlPackages
@@ -244,6 +245,11 @@ in stdenv.mkDerivation (finalAttrs: {
     # - the remaining tests have notes in the patch
     # FIXME: get rid of this ASAP
     ./skip-broken-tests.patch
+    (fetchpatch2 {
+      name = "icu74-compat.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-fresh/-/raw/main/libreoffice-7.5.8.2-icu-74-compatibility.patch?ref_type=heads.patch";
+      hash = "sha256-OGBPIVQj8JTYlkKywt4QpH7ULAzKmet5jTLztGpIS0Y=";
+    })
   ] ++ lib.optionals (variant == "still") [
     # Remove build config to reduce the amount of `-dev` outputs in the
     # runtime closure. This behavior was introduced by upstream in commit
@@ -268,6 +274,9 @@ in stdenv.mkDerivation (finalAttrs: {
     substituteInPlace configure.ac --replace-fail \
       'GPGMEPP_CFLAGS=-I/usr/include/gpgme++' \
       'GPGMEPP_CFLAGS=-I${gpgme.dev}/include/gpgme++'
+
+    # Fix for Python 3.12
+    substituteInPlace configure.ac --replace-fail distutils.sysconfig sysconfig
   '';
 
   nativeBuildInputs = [
@@ -372,7 +381,7 @@ in stdenv.mkDerivation (finalAttrs: {
     perl
     poppler
     postgresql
-    python3
+    python311
     sane-backends
     unixODBC
     unzip
diff --git a/pkgs/applications/science/astronomy/celestia/default.nix b/pkgs/applications/science/astronomy/celestia/default.nix
index 8b40196fdbff..3347fa5356b5 100644
--- a/pkgs/applications/science/astronomy/celestia/default.nix
+++ b/pkgs/applications/science/astronomy/celestia/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, freeglut, gtk2, gtkglext
+{ lib, stdenv, fetchFromGitHub, pkg-config, libglut, gtk2, gtkglext
 , libjpeg_turbo, libtheora, libXmu, lua, libGLU, libGL, perl, autoreconfHook
 }:
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
-    freeglut gtk2 gtkglext lua perl
+    libglut gtk2 gtkglext lua perl
     libjpeg_turbo libtheora libXmu libGLU libGL
   ];
 
diff --git a/pkgs/applications/science/biology/macs2/default.nix b/pkgs/applications/science/biology/macs2/default.nix
index 26ec138048f7..153f85535f94 100644
--- a/pkgs/applications/science/biology/macs2/default.nix
+++ b/pkgs/applications/science/biology/macs2/default.nix
@@ -1,9 +1,11 @@
-{ lib, python3, fetchpatch, fetchPypi }:
+{ lib, python311, fetchpatch, fetchPypi }:
 
-python3.pkgs.buildPythonPackage rec {
+# pin python311 because macs2 does not support python 3.12
+# https://github.com/macs3-project/MACS/issues/598#issuecomment-1812622572
+python311.pkgs.buildPythonPackage rec {
   pname = "macs2";
   version = "2.2.9.1";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     pname = lib.toUpper pname;
@@ -20,20 +22,19 @@ python3.pkgs.buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python311.pkgs; [
     cython_0
     numpy
     setuptools
-    wheel
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python311.pkgs; [
     numpy
   ];
 
   __darwinAllowLocalNetworking = true;
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python311.pkgs; [
     unittestCheckHook
   ];
 
diff --git a/pkgs/applications/science/geometry/antiprism/default.nix b/pkgs/applications/science/geometry/antiprism/default.nix
index 62ffc099dc6c..9d4c6fc6a409 100644
--- a/pkgs/applications/science/geometry/antiprism/default.nix
+++ b/pkgs/applications/science/geometry/antiprism/default.nix
@@ -4,7 +4,7 @@
 , libX11
 , libGL
 , libGLU
-, freeglut }:
+, libglut }:
 
 stdenv.mkDerivation rec {
   pname = "antiprism";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libX11 libGLU libGL.dev freeglut.dev ];
+  buildInputs = [ libX11 libGLU libGL libglut ];
 
   meta = with lib; {
     homepage = "https://www.antiprism.com";
diff --git a/pkgs/applications/science/math/glsurf/default.nix b/pkgs/applications/science/math/glsurf/default.nix
index 38caee5805b4..0edaa32babd7 100644
--- a/pkgs/applications/science/math/glsurf/default.nix
+++ b/pkgs/applications/science/math/glsurf/default.nix
@@ -5,7 +5,7 @@
 , makeWrapper
 , libGLU
 , libGL
-, freeglut
+, libglut
 , mpfr
 , gmp
 , pkgsHostTarget
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   ]);
 
   buildInputs = [
-    freeglut
+    libglut
     libGL
     libGLU
     mpfr
diff --git a/pkgs/applications/science/math/sage/sagelib.nix b/pkgs/applications/science/math/sage/sagelib.nix
index 1552de773d01..f54c6a92300c 100644
--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@@ -6,7 +6,6 @@
 , perl
 , pkg-config
 , sage-setup
-, pythonRelaxDepsHook
 , gd
 , iml
 , libpng
@@ -103,7 +102,6 @@ buildPythonPackage rec {
     pip # needed to query installed packages
     pkg-config
     sage-setup
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/science/misc/boinc/default.nix b/pkgs/applications/science/misc/boinc/default.nix
index 0c559a530e08..cd0ebefe067d 100644
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@@ -10,7 +10,7 @@
 , libGL
 , libXmu
 , libXi
-, freeglut
+, libglut
 , libjpeg
 , libtool
 , wxGTK32
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     libGL
     libXmu
     libXi
-    freeglut
+    libglut
     libjpeg
     wxGTK32
     gtk3
diff --git a/pkgs/applications/science/misc/foldingathome/viewer.nix b/pkgs/applications/science/misc/foldingathome/viewer.nix
index 7f28c8d1b146..bb2c3c0abe30 100644
--- a/pkgs/applications/science/misc/foldingathome/viewer.nix
+++ b/pkgs/applications/science/misc/foldingathome/viewer.nix
@@ -2,7 +2,7 @@
 , autoPatchelfHook
 , dpkg
 , fetchurl
-, freeglut
+, libglut
 , gcc-unwrapped
 , libGL
 , libGLU
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    freeglut
+    libglut
     gcc-unwrapped.lib
     libGL
     libGLU
diff --git a/pkgs/applications/terminal-emulators/rio/default.nix b/pkgs/applications/terminal-emulators/rio/default.nix
index 6b68e6bdc0f5..48f175e67e7c 100644
--- a/pkgs/applications/terminal-emulators/rio/default.nix
+++ b/pkgs/applications/terminal-emulators/rio/default.nix
@@ -51,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rio";
-  version = "0.0.39";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     rev = "v${version}";
-    hash = "sha256-pnU2wxgopHMWgJ7JGdO2P/MCfxqCY7MTEE39qtD0XKw=";
+    hash = "sha256-Jp8f8u9CkY+pz6QaoWp6P6+OqsIjhzXH0eeoBiSDR0k=";
   };
 
-  cargoHash = "sha256-GwI2zHX1YcR4pC+qtkDoxx2U+zipbqqxsCI8/XNg2BU=";
+  cargoHash = "sha256-3FirYpHxTRvXgRQACVvmwlaCNTyJ8dLbZ258qv5vbsc=";
 
   nativeBuildInputs = [
     ncurses
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index 303c6d1b77da..8fd39b2f6e7f 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -1,19 +1,21 @@
-{ lib, stdenv, fetchurl, fetchpatch, xorg, ncurses, freetype, fontconfig
+{ lib, stdenv, fetchurl, xorg, ncurses, freetype, fontconfig
 , pkg-config, makeWrapper, nixosTests, gitUpdater
 , nix, gnused, coreutils, enableDecLocator ? true }:
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "390";
+  version = "392";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    hash = "sha256-dRF8PMUXSgnEJe8QbmlATXL17wXgOl2gCq8VeS1vnA8=";
+    hash = "sha256-TVc3LvCOr6n7doLbjQe+D+BRPljoR4wuyOm2JIbn/l4=";
   };
 
+  patches = [ ./sixel-256.support.patch ];
+
   strictDeps = true;
 
   nativeBuildInputs = [ makeWrapper pkg-config fontconfig ];
@@ -32,14 +34,6 @@ stdenv.mkDerivation rec {
     xorg.luit
   ];
 
-  patches = [ ./sixel-256.support.patch ]
-    ++ lib.optional stdenv.hostPlatform.isMusl (fetchpatch {
-      name = "posix-ptys.patch";
-      url =
-        "https://git.alpinelinux.org/aports/plain/community/xterm/posix-ptys.patch?id=3aa532e77875fa1db18c7fcb938b16647031bcc1";
-      sha256 = "0czgnsxkkmkrk1idw69qxbprh0jb4sw3c24zpnqq2v76jkl7zvlr";
-    });
-
   configureFlags = [
     "--enable-wide-chars"
     "--enable-256-color"
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index f0cfc626c4fa..10a2ad2adcbe 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -24,12 +24,12 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   pythonRelaxDeps = [
+    "argcomplete"
     "decli"
   ];
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
     installShellFiles
   ];
 
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index d7e008d656fd..f0386bd4a273 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -29,7 +29,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.45.1";
+  version = "2.45.2";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-5k00Co5ieuIs+4vMZRzKC0l88en99SNzVUT/SnMvEr8=";
+    hash = "sha256-Ub/ofrHAL+0UhAUYdTZe6rIpgx0w0M7F2JoU+eQOmts=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/applications/version-management/git/update.sh b/pkgs/applications/version-management/git/update.sh
index 1f70dcff4294..7aa1e90d53b3 100755
--- a/pkgs/applications/version-management/git/update.sh
+++ b/pkgs/applications/version-management/git/update.sh
@@ -4,7 +4,7 @@
 set -eu -o pipefail
 
 oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion git" | tr -d '"')"
-latestTag="$(git ls-remote --tags --sort="v:refname" https://github.com/git/git.git | grep -v '\{\}' | grep -v '\-rc' | tail -1 | sed 's|^.*/v\(.*\)|\1|')"
+latestTag="$(git ls-remote --tags --sort="v:refname" https://github.com/git/git.git | grep -v '{}' | grep -v '\-rc' | tail -1 | sed 's|^.*/v\(.*\)|\1|')"
 targetVersion="${1:-$latestTag}"
 
 if [ ! "${oldVersion}" = "${targetVersion}" ]; then
diff --git a/pkgs/applications/version-management/gitless/default.nix b/pkgs/applications/version-management/gitless/default.nix
index 8bbb0eee971d..93014402a2eb 100644
--- a/pkgs/applications/version-management/gitless/default.nix
+++ b/pkgs/applications/version-management/gitless/default.nix
@@ -15,7 +15,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-XDB1i2b1reMCM6i1uK3IzTnsoLXO7jldYtNlYUo1AoQ=";
   };
 
-  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
     pygit2
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 25c2df1ad71b..5057e725010e 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -23,11 +23,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.6.3";
+    version = "6.7.4";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-911qSnWCOht9cTpJZ+yi9Zb0ZuWPxrwG1yZCky/X4wc=";
+      hash = "sha256-dHCPhzQFwSJy/sEWxt1Shi6O0RwQARx+V19eqBJj6l4=";
     };
 
     format = "other";
@@ -37,7 +37,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-G5tzwoIGOgpVI35rYXDeelnBgTbAiq7BDcXCHQzqSrs=";
+      hash = "sha256-FRa7frX2z9jQGFBXS2TpOUANs0+xwegNETUAQIU0S4o=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
diff --git a/pkgs/applications/video/animdl/default.nix b/pkgs/applications/video/animdl/default.nix
index c8ba0264e36a..ebe13e8b12e2 100644
--- a/pkgs/applications/video/animdl/default.nix
+++ b/pkgs/applications/video/animdl/default.nix
@@ -2,7 +2,6 @@
   buildPythonApplication,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   anchor-kr,
   anitopy,
   click,
@@ -47,7 +46,6 @@ buildPythonApplication {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
   propagatedBuildInputs = [
     anchor-kr
diff --git a/pkgs/applications/video/kodi/no-python-lib.patch b/pkgs/applications/video/kodi/no-python-lib.patch
new file mode 100644
index 000000000000..d45e02dd1846
--- /dev/null
+++ b/pkgs/applications/video/kodi/no-python-lib.patch
@@ -0,0 +1,13 @@
+diff --git a/cmake/scripts/linux/Install.cmake b/cmake/scripts/linux/Install.cmake
+index 9c45c91774..763d6acab4 100644
+--- a/cmake/scripts/linux/Install.cmake
++++ b/cmake/scripts/linux/Install.cmake
+@@ -199,8 +199,6 @@ install(FILES ${CMAKE_BINARY_DIR}/${CORE_BUILD_DIR}/scripts/${APP_NAME}Config.cm
+ 
+ if(ENABLE_EVENTCLIENTS)
+   find_package(PythonInterpreter REQUIRED)
+-  execute_process(COMMAND ${PYTHON_EXECUTABLE} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(prefix=''))"
+-                  OUTPUT_VARIABLE PYTHON_LIB_PATH OUTPUT_STRIP_TRAILING_WHITESPACE)
+   # Install kodi-eventclients-common BT python files
+   install(PROGRAMS ${CMAKE_SOURCE_DIR}/tools/EventClients/lib/python/bt/__init__.py
+                    ${CMAKE_SOURCE_DIR}/tools/EventClients/lib/python/bt/bt.py
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index e8e5b5844f1f..b3fd8d87881a 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchzip
+{ stdenv, lib, fetchFromGitHub, fetchzip, fetchpatch
 , autoconf, automake, libtool, makeWrapper
 , pkg-config, cmake, yasm, python3Packages
 , libxcrypt, libgcrypt, libgpg-error, libunistring
@@ -97,6 +97,10 @@ in stdenv.mkDerivation (finalAttrs: {
       hash  = "sha256-xrFWqgwTkurEwt3/+/e4SCM6Uk9nxuW62SrCFWWqZO0=";
     };
 
+    patches = [
+      ./no-python-lib.patch
+    ];
+
     # make  derivations declared in the let binding available here, so
     # they can be overridden
     inherit libdvdcss libdvdnav libdvdread groovy
@@ -189,6 +193,7 @@ in stdenv.mkDerivation (finalAttrs: {
       "-DSWIG_EXECUTABLE=${buildPackages.swig}/bin/swig"
       "-DFLATBUFFERS_FLATC_EXECUTABLE=${buildPackages.flatbuffers}/bin/flatc"
       "-DPYTHON_EXECUTABLE=${buildPackages.python3Packages.python}/bin/python"
+      "-DPYTHON_LIB_PATH=${python3Packages.python.sitePackages}"
       # When wrapped KODI_HOME will likely contain symlinks to static assets
       # that Kodi's built in webserver will cautiously refuse to serve up
       # (because their realpaths are outside of KODI_HOME and the other
diff --git a/pkgs/applications/window-managers/herbstluftwm/default.nix b/pkgs/applications/window-managers/herbstluftwm/default.nix
index 825ae0de85e4..a67588fea1fd 100644
--- a/pkgs/applications/window-managers/herbstluftwm/default.nix
+++ b/pkgs/applications/window-managers/herbstluftwm/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, cmake, pkg-config, python3, libX11, libXext, libXinerama, libXrandr, libXft, libXrender, libXdmcp, libXfixes, freetype, asciidoc
-, xdotool, xorgserver, xsetroot, xterm, runtimeShell
+, xdotool, xorg, xsetroot, xterm, runtimeShell
 , fetchpatch
 , nixosTests }:
 
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
   nativeCheckInputs = [
     (python3.withPackages (ps: with ps; [ ewmh pytest xlib ]))
     xdotool
-    xorgserver
+    xorg.xvfb
     xsetroot
     xterm
     python3.pkgs.pytestCheckHook
diff --git a/pkgs/applications/window-managers/i3/default.nix b/pkgs/applications/window-managers/i3/default.nix
index 16dd2e6485e7..8ced173b2223 100644
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, lib, stdenv, pkg-config, makeWrapper, meson, ninja, installShellFiles, libxcb, xcbutilkeysyms
 , xcbutil, xcbutilwm, xcbutilxrm, libstartup_notification, libX11, pcre2, libev
 , yajl, xcb-util-cursor, perl, pango, perlPackages, libxkbcommon
-, xorgserver, xvfb-run
+, xvfb-run
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, findXMLCatalogs
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     libstartup_notification libX11 pcre2 libev yajl xcb-util-cursor perl pango
     perlPackages.AnyEventI3 perlPackages.X11XCB perlPackages.IPCRun
     perlPackages.ExtUtilsPkgConfig perlPackages.InlineC
-    xorgserver xvfb-run
+    xvfb-run
   ];
 
   configureFlags = [ "--disable-builddir" ];
diff --git a/pkgs/build-support/appimage/default.nix b/pkgs/build-support/appimage/default.nix
index 638e29c3bc3b..6451feeabe3c 100644
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@@ -162,7 +162,7 @@ rec {
       vulkan-loader
 
       flac
-      freeglut
+      libglut
       libjpeg
       libpng12
       libpulseaudio
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 2a1fe1344e20..e7fcf173c602 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -45,6 +45,7 @@
     "relro"
     "stackprotector"
     "strictoverflow"
+    "zerocallusedregs"
   ] ++ lib.optional (with stdenvNoCC;
     # Musl-based platforms will keep "pie", other platforms will not.
     # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
diff --git a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
index a1d06b9c6b0a..51bfeb18f58a 100644
--- a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
+++ b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
@@ -7,5 +7,5 @@ for p in "${params[@]}"; do
 done
 
 if $needsTarget; then
-    extraBefore+=(-target @defaultTarget@ @march@)
+    extraBefore+=(-target @defaultTarget@ @machineFlags@)
 fi
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index ef166e2f50c5..0dca3b3347e5 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format trivialautovarinit zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 stackprotector stackclashprotection pie pic strictoverflow format trivialautovarinit zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -79,6 +79,10 @@ for flag in "${!hardeningEnableMap[@]}"; do
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
       hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
       ;;
+    stackclashprotection)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stack-clash-protection >&2; fi
+      hardeningCFlagsBefore+=('-fstack-clash-protection')
+      ;;
     pie)
       # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 4adc1dcb1f8d..d842f3fc7090 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -67,6 +67,7 @@ let
     concatMapStrings
     concatStringsSep
     escapeShellArg
+    escapeShellArgs
     getBin
     getDev
     getLib
@@ -234,6 +235,32 @@ let
        then guess
        else null;
 
+  thumb = if targetPlatform.gcc.thumb then "thumb" else "arm";
+  tune = if targetPlatform ? gcc.tune
+         then findBestTuneApproximation targetPlatform.gcc.tune
+         else null;
+
+  # Machine flags. These are necessary to support
+
+  # TODO: We should make a way to support miscellaneous machine
+  # flags and other gcc flags as well.
+
+  machineFlags =
+    # Always add -march based on cpu in triple. Sometimes there is a
+    # discrepency (x86_64 vs. x86-64), so we provide an "arch" arg in
+    # that case.
+    optional (targetPlatform ? gcc.arch && !(targetPlatform.isDarwin && targetPlatform.isAarch64) && isGccArchSupported targetPlatform.gcc.arch) "-march=${targetPlatform.gcc.arch}" ++
+    # TODO: aarch64-darwin has mcpu incompatible with gcc
+    optional (targetPlatform ? gcc.cpu && !(targetPlatform.isDarwin && targetPlatform.isAarch64)) "-mcpu=${targetPlatform.gcc.cpu}" ++
+    # -mfloat-abi only matters on arm32 but we set it here
+    # unconditionally just in case. If the abi specifically sets hard
+    # vs. soft floats we use it here.
+    optional (targetPlatform ? gcc.float-abi) "-mfloat-abi=${targetPlatform.gcc.float-abi}" ++
+    optional (targetPlatform ? gcc.fpu) "-mfpu=${targetPlatform.gcc.fpu}" ++
+    optional (targetPlatform ? gcc.mode) "-mmode=${targetPlatform.gcc.mode}" ++
+    optional (targetPlatform ? gcc.thumb) "-m${thumb}" ++
+    optional (tune != null) "-mtune=${tune}";
+
   defaultHardeningFlags = bintools.defaultHardeningFlags or [];
 
   # if cc.hardeningUnsupportedFlagsByTargetPlatform exists, this is
@@ -610,53 +637,11 @@ stdenvNoCC.mkDerivation {
       export hardening_unsupported_flags="${concatStringsSep " " ccHardeningUnsupportedFlags}"
     ''
 
-    # Machine flags. These are necessary to support
-
-    # TODO: We should make a way to support miscellaneous machine
-    # flags and other gcc flags as well.
-
-    # Always add -march based on cpu in triple. Sometimes there is a
-    # discrepency (x86_64 vs. x86-64), so we provide an "arch" arg in
-    # that case.
-    #
     # For clang, this is handled in add-clang-cc-cflags-before.sh
-
-    # TODO: aarch64-darwin has mcpu incompatible with gcc
-    + optionalString ((targetPlatform ? gcc.arch) && !isClang && !(targetPlatform.isDarwin && targetPlatform.isAarch64) &&
-                      isGccArchSupported targetPlatform.gcc.arch) ''
-      echo "-march=${targetPlatform.gcc.arch}" >> $out/nix-support/cc-cflags-before
-    ''
-
-    # -mcpu is not very useful, except on PowerPC where it is used
-    # instead of march. On all other platforms you should use mtune
-    # and march instead.
-    # TODO: aarch64-darwin has mcpu incompatible with gcc
-    + optionalString ((targetPlatform ? gcc.cpu) && (isClang || !(targetPlatform.isDarwin && targetPlatform.isAarch64))) ''
-      echo "-mcpu=${targetPlatform.gcc.cpu}" >> $out/nix-support/cc-cflags-before
+    + lib.optionalString (!isClang && machineFlags != []) ''
+      printf "%s\n" ${lib.escapeShellArgs machineFlags} >> $out/nix-support/cc-cflags-before
     ''
 
-    # -mfloat-abi only matters on arm32 but we set it here
-    # unconditionally just in case. If the abi specifically sets hard
-    # vs. soft floats we use it here.
-    + optionalString (targetPlatform ? gcc.float-abi) ''
-      echo "-mfloat-abi=${targetPlatform.gcc.float-abi}" >> $out/nix-support/cc-cflags-before
-    ''
-    + optionalString (targetPlatform ? gcc.fpu) ''
-      echo "-mfpu=${targetPlatform.gcc.fpu}" >> $out/nix-support/cc-cflags-before
-    ''
-    + optionalString (targetPlatform ? gcc.mode) ''
-      echo "-mmode=${targetPlatform.gcc.mode}" >> $out/nix-support/cc-cflags-before
-    ''
-    + optionalString (targetPlatform ? gcc.thumb) ''
-      echo "-m${if targetPlatform.gcc.thumb then "thumb" else "arm"}" >> $out/nix-support/cc-cflags-before
-    ''
-    + (let tune = if targetPlatform ? gcc.tune
-                  then findBestTuneApproximation targetPlatform.gcc.tune
-                  else null;
-      in optionalString (tune != null) ''
-      echo "-mtune=${tune}" >> $out/nix-support/cc-cflags-before
-    '')
-
     # TODO: categorize these and figure out a better place for them
     + optionalString targetPlatform.isWindows ''
       hardening_unsupported_flags+=" pic"
@@ -718,9 +703,7 @@ stdenvNoCC.mkDerivation {
     ##
     + optionalString isClang ''
       # Escape twice: once for this script, once for the one it gets substituted into.
-      export march=${escapeShellArg
-        (optionalString (targetPlatform ? gcc.arch)
-          (escapeShellArg "-march=${targetPlatform.gcc.arch}"))}
+      export machineFlags=${escapeShellArg (escapeShellArgs machineFlags)}
       export defaultTarget=${targetPlatform.config}
       substituteAll ${./add-clang-cc-cflags-before.sh} $out/nix-support/add-local-cc-cflags-before.sh
     ''
diff --git a/pkgs/build-support/emacs/melpa.nix b/pkgs/build-support/emacs/melpa.nix
index c8f656704918..29b3567ec6f4 100644
--- a/pkgs/build-support/emacs/melpa.nix
+++ b/pkgs/build-support/emacs/melpa.nix
@@ -38,6 +38,11 @@ in
     Default: pname
   */
 , ename ? pname
+  /*
+    version: Either a stable version such as "1.2" or an unstable version.
+    An unstable version can use either Nix format (preferred) such as
+    "1.2-unstable-2024-06-01" or MELPA format such as "20240601.1230".
+  */
 , version
   /*
     commit: Optional package history commit.
@@ -71,6 +76,19 @@ genericBuild ({
 
   inherit packageBuild commit ename recipe;
 
+  melpaVersion =
+    let
+      parsed = lib.flip builtins.match version
+        # match <version>-unstable-YYYY-MM-DD format
+        "^.*-unstable-([[:digit:]]{4})-([[:digit:]]{2})-([[:digit:]]{2})$";
+      unstableVersionInNixFormat = parsed != null; # heuristics
+      date = builtins.concatStringsSep "" parsed;
+      time = "0"; # unstable version in nix format lacks this info
+    in
+    if unstableVersionInNixFormat
+    then date + "." + time
+    else version;
+
   preUnpack = ''
     mkdir -p "$NIX_BUILD_TOP/recipes"
     if [ -n "$recipe" ]; then
@@ -96,7 +114,7 @@ genericBuild ({
         -L "$NIX_BUILD_TOP/package-build" \
         -l "$melpa2nix" \
         -f melpa2nix-build-package \
-        $ename $version $commit
+        $ename $melpaVersion $commit
 
     runHook postBuild
     '';
@@ -104,9 +122,9 @@ genericBuild ({
   installPhase = ''
     runHook preInstall
 
-    archive="$NIX_BUILD_TOP/packages/$ename-$version.el"
+    archive="$NIX_BUILD_TOP/packages/$ename-$melpaVersion.el"
     if [ ! -f "$archive" ]; then
-        archive="$NIX_BUILD_TOP/packages/$ename-$version.tar"
+        archive="$NIX_BUILD_TOP/packages/$ename-$melpaVersion.tar"
     fi
 
     emacs --batch -Q \
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index bc28fbf6fc42..a5e722b0ac08 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -218,8 +218,7 @@ let
       buildGoDir() {
         local cmd="$1" dir="$2"
 
-        . $TMPDIR/buildFlagsArray
-
+        declare -ga buildFlagsArray
         declare -a flags
         flags+=($buildFlags "''${buildFlagsArray[@]}")
         flags+=(''${tags:+-tags=''${tags// /,}})
@@ -258,11 +257,6 @@ let
         buildFlagsArray+=(-x)
       fi
 
-      if [ ''${#buildFlagsArray[@]} -ne 0 ]; then
-        declare -p buildFlagsArray > $TMPDIR/buildFlagsArray
-      else
-        touch $TMPDIR/buildFlagsArray
-      fi
       if [ -z "$enableParallelBuilding" ]; then
           export NIX_BUILD_CORES=1
       fi
diff --git a/pkgs/build-support/rust/hooks/maturin-build-hook.sh b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
index b3cc1ced7964..c1e701425f00 100644
--- a/pkgs/build-support/rust/hooks/maturin-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
@@ -3,6 +3,9 @@ maturinBuildHook() {
 
     runHook preBuild
 
+    # Put the wheel to dist/ so that regular Python tooling can find it.
+    local dist="$PWD/dist"
+
     if [ ! -z "${buildAndTestSubdir-}" ]; then
         pushd "${buildAndTestSubdir}"
     fi
@@ -16,6 +19,7 @@ maturinBuildHook() {
         --manylinux off \
         --strip \
         --release \
+        --out "$dist" \
         ${maturinBuildFlags-}
     )
 
@@ -23,10 +27,6 @@ maturinBuildHook() {
         popd
     fi
 
-    # Move the wheel to dist/ so that regular Python tooling can find it.
-    mkdir -p dist
-    mv ${cargoRoot:+$cargoRoot/}target/wheels/*.whl dist/
-
     # These are python build hooks and may depend on ./dist
     runHook postBuild
 
diff --git a/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh b/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
index e103fe77d9be..0b03460eacb6 100644
--- a/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
+++ b/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
@@ -23,10 +23,13 @@ fixDarwinDylibNames() {
     for fn in "$@"; do
         if [ -L "$fn" ]; then continue; fi
         echo "$fn: fixing dylib"
+        set +e
         int_out=$(@targetPrefix@install_name_tool -id "$fn" "${flags[@]}" "$fn" 2>&1)
         result=$?
+        set -e
         if [ "$result" -ne 0 ] &&
-            ! grep "shared library stub file and can't be changed" <<< "$out"
+            ! grep -q -e "shared library stub file and can't be changed" \
+                      -e "is not a Mach-O file" <<< "$int_out"
         then
             echo "$int_out" >&2
             exit "$result"
diff --git a/pkgs/build-support/setup-hooks/install-shell-files.sh b/pkgs/build-support/setup-hooks/install-shell-files.sh
index 194b408b1050..4f4e215da4df 100644
--- a/pkgs/build-support/setup-hooks/install-shell-files.sh
+++ b/pkgs/build-support/setup-hooks/install-shell-files.sh
@@ -219,6 +219,11 @@ installShellCompletion() {
         else
             install -Dm644 -T "$arg" "$outPath"
         fi || return
+
+        if [ ! -s "$outPath" ]; then
+            echo "installShellCompletion: error: installed shell completion file \`$outPath' does not exist or has zero size" >&2
+            return 1
+        fi
         # Clear the per-path flags
         name=
     done
diff --git a/pkgs/by-name/ad/ad-miner/package.nix b/pkgs/by-name/ad/ad-miner/package.nix
index d5d224957a94..b77ecb7256bc 100644
--- a/pkgs/by-name/ad/ad-miner/package.nix
+++ b/pkgs/by-name/ad/ad-miner/package.nix
@@ -22,10 +22,6 @@ python3.pkgs.buildPythonApplication rec {
     poetry-core
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   dependencies = with python3.pkgs; [
     neo4j
     numpy
diff --git a/pkgs/by-name/ai/airlift/package.nix b/pkgs/by-name/ai/airlift/package.nix
index afcd1545aa66..1293a70cdb95 100644
--- a/pkgs/by-name/ai/airlift/package.nix
+++ b/pkgs/by-name/ai/airlift/package.nix
@@ -27,7 +27,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3.pkgs.poetry-core
-    python3.pkgs.pythonRelaxDepsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/al/alsa-plugins/package.nix b/pkgs/by-name/al/alsa-plugins/package.nix
index ababb767955b..bba1944f109e 100644
--- a/pkgs/by-name/al/alsa-plugins/package.nix
+++ b/pkgs/by-name/al/alsa-plugins/package.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-plugins";
-  version = "1.2.7.1";
+  version = "1.2.12";
 
   src = fetchurl {
     url = "mirror://alsa/plugins/${pname}-${version}.tar.bz2";
-    hash = "sha256-jDN4FJVLt8FnRWczpgRhQqKTHxLsy6PsKkrmGKNDJRE=";
+    hash = "sha256-e9ioPTBOji2GoliV2Nyw7wJFqN8y4nGVnNvcavObZvI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/au/audible-cli/package.nix b/pkgs/by-name/au/audible-cli/package.nix
index e9ee1bda75cd..b0026fef4641 100644
--- a/pkgs/by-name/au/audible-cli/package.nix
+++ b/pkgs/by-name/au/audible-cli/package.nix
@@ -13,7 +13,6 @@ python3Packages.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ] ++ [
     installShellFiles
diff --git a/pkgs/by-name/au/audiness/package.nix b/pkgs/by-name/au/audiness/package.nix
index f1f64afb3140..8ad9d6397341 100644
--- a/pkgs/by-name/au/audiness/package.nix
+++ b/pkgs/by-name/au/audiness/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies =
     with python3.pkgs;
diff --git a/pkgs/by-name/aw/aws-gate/package.nix b/pkgs/by-name/aw/aws-gate/package.nix
index cafe14c611bd..1561d1c17a92 100644
--- a/pkgs/by-name/aw/aws-gate/package.nix
+++ b/pkgs/by-name/aw/aws-gate/package.nix
@@ -27,7 +27,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     installShellFiles
-    python3Packages.pythonRelaxDepsHook
     python3Packages.setuptools
     python3Packages.wheel
   ];
diff --git a/pkgs/by-name/ba/backgroundremover/package.nix b/pkgs/by-name/ba/backgroundremover/package.nix
index 67c2f2eaa6a8..3ee27b692393 100644
--- a/pkgs/by-name/ba/backgroundremover/package.nix
+++ b/pkgs/by-name/ba/backgroundremover/package.nix
@@ -32,7 +32,7 @@ let
         --replace 'os.path.expanduser(os.path.join("~", ".u2net", model_name + ".pth"))' "os.path.join(\"$models\", model_name + \".pth\")"
     '';
 
-    nativeBuildInputs = [ p.setuptools p.wheel p.pythonRelaxDepsHook ];
+    nativeBuildInputs = [ p.setuptools p.wheel ];
 
     pythonRelaxDeps = [ "pillow" "torchvision" ];
 
diff --git a/pkgs/by-name/ch/charmcraft/package.nix b/pkgs/by-name/ch/charmcraft/package.nix
index a78fb1c3557f..6c340102a502 100644
--- a/pkgs/by-name/ch/charmcraft/package.nix
+++ b/pkgs/by-name/ch/charmcraft/package.nix
@@ -45,7 +45,6 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/ch/chow-kick/package.nix b/pkgs/by-name/ch/chow-kick/package.nix
index 4998d2d38a28..990422f0ef4b 100644
--- a/pkgs/by-name/ch/chow-kick/package.nix
+++ b/pkgs/by-name/ch/chow-kick/package.nix
@@ -6,7 +6,7 @@
 , dbus
 , libepoxy
 , fetchFromGitHub
-, freeglut
+, libglut
 , freetype
 , gtk2-x11
 , lib
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     dbus
     libepoxy
-    freeglut
+    libglut
     freetype
     gtk2-x11
     libGL
diff --git a/pkgs/by-name/ch/chow-phaser/package.nix b/pkgs/by-name/ch/chow-phaser/package.nix
index 23cfe684d81f..fd329070d0aa 100644
--- a/pkgs/by-name/ch/chow-phaser/package.nix
+++ b/pkgs/by-name/ch/chow-phaser/package.nix
@@ -1,4 +1,4 @@
-{ alsa-lib, at-spi2-core, cmake, curl, dbus, libepoxy, fetchFromGitHub, freeglut
+{ alsa-lib, at-spi2-core, cmake, curl, dbus, libepoxy, fetchFromGitHub, libglut
 , freetype, gcc-unwrapped, gtk3, lib, libGL, libXcursor, libXdmcp, libXext
 , libXinerama, libXrandr, libXtst, libdatrie, libjack2, libpsl, libselinux
 , libsepol, libsysprof-capture, libthai, libxkbcommon, pcre, pkg-config
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     dbus
     libepoxy
-    freeglut
+    libglut
     freetype
     gtk3
     libGL
diff --git a/pkgs/by-name/ch/chow-tape-model/package.nix b/pkgs/by-name/ch/chow-tape-model/package.nix
index 44fc35073d36..89c58fcaf4b1 100644
--- a/pkgs/by-name/ch/chow-tape-model/package.nix
+++ b/pkgs/by-name/ch/chow-tape-model/package.nix
@@ -5,7 +5,7 @@
 , dbus
 , libepoxy
 , fetchFromGitHub
-, freeglut
+, libglut
 , freetype
 , gtk3
 , lib
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     dbus
     libepoxy
-    freeglut
+    libglut
     freetype
     gtk3
     libGL
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index 5c2a9983d627..c03c1055f724 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.29.3";
+  version = "3.29.6";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-JSruFEjUnKoElU/V4n0YndUVcFVzE+eygWNnFqI4vMs=";
+    hash = "sha256-E5ExMAO4PUjiqxFai1JaVX942MFURhi0jR2QGEoQ8K8=";
   };
 
   patches = [
@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by libc_dev ${lib.getDev stdenv.cc.libc} \
       --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
     # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
-    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags"
+    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags $cmakeFlags"
   '';
 
   # The configuration script is not autoconf-based, although being similar;
diff --git a/pkgs/by-name/co/corrscope/package.nix b/pkgs/by-name/co/corrscope/package.nix
index 8b8607d723a6..0148ab90eb07 100644
--- a/pkgs/by-name/co/corrscope/package.nix
+++ b/pkgs/by-name/co/corrscope/package.nix
@@ -26,7 +26,6 @@ python3Packages.buildPythonApplication rec {
     wrapQtAppsHook
   ]) ++ (with python3Packages; [
     poetry-core
-    pythonRelaxDepsHook
   ]);
 
   buildInputs = [
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index 8120fcc61e16..2fc1f95082d9 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -97,7 +97,7 @@ rustPlatform.buildRustPackage rec {
     wrapProgram "$out/bin/${pname}" \
       --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
-        xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr vulkan-loader libxkbcommon mesa.drivers wayland
+        xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr vulkan-loader libxkbcommon wayland
       ]}
   '';
 
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 1a89a00a2301..fb4eb787cb70 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -86,7 +86,6 @@ rustPlatform.buildRustPackage rec {
           xorg.libXrandr
           libxkbcommon
           vulkan-loader
-          mesa.drivers
         ]
       }
   '';
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index 9a0453e0ee2e..b2bcf3ebccbc 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -99,7 +99,6 @@ rustPlatform.buildRustPackage rec {
       --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
         libxkbcommon
-        mesa.drivers
         vulkan-loader
         xorg.libX11
         xorg.libXcursor
diff --git a/pkgs/by-name/cu/cups-printers/package.nix b/pkgs/by-name/cu/cups-printers/package.nix
index 50af156ff668..b6e124fef07d 100644
--- a/pkgs/by-name/cu/cups-printers/package.nix
+++ b/pkgs/by-name/cu/cups-printers/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies =
     with python3.pkgs;
diff --git a/pkgs/by-name/do/donpapi/package.nix b/pkgs/by-name/do/donpapi/package.nix
index 1271d67d398f..c2a777b3dc43 100644
--- a/pkgs/by-name/do/donpapi/package.nix
+++ b/pkgs/by-name/do/donpapi/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/do/dooit/package.nix b/pkgs/by-name/do/dooit/package.nix
index b8fae74dd85e..ea549fff7196 100644
--- a/pkgs/by-name/do/dooit/package.nix
+++ b/pkgs/by-name/do/dooit/package.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/filesystems/f2fs-tools/f2fs-tools-cross-fix.patch b/pkgs/by-name/f2/f2fs-tools/f2fs-tools-cross-fix.patch
index e01a97b0bc3c..e01a97b0bc3c 100644
--- a/pkgs/tools/filesystems/f2fs-tools/f2fs-tools-cross-fix.patch
+++ b/pkgs/by-name/f2/f2fs-tools/f2fs-tools-cross-fix.patch
diff --git a/pkgs/tools/filesystems/f2fs-tools/default.nix b/pkgs/by-name/f2/f2fs-tools/package.nix
index 2a913be9fa80..0c91e41da45f 100644
--- a/pkgs/tools/filesystems/f2fs-tools/default.nix
+++ b/pkgs/by-name/f2/f2fs-tools/package.nix
@@ -1,5 +1,14 @@
-{ lib, stdenv, fetchzip, fetchpatch
-, autoreconfHook, libselinux, libuuid, pkg-config
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchpatch,
+  autoreconfHook,
+  libselinux,
+  libuuid,
+  pkg-config,
+  lz4,
+  lzo,
 }:
 
 stdenv.mkDerivation rec {
@@ -11,8 +20,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-zNG1F//+BTBzlEc6qNVixyuCB6PMZD5Kf8pVK0ePYiA=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libselinux libuuid ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+  buildInputs = [
+    libselinux
+    libuuid
+    lz4
+    lzo
+  ];
 
   patches = [
     ./f2fs-tools-cross-fix.patch
@@ -24,11 +41,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git/";
     description = "Userland tools for the f2fs filesystem";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ehmry jagajaga ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      ehmry
+      jagajaga
+    ];
   };
 }
diff --git a/pkgs/by-name/fl/flite/package.nix b/pkgs/by-name/fl/flite/package.nix
new file mode 100644
index 000000000000..f39e1257185a
--- /dev/null
+++ b/pkgs/by-name/fl/flite/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  alsa-lib,
+  libpulseaudio,
+  testers,
+  audioBackend ? "pulseaudio",
+}:
+assert lib.assertOneOf "audioBackend" audioBackend [
+  "alsa"
+  "pulseaudio"
+];
+stdenv.mkDerivation (finalAttrs: {
+  pname = "flite";
+  version = "2.2";
+
+  outputs = [
+    "bin"
+    "dev"
+    "lib"
+    "out"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "festvox";
+    repo = "flite";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Tq5pyg3TiQt8CPqGXTyLOaGgaeLTmPp+Duw3+2VAF9g=";
+  };
+
+  # https://github.com/festvox/flite/pull/60.
+  # Replaces `ar` with `$(AR)` in config/common_make_rules.
+  # Improves cross-compilation compatibility.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/festvox/flite/commit/54c65164840777326bbb83517568e38a128122ef.patch";
+      hash = "sha256-hvKzdX7adiqd9D+9DbnfNdqEULg1Hhqe1xElYxNM1B8=";
+    })
+  ];
+
+  buildInputs = lib.optional stdenv.isLinux (
+    {
+      alsa = alsa-lib;
+      pulseaudio = libpulseaudio;
+    }
+    .${audioBackend} or (throw "${audioBackend} is not a supported backend!")
+  );
+
+  configureFlags = [
+    "--enable-shared"
+  ] ++ lib.optionals stdenv.isLinux [ "--with-audio=${audioBackend}" ];
+
+  # main/Makefile creates and removes 'flite_voice_list.c' from multiple targets:
+  # make[1]: *** No rule to make target 'flite_voice_list.c', needed by 'all'.  Stop
+  enableParallelBuilding = false;
+
+  passthru = {
+    tests.version = testers.testVersion {
+      # `flite` does have a `--version` command, but it returns 1
+      command = "flite --help";
+      package = finalAttrs.finalPackage;
+    };
+  };
+
+  meta = {
+    description = "Small, fast run-time speech synthesis engine";
+    homepage = "http://www.festvox.org/flite/";
+    license = lib.licenses.bsdOriginal;
+    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "flite";
+  };
+})
diff --git a/pkgs/by-name/fl/flye/aarch64-fix.patch b/pkgs/by-name/fl/flye/aarch64-fix.patch
deleted file mode 100644
index 02588fc63e21..000000000000
--- a/pkgs/by-name/fl/flye/aarch64-fix.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 75f62aed..91b9571b 100644
---- a/Makefile
-+++ b/Makefile
-@@ -16,6 +16,10 @@ ifeq ($(shell uname -m),arm64)
- 	export aarch64=1
- endif
- 
-+ifeq ($(shell uname -m),aarch64)
-+	export aarch64=1
-+endif
-+
- .PHONY: clean all profile debug minimap2 samtools
- 
- .DEFAULT_GOAL := all
diff --git a/pkgs/by-name/fl/flye/package.nix b/pkgs/by-name/fl/flye/package.nix
index 76ea84a1c9a0..41e098609597 100644
--- a/pkgs/by-name/fl/flye/package.nix
+++ b/pkgs/by-name/fl/flye/package.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , python3Packages
 , zlib
 , curl
@@ -11,6 +12,7 @@
 python3Packages.buildPythonApplication rec {
   pname = "flye";
   version = "2.9.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fenderglass";
@@ -19,7 +21,33 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-lwiY0VTEsLMMXt1VowsS3jj44v30Z766xNRwQtQKr10=";
   };
 
-  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
+  patches = [
+    (fetchpatch {
+      # https://github.com/mikolmogorov/Flye/pull/691
+      name = "aarch64-fix.patch";
+      url = "https://github.com/mikolmogorov/Flye/commit/e4dcc3fdf0fa1430a974fcd7da31b03ea642df9b.patch";
+      hash = "sha256-Ny2daPt8eYOKnwZ6bdBoCcFWhe9eiIHF4vJU/occwU0=";
+    })
+    (fetchpatch {
+      # https://github.com/mikolmogorov/Flye/pull/711
+      name = "remove-distutils.patch";
+      url = "https://github.com/mikolmogorov/Flye/commit/fb34f1ccfdf569d186a4ce822ee18eced736636b.patch";
+      hash = "sha256-52bnZ8XyP0HsY2OpNYMU3xJgotNVdQc/O2w3XIReUdQ=";
+    })
+    (fetchpatch {
+      # https://github.com/mikolmogorov/Flye/pull/670
+      name = "remove-find_module.patch";
+      url = "https://github.com/mikolmogorov/Flye/commit/441b1c6eb0f60b7c4fb1a40d659c7dabb7ad41b6.patch";
+      hash = "sha256-RytFIN1STK33/nvXpck6woQcwV/e1fmA8AgmptiIiDU=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace flye/polishing/alignment.py \
+      --replace-fail "/bin/bash" "${lib.getExe bash}"
+  '';
+
+  build-system = [ python3Packages.setuptools ];
 
   propagatedBuildInputs = [ coreutils ];
 
@@ -29,22 +57,18 @@ python3Packages.buildPythonApplication rec {
     libdeflate
   ];
 
-  patches = [ ./aarch64-fix.patch ];
+  pythonImportsCheck = [ "flye" ];
 
-  postPatch = ''
-    substituteInPlace flye/polishing/alignment.py \
-      --replace-fail "/bin/bash" "${lib.getExe bash}"
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
 
-    substituteInPlace flye/tests/test_toy.py \
-      --replace-fail "find_executable(\"flye" "find_executable(\"$out/bin/flye" \
-      --replace-fail "[\"flye" "[\"$out/bin/flye"
+  preCheck = ''
+    export PATH=$out/bin:$PATH
   '';
 
   meta = with lib; {
     description = "De novo assembler for single molecule sequencing reads using repeat graphs";
     homepage = "https://github.com/fenderglass/Flye";
     license = licenses.bsd3;
-    platforms = platforms.unix;
     mainProgram = "flye";
     maintainers = with maintainers; [ assistant ];
   };
diff --git a/pkgs/by-name/fr/fritz-exporter/package.nix b/pkgs/by-name/fr/fritz-exporter/package.nix
index d79b74eb9a2b..ee4099d207fc 100644
--- a/pkgs/by-name/fr/fritz-exporter/package.nix
+++ b/pkgs/by-name/fr/fritz-exporter/package.nix
@@ -20,6 +20,10 @@ python3.pkgs.buildPythonApplication rec {
     sed -i "/^addopts/d" pyproject.toml
   '';
 
+  pythonRelaxDeps = [
+    "defusedxml"
+  ];
+
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/by-name/gc/gcp-scanner/package.nix b/pkgs/by-name/gc/gcp-scanner/package.nix
index a577790d16a6..0e16965f63f0 100644
--- a/pkgs/by-name/gc/gcp-scanner/package.nix
+++ b/pkgs/by-name/gc/gcp-scanner/package.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     setuptools
     setuptools-git-versioning
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/gh/ghunt/package.nix b/pkgs/by-name/gh/ghunt/package.nix
index 8f26785bda8f..580f3a5e2847 100644
--- a/pkgs/by-name/gh/ghunt/package.nix
+++ b/pkgs/by-name/gh/ghunt/package.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
   pythonRelaxDeps = true;
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix b/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
index b3f2528ce2a2..d9ea3eeb4787 100644
--- a/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
+++ b/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [ ha-mqtt-discoverable ];
 
diff --git a/pkgs/by-name/ha/hatch/package.nix b/pkgs/by-name/ha/hatch/package.nix
index 06f2911faafb..c3c760abafec 100644
--- a/pkgs/by-name/ha/hatch/package.nix
+++ b/pkgs/by-name/ha/hatch/package.nix
@@ -4,26 +4,23 @@
 , python3
 , cargo
 , git
+, uv
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hatch";
-  version = "1.9.7";
+  version = "1.12.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Gae4IXn5Tyrd2612qn5lq5DK1VqxA9U4J2N5NcnmYkw=";
+    hash = "sha256-roBHjRAxLfK0TWWck7wu1NM67N3OS3Y3gjG9+ByL9q0=";
   };
 
-  postPatch = ''
-    # Loosen hatchling runtime version dependency
-    sed -i 's/hatchling<1.22/hatchling/' pyproject.toml
-  '';
-
   nativeBuildInputs = with python3.pkgs; [
     hatchling
     hatch-vcs
+    uv
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -62,25 +59,15 @@ python3.pkgs.buildPythonApplication rec {
   disabledTests = [
     # AssertionError: assert (1980, 1, 2, 0, 0, 0) == (2020, 2, 2, 0, 0, 0)
     "test_default"
-    "test_explicit_path"
-    "test_default_auto_detection"
-    "test_editable_default"
-    "test_editable_default_extra_dependencies"
-    "test_editable_default_force_include"
-    "test_editable_default_force_include_option"
-    "test_editable_exact"
-    "test_editable_exact_extra_dependencies"
-    "test_editable_exact_force_include"
-    "test_editable_exact_force_include_option"
-    "test_editable_exact_force_include_build_data_precedence"
-    "test_editable_pth"
-    # expects sh, finds bash
-    "test_all"
-    "test_already_installed_update_flag"
-    "test_already_installed_update_prompt"
     # Loosen hatchling runtime version dependency
     "test_core"
-    "test_correct"
+    # New failing
+    "test_guess_variant"
+    "test_open"
+    "test_no_open"
+    "test_uv_env"
+    "test_pyenv"
+    "test_pypirc"
   ] ++ lib.optionals stdenv.isDarwin [
     # https://github.com/NixOS/nixpkgs/issues/209358
     "test_scripts_no_environment"
diff --git a/pkgs/by-name/he/hekatomb/package.nix b/pkgs/by-name/he/hekatomb/package.nix
index 1d9df3a03215..0b6e708f65b2 100644
--- a/pkgs/by-name/he/hekatomb/package.nix
+++ b/pkgs/by-name/he/hekatomb/package.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/ho/homeassistant-satellite/package.nix b/pkgs/by-name/ho/homeassistant-satellite/package.nix
index c5a6026d8ec3..cf69238d8af5 100644
--- a/pkgs/by-name/ho/homeassistant-satellite/package.nix
+++ b/pkgs/by-name/ho/homeassistant-satellite/package.nix
@@ -16,7 +16,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/ic/icloudpd/package.nix b/pkgs/by-name/ic/icloudpd/package.nix
index e345ca65c7ad..ea7386c4e8d8 100644
--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@@ -20,10 +20,6 @@ python3Packages.buildPythonApplication rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
-  ];
-
   propagatedBuildInputs = with python3Packages; [
     wheel
     setuptools
diff --git a/pkgs/by-name/ir/irrd/package.nix b/pkgs/by-name/ir/irrd/package.nix
index ba62bf6e6cc2..b6d323129abd 100644
--- a/pkgs/by-name/ir/irrd/package.nix
+++ b/pkgs/by-name/ir/irrd/package.nix
@@ -76,7 +76,6 @@ py.pkgs.buildPythonPackage rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/by-name/ja/jasper/package.nix b/pkgs/by-name/ja/jasper/package.nix
index 11a298208f56..ad364086efa9 100644
--- a/pkgs/by-name/ja/jasper/package.nix
+++ b/pkgs/by-name/ja/jasper/package.nix
@@ -1,10 +1,11 @@
 { lib
 , cmake
 , fetchFromGitHub
-, freeglut
+, libglut
 , libGL
 , libheif
 , libjpeg
+, darwin
 , pkg-config
 , stdenv
 , enableHEIFCodec ? true
@@ -36,8 +37,10 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals enableJPGCodec [
     libjpeg
   ] ++ lib.optionals enableOpenGL [
-    freeglut
+    libglut
     libGL
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.apple_sdk.frameworks.Cocoa
   ];
 
   # Since "build" already exists and is populated, cmake tries to use it,
@@ -55,6 +58,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  # The value of __STDC_VERSION__ cannot be automatically determined when cross-compiling
+  # https://github.com/jasper-software/jasper/blob/87668487/CMakeLists.txt#L415
+  # workaround taken from
+  # https://github.com/openembedded/meta-openembedded/blob/907b9c0a/meta-oe/recipes-graphics/jasper/jasper_4.1.1.bb#L16
+  preConfigure = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    cmakeFlagsArray+=(-DJAS_STDC_VERSION="$(echo __STDC_VERSION__ | $CXX -E -P -)")
+  '';
+
   meta = {
     homepage = "https://jasper-software.github.io/jasper/";
     description = "Image processing/coding toolkit";
@@ -79,9 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "jasper";
     maintainers = with lib.maintainers; [ AndersonTorres ];
     platforms = lib.platforms.unix;
-    # The value of __STDC_VERSION__ cannot be automatically determined when
-    # cross-compiling.
-    broken = stdenv.buildPlatform != stdenv.hostPlatform;
   };
 })
 # TODO: investigate opengl support
diff --git a/pkgs/by-name/ki/kikit/solidpython/default.nix b/pkgs/by-name/ki/kikit/solidpython/default.nix
index 2244166bbfea..777f4db9c2bb 100644
--- a/pkgs/by-name/ki/kikit/solidpython/default.nix
+++ b/pkgs/by-name/ki/kikit/solidpython/default.nix
@@ -2,7 +2,6 @@
 { buildPythonPackage
 , fetchFromGitHub
 , lib
-, pythonRelaxDepsHook
 
 , poetry-core
 , prettytable
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/ko/koodousfinder/package.nix b/pkgs/by-name/ko/koodousfinder/package.nix
index 103863b76ee3..b6602e2c6000 100644
--- a/pkgs/by-name/ko/koodousfinder/package.nix
+++ b/pkgs/by-name/ko/koodousfinder/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     keyring
diff --git a/pkgs/by-name/kr/krbjack/package.nix b/pkgs/by-name/kr/krbjack/package.nix
index a26b55144277..bd7455cef9a4 100644
--- a/pkgs/by-name/kr/krbjack/package.nix
+++ b/pkgs/by-name/kr/krbjack/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
     poetry-core
   ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     colorama
diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix
index c122f840df32..6795a5bf5cfd 100644
--- a/pkgs/by-name/li/libcamera/package.nix
+++ b/pkgs/by-name/li/libcamera/package.nix
@@ -25,18 +25,18 @@
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-x0Im9m9MoACJhQKorMI34YQ+/bd62NdAPc2nWwaJAvM=";
+    hash = "sha256-eCtOtdjpwn0S56ZyRVdG1QCBk1KGPh8YTXD50xev7Bc=";
   };
 
   outputs = [ "out" "dev" ];
 
   postPatch = ''
-    patchShebangs utils/
+    patchShebangs src/py/ utils/
   '';
 
   # libcamera signs the IPA module libraries at install time, but they are then
@@ -81,6 +81,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     python3Packages.jinja2
+    python3Packages.pybind11
     python3Packages.pyyaml
     python3Packages.ply
     python3Packages.sphinx
diff --git a/pkgs/by-name/li/linux-wallpaperengine/package.nix b/pkgs/by-name/li/linux-wallpaperengine/package.nix
index 02838ccb83cc..0ec85d195db7 100644
--- a/pkgs/by-name/li/linux-wallpaperengine/package.nix
+++ b/pkgs/by-name/li/linux-wallpaperengine/package.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , ffmpeg
-, freeglut
+, libglut
 , freeimage
 , glew
 , glfw
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     ffmpeg
-    freeglut
+    libglut
     freeimage
     glew
     glfw
diff --git a/pkgs/by-name/ma/malwoverview/package.nix b/pkgs/by-name/ma/malwoverview/package.nix
index 853aeab3bb71..02a5fc015162 100644
--- a/pkgs/by-name/ma/malwoverview/package.nix
+++ b/pkgs/by-name/ma/malwoverview/package.nix
@@ -19,10 +19,6 @@ python3.pkgs.buildPythonApplication rec {
     "pathlib"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   build-system  = with python3.pkgs; [
     setuptools
   ];
diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix
index 6646a8ec0980..f93d6de6fb76 100644
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@@ -39,7 +39,6 @@ in pythonpkgs.buildPythonPackage rec {
 
   nativeBuildInputs = [
     pythonpkgs.poetry-core
-    pythonpkgs.pythonRelaxDepsHook
     makeWrapper
   ];
 
diff --git a/pkgs/by-name/me/mednafen/package.nix b/pkgs/by-name/me/mednafen/package.nix
index f3e0f8478c08..88079e48155d 100644
--- a/pkgs/by-name/me/mednafen/package.nix
+++ b/pkgs/by-name/me/mednafen/package.nix
@@ -5,7 +5,7 @@
   alsa-lib,
   fetchurl,
   flac,
-  freeglut,
+  libglut,
   libGL,
   libGLU,
   libX11,
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     SDL2
     SDL2_net
     flac
-    freeglut
+    libglut
     libcdio
     libjack2
     libsamplerate
diff --git a/pkgs/by-name/mo/mokuro/package.nix b/pkgs/by-name/mo/mokuro/package.nix
index 95054f371480..1fb6ca5443b4 100644
--- a/pkgs/by-name/mo/mokuro/package.nix
+++ b/pkgs/by-name/mo/mokuro/package.nix
@@ -22,7 +22,6 @@ python3Packages.buildPythonApplication rec {
         --replace-fail 'opencv-python' 'opencv'
   '';
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "torchvision" ];
 
diff --git a/pkgs/by-name/mo/mov-cli/package.nix b/pkgs/by-name/mo/mov-cli/package.nix
index 05691e619285..16244793662e 100644
--- a/pkgs/by-name/mo/mov-cli/package.nix
+++ b/pkgs/by-name/mo/mov-cli/package.nix
@@ -35,10 +35,6 @@ python3.pkgs.buildPythonPackage {
     tldextract
   ];
 
-  nativeBuildInputs = [
-    python3.pkgs.pythonRelaxDepsHook
-  ];
-
   pythonRelaxDeps = [
     "httpx"
     "tldextract"
diff --git a/pkgs/by-name/ng/nginx-language-server/package.nix b/pkgs/by-name/ng/nginx-language-server/package.nix
index 891d6e4d5cb6..39a5a55f5abd 100644
--- a/pkgs/by-name/ng/nginx-language-server/package.nix
+++ b/pkgs/by-name/ng/nginx-language-server/package.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/no/normcap/package.nix b/pkgs/by-name/no/normcap/package.nix
index a7c349a7a356..e862247b0df5 100644
--- a/pkgs/by-name/no/normcap/package.nix
+++ b/pkgs/by-name/no/normcap/package.nix
@@ -52,7 +52,6 @@ ps.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    ps.pythonRelaxDepsHook
     ps.hatchling
     ps.babel
   ];
@@ -76,7 +75,7 @@ ps.buildPythonApplication rec {
     ps.toml
   ] ++ lib.optionals stdenv.isLinux [
     ps.pytest-xvfb
-    xorg.xorgserver
+    xorg.xvfb
   ];
 
   preCheck = ''
diff --git a/pkgs/by-name/on/onthespot/package.nix b/pkgs/by-name/on/onthespot/package.nix
index 138ac6e94b7c..696a7e51f78e 100644
--- a/pkgs/by-name/on/onthespot/package.nix
+++ b/pkgs/by-name/on/onthespot/package.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     copyDesktopItems
-    pythonRelaxDepsHook
     libsForQt5.wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 90bda880211d..bffa3c7d3e1c 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -122,7 +122,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ hatchling ];
 
-  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
 
   pythonImportsCheck = [ "open_webui" ];
 
diff --git a/pkgs/by-name/op/opencomposite/package.nix b/pkgs/by-name/op/opencomposite/package.nix
index 173e4b05d76f..40bc6f785839 100644
--- a/pkgs/by-name/op/opencomposite/package.nix
+++ b/pkgs/by-name/op/opencomposite/package.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation {
   cmakeFlags = [
     (lib.cmakeBool "USE_SYSTEM_OPENXR" true)
     (lib.cmakeBool "USE_SYSTEM_GLM" true)
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DGLM_ENABLE_EXPERIMENTAL")
     # debug logging macros cause format-security warnings
     (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-Wno-error=format-security")
   ];
diff --git a/pkgs/by-name/op/openctm/package.nix b/pkgs/by-name/op/openctm/package.nix
index e255e209111d..169e4469abcd 100644
--- a/pkgs/by-name/op/openctm/package.nix
+++ b/pkgs/by-name/op/openctm/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   pkg-config,
-  freeglut,
+  libglut,
   gtk2,
   libGLU,
 }:
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
-    freeglut
+    libglut
     gtk2
     libGLU
   ];
diff --git a/pkgs/by-name/op/openscad-unstable/package.nix b/pkgs/by-name/op/openscad-unstable/package.nix
index 1e14580b42bb..09514490ebf9 100644
--- a/pkgs/by-name/op/openscad-unstable/package.nix
+++ b/pkgs/by-name/op/openscad-unstable/package.nix
@@ -149,11 +149,14 @@ clangStdenv.mkDerivation rec {
     "-DCMAKE_EXE_LINKER_FLAGS=-fuse-ld=lld"
     "-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON"
   ];
+
   doCheck = true;
+
+  nativeCheckInputs = [
+    mesa.llvmpipeHook
+  ];
+
   checkPhase = ''
-    # for running mesa llvmpipe
-    export __EGL_VENDOR_LIBRARY_FILENAMES=${mesa.drivers}/share/glvnd/egl_vendor.d/50_mesa.json
-    export LIBGL_DRIVERS_PATH=${mesa.drivers}/lib:${mesa.drivers}/lib/dri
     # some fontconfig issues cause pdf output to have wrong font
     ctest -j$NIX_BUILD_CORES -E pdfexporttest.\*
   '';
diff --git a/pkgs/by-name/op/opensplat/package.nix b/pkgs/by-name/op/opensplat/package.nix
index cd6052f5369b..d808a403e7bd 100644
--- a/pkgs/by-name/op/opensplat/package.nix
+++ b/pkgs/by-name/op/opensplat/package.nix
@@ -4,13 +4,13 @@
   cmake,
   ninja,
   fetchFromGitHub,
-  fetchpatch,
   python3,
   opencv,
   nlohmann_json,
   nanoflann,
   glm,
   cxxopts,
+  nix-update-script,
   config,
   # Upstream has rocm/hip support, too. anyone?
   cudaSupport ? config.cudaSupport,
@@ -18,7 +18,7 @@
   autoAddDriverRunpath,
 }:
 let
-  version = "1.1.2";
+  version = "1.1.3";
   torch = python3.pkgs.torch.override { inherit cudaSupport; };
   # Using a normal stdenv with cuda torch gives
   # ld: /nix/store/k1l7y96gv0nc685cg7i3g43i4icmddzk-python3.11-torch-2.2.1-lib/lib/libc10.so: undefined reference to `std::ios_base_library_init()@GLIBCXX_3.4.32'
@@ -32,27 +32,9 @@ stdenv'.mkDerivation {
     owner = "pierotofy";
     repo = "OpenSplat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3tk62b5fSf6wzuc5TwkdfAKgUMrw3ZxetCJa2RVMS/s=";
+    hash = "sha256-2NcKb2SWU/vNsnd2KhdU85J60fJPuc44ZxIle/1UT6g=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "install-executables.patch";
-      url = "https://github.com/pierotofy/OpenSplat/commit/b4c4176819b508978583b7ebf66306171807a8e6.patch";
-      hash = "sha256-BUgPMcO3lt3ZEzv24u36k3aTEIoloOhxrCGi1KQ5Epk=";
-    })
-  ];
-
-  postPatch = ''
-    # the two vendored gsplats are so heavily modified they may be considered a fork
-    find vendor ! -name 'gsplat*' -maxdepth 1 -mindepth 1 -exec rm -rf {} +
-    mkdir vendor/{nanoflann,glm}
-    ln -s ${glm}/include/glm vendor/glm/glm
-    ln -s ${nanoflann}/include/nanoflann.hpp vendor/nanoflann/nanoflann.hpp
-    ln -s ${nlohmann_json}/include/nlohmann vendor/json
-    ln -s ${cxxopts}/include/cxxopts.hpp vendor/cxxopts.hpp
-  '';
-
   nativeBuildInputs = [
     cmake
     ninja
@@ -63,6 +45,9 @@ stdenv'.mkDerivation {
 
   buildInputs = [
     nlohmann_json
+    nanoflann
+    glm
+    cxxopts
     torch.cxxdev
     torch
     opencv
@@ -74,15 +59,23 @@ stdenv'.mkDerivation {
 
   cmakeFlags = [
     (lib.cmakeBool "CMAKE_SKIP_RPATH" true)
+    (lib.cmakeFeature "FETCHCONTENT_TRY_FIND_PACKAGE_MODE" "ALWAYS")
   ] ++ lib.optionals cudaSupport [
     (lib.cmakeFeature "GPU_RUNTIME" "CUDA")
     (lib.cmakeFeature "CUDA_TOOLKIT_ROOT_DIR" "${cudaPackages.cudatoolkit}/")
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Production-grade 3D gaussian splatting";
     homepage = "https://github.com/pierotofy/OpenSplat/";
-    license = lib.licenses.mit;
+    license = [
+      # main
+      lib.licenses.agpl3Only
+      # vendored+modified gsplat
+      lib.licenses.asl20
+    ];
     maintainers = [ lib.maintainers.jcaesar ];
     platforms = lib.platforms.linux ++ lib.optionals (!cudaSupport) lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/ot/oterm/package.nix b/pkgs/by-name/ot/oterm/package.nix
index 9651b8d9cf3b..680a66820d87 100644
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@@ -28,7 +28,6 @@ python3Packages.buildPythonApplication rec {
 
   build-system = with python3Packages; [ poetry-core ];
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   dependencies = with python3Packages; [
     aiohttp
diff --git a/pkgs/by-name/pa/pacu/package.nix b/pkgs/by-name/pa/pacu/package.nix
index 46143afdb5e3..5c87d124ee96 100644
--- a/pkgs/by-name/pa/pacu/package.nix
+++ b/pkgs/by-name/pa/pacu/package.nix
@@ -32,7 +32,6 @@ python.pkgs.buildPythonApplication rec {
 
   build-system = with python.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies =
     [ awscli ]
diff --git a/pkgs/by-name/pi/picocrypt/package.nix b/pkgs/by-name/pi/picocrypt/package.nix
index f136ceb65e95..70efd103118f 100644
--- a/pkgs/by-name/pi/picocrypt/package.nix
+++ b/pkgs/by-name/pi/picocrypt/package.nix
@@ -8,7 +8,7 @@
   makeDesktopItem,
 
   xorg,
-  libGL,
+  glfw,
   gtk3,
   pkg-config,
   wrapGAppsHook3,
@@ -34,18 +34,14 @@ buildGoModule rec {
     "-w"
   ];
 
-  buildInputs = [
-    xorg.libX11
-    xorg.libXcursor
-    xorg.libXrandr
-    xorg.libXi
-    xorg.libXinerama
-    xorg.libXxf86vm
-    libGL.dev
-    gtk3
-  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Kernel
-  ];
+  buildInputs =
+    # Depends on a vendored, patched GLFW.
+    glfw.buildInputs or [ ]
+    ++ glfw.propagatedBuildInputs or [ ]
+    ++ lib.optionals (!stdenv.isDarwin) [
+      gtk3
+      xorg.libXxf86vm
+    ];
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/pr/pre2k/package.nix b/pkgs/by-name/pr/pre2k/package.nix
index 4865269b5565..98b763cb011d 100644
--- a/pkgs/by-name/pr/pre2k/package.nix
+++ b/pkgs/by-name/pr/pre2k/package.nix
@@ -24,7 +24,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/pr/pretalx/package.nix b/pkgs/by-name/pr/pretalx/package.nix
index 631f72672ea4..4f4a259f02e7 100644
--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@@ -91,7 +91,6 @@ python.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [
     gettext
   ] ++ (with python.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ]);
 
diff --git a/pkgs/by-name/pr/prowler/package.nix b/pkgs/by-name/pr/prowler/package.nix
index cf843d8ab1c7..4b19cadb0e3a 100644
--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@@ -34,10 +34,6 @@ python3.pkgs.buildPythonApplication rec {
     "slack-sdk"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   build-system = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/by-name/py/pysqlrecon/package.nix b/pkgs/by-name/py/pysqlrecon/package.nix
index e2019c45b134..d9d8c51bb828 100644
--- a/pkgs/by-name/py/pysqlrecon/package.nix
+++ b/pkgs/by-name/py/pysqlrecon/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/ra/rabbit/package.nix b/pkgs/by-name/ra/rabbit/package.nix
index 09fb2d789423..1ec1e092c1f1 100644
--- a/pkgs/by-name/ra/rabbit/package.nix
+++ b/pkgs/by-name/ra/rabbit/package.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
   build-system = [
     python3.pkgs.setuptools
     python3.pkgs.wheel
-    python3.pkgs.pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/by-name/rc/rclip/package.nix b/pkgs/by-name/rc/rclip/package.nix
index 4be5a5429d1e..8cca9c52e26a 100644
--- a/pkgs/by-name/rc/rclip/package.nix
+++ b/pkgs/by-name/rc/rclip/package.nix
@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication rec {
     tqdm
   ];
 
-  nativeCheckInputs = with python3Packages; [ pytestCheckHook pythonRelaxDepsHook ];
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
 
   pythonRelaxDeps = [ "torch" "torchvision" ];
 
diff --git a/pkgs/by-name/rd/rdwatool/package.nix b/pkgs/by-name/rd/rdwatool/package.nix
index 49459eb39a9e..7ae9db0bfae7 100644
--- a/pkgs/by-name/rd/rdwatool/package.nix
+++ b/pkgs/by-name/rd/rdwatool/package.nix
@@ -24,7 +24,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 6fedb10cfed1..4d9c8da8041c 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -126,8 +126,5 @@ rustPlatform.buildRustPackage rec {
     ];
     maintainers = with maintainers; [ SomeoneSerge ];
     mainProgram = "rerun";
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
   };
 }
diff --git a/pkgs/by-name/re/retool/package.nix b/pkgs/by-name/re/retool/package.nix
index 84bba4dae2ee..fda7361ee8b7 100644
--- a/pkgs/by-name/re/retool/package.nix
+++ b/pkgs/by-name/re/retool/package.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     hatchling
-    pythonRelaxDepsHook
     qt6.wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/ro/route-graph/package.nix b/pkgs/by-name/ro/route-graph/package.nix
index 36158282f783..7e6e8d2bd6a6 100644
--- a/pkgs/by-name/ro/route-graph/package.nix
+++ b/pkgs/by-name/ro/route-graph/package.nix
@@ -25,10 +25,6 @@ python3.pkgs.buildPythonApplication rec {
     poetry-core
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   propagatedBuildInputs = [
     graphviz
   ] ++ (with python3.pkgs; [
diff --git a/pkgs/by-name/se/selenium-manager/package.nix b/pkgs/by-name/se/selenium-manager/package.nix
index 4dac1c11b433..d9f127a1c953 100644
--- a/pkgs/by-name/se/selenium-manager/package.nix
+++ b/pkgs/by-name/se/selenium-manager/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "selenium-manager";
-  version = "4.18.1";
+  version = "4.22.0";
 
   src = fetchFromGitHub {
     owner = "SeleniumHQ";
     repo = "selenium";
     rev = "selenium-${version}";
-    hash = "sha256-1C9Epsk9rFlShxHGGzbWl6smrMzPn2h3yCWlzUIMpY8=";
+    hash = "sha256-qBuZgI5SSBwxbSBrAT0W/HzzV2JmPL00hPJ6s57QTeg=";
   };
 
   sourceRoot = "${src.name}/rust";
 
-  cargoHash = "sha256-BystESOFIitw3ER2K1TPOf5luOBvKXFuqc/unL93yRY=";
+  cargoHash = "sha256-1CPUOAfBfUeZt5S8t5SM3oyrNwXKHplhHG5idVy4YrE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/by-name/sh/shell-gpt/package.nix b/pkgs/by-name/sh/shell-gpt/package.nix
index 92f451b24088..6558c612d84f 100644
--- a/pkgs/by-name/sh/shell-gpt/package.nix
+++ b/pkgs/by-name/sh/shell-gpt/package.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ hatchling ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
     click
diff --git a/pkgs/by-name/sm/smassh/package.nix b/pkgs/by-name/sm/smassh/package.nix
index eb82f51399ac..d723be41d2b9 100644
--- a/pkgs/by-name/sm/smassh/package.nix
+++ b/pkgs/by-name/sm/smassh/package.nix
@@ -19,7 +19,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
index 38d0f47edbaa..5fd0b80ce6ec 100644
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -105,7 +105,6 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/st/streamdeck-ui/package.nix b/pkgs/by-name/st/streamdeck-ui/package.nix
index 4af7ad66c789..1549d2c6e1c9 100644
--- a/pkgs/by-name/st/streamdeck-ui/package.nix
+++ b/pkgs/by-name/st/streamdeck-ui/package.nix
@@ -40,7 +40,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3Packages.poetry-core
-    python3Packages.pythonRelaxDepsHook
     copyDesktopItems
     qt6.wrapQtAppsHook
     wrapGAppsHook3
diff --git a/pkgs/by-name/st/strictdoc/package.nix b/pkgs/by-name/st/strictdoc/package.nix
index 326feb08afa6..aa0adea474be 100644
--- a/pkgs/by-name/st/strictdoc/package.nix
+++ b/pkgs/by-name/st/strictdoc/package.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3.pkgs.hatchling
-    python3.pkgs.pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/tb/tbump/package.nix b/pkgs/by-name/tb/tbump/package.nix
index 2812dd2f05d0..1314c1ec6d12 100644
--- a/pkgs/by-name/tb/tbump/package.nix
+++ b/pkgs/by-name/tb/tbump/package.nix
@@ -18,7 +18,6 @@ python3Packages.buildPythonApplication rec {
 
   pythonRelaxDeps = [ "tomlkit" ];
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   build-system = with python3Packages; [ poetry-core ];
 
diff --git a/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
index c01bc623c9d9..0ee89e9e037b 100644
--- a/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
+++ b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
@@ -78,9 +78,6 @@ let
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [ huantian wackbyte ];
       platforms = lib.platforms.linux;
-      # See comment about wasm32-unknown-unknown in rustc.nix.
-      broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-        !stdenv.hostPlatform.gcc.thumb or true;
     };
   };
 
diff --git a/pkgs/by-name/tr/troubadix/package.nix b/pkgs/by-name/tr/troubadix/package.nix
index 0906dd4becb2..a23d8da4eaf7 100644
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     chardet
diff --git a/pkgs/by-name/tu/tunnelgraf/package.nix b/pkgs/by-name/tu/tunnelgraf/package.nix
index d7f2c77dab0a..a24ea1b67fc6 100644
--- a/pkgs/by-name/tu/tunnelgraf/package.nix
+++ b/pkgs/by-name/tu/tunnelgraf/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/by-name/tw/twitch-dl/package.nix b/pkgs/by-name/tw/twitch-dl/package.nix
index 81c444ea340f..b98f88d30060 100644
--- a/pkgs/by-name/tw/twitch-dl/package.nix
+++ b/pkgs/by-name/tw/twitch-dl/package.nix
@@ -24,7 +24,6 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     python3Packages.setuptools
     python3Packages.setuptools-scm
-    python3Packages.pythonRelaxDepsHook
     installShellFiles
     scdoc
   ];
diff --git a/pkgs/by-name/un/unsilence/package.nix b/pkgs/by-name/un/unsilence/package.nix
index c82fe04616b6..76a362f279c3 100644
--- a/pkgs/by-name/un/unsilence/package.nix
+++ b/pkgs/by-name/un/unsilence/package.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonPackage rec {
 
   nativeBuildInputs = with python3Packages; [
     rich
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/up/upiano/package.nix b/pkgs/by-name/up/upiano/package.nix
index 46224f45a9bb..4ad1456fc96e 100644
--- a/pkgs/by-name/up/upiano/package.nix
+++ b/pkgs/by-name/up/upiano/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/uw/uwhoisd/package.nix b/pkgs/by-name/uw/uwhoisd/package.nix
index 2fb31c23669d..81080d476e8e 100644
--- a/pkgs/by-name/uw/uwhoisd/package.nix
+++ b/pkgs/by-name/uw/uwhoisd/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/vu/vunnel/package.nix b/pkgs/by-name/vu/vunnel/package.nix
index 9ca3f5d42c33..53df74f8533c 100644
--- a/pkgs/by-name/vu/vunnel/package.nix
+++ b/pkgs/by-name/vu/vunnel/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
     "sqlalchemy"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   build-system = with python3.pkgs; [
     poetry-core
diff --git a/pkgs/by-name/wa/waf/package.nix b/pkgs/by-name/wa/waf/package.nix
index 812c6dd9b8d7..a30c5df8d851 100644
--- a/pkgs/by-name/wa/waf/package.nix
+++ b/pkgs/by-name/wa/waf/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waf";
-  version = "2.0.27";
+  version = "2.1.1";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "waf-${finalAttrs.version}";
-    hash = "sha256-GeEoD5CHubwR4ndGk7J7czEf0hWtPQr88TqJDPqeK0s=";
+    hash = "sha256-38u8DJ1KLkb7FfeCr+1e5UBE3Qkx1q2FBsm5HDXnunQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wi/witnessme/package.nix b/pkgs/by-name/wi/witnessme/package.nix
index a19a387f3185..de83d1475360 100644
--- a/pkgs/by-name/wi/witnessme/package.nix
+++ b/pkgs/by-name/wi/witnessme/package.nix
@@ -28,10 +28,6 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   build-system = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/by-name/ws/wsrepl/package.nix b/pkgs/by-name/ws/wsrepl/package.nix
index 9bab0957d5b3..9557fec2210c 100644
--- a/pkgs/by-name/ws/wsrepl/package.nix
+++ b/pkgs/by-name/ws/wsrepl/package.nix
@@ -19,10 +19,6 @@ python3.pkgs.buildPythonApplication rec {
     "textual"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   build-system = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/by-name/wt/wtfis/package.nix b/pkgs/by-name/wt/wtfis/package.nix
index ad710bf8f229..3d8e97ea80f0 100644
--- a/pkgs/by-name/wt/wtfis/package.nix
+++ b/pkgs/by-name/wt/wtfis/package.nix
@@ -17,10 +17,6 @@ in python3.pkgs.buildPythonApplication {
 
   format = "pyproject";
 
-  nativeBuildInputs = [
-    python3.pkgs.pythonRelaxDepsHook
-  ];
-
   propagatedBuildInputs = [
     python3.pkgs.hatchling
     python3.pkgs.pydantic
diff --git a/pkgs/by-name/wy/wyoming-satellite/package.nix b/pkgs/by-name/wy/wyoming-satellite/package.nix
index cb34afc5b2f1..f23a5864b452 100644
--- a/pkgs/by-name/wy/wyoming-satellite/package.nix
+++ b/pkgs/by-name/wy/wyoming-satellite/package.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/libraries/xsimd/disable-test_error_gamma.patch b/pkgs/by-name/xs/xsimd/disable-test_error_gamma.patch
index 49957ea62ed7..49957ea62ed7 100644
--- a/pkgs/development/libraries/xsimd/disable-test_error_gamma.patch
+++ b/pkgs/by-name/xs/xsimd/disable-test_error_gamma.patch
diff --git a/pkgs/development/libraries/xsimd/default.nix b/pkgs/by-name/xs/xsimd/package.nix
index 019b3afbefc8..8f8c72bc3f6a 100644
--- a/pkgs/development/libraries/xsimd/default.nix
+++ b/pkgs/by-name/xs/xsimd/package.nix
@@ -28,10 +28,17 @@ stdenv.mkDerivation (finalAttrs: {
     ./disable-test_error_gamma.patch
   ];
 
+  # strictDeps raises the chance that xsimd will be able to be cross compiled
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
   ];
 
+  buildInputs = [
+    doctest
+  ];
+
   cmakeFlags = [
     # Always build the tests, even if not running them, because testing whether
     # they can be built is a test in itself.
@@ -39,12 +46,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   doCheck = true;
-  nativeCheckInputs = [
-    doctest
-  ];
   checkTarget = "xtest";
 
   meta = with lib; {
+    changelog = "https://github.com/xtensor-stack/xsimd/blob/${finalAttrs.version}/Changelog.rst#${
+      builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version
+    }";
     description = "C++ wrappers for SIMD intrinsics";
     homepage = "https://github.com/xtensor-stack/xsimd";
     license = licenses.bsd3;
diff --git a/pkgs/data/fonts/iwona/default.nix b/pkgs/data/fonts/iwona/default.nix
index 6a40b20b28e0..6d235d1b2f2b 100644
--- a/pkgs/data/fonts/iwona/default.nix
+++ b/pkgs/data/fonts/iwona/default.nix
@@ -4,11 +4,12 @@ stdenvNoCC.mkDerivation rec {
   inherit (src) pname version;
 
   src = texlive.pkgs.iwona;
+  dontUnpack = true;
 
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
+    install -Dm644 $src/fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
 
     runHook postInstall
   '';
diff --git a/pkgs/data/icons/hicolor-icon-theme/default.nix b/pkgs/data/icons/hicolor-icon-theme/default.nix
index 096baa49acea..0d528243a865 100644
--- a/pkgs/data/icons/hicolor-icon-theme/default.nix
+++ b/pkgs/data/icons/hicolor-icon-theme/default.nix
@@ -1,20 +1,42 @@
-{ lib, stdenvNoCC, fetchurl }:
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitLab,
+  testers,
+  meson,
+  pkg-config,
+  ninja,
+}:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hicolor-icon-theme";
-  version = "0.17";
+  version = "0.18";
 
-  src = fetchurl {
-    url = "https://icon-theme.freedesktop.org/releases/hicolor-icon-theme-${version}.tar.xz";
-    sha256 = "1n59i3al3zx6p90ff0l43gzpzmlqnzm6hf5cryxqrlbi48sq8x1i";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "xdg";
+    repo = "default-icon-theme";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-uoB7u/ok7vMxKDl8pINdnV9VsvmsntBcZuz3Q4zGz7M=";
   };
 
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+  ];
+
   setupHook = ./setup-hook.sh;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Default fallback theme used by implementations of the icon theme specification";
-    homepage = "https://icon-theme.freedesktop.org/releases/";
+    homepage = "https://www.freedesktop.org/wiki/Software/icon-theme/";
+    changelog = "https://gitlab.freedesktop.org/xdg/default-icon-theme/-/blob/${finalAttrs.src.rev}/NEWS";
     platforms = platforms.unix;
     license = licenses.gpl2Only;
+    pkgConfigModules = [ "default-icon-theme" ];
+    maintainers = with maintainers; [ jopejoe1 ];
   };
-}
+})
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index b8b239e4fc58..7a332e808701 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.98";
+  srcVersion = "3.101";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -37,7 +37,7 @@ let
       owner = "nss-dev";
       repo = "nss";
       rev = "NSS_${lib.replaceStrings ["."] ["_"] version}_RTM";
-      hash = "sha256-0p1HzspxyzhzX46O7ax8tmYiaFEBeqEqEvman4NIiQc=";
+      hash = "sha256-lO+81zYBBFwqcjh4cd/fpiznHZ9rTJpfDW/yF8phYts=";
     };
 
     dontBuild = true;
diff --git a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
index e7d18a0d3c0d..c2dc78787de5 100644
--- a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
@@ -1,7 +1,6 @@
 { lib
 , fetchPypi
 , buildPythonApplication
-, pythonRelaxDepsHook
 , poetry-core
 , colorama
 , packaging
@@ -28,7 +27,6 @@ buildPythonApplication rec {
     gobject-introspection
     poetry-core
     wrapGAppsNoGuiHook
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index 9548f8fe06f8..3bf938b75903 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -23,36 +23,50 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-FMh3VvlY3fUK8fbd0M+aCmlUrmG9YegiOOQ7MOByffc=";
   };
 
-  patches = [
+  # Big pile of backports.
+  # FIXME: remove all of these after next upstream release.
+  patches = let
+    fetchUpstreamPatch = { rev, hash }: fetchpatch {
+      name = "dtc-${rev}.patch";
+      url = "https://git.kernel.org/pub/scm/utils/dtc/dtc.git/patch/?id=${rev}";
+      inherit hash;
+    };
+  in [
     # meson: Fix cell overflow tests when running from meson
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/32174a66efa4ad19fc6a2a6422e4af2ae4f055cb.patch";
-      sha256 = "sha256-C7OzwY0zq+2CV3SB5unI7Ill2M3deF7FXeQE3B/Kx2s=";
+    (fetchUpstreamPatch {
+      rev = "32174a66efa4ad19fc6a2a6422e4af2ae4f055cb";
+      hash = "sha256-C7OzwY0zq+2CV3SB5unI7Ill2M3deF7FXeQE3B/Kx2s=";
     })
 
     # Use #ifdef NO_VALGRIND
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/41821821101ad8a9f83746b96b163e5bcbdbe804.patch";
-      sha256 = "sha256-7QEFDtap2DWbUGqtyT/RgJZJFldKB8oSubKiCtLZ0w4=";
+    (fetchUpstreamPatch {
+      rev = "41821821101ad8a9f83746b96b163e5bcbdbe804";
+      hash = "sha256-7QEFDtap2DWbUGqtyT/RgJZJFldKB8oSubKiCtLZ0w4=";
     })
 
     # dtc: Fix linker options so it also works in Darwin
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/3acde70714df3623e112cf3ec99fc9b5524220b8.patch";
-      sha256 = "sha256-uLXL0Sjcn+bnMuF+A6PjUW1Rq6uNg1dQl58zbeYpP/U=";
+    (fetchUpstreamPatch {
+      rev = "71a8b8ef0adf01af4c78c739e04533a35c1dc89c";
+      hash = "sha256-uLXL0Sjcn+bnMuF+A6PjUW1Rq6uNg1dQl58zbeYpP/U=";
     })
 
     # meson: allow disabling tests
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/35f26d2921b68d97fefbd5a2b6e821a2f02ff65d.patch";
-      sha256 = "sha256-cO4f/jJX/pQL7kk4jpKUhsCVESW2ZuWaTr7z3BuvVkw=";
+    (fetchUpstreamPatch {
+      rev = "bdc5c8793a13abb8846d115b7923df87605d05bd";
+      hash = "sha256-cO4f/jJX/pQL7kk4jpKUhsCVESW2ZuWaTr7z3BuvVkw=";
     })
 
-    (fetchpatch {
-      name = "static.patch";
-      url = "https://git.kernel.org/pub/scm/utils/dtc/dtc.git/patch/?id=3fbfdd08afd2a7a25b27433f6f5678c0fe694721";
+    # meson: fix installation with meson-python
+    (fetchUpstreamPatch {
+      rev = "3fbfdd08afd2a7a25b27433f6f5678c0fe694721";
       hash = "sha256-skK8m1s4xkK6x9AqzxiEK+1uMEmS27dBI1CdEXNFTfU=";
     })
+
+    # pylibfdt: fix get_mem_rsv for newer Python versions
+    (fetchUpstreamPatch {
+      rev = "822123856980f84562406cc7bd1d4d6c2b8bc184";
+      hash = "sha256-IJpRgP3pP8Eewx2PNKxhXZdsnomz2AR6oOsun50qAms=";
+    })
   ];
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index 5e017a21fa1f..5eb92fd701da 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -280,7 +280,7 @@ pipe ((callFile ./common/builder.nix {}) ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" "pie" ]
+  hardeningDisable = [ "format" "pie" "stackclashprotection" ]
   ++ optionals (is11 && langAda) [ "fortify3" ];
 
   postPatch = optionalString atLeast7 ''
@@ -425,6 +425,9 @@ pipe ((callFile ./common/builder.nix {}) ({
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
     isGNU = true;
     hardeningUnsupportedFlags = optional is48 "stackprotector"
+      ++ optional (
+        (targetPlatform.isAarch64 && !atLeast9) || !atLeast8
+      ) "stackclashprotection"
       ++ optional (!atLeast11) "zerocallusedregs"
       ++ optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
       ++ optionals (langFortran) [ "fortify" "format" ];
diff --git a/pkgs/development/compilers/gcc/patches/12/lambda-ICE-PR109241.patch b/pkgs/development/compilers/gcc/patches/12/lambda-ICE-PR109241.patch
deleted file mode 100644
index a27a8a08d9d5..000000000000
--- a/pkgs/development/compilers/gcc/patches/12/lambda-ICE-PR109241.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-https://gcc.gnu.org/PR109241
-
-Fix ICE on ccache.
-
-From 396a4e76afec30d2461638f569cae18955eb4ad2 Mon Sep 17 00:00:00 2001
-From: Jason Merrill <jason@redhat.com>
-Date: Wed, 22 Mar 2023 16:11:47 -0400
-Subject: [PATCH] c++: local class in nested generic lambda [PR109241]
-
-In this testcase, the tree walk to look for bare parameter packs was
-confused by finding a type with no TREE_BINFO.  But it should be fine that
-it's unset; we already checked for unexpanded packs at parse time.
-
-I also tried doing the partial instantiation of the local class, which is
-probably the long-term direction we want to go, but for stage 4 let's go
-with this safer change.
-
-	PR c++/109241
-
-gcc/cp/ChangeLog:
-
-	* pt.cc (find_parameter_packs_r): Handle null TREE_BINFO.
-
-gcc/testsuite/ChangeLog:
-
-	* g++.dg/cpp1y/lambda-generic-local-class2.C: New test.
----
- gcc/cp/pt.cc                                        | 12 ++++++++----
- .../g++.dg/cpp1y/lambda-generic-local-class2.C      | 13 +++++++++++++
- 2 files changed, 21 insertions(+), 4 deletions(-)
- create mode 100644 gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
-
-diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
-index c7f4a95a723..79bc9c014c8 100644
---- a/gcc/cp/pt.cc
-+++ b/gcc/cp/pt.cc
-@@ -4106,10 +4106,14 @@ find_parameter_packs_r (tree *tp, int *walk_subtrees, void* data)
-     case TAG_DEFN:
-       t = TREE_TYPE (t);
-       if (CLASS_TYPE_P (t))
--	/* Local class, need to look through the whole definition.  */
--	for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
--	  cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
--			ppd, ppd->visited);
-+	{
-+	  /* Local class, need to look through the whole definition.
-+	     TYPE_BINFO might be unset for a partial instantiation.  */
-+	  if (TYPE_BINFO (t))
-+	    for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
-+	      cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
-+			    ppd, ppd->visited);
-+	}
-       else
- 	/* Enum, look at the values.  */
- 	for (tree l = TYPE_VALUES (t); l; l = TREE_CHAIN (l))
-diff --git a/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
-new file mode 100644
-index 00000000000..83856de1f41
---- /dev/null
-+++ b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
-@@ -0,0 +1,13 @@
-+// PR c++/109241
-+// { dg-do compile { target c++14 } }
-+// { dg-options "" } no pedantic
-+
-+void g() {
-+  [](auto) {
-+    [](auto) {
-+      ({
-+        struct A {};
-+      });
-+    };
-+  }(1);
-+}
--- 
-2.40.1
-
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 8f0a499da362..b7da7eb925ee 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -76,7 +76,6 @@ in
 ++ optional (atLeast12 && langAda) ./gnat-cflags-11.patch
 ++ optional langFortran (if atLeast12 then ./gcc-12-gfortran-driving.patch else ./gfortran-driving.patch)
 ++ optional atLeast7 ./ppc-musl.patch
-++ optional is12 ./12/lambda-ICE-PR109241.patch # backport ICE fix on ccache code
 ++ optional (atLeast9 && langD) ./libphobos.patch
 
 
diff --git a/pkgs/development/compilers/gcc/versions.nix b/pkgs/development/compilers/gcc/versions.nix
index 3421152ef12a..317f4f1165e6 100644
--- a/pkgs/development/compilers/gcc/versions.nix
+++ b/pkgs/development/compilers/gcc/versions.nix
@@ -2,7 +2,7 @@ let
   majorMinorToVersionMap = {
     "14" = "14.1.0";
     "13" = "13.3.0";
-    "12" = "12.3.0";
+    "12" = "12.4.0";
     "11" = "11.4.0";
     "10" = "10.5.0";
     "9"  =  "9.5.0";
@@ -18,11 +18,9 @@ let
 
   # TODO(amjoseph): convert older hashes to SRI form
   srcHashForVersion = version: {
-    # NOTE: there is no need to remove hashes of obsolete minor
-    # versions when adding a new minor version.
     "14.1.0" = "sha256-4oPGVJh6/j3p2AgLwL15U0tcoNaBpzoR/ytdN2dCaEA=";
     "13.3.0" = "sha256-CEXpYhyVQ6E/SE6UWEpJ/8ASmXDpkUYkI1/B0GGgwIM=";
-    "12.3.0" = "sha256-lJpdT5nnhkIak7Uysi/6tVeN5zITaZdbka7Jet/ajDs=";
+    "12.4.0" = "sha256-cE9lJgTMvMsUvavzR4yVEciXiLEss7v/3tNzQZFqkXU=";
     "11.4.0" = "sha256-Py2yIrAH6KSiPNW6VnJu8I6LHx6yBV7nLBQCzqc6jdk=";
     "10.5.0" = "sha256-JRCVQ/30bzl8NHtdi3osflaUpaUczkucbh6opxyjB8E=";
     "9.5.0"  = "13ygjmd938m0wmy946pxdhz9i1wq7z4w10l6pvidak0xxxj9yxi7";
diff --git a/pkgs/development/compilers/go/1.22.nix b/pkgs/development/compilers/go/1.22.nix
index d3b8982118ae..dc027c785e56 100644
--- a/pkgs/development/compilers/go/1.22.nix
+++ b/pkgs/development/compilers/go/1.22.nix
@@ -48,11 +48,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.22.3";
+  version = "1.22.5";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-gGSO80+QMZPXKlnA3/AZ9fmK4MmqE63gsOy/+ZGnb2g=";
+    hash = "sha256-rJxyPyJJaa7mJLw0/TTJ4T8qIS11xxyAfeZEu0bhEvY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/llvm/17/default.nix b/pkgs/development/compilers/llvm/17/default.nix
index e0791e4b5281..a7b5ac3461b3 100644
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@@ -133,6 +133,14 @@ in let
         # It's not clear to me why this isn't an issue for LLVM developers running
         # on macOS (nothing about this _seems_ nix specific)..
         ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
+
+        # resolves https://github.com/llvm/llvm-project/issues/75168
+        (fetchpatch {
+          name = "fix-fzero-call-used-regs.patch";
+          url = "https://github.com/llvm/llvm-project/commit/f800c1f3b207e7bcdc8b4c7192928d9a078242a0.patch";
+          stripLen = 1;
+          hash = "sha256-e8YKrMy2rGcSJGC6er2V66cOnAnI+u1/yImkvsRsmg8=";
+        })
       ];
       pollyPatches = [
         ./llvm/gnu-install-dirs-polly.patch
diff --git a/pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch
index e2122ebf603d..eb9f6098d1c9 100644
--- a/pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch
@@ -72,8 +72,8 @@ index 230620c37027..dd16cab1835e 100644
 +    # As noted in the differential above, an alternative solution is to have
 +    # all rdeps of nixpkgs' LLVM (that use the AddLLVM.cmake machinery) set
 +    # `CMAKE_INSTALL_RPATH`.
-+    set(_build_rpath "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
-+    set(_install_rpath "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_build_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_install_rpath ${extra_libdir})
      if(${CMAKE_SYSTEM_NAME} MATCHES "(FreeBSD|DragonFly)")
        set_property(TARGET ${name} APPEND_STRING PROPERTY
                     LINK_FLAGS " -Wl,-z,origin ")
@@ -86,10 +86,10 @@ index 891c9e6d618c..8d963f3b0069 100644
  
    if( APPLE )
 -    set(ocaml_rpath "@executable_path/../../../lib${LLVM_LIBDIR_SUFFIX}")
-+    set(ocaml_rpath "@executable_path/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
++    set(ocaml_rpath "${LLVM_LIBRARY_DIR}")
    elseif( UNIX )
 -    set(ocaml_rpath "\\$ORIGIN/../../../lib${LLVM_LIBDIR_SUFFIX}")
-+    set(ocaml_rpath "\\$ORIGIN/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
++    set(ocaml_rpath "${LLVM_LIBRARY_DIR}")
    endif()
    list(APPEND ocaml_flags "-ldopt" "-Wl,-rpath,${ocaml_rpath}")
  
diff --git a/pkgs/development/compilers/llvm/18/default.nix b/pkgs/development/compilers/llvm/18/default.nix
index 6faaab80ac31..9d0dff4e52f3 100644
--- a/pkgs/development/compilers/llvm/18/default.nix
+++ b/pkgs/development/compilers/llvm/18/default.nix
@@ -26,7 +26,7 @@
   #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
   #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
   # }
-, officialRelease ? { version = "18.1.7"; sha256 = "sha256-qBL/1zh2YFabiPAyHehvzDSDfnwnCvyH6nY/pzG757A="; }
+, officialRelease ? { version = "18.1.8"; sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE="; }
   # i.e.:
   # {
   #   version = /* i.e. "15.0.0" */;
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index dc175e085f0b..922eb8657cee 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -136,16 +136,26 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-    } // (lib.optionalAttrs (lib.versionAtLeast release_version "15") {
-      hardeningUnsupportedFlags = [
-        "fortify3"
-      ];
       hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
-        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        [ "fortify3" ]
+        ++ lib.optional (
+          (lib.versionOlder release_version "11")
+          || (targetPlatform.isAarch64 && (lib.versionOlder release_version "18.1"))
+          || (targetPlatform.isFreeBSD && (lib.versionOlder release_version "15"))
+          || !(targetPlatform.isLinux || targetPlatform.isFreeBSD)
+          || !(
+            targetPlatform.isx86
+            || targetPlatform.isPower64
+            || targetPlatform.isS390x
+            || targetPlatform.isAarch64
+          )
+        ) "stackclashprotection"
+        ++ lib.optional (
+          (lib.versionOlder release_version "15")
+          || !(targetPlatform.isx86_64 || targetPlatform.isAarch64)
+        ) "zerocallusedregs"
         ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
-    }) // (lib.optionalAttrs (lib.versionOlder release_version "15") {
-      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
-    });
+    };
 
     meta = llvm_meta // {
       homepage = "https://clang.llvm.org/";
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
index 23a966ce238f..67f9661cf743 100644
--- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
@@ -142,7 +142,7 @@ stdenv.mkDerivation ({
   '' + (if stdenv.hostPlatform.isFreeBSD then
     # As per above, but in FreeBSD assert is a macro and simply allowing it to be implicitly declared causes Issues!!!!!
     ''
-    substituteInPlace lib/builtins/clear_cache.c lib/builtins/cpu_model.c \
+    substituteInPlace lib/builtins/clear_cache.c lib/builtins/cpu_model${lib.optionalString (lib.versionAtLeast version "18") "/x86"}.c \
       --replace "#include <assert.h>" "#define assert(e) ((e)?(void)0:__assert(__FUNCTION__,__FILE__,__LINE__,#e))"
     '' else ''
     substituteInPlace lib/builtins/clear_cache.c \
diff --git a/pkgs/development/compilers/llvm/common/libcxx/default.nix b/pkgs/development/compilers/llvm/common/libcxx/default.nix
index e2b0c8fb458b..646d435489c6 100644
--- a/pkgs/development/compilers/llvm/common/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/common/libcxx/default.nix
@@ -13,16 +13,12 @@
 , python3
 , fixDarwinDylibNames
 , version
-, cxxabi ? null
-, libcxxrt
+, freebsd
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then freebsd.libcxxrt else null
 , libunwind
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
-# note: our setup using libcxxabi instead of libcxxrt on FreeBSD diverges from
-# normal FreeBSD. This may cause issues with binary patching down the line.
-# If this becomes an issue, try adding as symlink libcxxrt.so -> libc++abi.so
-
 # external cxxabi is not supported on Darwin as the build will not link libcxx
 # properly and not re-export the cxxabi symbols into libcxx
 # https://github.com/NixOS/nixpkgs/issues/166205
@@ -97,6 +93,8 @@ let
     "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
   ] ++ lib.optionals (!enableShared) [
     "-DLIBCXX_ENABLE_SHARED=OFF"
+  ] ++ lib.optionals (cxxabi != null && cxxabi.libName == "cxxrt") [
+    "-DLIBCXX_ENABLE_NEW_DELETE_DEFINITIONS=ON"
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index 89ea8f6e7a56..f780c87d0e4b 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -313,7 +313,7 @@ stdenv.mkDerivation (rec {
     )
   '';
 
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
+  # E.g. Mesa uses the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
   cmakeBuildType = if debugVersion then "Debug" else "Release";
diff --git a/pkgs/development/compilers/openjdk/21.nix b/pkgs/development/compilers/openjdk/21.nix
index 623ac281acf7..160b3da4c8ee 100644
--- a/pkgs/development/compilers/openjdk/21.nix
+++ b/pkgs/development/compilers/openjdk/21.nix
@@ -14,8 +14,8 @@
 let
   version = {
     feature = "21";
-    interim = "";
-    build = "35";
+    interim = ".0.3";
+    build = "9";
   };
 
   # when building a headless jdk, also bootstrap it with a headless jdk
@@ -29,7 +29,7 @@ let
       owner = "openjdk";
       repo = "jdk${version.feature}u";
       rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      hash = "sha256-fA8nRWBuTL87S8mwapmNfCPPQoI2aKHjbHJ6PDN3khs=";
+      hash = "sha256-zRN16lrc5gtDlTVIQJRRx103w/VbRkatCLeEc9AXWPE=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
diff --git a/pkgs/development/compilers/openjdk/openjfx/21.nix b/pkgs/development/compilers/openjdk/openjfx/21.nix
index d4092a99f363..ee262eb8b950 100644
--- a/pkgs/development/compilers/openjdk/openjfx/21.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/21.nix
@@ -7,7 +7,7 @@
 
 let
   major = "21";
-  update = "";
+  update = ".0.3";
   build = "-ga";
   repover = "${major}${update}${build}";
   gradle_ = (gradle_7.override {
@@ -30,9 +30,9 @@ let
 
     src = fetchFromGitHub {
       owner = "openjdk";
-      repo = "jfx";
+      repo = "jfx21u";
       rev = repover;
-      hash = "sha256-deNAGfnA6gwcAa64l0AWdkX+vJd3ZOfIgAifSl+/m+s=";
+      hash = "sha256-7z0GIbkQwG9mXY9dssaicqaKpMo3FkNEpyAvkswoQQ4=";
     };
 
     buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
diff --git a/pkgs/development/compilers/rust/1_78.nix b/pkgs/development/compilers/rust/1_78.nix
index 3ce368e8d99f..d81e964fb745 100644
--- a/pkgs/development/compilers/rust/1_78.nix
+++ b/pkgs/development/compilers/rust/1_78.nix
@@ -49,6 +49,7 @@ import ./default.nix {
     aarch64-apple-darwin = "415bb2bc198feb0f2d8329e33c57d0890bbd57977d1ae48b17f6c7e1f632eaa7";
     powerpc64le-unknown-linux-gnu = "79582acb339bd2d79fef095b977049049ffa04616011f1af1793fb8e98194b19";
     riscv64gc-unknown-linux-gnu = "300fe4861e2d1f6e4c4f5e36ae7997beca8a979343a7f661237ab78a37a54648";
+    x86_64-unknown-freebsd = "72f49040fc2ed4492cddfaef3b4a9cb28d008f9f5ce5cac50802a5fca910f58c";
   };
 
   selectRustPackage = pkgs: pkgs.rust_1_78;
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index d1df1c542e98..10e944515df7 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -35,7 +35,8 @@ rec {
 
     nativeBuildInputs = lib.optional (!stdenv.isDarwin) autoPatchelfHook;
     buildInputs = [ bash ]
-      ++ lib.optionals (!stdenv.isDarwin) [ gcc.cc.lib zlib ]
+      ++ lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) gcc.cc.lib
+      ++ lib.optional (!stdenv.isDarwin) zlib
       ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
@@ -81,7 +82,7 @@ rec {
     nativeBuildInputs = [ makeWrapper ]
       ++ lib.optional (!stdenv.isDarwin) autoPatchelfHook;
     buildInputs = [ bash ]
-      ++ lib.optional (!stdenv.isDarwin) gcc.cc.lib
+      ++ lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) gcc.cc.lib
       ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
diff --git a/pkgs/development/compilers/rust/print-hashes.sh b/pkgs/development/compilers/rust/print-hashes.sh
index ebf8d900bb3b..54c15406df67 100755
--- a/pkgs/development/compilers/rust/print-hashes.sh
+++ b/pkgs/development/compilers/rust/print-hashes.sh
@@ -19,6 +19,7 @@ PLATFORMS=(
   aarch64-apple-darwin
   powerpc64le-unknown-linux-gnu
   riscv64gc-unknown-linux-gnu
+  x86_64-unknown-freebsd
 )
 BASEURL=https://static.rust-lang.org/dist
 VERSION=${1:-}
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index e00ba329ccdc..a68e117658fa 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -58,8 +58,11 @@ in stdenv.mkDerivation (finalAttrs: {
 
   NIX_LDFLAGS = toString (
        # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
-       optional (stdenv.isLinux && !withBundledLLVM) "--push-state --as-needed -lstdc++ --pop-state"
+       # This doesn't apply to cross-building for FreeBSD because the host
+       # uses libstdc++, but the target (used for building std) uses libc++
+       optional (stdenv.isLinux && !withBundledLLVM && !stdenv.targetPlatform.isFreeBSD) "--push-state --as-needed -lstdc++ --pop-state"
     ++ optional (stdenv.isDarwin && !withBundledLLVM) "-lc++ -lc++abi"
+    ++ optional stdenv.isFreeBSD "-rpath ${llvmPackages.libunwind}/lib"
     ++ optional stdenv.isDarwin "-rpath ${llvmSharedForHost}/lib");
 
   # Increase codegen units to introduce parallelism within the compiler.
@@ -103,9 +106,7 @@ in stdenv.mkDerivation (finalAttrs: {
       stdenv.targetPlatform.rust.rustcTargetSpec
 
     # Other targets that don't need any extra dependencies to build.
-    # Temporarily broken if some global compiler flags are set:
-    # https://github.com/NixOS/nixpkgs/pull/317273
-    ] ++ optionals (!fastCross && !lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] && stdenv.hostPlatform.gcc.thumb or true) [
+    ] ++ optionals (!fastCross) [
       "wasm32-unknown-unknown"
 
     # (build!=target): When cross-building a compiler we need to add
@@ -220,6 +221,11 @@ in stdenv.mkDerivation (finalAttrs: {
     [source.vendored-sources]
     directory = "vendor"
     EOF
+  '' + lib.optionalString (stdenv.isFreeBSD) ''
+    # lzma-sys bundles an old version of xz that doesn't build
+    # on modern FreeBSD, use the system one instead
+    substituteInPlace src/bootstrap/src/core/build_steps/tool.rs \
+        --replace 'cargo.env("LZMA_API_STATIC", "1");' ' '
   '';
 
   # rustc unfortunately needs cmake to compile llvm-rt but doesn't
@@ -297,4 +303,10 @@ in stdenv.mkDerivation (finalAttrs: {
       "i686-windows" "x86_64-windows"
     ];
   };
+} // lib.optionalAttrs stdenv.cc.isClang { # FIXME: move inside again when rebuilds are OK
+  hardeningDisable = optionals stdenv.cc.isClang [
+    # remove once https://github.com/NixOS/nixpkgs/issues/318674 is
+    # addressed properly
+    "zerocallusedregs"
+  ];
 })
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index f788bcef370a..4e164f25e9ee 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -10,7 +10,7 @@
 , pkg-config
 , clang
 , bintools
-, python3
+, python3Packages
 , git
 , fetchpatch
 , makeWrapper
@@ -42,6 +42,7 @@
 }:
 
 let
+  python3 = python3Packages.python.withPackages (p: [ p.setuptools ]); # python 3.12 compat.
 
   inherit (stdenv) hostPlatform targetPlatform;
 
diff --git a/pkgs/development/compilers/swift/wrapper/wrapper.sh b/pkgs/development/compilers/swift/wrapper/wrapper.sh
index 5836dea39787..5cd5d8da8819 100644
--- a/pkgs/development/compilers/swift/wrapper/wrapper.sh
+++ b/pkgs/development/compilers/swift/wrapper/wrapper.sh
@@ -252,7 +252,7 @@ for ((i=0; i < ${#extraBefore[@]}; i++));do
         # TODO: Assumes macOS.
         extraBefore[i]="${extraBefore[i]/-apple-darwin/-apple-macosx${MACOSX_DEPLOYMENT_TARGET:-11.0}}"
         ;;
-    -march=*)
+    -march=*|-mcpu=*|-mfloat-abi=*|-mfpu=*|-mmode=*|-mthumb|-marm|-mtune=*)
         [[ i -gt 0 && ${extraBefore[i-1]} == -Xcc ]] && continue
         extraBefore=(
             "${extraBefore[@]:0:i}"
diff --git a/pkgs/development/compilers/temurin-bin/generate-sources.py b/pkgs/development/compilers/temurin-bin/generate-sources.py
index bb60d6903df1..befb24422936 100755
--- a/pkgs/development/compilers/temurin-bin/generate-sources.py
+++ b/pkgs/development/compilers/temurin-bin/generate-sources.py
@@ -6,10 +6,10 @@ import re
 import requests
 import sys
 
-feature_versions = (8, 11, 16, 17, 18, 19, 20, 21)
+feature_versions = (8, 11, 16, 17, 18, 19, 20, 21, 22)
 oses = ("mac", "linux", "alpine-linux")
 types = ("jre", "jdk")
-impls = ("hotspot")
+impls = ("hotspot",)
 
 arch_to_nixos = {
     "x64": ("x86_64",),
diff --git a/pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix b/pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix
index 8f6831a7907c..886c92ba2e38 100644
--- a/pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix
@@ -1,11 +1,12 @@
 { name-prefix ? "temurin"
 , brand-name ? "Eclipse Temurin"
 , sourcePerArch
-, knownVulnerabilities ? []
+, knownVulnerabilities ? [ ]
 }:
 
 { swingSupport ? true # not used for now
-, lib, stdenv
+, lib
+, stdenv
 , fetchurl
 , setJavaClassPath
 }:
@@ -17,7 +18,8 @@ let
     (arch: builtins.elem arch validCpuTypes)
     (builtins.attrNames sourcePerArch);
   result = stdenv.mkDerivation {
-    pname = if sourcePerArch.packageType == "jdk"
+    pname =
+      if sourcePerArch.packageType == "jdk"
       then "${name-prefix}-bin"
       else "${name-prefix}-${sourcePerArch.packageType}-bin";
     version =
@@ -66,10 +68,11 @@ let
       license = licenses.gpl2Classpath;
       sourceProvenance = with sourceTypes; [ binaryNativeCode binaryBytecode ];
       description = "${brand-name}, prebuilt OpenJDK binary";
-      platforms = builtins.map (arch: arch + "-darwin") providedCpuTypes;  # some inherit jre.meta.platforms
+      platforms = builtins.map (arch: arch + "-darwin") providedCpuTypes; # some inherit jre.meta.platforms
       maintainers = with maintainers; [ taku0 ];
       inherit knownVulnerabilities;
       mainProgram = "java";
     };
   };
-in result
+in
+result
diff --git a/pkgs/development/compilers/temurin-bin/jdk-darwin.nix b/pkgs/development/compilers/temurin-bin/jdk-darwin.nix
index 5122b6ed7294..622d1629dbb5 100644
--- a/pkgs/development/compilers/temurin-bin/jdk-darwin.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-darwin.nix
@@ -2,27 +2,34 @@
 
 let
   sources = (lib.importJSON ./sources.json).hotspot.mac;
-  common = opts: callPackage (import ./jdk-darwin-base.nix opts) {};
+  common = opts: callPackage (import ./jdk-darwin-base.nix opts) { };
+
+  EOL = [ "This JDK version has reached End of Life." ];
 in
 {
   jdk-8 = common { sourcePerArch = sources.jdk.openjdk8; };
   jre-8 = common { sourcePerArch = sources.jre.openjdk8; };
+
   jdk-11 = common { sourcePerArch = sources.jdk.openjdk11; };
   jre-11 = common { sourcePerArch = sources.jre.openjdk11; };
-  jdk-16 = common { sourcePerArch = sources.jdk.openjdk16; };
+
+  jdk-16 = common { sourcePerArch = sources.jdk.openjdk16; knownVulnerabilities = EOL; };
 
   jdk-17 = common { sourcePerArch = sources.jdk.openjdk17; };
   jre-17 = common { sourcePerArch = sources.jre.openjdk17; };
 
-  jdk-18 = common { sourcePerArch = sources.jdk.openjdk18; };
-  jre-18 = common { sourcePerArch = sources.jre.openjdk18; };
+  jdk-18 = common { sourcePerArch = sources.jdk.openjdk18; knownVulnerabilities = EOL; };
+  jre-18 = common { sourcePerArch = sources.jre.openjdk18; knownVulnerabilities = EOL; };
 
-  jdk-19 = common { sourcePerArch = sources.jdk.openjdk19; };
-  jre-19 = common { sourcePerArch = sources.jre.openjdk19; };
+  jdk-19 = common { sourcePerArch = sources.jdk.openjdk19; knownVulnerabilities = EOL; };
+  jre-19 = common { sourcePerArch = sources.jre.openjdk19; knownVulnerabilities = EOL; };
 
-  jdk-20 = common { sourcePerArch = sources.jdk.openjdk20; };
-  jre-20 = common { sourcePerArch = sources.jre.openjdk20; };
+  jdk-20 = common { sourcePerArch = sources.jdk.openjdk20; knownVulnerabilities = EOL; };
+  jre-20 = common { sourcePerArch = sources.jre.openjdk20; knownVulnerabilities = EOL; };
 
   jdk-21 = common { sourcePerArch = sources.jdk.openjdk21; };
   jre-21 = common { sourcePerArch = sources.jre.openjdk21; };
+
+  jdk-22 = common { sourcePerArch = sources.jdk.openjdk22; };
+  jre-22 = common { sourcePerArch = sources.jre.openjdk22; };
 }
diff --git a/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix b/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix
index ba56518e15a6..9da96aee8d5a 100644
--- a/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix
@@ -1,7 +1,7 @@
 { name-prefix ? "temurin"
 , brand-name ? "Eclipse Temurin"
 , sourcePerArch
-, knownVulnerabilities ? []
+, knownVulnerabilities ? [ ]
 }:
 
 { stdenv
@@ -10,18 +10,18 @@
 , autoPatchelfHook
 , makeWrapper
 , setJavaClassPath
-# minimum dependencies
+  # minimum dependencies
 , alsa-lib
 , fontconfig
 , freetype
 , libffi
 , xorg
 , zlib
-# runtime dependencies
+  # runtime dependencies
 , cups
-# runtime dependencies for GTK+ Look and Feel
-# TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
-# which should be fixable, this is a no-rebuild workaround for GHC.
+  # runtime dependencies for GTK+ Look and Feel
+  # TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
+  # which should be fixable, this is a no-rebuild workaround for GHC.
 , gtkSupport ? !stdenv.targetPlatform.isGhcjs
 , cairo
 , glib
@@ -33,7 +33,9 @@ let
   runtimeDependencies = [
     cups
   ] ++ lib.optionals gtkSupport [
-    cairo glib gtk3
+    cairo
+    glib
+    gtk3
   ];
   runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
   validCpuTypes = builtins.attrNames lib.systems.parse.cpuTypes;
@@ -41,7 +43,8 @@ let
     (arch: builtins.elem arch validCpuTypes)
     (builtins.attrNames sourcePerArch);
   result = stdenv.mkDerivation {
-    pname = if sourcePerArch.packageType == "jdk"
+    pname =
+      if sourcePerArch.packageType == "jdk"
       then "${name-prefix}-bin"
       else "${name-prefix}-${sourcePerArch.packageType}-bin";
 
@@ -123,10 +126,11 @@ let
       license = licenses.gpl2Classpath;
       sourceProvenance = with sourceTypes; [ binaryNativeCode binaryBytecode ];
       description = "${brand-name}, prebuilt OpenJDK binary";
-      platforms = builtins.map (arch: arch + "-linux") providedCpuTypes;  # some inherit jre.meta.platforms
+      platforms = builtins.map (arch: arch + "-linux") providedCpuTypes; # some inherit jre.meta.platforms
       maintainers = with maintainers; [ taku0 ];
       inherit knownVulnerabilities;
       mainProgram = "java";
     };
   };
-in result
+in
+result
diff --git a/pkgs/development/compilers/temurin-bin/jdk-linux.nix b/pkgs/development/compilers/temurin-bin/jdk-linux.nix
index 87a00a373916..2a38e3472d53 100644
--- a/pkgs/development/compilers/temurin-bin/jdk-linux.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-linux.nix
@@ -3,27 +3,34 @@
 let
   variant = if stdenv.hostPlatform.isMusl then "alpine-linux" else "linux";
   sources = (lib.importJSON ./sources.json).hotspot.${variant};
-  common = opts: callPackage (import ./jdk-linux-base.nix opts) {};
+  common = opts: callPackage (import ./jdk-linux-base.nix opts) { };
+
+  EOL = [ "This JDK version has reached End of Life." ];
 in
 {
   jdk-8 = common { sourcePerArch = sources.jdk.openjdk8; };
   jre-8 = common { sourcePerArch = sources.jre.openjdk8; };
+
   jdk-11 = common { sourcePerArch = sources.jdk.openjdk11; };
   jre-11 = common { sourcePerArch = sources.jre.openjdk11; };
-  jdk-16 = common { sourcePerArch = sources.jdk.openjdk16; };
+
+  jdk-16 = common { sourcePerArch = sources.jdk.openjdk16; knownVulnerabilities = EOL; };
 
   jdk-17 = common { sourcePerArch = sources.jdk.openjdk17; };
   jre-17 = common { sourcePerArch = sources.jre.openjdk17; };
 
-  jdk-18 = common { sourcePerArch = sources.jdk.openjdk18; };
-  jre-18 = common { sourcePerArch = sources.jre.openjdk18; };
+  jdk-18 = common { sourcePerArch = sources.jdk.openjdk18; knownVulnerabilities = EOL; };
+  jre-18 = common { sourcePerArch = sources.jre.openjdk18; knownVulnerabilities = EOL; };
 
-  jdk-19 = common { sourcePerArch = sources.jdk.openjdk19; };
-  jre-19 = common { sourcePerArch = sources.jre.openjdk19; };
+  jdk-19 = common { sourcePerArch = sources.jdk.openjdk19; knownVulnerabilities = EOL; };
+  jre-19 = common { sourcePerArch = sources.jre.openjdk19; knownVulnerabilities = EOL; };
 
-  jdk-20 = common { sourcePerArch = sources.jdk.openjdk20; };
-  jre-20 = common { sourcePerArch = sources.jre.openjdk20; };
+  jdk-20 = common { sourcePerArch = sources.jdk.openjdk20; knownVulnerabilities = EOL; };
+  jre-20 = common { sourcePerArch = sources.jre.openjdk20; knownVulnerabilities = EOL; };
 
   jdk-21 = common { sourcePerArch = sources.jdk.openjdk21; };
   jre-21 = common { sourcePerArch = sources.jre.openjdk21; };
+
+  jdk-22 = common { sourcePerArch = sources.jdk.openjdk22; };
+  jre-22 = common { sourcePerArch = sources.jre.openjdk22; };
 }
diff --git a/pkgs/development/compilers/temurin-bin/sources.json b/pkgs/development/compilers/temurin-bin/sources.json
index 00a0e72997ec..fe24b9f5199c 100644
--- a/pkgs/development/compilers/temurin-bin/sources.json
+++ b/pkgs/development/compilers/temurin-bin/sources.json
@@ -7,9 +7,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "d5e2235d3707526f7c9ba3f0dc194e60d5dec33eceff2a2dcf9d874464cc0e9e",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_x64_alpine-linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "b45c467be52fe11ffd9bf69b3a035068134b305053874de4f3b3c5e5e1419659",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_alpine-linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk16": {
@@ -27,9 +27,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "c2a571a56e5bd3f30956b17b048880078c7801ed9e8754af6d1e38b9176059a9",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_alpine-linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "839326b5b4b3e4ac2edc3b685c8ab550f9b6d267eddf966323c801cb21e3e018",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_x64_alpine-linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -64,28 +64,44 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "77006c0a753808c2a6662007906eb6eb230f2fb6eb9d201a39cc46113e68f82c",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "0f68a9122054149861f6ce9d1b1c176bbe30dd76b36b74c916ba897c12e9d970",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "8e861638bf6b08c6d5837de6dc929930550928ec5fcc81b9fa7e8296afd0f9c0",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "86a7b47c9277f2fd063ec910616b3676d86553ab7d23aa3bd365e51a57be1dc5",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_aarch64_alpine-linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "422f23f5109056cacb9227247bebf8532e2dc3c9d505e71637ba610569d6b3ff",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "d226e44b3513942db855df9a8737d848f64069848970d4cfd35ee3c38f2525c1",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_x64_alpine-linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "5",
-            "sha256": "6cf2d4925c387c4cdc0bf2e71de3690527141b5244695d0b3109ce83a8512235",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jdk_x64_alpine-linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "409091665e5f8cf678938bbbc0d377122ef8bad7b1c97a0f809da054db956e51",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_x64_alpine-linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       },
@@ -95,9 +111,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "6a3d1759bdf91433411d37ca2ad1505a7f214c1401797834e9884165c2457368",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_x64_alpine-linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "6972a6251bc88d6fbb64a188557cf165f1c415ded550d2a280bbcbc4272caff1",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_x64_alpine-linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk17": {
@@ -105,9 +121,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "70e5d108f51ae7c7b2435d063652df058723e303a18b4f72f17f75c5320052d3",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_alpine-linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "b5dffd0be08c464d9c3903e2947508c1a5c21804ea1cff5556991a2a47d617d8",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_x64_alpine-linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -142,28 +158,44 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "2898ea1ddf6f70f09b09cf99d928f6d4c862f78f81104f5dce3e44a832b8444a",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_alpine-linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "54e8618da373258654fe788d509f087d3612de9e080eb6831601069dbc8a4b2b",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_aarch64_alpine-linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "b3e7170deab11a7089fe8e14f9f398424fd86db085f745dad212f6cfc4121df6",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "6cac56dde6793d887deea101cfff283dc5f285e1118c21cbd1c4cb69f1072e55",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_aarch64_alpine-linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "a8fcc43927664ba191c9a77d1013f1f32fec1acc22fe6f0c29d687221f2cc95d",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "e7c26ad00e3ded356b8c4b20b184ccf5bd63ccdccabde8d4a892389f178f1d5b",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_x64_alpine-linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "5",
-            "sha256": "7040d865493f13204194c5a1add63e22516b1fa4481264baa6a5b2614a275a0e",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jre_x64_alpine-linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "c82962d7378d1fd415db594fce6ec047939e9fab5301fa4407cd7faea9ea7e31",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_x64_alpine-linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       }
@@ -173,35 +205,35 @@
         "openjdk11": {
           "aarch64": {
             "build": "9",
-            "sha256": "8c3146035b99c55ab26a2982f4b9abd2bf600582361cf9c732539f713d271faf",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "e00476a7be3c4adfa9b3d55d30768967fd246a8352e518894e183fa444d4d3ce",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "armv6l": {
-            "build": "1",
-            "sha256": "e83674aee238ebb5f359b9395b3c5e3fad5b645846095494662802d2f0fd01c9",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_arm_linux_hotspot_11.0.20.1_1.tar.gz",
-            "version": "11.0.20"
+            "build": "9",
+            "sha256": "8077edc07a57d846c3d11286a7caf05ed6ca6d6c1234bf0e03611f18e187f075",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_arm_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "armv7l": {
-            "build": "1",
-            "sha256": "e83674aee238ebb5f359b9395b3c5e3fad5b645846095494662802d2f0fd01c9",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_arm_linux_hotspot_11.0.20.1_1.tar.gz",
-            "version": "11.0.20"
+            "build": "9",
+            "sha256": "8077edc07a57d846c3d11286a7caf05ed6ca6d6c1234bf0e03611f18e187f075",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_arm_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "packageType": "jdk",
           "powerpc64le": {
             "build": "9",
-            "sha256": "262ff98d6d88a7c7cc522cb4ec4129491a0eb04f5b17dcca0da57cfcdcf3830d",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "f56068bb64c6bf858894f75c2bc261f54db32932422eb07527f36ae40046e9a0",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "60ea98daa09834fdd3162ca91ddc8d92a155ab3121204f6f643176ee0c2d0d5e",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_x64_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "23e47ea7a3015be3240f21185fd902adebdcf76530757c9b482c7eb5bd3417c2",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk16": {
@@ -241,35 +273,35 @@
         "openjdk17": {
           "aarch64": {
             "build": "9",
-            "sha256": "e2c5e26f8572544b201bc22a9b28f2b1a3147ab69be111cea07c7f52af252e75",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "a900acf3ae56b000afc35468a083b6d6fd695abec87a8abdb02743d5c72f6d6d",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "armv6l": {
-            "build": "1",
-            "sha256": "b1f1d8b7fcb159a0a8029b6c3106d1d16207cecbb2047f9a4be2a64d29897da5",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8.1%2B1/OpenJDK17U-jdk_arm_linux_hotspot_17.0.8.1_1.tar.gz",
-            "version": "17.0.8"
+            "build": "9",
+            "sha256": "9b5c375ed7ce654083c6c1137d8daadebaf8657650576115f0deafab00d0f1d7",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_arm_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "armv7l": {
-            "build": "1",
-            "sha256": "b1f1d8b7fcb159a0a8029b6c3106d1d16207cecbb2047f9a4be2a64d29897da5",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8.1%2B1/OpenJDK17U-jdk_arm_linux_hotspot_17.0.8.1_1.tar.gz",
-            "version": "17.0.8"
+            "build": "9",
+            "sha256": "9b5c375ed7ce654083c6c1137d8daadebaf8657650576115f0deafab00d0f1d7",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_arm_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "packageType": "jdk",
           "powerpc64le": {
             "build": "9",
-            "sha256": "3ae4b254d5b720f94f986481e787fbd67f0667571140ba2e2ae5020ceddbc826",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "44bdd662c3b832cfe0b808362866b8d7a700dd60e6e39716dee97211d35c230f",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "aa7fb6bb342319d227a838af5c363bfa1b4a670c209372f9e6585bd79da6220c",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -364,58 +396,80 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "e184dc29a6712c1f78754ab36fb48866583665fa345324f1a79e569c064f95e9",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "7d3ab0e8eba95bd682cfda8041c6cb6fa21e09d0d9131316fd7c96c78969de31",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jdk",
+          "powerpc64le": {
+            "build": "9",
+            "sha256": "9a1079d7f0fc72951fdc9a0029e49a15f6ba114683aee626f882ee2c761f1d57",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "fffa52c22d797b715a962e6c8d11ec7d79b90dd819b5bc51d62137ea4b22a340",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_x64_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "d8488fa1e4e8c1e318cef4c0fc3842a7f15a4cf52b27054663bb94471f54b3fa",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_aarch64_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jdk",
           "powerpc64le": {
-            "build": "12",
-            "sha256": "9574828ef3d735a25404ced82e09bf20e1614f7d6403956002de9cfbfcb8638f",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "4113606ba65044a3cbd7678e1c0d41881d24a2441c8ab8b658b4ac58da624de5",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_ppc64le_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "1a6fa8abda4c5caed915cfbeeb176e7fbd12eb6b222f26e290ee45808b529aa1",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "e59c6bf801cc023a1ea78eceb5e6756277f1564cd0a421ea984efe6cb96cfcf8",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_x64_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
           "aarch64": {
             "build": "8",
-            "sha256": "70636c2fa4927913e9e869d471607a99d3a521c1fa3f3687b889c2acba67c493",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jdk_aarch64_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "3504d748a93f23cac8c060bd33231bd51e90dcb620f38dadc6239b6cd2a5011c",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_aarch64_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "armv6l": {
-            "build": "5",
-            "sha256": "5d805ff157f272acf0f7d192f21af4a3b68c840333ca95568e4e07142efc369d",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jdk_arm_linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "be4aff6fa7bf6515f16f93dcaf9fdc61853fe1ef0d25b08a1bb1cf6e3d047391",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_arm_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "armv7l": {
-            "build": "5",
-            "sha256": "5d805ff157f272acf0f7d192f21af4a3b68c840333ca95568e4e07142efc369d",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jdk_arm_linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "be4aff6fa7bf6515f16f93dcaf9fdc61853fe1ef0d25b08a1bb1cf6e3d047391",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_arm_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "packageType": "jdk",
           "powerpc64le": {
             "build": "8",
-            "sha256": "9d9813d2840360ffdbc449c45e71124e8170c31a3b6cce9151fbb31352064406",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jdk_ppc64le_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "6b7ed7996788075e182dd33349288346240fbce540e50fd77aecfc309a5ada19",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_ppc64le_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "8",
-            "sha256": "15d091e22aa0cad12a241acff8c1634e7228b9740f8d19634250aa6fe0c19a33",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jdk_x64_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "b9884a96f78543276a6399c3eb8c2fd8a80e6b432ea50e87d3d12d495d1d2808",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_x64_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       },
@@ -423,69 +477,69 @@
         "openjdk11": {
           "aarch64": {
             "build": "9",
-            "sha256": "8dc527e5c5da62f80ad3b6a2cd7b1789f745b1d90d5e83faba45f7a1d0b6cab8",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "7290ace47a030d89ea023c28e7aa555c9da72b4194f73b39ec9d058011bf06dd",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "armv6l": {
-            "build": "1",
-            "sha256": "2fc1cc935897312c0bc2515b2e7ea1fa3b267e77305a1b51a8c3917d92af380f",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jre_arm_linux_hotspot_11.0.20.1_1.tar.gz",
-            "version": "11.0.20"
+            "build": "9",
+            "sha256": "025f994549708f7291ce3b0fa7c41f7e78ec3af3eae3f85fffe9c5fa4a54889f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_arm_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "armv7l": {
-            "build": "1",
-            "sha256": "2fc1cc935897312c0bc2515b2e7ea1fa3b267e77305a1b51a8c3917d92af380f",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jre_arm_linux_hotspot_11.0.20.1_1.tar.gz",
-            "version": "11.0.20"
+            "build": "9",
+            "sha256": "025f994549708f7291ce3b0fa7c41f7e78ec3af3eae3f85fffe9c5fa4a54889f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_arm_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "packageType": "jre",
           "powerpc64le": {
             "build": "9",
-            "sha256": "286e37ce06316185377eea847d2aa9f1523b9f1428684e59e772f2f6055e89b9",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_ppc64le_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "3b3fbd324620fd914bd8462e292124493fcf846fd69195c4b9a231131dc68d5f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_ppc64le_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "156861bb901ef18759e05f6f008595220c7d1318a46758531b957b0c950ef2c3",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_x64_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "786a72296189ba8e43999532aa73730d87ec1fce558eb3c4e98b611b423375e3",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_x64_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk17": {
           "aarch64": {
             "build": "9",
-            "sha256": "05b192f81ed478178ba953a2a779b67fc5a810acadb633ad69f8c4412399edb8",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "ccfa23c25790475c84df983cc5f729b94c04d9ea9863912deb15c6266782cf16",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "armv6l": {
-            "build": "1",
-            "sha256": "8af898c5d356f0b2cee2db67ff9c8e7a8e738c0f6b3a61c383150b3168b9ea58",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8.1%2B1/OpenJDK17U-jre_arm_linux_hotspot_17.0.8.1_1.tar.gz",
-            "version": "17.0.8"
+            "build": "9",
+            "sha256": "2e06401aa3aa7a825d73a6af8e9462449b1a86e7705b793dc8ec90423b602ee2",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_arm_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "armv7l": {
-            "build": "1",
-            "sha256": "8af898c5d356f0b2cee2db67ff9c8e7a8e738c0f6b3a61c383150b3168b9ea58",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8.1%2B1/OpenJDK17U-jre_arm_linux_hotspot_17.0.8.1_1.tar.gz",
-            "version": "17.0.8"
+            "build": "9",
+            "sha256": "2e06401aa3aa7a825d73a6af8e9462449b1a86e7705b793dc8ec90423b602ee2",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_arm_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "packageType": "jre",
           "powerpc64le": {
             "build": "9",
-            "sha256": "79c85ecf1320c67b828310167e1ced62e402bc86a5d47ca9cc7bfa3b708cb07a",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "884b5cb817e50010b4d0a3252afb6a80db18995af19bbd16a37348b2c37949bc",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "bcb1b7b8ad68c93093f09b591b7cb17161d39891f7d29d33a586f5a328603707",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -580,58 +634,80 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "4582c4cc0c6d498ba7a23fdb0a5179c9d9c0d7a26f2ee8610468d5c2954fcf2f",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "c7c31bc6f5ab4c4b6f4559e11c2fa9541ae6757ab8da6dd85c29163913bd9238",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jre",
+          "powerpc64le": {
+            "build": "9",
+            "sha256": "aa628c6accc9d075b7b0f2bff6487f8ca0b8f057af31842a85fc8b363e1e10f3",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "f1af100c4afca2035f446967323230150cfe5872b5a664d98c86963e5c066e0d",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_x64_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "8e5996a2bbae2da9797cff5a62cb2080965e08fd66de24673b29a8e481ec769e",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_aarch64_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jre",
           "powerpc64le": {
-            "build": "12",
-            "sha256": "05cc9b7bfbe246c27d307783b3d5095797be747184b168018ae3f7cc55608db2",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "7df4a10fab324181a6c9e8b1e2a45042b8d30490f0fdb937a536f6cd17c907ef",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_ppc64le_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "277f4084bee875f127a978253cfbaad09c08df597feaf5ccc82d2206962279a3",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "154dbc7975cf765c59bdaa1e693d6c8b009635c9a182d6d6d9f0cfbec5317b4c",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_x64_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
           "aarch64": {
             "build": "8",
-            "sha256": "37b997f12cd572da979283fccafec9ba903041a209605b50fcb46cc34f1a9917",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jre_aarch64_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "17550a6a4ddf71ac81ba8f276467bc58f036c123c0f1bafcafd69f70e3e49cf5",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_aarch64_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "armv6l": {
-            "build": "5",
-            "sha256": "b92fb3972372b5d1f9fb51815def903105722b747f680b7ecf2ba2ba863ab156",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jre_arm_linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "1a6b470ac83b241223447a1e6cb55c4a8f78af0146b9387e9842625041226654",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_arm_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "armv7l": {
-            "build": "5",
-            "sha256": "b92fb3972372b5d1f9fb51815def903105722b747f680b7ecf2ba2ba863ab156",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jre_arm_linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "1a6b470ac83b241223447a1e6cb55c4a8f78af0146b9387e9842625041226654",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_arm_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "packageType": "jre",
           "powerpc64le": {
             "build": "8",
-            "sha256": "0ecb0aeb54fb9d3c9e1a7ea411490127e8e298d93219fafc4dd6051a5b74671f",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jre_ppc64le_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "d3157230c01b320e47ad6df650e83b15f8f76294d0df9f1c03867d07fe2883c9",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_ppc64le_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "8",
-            "sha256": "91d31027da0d985be3549714389593d9e0da3da5057d87e3831c7c538b9a2a0f",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jre_x64_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "a8d994332a2ff15d48bf04405c3b2f6bd331a928dd96639b15e62891f7172363",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_x64_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       }
@@ -641,17 +717,17 @@
         "openjdk11": {
           "aarch64": {
             "build": "9",
-            "sha256": "3be236f2cf9612cd38cd6b7cfa4b8eef642a88beab0cd37c6ccf1766d755b4cc",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_aarch64_mac_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "49122443bdeab2c9f468bd400f58f85a9ea462846faa79084fd6fd786d9b492d",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_aarch64_mac_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "39e30e333d01f70765f0fdc57332bc2c5ae101392bcc315ef06f472d80d8e2d7",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_x64_mac_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "4dbd21d9a0311d321f5886eda50c3086026ed61d02e1a85f7b8c2e9ad557bf03",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_mac_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk16": {
@@ -667,17 +743,17 @@
         "openjdk17": {
           "aarch64": {
             "build": "9",
-            "sha256": "823777266415347983bbd87ccd8136537242ff27e62f307b7e8521494c665f0d",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_aarch64_mac_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "09a162c58dd801f7cfacd87e99703ed11fb439adc71cfa14ceb2d3194eaca01c",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_aarch64_mac_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "c69b37ea72136df49ce54972408803584b49b2c91b0fbc876d7125e963c7db37",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_mac_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "f8b96724618f4df557c47f11048d1084e98ed3eb87f0dbd5b84f768a80c3348e",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_x64_mac_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -730,18 +806,34 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "0d29257c9bcb5f20f5c4643ef9437f36b10376863eddaf6248d09093796c6b30",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "b6be6a9568be83695ec6b7cb977f4902f7be47d74494c290bc2a5c3c951e254f",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "f777103aab94330d14a29bd99f3a26d60abbab8e2c375cec9602746096721a7c",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_x64_mac_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "80d6fa75e87280202ae7660139870fe50f07fca9dc6c4fbd3f2837cbd70ec902",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_aarch64_mac_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "35f3cbc86d7ff0a01facefd741d5cfb675867e0a5ec137f62ba071d2511a45c9",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_mac_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "9445952d4487451af024a9a3f56373df76fbd928d9ff9186988aa27be2e4f10c",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_x64_mac_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
@@ -749,9 +841,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "8",
-            "sha256": "d152f5b2ed8473ee0eb29c7ee134958d75ea86c8ccbafb5ee04a5545dd76108f",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jdk_x64_mac_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "fd62491f7634c1cbed7557d6b21db7ef4818fbc0e63e678110d9d92cbea4ad8c",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_x64_mac_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       },
@@ -759,33 +851,33 @@
         "openjdk11": {
           "aarch64": {
             "build": "9",
-            "sha256": "bcac3231195a95cac397a35410bfa3f0945ec03e5194e7b0c1d0e785a48f8b76",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_aarch64_mac_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "8ecc59f0bda845717cecbc6025c4c7fcc26d6ffe48824b8f7a5db024216c5fb4",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_aarch64_mac_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "43d29affe994a09de31bf2fb6f8ab6d6792ba4267b9a2feacaa1f6e042481b9b",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_x64_mac_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "9855769dddc3f3b5a1fb530ce953025b1f7b3fac861628849b417676b1310b1f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_x64_mac_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk17": {
           "aarch64": {
             "build": "9",
-            "sha256": "89831d03b7cd9922bd178f1a9c8544a36c54d52295366db4e6628454b01acaef",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_aarch64_mac_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "003d3e0a65a2f0633b8bfed42be133724b490acb323c174c708d3a446d5fc660",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_aarch64_mac_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "ba214f2217dc134e94432085cff4fc5a97e964ffc211d343725fd535f3cd98a0",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_mac_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "232c40bebd6ddbb673862e86e7e6e09bcfe399e5a53c8a6b77bf1ceab8edefd0",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_x64_mac_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -838,18 +930,34 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "bc384961d3a866198b1055a80fdff7fb6946aa6823b3ce624cc8c3125a26bed5",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_mac_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "8df56361b834c4681ef304ae9dc8406ce3d79c8572d2d6c2fefcbea55be7d86b",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_aarch64_mac_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "d7fc89c196ed03deb8a98f6599e1b2e78859ec8ec752142549cd3710f3e1a025",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_x64_mac_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "73a8a0270534db7b4760399f41c573fd1cff5f86f4e68b08988afee0df814889",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_aarch64_mac_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "c21a2648ec21bc4701acfb6b7a1fd90aca001db1efb8454e2980d4c8dcd9e310",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_mac_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "d21e84edc1d7cc58fc04bcd9a214b71bf85e8ea348f8659197be3383afcb2b9a",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_x64_mac_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
@@ -857,9 +965,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "8",
-            "sha256": "f1f15920ed299e10c789aef6274d88d45eb21b72f9a7b0d246a352107e344e6a",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jre_x64_mac_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "1237e4f4238211d9137eec838e5d7cabdc9d93d41001cf41f6de3a4eb90884ef",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_x64_mac_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       }
diff --git a/pkgs/development/compilers/vyper/default.nix b/pkgs/development/compilers/vyper/default.nix
index 078cb7dac925..b0a8b02ae49a 100644
--- a/pkgs/development/compilers/vyper/default.nix
+++ b/pkgs/development/compilers/vyper/default.nix
@@ -9,7 +9,6 @@
 , pycryptodome
 , pytest-runner
 , pythonOlder
-, pythonRelaxDepsHook
 , recommonmark
 , setuptools-scm
 , sphinx
@@ -50,7 +49,6 @@ buildPythonPackage rec {
     # ever since https://github.com/vyperlang/vyper/pull/2816
     git
 
-    pythonRelaxDepsHook
     pytest-runner
     setuptools-scm
   ];
diff --git a/pkgs/development/cuda-modules/cuda/overrides.nix b/pkgs/development/cuda-modules/cuda/overrides.nix
index 00ebb5535c69..46e4401f6a26 100644
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@@ -238,7 +238,7 @@ filterAndCreateOverrides {
 
   cuda_demo_suite =
     {
-      freeglut,
+      libglut,
       libcufft,
       libcurand,
       libGLU,
@@ -247,7 +247,7 @@ filterAndCreateOverrides {
     }:
     prevAttrs: {
       buildInputs = prevAttrs.buildInputs ++ [
-        freeglut
+        libglut
         libcufft
         libcurand
         libGLU
diff --git a/pkgs/development/cuda-modules/cudatoolkit/default.nix b/pkgs/development/cuda-modules/cudatoolkit/default.nix
index 24e41d331895..d2f8e2ce3fdf 100644
--- a/pkgs/development/cuda-modules/cudatoolkit/default.nix
+++ b/pkgs/development/cuda-modules/cudatoolkit/default.nix
@@ -35,7 +35,7 @@
   wayland,
   xorg,
   zlib,
-  freeglut,
+  libglut,
   libGLU,
   libsForQt5,
   libtiff,
@@ -85,7 +85,7 @@ backendStdenv.mkDerivation rec {
   buildInputs =
     lib.optionals (lib.versionOlder version "11") [
       libsForQt5.qt5.qtwebengine
-      freeglut
+      libglut
       libGLU
     ]
     ++ [
diff --git a/pkgs/development/embedded/platformio/core.nix b/pkgs/development/embedded/platformio/core.nix
index 9013f39ad424..f2ebeba39361 100644
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@@ -46,11 +46,13 @@ with python3Packages; buildPythonApplication rec {
   postPatch = ''
     # Disable update checks at runtime
     substituteInPlace platformio/maintenance.py --replace-fail '    check_platformio_upgrade()' ""
+
+    # Remove filterwarnings which fails on new deprecations in Python 3.12 for 3.14
+    rm tox.ini
   '';
 
   nativeBuildInputs = [
     installShellFiles
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/interpreters/io/default.nix b/pkgs/development/interpreters/io/default.nix
index 8a6de1f094d2..64e5b7c4d827 100644
--- a/pkgs/development/interpreters/io/default.nix
+++ b/pkgs/development/interpreters/io/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, zlib, sqlite, gmp, libffi, cairo,
   ncurses, freetype, libGLU, libGL, libpng, libtiff, libjpeg, readline, libsndfile,
-  libxml2, freeglut, libsamplerate, pcre, libevent, libedit, yajl,
+  libxml2, libglut, libsamplerate, pcre, libevent, libedit, yajl,
   python3, openssl, glfw, pkg-config, libpthreadstubs, libXdmcp, libmemcached
 }:
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
   buildInputs = [
     zlib sqlite gmp libffi cairo ncurses freetype
     libGLU libGL libpng libtiff libjpeg readline libsndfile libxml2
-    freeglut libsamplerate pcre libevent libedit yajl
+    libglut libsamplerate pcre libevent libedit yajl
     glfw openssl libpthreadstubs libXdmcp
     libmemcached python3
   ];
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index 7775fa5c8493..497307d57b3f 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs:
   LuaCPathSearchPaths = luaPackages.luaLib.luaCPathList;
   setupHook = builtins.toFile "lua-setup-hook" ''
       source @out@/nix-support/utils.sh
-      addEnvHooks "$hostOffset" addToLuaPath
+      addEnvHooks "$hostOffset" luaEnvHook
       '';
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/interpreters/lua-5/tests/default.nix b/pkgs/development/interpreters/lua-5/tests/default.nix
index c95d11aefc96..768f07cb8400 100644
--- a/pkgs/development/interpreters/lua-5/tests/default.nix
+++ b/pkgs/development/interpreters/lua-5/tests/default.nix
@@ -96,4 +96,17 @@ in
 
       touch $out
     '');
+
+
+    /*
+    Check that a lua package's propagatedBuildInputs end up in LUA_PATH
+    */
+    checkPropagatedBuildInputs = pkgs.runCommandLocal "test-${lua.name}-setup-hook" ({
+      # lua-curl is a propagatedBuildInput of rest-nvim has
+      buildInputs = [ lua.pkgs.rest-nvim ];
+    }) (''
+      ${lua}/bin/lua -e "require'cURL'"
+      touch $out
+    '');
+
 })
diff --git a/pkgs/development/interpreters/lua-5/utils.sh b/pkgs/development/interpreters/lua-5/utils.sh
index 5491f8f7ad2d..2365af08dc9c 100644
--- a/pkgs/development/interpreters/lua-5/utils.sh
+++ b/pkgs/development/interpreters/lua-5/utils.sh
@@ -1,4 +1,8 @@
-#!/bin/sh
+#!/bin/bash
+
+declare -gA luaPathsSeen=()
+
+# shellcheck disable=SC2164,SC2041
 nix_print() {
   if [ ${NIX_DEBUG:-0} -ge $1 ]; then
     echo "$2"
@@ -33,13 +37,53 @@ addToLuaSearchPathWithCustomDelimiter() {
   shopt -u globstar
 }
 
+# used in setup Hooks to load LUA_PATH and LUA_CPATH
+# luaEnvHook
+luaEnvHook() {
+    _addToLuaPath "$1"
+}
+
 addToLuaPath() {
   local dir="$1"
 
+  if [ ! -d "$dir" ]; then
+    nix_debug "$dir not a directory abort"
+    return 0
+  fi
+  cd "$dir"
+  for pattern in @luapathsearchpaths@; do
+    addToLuaSearchPathWithCustomDelimiter LUA_PATH "$PWD/$pattern"
+  done
+
+  # LUA_CPATH
+  for pattern in @luacpathsearchpaths@; do
+    addToLuaSearchPathWithCustomDelimiter LUA_CPATH "$PWD/$pattern"
+  done
+  cd - >/dev/null
+}
+
+
+_addToLuaPath() {
+  local dir="$1"
+
+  echo "_addToLuaPath called for dir $dir"
+
   if [[ ! -d "$dir" ]]; then
     nix_debug "$dir not a directory abort"
     return 0
   fi
+
+# set -x
+  # if [ -n "${pythonPathsSeen[$dir]}" ]; then return; fi
+  if [[ -n "${luaPathsSeen[$dir]:-}" ]]; then
+  # if [ -n "${luaPathsSeen[$dir]}" ]; then
+    echo "$dir already parsed"
+    return
+  fi
+
+  luaPathsSeen["$dir"]=true
+
+  # shellcheck disable=SC2164
   cd "$dir"
   for pattern in @luapathsearchpaths@; do
     addToLuaSearchPathWithCustomDelimiter LUA_PATH "$PWD/$pattern"
@@ -49,6 +93,43 @@ addToLuaPath() {
   for pattern in @luacpathsearchpaths@; do
     addToLuaSearchPathWithCustomDelimiter LUA_CPATH "$PWD/$pattern"
   done
+
   cd - >/dev/null
+
+  addToSearchPath program_PATH "$dir"/bin
+
+  # Inspect the propagated inputs (if they exist) and recur on them.
+  local prop="$dir/nix-support/propagated-build-inputs"
+  if [ -e "$prop" ]; then
+    local new_path
+    for new_path in $(cat $prop); do
+        echo "newpath: $new_path"
+        _addToLuaPath "$new_path"
+    done
+  fi
+
 }
 
+# Builds environment variables like LUA_PATH and PATH walking through closure
+# of dependencies.
+buildLuaPath() {
+  local luaPath="$1"
+  local path
+
+  echo "BUILD_LUA_PATH"
+
+#   # set -x
+#   # Create an empty table of paths (see doc on loadFromPropagatedInputs
+#   # for how this is used). Build up the program_PATH and program_LUA_PATH
+#   # variables.
+  # declare -gA luaPathsSeen=()
+#   # shellcheck disable=SC2034
+  program_PATH=
+  luaPathsSeen["@lua@"]=1
+#   addToSearchPath program_PATH @lua@/bin
+  for path in $luaPath; do
+    _addToLuaPath "$path"
+  done
+}
+
+
diff --git a/pkgs/development/interpreters/lua-5/wrap.sh b/pkgs/development/interpreters/lua-5/wrap.sh
index 7d59cf609577..f6868e6faac5 100644
--- a/pkgs/development/interpreters/lua-5/wrap.sh
+++ b/pkgs/development/interpreters/lua-5/wrap.sh
@@ -9,24 +9,6 @@ wrapLuaPrograms() {
   wrapLuaProgramsIn "$out/bin" "$out $luaPath"
 }
 
-# Builds environment variables like LUA_PATH and PATH walking through closure
-# of dependencies.
-buildLuaPath() {
-  local luaPath="$1"
-  local path
-
-  # Create an empty table of paths (see doc on loadFromPropagatedInputs
-  # for how this is used). Build up the program_PATH and program_LUA_PATH
-  # variables.
-  declare -A luaPathsSeen=()
-  program_PATH=
-  luaPathsSeen["@lua@"]=1
-  addToSearchPath program_PATH @lua@/bin
-  for path in $luaPath; do
-    addToLuaPath "$path"
-  done
-}
-
 # with an executable shell script which will set some environment variables
 # and then call into the original binary (which has been given a .wrapped suffix).
 # luaPath is a list of directories
@@ -47,7 +29,6 @@ wrapLuaProgramsIn() {
   # Find all regular files in the output directory that are executable.
   find "$dir" -type f -perm -0100 -print0 | while read -d "" f; do
     # Rewrite "#! .../env lua" to "#! /nix/store/.../lua".
-    # Strip suffix, like "3" or "2.7m" -- we don't have any choice on which
     # Lua to use besides one with this hook anyway.
     if head -n1 "$f" | grep -q '#!.*/env.*\(lua\)'; then
       sed -i "$f" -e "1 s^.*/env[ ]*\(lua\)[^ ]*^#! @executable@^"
@@ -73,28 +54,3 @@ wrapLuaProgramsIn() {
 
   done
 }
-
-# Adds the lib and bin directories to the LUA_PATH and PATH variables,
-# respectively. Recurses on any paths declared in
-# `propagated-native-build-inputs`, while avoiding duplicating paths by
-# flagging the directories it has visited in `luaPathsSeen`.
-loadFromPropagatedInputs() {
-  local dir="$1"
-  # Stop if we've already visited here.
-  if [ -n "${luaPathsSeen[$dir]}" ]; then
-    return
-  fi
-  luaPathsSeen[$dir]=1
-
-  addToLuaPath "$dir"
-  addToSearchPath program_PATH $dir/bin
-
-  # Inspect the propagated inputs (if they exist) and recur on them.
-  local prop="$dir/nix-support/propagated-native-build-inputs"
-  if [ -e "$prop" ]; then
-    local new_path
-    for new_path in $(cat $prop); do
-      loadFromPropagatedInputs "$new_path"
-    done
-  fi
-}
diff --git a/pkgs/development/interpreters/lua-5/wrapper.nix b/pkgs/development/interpreters/lua-5/wrapper.nix
index 07ea75605c0f..6eb94b60360b 100644
--- a/pkgs/development/interpreters/lua-5/wrapper.nix
+++ b/pkgs/development/interpreters/lua-5/wrapper.nix
@@ -30,7 +30,7 @@ let
       fi
       mkdir -p "$out/bin"
 
-      addToLuaPath "$out"
+      buildLuaPath "$out"
 
       # take every binary from lua packages and put them into the env
       for path in ${lib.concatStringsSep " " paths}; do
diff --git a/pkgs/development/interpreters/luajit/default.nix b/pkgs/development/interpreters/luajit/default.nix
index 3b98e8c79014..25f3332b2602 100644
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   setupHook = builtins.toFile "lua-setup-hook" ''
       source @out@/nix-support/utils.sh
-      addEnvHooks "$hostOffset" addToLuaPath
+      addEnvHooks "$hostOffset" luaEnvHook
       '';
 
   # copied from python
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index ab5960b5ea61..0f989419b128 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -417,6 +417,9 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     (enableFeature enableGIL "gil")
   ] ++ optionals enableOptimizations [
     "--enable-optimizations"
+  ] ++ optionals (stdenv.isDarwin && configd == null) [
+    # Make conditional on Darwin for now to avoid causing Linux rebuilds.
+    "py_cv_module__scproxy=n/a"
   ] ++ optionals (sqlite != null) [
     "--enable-loadable-sqlite-extensions"
   ] ++ optionals (libxcrypt != null) [
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 08e017fb06e8..c406780e83fc 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -16,14 +16,14 @@
   passthruFun = import ./passthrufun.nix args;
 
   sources = {
-    python311 = {
+    python312 = {
       sourceVersion = {
         major = "3";
-        minor = "11";
-        patch = "9";
+        minor = "12";
+        patch = "4";
         suffix = "";
       };
-      hash = "sha256-mx6JZSP8UQaREmyGRAbZNgo9Hphqy9pZzaV7Wr2kW4c=";
+      hash = "sha256-9tQZpth0OrJnAIAbSQjSbZfouYbhT5XeMbMt4rDnlVQ=";
     };
   };
 
@@ -68,25 +68,25 @@ in {
     inherit passthruFun;
   };
 
-  python311 = callPackage ./cpython ({
+  python311 = callPackage ./cpython {
     self = __splicedPackages.python311;
-    inherit (darwin) configd;
-    inherit passthruFun;
-  } // sources.python311);
-
-  python312 = callPackage ./cpython {
-    self = __splicedPackages.python312;
     sourceVersion = {
       major = "3";
-      minor = "12";
-      patch = "3";
+      minor = "11";
+      patch = "9";
       suffix = "";
     };
-    hash = "sha256-Vr/vH9/BIhzmcg5DpmHj60F4XdkUzplpjYx4lq9L2qE=";
+    hash = "sha256-mx6JZSP8UQaREmyGRAbZNgo9Hphqy9pZzaV7Wr2kW4c=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
 
+  python312 = callPackage ./cpython ({
+    self = __splicedPackages.python312;
+    inherit (darwin) configd;
+    inherit passthruFun;
+  } // sources.python312);
+
   python313 = callPackage ./cpython {
     self = __splicedPackages.python313;
     sourceVersion = {
@@ -123,7 +123,7 @@ in {
     enableOptimizations = false;
     enableLTO = false;
     mimetypesSupport = false;
-  } // sources.python311)).overrideAttrs(old: {
+  } // sources.python312)).overrideAttrs(old: {
     # TODO(@Artturin): Add this to the main cpython expr
     strictDeps = true;
     pname = "python3-minimal";
diff --git a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
index 7172ac498545..b65d6e745247 100644
--- a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
@@ -6,8 +6,13 @@ pythonImportsCheckPhase () {
 
     if [ -n "$pythonImportsCheck" ]; then
         echo "Check whether the following modules can be imported: $pythonImportsCheck"
-        export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
-        ( cd $out && eval "@pythonCheckInterpreter@ -c 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ[\"pythonImportsCheck\"].split()))'" )
+        pythonImportsCheckOutput=$out
+        if [ -n "$python" ]; then
+            echo "Using python specific output \$python for imports check"
+            pythonImportsCheckOutput=$python
+        fi
+        export PYTHONPATH="$pythonImportsCheckOutput/@pythonSitePackages@:$PYTHONPATH"
+        ( cd $pythonImportsCheckOutput && eval "@pythonCheckInterpreter@ -c 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ[\"pythonImportsCheck\"].split()))'" )
     fi
 }
 
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index d656760a71a1..0d6ab2224991 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -17,6 +17,7 @@
 , pythonImportsCheckHook
 , pythonNamespacesHook
 , pythonOutputDistHook
+, pythonRelaxDepsHook
 , pythonRemoveBinBytecodeHook
 , pythonRemoveTestsDirHook
 , pythonRuntimeDepsCheckHook
@@ -252,6 +253,8 @@ let
       #    because the hook that checks for conflicts uses setuptools.
       #
       pythonCatchConflictsHook
+    ] ++ optionals (attrs ? pythonRelaxDeps || attrs ? pythonRemoveDeps) [
+      pythonRelaxDepsHook
     ] ++ optionals removeBinBytecode [
       pythonRemoveBinBytecodeHook
     ] ++ optionals (hasSuffix "zip" (attrs.src.name or "")) [
diff --git a/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py b/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
index fbc096502fa7..555d15b8ca4d 100755
--- a/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
+++ b/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
@@ -319,14 +319,17 @@ def _get_latest_version_github(attr_path, package, extension, current_version, t
             tag_url = str(release["tarball_url"]).replace(
                 "tarball", "tarball/refs/tags"
             )
-            hash = (
-                subprocess.check_output(
-                    ["nix-prefetch-url", "--type", "sha256", "--unpack", tag_url],
-                    stderr=subprocess.DEVNULL,
+            try:
+                hash = (
+                    subprocess.check_output(
+                        ["nix-prefetch-url", "--type", "sha256", "--unpack", tag_url],
+                        stderr=subprocess.DEVNULL,
+                    )
+                    .decode("utf-8")
+                    .strip()
                 )
-                .decode("utf-8")
-                .strip()
-            )
+            except subprocess.CalledProcessError:
+                raise ValueError("nix-prefetch-url failed")
 
     return version, hash, prefix
 
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 91903c9f6851..816afa176754 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -58,13 +58,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2";
-  version = "2.30.3";
+  version = "2.30.4";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-ycY/AkWulV3vAu/+vKw+j/b6jTZWjqKjIgjRwqNHFl8=";
+    hash = "sha256-RhqbmS+mPVlXlo4/jrqPqtyGzvfaPTozlUEeAjHUBoA=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/SDL_compat/default.nix b/pkgs/development/libraries/SDL_compat/default.nix
index 3c3df10f9167..8b0cd67f79c4 100644
--- a/pkgs/development/libraries/SDL_compat/default.nix
+++ b/pkgs/development/libraries/SDL_compat/default.nix
@@ -9,7 +9,6 @@
 , autoSignDarwinBinariesHook
 , libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
 , openglSupport ? libGLSupported
-, libGL
 , libGLU
 }:
 
@@ -33,7 +32,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ SDL2 ]
     ++ optionals stdenv.hostPlatform.isDarwin [ libiconv Cocoa ]
-    ++ optionals openglSupport [ libGL libGLU ];
+    ++ optionals openglSupport [ libGLU ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/aubio/default.nix b/pkgs/development/libraries/aubio/default.nix
index 6702eb91c9b1..a3e4a120e9ad 100644
--- a/pkgs/development/libraries/aubio/default.nix
+++ b/pkgs/development/libraries/aubio/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, alsa-lib, fftw, libjack2, libsamplerate
-, libsndfile, pkg-config, python3, wafHook
+, libsndfile, pkg-config, python311, wafHook
 }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1npks71ljc48w6858l9bq30kaf5nph8z0v61jkfb70xb9np850nl";
   };
 
-  nativeBuildInputs = [ pkg-config python3 wafHook ];
+  nativeBuildInputs = [ pkg-config python311 wafHook ];
   buildInputs = [ alsa-lib fftw libjack2 libsamplerate libsndfile ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 0f4c3509244d..8e32ae89502b 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.7.7";
+  version = "0.7.8";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-WMaiiXISaCim9ljghK7nqo+L/bdaC9DjRcf/Km2e8Iw=";
+    hash = "sha256-h3eMgEaiJsbL+xFPTI4+J8Eht7PczOXLfeRYmSUCdMw=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/audio/suil/default.nix b/pkgs/development/libraries/audio/suil/default.nix
index 6214b65189d3..df63737474eb 100644
--- a/pkgs/development/libraries/audio/suil/default.nix
+++ b/pkgs/development/libraries/audio/suil/default.nix
@@ -1,20 +1,68 @@
-{ stdenv, lib, fetchurl, gtk2, lv2, pkg-config, python3, serd, sord, sratom
-, wafHook
-, withQt5 ? true, qt5 ? null
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+
+  # build time
+  pkg-config,
+  meson,
+  ninja,
+
+  # runtime
+  lv2,
+
+  # options
+  withGtk2 ? false,
+  gtk2,
+  withGtk3 ? true,
+  gtk3,
+  withQt5 ? true,
+  qt5,
+  withX11 ? !stdenv.isDarwin,
 }:
 
+let
+  inherit (lib) mesonEnable;
+in
+
 stdenv.mkDerivation rec {
   pname = "suil";
-  version = "0.10.6";
+  version = "0.10.20";
 
-  src = fetchurl {
-    url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "0z4v01pjw4wh65x38w6icn28wdwxz13ayl8hvn4p1g9kmamp1z06";
+  src = fetchFromGitLab {
+    owner = "lv2";
+    repo = "suil";
+    rev = "v${version}";
+    hash = "sha256-rP8tq+zmHrAZeuNttakPPfraFXNvnwqbhtt+LtTNV/k=";
   };
 
-  nativeBuildInputs = [ pkg-config wafHook python3 ];
-  buildInputs = [ gtk2 lv2 serd sord sratom ]
-    ++ lib.optionals withQt5 (with qt5; [ qtbase qttools ]);
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  mesonFlags = [
+    # docs require sphinxygen
+    (mesonEnable "docs" false)
+    (mesonEnable "gtk2" withGtk2)
+    (mesonEnable "gtk3" withGtk3)
+    (mesonEnable "qt5" withQt5)
+    (mesonEnable "x11" withX11)
+  ];
+
+  buildInputs =
+    [ lv2 ]
+    ++ lib.optionals withGtk2 [ gtk2 ]
+    ++ lib.optionals withGtk3 [ gtk3 ]
+    ++ lib.optionals withQt5 (
+      with qt5;
+      [
+        qtbase
+        qttools
+      ]
+      ++ lib.optionals withX11 [ qtx11extras ]
+    );
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/libraries/box2d/default.nix b/pkgs/development/libraries/box2d/default.nix
index c2611a8b8dff..2008cab52ac3 100644
--- a/pkgs/development/libraries/box2d/default.nix
+++ b/pkgs/development/libraries/box2d/default.nix
@@ -4,7 +4,7 @@
 , cmake
 , libGLU
 , libGL
-, freeglut
+, libglut
 , libX11
 , libXcursor
 , libXinerama
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     libGLU
     libGL
-    freeglut
+    libglut
     libX11
     libXcursor
     libXinerama
diff --git a/pkgs/development/libraries/bullet/default.nix b/pkgs/development/libraries/bullet/default.nix
index dc0e1d304eea..5ba9186dcac9 100644
--- a/pkgs/development/libraries/bullet/default.nix
+++ b/pkgs/development/libraries/bullet/default.nix
@@ -4,7 +4,7 @@
 , cmake
 , libGLU
 , libGL
-, freeglut
+, libglut
 , Cocoa
 , OpenGL
 }:
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optionals stdenv.isLinux [ libGLU libGL freeglut ]
+  buildInputs = lib.optionals stdenv.isLinux [ libGLU libGL libglut ]
     ++ lib.optionals stdenv.isDarwin [ Cocoa OpenGL ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/bullet/roboschool-fork.nix b/pkgs/development/libraries/bullet/roboschool-fork.nix
index 7d601e857001..c5f6f3a436d2 100644
--- a/pkgs/development/libraries/bullet/roboschool-fork.nix
+++ b/pkgs/development/libraries/bullet/roboschool-fork.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, libGLU, libGL, freeglut
+{ lib, stdenv, fetchFromGitHub, cmake, libGLU, libGL, libglut
 , Cocoa,  OpenGL
 }:
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optionals stdenv.isLinux [ libGLU libGL freeglut ]
+  buildInputs = lib.optionals stdenv.isLinux [ libGLU libGL libglut ]
     ++ lib.optionals stdenv.isDarwin [ Cocoa OpenGL ];
 
   patches = [ ./gwen-narrowing.patch ];
diff --git a/pkgs/development/libraries/chipmunk/default.nix b/pkgs/development/libraries/chipmunk/default.nix
index 1cb32dc8ee4b..a0b34f0aa30f 100644
--- a/pkgs/development/libraries/chipmunk/default.nix
+++ b/pkgs/development/libraries/chipmunk/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, freeglut, libGLU, libGL, glfw2, glew, libX11, xorgproto
+{ lib, stdenv, fetchurl, cmake, libglut, libGLU, libGL, glfw2, glew, libX11, xorgproto
 , libXi, libXmu, fetchpatch, libXrandr
 }:
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs =
-    [ freeglut libGLU libGL glfw2 glew libX11 xorgproto libXi libXmu libXrandr ];
+    [ libglut libGLU libGL glfw2 glew libX11 xorgproto libXi libXmu libXrandr ];
 
   postInstall = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 2fa7aec062f3..69cab2ca5b61 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -9,8 +9,18 @@
 , hspell
 , nuspell
 , unittest-cpp
+
+, withHspell ? true
+, withAspell ? true
+, withHunspell ? true
+, withNuspell ? true
+, withAppleSpell ? stdenv.isDarwin
+
+, Cocoa
 }:
 
+assert withAppleSpell -> stdenv.isDarwin;
+
 stdenv.mkDerivation rec {
   pname = "enchant";
   version = "2.6.9";
@@ -31,8 +41,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
+  ] ++ lib.optionals withHunspell [
     hunspell
+  ] ++ lib.optionals withNuspell [
     nuspell
+  ] ++ lib.optionals withAppleSpell [
+    Cocoa
   ];
 
   checkInputs = [
@@ -40,8 +54,9 @@ stdenv.mkDerivation rec {
   ];
 
   # libtool puts these to .la files
-  propagatedBuildInputs = [
+  propagatedBuildInputs = lib.optionals withHspell [
     hspell
+  ] ++ lib.optionals withAspell [
     aspell
   ];
 
@@ -51,10 +66,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-relocatable" # needed for tests
-    "--with-aspell"
-    "--with-hspell"
-    "--with-hunspell"
-    "--with-nuspell"
+    (lib.withFeature withAspell "aspell")
+    (lib.withFeature withHspell "hspell")
+    (lib.withFeature withHunspell "hunspell")
+    (lib.withFeature withNuspell "nuspell")
+    (lib.withFeature withAppleSpell "applespell")
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/ffmpeg/5.1.4-CVE-2023-49502.patch b/pkgs/development/libraries/ffmpeg/5.1.4-CVE-2023-49502.patch
new file mode 100644
index 000000000000..ca8b8b4d15bd
--- /dev/null
+++ b/pkgs/development/libraries/ffmpeg/5.1.4-CVE-2023-49502.patch
@@ -0,0 +1,26 @@
+Based on upstream 737ede405b11a37fdd61d19cf25df296a0cb0b75, with cuda and
+vulkan implementations removed, bwdif adjusted to apply to 5.1.4
+
+diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c
+index 65c617ebb3..35c864f71e 100644
+--- a/libavfilter/vf_bwdif.c
++++ b/libavfilter/vf_bwdif.c
+@@ -333,13 +333,14 @@ static int config_props(AVFilterLink *link)
+     if(yadif->mode&1)
+         link->frame_rate = av_mul_q(link->src->inputs[0]->frame_rate, (AVRational){2,1});
+ 
+-    if (link->w < 3 || link->h < 4) {
+-        av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or 4 lines is not supported\n");
++    yadif->csp = av_pix_fmt_desc_get(link->format);
++    yadif->filter = filter;
++
++    if (AV_CEIL_RSHIFT(link->w, yadif->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, yadif->csp->log2_chroma_h) < 4) {
++        av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or 4 lines is not supported\n");
+         return AVERROR(EINVAL);
+     }
+ 
+-    yadif->csp = av_pix_fmt_desc_get(link->format);
+-    yadif->filter = filter;
+     if (yadif->csp->comp[0].depth > 8) {
+         s->filter_intra = filter_intra_16bit;
+         s->filter_line  = filter_line_c_16bit;
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index 5bd9171275be..88b5564ecba4 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -12,6 +12,7 @@ let
           CoreImage
           VideoToolbox
           ;
+        inherit (darwin) xcode;
       }
       // (initArgs // { inherit ffmpegVariant; })
     );
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 7496cb4de0e7..6d54d63c6ca8 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -73,6 +73,7 @@
 , withJxl ? withFullDeps && lib.versionAtLeast version "5" # JPEG XL de/encoding
 , withLadspa ? withFullDeps # LADSPA audio filtering
 , withLzma ? withHeadlessDeps # xz-utils
+, withMetal ? false # Unfree and requires manual downloading of files
 , withMfx ? withFullDeps && (with stdenv.hostPlatform; isLinux && !isAarch) # Hardware acceleration via intel-media-sdk/libmfx
 , withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
 , withMp3lame ? withHeadlessDeps # LAME MP3 encoder
@@ -106,6 +107,7 @@
 , withSvtav1 ? withHeadlessDeps && !stdenv.isAarch64 && !stdenv.hostPlatform.isMinGW # AV1 encoder/decoder (focused on speed and correctness)
 , withTensorflow ? false # Tensorflow dnn backend support (Increases closure size by ~390 MiB)
 , withTheora ? withHeadlessDeps # Theora encoder
+, withTwolame ? withFullDeps # MP2 encoding
 , withV4l2 ? withHeadlessDeps && stdenv.isLinux  # Video 4 Linux support
 , withV4l2M2m ? withV4l2
 , withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
@@ -288,6 +290,7 @@
 , quirc
 , rav1e
 , rtmpdump
+, twolame
 , samba
 , SDL2
 , shaderc
@@ -317,6 +320,7 @@
 , AVFoundation
 , CoreImage
 , VideoToolbox
+, xcode # unfree contains metalcc and metallib
 /*
  *  Testing
  */
@@ -395,22 +399,22 @@ stdenv.mkDerivation (finalAttrs: {
       --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
   '';
 
-  patches = map (patch: fetchpatch2 patch) ([ ]
+  patches = []
     ++ optionals (versionOlder version "5") [
-      {
+      (fetchpatch2 {
         name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/031f1561cd286596cdb374da32f8aa816ce3b135";
         hash = "sha256-agJgzIzrBTQBAypuCmGXXFo7vw6Iodw5Ny5O5QCKCn8=";
-      }
-      {
+      })
+      (fetchpatch2 {
         # Backport fix for binutils-2.41.
         name = "binutils-2.41.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/effadce6c756247ea8bae32dc13bb3e6f464f0eb";
         hash = "sha256-vLSltvZVMcQ0CnkU0A29x6fJSywE8/aU+Mp9os8DZYY=";
-      }
+      })
       # The upstream patch isn’t for ffmpeg 4, but it will apply with a few tweaks.
       # Fixes a crash when built with clang 16 due to UB in ff_seek_frame_binary.
-      {
+      (fetchpatch2 {
         name = "utils-fix_crash_in_ff_seek_frame_binary.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/ab792634197e364ca1bb194f9abe36836e42f12d";
         hash = "sha256-vqqVACjbCcGL9Qvmg1QArSKqVmOqr8BEr+OxTBDt6mA=";
@@ -419,60 +423,96 @@ stdenv.mkDerivation (finalAttrs: {
             --replace libavformat/seek.c libavformat/utils.c \
             --replace 'const AVInputFormat *const ' 'const AVInputFormat *'
         '';
-      }
+      })
     ]
-    ++ (lib.optionals (lib.versionAtLeast version "5" && lib.versionOlder version "6") [
-      {
+    ++ optionals (lib.versionAtLeast version "5" && lib.versionOlder version "6") [
+      (fetchpatch2 {
         name = "fix_build_failure_due_to_libjxl_version_to_new";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/75b1a555a70c178a9166629e43ec2f6250219eb2";
         hash = "sha256-+2kzfPJf5piim+DqEgDuVEEX5HLwRsxq0dWONJ4ACrU=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "5.x-CVE-2024-31585.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/8711cea3841fc385cccb1e7255176479e865cd4d";
         hash = "sha256-WT+ly/l04yM/tRVbhkESA3sDDjwvtd/Cg2y8tQo4ApI=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "CVE-2024-31582.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/99debe5f823f45a482e1dc08de35879aa9c74bd2";
         hash = "sha256-+CQ9FXR6Vr/AmsbXFiCUXZcxKj1s8nInEdke/Oc/kUA=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "CVE-2024-31578.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/3bb00c0a420c3ce83c6fafee30270d69622ccad7";
         hash = "sha256-oZMZysBA+/gwaGEM1yvI+8wCadXWE7qLRL6Emap3b8Q=";
-      }
-    ])
-    ++ (lib.optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
-      { # this can be removed post 6.1
+      })
+      ./5.1.4-CVE-2023-49502.patch
+      (fetchpatch2 {
+        name = "CVE-2023-50008.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/5f87a68cf70dafeab2fb89b42e41a4c29053b89b";
+        hash = "sha256-sqUUSOPTPLwu2h8GbAw4SfEf+0oWioz52BcpW1n4v3Y=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-51793.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/8b8b4bdef311f88c0075a06a25320187aff00bf2";
+        hash = "sha256-e7oGyOfUXuA8XK3vfygNtFlHpHl92O2KSLAo50sNJ5o=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-51796.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/e01a55c5283b82667dad347331816a5e20869ce9";
+        hash = "sha256-m4rq+UFG3nXdgOJ3S6XcruMZ+CPw+twmy2HFv3cnvJc=";
+      })
+    ]
+    ++ optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
+      (fetchpatch2 { # this can be removed post 6.1
         name = "fix_build_failure_due_to_PropertyKey_EncoderID";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
         hash = "sha256-sxRXKKgUak5vsQTiV7ge8vp+N22CdTIvuczNgVRP72c=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "fix_vulkan_av1";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/e06ce6d2b45edac4a2df04f304e18d4727417d24";
         hash = "sha256-73mlX1rdJrguw7OXaSItfHtI7gflDrFj+7SepVvvUIg=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "CVE-2024-31582.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/99debe5f823f45a482e1dc08de35879aa9c74bd2";
         hash = "sha256-+CQ9FXR6Vr/AmsbXFiCUXZcxKj1s8nInEdke/Oc/kUA=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "CVE-2024-31578.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/3bb00c0a420c3ce83c6fafee30270d69622ccad7";
         hash = "sha256-oZMZysBA+/gwaGEM1yvI+8wCadXWE7qLRL6Emap3b8Q=";
-      }
-    ])
-    ++ (lib.optionals (lib.versionAtLeast version "7.0" && lib.versionOlder version "7.0.1") [
-      {
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-49501.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/4adb93dff05dd947878c67784d98c9a4e13b57a7";
+        hash = "sha256-7cwktto3fPMDGvCZCVtB01X8Q9S/4V4bDLUICSNfGgw=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-49502.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/737ede405b11a37fdd61d19cf25df296a0cb0b75";
+        hash = "sha256-mpSJwR9TX5ENjjCKvzuM/9e1Aj/AOiQW0+72oOMl9v8=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-50007.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/b1942734c7cbcdc9034034373abcc9ecb9644c47";
+        hash = "sha256-v0hNcqBtm8GCGAU9UbRUCE0slodOjZCHrkS8e4TrVcQ=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-50008.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/5f87a68cf70dafeab2fb89b42e41a4c29053b89b";
+        hash = "sha256-sqUUSOPTPLwu2h8GbAw4SfEf+0oWioz52BcpW1n4v3Y=";
+      })
+    ]
+    ++ optionals (lib.versionAtLeast version "7.0" && lib.versionOlder version "7.0.1") [
+      (fetchpatch2 {
         # Will likely be obsolete in >7.0
         name = "fate_avoid_dependency_on_samples";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/7b7b7819bd21cc92ac07f6696b0e7f26fa8f9834";
         hash = "sha256-TKI289XqtG86Sj9s7mVYvmkjAuRXeK+2cYYEDkg6u6I=";
-      }
-    ]));
+      })
+    ];
 
   configurePlatforms = [];
   setOutputFlags = false; # Only accepts some of them
@@ -605,6 +645,9 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ [
     (enableFeature withLadspa "ladspa")
     (enableFeature withLzma "lzma")
+  ] ++ optionals (versionAtLeast version "5.0") [
+    (enableFeature withMetal "metal")
+  ] ++ [
     (enableFeature withMfx "libmfx")
     (enableFeature withModplug "libmodplug")
     (enableFeature withMp3lame "libmp3lame")
@@ -643,6 +686,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withSvtav1 "libsvtav1")
     (enableFeature withTensorflow "libtensorflow")
     (enableFeature withTheora "libtheora")
+    (enableFeature withTwolame "libtwolame")
     (enableFeature withV4l2 "libv4l2")
     (enableFeature withV4l2M2m "v4l2-m2m")
     (enableFeature withVaapi "vaapi")
@@ -689,6 +733,9 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ optionals stdenv.cc.isClang [
     "--cc=clang"
     "--cxx=clang++"
+  ] ++ optionals withMetal [
+    "--metalcc=${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/metal"
+    "--metallib=${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/metallib"
   ];
 
   # ffmpeg embeds the configureFlags verbatim in its binaries and because we
@@ -697,7 +744,8 @@ stdenv.mkDerivation (finalAttrs: {
   # such references except for data.
   postConfigure = let
     toStrip = map placeholder (lib.remove "data" finalAttrs.outputs) # We want to keep references to the data dir.
-      ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.stdenv.cc;
+      ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.stdenv.cc
+      ++ lib.optional withMetal xcode;
   in
     "remove-references-to ${lib.concatStringsSep " " (map (o: "-t ${o}") toStrip)} config.h";
 
@@ -774,6 +822,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withSvtav1 [ svt-av1 ]
   ++ optionals withTensorflow [ libtensorflow ]
   ++ optionals withTheora [ libtheora ]
+  ++ optionals withTwolame [ twolame ]
   ++ optionals withV4l2 [ libv4l ]
   ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
   ++ optionals withVdpau [ libvdpau ]
@@ -882,4 +931,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with maintainers; [ atemu arthsmn jopejoe1 ];
     mainProgram = "ffmpeg";
   };
+} // lib.optionalAttrs withCudaLLVM {
+  # remove once https://github.com/NixOS/nixpkgs/issues/318674 is addressed properly
+  hardeningDisable = [ "zerocallusedregs" ];
 })
diff --git a/pkgs/development/libraries/flite/default.nix b/pkgs/development/libraries/flite/default.nix
deleted file mode 100644
index 8573c862726e..000000000000
--- a/pkgs/development/libraries/flite/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, alsa-lib
-, fetchpatch
-, libpulseaudio
-, audioBackend ? "pulseaudio"
-}:
-
-assert lib.assertOneOf "audioBackend" audioBackend [ "alsa" "pulseaudio" ];
-
-stdenv.mkDerivation rec {
-  pname = "flite";
-  version = "2.2";
-
-  src = fetchFromGitHub {
-    owner = "festvox";
-    repo = "flite";
-    rev = "v${version}";
-    sha256 = "1n0p81jzndzc1rzgm66kw9ls189ricy5v1ps11y0p2fk1p56kbjf";
-  };
-
-  buildInputs = lib.optional (stdenv.isLinux && audioBackend == "alsa") alsa-lib
-    ++ lib.optional (stdenv.isLinux && audioBackend == "pulseaudio") libpulseaudio;
-
-  # https://github.com/festvox/flite/pull/60.
-  # Replaces `ar` with `$(AR)` in config/common_make_rules.
-  # Improves cross-compilation compatibility.
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/festvox/flite/commit/54c65164840777326bbb83517568e38a128122ef.patch";
-      sha256 = "sha256-hvKzdX7adiqd9D+9DbnfNdqEULg1Hhqe1xElYxNM1B8=";
-    })
-  ];
-
-  configureFlags = [
-    "--enable-shared"
-  ] ++ lib.optionals stdenv.isLinux [ "--with-audio=${audioBackend}" ];
-
-  # main/Makefile creates and removes 'flite_voice_list.c' from multiple targets:
-  # make[1]: *** No rule to make target 'flite_voice_list.c', needed by 'all'.  Stop
-  enableParallelBuilding = false;
-
-  meta = with lib; {
-    description = "Small, fast run-time speech synthesis engine";
-    homepage = "http://www.festvox.org/flite/";
-    license = licenses.bsdOriginal;
-    maintainers = with maintainers; [ getchoo ];
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/development/libraries/fox/default.nix b/pkgs/development/libraries/fox/default.nix
index 2715e2c80ca4..6286155d8efb 100644
--- a/pkgs/development/libraries/fox/default.nix
+++ b/pkgs/development/libraries/fox/default.nix
@@ -6,13 +6,11 @@
 , libtiff
 , zlib
 , bzip2
-, libGL
-, libGLU
+, mesa_glu
 , libXcursor
 , libXext
 , libXrandr
 , libXft
-, CoreServices
 }:
 
 stdenv.mkDerivation rec {
@@ -24,8 +22,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-bu+IEqNkv9OAf96dPYre3CP759pjalVIbYyc3QSQW2w=";
   };
 
-  buildInputs = [ libpng libjpeg libtiff zlib bzip2 libGL libGLU libXcursor libXext libXrandr libXft ]
-    ++ lib.optional stdenv.isDarwin CoreServices;
+  buildInputs = [ libpng libjpeg libtiff zlib bzip2 mesa_glu libXcursor libXext libXrandr libXft ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/freeglut/default.nix b/pkgs/development/libraries/freeglut/default.nix
index 69c3b65e4a51..8e79b3e57dea 100644
--- a/pkgs/development/libraries/freeglut/default.nix
+++ b/pkgs/development/libraries/freeglut/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libICE, libXext, libXi, libXrandr, libXxf86vm, libGL, libGLU, cmake
+{ lib, stdenv, fetchurl, libICE, libXext, libXi, libXrandr, libXxf86vm, libGLX, libGLU, cmake
 , testers
 }:
 
@@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ libICE libXext libXi libXrandr libXxf86vm libGL libGLU ];
+  buildInputs = [ libICE libXext libXi libXrandr libXxf86vm libGLU ];
 
   cmakeFlags = lib.optionals stdenv.isDarwin [
-                 "-DOPENGL_INCLUDE_DIR=${libGL}/include"
-                 "-DOPENGL_gl_LIBRARY:FILEPATH=${libGL}/lib/libGL.dylib"
+                 "-DOPENGL_INCLUDE_DIR=${libGLX.dev}/include"
+                 "-DOPENGL_gl_LIBRARY:FILEPATH=${libGLX}/lib/libGL.dylib"
                  "-DOPENGL_glu_LIBRARY:FILEPATH=${libGLU}/lib/libGLU.dylib"
                  "-DFREEGLUT_BUILD_DEMOS:BOOL=OFF"
                  "-DFREEGLUT_BUILD_STATIC:BOOL=OFF"
diff --git a/pkgs/development/libraries/freenect/default.nix b/pkgs/development/libraries/freenect/default.nix
index 387fac6d84ad..b537bea33777 100644
--- a/pkgs/development/libraries/freenect/default.nix
+++ b/pkgs/development/libraries/freenect/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake, libusb1, pkg-config, freeglut, libGLU, libGL, libXi, libXmu
+{ stdenv, lib, fetchFromGitHub, cmake, libusb1, pkg-config, libglut, libGLU, libGL, libXi, libXmu
 , GLUT, Cocoa
  }:
 
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Lb5mrl9jiI1Z9UOAlP+bBPNoKNxm5VSrFZRvifEfhoU=";
   };
 
-  buildInputs = [ libusb1 freeglut libGLU libGL libXi libXmu ]
+  buildInputs = [ libusb1 libglut libGLU libGL libXi libXmu ]
     ++ lib.optionals stdenv.isDarwin [ GLUT Cocoa ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/fribidi/default.nix b/pkgs/development/libraries/fribidi/default.nix
index d23cd352360b..768c2185a158 100644
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fribidi";
-  version = "1.0.13";
+  version = "1.0.14";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   # NOTE: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
   src = fetchurl {
     url = with finalAttrs; "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-f6FsgMgb1iL3sZjTE1baE5zDGKY/x3YSF69BMJA/VKI=";
+    sha256 = "sha256-dq4gSnAnZSrDmBufpYF8CDuiMRQ0AoTFjnVrJZzSJZo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/ftgl/default.nix b/pkgs/development/libraries/ftgl/default.nix
index b6554979c7ee..d1fb07167e13 100644
--- a/pkgs/development/libraries/ftgl/default.nix
+++ b/pkgs/development/libraries/ftgl/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , autoreconfHook
 , doxygen
-, freeglut
+, libglut
 , freetype
 , libGL
 , libGLU
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   ] else [
     libGL
     libGLU
-    freeglut
+    libglut
   ]);
 
   configureFlags = [
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index f8bf3f7c075a..611b547b101a 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , callPackage
 , fetchFromGitHub
-, fetchpatch
 
 , useMinimalFeatures ? false
 , useTiledb ? (!useMinimalFeatures) && !(stdenv.isDarwin && stdenv.isx86_64)
@@ -80,23 +79,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdal" + lib.optionalString useMinimalFeatures "-minimal";
-  version = "3.9.0";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "OSGeo";
     repo = "gdal";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-xEekgF9GzsPYkwk7Nny9b1DMLTxBqTSdudYxaz4jl/c=";
+    hash = "sha256-WCTQHUU2WYYiliwCJ4PsbvJIOar9LmvXn/i5jJzTCtM=";
   };
 
-  patches = [
-    # HDF5: add support for libhdf5 >= 1.14.4.2 when built with Float16
-    (fetchpatch {
-      url = "https://github.com/OSGeo/gdal/commit/16ade8253f26200246abb5ab24d17e18216e7a11.patch";
-      sha256 = "sha256-N6YqfcOUWeaJXVE9RUo1dzulxqIY5Q/UygPnZHau3Lc=";
-    })
-  ];
-
   nativeBuildInputs = [
     bison
     cmake
diff --git a/pkgs/development/libraries/gl2ps/default.nix b/pkgs/development/libraries/gl2ps/default.nix
index dfc9e36488f8..f1d67c8c8855 100644
--- a/pkgs/development/libraries/gl2ps/default.nix
+++ b/pkgs/development/libraries/gl2ps/default.nix
@@ -6,7 +6,7 @@
 , libpng
 , libGL
 , libGLU
-, freeglut
+, libglut
 , darwin
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (!stdenv.isDarwin) [
     libGL
     libGLU
-    freeglut
+    libglut
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.OpenGL
   ];
diff --git a/pkgs/development/libraries/gle/default.nix b/pkgs/development/libraries/gle/default.nix
index 79be821faaec..f9ef65197bd5 100644
--- a/pkgs/development/libraries/gle/default.nix
+++ b/pkgs/development/libraries/gle/default.nix
@@ -1,8 +1,8 @@
-{lib, stdenv, fetchurl, freeglut, libX11, libXt, libXmu, libXi, libXext, libGL, libGLU}:
+{lib, stdenv, fetchurl, libglut, libX11, libXt, libXmu, libXi, libXext, libGL, libGLU}:
 stdenv.mkDerivation rec {
   pname = "gle";
   version = "3.1.0";
-  buildInputs = [libGLU libGL freeglut libX11 libXt libXmu libXi libXext];
+  buildInputs = [libGLU libGL libglut libX11 libXt libXmu libXi libXext];
   src = fetchurl {
     urls = [
       "mirror://sourceforge/project/gle/gle/gle-${version}/gle-${version}.tar.gz"
diff --git a/pkgs/development/libraries/glfw/3.x.nix b/pkgs/development/libraries/glfw/3.x.nix
index 67d5a0095148..7ca694827301 100644
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, cmake
 , libGL, libXrandr, libXinerama, libXcursor, libX11, libXi, libXext
-, Carbon, Cocoa, Kernel, OpenGL, fixDarwinDylibNames
+, Carbon, Cocoa, Kernel, fixDarwinDylibNames
 , extra-cmake-modules, wayland
 , wayland-scanner, wayland-protocols, libxkbcommon
 }:
@@ -19,9 +19,7 @@ stdenv.mkDerivation rec {
   # Fix linkage issues on X11 (https://github.com/NixOS/nixpkgs/issues/142583)
   patches = ./x11.patch;
 
-  propagatedBuildInputs =
-    lib.optionals stdenv.isDarwin [ OpenGL ]
-    ++ lib.optionals stdenv.isLinux [ libGL ];
+  propagatedBuildInputs = [ libGL ];
 
   nativeBuildInputs = [ cmake extra-cmake-modules ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index a60ba9fae6bf..47ca3f35b218 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -61,28 +61,24 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.80.2";
+  version = "2.80.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-uc+296W9WzEjj9XVbfImst2l6jdhFHW/ifag+UAP6L0=";
+    hash = "sha256-OUeg6t3Q82E9AjC7JG0MaeRhQsGQIvXEsbLjy6I21Bc=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
     ./darwin-compilation.patch
+    # FIXME: remove when https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4088 is merged and is in the tagged release
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/9d0988ca62ee96e09aa76abbd65ff192cfce6858.patch";
+      hash = "sha256-JrR3Ba6L+3M0Nt8DgHmPG8uKtx7hOgUp7np08ATIzjA=";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch
   ] ++ [
-    # Fix double-free & segfault issues on menu and dbus connection action group export failures
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4073
-    # Remove when version > 2.80.2
-    (fetchpatch {
-      name = "GLib-Fix-memory-problems-on-gmenuexporter-and-gactiongroupexporter-error-paths.patch";
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/b9490a499a004618c883f180b1081a166ff1a86b.patch";
-      hash = "sha256-c6uZ9NEhg26/2RdgjQ4s5ErCDm5HH6T/tfJXTwh/H6o=";
-    })
-
     # This patch lets GLib's GDesktopAppInfo API watch and notice changes
     # to the Nix user and system profiles.  That way, the list of available
     # applications shown by the desktop environment is immediately updated
@@ -124,6 +120,15 @@ stdenv.mkDerivation (finalAttrs: {
     # 3. Tools for desktop environment that cannot go to $bin due to $out depending on them ($out)
     #    * gio-launch-desktop
     ./split-dev-programs.patch
+
+    # Tell Meson to install gdb scripts next to the lib
+    # GDB only looks there and in ${gdb}/share/gdb/auto-load,
+    # and by default meson installs in to $out/share/gdb/auto-load
+    # which does not help
+    ./gdb_script.patch
+
+    # glib assumes that `RTLD_LOCAL` is defined to `0`, which is true on Linux and FreeBSD but not on Darwin.
+    ./gmodule-rtld_local.patch
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
@@ -221,6 +226,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     moveToOutput "share/glib-2.0" "$dev"
+    moveToOutput "share/glib-2.0/gdb" "$out"
     substituteInPlace "$dev/bin/gdbus-codegen" --replace "$out" "$dev"
     sed -i "$dev/bin/glib-gettextize" -e "s|^gettext_dir=.*|gettext_dir=$dev/share/glib-2.0/gettext|"
 
diff --git a/pkgs/development/libraries/glib/gdb_script.patch b/pkgs/development/libraries/glib/gdb_script.patch
new file mode 100644
index 000000000000..c1e5d22e085b
--- /dev/null
+++ b/pkgs/development/libraries/glib/gdb_script.patch
@@ -0,0 +1,23 @@
+diff --git a/glib/meson.build b/glib/meson.build
+index b2dd569e1..b013991a1 100644
+--- a/glib/meson.build
++++ b/glib/meson.build
+@@ -541,7 +540,7 @@ configure_file(
+   input: 'libglib-gdb.py.in',
+   output: 'libglib-2.0.so.@0@-gdb.py'.format(library_version),
+   configuration: gdb_conf,
+-  install_dir: gdb_install_dir,
++  install_dir: glib_libdir,
+   install_tag: 'devel',
+   install: gdb_install,
+ )
+diff --git a/gobject/meson.build b/gobject/meson.build
+@@ -185,7 +184,7 @@ configure_file(
+   input: 'libgobject-gdb.py.in',
+   output: 'libgobject-2.0.so.@0@-gdb.py'.format(library_version),
+   configuration: gdb_conf,
+-  install_dir: gdb_install_dir,
++  install_dir: glib_libdir,
+   install_tag: 'devel',
+   install: gdb_install,
+ )
diff --git a/pkgs/development/libraries/glib/gmodule-rtld_local.patch b/pkgs/development/libraries/glib/gmodule-rtld_local.patch
new file mode 100644
index 000000000000..abbf19d70b20
--- /dev/null
+++ b/pkgs/development/libraries/glib/gmodule-rtld_local.patch
@@ -0,0 +1,13 @@
+diff --git a/gmodule/gmodule-dl.c b/gmodule/gmodule-dl.c
+index 6d1c5fab7..b21773bca 100644
+--- a/gmodule/gmodule-dl.c
++++ b/gmodule/gmodule-dl.c
+@@ -136,7 +136,7 @@ _g_module_open (const gchar *file_name,
+   
+   lock_dlerror ();
+   handle = dlopen (file_name,
+-		   (bind_local ? 0 : RTLD_GLOBAL) | (bind_lazy ? RTLD_LAZY : RTLD_NOW));
++		   (bind_local ? RTLD_LOCAL : RTLD_GLOBAL) | (bind_lazy ? RTLD_LAZY : RTLD_NOW));
+   if (!handle)
+     {
+       const gchar *message = fetch_dlerror (TRUE);
diff --git a/pkgs/development/libraries/glm/default.nix b/pkgs/development/libraries/glm/default.nix
index 417d70d621b6..3894db5ab9c8 100644
--- a/pkgs/development/libraries/glm/default.nix
+++ b/pkgs/development/libraries/glm/default.nix
@@ -1,61 +1,40 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.9.8";
+  version = "1.0.1";
   pname = "glm";
 
   src = fetchFromGitHub {
     owner = "g-truc";
     repo = pname;
     rev = version;
-    sha256 = "sha256-F//+3L5Ozrw6s7t4LrcUmO7sN30ZSESdrPAYX57zgr8=";
+    sha256 = "sha256-GnGyzNRpzuguc3yYbEFtYLvG+KiCtRAktiN+NvbOICE=";
   };
 
-  # (https://github.com/g-truc/glm/pull/986 wasn't enough, and -Werror is used)
-  # (https://github.com/g-truc/glm/pull/1055 neither)
-  patches = [
-    (fetchpatch {
-      name = "glm-0.9.9.8-clang.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/glm/files/glm-0.9.9.8-clang.patch?id=79476d4b145a4a6b0cbc0e73a6cefb5d584bf8fa";
-      hash = "sha256-D8O+qofnGUEaH5nQGdNddwHyr5FhPQa/lOup4z4SFgY=";
-    })
-  ];
-
   outputs = [ "out" "doc" ];
 
   nativeBuildInputs = [ cmake ];
 
-  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102823
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") "-fno-ipa-modref";
+  env.NIX_CFLAGS_COMPILE =
+    # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102823
+    if (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") then "-fno-ipa-modref"
+    # Fix compilation errors on darwin
+    else if (stdenv.cc.isClang) then "-Wno-error"
+    else "";
 
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=OFF"
-    "-DBUILD_STATIC_LIBS=OFF"
-    "-DGLM_TEST_ENABLE=${if doCheck then "ON" else "OFF"}"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" false)
+    (lib.cmakeBool "BUILD_STATIC_LIBS" false)
+    (lib.cmakeBool "GLM_TEST_ENABLE" doCheck)
   ];
 
   doCheck = true;
 
-  installPhase = ''
-    runHook preInstall
-
-    # Install header-only library
-    mkdir -p $out/include
-    cp -rv ../glm $out/include
-    rm $out/include/glm/CMakeLists.txt
-    rm $out/include/glm/detail/*.cpp
-
-    # Install CMake files
-    mkdir -p $out/lib
-    cp -rv ../cmake $out/lib
-    substituteInPlace $out/lib/cmake/glm/glmConfig.cmake \
-        --replace 'GLM_INCLUDE_DIRS ''${_IMPORT_PREFIX}' "GLM_INCLUDE_DIRS $out/include"
-
+  postInstall = ''
     # Install pkg-config file
     mkdir -p $out/lib/pkgconfig
     substituteAll ${./glm.pc.in} $out/lib/pkgconfig/glm.pc
@@ -64,8 +43,6 @@ stdenv.mkDerivation rec {
     mkdir -p $doc/share/doc/glm
     cp -rv ../doc/api $doc/share/doc/glm/html
     cp -v ../doc/manual.pdf $doc/share/doc/glm
-
-    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/glui/default.nix b/pkgs/development/libraries/glui/default.nix
index 716c998b9c99..f3999bfb439b 100644
--- a/pkgs/development/libraries/glui/default.nix
+++ b/pkgs/development/libraries/glui/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
-, freeglut
+, libglut
 , libGL
 , libGLU
 , libX11
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     sha256 = "0qg2y8w95s03zay1qsqs8pqxxlg6l9kwm7rrs1qmx0h22sxb360i";
   };
 
-  buildInputs = [ freeglut libGLU libGL libXmu libXext libX11 libXi ];
+  buildInputs = [ libglut libGLU libGL libXmu libXext libX11 libXi ];
 
   installPhase = ''
     mkdir -p "$out"/{bin,lib,share/glui/doc,include}
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 9aba5156bef2..1a205a6c04cb 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -33,6 +33,7 @@ let
   pythonModules = pp: [
     pp.mako
     pp.markdown
+    pp.setuptools
   ];
 
   # https://discourse.gnome.org/t/dealing-with-glib-and-gobject-introspection-circular-dependency/18701
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index ac1a192f37ad..40c9cbc769c0 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -68,6 +68,8 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Reenable dynamic loading of libsoup on Darwin and use a different approach to do it.
+    ./souploader-darwin.diff
     # dlopen libsoup_3 with an absolute path
     (substituteAll {
       src = ./souploader.diff;
diff --git a/pkgs/development/libraries/gstreamer/good/souploader-darwin.diff b/pkgs/development/libraries/gstreamer/good/souploader-darwin.diff
new file mode 100644
index 000000000000..40dea3a764ac
--- /dev/null
+++ b/pkgs/development/libraries/gstreamer/good/souploader-darwin.diff
@@ -0,0 +1,128 @@
+diff --git a/ext/adaptivedemux2/meson.build b/ext/adaptivedemux2/meson.build
+index 711b38a2a9..67a789f664 100644
+--- a/ext/adaptivedemux2/meson.build
++++ b/ext/adaptivedemux2/meson.build
+@@ -82,7 +82,7 @@ soup_link_args = []
+ soup_link_deps = []
+ 
+ default_library = get_option('default_library')
+-if host_system != 'linux' or default_library in ['static', 'both']
++if default_library in ['static', 'both']
+   if soup_ver_opt in ['auto', '3']
+     libsoup3_dep = dependency('libsoup-3.0', allow_fallback: true,
+                               required: soup_ver_opt == '3' and soup_opt.enabled())
+@@ -120,7 +120,7 @@ adaptive_deps = [gmodule_dep, gst_dep, gsttag_dep, gstnet_dep, gstbase_dep, gstp
+ adaptive_args = [gst_plugins_good_args, soup_loader_args, hls_cargs,
+     '-DGST_ISOFF_API=G_GNUC_INTERNAL']
+ 
+-if host_system != 'linux'
++if false
+     adaptivedemux2 = library('gstadaptivedemux2',
+       c_args: [adaptive_args, soup_link_args],
+       dependencies: [adaptive_deps, soup_link_deps],
+diff --git a/ext/soup/gstsouploader.c b/ext/soup/gstsouploader.c
+index 9192e4dac5..8082b2614d 100644
+--- a/ext/soup/gstsouploader.c
++++ b/ext/soup/gstsouploader.c
+@@ -34,12 +34,18 @@ GST_DEBUG_CATEGORY (gst_soup_debug);
+ 
+ #ifndef LINK_SOUP
+ 
+-#if defined(__APPLE__) || defined(G_OS_WIN32)
+-#error "dlopen of libsoup is only supported on Linux"
++#if defined(G_OS_WIN32)
++#error "dlopen of libsoup is only supported on Darwin and Linux"
+ #endif
+ 
++#if defined(__APPLE__)
++#define LIBSOUP_3_SONAME "libsoup-3.0.0.dylib"
++#define LIBSOUP_2_SONAME "libsoup-2.4.1.dylib"
++#define LIBSOUP_COMMON_SYMBOL "soup_get_major_version"
++#else
+ #define LIBSOUP_3_SONAME "libsoup-3.0.so.0"
+ #define LIBSOUP_2_SONAME "libsoup-2.4.so.1"
++#endif
+ 
+ #define LOAD_SYMBOL(name) G_STMT_START {                                \
+     if (!g_module_symbol (module, G_STRINGIFY (name), (gpointer *) &G_PASTE (vtable->_, name))) { \
+@@ -156,7 +162,46 @@ gst_soup_load_library (void)
+   GST_DEBUG_CATEGORY_INIT (gst_soup_debug, "soup", 0, "soup");
+ #endif
+ 
+-#ifdef HAVE_RTLD_NOLOAD
++#if defined(__APPLE__)
++  g_autofree gchar* libsoup_path = NULL;
++  {
++    /* In order to avoid causing conflicts we detect if libsoup 2 or 3 is loaded already.
++     * Darwin has to probe by checking for symbols because `dlopen` called with a dylib
++     * basename will try to locate it via the process’s rpath stack (and not find it). */
++
++    gpointer func = NULL;
++    Dl_info info = { 0 };
++
++    GModule* module = g_module_open (NULL, 0);
++    if (g_module_symbol (module, LIBSOUP_COMMON_SYMBOL, &func)
++        && dladdr (func, &info) && info.dli_sname) {
++      libsoup_path = g_strndup(info.dli_fname, PATH_MAX - 1);
++      g_autofree gchar* image_name = g_path_get_basename (libsoup_path);
++
++      /* Make sure `libsoup_path` points to a dylib that actually exists and
++       * contains the libsoup symbol that was queried. */
++      gpointer handle = dlopen (libsoup_path, RTLD_NOW | RTLD_NOLOAD);
++      gboolean has_symbol = dlsym (handle, LIBSOUP_COMMON_SYMBOL) != NULL;
++      if (handle && has_symbol && g_str_equal (image_name, LIBSOUP_3_SONAME)) {
++        libsoup_sonames[0] = libsoup_path;
++        GST_DEBUG ("LibSoup 3 found");
++      } else if (handle && has_symbol && g_str_equal (image_name, LIBSOUP_2_SONAME)) {
++        libsoup_sonames[0] = libsoup_path;
++        GST_DEBUG ("LibSoup 2 found");
++      } else {
++        g_clear_pointer (&libsoup_path, g_free);
++      }
++      g_clear_pointer (&handle, dlclose);
++    }
++    g_module_close (module);
++
++    if (!libsoup_sonames[0]) {
++      GST_DEBUG ("Trying all libsoups");
++      libsoup_sonames[0] = LIBSOUP_3_SONAME;
++      libsoup_sonames[1] = LIBSOUP_2_SONAME;
++    }
++  }
++#elif defined(HAVE_RTLD_NOLOAD)
+   {
+     gpointer handle = NULL;
+ 
+diff --git a/ext/soup/meson.build b/ext/soup/meson.build
+index aaa01dbcf6..83b7cf3fbf 100644
+--- a/ext/soup/meson.build
++++ b/ext/soup/meson.build
+@@ -20,8 +20,8 @@ soup_link_deps = []
+ libsoup2_dep = disabler()
+ libsoup3_dep = disabler()
+ default_library = get_option('default_library')
+-soup_lookup_dep = get_option('soup-lookup-dep') and host_system == 'linux'
+-if host_system != 'linux' or default_library in ['static', 'both'] or soup_lookup_dep
++soup_lookup_dep = get_option('soup-lookup-dep')
++if default_library in ['static', 'both'] or soup_lookup_dep
+   if soup_ver_opt in ['auto', '3']
+     libsoup3_dep = dependency('libsoup-3.0', allow_fallback: true,
+                               required: soup_ver_opt == '3' and soup_opt.enabled())
+@@ -33,7 +33,7 @@ if host_system != 'linux' or default_library in ['static', 'both'] or soup_looku
+   endif
+ endif
+ 
+-if host_system != 'linux' or default_library in ['static', 'both']
++if default_library in ['static', 'both']
+   if libsoup3_dep.found()
+     soup_link_deps += libsoup3_dep
+     soup_link_args += '-DLINK_SOUP=3'
+@@ -60,7 +60,7 @@ soup_library_kwargs = {
+ soup_library_deps = [gst_dep, gstbase_dep, gsttag_dep, gmodule_dep, gio_dep, libdl_dep]
+ soup_library_c_args = gst_plugins_good_args
+ 
+-if host_system != 'linux'
++if false
+   gstsouphttpsrc = library('gstsoup',
+     c_args : soup_library_c_args + soup_link_args,
+     dependencies : soup_library_deps + soup_link_deps,
diff --git a/pkgs/development/libraries/gstreamer/good/souploader.diff b/pkgs/development/libraries/gstreamer/good/souploader.diff
index 8662207de8f2..49917cad91de 100644
--- a/pkgs/development/libraries/gstreamer/good/souploader.diff
+++ b/pkgs/development/libraries/gstreamer/good/souploader.diff
@@ -1,8 +1,17 @@
 diff --git a/ext/soup/gstsouploader.c b/ext/soup/gstsouploader.c
-index 85048ce303..d7d818cf95 100644
+index 85a033668e..8082b2614d 100644
 --- a/ext/soup/gstsouploader.c
 +++ b/ext/soup/gstsouploader.c
-@@ -181,7 +181,7 @@ gst_soup_load_library (void)
+@@ -197,7 +197,7 @@ gst_soup_load_library (void)
+ 
+     if (!libsoup_sonames[0]) {
+       GST_DEBUG ("Trying all libsoups");
+-      libsoup_sonames[0] = LIBSOUP_3_SONAME;
++      libsoup_sonames[0] = "@nixLibSoup3Path@/" LIBSOUP_3_SONAME;
+       libsoup_sonames[1] = LIBSOUP_2_SONAME;
+     }
+   }
+@@ -216,7 +216,7 @@ gst_soup_load_library (void)
        GST_DEBUG ("LibSoup 2 found");
      } else {
        GST_DEBUG ("Trying all libsoups");
diff --git a/pkgs/development/libraries/hamlib/4.nix b/pkgs/development/libraries/hamlib/4.nix
index 8fde56729e83..168a0477b2f8 100644
--- a/pkgs/development/libraries/hamlib/4.nix
+++ b/pkgs/development/libraries/hamlib/4.nix
@@ -5,7 +5,7 @@
 , swig
 , gd
 , ncurses
-, python3
+, python311
 , libxml2
 , tcl
 , libusb-compat-0_1
@@ -17,7 +17,9 @@
 , tclBindings ? true
 , perlBindings ? true
 }:
-
+let
+  python3 = python311; # needs distutils and imp
+in
 stdenv.mkDerivation rec {
   pname = "hamlib";
   version = "4.5.5";
diff --git a/pkgs/development/libraries/hamlib/default.nix b/pkgs/development/libraries/hamlib/default.nix
index 9250a66c219e..2b7f05bcdef0 100644
--- a/pkgs/development/libraries/hamlib/default.nix
+++ b/pkgs/development/libraries/hamlib/default.nix
@@ -5,7 +5,7 @@
 , swig
 , gd
 , ncurses
-, python3
+, python311
 , libxml2
 , tcl
 , libusb-compat-0_1
@@ -18,7 +18,9 @@
 , perlBindings ? stdenv.buildPlatform == stdenv.hostPlatform
 , buildPackages
 }:
-
+let
+  python3 = python311; # needs distutils and imp
+in
 stdenv.mkDerivation rec {
   pname = "hamlib";
   version = "3.3";
diff --git a/pkgs/development/libraries/icu/default.nix b/pkgs/development/libraries/icu/default.nix
index 0e77aebd1486..4f1e0e4172bb 100644
--- a/pkgs/development/libraries/icu/default.nix
+++ b/pkgs/development/libraries/icu/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, lib, fetchurl, fetchpatch, fixDarwinDylibNames, testers, buildPackages }:
+{ stdenv, lib, fetchurl, fetchpatch, fixDarwinDylibNames, testers, buildPackages, updateAutotoolsGnuConfigScriptsHook }:
 
 let
   make-icu = (import ./make-icu.nix) {
-    inherit stdenv lib buildPackages fetchurl fixDarwinDylibNames testers;
+    inherit stdenv lib buildPackages fetchurl fixDarwinDylibNames testers updateAutotoolsGnuConfigScriptsHook;
   };
 in
 {
diff --git a/pkgs/development/libraries/icu/make-icu.nix b/pkgs/development/libraries/icu/make-icu.nix
index 3e65e80ef7c4..575f184c163f 100644
--- a/pkgs/development/libraries/icu/make-icu.nix
+++ b/pkgs/development/libraries/icu/make-icu.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPackages, fetchurl, fixDarwinDylibNames, testers }:
+{ stdenv, lib, buildPackages, fetchurl, fixDarwinDylibNames, testers, updateAutotoolsGnuConfigScriptsHook }:
 
 { version, hash, patches ? [], patchFlags ? [], withStatic ? stdenv.hostPlatform.isStatic }:
 
@@ -64,9 +64,11 @@ let
     outputs = [ "out" "dev" ] ++ lib.optional withStatic "static";
     outputBin = "dev";
 
-    # FIXME: This fixes dylib references in the dylibs themselves, but
-    # not in the programs in $out/bin.
-    nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+    nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ] ++
+      # FIXME: This fixes dylib references in the dylibs themselves, but
+      # not in the programs in $out/bin.
+      lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
 
     # remove dependency on bootstrap-tools in early stdenv build
     postInstall = lib.optionalString withStatic ''
diff --git a/pkgs/development/libraries/irrlichtmt/default.nix b/pkgs/development/libraries/irrlichtmt/default.nix
index 8787fd390efd..538858904291 100644
--- a/pkgs/development/libraries/irrlichtmt/default.nix
+++ b/pkgs/development/libraries/irrlichtmt/default.nix
@@ -32,13 +32,14 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     libjpeg
     libGL
+  ] ++ (if stdenv.hostPlatform.isDarwin then [
+    Cocoa
+    Kernel
+  ] else [
     libX11
     libXi
     libXext
-  ] ++ lib.optionals stdenv.isDarwin [
-    Cocoa
-    Kernel
-  ];
+  ]);
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/libass/default.nix b/pkgs/development/libraries/libass/default.nix
index ad94f55ccb6d..cf8f4c85e0c6 100644
--- a/pkgs/development/libraries/libass/default.nix
+++ b/pkgs/development/libraries/libass/default.nix
@@ -11,11 +11,11 @@ assert fontconfigSupport -> fontconfig != null;
 
 stdenv.mkDerivation rec {
   pname = "libass";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchurl {
     url = "https://github.com/libass/libass/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8NoLv7pHbBauPhz9hiJW0wkVkR96uqGxbOYu5lMZJ4Q=";
+    sha256 = "sha256-6CYbUdZrqTP+mSSMb92HZ+2WxaflNjyDmSxzWiwvv3Q=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libdc1394/default.nix b/pkgs/development/libraries/libdc1394/default.nix
index 9ca5581b3bff..afd53588a336 100644
--- a/pkgs/development/libraries/libdc1394/default.nix
+++ b/pkgs/development/libraries/libdc1394/default.nix
@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-U3zreN087ycaGD9KF2GR0c7PhfAlUg5r03WLDhnmYJ8=";
   };
 
+  hardeningDisable = [
+    # "sorry, unimplemented: __builtin_clear_padding not supported for variable length aggregates"
+    "trivialautovarinit"
+  ];
+
   buildInputs = [ libusb1 ]
     ++ lib.optional stdenv.isLinux libraw1394
     ++ lib.optional stdenv.isDarwin CoreServices;
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 879120388146..31e36be121b5 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.120";
+  version = "2.4.121";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-O/VTY/dsclCUZEGrUdOmzArlGAVcD/AXMkq3bN77Mno=";
+    hash = "sha256-kJCEpQXXY4iH9ZC3B5Gzu9kGnHEMlI9dHxzm0IDN/Ks=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libevent/default.nix b/pkgs/development/libraries/libevent/default.nix
index ff9784064432..983395f33b4b 100644
--- a/pkgs/development/libraries/libevent/default.nix
+++ b/pkgs/development/libraries/libevent/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchurl, findutils, fixDarwinDylibNames
+, updateAutotoolsGnuConfigScriptsHook
 , sslSupport ? true, openssl
 , fetchpatch
 }:
@@ -36,7 +37,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional sslSupport "openssl"
     ;
 
-  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   buildInputs = lib.optional sslSupport openssl
     ++ lib.optional stdenv.isCygwin findutils;
diff --git a/pkgs/development/libraries/libftdi/1.x.nix b/pkgs/development/libraries/libftdi/1.x.nix
index 116f1dca1bbb..5d579cf8cb33 100644
--- a/pkgs/development/libraries/libftdi/1.x.nix
+++ b/pkgs/development/libraries/libftdi/1.x.nix
@@ -21,12 +21,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libftdi";
-  version = "1.5";
+  version = "1.5-unstable-2023-12-21";
 
   src = fetchgit {
     url = "git://developer.intra2net.com/libftdi";
-    rev = "v${version}";
-    sha256 = "0vipg3y0kbbzjhxky6hfyxy42mpqhvwn1r010zr5givcfp8ghq26";
+    rev = "de9f01ece34d2fe6e842e0250a38f4b16eda2429";
+    hash = "sha256-U37M5P7itTF1262oW+txbKxcw2lhYHAwy1ML51SDVMs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
index 664378d42b6d..7bf78ec875e2 100644
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -27,6 +27,12 @@ stdenv.mkDerivation rec {
       hash = "sha256-ileSNYddOt1F5rooRB0fXT20WkVlnG+gP5w7qJdBuww=";
     });
 
+  hardeningDisable = lib.optionals stdenv.hostPlatform.isAarch64 [
+    # aarch64-specific code gets:
+    # __builtin_clear_padding not supported for variable length aggregates
+    "trivialautovarinit"
+  ];
+
   nativeBuildInputs = [ cmake ninja ];
 
   # Required for case-insensitive filesystems ("BUILD" exists)
diff --git a/pkgs/development/libraries/libimobiledevice-glue/default.nix b/pkgs/development/libraries/libimobiledevice-glue/default.nix
index f85c559593d1..13a2e83d0473 100644
--- a/pkgs/development/libraries/libimobiledevice-glue/default.nix
+++ b/pkgs/development/libraries/libimobiledevice-glue/default.nix
@@ -4,21 +4,24 @@
 , autoreconfHook
 , pkg-config
 , libplist
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "libimobiledevice-glue";
-  version = "1.2.0";
-
-  outputs = [ "out" "dev" ];
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
     repo = pname;
     rev = version;
-    hash = "sha256-Rfs1i1Tt8uf3WfR+cDlF4L75nFHg9VypjMhHt0TgkyQ=";
+    hash = "sha256-+poCrn2YHeH8RQCfWDdnlmJB4Nf+unWUVwn7YwILHIs=";
   };
 
+  preAutoreconf = ''
+    export RELEASE_VERSION=${version}
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
@@ -28,9 +31,9 @@ stdenv.mkDerivation rec {
     libplist
   ];
 
-  preAutoreconf = ''
-    export RELEASE_VERSION=${version}
-  '';
+  outputs = [ "out" "dev" ];
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     homepage = "https://github.com/libimobiledevice/libimobiledevice-glue";
diff --git a/pkgs/development/libraries/libimobiledevice/default.nix b/pkgs/development/libraries/libimobiledevice/default.nix
index 59ee89c95422..0e81f32bebf8 100644
--- a/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/pkgs/development/libraries/libimobiledevice/default.nix
@@ -12,31 +12,36 @@
 , libimobiledevice-glue
 , SystemConfiguration
 , CoreFoundation
+, unstableGitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "libimobiledevice";
-  version = "1.3.0+date=2023-04-30";
-
-  outputs = [ "out" "dev" ];
+  version = "1.3.0-unstable-2024-05-20";
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
     repo = pname;
-    rev = "860ffb707af3af94467d2ece4ad258dda957c6cd";
-    hash = "sha256-mIsB+EaGJlGMOpz3OLrs0nAmhOY1BwMs83saFBaejwc=";
+    rev = "9ccc52222c287b35e41625cc282fb882544676c6";
+    hash = "sha256-pNvtDGUlifp10V59Kah4q87TvLrcptrCJURHo+Y+hs4=";
   };
 
   patches = [
-    # Pull upstream fix for clang-16 and upcoming gcc-14 support:
-    #   https://github.com/libimobiledevice/libimobiledevice/pull/1444
+    # Fix gcc-14 and clang-16 build:
+    #   https://github.com/libimobiledevice/libimobiledevice/pull/1569
     (fetchpatch {
-      name = "usleep-decl.patch";
-      url = "https://github.com/libimobiledevice/libimobiledevice/commit/db623184c0aa09c27697f5a2e81025db223075d5.patch";
-      hash = "sha256-TgdgBkEDXzQDSgJxcZc+pZncfmBVXarhHOByGFs6p0Q=";
+      name = "fime.h.patch";
+      url = "https://github.com/libimobiledevice/libimobiledevice/commit/92256c2ae2422dac45d8648a63517598bdd89883.patch";
+      hash = "sha256-sB+wEFuXFoQnuf7ntWfvYuCgWfYbmlPL7EjW0L0F74o=";
     })
   ];
 
+  preAutoreconf = ''
+    export RELEASE_VERSION=${version}
+  '';
+
+  configureFlags = [ "--without-cython" ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
@@ -54,11 +59,12 @@ stdenv.mkDerivation rec {
     CoreFoundation
   ];
 
-  preAutoreconf = ''
-    export RELEASE_VERSION=${version}
-  '';
 
-  configureFlags = [ "--without-cython" ];
+  outputs = [ "out" "dev" ];
+
+  enableParallelBuilding = true;
+
+  passthru.updateScript = unstableGitUpdater { };
 
   meta = with lib; {
     homepage = "https://github.com/libimobiledevice/libimobiledevice";
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index f0005969bbcf..4f7e652e9bb8 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.25.0";
+  version = "1.26.0";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     owner = "libinput";
     repo = "libinput";
     rev = version;
-    hash = "sha256-c2FU5OW+CIgtYTQy+bwIbaw3SP1pVxaLokhO+ag5/1s=";
+    hash = "sha256-mlxw4OUjaAdgRLFfPKMZDMOWosW9yKAkzDccwuLGCwQ=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index 8d2a4044458e..693e1874bdf0 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -32,6 +32,10 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     gettext
     python3
+    python3.pkgs.build
+    python3.pkgs.installer
+    python3.pkgs.setuptools
+    python3.pkgs.wheel
     # Docs, man, info
     texinfo
     help2man
@@ -58,7 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     pushd python
-    python setup.py install --prefix="$out" --optimize=1
+    python -m build --no-isolation --outdir dist/ --wheel
+    python -m installer --prefix $out dist/*.whl
     popd
   '';
 
diff --git a/pkgs/development/libraries/libsurvive/default.nix b/pkgs/development/libraries/libsurvive/default.nix
index dc282886b963..fae57569067a 100644
--- a/pkgs/development/libraries/libsurvive/default.nix
+++ b/pkgs/development/libraries/libsurvive/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
-, freeglut
+, libglut
 , lapack
 , libusb1
 , blas
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [
-    freeglut
+    libglut
     lapack
     libusb1
     blas
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index f1e5c7da1803..b66c8c288bc8 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch
 , nix-update-script
 
 , autoreconfHook
@@ -43,6 +44,15 @@ stdenv.mkDerivation (finalAttrs: {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    # Fix static linking of `libtiff` via `pkg-config` not working
+    # because `libtiff` does not declare `Lerc` dependency.
+    # nixpkgs has `lerc` >= 4 which provides a `.pc` file.
+    # TODO: Close when https://gitlab.com/libtiff/libtiff/-/merge_requests/633 is merged and available
+    (fetchpatch {
+      name = "libtiff-4.pc-Fix-Requires.private-missing-Lerc.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/ea882c3c240c14a897b9be38d815cc1893aafa59.patch";
+      hash = "sha256-C0xA3k1sgKmGJjEnyG9UxhXqYBYShKUDQsyjhbEDJbQ=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libtorrent-rasterbar/default.nix b/pkgs/development/libraries/libtorrent-rasterbar/default.nix
index 118d143e2cd5..55c284987a9b 100644
--- a/pkgs/development/libraries/libtorrent-rasterbar/default.nix
+++ b/pkgs/development/libraries/libtorrent-rasterbar/default.nix
@@ -25,10 +25,13 @@ in stdenv.mkDerivation {
   buildInputs = [ boostPython openssl zlib python ncurses ]
     ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ];
 
+  patches = [
+    # provide distutils alternative for python 3.12
+    ./distutils.patch
+  ];
+
   # https://github.com/arvidn/libtorrent/issues/6865
   postPatch = ''
-    substituteInPlace cmake/Modules/GeneratePkgConfig.cmake \
-      --replace @CMAKE_INSTALL_PREFIX@/'$<'1: '$<'1:
     substituteInPlace cmake/Modules/GeneratePkgConfig/target-compile-settings.cmake.in \
       --replace 'set(_INSTALL_LIBDIR "@CMAKE_INSTALL_LIBDIR@")' \
                 'set(_INSTALL_LIBDIR "@CMAKE_INSTALL_LIBDIR@")
diff --git a/pkgs/development/libraries/libtorrent-rasterbar/distutils.patch b/pkgs/development/libraries/libtorrent-rasterbar/distutils.patch
new file mode 100644
index 000000000000..57c90b69808c
--- /dev/null
+++ b/pkgs/development/libraries/libtorrent-rasterbar/distutils.patch
@@ -0,0 +1,20 @@
+diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
+index 2f4de4854..a68d547e6 100644
+--- a/bindings/python/CMakeLists.txt
++++ b/bindings/python/CMakeLists.txt
+@@ -95,8 +95,13 @@ if (python-install-system-dir)
+ else()
+ 	execute_process(
+ 		COMMAND "${Python3_EXECUTABLE}" -c [=[
+-import distutils.sysconfig
+-print(distutils.sysconfig.get_python_lib(prefix='', plat_specific=True))
++try:
++	import distutils.sysconfig
++	print(distutils.sysconfig.get_python_lib(prefix='', plat_specific=True))
++except ModuleNotFoundError:
++	import os, sys
++	version = f"{sys.version_info.major}.{sys.version_info.minor}"
++	print(os.sep.join(["lib", f"python{version}", "site-packages"]))
+ ]=]
+ 		OUTPUT_VARIABLE _PYTHON3_SITE_ARCH
+ 		OUTPUT_STRIP_TRAILING_WHITESPACE
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 51eb5558d626..e865873c2851 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, libiconv }:
+{ fetchurl, lib, stdenv, libiconv, updateAutotoolsGnuConfigScriptsHook }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
   propagatedBuildInputs = lib.optional (!stdenv.isLinux) libiconv;
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
   configureFlags = [
     "--with-libiconv-prefix=${libiconv}"
diff --git a/pkgs/development/libraries/liburing/default.nix b/pkgs/development/libraries/liburing/default.nix
index a42aab3d59e8..95df981d02e7 100644
--- a/pkgs/development/libraries/liburing/default.nix
+++ b/pkgs/development/libraries/liburing/default.nix
@@ -1,44 +1,66 @@
-{ lib, stdenv, fetchgit }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
 
 stdenv.mkDerivation rec {
   pname = "liburing";
-  version = "2.5";
+  version = "2.6";
 
-  src = fetchgit {
-    url    = "http://git.kernel.dk/${pname}";
-    rev    = "liburing-${version}";
-    sha256 = "sha256-hPyEZ0P1rfos53OCNd2OYFiqmv6TgpWaj5/xPLccCvM=";
+  src = fetchFromGitHub {
+    owner = "axboe";
+    repo = "liburing";
+    rev = "refs/tags/liburing-${version}";
+    hash = "sha256-UOhnFT4UKZmPchKxew3vYeKH2oETDVylE1RmJ2hnLq0=";
   };
 
   separateDebugInfo = true;
   enableParallelBuilding = true;
   # Upstream's configure script is not autoconf generated, but a hand written one.
   setOutputFlags = false;
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
   configureFlags = [
     "--includedir=${placeholder "dev"}/include"
     "--mandir=${placeholder "man"}/share/man"
   ];
 
+  # mysterious link failure
+  hardeningDisable = [ "trivialautovarinit" ];
+
   # Doesn't recognize platform flags
-  configurePlatforms = [];
+  configurePlatforms = [ ];
 
-  outputs = [ "out" "bin" "dev" "man" ];
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+    "man"
+  ];
 
   postInstall = ''
-    # Copy the examples into $bin. Most reverse dependency of this package should
-    # reference only the $out output
-    mkdir -p $bin/bin
-    cp ./examples/io_uring-cp examples/io_uring-test $bin/bin
-    cp ./examples/link-cp $bin/bin/io_uring-link-cp
-  '' + lib.optionalString stdenv.hostPlatform.isGnu ''
-    cp ./examples/ucontext-cp $bin/bin/io_uring-ucontext-cp
+    # Always builds both static and dynamic libraries, so we need to remove the
+    # libraries that don't match stdenv type.
+    rm $out/lib/liburing*${
+      if stdenv.hostPlatform.isStatic then ".so*" else ".a"
+    }
+
+    # Copy the examples into $bin. Most reverse dependency of
+    # this package should reference only the $out output
+    for file in $(find ./examples -executable -type f); do
+      install -Dm555 -t "$bin/bin" "$file"
+    done
   '';
 
   meta = with lib; {
     description = "Userspace library for the Linux io_uring API";
-    homepage    = "https://git.kernel.dk/cgit/liburing/";
-    license     = licenses.lgpl21;
-    platforms   = platforms.linux;
-    maintainers = with maintainers; [ thoughtpolice nickcao ];
+    homepage = "https://github.com/axboe/liburing";
+    license = licenses.lgpl21;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [
+      thoughtpolice
+      nickcao
+    ];
   };
 }
diff --git a/pkgs/development/libraries/libva/1.nix b/pkgs/development/libraries/libva/1.nix
index 63be647f015a..1a9c7309e542 100644
--- a/pkgs/development/libraries/libva/1.nix
+++ b/pkgs/development/libraries/libva/1.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   # TODO: share libs between minimal and !minimal - perhaps just symlink them
 
   # Add FHS paths for non-NixOS applications.
-  configureFlags = [ "--with-drivers-path=${mesa.drivers.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri" ]
+  configureFlags = lib.optionals stdenv.isLinux [ "--with-drivers-path=${mesa.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri" ]
     ++ lib.optionals (!minimal) [ "--enable-glx" ];
 
   installFlags = [ "dummy_drv_video_ladir=$(out)/lib/dri" ];
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index eceba4ac8ebf..aad42d7e51f8 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -33,9 +33,9 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [ libdrm ]
     ++ lib.optionals (!minimal) [ libX11 libXext libXfixes wayland libffi libGL ];
 
-  mesonFlags = [
+  mesonFlags = lib.optionals stdenv.isLinux [
     # Add FHS and Debian paths for non-NixOS applications
-    "-Ddriverdir=${mesa.drivers.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri:/usr/lib/x86_64-linux-gnu/dri:/usr/lib/i386-linux-gnu/dri"
+    "-Ddriverdir=${mesa.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri:/usr/lib/x86_64-linux-gnu/dri:/usr/lib/i386-linux-gnu/dri"
   ];
 
   passthru.tests = {
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index 906a3c59234a..8c1c3b7c5e9c 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -17,8 +17,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ xorg.libX11 ];
 
-  mesonFlags = lib.optionals stdenv.isLinux
-    [ "-Dmoduledir=${mesa.drivers.driverLink}/lib/vdpau" ];
+  mesonFlags = lib.optionals stdenv.isLinux [ "-Dmoduledir=${mesa.driverLink}/lib/vdpau" ];
 
   NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lX11";
 
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index 5f5fc710d14d..f028a1ca7333 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -36,6 +36,10 @@
 , experimentalSpatialSvcSupport ? false # Spatial scalable video coding
 , experimentalFpMbStatsSupport ? false
 , experimentalEmulateHardwareSupport ? false
+
+# for passthru.tests
+, ffmpeg
+, gst_all_1
 }:
 
 let
@@ -89,13 +93,13 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-duU1exUg7JiKCtZfNxyb/y40hxsXeTIMShf9YounTWA=";
+    hash = "sha256-Pfg7g4y/dqn2VKDQU1LnTJQSj1Tont9/8Je6ShDb2GQ=";
   };
 
   postPatch = ''
@@ -198,6 +202,11 @@ stdenv.mkDerivation rec {
 
   postInstall = ''moveToOutput bin "$bin" '';
 
+  passthru.tests = {
+    inherit (gst_all_1) gst-plugins-good;
+    ffmpeg = ffmpeg.override { withVpx = true; };
+  };
+
   meta = with lib; {
     description = "WebM VP8/VP9 codec SDK";
     homepage    = "https://www.webmproject.org/";
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 58c9b7c7f666..22aab5c66944 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -8,14 +8,13 @@
 , udev
 , libevdev
 , libgudev
-, libxml2
 , python3
 , valgrind
 }:
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.11.0";
+  version = "2.12.2";
 
   outputs = [ "out" "dev" ];
 
@@ -23,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    hash = "sha256-TQOe954Zos3VpAG5M/O5je9dr8d4gOXIwy4xl3o+e1g=";
+    hash = "sha256-dxnXh+O/8q8ShsPbpqvaBPNQR6lJBphBolYTmcJEF/0=";
   };
 
   postPatch = ''
@@ -53,10 +52,6 @@ stdenv.mkDerivation rec {
     "-Dtests=${if doCheck then "enabled" else "disabled"}"
   ];
 
-  checkInputs = [
-    libxml2
-  ];
-
   nativeCheckInputs = [
     valgrind
     (python3.withPackages (ps: with ps; [
diff --git a/pkgs/development/libraries/libwacom/surface.nix b/pkgs/development/libraries/libwacom/surface.nix
index 54f5c424fda3..0d6ec49a6a5b 100644
--- a/pkgs/development/libraries/libwacom/surface.nix
+++ b/pkgs/development/libraries/libwacom/surface.nix
@@ -7,8 +7,8 @@ let
   libwacom-surface = fetchFromGitHub {
     owner = "linux-surface";
     repo = "libwacom-surface";
-    rev = "v2.10.0-1";
-    hash = "sha256-5/9X20veXazXEdSDGY5aMGQixulqMlC5Av0NGOF9m98=";
+    rev = "v2.12.0-1";
+    hash = "sha256-z/qNXbe89/0GIDj0BDQY6xdjHKA9chAPpviHPtBLjFM=";
   };
 in libwacom.overrideAttrs (old: {
   pname = "libwacom-surface";
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 2662d4e94008..184a48adf0dd 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, libtool
 , threadingSupport ? true # multi-threading
-, openglSupport ? false, freeglut, libGL, libGLU # OpenGL (required for vwebp)
+, openglSupport ? false, libglut, libGL, libGLU # OpenGL (required for vwebp)
 , pngSupport ? true, libpng # PNG image format
 , jpegSupport ? true, libjpeg # JPEG image format
 , tiffSupport ? true, libtiff # TIFF image format
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook libtool ];
   buildInputs = [ ]
-    ++ lib.optionals openglSupport [ freeglut libGL libGLU ]
+    ++ lib.optionals openglSupport [ libglut libGL libGLU ]
     ++ lib.optionals pngSupport [ libpng ]
     ++ lib.optionals jpegSupport [ libjpeg ]
     ++ lib.optionals tiffSupport [ libtiff ]
diff --git a/pkgs/development/libraries/libxkbcommon/default.nix b/pkgs/development/libraries/libxkbcommon/default.nix
index 7c635eb98b69..6994398eaa90 100644
--- a/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/pkgs/development/libraries/libxkbcommon/default.nix
@@ -13,7 +13,7 @@
 , libX11
   # To enable the "interactive-wayland" subcommand of xkbcli. This is the
   # wayland equivalent of `xev` on X11.
-, xorgserver # for Xvfb in tests
+, xorg
 , withWaylandTools ? stdenv.isLinux
 , wayland
 , wayland-protocols
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [ "out" "dev" "doc" ];
 
   depsBuildBuild = [ pkg-config ];
-  nativeBuildInputs = [ meson ninja pkg-config bison doxygen xorgserver ]
+  nativeBuildInputs = [ meson ninja pkg-config bison doxygen xorg.xvfb ]
     ++ lib.optional withWaylandTools wayland-scanner;
   buildInputs = [ xkeyboard_config libxcb libxml2 ]
     ++ lib.optionals withWaylandTools [ wayland wayland-protocols ];
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index 1938c523006b..df04c749d07e 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -15,16 +15,16 @@
 , gnome
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libxslt";
-  version = "1.1.39";
+  version = "1.1.41";
 
   outputs = [ "bin" "dev" "out" "doc" "devdoc" ] ++ lib.optional pythonSupport "py";
   outputMan = "bin";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-KiCtYhFIM5sHWcTU6WcZNi3uZMmgltu6YlugU4RjSfA=";
+    url = "mirror://gnome/sources/libxslt/${lib.versions.majorMinor finalAttrs.version}/libxslt-${finalAttrs.version}.tar.xz";
+    hash = "sha256-OtOSr5ERW3dA97UNIozBxfwTr8HafxbLAhORejf3G9o=";
   };
 
   strictDeps = true;
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
     inherit pythonSupport;
 
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "libxslt";
       versionPolicy = "none";
     };
   };
@@ -88,4 +88,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ eelco jtojnar ];
     broken = pythonSupport && !libxml2.pythonSupport; # see #73102 for why this is not an assert
   };
-}
+})
diff --git a/pkgs/development/libraries/mesa-glu/default.nix b/pkgs/development/libraries/mesa-glu/default.nix
index bcff20f1847c..138e7f247c13 100644
--- a/pkgs/development/libraries/mesa-glu/default.nix
+++ b/pkgs/development/libraries/mesa-glu/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl
 , meson, ninja
-, pkg-config, libGL, ApplicationServices
+, pkg-config, libGLX
 , testers
 , gitUpdater
 }:
@@ -17,8 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
-  propagatedBuildInputs = [ libGL ]
-    ++ lib.optional stdenv.isDarwin ApplicationServices;
+  propagatedBuildInputs = [ libGLX ];
 
   outputs = [ "out" "dev" ];
 
@@ -35,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = gitUpdater {
       # No nicer place to find latest release.
       url = "https://gitlab.freedesktop.org/mesa/glu";
-    rev-prefix = "glu-";
+      rev-prefix = "glu-";
     };
   };
 
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
new file mode 100644
index 000000000000..b42403d10aee
--- /dev/null
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -0,0 +1,31 @@
+{ lib, fetchurl }:
+rec {
+  pname = "mesa";
+  version = "24.1.2";
+
+  src = fetchurl {
+    urls = [
+      "https://archive.mesa3d.org/mesa-${version}.tar.xz"
+      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
+    ];
+    hash = "sha256-osWEyNV9O9i6EXkKbprjcT+IId+WwFm3ivsp3Zdcn0U=";
+  };
+
+  meta = {
+    description = "Open source 3D graphics library";
+    longDescription = ''
+      The Mesa project began as an open-source implementation of the OpenGL
+      specification - a system for rendering interactive 3D graphics. Over the
+      years the project has grown to implement more graphics APIs, including
+      OpenGL ES (versions 1, 2, 3), OpenCL, OpenMAX, VDPAU, VA API, XvMC, and
+      Vulkan.  A variety of device drivers allows the Mesa libraries to be used
+      in many different environments ranging from software emulation to
+      complete hardware acceleration for modern GPUs.
+    '';
+    homepage = "https://www.mesa3d.org/";
+    changelog = "https://www.mesa3d.org/relnotes/${version}.html";
+    license = with lib.licenses; [ mit ]; # X11 variant, in most files
+    platforms = lib.platforms.mesaPlatforms;
+    maintainers = with lib.maintainers; [ primeos vcunat ]; # Help is welcome :)
+  };
+}
diff --git a/pkgs/development/libraries/mesa/darwin.nix b/pkgs/development/libraries/mesa/darwin.nix
new file mode 100644
index 000000000000..aeeb8ab7648b
--- /dev/null
+++ b/pkgs/development/libraries/mesa/darwin.nix
@@ -0,0 +1,53 @@
+# The Darwin build of Mesa is different enough that we just give it an entire separate expression.
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bison,
+  flex,
+  meson,
+  ninja,
+  pkg-config,
+  python3Packages,
+  Xplugin,
+  xorg,
+  zlib,
+}:
+let
+  common = import ./common.nix { inherit lib fetchurl; };
+in stdenv.mkDerivation {
+  inherit (common) pname version src meta;
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    bison
+    flex
+    meson
+    ninja
+    pkg-config
+    python3Packages.packaging
+    python3Packages.python
+    python3Packages.mako
+  ];
+
+  buildInputs = [
+    Xplugin
+    xorg.libX11
+    xorg.libXext
+    xorg.libXfixes
+    zlib
+  ];
+
+  mesonAutoFeatures = "disabled";
+
+  mesonFlags = [
+    "--sysconfdir=/etc"
+    "--datadir=${placeholder "out"}/share"
+    (lib.mesonEnable "glvnd" false)
+    (lib.mesonEnable "shared-glapi" true)
+  ];
+
+  # Don't need this on Darwin.
+  passthru.llvmpipeHook = null;
+}
diff --git a/pkgs/development/libraries/mesa/darwin.patch b/pkgs/development/libraries/mesa/darwin.patch
deleted file mode 100644
index 4649e09afb5f..000000000000
--- a/pkgs/development/libraries/mesa/darwin.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/src/glx/glxext.c b/src/glx/glxext.c
-index 8770863eb7c..537f0af112c 100644
---- a/src/glx/glxext.c
-+++ b/src/glx/glxext.c
-@@ -886,10 +886,11 @@ __glXInitialize(Display * dpy)
-    Bool zink = False;
-    Bool try_zink = False;
- 
-+   const char *env = getenv("MESA_LOADER_DRIVER_OVERRIDE");
-+
- #if defined(GLX_DIRECT_RENDERING) && (!defined(GLX_USE_APPLEGL) || defined(GLX_USE_APPLE))
-    Bool glx_direct = !debug_get_bool_option("LIBGL_ALWAYS_INDIRECT", false);
-    Bool glx_accel = !debug_get_bool_option("LIBGL_ALWAYS_SOFTWARE", false);
--   const char *env = getenv("MESA_LOADER_DRIVER_OVERRIDE");
- 
-    zink = env && !strcmp(env, "zink");
-    try_zink = False;
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index af5baf1bc3a5..43aa88034168 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,6 +1,4 @@
 { lib
-, OpenGL
-, Xplugin
 , bison
 , buildPackages
 , directx-headers
@@ -14,7 +12,6 @@
 , intltool
 , jdupes
 , libdrm
-, libffi
 , libglvnd
 , libomxil-bellagio
 , libunwind
@@ -24,7 +21,6 @@
 , lm_sensors
 , meson
 , ninja
-, openssl
 , pkg-config
 , python3Packages
 , rust-bindgen
@@ -42,19 +38,9 @@
 , xcbutilkeysyms
 , xorg
 , zstd
-, withValgrind ?
-  lib.meta.availableOn stdenv.hostPlatform valgrind-light
-  && !valgrind-light.meta.broken
-, withLibunwind ? lib.meta.availableOn stdenv.hostPlatform libunwind
-, enableGalliumNine ? stdenv.isLinux
-, enableOSMesa ? stdenv.isLinux
-, enableOpenCL ? stdenv.isLinux && stdenv.isx86_64
-, enableTeflon ? stdenv.isLinux && stdenv.isAarch64  # currently only supports aarch64 SoCs, may change in the future
 , enablePatentEncumberedCodecs ? true
 
-, galliumDrivers ?
-  if stdenv.isLinux
-  then [
+, galliumDrivers ? [
     "d3d12" # WSL emulated GPU (aka Dozen)
     "iris" # new Intel (Broadwell+)
     "kmsro" # special "render only" driver for GPUs without a display controller
@@ -79,10 +65,7 @@
     "crocus" # Intel legacy, x86 only
     "i915" # Intel extra legacy, x86 only
   ]
-  else [ "auto" ]
-, vulkanDrivers ?
-  if stdenv.isLinux
-  then [
+, vulkanDrivers ? [
     "amd" # AMD (aka RADV)
     "intel" # new Intel (aka ANV)
     "microsoft-experimental" # WSL virtualized GPU (aka DZN/Dozen)
@@ -100,32 +83,20 @@
   ] ++ lib.optionals stdenv.hostPlatform.isx86 [
     "intel_hasvk" # Intel Haswell/Broadwell, "legacy" Vulkan driver (https://www.phoronix.com/news/Intel-HasVK-Drop-Dead-Code)
   ]
-  else [ "auto" ]
-, eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
-, vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ # No Vulkan support on Darwin
-  "device-select"
-  "overlay"
-  "intel-nullhw"
-]
+, eglPlatforms ? [ "x11" "wayland" ]
+, vulkanLayers ? [
+    "device-select"
+    "overlay"
+    "intel-nullhw"
+  ]
+, mesa
+, makeSetupHook
 }:
 
 # When updating this package, please verify at least these build (assuming x86_64-linux):
 # nix build .#mesa .#pkgsi686Linux.mesa .#pkgsCross.aarch64-multiplatform.mesa .#pkgsMusl.mesa
 
 let
-  version = "24.1.1";
-  hash = "sha256-ADiCbG9+iNkLTOb3GRkvpYyn3t9O3KoRdM972SDvieo=";
-
-  # Release calendar: https://www.mesa3d.org/release-calendar.html
-  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  branch = lib.versions.major version;
-
-  withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
-
-  haveWayland = lib.elem "wayland" eglPlatforms;
-  haveZink = lib.elem "zink" galliumDrivers;
-  haveDozen = (lib.elem "d3d12" galliumDrivers) || (lib.elem "microsoft-experimental" vulkanDrivers);
-
   rustDeps = [
     {
       pname = "paste";
@@ -162,28 +133,13 @@ let
   copyRustDeps = lib.concatStringsSep "\n" (builtins.map copyRustDep rustDeps);
 
   needNativeCLC = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-self = stdenv.mkDerivation {
-  pname = "mesa";
-  inherit version;
-
-  src = fetchurl {
-    urls = [
-      "https://archive.mesa3d.org/mesa-${version}.tar.xz"
-      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
-      "ftp://ftp.freedesktop.org/pub/mesa/mesa-${version}.tar.xz"
-      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
-      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
-    ];
-    inherit hash;
-  };
+
+  common = import ./common.nix { inherit lib fetchurl; };
+in stdenv.mkDerivation {
+  inherit (common) pname version src meta;
 
   patches = [
     ./opencl.patch
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Reorder things to make it build on Darwin again
-    # Submitted upstream: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/29592
-    # FIXME: remove when merged or otherwise addressed
-    ./darwin.patch
   ];
 
   postPatch = ''
@@ -201,16 +157,7 @@ self = stdenv.mkDerivation {
   '';
 
   outputs = [
-    "out" "dev" "drivers"
-  ] ++ lib.optionals enableOSMesa [
-    "osmesa"
-  ] ++ lib.optionals stdenv.isLinux [
-    "driversdev"
-  ] ++ lib.optionals enableTeflon [
-    "teflon"
-  ] ++ lib.optionals enableOpenCL [
-    "opencl"
-  ] ++ lib.optionals haveDozen [
+    "out" "dev" "drivers" "driversdev" "opencl" "teflon" "osmesa"
     # the Dozen drivers depend on libspirv2dxil, but link it statically, and
     # libspirv2dxil itself is pretty chonky, so relocate it to its own output in
     # case anything wants to use it at some point
@@ -228,69 +175,49 @@ self = stdenv.mkDerivation {
 
   mesonFlags = [
     "--sysconfdir=/etc"
-    "--datadir=${placeholder "drivers"}/share" # Vendor files
-
-    # Don't build in debug mode
-    # https://gitlab.freedesktop.org/mesa/mesa/blob/master/docs/meson.html#L327
-    (lib.mesonBool "b_ndebug" true)
-
-    (lib.mesonOption "dri-search-path" "${libglvnd.driverLink}/lib/dri")
+    "--datadir=${placeholder "drivers"}/share"
 
+    # What to build
     (lib.mesonOption "platforms" (lib.concatStringsSep "," eglPlatforms))
     (lib.mesonOption "gallium-drivers" (lib.concatStringsSep "," galliumDrivers))
     (lib.mesonOption "vulkan-drivers" (lib.concatStringsSep "," vulkanDrivers))
+    (lib.mesonOption "vulkan-layers" (builtins.concatStringsSep "," vulkanLayers))
 
+    # Make sure we know where to find all the drivers
     (lib.mesonOption "dri-drivers-path" "${placeholder "drivers"}/lib/dri")
     (lib.mesonOption "vdpau-libs-path" "${placeholder "drivers"}/lib/vdpau")
     (lib.mesonOption "omx-libs-path" "${placeholder "drivers"}/lib/bellagio")
     (lib.mesonOption "va-libs-path" "${placeholder "drivers"}/lib/dri")
     (lib.mesonOption "d3d-drivers-path" "${placeholder "drivers"}/lib/d3d")
 
-    (lib.mesonBool "gallium-nine" enableGalliumNine) # Direct3D in Wine
-    (lib.mesonBool "osmesa" enableOSMesa) # used by wine
-    (lib.mesonBool "teflon" enableTeflon) # TensorFlow frontend
-    (lib.mesonEnable "microsoft-clc" false) # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
-
-    # To enable non-mesa gbm backends to be found (e.g. Nvidia)
+    # Set search paths for non-Mesa drivers (e.g. Nvidia)
+    (lib.mesonOption "dri-search-path" "${libglvnd.driverLink}/lib/dri")
     (lib.mesonOption "gbm-backends-path" "${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm")
 
-    # meson auto_features enables these features, but we do not want them
-    (lib.mesonEnable "android-libbacktrace" false)
-  ] ++ lib.optionals stdenv.isLinux [
+    # Enable glvnd for dynamic libGL dispatch
     (lib.mesonEnable "glvnd" true)
+
+    (lib.mesonBool "gallium-nine" true) # Direct3D in Wine
+    (lib.mesonBool "osmesa" true) # used by wine
+    (lib.mesonBool "teflon" true) # TensorFlow frontend
+
+    # Enable Intel RT stuff when available
     (lib.mesonBool "install-intel-clc" true)
     (lib.mesonEnable "intel-rt" stdenv.isx86_64)
     (lib.mesonOption "clang-libdir" "${llvmPackages.clang-unwrapped.lib}/lib")
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Disable features that are explicitly unsupported on the platform
-    (lib.mesonEnable "gbm" false)
-    (lib.mesonEnable "xlib-lease" false)
-    (lib.mesonEnable "egl" false)
-    (lib.mesonEnable "gallium-vdpau" false)
-    (lib.mesonEnable "gallium-va" false)
-    (lib.mesonEnable "gallium-xa" false)
-    (lib.mesonEnable "lmsensors" false)
-    # Don’t build with glvnd support to make sure Mesa builds libGL on Darwin
-    (lib.mesonEnable "glvnd" false)
-    # This gets enabled by mesonAutoFeatures and fails on aarch64-darwin,
-    # which makes no sense because Darwin has neither Intel nor RT, but OK
-    (lib.mesonEnable "intel-rt" false)
-  ] ++ lib.optionals enableOpenCL [
+
     # Clover, old OpenCL frontend
     (lib.mesonOption "gallium-opencl" "icd")
     (lib.mesonBool "opencl-spirv" true)
 
     # Rusticl, new OpenCL frontend
     (lib.mesonBool "gallium-rusticl" true)
-  ] ++ lib.optionals (!withValgrind) [
-    (lib.mesonEnable "valgrind" false)
-  ] ++ lib.optionals (!withLibunwind) [
-    (lib.mesonEnable "libunwind" false)
-  ]
-  ++ lib.optionals enablePatentEncumberedCodecs [
+
+    # meson auto_features enables this, but we do not want it
+    (lib.mesonEnable "android-libbacktrace" false)
+    (lib.mesonEnable "microsoft-clc" false) # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
+  ] ++ lib.optionals enablePatentEncumberedCodecs [
     (lib.mesonOption "video-codecs" "all")
-  ] ++ lib.optionals (vulkanLayers != []) [
-    (lib.mesonOption "vulkan-layers" (builtins.concatStringsSep "," vulkanLayers))
   ] ++ lib.optionals needNativeCLC [
     (lib.mesonOption "intel-clc" "system")
   ];
@@ -298,61 +225,41 @@ self = stdenv.mkDerivation {
   strictDeps = true;
 
   buildInputs = with xorg; [
+    directx-headers
+    elfutils
     expat
     glslang
-    libffi
     libglvnd
+    libomxil-bellagio
+    libunwind
+    libva-minimal
     libvdpau
-    llvmPackages.libllvm
-    openssl
-    zstd
-  ] ++ (with xorg; [
     libX11
+    libxcb
     libXext
     libXfixes
     libXrandr
-    libXt
-    libXvMC
-    libpthreadstubs
-    libxcb
     libxshmfence
-    xcbutilkeysyms
-    xorgproto
-  ]) ++ lib.optionals withLibunwind [
-    libunwind
-  ] ++ [
-    python3Packages.python # for shebang
-  ] ++ lib.optionals haveWayland [
-    wayland
-    wayland-protocols
-  ] ++ lib.optionals stdenv.isLinux [
-    libomxil-bellagio
-    libva-minimal
+    libXxf86vm
+    llvmPackages.clang
     llvmPackages.clang-unwrapped
     llvmPackages.libclc
+    llvmPackages.libllvm
     lm_sensors
+    python3Packages.python # for shebang
     spirv-llvm-translator
     udev
-  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
-    elfutils
-  ] ++ lib.optionals enableOpenCL [
-    llvmPackages.clang
-  ] ++ lib.optionals withValgrind [
     valgrind-light
-  ] ++ lib.optionals haveZink [
     vulkan-loader
-  ] ++ lib.optionals haveDozen [
-    directx-headers
+    wayland
+    wayland-protocols
+    xcbutilkeysyms
+    xorgproto
+    zstd
   ];
 
   depsBuildBuild = [
     pkg-config
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    # Adding this unconditionally makes x86_64-darwin pick up an older
-    # toolchain, as we explicitly call Mesa with 11.0 stdenv, but buildPackages
-    # is still 10.something, and Mesa can't build with that.
-    # FIXME: figure this out, or figure out how to get rid of Mesa on Darwin,
-    # whichever is easier.
     buildPackages.stdenv.cc
   ];
 
@@ -365,6 +272,7 @@ self = stdenv.mkDerivation {
     flex
     file
     python3Packages.python
+    python3Packages.packaging
     python3Packages.pycparser
     python3Packages.mako
     python3Packages.ply
@@ -374,7 +282,6 @@ self = stdenv.mkDerivation {
     rust-bindgen
     rust-cbindgen
     rustPlatform.bindgenHook
-  ] ++ lib.optionals haveWayland [
     wayland-scanner
   ] ++ lib.optionals needNativeCLC [
     buildPackages.mesa.driversdev
@@ -384,74 +291,48 @@ self = stdenv.mkDerivation {
     buildPackages.mesa.driversdev
   ];
 
-  propagatedBuildInputs = (with xorg; [
-    libXdamage
-    libXxf86vm
-  ]) ++ lib.optionals withLibdrm [
-    libdrm
-  ] ++ lib.optionals stdenv.isDarwin [
-    OpenGL
-    Xplugin
-  ];
+  propagatedBuildInputs = [ libdrm ];
 
   doCheck = false;
 
   postInstall = ''
-    # Some installs don't have any drivers so this directory is never created.
-    mkdir -p $drivers $osmesa
-  '' + lib.optionalString stdenv.isLinux ''
-    mkdir -p $drivers/lib
-
-    if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
-      # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
-      mv -t $drivers/lib       \
-        $out/lib/libpowervr_rogue* \
-        $out/lib/libxatracker* \
-        $out/lib/libvulkan_*
-    fi
-
-    if [ -n "$(shopt -s nullglob; echo "$out"/lib/lib*_mesa*)" ]; then
-      # Move other drivers to a separate output
-      mv -t $drivers/lib $out/lib/lib*_mesa*
-    fi
-
-    # Update search path used by glvnd
+    # Move driver-related bits to $drivers
+    moveToOutput "lib/lib*_mesa*" $drivers
+    moveToOutput "lib/libpowervr_rogue*" $drivers
+    moveToOutput "lib/libxatracker*" $drivers
+    moveToOutput "lib/libvulkan_*" $drivers
+
+    # Update search path used by glvnd (it's pointing to $out but drivers are in $drivers)
     for js in $drivers/share/glvnd/egl_vendor.d/*.json; do
-      substituteInPlace "$js" --replace '"libEGL_' '"'"$drivers/lib/libEGL_"
+      substituteInPlace "$js" --replace-fail '"libEGL_' '"'"$drivers/lib/libEGL_"
     done
 
-    # Update search path used by Vulkan (it's pointing to $out but
-    # drivers are in $drivers)
+    # And same for Vulkan
     for js in $drivers/share/vulkan/icd.d/*.json; do
-      substituteInPlace "$js" --replace "$out" "$drivers"
+      substituteInPlace "$js" --replace-fail "$out" "$drivers"
     done
-  '' + lib.optionalString enableOpenCL ''
-    # Move OpenCL stuff
-    mkdir -p $opencl/lib
-    mv -t "$opencl/lib/"     \
-      $out/lib/gallium-pipe   \
-      $out/lib/lib*OpenCL*
-
-    # We construct our own .icd files that contain absolute paths.
-    mkdir -p $opencl/etc/OpenCL/vendors/
-    echo $opencl/lib/libMesaOpenCL.so > $opencl/etc/OpenCL/vendors/mesa.icd
-    echo $opencl/lib/libRusticlOpenCL.so > $opencl/etc/OpenCL/vendors/rusticl.icd
-  '' + lib.optionalString enableOSMesa ''
-    # move libOSMesa to $osmesa, as it's relatively big
-    mkdir -p $osmesa/lib
-    mv -t $osmesa/lib/ $out/lib/libOSMesa*
-  '' + lib.optionalString (vulkanLayers != []) ''
-    mv -t $drivers/lib $out/lib/libVkLayer*
+
+    # Move Vulkan layers to $drivers and update manifests
+    moveToOutput "lib/libVkLayer*" $drivers
     for js in $drivers/share/vulkan/{im,ex}plicit_layer.d/*.json; do
       substituteInPlace "$js" --replace '"libVkLayer_' '"'"$drivers/lib/libVkLayer_"
     done
-  '' + lib.optionalString haveDozen ''
-    mkdir -p $spirv2dxil/{bin,lib}
-    mv -t $spirv2dxil/lib $out/lib/libspirv_to_dxil*
-    mv -t $spirv2dxil/bin $out/bin/spirv2dxil
+
+    # Construct our own .icd files that contain absolute paths.
+    mkdir -p $opencl/etc/OpenCL/vendors/
+    echo $opencl/lib/libMesaOpenCL.so > $opencl/etc/OpenCL/vendors/mesa.icd
+    echo $opencl/lib/libRusticlOpenCL.so > $opencl/etc/OpenCL/vendors/rusticl.icd
+
+    moveToOutput bin/intel_clc $driversdev
+    moveToOutput lib/gallium-pipe $opencl
+    moveToOutput "lib/lib*OpenCL*" $opencl
+    moveToOutput "lib/libOSMesa*" $osmesa
+    moveToOutput bin/spirv2dxil $spirv2dxil
+    moveToOutput "lib/libspirv_to_dxil*" $spirv2dxil
+    moveToOutput lib/libteflon.so $teflon
   '';
 
-  postFixup = lib.optionalString stdenv.isLinux ''
+  postFixup = ''
     # set the default search path for DRI drivers; used e.g. by X server
     for pc in lib/pkgconfig/{dri,d3d}.pc; do
       [ -f "$dev/$pc" ] && substituteInPlace "$dev/$pc" --replace "$drivers" "${libglvnd.driverLink}"
@@ -471,8 +352,6 @@ self = stdenv.mkDerivation {
       fi
     done
 
-    moveToOutput bin/intel_clc $driversdev
-
     # Don't depend on build python
     patchShebangs --host --update $out/bin/*
 
@@ -486,59 +365,31 @@ self = stdenv.mkDerivation {
         patchelf --set-rpath "$(patchelf --print-rpath $lib):$drivers/lib" "$lib"
       fi
     done
-    # add RPATH here so Zink can find libvulkan.so
-    ${lib.optionalString haveZink ''
-      patchelf --add-rpath ${vulkan-loader}/lib $drivers/lib/dri/zink_dri.so
-    ''}
 
-    ${lib.optionalString enableTeflon ''
-      moveToOutput lib/libteflon.so $teflon
-    ''}
+    # add RPATH here so Zink can find libvulkan.so
+    patchelf --add-rpath ${vulkan-loader}/lib $drivers/lib/dri/zink_dri.so
   '';
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.isDarwin [
-      "-fno-common"
-    ] ++ lib.optionals enableOpenCL [
-      "-UPIPE_SEARCH_DIR"
-      "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-UPIPE_SEARCH_DIR"
+    "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
   ]);
 
   passthru = {
     inherit (libglvnd) driverLink;
     inherit llvmPackages;
 
-    libdrm = if withLibdrm then libdrm else null;
-
-    tests = lib.optionalAttrs stdenv.isLinux {
-      devDoesNotDependOnLLVM = stdenv.mkDerivation {
-        name = "mesa-dev-does-not-depend-on-llvm";
-        buildCommand = ''
-          echo ${self.dev} >>$out
-        '';
-        disallowedRequisites = [ llvmPackages.llvm self.drivers ];
-      };
+    tests.devDoesNotDependOnLLVM = stdenv.mkDerivation {
+      name = "mesa-dev-does-not-depend-on-llvm";
+      buildCommand = ''
+        echo ${mesa.dev} >>$out
+      '';
+      disallowedRequisites = [ llvmPackages.llvm mesa.drivers ];
     };
-  };
 
-  meta = {
-    description = "Open source 3D graphics library";
-    longDescription = ''
-      The Mesa project began as an open-source implementation of the OpenGL
-      specification - a system for rendering interactive 3D graphics. Over the
-      years the project has grown to implement more graphics APIs, including
-      OpenGL ES (versions 1, 2, 3), OpenCL, OpenMAX, VDPAU, VA API, XvMC, and
-      Vulkan.  A variety of device drivers allows the Mesa libraries to be used
-      in many different environments ranging from software emulation to
-      complete hardware acceleration for modern GPUs.
-    '';
-    homepage = "https://www.mesa3d.org/";
-    changelog = "https://www.mesa3d.org/relnotes/${version}.html";
-    license = with lib.licenses; [ mit ]; # X11 variant, in most files
-    platforms = lib.platforms.mesaPlatforms;
-    badPlatforms = []; # Load bearing for libGL meta on Darwin.
-    maintainers = with lib.maintainers; [ primeos vcunat ]; # Help is welcome :)
+    llvmpipeHook = makeSetupHook {
+      name = "llvmpipe-hook";
+      substitutions.drivers = mesa.drivers;
+    } ./llvmpipe-hook.sh;
   };
-};
-
-in self
+}
diff --git a/pkgs/development/libraries/mesa/llvmpipe-hook.sh b/pkgs/development/libraries/mesa/llvmpipe-hook.sh
new file mode 100644
index 000000000000..6217182b15e8
--- /dev/null
+++ b/pkgs/development/libraries/mesa/llvmpipe-hook.sh
@@ -0,0 +1,14 @@
+# shellcheck shell=bash
+
+# https://docs.mesa3d.org/envvars.html
+export LIBGL_ALWAYS_SOFTWARE=true
+export LIBGL_DRIVERS_PATH=@drivers@/lib/dri
+
+# https://github.com/NVIDIA/libglvnd/blob/master/src/EGL/icd_enumeration.md
+export __EGL_VENDOR_LIBRARY_FILENAMES=@drivers@/share/glvnd/egl_vendor.d/50_mesa.json
+
+# https://github.com/KhronosGroup/Vulkan-Loader/blob/main/docs/LoaderInterfaceArchitecture.md
+# glob because the filenames contain an architecture suffix
+# echo is needed to force-expand the glob
+VK_DRIVER_FILES="$(echo @drivers@/share/vulkan/icd.d/lvp_icd.*.json)"
+export VK_DRIVER_FILES
diff --git a/pkgs/development/libraries/mesa/stubs.nix b/pkgs/development/libraries/mesa/stubs.nix
deleted file mode 100644
index f9c462e9b326..000000000000
--- a/pkgs/development/libraries/mesa/stubs.nix
+++ /dev/null
@@ -1,88 +0,0 @@
-{ stdenv
-, libglvnd
-, mesa
-, OpenGL
-, testers
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libGL";
-  inherit (if stdenv.hostPlatform.isDarwin then mesa else libglvnd) version;
-  outputs = [ "out" "dev" ];
-
-  # On macOS, libglvnd is not supported, so we just use what mesa
-  # build. We need to also include OpenGL.framework, and some
-  # extra tricks to go along with. We add mesa’s libGLX to support
-  # the X extensions to OpenGL.
-  buildCommand = if stdenv.hostPlatform.isDarwin then ''
-    mkdir -p $out/nix-support $dev
-    echo ${OpenGL} >> $out/nix-support/propagated-build-inputs
-    ln -s ${mesa.out}/lib $out/lib
-
-    mkdir -p $dev/lib/pkgconfig $dev/nix-support
-    echo "$out" > $dev/nix-support/propagated-build-inputs
-    ln -s ${mesa.dev}/include $dev/include
-
-    cat <<EOF >$dev/lib/pkgconfig/gl.pc
-  Name: gl
-  Description: gl library
-  Version: ${mesa.version}
-  Libs: -L${mesa.out}/lib -lGL
-  Cflags: -I${mesa.dev}/include
-  EOF
-
-    cat <<EOF >$dev/lib/pkgconfig/glesv1_cm.pc
-  Name: glesv1_cm
-  Description: glesv1_cm library
-  Version: ${mesa.version}
-  Libs: -L${mesa.out}/lib -lGLESv1_CM
-  Cflags: -I${mesa.dev}/include
-  EOF
-
-    cat <<EOF >$dev/lib/pkgconfig/glesv2.pc
-  Name: glesv2
-  Description: glesv2 library
-  Version: ${mesa.version}
-  Libs: -L${mesa.out}/lib -lGLESv2
-  Cflags: -I${mesa.dev}/include
-  EOF
-  ''
-
-  # Otherwise, setup gl stubs to use libglvnd.
-  else ''
-    mkdir -p $out/nix-support
-    ln -s ${libglvnd.out}/lib $out/lib
-
-    mkdir -p $dev/{,lib/pkgconfig,nix-support}
-    echo "$out ${libglvnd} ${libglvnd.dev}" > $dev/nix-support/propagated-build-inputs
-    ln -s ${libglvnd.dev}/include $dev/include
-
-    genPkgConfig() {
-      local name="$1"
-      local lib="$2"
-
-      cat <<EOF >$dev/lib/pkgconfig/$name.pc
-    Name: $name
-    Description: $lib library
-    Version: ${libglvnd.version}
-    Libs: -L${libglvnd.out}/lib -l$lib
-    Cflags: -I${libglvnd.dev}/include
-    EOF
-    }
-
-    genPkgConfig gl GL
-    genPkgConfig egl EGL
-    genPkgConfig glesv1_cm GLESv1_CM
-    genPkgConfig glesv2 GLESv2
-  '';
-
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-
-  meta = {
-    description = "Stub bindings using " + (if stdenv.hostPlatform.isDarwin then "mesa" else "libglvnd");
-    pkgConfigModules = [ "gl" "egl" "glesv1_cm" "glesv2" ];
-  } // {
-    inherit (if stdenv.hostPlatform.isDarwin then mesa.meta else libglvnd.meta)
-      homepage license platforms badPlatforms;
-  };
-})
diff --git a/pkgs/development/libraries/nettle/default.nix b/pkgs/development/libraries/nettle/default.nix
index 3a1297f89763..0791a05e338e 100644
--- a/pkgs/development/libraries/nettle/default.nix
+++ b/pkgs/development/libraries/nettle/default.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix rec {
-  version = "3.9.1";
+  version = "3.10";
 
   src = fetchurl {
     url = "mirror://gnu/nettle/nettle-${version}.tar.gz";
-    hash = "sha256-zP7/mBsMpxu9b7ywVPQHxg/7ZEOJpb6A1nFtW1UMbOM=";
+    hash = "sha256-tMUYrbF05ITLSs6lQRjwI4DHEzdx5+m+uYoHhxlO5Hw=";
   };
 }
diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index 93db5470b0f7..a77529a42704 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -12,7 +12,7 @@
 , pugixml
 , zziplib
   # linux
-, freeglut
+, libglut
 , libGL
 , libGLU
 , libICE
@@ -75,7 +75,7 @@ let
       pugixml
       zziplib
     ] ++ lib.optionals stdenv.isLinux [
-      freeglut
+      libglut
       libGL
       libGLU
       libICE
diff --git a/pkgs/development/libraries/opencolorio/default.nix b/pkgs/development/libraries/opencolorio/default.nix
index d5270b655ca1..3e9302e025f2 100644
--- a/pkgs/development/libraries/opencolorio/default.nix
+++ b/pkgs/development/libraries/opencolorio/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , expat
 , yaml-cpp
@@ -10,7 +9,7 @@
 , minizip-ng
 # Only required on Linux
 , glew
-, freeglut
+, libglut
 # Only required on Darwin
 , Carbon
 , GLUT
@@ -26,22 +25,16 @@
 
 stdenv.mkDerivation rec {
   pname = "opencolorio";
-  version = "2.3.0";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenColorIO";
     rev = "v${version}";
-    sha256 = "sha256-E4TmMEFzI3nKqiDFaAkNx44uo84sacvZqjbfWe3A8fE=";
+    hash = "sha256-CSD3AZ36tmC/cYSdPsdDYx894+jd9GkGkhYJ767QY8A=";
   };
 
   patches = [
-    (fetchpatch {
-      # Taken from https://github.com/AcademySoftwareFoundation/OpenColorIO/pull/1891.
-      name = "opencolorio-yaml-cpp-8.0-compat.patch";
-      url = "https://github.com/AcademySoftwareFoundation/OpenColorIO/commit/e99b4afcf0408d8ec56fdf2b9380327c9284db00.patch";
-      sha256 = "sha256-7eIvVWKcpE0lmuYdNqFQFHkW/sSSzQ//LNIMOC28KZg=";
-    })
     # Workaround for https://gitlab.kitware.com/cmake/cmake/-/issues/25200.
     # Needed for zlib >= 1.3 && cmake < 3.27.4.
     ./broken-cmake-zlib-version.patch
@@ -64,7 +57,7 @@ stdenv.mkDerivation rec {
     pystring
     imath
     minizip-ng
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ glew freeglut ]
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ glew libglut ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ Carbon GLUT Cocoa ]
     ++ lib.optionals pythonBindings [ python3Packages.python python3Packages.pybind11 ]
     ++ lib.optionals buildApps [
@@ -75,7 +68,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DOCIO_INSTALL_EXT_PACKAGES=NONE"
     "-DOCIO_USE_SSE2NEON=OFF"
-    # GPU test fails with: freeglut (GPU tests): failed to open display ''
+    # GPU test fails with: libglut (GPU tests): failed to open display ''
     "-DOCIO_BUILD_GPU_TESTS=OFF"
     "-Dminizip-ng_INCLUDE_DIR=${minizip-ng}/include/minizip-ng"
   ] ++ lib.optional (!pythonBindings) "-DOCIO_BUILD_PYTHON=OFF"
diff --git a/pkgs/development/libraries/opencsg/default.nix b/pkgs/development/libraries/opencsg/default.nix
index a2675b2d79dc..6ac83dfa7d92 100644
--- a/pkgs/development/libraries/opencsg/default.nix
+++ b/pkgs/development/libraries/opencsg/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, libGLU, libGL, freeglut, glew, libXmu, libXext, libX11
+{lib, stdenv, fetchurl, libGLU, libGL, libglut, glew, libXmu, libXext, libX11
 , qmake, GLUT, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   buildInputs = [ glew ]
-    ++ lib.optionals stdenv.isLinux [ libGLU libGL freeglut libXmu libXext libX11 ]
+    ++ lib.optionals stdenv.isLinux [ libGLU libGL libglut libXmu libXext libX11 ]
     ++ lib.optional stdenv.isDarwin GLUT;
 
   doCheck = false;
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 981ab14ddcaa..6c87feaab882 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -276,8 +276,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.13";
-    hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM=";
+    version = "3.0.14";
+    hash = "sha256-7soDXU3U6E/CWEbZUtpil0hK+gZQpvhMaC453zpBI8o=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
@@ -299,8 +299,8 @@ in {
   };
 
   openssl_3_2 = common {
-    version = "3.2.1";
-    hash = "sha256-g8cyn+UshQZ3115dCwyiRTCbl+jsvP3B39xKufrDWzk=";
+    version = "3.2.2";
+    hash = "sha256-GXFJwY2enyksQ/BACsq6EuX1LKz+BQ89GZJ36nOOwuc=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
@@ -322,8 +322,8 @@ in {
   };
 
   openssl_3_3 = common {
-    version = "3.3.0";
-    hash = "sha256-U+ZrBDMipgar8Ah+dpmg4DOjf6E/65dC3zXDozsY+wI=";
+    version = "3.3.1";
+    hash = "sha256-d3zVlihMiDN1oqehG/XSeG/FQTJV76sgxQ1v/m0CC34=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
diff --git a/pkgs/development/libraries/partio/default.nix b/pkgs/development/libraries/partio/default.nix
index 75817ff568f7..a567612fae4f 100644
--- a/pkgs/development/libraries/partio/default.nix
+++ b/pkgs/development/libraries/partio/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , unzip
 , cmake
-, freeglut
+, libglut
 , libGLU
 , libGL
 , zlib
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     darwin.apple_sdk.frameworks.Cocoa
     darwin.apple_sdk.frameworks.GLUT
   ] ++ lib.optionals (!stdenv.isDarwin) [
-    freeglut
+    libglut
     libGLU
     libGL
   ];
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 3450f910effe..a61a13590d16 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -7,30 +7,20 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.43";
+  version = "10.44";
 
   src = fetchurl {
     url = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
-    hash = "sha256-4qU5hP8LB9/bWuRIa7ubIcyo598kNAlsyb8bcow1C8s=";
+    hash = "sha256-008C4RPPcZOh6/J3DTrFJwiNSF1OBH7RDl0hfG713pY=";
   };
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
-  postPatch = ''
-    # Fix jit autodetection:
-    #   https://github.com/PCRE2Project/pcre2/pull/396
-    # Applying manually to avoid fetchpatch and autoreconfHook.
-    # TODO: remove once 10.44 is released
-    substituteInPlace configure --replace-fail \
-      '#include "src/sljit/sljitConfigInternal.h"' \
-      '#include "src/sljit/sljitConfigCPU.h"'
-  '';
-
   configureFlags = [
     "--enable-pcre2-16"
     "--enable-pcre2-32"
     # only enable jit on supported platforms which excludes Apple Silicon, see https://github.com/zherczeg/sljit/issues/51
-    "--enable-jit=${if stdenv.hostPlatform.isS390x || stdenv.hostPlatform.isLoongArch64 then "no" else "auto"}"
+    "--enable-jit=${if stdenv.hostPlatform.isS390x then "no" else "auto"}"
   ]
   # fix pcre jit in systemd units that set MemoryDenyWriteExecute=true like gitea
   ++ lib.optional withJitSealloc "--enable-jit-sealloc";
diff --git a/pkgs/development/libraries/physics/geant4/default.nix b/pkgs/development/libraries/physics/geant4/default.nix
index 569a0b3e6923..7349c708e3d9 100644
--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@@ -3,8 +3,8 @@
 , enableQT             ? false # deprecated name
 , enableQt             ? enableQT
 , enableXM             ? false
-, mesa
-, enableOpenGLX11      ? !mesa.meta.broken
+, libGLX
+, enableOpenGLX11      ? !libGLX.meta.broken
 , enablePython         ? false
 , enableRaytracerX11   ? false
 
@@ -77,8 +77,8 @@ stdenv.mkDerivation rec {
     "-DGEANT4_USE_SYSTEM_ZLIB=ON"
     "-DGEANT4_BUILD_MULTITHREADED=${if enableMultiThreading then "ON" else "OFF"}"
   ] ++ lib.optionals (enableOpenGLX11 && stdenv.isDarwin) [
-    "-DXQuartzGL_INCLUDE_DIR=${libGL.dev}/include"
-    "-DXQuartzGL_gl_LIBRARY=${libGL}/lib/libGL.dylib"
+    "-DXQuartzGL_INCLUDE_DIR=${libGLX.dev}/include"
+    "-DXQuartzGL_gl_LIBRARY=${libGLX}/lib/libGL.dylib"
   ] ++ lib.optionals (enableMultiThreading && enablePython) [
     "-DGEANT4_BUILD_TLS_MODEL=global-dynamic"
   ] ++ lib.optionals enableInventor [
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index c3532d93683d..49dc2f4dd5d2 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -75,7 +75,7 @@ assert ldacbtSupport -> bluezSupport;
 
 stdenv.mkDerivation(finalAttrs: {
   pname = "pipewire";
-  version = "1.0.7";
+  version = "1.2.0";
 
   outputs = [
     "out"
@@ -91,7 +91,7 @@ stdenv.mkDerivation(finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     rev = finalAttrs.version;
-    sha256 = "sha256-YzI+hkX1ZdeTfxuKaw5P9OYPtkWtUg9cNo32wLCgjNU=";
+    sha256 = "sha256-hjjiH7+JoyRTcdbPDvkUEpO72b5p8CbTD6Un/vZrHL8=";
   };
 
   patches = [
@@ -185,6 +185,7 @@ stdenv.mkDerivation(finalAttrs: {
     (lib.mesonBool "rlimits-install" false) # installs to /etc, we won't use this anyway
     (lib.mesonEnable "compress-offload" true)
     (lib.mesonEnable "man" true)
+    (lib.mesonEnable "snap" false) # we don't currently have a working snapd
   ];
 
   # Fontconfig error: Cannot load default config file
diff --git a/pkgs/development/libraries/plib/default.nix b/pkgs/development/libraries/plib/default.nix
index c7349c369305..de93d6944c93 100644
--- a/pkgs/development/libraries/plib/default.nix
+++ b/pkgs/development/libraries/plib/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, fetchpatch, lib, stdenv, libGLU, libGL, freeglut, SDL
+{ fetchurl, fetchpatch, lib, stdenv, libGLU, libGL, libglut, SDL
 , libXi, libSM, libXmu, libXext, libX11 }:
 
 stdenv.mkDerivation rec {
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   ];
 
   propagatedBuildInputs = [
-    libGLU libGL freeglut SDL
+    libGLU libGL libglut SDL
 
     # The following libs ought to be propagated build inputs of Mesa.
     libXi libSM libXmu libXext libX11
diff --git a/pkgs/development/libraries/py3c/default.nix b/pkgs/development/libraries/py3c/default.nix
index 11ccba4c9ee3..32e7d1249118 100644
--- a/pkgs/development/libraries/py3c/default.nix
+++ b/pkgs/development/libraries/py3c/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python3 }:
+{ lib, stdenv, fetchFromGitHub, python311 }:
 
 stdenv.mkDerivation rec {
   pname = "py3c";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   nativeCheckInputs = [
-    python3
+    python311
   ];
 
   checkTarget = "test-python";
diff --git a/pkgs/development/libraries/qpdf/default.nix b/pkgs/development/libraries/qpdf/default.nix
index e3772dbb2787..b2858944ef7c 100644
--- a/pkgs/development/libraries/qpdf/default.nix
+++ b/pkgs/development/libraries/qpdf/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qpdf";
-  version = "11.9.0";
+  version = "11.9.1";
 
   src = fetchFromGitHub {
     owner = "qpdf";
     repo = "qpdf";
     rev = "v${version}";
-    hash = "sha256-HD7+2TBDLBIt+VaPO5WgnDjNZOj8naltFmYdYzOIn+4=";
+    hash = "sha256-DhrOKjUPgNo61db8av0OTfM8mCNebQocQWtTWdt002s=";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index dabb77ea0c85..9073bcb6f9e5 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -36,14 +36,6 @@ let
       ./qtbase.patch.d/0012-qtbase-tbd-frameworks.patch
 
       ./qtbase.patch.d/0014-aarch64-darwin.patch
-
-      # Fix typo that breaks build on Darwin
-      # FIXME: remove this once merged upstream
-      # See: https://invent.kde.org/qt/qt/qtbase/-/merge_requests/325
-      (fetchpatch {
-        url = "https://invent.kde.org/qt/qt/qtbase/-/commit/e84c0df50f51c61aa49b47823582b0f8de406e3d.patch";
-        hash = "sha256-d1RIY03E71aMzOOVtcIaMeariki/72QRekUne6P2D3M=";
-      })
     ] ++ [
       ./qtbase.patch.d/0003-qtbase-mkspecs.patch
       ./qtbase.patch.d/0004-qtbase-replace-libdir.patch
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index f3281a17170e..96c3621307c6 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "0e1ff2f06ddac7c32c5a5e0b65e402c9332e56f8",
-    "sha256": "1pfby0ilkikq8802diaslnkxw8qzbp4r0f80v696wfynn973mhdd"
+    "rev": "2b9835f5c9bcfe3105b60a8dd33c1db7d8611378",
+    "sha256": "1yms1r42yps06bg8gjbzb5y7x03ks11vg97s2j7r1aplp7kjf7wm"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index d92287feb151..7f3079d5add5 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -152,8 +152,8 @@ stdenv.mkDerivation (finalAttrs: ({
                 --replace "/System/Library/Frameworks/AGL.framework/" "${AGL}/Library/Frameworks/AGL.framework/"
     '' else lib.optionalString libGLSupported ''
       sed -i mkspecs/common/linux.conf \
-          -e "/^QMAKE_INCDIR_OPENGL/ s|$|${libGL.dev or libGL}/include|" \
-          -e "/^QMAKE_LIBDIR_OPENGL/ s|$|${libGL.out}/lib|"
+          -e "/^QMAKE_INCDIR_OPENGL/ s|$|${lib.getDev libGL}/include|" \
+          -e "/^QMAKE_LIBDIR_OPENGL/ s|$|${lib.getLib libGL}/lib|"
     '' + lib.optionalString (stdenv.hostPlatform.isx86_32 && stdenv.cc.isGNU) ''
       sed -i mkspecs/common/gcc-base-unix.conf \
           -e "/^QMAKE_LFLAGS_SHLIB/ s/-shared/-shared -static-libgcc/"
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index b2715fbe7502..73920c1646b9 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -1,5 +1,6 @@
 { qtModule
 , qtdeclarative, qtquickcontrols, qtlocation, qtwebchannel
+, fetchpatch
 
 , bison, flex, git, gperf, ninja, pkg-config, python, which
 , nodejs, perl
@@ -81,6 +82,21 @@ qtModule ({
     (
       cd src/3rdparty/chromium;
 
+      patch -p2 < ${
+        (fetchpatch { # support for building with python 3.12
+          name = "python312-imp.patch";
+          url = "https://codereview.qt-project.org/gitweb?p=qt/qtwebengine-chromium.git;a=patch;h=3664134f749f4851a14ab1953a9ee460a1fe0b68";
+          hash = "sha256-XY0dEdeuOTRMR7onmuNg1Axld8+pquKAzOfDAGSIzI4=";
+        })
+      }
+      patch -p1 < ${
+        (fetchpatch { # support for building with python 3.12
+          name = "python312-six.patch";
+          url = "https://gitlab.archlinux.org/archlinux/packaging/packages/qt5-webengine/-/raw/6b0c0e76e0934db2f84be40cb5978cee47266e78/python3.12-six.patch";
+          hash = "sha256-YgP9Sq5+zTC+U7+0hQjZokwb+fytk0UEIJztUXFhTkI=";
+        })
+      }
+
       # Manually fix unsupported shebangs
       substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
         --replace "/usr/bin/env -S make -f" "/usr/bin/make -f" || true
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index 2310ce33ea4f..09d2f7539f15 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -1,61 +1,61 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, ninja
-, chromium
-, grpc
-, haskellPackages
-, mercurial
-, python3Packages
-, abseil-cpp
+{
+  abseil-cpp,
+  chromium,
+  cmake,
+  fetchFromGitHub,
+  gbenchmark,
+  grpc,
+  gtest,
+  haskellPackages,
+  icu,
+  lib,
+  mercurial,
+  ninja,
+  python3Packages,
+  stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "re2";
-  version = "2024-05-01";
+  version = "2024-06-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
-    rev = version;
-    hash = "sha256-p4MdHjTk0SQsBPVkEy+EceAN/QTyzBDe7Pd1hJwOs3A=";
+    rev = finalAttrs.version;
+    hash = "sha256-iQETsjdIFcYM5I/W8ytvV3z/4va6TaZ/+KkSjb8CtF0=";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
-  nativeBuildInputs = [ cmake ninja ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
 
-  propagatedBuildInputs = [ abseil-cpp ];
+  buildInputs = lib.optionals finalAttrs.doCheck [
+    gbenchmark
+    gtest
+  ];
 
-  postPatch = ''
-    substituteInPlace re2Config.cmake.in \
-      --replace "\''${PACKAGE_PREFIX_DIR}/" ""
-  '';
+  propagatedBuildInputs = [
+    abseil-cpp
+    icu
+  ];
 
-  # Needed for case-insensitive filesystems (i.e. MacOS) because a file named
-  # BUILD already exists.
-  cmakeBuildDir = "build_dir";
-
-  cmakeFlags = lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS:BOOL=ON";
-
-  # This installs a pkg-config definition.
-  postInstall = ''
-    pushd "$src"
-    make common-install prefix="$dev" SED_INPLACE="sed -i"
-    popd
-  '';
+  cmakeFlags = [
+    (lib.cmakeBool "RE2_BUILD_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "RE2_USE_ICU" true)
+  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) (lib.cmakeBool "BUILD_SHARED_LIBS" true);
 
   doCheck = true;
 
   passthru.tests = {
-    inherit
-      chromium
-      grpc
-      mercurial;
-    inherit (python3Packages)
-      fb-re2
-      google-re2;
+    inherit chromium grpc mercurial;
+    inherit (python3Packages) fb-re2 google-re2;
     haskell-re2 = haskellPackages.re2;
   };
 
@@ -68,7 +68,10 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.bsd3;
     homepage = "https://github.com/google/re2";
-    maintainers = with maintainers; [ azahi networkexception ];
+    maintainers = with maintainers; [
+      azahi
+      networkexception
+    ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index c67e44ea228c..2c70046108da 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -11,6 +11,8 @@
 , windows
 , enableJemalloc ? false
 , jemalloc
+, enableLiburing ? true
+, liburing
 , enableShared ? !stdenv.hostPlatform.isStatic
 , sse42Support ? stdenv.hostPlatform.sse4_2Support
 }:
@@ -26,11 +28,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-bTUzh7ch14TDcm6GkfhA5I/qUVmUm+RE5d2HMZ3zaNc=";
   };
 
+  patches = [ ./fix-findliburing.patch ];
+
   nativeBuildInputs = [ cmake ninja ];
 
   propagatedBuildInputs = [ bzip2 lz4 snappy zlib zstd ];
 
   buildInputs = lib.optional enableJemalloc jemalloc
+    ++ lib.optional enableLiburing liburing
     ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64_pthreads;
 
   outputs = [
@@ -45,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-DPORTABLE=1"
     "-DWITH_JEMALLOC=${if enableJemalloc then "1" else "0"}"
+    "-DWITH_LIBURING=${if enableLiburing then "1" else "0"}"
     "-DWITH_JNI=0"
     "-DWITH_BENCHMARK_TOOLS=0"
     "-DWITH_TESTS=1"
diff --git a/pkgs/development/libraries/rocksdb/fix-findliburing.patch b/pkgs/development/libraries/rocksdb/fix-findliburing.patch
new file mode 100644
index 000000000000..c546577813ce
--- /dev/null
+++ b/pkgs/development/libraries/rocksdb/fix-findliburing.patch
@@ -0,0 +1,29 @@
+From 23432b7958ecea64b49ba680767ea5dc696768c9 Mon Sep 17 00:00:00 2001
+From: Benjamin Lee <benjamin@computer.surgery>
+Date: Sun, 26 May 2024 17:17:01 -0700
+Subject: [PATCH] fix findliburing
+
+`find_package(... NAMES lib*)` is basically always wrong. The previous
+code was just hardcoding the static library path to work around the fact
+that this doesn't work. This breaks the build when only dynamic liburing
+builds are available.
+---
+ cmake/modules/Finduring.cmake | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cmake/modules/Finduring.cmake b/cmake/modules/Finduring.cmake
+index 8cb14cb27..87f2df474 100644
+--- a/cmake/modules/Finduring.cmake
++++ b/cmake/modules/Finduring.cmake
+@@ -7,7 +7,7 @@
+ find_path(uring_INCLUDE_DIR
+   NAMES liburing.h)
+ find_library(uring_LIBRARIES
+-  NAMES liburing.a liburing)
++  NAMES uring)
+ 
+ include(FindPackageHandleStandardArgs)
+ find_package_handle_standard_args(uring
+-- 
+2.44.0
+
diff --git a/pkgs/development/libraries/science/biology/bicgl/default.nix b/pkgs/development/libraries/science/biology/bicgl/default.nix
index 07d64fbd97ed..89f4220f92f4 100644
--- a/pkgs/development/libraries/science/biology/bicgl/default.nix
+++ b/pkgs/development/libraries/science/biology/bicgl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, libminc, bicpl, freeglut, mesa_glu, GLUT }:
+{ lib, stdenv, fetchFromGitHub, cmake, libminc, bicpl, libGLU, libglut }:
 
 stdenv.mkDerivation rec {
   pname = "bicgl";
@@ -14,9 +14,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ libminc bicpl mesa_glu ]
-    ++ lib.optionals stdenv.isDarwin [ GLUT ]
-    ++ lib.optionals stdenv.isLinux [ freeglut ];
+  buildInputs = [ libminc bicpl libGLU libglut ];
 
   cmakeFlags = [
     "-DLIBMINC_DIR=${libminc}/lib/cmake"
diff --git a/pkgs/development/libraries/science/biology/mirtk/default.nix b/pkgs/development/libraries/science/biology/mirtk/default.nix
index ce02474eeb1e..979f3589b330 100644
--- a/pkgs/development/libraries/science/biology/mirtk/default.nix
+++ b/pkgs/development/libraries/science/biology/mirtk/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     eigen
     fltk
     itk
-    libGLU.dev
+    libGLU
     python3
     tbb
     vtk
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 842bc3af9834..e36c92d60b67 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -181,6 +181,10 @@ stdenv.mkDerivation rec {
     "strictoverflow"
     # don't interfere with dynamic target detection
     "relro" "bindnow"
+  ] ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+    # "__builtin_clear_padding not supported for variable length aggregates"
+    # in aarch64-specific code
+    "trivialautovarinit"
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/simgear/default.nix b/pkgs/development/libraries/simgear/default.nix
index c66dfb3fdcc8..416274e1c545 100644
--- a/pkgs/development/libraries/simgear/default.nix
+++ b/pkgs/development/libraries/simgear/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, plib, freeglut, xorgproto, libX11, libXext, libXi
+{ lib, stdenv, fetchurl, plib, libglut, xorgproto, libX11, libXext, libXi
 , libICE, libSM, libXt, libXmu, libGLU, libGL, boost179, zlib, libjpeg, freealut
 , openscenegraph, openal, expat, cmake, apr, xz
 , curl
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ plib freeglut xorgproto libX11 libXext libXi
+  buildInputs = [ plib libglut xorgproto libX11 libXext libXi
                   libICE libSM libXt libXmu libGLU libGL boost179 zlib libjpeg freealut
                   openscenegraph openal expat apr curl xz ];
 
diff --git a/pkgs/development/libraries/snappy/default.nix b/pkgs/development/libraries/snappy/default.nix
index 869c56ed7300..21785e251841 100644
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snappy";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "snappy";
     rev = version;
-    hash = "sha256-mpEeUoJs+lGlqh1m6Mmr8UnbtQDn/8kfkeQdFwo2rQ0=";
+    hash = "sha256-IzKzrMDjh+Weor+OrKdX62cAKYTdDXgldxCgNE2/8vk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/spdlog/default.nix b/pkgs/development/libraries/spdlog/default.nix
index f9255e3df595..6aa91db83549 100644
--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spdlog";
-  version = "1.13.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "gabime";
     repo  = "spdlog";
     rev   = "v${version}";
-    hash  = "sha256-3n8BnjZ7uMH8quoiT60yTU7poyOtoEmzNMOLa1+r7X0=";
+    hash  = "sha256-F7khXbMilbh5b+eKnzcB0fPPWQqUHqAYPWJb83OnUKQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/thrift/default.nix b/pkgs/development/libraries/thrift/default.nix
index 3d0a9d8a7874..7995a3fe1699 100644
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation rec {
     cmake
     flex
     pkg-config
+    python3
+    python3.pkgs.setuptools
   ];
 
   buildInputs = [
@@ -54,6 +56,11 @@ stdenv.mkDerivation rec {
       --replace "'FastbinaryTest.py'," "" \
       --replace "'TestEof.py'," "" \
       --replace "'TestFrozen.py'," ""
+
+    # these functions are removed in Python3.12
+    substituteInPlace test/py/SerializationTest.py \
+      --replace-fail "assertEquals" "assertEqual" \
+      --replace-fail "assertNotEquals" "assertNotEqual"
   '';
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index cfd6b99412a1..23970be58d08 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -60,6 +60,9 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-armasm=inline"
   ] ++ extraConfigureFlags;
 
+  # Breaks tls13 tests on aarch64-darwin.
+  hardeningDisable = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ "zerocallusedregs" ];
+
   # LTO should help with the C implementations.
   env.NIX_CFLAGS_COMPILE = lib.optionalString enableLto "-flto";
   env.NIX_LDFLAGS_COMPILE = lib.optionalString enableLto "-flto";
diff --git a/pkgs/development/libraries/zlib-ng/default.nix b/pkgs/development/libraries/zlib-ng/default.nix
index c4d2aa2c5334..c6fa9cb2a2ac 100644
--- a/pkgs/development/libraries/zlib-ng/default.nix
+++ b/pkgs/development/libraries/zlib-ng/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zlib-ng";
-  version = "2.1.6";
+  version = "2.1.7";
 
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = "zlib-ng";
     rev = version;
-    hash = "sha256-Auu7DS4qNm9/8t/nCjEJBaXfPPxA18oZr2qqybVY4Es=";
+    hash = "sha256-fNebnLeME0HXUx8M7YfTT0aMJQggEmMs9EbJFWL1zC4=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/lisp-modules/ql.nix b/pkgs/development/lisp-modules/ql.nix
index a745bfd4fe20..595e08dd6a94 100644
--- a/pkgs/development/lisp-modules/ql.nix
+++ b/pkgs/development/lisp-modules/ql.nix
@@ -140,7 +140,7 @@ let
       nativeLibs = [ pkgs.libGLU ];
     });
     cl-glut = super.cl-glut.overrideLispAttrs (o: {
-      nativeLibs = [ pkgs.freeglut ];
+      nativeLibs = [ pkgs.libglut ];
     });
     cl-glfw = super.cl-glfw.overrideLispAttrs (o: {
       nativeLibs = [ pkgs.glfw ];
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 61fab76b9834..6abc3b9c0fff 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2347,14 +2347,14 @@ buildLuarocksPackage {
 luv = callPackage({ buildLuarocksPackage, cmake, fetchurl, luaOlder }:
 buildLuarocksPackage {
   pname = "luv";
-  version = "1.44.2-1";
+  version = "1.48.0-2";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luv-1.44.2-1.rockspec";
-    sha256 = "07jwi50i16rv7sj914k1q3l9dy9wldbw2skmsdrzlkc57mqvg348";
+    url    = "mirror://luarocks/luv-1.48.0-2.rockspec";
+    sha256 = "0353bjn9z90a1hd7rksdfrd9fbdd31hbvdaxr1fb0fh0bc1cpy94";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/luvit/luv/releases/download/1.44.2-1/luv-1.44.2-1.tar.gz";
-    sha256 = "0c2wkszxw6gwa4l6g1d2zzh660j13lif6c7a910vq7zn8jycgd9y";
+    url    = "https://github.com/luvit/luv/releases/download/1.48.0-2/luv-1.48.0-2.tar.gz";
+    sha256 = "2c3a1ddfebb4f6550293a40ee789f7122e97647eede51511f57203de48c03b7a";
   };
 
   disabled = luaOlder "5.1";
diff --git a/pkgs/development/ocaml-modules/lablgl/Makefile.config.patch b/pkgs/development/ocaml-modules/lablgl/Makefile.config.patch
deleted file mode 100644
index 3d880c00947e..000000000000
--- a/pkgs/development/ocaml-modules/lablgl/Makefile.config.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-diff -Naur lablGL.ori/Makefile.config lablGL/Makefile.config
---- lablGL.ori/Makefile.config	1970-01-01 01:00:00.000000000 +0100
-+++ lablGL/Makefile.config	2013-06-02 08:13:10.000000000 +0200
-@@ -0,0 +1,63 @@
-+#	LablGL and Togl configuration file
-+#
-+# Please have a look at the config/Makefile in the Objective Caml distribution,
-+# or at the labltklink script to get the information needed here
-+#
-+
-+##### Adjust these always
-+
-+# Uncomment if you have the fast ".opt" compilers
-+#CAMLC = ocamlc.opt
-+#CAMLOPT = ocamlopt.opt
-+
-+# Where to put the lablgl script
-+BINDIR = @BINDIR@
-+
-+# Where to find X headers
-+XINCLUDES = @XINCLUDES@
-+# X libs (for broken RTLD_GLOBAL: e.g. FreeBSD 4.0)
-+#XLIBS = -L/usr/X11R6/lib -lXext -lXmu -lX11 -lXi
-+
-+# Where to find Tcl/Tk headers
-+# This must the same version as for LablTk
-+TKINCLUDES = @TKINCLUDES@
-+# Tcl/Tk libs (for broken RTLD_GLOBAL: e.g. FreeBSD 4.0)
-+#TKLIBS = -L/usr/local/lib -ltk84 -ltcl84
-+
-+# Where to find OpenGL/Mesa/Glut headers and libraries
-+GLINCLUDES =
-+GLLIBS = -lGL -lGLU
-+GLUTLIBS = -lglut
-+# The following libraries may be required (try to add them one at a time)
-+#GLLIBS = -lGL -lGLU -lXmu -lXext -lXi -lcipher -lpthread
-+
-+# How to index a library after installing (ranlib required on MacOSX)
-+RANLIB = :
-+#RANLIB = ranlib
-+
-+##### Uncomment these for windows
-+#TKLIBS = tk83.lib tcl83.lib gdi32.lib user32.lib
-+#GLLIBS = opengl32.lib glu32.lib
-+#TOOLCHAIN = msvc
-+#XA = .lib
-+#XB = .bat
-+#XE = .exe
-+#XO = .obj
-+#XS = .dll
-+
-+##### Adjust these if non standard
-+
-+# The Objective Caml library directory
-+#LIBDIR = `ocamlc -where`
-+
-+# Where to put dlls (if dynamic loading available)
-+DLLDIR = @DLLDIR@
-+
-+# Where to put LablGL (standard)
-+INSTALLDIR = @INSTALLDIR@
-+
-+# Where is Togl (default)
-+#TOGLDIR = Togl
-+
-+# C Compiler options
-+#COPTS = -c -O
diff --git a/pkgs/development/ocaml-modules/lablgl/default.nix b/pkgs/development/ocaml-modules/lablgl/default.nix
index abe1649e0094..64ace7c44963 100644
--- a/pkgs/development/ocaml-modules/lablgl/default.nix
+++ b/pkgs/development/ocaml-modules/lablgl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ocaml, findlib, libGLU, libGL, freeglut, camlp-streams, darwin } :
+{ lib, stdenv, fetchFromGitHub, ocaml, findlib, libGLU, libglut, camlp-streams } :
 
 if lib.versionOlder ocaml.version "4.06"
 then throw "lablgl is not available for OCaml ${ocaml.version}"
@@ -18,28 +18,30 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   nativeBuildInputs = [ ocaml findlib ];
-  buildInputs = [ freeglut camlp-streams ];
+  buildInputs = [ libglut camlp-streams ];
   propagatedBuildInputs = [
     libGLU
-    libGL
-  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.GLUT
-    darwin.apple_sdk.libs.Xplugin
   ];
 
-  patches = [ ./Makefile.config.patch ./META.patch ];
+  patches = [ ./META.patch ];
 
   preConfigure = ''
     mkdir -p $out/bin
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs
-    substituteInPlace Makefile.config \
-      --subst-var-by BINDIR $out/bin/ \
-      --subst-var-by INSTALLDIR $out/lib/ocaml/${ocaml.version}/site-lib/lablgl/ \
-      --subst-var-by DLLDIR $out/lib/ocaml/${ocaml.version}/site-lib/stublibs/ \
-      --subst-var-by TKINCLUDES "" \
-      --subst-var-by XINCLUDES ""
+    cp \
+      Makefile.config.${if stdenv.hostPlatform.isDarwin then "osx" else "ex"} \
+      Makefile.config
   '';
 
+  makeFlags = [
+    "BINDIR=${placeholder "out"}/bin/"
+    "INSTALLDIR=${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib/lablgl/"
+    "DLLDIR=${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib/stublibs/"
+    "XINCLUDES="
+    "TKINCLUDES="
+    "TKLIBS="
+  ];
+
   buildFlags = [ "lib" "libopt" "glut" "glutopt" ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index 498de531b9c5..fcee1327c2a2 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "accelerate";
-  version = "0.30.0";
+  version = "0.31.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "accelerate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-E20pI5BrcTrMYrhriuOUl5/liSaQQy6eqRyCoauwb9Q=";
+    hash = "sha256-1iLTmSyZzOHGeAr2xBW4mebbq1FZdNfJb8blCtbSqsI=";
   };
 
   buildInputs = [ llvmPackages.openmp ];
diff --git a/pkgs/development/python-modules/accessible-pygments/default.nix b/pkgs/development/python-modules/accessible-pygments/default.nix
index 591e5c75db13..74bd2d1e09a0 100644
--- a/pkgs/development/python-modules/accessible-pygments/default.nix
+++ b/pkgs/development/python-modules/accessible-pygments/default.nix
@@ -3,23 +3,30 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  setuptools,
+  hatchling,
+  hatch-vcs,
+  hatch-fancy-pypi-readme,
   pygments,
 }:
 
 buildPythonPackage rec {
   pname = "accessible-pygments";
-  version = "0.0.4";
+  version = "0.0.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-57V6mxWVjpYBx+nrB6RAyBMoNUWiCXPyV0pfRT0OlT4=";
+    pname = "accessible_pygments";
+    inherit version;
+    hash = "sha256-QJGNPmorYZrUJMuR5Va9O9iGVEPZ8i8dzfeeM8gEaHI=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    hatchling
+    hatch-vcs
+    hatch-fancy-pypi-readme
+  ];
 
   dependencies = [ pygments ];
 
diff --git a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
index e8c1606433db..c47ea3e7cf57 100644
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -9,7 +9,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   setuptools,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/aioautomower/default.nix b/pkgs/development/python-modules/aioautomower/default.nix
index f300758aa811..19744f9aa3ba 100644
--- a/pkgs/development/python-modules/aioautomower/default.nix
+++ b/pkgs/development/python-modules/aioautomower/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   freezegun,
+  ical,
   mashumaro,
   poetry-core,
   pyjwt,
@@ -15,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "aioautomower";
-  version = "2024.5.1";
+  version = "2024.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "Thomas55555";
     repo = "aioautomower";
     rev = "refs/tags/${version}";
-    hash = "sha256-SwRr8BJOchQ7qObgVkNGTkaFEx7wiB/EPedRG2csH+A=";
+    hash = "sha256-v+wg/2JRBJ0VgRYOey92WGwVzHmxU9h/ev2oICefaMg=";
   };
 
   postPatch = ''
@@ -38,6 +39,7 @@ buildPythonPackage rec {
 
   dependencies = [
     aiohttp
+    ical
     mashumaro
     pyjwt
   ];
diff --git a/pkgs/development/python-modules/aioazuredevops/default.nix b/pkgs/development/python-modules/aioazuredevops/default.nix
index d8b046d3b03b..48687293d434 100644
--- a/pkgs/development/python-modules/aioazuredevops/default.nix
+++ b/pkgs/development/python-modules/aioazuredevops/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "aioazuredevops";
-  version = "2.0.0";
+  version = "2.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "timmo001";
     repo = "aioazuredevops";
     rev = "refs/tags/${version}";
-    hash = "sha256-QEIVAcBoTvuOeLN2kfDa3uYfrUm5Qu1TLp9C0uU+mW4=";
+    hash = "sha256-1v58I9WOyyrp9n+qdvVeMZ3EObqP/06XCOZYS0nEvPU=";
   };
 
   build-system = [
@@ -54,7 +54,6 @@ buildPythonPackage rec {
   ];
 
   pythonImportsCheck = [
-    "aioazuredevops.builds"
     "aioazuredevops.client"
     "aioazuredevops.core"
   ];
diff --git a/pkgs/development/python-modules/aiobiketrax/default.nix b/pkgs/development/python-modules/aiobiketrax/default.nix
index 88b070a51049..b07dda7f5171 100644
--- a/pkgs/development/python-modules/aiobiketrax/default.nix
+++ b/pkgs/development/python-modules/aiobiketrax/default.nix
@@ -10,7 +10,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/aioboto3/default.nix b/pkgs/development/python-modules/aioboto3/default.nix
index 96a7cc9c4d74..592e8087349f 100644
--- a/pkgs/development/python-modules/aioboto3/default.nix
+++ b/pkgs/development/python-modules/aioboto3/default.nix
@@ -13,7 +13,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "aiobotocore" ];
diff --git a/pkgs/development/python-modules/aiobotocore/default.nix b/pkgs/development/python-modules/aiobotocore/default.nix
index 8ecbb92d75f7..4a7ced69d970 100644
--- a/pkgs/development/python-modules/aiobotocore/default.nix
+++ b/pkgs/development/python-modules/aiobotocore/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "aiobotocore";
-  version = "2.12.3";
+  version = "2.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "aiobotocore";
     rev = "refs/tags/${version}";
-    hash = "sha256-Us94kT7UhTTwMxF63iLLczXZhfr/Z8cJr12DKEphkog=";
+    hash = "sha256-8fsZCmzjM6JlX3HoRGt7zsezYIXnv411kkHG8rJqMuY=";
   };
 
   # Relax version constraints: aiobotocore works with newer botocore versions
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 371776aa1749..fa2ee1ee7e46 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "24.5.0";
+  version = "24.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = "aioesphomeapi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-i/tmPTDb5DJRSj//Ju9OERx8A9S69WkWyoN+j2MO6mI=";
+    hash = "sha256-wvfAkV+EjGytPog3ik7NAC0rW8nkHufenGfapeQr1X0=";
   };
 
   build-system = [
@@ -62,6 +62,10 @@ buildPythonPackage rec {
   disabledTests = [
     # https://github.com/esphome/aioesphomeapi/issues/837
     "test_reconnect_logic_stop_callback"
+    # python3.12.4 regression
+    # https://github.com/esphome/aioesphomeapi/issues/889
+    "test_start_connection_cannot_increase_recv_buffer"
+    "test_start_connection_can_only_increase_buffer_size_to_262144"
   ];
 
   pythonImportsCheck = [ "aioesphomeapi" ];
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index 5d02fe426397..31c5b19a1ab3 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -20,7 +20,6 @@
   pytest-lazy-fixture,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   redis,
 }:
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   build-system = [ hatchling ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "pydantic" ];
 
diff --git a/pkgs/development/python-modules/aiomisc-pytest/default.nix b/pkgs/development/python-modules/aiomisc-pytest/default.nix
index 01230505b2b6..ebbc22e37a22 100644
--- a/pkgs/development/python-modules/aiomisc-pytest/default.nix
+++ b/pkgs/development/python-modules/aiomisc-pytest/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   pytest,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "pytest" ];
 
diff --git a/pkgs/development/python-modules/aioopenexchangerates/default.nix b/pkgs/development/python-modules/aioopenexchangerates/default.nix
index b68120fee83e..7d3f698129ef 100644
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@@ -9,7 +9,6 @@
   pytest-aiohttp,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/aiooss2/default.nix b/pkgs/development/python-modules/aiooss2/default.nix
index 7bdd692ac2d6..7d1e235949e7 100644
--- a/pkgs/development/python-modules/aiooss2/default.nix
+++ b/pkgs/development/python-modules/aiooss2/default.nix
@@ -8,7 +8,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   setuptools-scm,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/aiooui/default.nix b/pkgs/development/python-modules/aiooui/default.nix
index fb85170c54b4..bc087915bf4f 100644
--- a/pkgs/development/python-modules/aiooui/default.nix
+++ b/pkgs/development/python-modules/aiooui/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aiooui";
-  version = "0.1.5";
+  version = "0.1.6";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "aiooui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/RZ8nZatlfo3AJvg/4JgyAHtrnoj50uxbhqr+ToCTJ4=";
+    hash = "sha256-dsMVKfY9o1krzp100/7JtClgPrpsFTVNwMnYMqOVFIU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aiormq/default.nix b/pkgs/development/python-modules/aiormq/default.nix
index 773477e62c72..7dd16b1f4811 100644
--- a/pkgs/development/python-modules/aiormq/default.nix
+++ b/pkgs/development/python-modules/aiormq/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytestCheckHook,
   pamqp,
   yarl,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pamqp" ];
diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index 359a1db2cb74..819eb840fa0d 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "10.0.1";
+  version = "11.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "aioshelly";
     rev = "refs/tags/${version}";
-    hash = "sha256-+p+AFgqS/9rCDkIiNm4o7GhQ4dPfKl2s7ukEYaAdlgo=";
+    hash = "sha256-158b4lsxebtLXXsPhzbkXP9ioPlFIsJcS5G5eDqFY98=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiosmtpd/default.nix b/pkgs/development/python-modules/aiosmtpd/default.nix
index 78ea18709d8b..dfecf0b966af 100644
--- a/pkgs/development/python-modules/aiosmtpd/default.nix
+++ b/pkgs/development/python-modules/aiosmtpd/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiosmtpd";
-  version = "1.4.5";
+  version = "1.4.6";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "aiosmtpd";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8nQ4BVSLYgZHRGkbujy/olV/+GABlkDhe5wef3hyQpQ=";
+    hash = "sha256-Ih/xbWM9O/fFQiZezydlPlIr36fLRc2lLgdfxD5Jviw=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiowebostv/default.nix b/pkgs/development/python-modules/aiowebostv/default.nix
index 2d3c94b0f0f0..a9a4d6bca847 100644
--- a/pkgs/development/python-modules/aiowebostv/default.nix
+++ b/pkgs/development/python-modules/aiowebostv/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aiowebostv";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "aiowebostv";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pjHm+oCwbiD2dtkl30yATIVP85R72xEk/cmA+a5b05c=";
+    hash = "sha256-RrSEl/U6UzPoE2151opDe0QRmj6M6wAtsQyF4/dd8ek=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/aioxmpp/default.nix b/pkgs/development/python-modules/aioxmpp/default.nix
index 9e770ae06522..e753cb6c63dc 100644
--- a/pkgs/development/python-modules/aioxmpp/default.nix
+++ b/pkgs/development/python-modules/aioxmpp/default.nix
@@ -14,7 +14,6 @@
   pytestCheckHook,
   pythonAtLeast,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   setuptools,
   sortedcollections,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiosasl
diff --git a/pkgs/development/python-modules/aiozoneinfo/default.nix b/pkgs/development/python-modules/aiozoneinfo/default.nix
index 632967637818..86f624c9da85 100644
--- a/pkgs/development/python-modules/aiozoneinfo/default.nix
+++ b/pkgs/development/python-modules/aiozoneinfo/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "aiozoneinfo";
-  version = "0.2.0";
+  version = "0.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "bluetooth-devices";
     repo = "aiozoneinfo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VpdghF2rXoA94YfMSNaICa3yfRRRiQueVrLk1K4igdk=";
+    hash = "sha256-u7yQiy5xKK1A19cmpXjA4MMK4q7RvtuvwkUECnddzG8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/airtouch5py/default.nix b/pkgs/development/python-modules/airtouch5py/default.nix
index a848a97158dd..0a8fc8cf90b1 100644
--- a/pkgs/development/python-modules/airtouch5py/default.nix
+++ b/pkgs/development/python-modules/airtouch5py/default.nix
@@ -6,7 +6,6 @@
 
   # build-system
   poetry-core,
-  pythonRelaxDepsHook,
 
   # dependencies
   bitarray,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   };
 
   build-system = [ poetry-core ];
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "crc" ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/albumentations/default.nix b/pkgs/development/python-modules/albumentations/default.nix
index b17e1c055c5f..6651771f5ca5 100644
--- a/pkgs/development/python-modules/albumentations/default.nix
+++ b/pkgs/development/python-modules/albumentations/default.nix
@@ -13,7 +13,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   torch,
   torchvision,
   typing-extensions,
@@ -21,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "albumentations";
-  version = "1.4.4";
+  version = "1.4.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,10 +29,9 @@ buildPythonPackage rec {
     owner = "albumentations-team";
     repo = "albumentations";
     rev = "refs/tags/${version}";
-    hash = "sha256-7t1+22zzFtkZaAyOo6xjk+MXT9N44PmQ/NRRfvLeRVk=";
+    hash = "sha256-tzalxhn61hYI6lN1wXwOd1EhTPx/9Fk8pTn/+zx188Y=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     "opencv-python"
diff --git a/pkgs/development/python-modules/alexapy/default.nix b/pkgs/development/python-modules/alexapy/default.nix
index fcc0bd1c46f6..af10ae03468e 100644
--- a/pkgs/development/python-modules/alexapy/default.nix
+++ b/pkgs/development/python-modules/alexapy/default.nix
@@ -12,7 +12,6 @@
   poetry-core,
   pyotp,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   simplejson,
   yarl,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-core/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-core/default.nix
index 57323e4b189d..b722dac05fc8 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-core/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-core/default.nix
@@ -5,7 +5,6 @@
   fetchPypi,
   jmespath,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     cryptography
diff --git a/pkgs/development/python-modules/altair/default.nix b/pkgs/development/python-modules/altair/default.nix
index 185980320236..f195c3b080ba 100644
--- a/pkgs/development/python-modules/altair/default.nix
+++ b/pkgs/development/python-modules/altair/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "altair";
-  version = "5.2.0";
+  version = "5.3.0";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "altair-viz";
     repo = "altair";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uTG+V0SQgAQtMjvrVvKVKgIBT9qO+26EPRxQCEXj/gc=";
+    hash = "sha256-VGtH+baIKObJY8/44JCyKi+XrIddSqOtpNeMCO+8o9M=";
   };
 
   nativeBuildInputs = [ hatchling ];
@@ -56,6 +56,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "altair" ];
 
+  disabledTests = [
+    # ValueError: Saving charts in 'svg' format requires the vl-convert-python or altair_saver package: see http://github.com/altair-viz/altair_saver/
+    "test_renderer_with_none_embed_options"
+  ];
+
   disabledTestPaths = [
     # Disabled because it requires internet connectivity
     "tests/test_examples.py"
diff --git a/pkgs/development/python-modules/amazon-kclpy/default.nix b/pkgs/development/python-modules/amazon-kclpy/default.nix
index 3186ade26999..1ade5e23e240 100644
--- a/pkgs/development/python-modules/amazon-kclpy/default.nix
+++ b/pkgs/development/python-modules/amazon-kclpy/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "amazon-kclpy";
-  version = "2.1.4";
+  version = "2.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "amazon-kinesis-client-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TWIGu7WuoaPhk8cz+hMXvGLIPQ5kly8aj20ZtvTZzwg=";
+    hash = "sha256-kSboeg/fdg7hbiWyPzAAsYo+0vbQDfRoeJYHlrrFNrA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/ancp-bids/default.nix b/pkgs/development/python-modules/ancp-bids/default.nix
index 8ab4de7ac38c..77978e6cd19c 100644
--- a/pkgs/development/python-modules/ancp-bids/default.nix
+++ b/pkgs/development/python-modules/ancp-bids/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "ancp-bids";
-  version = "0.2.1";
+  version = "0.2.4";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "ANCPLabOldenburg";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Nu9pulVSZysgm/F7jl+VpoqMCiHeysZjQDQ1dT7AnpE=";
+    hash = "sha256-c6X1gCYAezgZQP6xfQPfKW8V35F1cnTdbryEp3sZ4jw=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 368a6c50cd05..41bf3abe2ee0 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -23,7 +23,6 @@
   pycparser,
   pyformlang,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyvex,
   rich,
   rpyc,
@@ -52,7 +51,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "capstone" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/annotated-types/default.nix b/pkgs/development/python-modules/annotated-types/default.nix
index 4cb4b9856ef6..77ab71785200 100644
--- a/pkgs/development/python-modules/annotated-types/default.nix
+++ b/pkgs/development/python-modules/annotated-types/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "annotated-types";
-  version = "0.6.0";
+  version = "0.7.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "annotated-types";
     repo = "annotated-types";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SZ9/rXYcns4DFM6vk6SRKvuv3MY3T7xO9aW7WAQqtVE=";
+    hash = "sha256-I1SPUKq2WIwEX5JmS3HrJvrpNrKDu30RWkBRDFE+k9A=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/ansible-navigator/default.nix b/pkgs/development/python-modules/ansible-navigator/default.nix
index 4f5dca37452f..5d767a4fab43 100644
--- a/pkgs/development/python-modules/ansible-navigator/default.nix
+++ b/pkgs/development/python-modules/ansible-navigator/default.nix
@@ -9,12 +9,12 @@
 }:
 buildPythonPackage rec {
   pname = "ansible-navigator";
-  version = "24.2.0";
+  version = "24.3.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qXBhM63fFwPwo0pmEhZnZnGC8Eht8eFPfVbDkY98MGM=";
+    hash = "sha256-IAcZFisB3BOmdxZuGZ3PZcDl2CXsg6ToI/1fdPpkIXw=";
   };
 
   buildInputs = with python3Packages; [
diff --git a/pkgs/development/python-modules/ansible-pylibssh/default.nix b/pkgs/development/python-modules/ansible-pylibssh/default.nix
index 068af47bca3c..26dbb4413a9e 100644
--- a/pkgs/development/python-modules/ansible-pylibssh/default.nix
+++ b/pkgs/development/python-modules/ansible-pylibssh/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "ansible-pylibssh";
-  version = "1.1.0";
+  version = "1.2.0.post4";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-spaGux6dYvtUtpOdU6oN7SEn8IgBof2NpQSPvr+Zplg=";
+    hash = "sha256-brnSrzSnumK32/mEON0l0iSPdoYrFwYmBc4MT7WcrX8=";
   };
 
   # Remove after https://github.com/ansible/pylibssh/pull/502 is merged
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index 2bc07dd1277f..0c6ed904a454 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -4,14 +4,12 @@
   ansible-core,
   buildPythonPackage,
   fetchPypi,
-  fetchpatch,
   glibcLocales,
   importlib-metadata,
   mock,
   openssh,
-  pbr,
+  packaging,
   pexpect,
-  psutil,
   pytest-mock,
   pytest-timeout,
   pytest-xdist,
@@ -20,50 +18,36 @@
   python-daemon,
   pyyaml,
   setuptools,
-  six,
+  setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "ansible-runner";
-  version = "2.3.6";
+  version = "2.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-shdKEtytLcLzQuqCh2iY9WigtmxTVoYAv4BXcVj8uhw=";
+    hash = "sha256-gtArJUiDDzelNRe2XII8SvNxBpQGx9ITtckEHUXgxbY=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-tests.patch";
-      url = "https://github.com/ansible/ansible-runner/commit/0d522c90cfc1f305e118705a1b3335ccb9c1633d.patch";
-      hash = "sha256-eTnQkftvjK0YHU+ovotRVSuVlvaVeXp5SvYk1DPCg88=";
-      excludes = [
-        ".github/workflows/ci.yml"
-        "tox.ini"
-      ];
-    })
-    (fetchpatch {
-      # python 3.12 compat
-      url = "https://github.com/ansible/ansible-runner/commit/dc248497bb2375a363222ce755bf3a31f21d5f64.patch";
-      hash = "sha256-QT28Iw0uENoO35rqZpYBcmJB/GNDEF4m86SKf6p0XQU=";
-    })
-  ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"setuptools>=45, <=69.0.2", "setuptools-scm[toml]>=6.2, <=8.0.4"' '"setuptools", "setuptools-scm"'
+  '';
 
   build-system = [
     setuptools
-    pbr
+    setuptools-scm
   ];
 
   dependencies = [
-    ansible-core
-    psutil
+    packaging
     pexpect
     python-daemon
     pyyaml
-    six
   ] ++ lib.optionals (pythonOlder "3.10") [ importlib-metadata ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix
index 0a2103efc9c6..8caf7e1e6274 100644
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   installShellFiles,
   docutils,
   ansible,
@@ -51,7 +50,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     installShellFiles
     docutils
-  ] ++ lib.optionals (pythonOlder "3.10") [ pythonRelaxDepsHook ];
+  ];
 
   propagatedBuildInputs =
     [
diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix
index d2b531a0066f..2dd2567589f2 100644
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@@ -22,7 +22,7 @@
 
 let
   pname = "ansible";
-  version = "9.6.0";
+  version = "10.1.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -32,7 +32,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WHMqStdKdG0pns+ki3qRyyF+LAvTpEST8tnymvLzq2E=";
+    hash = "sha256-fYxEVX9XBocwbhnQ4ylq0jBZPLEr2jXc/JJ0pgY68io=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/anthropic/default.nix b/pkgs/development/python-modules/anthropic/default.nix
index f97672495a66..ad79271688f6 100644
--- a/pkgs/development/python-modules/anthropic/default.nix
+++ b/pkgs/development/python-modules/anthropic/default.nix
@@ -9,6 +9,7 @@
   hatch-fancy-pypi-readme,
   hatchling,
   httpx,
+  jiter,
   pydantic,
   pytest-asyncio,
   pytestCheckHook,
@@ -21,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "anthropic";
-  version = "0.26.0";
+  version = "0.28.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,7 +31,7 @@ buildPythonPackage rec {
     owner = "anthropics";
     repo = "anthropic-sdk-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xoYhRRanqZ93UlSoqeeH83JmsoiijDTUDtnY3VDLQAg=";
+    hash = "sha256-n5Vmi2frUdSbrmulopwUlIO+blkf7cANoKTaTFZQdjw=";
   };
 
   build-system = [
@@ -42,6 +43,7 @@ buildPythonPackage rec {
     anyio
     distro
     httpx
+    jiter
     sniffio
     pydantic
     tokenizers
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index e317f6fe5775..3c1492c98223 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -26,6 +26,9 @@
   pytestCheckHook,
   trustme,
   uvloop,
+
+  # smoke tests
+  starlette,
 }:
 
 buildPythonPackage rec {
@@ -96,6 +99,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "anyio" ];
 
+  passthru.tests = {
+    inherit starlette;
+  };
+
   meta = with lib; {
     changelog = "https://github.com/agronholm/anyio/blob/${src.rev}/docs/versionhistory.rst";
     description = "High level compatibility layer for multiple asynchronous event loop implementations on Python";
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index 0854275c395f..f1ad42c81d9c 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -33,7 +33,6 @@
   pytestCheckHook,
   python,
   python-dateutil,
-  pythonRelaxDepsHook,
   pytz,
   pyyaml,
   regex,
@@ -50,14 +49,14 @@
 
 buildPythonPackage rec {
   pname = "apache-beam";
-  version = "2.54.0";
+  version = "2.56.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "beam";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DcqYBPAS+yUqTJLUem8+2OqRUzb6DoBOeRkMjmvuvws=";
+    hash = "sha256-SD+93duc3vTIlS/LPOuzXeiUSpwX+GNrqW3GTJMVgKY=";
   };
 
   patches = [
@@ -96,7 +95,6 @@ buildPythonPackage rec {
     cython
     grpcio-tools
     mypy-protobuf
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index 67ed8ef74b59..bda93dfe5cdf 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   appdirs,
+  apsw,
   buildPythonPackage,
   cvss,
   fetchFromGitHub,
@@ -8,9 +9,10 @@
   msgpack,
   orjson,
   packageurl-python,
+  pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
+  rich,
   semver,
   setuptools,
   tabulate,
@@ -18,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "5.6.7";
+  version = "6.0.8";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -27,7 +29,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/QzK+su+g2ESZ81C0coxKf13WOUVz1GyfJbOrO7fS98=";
+    hash = "sha256-lgt609UDuHTGQTTrpvxNvgUk6GU+TYqwc19dzatI4Io=";
   };
 
   postPatch = ''
@@ -42,15 +44,17 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     appdirs
+    apsw
     cvss
     httpx
     msgpack
     orjson
     packageurl-python
+    pydantic
+    rich
     semver
     tabulate
   ] ++ httpx.optional-dependencies.http2;
diff --git a/pkgs/development/python-modules/argcomplete/default.nix b/pkgs/development/python-modules/argcomplete/default.nix
index 2fd19fc2091a..969acd0b1c45 100644
--- a/pkgs/development/python-modules/argcomplete/default.nix
+++ b/pkgs/development/python-modules/argcomplete/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "argcomplete";
-  version = "3.3.0";
+  version = "3.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "kislyuk";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ekTmT6jYkC36X2e0ukwHfDGwdPg3jK8jML2naBCgNI8=";
+    hash = "sha256-4JMyBixc6LcSdpvvLmK4nyyqZMK2kuFcPU7OXhJLpoc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index 2d2e25a83ed5..cbfeb2c87c7e 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -41,7 +41,6 @@
   python-jose,
   python-multipart,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   rich,
   schedule,
@@ -68,7 +67,7 @@
 
 buildPythonPackage rec {
   pname = "argilla";
-  version = "1.28.0";
+  version = "1.29.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -77,7 +76,7 @@ buildPythonPackage rec {
     owner = "argilla-io";
     repo = "argilla";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gQpJ2umi3IE5BhRu3bM7ONPIP0hb2YG37jGvDKQHZWA=";
+    hash = "sha256-+eQNvLDV063JY6CyngpGyo4NdSd6HvAHFgGWtPfZNVQ=";
   };
 
   pythonRelaxDeps = [
@@ -90,7 +89,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     httpx
diff --git a/pkgs/development/python-modules/arsenic/default.nix b/pkgs/development/python-modules/arsenic/default.nix
index 2d742f943f79..8d7ab341c9d2 100644
--- a/pkgs/development/python-modules/arsenic/default.nix
+++ b/pkgs/development/python-modules/arsenic/default.nix
@@ -7,7 +7,6 @@
   fetchpatch,
   packaging,
   poetry-core,
-  pythonRelaxDepsHook,
   pythonOlder,
   structlog,
 }:
@@ -43,7 +42,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "structlog" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/asana/default.nix b/pkgs/development/python-modules/asana/default.nix
index 5f78649ba449..f63bd17297e1 100644
--- a/pkgs/development/python-modules/asana/default.nix
+++ b/pkgs/development/python-modules/asana/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "asana";
-  version = "5.0.3";
+  version = "5.0.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "asana";
     repo = "python-asana";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9F63DvwMh9NwlTqFuhiXfgRRRxAFjjRYmYzsuOhlQJ0=";
+    hash = "sha256-X6444LU2hcx4Er5N+WbSjgbe2tHjl1y1z5FqZGngiOw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ase/default.nix b/pkgs/development/python-modules/ase/default.nix
index b6b020c07121..f99b201842e6 100644
--- a/pkgs/development/python-modules/ase/default.nix
+++ b/pkgs/development/python-modules/ase/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "ase";
-  version = "3.22.1";
+  version = "3.23.0";
   pyproject = true;
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AE32sOoEsRFMeQ+t/kXUEl6w5TElxmqTQlr4U9gqtDI=";
+    hash = "sha256-kaKqMdib2QsO/f5KfoQmTzKCiyq/yfOOZeBBrXb+yK4=";
   };
 
   build-system = [ setuptools ];
@@ -57,6 +57,8 @@ buildPythonPackage rec {
     "test_favicon"
     "test_vibrations_methods" # missing attribute
     "test_jmol_roundtrip" # missing attribute
+    "test_pw_input_write_nested_flat" # Did not raise DeprecationWarning
+    "test_fix_scaled" # Did not raise UserWarning
   ] ++ lib.optionals (pythonAtLeast "3.12") [ "test_info_calculators" ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/asf-search/default.nix b/pkgs/development/python-modules/asf-search/default.nix
index f4e06bb8af8d..1d54f0895933 100644
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@@ -9,7 +9,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   remotezip,
   requests-mock,
@@ -21,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "asf-search";
-  version = "7.0.9";
+  version = "7.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,14 +29,13 @@ buildPythonPackage rec {
     owner = "asfadmin";
     repo = "Discovery-asf_search";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CD9Up4h23dplTt51zif+4ZdW0qczRUz2hCOwUOOlS24=";
+    hash = "sha256-4TiLncVxDxGB8YSgeEvXGb3kY2tjfYYmBAleJeaiPWU=";
   };
 
   pythonRelaxDeps = [ "tenacity" ];
 
   build-system = [ setuptools-scm ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     dateparser
diff --git a/pkgs/development/python-modules/astroid/default.nix b/pkgs/development/python-modules/astroid/default.nix
index 123af5462164..200dc13e989f 100644
--- a/pkgs/development/python-modules/astroid/default.nix
+++ b/pkgs/development/python-modules/astroid/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "astroid";
-  version = "3.1.0"; # Check whether the version is compatible with pylint
+  version = "3.2.2"; # Check whether the version is compatible with pylint
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = "astroid";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+cTQHbqoucaNi7rPoyH6Cu07vZMS8KWn5C/A3NXRSwE=";
+    hash = "sha256-Fc/AjMOz9D9SgkxXvMAhvJcZtj9BsPykg0DX4hEqdB8=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/astropy-iers-data/default.nix b/pkgs/development/python-modules/astropy-iers-data/default.nix
index c878ce72f660..9d7a88369aaf 100644
--- a/pkgs/development/python-modules/astropy-iers-data/default.nix
+++ b/pkgs/development/python-modules/astropy-iers-data/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "astropy-iers-data";
-  version = "0.2024.04.01.00.33.14";
+  version = "0.2024.06.17.00.31.35";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "astropy";
     repo = "astropy-iers-data";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6FHAntN+m0cLDEhWPrcgyD0PgVDOfC8nf4kVl1z8x0g=";
+    hash = "sha256-hFlDXnxhKuhlCFrF+Uip3Xjc9Jt8UFJcDCST90BmAlg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index 5aca4395568e..c88029cb09a8 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchPypi,
+  fetchpatch,
   buildPythonPackage,
   pythonOlder,
 
@@ -27,16 +28,29 @@
 
 buildPythonPackage rec {
   pname = "astropy";
-  version = "6.0.1";
+  version = "6.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8"; # according to setup.cfg
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ial13jVtBgjnTx9JNEL7Osu7eoW3OeB0RguwNAAUs5w=";
+    hash = "sha256-5cb0XZEcMKy41VbH+O2ZSuxxsQjmHu5QZ/AK8eTjYTg=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "drop-usage-known-bad-actor-cdn.patch";
+      url = "https://github.com/astropy/astropy/commit/d329cb38e49584ad0ff5244fd2fff74cfa1f92f1.patch";
+      hash = "sha256-+DbDwYeyR+mMDLRB4jiyol/5WO0LwqSCCEwjgflxoTk=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy>=2.0.0"  "numpy"
+  '';
+
   nativeBuildInputs = [
     astropy-extension-helpers
     cython
@@ -83,6 +97,8 @@ buildPythonPackage rec {
     "test_sidereal_lon_independent"
     "test_timedelta_full_precision_arithmetic"
     "test_datetime_to_timedelta"
+
+    "test_datetime_difference_agrees_with_timedelta_no_hypothesis"
   ] ++ lib.optionals stdenv.isDarwin [ "test_sidereal_lat_independent" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/async-interrupt/default.nix b/pkgs/development/python-modules/async-interrupt/default.nix
index d9fa7c8a59e5..f166eff8db1a 100644
--- a/pkgs/development/python-modules/async-interrupt/default.nix
+++ b/pkgs/development/python-modules/async-interrupt/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "async-interrupt";
-  version = "1.1.1";
+  version = "1.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = "async_interrupt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mbvOj1ybCkDNr3je3PtFwmddkh2k/nHOerpC6hGSUYI=";
+    hash = "sha256-CFCWlIx4iAG6gW2ORRYfZpFWRvjukqdcR2yg6NjVqps=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/async-tkinter-loop/default.nix b/pkgs/development/python-modules/async-tkinter-loop/default.nix
index 0119dbd96be6..a620c95843cc 100644
--- a/pkgs/development/python-modules/async-tkinter-loop/default.nix
+++ b/pkgs/development/python-modules/async-tkinter-loop/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   tkinter,
   typing-extensions,
-  pythonRelaxDepsHook,
   pytestCheckHook,
 }:
 
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     poetry-core
   ];
 
diff --git a/pkgs/development/python-modules/async-upnp-client/default.nix b/pkgs/development/python-modules/async-upnp-client/default.nix
index 86ed8e48b504..7c87735f7472 100644
--- a/pkgs/development/python-modules/async-upnp-client/default.nix
+++ b/pkgs/development/python-modules/async-upnp-client/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "async-upnp-client";
-  version = "0.38.3";
+  version = "0.39.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,9 +32,11 @@ buildPythonPackage rec {
     owner = "StevenLooman";
     repo = "async_upnp_client";
     rev = "refs/tags/${version}";
-    hash = "sha256-RmpQOVZ/s3Zv2e+iS7LTI5Wh/g0yy0Xv0M8ppsbYZPg=";
+    hash = "sha256-2A46/j6DkZ7rz/B64aBAp0NvRG5TBuL4VwMVS50+fQs=";
   };
 
+  pythonRelaxDeps = [ "defusedxml" ];
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/asyncclick/default.nix b/pkgs/development/python-modules/asyncclick/default.nix
index f36b5a773d19..9e5b82197efb 100644
--- a/pkgs/development/python-modules/asyncclick/default.nix
+++ b/pkgs/development/python-modules/asyncclick/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "asyncclick";
-  version = "8.1.7.1";
+  version = "8.1.7.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "python-trio";
     repo = "asyncclick";
     rev = "refs/tags/${version}";
-    hash = "sha256-gx7s/HikvjsXalc0Z73JWMKc1SlhR+kohwk2sW4o19I=";
+    hash = "sha256-ahzI7yILq1OpZ6IT0qt8vjzi6I6zAoTrULOl8CqRw4A=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index 78775f666f50..6a481aed589d 100644
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "3.41.13";
+  version = "3.41.14";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "atlassian-api";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ldSiO9exbF89KDaspj3kIzAZzOfr/6ohlOyQ5mBxo/U=";
+    hash = "sha256-cXVHGEOvEuSH19mub9u6kjK3epetN3IeXlHxwiBzTPY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/atomman/default.nix b/pkgs/development/python-modules/atomman/default.nix
index 8a04f3e8f9ab..6728f39269ec 100644
--- a/pkgs/development/python-modules/atomman/default.nix
+++ b/pkgs/development/python-modules/atomman/default.nix
@@ -20,7 +20,6 @@
   toolz,
   wheel,
   xmltodict,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage {
@@ -37,7 +36,6 @@ buildPythonPackage {
     hash = "sha256-WfB+OY61IPprT6OCVHl8VA60p7lLVkRGuyYX+nm7bbA=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/audio-metadata/default.nix b/pkgs/development/python-modules/audio-metadata/default.nix
index e9be3715ec31..40b47f61016a 100644
--- a/pkgs/development/python-modules/audio-metadata/default.nix
+++ b/pkgs/development/python-modules/audio-metadata/default.nix
@@ -10,7 +10,6 @@
   poetry-core,
   pprintpp,
   pythonOlder,
-  pythonRelaxDepsHook,
   tbm-utils,
 }:
 
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     attrs
diff --git a/pkgs/development/python-modules/autarco/default.nix b/pkgs/development/python-modules/autarco/default.nix
index b843f023dc60..72ad0c41fc76 100644
--- a/pkgs/development/python-modules/autarco/default.nix
+++ b/pkgs/development/python-modules/autarco/default.nix
@@ -10,7 +10,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   syrupy,
   yarl,
 }:
@@ -40,7 +39,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index ae2692cd697f..69d4fdedfd2a 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -13,7 +13,6 @@
   pyopenssl,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   urllib3,
 }:
@@ -35,7 +34,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/autofaiss/default.nix b/pkgs/development/python-modules/autofaiss/default.nix
index e5d117e6cc29..02dd9c071d7f 100644
--- a/pkgs/development/python-modules/autofaiss/default.nix
+++ b/pkgs/development/python-modules/autofaiss/default.nix
@@ -9,7 +9,6 @@
   numpy,
   pyarrow,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
 }:
 
@@ -27,7 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-pey3wrW7CDLMiPPKnmYrcSJqGuy6ecA2SE9m3Jtt6DU=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     # The `dataclasses` packages is a python2-only backport, unnecessary in
diff --git a/pkgs/development/python-modules/avro/default.nix b/pkgs/development/python-modules/avro/default.nix
index 41c0e90ae939..ec07daa2880c 100644
--- a/pkgs/development/python-modules/avro/default.nix
+++ b/pkgs/development/python-modules/avro/default.nix
@@ -5,7 +5,7 @@
   setuptools,
   fetchPypi,
   typing-extensions,
-  pytestCheckHook,
+  pytest7CheckHook,
 }:
 
 buildPythonPackage rec {
@@ -30,7 +30,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytest7CheckHook ];
 
   disabledTests = [
     # Requires network access
diff --git a/pkgs/development/python-modules/aw-core/default.nix b/pkgs/development/python-modules/aw-core/default.nix
index e7410409c4be..84b13c6f100d 100644
--- a/pkgs/development/python-modules/aw-core/default.nix
+++ b/pkgs/development/python-modules/aw-core/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   poetry-core,
   jsonschema,
   peewee,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aws-adfs/default.nix b/pkgs/development/python-modules/aws-adfs/default.nix
index cd81d99efac8..c2c0b859b033 100644
--- a/pkgs/development/python-modules/aws-adfs/default.nix
+++ b/pkgs/development/python-modules/aws-adfs/default.nix
@@ -12,7 +12,6 @@
   pyopenssl,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   requests-kerberos,
   toml,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 005c65b91c10..e672317cc75f 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.86.0";
+  version = "1.89.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "serverless-application-model";
     rev = "refs/tags/v${version}";
-    hash = "sha256-elirU6u6smuYIj8oO6s2ybQB8Tu0pJPkBdjd0W0CfFE=";
+    hash = "sha256-wqM3n99lD0s/E9nd55q19Us31XgFtU/bBYJR1HTnnvk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aws-xray-sdk/default.nix b/pkgs/development/python-modules/aws-xray-sdk/default.nix
index 9ad75c36d59f..418a938dc75e 100644
--- a/pkgs/development/python-modules/aws-xray-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-xray-sdk/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "aws-xray-sdk";
-  version = "2.13.0";
+  version = "2.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "aws-xray-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-KhYYzeOteQxS1ltEUbjsDriHXO0Kom9YiCvVhSNvXVQ=";
+    hash = "sha256-rWP0yQ+Ril0UByOCWJKcL3mD7TvzK8Ddq9JlFIRBFU4=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index 74d7a17a8f6c..209627d858bf 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.20.11";
+  version = "0.20.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w9v7fxkJRXlS5kU3PnK2n5DFDEZe5qRtm73BKst5gDw=";
+    hash = "sha256-Z271rdHsBh8/+nIrMm3wGhxEJJNIl2hYuBQdkHSlRok=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/awslambdaric/default.nix b/pkgs/development/python-modules/awslambdaric/default.nix
index 7defc559cce0..a831b5300eb9 100644
--- a/pkgs/development/python-modules/awslambdaric/default.nix
+++ b/pkgs/development/python-modules/awslambdaric/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "awslambdaric";
-  version = "2.0.10";
+  version = "2.0.11";
   pyproject = true;
 
   disabled = isPy27;
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "aws-lambda-python-runtime-interface-client";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-tvTN6gV73Qnbe4OBHtfxt4jXV32fMTPE4H79WIkgkxE=";
+    sha256 = "sha256-9DiUpgeL4bY7G3b5R06FjpN0st03F84fj0bhp70moKo=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/awswrangler/default.nix b/pkgs/development/python-modules/awswrangler/default.nix
index a9ac6a814c60..12f4549bbe43 100644
--- a/pkgs/development/python-modules/awswrangler/default.nix
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@@ -20,14 +20,13 @@
   pyparsing,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   redshift-connector,
   requests-aws4auth,
 }:
 
 buildPythonPackage rec {
   pname = "awswrangler";
-  version = "3.7.3";
+  version = "3.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -36,14 +35,13 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "aws-sdk-pandas";
     rev = "refs/tags/${version}";
-    hash = "sha256-gm6ieteW+NcY+AOLcMZLUPcSi2Z/Mo27rzd1i9imp5I=";
+    hash = "sha256-2eF8WDhWfYgR3Ce/ehzCBtUdGUFzNmrTNfnatDpCg7Q=";
   };
 
   pythonRelaxDeps = [ "packaging" ];
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     boto3
diff --git a/pkgs/development/python-modules/axis/default.nix b/pkgs/development/python-modules/axis/default.nix
index 79692ba7d656..e0a316317ef3 100644
--- a/pkgs/development/python-modules/axis/default.nix
+++ b/pkgs/development/python-modules/axis/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "axis";
-  version = "61";
+  version = "62";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = "axis";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YiEY+Eu1j42bBzM4f5Ku5mAE2/tY9f+Hyb2DS6LIW7c=";
+    hash = "sha256-ey0yt+AIbMO74brHepnCFtekDS4XscTKswshlTrS41A=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/axisregistry/default.nix b/pkgs/development/python-modules/axisregistry/default.nix
index 9b509c2adca2..453f1c27f8bd 100644
--- a/pkgs/development/python-modules/axisregistry/default.nix
+++ b/pkgs/development/python-modules/axisregistry/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   fonttools,
   protobuf,
-  pythonRelaxDepsHook,
   pytestCheckHook,
   setuptools-scm,
 }:
@@ -24,7 +23,6 @@ buildPythonPackage rec {
     protobuf
   ];
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/azure-core/default.nix b/pkgs/development/python-modules/azure-core/default.nix
index 3718ee9ae723..d5bc90eaf57b 100644
--- a/pkgs/development/python-modules/azure-core/default.nix
+++ b/pkgs/development/python-modules/azure-core/default.nix
@@ -20,7 +20,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.30.1";
+  version = "1.30.2";
   pname = "azure-core";
   pyproject = true;
 
@@ -30,7 +30,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Jic6JUEx+EJp6OpEZPNWDHMfKcDB9prJkBCEXyOcGo8=";
+    hash = "sha256-oU3CEO/NYIghqkctn7jo0DXSm2iZOBkUe8KQqKwiRHI=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-eventhub/default.nix b/pkgs/development/python-modules/azure-eventhub/default.nix
index 1925ea45912b..6fc221c965f5 100644
--- a/pkgs/development/python-modules/azure-eventhub/default.nix
+++ b/pkgs/development/python-modules/azure-eventhub/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-eventhub";
-  version = "5.12.0";
+  version = "5.12.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EqF/V51puTDZBuqVeuzEVoJ0/xrQn8qhiLt7/pvpsXY=";
+    hash = "sha256-DaMLBRLFLqInuKR2sYH/wH0gIiMRF2xxBHuv1HW4G44=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-identity/default.nix b/pkgs/development/python-modules/azure-identity/default.nix
index c7470e5f36c8..6f89cacb08bd 100644
--- a/pkgs/development/python-modules/azure-identity/default.nix
+++ b/pkgs/development/python-modules/azure-identity/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "azure-identity";
-  version = "1.16.0";
+  version = "1.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b/HWZ83Ngdoc6rQvgKC+Y8qEZin1GKki9zF6fjyEThs=";
+    hash = "sha256-oRaPIjstf6OWg2K3iv/RV6Hzdy8xCozc6IPMUVxsiZg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-cdn/default.nix b/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
index adb2d6033421..c98f7f9f36aa 100644
--- a/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
@@ -10,15 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cdn";
-  version = "13.1.0";
+  version = "13.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    pname = "azure_mgmt_cdn";
-    inherit version;
-    hash = "sha256-Igpr2snnXkwAyEGlnY3j7JAQ4LnhQS3snmwka2GeO/I=";
+    inherit pname version;
+    hash = "sha256-RmMwTzG2Zy3sMgx857qXFcK5nn2LaEs3XwtO/9qQIQw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix b/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
index f46d6f967b22..01ef04a5d231 100644
--- a/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cosmosdb";
-  version = "9.4.0";
+  version = "9.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yruCHNRGsJ5z0kwxwoemD8w2I0iPH/qTNcaSJn55w0E=";
+    hash = "sha256-XSGhl94Is2OOCa2I4y2iEfe7WYt9fP7kjWHVfWmz7dk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
index 2d8e7b884d18..3c511be3ca53 100644
--- a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-datafactory";
-  version = "7.0.0";
+  version = "8.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-99uvyPwzRnUxp4ePA5Xa19QVTRvkAjvHDVIGgbcBP7o=";
+    hash = "sha256-CL1Z50yjbEkncmKT4FhJ7UaOiUtw1CD85TVEJ7KHjQ4=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-mgmt-web/default.nix b/pkgs/development/python-modules/azure-mgmt-web/default.nix
index a4b2769543d3..adbae42173ca 100644
--- a/pkgs/development/python-modules/azure-mgmt-web/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-web/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-web";
-  version = "7.2.0";
+  version = "7.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-78/m9/Ug7Qq8/oZRfhyM8CpxL3N6PbDbfLRsbWR5ge0=";
+    hash = "sha256-IDK/TVDfC7uCLqAMrDv74OZ0h9LJzBGCwIWPgxSc3qk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-storage-blob/default.nix b/pkgs/development/python-modules/azure-storage-blob/default.nix
index 19a7bb6af82e..fa2876123e97 100644
--- a/pkgs/development/python-modules/azure-storage-blob/default.nix
+++ b/pkgs/development/python-modules/azure-storage-blob/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "azure-storage-blob";
-  version = "12.19.1";
+  version = "12.20.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-E+FrpC/FSsLH6Pl2BiFzpcgrnsBZRyjhNKrDcpZaEbA=";
+    hash = "sha256-7rkSVuQdS1ubrWqH/QqK3gfdWKpSNE4sjSdG4noBfTs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index aa53bbe3ddc0..5c67b77e78f9 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -6,6 +6,7 @@
   glibcLocales,
   importlib-metadata,
   logfury,
+  annotated-types,
   packaging,
   pdm-backend,
   pyfakefs,
@@ -13,7 +14,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   tqdm,
   typing-extensions,
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "b2sdk";
-  version = "2.3.0";
+  version = "2.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,17 +30,17 @@ buildPythonPackage rec {
     owner = "Backblaze";
     repo = "b2-sdk-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Duva6rFYtMAfMYb2Ze8k3jIX8Ld8u4zdl7WXDbS0o64=";
+    hash = "sha256-SaoQzP7vtzVWmkUTw0vCeneeSMTmBTIr5kiMXGcgm9g=";
   };
 
   build-system = [ pdm-backend ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [ "setuptools" ];
 
   dependencies =
     [
+      annotated-types
       packaging
       logfury
       requests
diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index 3bd0b83f2db0..de68774a358b 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   isPyPy,
-  pythonAtLeast,
   pythonOlder,
 
   # build-system
@@ -18,23 +17,17 @@
 
 buildPythonPackage rec {
   pname = "babel";
-  version = "2.14.0";
+  version = "2.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    pname = "Babel";
-    inherit version;
-    hash = "sha256-aRmGfbA2OYuiHrXHoPayirjLw656c6ROvjSudKTn02M=";
+    inherit pname version;
+    hash = "sha256-ja8OJl0FdovGx6MUzxMh6aEjr8MozGNcGGIqLzCgRBM=";
   };
 
-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [ pytz ];
-
-  # including backports.zoneinfo for python<3.9 yields infinite recursion
-  doCheck = pythonAtLeast "3.9";
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [
     freezegun
@@ -49,12 +42,14 @@ buildPythonPackage rec {
     "test_format_time"
   ];
 
-  meta = with lib; {
+  pythonImportsCheck = [ "babel" ];
+
+  meta = {
+    description = "Collection of internationalizing tools";
     homepage = "https://babel.pocoo.org/";
     changelog = "https://github.com/python-babel/babel/releases/tag/v${version}";
-    description = "Collection of internationalizing tools";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ getchoo ];
     mainProgram = "pybabel";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/babelfish/default.nix b/pkgs/development/python-modules/babelfish/default.nix
index 5f59c2b11053..64cd4318226a 100644
--- a/pkgs/development/python-modules/babelfish/default.nix
+++ b/pkgs/development/python-modules/babelfish/default.nix
@@ -2,20 +2,24 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  setuptools,
+  pythonOlder,
+  poetry-core,
+  importlib-metadata,
 }:
 
 buildPythonPackage rec {
   pname = "babelfish";
-  version = "0.6.0";
-  format = "setuptools";
+  version = "0.6.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2dadfadd1b205ca5fa5dc9fa637f5b7933160a0418684c7c46a7a664033208a2";
+    hash = "sha256-3stnpGYIiNSEgKtpmDCYNxdBWNDxqmO+uxwuEaq5eqs=";
   };
 
-  propagatedBuildInputs = [ setuptools ];
+  build-system = [ poetry-core ];
+
+  dependencies = lib.optionals (pythonOlder "3.10") [ importlib-metadata ];
 
   # no tests executed
   doCheck = false;
@@ -23,7 +27,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "babelfish" ];
 
   meta = with lib; {
-    homepage = "https://pypi.python.org/pypi/babelfish";
+    homepage = "https://github.com/Diaoul/babelfish";
     description = "Module to work with countries and languages";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/babelfont/default.nix b/pkgs/development/python-modules/babelfont/default.nix
index ffdc8953c36a..afc75992a9a5 100644
--- a/pkgs/development/python-modules/babelfont/default.nix
+++ b/pkgs/development/python-modules/babelfont/default.nix
@@ -9,26 +9,31 @@
   glyphslib,
   openstep-plist,
   orjson,
-  poetry-core,
   pytestCheckHook,
+  setuptools,
+  setuptools-scm,
   ufolib2,
 }:
 
 buildPythonPackage rec {
   pname = "babelfont";
-  version = "3.0.1";
+  version = "3.0.5";
+  pyproject = true;
 
   # PyPI source tarballs omit tests, fetch from Github instead
   src = fetchFromGitHub {
     owner = "simoncozens";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-1DHcJDVaCgIAODyf5UUrXej8x3ySD4+6/KtxuF2yFV4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9PEOkkm7qH4ExiJJKrTZX5Ph/urtOyFsy7jjtFepncU=";
   };
 
-  pyproject = true;
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cu2qu
     fontfeatures
     fonttools
@@ -37,9 +42,7 @@ buildPythonPackage rec {
     orjson
     ufolib2
   ];
-  nativeBuildInputs = [ poetry-core ];
 
-  doCheck = true;
   nativeCheckInputs = [
     defcon
     pytestCheckHook
diff --git a/pkgs/development/python-modules/backports-tarfile/default.nix b/pkgs/development/python-modules/backports-tarfile/default.nix
new file mode 100644
index 000000000000..1b1c7790a91a
--- /dev/null
+++ b/pkgs/development/python-modules/backports-tarfile/default.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  jaraco-test,
+  pytestCheckHook,
+}:
+
+let self = buildPythonPackage rec {
+  pname = "backports-tarfile";
+  version = "1.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jaraco";
+    repo = "backports.tarfile";
+    rev = "v${version}";
+    hash = "sha256-X3rkL35aDG+DnIOq0fI7CFoWGNtgLkLjtT9y6+23oto=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  doCheck = false;
+
+  nativeCheckInputs = [
+    jaraco-test
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # calls python -m backports.tarfile and doesn't find module documentation
+    "test_bad_use"
+    "test_create_command"
+    "test_create_command_compressed"
+    "test_create_command_dot_started_filename"
+    "test_create_command_dotless_filename"
+    "test_extract_command"
+    "test_extract_command_different_directory"
+    "test_extract_command_invalid_file"
+    "test_list_command_invalid_file"
+    "test_test_command"
+    "test_test_command_invalid_file"
+    # chmod: permission denied
+    "test_modes"
+  ];
+
+  pythonImportsCheck = [ "backports.tarfile" ];
+
+  passthru.tests.pytest = self.overridePythonAttrs { doCheck = true; };
+
+  meta = with lib; {
+    description = "Backport of CPython tarfile module";
+    homepage = "https://github.com/jaraco/backports.tarfile";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+};
+in self
diff --git a/pkgs/development/python-modules/barectf/default.nix b/pkgs/development/python-modules/barectf/default.nix
index e56367d85fa1..532228c31e4f 100644
--- a/pkgs/development/python-modules/barectf/default.nix
+++ b/pkgs/development/python-modules/barectf/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   poetry-core,
   pytest7CheckHook,
-  pythonRelaxDepsHook,
   setuptools,
   jsonschema,
   pyyaml,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/basemap/default.nix b/pkgs/development/python-modules/basemap/default.nix
index ecc9b0bae69e..74759f2a0d98 100644
--- a/pkgs/development/python-modules/basemap/default.nix
+++ b/pkgs/development/python-modules/basemap/default.nix
@@ -12,7 +12,6 @@
   pyproj,
   pyshp,
   python,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     cython
     geos
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/bcrypt/default.nix b/pkgs/development/python-modules/bcrypt/default.nix
index e4dcaceabbdf..396a9668b777 100644
--- a/pkgs/development/python-modules/bcrypt/default.nix
+++ b/pkgs/development/python-modules/bcrypt/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "bcrypt";
-  version = "4.1.2";
+  version = "4.1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MzE6EgCjrpC3VYfOrFArBIuED8aef3oJBbX4f6x6Elg=";
+    hash = "sha256-LuFd10n1lS/j8EMND/a3QILhWcUDMqFBPVG1aJzwZiM=";
   };
 
   cargoRoot = "src/_bcrypt";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-fTD1AKvyeni5ukYjK53gueKLey+rcIUjW/0R289xeb0=";
+    hash = "sha256-Uag1pUuis5lpnus2p5UrMLa4HP7VQLhKxR5TEMfpK0s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/beaker/default.nix b/pkgs/development/python-modules/beaker/default.nix
index 64c3c65c743e..a369c25e8970 100644
--- a/pkgs/development/python-modules/beaker/default.nix
+++ b/pkgs/development/python-modules/beaker/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "beaker";
-  version = "1.11.0";
+  version = "1.13.0";
 
   # The pypy release do not contains the tests
   src = fetchFromGitHub {
     owner = "bbangert";
     repo = "beaker";
-    rev = version;
-    sha256 = "059sc7iar90lc2y9mppdis5ddfcxyirz03gmsfb0307f5dsa1dhj";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-HzjhOPXElwKoJLrhGIbVn798tbX/kaS1EpQIX+vXCtE=";
   };
 
   propagatedBuildInputs =
diff --git a/pkgs/development/python-modules/beancount/default.nix b/pkgs/development/python-modules/beancount/default.nix
index ebe39136080e..b0e9c97c5d1a 100644
--- a/pkgs/development/python-modules/beancount/default.nix
+++ b/pkgs/development/python-modules/beancount/default.nix
@@ -18,7 +18,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.3.6";
+  version = "3.0.0";
   format = "setuptools";
   pname = "beancount";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gB+Tvta1fS4iQ2aIxInVob8fduIQ887RhoB1fmDTR1o=";
+    hash = "sha256-z2aGhpx+o+78CU7hPthmv196K7DGHk1PXfPjX4Rs/98=";
   };
 
   # Tests require files not included in the PyPI archive.
diff --git a/pkgs/development/python-modules/beautysh/default.nix b/pkgs/development/python-modules/beautysh/default.nix
index 79cda3b5eec6..8c8af617f833 100644
--- a/pkgs/development/python-modules/beautysh/default.nix
+++ b/pkgs/development/python-modules/beautysh/default.nix
@@ -5,7 +5,7 @@
   fetchFromGitHub,
   fetchpatch,
   poetry-core,
-  pytestCheckHook,
+  pytest7CheckHook,
   setuptools,
   types-colorama,
   types-setuptools,
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     types-setuptools
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytest7CheckHook ];
 
   pythonImportsCheck = [ "beautysh" ];
 
diff --git a/pkgs/development/python-modules/bids-validator/default.nix b/pkgs/development/python-modules/bids-validator/default.nix
index 6e95bec307ee..8a3ebaf0b665 100644
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@@ -11,14 +11,15 @@
 
 buildPythonPackage rec {
   pname = "bids-validator";
-  version = "1.14.5";
+  version = "1.14.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-TXIb1ff7D6aM+8L5F47O5Dvupp1Sn4Rnl+GQaUdEgno=";
+    pname = "bids_validator";
+    inherit version;
+    hash = "sha256-3ytrXRqq1h00zK0ElPLtc84wgoJa2jGVTE4UwlONSFw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/biliass/default.nix b/pkgs/development/python-modules/biliass/default.nix
index 8836f20fbb41..75e799ce44b9 100644
--- a/pkgs/development/python-modules/biliass/default.nix
+++ b/pkgs/development/python-modules/biliass/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "biliass";
-  version = "1.3.7";
+  version = "1.3.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "yutto-dev";
     repo = "biliass";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Opb4rlGe+LDJZs3F7e/NZYfuMtHEWUZeMm8VZQfEzKI=";
+    hash = "sha256-hBorYAqtxTZ4LElxxJOGxC2g7sBRhRKVv6HOVHZn9FA=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/biopandas/default.nix b/pkgs/development/python-modules/biopandas/default.nix
index b947164f1d88..29e609b9b43c 100644
--- a/pkgs/development/python-modules/biopandas/default.nix
+++ b/pkgs/development/python-modules/biopandas/default.nix
@@ -9,7 +9,6 @@
   pandas,
   pynose,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -24,7 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-1c78baBBsDyvAWrNx5mZI/Q75wyXv0DAwAdWm3EwX/I=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "looseversion" ];
 
diff --git a/pkgs/development/python-modules/bip32/default.nix b/pkgs/development/python-modules/bip32/default.nix
index a042acd83299..ea8e22a52cc6 100644
--- a/pkgs/development/python-modules/bip32/default.nix
+++ b/pkgs/development/python-modules/bip32/default.nix
@@ -24,11 +24,7 @@ buildPythonPackage rec {
     hash = "sha256-o8UKR17XDWp1wTWYeDL0DJY+D11YI4mg0UuGEAPkHxE=";
   };
 
-  # https://github.com/darosior/python-bip32/pull/40/files
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace-fail 'coincurve>=15.0,<19' 'coincurve>=15.0,<20'
-  '';
+  pythonRelaxDeps = [ "coincurve" ];
 
   nativeBuildInputs = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/bitlist/default.nix b/pkgs/development/python-modules/bitlist/default.nix
index 6054bee43bea..76d2b45b2605 100644
--- a/pkgs/development/python-modules/bitlist/default.nix
+++ b/pkgs/development/python-modules/bitlist/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "bitlist";
   version = "1.2.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -23,15 +23,17 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace '--cov=bitlist --cov-report term-missing' ""
+      --replace-fail '--cov=bitlist --cov-report term-missing' ""
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     wheel
   ];
 
-  propagatedBuildInputs = [ parts ];
+  pythonRelaxDeps = [ "parts" ];
+
+  dependencies = [ parts ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/bitsandbytes/default.nix b/pkgs/development/python-modules/bitsandbytes/default.nix
index a80643c4d1bd..9bfc4a89784f 100644
--- a/pkgs/development/python-modules/bitsandbytes/default.nix
+++ b/pkgs/development/python-modules/bitsandbytes/default.nix
@@ -13,7 +13,7 @@
 
 let
   pname = "bitsandbytes";
-  version = "0.42.0";
+  version = "0.43.1";
 
   inherit (torch) cudaCapabilities cudaPackages cudaSupport;
   inherit (cudaPackages) backendStdenv cudaVersion;
@@ -54,7 +54,7 @@ buildPythonPackage {
     owner = "TimDettmers";
     repo = "bitsandbytes";
     rev = "refs/tags/${version}";
-    hash = "sha256-PZxsFJ6WpfeQqRQrRRBZfZfNY6/TfJFLBeknX24OXcU=";
+    hash = "sha256-GFbFKPdV96DXPA+PZO4h0zdBclN670fb0PGv4QPHWHU=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/bitstring/default.nix b/pkgs/development/python-modules/bitstring/default.nix
index d21e985bfa09..af85d4b32034 100644
--- a/pkgs/development/python-modules/bitstring/default.nix
+++ b/pkgs/development/python-modules/bitstring/default.nix
@@ -5,12 +5,13 @@
   pythonOlder,
   bitarray,
   setuptools,
-  unittestCheckHook,
+  pytest-benchmark,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "bitstring";
-  version = "4.1.4";
+  version = "4.2.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,14 +20,27 @@ buildPythonPackage rec {
     owner = "scott-griffiths";
     repo = pname;
     rev = "refs/tags/bitstring-${version}";
-    hash = "sha256-CO7R2SCb232OW1DCLo45UIarFG5FhR4WkwuQieXha0Y=";
+    hash = "sha256-m2LZdUWOMxzr/biZhD1nWagab8PohHTcr+U1di0nkrU=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ bitarray ];
+  dependencies = [ bitarray ];
 
-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    pytest-benchmark
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "--benchmark-disable"
+  ];
+
+  disabledTestPaths = [
+    "tests/test_bits.py"
+    "tests/test_fp8.py"
+    "tests/test_mxfp.py"
+  ];
 
   pythonImportsCheck = [ "bitstring" ];
 
diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index d9d1980ed2d0..06b53f599e30 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "black";
-  version = "24.4.0";
+  version = "24.4.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8Htp/aIFeDZ+rrvWcP+PxlOrGB4f+V2ESX+fog59BkE=";
+    hash = "sha256-yHK1MFfwAAhdpmoZxV1o9vjdysJkI5KtOjVYeEBvvU0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index 3d24c627fbb2..aef8d84b43f1 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "bleak";
-  version = "0.22.1";
+  version = "0.22.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "hbldh";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kBKNBVbEq1xHLu/gKUL2SwlA2WKjzqFVC5o4N+qnqLM=";
+    hash = "sha256-O8EvF+saJ0UBZ8MESM5gIRmk2wbA4HUDADiVUtXzXrY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/blinker/default.nix b/pkgs/development/python-modules/blinker/default.nix
index 3c3556cc32f6..72cb3205e155 100644
--- a/pkgs/development/python-modules/blinker/default.nix
+++ b/pkgs/development/python-modules/blinker/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "blinker";
-  version = "1.7.0";
+  version = "1.8.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5oIP9vpOTR2OJ0fCKDdJw/VH5P7hErmFVc3NrjKZYYI=";
+    hash = "sha256-j3ewnTv3x5XpaelIbznCxenDnU7gdCS+K8WU7OlkLYM=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/blinkpy/default.nix b/pkgs/development/python-modules/blinkpy/default.nix
index b2b7dc6dc9bb..014b7d15b9e3 100644
--- a/pkgs/development/python-modules/blinkpy/default.nix
+++ b/pkgs/development/python-modules/blinkpy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "blinkpy";
-  version = "0.22.7";
+  version = "0.23.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "fronzbot";
     repo = "blinkpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FfjvF6PBM+18JgQBP6vyElQYWMVizAEGk92ILwxpFSk=";
+    hash = "sha256-MWXOxE0nxBFhkAWjy7qFPhv4AO6VjGf+fAiyaWXeiX8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bluetooth-adapters/default.nix b/pkgs/development/python-modules/bluetooth-adapters/default.nix
index 518b38000ca0..10e5633927e8 100644
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-adapters";
-  version = "0.19.2";
+  version = "0.19.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "bluetooth-adapters";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hPs6YnmndJ2Z5RotcIRIYWPdvMyX56ul84l1Cs8kqH0=";
+    hash = "sha256-yRGlp3hykxdWnJde/VF6CwQgP6cupj1BCW7OmFNQAbM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 4a68e748c9ce..9b10c329ce15 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.19.0";
+  version = "1.19.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-G345Nz0iVUQWOCEnf5UqUa49kAXCmNY22y4v+J2/G2Q=";
+    hash = "sha256-ofcGdHHd1P+R9ykJGtwHURTzHCeiJ603EqtgUgLPnmM=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/bme680/default.nix b/pkgs/development/python-modules/bme680/default.nix
index bed4b74b0344..3d1a3c0cd233 100644
--- a/pkgs/development/python-modules/bme680/default.nix
+++ b/pkgs/development/python-modules/bme680/default.nix
@@ -2,39 +2,43 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  hatchling,
+  hatch-fancy-pypi-readme,
+
+  # dependencies
+  smbus2,
+
+  # checks
   mock,
-  smbus-cffi,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "bme680";
-  version = "1.1.1";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pimoroni";
     repo = "bme680-python";
-    rev = "v${version}";
-    hash = "sha256-gmdRxMJ0DoCyNcb/bYp746PBi4HktHAAYOcSQJ0Uheg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ep0dnok/ycEoUAnOK4QmdqdO0r4ttzSoqHDl7aPengE=";
   };
 
-  propagatedBuildInputs = [ smbus-cffi ];
+  build-system = [
+    hatchling
+    hatch-fancy-pypi-readme
+  ];
 
-  preBuild = ''
-    cd library
-  '';
+  dependencies = [ smbus2 ];
 
   nativeCheckInputs = [
     mock
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace library/setup.cfg \
-      --replace "smbus" "smbus-cffi"
-  '';
-
   pythonImportsCheck = [ "bme680" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/boiboite-opener-framework/default.nix b/pkgs/development/python-modules/boiboite-opener-framework/default.nix
index b86989bbbd71..d9936a7593e9 100644
--- a/pkgs/development/python-modules/boiboite-opener-framework/default.nix
+++ b/pkgs/development/python-modules/boiboite-opener-framework/default.nix
@@ -5,7 +5,6 @@
   packaging,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scapy,
   setuptools,
 }:
diff --git a/pkgs/development/python-modules/borb/default.nix b/pkgs/development/python-modules/borb/default.nix
index 3639e72e4d05..594c64fe66ef 100644
--- a/pkgs/development/python-modules/borb/default.nix
+++ b/pkgs/development/python-modules/borb/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "borb";
-  version = "2.1.23";
+  version = "2.1.24";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "jorisschellekens";
     repo = "borb";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cpih7ijoT4dEdoFjh6qQcnzjWd2zusv4tNgPyrIghvg=";
+    hash = "sha256-3PZ3fHsq9pgJ4oK42Y4b/3ghuYELgRPe09fciOKknuE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/bork/default.nix b/pkgs/development/python-modules/bork/default.nix
index b48ff6603f33..c0404e566de6 100644
--- a/pkgs/development/python-modules/bork/default.nix
+++ b/pkgs/development/python-modules/bork/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   build,
   coloredlogs,
@@ -29,7 +28,6 @@ buildPythonPackage rec {
   };
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 274f74201520..e6accaddef6e 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -7,7 +7,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   s3transfer,
   setuptools,
 }:
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 3c71ca2f6b1b..3eaade127cfe 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -8,27 +8,25 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.34.109"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.34.129"; # N.B: if you change this, change boto3 and awscli to a matching version
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gEghJSWXgh9yI8s7/KKipROuC7mnHo4iYFr/aGbhPnE=";
+    hash = "sha256-fFbiWvYRLWnF0UoVtC92unaHaHq8RjqWrF7coZwKnC0=";
   };
 
   pythonRelaxDeps = [ "urllib3" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/botorch/default.nix b/pkgs/development/python-modules/botorch/default.nix
index e35cb5261f7b..129facf57de1 100644
--- a/pkgs/development/python-modules/botorch/default.nix
+++ b/pkgs/development/python-modules/botorch/default.nix
@@ -12,23 +12,21 @@
   torch,
   scipy,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
   pname = "botorch";
-  version = "0.11.0";
+  version = "0.11.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-eL0buwqrGt4qcwdzCwD85IyiWjAFuP1n8aUb2pvvIKw=";
+    hash = "sha256-YX/G46U09y/VZuWZhKY8zU0Y+bf0NKumzSGYUWvrq/0=";
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
diff --git a/pkgs/development/python-modules/bottleneck/default.nix b/pkgs/development/python-modules/bottleneck/default.nix
index 4a0456b936fd..8b84fc8c125f 100644
--- a/pkgs/development/python-modules/bottleneck/default.nix
+++ b/pkgs/development/python-modules/bottleneck/default.nix
@@ -10,15 +10,14 @@
 
 buildPythonPackage rec {
   pname = "bottleneck";
-  version = "1.3.8";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    pname = "Bottleneck";
-    inherit version;
-    hash = "sha256-Z4DYlpabp/U8iZW6kMh8VIvrPbQ13JDGC5oQ7Rq02Gg=";
+    inherit pname version;
+    hash = "sha256-vrNt9Rm4cJ59NXwMljmwO4hcpjVbv15TdSxoXeUWBbg=";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/brian2/default.nix b/pkgs/development/python-modules/brian2/default.nix
index aefe2b55500a..c6a31766078b 100644
--- a/pkgs/development/python-modules/brian2/default.nix
+++ b/pkgs/development/python-modules/brian2/default.nix
@@ -15,16 +15,17 @@
 
 buildPythonPackage rec {
   pname = "brian2";
-  version = "2.6.0";
-  format = "setuptools";
+  version = "2.7.0";
+  pyproject = true;
 
   src = fetchPypi {
-    pname = "Brian2";
-    inherit version;
-    hash = "sha256-qYeIMn8l2V2Ckpj5AY7TWihFnfZ//JcP5VacUUfYCf4=";
+    inherit pname version;
+    hash = "sha256-d9GDWp8CGIjeprWf4TtchVd36gmo36HBRkBOLaRXbpo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     cython
     jinja2
     numpy
@@ -33,7 +34,7 @@ buildPythonPackage rec {
     sympy
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     pytest
     pytest-xdist
   ];
diff --git a/pkgs/development/python-modules/btrees/default.nix b/pkgs/development/python-modules/btrees/default.nix
index e9cf59606e99..52aafcf554b6 100644
--- a/pkgs/development/python-modules/btrees/default.nix
+++ b/pkgs/development/python-modules/btrees/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "btrees";
-  version = "5.2";
+  version = "6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "BTrees";
     inherit version;
-    hash = "sha256-bkoK8BpLvslan5Mbr1xUWXn0NBoTp2Yf+KSXr089g4E=";
+    hash = "sha256-9puM3TNDThPhgCFruCrgt80x+t+3zFWWlcs3MZyjX/A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/btsocket/default.nix b/pkgs/development/python-modules/btsocket/default.nix
index 6374188f7cc1..6065a670f12d 100644
--- a/pkgs/development/python-modules/btsocket/default.nix
+++ b/pkgs/development/python-modules/btsocket/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "btsocket";
-  version = "0.2.0";
+  version = "0.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ukBaz";
     repo = "python-btsocket";
-    rev = "v${version}";
-    hash = "sha256-IqlbFYbEyJPlcmT3DIQIwsjQEAGeIGRtFNx4jWwNtjE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/T89GZJth7pBGQuN1ytCf649oWv7aZcfPHjYoftbLw8=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/cachier/default.nix b/pkgs/development/python-modules/cachier/default.nix
index 189ae9d28196..dac7bb71f236 100644
--- a/pkgs/development/python-modules/cachier/default.nix
+++ b/pkgs/development/python-modules/cachier/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   setuptools,
   watchdog,
   portalocker,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
   pythonRemoveDeps = [ "setuptools" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/cairocffi/default.nix b/pkgs/development/python-modules/cairocffi/default.nix
index dbbcbbbffed6..11a65554116c 100644
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "cairocffi";
-  version = "1.6.1";
+  version = "1.7.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eOa75HNXZAxFPQvpKfpJzQXM4uEobz0qHKnL2n79uLc=";
+    hash = "sha256-LkjuhkiE7Eo6NL+oyauZmfaIKG63FKFaQ+ydBow2VXs=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/cairocffi/dlopen-paths.patch b/pkgs/development/python-modules/cairocffi/dlopen-paths.patch
index 6542b4367eb4..d4cc7061e86d 100644
--- a/pkgs/development/python-modules/cairocffi/dlopen-paths.patch
+++ b/pkgs/development/python-modules/cairocffi/dlopen-paths.patch
@@ -1,21 +1,13 @@
 Patch dlopen() to allow direct paths to all required libs
 
-This is an update of the patch submitted in
-https://github.com/NixOS/nixpkgs/commit/b13e44e094989d3a902f8c73b22e8d3c0cc7acf4
-by Alexander V. Nikolaev <avn@avnik.info>
-
----
- cairocffi/__init__.py | 34 ++++++++++++++++------------------
- 1 file changed, 16 insertions(+), 18 deletions(-)
-
 diff --git a/cairocffi/__init__.py b/cairocffi/__init__.py
-index 307d58c..43c29e3 100644
+index f917d90..31dab12 100644
 --- a/cairocffi/__init__.py
 +++ b/cairocffi/__init__.py
-@@ -21,28 +21,26 @@ VERSION = __version__ = (Path(__file__).parent / 'VERSION').read_text().strip()
+@@ -22,6 +22,14 @@ VERSION = __version__ = '1.7.1'
  version = '1.17.2'
  version_info = (1, 17, 2)
-
+ 
 +# Use hardcoded soname, because ctypes.util use gcc/objdump which shouldn't be
 +# required for runtime
 +_LIBS = {
@@ -24,8 +16,11 @@ index 307d58c..43c29e3 100644
 +    'gobject-2.0': '@glib@/lib/libgobject-2.0@ext@',
 +    'gdk_pixbuf-2.0': '@gdk_pixbuf@/lib/libgdk_pixbuf-2.0@ext@',
 +}
-+
-
+ 
+ # Python 3.8 no longer searches for DLLs in PATH, so we can add everything in
+ # CAIROCFFI_DLL_DIRECTORIES manually. Note that unlike PATH, add_dll_directory
+@@ -36,26 +44,14 @@ if dll_directories and hasattr(os, 'add_dll_directory'):
+ 
  def dlopen(ffi, library_names, filenames):
      """Try various names for the same library, for different platforms."""
 -    exceptions = []
@@ -33,7 +28,7 @@ index 307d58c..43c29e3 100644
      for library_name in library_names:
 -        library_filename = find_library(library_name)
 -        if library_filename:
--            filenames = (library_filename,) + filenames
+-            filenames = (library_filename, *filenames)
 -        else:
 -            exceptions.append(
 -                'no library called "{}" was found'.format(library_name))
@@ -52,10 +47,8 @@ index 307d58c..43c29e3 100644
 +            lib = ffi.dlopen(path)
 +            if lib:
 +                return lib
-+
+ 
 +    raise OSError("dlopen() failed to load a library: %s as %s" % (library_name, path))
-
-
+ 
  cairo = dlopen(
---
-2.19.2
+     ffi, ('cairo-2', 'cairo', 'libcairo-2'),
diff --git a/pkgs/development/python-modules/can/default.nix b/pkgs/development/python-modules/can/default.nix
index 2fe52ed11b86..71097501c21b 100644
--- a/pkgs/development/python-modules/can/default.nix
+++ b/pkgs/development/python-modules/can/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "can";
-  version = "4.3.1";
+  version = "4.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "hardbyte";
     repo = "python-can";
     rev = "refs/tags/v${version}";
-    hash = "sha256-t2zt54nPOYcEE0RPb4fbW7sN4HzFXlDIHvHudstBwrM=";
+    hash = "sha256-A3J/81QFSr9dP1FfpYZC+qAQlnYbzE4y5nBcfSzA3oI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/canopen/default.nix b/pkgs/development/python-modules/canopen/default.nix
index 4a5bf0062193..90351fd00776 100644
--- a/pkgs/development/python-modules/canopen/default.nix
+++ b/pkgs/development/python-modules/canopen/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "canopen";
-  version = "2.2.0";
+  version = "2.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XxhlG5325HabmILpafk0rnc+8kpFqrwzNLWGmCBI0Iw=";
+    hash = "sha256-eSCEqTwTjVsqQG3dLU61ziCPA72P2mD4GtK7jVbGuCc=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/case/default.nix b/pkgs/development/python-modules/case/default.nix
index 3271bd8e0179..8cf5ad07a64b 100644
--- a/pkgs/development/python-modules/case/default.nix
+++ b/pkgs/development/python-modules/case/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   pynose,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   six,
 }:
@@ -23,7 +22,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/catppuccin/default.nix b/pkgs/development/python-modules/catppuccin/default.nix
index 3256f83e3108..2726aa4f98de 100644
--- a/pkgs/development/python-modules/catppuccin/default.nix
+++ b/pkgs/development/python-modules/catppuccin/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   poetry-core,
   poetry-dynamic-versioning,
+  matplotlib,
   pygments,
   rich,
   pytestCheckHook,
@@ -11,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "catppuccin";
-  version = "2.2.0";
+  version = "2.3.0";
 
   pyproject = true;
 
@@ -19,7 +20,7 @@ buildPythonPackage rec {
     owner = "catppuccin";
     repo = "python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+V1rln3FlFvs1FEIANIch7k/b2EsI9xBxhg3Bwg99+I=";
+    hash = "sha256-1CPNs+n9S7fV+EvhFWBwnv6/N3UWQ/jiyRcn4XKzmd8=";
   };
 
   build-system = [
@@ -28,6 +29,7 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
+    matplotlib = [ matplotlib ];
     pygments = [ pygments ];
     rich = [ rich ];
   };
diff --git a/pkgs/development/python-modules/cbor2/default.nix b/pkgs/development/python-modules/cbor2/default.nix
index ce8bf6257cfb..319d7feb44fa 100644
--- a/pkgs/development/python-modules/cbor2/default.nix
+++ b/pkgs/development/python-modules/cbor2/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "cbor2";
-  version = "5.6.3";
+  version = "5.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5vCuJ1HC0zOpYOCAfAYRSU6xJFYxoWeWWsvBAFCUVdM=";
+    hash = "sha256-HFM8UN3oa+8caVBgIFSg/6PDduiw4gx7j1sQh5P2mD4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/censys/default.nix b/pkgs/development/python-modules/censys/default.nix
index a741b914c161..460ac35b5351 100644
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@@ -10,7 +10,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   requests-mock,
   responses,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index e0e24ed03d27..a922e5a69d29 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "certbot";
-  version = "2.9.0";
+  version = "2.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "certbot";
     repo = "certbot";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yYB9Y0wniRgzNk5XatkjKayIPj7ienXsqOboKPwzIfk=";
+    hash = "sha256-Qee7lUjgliG5fmUWWPm3MzpGJHUF/DXZ08UA6kkWjjk=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 7d03ab82c7bc..83c955b3c1c0 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   isPyPy,
   fetchPypi,
+  fetchpatch2,
   setuptools,
   pytestCheckHook,
   libffi,
@@ -12,6 +13,9 @@
   pythonAtLeast,
 }:
 
+let
+  ccVersion = lib.getVersion stdenv.cc;
+in
 if isPyPy then
   null
 else
@@ -38,10 +42,23 @@ else
         # deemed safe to trust in cffi.
         #
         ./darwin-use-libffi-closures.diff
+
+        (fetchpatch2 {
+          # https://github.com/python-cffi/cffi/pull/34
+          name = "python-3.13-compat-1.patch";
+          url = "https://github.com/python-cffi/cffi/commit/49127c6929bfc7186fbfd3819dd5e058ad888de4.patch";
+          hash = "sha256-RbspsjwDf4uwJxMqG0JZGvipd7/JqXJ2uVB7PO4Qcms=";
+        })
+        (fetchpatch2 {
+          # https://github.com/python-cffi/cffi/pull/24
+          name = "python-3.13-compat-2.patch";
+          url = "https://github.com/python-cffi/cffi/commit/14723b0bbd127790c450945099db31018d80fa83.patch";
+          hash = "sha256-H5rFgRRTr27l5S6REo8+7dmPDQW7WXhP4f4DGZjdi+s=";
+        })
       ]
-      ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc) "13") [
+      ++ lib.optionals (stdenv.cc.isClang && (ccVersion == "boot" || lib.versionAtLeast ccVersion "13")) [
         # -Wnull-pointer-subtraction is enabled with -Wextra. Suppress it to allow the following tests
-        # to run and pass when cffi is built with newer versions of clang:
+        # to run and pass when cffi is built with newer versions of clang (including the bootstrap tools clang on Darwin):
         # - testing/cffi1/test_verify1.py::test_enum_usage
         # - testing/cffi1/test_verify1.py::test_named_pointer_as_argument
         ./clang-pointer-substraction-warning.diff
diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index c2f90f4d52f2..0e182eafcd74 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "cfn-lint";
-  version = "0.86.0";
+  version = "0.87.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "aws-cloudformation";
     repo = "cfn-lint";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QkxCQ8YPRZSqAidmPus4JCgzez6uuRWvcaqfZsvugtY=";
+    hash = "sha256-em6Vi9zIn8ikmcHVbljA1vr+R3t8ZpJ57p3Ix3bqMYU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cftime/default.nix b/pkgs/development/python-modules/cftime/default.nix
index f8689e4e6cef..739d828ef2e5 100644
--- a/pkgs/development/python-modules/cftime/default.nix
+++ b/pkgs/development/python-modules/cftime/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "cftime";
-  version = "1.6.3";
+  version = "1.6.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0Kayn3KhPwjgCLm+z/JHzHXISsshMzLt4Yh5xbaqTf0=";
+    hash = "sha256-4yVAYZN1in7WcwjetS5yd4KhnjhOGDN45/9iCYvgrtw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/chameleon/default.nix b/pkgs/development/python-modules/chameleon/default.nix
index fda91a8259dd..d3f0d7a0f427 100644
--- a/pkgs/development/python-modules/chameleon/default.nix
+++ b/pkgs/development/python-modules/chameleon/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "chameleon";
-  version = "4.5.2";
+  version = "4.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "malthe";
     repo = "chameleon";
     rev = "refs/tags/${version}";
-    hash = "sha256-SVLKT6JeFUpF7gYkq3B7Lm9b9SG2qa6Ekp8i8xM0Xh0=";
+    hash = "sha256-TbXx3reRpUqnMVDsr38FM1SLgARjqXAduO3k87U5TIg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cherrypy/default.nix b/pkgs/development/python-modules/cherrypy/default.nix
index ab0986a7dcab..f0f6ea8edcde 100644
--- a/pkgs/development/python-modules/cherrypy/default.nix
+++ b/pkgs/development/python-modules/cherrypy/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   cheroot,
-  fetchpatch,
   fetchPypi,
   jaraco-collections,
   more-itertools,
@@ -26,29 +25,17 @@
 
 buildPythonPackage rec {
   pname = "cherrypy";
-  version = "18.9.0";
+  version = "18.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    pname = "CherryPy";
-    inherit version;
-    hash = "sha256-awbBkc5xqGRh8wVyoatX/8CfQxQ7qOQsEDx7M0ciDrE=";
+    inherit pname version;
+    hash = "sha256-bHDnjuETAOiyHAdnxUKuaxAqScrFz9Tj4xPXu5B8WJE=";
   };
 
-  patches = [
-    # Replace distutils.spawn.find_executable with shutil.which, https://github.com/cherrypy/cherrypy/pull/2023
-    (fetchpatch {
-      name = "remove-distutils.patch";
-      url = "https://github.com/cherrypy/cherrypy/commit/8a19dd5f1e712a326a3613b17e6fc900012ed09a.patch";
-      hash = "sha256-fXECX0CdU74usiq9GEkIG9CF+dueszblT4qOeF6B700=";
-    })
-  ];
-
   postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail '"setuptools_scm_git_archive >= 1.1",' ""
     # Disable doctest plugin because times out
     substituteInPlace pytest.ini \
       --replace-fail "--doctest-modules" "-vvv" \
@@ -57,9 +44,9 @@ buildPythonPackage rec {
     sed -i "/--cov/d" pytest.ini
   '';
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cheroot
     jaraco-collections
     more-itertools
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 867a380d7897..50cae5fb0108 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -33,7 +33,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   rustc,
@@ -75,7 +74,6 @@ buildPythonPackage rec {
     cargo
     pkg-config
     protobuf
-    pythonRelaxDepsHook
     rustc
     rustPlatform.cargoSetupHook
     setuptools
diff --git a/pkgs/development/python-modules/cirq-core/default.nix b/pkgs/development/python-modules/cirq-core/default.nix
index 5bc7a634de1a..e12dc6f3255e 100644
--- a/pkgs/development/python-modules/cirq-core/default.nix
+++ b/pkgs/development/python-modules/cirq-core/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
+  attrs,
   duet,
   matplotlib,
   networkx,
@@ -31,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "cirq-core";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -40,7 +41,7 @@ buildPythonPackage rec {
     owner = "quantumlib";
     repo = "cirq";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JAJJciFg3BuRha1wTKixtKWcYy3NA2mNpniPyPHTTe8=";
+    hash = "sha256-KHwVq0qVtc8E9i2lugILYNwk9awq952w0x4DM+HG7Pg=";
   };
 
   sourceRoot = "${src.name}/${pname}";
@@ -52,6 +53,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs =
     [
+      attrs
       duet
       matplotlib
       networkx
diff --git a/pkgs/development/python-modules/cirq-google/default.nix b/pkgs/development/python-modules/cirq-google/default.nix
index e8e0366b78d9..b7b70b00afed 100644
--- a/pkgs/development/python-modules/cirq-google/default.nix
+++ b/pkgs/development/python-modules/cirq-google/default.nix
@@ -5,7 +5,6 @@
   google-api-core,
   protobuf,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -17,7 +16,6 @@ buildPythonPackage rec {
   sourceRoot = "${src.name}/${pname}";
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/ciscoconfparse/default.nix b/pkgs/development/python-modules/ciscoconfparse/default.nix
index 991153a573ae..1643c6acfa47 100644
--- a/pkgs/development/python-modules/ciscoconfparse/default.nix
+++ b/pkgs/development/python-modules/ciscoconfparse/default.nix
@@ -9,7 +9,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   toml,
 }:
 
@@ -43,7 +42,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/clarifai/default.nix b/pkgs/development/python-modules/clarifai/default.nix
index 1c7b15ca241f..7d9e7a65b726 100644
--- a/pkgs/development/python-modules/clarifai/default.nix
+++ b/pkgs/development/python-modules/clarifai/default.nix
@@ -13,7 +13,6 @@
   pypdf,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   rich,
   schema,
@@ -37,23 +36,18 @@ buildPythonPackage rec {
     hash = "sha256-zAjGVICrYgai6GFpcJyigKxn7kNEZKclggR5ktzrCQ0=";
   };
 
-  pythonRelaxDeps = [ "clarifai-grpc" ];
-
-  pythonRemoveDeps = [ "opencv-python" ];
+  pythonRelaxDeps = [
+    "clarifai-grpc"
+    "schema"
+  ];
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-
   dependencies = [
     clarifai-grpc
     inquirerpy
-    llama-index-core
     numpy
-    opencv4
-    pandas
     pillow
-    pypdf
     pyyaml
     rich
     schema
@@ -75,6 +69,8 @@ buildPythonPackage rec {
   disabledTests = [
     # Test requires network access and API key
     "test_export_workflow_general"
+    "test_validate_invalid_id"
+    "test_validate_invalid_hex_id"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 8d1a36a72b9a..e905189e9c05 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -7,7 +7,6 @@
   pysmt,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   z3-solver,
 }:
@@ -30,7 +29,6 @@ buildPythonPackage rec {
   pythonRemoveDeps = [ "z3-solver" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 1e9ea45916ea..f02d1f1fb62e 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -45,6 +45,8 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [ "pyvex" ];
+
   dependencies = [
     archinfo
     cart
diff --git a/pkgs/development/python-modules/cleo/default.nix b/pkgs/development/python-modules/cleo/default.nix
index e29989fdb866..be805228302a 100644
--- a/pkgs/development/python-modules/cleo/default.nix
+++ b/pkgs/development/python-modules/cleo/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   pytest-mock,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   rapidfuzz,
 }:
 
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "rapidfuzz" ];
diff --git a/pkgs/development/python-modules/cli-ui/default.nix b/pkgs/development/python-modules/cli-ui/default.nix
index 88f152a6fc59..ecd30ce3fc07 100644
--- a/pkgs/development/python-modules/cli-ui/default.nix
+++ b/pkgs/development/python-modules/cli-ui/default.nix
@@ -3,7 +3,6 @@
   python3Packages,
   fetchPypi,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   poetry-core,
   colorama,
@@ -24,7 +23,6 @@ python3Packages.buildPythonPackage rec {
 
   pythonRelaxDeps = [ "tabulate" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/clickhouse-cli/default.nix b/pkgs/development/python-modules/clickhouse-cli/default.nix
index b444e17fbde4..15a700f684e1 100644
--- a/pkgs/development/python-modules/clickhouse-cli/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cli/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   click,
   prompt-toolkit,
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/clickhouse-connect/default.nix b/pkgs/development/python-modules/clickhouse-connect/default.nix
index 967f1850c698..d5300b5499a8 100644
--- a/pkgs/development/python-modules/clickhouse-connect/default.nix
+++ b/pkgs/development/python-modules/clickhouse-connect/default.nix
@@ -24,7 +24,7 @@
 }:
 buildPythonPackage rec {
   pname = "clickhouse-connect";
-  version = "0.7.11";
+  version = "0.7.12";
 
   format = "setuptools";
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     repo = "clickhouse-connect";
     owner = "ClickHouse";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Qh1F9dtDg19jr0ic3V+jH3pQczSMqVi7kxD6HG2llyA=";
+    hash = "sha256-UJSg/ADxVsO4xuym8NGjbgQafWmu7J3Is2hKvObYhU8=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/clustershell/default.nix b/pkgs/development/python-modules/clustershell/default.nix
index 284e5a0eb53a..964b2724d07c 100644
--- a/pkgs/development/python-modules/clustershell/default.nix
+++ b/pkgs/development/python-modules/clustershell/default.nix
@@ -57,6 +57,8 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "ClusterShell" ];
 
+  doCheck = false; # tests often get stuck
+
   # Many tests want to open network connections
   # https://github.com/cea-hpc/clustershell#test-suite
   #
diff --git a/pkgs/development/python-modules/cmdstanpy/default.nix b/pkgs/development/python-modules/cmdstanpy/default.nix
index 49ac02e6e92e..f0de12dcc8b3 100644
--- a/pkgs/development/python-modules/cmdstanpy/default.nix
+++ b/pkgs/development/python-modules/cmdstanpy/default.nix
@@ -5,7 +5,6 @@
   fetchpatch,
   substituteAll,
   cmdstan,
-  pythonRelaxDepsHook,
   setuptools,
   pandas,
   numpy,
@@ -18,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "cmdstanpy";
-  version = "1.2.3";
+  version = "1.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stan-dev";
     repo = "cmdstanpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PV7W1H4QYIOx1EHrGljrGUhCH1Y8ZPd9gEtCocc7x64=";
+    hash = "sha256-SKDqLvWbzaBcL13E87kcphBJNIZfdkPp2g4SIDEKA0U=";
   };
 
   patches = [
@@ -47,7 +46,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/coconut/default.nix b/pkgs/development/python-modules/coconut/default.nix
index 0c2153af5710..e7c8e7072538 100644
--- a/pkgs/development/python-modules/coconut/default.nix
+++ b/pkgs/development/python-modules/coconut/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "coconut";
-  version = "3.1.0";
+  version = "3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "evhub";
     repo = "coconut";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xlA/yryUXZCU56gJ0y7M9JHgWkvXiB09ywyf0sP1o+4=";
+    hash = "sha256-AqKLSghuyha4wSaC/91bfNna7v8xyw8NLRWBjwu5Rjo=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index b71784091607..46aed51be299 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "5.3.4";
+  version = "5.5.8";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tFoshbAl3RU2fWm/knSN5KMOyCq7Swj6UwG3LokFH+I=";
+    hash = "sha256-hM52Zv+PvfT0H7X2ykUqsmOaUUvIiWeihUqbG4INbqA=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/coincurve/default.nix b/pkgs/development/python-modules/coincurve/default.nix
index 74ca443929b6..6516cfce1687 100644
--- a/pkgs/development/python-modules/coincurve/default.nix
+++ b/pkgs/development/python-modules/coincurve/default.nix
@@ -2,49 +2,62 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  cmake,
+  hatchling,
+  ninja,
+  pkg-config,
+  setuptools,
+  scikit-build-core,
+
+  # dependencies
   asn1crypto,
-  autoconf,
-  automake,
   cffi,
-  libtool,
-  pkg-config,
+  secp256k1,
+
+  # checks
   pytestCheckHook,
-  python,
   pythonOlder,
-  secp256k1,
 }:
 
 buildPythonPackage rec {
   pname = "coincurve";
-  version = "19.0.1";
-  format = "setuptools";
+  version = "20.0.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ofek";
     repo = "coincurve";
     rev = "refs/tags/v${version}";
-    hash = "sha256-T60iKRrc8/t86nqf8/R4971SjOw586YNCWWBuLd9MjM=";
+    hash = "sha256-NKx/iLuzFEu1UBuwa14x55Ab3laVAKEtX6dtoWi0dOg=";
   };
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace ", 'requests'" ""
-
     # don't try to load .dll files
-    rm coincurve/_windows_libsecp256k1.py
     cp -r --no-preserve=mode ${secp256k1.src} libsecp256k1
     patchShebangs secp256k1/autogen.sh
   '';
 
-  nativeBuildInputs = [
-    autoconf
-    automake
-    libtool
+  build-system = [
+    hatchling
+    cffi
+    cmake
+    ninja
     pkg-config
+    setuptools
+    scikit-build-core
   ];
 
-  propagatedBuildInputs = [
+  dontUseCmakeConfigure = true;
+
+  env.COINCURVE_IGNORE_SYSTEM_LIB = "OFF";
+
+  buildInputs = [ secp256k1 ];
+
+  dependencies = [
     asn1crypto
     cffi
   ];
diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index b7c9ef2a68d1..fe5bf7716e40 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -9,7 +9,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   tqdm,
   typer,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/comicon/default.nix b/pkgs/development/python-modules/comicon/default.nix
index 932d6810ea3f..d42304712ef3 100644
--- a/pkgs/development/python-modules/comicon/default.nix
+++ b/pkgs/development/python-modules/comicon/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   pythonOlder,
   ebooklib,
   lxml,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pypdf" ];
diff --git a/pkgs/development/python-modules/commoncode/default.nix b/pkgs/development/python-modules/commoncode/default.nix
index 64be57156196..049cc4e09aa1 100644
--- a/pkgs/development/python-modules/commoncode/default.nix
+++ b/pkgs/development/python-modules/commoncode/default.nix
@@ -5,7 +5,7 @@
   beautifulsoup4,
   buildPythonPackage,
   click,
-  fetchPypi,
+  fetchFromGitHub,
   pytest-xdist,
   pytestCheckHook,
   pythonAtLeast,
@@ -18,14 +18,16 @@
 
 buildPythonPackage rec {
   pname = "commoncode";
-  version = "31.0.3";
+  version = "31.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-ura55/m/iesqN6kSYmdHB1sbthSHXaFWiQ76wVmyl0E=";
+  src = fetchFromGitHub {
+    owner = "nexB";
+    repo = "commoncode";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4ZgyNlMj1i1fRru4wgDOyP3qzbne8D2eH/tFI60kgrE=";
   };
 
   dontConfigure = true;
@@ -46,6 +48,11 @@ buildPythonPackage rec {
     pytest-xdist
   ];
 
+  preCheck = ''
+    # prevent readout of /etc/os-release during tests
+    sed -i "s/is_on_ubuntu_22()/lambda _: False/" src/commoncode/system.py
+  '';
+
   disabledTests =
     [
       # chinese character translates different into latin
diff --git a/pkgs/development/python-modules/conda-libmamba-solver/default.nix b/pkgs/development/python-modules/conda-libmamba-solver/default.nix
index aff927bfc6a8..4c99fc866c5d 100644
--- a/pkgs/development/python-modules/conda-libmamba-solver/default.nix
+++ b/pkgs/development/python-modules/conda-libmamba-solver/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   libmambapy,
   hatchling,
@@ -21,7 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-vsUYrDVNMKHd3mlaAFYCP4uPQ9HxeKsose5O8InaMcE=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     hatchling
diff --git a/pkgs/development/python-modules/conda-package-handling/default.nix b/pkgs/development/python-modules/conda-package-handling/default.nix
index 59736724577b..75ccc6039fff 100644
--- a/pkgs/development/python-modules/conda-package-handling/default.nix
+++ b/pkgs/development/python-modules/conda-package-handling/default.nix
@@ -7,12 +7,12 @@
 }:
 buildPythonPackage rec {
   pname = "conda-package-handling";
-  version = "2.2.0";
+  version = "2.3.0";
   src = fetchFromGitHub {
     owner = "conda";
     repo = "conda-package-handling";
-    rev = version;
-    hash = "sha256-WeGfmT6lLwcwhheLBPMFcVMudY+zPsvTuXuOsiEAorQ=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Mo3qCNA/NtVtrsJmJ96ST6GMt2basSh5KlFBkrJ4pGE=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/conda-package-streaming/default.nix b/pkgs/development/python-modules/conda-package-streaming/default.nix
index 931da36132c2..462660cce15f 100644
--- a/pkgs/development/python-modules/conda-package-streaming/default.nix
+++ b/pkgs/development/python-modules/conda-package-streaming/default.nix
@@ -8,14 +8,14 @@
 }:
 buildPythonPackage rec {
   pname = "conda-package-streaming";
-  version = "0.9.0";
+  version = "0.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "conda";
     repo = "conda-package-streaming";
-    rev = "v${version}";
-    hash = "sha256-UTql2M+9eFDuHOwLYYKJ751wEcOfLJYzfU6+WF8Je2g=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3TSjVISnUTReyKtt58RXCD30VodhiDDfJssM3PkP5Yk=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/conda/default.nix b/pkgs/development/python-modules/conda/default.nix
index adebce0b2377..f9971372197a 100644
--- a/pkgs/development/python-modules/conda/default.nix
+++ b/pkgs/development/python-modules/conda/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   hostPlatform,
   fetchFromGitHub,
   # build dependencies
@@ -27,7 +26,7 @@
 }:
 buildPythonPackage rec {
   pname = "conda";
-  version = "24.4.0";
+  version = "24.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -35,10 +34,9 @@ buildPythonPackage rec {
     owner = "conda";
     repo = "conda";
     rev = "refs/tags/${version}";
-    hash = "sha256-LdoBlR5EFYd2mQIjOgp1MH3w6osfRfurPq+N5Y1iaFw=";
+    hash = "sha256-DbgdTaCMWf0d3MLEMGoWxN3x37tAtoW8T7mm5279yqk=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     hatchling
diff --git a/pkgs/development/python-modules/connexion/default.nix b/pkgs/development/python-modules/connexion/default.nix
index 6c8373b3fad2..0e599c2945c3 100644
--- a/pkgs/development/python-modules/connexion/default.nix
+++ b/pkgs/development/python-modules/connexion/default.nix
@@ -34,7 +34,7 @@
 
 buildPythonPackage rec {
   pname = "connexion";
-  version = "3.0.6";
+  version = "3.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     owner = "spec-first";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-0EaJwxT80qLqlrxYk4H7Pf/UKq2pA/8HGL8OiqNA/2s=";
+    hash = "sha256-rngQDU9kXw/Z+Al0SCVnWN8xnphueTtZ0+xPBR5MbEM=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/container-inspector/default.nix b/pkgs/development/python-modules/container-inspector/default.nix
index 8bfa583d7b42..430855c6f03e 100644
--- a/pkgs/development/python-modules/container-inspector/default.nix
+++ b/pkgs/development/python-modules/container-inspector/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "container-inspector";
-  version = "32.0.1";
+  version = "33.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "nexB";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-J9glnfs6l36/IQoIvE8a+Cw4B8x/6r5UeAU8+T/OiQg=";
+    hash = "sha256-vtC42yq59vTE+4tF5CSm9zszj8goOP5i6+NMF2n4T1Q=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/development/python-modules/contourpy/default.nix b/pkgs/development/python-modules/contourpy/default.nix
index 85c7d8539219..652fbbef7207 100644
--- a/pkgs/development/python-modules/contourpy/default.nix
+++ b/pkgs/development/python-modules/contourpy/default.nix
@@ -27,7 +27,7 @@
 let
   contourpy = buildPythonPackage rec {
     pname = "contourpy";
-    version = "1.2.0";
+    version = "1.2.1";
     format = "pyproject";
 
     disabled = pythonOlder "3.8";
@@ -36,7 +36,7 @@ let
       owner = "contourpy";
       repo = "contourpy";
       rev = "refs/tags/v${version}";
-      hash = "sha256-5yZrIwwe9dL5vtdSJnOhY9X4BdK/cdEY4DkVVjCq1uw=";
+      hash = "sha256-Qd6FC7SgFyC/BvOPWVkr2ZfKVMVAknLlidNRq3zcWU0=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/convertertools/default.nix b/pkgs/development/python-modules/convertertools/default.nix
new file mode 100644
index 000000000000..bf58e95a9e58
--- /dev/null
+++ b/pkgs/development/python-modules/convertertools/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+
+  # build-system
+  cython,
+  poetry-core,
+  setuptools,
+
+  # checks
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "convertertools";
+  version = "0.5.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "bluetooth-devices";
+    repo = "convertertools";
+    rev = "v${version}";
+    hash = "sha256-g4dSJjogMBC8wqvbYDjDP6YihxuG7PQn/jwrrBFOt80=";
+  };
+
+  postPatch = ''
+    sed -i "/--cov/d" pyproject.toml
+  '';
+
+  build-system = [
+    cython
+    poetry-core
+    setuptools
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "convertertools" ];
+
+  meta = with lib; {
+    description = "Tools for converting python data types";
+    homepage = "https://github.com/bluetooth-devices/convertertools";
+    changelog = "https://github.com/bluetooth-devices/convertertools/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/conway-polynomials/default.nix b/pkgs/development/python-modules/conway-polynomials/default.nix
index fdf3f76a122e..c89898e85107 100644
--- a/pkgs/development/python-modules/conway-polynomials/default.nix
+++ b/pkgs/development/python-modules/conway-polynomials/default.nix
@@ -2,17 +2,22 @@
   lib,
   fetchPypi,
   buildPythonPackage,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "conway-polynomials";
-  version = "0.9";
+  version = "0.10";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-btIwBgm8558BddW4VGhY7sAoVPi+MjfbjRRJzMzBxYE=";
+    pname = "conway_polynomials";
+    inherit version;
+    hash = "sha256-T2GfZPgaPrFsTibFooT+7sJ6b0qtZHZD55ryiYAa4PM=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "conway_polynomials" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 2c23c43fd65f..7e366cf49725 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.4.4";
+  version = "7.5.3";
   pyproject = true;
 
   # uses f strings
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yQHfg9CXZJ4lfoA74iWSrt/VGC8Hs8yH1kC7ua/VD0k=";
+    hash = "sha256-BK78pRkNHcelOkwaWn+FaIETBteo7iMcQvtpIVVxlE8=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/coveralls/default.nix b/pkgs/development/python-modules/coveralls/default.nix
index 2e2e23e44d65..c59dd631bf08 100644
--- a/pkgs/development/python-modules/coveralls/default.nix
+++ b/pkgs/development/python-modules/coveralls/default.nix
@@ -1,57 +1,62 @@
 {
   buildPythonPackage,
   lib,
-  fetchPypi,
-  isPy27,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # checks
   mock,
-  pytest,
-  pytest-runner,
+  pytestCheckHook,
   sh,
   coverage,
   docopt,
   requests,
-  urllib3,
   git,
-  isPy3k,
+  responses,
 }:
 
 buildPythonPackage rec {
   pname = "coveralls";
-  version = "3.3.1";
-  format = "setuptools";
-  disabled = isPy27;
-
-  # wanted by tests
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "b32a8bb5d2df585207c119d6c01567b81fba690c9c10a753bfe27a335bfc43ea";
+  version = "4.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "TheKevJames";
+    repo = "coveralls-python";
+    rev = "refs/tags/${version}";
+    hash = "sha256-1MjP99NykWNDyzWwZopLAzZ93vGX1mXEU+m+zvOBIZA=";
   };
 
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    coverage
+    docopt
+    requests
+  ];
+
   nativeCheckInputs = [
     mock
     sh
-    pytest
+    pytestCheckHook
+    responses
     git
   ];
 
-  buildInputs = [ pytest-runner ];
-
-  postPatch = ''
-    sed -i "s/'coverage>=\([^,]\+\),.*',$/'coverage>=\1',/" setup.py
-  '';
-
-  # FIXME: tests requires .git directory to be present
-  doCheck = false;
-
-  checkPhase = ''
-    python setup.py test
+  preCheck = ''
+    export PATH=${coverage}/bin:$PATH
   '';
 
-  propagatedBuildInputs = [
-    coverage
-    docopt
-    requests
-  ] ++ lib.optional (!isPy3k) urllib3;
+  disabledTests = [
+    # requires .git in checkout
+    "test_git"
+    # try to run unwrapped python
+    "test_5"
+    "test_7"
+    "test_11"
+  ];
 
   meta = {
     description = "Show coverage stats online via coveralls.io";
diff --git a/pkgs/development/python-modules/craft-application/default.nix b/pkgs/development/python-modules/craft-application/default.nix
index d37e4e4063bf..1d8f388f7881 100644
--- a/pkgs/development/python-modules/craft-application/default.nix
+++ b/pkgs/development/python-modules/craft-application/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "craft-application";
-  version = "2.6.3";
+  version = "2.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-application";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZhZoR8O5oxcF8+zzihiIbiC/j3AkDL7AjaJSlZ0N48s=";
+    hash = "sha256-COcZgl2XzPWknSKMUZgZBEMzkDdwK2PouIEuWKOP8dc=";
   };
 
   postPatch = ''
@@ -44,7 +44,7 @@ buildPythonPackage rec {
       --replace-fail "dev" "${version}"
 
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools==69.4.0" "setuptools"
+      --replace-fail "setuptools==" "setuptools>="
   '';
 
   build-system = [
diff --git a/pkgs/development/python-modules/craft-providers/default.nix b/pkgs/development/python-modules/craft-providers/default.nix
index e4927e69612b..52954f8f0ddf 100644
--- a/pkgs/development/python-modules/craft-providers/default.nix
+++ b/pkgs/development/python-modules/craft-providers/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "craft-providers";
-  version = "1.23.1";
+  version = "1.24.0";
 
   pyproject = true;
 
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-providers";
     rev = "refs/tags/${version}";
-    hash = "sha256-opVgOtbwZD+uQJ10Q8QlgQaS9KjRFnQ4h98Ak7Ze5qQ=";
+    hash = "sha256-CkaJ8taTsnBpCffe/Eu4/FGpMwKcg3yeLVAahCyEsII=";
   };
 
   patches = [
@@ -52,10 +52,12 @@ buildPythonPackage rec {
     # The urllib3 incompat: https://github.com/msabramo/requests-unixsocket/pull/69
     # This is already patched in nixpkgs.
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools==69.1.1" "setuptools" \
+      --replace-fail "setuptools==" "setuptools>=" \
       --replace-fail "urllib3<2" "urllib3"
   '';
 
+  pythonRelaxDeps = [ "requests" ];
+
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/craft-store/default.nix b/pkgs/development/python-modules/craft-store/default.nix
index 637e7ed26a9d..853df850c02a 100644
--- a/pkgs/development/python-modules/craft-store/default.nix
+++ b/pkgs/development/python-modules/craft-store/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "craft-store";
-  version = "2.6.0";
+  version = "2.6.2";
 
   pyproject = true;
 
@@ -28,12 +28,12 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-store";
     rev = "refs/tags/${version}";
-    hash = "sha256-VtKOe3IrvGcNWfp1/tg1cO94xtfkP7AbIHh0WTdlfbQ=";
+    hash = "sha256-QKfXOgAWMV1mVm32ZP3HQTJmWKm82dEDmy3fo5d67TU=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools==67.7.2" "setuptools"
+      --replace-fail "setuptools==" "setuptools>="
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cryptodatahub/default.nix b/pkgs/development/python-modules/cryptodatahub/default.nix
index ae898e42b759..2c2bad80e21b 100644
--- a/pkgs/development/python-modules/cryptodatahub/default.nix
+++ b/pkgs/development/python-modules/cryptodatahub/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "cryptodatahub";
-  version = "0.12.4";
+  version = "0.12.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "coroner";
     repo = "cryptodatahub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+IGzXYSaeZjN5AxBu7jXgrnGtrtaSveFiVeNQRBZMNg=";
+    hash = "sha256-jYMzvh4tgfLS7Za0MYHbWbczptAvENfzfTEV9Drlfto=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cryptolyzer/default.nix b/pkgs/development/python-modules/cryptolyzer/default.nix
index 56af4ceb5901..98f3ce9ce8ab 100644
--- a/pkgs/development/python-modules/cryptolyzer/default.nix
+++ b/pkgs/development/python-modules/cryptolyzer/default.nix
@@ -19,15 +19,14 @@
 
 buildPythonPackage rec {
   pname = "cryptolyzer";
-  version = "0.12.3";
+  version = "0.12.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    pname = "CryptoLyzer";
-    inherit version;
-    hash = "sha256-UdM0+PkO3K4XshcqaDkEKry6Spny9KMZAHiADxxth+c=";
+    inherit pname version;
+    hash = "sha256-Qc1L4F2U/nk37s/mIa2YgJZqC2dkPsB/Si84SEl576Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cryptoparser/default.nix b/pkgs/development/python-modules/cryptoparser/default.nix
index 61efe59f0637..c0e28720423a 100644
--- a/pkgs/development/python-modules/cryptoparser/default.nix
+++ b/pkgs/development/python-modules/cryptoparser/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "cryptoparser";
-  version = "0.12.4";
+  version = "0.12.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-y5rpc0tn5JJQr4xdRUJbsq8XT/YqqJqZr3CXjqN7k7I=";
+    hash = "sha256-t8vK7T6nz1iH81fTMEYkQv7E7EjmkTx3u4zUIybEm5E=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cssutils/default.nix b/pkgs/development/python-modules/cssutils/default.nix
index 55ac4c5489fc..a442c2c22e14 100644
--- a/pkgs/development/python-modules/cssutils/default.nix
+++ b/pkgs/development/python-modules/cssutils/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "cssutils";
-  version = "2.10.2";
+  version = "2.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "jaraco";
     repo = "cssutils";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1sAn6pFwWsnYS1eHQmyDNGTo6kdhL1vJBwUptADvHyo=";
+    hash = "sha256-U9myMfKz1HpYVJXp85izRBpm2wjLHYZj8bUVt3ROTEg=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/ctap-keyring-device/default.nix b/pkgs/development/python-modules/ctap-keyring-device/default.nix
index 656e5f04456c..a18241658b01 100644
--- a/pkgs/development/python-modules/ctap-keyring-device/default.nix
+++ b/pkgs/development/python-modules/ctap-keyring-device/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools-scm,
   # install requirements
   fido2,
@@ -40,7 +39,6 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/cupy/default.nix b/pkgs/development/python-modules/cupy/default.nix
index 6311a7d099e7..8c042a9a965e 100644
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@@ -40,14 +40,14 @@ let
 in
 buildPythonPackage rec {
   pname = "cupy";
-  version = "13.0.0";
+  version = "13.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LwTnhX9pKnEzYNycOwZwmAarhAT8o5ta+XIcBKKXmq4=";
+    hash = "sha256-5NvSsu1BWaXMDA+YpxCgFJUOssFu60VelWEo87O9DVE=";
   };
 
   # See https://docs.cupy.dev/en/v10.2.0/reference/environment.html. Seting both
diff --git a/pkgs/development/python-modules/cx-freeze/default.nix b/pkgs/development/python-modules/cx-freeze/default.nix
index d418b3b3c304..bc6ebb6820c8 100644
--- a/pkgs/development/python-modules/cx-freeze/default.nix
+++ b/pkgs/development/python-modules/cx-freeze/default.nix
@@ -12,15 +12,15 @@
 
 buildPythonPackage rec {
   pname = "cx-freeze";
-  version = "6.15.16";
+  version = "7.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    pname = "cx_Freeze";
+    pname = "cx_freeze";
     inherit version;
-    hash = "sha256-xjmRiG/ypTGfjw0HwDSaa74aZbXzIPi5JDiI5jyaSiI=";
+    hash = "sha256-M1wwutDj5lNlXyMJkzCEWL7cmXuvW3qZXoZB3rousoc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
index 7f0cd0486a97..1dec71571003 100644
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@@ -9,7 +9,6 @@
   lxml,
   packageurl-python,
   py-serializable,
-  pythonRelaxDepsHook,
   poetry-core,
   pytestCheckHook,
   pythonOlder,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     importlib-metadata
diff --git a/pkgs/development/python-modules/cypherpunkpay/default.nix b/pkgs/development/python-modules/cypherpunkpay/default.nix
index cb4233883d37..8228274ee171 100644
--- a/pkgs/development/python-modules/cypherpunkpay/default.nix
+++ b/pkgs/development/python-modules/cypherpunkpay/default.nix
@@ -16,7 +16,6 @@
   pysocks,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   tzlocal,
   waitress,
@@ -50,7 +49,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dask-awkward/default.nix b/pkgs/development/python-modules/dask-awkward/default.nix
index 99bf5858bf68..09d4749c0978 100644
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@@ -14,7 +14,6 @@
   pyarrow,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   typing-extensions,
   uproot,
 }:
@@ -38,7 +37,6 @@ buildPythonPackage rec {
   build-system = [
     hatch-vcs
     hatchling
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/databricks-sql-connector/default.nix b/pkgs/development/python-modules/databricks-sql-connector/default.nix
index fdbee91fdae4..00a67be18575 100644
--- a/pkgs/development/python-modules/databricks-sql-connector/default.nix
+++ b/pkgs/development/python-modules/databricks-sql-connector/default.nix
@@ -12,14 +12,13 @@
   pyarrow,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sqlalchemy,
   thrift,
 }:
 
 buildPythonPackage rec {
   pname = "databricks-sql-connector";
-  version = "3.1.0";
+  version = "3.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +27,7 @@ buildPythonPackage rec {
     owner = "databricks";
     repo = "databricks-sql-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LiA+zZuhPPXgBb8B1vZ/PuAYMrBXzxgd1CXwugf0mk8=";
+    hash = "sha256-Sk/tYgFnWWHAsMSHhEUIwUagc6femAzQpQGyzJGXW1E=";
   };
 
   pythonRelaxDeps = [
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dataprep-ml/default.nix b/pkgs/development/python-modules/dataprep-ml/default.nix
index a8e24c9bc2a1..df952df2bd0a 100644
--- a/pkgs/development/python-modules/dataprep-ml/default.nix
+++ b/pkgs/development/python-modules/dataprep-ml/default.nix
@@ -12,7 +12,6 @@
   pydateinfer,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   scipy,
   symlinkJoin,
   type-infer,
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/datasets/default.nix b/pkgs/development/python-modules/datasets/default.nix
index 6c3c9b11434a..3718c4db7eab 100644
--- a/pkgs/development/python-modules/datasets/default.nix
+++ b/pkgs/development/python-modules/datasets/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "datasets";
-  version = "2.19.1";
+  version = "2.20.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-GicQopfQ6Ih9VEcLPAPlkvYAo2+aRqiFP1iGRM8/9m0=";
+    hash = "sha256-9mB4RXJVkmaK+fLEmyZAdf64YKGoAhE3RzMoj4/8K98=";
   };
 
   # remove pyarrow<14.0.1 vulnerability fix
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index 45f009df98ad..1fc9b1e80de0 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "datashader";
-  version = "0.16.1";
+  version = "0.16.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Wy8d1Eje/OIG7MFumWD+k3jzIwfqH8sMKYwiwU9YyIE=";
+    hash = "sha256-eJmXm0wa26a0/S6GyqP175TE5qsjTLtzBspr/iQ/xN8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbt-adapters/default.nix b/pkgs/development/python-modules/dbt-adapters/default.nix
new file mode 100644
index 000000000000..ad2616490319
--- /dev/null
+++ b/pkgs/development/python-modules/dbt-adapters/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  agate,
+  dbt-common,
+  mashumaro,
+  protobuf,
+  pytz,
+  typing-extensions,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "dbt-adapters";
+  version = "1.3.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dbt-labs";
+    repo = "dbt-adapters";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Erx/j1x+I4ypPqBFzJRZk3ILr3ZG97Hvk4vXe2p6cDc=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    agate
+    dbt-common
+    mashumaro
+    protobuf
+    pytz
+    typing-extensions
+  ] ++ mashumaro.optional-dependencies.msgpack;
+
+  pythonImportsCheck = [ "dbt.adapters" ];
+
+  # circular dependencies
+  doCheck = false;
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "The set of adapter protocols and base functionality that supports integration with dbt-core";
+    homepage = "https://github.com/dbt-labs/dbt-adapters";
+    changelog = "https://github.com/dbt-labs/dbt-adapters/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/dbt-bigquery/default.nix b/pkgs/development/python-modules/dbt-bigquery/default.nix
index 6de783f936a6..d04bf2788b60 100644
--- a/pkgs/development/python-modules/dbt-bigquery/default.nix
+++ b/pkgs/development/python-modules/dbt-bigquery/default.nix
@@ -9,14 +9,13 @@
   google-cloud-storage,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "dbt-bigquery";
-  version = "1.7.8";
+  version = "1.8.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,13 +24,12 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-bigquery";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Uc842hkrCYDR92ACDtNW+Iqq5l54CSp40D1tOL7wt8o=";
+    hash = "sha256-5sqKvYXKBze6t0yNaeYvwyS919CHMXCv3RRzNnBxfec=";
   };
 
   pythonRelaxDeps = [ "agate" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/dbt-common/default.nix b/pkgs/development/python-modules/dbt-common/default.nix
new file mode 100644
index 000000000000..be1246264845
--- /dev/null
+++ b/pkgs/development/python-modules/dbt-common/default.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  agate,
+  colorama,
+  isodate,
+  jinja2,
+  jsonschema,
+  mashumaro,
+  pathspec,
+  protobuf,
+  python-dateutil,
+  requests,
+  typing-extensions,
+  pytest-mock,
+  pytest-xdist,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "dbt-common";
+  version = "1.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dbt-labs";
+    repo = "dbt-common";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3UjwQy257ks21fQV0uZNKu5EsuzjlIAEcVtRWkR9x/4=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    agate
+    colorama
+    isodate
+    jinja2
+    jsonschema
+    mashumaro
+    pathspec
+    protobuf
+    python-dateutil
+    requests
+    typing-extensions
+  ] ++ mashumaro.optional-dependencies.msgpack;
+
+  pythonImportsCheck = [ "dbt_common" ];
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Shared common utilities for dbt-core and adapter implementations use";
+    homepage = "https://github.com/dbt-labs/dbt-common";
+    changelog = "https://github.com/dbt-labs/dbt-common/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/dbt-core/default.nix b/pkgs/development/python-modules/dbt-core/default.nix
index 2de11c94934d..0d2437e47f0b 100644
--- a/pkgs/development/python-modules/dbt-core/default.nix
+++ b/pkgs/development/python-modules/dbt-core/default.nix
@@ -2,15 +2,13 @@
   lib,
   agate,
   buildPythonPackage,
-  cffi,
   click,
-  colorama,
+  daff,
+  dbt-adapters,
+  dbt-common,
   dbt-extractor,
   dbt-semantic-interfaces,
   fetchFromGitHub,
-  hologram,
-  idna,
-  isodate,
   jinja2,
   logbook,
   mashumaro,
@@ -21,20 +19,17 @@
   protobuf,
   python3,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   pyyaml,
   requests,
   setuptools,
   sqlparse,
   typing-extensions,
-  urllib3,
-  werkzeug,
 }:
 
 buildPythonPackage rec {
   pname = "dbt-core";
-  version = "1.7.14";
+  version = "1.8.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -43,7 +38,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4PydrJGhriGCB6oc4kQE8/a24Sn9cqZhoKsiBJuEDYM=";
+    hash = "sha256-W1bD/XUmBYKzx66/rO//lCG+LOwDSlOW/KQPs0+cKTI=";
   };
 
   sourceRoot = "${src.name}/core";
@@ -51,6 +46,7 @@ buildPythonPackage rec {
   pythonRelaxDeps = [
     "agate"
     "click"
+    "dbt-semantic-interfaces"
     "mashumaro"
     "networkx"
     "logbook"
@@ -59,20 +55,17 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
   dependencies = [
     agate
-    cffi
     click
-    colorama
+    daff
+    dbt-adapters
+    dbt-common
     dbt-extractor
     dbt-semantic-interfaces
-    hologram
-    idna
-    isodate
     jinja2
     logbook
     mashumaro
@@ -86,8 +79,6 @@ buildPythonPackage rec {
     requests
     sqlparse
     typing-extensions
-    urllib3
-    werkzeug
   ] ++ mashumaro.optional-dependencies.msgpack;
 
   # tests exist for the dbt tool but not for this package specifically
diff --git a/pkgs/development/python-modules/dbt-postgres/default.nix b/pkgs/development/python-modules/dbt-postgres/default.nix
index 8cca80c11285..f3503eac82d0 100644
--- a/pkgs/development/python-modules/dbt-postgres/default.nix
+++ b/pkgs/development/python-modules/dbt-postgres/default.nix
@@ -2,28 +2,39 @@
   lib,
   agate,
   buildPythonPackage,
+  fetchFromGitHub,
+  dbt-adapters,
+  dbt-common,
   dbt-core,
+  hatchling,
   psycopg2,
   pythonOlder,
-  setuptools,
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "dbt-postgres";
+  version = "1.8.2";
   pyproject = true;
 
-  inherit (dbt-core) version src;
+  disabled = pythonOlder "3.8";
 
-  disabled = pythonOlder "3.7";
-
-  sourceRoot = "${dbt-core.src.name}/plugins/postgres";
+  src = fetchFromGitHub {
+    owner = "dbt-labs";
+    repo = "dbt-postgres";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-E7Y2lY8aCiAZx5sLWwpOBLTrdOsCQAdWWJTvR2jGOaA=";
+  };
 
   env.DBT_PSYCOPG2_NAME = "psycopg2";
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
+
+  pythonRemoveDeps = [ "psycopg2-binary" ];
 
   dependencies = [
     agate
+    dbt-adapters
+    dbt-common
     dbt-core
     psycopg2
   ];
diff --git a/pkgs/development/python-modules/dbt-redshift/default.nix b/pkgs/development/python-modules/dbt-redshift/default.nix
index b30c787a9324..b818182d13b0 100644
--- a/pkgs/development/python-modules/dbt-redshift/default.nix
+++ b/pkgs/development/python-modules/dbt-redshift/default.nix
@@ -8,14 +8,13 @@
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   redshift-connector,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "dbt-redshift";
-  version = "1.7.7";
+  version = "1.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +23,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-redshift";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DKqJ/8hEPe9O9YrAjrTL2Gh1lj6QrdtHtd7aarZ7GkQ=";
+    hash = "sha256-XTAWCJ+aTFrAuggS3dbR9X08/x9ypXgE8tlWTaOmyRc=";
   };
 
   pythonRelaxDeps = [
@@ -32,7 +31,6 @@ buildPythonPackage rec {
     "redshift-connector"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
index 1abaa554e9a2..5f6a9d41fc4d 100644
--- a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
+++ b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
@@ -6,7 +6,6 @@
   dbt-postgres,
   fetchFromGitHub,
   hatchling,
-  pythonRelaxDepsHook,
   hypothesis,
   importlib-metadata,
   jinja2,
@@ -21,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-semantic-interfaces";
-  version = "0.4.4";
+  version = "0.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,14 +29,13 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-semantic-interfaces";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uvwcnOKjwxEmA+/QRGSRofpoE4jZzmE02mGSDLINrJw=";
+    hash = "sha256-77WKfegchgHIxgzL3Yhtx/4S5pYi6HeVCQH/19YscWA=";
   };
 
   pythonRelaxDeps = [ "importlib-metadata" ];
 
   build-system = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/dbt-snowflake/default.nix b/pkgs/development/python-modules/dbt-snowflake/default.nix
index 5f46ad88e038..17e9cd092709 100644
--- a/pkgs/development/python-modules/dbt-snowflake/default.nix
+++ b/pkgs/development/python-modules/dbt-snowflake/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-snowflake";
-  version = "1.7.3";
+  version = "1.8.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-snowflake";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ksnLQdoXR8KVtYTFdlaWT8UYjAsLNyEVVap/QHtm+j8=";
+    hash = "sha256-jvhjf+Ce/oyHXFxMryz5Uy6Hq5Sx6vKgaGEJVAzqSdA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index e26f2a522e17..f018af1bce0c 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "2.21.3";
+  version = "2.22.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "dbus-fast";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Wmv6R/aOBFPSzTVEElYsg/CrywB/pAYPWZBsMhpqtFQ=";
+    hash = "sha256-WT32nkRcS+JFCJCZNXXFm38nzttYLsqU98tJD7YBn9w=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/deal-solver/default.nix b/pkgs/development/python-modules/deal-solver/default.nix
index 4657d0f21d9a..8acefba226a8 100644
--- a/pkgs/development/python-modules/deal-solver/default.nix
+++ b/pkgs/development/python-modules/deal-solver/default.nix
@@ -8,7 +8,6 @@
   astroid,
   pytestCheckHook,
   hypothesis,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
diff --git a/pkgs/development/python-modules/deepdiff/default.nix b/pkgs/development/python-modules/deepdiff/default.nix
index e16fd6e90cc3..af4500ffd580 100644
--- a/pkgs/development/python-modules/deepdiff/default.nix
+++ b/pkgs/development/python-modules/deepdiff/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "deepdiff";
-  version = "6.7.1";
+  version = "7.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "seperman";
     repo = "deepdiff";
     rev = "refs/tags/${version}";
-    hash = "sha256-YGYprSC5j06Ozg0dUJN5xnba0HUgiXa+d9Ci3czGWoY=";
+    hash = "sha256-HqmAE5sLwyjyUahIUeRIJW0c5eliq/qEzE2FydHwc70=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/defusedxml/default.nix b/pkgs/development/python-modules/defusedxml/default.nix
index ee23d66e59d7..ce997d1fcb82 100644
--- a/pkgs/development/python-modules/defusedxml/default.nix
+++ b/pkgs/development/python-modules/defusedxml/default.nix
@@ -1,27 +1,38 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
+  lxml,
   python,
 }:
 
 buildPythonPackage rec {
   pname = "defusedxml";
-  version = "0.7.1";
-  format = "setuptools";
+  version = "0.8.0rc2";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69";
+  src = fetchFromGitHub {
+    owner = "tiran";
+    repo = "defusedxml";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-X88A5V9uXP3wJQ+olK6pZJT66LP2uCXLK8goa5bPARA=";
   };
 
+  build-system = [ setuptools ] ;
+
+  nativeCheckInputs = [ lxml ];
+
   checkPhase = ''
+    runHook preCheck
     ${python.interpreter} tests.py
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "defusedxml" ];
 
   meta = with lib; {
+    changelog = "https://github.com/tiran/defusedxml/blob/v${version}/CHANGES.txt";
     description = "Python module to defuse XML issues";
     homepage = "https://github.com/tiran/defusedxml";
     license = licenses.psfl;
diff --git a/pkgs/development/python-modules/demetriek/default.nix b/pkgs/development/python-modules/demetriek/default.nix
index b51e463c67f0..2a9a466c9ab0 100644
--- a/pkgs/development/python-modules/demetriek/default.nix
+++ b/pkgs/development/python-modules/demetriek/default.nix
@@ -12,7 +12,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   yarl,
 }:
 
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/denonavr/default.nix b/pkgs/development/python-modules/denonavr/default.nix
index 2cd72f29655b..5f113865c388 100644
--- a/pkgs/development/python-modules/denonavr/default.nix
+++ b/pkgs/development/python-modules/denonavr/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     hash = "sha256-VxoRK1qeGrIunsiCzeZJUHxW/sxk+PFpntInL+G/yI8=";
   };
 
+  pythonRelaxDeps = [ "defusedxml" ];
+
   nativeBuildInputs = [ setuptools ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/detect-secrets/default.nix b/pkgs/development/python-modules/detect-secrets/default.nix
index 9fa8cb8d1590..a678a2bb69de 100644
--- a/pkgs/development/python-modules/detect-secrets/default.nix
+++ b/pkgs/development/python-modules/detect-secrets/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "detect-secrets";
-  version = "1.4.0";
+  version = "1.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,8 +24,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Yelp";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-6EmL6XPySqcA3EA+FFkfw7Dkxl5LvyBorIw0hesV5eU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-pNLAZUJhjZ3b01XaltJUJ9O7Blv6/pHQrRvURe7MJ5A=";
     leaveDotGit = true;
   };
 
diff --git a/pkgs/development/python-modules/detectron2/default.nix b/pkgs/development/python-modules/detectron2/default.nix
index 944ff80850cf..2247b4581a4d 100644
--- a/pkgs/development/python-modules/detectron2/default.nix
+++ b/pkgs/development/python-modules/detectron2/default.nix
@@ -3,7 +3,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   ninja,
   which,
   # build inputs
@@ -72,7 +71,6 @@ buildPythonPackage {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     ninja
     which
   ];
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 9b9eeb9cc89c..a9d34cd2f0bb 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -19,7 +19,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scipy,
   sympy,
 }:
@@ -47,7 +46,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     anytree
diff --git a/pkgs/development/python-modules/devpi-common/default.nix b/pkgs/development/python-modules/devpi-common/default.nix
index 7f5ab1ef7422..e83e9d88d724 100644
--- a/pkgs/development/python-modules/devpi-common/default.nix
+++ b/pkgs/development/python-modules/devpi-common/default.nix
@@ -13,14 +13,15 @@
 
 buildPythonPackage rec {
   pname = "devpi-common";
-  version = "4.0.3";
+  version = "4.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-+OAbT23wgPYihMzljFuxzh6GmwwjSqx60TVgl0X8Fz0=";
+    pname = "devpi_common";
+    inherit version;
+    hash = "sha256-I1oKmkXJblTGC6a6L3fYVs+Q8aacG+6UmIfp7cA6Qcw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/diffsync/default.nix b/pkgs/development/python-modules/diffsync/default.nix
index f5ffb2dfbd06..28ea4eb3a9f5 100644
--- a/pkgs/development/python-modules/diffsync/default.nix
+++ b/pkgs/development/python-modules/diffsync/default.nix
@@ -6,7 +6,6 @@
   packaging,
   poetry-core,
   pydantic,
-  pythonRelaxDepsHook,
   redis,
   structlog,
 }:
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/dissect/default.nix b/pkgs/development/python-modules/dissect/default.nix
index 73f022e97eaa..7102f03e869a 100644
--- a/pkgs/development/python-modules/dissect/default.nix
+++ b/pkgs/development/python-modules/dissect/default.nix
@@ -30,7 +30,6 @@
   dissect-xfs,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-scm,
 }:
@@ -56,7 +55,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     dissect-archive
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index f282e0bb5504..0778fcc9543b 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -11,7 +11,6 @@
   packaging,
   psutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   setuptools,
   setuptools-scm,
@@ -45,7 +44,6 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     versioneer
diff --git a/pkgs/development/python-modules/dj-database-url/default.nix b/pkgs/development/python-modules/dj-database-url/default.nix
index cbf1502bfde9..aec84b910291 100644
--- a/pkgs/development/python-modules/dj-database-url/default.nix
+++ b/pkgs/development/python-modules/dj-database-url/default.nix
@@ -1,24 +1,33 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   django,
   pythonOlder,
+  setuptools,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "dj-database-url";
-  version = "2.1.0";
-  format = "setuptools";
+  version = "2.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-8gQs7+EIblOcnaOfrVrX9hFzv3lmXmm/fk3lX6iLE18=";
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "dj-database-url";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-i2btutob+5R+FFPlGwRSNF01MTfxVop8xaePDHxnqLE=";
   };
 
-  propagatedBuildInputs = [ django ];
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    typing-extensions
+  ];
 
   # Tests access a DB via network
   doCheck = false;
diff --git a/pkgs/development/python-modules/django-admin-sortable2/default.nix b/pkgs/development/python-modules/django-admin-sortable2/default.nix
index ae9b84536f93..22ef40ac2f69 100644
--- a/pkgs/development/python-modules/django-admin-sortable2/default.nix
+++ b/pkgs/development/python-modules/django-admin-sortable2/default.nix
@@ -8,14 +8,15 @@
 
 buildPythonPackage rec {
   pname = "django-admin-sortable2";
-  version = "2.1.10";
+  version = "2.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit version pname;
-    hash = "sha256-N1awLH0JxbN+/mV3GNWq4rdfRv0Bu/4cOdTmBlEBnXk=";
+    pname = "django_admin_sortable2";
+    inherit version;
+    hash = "sha256-MKlSf5P8YbeixZVNtX2EKJMeN/Riw7RssQEFPcX1F1E=";
   };
 
   propagatedBuildInputs = [ django_4 ];
diff --git a/pkgs/development/python-modules/django-cacheops/default.nix b/pkgs/development/python-modules/django-cacheops/default.nix
index f7f15c540a99..85b44d4523a9 100644
--- a/pkgs/development/python-modules/django-cacheops/default.nix
+++ b/pkgs/development/python-modules/django-cacheops/default.nix
@@ -3,7 +3,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   django,
   funcy,
   redis,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-d6N8c9f6z8cpk2XtZqEr56SH3XRd2GwdM8ouv9OzKHg=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "funcy" ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-compressor/default.nix b/pkgs/development/python-modules/django-compressor/default.nix
index cf818ce7581e..668c36f5deda 100644
--- a/pkgs/development/python-modules/django-compressor/default.nix
+++ b/pkgs/development/python-modules/django-compressor/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/django-debug-toolbar/default.nix b/pkgs/development/python-modules/django-debug-toolbar/default.nix
index 20e4c5d7e1eb..99bb0afb9178 100644
--- a/pkgs/development/python-modules/django-debug-toolbar/default.nix
+++ b/pkgs/development/python-modules/django-debug-toolbar/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "django-debug-toolbar";
-  version = "4.3";
+  version = "4.4.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-8rwEM+YSO9TtkC1UWS4JrzFH+TlGOHzL+WmxNwMJIWQ=";
+    hash = "sha256-ZfGDXyrHwlFpeGK1QTD4nlGWdbEK7+hurOVkAAp/LyA=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/django-extensions/default.nix b/pkgs/development/python-modules/django-extensions/default.nix
index 54f01c14c48f..8e10c4c1f567 100644
--- a/pkgs/development/python-modules/django-extensions/default.nix
+++ b/pkgs/development/python-modules/django-extensions/default.nix
@@ -2,13 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonAtLeast,
+  fetchpatch2,
 
   # build-system
   setuptools,
 
   # dependencies
+  aiosmtpd,
   django,
+  looseversion,
 
   # tests
   factory-boy,
@@ -27,25 +29,37 @@ buildPythonPackage rec {
   version = "3.2.3";
   pyproject = true;
 
-  # https://github.com/django-extensions/django-extensions/issues/1831
-  # Requires asyncore, which was dropped in 3.12
-  disabled = pythonAtLeast "3.12";
-
-  src = fetchFromGitHub {
+   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
     hash = "sha256-A2+5FBv0IhTJPkwgd7je+B9Ac64UHJEa3HRBbWr2FxM=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # Replace dead asyncore, smtp implementation with aiosmtpd
+      name = "django-extensions-aiosmtpd.patch";
+      url = "https://github.com/django-extensions/django-extensions/commit/37d56c4a4704c823ac6a4ef7c3de4c0232ceee64.patch";
+      hash = "sha256-49UeJQKO0epwY/7tqoiHgOXdgPcB/JBIZaCn3ulaHTg=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "--cov=django_extensions --cov-report html --cov-report term" ""
+      --replace-fail "--cov=django_extensions --cov-report html --cov-report term" ""
+
+    substituteInPlace django_extensions/management/commands/pipchecker.py \
+      --replace-fail "from distutils.version" "from looseversion"
   '';
 
   build-system = [ setuptools ];
 
-  dependencies = [ django ];
+  dependencies = [
+    aiosmtpd
+    django
+    looseversion
+  ];
 
   __darwinAllowLocalNetworking = true;
 
@@ -61,6 +75,11 @@ buildPythonPackage rec {
     werkzeug
   ];
 
+  disabledTests = [
+    # Mismatch in expectation of exception message
+    "test_installed_apps_no_resolve_conflicts_function"
+  ];
+
   disabledTestPaths = [
     # requires network access
     "tests/management/commands/test_pipchecker.py"
diff --git a/pkgs/development/python-modules/django-haystack/default.nix b/pkgs/development/python-modules/django-haystack/default.nix
index 32839d246c33..8b49b0014b92 100644
--- a/pkgs/development/python-modules/django-haystack/default.nix
+++ b/pkgs/development/python-modules/django-haystack/default.nix
@@ -14,7 +14,6 @@
   # tests
   elasticsearch,
   geopy,
-  nose,
   pysolr,
   python-dateutil,
   requests,
@@ -23,42 +22,36 @@
 
 buildPythonPackage rec {
   pname = "django-haystack";
-  version = "3.2.1";
+  version = "3.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-l+MZeu/CJf5AW28XYAolNL+CfLTWdDEwwgvBoG9yk6Q=";
+    pname = "django_haystack";
+    inherit version;
+    hash = "sha256-487ta4AAYl2hTUCetNrGmJSQXirIrBj5v9tZMjygLqs=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "geopy==" "geopy>="
-  '';
-
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
   ];
 
   buildInputs = [ django ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     elasticsearch = [ elasticsearch ];
   };
 
-  doCheck = lib.versionOlder django.version "4";
-
   nativeCheckInputs = [
     geopy
-    nose
     pysolr
     python-dateutil
     requests
     whoosh
-  ] ++ passthru.optional-dependencies.elasticsearch;
+  ] ++ optional-dependencies.elasticsearch;
+
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/python-modules/django-health-check/default.nix b/pkgs/development/python-modules/django-health-check/default.nix
index 76641bd9cbc8..420475a54e8a 100644
--- a/pkgs/development/python-modules/django-health-check/default.nix
+++ b/pkgs/development/python-modules/django-health-check/default.nix
@@ -7,6 +7,8 @@
   django,
   redis,
   celery,
+  boto3,
+  django-storages,
   pytest-django,
   pytestCheckHook,
   mock,
@@ -15,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "django-health-check";
-  version = "3.18.1";
+  version = "3.18.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "KristianOellegaard";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-4fl7x0pleI1yL+tEWGt5Gmcl6ZKETQz2AsNQDVIAwy8=";
+    hash = "sha256-c0JOfbuVIiTqZo/alJWPN7AB8a3nNdG7euS3scwGHaY=";
   };
 
   buildInputs = [
@@ -36,6 +38,8 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    boto3
+    django-storages
     pytest-django
     pytestCheckHook
     mock
diff --git a/pkgs/development/python-modules/django-import-export/default.nix b/pkgs/development/python-modules/django-import-export/default.nix
index 1a155875676f..6cde0dae20cb 100644
--- a/pkgs/development/python-modules/django-import-export/default.nix
+++ b/pkgs/development/python-modules/django-import-export/default.nix
@@ -8,7 +8,6 @@
   psycopg2,
   python,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   setuptools-scm,
   tablib,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     diff-match-patch
diff --git a/pkgs/development/python-modules/django-leaflet/default.nix b/pkgs/development/python-modules/django-leaflet/default.nix
index 7dd2ee7fe210..99e7e47ca8b6 100644
--- a/pkgs/development/python-modules/django-leaflet/default.nix
+++ b/pkgs/development/python-modules/django-leaflet/default.nix
@@ -4,21 +4,25 @@
   django,
   fetchPypi,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "django-leaflet";
-  version = "0.29.1";
-  format = "setuptools";
+  version = "0.30.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-ECtocPJHYR1DsFLeVMVdtlia4UNOJyNMsU1CrX1aVsQ=";
+    pname = "django_leaflet";
+    inherit version;
+    hash = "sha256-jsG2RcUe0Zob9GAZVKSIr8iPPubqqsh679uhUioNR0Y=";
   };
 
-  propagatedBuildInputs = [ django ];
+  build-system = [ setuptools ];
+
+  dependencies = [ django ];
 
   # The tests seem to be impure.
   # They are throwing a error about unset configs:
diff --git a/pkgs/development/python-modules/django-modeltranslation/default.nix b/pkgs/development/python-modules/django-modeltranslation/default.nix
index 32e5d59b4de0..e32886c600f5 100644
--- a/pkgs/development/python-modules/django-modeltranslation/default.nix
+++ b/pkgs/development/python-modules/django-modeltranslation/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   pythonOlder,
   django,
+  django-stubs,
   pytestCheckHook,
   pytest-django,
   parameterized,
@@ -11,7 +12,7 @@
 let
   # 0.18.12 was yanked from PyPI, it refers to this issue:
   # https://github.com/deschler/django-modeltranslation/issues/701
-  version = "0.19.2";
+  version = "0.19.3";
 in
 buildPythonPackage {
   pname = "django-modeltranslation";
@@ -21,7 +22,7 @@ buildPythonPackage {
     owner = "deschler";
     repo = "django-modeltranslation";
     rev = "refs/tags/v${version}";
-    hash = "sha256-l0NyHIDAv7qmwtbMcxdnHFExlLchdfkP4iX/1ABzcRA=";
+    hash = "sha256-tCj3+9iQ5DBf0fxAHgHkgcARFDfZTV/o6wvQ7ASUJWQ=";
   };
 
   # Remove all references to pytest-cov
@@ -37,6 +38,7 @@ buildPythonPackage {
   propagatedBuildInputs = [ django ];
 
   nativeCheckInputs = [
+    django-stubs
     pytestCheckHook
     pytest-django
     parameterized
diff --git a/pkgs/development/python-modules/django-oauth-toolkit/default.nix b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
index fdde98dd5ee5..139a0d022c15 100644
--- a/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # propagates
   django,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "django" ];
 
   DJANGO_SETTINGS_MODULE = "tests.settings";
diff --git a/pkgs/development/python-modules/django-simple-history/default.nix b/pkgs/development/python-modules/django-simple-history/default.nix
index 3714914bc95a..0179760be698 100644
--- a/pkgs/development/python-modules/django-simple-history/default.nix
+++ b/pkgs/development/python-modules/django-simple-history/default.nix
@@ -3,15 +3,16 @@
   buildPythonPackage,
   django,
   fetchFromGitHub,
-  pytest-django,
+  hatch-fancy-pypi-readme,
+  hatchling,
+  hatch-vcs,
   python,
   pythonOlder,
-  setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "django-simple-history";
-  version = "3.5.0";
+  version = "3.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,15 +21,21 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "django-simple-history";
     rev = "refs/tags/${version}";
-    hash = "sha256-BW/F+RBf1KvwGRY9IK00+n69Jtx/ndEuvpHSi8/odSE=";
+    hash = "sha256-bPdMdtiEDRvRD00ZBwUQkeCDKCx2SW65+FsbuMwVdK0=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    hatch-fancy-pypi-readme
+    hatchling
+    hatch-vcs
+  ];
 
   propagatedBuildInputs = [ django ];
 
   checkPhase = ''
+    runHook preCheck
     ${python.interpreter} runtests.py
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "simple_history" ];
diff --git a/pkgs/development/python-modules/django-stubs-ext/default.nix b/pkgs/development/python-modules/django-stubs-ext/default.nix
index cfedb113a1c8..1176f2ba09c7 100644
--- a/pkgs/development/python-modules/django-stubs-ext/default.nix
+++ b/pkgs/development/python-modules/django-stubs-ext/default.nix
@@ -11,14 +11,15 @@
 
 buildPythonPackage rec {
   pname = "django-stubs-ext";
-  version = "4.2.7";
+  version = "5.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-UZNCrAhJzaFVl0bJpWPwP/mfY2sOvnwUt16BagDf3cM=";
+    pname = "django_stubs_ext";
+    inherit version;
+    hash = "sha256-QJxiWF1/mWzvXHYObifqP/KflhyUN0fmdRnIN0IsrTI=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-stubs/default.nix b/pkgs/development/python-modules/django-stubs/default.nix
index dfae4891d542..72adac752285 100644
--- a/pkgs/development/python-modules/django-stubs/default.nix
+++ b/pkgs/development/python-modules/django-stubs/default.nix
@@ -16,14 +16,15 @@
 
 buildPythonPackage rec {
   pname = "django-stubs";
-  version = "4.2.7";
+  version = "5.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-jM0v9O5a3yK547expRbS4cIZHp2U5nLDXMK8PdYeD2s=";
+    pname = "django_stubs";
+    inherit version;
+    hash = "sha256-I2vFYG5WB8uWj5K2SEcfntqkYad0vAE7+ea/+HMPa98=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-two-factor-auth/default.nix b/pkgs/development/python-modules/django-two-factor-auth/default.nix
index f14b4a0d0c85..718d2206700b 100644
--- a/pkgs/development/python-modules/django-two-factor-auth/default.nix
+++ b/pkgs/development/python-modules/django-two-factor-auth/default.nix
@@ -9,7 +9,6 @@
   phonenumbers,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   qrcode,
   setuptools-scm,
   twilio,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/django-webpush/default.nix b/pkgs/development/python-modules/django-webpush/default.nix
index 25d406e348c4..0c9b0ac65787 100644
--- a/pkgs/development/python-modules/django-webpush/default.nix
+++ b/pkgs/development/python-modules/django-webpush/default.nix
@@ -4,7 +4,6 @@
   django,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   pywebpush,
   setuptools-scm,
 }:
@@ -26,7 +25,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pywebpush" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/djangorestframework-stubs/default.nix b/pkgs/development/python-modules/djangorestframework-stubs/default.nix
index 70c672cdc25a..140168e8260c 100644
--- a/pkgs/development/python-modules/djangorestframework-stubs/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-stubs/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "djangorestframework-stubs";
-  version = "3.14.5";
+  version = "3.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "typeddjango";
     repo = "djangorestframework-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-AOhNlhTZ6Upevb/7Z1sUQoIkIlwYlIcf1CC+Ag7H4bg=";
+    hash = "sha256-5fZzSRn59ii41QKOqkZUXTDnm70Um9SY445Vfoo8sgg=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/djangorestframework/default.nix b/pkgs/development/python-modules/djangorestframework/default.nix
index d151b538bf99..184307a5a2e4 100644
--- a/pkgs/development/python-modules/djangorestframework/default.nix
+++ b/pkgs/development/python-modules/djangorestframework/default.nix
@@ -57,6 +57,11 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  disabledTests = [
+    # https://github.com/encode/django-rest-framework/issues/9422
+    "test_urlpatterns"
+  ];
+
   pythonImportsCheck = [ "rest_framework" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/dm-control/default.nix b/pkgs/development/python-modules/dm-control/default.nix
index 25a375bf7eb6..af8c7bdbee7f 100644
--- a/pkgs/development/python-modules/dm-control/default.nix
+++ b/pkgs/development/python-modules/dm-control/default.nix
@@ -6,7 +6,6 @@
   absl-py,
   mujoco,
   pyparsing,
-  pythonRelaxDepsHook,
   setuptools,
   wheel,
   dm-env,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
     absl-py
     mujoco
     pyparsing
-    pythonRelaxDepsHook
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/dploot/default.nix b/pkgs/development/python-modules/dploot/default.nix
index 4104ec2ac44b..4cb0a90c0f0f 100644
--- a/pkgs/development/python-modules/dploot/default.nix
+++ b/pkgs/development/python-modules/dploot/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   pyasn1,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -29,7 +28,6 @@ buildPythonPackage rec {
     "pyasn1"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 4e3683fc485b..73a551a5c278 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -12,7 +12,6 @@
   pytestCheckHook,
   sphinxHook,
   sphinx-rtd-theme,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -60,7 +59,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     sphinxHook
     sphinx-rtd-theme
-    pythonRelaxDepsHook
   ];
 
   # Version 12.0.0 re-introduced Python 2 support and set some very restrictive version bounds
diff --git a/pkgs/development/python-modules/duckdb-engine/default.nix b/pkgs/development/python-modules/duckdb-engine/default.nix
index 32c0d20b6beb..3c195638a8e0 100644
--- a/pkgs/development/python-modules/duckdb-engine/default.nix
+++ b/pkgs/development/python-modules/duckdb-engine/default.nix
@@ -9,13 +9,14 @@
   pandas,
   poetry-core,
   pytest-remotedata,
+  snapshottest,
   sqlalchemy,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "duckdb-engine";
-  version = "0.12.1";
+  version = "0.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     repo = "duckdb_engine";
     owner = "Mause";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+l6sRZHJnLfei1LR8WHqpC+0+91VLYKXn2e0w9+QRyk=";
+    hash = "sha256-XbO9LyweJ+pYQvEbdmiUJnVNr2BQAgwu9Imq7rAFEYg=";
   };
 
   nativeBuildInputs = [ poetry-core ];
@@ -44,6 +45,7 @@ buildPythonPackage rec {
     hypothesis
     pandas
     pytest-remotedata
+    snapshottest
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/duckduckgo-search/default.nix b/pkgs/development/python-modules/duckduckgo-search/default.nix
index 42ba286a55d0..9dbaee5c8975 100644
--- a/pkgs/development/python-modules/duckduckgo-search/default.nix
+++ b/pkgs/development/python-modules/duckduckgo-search/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     pyreqwest-impersonate
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     lxml = [ lxml ];
   };
 
diff --git a/pkgs/development/python-modules/dulwich/default.nix b/pkgs/development/python-modules/dulwich/default.nix
index 2a7ca19802b7..436dae6ee78f 100644
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@@ -2,9 +2,9 @@
   lib,
   stdenv,
   buildPythonPackage,
-  certifi,
   fastimport,
   fetchFromGitHub,
+  fetchpatch2,
   gevent,
   geventhttpclient,
   git,
@@ -12,8 +12,7 @@
   gnupg,
   gpgme,
   paramiko,
-  pytest-xdist,
-  pytestCheckHook,
+  unittestCheckHook,
   pythonOlder,
   setuptools,
   setuptools-rust,
@@ -21,7 +20,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.21.7";
+  version = "0.22.1";
   pname = "dulwich";
   format = "setuptools";
 
@@ -30,22 +29,30 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jelmer";
     repo = "dulwich";
-    rev = "refs/tags/${pname}-${version}";
-    hash = "sha256-iP+6KtaQ8tfOobovSLSJZogS/XWW0LuHgE2oV8uQW/8=";
+    rev = "refs/tags/dulwich-${version}";
+    hash = "sha256-bf3ZUMX4afpdTBpFnx0HMyzCNG6V/p4eOl36djxGbtk=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "dulwich-geventhttpclient-api-breakage.patch";
+      url = "https://github.com/jelmer/dulwich/commit/5f0497de9c37ac4f4e8f27bed8decce13765d3df.patch";
+      hash = "sha256-0GgDgmYuLCsMc9nRRLNL2W6WYrkZ/1ZnZBQusEAzLKI=";
+    })
+  ];
+
   build-system = [
     setuptools
     setuptools-rust
   ];
 
   propagatedBuildInputs = [
-    certifi
     urllib3
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     fastimport = [ fastimport ];
+    https = [ urllib3 ];
     pgp = [
       gpgme
       gnupg
@@ -59,32 +66,19 @@ buildPythonPackage rec {
       geventhttpclient
       git
       glibcLocales
-      pytest-xdist
-      pytestCheckHook
+      unittestCheckHook
     ]
-    ++ passthru.optional-dependencies.fastimport
-    ++ passthru.optional-dependencies.pgp
-    ++ passthru.optional-dependencies.paramiko;
+    ++ lib.flatten (lib.attrValues optional-dependencies);
 
-  doCheck = !stdenv.isDarwin;
+  preCheck = ''
+    # requires swift config file
+    rm tests/contrib/test_swift_smoke.py
 
-  disabledTests = [
-    # OSError: [Errno 84] Invalid or incomplete multibyte or wide character: b'/build/tmpsqwlbpd1/\xc0'
-    "test_no_decode_encode"
-    # OSError: [Errno 84] Invalid or incomplete multibyte or wide character: b'/build/tmpwmtfyvo2/refs.git/refs/heads/\xcd\xee\xe2\xe0\xff\xe2\xe5\xf2\xea\xe01'
-    "test_cyrillic"
-    # OSError: [Errno 84] Invalid or incomplete multibyte or wide character: b'/build/tmpfseetobk/test/\xc0'
-    "test_commit_no_encode_decode"
-    # https://github.com/jelmer/dulwich/issues/1279
-    "test_init_connector"
-  ];
+    # ImportError: attempted relative import beyond top-level package
+    rm tests/test_greenthreads.py
+  '';
 
-  disabledTestPaths = [
-    # missing test inputs
-    "dulwich/contrib/test_swift_smoke.py"
-    # flaky on high core count >4
-    "dulwich/tests/compat/test_client.py"
-  ];
+  doCheck = !stdenv.isDarwin;
 
   pythonImportsCheck = [ "dulwich" ];
 
diff --git a/pkgs/development/python-modules/dunamai/default.nix b/pkgs/development/python-modules/dunamai/default.nix
index 2ac7229c325b..3ee9866f98c5 100644
--- a/pkgs/development/python-modules/dunamai/default.nix
+++ b/pkgs/development/python-modules/dunamai/default.nix
@@ -12,8 +12,8 @@
 
 buildPythonPackage rec {
   pname = "dunamai";
-  version = "1.20.0";
-  format = "pyproject";
+  version = "1.21.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "mtkennerly";
     repo = "dunamai";
     rev = "refs/tags/v${version}";
-    hash = "sha256-K7G5BiUm8QTRbw0W3ebTld7CAZI8sYSnRsD7vQhCptE=";
+    hash = "sha256-dsL1MhlL1Yjj06D0z2FzZ53Frfp4U+5dXA9vPjU+pvY=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/dvc-azure/default.nix b/pkgs/development/python-modules/dvc-azure/default.nix
index f212889f2085..7aada9f9e75a 100644
--- a/pkgs/development/python-modules/dvc-azure/default.nix
+++ b/pkgs/development/python-modules/dvc-azure/default.nix
@@ -6,7 +6,6 @@
   dvc-objects,
   fetchPypi,
   knack,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-gs/default.nix b/pkgs/development/python-modules/dvc-gs/default.nix
index 235c6a8e5f8e..f457d2e1d3e8 100644
--- a/pkgs/development/python-modules/dvc-gs/default.nix
+++ b/pkgs/development/python-modules/dvc-gs/default.nix
@@ -4,7 +4,6 @@
   dvc-objects,
   fetchPypi,
   gcsfs,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
@@ -23,7 +22,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-http/default.nix b/pkgs/development/python-modules/dvc-http/default.nix
index e9eb01b5379e..ddd707736ae4 100644
--- a/pkgs/development/python-modules/dvc-http/default.nix
+++ b/pkgs/development/python-modules/dvc-http/default.nix
@@ -7,7 +7,6 @@
   fsspec,
   funcy,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
diff --git a/pkgs/development/python-modules/dvc-s3/default.nix b/pkgs/development/python-modules/dvc-s3/default.nix
index d85b3ecf9d52..eaed1006a500 100644
--- a/pkgs/development/python-modules/dvc-s3/default.nix
+++ b/pkgs/development/python-modules/dvc-s3/default.nix
@@ -6,7 +6,6 @@
   dvc-objects,
   fetchPypi,
   flatten-dict,
-  pythonRelaxDepsHook,
   s3fs,
   setuptools-scm,
 }:
@@ -31,13 +30,7 @@ buildPythonPackage rec {
       --replace-fail "aiobotocore[boto3]" "aiobotocore"
   '';
 
-  build-system = [
-    setuptools-scm
-  ];
-
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
+  build-system = [ setuptools-scm  ];
 
   dependencies = [
     aiobotocore
diff --git a/pkgs/development/python-modules/dvc-ssh/default.nix b/pkgs/development/python-modules/dvc-ssh/default.nix
index cba3ae243d17..3578e1b572eb 100644
--- a/pkgs/development/python-modules/dvc-ssh/default.nix
+++ b/pkgs/development/python-modules/dvc-ssh/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   dvc-objects,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools-scm,
   sshfs,
 }:
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index f9190e727a1d..85c817f2f4fc 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -36,7 +36,6 @@
   pygtrie,
   pyparsing,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   rich,
   ruamel-yaml,
@@ -58,7 +57,7 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.50.0";
+  version = "3.51.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -67,7 +66,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc";
     rev = "refs/tags/${version}";
-    hash = "sha256-/MvKWpJzKWLj1+y8nPMQiAwdktmQyJNM+s6ctYNk9u0=";
+    hash = "sha256-MjzunpPWzGfa62Jr+krEdm+i+N10QNmW7qRWaU/58OM=";
   };
 
   pythonRelaxDeps = [
@@ -84,7 +83,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies =
     [
diff --git a/pkgs/development/python-modules/e3-core/default.nix b/pkgs/development/python-modules/e3-core/default.nix
index fbcc39e88325..2701b845234e 100644
--- a/pkgs/development/python-modules/e3-core/default.nix
+++ b/pkgs/development/python-modules/e3-core/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "e3-core";
-  version = "22.4.0";
+  version = "22.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AdaCore";
     repo = "e3-core";
-    rev = "v${version}";
-    hash = "sha256-dgEk2/qRfAYwUz+e5TWKUy/aPLpmyWZ32OV1i7QM9Fs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-7csZYohU89uavSMPOKGJ8HClmtiweGSghyR7QgFfSY8=";
   };
 
   patches = [ ./0001-use-distro-over-ld.patch ];
diff --git a/pkgs/development/python-modules/elastic-apm/default.nix b/pkgs/development/python-modules/elastic-apm/default.nix
index 93fd450edfa4..113898825f5d 100644
--- a/pkgs/development/python-modules/elastic-apm/default.nix
+++ b/pkgs/development/python-modules/elastic-apm/default.nix
@@ -19,7 +19,6 @@
   pytest-random-order,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sanic,
   sanic-testing,
   setuptools,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/elasticsearch-dsl/default.nix b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
index 14eee9278f20..45476eaf0418 100644
--- a/pkgs/development/python-modules/elasticsearch-dsl/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch-dsl";
-  version = "8.13.1";
+  version = "8.14.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FTMFODQZp+5hulOG9P4iueIHMnmv75c01bWfXKtoL3o=";
+    sha256 = "sha256-MmxtzPMvH/PUyEiJOIWQd4REuhj3cK3uUvJHIcuXxMc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index 905a2e2daf44..e33c98782bb4 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch";
-  version = "8.13.0";
+  version = "8.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5Ovrsi0J8O+DnCa2qpjhnM1ja8t38IwStWKwLKzV50Q=";
+    sha256 = "sha256-qiSQAp3Zb0AVszPBgnqiH9bApNIjsA37D+kzuNCaURs=";
   };
 
   nativeBuildInputs = [ elastic-transport ];
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
index 3d073bb1e030..735496b67645 100644
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "email-validator";
-  version = "2.1.1";
+  version = "2.1.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "email_validator";
     inherit version;
-    hash = "sha256-IApwaAugiQS+bR7vcpIFzA1odjQ5mlkk2EJTPvuCS4Q=";
+    hash = "sha256-FMDz00PEvto3QAQhs5+kEbvjOnXfIIJd9zrVPgap8Ew=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/embedding-reader/default.nix b/pkgs/development/python-modules/embedding-reader/default.nix
index c49f6026d7e4..0f4d3c54a34b 100644
--- a/pkgs/development/python-modules/embedding-reader/default.nix
+++ b/pkgs/development/python-modules/embedding-reader/default.nix
@@ -7,7 +7,6 @@
   pandas,
   pyarrow,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -22,7 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-paN6rAyH3L7qCfWPr5kXo9Xl57gRMhdcDnoyLJ7II2w=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "pyarrow" ];
 
diff --git a/pkgs/development/python-modules/emborg/default.nix b/pkgs/development/python-modules/emborg/default.nix
index 572c73fb786a..5d244fb9a322 100644
--- a/pkgs/development/python-modules/emborg/default.nix
+++ b/pkgs/development/python-modules/emborg/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "emborg";
-  version = "1.38";
+  version = "1.39";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "KenKundert";
     repo = "emborg";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dK/6y1cjegomiy3fta2grUm4T0ZrylmstXfkJo4mDCE=";
+    hash = "sha256-DK98VAYSwN+UKuwwbd2O+gF2PDQPosbXo9D2Zrwe/yU=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/emoji/default.nix b/pkgs/development/python-modules/emoji/default.nix
index 994c90467bee..d6f1fd245931 100644
--- a/pkgs/development/python-modules/emoji/default.nix
+++ b/pkgs/development/python-modules/emoji/default.nix
@@ -2,14 +2,16 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
+  typing-extensions,
   pytestCheckHook,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "emoji";
-  version = "2.10.1";
-  format = "setuptools";
+  version = "2.12.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -17,9 +19,13 @@ buildPythonPackage rec {
     owner = "carpedm20";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-cCYZ+0IFHIR9++RfUbFTRMKYB9nC5dBaPMH6dSiAXK0=";
+    hash = "sha256-m9V9ryIE2U+KsyzFhAoMCGYMkPCBUl/ex1Ue5OUwslc=";
   };
 
+  build-system = [ setuptools ];
+
+  dependencies = [ typing-extensions ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [ "test_emojize_name_only" ];
diff --git a/pkgs/development/python-modules/es-client/default.nix b/pkgs/development/python-modules/es-client/default.nix
index 3204da1d5a97..ce5f362675bc 100644
--- a/pkgs/development/python-modules/es-client/default.nix
+++ b/pkgs/development/python-modules/es-client/default.nix
@@ -12,7 +12,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   six,
@@ -21,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "es-client";
-  version = "8.13.1";
+  version = "8.14.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,14 +29,13 @@ buildPythonPackage rec {
     owner = "untergeek";
     repo = "es_client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4v9SRWVG9p4kCob4C3by2JxNqX6L3yMHpbnMYEAM7A0=";
+    hash = "sha256-CJhiSDmIlhTWV7LLWd2ZCzuj5cWXwgh0lkKJvhmaDFw=";
   };
 
   pythonRelaxDeps = true;
 
   build-system = [ hatchling ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     certifi
diff --git a/pkgs/development/python-modules/evdev/default.nix b/pkgs/development/python-modules/evdev/default.nix
index 2824f5e821fe..bf3eee9692f1 100644
--- a/pkgs/development/python-modules/evdev/default.nix
+++ b/pkgs/development/python-modules/evdev/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "evdev";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lb0qHgxs4s16LsxubNlzb/eUs61ctU2B2MvC5BTQuHA=";
+    hash = "sha256-DHLDcL2inYV+GI2TEBnDJlGpweqXfAjI2TmxztFjf94=";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/evtx/default.nix b/pkgs/development/python-modules/evtx/default.nix
index 1f2cd6dfadcd..afa496973249 100644
--- a/pkgs/development/python-modules/evtx/default.nix
+++ b/pkgs/development/python-modules/evtx/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "evtx";
-  version = "0.8.2";
+  version = "0.8.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,13 +20,13 @@ buildPythonPackage rec {
     owner = "omerbenamram";
     repo = "pyevtx-rs";
     rev = "refs/tags/${version}";
-    hash = "sha256-t//oNvD+7wnv5KkriKBX4xgGS8pQpZgCsKxAEXsj0X8=";
+    hash = "sha256-s94KCUIJplrkMvFsFxPokTucB5TwVYD1xxcoJyvk5NU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-DPEL36cYNV5v4iW3+Fg1eEeuBuK9S7Qe78xOzZs8aJw=";
+    hash = "sha256-i16FNFbYrF2BONahLP7APMi9RPaLGmbnBH4hBPnHWzg=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index cb1577e1ed4f..7dc9c78852ea 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "exceptiongroup";
     rev = version;
-    hash = "sha256-iGeaRVJeFAWfJpwr7N4kST7d8YxpX3WgDqQemlR0cLU=";
+    hash = "sha256-87HmZsbsoV7QPHux50sYsFY2RaIc3627dH3WAwqXfQU=";
   };
 
   nativeBuildInputs = [ flit-scm ];
@@ -28,16 +28,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  disabledTests =
-    if pythonAtLeast "3.12" then
-      [
-        # https://github.com/agronholm/exceptiongroup/issues/116
-        "test_deep_split"
-        "test_deep_subgroup"
-      ]
-    else
-      null;
-
   pythonImportsCheck = [ "exceptiongroup" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/executing/default.nix b/pkgs/development/python-modules/executing/default.nix
index 7eb94f3b1348..6c225d2679f7 100644
--- a/pkgs/development/python-modules/executing/default.nix
+++ b/pkgs/development/python-modules/executing/default.nix
@@ -44,6 +44,11 @@ buildPythonPackage rec {
   disabledTests = [
     # requires ipython, which causes a circular dependency
     "test_two_statement_lookups"
+
+    # Asserts against time passed using time.time() to estimate
+    # if the test runs fast enough. That makes the test flaky when
+    # running on slow systems or cross- / emulated building
+    "test_many_source_for_filename_calls"
   ];
 
   pythonImportsCheck = [ "executing" ];
diff --git a/pkgs/development/python-modules/explorerscript/default.nix b/pkgs/development/python-modules/explorerscript/default.nix
index 9bc49b2ee682..391881204e29 100644
--- a/pkgs/development/python-modules/explorerscript/default.nix
+++ b/pkgs/development/python-modules/explorerscript/default.nix
@@ -7,7 +7,6 @@
   igraph,
   pygments,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     antlr4
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/extract-msg/default.nix b/pkgs/development/python-modules/extract-msg/default.nix
index c687ef3272f7..27faad2695ca 100644
--- a/pkgs/development/python-modules/extract-msg/default.nix
+++ b/pkgs/development/python-modules/extract-msg/default.nix
@@ -8,7 +8,6 @@
   olefile,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   red-black-tree-mod,
   rtfde,
   setuptools,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/extruct/default.nix b/pkgs/development/python-modules/extruct/default.nix
index f44f9443add9..f7ede7184112 100644
--- a/pkgs/development/python-modules/extruct/default.nix
+++ b/pkgs/development/python-modules/extruct/default.nix
@@ -10,7 +10,6 @@
   pyrdfa3,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   rdflib,
   setuptools,
   six,
diff --git a/pkgs/development/python-modules/fairseq/default.nix b/pkgs/development/python-modules/fairseq/default.nix
index e0634af26f20..5cea23e2bda6 100644
--- a/pkgs/development/python-modules/fairseq/default.nix
+++ b/pkgs/development/python-modules/fairseq/default.nix
@@ -7,7 +7,6 @@
 
   # Native build inputs
   cython,
-  pythonRelaxDepsHook,
   which,
 
   # Propagated build inputs
@@ -53,7 +52,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cython
-    pythonRelaxDepsHook
     which
   ];
 
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index 9f01cc2ed4f5..babcc2423d35 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "faker";
-  version = "24.11.0";
+  version = "25.8.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "Faker";
     inherit version;
-    hash = "sha256-NLlHWBwrztNAw5s1+J2/rE81aTLP/4/ok73oVJA/Dm4=";
+    hash = "sha256-vexfL7BX0kTr724O0xj+pNy98yw6GgEHZvxF9daPxo0=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/farm-haystack/default.nix b/pkgs/development/python-modules/farm-haystack/default.nix
index 14c563918964..f2139a61bc25 100644
--- a/pkgs/development/python-modules/farm-haystack/default.nix
+++ b/pkgs/development/python-modules/farm-haystack/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   hatchling,
   boilerpy3,
   events,
@@ -92,19 +91,18 @@
 
 buildPythonPackage rec {
   pname = "farm-haystack";
-  version = "1.25.0";
+  version = "2.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "deepset-ai";
     repo = "haystack";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lAXzWnHpOBVjgleFTYqlZ34hmZkcrPJ/h1kk4iVVvec=";
+    hash = "sha256-vaZ8bn36Eezf3/SnJ6ao0CvFZaHrpgbX+nM0IOqG2oo=";
   };
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/fastapi-cli/default.nix b/pkgs/development/python-modules/fastapi-cli/default.nix
new file mode 100644
index 000000000000..f717ccee0428
--- /dev/null
+++ b/pkgs/development/python-modules/fastapi-cli/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pdm-backend
+, typer
+, fastapi
+, uvicorn
+
+# checks
+, pytestCheckHook
+, rich
+}:
+
+let self = buildPythonPackage rec {
+  pname = "fastapi-cli";
+  version = "0.0.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tiangolo";
+    repo = "fastapi-cli";
+    rev = version;
+    hash = "sha256-eWvZn7ZeLnQZAvGOzY77o6oO5y+QV2cx+peBov9YpJE=";
+  };
+
+  build-system = [ pdm-backend ];
+
+  dependencies = [ typer ];
+
+  optional-dependencies = {
+    standard = [
+      fastapi
+      uvicorn
+    ];
+  };
+
+  doCheck = false;
+
+  passthru.tests.pytest = self.overridePythonAttrs { doCheck = true; };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    rich
+  ] ++ optional-dependencies.standard;
+
+  # coverage
+  disabledTests = [ "test_script" ];
+
+  pythonImportsCheck = [ "fastapi_cli" ];
+
+  meta = with lib; {
+    description = "Run and manage FastAPI apps from the command line with FastAPI CLI";
+    homepage = "https://github.com/tiangolo/fastapi-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+};
+in self
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index a39604d71497..83f0eb95438a 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -3,12 +3,12 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build-system
-  hatchling,
+  pdm-backend,
 
   # dependencies
+  fastapi-cli,
   starlette,
   pydantic,
   typing-extensions,
@@ -39,7 +39,7 @@
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.110.2";
+  version = "0.111.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -48,27 +48,24 @@ buildPythonPackage rec {
     owner = "tiangolo";
     repo = "fastapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-qUh5exkXVRcKIO0t4KIOZhhpsftj3BrWaL2asf8RqUI=";
+    hash = "sha256-DQYjK1dZuL7cF6quyNkgdd/GYmWm7k6YlF7YEjObQlI=";
   };
 
-  nativeBuildInputs = [
-    hatchling
-    pythonRelaxDepsHook
-  ];
+  build-system = [ pdm-backend ];
 
   pythonRelaxDeps = [
     "anyio"
-    # https://github.com/tiangolo/fastapi/pull/9636
     "starlette"
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
+    fastapi-cli
     starlette
     pydantic
     typing-extensions
   ];
 
-  passthru.optional-dependencies.all =
+  optional-dependencies.all =
     [
       httpx
       jinja2
@@ -95,7 +92,7 @@ buildPythonPackage rec {
     python-jose
     trio
     sqlalchemy
-  ] ++ passthru.optional-dependencies.all ++ python-jose.optional-dependencies.cryptography;
+  ] ++ optional-dependencies.all ++ python-jose.optional-dependencies.cryptography;
 
   pytestFlagsArray = [
     # ignoring deprecation warnings to avoid test failure from
diff --git a/pkgs/development/python-modules/fastembed/default.nix b/pkgs/development/python-modules/fastembed/default.nix
index f55f8a78ac24..2767700af20b 100644
--- a/pkgs/development/python-modules/fastembed/default.nix
+++ b/pkgs/development/python-modules/fastembed/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build-system
   poetry-core,
@@ -39,7 +38,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     huggingface-hub
diff --git a/pkgs/development/python-modules/faster-whisper/default.nix b/pkgs/development/python-modules/faster-whisper/default.nix
index 9c02e6beee36..8dff7f5a3944 100644
--- a/pkgs/development/python-modules/faster-whisper/default.nix
+++ b/pkgs/development/python-modules/faster-whisper/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "tokenizers" ];
diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index bc17b09b7995..7edfa503f2e9 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "3.13.4";
+  version = "3.15.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0T9GZhi/3nK9LBglXiafclQsbnDnusg6AjLWscxcjPQ=";
+    hash = "sha256-WKJUmv354C4Qcg6qTURw9WOG16b3Lt19BZYzevjtetg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/finvizfinance/default.nix b/pkgs/development/python-modules/finvizfinance/default.nix
index ce85324c561e..9d09ace0f578 100644
--- a/pkgs/development/python-modules/finvizfinance/default.nix
+++ b/pkgs/development/python-modules/finvizfinance/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "finvizfinance";
-  version = "0.14.7";
+  version = "1.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "lit26";
     repo = "finvizfinance";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ht1bez04MAgugsQqa47q2ED7z8xpiXmzkOYBR7/PZHU=";
+    hash = "sha256-cdQdpQWPnMJ69VxOrn8SvNWTRcGt3S/PwoClGO9uh5I=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/fire/default.nix b/pkgs/development/python-modules/fire/default.nix
index 5cce963a2dfc..05a94d1f2dc3 100644
--- a/pkgs/development/python-modules/fire/default.nix
+++ b/pkgs/development/python-modules/fire/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
+  setuptools,
   six,
   hypothesis,
   mock,
@@ -14,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "fire";
-  version = "0.5.0";
-  format = "setuptools";
+  version = "0.6.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -23,19 +23,12 @@ buildPythonPackage rec {
     owner = "google";
     repo = "python-fire";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cwY1RRNtpAn6LnBASQLTNf4XXSPnfhOa1WgglGEM2/s=";
+    hash = "sha256-tBmsy0MuJu0Ei+4lUy/XfKoOU+OuH4xqmjPv/uKVuwg=";
   };
 
-  patches = [
-    # https://github.com/google/python-fire/pull/440
-    (fetchpatch {
-      name = "remove-asyncio-coroutine.patch";
-      url = "https://github.com/google/python-fire/pull/440/commits/30b775a7b36ce7fbc04656c7eec4809f99d3e178.patch";
-      hash = "sha256-GDAAlvZKbJl3OhajsEO0SZvWIXcPDi3eNKKVgbwSNKk=";
-    })
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     six
     termcolor
   ];
diff --git a/pkgs/development/python-modules/firebase-messaging/default.nix b/pkgs/development/python-modules/firebase-messaging/default.nix
index ed630616db8b..dc9bee90b3cb 100644
--- a/pkgs/development/python-modules/firebase-messaging/default.nix
+++ b/pkgs/development/python-modules/firebase-messaging/default.nix
@@ -1,5 +1,7 @@
 {
   lib,
+  aiohttp,
+  aioresponses,
   async-timeout,
   buildPythonPackage,
   cryptography,
@@ -9,9 +11,9 @@
   protobuf,
   pytest-asyncio,
   pytest-mock,
+  pytest-socket,
   pytestCheckHook,
   pythonOlder,
-  requests,
   requests-mock,
   sphinx,
   sphinx-autodoc-typehints,
@@ -21,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "firebase-messaging";
-  version = "0.2.1";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,7 +32,7 @@ buildPythonPackage rec {
     owner = "sdb9696";
     repo = "firebase-messaging";
     rev = "refs/tags/${version}";
-    hash = "sha256-8e+S12ZMqAmK7OR7O45QsRa0UKQq6cngeaqz2ugi6iY=";
+    hash = "sha256-pZpnekJ11yx3L8l56vZOa4uS+jJMxUkYODgNAqysVeY=";
   };
 
   outputs = [
@@ -44,10 +46,10 @@ buildPythonPackage rec {
   ] ++ passthru.optional-dependencies.docs;
 
   propagatedBuildInputs = [
+    aiohttp
     cryptography
     http-ece
     protobuf
-    requests
   ];
 
   passthru.optional-dependencies = {
@@ -61,10 +63,12 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "firebase_messaging" ];
 
   nativeCheckInputs = [
+    aioresponses
     async-timeout
     requests-mock
     pytest-asyncio
     pytest-mock
+    pytest-socket
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/flake8/default.nix b/pkgs/development/python-modules/flake8/default.nix
index 3d2938f9e6fd..8fa7a8fa99a9 100644
--- a/pkgs/development/python-modules/flake8/default.nix
+++ b/pkgs/development/python-modules/flake8/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "flake8";
-  version = "7.0.0";
+  version = "7.1.0";
 
   disabled = pythonOlder "3.8";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = "flake8";
     rev = version;
-    hash = "sha256-2oVvchDhH3cX90RTIquYLyr+rzHxzQgYA4k4ReTxpH8=";
+    hash = "sha256-jkRr/k/XjiKOkcd4jlOQTnnFun7/hMHdVUWBlS1QZ1E=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/flask-appbuilder/default.nix b/pkgs/development/python-modules/flask-appbuilder/default.nix
index e6d6231a25ca..b35020f88ee2 100644
--- a/pkgs/development/python-modules/flask-appbuilder/default.nix
+++ b/pkgs/development/python-modules/flask-appbuilder/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "flask-appbuilder";
-  version = "4.4.1";
+  version = "4.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Flask-AppBuilder";
     inherit version;
-    hash = "sha256-pk1MO1GXVHdEx8QffrD+Aga6Fnc2nOR5A90Iw8m3U70=";
+    hash = "sha256-CoQ5/pOR1xy71koUm1uwTJDLTDROTjJQMW9ZcgtzV50=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-caching/default.nix b/pkgs/development/python-modules/flask-caching/default.nix
index d21d3cedd4df..e679bf16e8eb 100644
--- a/pkgs/development/python-modules/flask-caching/default.nix
+++ b/pkgs/development/python-modules/flask-caching/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "flask-caching";
-  version = "2.1.0";
+  version = "2.3.0";
   format = "setuptools";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    pname = "Flask-Caching";
+    pname = "flask_caching";
     inherit version;
-    hash = "sha256-t1AMFFE1g2qVLj3jqAiB2WVOMnopyFLJJlYH9cRJI1w=";
+    hash = "sha256-1+TKZKM7Sf6zOfzdF+a6JfXgEWjPiF5TeQ6IX4Ok0s8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
index 9af0d44166f6..2456aa9ab52a 100644
--- a/pkgs/development/python-modules/flask-cors/default.nix
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "flask-cors";
-  version = "4.0.0";
+  version = "4.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "corydolphin";
     repo = "flask-cors";
     rev = "refs/tags/${version}";
-    hash = "sha256-o//ulROKKBv/CBJIGPBFP/+T0TpMHUVjr23Y5g1V05g=";
+    hash = "sha256-ISot5KglCjfbJNsnveDLK44vVaapHRAFdS+1tOd08pw=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/flask-login/default.nix b/pkgs/development/python-modules/flask-login/default.nix
index 6f6f60c84cab..ce9da8b158dc 100644
--- a/pkgs/development/python-modules/flask-login/default.nix
+++ b/pkgs/development/python-modules/flask-login/default.nix
@@ -1,11 +1,11 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pythonOlder,
 
   # build-system
-  setuptools,
+  flit-core,
 
   # dependencies
   flask,
@@ -20,20 +20,21 @@
 
 buildPythonPackage rec {
   pname = "flask-login";
-  version = "0.6.3";
+  version = "0.7.0dev0-2024-06-18";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    pname = "Flask-Login";
-    inherit version;
-    hash = "sha256-XiPRSmB+8SgGxplZC4nQ8ODWe67sWZ11lHv5wUczAzM=";
+  src = fetchFromGitHub {
+    owner = "maxcountryman";
+    repo = "flask-login";
+    rev = "30675c56b651389d47b47eeb1ad114decb35b8fc";
+    hash = "sha256-mIEYZnYWerjCetQuV2HRcmerMh2uLWNvHV7tfo5j4PU=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     flask
     werkzeug
   ];
diff --git a/pkgs/development/python-modules/flask-mailman/default.nix b/pkgs/development/python-modules/flask-mailman/default.nix
index 5727fd016da0..2403e436266e 100644
--- a/pkgs/development/python-modules/flask-mailman/default.nix
+++ b/pkgs/development/python-modules/flask-mailman/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "flask-mailman";
-  version = "1.0.0";
+  version = "1.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "waynerv";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-wfbMz9k9cy9m95mc0Y0lqmpJczrfjhmumO31gRQy704=";
+    hash = "sha256-2ll5+D35dQN3r7gDpY1iSOuJBlqMorhjhFohPug8GK8=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/flask-openid/default.nix b/pkgs/development/python-modules/flask-openid/default.nix
index 9c27a483f64b..6fbcb0b29c8d 100644
--- a/pkgs/development/python-modules/flask-openid/default.nix
+++ b/pkgs/development/python-modules/flask-openid/default.nix
@@ -2,23 +2,25 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   flask,
   python3-openid,
-  isPy3k,
 }:
 
 buildPythonPackage rec {
   pname = "flask-openid";
-  version = "1.3.0";
-  format = "setuptools";
+  version = "1.3.1";
+  pyproject = true;
 
   src = fetchPypi {
-    pname = "Flask-OpenID";
+    pname = "flask_openid";
     inherit version;
-    sha256 = "539289ed2d19af61ae38d8fe46aec9e4de2b56f9f8b46da0b98c0d387f1d975a";
+    hash = "sha256-J2KLwKN+ZTCUiCMZPgaNeQNa2Ulth7dAQEQ+xITHZXo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     flask
     python3-openid
   ];
diff --git a/pkgs/development/python-modules/flask-session/default.nix b/pkgs/development/python-modules/flask-session/default.nix
index c781ba6e01c1..dcfb8bfe4a36 100644
--- a/pkgs/development/python-modules/flask-session/default.nix
+++ b/pkgs/development/python-modules/flask-session/default.nix
@@ -2,39 +2,70 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
+
+  # build-system
   flit-core,
+
+  # dependencies
   flask,
   cachelib,
+  msgspec,
+
+  # checks
+  boto3,
+  flask-sqlalchemy,
   pytestCheckHook,
+  redis,
+  pymongo,
+  pymemcache,
+  python-memcached,
+  pkgs,
 }:
 
 buildPythonPackage rec {
   pname = "flask-session";
-  version = "0.5.0";
-  format = "pyproject";
+  version = "0.8.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pallets-eco";
     repo = "flask-session";
     rev = "refs/tags/${version}";
-    hash = "sha256-t8w6ZS4gBDpnnKvL3DLtn+rRLQNJbrT2Hxm4f3+a3Xc=";
+    hash = "sha256-QLtsM0MFgZbuLJPLc5/mUwyYc3bYxildNKNxOF8Z/3Y=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [
-    flask
+  dependencies = [
     cachelib
+    flask
+    msgspec
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  # The rest of the tests require database servers and optional db connector dependencies
-  pytestFlagsArray = [
-    "-k"
-    "'null_session or filesystem_session'"
+  nativeCheckInputs = [
+    flask-sqlalchemy
+    pytestCheckHook
+    redis
+    pymongo
+    pymemcache
+    python-memcached
+    boto3
   ];
 
+  preCheck = ''
+    ${pkgs.redis}/bin/redis-server &
+    ${pkgs.memcached}/bin/memcached &
+  '';
+
+  postCheck = ''
+    kill %%
+    kill %%
+  '';
+
+  disabledTests = [ "test_mongo_default" ]; # unfree
+
+  disabledTestPaths = [ "tests/test_dynamodb.py" ];
+
   pythonImportsCheck = [ "flask_session" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/flax/default.nix b/pkgs/development/python-modules/flax/default.nix
index 955177b9bbca..c176c825943c 100644
--- a/pkgs/development/python-modules/flax/default.nix
+++ b/pkgs/development/python-modules/flax/default.nix
@@ -6,7 +6,6 @@
 
   # build-system
   jaxlib,
-  pythonRelaxDepsHook,
   setuptools-scm,
 
   # dependencies
@@ -48,7 +47,6 @@ buildPythonPackage rec {
 
   build-system = [
     jaxlib
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/flet-runtime/default.nix b/pkgs/development/python-modules/flet-runtime/default.nix
index 323e93e43ee1..d9679fdc4f45 100644
--- a/pkgs/development/python-modules/flet-runtime/default.nix
+++ b/pkgs/development/python-modules/flet-runtime/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   flet-client-flutter,
   poetry-core,
-  pythonRelaxDepsHook,
   flet-core,
   httpx,
   oauthlib,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "httpx" ];
diff --git a/pkgs/development/python-modules/flet/default.nix b/pkgs/development/python-modules/flet/default.nix
index c448c11c7e55..7857ff562737 100644
--- a/pkgs/development/python-modules/flet/default.nix
+++ b/pkgs/development/python-modules/flet/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   flet-client-flutter,
-  pythonRelaxDepsHook,
 
   # build-system
   poetry-core,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   makeWrapperArgs = [
diff --git a/pkgs/development/python-modules/flexcache/default.nix b/pkgs/development/python-modules/flexcache/default.nix
index 1442940ca199..a15801505ca9 100644
--- a/pkgs/development/python-modules/flexcache/default.nix
+++ b/pkgs/development/python-modules/flexcache/default.nix
@@ -2,9 +2,19 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
   setuptools-scm,
+  wheel,
+
+  # dependencies
   typing-extensions,
+
+  # checks
   pytestCheckHook,
+  pytest-mpl,
+  pytest-subtests,
 }:
 
 buildPythonPackage rec {
@@ -15,23 +25,31 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "hgrecco";
     repo = "flexcache";
-    rev = "refs/tags/${version}";
+    rev = version;
     hash = "sha256-MAbTe7NxzfRPzo/Wnb5SnPJvJWf6zVeYsaw/g9OJYSE=";
   };
 
-  build-system = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
 
   dependencies = [ typing-extensions ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mpl
+    pytest-subtests
+  ];
 
   pythonImportsCheck = [ "flexcache" ];
 
-  meta = {
+  meta = with lib; {
     description = "An robust and extensible package to cache on disk the result of expensive calculations";
     homepage = "https://github.com/hgrecco/flexcache";
     changelog = "https://github.com/hgrecco/flexcache/blob/${src.rev}/CHANGES";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ doronbehar ];
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ doronbehar ];
   };
 }
diff --git a/pkgs/development/python-modules/flexparser/default.nix b/pkgs/development/python-modules/flexparser/default.nix
index b0ec855ed229..60ab74a5546e 100644
--- a/pkgs/development/python-modules/flexparser/default.nix
+++ b/pkgs/development/python-modules/flexparser/default.nix
@@ -2,9 +2,19 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
   setuptools-scm,
+  wheel,
+
+  # dependencies
   typing-extensions,
+
+  # checks
   pytestCheckHook,
+  pytest-mpl,
+  pytest-subtests,
 }:
 
 buildPythonPackage rec {
@@ -15,23 +25,31 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "hgrecco";
     repo = "flexparser";
-    rev = "refs/tags/${version}";
+    rev = version;
     hash = "sha256-9ImG8uh1SZ+pAbqzWBkTVn+3EBAGzzdP8vqqP59IgIw=";
   };
 
-  build-system = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
 
-  dependencies = [ typing-extensions ];
+  propagatedBuildInputs = [ typing-extensions ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mpl
+    pytest-subtests
+  ];
 
   pythonImportsCheck = [ "flexparser" ];
 
-  meta = {
+  meta = with lib; {
     description = "Parsing made fun ... using typing";
     homepage = "https://github.com/hgrecco/flexparser";
     changelog = "https://github.com/hgrecco/flexparser/blob/${src.rev}/CHANGES";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ doronbehar ];
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ doronbehar ];
   };
 }
diff --git a/pkgs/development/python-modules/fluent-logger/default.nix b/pkgs/development/python-modules/fluent-logger/default.nix
index 4314bc737779..320cb1343f46 100644
--- a/pkgs/development/python-modules/fluent-logger/default.nix
+++ b/pkgs/development/python-modules/fluent-logger/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "fluent-logger";
-  version = "0.11.0";
+  version = "0.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-logger-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PfyjJZT5K/IMsyyWNZdh/CZf+uZHeJGfhyAPuu0IhJk=";
+    hash = "sha256-i6S5S2ZUwC5gQPdVjefUXrKj43iLIqxd8tdXbMBJNnA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/flufl/bounce.nix b/pkgs/development/python-modules/flufl/bounce.nix
index f331c0705cd2..b514947d8e3b 100644
--- a/pkgs/development/python-modules/flufl/bounce.nix
+++ b/pkgs/development/python-modules/flufl/bounce.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  fetchpatch2,
   setuptools,
   atpublic,
   zope-interface,
@@ -19,6 +20,14 @@ buildPythonPackage rec {
     hash = "sha256-JVBK65duwP5aGc1sQTo0EMtRT9zb3Kn5tdjTQ6hgODE=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # Replace deprecated failIf with assertFalse for Python 3.12 compatibility.
+      url = "https://gitlab.com/warsaw/flufl.bounce/-/commit/e0b9fd0f24572e024a8d0484a3c9fb4542337d18.patch";
+      hash = "sha256-HJHEbRVjiiP5Z7W0sQCj6elUMyaWOTqQw6UpYOYCVZM=";
+    })
+  ];
+
   nativeBuildInputs = [ setuptools ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/folium/default.nix b/pkgs/development/python-modules/folium/default.nix
index 619a6c1f6a43..ccc8a300095c 100644
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "folium";
-  version = "0.16.0";
+  version = "0.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "python-visualization";
     repo = "folium";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ADDqjZUQVI4K/Bf38905g1K9TD2/e1RYvYWddvFtdrU=";
+    hash = "sha256-uKT6WqT3pI3rqfV/3CA+mXBk3F7h4RWW1h2FPIy0JH4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fontbakery/default.nix b/pkgs/development/python-modules/fontbakery/default.nix
index d98575536419..5d0f5d6dcaef 100644
--- a/pkgs/development/python-modules/fontbakery/default.nix
+++ b/pkgs/development/python-modules/fontbakery/default.nix
@@ -29,7 +29,6 @@
   protobuf,
   pytestCheckHook,
   pytest-xdist,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   requests-mock,
@@ -47,11 +46,11 @@
 
 buildPythonPackage rec {
   pname = "fontbakery";
-  version = "0.12.5";
+  version = "0.12.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DN1v5MQtMhHO12tVPkJUuIfh+X3kb1o71zAwNgtLH+I=";
+    hash = "sha256-7cZeazEyAyU+WDop2n7wneg2wzh+9U9atKSRcreJpGw=";
   };
 
   pyproject = true;
@@ -96,7 +95,6 @@ buildPythonPackage rec {
   ];
   nativeBuildInputs = [
     installShellFiles
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index 1f7e3f04d050..419124aea28c 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "fonttools";
-  version = "4.51.0";
+  version = "4.53.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-JUAFGLjyq/2OXlhTB6dIcO3Mq7Rx1HII+sg2TaQfPYU=";
+    hash = "sha256-eWN5QcdiQIDfjn7Hrqk0f5jMaADpqNa/kExncjcWXFw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fpdf2/default.nix b/pkgs/development/python-modules/fpdf2/default.nix
index 378798f5ea9b..2cd654ded25a 100644
--- a/pkgs/development/python-modules/fpdf2/default.nix
+++ b/pkgs/development/python-modules/fpdf2/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "fpdf2";
-  version = "2.7.8";
+  version = "2.7.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "py-pdf";
     repo = "fpdf2";
     rev = "refs/tags/${version}";
-    hash = "sha256-6aedXr8Yhes1aYIslBvw2HzRc4BwYDIiGJvEdp1tFSc=";
+    hash = "sha256-8CuK8ZFn4msOSNIdgOFjD3ygVeiBUw4/Bc3w1J6Kn9U=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/freebox-api/default.nix b/pkgs/development/python-modules/freebox-api/default.nix
index a5fa4fe5746f..ec5df3641737 100644
--- a/pkgs/development/python-modules/freebox-api/default.nix
+++ b/pkgs/development/python-modules/freebox-api/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   urllib3,
 }:
 
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "urllib3" ];
diff --git a/pkgs/development/python-modules/freezegun/default.nix b/pkgs/development/python-modules/freezegun/default.nix
index ab170e3ee916..cc15733d053b 100644
--- a/pkgs/development/python-modules/freezegun/default.nix
+++ b/pkgs/development/python-modules/freezegun/default.nix
@@ -4,20 +4,21 @@
   fetchPypi,
   pytestCheckHook,
   python-dateutil,
+  pythonAtLeast,
   pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "freezegun";
-  version = "1.4.0";
+  version = "1.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EJObC6D/Wtrs87BqXC9zBx2WeOUHxertsjx2HVasd0s=";
+    hash = "sha256-sp3t/NptXo4IPOcbK1QnU61Iz+xEA3s/x5cC4pgKiek=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -26,6 +27,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.13") [
+    # https://github.com/spulec/freezegun/issues/547
+    "test_method_decorator_works_on_unittest_kwarg_frozen_time"
+    "test_method_decorator_works_on_unittest_kwarg_frozen_time_with_func"
+    "test_method_decorator_works_on_unittest_kwarg_hello"
+  ];
+
   pythonImportsCheck = [ "freezegun" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/freud/default.nix b/pkgs/development/python-modules/freud/default.nix
index e5b776734367..49a25ed500e3 100644
--- a/pkgs/development/python-modules/freud/default.nix
+++ b/pkgs/development/python-modules/freud/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "freud";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "glotzerlab";
     repo = "freud";
-    rev = "v${version}";
-    hash = "sha256-aKh2Gub1vU/wzvWkCl8yzlIswp8CtR975USiCr6ijUI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-jlscEHQ1q4oqxE06NhVWCOlPRcjDcJVrvy4h6iYrkz0=";
     fetchSubmodules = true;
   };
   # Because we prefer to not `leaveDotGit`, we need to fool upstream into
diff --git a/pkgs/development/python-modules/furl/default.nix b/pkgs/development/python-modules/furl/default.nix
index fb9e9b620663..4b4f81d1a2aa 100644
--- a/pkgs/development/python-modules/furl/default.nix
+++ b/pkgs/development/python-modules/furl/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  pythonAtLeast,
   flake8,
   orderedmultidict,
   pytestCheckHook,
@@ -35,6 +36,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # AssertionError: assert '//////path' == '////path'
+    "test_odd_urls"
+  ];
+
   pythonImportsCheck = [ "furl" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/furo/default.nix b/pkgs/development/python-modules/furo/default.nix
index 190f54481679..26eab2292967 100644
--- a/pkgs/development/python-modules/furo/default.nix
+++ b/pkgs/development/python-modules/furo/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  pythonRelaxDepsHook,
   sphinx,
   beautifulsoup4,
   sphinx-basic-ng,
@@ -11,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "furo";
-  version = "2024.1.29";
+  version = "2024.5.6";
   format = "wheel";
 
   disabled = pythonOlder "3.8";
@@ -20,10 +19,9 @@ buildPythonPackage rec {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-NUi+LO9Foy+M3AJy1BX8s+X6ag603f4h3z7PH+RaE88=";
+    hash = "sha256-SQoA0IwKN+zJDeA66SJ+jrXW9/dQ7fmAfzmKK98jWN4=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "sphinx" ];
 
diff --git a/pkgs/development/python-modules/galois/default.nix b/pkgs/development/python-modules/galois/default.nix
index a11a9d0fabe4..ace8f66e14ea 100644
--- a/pkgs/development/python-modules/galois/default.nix
+++ b/pkgs/development/python-modules/galois/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   setuptools-scm,
   pythonOlder,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   pytestCheckHook,
   pytest-xdist,
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/garth/default.nix b/pkgs/development/python-modules/garth/default.nix
index 16bd5bb9085d..5ab18ebb6905 100644
--- a/pkgs/development/python-modules/garth/default.nix
+++ b/pkgs/development/python-modules/garth/default.nix
@@ -23,6 +23,8 @@ buildPythonPackage rec {
     hash = "sha256-WuGeZ2EggyhbEDIbjg4ffIFaj2DyHi8Tvowhoi5k2Os=";
   };
 
+  pythonRelaxDeps = [ "requests-oauthlib" ];
+
   build-system = [ pdm-backend ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/gbulb/default.nix b/pkgs/development/python-modules/gbulb/default.nix
index 3dba75d253f5..4c192b43f666 100644
--- a/pkgs/development/python-modules/gbulb/default.nix
+++ b/pkgs/development/python-modules/gbulb/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "gbulb";
-  version = "0.6.4";
+  version = "0.6.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "beeware";
     repo = "gbulb";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AdZSvxix0cpoFQSrslGl+hB/s6Nh0EsWMQmXZAJVJOg=";
+    hash = "sha256-03Ott+V3Y4+Y72Llsug5coqG3C+pjAdLkPYbaY/6Uow=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gcal-sync/default.nix b/pkgs/development/python-modules/gcal-sync/default.nix
index 95b6db3b9a29..2c42a1008ad1 100644
--- a/pkgs/development/python-modules/gcal-sync/default.nix
+++ b/pkgs/development/python-modules/gcal-sync/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "gcal-sync";
-  version = "6.1.0";
+  version = "6.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "gcal_sync";
     rev = "refs/tags/${version}";
-    hash = "sha256-mZn/3oROIUSv6cCxXs3rBJtlmKsqNflTW2pcER8GisE=";
+    hash = "sha256-aKLuv/hH9ZVM8WeUwCtJ6BB2/aQh6NHJKh890hR23eM=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix b/pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix
index 9d93efe8897d..87f9e361feaa 100644
--- a/pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix
+++ b/pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix
@@ -11,7 +11,6 @@
   pyopenssl,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   retry-decorator,
   rsa,
   six,
diff --git a/pkgs/development/python-modules/gekko/default.nix b/pkgs/development/python-modules/gekko/default.nix
index d62c1f3dbfd1..1fb6123f0133 100644
--- a/pkgs/development/python-modules/gekko/default.nix
+++ b/pkgs/development/python-modules/gekko/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "gekko";
-  version = "1.1.1";
+  version = "1.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xc6NfPCvkEYjUG82QmFqDuu02QNwKfoS6DDpkdaMWJ8=";
+    hash = "sha256-JN7CWOR7CcWzmKDNlUXm/6ilrTJ3vLa8h2TNnmALhfk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/genshi/default.nix b/pkgs/development/python-modules/genshi/default.nix
index 218904113c07..78ee38cfa32a 100644
--- a/pkgs/development/python-modules/genshi/default.nix
+++ b/pkgs/development/python-modules/genshi/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "genshi";
-  version = "0.7.7";
+  version = "0.7.9";
 
   src = fetchPypi {
     pname = "Genshi";
     inherit version;
-    hash = "sha256-wQBSCGLNaQhdEO4ah+kSief1n2s9m9Yiv1iygE5rmqs=";
+    hash = "sha256-x2FwqLLcGJROCRUQPChMuInfzuNODhQLozY8gPdUGtI=";
   };
 
   # FAIL: test_sanitize_remove_script_elem (genshi.filters.tests.html.HTMLSanitizerTestCase)
diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 53c56b2d7b69..058f241d37d7 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -5,7 +5,6 @@
   protobuf,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-scm,
   uharfbuzz,
@@ -39,7 +38,6 @@ buildPythonPackage rec {
   dependencies = [ protobuf ];
 
   nativeCheckInputs = [
-    pythonRelaxDepsHook
     pytestCheckHook
     uharfbuzz
     youseedee
diff --git a/pkgs/development/python-modules/gfsubsets/default.nix b/pkgs/development/python-modules/gfsubsets/default.nix
index 33dca6d3a858..ff2db29a1eb2 100644
--- a/pkgs/development/python-modules/gfsubsets/default.nix
+++ b/pkgs/development/python-modules/gfsubsets/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "gfsubsets";
-  version = "2024.2.5";
+  version = "2024.5.9";
   gitTag = "v2024.02.05";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-g9QxLa3B1MMTs+jmj4CyJySZRU0zoFNYdbOZwHjKPaQ=";
+    hash = "sha256-OgpdcOJWX0o0Hy6LjRsxsZMAVWgKziM+bqe/FfJniZY=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/gitdb/default.nix b/pkgs/development/python-modules/gitdb/default.nix
index 838e0679c74c..422b7b52c3c5 100644
--- a/pkgs/development/python-modules/gitdb/default.nix
+++ b/pkgs/development/python-modules/gitdb/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   smmap,
 }:
@@ -23,7 +22,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "smmap" ];
diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index fe14c80356ae..85e581200fde 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -11,13 +11,12 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "githubkit";
-  version = "0.11.5";
+  version = "0.11.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +25,7 @@ buildPythonPackage rec {
     owner = "yanyongyu";
     repo = "githubkit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YlI5NEfZD+9I2Ikd/LyEq+MnsdYixi+UVNUP8mfFKc8=";
+    hash = "sha256-bcQUms4nZ4BUowcF3YxTQPc6Ts6VoRumEA0DuCPQpfg=";
   };
 
   postPatch = ''
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     hishel
diff --git a/pkgs/development/python-modules/glueviz/default.nix b/pkgs/development/python-modules/glueviz/default.nix
index 98a8248333a6..1db27a1d7282 100644
--- a/pkgs/development/python-modules/glueviz/default.nix
+++ b/pkgs/development/python-modules/glueviz/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "glueviz";
-  version = "1.17.1";
+  version = "1.21.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "glue-viz";
     repo = "glue";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-nr84GJAGnpKzjZEFNsQujPysSQENwGxdNfPIYUCJkK4=";
+    sha256 = "sha256-C9UqDdhPcaznidiDlQO27Vgct2MT9gVlH740hoYg3Bc=";
   };
 
   buildInputs = [ pyqt-builder ];
diff --git a/pkgs/development/python-modules/glyphsets/default.nix b/pkgs/development/python-modules/glyphsets/default.nix
index 2792bec5c3ed..e918de58ae85 100644
--- a/pkgs/development/python-modules/glyphsets/default.nix
+++ b/pkgs/development/python-modules/glyphsets/default.nix
@@ -24,6 +24,16 @@ buildPythonPackage rec {
     hash = "sha256-fa+W1IGIZcn1P1xNKm1Yb/TOuf4QdDVnIvlDkOLOcLY=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "setuptools_scm>=8.0.4,<8.1" "setuptools_scm"
+  '';
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
   dependencies = [
     defcon
     fonttools
@@ -31,16 +41,15 @@ buildPythonPackage rec {
     glyphslib
     pyyaml
     requests
-    setuptools
     unicodedata2
   ];
-  build-system = [ setuptools-scm ];
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
+
   preCheck = ''
     export PATH="$out/bin:$PATH"
   '';
+
   disabledTests = [
     # This "test" just tries to connect to PyPI and look for newer releases. Not needed.
     "test_dependencies"
diff --git a/pkgs/development/python-modules/gnureadline/default.nix b/pkgs/development/python-modules/gnureadline/default.nix
index 17f14f488944..f0db91f45cc0 100644
--- a/pkgs/development/python-modules/gnureadline/default.nix
+++ b/pkgs/development/python-modules/gnureadline/default.nix
@@ -7,14 +7,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "8.1.2";
+  version = "8.2.10";
   format = "setuptools";
   pname = "gnureadline";
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QmKmqjVqsi72QvQ6f5TrQqctbwxTLttOjGuTP1cwVtI=";
+    hash = "sha256-p0a6mNTeN7B55C2Um3BMM8FoswvR+QcaHSXJ2ppEmZc=";
   };
 
   buildInputs = [ pkgs.ncurses ];
diff --git a/pkgs/development/python-modules/google-api-core/default.nix b/pkgs/development/python-modules/google-api-core/default.nix
index 440729136876..cbff06c5d889 100644
--- a/pkgs/development/python-modules/google-api-core/default.nix
+++ b/pkgs/development/python-modules/google-api-core/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "google-api-core";
-  version = "2.18.0";
+  version = "2.19.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ytl0F7/GdNbO8lHlxNY5qWVeAMRVKMQ2T7/rtHjOcqk=";
+    hash = "sha256-zxt8JpQEeIbSrxEooDrpnjkRCKCIBPh8/TWXDknJzRA=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-auth/default.nix b/pkgs/development/python-modules/google-auth/default.nix
index 807cf745f788..d086f02de5c0 100644
--- a/pkgs/development/python-modules/google-auth/default.nix
+++ b/pkgs/development/python-modules/google-auth/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "google-auth";
-  version = "2.29.0";
+  version = "2.30.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Zy3/My0HMidVD/x0V4aKxCGNbFALFV/mzBfSsTYCw2A=";
+    hash = "sha256-q2MKEyD2cgkJrXan29toQc31xmsyjWkAJ+SGe9+xZog=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index efb503cc702f..5a9c25bfc20f 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-kms";
-  version = "2.21.4";
+  version = "2.23.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AQW8FKOYt/05GUO766/VkY8+NAaCepiXObLcOInMEhg=";
+    hash = "sha256-UrX8b3CxY1FvrWEKr8CI++eI9QHVu+HV9FjNw/y6/Sw=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index b3f0d3d55830..3d47efcfcfbb 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -12,25 +12,23 @@
   protobuf,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "2.16.0";
+  version = "2.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3aSF+lA3EKgo0BJGvRbOnbCCPcUbvKdCzpamgX1YZp8=";
+    hash = "sha256-STeKv/VO9la1Lcpe8PLrqaqD3CsscseHFLA6GpX+k4g=";
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/google-generativeai/default.nix b/pkgs/development/python-modules/google-generativeai/default.nix
index 21730414ed6c..69882392bb98 100644
--- a/pkgs/development/python-modules/google-generativeai/default.nix
+++ b/pkgs/development/python-modules/google-generativeai/default.nix
@@ -9,7 +9,6 @@
   protobuf,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   tqdm,
   typing-extensions,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     google-ai-generativelanguage
diff --git a/pkgs/development/python-modules/google-re2/default.nix b/pkgs/development/python-modules/google-re2/default.nix
index 01821eee8fc3..bcfbd6744dd6 100644
--- a/pkgs/development/python-modules/google-re2/default.nix
+++ b/pkgs/development/python-modules/google-re2/default.nix
@@ -3,28 +3,31 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
+  setuptools,
   pybind11,
   re2,
-  six,
 }:
 
 buildPythonPackage rec {
   pname = "google-re2";
-  version = "1.1";
-  format = "setuptools";
+  version = "1.1.20240601";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-06lGfuUrRqx3ypKPbQy+rM/ZLwPKDw9lud9qlRhPOhw=";
+    pname = "google_re2";
+    inherit version;
+    hash = "sha256-MYf2iFUwd1TUnzmOWDhT1bCNeD0/5mL2kWuZkHX34JU=";
   };
 
-  propagatedBuildInputs = [
-    pybind11
-    re2
-    six
-  ];
+  build-system = [ setuptools ];
+
+  buildInputs = [ re2 ];
+
+  dependencies = [ pybind11 ];
+
+  doCheck = false; # no tests in sdist
 
   pythonImportsCheck = [ "re2" ];
 
diff --git a/pkgs/development/python-modules/google-resumable-media/default.nix b/pkgs/development/python-modules/google-resumable-media/default.nix
index eff67014bed5..f5975586735c 100644
--- a/pkgs/development/python-modules/google-resumable-media/default.nix
+++ b/pkgs/development/python-modules/google-resumable-media/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-resumable-media";
-  version = "2.7.0";
+  version = "2.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Xxj1+pg29LCDFiBkocLJjBcjm/2pylCtlwzPkF8+Yls=";
+    hash = "sha256-6uRRp7LizbqqD9LrAMyKHuXpXha1VZc1nLw9J9fZDjM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/googleapis-common-protos/default.nix b/pkgs/development/python-modules/googleapis-common-protos/default.nix
index 32449c05311d..9e62755a0e11 100644
--- a/pkgs/development/python-modules/googleapis-common-protos/default.nix
+++ b/pkgs/development/python-modules/googleapis-common-protos/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "googleapis-common-protos";
-  version = "1.63.0";
+  version = "1.63.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-F60BsR1fHQFxwG07pcBMVEdOiDtmuUlyK0k47iaU704=";
+    hash = "sha256-xkQvegprKoA2lFfXnmZyu33LqriOCEgwJJfj7IB4Cmo=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/gophish/default.nix b/pkgs/development/python-modules/gophish/default.nix
index 8a7d8c90d487..48b4e880e5fc 100644
--- a/pkgs/development/python-modules/gophish/default.nix
+++ b/pkgs/development/python-modules/gophish/default.nix
@@ -10,7 +10,6 @@
   pyparsing,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   six,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     appdirs
diff --git a/pkgs/development/python-modules/gpsoauth/default.nix b/pkgs/development/python-modules/gpsoauth/default.nix
index 28d364c2650d..d40d2f3c6174 100644
--- a/pkgs/development/python-modules/gpsoauth/default.nix
+++ b/pkgs/development/python-modules/gpsoauth/default.nix
@@ -5,7 +5,6 @@
   poetry-core,
   pycryptodomex,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     poetry-core
   ];
 
diff --git a/pkgs/development/python-modules/gpustat/default.nix b/pkgs/development/python-modules/gpustat/default.nix
index c7a920a07f1a..d3a06d7f8900 100644
--- a/pkgs/development/python-modules/gpustat/default.nix
+++ b/pkgs/development/python-modules/gpustat/default.nix
@@ -8,7 +8,6 @@
   psutil,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "nvidia-ml-py" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/gpy/default.nix b/pkgs/development/python-modules/gpy/default.nix
index 176200e95c8e..161c364694e3 100644
--- a/pkgs/development/python-modules/gpy/default.nix
+++ b/pkgs/development/python-modules/gpy/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "gpy";
-  version = "1.13.0";
+  version = "1.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "SheffieldML";
     repo = "GPy";
-    rev = "refs/tags/v.${version}";
-    hash = "sha256-2HKKKBD/JFSeLQGvvgObxqxv9IHEKFnpaejdKbYZbmY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ykoGdXy1uagKrP9Nqn74mDESZwKVPq6wQgnHlCznevM=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/gpytorch/default.nix b/pkgs/development/python-modules/gpytorch/default.nix
index 5c82e860ed5a..27bc11f0ee0e 100644
--- a/pkgs/development/python-modules/gpytorch/default.nix
+++ b/pkgs/development/python-modules/gpytorch/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   linear-operator,
   scikit-learn,
   setuptools,
@@ -23,6 +24,16 @@ buildPythonPackage rec {
     hash = "sha256-cpkfjx5G/4duL1Rr4nkHTHi03TDcYbcx3bKP2Ny7Ijo=";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/cornellius-gp/gpytorch/pull/2545
+      name = "scipy-1.14-compatibility.patch";
+      url = "https://github.com/cornellius-gp/gpytorch/commit/2562be472521b8aec366de2619e3130a96fab982.patch";
+      excludes = [ "setup.py" ];
+      hash = "sha256-znOFpN6go2iIxP24VjJLKF3Laxcr4xV/IyP2y36g4QY=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/grad-cam/default.nix b/pkgs/development/python-modules/grad-cam/default.nix
index 8e2c61075d98..e632650a40a6 100644
--- a/pkgs/development/python-modules/grad-cam/default.nix
+++ b/pkgs/development/python-modules/grad-cam/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   matplotlib,
   numpy,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index 768e5e3f9956..1c7a51dd2aa8 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   nix-update-script,
   pythonOlder,
-  pythonRelaxDepsHook,
   # pyproject
   hatchling,
   hatch-requirements-txt,
@@ -58,7 +57,6 @@ buildPythonPackage rec {
     hatchling
     hatch-requirements-txt
     hatch-fancy-pypi-readme
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 4d028da04e49..5cc026cd3f2a 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   writeShellScriptBin,
   gradio,
 
@@ -91,7 +90,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     hatchling
     hatch-requirements-txt
     hatch-fancy-pypi-readme
diff --git a/pkgs/development/python-modules/graspologic/default.nix b/pkgs/development/python-modules/graspologic/default.nix
index 891af40a779d..74e7442f0e41 100644
--- a/pkgs/development/python-modules/graspologic/default.nix
+++ b/pkgs/development/python-modules/graspologic/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "graspologic";
-  version = "3.3.0";
+  version = "3.4.1";
   pyproject = true;
 
   disabled = isPy27;
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "graspologic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hd3OyV95N8vhc4s50HbKkrcUOeSegn66Dkw7dixim00=";
+    hash = "sha256-taX/4/uCQXW7yFykVHY78hJIGThEIycHwrEOZ3h1LPY=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/greatfet/default.nix b/pkgs/development/python-modules/greatfet/default.nix
index 54869f592d66..147cd19164e2 100644
--- a/pkgs/development/python-modules/greatfet/default.nix
+++ b/pkgs/development/python-modules/greatfet/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "greatfet";
-  version = "2019.5.1.dev0";
+  version = "2024.0.1";
 
   src = fetchFromGitHub {
     owner = "greatscottgadgets";
     repo = "greatfet";
-    rev = "v${version}";
-    sha256 = "054vkx4xkbhxhh5grjbs9kw3pjkv1zapp91ysrqr0c8mg1pc7zxv";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-AKpaJZJTzMY3IQXLvVnLWh3IHeGp759z6tvaBl28BHQ=";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/greenlet/default.nix b/pkgs/development/python-modules/greenlet/default.nix
index 5c41e8845541..2ea828cd4174 100644
--- a/pkgs/development/python-modules/greenlet/default.nix
+++ b/pkgs/development/python-modules/greenlet/default.nix
@@ -24,6 +24,11 @@ let
       hash = "sha256-QzdEQjUyWVVM4zWZ2otpLVqpb4l21WfUut8mM3H75JE=";
     };
 
+    patches = [
+      # https://github.com/python-greenlet/greenlet/pull/396
+      ./python-3.13-compat.patch
+    ];
+
     nativeBuildInputs = [ setuptools ];
 
     # tests in passthru, infinite recursion via objgraph/graphviz
diff --git a/pkgs/development/python-modules/greenlet/python-3.13-compat.patch b/pkgs/development/python-modules/greenlet/python-3.13-compat.patch
new file mode 100644
index 000000000000..9f5488b831d3
--- /dev/null
+++ b/pkgs/development/python-modules/greenlet/python-3.13-compat.patch
@@ -0,0 +1,313 @@
+Port of https://github.com/python-greenlet/greenlet/pull/396
+
+From 94979488f841fcb41bd2bd3b80b5c0b011af4c94 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Wed, 14 Feb 2024 16:37:42 +0100
+Subject: [PATCH 1/5] Fix #392: Port to Python 3.13
+
+* Replace C_RECURSION_LIMIT with Py_C_RECURSION_LIMIT.
+* Add Py_C_RECURSION_LIMIT for Python 3.12 and older.
+* Disable GREENLET_USE_CFRAME on Python 3.13.
+* Define Py_BUILD_CORE to include pycore_frame.h.
+---
+ src/greenlet/TPythonState.cpp            | 10 +++++++---
+ src/greenlet/greenlet_cpython_compat.hpp | 13 +++++++++++--
+ src/greenlet/greenlet_greenlet.hpp       |  1 +
+ 3 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/src/greenlet/TPythonState.cpp b/src/greenlet/TPythonState.cpp
+index 465d4174..c0dbf703 100644
+--- a/src/greenlet/TPythonState.cpp
++++ b/src/greenlet/TPythonState.cpp
+@@ -130,11 +130,13 @@ void PythonState::operator<<(const PyThreadState *const tstate) noexcept
+ #if GREENLET_PY311
+   #if GREENLET_PY312
+     this->py_recursion_depth = tstate->py_recursion_limit - tstate->py_recursion_remaining;
+-    this->c_recursion_depth = C_RECURSION_LIMIT - tstate->c_recursion_remaining;
++    this->c_recursion_depth = Py_C_RECURSION_LIMIT - tstate->c_recursion_remaining;
+   #else // not 312
+     this->recursion_depth = tstate->recursion_limit - tstate->recursion_remaining;
+   #endif // GREENLET_PY312
++  #if GREENLET_USE_CFRAME
+     this->current_frame = tstate->cframe->current_frame;
++  #endif
+     this->datastack_chunk = tstate->datastack_chunk;
+     this->datastack_top = tstate->datastack_top;
+     this->datastack_limit = tstate->datastack_limit;
+@@ -199,12 +201,14 @@ void PythonState::operator>>(PyThreadState *const tstate) noexcept
+ #if GREENLET_PY311
+   #if GREENLET_PY312
+     tstate->py_recursion_remaining = tstate->py_recursion_limit - this->py_recursion_depth;
+-    tstate->c_recursion_remaining = C_RECURSION_LIMIT - this->c_recursion_depth;
++    tstate->c_recursion_remaining = Py_C_RECURSION_LIMIT - this->c_recursion_depth;
+     this->unexpose_frames();
+   #else // \/ 3.11
+     tstate->recursion_remaining = tstate->recursion_limit - this->recursion_depth;
+   #endif // GREENLET_PY312
++  #if GREENLET_USE_CFRAME
+     tstate->cframe->current_frame = this->current_frame;
++  #endif
+     tstate->datastack_chunk = this->datastack_chunk;
+     tstate->datastack_top = this->datastack_top;
+     tstate->datastack_limit = this->datastack_limit;
+@@ -238,7 +242,7 @@ void PythonState::set_initial_state(const PyThreadState* const tstate) noexcept
+ #if GREENLET_PY312
+     this->py_recursion_depth = tstate->py_recursion_limit - tstate->py_recursion_remaining;
+     // XXX: TODO: Comment from a reviewer:
+-    //     Should this be ``C_RECURSION_LIMIT - tstate->c_recursion_remaining``?
++    //     Should this be ``Py_C_RECURSION_LIMIT - tstate->c_recursion_remaining``?
+     // But to me it looks more like that might not be the right
+     // initialization either?
+     this->c_recursion_depth = tstate->py_recursion_limit - tstate->py_recursion_remaining;
+diff --git a/src/greenlet/greenlet_cpython_compat.hpp b/src/greenlet/greenlet_cpython_compat.hpp
+index cdc1617f..c0fb94c5 100644
+--- a/src/greenlet/greenlet_cpython_compat.hpp
++++ b/src/greenlet/greenlet_cpython_compat.hpp
+@@ -12,19 +12,24 @@
+ 
+ #if PY_VERSION_HEX >= 0x30A00B1
+ #    define GREENLET_PY310 1
++#else
++#    define GREENLET_PY310 0
++#endif
++
+ /*
+ Python 3.10 beta 1 changed tstate->use_tracing to a nested cframe member.
+ See https://github.com/python/cpython/pull/25276
+ We have to save and restore this as well.
++
++Python 3.13 removed PyThreadState.cframe (GH-108035).
+ */
++#if GREENLET_PY310 && PY_VERSION_HEX < 0x30D0000
+ #    define GREENLET_USE_CFRAME 1
+ #else
+ #    define GREENLET_USE_CFRAME 0
+-#    define GREENLET_PY310 0
+ #endif
+ 
+ 
+-
+ #if PY_VERSION_HEX >= 0x30B00A4
+ /*
+ Greenlet won't compile on anything older than Python 3.11 alpha 4 (see
+@@ -124,4 +129,8 @@ static inline void PyThreadState_LeaveTracing(PyThreadState *tstate)
+ }
+ #endif
+ 
++#if !defined(Py_C_RECURSION_LIMIT) && defined(C_RECURSION_LIMIT)
++#  define Py_C_RECURSION_LIMIT C_RECURSION_LIMIT
++#endif
++
+ #endif /* GREENLET_CPYTHON_COMPAT_H */
+diff --git a/src/greenlet/greenlet_greenlet.hpp b/src/greenlet/greenlet_greenlet.hpp
+index d52ce1fd..6da6841f 100644
+--- a/src/greenlet/greenlet_greenlet.hpp
++++ b/src/greenlet/greenlet_greenlet.hpp
+@@ -23,6 +23,7 @@ using greenlet::refs::BorrowedGreenlet;
+ #endif
+ 
+ #if GREENLET_PY312
++#  define Py_BUILD_CORE
+ #  include "internal/pycore_frame.h"
+ #endif
+ 
+
+From 00611d7567d09869973fe314f60575674cc877d8 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Mon, 3 Jun 2024 10:55:14 +0200
+Subject: [PATCH 3/5] Support delete_later
+
+---
+ src/greenlet/TPythonState.cpp            | 14 ++++++++++++--
+ src/greenlet/greenlet.cpp                |  4 ++++
+ src/greenlet/greenlet_cpython_compat.hpp |  6 ++++++
+ src/greenlet/greenlet_greenlet.hpp       |  4 ++++
+ 4 files changed, 26 insertions(+), 2 deletions(-)
+
+diff --git a/src/greenlet/TPythonState.cpp b/src/greenlet/TPythonState.cpp
+index c0dbf703..bfb40cac 100644
+--- a/src/greenlet/TPythonState.cpp
++++ b/src/greenlet/TPythonState.cpp
+@@ -18,7 +18,11 @@ PythonState::PythonState()
+ #else
+     ,recursion_depth(0)
+ #endif
++#if GREENLET_PY313
++    ,delete_later(nullptr)
++#else
+     ,trash_delete_nesting(0)
++#endif
+ #if GREENLET_PY311
+     ,current_frame(nullptr)
+     ,datastack_chunk(nullptr)
+@@ -145,7 +149,9 @@ void PythonState::operator<<(const PyThreadState *const tstate) noexcept
+     Py_XDECREF(frame);  // PyThreadState_GetFrame gives us a new
+                         // reference.
+     this->_top_frame.steal(frame);
+-  #if GREENLET_PY312
++  #if GREENLET_PY313
++    this->delete_later = Py_XNewRef(tstate->delete_later);
++  #elif GREENLET_PY312
+     this->trash_delete_nesting = tstate->trash.delete_nesting;
+   #else // not 312
+     this->trash_delete_nesting = tstate->trash_delete_nesting;
+@@ -213,7 +219,11 @@ void PythonState::operator>>(PyThreadState *const tstate) noexcept
+     tstate->datastack_top = this->datastack_top;
+     tstate->datastack_limit = this->datastack_limit;
+     this->_top_frame.relinquish_ownership();
+-  #if GREENLET_PY312
++  #if GREENLET_PY313
++    Py_XDECREF(tstate->delete_later);
++    tstate->delete_later = this->delete_later;
++    Py_CLEAR(this->delete_later);
++  #elif GREENLET_PY312
+     tstate->trash.delete_nesting = this->trash_delete_nesting;
+   #else // not 3.12
+     tstate->trash_delete_nesting = this->trash_delete_nesting;
+diff --git a/src/greenlet/greenlet.cpp b/src/greenlet/greenlet.cpp
+index 5a9818e8..dfc748a8 100644
+--- a/src/greenlet/greenlet.cpp
++++ b/src/greenlet/greenlet.cpp
+@@ -1328,6 +1328,7 @@ mod_enable_optional_cleanup(PyObject* UNUSED(module), PyObject* flag)
+     Py_RETURN_NONE;
+ }
+ 
++#if !GREENLET_PY313
+ PyDoc_STRVAR(mod_get_tstate_trash_delete_nesting_doc,
+              "get_tstate_trash_delete_nesting() -> Integer\n"
+              "\n"
+@@ -1343,6 +1344,7 @@ mod_get_tstate_trash_delete_nesting(PyObject* UNUSED(module))
+     return PyLong_FromLong(tstate->trash_delete_nesting);
+ #endif
+ }
++#endif
+ 
+ static PyMethodDef GreenMethods[] = {
+     {"getcurrent",
+@@ -1356,7 +1358,9 @@ static PyMethodDef GreenMethods[] = {
+     {"get_total_main_greenlets", (PyCFunction)mod_get_total_main_greenlets, METH_NOARGS, mod_get_total_main_greenlets_doc},
+     {"get_clocks_used_doing_optional_cleanup", (PyCFunction)mod_get_clocks_used_doing_optional_cleanup, METH_NOARGS, mod_get_clocks_used_doing_optional_cleanup_doc},
+     {"enable_optional_cleanup", (PyCFunction)mod_enable_optional_cleanup, METH_O, mod_enable_optional_cleanup_doc},
++#if !GREENLET_PY313
+     {"get_tstate_trash_delete_nesting", (PyCFunction)mod_get_tstate_trash_delete_nesting, METH_NOARGS, mod_get_tstate_trash_delete_nesting_doc},
++#endif
+     {NULL, NULL} /* Sentinel */
+ };
+ 
+diff --git a/src/greenlet/greenlet_cpython_compat.hpp b/src/greenlet/greenlet_cpython_compat.hpp
+index c0fb94c5..ce5fd882 100644
+--- a/src/greenlet/greenlet_cpython_compat.hpp
++++ b/src/greenlet/greenlet_cpython_compat.hpp
+@@ -55,6 +55,12 @@ Greenlet won't compile on anything older than Python 3.11 alpha 4 (see
+ #    define GREENLET_PY312 0
+ #endif
+ 
++#if PY_VERSION_HEX >= 0x30D0000
++#    define GREENLET_PY313 1
++#else
++#    define GREENLET_PY313 0
++#endif
++
+ #ifndef Py_SET_REFCNT
+ /* Py_REFCNT and Py_SIZE macros are converted to functions
+ https://bugs.python.org/issue39573 */
+diff --git a/src/greenlet/greenlet_greenlet.hpp b/src/greenlet/greenlet_greenlet.hpp
+index 6da6841f..fbfdfbfc 100644
+--- a/src/greenlet/greenlet_greenlet.hpp
++++ b/src/greenlet/greenlet_greenlet.hpp
+@@ -111,7 +111,11 @@ namespace greenlet
+ #else
+         int recursion_depth;
+ #endif
++#if GREENLET_PY313
++        PyObject *delete_later;
++#else
+         int trash_delete_nesting;
++#endif
+ #if GREENLET_PY311
+         _PyInterpreterFrame* current_frame;
+         _PyStackChunk* datastack_chunk;
+
+From b65558ec962d3d81ae09787ebca8686d233e2a4c Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Wed, 5 Jun 2024 12:04:21 +0200
+Subject: [PATCH 4/5] Fix current_frame
+
+---
+ src/greenlet/TPythonState.cpp | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/greenlet/TPythonState.cpp b/src/greenlet/TPythonState.cpp
+index bfb40cac..82eb34f0 100644
+--- a/src/greenlet/TPythonState.cpp
++++ b/src/greenlet/TPythonState.cpp
+@@ -138,7 +138,9 @@ void PythonState::operator<<(const PyThreadState *const tstate) noexcept
+   #else // not 312
+     this->recursion_depth = tstate->recursion_limit - tstate->recursion_remaining;
+   #endif // GREENLET_PY312
+-  #if GREENLET_USE_CFRAME
++  #if GREENLET_PY313
++    this->current_frame = tstate->current_frame;
++  #elif GREENLET_USE_CFRAME
+     this->current_frame = tstate->cframe->current_frame;
+   #endif
+     this->datastack_chunk = tstate->datastack_chunk;
+@@ -212,7 +214,9 @@ void PythonState::operator>>(PyThreadState *const tstate) noexcept
+   #else // \/ 3.11
+     tstate->recursion_remaining = tstate->recursion_limit - this->recursion_depth;
+   #endif // GREENLET_PY312
+-  #if GREENLET_USE_CFRAME
++  #if GREENLET_PY313
++    tstate->current_frame = this->current_frame;
++  #elif GREENLET_USE_CFRAME
+     tstate->cframe->current_frame = this->current_frame;
+   #endif
+     tstate->datastack_chunk = this->datastack_chunk;
+
+From b7cfc1748766cac351fe5fca32fa7c8cacdea2ae Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Wed, 5 Jun 2024 12:17:28 +0200
+Subject: [PATCH 5/5] Update tests
+
+---
+ src/greenlet/tests/test_greenlet.py       | 4 +++-
+ src/greenlet/tests/test_greenlet_trash.py | 9 +++++++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/greenlet/tests/test_greenlet.py b/src/greenlet/tests/test_greenlet.py
+index 51849cd6..259707ae 100644
+--- a/src/greenlet/tests/test_greenlet.py
++++ b/src/greenlet/tests/test_greenlet.py
+@@ -471,7 +471,9 @@ def creator():
+         # Unfortunately, this doesn't actually clear the references, they're in the
+         # fast local array.
+         if not wait_for_cleanup:
+-            result[0].gr_frame.f_locals.clear()
++            # f_locals has no clear method in Python 3.13
++            if hasattr(result[0].gr_frame.f_locals, 'clear'):
++                result[0].gr_frame.f_locals.clear()
+         else:
+             self.assertIsNone(result[0].gr_frame)
+ 
+diff --git a/src/greenlet/tests/test_greenlet_trash.py b/src/greenlet/tests/test_greenlet_trash.py
+index 8d9716e9..2bce8fd0 100644
+--- a/src/greenlet/tests/test_greenlet_trash.py
++++ b/src/greenlet/tests/test_greenlet_trash.py
+@@ -29,8 +29,17 @@
+ 
+ import unittest
+ 
++try:
++    from greenlet._greenlet import get_tstate_trash_delete_nesting
++except ImportError:
++    get_tstate_trash_delete_nesting = None
++
++
+ class TestTrashCanReEnter(unittest.TestCase):
+ 
++    # Python 3.13 has not "trash delete nesting" anymore (but "delete later")
++    @unittest.skipIf(get_tstate_trash_delete_nesting is None,
++                     'need get_tstate_trash_delete_nesting()')
+     def test_it(self):
+         # Try several times to trigger it, because it isn't 100%
+         # reliable.
diff --git a/pkgs/development/python-modules/gridnet/default.nix b/pkgs/development/python-modules/gridnet/default.nix
index 75ad2c335149..8b8be88367d8 100644
--- a/pkgs/development/python-modules/gridnet/default.nix
+++ b/pkgs/development/python-modules/gridnet/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "gridnet";
-  version = "5.0.0";
+  version = "5.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "klaasnicolaas";
     repo = "python-gridnet";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7tLT5sRoUjWs1DOIuUEbnJJkg9LHZqrN/eu+Mjx5Yd4=";
+    hash = "sha256-HVBUAasK7lFsj/tT0j70x/2w4RJtnHWfX/1XbfKKLf8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index 9291bd5f14e0..aa06cb44f0ca 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -1,26 +1,31 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchPypi,
+  setuptools,
   grpcio,
   protobuf,
 }:
 
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.62.2";
-  format = "setuptools";
+  version = "1.64.1";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-bkrCxD12skXF9m2Y9SPbCHhrGGEoplXubyCjCn5o5Pk=";
+    pname = "grpcio_channelz";
+    inherit version;
+    hash = "sha256-FUNKohIyERNoZe1y5JzmaP6IausTewNgpv6765Efd1U=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-  pythonRelaxDeps = [ "grpcio" ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "grpcio"
+    "protobuf"
+  ];
+
+  dependencies = [
     grpcio
     protobuf
   ];
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index c71c63fce021..4822365f1b6a 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchPypi,
   grpcio,
   protobuf,
@@ -9,12 +8,13 @@
 
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.62.2";
+  version = "1.64.1";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-pE0eoeFRC1xiJl2toE2GYhuxSR113ph3E8nA6gBcEKg=";
+    pname = "grpcio_health_checking";
+    inherit version;
+    hash = "sha256-VSOJ8/Jj32p/U8sk8opjGlhKMHIfn0Mp0nFZU+GX49s=";
   };
 
   propagatedBuildInputs = [
@@ -22,7 +22,6 @@ buildPythonPackage rec {
     protobuf
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "grpcio" ];
 
   pythonImportsCheck = [ "grpc_health" ];
diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 4699a09a3343..982711830d46 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -2,25 +2,30 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
+  setuptools,
   grpcio,
   protobuf,
 }:
 
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.62.2";
-  format = "setuptools";
+  version = "1.64.1";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-LdRIBtaNAAZjZSm9pXMBKxmkIoFHjC0FHNquu5HiUWw=";
+    pname = "grpcio_reflection";
+    inherit version;
+    hash = "sha256-43511hl02iKjtcJgSZKqLyFjlx6jeK2Fa047YyEJ88c=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-  pythonRelaxDeps = [ "grpcio" ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "grpcio"
+    "protobuf"
+  ];
+
+  dependencies = [
     grpcio
     protobuf
   ];
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index c587948f185f..2486ba8aa7cd 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -10,14 +10,15 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.62.2";
+  version = "1.64.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-YuG/ywICWhzXNzKi0zZy0+nQ300hwSxR4LvK8JurdCo=";
+    pname = "grpcio_status";
+    inherit version;
+    hash = "sha256-xQvRTrZQbYWApsVTvqRj18CEmbLA6T9tGGTF6Oq7EGY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 263e57ed8f3a..33ec8143c265 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -5,20 +5,20 @@
   grpcio,
   protobuf,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.62.2";
+  version = "1.64.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-dNGeGQnpQbGmvvf71fnvMwWZ9nb7BrsGB8hFDtVVnfI=";
+    pname = "grpcio_testing";
+    inherit version;
+    hash = "sha256-Nta9aurAzEg/iUlYE35Jz7uQ+syH4NMnHNuMGq7XEBw=";
   };
 
   postPatch = ''
@@ -26,9 +26,13 @@ buildPythonPackage rec {
       --replace-fail '"grpcio>={version}".format(version=grpc_version.VERSION)' '"grpcio"'
   '';
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "protobuf"
+  ];
+
+  dependencies = [
     grpcio
     protobuf
   ];
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index d98f1bee9ee2..fa204c048982 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -9,12 +9,13 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.62.2";
+  version = "1.64.1";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-X9XhWCtnjmuUHuX1gJNAvl4HJGkd9SmaroImZA+U4Y8=";
+    pname = "grpcio_tools";
+    inherit version;
+    hash = "sha256-crNVC5GtuDVGVuzw9tHUYRKZBEuuEfsefMHRu2a4wes=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 5e1524866087..dca383e92a6b 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -19,11 +19,11 @@
 buildPythonPackage rec {
   pname = "grpcio";
   format = "setuptools";
-  version = "1.62.2";
+  version = "1.64.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-x3YYBx2Wt6i+LBBwGphTeCO5xluiVsC5Bn4FlM29lU0=";
+    hash = "sha256-jVHdHFnV+g80JmuAo4BewpofJkJcKlRzYTP22H/Eloo=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/gruut/default.nix b/pkgs/development/python-modules/gruut/default.nix
index 995357abff7e..c597b82ee57f 100644
--- a/pkgs/development/python-modules/gruut/default.nix
+++ b/pkgs/development/python-modules/gruut/default.nix
@@ -3,14 +3,20 @@
   buildPythonPackage,
   callPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   babel,
   gruut-ipa,
   dateparser,
   jsonlines,
   num2words,
   python-crfsuite,
-  python,
   networkx,
+
+  # checks
   glibcLocales,
   pytestCheckHook,
 }:
@@ -36,23 +42,20 @@ in
 buildPythonPackage rec {
   pname = "gruut";
   version = "2.3.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rhasspy";
-    repo = pname;
+    repo = "gruut";
     rev = "refs/tags/v${version}";
     hash = "sha256-DD7gnvH9T2R6E19+exWE7Si+XEpfh0Iy5FYbycjgzgM=";
   };
 
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "gruut_lang_en~=2.0.0" "gruut_lang_en" \
-      --replace "jsonlines~=1.2.0" "jsonlines" \
-      --replace "networkx>=2.5.0,<3.0.0" "networkx"
-  '';
+  pythonRelaxDeps = true;
+
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs =
+  dependencies =
     [
       babel
       gruut-ipa
@@ -68,8 +71,8 @@ buildPythonPackage rec {
         inherit
           lang
           version
-          format
           src
+          build-system
           ;
       }
     ) langPkgs);
diff --git a/pkgs/development/python-modules/gruut/language-pack.nix b/pkgs/development/python-modules/gruut/language-pack.nix
index 3a2dcaba893b..b3a9e5828778 100644
--- a/pkgs/development/python-modules/gruut/language-pack.nix
+++ b/pkgs/development/python-modules/gruut/language-pack.nix
@@ -4,13 +4,14 @@
 
   lang,
   version,
-  format,
   src,
+  build-system,
 }:
 
 buildPythonPackage rec {
   pname = "gruut-lang-${lang}";
-  inherit version format src;
+  pyproject = true;
+  inherit version src build-system;
 
   prePatch = ''
     cd "${pname}"
diff --git a/pkgs/development/python-modules/gsd/default.nix b/pkgs/development/python-modules/gsd/default.nix
index 449f41620abe..48b8694650b4 100644
--- a/pkgs/development/python-modules/gsd/default.nix
+++ b/pkgs/development/python-modules/gsd/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "gsd";
-  version = "3.2.1";
+  version = "3.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "glotzerlab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-huMM98An/DG8PIVblS3b6AxF6vJ5IoKOs1f9kBnR3ik=";
+    hash = "sha256-sDb6TJvN7yFiRabc66zIjk6w9CEUYMhpe+fWv+apvkI=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/gunicorn/default.nix b/pkgs/development/python-modules/gunicorn/default.nix
index 25296b64d9ba..909fff5b5aaa 100644
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@@ -17,27 +17,23 @@
   setproctitle,
 
   pytestCheckHook,
+  pytest-cov,
 }:
 
 buildPythonPackage rec {
   pname = "gunicorn";
-  version = "21.2.0";
+  version = "22.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "benoitc";
     repo = "gunicorn";
-    rev = version;
-    hash = "sha256-xP7NNKtz3KNrhcAc00ovLZRx2h6ZqHbwiFOpCiuwf98=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xIXQMAdTZEBORu6789tLpT1OpBL+aveL/MfDj4f4bes=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov=gunicorn --cov-report=xml" ""
-  '';
-
   build-system = [ setuptools ];
 
   dependencies = [ packaging ];
@@ -52,7 +48,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "gunicorn" ];
 
-  nativeCheckInputs = [ pytestCheckHook ] ++ lib.flatten (lib.attrValues optional-dependencies);
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   meta = {
     description = "gunicorn 'Green Unicorn' is a WSGI HTTP Server for UNIX, fast clients and sleepy applications";
diff --git a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
index 40c61f8a7dc9..32024f892556 100644
--- a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
+++ b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
@@ -8,7 +8,6 @@
   pyaml,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   thelogrus,
 }:
 
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     gitlike-commands
diff --git a/pkgs/development/python-modules/habluetooth/default.nix b/pkgs/development/python-modules/habluetooth/default.nix
index 4a1f28a60b43..170a29ef8cf9 100644
--- a/pkgs/development/python-modules/habluetooth/default.nix
+++ b/pkgs/development/python-modules/habluetooth/default.nix
@@ -10,6 +10,7 @@
   cython,
   fetchFromGitHub,
   poetry-core,
+  pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
   setuptools,
@@ -18,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "habluetooth";
-  version = "3.1.1";
+  version = "3.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -27,7 +28,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "habluetooth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HlQAYR+feu1awKFf11Q5Us4zSeHASu8OscJ8T8tlm5M=";
+    hash = "sha256-HG2G/ymSw6e03KJOB/F5ja2Cv5nD+nPgOjMHPCYNSH8=";
   };
 
   postPatch = ''
@@ -51,7 +52,10 @@ buildPythonPackage rec {
     bluetooth-data-tools
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "habluetooth" ];
 
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 8b9f883ce54c..62ccb7ef91d0 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -14,7 +14,6 @@
   pytest-timeout,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   snitun,
   syrupy,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "acme" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/hatasmota/default.nix b/pkgs/development/python-modules/hatasmota/default.nix
index a6b84d93b1a6..8b7c477c8494 100644
--- a/pkgs/development/python-modules/hatasmota/default.nix
+++ b/pkgs/development/python-modules/hatasmota/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "hatasmota";
-  version = "0.8.0";
+  version = "0.9.2";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "emontnemery";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Kbz/ETSJGx6u0ZNfEWfl9klBIB3yPcfHGy1uKK50TGA=";
+    hash = "sha256-m40ZK1+cfWgrwWftFqExUZidCrbDMC1Sfshugqrp5QM=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 8df49b40e94d..069cd5374b4c 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -21,13 +21,13 @@
 
 buildPythonPackage rec {
   pname = "hatchling";
-  version = "1.24.2";
+  version = "1.25.0";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Qd3CfNsl2573tovvB1+CnITLNJqhv/gkB5fQElEFR7A=";
+    hash = "sha256-cGRjGlEmELUiUKTT/xvYFVHW0UMcTre3LnNN9sdPQmI=";
   };
 
   # listed in backend/pyproject.toml
diff --git a/pkgs/development/python-modules/hdate/default.nix b/pkgs/development/python-modules/hdate/default.nix
index c6b9bbcde847..0b3fa2ab78a4 100644
--- a/pkgs/development/python-modules/hdate/default.nix
+++ b/pkgs/development/python-modules/hdate/default.nix
@@ -30,7 +30,6 @@ buildPythonPackage rec {
 
   build-system = [
     pdm-backend
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/hdbscan/default.nix b/pkgs/development/python-modules/hdbscan/default.nix
index d3de4a76bd48..e56d4fd17123 100644
--- a/pkgs/development/python-modules/hdbscan/default.nix
+++ b/pkgs/development/python-modules/hdbscan/default.nix
@@ -9,7 +9,6 @@
   fetchPypi,
   joblib,
   six,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "cython" ];
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     cython
   ];
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hg-git/default.nix b/pkgs/development/python-modules/hg-git/default.nix
index fb38f22af4bf..25ed4d5d9505 100644
--- a/pkgs/development/python-modules/hg-git/default.nix
+++ b/pkgs/development/python-modules/hg-git/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   setuptools-scm,
   dulwich,
   mercurial,
@@ -10,19 +11,23 @@
 
 buildPythonPackage rec {
   pname = "hg-git";
-  version = "1.1.1";
-  format = "pyproject";
+  version = "1.1.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-r04Q6zbt8VM1jYkoGOdJZqKPPxXy4jC1X1d9nJ+fEWY=";
+    pname = "hg_git";
+    inherit version;
+    hash = "sha256-BZzcElZa0pMBSGXSiSB+d+YFhJMM5PAdT2Txq5qLZCU=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     dulwich
     mercurial
   ];
diff --git a/pkgs/development/python-modules/hikari/default.nix b/pkgs/development/python-modules/hikari/default.nix
index 05d2214f6a3d..f83a50b29160 100644
--- a/pkgs/development/python-modules/hikari/default.nix
+++ b/pkgs/development/python-modules/hikari/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytest-runner,
   aiohttp,
   attrs,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
     '';
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/hologram/default.nix b/pkgs/development/python-modules/hologram/default.nix
index 17e7b62e1f63..bedeb1f17dfb 100644
--- a/pkgs/development/python-modules/hologram/default.nix
+++ b/pkgs/development/python-modules/hologram/default.nix
@@ -6,7 +6,6 @@
   jsonschema,
   pytestCheckHook,
   python-dateutil,
-  pythonRelaxDepsHook,
   setuptools,
   wheel,
 }:
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/holoviews/default.nix b/pkgs/development/python-modules/holoviews/default.nix
index e09ca86f8a16..ae765df32b4b 100644
--- a/pkgs/development/python-modules/holoviews/default.nix
+++ b/pkgs/development/python-modules/holoviews/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "holoviews";
-  version = "1.18.3";
+  version = "1.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-V44w6J1ydU+XqD6+CBmP7I6HzH5JslufMew5P5OcpQA=";
+    hash = "sha256-yrFSL3WptGN3+TZLZ1vv15gS4iAFlxRHCljiFHXVMbo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
index f155a5db19c3..fc288114c374 100644
--- a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
+++ b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-bluetooth";
-  version = "1.12.0";
+  version = "1.12.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,34 +28,29 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "home-assistant-bluetooth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KTaZ3xbZpBIN5zP73YdJW6QeCQThGdqejnfWwvL+0R8=";
+    hash = "sha256-WAsgiOmYqmt/PCKp+vZA2To95YZAgnYCF8ysCn5N9nc=";
   };
 
-  patches = [
-    # https://github.com/home-assistant-libs/home-assistant-bluetooth/issues/38
-    ./habluetooth-3.0-compat.patch
-  ];
-
   postPatch = ''
     # drop pytest parametrization (coverage, etc.)
     sed -i '/addopts/d' pyproject.toml
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     cython
     poetry-core
     setuptools
   ];
 
-  propagatedBuildInputs = [ habluetooth ];
-
-  pythonImportsCheck = [ "home_assistant_bluetooth" ];
+  dependencies = [ habluetooth ];
 
   nativeCheckInputs = [
     bleak
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "home_assistant_bluetooth" ];
+
   meta = with lib; {
     description = "Basic bluetooth models used by Home Assistant";
     changelog = "https://github.com/home-assistant-libs/home-assistant-bluetooth/blob/v${version}/CHANGELOG.md";
diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/habluetooth-3.0-compat.patch b/pkgs/development/python-modules/home-assistant-bluetooth/habluetooth-3.0-compat.patch
deleted file mode 100644
index c56d890fd8aa..000000000000
--- a/pkgs/development/python-modules/home-assistant-bluetooth/habluetooth-3.0-compat.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-diff --git a/tests/test_models.py b/tests/test_models.py
-index ecfd70c..b8001f2 100644
---- a/tests/test_models.py
-+++ b/tests/test_models.py
-@@ -88,6 +88,7 @@ def test_model_from_scanner():
-         "service_uuids": ["cba20d00-224d-11e6-9fb8-0002a5d5c51b"],
-         "source": "local",
-         "time": now,
-+        "tx_power": -127,
-     }
- 
- 
-@@ -109,6 +110,7 @@ def test_construct_service_info_bleak():
-         advertisement=switchbot_adv,
-         connectable=False,
-         time=now,
-+        tx_power=None,
-     )
- 
-     assert service_info.service_uuids == ["cba20d00-224d-11e6-9fb8-0002a5d5c51b"]
-@@ -132,6 +134,7 @@ def test_construct_service_info_bleak():
-         "service_uuids": ["cba20d00-224d-11e6-9fb8-0002a5d5c51b"],
-         "source": "local",
-         "time": now,
-+        "tx_power": None,
-     }
- 
- 
-@@ -165,6 +168,7 @@ def test_from_device_and_advertisement_data():
-         "service_uuids": ["cba20d00-224d-11e6-9fb8-0002a5d5c51b"],
-         "source": "local",
-         "time": now_monotonic,
-+        "tx_power": -127,
-     }
- 
- 
-@@ -200,6 +204,7 @@ def test_pyobjc_compat():
-         advertisement=switchbot_adv,
-         connectable=False,
-         time=now,
-+        tx_power=None,
-     )
- 
-     assert service_info.service_uuids == ["cba20d00-224d-11e6-9fb8-0002a5d5c51b"]
-@@ -223,4 +228,5 @@ def test_pyobjc_compat():
-         "service_uuids": ["cba20d00-224d-11e6-9fb8-0002a5d5c51b"],
-         "source": "local",
-         "time": now,
-+        "tx_power": None,
-     }
diff --git a/pkgs/development/python-modules/home-assistant-chip-clusters/default.nix b/pkgs/development/python-modules/home-assistant-chip-clusters/default.nix
index e4425df5c63a..04e71d133e19 100644
--- a/pkgs/development/python-modules/home-assistant-chip-clusters/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-clusters/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-chip-clusters";
-  version = "2024.5.2";
+  version = "2024.7.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     pname = "home_assistant_chip_clusters";
     dist = "py3";
     python = "py3";
-    hash = "sha256-LP/Iw0dgm8TUws/SNUfg7b/OPIboCGB7JRiEwXNd+4A=";
+    hash = "sha256-1yR8Z+R16u099XtxPasmocFbdQPH1Rr6sqngNpWmuWE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/home-assistant-chip-core/default.nix b/pkgs/development/python-modules/home-assistant-chip-core/default.nix
index 0c2c6fda5ed8..c9c18a722d1c 100644
--- a/pkgs/development/python-modules/home-assistant-chip-core/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-core/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-chip-core";
-  version = "2024.5.2";
+  version = "2024.7.0";
   format = "wheel";
 
   disabled = pythonOlder "3.7";
@@ -40,11 +40,11 @@ buildPythonPackage rec {
         {
           "aarch64-linux" = {
             name = "aarch64";
-            hash = "sha256-4C3KHmFbbpeWvmfwoVcc8kWRw22sGJMyDKsUGcbch6U=";
+            hash = "sha256-omEYZXAqkB5+trALBTqJ8SBGasTHD2mT2km6FizBvS8=";
           };
           "x86_64-linux" = {
             name = "x86_64";
-            hash = "sha256-n+Dn0vL0uUEvXsoKegSpJIG2jHbXSrYv2NhL+ZeVHrk=";
+            hash = "sha256-mTMXCpYRon8SqZB+0+P4IM+NUUOKBfxjf/NmLTElB+A=";
           };
         }
         .${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
diff --git a/pkgs/development/python-modules/httpbin/default.nix b/pkgs/development/python-modules/httpbin/default.nix
index 869077cdd6e6..a4e867d98171 100644
--- a/pkgs/development/python-modules/httpbin/default.nix
+++ b/pkgs/development/python-modules/httpbin/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "greenlet" ];
diff --git a/pkgs/development/python-modules/huey/default.nix b/pkgs/development/python-modules/huey/default.nix
index a17f2abbb970..11d41ca0334d 100644
--- a/pkgs/development/python-modules/huey/default.nix
+++ b/pkgs/development/python-modules/huey/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "huey";
-  version = "2.5.0";
+  version = "2.5.1";
 
   format = "pyproject";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "coleifer";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-t767eqZ6U12mG8nWEYC9Hoq/jW2yfrPkCxB3/xLKQww=";
+    hash = "sha256-0oiYmLOwUsZjq7mR0nXwS00VVsLWOXY25whw6262uEo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hvac/default.nix b/pkgs/development/python-modules/hvac/default.nix
index 5f36a456210c..74002cade843 100644
--- a/pkgs/development/python-modules/hvac/default.nix
+++ b/pkgs/development/python-modules/hvac/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "hvac";
-  version = "2.2.0";
+  version = "2.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5LAkjFZyy5pvWXTnyPUnGgnGxmPL+KsRczoifz0tssI=";
+    hash = "sha256-G4XjMg6GQt2C8jTbYyU82haagXWJ6CNxPcX8qDEZseI=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/hvplot/default.nix b/pkgs/development/python-modules/hvplot/default.nix
index 5a4881fefbf3..408263164621 100644
--- a/pkgs/development/python-modules/hvplot/default.nix
+++ b/pkgs/development/python-modules/hvplot/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "hvplot";
-  version = "0.9.2";
+  version = "0.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-moyekkkTmqo97l8c6g+TzzY3TReemGcF/N3CuSxHB5M=";
+    hash = "sha256-6HSGqVv+FRq1LvFjpek9nL0EOZLPC3Vcyt0r82/t03Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/i3ipc/default.nix b/pkgs/development/python-modules/i3ipc/default.nix
index 05495e0ab229..febac35bc4a4 100644
--- a/pkgs/development/python-modules/i3ipc/default.nix
+++ b/pkgs/development/python-modules/i3ipc/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  xorgserver,
+  xorg,
   pytest,
   pytest-xvfb,
   i3,
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     pytest
     xdpyinfo
     pytest-xvfb
-    xorgserver
+    xorg.xvfb
     i3
   ];
 
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 1bb75ee2c86e..3a3a86731df3 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "ibm-cloud-sdk-core";
-  version = "3.20.0";
+  version = "3.20.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CqbZcEP1ianvRRpx527KBjQTjvGBzlSmoKY1Pe5MXRA=";
+    hash = "sha256-nE1JIlYlJ5O3L7FQD5L+JvLnVs7nq4Ff6dmHvgXjj0M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index 2d573dcaeafd..53eaa42d30c0 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "8.0.2";
+  version = "8.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "ical";
     rev = "refs/tags/${version}";
-    hash = "sha256-NrnRId+bgRh31+ocWBjWE2Zo3gOvPJ2fYtOVWOWD5EY=";
+    hash = "sha256-b0laQRDATmx4401bJKkdHsfT9gpMff8vGaZJ9l8O7w4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/icalevents/default.nix b/pkgs/development/python-modules/icalevents/default.nix
index 26c62a1233e1..7cbffd265e8f 100644
--- a/pkgs/development/python-modules/icalevents/default.nix
+++ b/pkgs/development/python-modules/icalevents/default.nix
@@ -5,7 +5,6 @@
   pythonOlder,
   pytestCheckHook,
   poetry-core,
-  pythonRelaxDepsHook,
   datetime,
   httplib2,
   icalendar,
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ifcopenshell/default.nix b/pkgs/development/python-modules/ifcopenshell/default.nix
index c54c7d514c40..5c67a8ee5c2d 100644
--- a/pkgs/development/python-modules/ifcopenshell/default.nix
+++ b/pkgs/development/python-modules/ifcopenshell/default.nix
@@ -18,7 +18,7 @@ let
 in
 buildPythonPackage rec {
   pname = "ifcopenshell";
-  version = "240306";
+  version = "240611";
   format = "other";
 
   src = fetchFromGitHub {
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     repo = "IfcOpenShell";
     rev = "refs/tags/blenderbim-${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-DtA8KeWipPfOnztKG/lrgLZeOCUG3nWR9oW7OST7koc=";
+    sha256 = "sha256-fCgxSambC01qb14EoZTrVxNNw8H3nX8oMi6gk0O/HmQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ihm/default.nix b/pkgs/development/python-modules/ihm/default.nix
index c71616be90db..d281d66369cb 100644
--- a/pkgs/development/python-modules/ihm/default.nix
+++ b/pkgs/development/python-modules/ihm/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "ihm";
-  version = "1.1";
+  version = "1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ihmwg";
     repo = "python-ihm";
     rev = "refs/tags/${version}";
-    hash = "sha256-auzArRwiue2CFo2DNS0NAF+aoZFvadhP6ARM0lRGcSA=";
+    hash = "sha256-lQ7/A/RT8/5gLozsToti+4g1Jc++GtjzOU4XZ+feqDs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ijson/default.nix b/pkgs/development/python-modules/ijson/default.nix
index 100fafcb4959..7a16b64e86f3 100644
--- a/pkgs/development/python-modules/ijson/default.nix
+++ b/pkgs/development/python-modules/ijson/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "ijson";
-  version = "3.2.3";
+  version = "3.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EClOm/ictxPaBbxHkL3/YWYQQy21YZZIJwdImOF0+Rc=";
+    hash = "sha256-fxcua6G+4NTI+OvWOVd7/kKd7g8/lndaBnuLrkSS2KA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/image-go-nord/default.nix b/pkgs/development/python-modules/image-go-nord/default.nix
index 926d26aa2c26..5350b3180d29 100644
--- a/pkgs/development/python-modules/image-go-nord/default.nix
+++ b/pkgs/development/python-modules/image-go-nord/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "image-go-nord";
-  version = "0.1.7";
+  version = "1.1.0";
   format = "setuptools";
   disabled = pythonOlder "3.7";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Schrodinger-Hat";
     repo = "ImageGoNord-pip";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vXABG3aJ6bwT37hfo909oF8qfAY3ZW18xvr1V8vSy5w=";
+    hash = "sha256-2Dnl0dcdMo4PnhHTb/5cJ7C0CvW84av4CCbrTLPqopg=";
   };
 
   propagatedBuildInputs = [ pillow ];
diff --git a/pkgs/development/python-modules/imageio-ffmpeg/default.nix b/pkgs/development/python-modules/imageio-ffmpeg/default.nix
index 5c70706d8c40..250f5ea64b18 100644
--- a/pkgs/development/python-modules/imageio-ffmpeg/default.nix
+++ b/pkgs/development/python-modules/imageio-ffmpeg/default.nix
@@ -1,26 +1,35 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   substituteAll,
-  ffmpeg_4,
+  ffmpeg,
+
+  # build-system
+  setuptools,
+
+  # checks
+  psutil,
+  pytestCheckHook,
   python,
 }:
 
 buildPythonPackage rec {
   pname = "imageio-ffmpeg";
-  version = "0.4.9";
-  format = "setuptools";
+  version = "0.5.1";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-ObzRZgEY7zYPpAR0VlAQcTZGYaqdkCHT0mxY8e4ggfU=";
+  src = fetchFromGitHub {
+    owner = "imageio";
+    repo = "imageio-ffmpeg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-i9DBEhRyW5shgnhpaqpPLTI50q+SATJnxur8PAauYX4=";
   };
 
   patches = [
     (substituteAll {
       src = ./ffmpeg-path.patch;
-      ffmpeg = "${ffmpeg_4}/bin/ffmpeg";
+      ffmpeg = "${ffmpeg}/bin/ffmpeg";
     })
   ];
 
@@ -29,20 +38,31 @@ buildPythonPackage rec {
     sed -i '/setup_requires=\["pip>19"\]/d' setup.py
   '';
 
-  checkPhase = ''
-    runHook preCheck
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    psutil
+    pytestCheckHook
+  ];
 
+  disabledTestPaths = [
+    # network access
+    "tests/test_io.py"
+    "tests/test_special.py"
+    "tests/test_terminate.py"
+  ];
+
+  postCheck = ''
     ${python.interpreter} << EOF
     from imageio_ffmpeg import get_ffmpeg_version
-    assert get_ffmpeg_version() == '${ffmpeg_4.version}'
+    assert get_ffmpeg_version() == '${ffmpeg.version}'
     EOF
-
-    runHook postCheck
   '';
 
   pythonImportsCheck = [ "imageio_ffmpeg" ];
 
   meta = with lib; {
+    changelog = "https://github.com/imageio/imageio-ffmpeg/releases/tag/v${version}";
     description = "FFMPEG wrapper for Python";
     homepage = "https://github.com/imageio/imageio-ffmpeg";
     license = licenses.bsd2;
diff --git a/pkgs/development/python-modules/imageio-ffmpeg/ffmpeg-path.patch b/pkgs/development/python-modules/imageio-ffmpeg/ffmpeg-path.patch
index 33e2f9695d80..aef4d1f2364f 100644
--- a/pkgs/development/python-modules/imageio-ffmpeg/ffmpeg-path.patch
+++ b/pkgs/development/python-modules/imageio-ffmpeg/ffmpeg-path.patch
@@ -1,16 +1,13 @@
-diff --git a/imageio_ffmpeg/_utils.py b/imageio_ffmpeg/_utils.py
-index 6387834..e5e312d 100644
 --- a/imageio_ffmpeg/_utils.py
 +++ b/imageio_ffmpeg/_utils.py
-@@ -38,29 +38,7 @@ def get_ffmpeg_exe():
+@@ -38,28 +38,7 @@ def get_ffmpeg_exe():
  
  @lru_cache()
  def _get_ffmpeg_exe():
 -    plat = get_platform()
 -
 -    # 2. Try from here
--    bin_dir = resource_filename("imageio_ffmpeg", "binaries")
--    exe = os.path.join(bin_dir, FNAME_PER_PLATFORM.get(plat, ""))
+-    exe = os.path.join(_get_bin_dir(), FNAME_PER_PLATFORM.get(plat, ""))
 -    if exe and os.path.isfile(exe) and _is_valid_exe(exe):
 -        return exe
 -
@@ -32,4 +29,4 @@ index 6387834..e5e312d 100644
 +    return "@ffmpeg@"
  
  
- def _popen_kwargs(prevent_sigint=False):
+ def _get_bin_dir():
diff --git a/pkgs/development/python-modules/imap-tools/default.nix b/pkgs/development/python-modules/imap-tools/default.nix
index ce6a88040fad..1ce7dea4645b 100644
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "imap-tools";
-  version = "1.5.0";
+  version = "1.6.0";
 
   disabled = pythonOlder "3.5";
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "ikvk";
     repo = "imap_tools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kY6Y8Uu1HwSkcmlKL5+zPh4n+4mofX2aoPVXAZvInlI=";
+    hash = "sha256-T4sA/PsoTfS2L0RwJyJP6BY33MJuybVqruHnwwstnXA=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/import-expression/default.nix b/pkgs/development/python-modules/import-expression/default.nix
index 3407aa277152..69a93830c5f6 100644
--- a/pkgs/development/python-modules/import-expression/default.nix
+++ b/pkgs/development/python-modules/import-expression/default.nix
@@ -9,13 +9,13 @@
 }:
 buildPythonPackage rec {
   pname = "import-expression";
-  version = "1.1.5";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "import_expression";
-    hash = "sha256-mVlYj8/I3LFEoHJRds/vbCjH2x/C1oNiUCXmh1FtQME=";
+    hash = "sha256-Biw7dIOPKbDcqYJSCyeqC/seREcVihSZuaKNFfgjTew=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 43c9826aa1ba..eea1111ff05e 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -16,12 +16,13 @@
 
   # tests
   jaraco-collections,
+  jaraco-test,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "importlib-resources";
-  version = "6.3.2";
+  version = "6.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -29,7 +30,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "importlib_resources";
     inherit version;
-    hash = "sha256-lj63lkklKwFgwa/P5aHT/jrWbt0KixFL6s/7cMBnQiM=";
+    hash = "sha256-zbK0U7gEbKTjeY6x2E88zhRGoOjnte9O+2APGfw5gUU=";
   };
 
   build-system = [
@@ -42,6 +43,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     jaraco-collections
+    jaraco-test
   ];
 
   pythonImportsCheck = [ "importlib_resources" ];
diff --git a/pkgs/development/python-modules/incomfort-client/default.nix b/pkgs/development/python-modules/incomfort-client/default.nix
index 86f59510ba26..8f4b2e960ebc 100644
--- a/pkgs/development/python-modules/incomfort-client/default.nix
+++ b/pkgs/development/python-modules/incomfort-client/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "incomfort-client";
-  version = "0.6.2";
+  version = "0.6.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "zxdavb";
     repo = "incomfort-client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2hTH0haG8ja0Hgomj7kbbHUij9w3jbhHeKeMCtsgeEE=";
+    hash = "sha256-GD5NsVvmuCuEXw8KvojSj5b67/i0skvhYW8ko+9iysU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/inflect/default.nix b/pkgs/development/python-modules/inflect/default.nix
index 45b0b844bdb9..8d0fe80336c6 100644
--- a/pkgs/development/python-modules/inflect/default.nix
+++ b/pkgs/development/python-modules/inflect/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "inflect";
-  version = "7.2.0";
+  version = "7.2.1";
   disabled = isPy27;
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Mv6s+s/K4vIub8zeoQ8N3yamOPrENNDd2q+8oANPN4Q=";
+    hash = "sha256-p85eI9Z5hzTyVsGtntUhhrjsJ28QsYzj0+yxnCHrbLY=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/inform/default.nix b/pkgs/development/python-modules/inform/default.nix
index 400887dbd277..e4397954dd66 100644
--- a/pkgs/development/python-modules/inform/default.nix
+++ b/pkgs/development/python-modules/inform/default.nix
@@ -6,13 +6,14 @@
   arrow,
   six,
   hypothesis,
+  num2words,
   pytestCheckHook,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "inform";
-  version = "1.29";
+  version = "1.30";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +22,7 @@ buildPythonPackage rec {
     owner = "KenKundert";
     repo = "inform";
     rev = "refs/tags/v${version}";
-    hash = "sha256-quJGgXMvVZGqZA6M/AjU/cjYeL0R2nuPDoL0Ji0Ow6I=";
+    hash = "sha256-6Yx9ZdmrFApJ6zBiC8Q++hlATVqjriJLS2KsqC0IBCk=";
   };
 
   nativeBuildInputs = [ flit-core ];
@@ -32,6 +33,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    num2words
     pytestCheckHook
     hypothesis
   ];
diff --git a/pkgs/development/python-modules/inquirer/default.nix b/pkgs/development/python-modules/inquirer/default.nix
index 15e24ce15769..f7974e228274 100644
--- a/pkgs/development/python-modules/inquirer/default.nix
+++ b/pkgs/development/python-modules/inquirer/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "inquirer";
-  version = "3.2.4";
+  version = "3.2.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "magmax";
     repo = "python-inquirer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LsZ2SYgBOKZegk7b9DwForwMA49XvIe+Z6WvI1/YscY=";
+    hash = "sha256-7No4Yw0zBGflvglx7G1/yjrsU/DkTrSz93DfIzokBYM=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/instructor/default.nix b/pkgs/development/python-modules/instructor/default.nix
index bb36e7a8abf2..02cba2b3b9d6 100644
--- a/pkgs/development/python-modules/instructor/default.nix
+++ b/pkgs/development/python-modules/instructor/default.nix
@@ -5,6 +5,7 @@
   buildPythonPackage,
   docstring-parser,
   fetchFromGitHub,
+  jiter,
   openai,
   poetry-core,
   pydantic,
@@ -15,7 +16,6 @@
   diskcache,
   redis,
   pythonOlder,
-  pythonRelaxDepsHook,
   rich,
   tenacity,
   typer,
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "instructor";
-  version = "1.2.3";
+  version = "1.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -32,21 +32,21 @@ buildPythonPackage rec {
     owner = "jxnl";
     repo = "instructor";
     rev = "refs/tags/${version}";
-    hash = "sha256-LmorlFKIG7iPAK4pDbQqjxjiwB1md3u52B4u5WlqqTk=";
+    hash = "sha256-ye6uNnwvJ3RXmKM8ix/sBiJgeCFQazNVgHZkBAnL0nw=";
   };
 
   pythonRelaxDeps = [
     "docstring-parser"
     "pydantic"
+    "jiter"
   ];
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-
   dependencies = [
     aiohttp
     docstring-parser
+    jiter
     openai
     pydantic
     rich
@@ -75,7 +75,6 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # Tests require OpenAI API key
     "tests/test_distil.py"
-    "tests/test_new_client.py"
     "tests/llm/"
   ];
 
diff --git a/pkgs/development/python-modules/intensity-normalization/default.nix b/pkgs/development/python-modules/intensity-normalization/default.nix
index a6f697ef8c28..f6c38f32cad6 100644
--- a/pkgs/development/python-modules/intensity-normalization/default.nix
+++ b/pkgs/development/python-modules/intensity-normalization/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   pythonOlder,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   matplotlib,
   nibabel,
   numpy,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
     substituteInPlace setup.cfg --replace "pytest-runner" ""
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "nibabel" ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ipwhois/default.nix b/pkgs/development/python-modules/ipwhois/default.nix
index 43495abeb052..bd69e5ccd514 100644
--- a/pkgs/development/python-modules/ipwhois/default.nix
+++ b/pkgs/development/python-modules/ipwhois/default.nix
@@ -9,7 +9,6 @@
   libredirect,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -41,7 +40,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "dnspython" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 56feb411fe95..af34d35c647d 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -42,13 +42,13 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "8.24.0";
+  version = "8.25.0";
   pyproject = true;
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AQ2z+KcopXi7ZB/dBsBjufuOlqlGTGOuxjEPvLXoBQE=";
+    hash = "sha256-xu1yahQLbnJbkRUo+AQ5xTT6yRUkavPvw5RAprD51xY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/irc/default.nix b/pkgs/development/python-modules/irc/default.nix
index 8afe89caf8ca..b73810bf3b8a 100644
--- a/pkgs/development/python-modules/irc/default.nix
+++ b/pkgs/development/python-modules/irc/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "irc";
-  version = "20.4.0";
+  version = "20.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fSUX9VZta/Oqhdf5jHdYth8NY+6RW/2fb1ZxOXNmRPk=";
+    hash = "sha256-J1aYebrlzYmRwhfNy0ZRkNe08YpqJnSeSNBT/QtaUsw=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/jaraco-abode/default.nix b/pkgs/development/python-modules/jaraco-abode/default.nix
index a1a725ddf001..a6e843f7d4a2 100644
--- a/pkgs/development/python-modules/jaraco-abode/default.nix
+++ b/pkgs/development/python-modules/jaraco-abode/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "jaraco-abode";
-  version = "5.1.1";
+  version = "5.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "jaraco";
     repo = "jaraco.abode";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TUxljF1k/fvQoNcHx6jMRJrYgzxjXefvMl+mBD0DL8o=";
+    hash = "sha256-O7adVcczkEZ3B7qhZlIWp5A7ujHlEjLQG6OfR59eSO4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jaraco-classes/default.nix b/pkgs/development/python-modules/jaraco-classes/default.nix
index 399849db57d9..e80c2add69f2 100644
--- a/pkgs/development/python-modules/jaraco-classes/default.nix
+++ b/pkgs/development/python-modules/jaraco-classes/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "jaraco-classes";
-  version = "3.3.1";
+  version = "3.4.0";
   format = "pyproject";
 
   disabled = isPy27;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "jaraco";
     repo = "jaraco.classes";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-ds84jNEx/2/BnMTbLMvXf/nxKSqyCBM7B7S0NNYagVE=";
+    sha256 = "sha256-pXDsLKiEru+UXcEBT4/cP1u8s9vSn1Zhf7Qnwy9Zr0I=";
   };
 
   pythonNamespaces = [ "jaraco" ];
diff --git a/pkgs/development/python-modules/jaraco-context/default.nix b/pkgs/development/python-modules/jaraco-context/default.nix
index 41837b391d89..c0ea092b0fc1 100644
--- a/pkgs/development/python-modules/jaraco-context/default.nix
+++ b/pkgs/development/python-modules/jaraco-context/default.nix
@@ -4,11 +4,12 @@
   fetchFromGitHub,
   pythonOlder,
   setuptools-scm,
+  backports-tarfile,
 }:
 
 buildPythonPackage rec {
   pname = "jaraco-context";
-  version = "4.3.0";
+  version = "5.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,13 +18,15 @@ buildPythonPackage rec {
     owner = "jaraco";
     repo = "jaraco.context";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YdbkpKv7k62uyhmjKoxeA9uf5BWnRD/rK+z46FJN4xk=";
+    hash = "sha256-Caj51qBLHbuiey023iLc+N2M8QiJKH8G/Pzu1v3AToU=";
   };
 
   pythonNamespaces = [ "jaraco" ];
 
   nativeBuildInputs = [ setuptools-scm ];
 
+  dependencies = lib.optionals (pythonOlder "3.12") [ backports-tarfile ];
+
   # Module has no tests
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/jaraco-text/default.nix b/pkgs/development/python-modules/jaraco-text/default.nix
index 4828e7c0b0c9..a3656f5cfbc2 100644
--- a/pkgs/development/python-modules/jaraco-text/default.nix
+++ b/pkgs/development/python-modules/jaraco-text/default.nix
@@ -15,15 +15,15 @@
 
 buildPythonPackage rec {
   pname = "jaraco-text";
-  version = "3.12.0";
+  version = "3.12.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    pname = "jaraco.text";
+    pname = "jaraco_text";
     inherit version;
-    hash = "sha256-OJ4lyNSzLpcVv1MFlvqw9c06pHKW5DlpOS4YpUGvWSw=";
+    hash = "sha256-tplJH50HS0/q/f2gQH+lu8XYP0hWB6AS6TRyuhYfaEM=";
   };
 
   pythonNamespaces = [ "jaraco" ];
diff --git a/pkgs/development/python-modules/jaxtyping/default.nix b/pkgs/development/python-modules/jaxtyping/default.nix
index 7d2a2b0bfa8e..c8fba04ec260 100644
--- a/pkgs/development/python-modules/jaxtyping/default.nix
+++ b/pkgs/development/python-modules/jaxtyping/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   hatchling,
-  pythonRelaxDepsHook,
   typeguard,
   cloudpickle,
   equinox,
@@ -33,7 +32,6 @@ let
 
     build-system = [
       hatchling
-      pythonRelaxDepsHook
     ];
 
     dependencies = [
diff --git a/pkgs/development/python-modules/jdatetime/default.nix b/pkgs/development/python-modules/jdatetime/default.nix
index 585d730cdd76..fa774a40b7e8 100644
--- a/pkgs/development/python-modules/jdatetime/default.nix
+++ b/pkgs/development/python-modules/jdatetime/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "jdatetime";
-  version = "4.1.1";
+  version = "5.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HdDuIQFgx70wACgDxEPmJgrGAuplsGVlKh1WfTv9yno=";
+    hash = "sha256-LMYD2RPA2OMokoRU09KVJhywN+mVAif2fJYpq0cQ/fk=";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/jedi/default.nix b/pkgs/development/python-modules/jedi/default.nix
index b39ba3ce8a42..26bd4a173dcb 100644
--- a/pkgs/development/python-modules/jedi/default.nix
+++ b/pkgs/development/python-modules/jedi/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
+  fetchpatch2,
 
   # build-system
   setuptools,
@@ -31,6 +32,14 @@ buildPythonPackage rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch2 {
+      # pytest8 compat
+      url = "https://github.com/davidhalter/jedi/commit/39c8317922f8f0312c12127cad10aea38d0ed7b5.patch";
+      hash = "sha256-wXHWcfoRJUl+ADrNMML0+DYTcRTyLs55Qrs7sDqT8BA=";
+    })
+  ];
+
   nativeBuildInputs = [ setuptools ];
 
   propagatedBuildInputs = [ parso ];
diff --git a/pkgs/development/python-modules/jellyfish/default.nix b/pkgs/development/python-modules/jellyfish/default.nix
index 1bef7eeca9ed..4210f5499d28 100644
--- a/pkgs/development/python-modules/jellyfish/default.nix
+++ b/pkgs/development/python-modules/jellyfish/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "jellyfish";
-  version = "1.0.0";
+  version = "1.0.4";
 
   disabled = !isPy3k;
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iBquNnGZm7B85QwnaW8pyn6ELz4SOswNtlJcmZmIG9Q=";
+    hash = "sha256-cqq7O+3VE83SBxIkL9URc7WZcsCxRregucbzLxZWKT8=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}-rust-dependencies";
-    hash = "sha256-Grk+n4VCPjirafcRWWI51jHw/IFUYkBtbXY739j0MFI=";
+    hash = "sha256-HtzgxTO6tbN/tohaiTm9B9jrFYGTt1Szo9qRzpcy8BA=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index ba8f7048c5b6..da220641dbe2 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   python,
+  pythonAtLeast,
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
@@ -44,6 +45,14 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ] ++ passthru.optional-dependencies.i18n;
 
+  disabledTests = lib.optionals (pythonAtLeast "3.13") [
+    # https://github.com/pallets/jinja/issues/1900
+    "test_custom_async_iteratable_filter"
+    "test_first"
+    "test_loop_errors"
+    "test_package_zip_list"
+  ];
+
   passthru.doc = stdenv.mkDerivation {
     # Forge look and feel of multi-output derivation as best as we can.
     #
diff --git a/pkgs/development/python-modules/jiter/Cargo.lock b/pkgs/development/python-modules/jiter/Cargo.lock
new file mode 100644
index 000000000000..d19633c580b9
--- /dev/null
+++ b/pkgs/development/python-modules/jiter/Cargo.lock
@@ -0,0 +1,588 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "arbitrary"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
+
+[[package]]
+name = "autocfg"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+
+[[package]]
+name = "bencher"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dfdb4953a096c551ce9ace855a604d702e6e62d77fac690575ae347571717f5"
+
+[[package]]
+name = "bitvec"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
+dependencies = [
+ "funty",
+ "radium",
+ "tap",
+ "wyz",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74b6a57f98764a267ff415d50a25e6e166f3831a5071af4995296ea97d210490"
+dependencies = [
+ "jobserver",
+ "libc",
+ "once_cell",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "codspeed"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a104ac948e0188b921eb3fcbdd55dcf62e542df4c7ab7e660623f6288302089"
+dependencies = [
+ "colored",
+ "libc",
+ "serde_json",
+]
+
+[[package]]
+name = "codspeed-bencher-compat"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ceaba84ea2634603a0f199c07fa39ff4dda61f89a3f9149fb89b035bc317b671"
+dependencies = [
+ "bencher",
+ "codspeed",
+]
+
+[[package]]
+name = "colored"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbf2150cce219b664a8a70df7a1f933836724b503f8a413af9365b4dcc4d90b8"
+dependencies = [
+ "lazy_static",
+ "windows-sys",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "funty"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
+
+[[package]]
+name = "fuzz"
+version = "0.5.0"
+dependencies = [
+ "indexmap",
+ "jiter",
+ "libfuzzer-sys",
+ "num-bigint",
+ "num-traits",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "indexmap"
+version = "2.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "indoc"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "jiter"
+version = "0.5.0"
+dependencies = [
+ "ahash",
+ "bencher",
+ "bitvec",
+ "codspeed-bencher-compat",
+ "lexical-parse-float",
+ "num-bigint",
+ "num-traits",
+ "paste",
+ "pyo3",
+ "pyo3-build-config",
+ "serde",
+ "serde_json",
+ "smallvec",
+]
+
+[[package]]
+name = "jiter-python"
+version = "0.5.0"
+dependencies = [
+ "jiter",
+ "pyo3",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2b099aaa34a9751c5bf0878add70444e1ed2dd73f347be99003d4577277de6e"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "lexical-parse-float"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683b3a5ebd0130b8fb52ba0bdc718cc56815b6a097e28ae5a6997d0ad17dc05f"
+dependencies = [
+ "lexical-parse-integer",
+ "lexical-util",
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-parse-integer"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d0994485ed0c312f6d965766754ea177d07f9c00c9b82a5ee62ed5b47945ee9"
+dependencies = [
+ "lexical-util",
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-util"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5255b9ff16ff898710eb9eb63cb39248ea8a5bb036bea8085b1a767ff6c4e3fc"
+dependencies = [
+ "static_assertions",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.155"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a96cfd5557eb82f2b83fed4955246c988d331975a002961b07c81584d107e7f7"
+dependencies = [
+ "arbitrary",
+ "cc",
+ "once_cell",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "portable-atomic"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1962a33ed2a201c637fc14a4e0fd4e06e6edfdeee6a5fede0dab55507ad74cf7"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "num-bigint",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab7164b2202753bd33afc7f90a10355a719aa973d1f94502c50d06f3488bc420"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6424906ca49013c0829c5c1ed405e20e2da2dc78b82d198564880a704e6a7b7"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b2f19e153122d64afd8ce7aaa72f06a00f52e34e1d1e74b6d71baea396460a"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd698c04cac17cf0fe63d47790ab311b8b25542f5cb976b65c374035c50f1eef"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "radium"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "serde"
+version = "1.0.203"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.203"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.120"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e0d21c9a8cae1235ad58a00c11cb40d4b1e5c784f1ef2c537876ed6ffd8b7c5"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "syn"
+version = "2.0.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901fa70d88b9d6c98022e23b4136f9f3e54e4662c3bc1bd1d84a42a9a0f0c1e9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tap"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "unindent"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "wyz"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
+dependencies = [
+ "tap",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/pkgs/development/python-modules/jiter/default.nix b/pkgs/development/python-modules/jiter/default.nix
new file mode 100644
index 000000000000..4f23966dcc16
--- /dev/null
+++ b/pkgs/development/python-modules/jiter/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  rustPlatform,
+  fetchFromGitHub,
+  libiconv,
+  dirty-equals,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "jiter";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "jiter";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-EgovddXbwutLaVkosdbJ2Y3BpEms+RoeaO8ghBRNdio=";
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';
+
+  cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; };
+
+  buildAndTestSubdir = "crates/jiter-python";
+
+  nativeBuildInputs = [ rustPlatform.cargoSetupHook ];
+
+  build-system = [ rustPlatform.maturinBuildHook ];
+
+  buildInputs = [ libiconv ];
+
+  pythonImportsCheck = [ "jiter" ];
+
+  nativeCheckInputs = [
+    dirty-equals
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Fast iterable JSON parser";
+    homepage = "https://github.com/pydantic/jiter/";
+    changelog = "https://github.com/pydantic/jiter/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ natsukium ];
+  };
+}
diff --git a/pkgs/development/python-modules/jiwer/default.nix b/pkgs/development/python-modules/jiwer/default.nix
index 6d4fb7d8c971..0d200572a7e2 100644
--- a/pkgs/development/python-modules/jiwer/default.nix
+++ b/pkgs/development/python-modules/jiwer/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   rapidfuzz,
   click,
   pythonOlder,
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/joblib/default.nix b/pkgs/development/python-modules/joblib/default.nix
index 764d14a58d97..f56aa7a39197 100644
--- a/pkgs/development/python-modules/joblib/default.nix
+++ b/pkgs/development/python-modules/joblib/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "joblib";
-  version = "1.4.0";
+  version = "1.4.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HrDcCRkZzThEkN6JDLXf1ThBCm1LO1Tu8J+4xQtAmxw=";
+    hash = "sha256-I4LFgWsmNvvSCgng9Ona1HNnZf37fcpYKUO5wTZrPw4=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/joserfc/default.nix b/pkgs/development/python-modules/joserfc/default.nix
index 17f5e6ae3b9d..a48098db4a48 100644
--- a/pkgs/development/python-modules/joserfc/default.nix
+++ b/pkgs/development/python-modules/joserfc/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "joserfc";
-  version = "0.9.0";
+  version = "0.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "authlib";
     repo = "joserfc";
-    rev = version;
-    hash = "sha256-+NFCveMPzE0hSs2Qe20/MDHApXVtU3cR/GPFKPqfVV4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-mnJzhkdX0+5Y/XwGlHgxLP0me8Cs/Cl3p46KgTKw2ug=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index 6b976adc6b1e..7d6912cc4a0f 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -12,7 +12,6 @@
   pygments,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   pyyaml,
   requests,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     click
diff --git a/pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix b/pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix
index 7187d7353fd0..9a65903e384d 100644
--- a/pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix
+++ b/pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "json-stream-rs-tokenizer";
-  version = "0.4.25";
+  version = "0.4.26";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "smheidrich";
     repo = "py-json-stream-rs-tokenizer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zo/jRAWSwcOnO8eU4KhDNz44P6xDGcrZf9CflwsSvF0=";
+    hash = "sha256-ogX0KsfHRQW7+exRMKGwJiNINrOKPiTKxAqiTZyEWrg=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/development/python-modules/jsonconversion/default.nix b/pkgs/development/python-modules/jsonconversion/default.nix
index dc4e89d9fa99..ac068b224edc 100644
--- a/pkgs/development/python-modules/jsonconversion/default.nix
+++ b/pkgs/development/python-modules/jsonconversion/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   pytestCheckHook,
   pdm-backend,
   numpy,
@@ -23,7 +22,6 @@ buildPythonPackage rec {
 
   build-system = [
     pdm-backend
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/jsonpickle/default.nix b/pkgs/development/python-modules/jsonpickle/default.nix
index a36d3429302e..dfb40be4bb61 100644
--- a/pkgs/development/python-modules/jsonpickle/default.nix
+++ b/pkgs/development/python-modules/jsonpickle/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "jsonpickle";
-  version = "3.0.4";
+  version = "3.2.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-obFMjWIhzY85TyqX5zXqHX7ckn+9E1sm8vhwBlfIxis=";
+    hash = "sha256-S212QJdBmfes+QNSlTZbWhpxqREJ7/oVuhcPu0jPhxw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jsonpointer/default.nix b/pkgs/development/python-modules/jsonpointer/default.nix
index 72c50ead2090..5017a0da27d6 100644
--- a/pkgs/development/python-modules/jsonpointer/default.nix
+++ b/pkgs/development/python-modules/jsonpointer/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "jsonpointer";
-  version = "2.4";
+  version = "3.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WFzugrcCEfqeYEO3u4nbbhqklSQ0Dd6K1rYyBuponYg=";
+    hash = "sha256-Ky1ynyCRUi1hw7MfguEYcPYLaPQ/vHBct2v0uDKvWe8=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/jsonschema-path/default.nix b/pkgs/development/python-modules/jsonschema-path/default.nix
index 467c162ca545..153c584047a9 100644
--- a/pkgs/development/python-modules/jsonschema-path/default.nix
+++ b/pkgs/development/python-modules/jsonschema-path/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   pathable,
   pyyaml,
   referencing,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "referencing" ];
diff --git a/pkgs/development/python-modules/jsonschema-spec/default.nix b/pkgs/development/python-modules/jsonschema-spec/default.nix
index f79283fa5160..f424b6db4649 100644
--- a/pkgs/development/python-modules/jsonschema-spec/default.nix
+++ b/pkgs/development/python-modules/jsonschema-spec/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build
   poetry-core,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "referencing" ];
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index c68b003bf52f..b0db522f61e9 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "4.21.1";
+  version = "4.22.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hXJ8ACefX6a+2+YjjSqmQDvt2LSGSrESB9B988wbLuU=";
+    hash = "sha256-WyLUNKRZNRGa+ZBVLIYuXW1WTo9mASBrMFph/fZhorc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index 166a1bb82b3f..9f3df60d49ca 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "4.2.1";
+  version = "4.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oQ+3EIWmkAggxi1DMkAFBGQC/8jw/eaWED43I4qDlQc=";
+    hash = "sha256-pTS2olcZqSpA1RT7Ezqf6PDZmBsLvOXYpfyqMzRKMDg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/justext/default.nix b/pkgs/development/python-modules/justext/default.nix
index fd9d94c399a0..cd2e6c933a6d 100644
--- a/pkgs/development/python-modules/justext/default.nix
+++ b/pkgs/development/python-modules/justext/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   pytestCheckHook,
   lxml,
+  lxml-html-clean,
 }:
 
 buildPythonPackage rec {
@@ -18,14 +19,17 @@ buildPythonPackage rec {
     hash = "sha256-9i7hzCK/ijh8xw9l2ZbVhVj5IBf0WD/49/R1tSWgqrQ=";
   };
 
-  propagatedBuildInputs = [ lxml ];
+  propagatedBuildInputs = [
+    lxml
+    lxml-html-clean
+  ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   # patch out coverage report
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace " --cov=justext --cov-report=term-missing --no-cov-on-fail" ""
+      --replace-fail " --cov=justext --cov-report=term-missing --no-cov-on-fail" ""
   '';
 
   pythonImportsCheck = [ "justext" ];
diff --git a/pkgs/development/python-modules/karton-dashboard/default.nix b/pkgs/development/python-modules/karton-dashboard/default.nix
index 96fba596da1f..efbff71a3795 100644
--- a/pkgs/development/python-modules/karton-dashboard/default.nix
+++ b/pkgs/development/python-modules/karton-dashboard/default.nix
@@ -8,7 +8,6 @@
   networkx,
   prometheus-client,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -32,7 +31,6 @@ buildPythonPackage rec {
     "prometheus-client"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     flask
diff --git a/pkgs/development/python-modules/kbcstorage/default.nix b/pkgs/development/python-modules/kbcstorage/default.nix
index 4385c806fa0e..aeccbe375738 100644
--- a/pkgs/development/python-modules/kbcstorage/default.nix
+++ b/pkgs/development/python-modules/kbcstorage/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "sapi-python-client";
-  version = "0.8.0";
+  version = "0.9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "keboola";
     repo = "sapi-python-client";
     rev = "refs/tags/${version}";
-    hash = "sha256-Xc4VD91Nhnj0UyWHpdwEaETJVH8Ue6/kuiKEMaiSR0g=";
+    hash = "sha256-4ykOwSQ1tM0ZviETkjU0ydg7FWjkGNysHQe+f9MS0MM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/keyring/default.nix b/pkgs/development/python-modules/keyring/default.nix
index 0fa0854d6dac..2ffd2235d3de 100644
--- a/pkgs/development/python-modules/keyring/default.nix
+++ b/pkgs/development/python-modules/keyring/default.nix
@@ -8,8 +8,9 @@
   setuptools-scm,
   shtab,
   importlib-metadata,
-  dbus-python,
   jaraco-classes,
+  jaraco-context,
+  jaraco-functools,
   jeepney,
   secretstorage,
   pytestCheckHook,
@@ -17,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "keyring";
-  version = "24.3.1";
+  version = "25.2.1";
   pyproject = true;
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wzJ7b/r8DovvvbWXys20ko/+XBIS92RfGG5tmVeomNs=";
+    hash = "sha256-2q/9QtvaJd2vsa1f7EAk5bvP5CRZfKHKRSspmGHknxs=";
   };
 
   nativeBuildInputs = [
@@ -33,7 +34,11 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs =
-    [ jaraco-classes ]
+    [
+      jaraco-classes
+      jaraco-context
+      jaraco-functools
+    ]
     ++ lib.optionals stdenv.isLinux [
       jeepney
       secretstorage
diff --git a/pkgs/development/python-modules/khanaa/default.nix b/pkgs/development/python-modules/khanaa/default.nix
index 91148489c9e8..5c9cf53dc11c 100644
--- a/pkgs/development/python-modules/khanaa/default.nix
+++ b/pkgs/development/python-modules/khanaa/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "khanaa";
-  version = "0.0.6";
+  version = "0.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "cakimpei";
     repo = "khanaa";
     rev = "refs/tags/v${version}";
-    hash = "sha256-BzxNHYMkp5pdJYQ80EI5jlP654yX9woW7wz1jArCln4=";
+    hash = "sha256-QFvvahVEld3BooINeUYJDahZyfh5xmQNtWRLAOdr6lw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/kserve/default.nix b/pkgs/development/python-modules/kserve/default.nix
index 567467c7bf47..b8877b7a6462 100644
--- a/pkgs/development/python-modules/kserve/default.nix
+++ b/pkgs/development/python-modules/kserve/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   deprecation,
   poetry-core,
-  pythonRelaxDepsHook,
   async-timeout,
   cloudevents,
   fastapi,
@@ -56,7 +55,6 @@ buildPythonPackage rec {
     poetry-core
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     async-timeout
diff --git a/pkgs/development/python-modules/kubernetes/default.nix b/pkgs/development/python-modules/kubernetes/default.nix
index 4f5eacab9d19..b7387675c954 100644
--- a/pkgs/development/python-modules/kubernetes/default.nix
+++ b/pkgs/development/python-modules/kubernetes/default.nix
@@ -10,7 +10,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   requests-oauthlib,
@@ -22,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "kubernetes";
-  version = "29.0.0";
+  version = "30.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -31,18 +30,10 @@ buildPythonPackage rec {
     owner = "kubernetes-client";
     repo = "python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KChfiXYnJTeIW6O7GaK/fMxU2quIvbjc4gB4aZBeTtI=";
+    hash = "sha256-zOooibXkk0iA6IYJViz+SIMgHwG0fr4WR3ZjhgIeUjE=";
   };
 
-  postPatch = ''
-    substituteInPlace kubernetes/base/config/kube_config_test.py \
-      --replace-fail "assertEquals" "assertEqual"
-  '';
-
-  pythonRelaxDeps = [ "urllib3" ];
-
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
@@ -58,7 +49,7 @@ buildPythonPackage rec {
     websocket-client
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     adal = [ adal ];
   };
 
@@ -67,7 +58,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     mock
     pytestCheckHook
-  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   disabledTests = lib.optionals stdenv.isDarwin [
     # AssertionError: <class 'urllib3.poolmanager.ProxyManager'> != <class 'urllib3.poolmanager.Poolmanager'>
diff --git a/pkgs/development/python-modules/kurbopy/default.nix b/pkgs/development/python-modules/kurbopy/default.nix
index 0935e36f7c76..d084fd43fac6 100644
--- a/pkgs/development/python-modules/kurbopy/default.nix
+++ b/pkgs/development/python-modules/kurbopy/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "kurbopy";
-  version = "0.10.40";
+  version = "0.11.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dhpcDi20Na6SDbRxrC8N3SWdN1J/CWJgCUI3scJX/6s=";
+    hash = "sha256-0TIVx0YH5L8l6at1fcWkj2UZYK0aF1fahTu9/+7MWMI=";
   };
 
   propagatedBuildInputs = [ fonttools ];
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-V3LeT0dqkfft1ftc+azwvuSzzdUJ7/wAp31fN7te9RQ=";
+    hash = "sha256-W0BebCXC1wqwtQP+zHjISxSJjXHD9U6p9eNS12Nfb2Y=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index 082ee58cbac3..04f3b74c95fd 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -16,7 +16,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   shapely,
@@ -28,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "labelbox";
-  version = "3.67.0";
+  version = "3.72.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -37,7 +36,7 @@ buildPythonPackage rec {
     owner = "Labelbox";
     repo = "labelbox-python";
     rev = "refs/tags/v.${version}";
-    hash = "sha256-JQTjmYxPBS8JC4HQTtbQ7hb80LPLYE4OEj1lFA6cZ1Y=";
+    hash = "sha256-gor1LFT/XrWxWPwGn8lOkF46p/yrRILZp6fpeV+xvto=";
   };
 
   postPatch = ''
@@ -49,7 +48,6 @@ buildPythonPackage rec {
       --replace-fail "pytest_plugins" "_pytest_plugins"
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "python-dateutil" ];
 
diff --git a/pkgs/development/python-modules/labgrid/default.nix b/pkgs/development/python-modules/labgrid/default.nix
index d677d59d2365..405bbfa33810 100644
--- a/pkgs/development/python-modules/labgrid/default.nix
+++ b/pkgs/development/python-modules/labgrid/default.nix
@@ -15,7 +15,6 @@
   pytestCheckHook,
   pytest-dependency,
   pytest-mock,
-  pythonRelaxDepsHook,
   pyudev,
   pyusb,
   pyyaml,
@@ -28,17 +27,16 @@
 
 buildPythonPackage rec {
   pname = "labgrid";
-  version = "23.0.5";
+  version = "23.0.6";
 
   src = fetchFromGitHub {
     owner = "labgrid-project";
     repo = "labgrid";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jrapbSrybuLT3V11rvV342tOr7/sRwBMgAdNWDG5obA=";
+    hash = "sha256-UAfBzQZeFNs2UJSFb5fH5wHXQoVU/dOTFciR0/UB7vc=";
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
diff --git a/pkgs/development/python-modules/lacuscore/default.nix b/pkgs/development/python-modules/lacuscore/default.nix
index 2f5fbf4e6901..9a6db9930256 100644
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -10,7 +10,6 @@
   pythonOlder,
   redis,
   requests,
-  pythonRelaxDepsHook,
   sphinx,
   ua-parser,
 }:
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     async-timeout
diff --git a/pkgs/development/python-modules/langchain-chroma/default.nix b/pkgs/development/python-modules/langchain-chroma/default.nix
index fb11a1abeed4..8afb70b1a467 100644
--- a/pkgs/development/python-modules/langchain-chroma/default.nix
+++ b/pkgs/development/python-modules/langchain-chroma/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-chroma";
-  version = "0.1.1";
+  version = "0.2.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    rev = "refs/tags/langchain-chroma==${version}";
-    hash = "sha256-PW4vfZVccuYnaR0jtOfHVaXXYoUyQbCfB8NwM+mXFGc=";
+    rev = "refs/tags/langchain-core==${version}";
+    hash = "sha256-/BUn/NxaE9l3VY6dPshr1JJaHTGzn9NMQhSQ2De65Jg=";
   };
 
   sourceRoot = "${src.name}/libs/partners/chroma";
diff --git a/pkgs/development/python-modules/langchain-community/default.nix b/pkgs/development/python-modules/langchain-community/default.nix
index 063ee482ddb5..4bf2cd9bd0f9 100644
--- a/pkgs/development/python-modules/langchain-community/default.nix
+++ b/pkgs/development/python-modules/langchain-community/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-community";
-  version = "0.2.5";
+  version = "0.2.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -37,8 +37,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    rev = "refs/tags/${pname}==${version}";
-    hash = "sha256-SVqhNfRAQoVyUsPw55ByPtVzU/h1II/ox8I79QJsci8=";
+    rev = "refs/tags/langchain-core==${version}";
+    hash = "sha256-/BUn/NxaE9l3VY6dPshr1JJaHTGzn9NMQhSQ2De65Jg=";
   };
 
   sourceRoot = "${src.name}/libs/community";
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 954ddd477f4a..f55d59b85059 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -15,7 +15,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   syrupy,
   tenacity,
@@ -24,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-core";
-  version = "0.2.7";
+  version = "0.2.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,8 +31,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    rev = "langchain-core==${version}";
-    hash = "sha256-MmWgnpOO+OWUyRUBqIKuIHG2/p8NfSlVJVbUXfF4spg=";
+    rev = "refs/tags/langchain-core==${version}";
+    hash = "sha256-/BUn/NxaE9l3VY6dPshr1JJaHTGzn9NMQhSQ2De65Jg=";
   };
 
   sourceRoot = "${src.name}/libs/core";
@@ -45,7 +44,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     jsonpatch
diff --git a/pkgs/development/python-modules/langchain-text-splitters/default.nix b/pkgs/development/python-modules/langchain-text-splitters/default.nix
index d24c177a0712..beb4c5d8c332 100644
--- a/pkgs/development/python-modules/langchain-text-splitters/default.nix
+++ b/pkgs/development/python-modules/langchain-text-splitters/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-text-splitters";
-  version = "0.2.1";
+  version = "0.2.9";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    rev = "refs/tags/langchain-text-splitters==${version}";
-    hash = "sha256-5le+P+7iGjrTetnTHiJilqtc7G7kJbZnEsUgFyF2aQ8=";
+    rev = "refs/tags/langchain-core==${version}";
+    hash = "sha256-/BUn/NxaE9l3VY6dPshr1JJaHTGzn9NMQhSQ2De65Jg=";
   };
 
   sourceRoot = "${src.name}/libs/text-splitters";
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index b6d34154583d..73c6050f01fd 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "langchain";
-  version = "0.2.5";
+  version = "0.2.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -39,8 +39,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    rev = "refs/tags/langchain==${version}";
-    hash = "sha256-WaJRXvA/SImTSgAkk06vmOtTbsYYs8nTChFLzmsFz7Q=";
+    rev = "refs/tags/langchain-core==${version}";
+    hash = "sha256-/BUn/NxaE9l3VY6dPshr1JJaHTGzn9NMQhSQ2De65Jg=";
   };
 
   sourceRoot = "${src.name}/libs/langchain";
diff --git a/pkgs/development/python-modules/langcodes/default.nix b/pkgs/development/python-modules/langcodes/default.nix
index fc2f51f9c87a..52f4c384f806 100644
--- a/pkgs/development/python-modules/langcodes/default.nix
+++ b/pkgs/development/python-modules/langcodes/default.nix
@@ -4,25 +4,28 @@
   marisa-trie,
   pythonOlder,
   fetchPypi,
-  poetry-core,
   pytestCheckHook,
   language-data,
   setuptools,
+  setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "langcodes";
-  version = "3.3.0";
+  version = "3.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "794d07d5a28781231ac335a1561b8442f8648ca07cd518310aeb45d6f0807ef6";
+    sha256 = "sha256-rlp30aAdDR6RhUpnGJCJK3zpq7YBq3Mn/FyHT4meGXk=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     language-data
@@ -41,7 +44,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python toolkit for working with and comparing the standardized codes for languages";
-    homepage = "https://github.com/LuminosoInsight/langcodes";
+    homepage = "https://github.com/georgkrause/langcodes";
     license = licenses.mit;
   };
 }
diff --git a/pkgs/development/python-modules/langfuse/default.nix b/pkgs/development/python-modules/langfuse/default.nix
index 46ae86b6b839..05b65c0cd137 100644
--- a/pkgs/development/python-modules/langfuse/default.nix
+++ b/pkgs/development/python-modules/langfuse/default.nix
@@ -11,7 +11,6 @@
   packaging,
   poetry-core,
   pydantic,
-  pythonRelaxDepsHook,
   wrapt,
 }:
 
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "packaging" ];
 
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index d86c96eb87ad..97ed19193113 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -16,14 +16,13 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   uvicorn,
 }:
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.77";
+  version = "0.1.80";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,7 +31,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Tkqo0BbBqFMsEDtEo0sVgSQOoa/J+ECw/7T7yALnL84=";
+    hash = "sha256-bkbJKg2ikdkTenAP+GD+Ss13nF8KrizLNM72oDgQgJM=";
   };
 
   sourceRoot = "${src.name}/python";
@@ -41,8 +40,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-
   dependencies = [
     orjson
     pydantic
diff --git a/pkgs/development/python-modules/lazy-loader/default.nix b/pkgs/development/python-modules/lazy-loader/default.nix
index 3d95f5e62d7a..974288e365f3 100644
--- a/pkgs/development/python-modules/lazy-loader/default.nix
+++ b/pkgs/development/python-modules/lazy-loader/default.nix
@@ -2,26 +2,28 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  flit-core,
+  setuptools,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "lazy-loader";
-  version = "0.3";
-  format = "pyproject";
+  version = "0.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scientific-python";
     repo = "lazy_loader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ky9EwPYt/wBqWXopH5WFjlVG+/Rd2gc+mlCeWqG7mZg=";
+    hash = "sha256-4Kid6yhm9C2liPoW+NlCsOiBZvv6iYt7hDunARc4PRY=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  pythonImportsCheck = [ "lazy_loader" ];
+
   meta = with lib; {
     description = "Populate library namespace without incurring immediate import costs";
     homepage = "https://github.com/scientific-python/lazy_loader";
diff --git a/pkgs/development/python-modules/leb128/default.nix b/pkgs/development/python-modules/leb128/default.nix
index 40ebe1d9fda8..1606c54c340c 100644
--- a/pkgs/development/python-modules/leb128/default.nix
+++ b/pkgs/development/python-modules/leb128/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "leb128";
-  version = "1.0.5";
+  version = "1.0.7";
   format = "setuptools";
 
   # fetchPypi doesn't include files required for tests
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "mohanson";
     repo = "leb128";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zK14LPziBkvXAMzuPbcg/47caO/5GEYA9txAzCGfpS8=";
+    hash = "sha256-17C0Eic8T2PFkuIGExcrfb3b1HldaSBAPSh5TtRBUuU=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/ledgerblue/default.nix b/pkgs/development/python-modules/ledgerblue/default.nix
index 0a1f6841d390..5010d8153032 100644
--- a/pkgs/development/python-modules/ledgerblue/default.nix
+++ b/pkgs/development/python-modules/ledgerblue/default.nix
@@ -16,7 +16,6 @@
   python-gnupg,
   python-u2flib-host,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-scm,
   websocket-client,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
   build-system = [
     setuptools
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "protobuf" ];
diff --git a/pkgs/development/python-modules/lexilang/default.nix b/pkgs/development/python-modules/lexilang/default.nix
index 6c487f45dce0..e586eba5a3e2 100644
--- a/pkgs/development/python-modules/lexilang/default.nix
+++ b/pkgs/development/python-modules/lexilang/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "lexilang";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LibreTranslate";
     repo = "LexiLang";
-    rev = "v${version}";
-    hash = "sha256-TLkaqCE9NDjN2XuYOUkeeWIRcqkxrdg31fS4mEnlcEo=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/uSoEz/5HJnFVkXZndIlM+K0OJLJaorFQ6+kWYELjrs=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/libcst/default.nix b/pkgs/development/python-modules/libcst/default.nix
index ba7e0fa5340e..140c919d7081 100644
--- a/pkgs/development/python-modules/libcst/default.nix
+++ b/pkgs/development/python-modules/libcst/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   cargo,
   hypothesis,
   libiconv,
@@ -21,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "libcst";
-  version = "1.1.0";
+  version = "1.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -30,27 +29,18 @@ buildPythonPackage rec {
     owner = "instagram";
     repo = "libcst";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kFs7edBWz0GRbgbLDmtpUVi5R+6mYXsJSvceOoPW9ck=";
+    hash = "sha256-H0YO8ILWOyhYdosNRWQQ9wziFk0syKSG3vF2zuYkL2k=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${src.name}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-fhaHiz64NH6S61fSXj4gNxxcuB+ECxWSSmG5StiFr1k=";
+    hash = "sha256-AcqHn3A7WCVyVnOBD96k4pxokhzgmCWOipK/DrIAQkU=";
   };
 
   cargoRoot = "native";
 
-  patches = [
-    # https://github.com/Instagram/LibCST/pull/1042
-    (fetchpatch {
-      name = "remove-distutils.patch";
-      url = "https://github.com/Instagram/LibCST/commit/a6834aa0e6eb78e41549fd1087d7ba60ca4dd237.patch";
-      hash = "sha256-lyIXJhm4UMwdCOso6McDslIvtK7Ar8sF5Zy7qo1nicQ=";
-    })
-  ];
-
   postPatch = ''
     # avoid infinite recursion by not formatting the release files
     substituteInPlace libcst/codegen/generate.py \
diff --git a/pkgs/development/python-modules/libmambapy/default.nix b/pkgs/development/python-modules/libmambapy/default.nix
index 73c31a259d9d..97f5e0dec10a 100644
--- a/pkgs/development/python-modules/libmambapy/default.nix
+++ b/pkgs/development/python-modules/libmambapy/default.nix
@@ -22,14 +22,14 @@
 }:
 buildPythonPackage rec {
   pname = "libmambapy";
-  version = "1.5.7";
+  version = "2024.03.25";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mamba-org";
     repo = "mamba";
-    rev = "${pname}-${version}";
-    hash = "sha256-HfmvLi9IBWlaGAn2Ej4Bnm4b3l19jEXwNl5IUkdVxi0=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-sxZDlMFoMLq2EAzwBVO++xvU1C30JoIoZXEX/sqkXS0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/librespot/default.nix b/pkgs/development/python-modules/librespot/default.nix
index 7e6d2edb253b..e2e98bc1e6ed 100644
--- a/pkgs/development/python-modules/librespot/default.nix
+++ b/pkgs/development/python-modules/librespot/default.nix
@@ -7,7 +7,6 @@
   pycryptodomex,
   pyogg,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   requests,
   websocket-client,
   zeroconf,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     defusedxml
diff --git a/pkgs/development/python-modules/libretranslate/default.nix b/pkgs/development/python-modules/libretranslate/default.nix
index cc1e27a8db56..eae30cc7407d 100644
--- a/pkgs/development/python-modules/libretranslate/default.nix
+++ b/pkgs/development/python-modules/libretranslate/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   pytestCheckHook,
   hatchling,
   argostranslate,
@@ -43,7 +42,6 @@ buildPythonPackage rec {
 
   build-system = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/librosa/default.nix b/pkgs/development/python-modules/librosa/default.nix
index fa99efb4f66c..9b015e335b75 100644
--- a/pkgs/development/python-modules/librosa/default.nix
+++ b/pkgs/development/python-modules/librosa/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
 
   # build-system
   setuptools,
@@ -34,7 +35,7 @@
 
 buildPythonPackage rec {
   pname = "librosa";
-  version = "0.10.2";
+  version = "0.10.2.post1";
   format = "pyproject";
 
   src = fetchFromGitHub {
@@ -42,11 +43,20 @@ buildPythonPackage rec {
     repo = "librosa";
     rev = "refs/tags/${version}";
     fetchSubmodules = true; # for test data
-    hash = "sha256-zUKljPKWOhyb3Zv4KEUcvLsVkxVhL+rzErKycAl6jIg=";
+    hash = "sha256-0FbKVAFWmcFTW2dR27nif6hPZeIxFWYF1gTm4BEJZ/Q=";
   };
 
   nativeBuildInputs = [ setuptools ];
 
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/librosa/librosa/issues/1849
+      name = "librosa-scipy-1.14-compat.patch";
+      url = "https://github.com/librosa/librosa/commit/d0a12c87cdff715ffb8ac1c7383bba1031aa71e4.patch";
+      hash = "sha256-NHuGo4U1FRikb5OIkycQBvuZ+0OdG/VykTcuhXkLUug=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace-fail "--cov-report term-missing --cov librosa --cov-report=xml " ""
diff --git a/pkgs/development/python-modules/lightgbm/default.nix b/pkgs/development/python-modules/lightgbm/default.nix
index 2b7e33347c94..16465624d65a 100644
--- a/pkgs/development/python-modules/lightgbm/default.nix
+++ b/pkgs/development/python-modules/lightgbm/default.nix
@@ -39,14 +39,14 @@ assert cudaSupport -> gpuSupport != true;
 
 buildPythonPackage rec {
   pname = "lightgbm";
-  version = "4.3.0";
+  version = "4.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AG9XhKm87kPlp+lD3E8C3hui7np68e5fGQ04Pztsnr4=";
+    hash = "sha256-nop2QJEUgRNOYJh9XR4c0Vf0MMO0s43o02/FXDArwpk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/limnoria/default.nix b/pkgs/development/python-modules/limnoria/default.nix
index 050dcc565824..f8384033690f 100644
--- a/pkgs/development/python-modules/limnoria/default.nix
+++ b/pkgs/development/python-modules/limnoria/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "limnoria";
-  version = "2024.4.26";
+  version = "2024.5.30";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-H8GAJvmkYJy8PJsXn4Yl9qY3zb9aFBa7sr4DN0bKYfQ=";
+    hash = "sha256-uKJMeC1dXhQp1CGbtdnqmELFO64VWblhABGfpKHGCZQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/linear-operator/default.nix b/pkgs/development/python-modules/linear-operator/default.nix
index 918a439c6279..ab402c37aa79 100644
--- a/pkgs/development/python-modules/linear-operator/default.nix
+++ b/pkgs/development/python-modules/linear-operator/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   jaxtyping,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   scipy,
   setuptools,
   setuptools-scm,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
diff --git a/pkgs/development/python-modules/linien-common/default.nix b/pkgs/development/python-modules/linien-common/default.nix
index 1fa188b8529c..513c4c11df20 100644
--- a/pkgs/development/python-modules/linien-common/default.nix
+++ b/pkgs/development/python-modules/linien-common/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "linien-common";
-  version = "1.0.2";
+  version = "2.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "linien-org";
     repo = "linien";
     rev = "refs/tags/v${version}";
-    hash = "sha256-V6oo0a4cNlvn4pIwzchvCTOu7qtUGS+Pc0qpbEsvGZo=";
+    hash = "sha256-TCQ1jLZpeQlG/ZyWY0qrHceMJ1TH7AYO7toYc74ZWq4=";
   };
 
   sourceRoot = "${src.name}/linien-common";
diff --git a/pkgs/development/python-modules/linode-api/default.nix b/pkgs/development/python-modules/linode-api/default.nix
index 67608a0a776d..816c72e5f288 100644
--- a/pkgs/development/python-modules/linode-api/default.nix
+++ b/pkgs/development/python-modules/linode-api/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "linode-api";
-  version = "5.13.1";
+  version = "5.16.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "linode";
     repo = "python-linode-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WB4CurdokRKh1eD6FZR2SeMpa3Z0BzLb0ldI7SYPEVI=";
+    hash = "sha256-B90BfuAqyncJPIvcni7bthiwSfmeL9CqeTYT1/y5TNY=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/lit/default.nix b/pkgs/development/python-modules/lit/default.nix
index 512f0501976b..6d4aec66c750 100644
--- a/pkgs/development/python-modules/lit/default.nix
+++ b/pkgs/development/python-modules/lit/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "lit";
-  version = "17.0.6";
+  version = "18.1.7";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-36mvm1X8RQmla+e/I0bwedf0okLVg7ny4LB4/Qq64xs=";
+    hash = "sha256-Ld2b4mvcxtoDrqPsRWxpRetaCdveVI01AL/5uO1HY7s=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index 950563c88aec..253b53a00788 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -34,7 +34,7 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.40.6";
+  version = "1.40.16";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mXrLhgOETrkwHYSJSmEPvFwZiO0kx9FmXlTJN2WZ8WI=";
+    hash = "sha256-CK/b0PVBOzfhnTk+iu/buu7BIjAGdz3aXYAGgB4s/pw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/llama-index-agent-openai/default.nix b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
index 7cd5fb8241c9..6073a4e60427 100644
--- a/pkgs/development/python-modules/llama-index-agent-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
@@ -6,7 +6,6 @@
   llama-index-llms-openai,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
index 3bd7ddbef460..05558eb38942 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
@@ -6,7 +6,6 @@
   llama-index-core,
   poetry-core,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
 }:
 
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     google-generativeai
diff --git a/pkgs/development/python-modules/llama-index-embeddings-google/default.nix b/pkgs/development/python-modules/llama-index-embeddings-google/default.nix
index 87ed37e9601d..f848acf1fd42 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-google/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-google/default.nix
@@ -6,7 +6,6 @@
   llama-index-core,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     google-generativeai
diff --git a/pkgs/development/python-modules/llama-index-llms-openai/default.nix b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
index 0bcedaa6fbb5..3c3a3ff12b5c 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-llms-openai";
-  version = "0.1.21";
+  version = "0.1.22";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_openai";
     inherit version;
-    hash = "sha256-6dYxE1FgrIcJPNfVrj4yxN6/juqvop7kc5Z1hnFV13M=";
+    hash = "sha256-cpvy6nBDUXRl4dWFCJUSt32LPOkiM6Z8E41dYhBh7VY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llama-index-program-openai/default.nix b/pkgs/development/python-modules/llama-index-program-openai/default.nix
index c3c181855218..e542c0f8a4e6 100644
--- a/pkgs/development/python-modules/llama-index-program-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-program-openai/default.nix
@@ -7,7 +7,6 @@
   llama-index-llms-openai,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     llama-index-agent-openai
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index 95045b4d3154..4e96733d29b7 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -8,7 +8,6 @@
   pymupdf,
   pypdf,
   pythonOlder,
-  pythonRelaxDepsHook,
   striprtf,
 }:
 
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     beautifulsoup4
diff --git a/pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix b/pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix
index 1db642215883..575c703b795f 100644
--- a/pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix
@@ -6,7 +6,6 @@
   llama-parse,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-google/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-google/default.nix
index 47a74e8a9710..fcf3e0fa9742 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-google/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-google/default.nix
@@ -6,7 +6,6 @@
   llama-index-core,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
index 63e8b5d9992d..078e7a7b3d59 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
@@ -7,7 +7,6 @@
   pgvector,
   poetry-core,
   psycopg2,
-  pythonRelaxDepsHook,
   pythonOlder,
 }:
 
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/llvmlite/default.nix b/pkgs/development/python-modules/llvmlite/default.nix
index 5c3a03fe7681..2d92814a1835 100644
--- a/pkgs/development/python-modules/llvmlite/default.nix
+++ b/pkgs/development/python-modules/llvmlite/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "llvmlite";
-  version = "0.42.0";
+  version = "0.43.0";
   pyproject = true;
 
   disabled = isPyPy || pythonAtLeast "3.13";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "numba";
     repo = "llvmlite";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vN2npyAyN6C340l69YSRtRJrAe4EHSqh4SCgWfeSQaQ=";
+    hash = "sha256-5QBSRDb28Bui9IOhGofj+c7Rk7J5fNv5nPksEPY/O5o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/lmcloud/default.nix b/pkgs/development/python-modules/lmcloud/default.nix
index 3bf4f38e5b5b..cfb193bcdfe1 100644
--- a/pkgs/development/python-modules/lmcloud/default.nix
+++ b/pkgs/development/python-modules/lmcloud/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "lmcloud";
-  version = "1.1.11";
+  version = "1.1.13";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "zweckj";
     repo = "lmcloud";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-NuqWzlTkarrLXgYV4Zzwlb++rV+6cpG97YZnDwi0m98=";
+    rev = "refs/tags/v.${version}";
+    hash = "sha256-byZtmyZcvr39hKzamGjSunMeVE2C19QtwF4u78k+YOY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/localstack-ext/default.nix b/pkgs/development/python-modules/localstack-ext/default.nix
index 2bf7bf447bc9..b0287a226a67 100644
--- a/pkgs/development/python-modules/localstack-ext/default.nix
+++ b/pkgs/development/python-modules/localstack-ext/default.nix
@@ -17,12 +17,13 @@
 
 buildPythonPackage rec {
   pname = "localstack-ext";
-  version = "2.3.2";
+  version = "3.5.0";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Ex5ZPlteDaiyex90QumucVdTTbpp9uWiBrvw1kMr++8=";
+    pname = "localstack_ext";
+    inherit version;
+    hash = "sha256-tJNgNqCzlebbDOOgkScOKaf04bLTVIjP+BaFiDLo/Gs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/localstack/default.nix b/pkgs/development/python-modules/localstack/default.nix
index d6b26ebe4086..7bcb46fa595c 100644
--- a/pkgs/development/python-modules/localstack/default.nix
+++ b/pkgs/development/python-modules/localstack/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "localstack";
-  version = "3.0.0";
+  version = "3.5.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "localstack";
     repo = "localstack";
     rev = "refs/tags/v${version}";
-    hash = "sha256-N/Mc1bubCcq38VxUqkO9LGG25pEetEyJ+VJMdg/7hrU=";
+    hash = "sha256-Sd5B4+pvUwNXfP3hsqBkUoHo06YyzUGCUHzc8f77Vx4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lsassy/default.nix b/pkgs/development/python-modules/lsassy/default.nix
index 8123a9967e22..27bfd2092388 100644
--- a/pkgs/development/python-modules/lsassy/default.nix
+++ b/pkgs/development/python-modules/lsassy/default.nix
@@ -7,7 +7,6 @@
   poetry-core,
   pypykatz,
   pythonOlder,
-  pythonRelaxDepsHook,
   rich,
 }:
 
@@ -31,7 +30,6 @@ buildPythonPackage rec {
     "rich"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index 98d1fae1d2b5..f53979f98d7c 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "5.1.0";
+  version = "5.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
     rev = "refs/tags/lxml-${version}";
-    hash = "sha256-eWLYzZWatYDmhuBTZynsdytlNFKKmtWQ1XIyzVD8sDY=";
+    hash = "sha256-c9r2uqjXmQOXyPCsJTzi1OatkQ9rhJbKqpxaoFz2l18=";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
diff --git a/pkgs/development/python-modules/lzallright/default.nix b/pkgs/development/python-modules/lzallright/default.nix
index d6dbde3cc457..697acafb6ed6 100644
--- a/pkgs/development/python-modules/lzallright/default.nix
+++ b/pkgs/development/python-modules/lzallright/default.nix
@@ -10,19 +10,19 @@
 
 buildPythonPackage rec {
   pname = "lzallright";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "vlaci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Zzif6WtecgAkNmml0kt0Z+Ewx0L30ahr+kwzYR5aUAM=";
+    hash = "sha256-6Dez14qlZ7cnVQfaiTHGuiTSAHvBoKtolgKF7ne9ASw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-+pV9q2QM6qFA1a5E10OAsE7KJEUsTiEiU1KqO4/2rFw=";
+    hash = "sha256-ZYFAWkcDdX10024hc+gdARyaJFpNNcXf+gGLxBP5VlA=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/m3u8/default.nix b/pkgs/development/python-modules/m3u8/default.nix
index d1f564a0c534..b48572c49a2e 100644
--- a/pkgs/development/python-modules/m3u8/default.nix
+++ b/pkgs/development/python-modules/m3u8/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "m3u8";
-  version = "4.1.0";
+  version = "5.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "globocom";
     repo = "m3u8";
     rev = "refs/tags/${version}";
-    hash = "sha256-vH5y/fk9dW8w54U3o+70enbTOubV4V0/NVbSSqOY9rQ=";
+    hash = "sha256-sI260BR22Ft5y/2lKn1ihu52y6soyk+yzj24TEOKJlA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/maison/default.nix b/pkgs/development/python-modules/maison/default.nix
index c37ce359ef90..4b94862ce332 100644
--- a/pkgs/development/python-modules/maison/default.nix
+++ b/pkgs/development/python-modules/maison/default.nix
@@ -7,7 +7,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   toml,
 }:
 
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/makefun/default.nix b/pkgs/development/python-modules/makefun/default.nix
index ab3428b502e6..ece4f85008c6 100644
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@@ -2,6 +2,7 @@
   lib,
   fetchPypi,
   buildPythonPackage,
+  pythonAtLeast,
 
   # build-system
   setuptools,
@@ -33,6 +34,11 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/smarie/python-makefun/issues/102
+    "test_args_order_and_kind"
+  ];
+
   pythonImportsCheck = [ "makefun" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/mako/default.nix b/pkgs/development/python-modules/mako/default.nix
index aa0fba8ff8b7..2e31d43b92b7 100644
--- a/pkgs/development/python-modules/mako/default.nix
+++ b/pkgs/development/python-modules/mako/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "mako";
-  version = "1.3.3";
+  version = "1.3.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Mako";
     inherit version;
-    hash = "sha256-4WwB2aucEfcpDu8c/vwJP7WkXuSj2gni/sLk0brlTnM=";
+    hash = "sha256-SNvCBWjB0naiaYs22Wj6dhYb8ScZSQfqb8WU+oH5Q7w=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/mandown/default.nix b/pkgs/development/python-modules/mandown/default.nix
index 1b7361b952ff..41c059aa1da2 100644
--- a/pkgs/development/python-modules/mandown/default.nix
+++ b/pkgs/development/python-modules/mandown/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   beautifulsoup4,
   comicon,
   feedparser,
@@ -20,19 +19,18 @@
 
 buildPythonPackage rec {
   pname = "mandown";
-  version = "1.8.2";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "potatoeggy";
     repo = "mandown";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DSbxWff5pY7tjB9aXY8/rQJzCQyDN2+OrmP10uEeXWM=";
+    hash = "sha256-K5/ij0VzQJGj+VvASllaV8/YBCiu2Lv+JdeSHLYMV7I=";
   };
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/manifest-ml/default.nix b/pkgs/development/python-modules/manifest-ml/default.nix
index 8b1dcaf5a090..7eeec2a60fee 100644
--- a/pkgs/development/python-modules/manifest-ml/default.nix
+++ b/pkgs/development/python-modules/manifest-ml/default.nix
@@ -12,7 +12,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   redis,
   requests,
   sentence-transformers,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pydantic" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/manim-slides/default.nix b/pkgs/development/python-modules/manim-slides/default.nix
index b8b236238ab5..7d9292b54224 100644
--- a/pkgs/development/python-modules/manim-slides/default.nix
+++ b/pkgs/development/python-modules/manim-slides/default.nix
@@ -5,7 +5,6 @@
   pythonOlder,
 
   hatchling,
-  pythonRelaxDepsHook,
   manim,
   ffmpeg,
 
@@ -35,7 +34,7 @@
 }:
 buildPythonPackage rec {
   pname = "manim-slides";
-  version = "5.1.6";
+  version = "5.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -44,12 +43,11 @@ buildPythonPackage rec {
     owner = "jeertmans";
     repo = "manim-slides";
     rev = "refs/tags/v${version}";
-    hash = "sha256-BFfp/jeKBXr+Ukh0jNEtMPHlstlBjhSnvA803ddYoZE=";
+    hash = "sha256-egQYL4Qvs1fQcJ5WEM461TSYqs2XN39wbyfx9uEFeIs=";
   };
 
   build-system = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [ "opencv-python" ];
diff --git a/pkgs/development/python-modules/manim/default.nix b/pkgs/development/python-modules/manim/default.nix
index 69aee1f41c3d..545f9df3c5a5 100644
--- a/pkgs/development/python-modules/manim/default.nix
+++ b/pkgs/development/python-modules/manim/default.nix
@@ -6,7 +6,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   cairo,
   ffmpeg,
@@ -191,7 +190,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/marisa-trie/default.nix b/pkgs/development/python-modules/marisa-trie/default.nix
index b9ce61973394..8001af18c0ff 100644
--- a/pkgs/development/python-modules/marisa-trie/default.nix
+++ b/pkgs/development/python-modules/marisa-trie/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   cython,
+  setuptools,
   pytestCheckHook,
   hypothesis,
   readme-renderer,
@@ -11,17 +12,21 @@
 
 buildPythonPackage rec {
   pname = "marisa-trie";
-  version = "1.1.0";
-  format = "setuptools";
+  version = "1.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-W/Q+0M82r0V4/nsDTPlfUyQ5dmUWaA5L1gNyNhHr1Ws=";
+    pname = "marisa_trie";
+    inherit version;
+    hash = "sha256-/t/GdJf4qidXdWtc9JN1nyRdMh+3iRTOElttddqom18=";
   };
 
-  nativeBuildInputs = [ cython ];
+  build-system = [
+    cython
+    setuptools
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/markdown-it-py/default.nix b/pkgs/development/python-modules/markdown-it-py/default.nix
index f64d415aa76b..1754ec45b76e 100644
--- a/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -21,7 +21,6 @@
   stdenv,
   pytest-regressions,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
 }:
 
@@ -43,7 +42,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "linkify-it-py" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     flit-core
   ];
 
diff --git a/pkgs/development/python-modules/mashumaro/default.nix b/pkgs/development/python-modules/mashumaro/default.nix
index 4456e418c487..153eb0298fce 100644
--- a/pkgs/development/python-modules/mashumaro/default.nix
+++ b/pkgs/development/python-modules/mashumaro/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "mashumaro";
-  version = "3.13";
+  version = "3.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "Fatal1ty";
     repo = "mashumaro";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ETK1rHKlByQkqibejiZmXF6c4eIiMazLa8XY2OH30q4=";
+    hash = "sha256-Km3RuDU77L3N2RQBhpcEztOjYtQhTXFZoGKu70g5EPU=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/material-color-utilities/default.nix b/pkgs/development/python-modules/material-color-utilities/default.nix
index 527d86a6bbde..527726401f82 100644
--- a/pkgs/development/python-modules/material-color-utilities/default.nix
+++ b/pkgs/development/python-modules/material-color-utilities/default.nix
@@ -3,7 +3,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   pillow,
   regex,
 }:
@@ -17,7 +16,6 @@ buildPythonPackage rec {
     sha256 = "sha256-PG8C585wWViFRHve83z3b9NijHyV+iGY2BdMJpyVH64=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "Pillow" ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/matplotlib/darwin-sandbox-crash.patch b/pkgs/development/python-modules/matplotlib/darwin-sandbox-crash.patch
new file mode 100644
index 000000000000..883f1edc8be0
--- /dev/null
+++ b/pkgs/development/python-modules/matplotlib/darwin-sandbox-crash.patch
@@ -0,0 +1,14 @@
+--- a/lib/matplotlib/font_manager.py
++++ b/lib/matplotlib/font_manager.py
+@@ -266,8 +266,11 @@ def _get_fontconfig_fonts():
+ @lru_cache
+ def _get_macos_fonts():
+     """Cache and list the font paths known to ``system_profiler SPFontsDataType``."""
+-    d, = plistlib.loads(
+-        subprocess.check_output(["system_profiler", "-xml", "SPFontsDataType"]))
++    try:
++        d, = plistlib.loads(
++            subprocess.check_output(["system_profiler", "-xml", "SPFontsDataType"]))
++    except (OSError, subprocess.CalledProcessError, plistlib.InvalidFileException):
++        return []
+     return [Path(entry["path"]) for entry in d["_items"]]
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index c0efd43bdcad..66436a2d2669 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchPypi,
-  writeText,
   buildPythonPackage,
   isPyPy,
   pythonOlder,
@@ -11,12 +10,22 @@
   certifi,
   pkg-config,
   pybind11,
-  setuptools,
+  meson-python,
   setuptools-scm,
+  pytestCheckHook,
+  python,
+  matplotlib,
+  fetchurl,
 
   # native libraries
   ffmpeg-headless,
   freetype,
+  # By default, almost all tests fail due to the fact we use our version of
+  # freetype. We still define use this argument to define the overriden
+  # derivation `matplotlib.passthru.tests.withoutOutdatedFreetype` - which
+  # builds matplotlib with the freetype version they default to, with which all
+  # tests should pass.
+  doCheck ? false,
   qhull,
 
   # propagates
@@ -80,7 +89,7 @@ let
 in
 
 buildPythonPackage rec {
-  version = "3.8.4";
+  version = "3.9.0";
   pname = "matplotlib";
   pyproject = true;
 
@@ -88,9 +97,15 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iqw5fV6ewViWDjHDgcX/xS3dUr2aR3F+KmlAOBZ9/+o=";
+    hash = "sha256-5tKepsGeNLMPt9iLcIH4aaAwFPZv4G1izHfVpuqI7Xo=";
   };
 
+  patches = lib.optionals stdenv.isDarwin [
+    # Don't crash when running in Darwin sandbox
+    # Submitted upstream: https://github.com/matplotlib/matplotlib/pull/28498
+    ./darwin-sandbox-crash.patch
+  ];
+
   env.XDG_RUNTIME_DIR = "/tmp";
 
   # Matplotlib tries to find Tcl/Tk by opening a Tk window and asking the
@@ -100,21 +115,16 @@ buildPythonPackage rec {
   # With the following patch we just hard-code these paths into the install
   # script.
   postPatch =
-    let
-      tcl_tk_cache = ''"${tk}/lib", "${tcl}/lib", "${lib.strings.substring 0 3 tk.version}"'';
-    in
     ''
       substituteInPlace pyproject.toml \
         --replace-fail '"numpy>=2.0.0rc1,<2.3",' ""
-    ''
-    + lib.optionalString enableTk ''
-      sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py
+      patchShebangs tools
     ''
     + lib.optionalString (stdenv.isLinux && interactive) ''
       # fix paths to libraries in dlopen calls (headless detection)
-      substituteInPlace src/_c_internal_utils.c \
-        --replace libX11.so.6 ${libX11}/lib/libX11.so.6 \
-        --replace libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
+      substituteInPlace src/_c_internal_utils.cpp \
+        --replace-fail libX11.so.6 ${libX11}/lib/libX11.so.6 \
+        --replace-fail libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
     '';
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals enableGtk3 [ gobject-introspection ];
@@ -144,7 +154,7 @@ buildPythonPackage rec {
     certifi
     numpy
     pybind11
-    setuptools
+    meson-python
     setuptools-scm
   ];
 
@@ -171,29 +181,45 @@ buildPythonPackage rec {
     ++ lib.optionals enableNbagg [ ipykernel ]
     ++ lib.optionals enableTk [ tkinter ];
 
-  passthru.config = {
-    directories = {
-      basedirlist = ".";
-    };
-    libs = {
-      system_freetype = true;
-      system_qhull = true;
-      # LTO not working in darwin stdenv, see #19312
-      enable_lto = !stdenv.isDarwin;
-    };
+  mesonFlags = lib.mapAttrsToList lib.mesonBool {
+    system-freetype = true;
+    system-qhull = true;
+    # Otherwise GNU's `ar` binary fails to put symbols from libagg into the
+    # matplotlib shared objects. See:
+    # -https://github.com/matplotlib/matplotlib/issues/28260#issuecomment-2146243663
+    # -https://github.com/matplotlib/matplotlib/issues/28357#issuecomment-2155350739
+    b_lto = false;
   };
 
   passthru.tests = {
     inherit sage;
+    withOutdatedFreetype = matplotlib.override {
+      doCheck = true;
+      freetype = freetype.overrideAttrs (_: {
+        src = fetchurl {
+          url = "https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz";
+          sha256 = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
+        };
+        patches = [ ];
+      });
+    };
   };
 
-  env.MPLSETUPCFG = writeText "mplsetup.cfg" (lib.generators.toINI { } passthru.config);
-
-  # Encountering a ModuleNotFoundError, as describved and investigated at:
-  # https://github.com/NixOS/nixpkgs/issues/255262 . It could be that some of
-  # which may fail due to a freetype version that doesn't match the freetype
-  # version used by upstream.
-  doCheck = false;
+  pythonImportsCheck = [ "matplotlib" ];
+  inherit doCheck;
+  nativeCheckInputs = [ pytestCheckHook ];
+  preCheck = ''
+    # https://matplotlib.org/devdocs/devel/testing.html#obtain-the-reference-images
+    find lib -name baseline_images -printf '%P\n' | while read p; do
+      cp -r lib/"$p" $out/${python.sitePackages}/"$p"
+    done
+    # Tests will fail without these files as well
+    cp \
+      lib/matplotlib/tests/{mpltest.ttf,cmr10.pfb,Courier10PitchBT-Bold.pfb} \
+      $out/${python.sitePackages}/matplotlib/tests/
+    # https://github.com/NixOS/nixpkgs/issues/255262
+    cd $out
+  '';
 
   meta = with lib; {
     description = "Python plotting library, making publication quality plots";
diff --git a/pkgs/development/python-modules/maxminddb/default.nix b/pkgs/development/python-modules/maxminddb/default.nix
index 4340a7837164..0457ad15cd50 100644
--- a/pkgs/development/python-modules/maxminddb/default.nix
+++ b/pkgs/development/python-modules/maxminddb/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "maxminddb";
-  version = "2.6.1";
+  version = "2.6.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bF1ZH2JeA7CjTfDH/4FYBnY5e4M14T7OEwxuOeSjr7k=";
+    hash = "sha256-fYQtMuJiCryJS315paEAemnfLGzyeaBrlMnDkT9m8mQ=";
   };
 
   buildInputs = [ libmaxminddb ];
diff --git a/pkgs/development/python-modules/mayavi/default.nix b/pkgs/development/python-modules/mayavi/default.nix
index be2d41eb2cd9..b9fa608772b7 100644
--- a/pkgs/development/python-modules/mayavi/default.nix
+++ b/pkgs/development/python-modules/mayavi/default.nix
@@ -20,14 +20,14 @@
 buildPythonPackage rec {
   pname = "mayavi";
   # TODO: Remove meta.broken on next release.
-  version = "4.8.1";
+  version = "4.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-n0J+8spska542S02ibpr7KJMhGDicG2KHJuEKJrT/Z4=";
+    hash = "sha256-sQ/pFF8hxI5JAvDnRrNgOzy2lNEUVlFaRoIPIaCnQik=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/mdit-py-plugins/default.nix b/pkgs/development/python-modules/mdit-py-plugins/default.nix
index 6b68f4f64322..a209f36ed4f1 100644
--- a/pkgs/development/python-modules/mdit-py-plugins/default.nix
+++ b/pkgs/development/python-modules/mdit-py-plugins/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "mdit-py-plugins";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "executablebooks";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-YBJu0vIOD747DrJLcqiZMHq34+gHdXeGLCw1OxxzIJ0=";
+    hash = "sha256-xIbP2zHvHWV+2wW17i78vxc5npCvRBYP6QuL/mCBIww=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/mdtraj/default.nix b/pkgs/development/python-modules/mdtraj/default.nix
index 7c7d95adf5d3..5cca00165cfb 100644
--- a/pkgs/development/python-modules/mdtraj/default.nix
+++ b/pkgs/development/python-modules/mdtraj/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "mdtraj";
-  version = "1.9.9";
+  version = "1.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mdtraj";
     repo = "mdtraj";
     rev = "refs/tags/${version}";
-    hash = "sha256-2Jg6DyVJlRBLD/6hMtcsrAdxKF5RkpUuhAQm/lqVGeE=";
+    hash = "sha256-hNv/humEZOX4W7cOlJSAodk9pIi18//YJNSWNiEFiVg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/mesa/default.nix b/pkgs/development/python-modules/mesa/default.nix
index 003e4f9609d0..d8a195f5f724 100644
--- a/pkgs/development/python-modules/mesa/default.nix
+++ b/pkgs/development/python-modules/mesa/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "mesa";
-  version = "2.2.4";
+  version = "2.3.0";
   format = "setuptools";
 
   # According to their docs, this library is for Python 3+.
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "mesa";
     inherit version;
-    hash = "sha256-5og3ACS2r36BEGWfqtw6WG6yJwNF5p3M9K25sSmHosM=";
+    hash = "sha256-wXHCyUk05Ez4ye5a1rKXCyKPZMK7bR7xZ5rpD5mEaUw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 8fc2d7919b7c..4c5d9928d070 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "2.3.4";
+  version = "2.3.11";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-WxiddF1n9lyxKkZk1MU40NzLh6goLVs81mbJZ3F33R8=";
+    hash = "sha256-s56apVx7+EXkdw3FUjyGKGFjP+IVbO0/VDB4urXEtXQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/meteofrance-api/default.nix b/pkgs/development/python-modules/meteofrance-api/default.nix
index 3b1d5e2b95b5..89cdc0735ea5 100644
--- a/pkgs/development/python-modules/meteofrance-api/default.nix
+++ b/pkgs/development/python-modules/meteofrance-api/default.nix
@@ -5,7 +5,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   requests,
   requests-mock,
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "urllib3" ];
diff --git a/pkgs/development/python-modules/miauth/default.nix b/pkgs/development/python-modules/miauth/default.nix
index 707057783921..aec9084ed773 100644
--- a/pkgs/development/python-modules/miauth/default.nix
+++ b/pkgs/development/python-modules/miauth/default.nix
@@ -1,13 +1,18 @@
 {
   lib,
-  bluepy,
   buildPythonPackage,
-  cryptography,
   fetchPypi,
-  pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
+
+  # build-system
   setuptools,
+
+  # dependencies
+  bluepy,
+  cryptography,
+
+  # checks
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -24,8 +29,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-
   pythonRelaxDeps = [ "cryptography" ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/mido/default.nix b/pkgs/development/python-modules/mido/default.nix
index 90ed0fb4cf48..270604f782ea 100644
--- a/pkgs/development/python-modules/mido/default.nix
+++ b/pkgs/development/python-modules/mido/default.nix
@@ -8,7 +8,6 @@
   # build-system
   setuptools,
   setuptools-scm,
-  pythonRelaxDepsHook,
 
   # dependencies
   packaging,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
   build-system = [
     setuptools
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/minichain/default.nix b/pkgs/development/python-modules/minichain/default.nix
index 61792c468925..5109a0136bde 100644
--- a/pkgs/development/python-modules/minichain/default.nix
+++ b/pkgs/development/python-modules/minichain/default.nix
@@ -9,7 +9,6 @@
   openai,
   pytestCheckHook,
   pythonAtLeast,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -32,7 +31,6 @@ buildPythonPackage rec {
     substituteInPlace ./minichain/__init__.py --replace "from .gradio import GradioConf, show" ""
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     # Only used in the examples:
diff --git a/pkgs/development/python-modules/miniupnpc/default.nix b/pkgs/development/python-modules/miniupnpc/default.nix
index f341bbf006f8..c4ec910b6425 100644
--- a/pkgs/development/python-modules/miniupnpc/default.nix
+++ b/pkgs/development/python-modules/miniupnpc/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "miniupnpc";
-  version = "2.0.2";
+  version = "2.2.8";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ca94zz7sr2x57j218aypxqcwkr23n8js30f3yrvvqbg929nr93y";
+    sha256 = "sha256-KwpNVl+tZTZHHZKW9p3a/S0nZJW6lZftjBK9ECkRUMo=";
   };
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 0a6864daea63..e04490dd4642 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   # Mitmproxy requirements
   aioquic,
   asgiref,
@@ -58,11 +57,12 @@ buildPythonPackage rec {
     hash = "sha256-rIyRY1FolbdoaI4OgFG7D2/mot8NiRHalgittPzledw=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [
     "aioquic"
     "cryptography"
+    "pyperclip"
+    "tornado"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-autolinks-plugin/default.nix b/pkgs/development/python-modules/mkdocs-autolinks-plugin/default.nix
index 8a4a98e994ef..c837ff25ceb6 100644
--- a/pkgs/development/python-modules/mkdocs-autolinks-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-autolinks-plugin/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-autolinks-plugin";
-  version = "0.7.1";
+  version = "071";
   pyproject = true;
   disabled = pythonOlder "3.8";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "zachhannum";
     repo = "mkdocs-autolinks-plugin";
     # The commit messages mention version 0.7.1, but the tag is v_071.
-    rev = "e2b649eb4db23459bcec121838f27c92c81f9ce1";
+    rev = "refs/tags/v_${version}";
     hash = "sha256-mEbuB9VwK7po1TqtJfBSkItOVlI3/W3nD2LYRHgPpTA=";
   };
 
diff --git a/pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix b/pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix
index 44b0c28d6a68..68725065cb0b 100644
--- a/pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix
+++ b/pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-drawio-exporter";
-  version = "0.8.0";
+  version = "0.9.1";
   format = "setuptools";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9cvA186FS6bHmpOrv4OfPZ5kRfgfafBfaWxgWJIlwwA=";
+    hash = "sha256-x8X8hvN/tL8C6VhgMCEHDh2hILjBoyLgQfsFD1+qXgo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-get-deps/default.nix b/pkgs/development/python-modules/mkdocs-get-deps/default.nix
new file mode 100644
index 000000000000..72d4fce4fa10
--- /dev/null
+++ b/pkgs/development/python-modules/mkdocs-get-deps/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, hatchling
+, importlib-metadata
+, mergedeep
+, platformdirs
+, pyyaml
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "mkdocs-get-deps";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mkdocs";
+    repo = "get-deps";
+    rev = "v${version}";
+    hash = "sha256-DahmSYWYhVch950InYBiCh6qz1pH2Kibf5ixwCNdsTg=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    importlib-metadata
+    mergedeep
+    platformdirs
+    pyyaml
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook  ];
+
+  pythonImportsCheck = [ "mkdocs_get_deps" ];
+
+  meta = with lib; {
+    description = "An extra command for MkDocs that infers required PyPI packages from `plugins` in mkdocs.yml";
+    homepage = "https://github.com/mkdocs/get-deps";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/mkdocs-jupyter/default.nix b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
index 7202c055d1e1..c64987e32a28 100644
--- a/pkgs/development/python-modules/mkdocs-jupyter/default.nix
+++ b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
@@ -11,7 +11,6 @@
   pygments,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-material/default.nix b/pkgs/development/python-modules/mkdocs-material/default.nix
index f344a92445ab..595333762f12 100644
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-material";
-  version = "9.5.18";
+  version = "9.5.27";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "squidfunk";
     repo = "mkdocs-material";
     rev = "refs/tags/${version}";
-    hash = "sha256-5FCIDAWRY6YfZi4QbcEpJMFfbJ17vudxlUYx4czDxrY=";
+    hash = "sha256-iuQmZJ5iJEeD54SxNO6ppcI74zyUL2WdSNhDNnmC7ZY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs/default.nix b/pkgs/development/python-modules/mkdocs/default.nix
index 25005b56d455..fc3b7fd4d8a9 100644
--- a/pkgs/development/python-modules/mkdocs/default.nix
+++ b/pkgs/development/python-modules/mkdocs/default.nix
@@ -17,6 +17,7 @@
   markdown,
   markupsafe,
   mergedeep,
+  mkdocs-get-deps,
   packaging,
   pathspec,
   platformdirs,
@@ -35,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs";
-  version = "1.5.3";
+  version = "1.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -44,18 +45,19 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-axH4AeL+osxoUIVJbW6YjiTfUr6TAXMB4raZ3oO0fyw=";
+    hash = "sha256-tpDKomHFoGYPLz7rcohkU9w7G/5+YkJ5Y6wJJRyMecI=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     click
     ghp-import
     jinja2
     markdown
     markupsafe
     mergedeep
+    mkdocs-get-deps
     packaging
     pathspec
     platformdirs
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index 7ee9df1c26a7..43d029108317 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -2,6 +2,7 @@
   lib,
   alembic,
   buildPythonPackage,
+  cachetools,
   click,
   cloudpickle,
   databricks-cli,
@@ -17,13 +18,14 @@
   markdown,
   matplotlib,
   numpy,
+  opentelemetry-api,
+  opentelemetry-sdk,
   packaging,
   pandas,
   prometheus-flask-exporter,
   protobuf,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyarrow,
   pytz,
   pyyaml,
@@ -39,21 +41,20 @@
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "2.12.2";
+  version = "2.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1xLxr51E8eueG67oymT3MR4YW3Vy/DweCoOkyM7/aq0=";
+    hash = "sha256-Nt4xBdhB/ZraEX5sgtDyp6DAm35FsgkjsuxN30QeAV8=";
   };
 
   # Remove currently broken dependency `shap`, a model explainability package.
   # This seems quite unprincipled especially with tests not being enabled,
   # but not mlflow has a 'skinny' install option which does not require `shap`.
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
   pythonRemoveDeps = [ "shap" ];
@@ -65,6 +66,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     alembic
+    cachetools
     click
     cloudpickle
     databricks-cli
@@ -79,12 +81,14 @@ buildPythonPackage rec {
     markdown
     matplotlib
     numpy
+    opentelemetry-api
+    opentelemetry-sdk
     packaging
     pandas
     prometheus-flask-exporter
     protobuf
-    python-dateutil
     pyarrow
+    python-dateutil
     pytz
     pyyaml
     querystring-parser
diff --git a/pkgs/development/python-modules/mlx/default.nix b/pkgs/development/python-modules/mlx/default.nix
index c45e35af8382..b65f87105d2d 100644
--- a/pkgs/development/python-modules/mlx/default.nix
+++ b/pkgs/development/python-modules/mlx/default.nix
@@ -30,13 +30,13 @@ let
 in
 buildPythonPackage rec {
   pname = "mlx";
-  version = "0.6.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "ml-explore";
     repo = "mlx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FihdI+3ACKMJfPT2POjTRdtkXs7x+KiQpdpo3RcczBE=";
+    hash = "sha256-+vgHEt+L91YJLpQo4bps+Rnm/TS1PAPXNohdICGK6GE=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/mobi/default.nix b/pkgs/development/python-modules/mobi/default.nix
index c4f3af961ca3..82065268cfeb 100644
--- a/pkgs/development/python-modules/mobi/default.nix
+++ b/pkgs/development/python-modules/mobi/default.nix
@@ -5,7 +5,6 @@
   loguru,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/mocket/default.nix b/pkgs/development/python-modules/mocket/default.nix
index 3a209f7a6a43..a76b460857af 100644
--- a/pkgs/development/python-modules/mocket/default.nix
+++ b/pkgs/development/python-modules/mocket/default.nix
@@ -36,12 +36,12 @@
 
 buildPythonPackage rec {
   pname = "mocket";
-  version = "3.12.5";
+  version = "3.12.8";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6yWo7SBlVldK+AxUBnQOXjQBxz9HbIC+Ch977xiZxek=";
+    hash = "sha256-++zGXLtQ01srmF0EqUFqaxh+mnNzW8IzYG1RzNGTXkw=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/mockupdb/default.nix b/pkgs/development/python-modules/mockupdb/default.nix
index 5ac9a946ac16..47ba794d0a0b 100644
--- a/pkgs/development/python-modules/mockupdb/default.nix
+++ b/pkgs/development/python-modules/mockupdb/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   pymongo,
+  pythonAtLeast,
   pythonOlder,
   pytestCheckHook,
 }:
@@ -12,7 +13,8 @@ buildPythonPackage rec {
   version = "1.8.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.9";
+  # use the removed ssl.wrap_socket function
+  disabled = pythonOlder "3.9" || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/moddb/default.nix b/pkgs/development/python-modules/moddb/default.nix
index 2846ef2d7a31..17af65e37a20 100644
--- a/pkgs/development/python-modules/moddb/default.nix
+++ b/pkgs/development/python-modules/moddb/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   beautifulsoup4,
   pyrate-limiter,
   requests,
@@ -21,7 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-2t5QQAmSLOrdNCl0XdsFPdP2UF10/qq69DovqeQ1Vt8=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     beautifulsoup4
diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index a525adad5947..e8472d3233e5 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -5,7 +5,6 @@
   setuptools,
   pythonOlder,
   z3-solver,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [ z3-solver ];
 
diff --git a/pkgs/development/python-modules/moderngl-window/default.nix b/pkgs/development/python-modules/moderngl-window/default.nix
index 90e07d12178d..8042df62a5f9 100644
--- a/pkgs/development/python-modules/moderngl-window/default.nix
+++ b/pkgs/development/python-modules/moderngl-window/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   setuptools,
   glfw,
   moderngl,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pillow" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/molbar/default.nix b/pkgs/development/python-modules/molbar/default.nix
index ada2c6cfb535..f69bfb6f17c2 100644
--- a/pkgs/development/python-modules/molbar/default.nix
+++ b/pkgs/development/python-modules/molbar/default.nix
@@ -1,6 +1,5 @@
 { buildPythonPackage
 , python
-, pythonRelaxDepsHook
 , lib
 , gfortran
 , fetchgit
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gfortran
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "networkx" ];
diff --git a/pkgs/development/python-modules/molecule/plugins.nix b/pkgs/development/python-modules/molecule/plugins.nix
index 8b7c5b8ffba5..b87c3b121b54 100644
--- a/pkgs/development/python-modules/molecule/plugins.nix
+++ b/pkgs/development/python-modules/molecule/plugins.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools-scm,
   python-vagrant,
   docker,
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   pythonRemoveDeps = [ "molecule" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/more-itertools/default.nix b/pkgs/development/python-modules/more-itertools/default.nix
index 6fd9f94525e7..0130714fecf7 100644
--- a/pkgs/development/python-modules/more-itertools/default.nix
+++ b/pkgs/development/python-modules/more-itertools/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "more-itertools";
-  version = "10.2.0";
+  version = "10.3.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-j8y0gMQ9PpmgAIdjTAbdArDVD78IizgN5aQaAV7COeE=";
+    hash = "sha256-5dk+9BEiT7zvNmpujdxMV4G8Y1nUNBKmXdWWTkYRFGM=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index e72fb7b5ea40..a013da79a922 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -44,19 +44,19 @@
 
 buildPythonPackage rec {
   pname = "moto";
-  version = "5.0.5";
+  version = "5.0.9";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Lqyi33dY9oaN9CC/ByXNC5PZhwlgbx+4sjQ7W9yCLZE=";
+    hash = "sha256-63Hxy6AccP/x8WCGrLJNbZrrMoMNZG2JifmKKa6uJLo=";
   };
 
   build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     boto3
     botocore
     cryptography
@@ -68,7 +68,7 @@ buildPythonPackage rec {
     jinja2
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     # non-exhaustive list of extras, that was cobbled together for testing
     all = [
       antlr4-python3-runtime
@@ -98,7 +98,7 @@ buildPythonPackage rec {
     pytestCheckHook
     pytest-order
     pytest-xdist
-  ] ++ passthru.optional-dependencies.all;
+  ] ++ optional-dependencies.all;
 
   # Some tests depend on AWS credentials environment variables to be set.
   env.AWS_ACCESS_KEY_ID = "ak";
@@ -156,6 +156,9 @@ buildPythonPackage rec {
     # Threading tests regularly blocks test execution
     "tests/test_utilities/test_threaded_server.py"
     "tests/test_s3/test_s3_bucket_policy.py"
+
+    # https://github.com/getmoto/moto/issues/7786
+    "tests/test_dynamodb/test_dynamodb_import_table.py"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/moviepy/default.nix b/pkgs/development/python-modules/moviepy/default.nix
index 01b6a7086ab8..7f1196b461a9 100644
--- a/pkgs/development/python-modules/moviepy/default.nix
+++ b/pkgs/development/python-modules/moviepy/default.nix
@@ -73,6 +73,8 @@ buildPythonPackage rec {
     "test_setup"
     "test_subtitles"
     "test_sys_write_flush"
+    # media duration mismatch: assert 2.9 == 3.0
+    "test_ffmpeg_parse_infos"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/mpris-server/default.nix b/pkgs/development/python-modules/mpris-server/default.nix
index 611ac8a2f864..06383416d96c 100644
--- a/pkgs/development/python-modules/mpris-server/default.nix
+++ b/pkgs/development/python-modules/mpris-server/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchPypi,
   emoji,
   pydbus,
@@ -21,7 +20,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/multipart/default.nix b/pkgs/development/python-modules/multipart/default.nix
index 34b12c70edfe..312699ecda41 100644
--- a/pkgs/development/python-modules/multipart/default.nix
+++ b/pkgs/development/python-modules/multipart/default.nix
@@ -2,28 +2,21 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  fetchpatch,
+  setuptools,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "multipart";
-  version = "0.2.4";
-
-  format = "setuptools";
+  version = "0.2.5";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "06ba205360bc7096fefe618e4f1e9b2cdb890b4f2157053a81f386912a2522cb";
+    hash = "sha256-+piDjUDJZ7sZWJYmoPuKXEDEId2i/r4bA1H89ibiRlE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "dont-test-semicolon-separators-in-urlencoded-data.patch";
-      url = "https://github.com/defnull/multipart/commit/4d4ac6b79c453918ebf40c690e8d57d982ee840b.patch";
-      hash = "sha256-rMeMhQEhonWAHzy5M8Im5mL6km5a9O0CGVOV+T3UNqo=";
-    })
-  ];
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/mwcli/default.nix b/pkgs/development/python-modules/mwcli/default.nix
index 613a52bd8a67..adcc5ab1e34c 100644
--- a/pkgs/development/python-modules/mwcli/default.nix
+++ b/pkgs/development/python-modules/mwcli/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   docopt,
   para,
 }:
@@ -20,7 +19,6 @@ buildPythonPackage rec {
   # Prevent circular dependency
   pythonRemoveDeps = [ "mwxml" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     docopt
diff --git a/pkgs/development/python-modules/myjwt/default.nix b/pkgs/development/python-modules/myjwt/default.nix
index 9f58f93f60ca..e7c80a480167 100644
--- a/pkgs/development/python-modules/myjwt/default.nix
+++ b/pkgs/development/python-modules/myjwt/default.nix
@@ -13,7 +13,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   questionary,
   requests,
   requests-mock,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index 3a0c97957b39..af3d186fb5a3 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.23.2";
+  version = "7.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-v5/3TCEtDXbmitb3e15XWkW8VO5nJk8TCVvVyh5rAMs=";
+    hash = "sha256-RVpyCXIM7ze2iWJsi3i5N5JF2EyASAJ52DpYeebNk5A=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/mypy-protobuf/default.nix b/pkgs/development/python-modules/mypy-protobuf/default.nix
index 73e0a331799a..0dca10652ac6 100644
--- a/pkgs/development/python-modules/mypy-protobuf/default.nix
+++ b/pkgs/development/python-modules/mypy-protobuf/default.nix
@@ -7,7 +7,6 @@
   protobuf,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   testers,
   types-protobuf,
@@ -25,7 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-AvJC6zQJ9miJ8rGjqlg1bsTZCc3Q+TEVYi6ecDZuyjw=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "protobuf" ];
 
diff --git a/pkgs/development/python-modules/myst-parser/default.nix b/pkgs/development/python-modules/myst-parser/default.nix
index bbf92943bf53..c5b7736c113a 100644
--- a/pkgs/development/python-modules/myst-parser/default.nix
+++ b/pkgs/development/python-modules/myst-parser/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   flit-core,
   pythonOlder,
   defusedxml,
@@ -18,12 +17,10 @@
   pytest-regressions,
   sphinx-pytest,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
-
 buildPythonPackage rec {
   pname = "myst-parser";
-  version = "2.0.0";
+  version = "3.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -32,20 +29,11 @@ buildPythonPackage rec {
     owner = "executablebooks";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-1BW7Z+0rs5Up+VZ3vDygnhLzE9Y2BqEMnTnflboweu0=";
+    hash = "sha256-TKo1lanZNM+XrOKZ0ZmtlhEPoAYQUspkyHXZm1wNTFE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "myst-parser-sphinx7.2-compat.patch";
-      url = "https://github.com/executablebooks/MyST-Parser/commit/4f670fc04c438b57a9d4014be74e9a62cc0deba4.patch";
-      hash = "sha256-FCvFSsD7qQwqWjSW7R4Gx+E2jaGkifSZqaRbAglt9Yw=";
-    })
-  ];
-
   nativeBuildInputs = [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
@@ -71,24 +59,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "docutils" ];
 
-  disabledTests = [
-    # AssertionError due to different files
-    "test_basic"
-    "test_footnotes"
-    "test_gettext_html"
-    "test_fieldlist_extension"
-    # docutils 0.19 expectation mismatches
-    "test_docutils_roles"
-    # sphinx 7.0 expectation mismatches
-    "test_heading_slug_func"
-    "test_references_singlehtml"
-    # sphinx 6.0 expectation mismatches
-    "test_sphinx_directives"
-    # sphinx 5.3 expectation mismatches
-    "test_render"
-    "test_includes"
-  ];
-
   meta = with lib; {
     description = "Sphinx and Docutils extension to parse MyST";
     homepage = "https://myst-parser.readthedocs.io/";
diff --git a/pkgs/development/python-modules/nbdev/default.nix b/pkgs/development/python-modules/nbdev/default.nix
index e46087b9e524..dc60601b7e6c 100644
--- a/pkgs/development/python-modules/nbdev/default.nix
+++ b/pkgs/development/python-modules/nbdev/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   ipywidgets,
   fastcore,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-MntVdZ6LazdFCm+h5FaTxvzEwCtoJjrW/EJPTt2fdnU=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "ipywidgets" ];
 
diff --git a/pkgs/development/python-modules/nbmake/default.nix b/pkgs/development/python-modules/nbmake/default.nix
index bb050d9b89af..4c6d46e6d470 100644
--- a/pkgs/development/python-modules/nbmake/default.nix
+++ b/pkgs/development/python-modules/nbmake/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   setuptools,
   wheel,
   ipykernel,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/netaddr/default.nix b/pkgs/development/python-modules/netaddr/default.nix
index a265984a800e..aaf776d9aaba 100644
--- a/pkgs/development/python-modules/netaddr/default.nix
+++ b/pkgs/development/python-modules/netaddr/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "netaddr";
-  version = "1.2.1";
+  version = "1.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-brj+3wQSxtKU0GiFwRDelFz00i0rUQ0EBPTgaVCFeYc=";
+    sha256 = "sha256-XDw9mJW1Ubdjd5un23oDSH3B+OOzha+BmvNBrp725Io=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/nethsm/default.nix b/pkgs/development/python-modules/nethsm/default.nix
index 5285d609d747..77d25a7a1b1d 100644
--- a/pkgs/development/python-modules/nethsm/default.nix
+++ b/pkgs/development/python-modules/nethsm/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   flit-core,
   certifi,
   cryptography,
@@ -35,7 +34,6 @@ buildPythonPackage {
 
   nativeBuildInputs = [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/netio/default.nix b/pkgs/development/python-modules/netio/default.nix
index bf33aa47ddc1..305b177b8245 100644
--- a/pkgs/development/python-modules/netio/default.nix
+++ b/pkgs/development/python-modules/netio/default.nix
@@ -5,7 +5,6 @@
   poetry-core,
   pyopenssl,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pyopenssl" ];
diff --git a/pkgs/development/python-modules/nettigo-air-monitor/default.nix b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
index dc2c2a908a79..11c6592526cc 100644
--- a/pkgs/development/python-modules/nettigo-air-monitor/default.nix
+++ b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "nettigo-air-monitor";
-  version = "3.1.0";
+  version = "3.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = "nettigo-air-monitor";
     rev = "refs/tags/${version}";
-    hash = "sha256-9LrzCUstzMTzt2qHzDsllyep5Rtt6vrrvVPRFILUtwA=";
+    hash = "sha256-2INL6ZXi7f4HD0ilhQLSivk8TfYh3qRSPRsCCtCLAP8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/nextdns/default.nix b/pkgs/development/python-modules/nextdns/default.nix
index 9b84c400e529..e6b68e8490d2 100644
--- a/pkgs/development/python-modules/nextdns/default.nix
+++ b/pkgs/development/python-modules/nextdns/default.nix
@@ -4,18 +4,18 @@
   aioresponses,
   buildPythonPackage,
   fetchFromGitHub,
-  orjson,
   pytest-asyncio,
   pytest-error-for-skips,
   pytestCheckHook,
   pythonOlder,
   setuptools,
   syrupy,
+  tenacity,
 }:
 
 buildPythonPackage rec {
   pname = "nextdns";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -24,14 +24,14 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = "nextdns";
     rev = "refs/tags/${version}";
-    hash = "sha256-ka/VT7c72la4z/BVAWnV06MxVmu52ZcJ4GsEeP7vbKA=";
+    hash = "sha256-bBGuMfXCAqds9SMGj1I+9rk/u2QljZW60quvWODboCA=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     aiohttp
-    orjson
+    tenacity
   ];
 
   nativeCheckInputs = [
@@ -42,6 +42,12 @@ buildPythonPackage rec {
     syrupy
   ];
 
+  disabledTests = [
+    # mocked object called too many times
+    "test_retry_error"
+    "test_retry_success"
+  ];
+
   pythonImportsCheck = [ "nextdns" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/nh3/default.nix b/pkgs/development/python-modules/nh3/default.nix
index 7c7a8895edff..1699b18c182d 100644
--- a/pkgs/development/python-modules/nh3/default.nix
+++ b/pkgs/development/python-modules/nh3/default.nix
@@ -10,12 +10,12 @@
 }:
 let
   pname = "nh3";
-  version = "0.2.15";
+  version = "0.2.17";
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OyTehgnjmDALU2qPRL/HrvoAMyIsmYuTKFlOJT8r+Gk=";
+    hash = "sha256-j9OoXAuuCWsBHanN+SzSip94ZA+kY8HUVvfY/omUSSM=";
   };
 in
 buildPythonPackage {
@@ -26,7 +26,7 @@ buildPythonPackage {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-fetAE3cj9hh4SoPE72Bqco5ytUMiDqbazeS2MHdUibM=";
+    hash = "sha256-WomlVzKOUfcgAWGJInSvZn9hm+bFpgc4nJbRiyPCU64=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/niaaml/default.nix b/pkgs/development/python-modules/niaaml/default.nix
index 88bcb450fbf5..27a851e35510 100644
--- a/pkgs/development/python-modules/niaaml/default.nix
+++ b/pkgs/development/python-modules/niaaml/default.nix
@@ -8,14 +8,13 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scikit-learn,
   toml-adapt,
 }:
 
 buildPythonPackage rec {
   pname = "niaaml";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,14 +23,13 @@ buildPythonPackage rec {
     owner = "lukapecnik";
     repo = "NiaAML";
     rev = "refs/tags/${version}";
-    hash = "sha256-d6UlpMrT0GBZlcD1BCZxInXTdyFMBVltxnSyUFbSy0g=";
+    hash = "sha256-VMZLEirE01Q9eyQIhV18PepGWmBcxLIwNeuVf7EuSWE=";
   };
 
   pythonRelaxDeps = [ "pandas" ];
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
     toml-adapt
   ];
 
diff --git a/pkgs/development/python-modules/niaclass/default.nix b/pkgs/development/python-modules/niaclass/default.nix
index b4fa278bfa01..b9ba6558b78d 100644
--- a/pkgs/development/python-modules/niaclass/default.nix
+++ b/pkgs/development/python-modules/niaclass/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scikit-learn,
   toml-adapt,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
     toml-adapt
   ];
 
diff --git a/pkgs/development/python-modules/niapy/default.nix b/pkgs/development/python-modules/niapy/default.nix
index 60308f21573f..f7cfecd8a5c1 100644
--- a/pkgs/development/python-modules/niapy/default.nix
+++ b/pkgs/development/python-modules/niapy/default.nix
@@ -7,7 +7,8 @@
   openpyxl,
   pandas,
   poetry-core,
-  pytestCheckHook,
+  pytest7CheckHook,
+  pytest-xdist,
   pythonOlder,
 }:
 
@@ -34,7 +35,7 @@ buildPythonPackage rec {
     pandas
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytest7CheckHook pytest-xdist ];
 
   pythonImportsCheck = [ "niapy" ];
 
diff --git a/pkgs/development/python-modules/nikola/default.nix b/pkgs/development/python-modules/nikola/default.nix
index 3af0fd4b9eb6..8085af5e364b 100644
--- a/pkgs/development/python-modules/nikola/default.nix
+++ b/pkgs/development/python-modules/nikola/default.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "nikola";
-  version = "8.3.0";
+  version = "8.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -52,7 +52,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Nikola";
     inherit version;
-    hash = "sha256-VYuhiGLMTHcOZM8/bGZT7Xx5BOHo9gsMPjufYglrBL0=";
+    hash = "sha256-IfJB2Rl3c1MyEiuyNpT3udfpM480VvFD8zosJFDHr7k=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index c592b35c076b..5ac5192eeb19 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   # python dependencies
   click,
   python-dateutil,
@@ -58,7 +57,6 @@ buildPythonPackage rec {
       --replace "/usr/bin/env bash" "${bash}/bin/bash"
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "traits" ];
 
diff --git a/pkgs/development/python-modules/nitime/default.nix b/pkgs/development/python-modules/nitime/default.nix
index 3e711b1bc7a7..e9a1ac4c3a18 100644
--- a/pkgs/development/python-modules/nitime/default.nix
+++ b/pkgs/development/python-modules/nitime/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "nitime";
-  version = "0.10.2";
+  version = "0.11";
   disabled = pythonOlder "3.7";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NCaWr7ZqL1XV0QfUD+4+Yn33N1cCP33ib5oJ91OtJLU=";
+    hash = "sha256-4Ie8fuk9CKdn/64TsCfN2No2dU16ICpBRWYerqqF0/0=";
   };
 
   # Upstream wants to build against the oldest version of numpy possible, but
diff --git a/pkgs/development/python-modules/nitransforms/default.nix b/pkgs/development/python-modules/nitransforms/default.nix
index 2729f23eab35..51f499d6ab17 100644
--- a/pkgs/development/python-modules/nitransforms/default.nix
+++ b/pkgs/development/python-modules/nitransforms/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   h5py,
   nibabel,
   numpy,
@@ -23,7 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-Lty4aPzSlwRJSqCXeIVICF+gudYqto1OS4cVZyrB2nY=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   buildInputs = [
     setuptools-scm
     toml
diff --git a/pkgs/development/python-modules/norfair/default.nix b/pkgs/development/python-modules/norfair/default.nix
index 11afdd9533d0..c3c50cd13334 100644
--- a/pkgs/development/python-modules/norfair/default.nix
+++ b/pkgs/development/python-modules/norfair/default.nix
@@ -11,7 +11,6 @@
   motmetrics,
   opencv4,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "rich" ];
diff --git a/pkgs/development/python-modules/nose2/default.nix b/pkgs/development/python-modules/nose2/default.nix
index 9155ae68a6b9..95a564c14c58 100644
--- a/pkgs/development/python-modules/nose2/default.nix
+++ b/pkgs/development/python-modules/nose2/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "nose2";
-  version = "0.14.1";
+  version = "0.15.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f48Dohyd4sMwFZM6/O9yv45KLV3+w7QAkih95uQbCTo=";
+    hash = "sha256-NncPUZ31vs08v+C+5Ku/v5ufa0604DNh0oK378/E8N8=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/notify-py/default.nix b/pkgs/development/python-modules/notify-py/default.nix
index a0c0b0b96aed..38f4ff5af140 100644
--- a/pkgs/development/python-modules/notify-py/default.nix
+++ b/pkgs/development/python-modules/notify-py/default.nix
@@ -9,7 +9,6 @@
   libnotify,
   which,
   poetry-core,
-  pythonRelaxDepsHook,
   jeepney,
   loguru,
   pytest,
@@ -19,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "notify-py";
-  version = "0.3.42";
+  version = "0.3.43";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -28,7 +27,7 @@ buildPythonPackage rec {
     owner = "ms7m";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XtjJImH9UwPPZS/Yqs8S5xGXOLBRmJRawzxWXoPWvrM=";
+    hash = "sha256-4PJ/0dLG3bWDuF1G/qUmvNaIUFXgPP2S/0uhZz86WRA=";
   };
 
   patches =
@@ -50,7 +49,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "loguru" ];
diff --git a/pkgs/development/python-modules/nototools/default.nix b/pkgs/development/python-modules/nototools/default.nix
index a712a936c4ef..ea555a5e0977 100644
--- a/pkgs/development/python-modules/nototools/default.nix
+++ b/pkgs/development/python-modules/nototools/default.nix
@@ -36,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "nototools";
-  version = "0.2.19";
+  version = "0.2.20";
 
   disabled = pythonOlder "3.6";
 
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     owner = "googlefonts";
     repo = "nototools";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-anAz+5PIhGhpFunjV2EVk2CrbXq2U0e+LINYUnS0IKU=";
+    sha256 = "sha256-id4UhyWOFHrtmBZHhnaY2jHDIK0s7rcGBpg4QsBTLKs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/notus-scanner/default.nix b/pkgs/development/python-modules/notus-scanner/default.nix
index 9d402201dcce..afe74c20e94e 100644
--- a/pkgs/development/python-modules/notus-scanner/default.nix
+++ b/pkgs/development/python-modules/notus-scanner/default.nix
@@ -8,7 +8,6 @@
   pytestCheckHook,
   python-gnupg,
   pythonOlder,
-  pythonRelaxDepsHook,
   sentry-sdk,
   tomli,
 }:
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     paho-mqtt
diff --git a/pkgs/development/python-modules/ntc-templates/default.nix b/pkgs/development/python-modules/ntc-templates/default.nix
index f329a00589d2..478a40150180 100644
--- a/pkgs/development/python-modules/ntc-templates/default.nix
+++ b/pkgs/development/python-modules/ntc-templates/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "ntc-templates";
-  version = "4.4.0";
+  version = "5.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "networktocode";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-8Lzh6ku2TUQFatqbOb5JIc/WkRPegx/gNnT53DErMuk=";
+    hash = "sha256-SnmI1/lB1p/zldgn9jIid4yJ5+ubr5mh/IAqXY/1Wbc=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/numba-scipy/default.nix b/pkgs/development/python-modules/numba-scipy/default.nix
index d144bf4c9610..05c07632a979 100644
--- a/pkgs/development/python-modules/numba-scipy/default.nix
+++ b/pkgs/development/python-modules/numba-scipy/default.nix
@@ -6,7 +6,6 @@
   numba,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    pythonRelaxDepsHook
   ];
   pythonRelaxDeps = [
     "scipy"
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index 2e219e018dd1..4c79076be77f 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -8,6 +8,7 @@
   buildPythonPackage,
   setuptools,
   numpy,
+  numpy_2,
   llvmlite,
   libcxx,
   importlib-metadata,
@@ -32,9 +33,7 @@ let
   cudatoolkit = cudaPackages.cuda_nvcc;
 in
 buildPythonPackage rec {
-  # Using an untagged version, with numpy 1.25 support, when it's released
-  # also drop the versioneer patch in postPatch
-  version = "0.59.1";
+  version = "0.60.0";
   pname = "numba";
   pyproject = true;
 
@@ -56,7 +55,7 @@ buildPythonPackage rec {
     # use `forceFetchGit = true;`.` If in the future we'll observe the hash
     # changes too often, we can always use forceFetchGit, and inject the
     # relevant strings ourselves, using `sed` commands, in extraPostFetch.
-    hash = "sha256-4udpgLLHbHNtxPiYVkj+gxAjTWV3ClZOv98Y313/qbc=";
+    hash = "sha256-hUL281wHLA7wo8umzBNhiGJikyIF2loCzjLECuC+pO0=";
   };
 
   postPatch = ''
@@ -68,16 +67,19 @@ buildPythonPackage rec {
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
-  nativeBuildInputs =
-    [ numpy ]
-    ++ lib.optionals cudaSupport [
-      autoAddDriverRunpath
-      cudaPackages.cuda_nvcc
-    ];
+  build-system = [
+    setuptools
+    numpy_2
+  ];
+
+  nativeBuildInputs = lib.optionals cudaSupport [
+    autoAddDriverRunpath
+    cudaPackages.cuda_nvcc
+  ];
 
   buildInputs = lib.optionals cudaSupport [ cudaPackages.cuda_cudart ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
     llvmlite
     setuptools
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/1.nix
index f20bd095cf97..f20bd095cf97 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/1.nix
diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
new file mode 100644
index 000000000000..6b52b7acec73
--- /dev/null
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -0,0 +1,180 @@
+{
+  lib,
+  stdenv,
+  fetchPypi,
+  python,
+  pythonAtLeast,
+  pythonOlder,
+  buildPythonPackage,
+  writeTextFile,
+
+  # build-system
+  cython,
+  gfortran,
+  meson-python,
+  mesonEmulatorHook,
+  pkg-config,
+  xcbuild,
+
+  # native dependencies
+  blas,
+  lapack,
+
+  # Reverse dependency
+  sage,
+
+  # tests
+  hypothesis,
+  pytest-xdist,
+  pytestCheckHook,
+  setuptools,
+  typing-extensions,
+}:
+
+assert (!blas.isILP64) && (!lapack.isILP64);
+
+let
+  cfg = writeTextFile {
+    name = "site.cfg";
+    text = lib.generators.toINI { } {
+      ${blas.implementation} = {
+        include_dirs = "${lib.getDev blas}/include:${lib.getDev lapack}/include";
+        library_dirs = "${blas}/lib:${lapack}/lib";
+        runtime_library_dirs = "${blas}/lib:${lapack}/lib";
+        libraries = "lapack,lapacke,blas,cblas";
+      };
+      lapack = {
+        include_dirs = "${lib.getDev lapack}/include";
+        library_dirs = "${lapack}/lib";
+        runtime_library_dirs = "${lapack}/lib";
+      };
+      blas = {
+        include_dirs = "${lib.getDev blas}/include";
+        library_dirs = "${blas}/lib";
+        runtime_library_dirs = "${blas}/lib";
+      };
+    };
+  };
+in
+buildPythonPackage rec {
+  pname = "numpy";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "tar.gz";
+    hash = "sha256-z10cnmg3+K+fkra9PobVE83BH2D9YhhcxJ7H0aujSGQ=";
+  };
+
+  patches = lib.optionals python.hasDistutilsCxxPatch [
+    # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
+    # Patching of numpy.distutils is needed to prevent it from undoing the
+    # patch to distutils.
+    ./numpy-distutils-C++.patch
+  ];
+
+  postPatch = ''
+    # remove needless reference to full Python path stored in built wheel
+    substituteInPlace numpy/meson.build \
+      --replace-fail 'py.full_path()' "'python'"
+  '';
+
+  build-system =
+    [
+      cython
+      gfortran
+      meson-python
+      pkg-config
+    ]
+    ++ lib.optionals stdenv.isDarwin [ xcbuild.xcrun ]
+    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
+
+  # we default openblas to build with 64 threads
+  # if a machine has more than 64 threads, it will segfault
+  # see https://github.com/OpenMathLib/OpenBLAS/issues/2993
+  preConfigure = ''
+    sed -i 's/-faltivec//' numpy/distutils/system_info.py
+    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
+  '';
+
+  # HACK: copy mesonEmulatorHook's flags to the variable used by meson-python
+  postConfigure = ''
+    mesonFlags="$mesonFlags ''${mesonFlagsArray[@]}"
+  '';
+
+  buildInputs = [
+    blas
+    lapack
+  ];
+
+  preBuild = ''
+    ln -s ${cfg} site.cfg
+  '';
+
+  enableParallelBuilding = true;
+
+  nativeCheckInputs = [
+    hypothesis
+    pytestCheckHook
+    pytest-xdist
+    setuptools
+    typing-extensions
+  ];
+
+  preCheck = ''
+    pushd $out
+  '';
+
+  postCheck = ''
+    popd
+  '';
+
+  # https://github.com/numpy/numpy/blob/a277f6210739c11028f281b8495faf7da298dbef/numpy/_pytesttester.py#L180
+  pytestFlagsArray = [
+    "-m"
+    "not\\ slow" # fast test suite
+  ];
+
+  disabledTests =
+    lib.optionals (pythonAtLeast "3.13") [
+      # https://github.com/numpy/numpy/issues/26713
+      "test_iter_refcount"
+    ]
+    ++ lib.optionals stdenv.isAarch32 [
+      # https://github.com/numpy/numpy/issues/24548
+      "test_impossible_feature_enable" # AssertionError: Failed to generate error
+      "test_features" # AssertionError: Failure Detection
+      "test_new_policy" # AssertionError: assert False
+      "test_identityless_reduction_huge_array" # ValueError: Maximum allowed dimension exceeded
+      "test_unary_spurious_fpexception" # AssertionError: Got warnings: [<warnings.WarningMessage object at 0xd1197430>]
+      "test_int" # AssertionError: selectedintkind(19): expected 16 but got -1
+      "test_real" # AssertionError: selectedrealkind(16): expected 10 but got -1
+      "test_quad_precision" # AssertionError: selectedrealkind(32): expected 16 but got -1
+      "test_big_arrays" # ValueError: array is too big; `arr.size * arr.dtype.itemsize` is larger tha...
+      "test_multinomial_pvals_float32" # Failed: DID NOT RAISE <class 'ValueError'>
+    ]
+    ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+      # AssertionError: (np.int64(0), np.longdouble('9.9999999999999994515e-21'), np.longdouble('3.9696755572509052902e+20'), 'arctanh')
+      "test_loss_of_precision"
+    ];
+
+  passthru = {
+    # just for backwards compatibility
+    blas = blas.provider;
+    blasImplementation = blas.implementation;
+    inherit cfg;
+    tests = {
+      inherit sage;
+    };
+  };
+
+  meta = {
+    changelog = "https://github.com/numpy/numpy/releases/tag/v${version}";
+    description = "Scientific tools for Python";
+    homepage = "https://numpy.org/";
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/python-modules/nutils/default.nix b/pkgs/development/python-modules/nutils/default.nix
index 2a170ebe3e44..86185683c4ce 100644
--- a/pkgs/development/python-modules/nutils/default.nix
+++ b/pkgs/development/python-modules/nutils/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "nutils";
-  version = "8.6";
+  version = "8.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "evalf";
     repo = "nutils";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vfdb7+jcJ5EuWDoZyRExWEPEWt+lgbzmAL3QhguLtHE=";
+    hash = "sha256-wxouS0FXrdIhm6nTVBuzkwHceJnZ7f7k8nMFxFsZchE=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/oci/default.nix b/pkgs/development/python-modules/oci/default.nix
index 5ca36d1c444c..847d45fc823d 100644
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@@ -8,7 +8,6 @@
   pyopenssl,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   setuptools,
 }:
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/odp-amsterdam/default.nix b/pkgs/development/python-modules/odp-amsterdam/default.nix
index 10373acbd436..abe1e5d1cba3 100644
--- a/pkgs/development/python-modules/odp-amsterdam/default.nix
+++ b/pkgs/development/python-modules/odp-amsterdam/default.nix
@@ -5,7 +5,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   pythonOlder,
   pytest-asyncio,
   pytestCheckHook,
@@ -37,10 +36,6 @@ buildPythonPackage rec {
     poetry-core
   ];
 
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
-
   pythonRelaxDeps = [ "pytz" ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/okta/default.nix b/pkgs/development/python-modules/okta/default.nix
index d825547bd4d5..239a204c0fb4 100644
--- a/pkgs/development/python-modules/okta/default.nix
+++ b/pkgs/development/python-modules/okta/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "okta";
-  version = "2.9.6";
+  version = "2.9.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WRWbS8bYUafnvnTKLHlV7YV5410E0jk2UYos2F20A7k=";
+    hash = "sha256-wW3QiWcyH9byMywsRAdWLulFUagouWM87vMJtQ+q2UE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ollama/default.nix b/pkgs/development/python-modules/ollama/default.nix
index fcfe04192262..33433bc17ac9 100644
--- a/pkgs/development/python-modules/ollama/default.nix
+++ b/pkgs/development/python-modules/ollama/default.nix
@@ -9,7 +9,6 @@
   pytest-httpserver,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [ httpx ];
 
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
index d4257e4489d8..082d0e0a313a 100644
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   cmake,
   fetchFromGitHub,
-  fetchpatch,
   gtest,
   nbval,
   numpy,
@@ -26,7 +25,7 @@ let
 in
 buildPythonPackage rec {
   pname = "onnx";
-  version = "1.15.0";
+  version = "1.16.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -35,19 +34,10 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Jzga1IiUO5LN5imSUmnbsjYtapRatTihx38EOUjm9Os=";
+    hash = "sha256-I1wwfn91hdH3jORIKny0Xc73qW2P04MjkVCgcaNnQUE=";
   };
 
-  patches = [
-    ./1.15.0-CVE-2024-27318.patch
-    (fetchpatch {
-      name = "CVE-2024-27319.patch";
-      url = "https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287.patch";
-      hash = "sha256-9X92N9i/hpQjDGe4I/C+FwUcTUTtP2Nf7+pcTA2sXoA=";
-    })
-  ];
-
-  nativeBuildInputs = [
+  build-system = [
     cmake
     pybind11
   ];
@@ -56,10 +46,11 @@ buildPythonPackage rec {
     abseil-cpp
     protobuf
     google-re2
+    gtestStatic
     pillow
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     protobuf_21
     protobuf
     numpy
diff --git a/pkgs/development/python-modules/onnxruntime/default.nix b/pkgs/development/python-modules/onnxruntime/default.nix
index 612e76354a00..b7475fd5b480 100644
--- a/pkgs/development/python-modules/onnxruntime/default.nix
+++ b/pkgs/development/python-modules/onnxruntime/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   autoPatchelfHook,
-  pythonRelaxDepsHook,
   onnxruntime,
   coloredlogs,
   numpy,
@@ -36,7 +35,7 @@ buildPythonPackage {
     chmod +w dist
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ] ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
 
   # This project requires fairly large dependencies such as sympy which we really don't always need.
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/open-interpreter/default.nix b/pkgs/development/python-modules/open-interpreter/default.nix
index 726a312b38e2..0fd3600d5d3e 100644
--- a/pkgs/development/python-modules/open-interpreter/default.nix
+++ b/pkgs/development/python-modules/open-interpreter/default.nix
@@ -3,7 +3,6 @@
   fetchFromGitHub,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   poetry-core,
 
   appdirs,
@@ -50,7 +49,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openai-triton/bin.nix b/pkgs/development/python-modules/openai-triton/bin.nix
index ef95ac07244a..bdf722bbc0fc 100644
--- a/pkgs/development/python-modules/openai-triton/bin.nix
+++ b/pkgs/development/python-modules/openai-triton/bin.nix
@@ -13,7 +13,6 @@
   autoPatchelfHook,
   filelock,
   lit,
-  pythonRelaxDepsHook,
   zlib,
 }:
 
@@ -34,13 +33,13 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [
     "cmake"
+    # torch and triton refer to each other so this hook is included to mitigate that.
     "torch"
   ];
 
   buildInputs = [ zlib ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook # torch and triton refer to each other so this hook is included to mitigate that.
     autoPatchelfHook
   ];
 
diff --git a/pkgs/development/python-modules/openai-triton/default.nix b/pkgs/development/python-modules/openai-triton/default.nix
index d1aaed52052d..8e3ed7bad51c 100644
--- a/pkgs/development/python-modules/openai-triton/default.nix
+++ b/pkgs/development/python-modules/openai-triton/default.nix
@@ -7,7 +7,6 @@
   fetchpatch,
   setuptools,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   cmake,
   ninja,
   pybind11,
@@ -105,7 +104,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
     # pytestCheckHook # Requires torch (circular dependency) and probably needs GPUs:
     cmake
     ninja
diff --git a/pkgs/development/python-modules/openapi-core/default.nix b/pkgs/development/python-modules/openapi-core/default.nix
index 15b02bf4bd10..61c4d891bbef 100644
--- a/pkgs/development/python-modules/openapi-core/default.nix
+++ b/pkgs/development/python-modules/openapi-core/default.nix
@@ -20,7 +20,7 @@
   parse,
   poetry-core,
   pytest-aiohttp,
-  pytest7CheckHook,
+  pytestCheckHook,
   pythonOlder,
   responses,
   requests,
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "openapi-core";
-  version = "0.19.0";
+  version = "0.19.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "p1c2u";
     repo = "openapi-core";
     rev = "refs/tags/${version}";
-    hash = "sha256-+YYcSNX717JjVHMk4Seb145iq9/rQZEVQn27Ulk1A3E=";
+    hash = "sha256-6FFJsXObIA9tchTJJmoSu9u+/ZuKuw29AYsLEmvHXrY=";
   };
 
   postPatch = ''
@@ -82,7 +82,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     httpx
     pytest-aiohttp
-    pytest7CheckHook
+    pytestCheckHook
     responses
     webob
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
diff --git a/pkgs/development/python-modules/openhomedevice/default.nix b/pkgs/development/python-modules/openhomedevice/default.nix
index 3c53f5f58322..b08b23905ce8 100644
--- a/pkgs/development/python-modules/openhomedevice/default.nix
+++ b/pkgs/development/python-modules/openhomedevice/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "openhomedevice";
-  version = "2.2";
+  version = "2.3";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "bazwilliams";
     repo = "openhomedevice";
     rev = "refs/tags/${version}";
-    hash = "sha256-GGp7nKFH01m1KW6yMkKlAdd26bDi8JDWva6OQ0CWMIw=";
+    hash = "sha256-q8UG+PYtJ7lLlnw2Rt5O/SxOrUtYmwO1cEG1WocaQ7M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/openllm-core/default.nix b/pkgs/development/python-modules/openllm-core/default.nix
index 928a47a43d75..1da77dee3242 100644
--- a/pkgs/development/python-modules/openllm-core/default.nix
+++ b/pkgs/development/python-modules/openllm-core/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   accelerate,
   attrs,
   bitsandbytes,
@@ -19,13 +18,14 @@
   mypy-extensions,
   orjson,
   peft,
+  pydantic,
   transformers,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "openllm-core";
-  version = "0.4.44";
+  version = "0.5.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -34,18 +34,17 @@ buildPythonPackage rec {
     owner = "bentoml";
     repo = "OpenLLM";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kRR715Vnt9ZAmxuWvtH0z093crH0JFrEKPtbjO3QMRc=";
+    hash = "sha256-sEZLszzoo39WUnziHGp7zWNO0YaqkXeXAoIxvyhw42w=";
   };
 
   sourceRoot = "${src.name}/openllm-core";
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "hatch-vcs==0.3.0" "hatch-vcs" \
-      --replace-fail "hatchling==1.18.0" "hatchling" \
-      --replace-fail "hatch-fancy-pypi-readme==23.1.0" "hatch-fancy-pypi-readme"
+      --replace-fail "hatch-vcs==" "hatch-vcs>=" \
+      --replace-fail "hatchling==" "hatchling>=" \
+      --replace-fail "hatch-fancy-pypi-readme==" "hatch-fancy-pypi-readme>="
   '';
 
   pythonRelaxDeps = [ "cattrs" ];
@@ -59,6 +58,7 @@ buildPythonPackage rec {
   dependencies = [
     attrs
     cattrs
+    pydantic
     # not listed in pyproject.toml, but required at runtime
     click-option-group
     deepmerge
diff --git a/pkgs/development/python-modules/openllm/default.nix b/pkgs/development/python-modules/openllm/default.nix
index 6ed4db129e58..5d5af060d846 100644
--- a/pkgs/development/python-modules/openllm/default.nix
+++ b/pkgs/development/python-modules/openllm/default.nix
@@ -6,7 +6,6 @@
   hatchling,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   accelerate,
   bentoml,
   bitsandbytes,
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   sourceRoot = "${src.name}/openllm-python";
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     # remove cuda-python as it has an unfree license
diff --git a/pkgs/development/python-modules/opensearch-py/default.nix b/pkgs/development/python-modules/opensearch-py/default.nix
index dafc633a5632..a73c319fd10b 100644
--- a/pkgs/development/python-modules/opensearch-py/default.nix
+++ b/pkgs/development/python-modules/opensearch-py/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "opensearch-py";
-  version = "2.4.2";
+  version = "2.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "opensearch-project";
     repo = "opensearch-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MPuHdjhsrccKYUIDlDYGoXBbBu/V+q43Puf0e5j8vhU=";
+    hash = "sha256-qpay0EDD99MzxDMkjk3hU/34rxLD71PM8zdcIcHj/0Q=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/opentelemetry-api/default.nix b/pkgs/development/python-modules/opentelemetry-api/default.nix
index 8116626b94d8..8fde20af6cbf 100644
--- a/pkgs/development/python-modules/opentelemetry-api/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-api/default.nix
@@ -9,14 +9,13 @@
   opentelemetry-test-utils,
   setuptools,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   writeScript,
 }:
 
 let
   self = buildPythonPackage rec {
     pname = "opentelemetry-api";
-    version = "1.24.0";
+    version = "1.25.0";
     pyproject = true;
 
     disabled = pythonOlder "3.8";
@@ -26,12 +25,11 @@ let
       owner = "open-telemetry";
       repo = "opentelemetry-python";
       rev = "refs/tags/v${version}";
-      hash = "sha256-id5cwNl2idgZa1AFfolzEo5vzspv3V2c1Vtzg3EWDZs=";
+      hash = "sha256-9mxgPYliGkNsZGOhF9YCmxZjP3hc2UUmxSpWY4IMLCo=";
     };
 
     sourceRoot = "${src.name}/opentelemetry-api";
 
-    nativeBuildInputs = [ pythonRelaxDepsHook ];
 
     build-system = [ hatchling ];
 
diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
index 1068b33036a9..1939a63fa6a1 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "opentelemetry-instrumentation";
-  version = "0.45b0";
+  version = "0.46b0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "open-telemetry";
     repo = "opentelemetry-python-contrib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-snpanTREdvfqpqPI8UWzm55pDK8Q77guqgT8kFULRKU=";
+    hash = "sha256-BC/RJL4GgC3vGe4bC9mavPNpE+j8ZIkOKCbK4I4LuGQ=";
   };
 
   sourceRoot = "${src.name}/opentelemetry-instrumentation";
diff --git a/pkgs/development/python-modules/opentelemetry-semantic-conventions/default.nix b/pkgs/development/python-modules/opentelemetry-semantic-conventions/default.nix
index f4001c4f13b6..ab2db17a4218 100644
--- a/pkgs/development/python-modules/opentelemetry-semantic-conventions/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-semantic-conventions/default.nix
@@ -1,5 +1,4 @@
 {
-  lib,
   buildPythonPackage,
   pythonOlder,
   hatchling,
@@ -22,6 +21,8 @@ buildPythonPackage {
 
   build-system = [ hatchling ];
 
+  dependencies = [ opentelemetry-api ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "opentelemetry.semconv" ];
diff --git a/pkgs/development/python-modules/openusd/default.nix b/pkgs/development/python-modules/openusd/default.nix
index 4110e887dc4f..d20bcf4c1f1c 100644
--- a/pkgs/development/python-modules/openusd/default.nix
+++ b/pkgs/development/python-modules/openusd/default.nix
@@ -51,13 +51,13 @@ in
 
 buildPythonPackage rec {
   pname = "openusd";
-  version = "24.03";
+  version = "24.05";
 
   src = fetchFromGitHub {
     owner = "PixarAnimationStudios";
     repo = "OpenUSD";
     rev = "refs/tags/v${version}";
-    hash = "sha256-EYf8GhXhsAx0Wxz9ibDZEV4E5scL3GPiu3Nje7N5C/I=";
+    hash = "sha256-akwLIB5YUbnDiaQXX/K5YLXzWlTYWZG51dtxbSFxPt0=";
   };
 
   stdenv = if python.stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else python.stdenv;
diff --git a/pkgs/development/python-modules/orange-canvas-core/default.nix b/pkgs/development/python-modules/orange-canvas-core/default.nix
index 49bd8f996fc0..7aaef933a66c 100644
--- a/pkgs/development/python-modules/orange-canvas-core/default.nix
+++ b/pkgs/development/python-modules/orange-canvas-core/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "orange-canvas-core";
-  version = "0.1.35";
+  version = "0.2.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xLCwjeNDx9RqxlNkIWMo0Pcrg7akGuu4Rv9oRDgOK18=";
+    hash = "sha256-f0E/7jnzoIrV4V1KSbec0MZB/BLz0UVbBCsc3v4dp0o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/orange-widget-base/default.nix b/pkgs/development/python-modules/orange-widget-base/default.nix
index 61d63c17344b..50a1e956919a 100644
--- a/pkgs/development/python-modules/orange-widget-base/default.nix
+++ b/pkgs/development/python-modules/orange-widget-base/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "orange-widget-base";
-  version = "4.22.0";
+  version = "4.24.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nV2aBPZzn7K+QECtCVoLLh5smG31zE2G9jFTKlxh9qM=";
+    hash = "sha256-2cBg7s4+qMrb2G4sMk5yednOzJCNheHIQ3lty4KAg18=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/orange3/default.nix b/pkgs/development/python-modules/orange3/default.nix
index a235fef5f044..146edc07bf06 100644
--- a/pkgs/development/python-modules/orange3/default.nix
+++ b/pkgs/development/python-modules/orange3/default.nix
@@ -6,7 +6,6 @@
   buildPythonPackage,
   chardet,
   copyDesktopItems,
-  pythonRelaxDepsHook,
   cython,
   catboost,
   xgboost,
@@ -53,7 +52,7 @@
 let
   self = buildPythonPackage rec {
     pname = "orange3";
-    version = "3.36.2";
+    version = "3.37.0";
     pyproject = true;
 
     disabled = pythonOlder "3.7";
@@ -62,7 +61,7 @@ let
       owner = "biolab";
       repo = "orange3";
       rev = "refs/tags/${version}";
-      hash = "sha256-v9lk5vGhBaR2PHZ+Jq0hy1WaCsbeLe+vZlTaHBkfacU=";
+      hash = "sha256-3PybiHXH6oIYJb78/a7LnQA6cYUicDx4Mf65QhIhT4w=";
     };
 
     postPatch = ''
@@ -75,7 +74,6 @@ let
 
     nativeBuildInputs = [
       copyDesktopItems
-      pythonRelaxDepsHook
       oldest-supported-numpy
       cython
       qt5.wrapQtAppsHook
diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix
index aa5a5572dec9..cfe81127811a 100644
--- a/pkgs/development/python-modules/orbax-checkpoint/default.nix
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "orbax-checkpoint";
-  version = "0.5.9";
+  version = "0.5.17";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "orbax_checkpoint";
     inherit version;
-    hash = "sha256-H96IkUM3IxV79uddNBCU0dq+0dvPx8/Ps4HeCItGi2A=";
+    hash = "sha256-cFV0oLQdk1sXMS/jaYjnLaHzPVfZdzKTeneoTAJ5P5Q=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 5bb2acb5dfd8..c1d58c0a1c54 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.10.3";
+  version = "3.10.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,13 +40,13 @@ buildPythonPackage rec {
     owner = "ijl";
     repo = "orjson";
     rev = "refs/tags/${version}";
-    hash = "sha256-bK6wA8P/IXEbiuJAx7psd0nUUKjR1jX4scFfJr1MBAk=";
+    hash = "sha256-Q2zi3mNgCFrg7Ucana0+lmR9C9kkuUidEJj8GneR2W4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-ilGq+/gPSuNwURUWy2ZxInzmUv+PxYMxd8esxrMpr2o=";
+    hash = "sha256-yhLKw4BhdIHgcu4iVlXQlHk/8J+3NK6LlmSWbm/5y4Q=";
   };
 
   maturinBuildFlags = [ "--interpreter ${python.executable}" ];
diff --git a/pkgs/development/python-modules/ormar/default.nix b/pkgs/development/python-modules/ormar/default.nix
index 2400ed2b223f..a2ef75c52bb1 100644
--- a/pkgs/development/python-modules/ormar/default.nix
+++ b/pkgs/development/python-modules/ormar/default.nix
@@ -21,14 +21,13 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sqlalchemy,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "ormar";
-  version = "0.12.2";
+  version = "0.20.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -37,7 +36,7 @@ buildPythonPackage rec {
     owner = "collerek";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Yd5ex0bcy61zq5Sn2dKeb98s/CMxUWnyGx6jFWQ3RUs=";
+    hash = "sha256-DzvmJpWJANIoc5lvWAD0b2bhbKdDEpNL2l3TqXSZSnc=";
   };
 
   pythonRelaxDeps = [
@@ -48,7 +47,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs =
diff --git a/pkgs/development/python-modules/osqp/default.nix b/pkgs/development/python-modules/osqp/default.nix
index 5a47de257846..d3dbb48df72f 100644
--- a/pkgs/development/python-modules/osqp/default.nix
+++ b/pkgs/development/python-modules/osqp/default.nix
@@ -9,7 +9,6 @@
   oldest-supported-numpy,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   qdldl,
   scipy,
   setuptools-scm,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
     cmake
     oldest-supported-numpy
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "scipy" ];
diff --git a/pkgs/development/python-modules/oss2/default.nix b/pkgs/development/python-modules/oss2/default.nix
index 79c0b50e2235..374f526b57f5 100644
--- a/pkgs/development/python-modules/oss2/default.nix
+++ b/pkgs/development/python-modules/oss2/default.nix
@@ -10,7 +10,6 @@
   pycryptodome,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   six,
 }:
@@ -29,7 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-jDSXPVyy8XvPgsGZXsdfavFPptq28pCwr9C63OZvNrY=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     requests
diff --git a/pkgs/development/python-modules/ossfs/default.nix b/pkgs/development/python-modules/ossfs/default.nix
index 833b22995af5..940f5a20b342 100644
--- a/pkgs/development/python-modules/ossfs/default.nix
+++ b/pkgs/development/python-modules/ossfs/default.nix
@@ -6,7 +6,6 @@
   fsspec,
   oss2,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/outlines/default.nix b/pkgs/development/python-modules/outlines/default.nix
index 6f7ee0ee37a0..b7e51351f7ef 100644
--- a/pkgs/development/python-modules/outlines/default.nix
+++ b/pkgs/development/python-modules/outlines/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "outlines";
-  version = "0.0.38";
+  version = "0.0.45";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "outlines-dev";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kOd2J6PV2idWaltkGUVNXfB+1dNU1f8vbnHQ5i1WxG8=";
+    hash = "sha256-VJ/q3NBNatBv3gsV637sciiOHdDJRnMlcisu5GRmWM0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ovh/default.nix b/pkgs/development/python-modules/ovh/default.nix
index 1f741962c902..f1cfb0536739 100644
--- a/pkgs/development/python-modules/ovh/default.nix
+++ b/pkgs/development/python-modules/ovh/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "ovh";
-  version = "1.1.0";
+  version = "1.1.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EI+bWjtHEZPOSkWJx3gvS8y//gugMWl3TrBHKsKO9nk=";
+    hash = "sha256-Yarx6ymS/Vr4Gbpa3Qgmbp7eLgAkUeOhYGpMNn3aoE8=";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/packageurl-python/default.nix b/pkgs/development/python-modules/packageurl-python/default.nix
index 1946c3087fbf..8ce0a1ed4020 100644
--- a/pkgs/development/python-modules/packageurl-python/default.nix
+++ b/pkgs/development/python-modules/packageurl-python/default.nix
@@ -9,14 +9,15 @@
 
 buildPythonPackage rec {
   pname = "packageurl-python";
-  version = "0.15.0";
+  version = "0.15.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-8hmyzmNIGFonvWpy5v3J+YTmyfoVfv+ny5PjQcSc3MI=";
+    pname = "packageurl_python";
+    inherit version;
+    hash = "sha256-mje5p8rZoocrRhIVG6N0n9neyQSFV3wU03S25mt+3wM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index 58327bc57543..4ddebe8901df 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -15,14 +15,14 @@
 let
   packaging = buildPythonPackage rec {
     pname = "packaging";
-    version = "24.0";
+    version = "24.1";
     pyproject = true;
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-64LF4+ViCQdHZuaIW7BLjDigwBXQowA26+fs40yZiek=";
+      hash = "sha256-Am7XLI7T/M5b+JUFciWGmJJ/0dvaEKXpgc3wrDf08AI=";
     };
 
     nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/paddle2onnx/default.nix b/pkgs/development/python-modules/paddle2onnx/default.nix
index 34278879ddd8..ee429fb164d0 100644
--- a/pkgs/development/python-modules/paddle2onnx/default.nix
+++ b/pkgs/development/python-modules/paddle2onnx/default.nix
@@ -9,7 +9,7 @@
 }:
 let
   pname = "paddle2onnx";
-  version = "1.2.0";
+  version = "1.2.4";
   format = "wheel";
   pyShortVersion = "cp${builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion}";
   src = fetchPypi {
@@ -18,7 +18,7 @@ let
     python = pyShortVersion;
     abi = pyShortVersion;
     platform = "manylinux_2_12_x86_64.manylinux2010_x86_64";
-    hash = "sha256-18eStagm7V4D87fiPoigAyXxVGoo//8UENutSqNfUBI=";
+    hash = "sha256-2muP4Y1zvqYVxvN6I9wjdMY+YE2d0nRmIwFFI/BsIKE=";
   };
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/paddleocr/default.nix b/pkgs/development/python-modules/paddleocr/default.nix
index c263fce2c649..8033d8c79e6d 100644
--- a/pkgs/development/python-modules/paddleocr/default.nix
+++ b/pkgs/development/python-modules/paddleocr/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   attrdict,
   beautifulsoup4,
@@ -29,7 +28,7 @@
 }:
 
 let
-  version = "2.7.1";
+  version = "2.7.5";
 in
 buildPythonPackage {
   pname = "paddleocr";
@@ -39,8 +38,8 @@ buildPythonPackage {
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleOCR";
-    rev = "v${version}";
-    hash = "sha256-5Dt4UL+7dwJNjcNnCVi3o8bLCt7/m/M6oh1vPu9rza8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-8mnSV4ga6G2cbYCX84XJRFiLCoXstTAtqvg9QqVN6GI=";
   };
 
   patches = [
@@ -55,7 +54,6 @@ buildPythonPackage {
     ./remove-import-imaug.patch
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   # trying to relax only pymupdf makes the whole build fail
   pythonRelaxDeps = true;
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/pallets-sphinx-themes/default.nix b/pkgs/development/python-modules/pallets-sphinx-themes/default.nix
index a021db9db307..bba0de1f208f 100644
--- a/pkgs/development/python-modules/pallets-sphinx-themes/default.nix
+++ b/pkgs/development/python-modules/pallets-sphinx-themes/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pallets-sphinx-themes";
-  version = "2.1.1";
+  version = "2.1.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pallets";
     repo = "pallets-sphinx-themes";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-Z03rsqkwF2rYaqRZflf5qc5EdHPIEcEcB1ftYIm5DQs=";
+    sha256 = "sha256-uXSejJLVmYpzRCP92JQKHosnlx7dgZlFf5XzbxOfvII=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/panasonic-viera/default.nix b/pkgs/development/python-modules/panasonic-viera/default.nix
index aff9ad947807..6cbdd76236d5 100644
--- a/pkgs/development/python-modules/panasonic-viera/default.nix
+++ b/pkgs/development/python-modules/panasonic-viera/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  poetry-core,
   aiohttp,
   pycryptodome,
   xmltodict,
@@ -9,17 +10,18 @@
 
 buildPythonPackage rec {
   pname = "panasonic-viera";
-  version = "0.4.0";
-
-  format = "setuptools";
+  version = "0.4.2";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "panasonic_viera";
     inherit version;
-    sha256 = "baad2db7958ddbc7288d0f1c50a9eeddd8b83f3d30ad14ac3f6c51fe953e0eb6";
+    hash = "sha256-gcFAFwEdCqiC1yHIA2B/gzmwvRwMC9fDxkgCbzIOpjM=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
     aiohttp
     pycryptodome
     xmltodict
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 93ac3fe7771c..3323c5c9a83b 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -66,7 +66,7 @@
 let
   pandas = buildPythonPackage rec {
     pname = "pandas";
-    version = "2.2.1";
+    version = "2.2.2";
     pyproject = true;
 
     disabled = pythonOlder "3.9";
@@ -75,14 +75,15 @@ let
       owner = "pandas-dev";
       repo = "pandas";
       rev = "refs/tags/v${version}";
-      hash = "sha256-eyVUIYG0KCAEJbh/qZiEjGpdXq7A+2Lab+5bp+7t4cw=";
+      hash = "sha256-+zQKrsJmP3FJeOiYwNH1u96+/ECDHQF39evzur3cKjc=";
     };
 
     postPatch = ''
       substituteInPlace pyproject.toml \
         --replace-fail "Cython==3.0.5" "Cython>=3.0.5" \
         --replace-fail "meson-python==0.13.1" "meson-python>=0.13.1" \
-        --replace-fail "meson==1.2.1" "meson>=1.2.1"
+        --replace-fail "meson==1.2.1" "meson>=1.2.1" \
+        --replace-fail "numpy>=2.0.0rc1" "numpy"
     '';
 
     nativeBuildInputs =
diff --git a/pkgs/development/python-modules/pandoc-xnos/default.nix b/pkgs/development/python-modules/pandoc-xnos/default.nix
index c41e2811ae31..af8c05f9a9eb 100644
--- a/pkgs/development/python-modules/pandoc-xnos/default.nix
+++ b/pkgs/development/python-modules/pandoc-xnos/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools ];
 
+  pythonRelaxDeps = [ "psutil" ];
+
   propagatedBuildInputs = [
     pandocfilters
     psutil
diff --git a/pkgs/development/python-modules/panel/default.nix b/pkgs/development/python-modules/panel/default.nix
index ddf9e6d69f6d..f034d572b3b6 100644
--- a/pkgs/development/python-modules/panel/default.nix
+++ b/pkgs/development/python-modules/panel/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   bleach,
   bokeh,
   param,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
     python = "py3";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "bokeh" ];
 
diff --git a/pkgs/development/python-modules/parse/default.nix b/pkgs/development/python-modules/parse/default.nix
index 6ab9af132478..76c6fdc51a5d 100644
--- a/pkgs/development/python-modules/parse/default.nix
+++ b/pkgs/development/python-modules/parse/default.nix
@@ -7,14 +7,14 @@
 }:
 buildPythonPackage rec {
   pname = "parse";
-  version = "1.20.1";
+  version = "1.20.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "r1chardj0n3s";
     repo = "parse";
     rev = "refs/tags/${version}";
-    hash = "sha256-FAAs39peR+Ibv0RKLrcnY2w0Z2EjVYyZ8U4HcbjTiew=";
+    hash = "sha256-i/H3E/Z8vqt2jLS8BaVHJuD2Fbi7TP7EeOjXAJ16bWg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/parsedmarc/default.nix b/pkgs/development/python-modules/parsedmarc/default.nix
index 6b3044636fee..7dd87d5f6af4 100644
--- a/pkgs/development/python-modules/parsedmarc/default.nix
+++ b/pkgs/development/python-modules/parsedmarc/default.nix
@@ -28,7 +28,6 @@
   opensearch-py,
   publicsuffixlist,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   tqdm,
   xmltodict,
@@ -42,19 +41,18 @@ let
 in
 buildPythonPackage rec {
   pname = "parsedmarc";
-  version = "8.11.0";
+  version = "8.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OBxiaXB8NKNMviRI19rYYJxpnfnaEL3zSPmYB4urIug=";
+    hash = "sha256-mscc3TRMYuaTqrrxGPCVVKa2fg5sXwK/BglpbvLXbLc=";
   };
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/parts/default.nix b/pkgs/development/python-modules/parts/default.nix
index 1df8298ba68f..5f942a17c58f 100644
--- a/pkgs/development/python-modules/parts/default.nix
+++ b/pkgs/development/python-modules/parts/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "parts";
-  version = "1.7.0";
+  version = "2.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TbcFgWKKgHXFyi1NqwVy1ITGHESb4ZusivOpFWazN1s=";
+    hash = "sha256-wQgiwr7iOBvy24/w1C311PivWLtXLD/Djs34zo1Zid4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pathy/default.nix b/pkgs/development/python-modules/pathy/default.nix
index 07e55245b385..3e384c62a98a 100644
--- a/pkgs/development/python-modules/pathy/default.nix
+++ b/pkgs/development/python-modules/pathy/default.nix
@@ -6,7 +6,6 @@
   pathlib-abc,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   smart-open,
   typer,
@@ -24,7 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-uz0OawuL92709jxxkeluCvLtZcj9tfoXSI+ch55jcG0=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "smart-open" ];
 
diff --git a/pkgs/development/python-modules/pdb2pqr/default.nix b/pkgs/development/python-modules/pdb2pqr/default.nix
index da3e3e0c2f06..e082eab102ba 100644
--- a/pkgs/development/python-modules/pdb2pqr/default.nix
+++ b/pkgs/development/python-modules/pdb2pqr/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   mmcif-pdbx,
   numpy,
   propka,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-He301TJ1bzWub0DZ6Ro/Xc+JMtJBbyygVpWjPY6RMbA=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "docutils" ];
 
diff --git a/pkgs/development/python-modules/pdf2docx/default.nix b/pkgs/development/python-modules/pdf2docx/default.nix
index e8a3f7e41634..af91594808b5 100644
--- a/pkgs/development/python-modules/pdf2docx/default.nix
+++ b/pkgs/development/python-modules/pdf2docx/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   python,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   imagemagick,
   pip,
   pytestCheckHook,
@@ -33,7 +32,6 @@ buildPythonPackage {
 
   nativeBuildInputs = [
     pip
-    pythonRelaxDepsHook
     imagemagick
   ];
 
diff --git a/pkgs/development/python-modules/pdm-backend/default.nix b/pkgs/development/python-modules/pdm-backend/default.nix
index 714dff4c5a52..889c36936afc 100644
--- a/pkgs/development/python-modules/pdm-backend/default.nix
+++ b/pkgs/development/python-modules/pdm-backend/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.3.0";
+  version = "2.3.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     rev = "refs/tags/${version}";
-    hash = "sha256-V+NESf7NavR6L6ko4Oh4KhAR2iIN5GiHZPELwvkpr4c=";
+    hash = "sha256-I1bAjryLDXzlstIHK4cD6/HPJBGGskRUVp7B2PDwXhc=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;
diff --git a/pkgs/development/python-modules/pelican/default.nix b/pkgs/development/python-modules/pelican/default.nix
index 93bde3408dea..9f77c7546ac1 100644
--- a/pkgs/development/python-modules/pelican/default.nix
+++ b/pkgs/development/python-modules/pelican/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build-system
   pdm-backend,
@@ -61,7 +60,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pdm-backend
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "unidecode" ];
@@ -105,6 +103,7 @@ buildPythonPackage rec {
     "test_basic_generation_works"
     "test_custom_generation_works"
     "test_custom_locale_generation_works"
+    "test_deprecated_attribute"
   ];
 
   env.LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/persistent/default.nix b/pkgs/development/python-modules/persistent/default.nix
index 96d6d796fbdf..cffa4633a117 100644
--- a/pkgs/development/python-modules/persistent/default.nix
+++ b/pkgs/development/python-modules/persistent/default.nix
@@ -1,35 +1,38 @@
 {
   lib,
   buildPythonPackage,
-  cffi,
   fetchPypi,
+  isPyPy,
+
+  # build-systems
+  setuptools,
+
+  # dependencies
+  cffi,
+  zope-deferredimport,
   zope-interface,
-  sphinx,
-  manuel,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "persistent";
-  version = "5.2";
-  format = "setuptools";
+  version = "6.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2+pdH/nbTkUco5vAtCqepTfmyskoKujAeA+4/64+yDQ=";
+    hash = "sha256-CDZQwP/ty4gDKJY8KUuVEaArawXkIec3p9Vfnu2I+18=";
   };
 
-  nativeBuildInputs = [
-    sphinx
-    manuel
-  ];
+  build-system = [ setuptools ];
 
   propagatedBuildInputs = [
     zope-interface
-    cffi
-  ];
+    zope-deferredimport
+  ]
+  ++ lib.optionals (!isPyPy) [ cffi ];
 
   pythonImportsCheck = [ "persistent" ];
 
diff --git a/pkgs/development/python-modules/pg8000/default.nix b/pkgs/development/python-modules/pg8000/default.nix
index d8ad4f8b7ea7..2607688f4cf5 100644
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pg8000";
-  version = "1.31.1";
+  version = "1.31.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sREw1MYV3TBi6o/tgUMGSnl4t/5tRPFLciYdQ8jicIc=";
+    hash = "sha256-HqRs8J2Oygf+fqre/XlR43vuf6vmdd8WTxpXL/swCHY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index cd9b32c97b32..8df6d6fc3d90 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.13.34";
+  version = "8.13.39";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fCZ2vge30PdEEeJ14GYDgKDsPuDTWfBw1xlCS9LF9i4=";
+    hash = "sha256-23yklw0gayBWIxEFMAdTsaWyKfQ0FvjCswEOY/u2jXc=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/phonopy/default.nix b/pkgs/development/python-modules/phonopy/default.nix
index 2a01d74be69f..38b239651b7c 100644
--- a/pkgs/development/python-modules/phonopy/default.nix
+++ b/pkgs/development/python-modules/phonopy/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "phonopy";
-  version = "2.23.1";
+  version = "2.24.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xJohROJNAPdEITtM/VncAYL8ASkfgThKy8XXnqiS3hU=";
+    hash = "sha256-VHtifCC28GKIE+0oz1wMgmZ9G6+rT8nF0PG6tYkhjG8=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 5bd009c93438..14ae97ea9686 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.14.0";
+  version = "9.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-3ORvbhO3eLu/NIE0Lwdf93QtUHUmyMf7LmdMBJpkYIg=";
+    hash = "sha256-dTEYI3dGu3Q/80lijp0ooApveSL1VWVHwLw7covnYYc=";
   };
 
   patches = [
@@ -53,12 +53,12 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "shims_enabled = not cflags_defined" "shims_enabled = False"
+      --replace-fail "shims_enabled = not cflags_defined" "shims_enabled = False"
   '';
 
   buildInputs = [ qpdf ];
 
-  nativeBuildInputs = [
+  build-system = [
     pybind11
     setuptools
   ];
@@ -74,7 +74,7 @@ buildPythonPackage rec {
     python-xmp-toolkit
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     deprecated
     lxml
     packaging
diff --git a/pkgs/development/python-modules/pinecone-client/default.nix b/pkgs/development/python-modules/pinecone-client/default.nix
index 52acaacfb62a..38ec710a14f4 100644
--- a/pkgs/development/python-modules/pinecone-client/default.nix
+++ b/pkgs/development/python-modules/pinecone-client/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   setuptools,
@@ -19,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pinecone-client";
-  version = "4.1.0";
+  version = "4.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,12 +26,11 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pinecone_client";
     inherit version;
-    hash = "sha256-QgYqYo56lB0Lwku4r7Am861NJkzwbWpiej3lgyFK494=";
+    hash = "sha256-sueMKd5QwYDb/nXhXwjIfsGjpPG8ayvh8Myu4atENPo=";
   };
 
   pythonRelaxDeps = [ "urllib3" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/pint/default.nix b/pkgs/development/python-modules/pint/default.nix
index 211027c8c4f6..51ef03ffc7dd 100644
--- a/pkgs/development/python-modules/pint/default.nix
+++ b/pkgs/development/python-modules/pint/default.nix
@@ -8,11 +8,11 @@
   setuptools,
   setuptools-scm,
 
-  # propagates
-  typing-extensions,
+  # dependencies
   appdirs,
   flexcache,
   flexparser,
+  typing-extensions,
 
   # tests
   pytestCheckHook,
@@ -47,6 +47,7 @@ buildPythonPackage rec {
     flexcache
     flexparser
     typing-extensions
+
     # Both uncertainties and numpy are not necessarily needed for every
     # function of pint, but needed for the pint-convert executable which we
     # necessarily distribute with this package as it is.
diff --git a/pkgs/development/python-modules/pip/default.nix b/pkgs/development/python-modules/pip/default.nix
index 310de7c4c717..058970320f90 100644
--- a/pkgs/development/python-modules/pip/default.nix
+++ b/pkgs/development/python-modules/pip/default.nix
@@ -2,23 +2,32 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   installShellFiles,
-  mock,
-  scripttest,
-  setuptools,
-  virtualenv,
   wheel,
-  pretend,
-  pytest,
+  setuptools,
 
   # docs
   sphinx,
 
+  # checks
+  freezegun,
+  git,
+  mock,
+  scripttest,
+  virtualenv,
+  pretend,
+  proxy-py,
+  pytestCheckHook,
+  tomli-w,
+  werkzeug,
+
   # coupled downsteam dependencies
   pip-tools,
 }:
 
-buildPythonPackage rec {
+let self = buildPythonPackage rec {
   pname = "pip";
   version = "24.0";
   format = "pyproject";
@@ -72,17 +81,21 @@ buildPythonPackage rec {
     cd ..
   '';
 
+  doCheck = false;
+
   nativeCheckInputs = [
+    freezegun
+    git
     mock
     scripttest
     virtualenv
     pretend
-    pytest
+    pytestCheckHook
+    proxy-py
+    tomli-w
+    werkzeug
   ];
 
-  # Pip wants pytest, but tests are not distributed
-  doCheck = false;
-
   postInstall = ''
     installManPage docs/build/man/*
 
@@ -94,6 +107,7 @@ buildPythonPackage rec {
 
   passthru.tests = {
     inherit pip-tools;
+    pytest = self.overridePythonAttrs { doCheck = true; };
   };
 
   meta = {
@@ -102,4 +116,5 @@ buildPythonPackage rec {
     homepage = "https://pip.pypa.io/";
     changelog = "https://pip.pypa.io/en/stable/news/#v${lib.replaceStrings [ "." ] [ "-" ] version}";
   };
-}
+};
+in self
diff --git a/pkgs/development/python-modules/pipx/default.nix b/pkgs/development/python-modules/pipx/default.nix
index 916ac250e86f..d3f8f3f43b14 100644
--- a/pkgs/development/python-modules/pipx/default.nix
+++ b/pkgs/development/python-modules/pipx/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pipx";
-  version = "1.4.3";
+  version = "1.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "pypa";
     repo = "pipx";
     rev = "refs/tags/${version}";
-    hash = "sha256-NxXOeVXwBhGqi4DUABV8UV+cDER0ROBFdgiyYTzdvuo=";
+    hash = "sha256-B57EIUIwy0XG5bnIwxYKgm3WwckdJWWAeUl84mWC1Ds=";
   };
 
   build-system = [
@@ -77,8 +77,20 @@ buildPythonPackage rec {
     "legacy_venv"
     "determination"
     "json"
+    "test_auto_update_shared_libs"
+    "test_cli"
+    "test_cli_global"
+    "test_fetch_missing_python"
+    "test_list_does_not_trigger_maintenance"
+    "test_list_pinned_packages"
     "test_list_short"
+    "test_list_standalone_interpreter"
+    "test_list_unused_standalone_interpreters"
+    "test_list_used_standalone_interpreters"
+    "test_pin"
     "test_skip_maintenance"
+    "test_unpin"
+    "test_unpin_warning"
   ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/pixel-font-builder/default.nix b/pkgs/development/python-modules/pixel-font-builder/default.nix
index e30f7c93d32e..b080d9f6b627 100644
--- a/pkgs/development/python-modules/pixel-font-builder/default.nix
+++ b/pkgs/development/python-modules/pixel-font-builder/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pixel-font-builder";
-  version = "0.0.25";
+  version = "0.0.26";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pixel_font_builder";
     inherit version;
-    hash = "sha256-66mGZ7q64z+tTJSSveD7UCkTq7YXgsHTM25MqUSLfvM=";
+    hash = "sha256-bgs2FbOA5tcUXe5+KuVztWGAv5yFxQNBaiZMeZ+ic+8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pkginfo/default.nix b/pkgs/development/python-modules/pkginfo/default.nix
index e0dcda5ff470..589721c4106e 100644
--- a/pkgs/development/python-modules/pkginfo/default.nix
+++ b/pkgs/development/python-modules/pkginfo/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pkginfo";
-  version = "1.10.0";
+  version = "1.11.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Xfc4NTmNENt5+O7NXNhrH20pMXWJ6nB5aZTUk5mvYpc=";
+    hash = "sha256-Lg3KHPTI45ZE7tMkCOqZZu4V4NMkxiuomaOTs8a0Z6o=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/pkutils/default.nix b/pkgs/development/python-modules/pkutils/default.nix
index a1f87f55e35a..724e991ee143 100644
--- a/pkgs/development/python-modules/pkutils/default.nix
+++ b/pkgs/development/python-modules/pkutils/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   nose3,
   pythonOlder,
-  pythonRelaxDepsHook,
   semver,
 }:
 
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "semver" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [ semver ];
 
diff --git a/pkgs/development/python-modules/plaid-python/default.nix b/pkgs/development/python-modules/plaid-python/default.nix
index 84150bed715c..5bd7bc2ada3e 100644
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@@ -6,21 +6,25 @@
   python-dateutil,
   urllib3,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "plaid-python";
-  version = "21.1.0";
-  format = "setuptools";
+  version = "23.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-KZGfr60RclPMis3y/XPY+VMQr0IxGXMwI7tPxNOlmhg=";
+    pname = "plaid_python";
+    inherit version;
+    hash = "sha256-1/819y1zcjoVwv5ITdvhno/X7piWdO22vYMovupwKXo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     nulltype
     python-dateutil
     urllib3
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index ac812994bc14..977127a694e6 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "4.2.0";
+  version = "4.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-DjRqOIkyhkA3Z1gl2o78R4kp23qJBj+pRmDBld8AbDI=";
+    hash = "sha256-WsHB+Si8RnJ9b8dYA9m7YRin3UYdJlL1v6/v8SExXtY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index cdbe9b143c2d..42472024e020 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -12,7 +12,7 @@
   setuptools,
   setuptools-scm,
   playwright-driver,
-  pythonRelaxDepsHook,
+  nodejs,
 }:
 
 let
@@ -21,7 +21,7 @@ in
 buildPythonPackage rec {
   pname = "playwright";
   # run ./pkgs/development/python-modules/playwright/update.sh to update
-  version = "1.42.0";
+  version = "1.44.0";
   pyproject = true;
   disabled = pythonOlder "3.7";
 
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "playwright-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GfaZ6wMbJShyTTcV9uulmsL8OI/OA+YDMvS2s3ePnjs=";
+    hash = "sha256-RM04I1QiyJhPvKdAdy8w2GmOOR+BWilxrZ5QUrwxBWA=";
   };
 
   patches = [
@@ -65,14 +65,14 @@ buildPythonPackage rec {
 
     # Set the correct driver path with the help of a patch in patches
     substituteInPlace playwright/_impl/_driver.py \
-      --replace "@driver@" "${driver}/bin/playwright"
+      --replace-fail "@node@" "${lib.getExe nodejs}" \
+      --replace-fail "@driver@" "${driver}/package/cli.js"
   '';
 
   nativeBuildInputs = [
     git
     setuptools-scm
     setuptools
-    pythonRelaxDepsHook
   ] ++ lib.optionals stdenv.isLinux [ auditwheel ];
 
   pythonRelaxDeps = [ "pyee" ];
diff --git a/pkgs/development/python-modules/playwright/driver-location.patch b/pkgs/development/python-modules/playwright/driver-location.patch
index a7f79840c65d..033b785e4eed 100644
--- a/pkgs/development/python-modules/playwright/driver-location.patch
+++ b/pkgs/development/python-modules/playwright/driver-location.patch
@@ -1,22 +1,22 @@
 diff --git a/playwright/_impl/_driver.py b/playwright/_impl/_driver.py
-index f3b911f..d00e509 100644
+index 9e8cdc1..7ee382d 100644
 --- a/playwright/_impl/_driver.py
 +++ b/playwright/_impl/_driver.py
 @@ -23,11 +23,7 @@ from playwright._repo_version import version
  
  
- def compute_driver_executable() -> Path:
--    package_path = Path(inspect.getfile(playwright)).parent
--    platform = sys.platform
--    if platform == "win32":
--        return package_path / "driver" / "playwright.cmd"
--    return package_path / "driver" / "playwright.sh"
-+   return Path("@driver@")
+ def compute_driver_executable() -> Tuple[str, str]:
+-    driver_path = Path(inspect.getfile(playwright)).parent / "driver"
+-    cli_path = str(driver_path / "package" / "cli.js")
+-    if sys.platform == "win32":
+-        return (str(driver_path / "node.exe"), cli_path)
+-    return (os.getenv("PLAYWRIGHT_NODEJS_PATH", str(driver_path / "node")), cli_path)
++   return "@node@", "@driver@"
  
  
- if sys.version_info.major == 3 and sys.version_info.minor == 7:
+ def get_driver_env() -> dict:
 diff --git a/setup.py b/setup.py
-index 3487a6a..05112c2 100644
+index 8709e52..59784dd 100644
 --- a/setup.py
 +++ b/setup.py
 @@ -141,25 +141,8 @@ class PlaywrightBDistWheelCommand(BDistWheelCommand):
diff --git a/pkgs/development/python-modules/playwrightcapture/default.nix b/pkgs/development/python-modules/playwrightcapture/default.nix
index d25abcde51c6..07f6f6813f1c 100644
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -12,7 +12,6 @@
   puremagic,
   pydub,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   requests,
   setuptools,
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/pluggy/default.nix b/pkgs/development/python-modules/pluggy/default.nix
index 649e00327367..ff03c4a6a533 100644
--- a/pkgs/development/python-modules/pluggy/default.nix
+++ b/pkgs/development/python-modules/pluggy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pluggy";
-  version = "1.4.0";
+  version = "1.5.0";
 
   disabled = pythonOlder "3.8";
 
@@ -20,10 +20,10 @@ buildPythonPackage rec {
     owner = "pytest-dev";
     repo = "pluggy";
     rev = "refs/tags/${version}";
-    hash = "sha256-1XHJwODmpYQkYZvnZck6RrtT4lOeCf8cr1QFx9DCbzw=";
+    hash = "sha256-f0DxyZZk6RoYtOEXLACcsOn2B+Hot4U4g5Ogr/hKmOE=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
 
   # To prevent infinite recursion with pytest
   doCheck = false;
diff --git a/pkgs/development/python-modules/plugincode/default.nix b/pkgs/development/python-modules/plugincode/default.nix
index 8dda4b7f7f62..9d82132c196b 100644
--- a/pkgs/development/python-modules/plugincode/default.nix
+++ b/pkgs/development/python-modules/plugincode/default.nix
@@ -38,7 +38,8 @@ buildPythonPackage rec {
     pytest-xdist
   ];
 
-  pythonImportsCheck = [ "plugincode" ];
+  # wants to read /etc/os-release and crashes because that is not available in the sandbox
+  # pythonImportsCheck = [ "plugincode" ];
 
   disabledTests = [
     # We don't want black as an input
diff --git a/pkgs/development/python-modules/plux/default.nix b/pkgs/development/python-modules/plux/default.nix
index 69559b4ca25e..5fbc757db88b 100644
--- a/pkgs/development/python-modules/plux/default.nix
+++ b/pkgs/development/python-modules/plux/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "plux";
-  version = "1.5.0";
+  version = "1.10.0";
   pyproject = true;
 
   # Tests are not available from PyPi
@@ -18,18 +18,22 @@ buildPythonPackage rec {
     owner = "localstack";
     repo = "plux";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XHRQTgvxXJCjCD/9Invf/5OCtp12A5poRUv8tR9DJsk=";
+    hash = "sha256-krlI7WimBluzkw3MVtGeotK5NFf+gsaUfL4CfhNPfpE=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     wheel
   ];
 
-  propagatedBuildInputs = [ stevedore ];
+  dependencies = [ stevedore ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
   pythonImportsCheck = [ "plugin.core" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
index f451f39b0852..690a155d056e 100644
--- a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
+++ b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "poetry-dynamic-versioning";
-  version = "1.2.0";
+  version = "1.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mtkennerly";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-qkRnlLLzbYf7C2VjPDjYfllej8an4WftNahPLz/Wkxw=";
+    hash = "sha256-dhAqDRMRcIYUluYgBlhyPPDZTnLlDrhcAOnT0dHk3Mo=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/polyswarm-api/default.nix b/pkgs/development/python-modules/polyswarm-api/default.nix
index 9aa77f50b62e..6b45f328598f 100644
--- a/pkgs/development/python-modules/polyswarm-api/default.nix
+++ b/pkgs/development/python-modules/polyswarm-api/default.nix
@@ -7,7 +7,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   responses,
   setuptools,
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "future" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/pooch/default.nix b/pkgs/development/python-modules/pooch/default.nix
index 3aec7fe45c56..ed35b18025ce 100644
--- a/pkgs/development/python-modules/pooch/default.nix
+++ b/pkgs/development/python-modules/pooch/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "pooch";
-  version = "1.8.1";
+  version = "1.8.2";
   format = "pyproject";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J+9jCX3ZpuT50mlPXPvy8KXe+kT8yv7AjWAecx10YnA=";
+    hash = "sha256-dlYfDeaKAdpN9q846ZVcTJ0aXJDac/fkAnalco7IPRA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ppscore/default.nix b/pkgs/development/python-modules/ppscore/default.nix
index f523ffce1c82..544681c2c704 100644
--- a/pkgs/development/python-modules/ppscore/default.nix
+++ b/pkgs/development/python-modules/ppscore/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   setuptools,
   pandas,
   pytestCheckHook,
@@ -25,7 +24,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/prettytable/default.nix b/pkgs/development/python-modules/prettytable/default.nix
index 1dc575d2dc06..f7fd2f5bfca2 100644
--- a/pkgs/development/python-modules/prettytable/default.nix
+++ b/pkgs/development/python-modules/prettytable/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   hatch-vcs,
   hatchling,
-  pytest-lazy-fixture,
+  pytest-lazy-fixtures,
   pytestCheckHook,
   pythonOlder,
   wcwidth,
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "prettytable";
-  version = "3.9.0";
+  version = "3.10.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "prettytable";
     rev = "refs/tags/${version}";
-    hash = "sha256-yIO4eO2VdOnUt9qoNQOeq/c0os2LQ3mqAkCOIuoGpyg=";
+    hash = "sha256-S23nUCA2WTxnCKKKFrtN9HYjP0SHUBPPsVNAc4SYlVg=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ wcwidth ];
 
   nativeCheckInputs = [
-    pytest-lazy-fixture
+    pytest-lazy-fixtures
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/private-gpt/default.nix b/pkgs/development/python-modules/private-gpt/default.nix
index 7012ff5cf5fc..765132c92ba5 100644
--- a/pkgs/development/python-modules/private-gpt/default.nix
+++ b/pkgs/development/python-modules/private-gpt/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "fastapi" ];
+
   dependencies = [
     fastapi
     injector
diff --git a/pkgs/development/python-modules/prometrix/default.nix b/pkgs/development/python-modules/prometrix/default.nix
index 850ee8e55be6..52e0621136c7 100644
--- a/pkgs/development/python-modules/prometrix/default.nix
+++ b/pkgs/development/python-modules/prometrix/default.nix
@@ -11,7 +11,6 @@
   poetry-core,
   prometheus-api-client,
   pydantic,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     boto3
diff --git a/pkgs/development/python-modules/prompt-toolkit/default.nix b/pkgs/development/python-modules/prompt-toolkit/default.nix
index 77550d1cf121..0a415b1926fe 100644
--- a/pkgs/development/python-modules/prompt-toolkit/default.nix
+++ b/pkgs/development/python-modules/prompt-toolkit/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "prompt-toolkit";
-  version = "3.0.43";
+  version = "3.0.47";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "prompt_toolkit";
     inherit version;
-    hash = "sha256-NSe3ryYQbLxloEC8yEg5o1ZuwbBRuwv+lTYx5wSw/30=";
+    hash = "sha256-Hhspy1gICx5p8gfIk6GnvxbRJ6XDDJ0Xolpdd3kuU2A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/prov/default.nix b/pkgs/development/python-modules/prov/default.nix
index fb725723d954..233f71b0a3d9 100644
--- a/pkgs/development/python-modules/prov/default.nix
+++ b/pkgs/development/python-modules/prov/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "prov";
-  version = "2.0.0";
+  version = "2.0.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b6438f2195ecb9f6e8279b58971e02bc51814599b5d5383366eef91d867422ee";
+    sha256 = "sha256-DiOMFAXRpVxyvTmzttc9b3q/2dCn+rLsBpOhmimlYX8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index f1e852930f6b..0b7a69a434fa 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.9.8";
+  version = "6.0.0";
   format = "setuptools";
 
   inherit stdenv;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a+Em4yJUht/yhqj7mgYkalJT9MfFO0depfWsk05kGUw=";
+    hash = "sha256-j6rk8xC22Wn6JsoFRTOLIfc8axXbfEqNk0pUgvqoGPI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/psycopg/ctypes.patch b/pkgs/development/python-modules/psycopg/ctypes.patch
index d2b0842b44b4..b3816d9c8d7c 100644
--- a/pkgs/development/python-modules/psycopg/ctypes.patch
+++ b/pkgs/development/python-modules/psycopg/ctypes.patch
@@ -1,5 +1,5 @@
 diff --git a/psycopg/psycopg/pq/_pq_ctypes.py b/psycopg/psycopg/pq/_pq_ctypes.py
-index 9ca1d129..02929ab6 100644
+index cfc68672..02929ab6 100644
 --- a/psycopg/psycopg/pq/_pq_ctypes.py
 +++ b/psycopg/psycopg/pq/_pq_ctypes.py
 @@ -11,14 +11,10 @@ from ctypes import Structure, CFUNCTYPE, POINTER
@@ -18,12 +18,15 @@ index 9ca1d129..02929ab6 100644
  
  
  class FILE(Structure):
-@@ -28,9 +24,7 @@ class FILE(Structure):
+@@ -28,12 +24,7 @@ class FILE(Structure):
  FILE_ptr = POINTER(FILE)
  
  if sys.platform == "linux":
 -    libcname = ctypes.util.find_library("c")
--    assert libcname
+-    if not libcname:
+-        # Likely this is a system using musl libc, see the following bug:
+-        # https://github.com/python/cpython/issues/65821
+-        libcname = "libc.so"
 -    libc = ctypes.cdll.LoadLibrary(libcname)
 +    libc = ctypes.cdll.LoadLibrary("@libc@")
  
diff --git a/pkgs/development/python-modules/psycopg/default.nix b/pkgs/development/python-modules/psycopg/default.nix
index 36ad3e83d342..c98ee99f154e 100644
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@@ -35,13 +35,13 @@
 
 let
   pname = "psycopg";
-  version = "3.1.17";
+  version = "3.1.19";
 
   src = fetchFromGitHub {
     owner = "psycopg";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Paq4Wkvv6d6+fNcvRO/yfj7OWCMygqccKIdfsohHUMM=";
+    hash = "sha256-Fvg67sGWSNwChZTO5QdLSOKrbGfxzQZJqCjI5Jidcqo=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/psygnal/default.nix b/pkgs/development/python-modules/psygnal/default.nix
index b9cc815f61d5..24ce03dad657 100644
--- a/pkgs/development/python-modules/psygnal/default.nix
+++ b/pkgs/development/python-modules/psygnal/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "psygnal";
-  version = "0.11.0";
+  version = "0.11.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "pyapp-kit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LZkYlqplapV2jD5yV5Co8zhGdHP0dqkIAoIj1AFETbA=";
+    hash = "sha256-eGJWtmw2Ps3jII4T8E6s3djzxfqcSdyPemvejal0cn4=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/ptyprocess/default.nix b/pkgs/development/python-modules/ptyprocess/default.nix
index e707086e259c..0cc11d0910a0 100644
--- a/pkgs/development/python-modules/ptyprocess/default.nix
+++ b/pkgs/development/python-modules/ptyprocess/default.nix
@@ -26,6 +26,10 @@ buildPythonPackage rec {
       url = "https://github.com/pexpect/ptyprocess/commit/40c1ccf3432a6787be1801ced721540e34c6cd87.patch";
       hash = "sha256-IemngBqBq3QRCmVscWtsuXHiFgvTOJIIB9SyAvsqHd0=";
     })
+    (fetchpatch {
+      url = "https://github.com/pexpect/ptyprocess/commit/a44312974bd9084aa568d2e18ce5b2a7e0e45983.patch";
+      hash = "sha256-DEO4FbzKNAXADYocSQhhwjQTGGu9V5pqd38u1sWhpOI=";
+    })
   ];
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/pulsectl/default.nix b/pkgs/development/python-modules/pulsectl/default.nix
index c0cba36a76c9..abdc439fd611 100644
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "pulsectl";
-  version = "23.5.2";
+  version = "24.4.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6RHTmOrwU5zzxjtCFzV7UaPRt+SlBgfRWRzytJ9dLGo=";
+    hash = "sha256-aX7VDn1FLnhniuOOKrk1hDAIvsRIlVKDzQ+zYoZ+MWU=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index 9d1da8ffdf18..8d276960ac2e 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "6.38.0";
+  version = "6.41.0";
 
   pyproject = true;
   build-system = [ setuptools ];
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sV8Gt8EZ1LPzRbnFoVIWjykiFK04UWQAjuF7hAmJBPk=";
+    hash = "sha256-7l+m4ULDGa15QNu6l2kURQznKP2Ut9Y1P9njV7s9nzc=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/pwndbg/default.nix b/pkgs/development/python-modules/pwndbg/default.nix
index 8862184d9cf7..e4b77db14eab 100644
--- a/pkgs/development/python-modules/pwndbg/default.nix
+++ b/pkgs/development/python-modules/pwndbg/default.nix
@@ -19,7 +19,6 @@
   unicorn,
   gdb-pt-dump,
   poetry-core,
-  pythonRelaxDepsHook,
 }:
 let
   # The newest gdb-pt-dump is incompatible with pwndbg 2024.02.14.
@@ -52,7 +51,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
   pythonRelaxDeps = true;
 
diff --git a/pkgs/development/python-modules/py-pdf-parser/default.nix b/pkgs/development/python-modules/py-pdf-parser/default.nix
index 2cc04d82a445..84d2e77d45af 100644
--- a/pkgs/development/python-modules/py-pdf-parser/default.nix
+++ b/pkgs/development/python-modules/py-pdf-parser/default.nix
@@ -5,7 +5,6 @@
   fetchPypi,
   pdfminer-six,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   wand,
 }:
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/py-serializable/default.nix b/pkgs/development/python-modules/py-serializable/default.nix
index dd7b8dd4312d..b0e0f0284cb4 100644
--- a/pkgs/development/python-modules/py-serializable/default.nix
+++ b/pkgs/development/python-modules/py-serializable/default.nix
@@ -26,6 +26,8 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "defusedxml" ];
+
   dependencies = [ defusedxml ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/py-vapid/default.nix b/pkgs/development/python-modules/py-vapid/default.nix
index dd18c14f87ea..5a546643e17e 100644
--- a/pkgs/development/python-modules/py-vapid/default.nix
+++ b/pkgs/development/python-modules/py-vapid/default.nix
@@ -10,14 +10,15 @@
 
 buildPythonPackage rec {
   pname = "py-vapid";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-BmSreJl0LvKyhzl6TUYe9pHtDML1hyBRKNjPYX/9uRk=";
+    pname = "py_vapid";
+    inherit version;
+    hash = "sha256-/itUYb9Fx7r/EDnfaYHwO4f6qHzeBIKt36NbP+Y2rBs=";
   };
 
   propagatedBuildInputs = [ cryptography ];
diff --git a/pkgs/development/python-modules/pyannote-audio/default.nix b/pkgs/development/python-modules/pyannote-audio/default.nix
index 661bf3cd3ff4..9f4510785b0f 100644
--- a/pkgs/development/python-modules/pyannote-audio/default.nix
+++ b/pkgs/development/python-modules/pyannote-audio/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "pyannote-audio";
-  version = "3.1.1";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyannote";
     repo = "pyannote-audio";
-    rev = version;
-    hash = "sha256-BxmEJE6v+QkEaAJ2oB2LwDQIoRajv6F9SRc8lP9iRLM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-AFBT6vpOgEIqEn778TWJ04gai7UOyfOeZdmtliYJLvs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/pyasn1-modules/default.nix b/pkgs/development/python-modules/pyasn1-modules/default.nix
index ed555556f84f..7c7b4b360070 100644
--- a/pkgs/development/python-modules/pyasn1-modules/default.nix
+++ b/pkgs/development/python-modules/pyasn1-modules/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pyasn1,
   pytestCheckHook,
   pythonOlder,
@@ -9,29 +10,31 @@
 
 buildPythonPackage rec {
   pname = "pyasn1-modules";
-  version = "0.3.0";
-  format = "setuptools";
+  version = "0.4.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pyasn1";
-    repo = pname;
+    repo = "pyasn1-modules";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AAS1VuppCIxgswpLSHFAc6q9cyJBLpdDuU9D1KU13vg=";
+    hash = "sha256-UJycVfj08+3zjHPji5Qlh3yqeS30dEwu1pyrN1yo1Vc=";
   };
 
-  propagatedBuildInputs = [ pyasn1 ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pyasn1 ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pyasn1_modules" ];
 
-  meta = with lib; {
+  meta = {
     description = "Collection of ASN.1-based protocols modules";
-    homepage = "https://github.com/pyasn1/pyasn1-modules";
+    homepage = "https://pyasn1.readthedocs.io";
     changelog = "https://github.com/pyasn1/pyasn1-modules/releases/tag/v${version}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 827b797f06fa..77a4b8249d07 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -35,6 +35,8 @@ buildPythonPackage rec {
       --replace "requests~=2.24" "requests"
   '';
 
+  pythonRelaxDeps = [ "requests-oauthlib" ];
+
   nativeBuildInputs = [ setuptools-scm ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyatv/default.nix b/pkgs/development/python-modules/pyatv/default.nix
index 054eec8fe72e..10667bc2f4f2 100644
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -18,7 +18,6 @@
   pytest-httpserver,
   pytest-timeout,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonAtLeast,
   pythonOlder,
   requests,
@@ -64,7 +63,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index d8f1352137e2..cdb7753119bf 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -14,7 +14,6 @@
   sqlalchemy,
   pytestCheckHook,
   versioneer,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     versioneer
   ] ++ versioneer.optional-dependencies.toml;
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 408544f42405..b0b766160712 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
+  fetchpatch2,
   cmake,
   ninja,
   setuptools,
@@ -60,6 +61,14 @@ buildPythonPackage rec {
     hash = "sha256-DVkI5NxM5uME9m3PFYVpJOOa2j+yjL6AJn76fCTv2nE=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/pybind/pybind11/pull/5127
+      url = "https://github.com/pybind/pybind11/commit/540bef2d2c9fb54fa7c1474ee1af959ce90f2b32.patch";
+      hash = "sha256-0ZWlH/5kQ3An/tu6ulOXO2k32asATrr1mlI4nGjIqaI=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "timeout=300" ""
diff --git a/pkgs/development/python-modules/pycardano/default.nix b/pkgs/development/python-modules/pycardano/default.nix
index 010a030693cb..cc1f79c9b2c5 100644
--- a/pkgs/development/python-modules/pycardano/default.nix
+++ b/pkgs/development/python-modules/pycardano/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   # Python deps
   blockfrost-python,
   cachetools,
@@ -45,7 +44,6 @@ buildPythonPackage rec {
     hash = "sha256-LP/W8IC2del476fGFq10VMWwMrbAoCCcZOngA8unBM0=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     blockfrost-python
diff --git a/pkgs/development/python-modules/pycatch22/default.nix b/pkgs/development/python-modules/pycatch22/default.nix
index 0f777bb361af..69b218ec66b0 100644
--- a/pkgs/development/python-modules/pycatch22/default.nix
+++ b/pkgs/development/python-modules/pycatch22/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pycatch22";
-  version = "0.4.4";
+  version = "0.4.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "DynamicsAndNeuralSystems";
     repo = "pycatch22";
     rev = "refs/tags/v${version}";
-    hash = "sha256-l41LLo9k075EL8rV48bwa4Yw12XuqNJSDYtd9kyqS3U=";
+    hash = "sha256-NvZrjOdC6rV4hwCuGcc2Br/VDhLwZcYpfnNvQpqU134=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycddl/default.nix b/pkgs/development/python-modules/pycddl/default.nix
index cd7f27e0f6e6..b1ffac55aad6 100644
--- a/pkgs/development/python-modules/pycddl/default.nix
+++ b/pkgs/development/python-modules/pycddl/default.nix
@@ -7,18 +7,19 @@
   pytestCheckHook,
   psutil,
   cbor2,
+  hypothesis,
 }:
 
 buildPythonPackage rec {
   pname = "pycddl";
-  version = "0.5.2";
+  version = "0.6.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LdecJPSov2Y/QI4MWb20DcF0EtMuDO0VwiQDUeD55GI=";
+    hash = "sha256-63fe8UJXEH6t4l7ujV8JDvlGb7q3kL6fHHATFdklzFc=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -41,14 +42,21 @@ buildPythonPackage rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-FJET2Xb1cq4aePFhPXpp2oEPIOtpugYWNFAa2Dj0F6Y=";
+    hash = "sha256-ssDEKRd3Y9/10oXBZHCxvlRkl9KMh3pGYbCkM4rXThQ=";
   };
 
   nativeCheckInputs = [
+    hypothesis
     pytestCheckHook
     psutil
     cbor2
   ];
+
+  disabledTests =[
+    # flaky
+    "test_memory_usage"
+  ];
+
   pythonImportsCheck = [ "pycddl" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index a2798e8199e6..e16ec8a669ab 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -6,7 +6,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [ pydantic ];
 
diff --git a/pkgs/development/python-modules/pycocotools/default.nix b/pkgs/development/python-modules/pycocotools/default.nix
index ccca116a7f0a..64f64a51fc58 100644
--- a/pkgs/development/python-modules/pycocotools/default.nix
+++ b/pkgs/development/python-modules/pycocotools/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pycocotools";
-  version = "2.0.7";
+  version = "2.0.8";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2ot4FRlu6/Ctq/Z/zEWRJsvGSYu8arH9FEw3FGXYaHk=";
+    hash = "sha256-jyvO23hromw2ejaA+cTrWyrZ3MsrNOrrIF4KAh4d+40=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pycodestyle/default.nix b/pkgs/development/python-modules/pycodestyle/default.nix
index 519d14215578..9c6133207a3c 100644
--- a/pkgs/development/python-modules/pycodestyle/default.nix
+++ b/pkgs/development/python-modules/pycodestyle/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pycodestyle";
-  version = "2.11.1";
+  version = "2.12.0";
 
   disabled = pythonOlder "3.6";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QboOevyXUt+1PO1UieifgYa+AOWZ5xJmBpW3p1/yZj8=";
+    hash = "sha256-RC+VAUG09D33Ut0wNRH/3tOgTCtvt/ZZgFdPDDHm55w=";
   };
 
   pythonImportsCheck = [ "pycodestyle" ];
diff --git a/pkgs/development/python-modules/pycookiecheat/default.nix b/pkgs/development/python-modules/pycookiecheat/default.nix
index 3a1c3efdf3cd..c90aee856a3c 100644
--- a/pkgs/development/python-modules/pycookiecheat/default.nix
+++ b/pkgs/development/python-modules/pycookiecheat/default.nix
@@ -7,7 +7,6 @@
   keyring,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   playwright,
   setuptools,
   setuptools-scm,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     cryptography
diff --git a/pkgs/development/python-modules/pydantic-core/default.nix b/pkgs/development/python-modules/pydantic-core/default.nix
index cc9854b46853..b0a84ed3fbdb 100644
--- a/pkgs/development/python-modules/pydantic-core/default.nix
+++ b/pkgs/development/python-modules/pydantic-core/default.nix
@@ -18,14 +18,14 @@
 let
   pydantic-core = buildPythonPackage rec {
     pname = "pydantic-core";
-    version = "2.16.3";
+    version = "2.18.4";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "pydantic";
       repo = "pydantic-core";
       rev = "refs/tags/v${version}";
-      hash = "sha256-RXytujvx/23Z24TWpvnHdjJ4/dXqjs5uiavUmukaD9A=";
+      hash = "sha256-wt6HG2jQU09Zxhxhzb49HvNnxahfSk2xvNApVZkqqbw=";
     };
 
     patches = [ ./01-remove-benchmark-flags.patch ];
@@ -33,7 +33,7 @@ let
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${pname}-${version}";
-      hash = "sha256-wj9u6s/3E3EWfQydkLrwHbJBvm8DwcGCoQQpSw1+q7U=";
+      hash = "sha256-m0xP4fIFgInkUeAy4HqfTKHEiqmWpYO8CgKzxg+WXiU=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pydantic-extra-types/default.nix b/pkgs/development/python-modules/pydantic-extra-types/default.nix
index 0a9970552c81..6a9cfaaeb29f 100644
--- a/pkgs/development/python-modules/pydantic-extra-types/default.nix
+++ b/pkgs/development/python-modules/pydantic-extra-types/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pydantic-extra-types";
-  version = "2.6.0";
+  version = "2.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-extra-types";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XLVhoZ3+TfVYEuk/5fORaGpCBaB5NcuskWhHgt+llS0=";
+    hash = "sha256-YNr3eKwlPmLpYp0Z4WAOmWNMjta22ZZMuSlONkONxZU=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/pydantic-settings/default.nix b/pkgs/development/python-modules/pydantic-settings/default.nix
index 15685c8c66bc..2d158699724a 100644
--- a/pkgs/development/python-modules/pydantic-settings/default.nix
+++ b/pkgs/development/python-modules/pydantic-settings/default.nix
@@ -14,7 +14,7 @@
 let
   self = buildPythonPackage rec {
     pname = "pydantic-settings";
-    version = "2.2.1";
+    version = "2.3.2";
     pyproject = true;
 
     disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ let
       owner = "pydantic";
       repo = "pydantic-settings";
       rev = "refs/tags/v${version}";
-      hash = "sha256-4o8LlIFVizoxb484lVT67e24jhtUl49otr1lX/2zZ4M=";
+      hash = "sha256-1wnTAoF9xi1xLgSWl0FhtIddWPpHgDJPxJlsctJvFQo=";
     };
 
     nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index e9d181b65789..f47c028ac54c 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "2.6.3";
+  version = "2.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,18 +38,9 @@ buildPythonPackage rec {
     owner = "pydantic";
     repo = "pydantic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-neTdG/IcXopCmevzFY5/XDlhPHmOb6dhyAnzaobmeG8=";
+    hash = "sha256-S4FZUnOsKC8J0xyTeXhMmCACCma+VfCSmrE6sYAnpok=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/pydantic/pydantic/pull/8678
-      name = "fix-pytest8-compatibility.patch";
-      url = "https://github.com/pydantic/pydantic/commit/825a6920e177a3b65836c13c7f37d82b810ce482.patch";
-      hash = "sha256-Dap5DtDzHw0jS/QUo5CRI9sLDJ719GRyC4ZNDWEdzus=";
-    })
-  ];
-
   buildInputs = lib.optionals (pythonOlder "3.9") [ libxcrypt ];
 
   build-system = [
@@ -81,10 +72,10 @@ buildPythonPackage rec {
   preCheck = ''
     export HOME=$(mktemp -d)
     substituteInPlace pyproject.toml \
-      --replace "'--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations'," "" \
-      --replace "'--benchmark-group-by', 'group'," "" \
-      --replace "'--benchmark-warmup', 'on'," "" \
-      --replace "'--benchmark-disable'," ""
+      --replace-fail "'--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations'," "" \
+      --replace-fail "'--benchmark-group-by', 'group'," "" \
+      --replace-fail "'--benchmark-warmup', 'on'," "" \
+      --replace-fail "'--benchmark-disable'," ""
   '';
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/pydevd/default.nix b/pkgs/development/python-modules/pydevd/default.nix
index 840784222544..8cb99dd9806f 100644
--- a/pkgs/development/python-modules/pydevd/default.nix
+++ b/pkgs/development/python-modules/pydevd/default.nix
@@ -6,6 +6,7 @@
   setuptools,
   numpy,
   psutil,
+  pytest-xdist,
   pytestCheckHook,
   pythonAtLeast,
   pythonOlder,
@@ -34,6 +35,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     numpy
     psutil
+    pytest-xdist
     pytestCheckHook
     trio
     untangle
@@ -66,6 +68,9 @@ buildPythonPackage rec {
       "test_case_stop_async_iteration_exception"
       "test_case_unhandled_exception_generator"
       "test_function_breakpoints_async"
+      # raise segmentation fault
+      # https://github.com/fabioz/PyDev.Debugger/issues/269
+      "test_evaluate_expression"
     ]
     ++ lib.optionals stdenv.isDarwin [
       "test_multiprocessing_simple"
diff --git a/pkgs/development/python-modules/pydicom-seg/default.nix b/pkgs/development/python-modules/pydicom-seg/default.nix
index ecab789fa2a9..9f06d7b44dd0 100644
--- a/pkgs/development/python-modules/pydicom-seg/default.nix
+++ b/pkgs/development/python-modules/pydicom-seg/default.nix
@@ -5,7 +5,6 @@
   fetchpatch,
   pythonOlder,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   poetry-core,
   jsonschema,
   numpy,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydiscovergy/default.nix b/pkgs/development/python-modules/pydiscovergy/default.nix
index 44f9cfc7c259..919eec4fae1f 100644
--- a/pkgs/development/python-modules/pydiscovergy/default.nix
+++ b/pkgs/development/python-modules/pydiscovergy/default.nix
@@ -11,7 +11,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   respx,
 }:
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     authlib
diff --git a/pkgs/development/python-modules/pydyf/default.nix b/pkgs/development/python-modules/pydyf/default.nix
index 218a3f35f847..d39f36b39e9e 100644
--- a/pkgs/development/python-modules/pydyf/default.nix
+++ b/pkgs/development/python-modules/pydyf/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pydyf";
-  version = "0.9.0";
+  version = "0.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1bJE6PwkEZznvV1R6i1nc8D/iKqBWX21VrxEDGuIBhA=";
+    hash = "sha256-NXGUWT769h17SKuXw9WXIhFJNJZ8PfPXh4ym3SWwTDA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyecoforest/default.nix b/pkgs/development/python-modules/pyecoforest/default.nix
index de968de3cef6..b0c69a520ade 100644
--- a/pkgs/development/python-modules/pyecoforest/default.nix
+++ b/pkgs/development/python-modules/pyecoforest/default.nix
@@ -39,6 +39,15 @@ buildPythonPackage rec {
     respx
   ];
 
+  disabledTests = [
+    # respx.models.AllMockedAssertionError
+    "test_get"
+    "test_get_errors"
+    "test_set_temperature"
+    "test_set_power"
+    "test_turn"
+  ];
+
   pythonImportsCheck = [ "pyecoforest" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyefergy/default.nix b/pkgs/development/python-modules/pyefergy/default.nix
index 2370bd7e6278..47e4e41e624f 100644
--- a/pkgs/development/python-modules/pyefergy/default.nix
+++ b/pkgs/development/python-modules/pyefergy/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   poetry-core,
   poetry-dynamic-versioning,
-  pythonRelaxDepsHook,
   iso4217,
   pythonOlder,
   pytz,
@@ -28,7 +27,6 @@ buildPythonPackage rec {
   build-system = [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/pyfakefs/default.nix b/pkgs/development/python-modules/pyfakefs/default.nix
index 8e49354362a1..ff29175870ab 100644
--- a/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/pkgs/development/python-modules/pyfakefs/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pyfakefs";
-  version = "5.4.1";
+  version = "5.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IMtR6GDC8/+DhZFirVE0u4sKHnqB3woYz8zEhi0Nncw=";
+    hash = "sha256-dEiqoHFC+JLQpOtSpe0yBqnwLGWZ5obNl9YkwYl5wVQ=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/pyfritzhome/default.nix b/pkgs/development/python-modules/pyfritzhome/default.nix
index 72731b0d1a31..865bf8832fa9 100644
--- a/pkgs/development/python-modules/pyfritzhome/default.nix
+++ b/pkgs/development/python-modules/pyfritzhome/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyfritzhome";
-  version = "0.6.11";
+  version = "0.6.12";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "hthiery";
     repo = "python-fritzhome";
     rev = "refs/tags/${version}";
-    hash = "sha256-YzrRkFa4J3NXdc4W5CHrHvqSVJ8yBGtaf6gRqmiY7gI=";
+    hash = "sha256-L+9CjSXJrPmlLif1SYfJr6C76IufUzj9FHSGQO78Vsw=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyftgl/default.nix b/pkgs/development/python-modules/pyftgl/default.nix
index b286b3e4c88a..4dd6aa9b6dd6 100644
--- a/pkgs/development/python-modules/pyftgl/default.nix
+++ b/pkgs/development/python-modules/pyftgl/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  stdenv,
   boost,
   freetype,
   ftgl,
@@ -31,6 +32,10 @@ buildPythonPackage rec {
     sed -i "s,'boost_python','boost_python${pythonVersion}',g" setup.py
   '';
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_COMPILE = "-L${libGL}/Library/Frameworks/OpenGL.framework/Versions/Current/Libraries";
+  };
+
   buildInputs = [
     boost
     freetype
diff --git a/pkgs/development/python-modules/pyfume/default.nix b/pkgs/development/python-modules/pyfume/default.nix
index 1dd97fef2536..b79bf238d48c 100644
--- a/pkgs/development/python-modules/pyfume/default.nix
+++ b/pkgs/development/python-modules/pyfume/default.nix
@@ -14,19 +14,24 @@
 
 buildPythonPackage rec {
   pname = "pyfume";
-  version = "0.3.1";
+  version = "0.3.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    pname = "pyFUME";
-    inherit version;
-    hash = "sha256-8J9qhSaTlb/KiCjegmc8iaGaZOXJ0Pk1EquOTEUUtW0=";
+    inherit pname version;
+    hash = "sha256-UwW5OwFfu01lDKwz72iB2egbOoxb+t8UnEFIUjZmffU=";
   };
 
   nativeBuildInputs = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "numpy"
+    "pandas"
+    "scipy"
+  ];
+
   propagatedBuildInputs = [
     fst-pso
     numpy
diff --git a/pkgs/development/python-modules/pygitguardian/default.nix b/pkgs/development/python-modules/pygitguardian/default.nix
index ccc9d2726d31..715c455c3cab 100644
--- a/pkgs/development/python-modules/pygitguardian/default.nix
+++ b/pkgs/development/python-modules/pygitguardian/default.nix
@@ -7,7 +7,6 @@
   pdm-backend,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   responses,
   setuptools,
@@ -38,10 +37,6 @@ buildPythonPackage rec {
     pdm-backend
   ];
 
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
-
   dependencies = [
     marshmallow
     marshmallow-dataclass
diff --git a/pkgs/development/python-modules/pygls/default.nix b/pkgs/development/python-modules/pygls/default.nix
index 49cf9dab4a26..c75cf68715ed 100644
--- a/pkgs/development/python-modules/pygls/default.nix
+++ b/pkgs/development/python-modules/pygls/default.nix
@@ -8,7 +8,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   typeguard,
   websockets,
 }:
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pygments/default.nix b/pkgs/development/python-modules/pygments/default.nix
index 82c0b2ec326e..ff8569b9b8eb 100644
--- a/pkgs/development/python-modules/pygments/default.nix
+++ b/pkgs/development/python-modules/pygments/default.nix
@@ -9,17 +9,20 @@
   # tests
   pytestCheckHook,
   wcag-contrast-ratio,
+  pythonOlder
 }:
 
 let
   pygments = buildPythonPackage rec {
     pname = "pygments";
-    version = "2.17.2";
+    version = "2.18.0";
     pyproject = true;
 
+    disabled = pythonOlder "3.8"; # 2.18.0 requirement
+
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-2kbOyf0t5b46inhPQ05MSrZwtP9U1gXEwnF+nUnEw2c=";
+      hash = "sha256-eG/4AvMukTEb/ziJ9umoboFQX+mfJzW7bWCuDFAE8Zk=";
     };
 
     nativeBuildInputs = [ hatchling ];
@@ -51,7 +54,7 @@ let
       description = "Generic syntax highlighter";
       mainProgram = "pygmentize";
       license = licenses.bsd2;
-      maintainers = with maintainers; [ ];
+      maintainers = with maintainers; [ sigmanificient ];
     };
   };
 in
diff --git a/pkgs/development/python-modules/pyicu/default.nix b/pkgs/development/python-modules/pyicu/default.nix
index 51461e392bce..8dd0fb09c740 100644
--- a/pkgs/development/python-modules/pyicu/default.nix
+++ b/pkgs/development/python-modules/pyicu/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "pyicu";
-  version = "2.12";
+  version = "2.13.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "PyICU";
     inherit version;
-    hash = "sha256-vXq176k61pLm2qKc0kk2TlISGDKSIXJqETyjyygchhE=";
+    hash = "sha256-1JGQheqgfaErrejuch57v3reAVHKD4KUaibI9LmM3Os=";
   };
 
   nativeBuildInputs = [ icu ]; # for icu-config, but should be replaced with pkg-config
diff --git a/pkgs/development/python-modules/pykoplenti/default.nix b/pkgs/development/python-modules/pykoplenti/default.nix
index e6ccb9bcbf2f..a4f605692c5f 100644
--- a/pkgs/development/python-modules/pykoplenti/default.nix
+++ b/pkgs/development/python-modules/pykoplenti/default.nix
@@ -8,7 +8,6 @@
   pycryptodome,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -29,7 +28,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pydantic" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 99f2ce5cf72a..01491a2a619a 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "pylint";
-  version = "3.1.1";
+  version = "3.2.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "pylint-dev";
     repo = "pylint";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LmpLt2GCzYU73BUpORHaFbGqkxyYqoPoKZpUJSChqKQ=";
+    hash = "sha256-J+68YwjVhaMPlvLCMI/BdnUCQPDYU9u0pIvOYlbzWvs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pylitterbot/default.nix b/pkgs/development/python-modules/pylitterbot/default.nix
index add82ecc2d15..dcd863d08bfc 100644
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -28,6 +28,8 @@ buildPythonPackage rec {
     hash = "sha256-MSQdX2PKQohmPGqtRZnUmCCVgKgaf4+cHAUItiPv7pY=";
   };
 
+  pythonRelaxDeps = [ "deepdiff" ];
+
   build-system = [
     poetry-core
     poetry-dynamic-versioning
diff --git a/pkgs/development/python-modules/pylxd/default.nix b/pkgs/development/python-modules/pylxd/default.nix
index 3c737f504123..048822ad976e 100644
--- a/pkgs/development/python-modules/pylxd/default.nix
+++ b/pkgs/development/python-modules/pylxd/default.nix
@@ -10,7 +10,6 @@
   pythonOlder,
   requests,
   urllib3,
-  pythonRelaxDepsHook,
   requests-toolbelt,
   requests-unixsocket,
   setuptools,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "urllib3" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/pymdown-extensions/default.nix b/pkgs/development/python-modules/pymdown-extensions/default.nix
index 472a9c334c3a..627d5ad562dc 100644
--- a/pkgs/development/python-modules/pymdown-extensions/default.nix
+++ b/pkgs/development/python-modules/pymdown-extensions/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
   hatchling,
   pytestCheckHook,
   markdown,
@@ -45,19 +46,27 @@ let
 in
 buildPythonPackage rec {
   pname = "pymdown-extensions";
-  version = "10.7.1";
-  format = "pyproject";
+  version = "10.8.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = "pymdown-extensions";
     rev = "refs/tags/${version}";
-    hash = "sha256-P2MkGD0B9mn34ia3Kd4MQej1XryNVXWVMF4JHaPTS0M=";
+    hash = "sha256-No0RDBgr40xSOiKXQRLRZnMdV+5i4eM8Jwp7c2Jw/ZY=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  patches = [
+    (fetchpatch2 {
+      name = "pymdown-extensions-pygments-compat.patch";
+      url = "https://github.com/facelessuser/pymdown-extensions/commit/f1e2fad862c9738e420b8451dfdfbd9e90e849fc.patch";
+      hash = "sha256-ENYTRXBJ76VPhhab8MdOh+bkcQNRklXT3thvPi+gHIY=";
+    })
+  ];
+
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     markdown
     pygments
   ];
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index 3a498ee4ffa2..c9f706ca4a95 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -12,7 +12,6 @@
   pyarrow,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   scikit-learn,
   setuptools-scm,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gitpython
-    pythonRelaxDepsHook
     setuptools-scm
     wheel
   ];
diff --git a/pkgs/development/python-modules/pymongo/default.nix b/pkgs/development/python-modules/pymongo/default.nix
index 1ba5c2a225db..0f504b00cd75 100644
--- a/pkgs/development/python-modules/pymongo/default.nix
+++ b/pkgs/development/python-modules/pymongo/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pymongo";
-  version = "4.6.3";
+  version = "4.7.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QAB0CQuaYx8SC0LGGyIv10NJDBM6XS+ZwCCM78zMlk4=";
+    hash = "sha256-Y1SmayKPLNOZvnQpaF+2jgfxkRCjZ5eC7LT9to2gODE=";
   };
 
   propagatedBuildInputs = [ dnspython ];
diff --git a/pkgs/development/python-modules/pymysql/default.nix b/pkgs/development/python-modules/pymysql/default.nix
index 7e9fdcfeb48b..be019c73f185 100644
--- a/pkgs/development/python-modules/pymysql/default.nix
+++ b/pkgs/development/python-modules/pymysql/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "pymysql";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchPypi {
-    pname = "PyMySQL";
+    pname = "pymysql";
     inherit version;
-    hash = "sha256-TxOn34vzalHoHdnzYF/t5FpIeP4C+SNjSf2Co/BhL5Y=";
+    hash = "sha256-4SdhGq8rQXQDxgv03FcBJK60pX9fN7jpWuOZpC+QTNA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyngo/default.nix b/pkgs/development/python-modules/pyngo/default.nix
index f580b50b01c1..0f6c85d993c8 100644
--- a/pkgs/development/python-modules/pyngo/default.nix
+++ b/pkgs/development/python-modules/pyngo/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build-system
   hatchling,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pynitrokey/default.nix b/pkgs/development/python-modules/pynitrokey/default.nix
index 900198cb425a..2e40250adb4b 100644
--- a/pkgs/development/python-modules/pynitrokey/default.nix
+++ b/pkgs/development/python-modules/pynitrokey/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   installShellFiles,
   libnitrokey,
   flit-core,
@@ -71,7 +70,6 @@ buildPythonPackage {
   nativeBuildInputs = [
     flit-core
     installShellFiles
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/pynndescent/default.nix b/pkgs/development/python-modules/pynndescent/default.nix
index 6b2c088209cb..00a3e513ea67 100644
--- a/pkgs/development/python-modules/pynndescent/default.nix
+++ b/pkgs/development/python-modules/pynndescent/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pynndescent";
-  version = "0.5.12";
+  version = "0.5.13";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BzYpH8u+39Xgo6KA9xpj+Osvi9lnDUwLUawbTQga33A=";
+    hash = "sha256-10JUwO4KHu7IRZfV/on+3Pd4WT7qvjLC+XQSk0qYAPs=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index ffce3a97b0c6..0f9e4808cb97 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -1,13 +1,22 @@
 {
   lib,
   stdenv,
-  fetchPypi,
+  fetchFromGitHub,
   buildPythonPackage,
+
+  # build-system
+  cmake,
+  scikit-build-core,
+  pathspec,
+  ninja,
+  nanobind,
+
+  # dependencies
   appdirs,
   cffi,
+  darwin,
   decorator,
   mako,
-  mesa_drivers,
   numpy,
   ocl-icd,
   oldest-supported-numpy,
@@ -16,30 +25,36 @@
   pybind11,
   pytestCheckHook,
   pytools,
-  setuptools,
   six,
-  wheel,
 }:
 
 let
-  os-specific-buildInputs = if stdenv.isDarwin then [ mesa_drivers.dev ] else [ ocl-icd ];
+  os-specific-buildInputs = if stdenv.isDarwin then [ darwin.apple_sdk.frameworks.OpenCL ] else [ ocl-icd ];
 in
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2024.1";
+  version = "2024.2.6";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-7NVy7pQK2L2hY5w6e+tog0/JqYrX6z9uAarE99nUusE=";
+  src = fetchFromGitHub {
+    owner = "inducer";
+    repo = "pyopencl";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nP7ZAGeRXrjqDRWlc2SDP1hk1fseGeu9Zx0lOp9Pchs=";
   };
 
   nativeBuildInputs = [
+    cmake
+    nanobind
+    ninja
+    numpy
     oldest-supported-numpy
-    setuptools
-    wheel
+    pathspec
+    scikit-build-core
   ];
 
+  dontUseCmakeConfigure = true;
+
   buildInputs = [
     opencl-headers
     pybind11
@@ -60,6 +75,7 @@ buildPythonPackage rec {
 
   preBuild = ''
     export HOME=$(mktemp -d)
+    rm -rf pyopencl
   '';
 
   # gcc: error: pygpu_language_opencl.cpp: No such file or directory
diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index 78cc507e42d8..9c8af0ac924a 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
         --replace '"GL",' '"${pkgs.libGL}/lib/libGL${ext}",' \
         --replace '"GLU",' '"${pkgs.libGLU}/lib/libGLU${ext}",' \
         --replace '"GLX",' '"${pkgs.libglvnd}/lib/libGLX${ext}",' \
-        --replace '"glut",' '"${pkgs.freeglut}/lib/libglut${ext}",' \
+        --replace '"glut",' '"${pkgs.libglut}/lib/libglut${ext}",' \
         --replace '"GLESv1_CM",' '"${pkgs.libGL}/lib/libGLESv1_CM${ext}",' \
         --replace '"GLESv2",' '"${pkgs.libGL}/lib/libGLESv2${ext}",' \
         --replace '"gle",' '"${pkgs.gle}/lib/libgle${ext}",' \
@@ -40,14 +40,14 @@ buildPythonPackage rec {
       substituteInPlace OpenGL/platform/egl.py \
         --replace "('OpenGL','GL')" "('${pkgs.libGL}/lib/libOpenGL${ext}', '${pkgs.libGL}/lib/libGL${ext}')" \
         --replace "'GLU'," "'${pkgs.libGLU}/lib/libGLU${ext}'," \
-        --replace "'glut'," "'${pkgs.freeglut}/lib/libglut${ext}'," \
+        --replace "'glut'," "'${pkgs.libglut}/lib/libglut${ext}'," \
         --replace "'GLESv1_CM'," "'${pkgs.libGL}/lib/libGLESv1_CM${ext}'," \
         --replace "'GLESv2'," "'${pkgs.libGL}/lib/libGLESv2${ext}'," \
         --replace "'gle'," '"${pkgs.gle}/lib/libgle${ext}",' \
         --replace "'EGL'," "'${pkgs.libGL}/lib/libEGL${ext}',"
       substituteInPlace OpenGL/platform/darwin.py \
         --replace "'OpenGL'," "'${pkgs.libGL}/lib/libGL${ext}'," \
-        --replace "'GLUT'," "'${pkgs.freeglut}/lib/libglut${ext}',"
+        --replace "'GLUT'," "'${pkgs.libglut}/lib/libglut${ext}',"
     ''
     + ''
       # https://github.com/NixOS/nixpkgs/issues/76822
diff --git a/pkgs/development/python-modules/pyowm/default.nix b/pkgs/development/python-modules/pyowm/default.nix
index d342ce313e8c..78d8e05301e4 100644
--- a/pkgs/development/python-modules/pyowm/default.nix
+++ b/pkgs/development/python-modules/pyowm/default.nix
@@ -8,7 +8,6 @@
   requests,
   setuptools,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     geojson
diff --git a/pkgs/development/python-modules/pyperclip/default.nix b/pkgs/development/python-modules/pyperclip/default.nix
index 22c2af63e439..2354927ec2d7 100644
--- a/pkgs/development/python-modules/pyperclip/default.nix
+++ b/pkgs/development/python-modules/pyperclip/default.nix
@@ -2,22 +2,24 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  stdenv,
   python,
+  setuptools,
 }:
 
 buildPythonPackage rec {
-  version = "1.8.2";
-  format = "setuptools";
+  version = "1.9.0";
   pname = "pyperclip";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "105254a8b04934f0bc84e9c24eb360a591aaf6535c9def5f29d92af107a9bf57";
+    hash = "sha256-t94BQt3IG/xcdQfuoZ2pILkiUrVIuWGGyvlKXiUn0xA=";
   };
 
-  # No such file or directory: 'pbcopy'
-  doCheck = !stdenv.isDarwin;
+  build-system = [ setuptools ];
+
+  # https://github.com/asweigart/pyperclip/issues/263
+  doCheck = false;
 
   checkPhase = ''
     ${python.interpreter} tests/test_pyperclip.py
diff --git a/pkgs/development/python-modules/pyqt-builder/default.nix b/pkgs/development/python-modules/pyqt-builder/default.nix
index ef380a7b872f..ef00791037b3 100644
--- a/pkgs/development/python-modules/pyqt-builder/default.nix
+++ b/pkgs/development/python-modules/pyqt-builder/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "pyqt-builder";
-  version = "1.16.0";
+  version = "1.16.2";
   format = "pyproject";
 
   src = fetchPypi {
-    pname = "PyQt-builder";
+    pname = "pyqt_builder";
     inherit version;
-    hash = "sha256-R7vSz6VDACAQj59AMB4WbL6pi27z5TlTNQvdTGsxqxg=";
+    hash = "sha256-v3I823zSPSUS4qzae8a4HwD7BczF6aiEa9NNR1FM3bk=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "PEP 517 compliant build system for PyQt";
-    homepage = "https://pypi.org/project/PyQt-builder/";
+    homepage = "https://github.com/Python-PyQt/PyQt-builder";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ nrdxp ];
   };
diff --git a/pkgs/development/python-modules/pyquil/default.nix b/pkgs/development/python-modules/pyquil/default.nix
index 77f2f3df334e..612e78239c2e 100644
--- a/pkgs/development/python-modules/pyquil/default.nix
+++ b/pkgs/development/python-modules/pyquil/default.nix
@@ -15,7 +15,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   qcs-sdk-python,
   respx,
   rpcq,
@@ -51,7 +50,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     deprecated
diff --git a/pkgs/development/python-modules/pyreaderwriterlock/default.nix b/pkgs/development/python-modules/pyreaderwriterlock/default.nix
index 7decdf8fda39..91a5d2934916 100644
--- a/pkgs/development/python-modules/pyreaderwriterlock/default.nix
+++ b/pkgs/development/python-modules/pyreaderwriterlock/default.nix
@@ -4,17 +4,20 @@
   buildPythonPackage,
   pythonOlder,
 
-  # propagates
+  # build-system
+  setuptools,
+
+  # dependencies
   typing-extensions,
 
   # tests
-  unittestCheckHook,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "pyreaderwriterlock";
   version = "1.0.9";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -25,9 +28,11 @@ buildPythonPackage rec {
     hash = "sha256-8FC+4aDgGpF1BmOdlkFtMy7OfWdSmvn9fjKXSmmeJlg=";
   };
 
-  propagatedBuildInputs = [ typing-extensions ];
+  build-system = [ setuptools ];
+
+  dependencies = [ typing-extensions ];
 
-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "readerwriterlock" ];
 
diff --git a/pkgs/development/python-modules/pyrisco/default.nix b/pkgs/development/python-modules/pyrisco/default.nix
index f01ff7b0f2e4..faec26a7fe31 100644
--- a/pkgs/development/python-modules/pyrisco/default.nix
+++ b/pkgs/development/python-modules/pyrisco/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyrisco";
-  version = "0.6.3";
+  version = "0.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "OnFreund";
     repo = "pyrisco";
     rev = "refs/tags/v${version}";
-    hash = "sha256-E/KVQSoyJWJJ+UFtu3SzJDfXu2cj7A0puYgcUxrHKRo=";
+    hash = "sha256-Xd6m7P/9ZB0tY6io59kCr8n4H8PXMO3nyMRmm8rpgJs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyro-ppl/default.nix b/pkgs/development/python-modules/pyro-ppl/default.nix
index 0c1d05fa284c..94d2c640d97e 100644
--- a/pkgs/development/python-modules/pyro-ppl/default.nix
+++ b/pkgs/development/python-modules/pyro-ppl/default.nix
@@ -1,20 +1,22 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   graphviz,
-  jupyter,
+  ipywidgets,
   matplotlib,
-  networkx,
+  notebook,
+  numpy,
   opt-einsum,
   pandas,
   pillow,
   pyro-api,
   pythonOlder,
-  torch,
   scikit-learn,
+  scipy,
   seaborn,
   setuptools,
+  torch,
   torchvision,
   tqdm,
   wget,
@@ -22,37 +24,40 @@
 
 buildPythonPackage rec {
   pname = "pyro-ppl";
-  version = "1.9.0";
+  version = "1.9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit version pname;
-    hash = "sha256-QfTABRWVaCgPvFEWSJYKmKKxpBACfYvQpDIgrJsQLN8=";
+  src = fetchFromGitHub {
+    owner = "pyro-ppl";
+    repo = "pyro";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Dvbl/80EGoGWGhWYVIf/xjovUJG1+3WtpMH+lx1oB2E=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
+    numpy
+    opt-einsum
     pyro-api
     torch
-    networkx
-    opt-einsum
     tqdm
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     extras = [
+      notebook
+      ipywidgets
       graphviz
-      jupyter
-      # lap
       matplotlib
+      torchvision
       pandas
       pillow
       scikit-learn
       seaborn
-      torchvision
+      scipy
       # visdom
       wget
     ];
diff --git a/pkgs/development/python-modules/pysaml2/default.nix b/pkgs/development/python-modules/pysaml2/default.nix
index 91fda24bfef6..957394ad5fa3 100644
--- a/pkgs/development/python-modules/pysaml2/default.nix
+++ b/pkgs/development/python-modules/pysaml2/default.nix
@@ -12,7 +12,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   repoze-who,
   requests,
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pysequoia/default.nix b/pkgs/development/python-modules/pysequoia/default.nix
index f0fe36b94d03..3fb8236f9b71 100644
--- a/pkgs/development/python-modules/pysequoia/default.nix
+++ b/pkgs/development/python-modules/pysequoia/default.nix
@@ -17,18 +17,18 @@
 
 buildPythonPackage rec {
   pname = "pysequoia";
-  version = "0.1.20";
+  version = "0.1.24";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KavsLp17e4ckX11B0pefiQ1Hma/O9x0VY/uVPiJm4Fs=";
+    hash = "sha256-sLGPVyUVh1MxAJz8933xGAxaI9+0L/D6wViy5ARLe44=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-7Lw6gR6o2HJ/zyG4b0wz4nmU2AIIAhyK9zaQ6w+/RgE=";
+    hash = "sha256-DLMAL1pJwJ5xU9XzJXlrqfNGloK9VNGxnapnh34bRhI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
index 3e995ca11f8a..b062ff435606 100644
--- a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
@@ -6,7 +6,6 @@
   pysigma,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [ pysigma ];
diff --git a/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix b/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
index 5716a6ebd79e..2e2249fd9c54 100644
--- a/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
@@ -7,7 +7,6 @@
   pysigma-backend-elasticsearch,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     pysigma
diff --git a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
index 9c2976ed46f4..d0ec8be3b48e 100644
--- a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
@@ -7,7 +7,6 @@
   pysigma-pipeline-sysmon,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [ pysigma ];
diff --git a/pkgs/development/python-modules/pysigma/default.nix b/pkgs/development/python-modules/pysigma/default.nix
index 6fbb4b8b93ed..3ccbefb250e3 100644
--- a/pkgs/development/python-modules/pysigma/default.nix
+++ b/pkgs/development/python-modules/pysigma/default.nix
@@ -8,7 +8,6 @@
   pyparsing,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
 }:
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     jinja2
diff --git a/pkgs/development/python-modules/pysilero-vad/default.nix b/pkgs/development/python-modules/pysilero-vad/default.nix
index 19cd2e70ed6a..7d2b44a61ec2 100644
--- a/pkgs/development/python-modules/pysilero-vad/default.nix
+++ b/pkgs/development/python-modules/pysilero-vad/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   stdenv,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "numpy" ];
diff --git a/pkgs/development/python-modules/pysimplegui/default.nix b/pkgs/development/python-modules/pysimplegui/default.nix
index b67d44e86c39..ac2d7482496a 100644
--- a/pkgs/development/python-modules/pysimplegui/default.nix
+++ b/pkgs/development/python-modules/pysimplegui/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pysimplegui";
-  version = "5.0.4";
+  version = "5.0.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PySimpleGUI";
     inherit version;
-    hash = "sha256-pThG6BBWxy98REUae91yBZDKK8Q1Zc1PHpoW7nhdmAw=";
+    hash = "sha256-4B2LgWmdXAU9ACSR0F26Q9+eP3izRI+p6QS/o9m6Hfk=";
   };
 
   propagatedBuildInputs = [ tkinter ];
diff --git a/pkgs/development/python-modules/pysolcast/default.nix b/pkgs/development/python-modules/pysolcast/default.nix
index cb5c822820b1..395130f01636 100644
--- a/pkgs/development/python-modules/pysolcast/default.nix
+++ b/pkgs/development/python-modules/pysolcast/default.nix
@@ -10,7 +10,6 @@
   requests,
   responses,
   poetry-core,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     anyconfig
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index 88aa722c89b8..0eb36db86388 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -34,6 +34,8 @@ buildPythonPackage rec {
     hash = "sha256-uLZ1TQx5awHOOF+IR3aWTwwYTd71O/V+EHaDrb1LAXU=";
   };
 
+  pythonRelaxDeps = [ "defusedxml" ];
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/pytest-astropy/default.nix b/pkgs/development/python-modules/pytest-astropy/default.nix
index d0acc179479b..b2771d70c495 100644
--- a/pkgs/development/python-modules/pytest-astropy/default.nix
+++ b/pkgs/development/python-modules/pytest-astropy/default.nix
@@ -11,7 +11,6 @@
   pytest-doctestplus,
   pytest-filter-subpackage,
   pytest-mock,
-  pytest-openfiles,
   pytest-remotedata,
   setuptools,
   setuptools-scm,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
     pytest-doctestplus
     pytest-filter-subpackage
     pytest-mock
-    pytest-openfiles
     pytest-remotedata
   ];
 
diff --git a/pkgs/development/python-modules/pytest-cov/default.nix b/pkgs/development/python-modules/pytest-cov/default.nix
index 15158fe0e0e8..07f162465f9e 100644
--- a/pkgs/development/python-modules/pytest-cov/default.nix
+++ b/pkgs/development/python-modules/pytest-cov/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-cov";
-  version = "4.1.0";
+  version = "5.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OQSxPfv+xH8AO453/VtYnNEZBKId3xqzimTyBNahDvY=";
+    hash = "sha256-WDe1jp9uvTNbD4Bg7szmm2YkFbFtxQOIOgL0Xf6xSFc=";
   };
 
   buildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pytest-cram/default.nix b/pkgs/development/python-modules/pytest-cram/default.nix
index 8cc38ccc15bc..674566e2301e 100644
--- a/pkgs/development/python-modules/pytest-cram/default.nix
+++ b/pkgs/development/python-modules/pytest-cram/default.nix
@@ -2,18 +2,20 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pytest,
+  pythonAtLeast,
+  setuptools,
+  pytest_7,
   cram,
   bash,
 }:
 
 buildPythonPackage rec {
-  version = "0.2.2";
-  format = "setuptools";
   pname = "pytest-cram";
+  version = "0.2.2";
+  pyproject = true;
 
-  nativeCheckInputs = [ pytest ];
-  propagatedBuildInputs = [ cram ];
+  # relies on the imp module
+  disabled = pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
@@ -26,6 +28,13 @@ buildPythonPackage rec {
       --replace "/bin/bash" "${bash}/bin/bash"
   '';
 
+  build-system = [ setuptools ];
+
+  dependencies = [ cram ];
+
+  # https://github.com/tbekolay/pytest-cram/issues/15
+  nativeCheckInputs = [ pytest_7 ];
+
   # Remove __init__.py from tests folder, otherwise pytest raises an error that
   # the imported and collected modules are different.
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pytest-examples/default.nix b/pkgs/development/python-modules/pytest-examples/default.nix
index 1776290a1581..05f16043172a 100644
--- a/pkgs/development/python-modules/pytest-examples/default.nix
+++ b/pkgs/development/python-modules/pytest-examples/default.nix
@@ -7,7 +7,6 @@
   pytest,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   ruff,
 }:
 
@@ -33,10 +32,6 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "ruff" ];
 
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
-
   build-system = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/pytest-golden/default.nix b/pkgs/development/python-modules/pytest-golden/default.nix
index 6cc78e6d7018..1d2879049e45 100644
--- a/pkgs/development/python-modules/pytest-golden/default.nix
+++ b/pkgs/development/python-modules/pytest-golden/default.nix
@@ -10,7 +10,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   testfixtures,
 }:
 
@@ -39,7 +38,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     # hatchling used for > 0.2.2
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   buildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pytest-httpx/default.nix b/pkgs/development/python-modules/pytest-httpx/default.nix
index b9dfda5404a3..59a5a76e2eb5 100644
--- a/pkgs/development/python-modules/pytest-httpx/default.nix
+++ b/pkgs/development/python-modules/pytest-httpx/default.nix
@@ -7,7 +7,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-scm,
 }:
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-lazy-fixtures/default.nix b/pkgs/development/python-modules/pytest-lazy-fixtures/default.nix
new file mode 100644
index 000000000000..3205d9d0e82d
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-lazy-fixtures/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-lazy-fixtures";
+  version = "1.0.7";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dev-petrov";
+    repo = "pytest-lazy-fixtures";
+    rev = version;
+    hash = "sha256-BOKUg5HPBQfteKOEsdZ30h/hWbVZPuHMhtGXF3KfMXg=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pytest_lazy_fixtures" ];
+
+  meta = with lib; {
+    description = "Allows you to use fixtures in @pytest.mark.parametrize";
+    homepage = "https://github.com/dev-petrov/pytest-lazy-fixtures";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytest-md-report/default.nix b/pkgs/development/python-modules/pytest-md-report/default.nix
index 8a624e6e48df..5caa41592589 100644
--- a/pkgs/development/python-modules/pytest-md-report/default.nix
+++ b/pkgs/development/python-modules/pytest-md-report/default.nix
@@ -2,6 +2,8 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
+  setuptools-scm,
   pytablewriter,
   pytest,
   tcolorpy,
@@ -12,16 +14,22 @@
 
 buildPythonPackage rec {
   pname = "pytest-md-report";
-  version = "0.5.1";
-  format = "setuptools";
+  version = "0.6.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-WzPspBVcrtcDqZI+PuAttfI7YBKC5DW5IM+Y7iUdQFI=";
+    pname = "pytest_md_report";
+    inherit version;
+    hash = "sha256-XpbGVevJtcPHt4v3xTgsH2gFbpaQRDAlJ5D4c33lzpk=";
   };
 
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
     pytablewriter
     tcolorpy
diff --git a/pkgs/development/python-modules/pytest-mpl/default.nix b/pkgs/development/python-modules/pytest-mpl/default.nix
index 020133c352c6..9290fa528e98 100644
--- a/pkgs/development/python-modules/pytest-mpl/default.nix
+++ b/pkgs/development/python-modules/pytest-mpl/default.nix
@@ -8,7 +8,7 @@
   matplotlib,
   pynose,
   pillow,
-  pytestCheckHook,
+  pytest7CheckHook,
 }:
 
 buildPythonPackage rec {
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     pillow
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytest7CheckHook ];
 
   disabledTests = [
     # Broken since b6e98f18950c2b5dbdc725c1181df2ad1be19fee
diff --git a/pkgs/development/python-modules/pytest-notebook/default.nix b/pkgs/development/python-modules/pytest-notebook/default.nix
index f65d7efd9ea2..21f40beb6a89 100644
--- a/pkgs/development/python-modules/pytest-notebook/default.nix
+++ b/pkgs/development/python-modules/pytest-notebook/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
-  pythonRelaxDepsHook,
   attrs,
   jsonschema,
   nbclient,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pytest-openfiles/default.nix b/pkgs/development/python-modules/pytest-openfiles/default.nix
deleted file mode 100644
index ebd0a0976c64..000000000000
--- a/pkgs/development/python-modules/pytest-openfiles/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchpatch,
-  fetchPypi,
-  isPy27,
-  packaging,
-  pytest,
-  pytestCheckHook,
-  psutil,
-  setuptools-scm,
-}:
-
-buildPythonPackage rec {
-  pname = "pytest-openfiles";
-  version = "0.5.0";
-  format = "setuptools";
-  disabled = isPy27; # abandoned
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "179c2911d8aee3441fee051aba08e0d9b4dab61b829ae4811906d5c49a3b0a58";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "replace-distutils-with-packaging.patch";
-      url = "https://github.com/astropy/pytest-openfiles/commit/e17e8123936689b0b0ecfb713976588d6793d8bb.patch";
-      includes = [ "pytest_openfiles/plugin.py" ];
-      hash = "sha256-+6xqOwnBO+jxenXxPdDhLqqm3w+ZRjWeVqqgz8j22bU=";
-    })
-  ];
-
-  nativeBuildInputs = [ setuptools-scm ];
-
-  buildInputs = [ pytest ];
-
-  propagatedBuildInputs = [
-    packaging
-    psutil
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  meta = with lib; {
-    description = "Pytest plugin for detecting inadvertent open file handles";
-    homepage = "https://astropy.org";
-    license = licenses.bsd3;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/pytest-regressions/default.nix b/pkgs/development/python-modules/pytest-regressions/default.nix
index eb0afeda5e22..9c109021be28 100644
--- a/pkgs/development/python-modules/pytest-regressions/default.nix
+++ b/pkgs/development/python-modules/pytest-regressions/default.nix
@@ -47,11 +47,6 @@ buildPythonPackage rec {
     "ignore::DeprecationWarning"
   ];
 
-  disabledTestPathss = lib.optionals (pythonAtLeast "3.12") [
-    # AttributeError: partially initialized module 'pandas' has no attribute '_pandas_datetime_CAPI' (most likely due to a circular import)
-    "tests/test_num_regression.py"
-  ];
-
   pythonImportsCheck = [
     "pytest_regressions"
     "pytest_regressions.plugin"
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index 3d2873321a75..751532baa6aa 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -11,23 +11,33 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "13.0";
+  version = "14.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4TLb5CC8R29US5bnA27dCmlwdXQgm2Z3JjyVDRmwkZk=";
+    hash = "sha256-SkALy808ekrRUauK+sEj2Q7KOr4n+Ycl3E2XAoh9LpI=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   buildInputs = [ pytest ];
-  propagatedBuildInputs = [ packaging ];
+
+  dependencies = [ packaging ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = [
+    # https://github.com/pytest-dev/pytest-rerunfailures/issues/267
+    "test_run_session_teardown_once_after_reruns"
+    "test_exception_matches_rerun_except_query"
+    "test_exception_not_match_rerun_except_query"
+    "test_exception_matches_only_rerun_query"
+    "test_exception_match_only_rerun_in_dual_query"
+  ];
+
   meta = with lib; {
     description = "Pytest plugin to re-run tests to eliminate flaky failures";
     homepage = "https://github.com/pytest-dev/pytest-rerunfailures";
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index b75a4b790528..555c84031144 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
+  setuptools,
   setuptools-scm,
   pytestCheckHook,
   filelock,
@@ -14,28 +15,32 @@
 
 buildPythonPackage rec {
   pname = "pytest-xdist";
-  version = "3.5.0";
+  version = "3.6.1";
   disabled = pythonOlder "3.7";
 
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-y7NvPWfgxHi6pX+k7ciEOIfg9s/ELWd1MKNtdHKzLYo=";
+    pname = "pytest_xdist";
+    inherit version;
+    hash = "sha256-6tFWpNsjHux2lzf1dmjvWKIISjSy5VxKj6INhhEHMA0=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   buildInputs = [ pytest ];
 
-  propagatedBuildInputs = [ execnet ];
+  dependencies = [ execnet ];
 
   nativeCheckInputs = [
     filelock
     pytestCheckHook
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     psutil = [ psutil ];
     setproctitle = [ setproctitle ];
   };
diff --git a/pkgs/development/python-modules/pytest-xprocess/default.nix b/pkgs/development/python-modules/pytest-xprocess/default.nix
index 4d784be7c118..efe696a270d8 100644
--- a/pkgs/development/python-modules/pytest-xprocess/default.nix
+++ b/pkgs/development/python-modules/pytest-xprocess/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-xprocess";
-  version = "0.23.0";
+  version = "1.0.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+NQEGiChwe8ZQwVOSj33rHtD5/KR9kD0PDTp3MSzTfo=";
+    hash = "sha256-FeJwY3WG6rxWdV7l/MgcSL20a6fvfA1bG2QwLQgMxg8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest/8.2.2-unittest-testcase-regression.patch b/pkgs/development/python-modules/pytest/8.2.2-unittest-testcase-regression.patch
new file mode 100644
index 000000000000..1d127b191f81
--- /dev/null
+++ b/pkgs/development/python-modules/pytest/8.2.2-unittest-testcase-regression.patch
@@ -0,0 +1,72 @@
+From de47b73520fd9b7e41272701d7fd4663357af046 Mon Sep 17 00:00:00 2001
+From: Ran Benita <ran@unusedvar.com>
+Date: Fri, 7 Jun 2024 09:49:29 +0300
+Subject: [PATCH] unittest: fix assertion errors on unittest reruns
+
+This fixes unittest test reruns when using plugins like
+pytest-rerunfailures.
+
+The `instance` property uses AttributeError to check if the instance
+needs to be initialized, so `del` is the correct way to clear it, not
+setting to `None`.
+
+Regressed in 8.2.2.
+---
+ changelog/12424.bugfix.rst                            |  1 +
+ src/_pytest/unittest.py                               |  2 +-
+ .../pytest_rerunfailures_integration.py               | 11 +++++++++++
+ tox.ini                                               |  2 +-
+ 4 files changed, 14 insertions(+), 2 deletions(-)
+ create mode 100644 changelog/12424.bugfix.rst
+ create mode 100644 testing/plugins_integration/pytest_rerunfailures_integration.py
+
+diff --git a/changelog/12424.bugfix.rst b/changelog/12424.bugfix.rst
+new file mode 100644
+index 00000000000..7ad1126858b
+--- /dev/null
++++ b/changelog/12424.bugfix.rst
+@@ -0,0 +1 @@
++Fix crash with `assert testcase is not None` assertion failure when re-running unittest tests using plugins like pytest-rerunfailures. Regressed in 8.2.2.
+diff --git a/src/_pytest/unittest.py b/src/_pytest/unittest.py
+index 643443f08c6..ca82ac5c14a 100644
+--- a/src/_pytest/unittest.py
++++ b/src/_pytest/unittest.py
+@@ -222,7 +222,7 @@ def teardown(self) -> None:
+             self._explicit_tearDown()
+             self._explicit_tearDown = None
+         self._obj = None
+-        self._instance = None
++        del self._instance
+         super().teardown()
+ 
+     def startTest(self, testcase: "unittest.TestCase") -> None:
+diff --git a/testing/plugins_integration/pytest_rerunfailures_integration.py b/testing/plugins_integration/pytest_rerunfailures_integration.py
+new file mode 100644
+index 00000000000..9a13a3279a9
+--- /dev/null
++++ b/testing/plugins_integration/pytest_rerunfailures_integration.py
+@@ -0,0 +1,11 @@
++import unittest
++
++
++class MyTestCase(unittest.TestCase):
++    first_time = True
++
++    def test_fail_the_first_time(self) -> None:
++        """Regression test for issue #12424."""
++        if self.first_time:
++            type(self).first_time = False
++            self.fail()
+diff --git a/tox.ini b/tox.ini
+index 0a3f0acf5b8..35b335a015d 100644
+--- a/tox.ini
++++ b/tox.ini
+@@ -141,7 +141,7 @@ commands =
+     pytest --cov=. simple_integration.py
+     pytest --ds=django_settings simple_integration.py
+     pytest --html=simple.html simple_integration.py
+-    pytest --reruns 5 simple_integration.py
++    pytest --reruns 5 simple_integration.py pytest_rerunfailures_integration.py
+     pytest pytest_anyio_integration.py
+     pytest pytest_asyncio_integration.py
+     pytest pytest_mock_integration.py
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 291f469be960..558909a61d25 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -4,6 +4,7 @@
   callPackage,
   pythonOlder,
   fetchPypi,
+  fetchpatch2,
   writeText,
 
   # build-system
@@ -30,14 +31,20 @@
 
 buildPythonPackage rec {
   pname = "pytest";
-  version = "8.1.1";
+  version = "8.2.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rJeBQadZSJSIF9NgKXt6rg/LnW/2vJ7G1RS4XVplwEQ=";
+    hash = "sha256-3ku4EE4gGTnM3GiLJ6iae+IHmyLivSsH+Aa2unEReXc=";
   };
 
+  patches = [
+    # https://github.com/pytest-dev/pytest/issues/12424
+    # https://github.com/pytest-dev/pytest/pull/12436
+    ./8.2.2-unittest-testcase-regression.patch
+  ];
+
   outputs = [
     "out"
     "testout"
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index a20a469eb3c1..055a993ca013 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -15,7 +15,6 @@
   python-fsutil,
   python-slugify,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   setuptools,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "boto3" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index 5f0ebb3988e1..9092a49d7690 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -2,15 +2,22 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  nose,
+  runCommand,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # dependencies
+  dbus-python,
+
+  # checks
   dbus,
   gobject-introspection,
-  dbus-python,
   pygobject3,
   bluez,
   networkmanager,
-  setuptools-scm,
-  runCommand,
+  pytestCheckHook,
 }:
 
 let
@@ -24,7 +31,7 @@ in
 buildPythonPackage rec {
   pname = "python-dbusmock";
   version = "0.31.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "martinpitt";
@@ -33,9 +40,12 @@ buildPythonPackage rec {
     hash = "sha256-DdV78o089Jkc7mSsGvlJgVpv8kPpMILo7lC6EbLxkxg=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [ dbus-python ];
+  dependencies = [ dbus-python ];
 
   nativeCheckInputs = [
     dbus
@@ -44,39 +54,19 @@ buildPythonPackage rec {
     bluez
     pbap-client
     networkmanager
-    nose
+    pytestCheckHook
   ];
 
-  # TODO: Get the rest of these tests running?
-  NOSE_EXCLUDE = lib.concatStringsSep "," [
-    "test_bluez4" # NixOS ships BlueZ5
-    # These appear to fail because they're expecting to run in an Ubuntu chroot?
-    "test_everything" # BlueZ5 OBEX
-    "test_polkitd"
-    "test_consolekit"
-    "test_api"
-    "test_logind"
-    "test_notification_daemon"
-    "test_ofono"
-    "test_gnome_screensaver"
-    "test_cli"
-    "test_timedated"
-    "test_upower"
-    # needs glib
-    "test_accounts_service"
-    # needs dbus-daemon active
-    "test_systemd"
-    # Very slow, consider disabling?
-    # "test_networkmanager"
+  disabledTests = [
+    # wants to call upower, which is a reverse-dependency
+    "test_dbusmock_test_template"
+    # Failed to execute program org.TestSystem: No such file or directory
+    "test_system_service_activation"
+    "test_session_service_activation"
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    nosetests -v
-    runHook postCheck
-  '';
-
   meta = with lib; {
+    changelog = "https://github.com/martinpitt/python-dbusmock/releases/tag/${version}";
     description = "Mock D-Bus objects for tests";
     homepage = "https://github.com/martinpitt/python-dbusmock";
     license = licenses.lgpl3Plus;
diff --git a/pkgs/development/python-modules/python-docx/default.nix b/pkgs/development/python-modules/python-docx/default.nix
index 627cb55ff354..28c4d4c3c115 100644
--- a/pkgs/development/python-modules/python-docx/default.nix
+++ b/pkgs/development/python-modules/python-docx/default.nix
@@ -2,7 +2,7 @@
   lib,
   behave,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   lxml,
   mock,
   pyparsing,
@@ -14,19 +14,21 @@
 
 buildPythonPackage rec {
   pname = "python-docx";
-  version = "1.1.0";
+  version = "1.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-WCm3IhQc8at5rt8MNNn+mSSyl2RYTA8hZOsrAtzfF8k=";
+  src = fetchFromGitHub {
+    owner = "python-openxml";
+    repo = "python-docx";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-isxMtq5j5J02GcHMzOJdJw+ZokLoxA6fG1xsN21Irbc=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     lxml
     typing-extensions
   ];
diff --git a/pkgs/development/python-modules/python-fx/default.nix b/pkgs/development/python-modules/python-fx/default.nix
index cdaae586a52e..b3a15ff913ca 100644
--- a/pkgs/development/python-modules/python-fx/default.nix
+++ b/pkgs/development/python-modules/python-fx/default.nix
@@ -19,7 +19,6 @@
   pytestCheckHook,
   pythonOlder,
   antlr4,
-  pythonRelaxDepsHook,
   pyyaml,
   setuptools,
   six,
@@ -52,7 +51,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     antlr4
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index 2209320f8712..8d7d40c4a734 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -16,14 +16,15 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "4.4.0";
+  version = "4.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-HRF797QzroJV5ddOcsZgl49Q7oXrYiSMn7Uu9Dw+OBQ=";
+    pname = "python_gitlab";
+    inherit version;
+    hash = "sha256-tWrjY4kDdMrt6FPvVS6SxBVR1gWADeHGS6YbzyXyN7A=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index 098bc746f553..b2c59c10ecd9 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -29,6 +29,8 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "defusedxml" ];
+
   dependencies = [
     defusedxml
     lxml
diff --git a/pkgs/development/python-modules/python-jenkins/default.nix b/pkgs/development/python-modules/python-jenkins/default.nix
index 090f5acd8e4a..8afb965dbaca 100644
--- a/pkgs/development/python-modules/python-jenkins/default.nix
+++ b/pkgs/development/python-modules/python-jenkins/default.nix
@@ -14,7 +14,6 @@
   requests-mock,
   stestr,
   multiprocess,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -34,7 +33,6 @@ buildPythonPackage rec {
       --replace test_jenkins_open_no_timeout dont_test_jenkins_open_no_timeout
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "setuptools" ];
 
   buildInputs = [ mock ];
diff --git a/pkgs/development/python-modules/python-kasa/default.nix b/pkgs/development/python-modules/python-kasa/default.nix
index 1ccae8b44d0e..56b56ebca187 100644
--- a/pkgs/development/python-modules/python-kasa/default.nix
+++ b/pkgs/development/python-modules/python-kasa/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   aiohttp,
-  anyio,
   async-timeout,
   asyncclick,
   buildPythonPackage,
@@ -12,6 +11,7 @@
   poetry-core,
   pydantic,
   pytest-asyncio,
+  pytest-freezer,
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "python-kasa";
-  version = "0.6.2.1";
+  version = "0.7.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,14 +29,13 @@ buildPythonPackage rec {
     owner = "python-kasa";
     repo = "python-kasa";
     rev = "refs/tags/${version}";
-    hash = "sha256-iCqJY3qkA3ZVXTCfxvQoaZsaqGui8PwKGAmLXKZgLJs=";
+    hash = "sha256-jbyc4YeUKjioUFXL5SVdgeUlSIiOCJ7D0cZRWPiKZII=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
-    anyio
     async-timeout
     asyncclick
     cryptography
@@ -45,6 +44,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-freezer
     pytest-mock
     pytestCheckHook
     voluptuous
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index c79e3f7e8d7b..f2df743ee1c4 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -22,7 +22,6 @@
   pytestCheckHook,
   python-lsp-jsonrpc,
   pythonOlder,
-  pythonRelaxDepsHook,
   rope,
   setuptools,
   setuptools-scm,
diff --git a/pkgs/development/python-modules/python-lzf/default.nix b/pkgs/development/python-modules/python-lzf/default.nix
index bcf7ea480a42..c2592f956253 100644
--- a/pkgs/development/python-modules/python-lzf/default.nix
+++ b/pkgs/development/python-modules/python-lzf/default.nix
@@ -1,19 +1,27 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
-  version = "0.2.4";
-  format = "setuptools";
+  version = "0.2.6";
   pname = "python-lzf";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1l8m6vzwm1m8hn7ldw8j8r2b6r199k8z3q0wnhdyy4p68hahyhni";
+  src = fetchFromGitHub {
+    owner = "teepark";
+    repo = "python-lzf";
+    rev = "refs/tags/release-${version}";
+    hash = "sha256-n5E75kRqe0dDbyFicoyLBAVi/SuoUU7qJka3viipQk8=";
   };
 
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
+
   meta = with lib; {
     description = "liblzf python bindings";
     homepage = "https://github.com/teepark/python-lzf";
diff --git a/pkgs/development/python-modules/python-matter-server/default.nix b/pkgs/development/python-modules/python-matter-server/default.nix
index e981e6ce8c6a..288f7a934a57 100644
--- a/pkgs/development/python-modules/python-matter-server/default.nix
+++ b/pkgs/development/python-modules/python-matter-server/default.nix
@@ -8,7 +8,6 @@
 
   # build
   setuptools,
-  pythonRelaxDepsHook,
 
   # propagates
   aiohttp,
@@ -56,7 +55,7 @@ in
 
 buildPythonPackage rec {
   pname = "python-matter-server";
-  version = "6.1.0";
+  version = "6.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -65,7 +64,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "python-matter-server";
     rev = "refs/tags/${version}";
-    hash = "sha256-sY/FaMZ3p/AC63t1ku1Khgqi71G7u2O+ZPTuMPHFkuk=";
+    hash = "sha256-20heZrdSuKfiRuKKnDyguSC5bbV/9qBcu6E/5vcV1iU=";
   };
 
   patches = [
@@ -83,7 +82,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "home-assistant-chip-clusters" ];
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
index b465f6a4d60e..07466ebcddcd 100644
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -37,6 +37,8 @@ buildPythonPackage rec {
     hash = "sha256-BJw1Gg3FO2R6WWKjkrpxDN4fTMTug5AIj0SNq1gEbBY=";
   };
 
+  pythonRelaxDeps = [ "defusedxml" ];
+
   nativeBuildInputs = [ poetry-core ];
 
   patches = [
diff --git a/pkgs/development/python-modules/python-ndn/default.nix b/pkgs/development/python-modules/python-ndn/default.nix
index fb7d54407ce6..69fedb261ed1 100644
--- a/pkgs/development/python-modules/python-ndn/default.nix
+++ b/pkgs/development/python-modules/python-ndn/default.nix
@@ -10,7 +10,6 @@
   pycryptodomex,
   pygtrie,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   setuptools,
 }:
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-nomad/default.nix b/pkgs/development/python-modules/python-nomad/default.nix
index 5969aeb56b78..2f4cfc1fef7f 100644
--- a/pkgs/development/python-modules/python-nomad/default.nix
+++ b/pkgs/development/python-modules/python-nomad/default.nix
@@ -2,23 +2,27 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   requests,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "python-nomad";
-  version = "2.0.0";
-  format = "setuptools";
+  version = "2.0.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-5IyHNw1ArE8fU9DoSQMGkDI9d/OiR1YI/7nTPeFIK+A=";
+    pname = "python_nomad";
+    inherit version;
+    hash = "sha256-TXCm6FxYoavjN3ASioQ7yXQVsDDXedDKBgGGP8ghQdM=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
 
   # Tests require nomad agent
   doCheck = false;
diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index 02e550736312..480c79403903 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -15,7 +15,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/python-sql/default.nix b/pkgs/development/python-modules/python-sql/default.nix
index 9ccfc02646ac..a7d91fcb759a 100644
--- a/pkgs/development/python-modules/python-sql/default.nix
+++ b/pkgs/development/python-modules/python-sql/default.nix
@@ -8,14 +8,15 @@
 
 buildPythonPackage rec {
   pname = "python-sql";
-  version = "1.4.3";
+  version = "1.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-YmC+/4NaNdOgrsTx2jUbC+nKoaDZSmy6lAp82Nz2Ymk=";
+    pname = "python_sql";
+    inherit version;
+    hash = "sha256-93RnHx0IT6a6Q4mJJM3r5O0NAHHfjWCAQKzU8cjYaqM=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/pytools/default.nix b/pkgs/development/python-modules/pytools/default.nix
index 1de63995bf29..f755014155dd 100644
--- a/pkgs/development/python-modules/pytools/default.nix
+++ b/pkgs/development/python-modules/pytools/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "pytools";
-  version = "2024.1.2";
+  version = "2024.1.5";
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CBhx5FFQXEuYbrr6aK7qv9x76z+qG6pQ9yauviHh0Fc=";
+    hash = "sha256-jDd7sf/ctRAzAbjn6U8By+Nlc6AeAgQ0/qlikbHxrBk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyudev/default.nix b/pkgs/development/python-modules/pyudev/default.nix
index 019158e1cbf1..13073a59f481 100644
--- a/pkgs/development/python-modules/pyudev/default.nix
+++ b/pkgs/development/python-modules/pyudev/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "pyudev";
-  version = "0.24.1";
+  version = "0.24.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-deVNNyGPWsRbDaHw/ZzF5SajysPvHPrUEM96sziwFHE=";
+    hash = "sha256-LpRUJ6IWdIk7uXYyQB22ITnZHOoe6WE3zHsHrSIZj8c=";
   };
 
   postPatch = lib.optionalString stdenvNoCC.isLinux ''
diff --git a/pkgs/development/python-modules/pyzmq/default.nix b/pkgs/development/python-modules/pyzmq/default.nix
index cf07118b5d02..f927515894c3 100644
--- a/pkgs/development/python-modules/pyzmq/default.nix
+++ b/pkgs/development/python-modules/pyzmq/default.nix
@@ -5,15 +5,15 @@
   isPyPy,
 
   # build-system
+  cffi,
   cython,
-  setuptools,
-  setuptools-scm,
+  cmake,
+  ninja,
   packaging,
-  cffi,
+  pathspec,
+  scikit-build-core,
 
-  # dependencies
-
-  py,
+  # checks
   pytestCheckHook,
   python,
   pythonOlder,
@@ -24,25 +24,29 @@
 
 buildPythonPackage rec {
   pname = "pyzmq";
-  version = "25.1.2";
+  version = "26.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-k/GqMR6LuRLjTwBM8YZAek6Q7sTw7MDv0mBWv37aAiY=";
+    hash = "sha256-26fZ8uBH36K8o7AfT4SqUkZyUgPWKE43kPLKFfumtAo=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    setuptools-scm
+  build-system = [
+    cmake
+    ninja
     packaging
+    pathspec
+    scikit-build-core
   ] ++ (if isPyPy then [ cffi ] else [ cython ]);
 
+  dontUseCmakeConfigure = true;
+
   buildInputs = [ zeromq ];
 
-  propagatedBuildInputs = lib.optionals isPyPy [ cffi ];
+  dependencies = lib.optionals isPyPy [ cffi ];
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/qcs-api-client/default.nix b/pkgs/development/python-modules/qcs-api-client/default.nix
index 0847a10ce625..d45f7d220188 100644
--- a/pkgs/development/python-modules/qcs-api-client/default.nix
+++ b/pkgs/development/python-modules/qcs-api-client/default.nix
@@ -15,7 +15,6 @@
   python-dateutil,
   pythonAtLeast,
   pythonOlder,
-  pythonRelaxDepsHook,
   respx,
   retrying,
   rfc3339,
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     attrs
diff --git a/pkgs/development/python-modules/qcs-sdk-python/Cargo.lock b/pkgs/development/python-modules/qcs-sdk-python/Cargo.lock
index fc65e87b236e..58d71179d4cf 100644
--- a/pkgs/development/python-modules/qcs-sdk-python/Cargo.lock
+++ b/pkgs/development/python-modules/qcs-sdk-python/Cargo.lock
@@ -1121,7 +1121,7 @@ dependencies = [
  "futures-util",
  "http",
  "hyper",
- "rustls 0.21.10",
+ "rustls 0.21.11",
  "tokio",
  "tokio-rustls 0.24.1",
 ]
@@ -1283,14 +1283,13 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "9.2.0"
+version = "8.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c7ea04a7c5c055c175f189b6dc6ba036fd62306b58c66c9f6389036c503a3f4"
+checksum = "6971da4d9c3aa03c3d8f3ff0f4155b534aad021292003895a469716b2a230378"
 dependencies = [
  "base64 0.21.7",
- "js-sys",
  "pem",
- "ring 0.17.8",
+ "ring 0.16.20",
  "serde",
  "serde_json",
  "simple_asn1",
@@ -1880,12 +1879,11 @@ checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
 
 [[package]]
 name = "pem"
-version = "3.0.3"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b8fcc794035347fb64beda2d3b462595dd2753e3f268d89c5aae77e8cf2c310"
+checksum = "a8835c273a76a90455d7344889b0964598e3316e2a79ede8e36f16bdcf2228b8"
 dependencies = [
- "base64 0.21.7",
- "serde",
+ "base64 0.13.1",
 ]
 
 [[package]]
@@ -2124,7 +2122,7 @@ dependencies = [
 
 [[package]]
 name = "qcs"
-version = "0.21.7"
+version = "0.21.10"
 dependencies = [
  "assert2",
  "async-trait",
@@ -2184,9 +2182,9 @@ dependencies = [
 
 [[package]]
 name = "qcs-api-client-common"
-version = "0.7.12"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e96a94ca1f4ac3e094d51d90deb5d158dddfd0723cca1b50d302acfd2e4e78ef"
+checksum = "53c56fa367070074f32143b4adef924af1441faa86e835f45371e14801884d14"
 dependencies = [
  "async-trait",
  "backoff",
@@ -2207,9 +2205,9 @@ dependencies = [
 
 [[package]]
 name = "qcs-api-client-grpc"
-version = "0.7.14"
+version = "0.7.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b82196be0676c8dc24749a830e886ffda6e34b3130c6a7078354c24dec07933a"
+checksum = "01247ae1b0523e058007edb0132cd40915452b8b4dc669d68156e187740ead70"
 dependencies = [
  "backoff",
  "http",
@@ -2240,9 +2238,9 @@ dependencies = [
 
 [[package]]
 name = "qcs-api-client-openapi"
-version = "0.8.13"
+version = "0.8.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e318c4bffb689688d4f95afb2b5a52a70e12a191da402e0dded093102fcb1e9"
+checksum = "04d7172e79b083a85c911917c03be58eda083b36ea7575db685d21aa2fa99b41"
 dependencies = [
  "anyhow",
  "qcs-api-client-common",
@@ -2260,7 +2258,7 @@ dependencies = [
 
 [[package]]
 name = "qcs-sdk-python"
-version = "0.17.7"
+version = "0.17.10"
 dependencies = [
  "async-trait",
  "numpy",
@@ -2290,8 +2288,8 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quil-rs"
-version = "0.25.1"
-source = "git+https://github.com/rigetti/quil-rs?tag=quil-py/v0.9.1#4179fb03feff6b83edfb7a0448b0b3967ed28212"
+version = "0.26.0"
+source = "git+https://github.com/rigetti/quil-rs?tag=quil-py/v0.10.0#25966563850ed151fad0cdab3f6931bdd90be8f8"
 dependencies = [
  "approx",
  "indexmap 2.2.6",
@@ -2436,7 +2434,7 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls 0.21.10",
+ "rustls 0.21.11",
  "rustls-native-certs 0.6.3",
  "rustls-pemfile 1.0.4",
  "serde",
@@ -2491,14 +2489,15 @@ dependencies = [
 
 [[package]]
 name = "rigetti-pyo3"
-version = "0.3.1"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff977cba40f2cadf214226cf51c9729a4f5730a5413f901246eed78cb6e795c9"
+checksum = "c59068763670399bb3e895a17cc631d9214c3172b64fc74d3ab63dac7371c340"
 dependencies = [
  "num-complex",
  "num-traits",
  "paste",
  "pyo3",
+ "time",
 ]
 
 [[package]]
@@ -2628,9 +2627,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.21.10"
+version = "0.21.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+checksum = "7fecbfb7b1444f477b345853b1fce097a2c6fb637b2bfb87e6bc5db0f043fae4"
 dependencies = [
  "log",
  "ring 0.17.8",
@@ -2640,9 +2639,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.22.2"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e87c9956bd9807afa1f77e0f7594af32566e830e088a5576d27c5b6f30f49d41"
+checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
 dependencies = [
  "log",
  "ring 0.17.8",
@@ -3290,7 +3289,7 @@ version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
 dependencies = [
- "rustls 0.21.10",
+ "rustls 0.21.11",
  "tokio",
 ]
 
@@ -3300,7 +3299,7 @@ version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
 dependencies = [
- "rustls 0.22.2",
+ "rustls 0.22.4",
  "rustls-pki-types",
  "tokio",
 ]
diff --git a/pkgs/development/python-modules/qcs-sdk-python/default.nix b/pkgs/development/python-modules/qcs-sdk-python/default.nix
index b47603e24a55..86421d7d84a3 100644
--- a/pkgs/development/python-modules/qcs-sdk-python/default.nix
+++ b/pkgs/development/python-modules/qcs-sdk-python/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "qcs-sdk-python";
-  version = "0.17.7";
+  version = "0.17.10";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,13 +24,13 @@ buildPythonPackage rec {
     owner = "rigetti";
     repo = "qcs-sdk-rust";
     rev = "python/v${version}";
-    hash = "sha256-6Rh5gQH+ObpWGR9rYJfkXnGfG1GjKLn+ckiR7RhKzoE=";
+    hash = "sha256-pBh7g4MH5hL3k458q6UhkW/5/HdFm4ELnJHIl0wQFGE=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "quil-rs-0.25.1" = "sha256-zC4DEjCN6y9XeZlzmXHSTbVTpFQ4Srozix89IHDhHXc=";
+      "quil-rs-0.26.0" = "sha256-Er4sl47i6TbcbG3JHHexrOn/Sdd5mLTl5R+eA7heBVg=";
     };
   };
 
diff --git a/pkgs/development/python-modules/qdldl/default.nix b/pkgs/development/python-modules/qdldl/default.nix
index 86054ca65b9d..4491788552c7 100644
--- a/pkgs/development/python-modules/qdldl/default.nix
+++ b/pkgs/development/python-modules/qdldl/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "qdldl";
-  version = "0.1.7.post2";
+  version = "0.1.7.post3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SxU5pewQzHV6/XFW1960AGAHythtd0yfD9w+NEFVV9M=";
+    hash = "sha256-WbOqK6IkyvI3StJArXmmlbxHdjnGTjFkzvTyyZyHzx0=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index 1ccb60f07f34..b8e1280ceb3d 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -5,7 +5,6 @@
   ipykernel,
   jupyter-core,
   jupyter-client,
-  ipython-genutils,
   pygments,
   pyqt5,
   pytestCheckHook,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   dependencies = [
     ipykernel
-    ipython-genutils
     jupyter-core
     jupyter-client
     pygments
diff --git a/pkgs/development/python-modules/qudida/default.nix b/pkgs/development/python-modules/qudida/default.nix
index 5003b5860c5d..7e0bac314b25 100644
--- a/pkgs/development/python-modules/qudida/default.nix
+++ b/pkgs/development/python-modules/qudida/default.nix
@@ -5,7 +5,6 @@
   numpy,
   opencv4,
   pythonOlder,
-  pythonRelaxDepsHook,
   scikit-learn,
   typing-extensions,
 }:
@@ -22,7 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-2xmOKIerDJqgAj5WWvv/Qd+3azYfhf1eE/eA11uhjMg=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [ "opencv-python" ];
 
diff --git a/pkgs/development/python-modules/questionary/default.nix b/pkgs/development/python-modules/questionary/default.nix
index 654aeca183d1..ea6844159930 100644
--- a/pkgs/development/python-modules/questionary/default.nix
+++ b/pkgs/development/python-modules/questionary/default.nix
@@ -7,7 +7,6 @@
   prompt-toolkit,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "prompt_toolkit" ];
diff --git a/pkgs/development/python-modules/quil/default.nix b/pkgs/development/python-modules/quil/default.nix
index c1530c320617..b03c8998e8c0 100644
--- a/pkgs/development/python-modules/quil/default.nix
+++ b/pkgs/development/python-modules/quil/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "quil";
-  version = "0.9.1";
+  version = "0.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,13 +22,13 @@ buildPythonPackage rec {
     owner = "rigetti";
     repo = "quil-rs";
     rev = "quil-py/v${version}";
-    hash = "sha256-c9nFF74Mr6S2b7NthRVUnarwxFZ9s5RUaoxYruE6QvI=";
+    hash = "sha256-GJ39pvIqYs2bMGAHJL8OgB0OfmIpo/k3FxorYvdOvhI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     name = "${pname}-${version}";
     inherit src;
-    hash = "sha256-FNkXdBLfKnrD9aUe25uJHi+TtApgFSCryYCY1r8ebho=";
+    hash = "sha256-VvnjdCFrpo/rDLNJrHpZoV+E+fQGgNW/nBOvMG91sHQ=";
   };
 
   buildAndTestSubdir = "quil-py";
diff --git a/pkgs/development/python-modules/r2pipe/default.nix b/pkgs/development/python-modules/r2pipe/default.nix
index 2436fe3acd60..d248b962f0d3 100644
--- a/pkgs/development/python-modules/r2pipe/default.nix
+++ b/pkgs/development/python-modules/r2pipe/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "r2pipe";
-  version = "1.8.8";
+  version = "1.9.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wAOmO5bev1zgPcJoiqKlS4anUKayo8HsncQXM+b1clQ=";
+    hash = "sha256-BNWP2uAJcEOCE92QakNI7Ils0iXRN5PUA9cSVrhDmx4=";
   };
 
   # Tiny sanity check to make sure r2pipe finds radare2 (since r2pipe doesn't
diff --git a/pkgs/development/python-modules/radios/default.nix b/pkgs/development/python-modules/radios/default.nix
index d66a41e2b343..241e95a18985 100644
--- a/pkgs/development/python-modules/radios/default.nix
+++ b/pkgs/development/python-modules/radios/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   aiodns,
   aiohttp,
   awesomeversion,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pycountry" ];
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index d0869e8afc08..cad6772ed22a 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -37,7 +37,6 @@
   python,
   pythonAtLeast,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   scikit-image,
@@ -112,7 +111,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/readability-lxml/default.nix b/pkgs/development/python-modules/readability-lxml/default.nix
index 5c772879dcc7..e676918cb698 100644
--- a/pkgs/development/python-modules/readability-lxml/default.nix
+++ b/pkgs/development/python-modules/readability-lxml/default.nix
@@ -7,6 +7,7 @@
   chardet,
   cssselect,
   lxml,
+  lxml-html-clean,
   timeout-decorator,
 }:
 
@@ -26,6 +27,7 @@ buildPythonPackage rec {
     chardet
     cssselect
     lxml
+    lxml-html-clean
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/redis-om/default.nix b/pkgs/development/python-modules/redis-om/default.nix
index 24b267d688ad..e4c545ad48fd 100644
--- a/pkgs/development/python-modules/redis-om/default.nix
+++ b/pkgs/development/python-modules/redis-om/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   unasync,
   poetry-core,
   python,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
   };
 
   build-system = [
-    pythonRelaxDepsHook
     unasync
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 31b2da5d6d3f..a55e5b293bb4 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "redis";
-  version = "5.0.3";
+  version = "5.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SXO650RMD77WSga4dEb3k2HLfk7BU4wCLWlu16UBVYA=";
+    hash = "sha256-OEc818Y4mtPkSpH0w+r2vLip90YAfym/T7IIJP8LIZc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index 76506e1f0f9b..4434ff860134 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2023.12.25";
+  version = "2024.5.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KRcaoSjaaa/fS95BLVvtwzXyyo/P5EiQOFd9BfFhgeU=";
+    hash = "sha256-0+4C2eX0gsyDCRNKke6qy90iYboRGw/vN0jutJE+aiw=";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/remarshal/default.nix b/pkgs/development/python-modules/remarshal/default.nix
index 708e0acc5324..dedab0bbc95e 100644
--- a/pkgs/development/python-modules/remarshal/default.nix
+++ b/pkgs/development/python-modules/remarshal/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build deps
   poetry-core,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pytest" ];
diff --git a/pkgs/development/python-modules/renault-api/default.nix b/pkgs/development/python-modules/renault-api/default.nix
index a295c2654513..40939cd6f295 100644
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "renault-api";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "hacf-fr";
     repo = "renault-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+QqiD4mMfzlHmSiriaS0JzbMdOGCG7cg/xv6zJaPSOU=";
+    hash = "sha256-dr830PDGiTpiWCHsgxDspVyk6isOVsdGhB/jL96CDic=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/reptor/default.nix b/pkgs/development/python-modules/reptor/default.nix
index 626f674d7b9b..2bd4a8112233 100644
--- a/pkgs/development/python-modules/reptor/default.nix
+++ b/pkgs/development/python-modules/reptor/default.nix
@@ -16,7 +16,6 @@
   pytest,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   reptor,
   requests,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     asgiref
diff --git a/pkgs/development/python-modules/reqif/default.nix b/pkgs/development/python-modules/reqif/default.nix
index e8fb4e1e9665..7548fb3c6f84 100644
--- a/pkgs/development/python-modules/reqif/default.nix
+++ b/pkgs/development/python-modules/reqif/default.nix
@@ -9,7 +9,6 @@
   pytestCheckHook,
   python,
   pythonOlder,
-  pythonRelaxDepsHook,
   xmlschema,
 }:
 
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/requests-ntlm/default.nix b/pkgs/development/python-modules/requests-ntlm/default.nix
index 347bf8cbee72..baa445aeb17c 100644
--- a/pkgs/development/python-modules/requests-ntlm/default.nix
+++ b/pkgs/development/python-modules/requests-ntlm/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "requests-ntlm";
-  version = "1.2.0";
+  version = "1.3.0";
 
   format = "pyproject";
 
   src = fetchPypi {
     pname = "requests_ntlm";
     inherit version;
-    hash = "sha256-M8KF9QdOMXy90zjRma+kanwBEy5cER02vUFVNOm5Fqg=";
+    hash = "sha256-spzCRiYj3/35uIxD4YDMtzW0AHIopUIiDogsWK5Wxmg=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/requests-oauthlib/default.nix b/pkgs/development/python-modules/requests-oauthlib/default.nix
index 46d63b3a8c27..27b2ae885573 100644
--- a/pkgs/development/python-modules/requests-oauthlib/default.nix
+++ b/pkgs/development/python-modules/requests-oauthlib/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "requests-oauthlib";
-  version = "1.3.1";
+  version = "2.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-db6sSkeIHuuU1epdatMe+IhWr/4jMrmq+1LGRSzPDXo=";
+    hash = "sha256-s9/669iE2M13hJQ2lgOp57WNKREb9rQb3C3NhyA69Ok=";
   };
 
   propagatedBuildInputs = [
@@ -37,6 +37,9 @@ buildPythonPackage rec {
     "test_url_is_native_str"
   ];
 
+  # Requires selenium and chrome
+  disabledTestPaths = [ "tests/examples/test_native_spa_pkce_auth0.py" ];
+
   pythonImportsCheck = [ "requests_oauthlib" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/respx/default.nix b/pkgs/development/python-modules/respx/default.nix
index 1dae80096035..7f6ea4561385 100644
--- a/pkgs/development/python-modules/respx/default.nix
+++ b/pkgs/development/python-modules/respx/default.nix
@@ -8,25 +8,32 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
+  setuptools,
   starlette,
   trio,
 }:
 
 buildPythonPackage rec {
   pname = "respx";
-  version = "0.20.2";
-  format = "setuptools";
+  version = "0.21.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "lundberg";
-    repo = pname;
+    repo = "respx";
     rev = version;
-    hash = "sha256-OiBKNK8V9WNQDe29Q5+E/jjBWD0qFcYUzhYUWA+7oFc=";
+    hash = "sha256-sBb9HPvX+AKJUMWBME381F2amYdQmBiM8OguGW3lFG0=";
   };
 
-  propagatedBuildInputs = [ httpx ];
+  postPatch = ''
+    sed -i "/--cov/d" setup.cfg
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [ httpx ];
 
   nativeCheckInputs = [
     httpcore
@@ -38,10 +45,6 @@ buildPythonPackage rec {
     trio
   ];
 
-  postPatch = ''
-    sed -i "/--cov/d" setup.cfg
-  '';
-
   disabledTests = [ "test_pass_through" ];
 
   pythonImportsCheck = [ "respx" ];
@@ -50,7 +53,7 @@ buildPythonPackage rec {
     description = "Python library for mocking HTTPX";
     homepage = "https://lundberg.github.io/respx/";
     changelog = "https://github.com/lundberg/respx/blob/${version}/CHANGELOG.md";
-    license = with licenses; [ bsd3 ];
+    license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/rich-pixels/default.nix b/pkgs/development/python-modules/rich-pixels/default.nix
index cda87a534fc4..62ce70c52576 100644
--- a/pkgs/development/python-modules/rich-pixels/default.nix
+++ b/pkgs/development/python-modules/rich-pixels/default.nix
@@ -2,13 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   hatchling,
   pillow,
+  rich,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
-  rich,
   syrupy,
 }:
 
diff --git a/pkgs/development/python-modules/ring-doorbell/default.nix b/pkgs/development/python-modules/ring-doorbell/default.nix
index 9b62f910e17e..7491f3fa5e51 100644
--- a/pkgs/development/python-modules/ring-doorbell/default.nix
+++ b/pkgs/development/python-modules/ring-doorbell/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     hash = "sha256-CcnGfiJuv3hzez/G/Nu4OyruPL+bbSAtMAfGruqyPUU=";
   };
 
+  pythonRelaxDeps = [ "requests-oauthlib" ];
+
   build-system = [ poetry-core ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/riscv-config/default.nix b/pkgs/development/python-modules/riscv-config/default.nix
index b8762769b10c..c03e97c6232e 100644
--- a/pkgs/development/python-modules/riscv-config/default.nix
+++ b/pkgs/development/python-modules/riscv-config/default.nix
@@ -7,7 +7,6 @@
   pyyaml,
   ruamel-yaml,
   setuptools,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     cerberus
diff --git a/pkgs/development/python-modules/rising/default.nix b/pkgs/development/python-modules/rising/default.nix
index 85990fda4809..fee5c590de51 100644
--- a/pkgs/development/python-modules/rising/default.nix
+++ b/pkgs/development/python-modules/rising/default.nix
@@ -5,7 +5,6 @@
   pythonOlder,
   fetchFromGitHub,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   dill,
   lightning-utilities,
   numpy,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-sBzVTst5Tp2oZZ+Xsg3M7uAMbucL6idlpYwHvib3EaY=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "lightning-utilities" ];
 
diff --git a/pkgs/development/python-modules/rmrl/default.nix b/pkgs/development/python-modules/rmrl/default.nix
index f07165c23c18..0dc783881414 100644
--- a/pkgs/development/python-modules/rmrl/default.nix
+++ b/pkgs/development/python-modules/rmrl/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   pdfrw,
   reportlab,
   rmscene,
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/rmscene/default.nix b/pkgs/development/python-modules/rmscene/default.nix
index e402463eca6b..7da1d58a976d 100644
--- a/pkgs/development/python-modules/rmscene/default.nix
+++ b/pkgs/development/python-modules/rmscene/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   poetry-core,
   packaging,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/rnginline/default.nix b/pkgs/development/python-modules/rnginline/default.nix
index c868150bb98b..966dec934aa2 100644
--- a/pkgs/development/python-modules/rnginline/default.nix
+++ b/pkgs/development/python-modules/rnginline/default.nix
@@ -3,7 +3,6 @@
   fetchPypi,
   buildPythonPackage,
   poetry-core,
-  pythonRelaxDepsHook,
   lxml,
   docopt-ng,
   typing-extensions,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     docopt-ng
diff --git a/pkgs/development/python-modules/roadrecon/default.nix b/pkgs/development/python-modules/roadrecon/default.nix
index 9c4b5b7da1c9..87db63bab3a8 100644
--- a/pkgs/development/python-modules/roadrecon/default.nix
+++ b/pkgs/development/python-modules/roadrecon/default.nix
@@ -11,7 +11,6 @@
   marshmallow-sqlalchemy,
   openpyxl,
   pythonOlder,
-  pythonRelaxDepsHook,
   roadlib,
   setuptools,
   sqlalchemy,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "flask" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/robomachine/default.nix b/pkgs/development/python-modules/robomachine/default.nix
index 795e31cb701c..69ca0941df4d 100644
--- a/pkgs/development/python-modules/robomachine/default.nix
+++ b/pkgs/development/python-modules/robomachine/default.nix
@@ -5,7 +5,6 @@
   buildPythonPackage,
   fetchPypi,
   pyparsing,
-  pythonRelaxDepsHook,
   robotframework,
   setuptools,
 }:
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/roombapy/default.nix b/pkgs/development/python-modules/roombapy/default.nix
index 00a8793f36dc..e2196301166a 100644
--- a/pkgs/development/python-modules/roombapy/default.nix
+++ b/pkgs/development/python-modules/roombapy/default.nix
@@ -11,7 +11,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   tabulate,
 }:
 
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "orjson" ];
diff --git a/pkgs/development/python-modules/rpds-py/default.nix b/pkgs/development/python-modules/rpds-py/default.nix
index 0b7a74166a91..3b6747759867 100644
--- a/pkgs/development/python-modules/rpds-py/default.nix
+++ b/pkgs/development/python-modules/rpds-py/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "rpds-py";
-  version = "0.17.1";
+  version = "0.18.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,13 +21,13 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "rpds_py";
     inherit version;
-    hash = "sha256-AhCyZo8kwHgwcmC/iL2snW8Qk2Nd9RI3ib/uTY1/yOc=";
+    hash = "sha256-3Ei0edVAdwyBH70eubortmlRhj5Ejv7C4sECYlMo6S8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-sFutrKLa2ISxtUN7hmw2P02nl4SM6Hn4yj1kkXrNWmI=";
+    hash = "sha256-caNEmU3K5COYa/UImE4BZYaFTc3Csi3WmnBSbFN3Yn8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rst2pdf/default.nix b/pkgs/development/python-modules/rst2pdf/default.nix
index ae81f6d2ff31..40225a9acb03 100644
--- a/pkgs/development/python-modules/rst2pdf/default.nix
+++ b/pkgs/development/python-modules/rst2pdf/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "rst2pdf";
-  version = "0.101";
+  version = "0.102";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AF8FssEIFHmeY2oVrAPNe85pbmgKWO52yD6ycNNzTSg=";
+    hash = "sha256-NzAGJOlTpz7d3cuubyRjDvVGfCC+61jfZIrcUwhE9CU=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/rtoml/default.nix b/pkgs/development/python-modules/rtoml/default.nix
index 0f4fe3a9966f..fe83ca2e32dc 100644
--- a/pkgs/development/python-modules/rtoml/default.nix
+++ b/pkgs/development/python-modules/rtoml/default.nix
@@ -1,20 +1,19 @@
 {
   lib,
   buildPythonPackage,
-  cargo,
   fetchFromGitHub,
   libiconv,
+  dirty-equals,
+  pytest-benchmark,
   pytestCheckHook,
   pythonOlder,
   rustPlatform,
-  rustc,
-  setuptools-rust,
 }:
 
 buildPythonPackage rec {
   pname = "rtoml";
-  version = "0.8";
-  format = "setuptools";
+  version = "0.10";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,30 +21,39 @@ buildPythonPackage rec {
     owner = "samuelcolvin";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tvX4KcQGw0khBjEXVFmkhsVyAkdr2Bgm6IfD1yGZ37c=";
+    hash = "sha256-1movtKMQkQ6PEpKpSkK0Oy4AV0ee7XrS0P9m6QwZTaM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-KcF3Z71S7ZNZicViqwpClfT736nYYbKcKWylOP+S3HI=";
+    hash = "sha256-BWcOIZMl4yHxxKxCn6Qh69MlMdz3REp3izN0A1eFX3o=";
   };
 
-  nativeBuildInputs = with rustPlatform; [
-    setuptools-rust
-    rustc
-    cargo
-    rustPlatform.cargoSetupHook
+  build-system = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
   ];
 
   buildInputs = [ libiconv ];
 
   pythonImportsCheck = [ "rtoml" ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    dirty-equals
+    pytest-benchmark
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "--benchmark-disable" ];
+
+  disabledTests = [
+    # TypeError: loads() got an unexpected keyword argument 'name'
+    "test_load_data_toml"
+  ];
 
   preCheck = ''
-    cd tests
+    rm -rf rtoml
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/s3fs/default.nix b/pkgs/development/python-modules/s3fs/default.nix
index 5869e9af74d9..426e65615bb0 100644
--- a/pkgs/development/python-modules/s3fs/default.nix
+++ b/pkgs/development/python-modules/s3fs/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "s3fs";
-  version = "2024.3.1";
+  version = "2024.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-G4vI29Zee2D1SHN49u7/4d5ZqnLKqe/Kba1quHdAVIc=";
+    hash = "sha256-pZAg7e3GHpZm8eRzzkqih2Tl97PJdBS+sVzZvlIqh7Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sabctools/default.nix b/pkgs/development/python-modules/sabctools/default.nix
index b41c3c18a799..c8e1e294ef1d 100644
--- a/pkgs/development/python-modules/sabctools/default.nix
+++ b/pkgs/development/python-modules/sabctools/default.nix
@@ -7,12 +7,12 @@
 }:
 buildPythonPackage rec {
   pname = "sabctools";
-  version = "8.2.0"; # needs to match version sabnzbd expects, e.g. https://github.com/sabnzbd/sabnzbd/blob/4.0.x/requirements.txt#L3
+  version = "8.2.3"; # needs to match version sabnzbd expects, e.g. https://github.com/sabnzbd/sabnzbd/blob/4.0.x/requirements.txt#L3
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dOMNZoKWQxHJt6yHiNKVtpnYvLJkK8nktOm+djsSTcM=";
+    hash = "sha256-cP3GCp2mGivtjyA76vqtO7mJyZjHeNkvBLl2kXxOT5w=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/safety-schemas/default.nix b/pkgs/development/python-modules/safety-schemas/default.nix
index 14774300b1f3..c94427bdf083 100644
--- a/pkgs/development/python-modules/safety-schemas/default.nix
+++ b/pkgs/development/python-modules/safety-schemas/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   hatchling,
-  pythonRelaxDepsHook,
   dparse,
   packaging,
   pydantic,
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "dparse" ];
diff --git a/pkgs/development/python-modules/safety/default.nix b/pkgs/development/python-modules/safety/default.nix
index 2399e4e977fe..3999897c9082 100644
--- a/pkgs/development/python-modules/safety/default.nix
+++ b/pkgs/development/python-modules/safety/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   click,
   urllib3,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index c96ad040dc2c..c8897cf3b7a6 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   fetchpatch,
-  pythonRelaxDepsHook,
   setuptools,
   attrs,
   boto3,
@@ -60,7 +59,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/sarif-tools/default.nix b/pkgs/development/python-modules/sarif-tools/default.nix
index 20fdc0343457..911e21198b8a 100644
--- a/pkgs/development/python-modules/sarif-tools/default.nix
+++ b/pkgs/development/python-modules/sarif-tools/default.nix
@@ -11,7 +11,6 @@
   pyyaml,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/scalene/default.nix b/pkgs/development/python-modules/scalene/default.nix
index 1d635edbedd9..4d2f02313d48 100644
--- a/pkgs/development/python-modules/scalene/default.nix
+++ b/pkgs/development/python-modules/scalene/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "scalene";
-  version = "1.5.41";
+  version = "1.5.42.2";
   pyproject = true;
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-akjxv9Qot2lGntZxkxfFqz65VboL1qduykfjyEg1Ivg=";
+    hash = "sha256-0ZGk0xFBFSeeg4vjNXu/ppGdEKGhUc2ql4R6oWG23aQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index 0010df2ab13c..4df6f0af21f0 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -9,7 +9,6 @@
   mypy,
   mypy-extensions,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   rdflib,
   requests,
diff --git a/pkgs/development/python-modules/schema/default.nix b/pkgs/development/python-modules/schema/default.nix
index 7bf1de67593b..9ffeb56f887d 100644
--- a/pkgs/development/python-modules/schema/default.nix
+++ b/pkgs/development/python-modules/schema/default.nix
@@ -5,22 +5,20 @@
   mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
   pname = "schema";
-  version = "0.7.5";
+  version = "0.7.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8GcXESxhiVyrxHB3UriHFuhCCogZ1xQEUB4RT5EEMZc=";
+    hash = "sha256-faVTq9KVihncJUfDiM3lM5izkZYXWpvlnqHK9asKGAc=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [ "contextlib2" ];
 
diff --git a/pkgs/development/python-modules/schwifty/default.nix b/pkgs/development/python-modules/schwifty/default.nix
index a3b5467b70d7..6a3c7d25f9cf 100644
--- a/pkgs/development/python-modules/schwifty/default.nix
+++ b/pkgs/development/python-modules/schwifty/default.nix
@@ -11,6 +11,7 @@
   importlib-resources,
   iso3166,
   pycountry,
+  rstr,
 
   # optional-dependencies
   pydantic,
@@ -23,34 +24,35 @@
 
 buildPythonPackage rec {
   pname = "schwifty";
-  version = "2024.4.0";
+  version = "2024.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1EV2oi2LBcjw2U7nKqdVUVDlFCzR8RqX5tVIciw1trg=";
+    hash = "sha256-32+YpDIXcgldwtxU5s9V6cong70EiyEgf9QCNYdEvp0=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     hatchling
     hatch-vcs
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     iso3166
     pycountry
+    rstr
   ] ++ lib.optionals (pythonOlder "3.12") [ importlib-resources ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     pydantic = [ pydantic ];
   };
 
   nativeCheckInputs = [
     pytest-cov
     pytestCheckHook
-  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "schwifty" ];
 
diff --git a/pkgs/development/python-modules/scikit-build-core/default.nix b/pkgs/development/python-modules/scikit-build-core/default.nix
index 91795a3484a5..f9081c6265c4 100644
--- a/pkgs/development/python-modules/scikit-build-core/default.nix
+++ b/pkgs/development/python-modules/scikit-build-core/default.nix
@@ -23,13 +23,13 @@
 
 buildPythonPackage rec {
   pname = "scikit-build-core";
-  version = "0.8.2";
+  version = "0.9.6";
   pyproject = true;
 
   src = fetchPypi {
     pname = "scikit_build_core";
     inherit version;
-    hash = "sha256-UOwkuVaMmqbicjPe6yl4kyvHmFYhKzBXXL+kBJZVxDY=";
+    hash = "sha256-e+r5M89zSsvrttlsApNlQQIkcJvN5o87C08MsD4FSTk=";
   };
 
   postPatch = lib.optionalString (pythonOlder "3.11") ''
@@ -73,6 +73,7 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # runs pip, requires network access
     "tests/test_custom_modules.py"
+    "tests/test_hatchling.py"
     "tests/test_pyproject_pep517.py"
     "tests/test_pyproject_pep518.py"
     "tests/test_pyproject_pep660.py"
diff --git a/pkgs/development/python-modules/scikit-fmm/default.nix b/pkgs/development/python-modules/scikit-fmm/default.nix
index b5ee709b7f62..fb58a91c68e5 100644
--- a/pkgs/development/python-modules/scikit-fmm/default.nix
+++ b/pkgs/development/python-modules/scikit-fmm/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  fetchpatch,
   fetchPypi,
   meson-python,
   numpy,
@@ -10,35 +9,15 @@
 
 buildPythonPackage rec {
   pname = "scikit-fmm";
-  version = "2023.4.2";
+  version = "2024.5.29";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-14ccR/ggdyq6kvJWUe8U5NJ96M45PArjwCqzxuJCPAs=";
+    pname = "scikit_fmm";
+    inherit version;
+    hash = "sha256-sy7J5UKXhuL5K8zr3lBulUMekwNlBFfC8C2VzguVTUE=";
   };
 
-  # TODO: Remove these patches after another stable release is made.
-  # For now, these allow us to build with Python 3.12+ by switching to Meson
-  # and off the deprecated distutils.
-  patches = [
-    (fetchpatch {
-      name = "first-try-at-meson-build.patch";
-      hash = "sha256-Kclg4YrQZL6ZSVsLh6X6DqdztPjDK35L5dp5PqYjzaY=";
-      url = "https://github.com/scikit-fmm/scikit-fmm/commit/a52c0eccb70077553607a5084152316d136b668b.patch";
-    })
-    (fetchpatch {
-      name = "work-in-progress-on-meson-build.patch";
-      hash = "sha256-WvSwBz7exqe1H+CqdoMfT5jEoIHnyt/nbc/CryuEKiA=";
-      url = "https://github.com/scikit-fmm/scikit-fmm/commit/db0e7a5f51541745027c3d081d7841e74587793e.patch";
-    })
-    (fetchpatch {
-      name = "re-cythonize-the-heap-wrapper.patch";
-      hash = "sha256-ro97+06R0szXQ9I8/sR4JAnFxoQwJeiImDcl1Yp9P0Y=";
-      url = "https://github.com/scikit-fmm/scikit-fmm/commit/4168323e209343facd5f6ba93a85893242e781a2.patch";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "oldest-supported-numpy" "numpy"
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index 591df46640db..717a732327f7 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -7,16 +7,14 @@
   # build-system
   cython,
   gfortran,
+  meson-python,
   numpy,
   scipy,
-  setuptools,
-  wheel,
 
   # native dependencies
   glibcLocales,
   llvmPackages,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pytest-xdist,
   pillow,
   joblib,
@@ -26,20 +24,24 @@
 
 buildPythonPackage rec {
   pname = "scikit-learn";
-  version = "1.4.2";
+  version = "1.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-2qHEcdlbrQgMbkS0lGyTkKSEKtwwglcsIOT4iE456Vk=";
+    pname = "scikit_learn";
+    inherit version;
+    hash = "sha256-eJ49sBx1DtbUlvott9UGN4V7RR5XvK6GO/9wfBJHvvc=";
   };
 
-  # Avoid build-system requirements causing failure
-  prePatch = ''
+  postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "numpy==2.0.0rc1" "numpy"
+      --replace-fail "numpy>=2.0.0rc2" "numpy"
+
+    substituteInPlace meson.build --replace-fail \
+      "run_command('sklearn/_build_utils/version.py', check: true).stdout().strip()," \
+      "'${version}',"
   '';
 
   buildInputs = [
@@ -50,15 +52,13 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gfortran
-    pythonRelaxDepsHook
   ];
 
   build-system = [
     cython
+    meson-python
     numpy
     scipy
-    setuptools
-    wheel
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/scikits-odes/default.nix b/pkgs/development/python-modules/scikits-odes/default.nix
index 7d2c270482e7..f5ddb753ffaf 100644
--- a/pkgs/development/python-modules/scikits-odes/default.nix
+++ b/pkgs/development/python-modules/scikits-odes/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  pythonAtLeast,
   cython,
   enum34,
   gfortran,
@@ -18,7 +19,8 @@ buildPythonPackage rec {
   pname = "scikits.odes";
   version = "2.7.0";
 
-  disabled = isPy27;
+  # https://github.com/bmcage/odes/issues/130
+  disabled = isPy27 || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 1bd02b708089..43e256b1fba6 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -5,8 +5,8 @@
   fetchpatch,
   fetchurl,
   writeText,
+  xcbuild,
   python,
-  pythonOlder,
   buildPythonPackage,
   cython,
   gfortran,
@@ -22,8 +22,11 @@
   numpy,
   pybind11,
   pooch,
-  libxcrypt,
   xsimd,
+  # Upstream has support for using Darwin's Accelerate package. However this
+  # requires a Darwin user to work on a nice way to do that via an override.
+  # See:
+  # https://github.com/scipy/scipy/blob/v1.14.0/scipy/meson.build#L194-L211
   blas,
   lapack,
 
@@ -38,8 +41,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.13.1";
-  srcHash = "sha256-KpTvBJhiJ/IBjIFQhvS+NhRP3tbyXU5gQnAiFv47sKU=";
+  version = "1.14.0";
+  srcHash = "sha256-rNplvbDExmMfcPuvhs+y9j5/9G6QR1GdMgQLty6oi2c=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
@@ -100,6 +103,12 @@ buildPythonPackage {
     pkg-config
     wheel
     setuptools
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Minimal version required according to:
+    # https://github.com/scipy/scipy/blob/v1.14.0/scipy/meson.build#L185-L188
+    (xcbuild.override {
+      sdkVer = "13.3";
+    })
   ];
 
   buildInputs = [
@@ -108,7 +117,7 @@ buildPythonPackage {
     pybind11
     pooch
     xsimd
-  ] ++ lib.optionals (pythonOlder "3.9") [ libxcrypt ];
+  ];
 
   propagatedBuildInputs = [ numpy ];
 
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index 3a31a78f2d85..e05a957ab9cf 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "scmrepo";
-  version = "3.3.1";
+  version = "3.3.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "scmrepo";
     rev = "refs/tags/${version}";
-    hash = "sha256-swv5uWsyM4mEXlurizUewnbdAOtjWgvzCO9IPfz2ZPE=";
+    hash = "sha256-wmziU00n2EjpXw8f1NwFRTUvpOftj+wa9ZiXVDh5hco=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/scramp/default.nix b/pkgs/development/python-modules/scramp/default.nix
index db2a741ccd4f..53a8faaaa7ee 100644
--- a/pkgs/development/python-modules/scramp/default.nix
+++ b/pkgs/development/python-modules/scramp/default.nix
@@ -3,18 +3,17 @@
   asn1crypto,
   buildPythonPackage,
   fetchFromGitHub,
-  importlib-metadata,
+  hatchling,
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  setuptools,
-  wheel,
+  versioningit,
 }:
 
 buildPythonPackage rec {
   pname = "scramp";
-  version = "1.4.4";
-  format = "pyproject";
+  version = "1.4.5";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,15 +21,15 @@ buildPythonPackage rec {
     owner = "tlocke";
     repo = "scramp";
     rev = version;
-    hash = "sha256-WOyv1fLSXG7p+WKs2QSwlsh8FSK/lxp6I1hPY0VIkKo=";
+    hash = "sha256-KpododRJ+CYRGBR7Sr5cVBhJvUwh9YmPERd/DAJqEcY=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
+  build-system = [
+    hatchling
+    versioningit
   ];
 
-  propagatedBuildInputs = [ asn1crypto ] ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  dependencies = [ asn1crypto ];
 
   nativeCheckInputs = [
     pytest-mock
diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index c97b5fc5598a..f291798d0500 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -19,6 +19,7 @@
   protego,
   pydispatcher,
   pyopenssl,
+  pytest-xdist,
   pytestCheckHook,
   pythonOlder,
   queuelib,
@@ -47,6 +48,9 @@ buildPythonPackage rec {
     hash = "sha256-EaO1kQ3VSTwEW+r0kSKycOxHNTPwwCVjch1ZBrTU0qQ=";
   };
 
+  pythonRelaxDeps = [
+    "defusedxml"
+  ];
 
   nativeBuildInputs = [
     installShellFiles
@@ -78,6 +82,7 @@ buildPythonPackage rec {
     glibcLocales
     jmespath
     pexpect
+    pytest-xdist
     pytestCheckHook
     sybil
     testfixtures
diff --git a/pkgs/development/python-modules/selenium/default.nix b/pkgs/development/python-modules/selenium/default.nix
index 4865e3f6636d..9009d6bf3c4f 100644
--- a/pkgs/development/python-modules/selenium/default.nix
+++ b/pkgs/development/python-modules/selenium/default.nix
@@ -9,6 +9,7 @@
   trio,
   trio-websocket,
   typing-extensions,
+  websocket-client,
   urllib3,
   pytest-trio,
   nixosTests,
@@ -18,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "selenium";
-  version = "4.18.1";
+  version = "4.22.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +29,7 @@ buildPythonPackage rec {
     repo = "selenium";
     # check if there is a newer tag with or without -python suffix
     rev = "refs/tags/selenium-${version}";
-    hash = "sha256-1C9Epsk9rFlShxHGGzbWl6smrMzPn2h3yCWlzUIMpY8=";
+    hash = "sha256-qBuZgI5SSBwxbSBrAT0W/HzzV2JmPL00hPJ6s57QTeg=";
   };
 
   preConfigure = ''
@@ -61,6 +62,7 @@ buildPythonPackage rec {
     trio-websocket
     urllib3
     typing-extensions
+    websocket-client
   ] ++ urllib3.optional-dependencies.socks;
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/setuptools-scm/default.nix b/pkgs/development/python-modules/setuptools-scm/default.nix
index afd117ae3bcf..cc82356de85a 100644
--- a/pkgs/development/python-modules/setuptools-scm/default.nix
+++ b/pkgs/development/python-modules/setuptools-scm/default.nix
@@ -19,23 +19,24 @@
 
 buildPythonPackage rec {
   pname = "setuptools-scm";
-  version = "8.0.4";
+  version = "8.1.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-tfQ/9oAGaVlRk/0JiRVk7p0dfcsZbKtLJQbVOi4clcc=";
+    pname = "setuptools_scm";
+    inherit version;
+    hash = "sha256-Qt6htldxy6k7elFdZaZdgkblYHaKZrkQalksjn8myKc=";
   };
 
-  nativeBuildInputs = [ setuptools ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];
+  build-system = [ setuptools ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     packaging
     setuptools
     typing-extensions
   ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     rich = [ rich ];
   };
 
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 5e82d06858c9..3bc6b0f9a6b1 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "setuptools";
-  version = "69.5.1";
+  version = "70.0.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "setuptools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-X0ntFlDIhUjxtWzz0LxybQSuxhRpHlMeBYtOGwqDl4A=";
+    hash = "sha256-LXF3R9zfWylvihP2M8N94/IlgifwxUwKJFhtvcXEPB0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/sev-snp-measure/default.nix b/pkgs/development/python-modules/sev-snp-measure/default.nix
index b5d706775987..886bdf993632 100644
--- a/pkgs/development/python-modules/sev-snp-measure/default.nix
+++ b/pkgs/development/python-modules/sev-snp-measure/default.nix
@@ -3,7 +3,6 @@
   cryptography,
   fetchFromGitHub,
   lib,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -22,7 +21,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "cryptography" ];
diff --git a/pkgs/development/python-modules/sfrbox-api/default.nix b/pkgs/development/python-modules/sfrbox-api/default.nix
index b4ee4fdebb4d..25722095f432 100644
--- a/pkgs/development/python-modules/sfrbox-api/default.nix
+++ b/pkgs/development/python-modules/sfrbox-api/default.nix
@@ -27,10 +27,10 @@ buildPythonPackage rec {
     hash = "sha256-rMfX9vA8IuWxXvVs4WYNHO6neeoie/3gABwhXyJoAF8=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'pydantic = ">=1.10.2"' 'pydantic = "*"'
-  '';
+  pythonRelaxDeps = [
+    "defusedxml"
+    "pydantic"
+  ];
 
   nativeBuildInputs = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/signalslot/default.nix b/pkgs/development/python-modules/signalslot/default.nix
index 18c3db8a45ba..0dcd54334666 100644
--- a/pkgs/development/python-modules/signalslot/default.nix
+++ b/pkgs/development/python-modules/signalslot/default.nix
@@ -3,7 +3,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   contexter,
   eventlet,
   mock,
@@ -28,7 +27,6 @@ buildPythonPackage rec {
       --replace "--cov-report html" ""
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     contexter
diff --git a/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix b/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix
index a45134a1cbd1..043b47e24310 100644
--- a/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix
+++ b/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "sigstore-protobuf-specs";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "sigstore_protobuf_specs";
     inherit version;
-    hash = "sha256-xAthl1uVeukG6ymlvHBA7AFbaLa0YAXMWAXmKUk+jew=";
+    hash = "sha256-yuBBtAUCYAuKYz9DwldpXQIiqU76HlEQp+x62njDnZk=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/sisyphus-control/default.nix b/pkgs/development/python-modules/sisyphus-control/default.nix
index 1ca675582ca7..eeaaea1cb01e 100644
--- a/pkgs/development/python-modules/sisyphus-control/default.nix
+++ b/pkgs/development/python-modules/sisyphus-control/default.nix
@@ -7,7 +7,6 @@
   python-engineio,
   python-socketio,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -29,7 +28,6 @@ buildPythonPackage rec {
     "python-socketio"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/skl2onnx/default.nix b/pkgs/development/python-modules/skl2onnx/default.nix
index 32c482e71064..8d258c18883c 100644
--- a/pkgs/development/python-modules/skl2onnx/default.nix
+++ b/pkgs/development/python-modules/skl2onnx/default.nix
@@ -11,7 +11,6 @@
   onnxruntime,
   pandas,
   unittestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -33,7 +32,6 @@ buildPythonPackage rec {
     onnxconverter-common
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "scikit-learn" ];
 
diff --git a/pkgs/development/python-modules/skorch/default.nix b/pkgs/development/python-modules/skorch/default.nix
index 9351d806b154..19048dfc9ca8 100644
--- a/pkgs/development/python-modules/skorch/default.nix
+++ b/pkgs/development/python-modules/skorch/default.nix
@@ -20,12 +20,12 @@
 
 buildPythonPackage rec {
   pname = "skorch";
-  version = "0.15.0";
+  version = "1.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-39XVBlCmbg162z9uL84GZrU+v+M8waXbGdVV72ZYf84=";
+    hash = "sha256-JcplwaeYlGRAJXRNac1Ya/hgWoHE+NWjZhCU9eaSyRQ=";
   };
 
   # Remove at next skorch release:
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index f7d7743ef6e5..cfc61601b34d 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -19,7 +19,6 @@
   pyjwt,
   pyopenssl,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   requests,
   setuptools,
@@ -31,14 +30,15 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "3.8.1";
+  version = "3.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-m8zhoNniEs7s9F7c6gLRjiBalfiMwEcK2kqLrLVCR9U=";
+    pname = "snowflake_connector_python";
+    inherit version;
+    hash = "sha256-MWnAFKA+X1hVESYF45OJelUuVYlTxp8loC4zsZmIZNA=";
   };
 
   build-system = [
@@ -47,7 +47,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     asn1crypto
diff --git a/pkgs/development/python-modules/sockjs/default.nix b/pkgs/development/python-modules/sockjs/default.nix
index 0cb52beb9724..da423a473052 100644
--- a/pkgs/development/python-modules/sockjs/default.nix
+++ b/pkgs/development/python-modules/sockjs/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "sockjs";
-  version = "0.11.0";
+  version = "0.13.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "A0fUBO2e8xllBnh+2AGPh+5OLQuupJ1CDN1TqWm+wik=";
+    sha256 = "sha256-V+lZoj8gqNVRSdHl2ws7hwcm8rStgWbUG9z0EbNs33Y=";
   };
 
   propagatedBuildInputs = [ aiohttp ];
diff --git a/pkgs/development/python-modules/sopel/default.nix b/pkgs/development/python-modules/sopel/default.nix
index 01b118baf22f..54943d0cb625 100644
--- a/pkgs/development/python-modules/sopel/default.nix
+++ b/pkgs/development/python-modules/sopel/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "sopel";
-  version = "7.1.9";
+  version = "8.0.0";
   format = "setuptools";
 
   disabled = isPyPy || pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IJ+ovLQv6/UU1oepmUQjzaWBG3Rdd3xvui7FjK85Urs=";
+    hash = "sha256-juLJp0Et5qMZwBZzw0e4tKg1cBYqAsH8KUzqNoIP70U=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/soundcloud-v2/default.nix b/pkgs/development/python-modules/soundcloud-v2/default.nix
index 7713c7d6d547..7b46166ec2f4 100644
--- a/pkgs/development/python-modules/soundcloud-v2/default.nix
+++ b/pkgs/development/python-modules/soundcloud-v2/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "soundcloud-v2";
-  version = "1.3.7";
+  version = "1.3.8";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-DiaCnIEXKSxyE4+MCq0KwdKWUGfWO3LAVwsMNEkOmqc=";
+    sha256 = "sha256-wcRjzLnPvpz4zWhV7LxAJ6+BDvkI1MexdgL4nBjJwbg=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/spacy-transformers/default.nix b/pkgs/development/python-modules/spacy-transformers/default.nix
index 5d5e08197fa1..ddc71b75eac5 100644
--- a/pkgs/development/python-modules/spacy-transformers/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/default.nix
@@ -6,7 +6,6 @@
   fetchFromGitHub,
   setuptools,
   cython,
-  pythonRelaxDepsHook,
   spacy,
   numpy,
   transformers,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
     cython
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     spacy
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index d84599ffc812..0f47280570c6 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -22,7 +22,6 @@
   pytestCheckHook,
   python,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   spacy-legacy,
@@ -42,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "spacy";
-  version = "3.7.4";
+  version = "3.7.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ul8s7S5AdhViyMrOk+9qHm6MSD8nvVZLwbFfYI776Fs=";
+    hash = "sha256-pkjGy/Ksx6Vaae6ef6TyK99pqoKKWHobxc//CM88LdM=";
   };
 
   pythonRelaxDeps = [
@@ -58,7 +57,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     cython_0
   ];
 
diff --git a/pkgs/development/python-modules/sphinx-autoapi/default.nix b/pkgs/development/python-modules/sphinx-autoapi/default.nix
index 637c214345c4..1a25fef81c24 100644
--- a/pkgs/development/python-modules/sphinx-autoapi/default.nix
+++ b/pkgs/development/python-modules/sphinx-autoapi/default.nix
@@ -22,19 +22,20 @@
 
 buildPythonPackage rec {
   pname = "sphinx-autoapi";
-  version = "3.0.0";
-  format = "pyproject";
+  version = "3.1.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-CevWdKMrREZyIrD7ipF7l8iVI/INvwW1LLij8OFXFN4=";
+    pname = "sphinx_autoapi";
+    inherit version;
+    hash = "sha256-tfbjxhzYbAzbfud6nVgMD9EWcmxbKc3LHx1fMKW8ob0=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     anyascii
     astroid
     jinja2
diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index 733750844dc9..7d3030c7226a 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -11,7 +11,7 @@
 
 let
   pname = "sphinx-autodoc-typehints";
-  version = "2.1.0";
+  version = "2.1.1";
 in
 
 buildPythonPackage {
@@ -23,7 +23,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "sphinx_autodoc_typehints";
     inherit version;
-    hash = "sha256-Ub+Nx3xPunR+MvBzUAKpFQB0fQVTyuYWhjhI6PXkn+g=";
+    hash = "sha256-AHK2X1qygYwinW1sLMmTdwr1XTa7e/sWAB4vzk0UiAw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-mdinclude/default.nix b/pkgs/development/python-modules/sphinx-mdinclude/default.nix
index 0ac245d87bfd..f938f267eb65 100644
--- a/pkgs/development/python-modules/sphinx-mdinclude/default.nix
+++ b/pkgs/development/python-modules/sphinx-mdinclude/default.nix
@@ -17,13 +17,13 @@
 
 buildPythonPackage rec {
   pname = "sphinx-mdinclude";
-  version = "0.5.3";
+  version = "0.6.1";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "sphinx_mdinclude";
     inherit version;
-    hash = "sha256-KZjj0YswIsmYPRtyGR/jfiX/zNVBZcvjrLIszu3ZGvQ=";
+    hash = "sha256-7OPYEuLVWbTn5H9ntqh7Dipom2svURR5XI7Uf/s5wWk=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/sphinx-prompt/default.nix b/pkgs/development/python-modules/sphinx-prompt/default.nix
index 2d7a0074ede8..57fa112da926 100644
--- a/pkgs/development/python-modules/sphinx-prompt/default.nix
+++ b/pkgs/development/python-modules/sphinx-prompt/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build-system
   poetry-core,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
index d2ed00bed59c..b53a9849ac06 100644
--- a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
+++ b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
@@ -7,7 +7,6 @@
   readthedocs-sphinx-ext,
   sphinxcontrib-jquery,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -32,7 +31,6 @@ buildPythonPackage rec {
     sphinxcontrib-jquery
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index e781abafac19..16e2a81e5043 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -1,8 +1,10 @@
 {
   lib,
   buildPythonPackage,
+  pythonAtLeast,
   pythonOlder,
   fetchFromGitHub,
+  fetchpatch2,
   isPyPy,
 
   # build-system
@@ -56,6 +58,14 @@ buildPythonPackage rec {
     hash = "sha256-XGGRWEvd1SbQsK8W5yxDzBd5hlvXcDzr8t5Qa6skH/M=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "python-3.13-compat.patch";
+      url = "https://github.com/sphinx-doc/sphinx/commit/3496de62b743942115acb486cf35dfcc102586c3.patch";
+      hash = "sha256-5VBPOQeGyj3a8VBq4hc9S/eKaeVZeGCTNislwgsauZo=";
+    })
+  ];
+
   build-system = [ flit-core ];
 
   dependencies =
@@ -116,6 +126,10 @@ buildPythonPackage rec {
       # Could not fetch remote image: http://localhost:7777/sphinx.png
       "test_copy_images"
     ]
+    ++ lib.optionals (pythonAtLeast "3.12") [
+      # https://github.com/sphinx-doc/sphinx/issues/12430
+      "test_autodoc_type_aliases"
+    ]
     ++ lib.optionals isPyPy [
       # PyPy has not __builtins__ which get asserted
       # https://doc.pypy.org/en/latest/cpython_differences.html#miscellaneous
diff --git a/pkgs/development/python-modules/sphinxawesome-theme/default.nix b/pkgs/development/python-modules/sphinxawesome-theme/default.nix
index 8d073b7fe123..8d028f2c63e7 100644
--- a/pkgs/development/python-modules/sphinxawesome-theme/default.nix
+++ b/pkgs/development/python-modules/sphinxawesome-theme/default.nix
@@ -5,7 +5,6 @@
   poetry-core,
   sphinx,
   beautifulsoup4,
-  pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -19,7 +18,7 @@ buildPythonPackage rec {
     hash = "sha256-wk8eXAueR1OA0W/F8fO/2ElVgX2gkF2V9+IICdfNPF0=";
   };
 
-  build-system = [ poetry-core pythonRelaxDepsHook ];
+  build-system = [ poetry-core ];
   dependencies = [
     sphinx
     beautifulsoup4
diff --git a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
index 15d1c9f1eaae..6716a3ba7902 100644
--- a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
@@ -3,25 +3,29 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
+  setuptools,
   sphinx,
+  pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-katex";
-  version = "0.9.9";
-  format = "setuptools";
+  version = "0.9.10";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-1ZTILfVLBI1Z1I5GsQn2IhezEaublSCMq5bZAvmj/ik=";
+    pname = "sphinxcontrib_katex";
+    inherit version;
+    hash = "sha256-MJqS2uJF28WE/36l+2VJcnuuleTlIAi3TSWdL9GtDew=";
   };
 
-  propagatedBuildInputs = [ sphinx ];
+  build-system = [ setuptools ];
 
-  # There are no unit tests
-  doCheck = false;
+  dependencies = [ sphinx ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "sphinxcontrib.katex" ];
 
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index 0e0d56aa027e..64f8c2648941 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   asn1crypto,
   astunparse,
   bincopy,
@@ -51,7 +50,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/sqlalchemy-continuum/default.nix b/pkgs/development/python-modules/sqlalchemy-continuum/default.nix
index b045fa3c6b24..10ea12e7fefa 100644
--- a/pkgs/development/python-modules/sqlalchemy-continuum/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-continuum/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   flask,
   flask-login,
   flask-sqlalchemy,
@@ -16,23 +17,25 @@
 
 buildPythonPackage rec {
   pname = "sqlalchemy-continuum";
-  version = "1.4.1";
-  format = "setuptools";
+  version = "1.4.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    pname = "SQLAlchemy-Continuum";
+    pname = "sqlalchemy_continuum";
     inherit version;
-    hash = "sha256-4BZGzfv9azGiGwrrprv/ZhJY1b6Ed8dQDKs6HHSEjm4=";
+    hash = "sha256-D9K+efcY7aR8IgaHnZLsTr8YiTZGN7PK8+5dNL0ZyOM=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     sqlalchemy
     sqlalchemy-utils
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     flask = [ flask ];
     flask-login = [ flask-login ];
     flask-sqlalchemy = [ flask-sqlalchemy ];
@@ -43,10 +46,12 @@ buildPythonPackage rec {
     psycopg2
     pymysql
     pytestCheckHook
-  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
-  # Indicate tests that we don't have a database server at hand
-  env.DB = "sqlite";
+  preCheck = ''
+    # Indicate tests that we don't have a database server at hand
+    export DB=sqlite
+  '';
 
   pythonImportsCheck = [ "sqlalchemy_continuum" ];
 
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 0c9ddbe50744..a40b2897cdab 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -41,7 +41,7 @@
 
 buildPythonPackage rec {
   pname = "sqlalchemy";
-  version = "2.0.30";
+  version = "2.0.31";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-l6VxBK4RT/sAFkz3g633MrfQH9Bvp/JE12mdtqjsxd8=";
+    hash = "sha256-+bF7pdz8bxkR+mbrOI773qLoZVzBHpzKOENWPEuVFt8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index ef5ed3f808a9..73fb920314c9 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -40,11 +40,11 @@ buildPythonPackage rec {
     hash = "sha256-GiCN1sfhLu9i19d2OcLZrlY8E64DFrFh+ITRSvLaxdE=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [ anyio ] ++ lib.optionals (pythonOlder "3.10") [ typing-extensions ];
+  dependencies = [ anyio ] ++ lib.optionals (pythonOlder "3.10") [ typing-extensions ];
 
-  passthru.optional-dependencies.full = [
+  optional-dependencies.full = [
     itsdangerous
     jinja2
     python-multipart
@@ -56,7 +56,7 @@ buildPythonPackage rec {
     pytestCheckHook
     trio
     typing-extensions
-  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pytestFlagsArray = [
     "-W"
diff --git a/pkgs/development/python-modules/steamship/default.nix b/pkgs/development/python-modules/steamship/default.nix
index b1f2fb500195..ef61a2397064 100644
--- a/pkgs/development/python-modules/steamship/default.nix
+++ b/pkgs/development/python-modules/steamship/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   setuptools-scm,
-  pythonRelaxDepsHook,
   requests,
   pydantic,
   aiohttp,
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/streamlit/default.nix b/pkgs/development/python-modules/streamlit/default.nix
index 84e66c60be23..c30512d1171d 100644
--- a/pkgs/development/python-modules/streamlit/default.nix
+++ b/pkgs/development/python-modules/streamlit/default.nix
@@ -19,7 +19,6 @@
   pympler,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   requests,
   rich,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index 51b956b1a547..3823eb4ea1b9 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "9.9.0";
+  version = "9.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xC2Pa0RjpU86AlWBgQ9OYy4tWnHeYQD8WV11WB9ppJI=";
+    hash = "sha256-y8Umq9DwAckgwyO6fEDM497hZH2SDp2+yuNIjzc2dSQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/subprocess-tee/default.nix b/pkgs/development/python-modules/subprocess-tee/default.nix
index 7c95ab66fbd8..1ca46a465206 100644
--- a/pkgs/development/python-modules/subprocess-tee/default.nix
+++ b/pkgs/development/python-modules/subprocess-tee/default.nix
@@ -1,7 +1,8 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
   setuptools-scm,
   pytestCheckHook,
   enrich,
@@ -9,15 +10,20 @@
 
 buildPythonPackage rec {
   pname = "subprocess-tee";
-  version = "0.4.1";
-  format = "pyproject";
+  version = "0.4.2";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-s8EkmT+LiNHrHC/eC8IGl4fqxyC6iHccuhfoyTMkgl0=";
+  src = fetchFromGitHub {
+    owner = "pycontribs";
+    repo = "subprocess-tee";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-rfI4UZdENfSQ9EbQeldv6DDGIQe5yMjboGTCOwed1AU=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
@@ -36,6 +42,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/pycontribs/subprocess-tee";
     description = "Subprocess.run drop-in replacement that supports a tee mode";
+    changelog = "https://github.com/pycontribs/subprocess-tee/releases/tag/${src.rev}";
     license = licenses.mit;
     maintainers = with maintainers; [ putchar ];
   };
diff --git a/pkgs/development/python-modules/succulent/default.nix b/pkgs/development/python-modules/succulent/default.nix
index f46ae33d4c87..f039a30d522a 100644
--- a/pkgs/development/python-modules/succulent/default.nix
+++ b/pkgs/development/python-modules/succulent/default.nix
@@ -8,7 +8,6 @@
   pyyaml,
   poetry-core,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   toml-adapt,
   xmltodict,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index 622100c10fdc..afabfff242f2 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "5.1.2";
+  version = "5.1.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1/oz2Ir1K7nR6B2TPZzSjbyiADyQyRlzE9KqTg7EwkA=";
+    hash = "sha256-y+tw1I+C6wDFlJvObWrOhisrryQCeXulkwFyRCuAgTA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/svg2tikz/default.nix b/pkgs/development/python-modules/svg2tikz/default.nix
index 8d143ee4d58a..4c63ce7dbf61 100644
--- a/pkgs/development/python-modules/svg2tikz/default.nix
+++ b/pkgs/development/python-modules/svg2tikz/default.nix
@@ -7,7 +7,6 @@
   inkex,
   lxml,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -38,7 +37,6 @@ buildPythonPackage rec {
     "lxml"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/sympy/default.nix b/pkgs/development/python-modules/sympy/default.nix
index 2337f161b5b7..c9978724763b 100644
--- a/pkgs/development/python-modules/sympy/default.nix
+++ b/pkgs/development/python-modules/sympy/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "sympy";
-  version = "1.12";
+  version = "1.12.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6/WVyNrD4P3EFSxRh4tJg5bsfzDnqRTWBx5nTUlCD7g=";
+    hash = "sha256-KHewP5mM2MCPB80N5bdnEZzT70DQn0HDDXIvZoaw+4g=";
   };
 
   nativeCheckInputs = [ glibcLocales ];
diff --git a/pkgs/development/python-modules/syncedlyrics/default.nix b/pkgs/development/python-modules/syncedlyrics/default.nix
index 72ac8b5794d3..08340ae69b9a 100644
--- a/pkgs/development/python-modules/syncedlyrics/default.nix
+++ b/pkgs/development/python-modules/syncedlyrics/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
   rapidfuzz,
   requests,
 }:
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "rapidfuzz" ];
diff --git a/pkgs/development/python-modules/synologydsm-api/default.nix b/pkgs/development/python-modules/synologydsm-api/default.nix
index c94e65db8117..6fc64f5baad7 100644
--- a/pkgs/development/python-modules/synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/synologydsm-api/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   fetchpatch,
   poetry-core,
-  pythonRelaxDepsHook,
   requests,
   urllib3,
   pytestCheckHook,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "urllib3" ];
diff --git a/pkgs/development/python-modules/tabcmd/default.nix b/pkgs/development/python-modules/tabcmd/default.nix
index e713fef830a7..7638e67378ae 100644
--- a/pkgs/development/python-modules/tabcmd/default.nix
+++ b/pkgs/development/python-modules/tabcmd/default.nix
@@ -12,7 +12,6 @@
   pytestCheckHook,
   python3,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   setuptools-scm,
@@ -47,7 +46,6 @@ buildPythonPackage rec {
     "urllib3"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/tableauserverclient/default.nix b/pkgs/development/python-modules/tableauserverclient/default.nix
index bc4141a03e01..e37539b18de6 100644
--- a/pkgs/development/python-modules/tableauserverclient/default.nix
+++ b/pkgs/development/python-modules/tableauserverclient/default.nix
@@ -6,7 +6,6 @@
   packaging,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   requests-mock,
   setuptools,
@@ -15,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "tableauserverclient";
-  version = "0.30";
+  version = "0.31";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MIE6V84xLEbgmTwvP6jQC0H//gBnMTO1sowL1HIMbpQ=";
+    hash = "sha256-e00/+yVKg7dGGq3Os+oWu/F93j5e9dnwWZxKwm+soqM=";
   };
 
   postPatch = ''
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
     versioneer
   ];
 
diff --git a/pkgs/development/python-modules/tago/default.nix b/pkgs/development/python-modules/tago/default.nix
index 974a7b44884f..eb42efff5689 100644
--- a/pkgs/development/python-modules/tago/default.nix
+++ b/pkgs/development/python-modules/tago/default.nix
@@ -6,7 +6,6 @@
   promise,
   python-socketio,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   websockets,
 }:
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/tagoio-sdk/default.nix b/pkgs/development/python-modules/tagoio-sdk/default.nix
index b32338821d66..4e2984a98721 100644
--- a/pkgs/development/python-modules/tagoio-sdk/default.nix
+++ b/pkgs/development/python-modules/tagoio-sdk/default.nix
@@ -8,7 +8,6 @@
   python-dateutil,
   python-socketio,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   requests-mock,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/taskw-ng/default.nix b/pkgs/development/python-modules/taskw-ng/default.nix
index 15f6412831d6..90f9ce35ed88 100644
--- a/pkgs/development/python-modules/taskw-ng/default.nix
+++ b/pkgs/development/python-modules/taskw-ng/default.nix
@@ -8,7 +8,6 @@
   poetry-dynamic-versioning,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   taskwarrior,
 }:
@@ -37,7 +36,6 @@ buildPythonPackage rec {
     poetry-dynamic-versioning
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     kitchen
diff --git a/pkgs/development/python-modules/tbm-utils/default.nix b/pkgs/development/python-modules/tbm-utils/default.nix
index fbd675bd2ebf..f2cec77022a7 100644
--- a/pkgs/development/python-modules/tbm-utils/default.nix
+++ b/pkgs/development/python-modules/tbm-utils/default.nix
@@ -10,7 +10,6 @@
   pprintpp,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   wrapt,
 }:
 
@@ -52,7 +51,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     attrs
diff --git a/pkgs/development/python-modules/tempora/default.nix b/pkgs/development/python-modules/tempora/default.nix
index 50f4b0eca641..6c2a136d831e 100644
--- a/pkgs/development/python-modules/tempora/default.nix
+++ b/pkgs/development/python-modules/tempora/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "tempora";
-  version = "5.5.1";
+  version = "5.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ortR4hIZdtkxNHs+QzkXw2S4P91fZO8nM2yGW/H7D3U=";
+    hash = "sha256-O/zBLL27uv7KrMuQl/w3VENbnQY9zkMzjk+ofTkQSu0=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/tenacity/default.nix b/pkgs/development/python-modules/tenacity/default.nix
index 134785e4e1fd..5ac8b3e2c963 100644
--- a/pkgs/development/python-modules/tenacity/default.nix
+++ b/pkgs/development/python-modules/tenacity/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "tenacity";
-  version = "8.2.3";
+  version = "8.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-U5jvDXjmP0AAfB+0wL/5bhkROU0vqNGU93YZwF/2zIo=";
+    hash = "sha256-VLFBK4eN334fFXfNSVJ7rYze8yQhvVmb6sDGw/EFgv0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tensorboard/default.nix b/pkgs/development/python-modules/tensorboard/default.nix
index 62b054d76f9a..2c09edbf60a4 100644
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@@ -3,7 +3,6 @@
   fetchPypi,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   numpy,
   wheel,
   werkzeug,
@@ -24,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "tensorboard";
-  version = "2.16.2";
+  version = "2.17.0";
   format = "wheel";
   disabled = pythonOlder "3.9";
 
@@ -32,10 +31,9 @@ buildPythonPackage rec {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-nytOfa2GZnYVwOXNBy8eqEA/wDKimfAHLW90hVd1zEU=";
+    hash = "sha256-hZpJmpsftooFiFiWRIZicQC3H8shZGhhxh0xhGpkePs=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [
     "google-auth-oauthlib"
diff --git a/pkgs/development/python-modules/terminaltexteffects/default.nix b/pkgs/development/python-modules/terminaltexteffects/default.nix
index 8cea46f094e6..78310f2fd967 100644
--- a/pkgs/development/python-modules/terminaltexteffects/default.nix
+++ b/pkgs/development/python-modules/terminaltexteffects/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "terminaltexteffects";
-  version = "0.10.1";
+  version = "0.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
    # no tests on pypi, no tags on github
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NyWPfdgLeXAxKPJOzB7j4aT+zjrURN59CGcv0Vt99y0=";
+    hash = "sha256-FDDLc7oAOgSpaxmuS6Wzej+vEOuSx3WT2ntpfoET3LI=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index f1b795fb641c..2561a15c763e 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "tesserocr";
-  version = "2.6.3";
+  version = "2.7.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-RMHE73vcKGz6FEzhoJfoHDMp9KQ1CbyElKGrhSM4xuE=";
+    sha256 = "sha256-RcCTYwM30Bpqj5d6JGrW1zLrEfLgcrsibVmtPSR4HJk=";
   };
 
   # https://github.com/sirfz/tesserocr/issues/314
diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index b097963861c5..6e98a9f3461e 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonAtLeast,
-  pythonRelaxDepsHook,
 
   # build-system
   hatchling,
@@ -15,18 +14,17 @@
 
 buildPythonPackage rec {
   pname = "testtools";
-  version = "2.7.1";
+  version = "2.7.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-323pYBDinuIfY3oUfqvzDVCyXjhB3R1o+T7onOd+Nmw=";
+    sha256 = "sha256-W+W7wfD6D4tgrKbO7AeEXUHQxHXPRFv6200sRew5fqM=";
   };
 
   nativeBuildInputs = [
     hatchling
     hatch-vcs
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [ "fixtures" ];
diff --git a/pkgs/development/python-modules/textnets/default.nix b/pkgs/development/python-modules/textnets/default.nix
index 9defe9da25ab..09b47a1b1207 100644
--- a/pkgs/development/python-modules/textnets/default.nix
+++ b/pkgs/development/python-modules/textnets/default.nix
@@ -10,7 +10,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scipy,
   setuptools,
   spacy,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     cython
     poetry-core
     setuptools
diff --git a/pkgs/development/python-modules/tf-keras/default.nix b/pkgs/development/python-modules/tf-keras/default.nix
index 0e0401159210..da7d2d6d869c 100644
--- a/pkgs/development/python-modules/tf-keras/default.nix
+++ b/pkgs/development/python-modules/tf-keras/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   wheel,
   numpy,
@@ -25,7 +24,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/tf2onnx/default.nix b/pkgs/development/python-modules/tf2onnx/default.nix
index 7c1926a11cbd..73c19842f103 100644
--- a/pkgs/development/python-modules/tf2onnx/default.nix
+++ b/pkgs/development/python-modules/tf2onnx/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   pytest-runner,
   # runtime dependencies
   numpy,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     pytest-runner
   ];
 
diff --git a/pkgs/development/python-modules/thelogrus/default.nix b/pkgs/development/python-modules/thelogrus/default.nix
index 433111926102..2ba9c5c1fd9b 100644
--- a/pkgs/development/python-modules/thelogrus/default.nix
+++ b/pkgs/development/python-modules/thelogrus/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   pyaml,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pyaml" ];
diff --git a/pkgs/development/python-modules/tifffile/default.nix b/pkgs/development/python-modules/tifffile/default.nix
index d2ffa700b8da..edde349d4125 100644
--- a/pkgs/development/python-modules/tifffile/default.nix
+++ b/pkgs/development/python-modules/tifffile/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2024.4.18";
+  version = "2024.6.18";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-X/zXe513w6raEnhjGvXIrHiEOEUv2i6xubYNVVPpXII=";
+    hash = "sha256-V+DSoDS8tih+oxVdhxZQjfrIZEOiV/ZQK1fuf4ozs7Y=";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/tilequant/default.nix b/pkgs/development/python-modules/tilequant/default.nix
index 66d735d966bd..e6f43890f564 100644
--- a/pkgs/development/python-modules/tilequant/default.nix
+++ b/pkgs/development/python-modules/tilequant/default.nix
@@ -6,7 +6,6 @@
   ordered-set,
   pillow,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-dso,
   sortedcollections,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pillow" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/tinycss2/default.nix b/pkgs/development/python-modules/tinycss2/default.nix
index 804d4efe5973..730bbfc4f4d7 100644
--- a/pkgs/development/python-modules/tinycss2/default.nix
+++ b/pkgs/development/python-modules/tinycss2/default.nix
@@ -10,18 +10,20 @@
 
 buildPythonPackage rec {
   pname = "tinycss2";
-  version = "1.2.1";
+  version = "1.3.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "kozea";
     repo = "tinycss2";
-    rev = "refs/tags/v${version}";
+
+    # Tag v1.3.0 is missing the actual version number bump.
+    rev = "bda62b101530588718d931d61bcc343a628b9af9";
     # for tests
     fetchSubmodules = true;
-    hash = "sha256-rJtxMmW30NK+E+Dhh/fu6FPrEojWWdoEWNt0raYEubs=";
+    hash = "sha256-Exjxdm0VnnjHUKjquXsC/zDmwA7bELHdX1f55IGBjYk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tlslite-ng/default.nix b/pkgs/development/python-modules/tlslite-ng/default.nix
index 266acc638b8f..450f40234378 100644
--- a/pkgs/development/python-modules/tlslite-ng/default.nix
+++ b/pkgs/development/python-modules/tlslite-ng/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  pythonAtLeast,
   ecdsa,
 }:
 
@@ -10,6 +11,9 @@ buildPythonPackage rec {
   version = "0.7.6";
   format = "setuptools";
 
+  # https://github.com/tlsfuzzer/tlslite-ng/issues/501
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "6ab56f0e9629ce3d807eb528c9112defa9f2e00af2b2961254e8429ca5c1ff00";
diff --git a/pkgs/development/python-modules/tomlkit/default.nix b/pkgs/development/python-modules/tomlkit/default.nix
index e398075acca8..85f9ed273b7d 100644
--- a/pkgs/development/python-modules/tomlkit/default.nix
+++ b/pkgs/development/python-modules/tomlkit/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "tomlkit";
-  version = "0.12.4";
+  version = "0.12.5";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fKHPwSIygGUXqFFQR7pmoZNp5x7fJDnQ9YJPkQMrbMM=";
+    hash = "sha256-7vNPujmDTU1rc8m6fz5NHEF6Tlb4mn6W4JDdDSS4+zw=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index cc08339f6e0f..40f26d282183 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -34,7 +34,6 @@
   which,
   pybind11,
   removeReferencesTo,
-  pythonRelaxDepsHook,
 
   # Build inputs
   numactl,
@@ -433,7 +432,6 @@ buildPythonPackage rec {
       which
       ninja
       pybind11
-      pythonRelaxDepsHook
       removeReferencesTo
     ]
     ++ lib.optionals cudaSupport (
diff --git a/pkgs/development/python-modules/torchdiffeq/default.nix b/pkgs/development/python-modules/torchdiffeq/default.nix
index ba3eda8cafbb..455450a718c1 100644
--- a/pkgs/development/python-modules/torchdiffeq/default.nix
+++ b/pkgs/development/python-modules/torchdiffeq/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "torchdiffeq";
-  version = "0.2.3";
+  version = "0.2.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/nX0NLkJCsDCdwLgK+0hRysPhwNb5lgfUe3F1AE+oxo=";
+    hash = "sha256-wOV8PIif7dp/I6YBXb/Nba5QcqBt1u0Q6CAMIAmEQEM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index afb6eeef5db3..38afe65df6cf 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -1,8 +1,8 @@
 {
   lib,
-  python,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pytestCheckHook,
 
   # for passthru.tests
@@ -20,16 +20,18 @@
 
 buildPythonPackage rec {
   pname = "tornado";
-  version = "6.3.3";
-  format = "setuptools";
+  version = "6.4.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tornadoweb";
     repo = "tornado";
     rev = "v${version}";
-    hash = "sha256-l9Ce/c2wDSmsySr9yXu5Fl/+63QkQay46aDSUTJmetA=";
+    hash = "sha256-vWiTLKL5gzrf3J6T3u8I1HHg5Ww0sf5ybSbZX6G3UXM=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/trafilatura/default.nix b/pkgs/development/python-modules/trafilatura/default.nix
index a8183bf3f841..720ead19e010 100644
--- a/pkgs/development/python-modules/trafilatura/default.nix
+++ b/pkgs/development/python-modules/trafilatura/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "trafilatura";
-  version = "1.9.0";
+  version = "1.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5oM9KauKE+2FOTfXyR5oaLxi774QIUrCsQZDbdI9FBI=";
+    hash = "sha256-exBXPi3Ra2cC9W9WhYsl80/4HWsW5CmvCjsmbwdGru4=";
   };
 
   # Patch out gui cli because it is not supported in this packaging and
diff --git a/pkgs/development/python-modules/traitlets/default.nix b/pkgs/development/python-modules/traitlets/default.nix
index cb657033ef24..09a4e2d944ac 100644
--- a/pkgs/development/python-modules/traitlets/default.nix
+++ b/pkgs/development/python-modules/traitlets/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "traitlets";
-  version = "5.14.2";
+  version = "5.14.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jN2DwEDat9He6CJnjl9dEAtRT3tysBYVsm/FcYkW/fk=";
+    hash = "sha256-ntBXnTUCyUtLNzKsEgN1zalvkjEUUihH3ks7uYuWtrc=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/treex/default.nix b/pkgs/development/python-modules/treex/default.nix
index 151e6f41ac7b..cc98867484a6 100644
--- a/pkgs/development/python-modules/treex/default.nix
+++ b/pkgs/development/python-modules/treex/default.nix
@@ -16,7 +16,6 @@
   tensorflow,
   treeo,
   torchmetrics,
-  pythonRelaxDepsHook,
   torch,
 }:
 
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   buildInputs = [ jaxlib ];
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index 2fcdd1be477e..302c5d975676 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -3,21 +3,14 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  isPy3k,
-  installShellFiles,
-  attrs,
   click,
   construct,
   construct-classes,
   ecdsa,
-  hidapi,
   libusb1,
   mnemonic,
-  pillow,
-  protobuf,
   requests,
-  shamir-mnemonic,
-  simple-rlp,
+  setuptools,
   typing-extensions,
   trezor-udev-rules,
   pytestCheckHook,
@@ -26,31 +19,23 @@
 buildPythonPackage rec {
   pname = "trezor";
   version = "0.13.9";
-  format = "setuptools";
-
-  disabled = !isPy3k;
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-lFC9e7nSPl4zo8nljhjwWLRMnZw0ymZLSYGnlaqfse8=";
   };
 
-  nativeBuildInputs = [ installShellFiles ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    attrs
+  dependencies = [
     click
     construct
     construct-classes
     ecdsa
-    hidapi
     libusb1
     mnemonic
-    pillow
-    protobuf
     requests
-    shamir-mnemonic
-    simple-rlp
     typing-extensions
   ] ++ lib.optionals stdenv.isLinux [ trezor-udev-rules ];
 
@@ -67,22 +52,12 @@ buildPythonPackage rec {
     $out/bin/trezorctl --version
   '';
 
-  postFixup = ''
-    mkdir completions
-    _TREZORCTL_COMPLETE=source_bash $out/bin/trezorctl > completions/trezorctl || true
-    _TREZORCTL_COMPLETE=source_zsh $out/bin/trezorctl > completions/_trezorctl || true
-    _TREZORCTL_COMPLETE=source_fish $out/bin/trezorctl > completions/trezorctl.fish || true
-    installShellCompletion --bash completions/trezorctl
-    installShellCompletion --zsh completions/_trezorctl
-    installShellCompletion --fish completions/trezorctl.fish
-  '';
-
   meta = with lib; {
     description = "Python library for communicating with Trezor Hardware Wallet";
     mainProgram = "trezorctl";
     homepage = "https://github.com/trezor/trezor-firmware/tree/master/python";
     changelog = "https://github.com/trezor/trezor-firmware/blob/python/v${version}/python/CHANGELOG.md";
-    license = licenses.gpl3;
+    license = licenses.lgpl3Only;
     maintainers = with maintainers; [
       np
       prusnak
diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 5f75a4331a4c..ec13fb857cee 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -11,14 +11,15 @@
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2024.4.10";
+    version = "2024.5.22";
     pyproject = true;
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-SfQLtqdGtyocuk+NVe6CUhac2g9wgC4/0k8Et/slpJI=";
+      pname = "trove_classifiers";
+      inherit version;
+      hash = "sha256-imJCu7XJrojTTPZl6Bayh9IhKXPId336717BjXKsHQM=";
     };
 
     postPatch = ''
diff --git a/pkgs/development/python-modules/tubeup/default.nix b/pkgs/development/python-modules/tubeup/default.nix
index a9dd6c8f5a50..3b351c3a608f 100644
--- a/pkgs/development/python-modules/tubeup/default.nix
+++ b/pkgs/development/python-modules/tubeup/default.nix
@@ -6,7 +6,6 @@
   yt-dlp,
   docopt,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -21,7 +20,6 @@ buildPythonPackage rec {
     sha256 = "sha256-Pp4h0MBoYhczmxPq21cLiYpLUeFP+2JoACcFpBl3b0E=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     internetarchive
diff --git a/pkgs/development/python-modules/tuya-device-sharing-sdk/default.nix b/pkgs/development/python-modules/tuya-device-sharing-sdk/default.nix
index c831f7a0108c..3179f22b5a5e 100644
--- a/pkgs/development/python-modules/tuya-device-sharing-sdk/default.nix
+++ b/pkgs/development/python-modules/tuya-device-sharing-sdk/default.nix
@@ -9,14 +9,14 @@
 }:
 let
   pname = "tuya-device-sharing-sdk";
-  version = "0.1.9";
+  version = "0.2.0";
 in
 buildPythonPackage {
   inherit pname version;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mBKR+ttBo0VF33pEmYdjbyM4bGgyDiYexIIsf8mXZW4=";
+    hash = "sha256-fu8zh59wlnxtstNbNL8mIm10tiXy22oPbi6oUy5x8c8=";
   };
 
   # workaround needed, upstream issue: https://github.com/tuya/tuya-device-sharing-sdk/issues/10
diff --git a/pkgs/development/python-modules/twill/default.nix b/pkgs/development/python-modules/twill/default.nix
index 3077cee0c6d1..9403f50f326b 100644
--- a/pkgs/development/python-modules/twill/default.nix
+++ b/pkgs/development/python-modules/twill/default.nix
@@ -7,7 +7,6 @@
   pyparsing,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   quixote,
   setuptools,
 }:
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     httpx
diff --git a/pkgs/development/python-modules/twine/default.nix b/pkgs/development/python-modules/twine/default.nix
index 5de355a1cc34..2002f84439d4 100644
--- a/pkgs/development/python-modules/twine/default.nix
+++ b/pkgs/development/python-modules/twine/default.nix
@@ -17,13 +17,13 @@
 
 buildPythonPackage rec {
   pname = "twine";
-  version = "5.0.0";
+  version = "5.1.0";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ibDMfTcKS2ZCHMYQLyaaqRD+DxhhwST1c88t3tvBDPQ=";
+    hash = "sha256-TXR3DIjE/K+BNNKmqdhj5A8IJV/32OKss8u9V9Jfbp0=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 8492807e71d2..8449cc2a6f12 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -130,6 +130,10 @@ buildPythonPackage rec {
       echo 'WorkerReporterTests.test_addSkipPyunit.skip = "'WorkerReporter' object has no attribute '_testStarted'"' >> src/twisted/trial/_dist/test/test_workerreporter.py
       echo 'LocalWorkerAMPTests.test_runSkip.skip = "twisted.protocols.amp.UnknownRemoteError: Code<UNKNOWN>: Unknown Error"' >> src/twisted/trial/_dist/test/test_worker.py
 
+      # https://github.com/twisted/twisted/issues/12194
+      echo 'FlattenerErrorTests.test_asynchronousFlattenError.skip = "builtins.KeyError: 'root'"' >> src/twisted/web/test/test_flatten.py
+      echo 'FlattenerErrorTests.test_cancel.skip = "builtins.KeyError: 'root'"' >> src/twisted/web/test/test_flatten.py
+
       # not packaged
       substituteInPlace src/twisted/test/test_failure.py \
         --replace "from cython_test_exception_raiser import raiser  # type: ignore[import]" "raiser = None"
diff --git a/pkgs/development/python-modules/txtai/default.nix b/pkgs/development/python-modules/txtai/default.nix
index a689f4381d6c..b2b9704d5425 100644
--- a/pkgs/development/python-modules/txtai/default.nix
+++ b/pkgs/development/python-modules/txtai/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   # propagated build input
   faiss,
   torch,
@@ -159,7 +158,6 @@ buildPythonPackage {
     hash = "sha256-2d31wzUz0/FcrejDIog2EI4BXgjd7XXpN4tRXpLk5DI=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     # We call it faiss, not faiss-cpu.
diff --git a/pkgs/development/python-modules/typed-settings/default.nix b/pkgs/development/python-modules/typed-settings/default.nix
index fe2ebd26d7d1..66f59fb6f0ad 100644
--- a/pkgs/development/python-modules/typed-settings/default.nix
+++ b/pkgs/development/python-modules/typed-settings/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "typed-settings";
-  version = "24.2.0";
+  version = "24.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "typed_settings";
     inherit version;
-    hash = "sha256-BuosfIlCgCD+h7eA/6/oE98zdURaT3eik+dysBpJR+Y=";
+    hash = "sha256-x1ojSSZNrKkBHKE9dWw7NzX/G6ggRYRIQ5MMahwL1Ps=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index 1c80ea352c09..41e7c35791ac 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -8,6 +8,7 @@
   pytestCheckHook,
   typing-extensions,
   importlib-metadata,
+  mypy,
   sphinxHook,
   sphinx-autodoc-typehints,
   sphinx-rtd-theme,
@@ -16,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "typeguard";
-  version = "4.2.1";
-  format = "pyproject";
+  version = "4.3.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xVahuVlIIwUQBwylP6A0H7CWRhG9BdWY2H+1IRXWX+4=";
+    hash = "sha256-ku5qCuyRNRgermBn69YX/Z3o111xT7VIcopJM7HeplE=";
   };
 
   outputs = [
@@ -31,7 +32,7 @@ buildPythonPackage rec {
     "doc"
   ];
 
-  nativeBuildInputs = [
+  build-system = [
     glibcLocales
     setuptools
     setuptools-scm
@@ -40,13 +41,16 @@ buildPythonPackage rec {
     sphinx-rtd-theme
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     typing-extensions
   ] ++ lib.optionals (pythonOlder "3.10") [ importlib-metadata ];
 
   env.LC_ALL = "en_US.utf-8";
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    mypy
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "typeguard" ];
 
diff --git a/pkgs/development/python-modules/typer-shell/default.nix b/pkgs/development/python-modules/typer-shell/default.nix
index bb195d121fb6..b54ad8d256f6 100644
--- a/pkgs/development/python-modules/typer-shell/default.nix
+++ b/pkgs/development/python-modules/typer-shell/default.nix
@@ -6,7 +6,6 @@
   fetchFromGitHub,
   iterfzf,
   poetry-core,
-  pythonRelaxDepsHook,
   pythonOlder,
   pyyaml,
   rich,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     click
diff --git a/pkgs/development/python-modules/types-protobuf/default.nix b/pkgs/development/python-modules/types-protobuf/default.nix
index eede2efa6d56..e7db25836e8f 100644
--- a/pkgs/development/python-modules/types-protobuf/default.nix
+++ b/pkgs/development/python-modules/types-protobuf/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "types-protobuf";
-  version = "4.25.0.20240417";
+  version = "5.26.0.20240422";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w07/F7mzoK22gwYi8PMCSE5MCJ9TOkbj8UdWgxNUQ1I=";
+    hash = "sha256-5gdBeBCfl+/p8LIKA1umHXw7A+hn60fSVNKyq2qAXjY=";
   };
 
   propagatedBuildInputs = [ types-futures ];
diff --git a/pkgs/development/python-modules/types-psutil/default.nix b/pkgs/development/python-modules/types-psutil/default.nix
index 45cef1e52775..766f6beebefe 100644
--- a/pkgs/development/python-modules/types-psutil/default.nix
+++ b/pkgs/development/python-modules/types-psutil/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-psutil";
-  version = "5.9.5.20240423";
+  version = "5.9.5.20240516";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-G5ds+GMIMWxawizsaIAVsEJzyE+OaRw9+wwSMY8ypvM=";
+    hash = "sha256-uylvWfxWRYiR0P6xmUcX5UihvPiZNqKHffh5K4IrRpY=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-setuptools/default.nix b/pkgs/development/python-modules/types-setuptools/default.nix
index 35e2530eeab1..0c5bcbbb5c48 100644
--- a/pkgs/development/python-modules/types-setuptools/default.nix
+++ b/pkgs/development/python-modules/types-setuptools/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "types-setuptools";
-  version = "69.5.0.20240415";
+  version = "70.0.0.20240524";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6mSvCpamdPjEC6NMCcJU88cLw/IYxr/6HQkSvZFYSi8=";
+    hash = "sha256-4x/ue50V71OYBSZXmsYImzrlGgBaKBrPlxeOkKxxr/Y=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/typical/default.nix b/pkgs/development/python-modules/typical/default.nix
index 8201e4ba8104..357bb8d1094a 100644
--- a/pkgs/development/python-modules/typical/default.nix
+++ b/pkgs/development/python-modules/typical/default.nix
@@ -12,7 +12,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sqlalchemy,
   ujson,
 }:
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     fastjsonschema
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index 5ee8e67e3794..198326fe35c2 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "typing-extensions";
-  version = "4.11.0";
+  version = "4.12.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "typing_extensions";
     inherit version;
-    hash = "sha256-g/CFvVylnIApX8KoKrXaxnnL4CufM/fYOvaOJBvqUbA=";
+    hash = "sha256-Gn6tVcflWd1N7ohW46iLQSJav+HOjfV7fBORX+Eh/7g=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/ufo2ft/default.nix b/pkgs/development/python-modules/ufo2ft/default.nix
index af40d6be2503..62741a5a06c1 100644
--- a/pkgs/development/python-modules/ufo2ft/default.nix
+++ b/pkgs/development/python-modules/ufo2ft/default.nix
@@ -11,7 +11,6 @@
   fonttools,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
   skia-pathops,
   ufolib2,
@@ -19,19 +18,18 @@
 
 buildPythonPackage rec {
   pname = "ufo2ft";
-  version = "3.2.4";
+  version = "3.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LkrYKERPJrKsWAYnlJJlybNy93J+uStaHv35jcZpTrU=";
+    hash = "sha256-PUPk92wugtIZWXP8vq8bJNxqTDhDENKdNhW1kNEcL3E=";
   };
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "cffsubr" ];
diff --git a/pkgs/development/python-modules/uiprotect/default.nix b/pkgs/development/python-modules/uiprotect/default.nix
index 77a4f48428d2..6a93690a5abf 100644
--- a/pkgs/development/python-modules/uiprotect/default.nix
+++ b/pkgs/development/python-modules/uiprotect/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonOlder,
 
   # build-system
   poetry-core,
@@ -11,6 +12,7 @@
   aiohttp,
   aioshutil,
   async-timeout,
+  convertertools,
   dateparser,
   orjson,
   packaging,
@@ -35,14 +37,16 @@
 
 buildPythonPackage rec {
   pname = "uiprotect";
-  version = "1.7.2";
+  version = "5.2.0";
   pyproject = true;
 
+  disabled = pythonOlder "3.10";
+
   src = fetchFromGitHub {
     owner = "uilibs";
     repo = "uiprotect";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gr+P7V0vsmWha/Di3BGORjssCLz0lsufawzMZKOMYt0=";
+    hash = "sha256-VH8b++7C4bLLoZoefc9zd9S7HTkrDiE7Wle3wkwvjoA=";
   };
 
   postPatch = ''
@@ -51,11 +55,14 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "pydantic" ];
+
   dependencies = [
     aiofiles
     aiohttp
     aioshutil
     async-timeout
+    convertertools
     dateparser
     orjson
     packaging
diff --git a/pkgs/development/python-modules/ujson/default.nix b/pkgs/development/python-modules/ujson/default.nix
index 9b5ae6fcb60c..b94550bdce50 100644
--- a/pkgs/development/python-modules/ujson/default.nix
+++ b/pkgs/development/python-modules/ujson/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "ujson";
-  version = "5.9.0";
+  version = "5.10.0";
   format = "setuptools";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-icyS5z1VAbin9IV17rFK0nFWrQksLp/H48+UnwfnVTI=";
+    hash = "sha256-s82PPF2MdzglfxAYiARE97fZtmIyxkZJ9WLXuoatS8E=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/uncertainties/default.nix b/pkgs/development/python-modules/uncertainties/default.nix
index db120296a24f..d20b06a2ee35 100644
--- a/pkgs/development/python-modules/uncertainties/default.nix
+++ b/pkgs/development/python-modules/uncertainties/default.nix
@@ -1,10 +1,17 @@
 {
   lib,
   buildPythonPackage,
-  setuptools-scm,
   fetchFromGitHub,
-  pytestCheckHook,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # optional-dependencies
   numpy,
+
+  # tests
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -19,14 +26,19 @@ buildPythonPackage rec {
     hash = "sha256-AaFazHeq7t4DnG2s9GvmAJ3ni62PWHR//mNPL+WyGSI=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
+    setuptools
     setuptools-scm
   ];
 
+  optional-dependencies.arrays = [ numpy ];
+
   nativeCheckInputs = [
     pytestCheckHook
-    numpy
-  ];
+  ]
+  ++ optional-dependencies.arrays;
+
+  pythonImportsCheck = [ "uncertainties" ];
 
   meta = with lib; {
     homepage = "https://pythonhosted.org/uncertainties/";
diff --git a/pkgs/development/python-modules/unidata-blocks/default.nix b/pkgs/development/python-modules/unidata-blocks/default.nix
index fc71e13c306b..ba48416c5157 100644
--- a/pkgs/development/python-modules/unidata-blocks/default.nix
+++ b/pkgs/development/python-modules/unidata-blocks/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "unidata-blocks";
-  version = "0.0.10";
+  version = "0.0.12";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "unidata_blocks";
     inherit version;
-    hash = "sha256-wwiOjfIAx6AZtK98uuPQ0jwblq+CdnMQp+JkQWh+RgM=";
+    hash = "sha256-V8xmw8CDq0Y89pidcMF+f0A40PfAmkRwcduTFkUguU4=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/universal-silabs-flasher/default.nix b/pkgs/development/python-modules/universal-silabs-flasher/default.nix
index e4b09034d18f..55551a5206ef 100644
--- a/pkgs/development/python-modules/universal-silabs-flasher/default.nix
+++ b/pkgs/development/python-modules/universal-silabs-flasher/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -43,7 +42,6 @@ buildPythonPackage rec {
       --replace-fail 'dynamic = ["version"]' 'version = "${version}"'
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/uplc/default.nix b/pkgs/development/python-modules/uplc/default.nix
index 993706665e08..8d93cd592626 100644
--- a/pkgs/development/python-modules/uplc/default.nix
+++ b/pkgs/development/python-modules/uplc/default.nix
@@ -2,7 +2,6 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   # Python deps
   frozenlist2,
   python-secp256k1-cardano,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-djJMNXijMVzMVzw8NZSe3YFRGyAPqdvr0P374Za5XkU=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     setuptools
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 77742a521d24..1bffd501e763 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -24,12 +24,12 @@
 let
   self = buildPythonPackage rec {
     pname = "urllib3";
-    version = "2.2.1";
+    version = "2.2.2";
     pyproject = true;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-0FcIdsYaueUg13bDisu7WwWndtP5/5ilyP1RYqREzxk=";
+      hash = "sha256-3VBUhVSaelUoM9peYGNjnQ0XfATyO8OGTkHl3F9hIWg=";
     };
 
     nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/vallox-websocket-api/default.nix b/pkgs/development/python-modules/vallox-websocket-api/default.nix
index 9558cbe056df..9d0d63e1ca7c 100644
--- a/pkgs/development/python-modules/vallox-websocket-api/default.nix
+++ b/pkgs/development/python-modules/vallox-websocket-api/default.nix
@@ -3,7 +3,6 @@
   aiohttp,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   setuptools,
   construct,
@@ -14,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "vallox-websocket-api";
-  version = "5.2.0";
+  version = "5.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,12 +22,11 @@ buildPythonPackage rec {
     owner = "yozik04";
     repo = "vallox_websocket_api";
     rev = "refs/tags/${version}";
-    hash = "sha256-qq58ZSrKVQ00rtXMe4L9xfz0QB+UpjGOhPo1srPYIY4=";
+    hash = "sha256-jJ+FFDU4w1vdCqErz6ksJDvjFcalSAwaH+G77BNI5/E=";
   };
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "websockets" ];
diff --git a/pkgs/development/python-modules/vdirsyncer/default.nix b/pkgs/development/python-modules/vdirsyncer/default.nix
index ab0af940e3e1..7851df4a2971 100644
--- a/pkgs/development/python-modules/vdirsyncer/default.nix
+++ b/pkgs/development/python-modules/vdirsyncer/default.nix
@@ -23,7 +23,6 @@
   aioresponses,
   vdirsyncer,
   testers,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -46,7 +45,6 @@ buildPythonPackage rec {
     setuptools
     setuptools-scm
     wheel
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "aiostream" ];
diff --git a/pkgs/development/python-modules/vector/default.nix b/pkgs/development/python-modules/vector/default.nix
index fce9211c6be2..f0ebd1f62128 100644
--- a/pkgs/development/python-modules/vector/default.nix
+++ b/pkgs/development/python-modules/vector/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "vector";
-  version = "1.3.1";
+  version = "1.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GpQhDCGl04020Po2wa+5LChXuh0JyCSw1LhhXVH08uU=";
+    hash = "sha256-Fa74kRVg2x6j/6nb1UFNDsV1pQSiw/I+pFFwoYmURm4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/vega/default.nix b/pkgs/development/python-modules/vega/default.nix
index aa37f746a011..d7fbe2cabaa2 100644
--- a/pkgs/development/python-modules/vega/default.nix
+++ b/pkgs/development/python-modules/vega/default.nix
@@ -4,7 +4,6 @@
   fetchpatch,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   altair,
   ipytablewidgets,
   ipywidgets,
@@ -39,7 +38,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pandas" ];
diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index 3b1dbb241b8b..023d1623a5b1 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "velbus-aio";
-  version = "2024.7.1";
+  version = "2024.7.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = "velbus-aio";
     rev = "refs/tags/${version}";
-    hash = "sha256-lKCeNQkI+KxhDZ2DYZPteLxJ5J1vBahyH2S7QTYAUiQ=";
+    hash = "sha256-nGFx4ZqGTLMOmYNZam5jLKUsL3GxyyDwT8WFSEX9Qcs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/versioningit/default.nix b/pkgs/development/python-modules/versioningit/default.nix
index dbbe59f5f60d..c578f96e1883 100644
--- a/pkgs/development/python-modules/versioningit/default.nix
+++ b/pkgs/development/python-modules/versioningit/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "versioningit";
-  version = "3.1.0";
+  version = "3.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eqxxPDGlPrNnprvC6LPejMK4bRDUXFEBr9ZRRGyxD9c=";
+    hash = "sha256-sLpYblrwi4fb4zVAgpEKHQUCw2IC1JbhrmDvO0HuKcE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 97655d743f01..75e9d40e860d 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.25.3";
+  version = "20.26.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e7VUu9/qrMM0n6YU6lv/asMA/HwzXp+s86O8/HA/Rb4=";
+    hash = "sha256-gr8PTuu7eNNt2u4Cg9Q/5XNrU4gLiozc03OQoHrDdBw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/vispy/default.nix b/pkgs/development/python-modules/vispy/default.nix
index 36833c75ff48..eb3b16c0a3ea 100644
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@@ -21,17 +21,17 @@
 
 buildPythonPackage rec {
   pname = "vispy";
-  version = "0.14.2";
+  version = "0.14.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7ti0TW9ch70pWySqmi4OTm3GqQXM7gGy1ByPvwp2ez0=";
+    hash = "sha256-77u4R6kIuvfnFpq5vylhOKOTZPNn5ssKjsA61xaZ0x0=";
   };
 
-  patches = [
+  patches = lib.optionals (!stdenv.hostPlatform.isDarwin) [
     (substituteAll {
       src = ./library-paths.patch;
       fontconfig = "${fontconfig.lib}/lib/libfontconfig${stdenv.hostPlatform.extensions.sharedLibrary}";
diff --git a/pkgs/development/python-modules/vivisect/default.nix b/pkgs/development/python-modules/vivisect/default.nix
index b5b93f3ccd22..ef939cbdca6e 100644
--- a/pkgs/development/python-modules/vivisect/default.nix
+++ b/pkgs/development/python-modules/vivisect/default.nix
@@ -8,7 +8,6 @@
   pyasn1-modules,
   pycparser,
   pyqt5,
-  pythonRelaxDepsHook,
   pyqtwebengine,
   pythonOlder,
   withGui ? false,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
index c0d6fa22c952..ca26ec29bd55 100644
--- a/pkgs/development/python-modules/vt-py/default.nix
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -7,7 +7,6 @@
   pytest-asyncio,
   pytest-httpserver,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   setuptools,
 }:
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [ aiohttp ];
 
diff --git a/pkgs/development/python-modules/vulcan-api/default.nix b/pkgs/development/python-modules/vulcan-api/default.nix
index 91fb22173469..37baf7f80f34 100644
--- a/pkgs/development/python-modules/vulcan-api/default.nix
+++ b/pkgs/development/python-modules/vulcan-api/default.nix
@@ -8,7 +8,6 @@
   fetchFromGitHub,
   pyopenssl,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   related,
   requests,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "faust-cchardet" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aenum
diff --git a/pkgs/development/python-modules/wagtail/default.nix b/pkgs/development/python-modules/wagtail/default.nix
index 9a8e33a3d8c1..c1b509b924dd 100644
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "wagtail";
-  version = "6.0.2";
+  version = "6.1.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-58/DwPU/swLxeY8OAqesYHirAusOhwPA9xzL0/GOOG8=";
+    hash = "sha256-/bgsbNb2rlwfeyMSFmlp2GAQFbZcuymtEg76xyfTmcE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index a41f5b94632a..fbd5d9baabf5 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -40,7 +40,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   responses,
@@ -77,7 +76,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/wasmer/default.nix b/pkgs/development/python-modules/wasmer/default.nix
index e3a419589913..8408780ef637 100644
--- a/pkgs/development/python-modules/wasmer/default.nix
+++ b/pkgs/development/python-modules/wasmer/default.nix
@@ -25,7 +25,7 @@ let
     }:
     buildPythonPackage rec {
       inherit pname;
-      version = "1.1.1";
+      version = "1.2.0";
       format = "pyproject";
 
       outputs = [ "out" ] ++ lib.optional (pname == "wasmer") "testsout";
@@ -87,19 +87,19 @@ in
   wasmer = common {
     pname = "wasmer";
     buildAndTestSubdir = "packages/api";
-    cargoHash = "sha256-vpbwU1HrIQmQkce9SK8UOHrX5tOLv/XKsfJHteqOteA=";
+    cargoHash = "sha256-HKbVss6jGFdnCgXV3UYf6RxtmQM3+tq3cHfOSKw5JnY=";
   };
 
   wasmer-compiler-cranelift = common {
     pname = "wasmer-compiler-cranelift";
     buildAndTestSubdir = "packages/compiler-cranelift";
-    cargoHash = "sha256-nv4cr52mUIuR3LWRT3eXU5b2LORwuN4iMbLX1efzovI=";
+    cargoHash = "sha256-BTBkoTluK7IVS+TpbQnMjn2Wvwhfxv1ev5PZWS/kW0w=";
   };
 
   wasmer-compiler-llvm = common {
     pname = "wasmer-compiler-llvm";
     buildAndTestSubdir = "packages/compiler-llvm";
-    cargoHash = "sha256-FA/xXlPaK8NxZIw7MCm9Fyesgu72Dsxhmb5xzOIINhE=";
+    cargoHash = "sha256-AfLp4RLfnJ3R1Wg+RCJRmYr7748LQtl1W+ttTgIMls4=";
     extraNativeBuildInputs = [ llvm_14 ];
     extraBuildInputs = [
       libffi
@@ -112,6 +112,6 @@ in
   wasmer-compiler-singlepass = common {
     pname = "wasmer-compiler-singlepass";
     buildAndTestSubdir = "packages/compiler-singlepass";
-    cargoHash = "sha256-yew7cB/7RLjW55jZmHFfIvaErgZ6XVxL1ucGGX2Cx18=";
+    cargoHash = "sha256-4DoeKRjS/2ijpUva0p/AE3qoIyt8CvCjkPWFPyLH6gs=";
   };
 }
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index 16be1cf5b48c..def2bdf1c880 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "watchdog";
-  version = "4.0.0";
+  version = "4.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4+cGXL2r5hg6uCGZ16T2s7oKQ4xaUSpoVZhGzLdqeOw=";
+    hash = "sha256-7rqs9nT6JVEeiGcCjSgeYC7mUABFtX9DsId4CC9/i0Q=";
   };
 
   # force kqueue on x86_64-darwin, because our api version does
diff --git a/pkgs/development/python-modules/watchfiles/default.nix b/pkgs/development/python-modules/watchfiles/default.nix
index 751a2886f472..22cd171afae5 100644
--- a/pkgs/development/python-modules/watchfiles/default.nix
+++ b/pkgs/development/python-modules/watchfiles/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "watchfiles";
-  version = "0.21.0";
+  version = "0.22.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,13 +27,13 @@ buildPythonPackage rec {
     owner = "samuelcolvin";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-/qNgkPF5N8jzSV3M0YFWvQngZ4Hf4WM/GBS1LtgFbWM=";
+    hash = "sha256-TtRSRgtMOqsnhdvsic3lg33xlA+r/DcYHlzewSOu/44=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-sqHTW1+E7Fp33KW6IYlNa77AYc2iCfaSoBRXzrhEKr8=";
+    hash = "sha256-n9yN/VRNQWCxh+BoliIMkKqJC51inpB9DQ9WtqR4oA0=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/weasel/default.nix b/pkgs/development/python-modules/weasel/default.nix
index 244b2e9587ad..bf01bbf033d2 100644
--- a/pkgs/development/python-modules/weasel/default.nix
+++ b/pkgs/development/python-modules/weasel/default.nix
@@ -8,7 +8,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   smart-open,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/weasyprint/default.nix b/pkgs/development/python-modules/weasyprint/default.nix
index d07a93a3a8b4..321ee830e57c 100644
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@@ -25,15 +25,15 @@
 
 buildPythonPackage rec {
   pname = "weasyprint";
-  version = "61.2";
+  version = "62.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit version;
     pname = "weasyprint";
-    hash = "sha256-R99s/u/4xsKM8uTK+DfN4XcV7+RicIradLqi6zkbYFk=";
+    hash = "sha256-oIrEAOEZGdmW12vsqjMWDXwaxVuhYGKMQs51hldMGlE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/weasyprint/library-paths.patch b/pkgs/development/python-modules/weasyprint/library-paths.patch
index 6d884f43ed3c..e54561a4018a 100644
--- a/pkgs/development/python-modules/weasyprint/library-paths.patch
+++ b/pkgs/development/python-modules/weasyprint/library-paths.patch
@@ -1,14 +1,14 @@
 diff --git a/weasyprint/text/ffi.py b/weasyprint/text/ffi.py
-index 09f614aad..cbe9a73dd 100644
+index 3aba3e75..dde0e260 100644
 --- a/weasyprint/text/ffi.py
 +++ b/weasyprint/text/ffi.py
-@@ -415,22 +415,11 @@ def _dlopen(ffi, *names):
+@@ -429,22 +429,11 @@ if hasattr(os, 'add_dll_directory'):  # pragma: no cover
          with suppress((OSError, FileNotFoundError)):
              os.add_dll_directory(dll_directory)
  
 -gobject = _dlopen(
 -    ffi, 'gobject-2.0-0', 'gobject-2.0', 'libgobject-2.0-0',
--    'libgobject-2.0.so.0', 'libgobject-2.0.dylib',  'libgobject-2.0-0.dll')
+-    'libgobject-2.0.so.0', 'libgobject-2.0.dylib', 'libgobject-2.0-0.dll')
 -pango = _dlopen(
 -    ffi, 'pango-1.0-0', 'pango-1.0', 'libpango-1.0-0', 'libpango-1.0.so.0',
 -    'libpango-1.0.dylib', 'libpango-1.0-0.dll')
@@ -28,4 +28,5 @@ index 09f614aad..cbe9a73dd 100644
 +fontconfig = _dlopen(ffi, '@fontconfig@')
 +pangoft2 = _dlopen(ffi, '@pangoft2@')
  
- gobject.g_type_init()
\ No newline at end of file
+ gobject.g_type_init()
+ 
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index adc385ebd2a4..fc9aa1050f51 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -9,7 +9,6 @@
   httpx,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
   tqdm,
   validators,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     authlib
diff --git a/pkgs/development/python-modules/websocket-client/default.nix b/pkgs/development/python-modules/websocket-client/default.nix
index 701583ad521d..b69dfcb58509 100644
--- a/pkgs/development/python-modules/websocket-client/default.nix
+++ b/pkgs/development/python-modules/websocket-client/default.nix
@@ -10,14 +10,15 @@
 
 buildPythonPackage rec {
   pname = "websocket-client";
-  version = "1.7.0";
+  version = "1.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-EOUR6jqMdEYx07135h6xftCTBMQTrULPbd+kx3h+j+Y=";
+    pname = "websocket_client";
+    inherit version;
+    hash = "sha256-Mjnfn0TaYy+WASRygF1AojKBqZECfOEdL0Wm8krEw9o=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/weconnect-mqtt/default.nix b/pkgs/development/python-modules/weconnect-mqtt/default.nix
index 30e5accbb3cf..bdbd57513c56 100644
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@@ -6,7 +6,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   weconnect,
 }:
@@ -39,7 +38,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     paho-mqtt
diff --git a/pkgs/development/python-modules/wheel-inspect/default.nix b/pkgs/development/python-modules/wheel-inspect/default.nix
index 683cec66d3a5..43b5f8dbedd5 100644
--- a/pkgs/development/python-modules/wheel-inspect/default.nix
+++ b/pkgs/development/python-modules/wheel-inspect/default.nix
@@ -7,7 +7,6 @@
   hatchling,
   headerparser,
   jsonschema,
-  pythonRelaxDepsHook,
   packaging,
   pytestCheckHook,
   pythonOlder,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/willow/default.nix b/pkgs/development/python-modules/willow/default.nix
index cc67f380517e..f2ab1675d043 100644
--- a/pkgs/development/python-modules/willow/default.nix
+++ b/pkgs/development/python-modules/willow/default.nix
@@ -35,6 +35,8 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ flit-core ];
 
+  pythonRelaxDeps = [ "defusedxml" ];
+
   propagatedBuildInputs = [
     filetype
     defusedxml
diff --git a/pkgs/development/python-modules/woob/default.nix b/pkgs/development/python-modules/woob/default.nix
index 7249390ab718..41450c7e27a8 100644
--- a/pkgs/development/python-modules/woob/default.nix
+++ b/pkgs/development/python-modules/woob/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchFromGitLab,
   fetchpatch,
-  pythonRelaxDepsHook,
   html2text,
   lxml,
   packaging,
@@ -48,7 +47,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/wurlitzer/default.nix b/pkgs/development/python-modules/wurlitzer/default.nix
index 84dfd700050b..9a619ad90460 100644
--- a/pkgs/development/python-modules/wurlitzer/default.nix
+++ b/pkgs/development/python-modules/wurlitzer/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "wurlitzer";
-  version = "3.1.0";
+  version = "3.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sx07GKtrg5SzrbiyGEGtbUtrsZW5tkKVOHLburTCmyo=";
+    hash = "sha256-v7kUSrnwJIfYArn/idvT+jgtCPc+EtuK3EwvsAzTm9k=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/xarray-dataclasses/default.nix b/pkgs/development/python-modules/xarray-dataclasses/default.nix
index 78de25f5bfbf..09205ea9e177 100644
--- a/pkgs/development/python-modules/xarray-dataclasses/default.nix
+++ b/pkgs/development/python-modules/xarray-dataclasses/default.nix
@@ -5,7 +5,6 @@
   pythonOlder,
   poetry-core,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   numpy,
   typing-extensions,
   xarray,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "xarray" ];
diff --git a/pkgs/development/python-modules/xarray/default.nix b/pkgs/development/python-modules/xarray/default.nix
index 14d0d860d5f5..9ea50cdae157 100644
--- a/pkgs/development/python-modules/xarray/default.nix
+++ b/pkgs/development/python-modules/xarray/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "xarray";
-  version = "2024.2.0";
+  version = "2024.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oQXwJ5EILIiOviYiCQvq/y57aFcUiNYv5q/as1tLcX8=";
+    hash = "sha256-C5HgvE3AKWlHlHZA/jHsboZ84ljS98vBC+30ptaDQMc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/xcffib/default.nix b/pkgs/development/python-modules/xcffib/default.nix
index eac873777312..63e96858b658 100644
--- a/pkgs/development/python-modules/xcffib/default.nix
+++ b/pkgs/development/python-modules/xcffib/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     xorg.xeyes
-    xorg.xorgserver
+    xorg.xvfb
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/xhtml2pdf/default.nix b/pkgs/development/python-modules/xhtml2pdf/default.nix
index fcaee169841f..1ab72c73a81b 100644
--- a/pkgs/development/python-modules/xhtml2pdf/default.nix
+++ b/pkgs/development/python-modules/xhtml2pdf/default.nix
@@ -12,7 +12,6 @@
   pytestCheckHook,
   python-bidi,
   pythonOlder,
-  pythonRelaxDepsHook,
   reportlab,
   setuptools,
   svglib,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 5e834c3419a4..531a5ad6299e 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -12,7 +12,6 @@
   pycryptodomex,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sensor-state-data,
 }:
 
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "pycryptodomex" ];
 
diff --git a/pkgs/development/python-modules/xlib/default.nix b/pkgs/development/python-modules/xlib/default.nix
index 0852e4b13fc3..28e18a01dce7 100644
--- a/pkgs/development/python-modules/xlib/default.nix
+++ b/pkgs/development/python-modules/xlib/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     nose
     util-linux
     xorg.xauth
-    xorg.xorgserver
+    xorg.xvfb
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/xmlschema/default.nix b/pkgs/development/python-modules/xmlschema/default.nix
index 3a155055df63..13829b6be86c 100644
--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@@ -34,6 +34,13 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # -file://///filer01/MY_HOME/dev/XMLSCHEMA/test.xsd
+    # +file:////filer01/MY_HOME/dev/XMLSCHEMA/test.xsd
+    "test_normalize_url_slashes"
+    "test_normalize_url_with_base_unc_path"
+  ];
+
   pythonImportsCheck = [ "xmlschema" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/xvfbwrapper/default.nix b/pkgs/development/python-modules/xvfbwrapper/default.nix
index 75155e475035..148a3de0371b 100644
--- a/pkgs/development/python-modules/xvfbwrapper/default.nix
+++ b/pkgs/development/python-modules/xvfbwrapper/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  xorgserver,
+  xorg,
   mock,
 }:
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     inherit pname version;
     sha256 = "097wxhvp01ikqpg1z3v8rqhss6f1vwr399zpz9a05d2135bsxx5w";
   };
-  propagatedBuildInputs = [ xorgserver ];
+  propagatedBuildInputs = [ xorg.xvfb ];
 
   # See: https://github.com/cgoldberg/xvfbwrapper/issues/30
   doCheck = false;
diff --git a/pkgs/development/python-modules/xyzservices/default.nix b/pkgs/development/python-modules/xyzservices/default.nix
index 1e808d587537..41c7083520c3 100644
--- a/pkgs/development/python-modules/xyzservices/default.nix
+++ b/pkgs/development/python-modules/xyzservices/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "xyzservices";
-  version = "2024.4.0";
+  version = "2024.6.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-agTxFIem+3fZKpiYTNEH+9kVf9XmX5Ka3Zw9bmBO6Iw=";
+    hash = "sha256-WMG9q0JX0lUbnvkc1IVx93t8TSvEW/XjwFrJezpNcoI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yangson/default.nix b/pkgs/development/python-modules/yangson/default.nix
index 80fa146f3d26..c623097a6d5f 100644
--- a/pkgs/development/python-modules/yangson/default.nix
+++ b/pkgs/development/python-modules/yangson/default.nix
@@ -11,18 +11,22 @@
 
 buildPythonPackage rec {
   pname = "yangson";
-  version = "1.5.2";
+  version = "1.5.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CZ-NIC";
     repo = "yangson";
     rev = "refs/tags/${version}";
-    hash = "sha256-c/UWyfJdVz6wSluL1Ej9cSV3EpDUTkP0GTeHPYfAduE=";
+    hash = "sha256-/9MxCkcPGRNZkuwAAvlr7gtGcyxXtliski7bNtFhVBE=";
   };
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [
+    "setuptools"
+  ];
+
   dependencies = [
     elementpath
     pyyaml
diff --git a/pkgs/development/python-modules/yark/default.nix b/pkgs/development/python-modules/yark/default.nix
index 9196169d27de..30143e8a90fa 100644
--- a/pkgs/development/python-modules/yark/default.nix
+++ b/pkgs/development/python-modules/yark/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   progress,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   yt-dlp,
 }:
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ypy-websocket/default.nix b/pkgs/development/python-modules/ypy-websocket/default.nix
index 06aa6fec33c5..d50c231a574b 100644
--- a/pkgs/development/python-modules/ypy-websocket/default.nix
+++ b/pkgs/development/python-modules/ypy-websocket/default.nix
@@ -9,7 +9,6 @@
   y-py,
   pytest-asyncio,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   uvicorn,
   websockets,
 }:
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/z3c-checkversions/default.nix b/pkgs/development/python-modules/z3c-checkversions/default.nix
index 4f17e183396b..400d22584451 100644
--- a/pkgs/development/python-modules/z3c-checkversions/default.nix
+++ b/pkgs/development/python-modules/z3c-checkversions/default.nix
@@ -1,9 +1,9 @@
 {
-  stdenv,
   lib,
   buildPythonPackage,
   fetchPypi,
   python,
+  pythonAtLeast,
   zc-buildout,
   zope-testrunner,
 }:
@@ -13,6 +13,9 @@ buildPythonPackage rec {
   version = "2.1";
   format = "setuptools";
 
+  # distutils usage
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     inherit version;
     pname = "z3c.checkversions";
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index 10a2d5e0e4f6..9022a3aaeb69 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "zarr";
-  version = "2.17.2";
+  version = "2.18.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LLqmy040LUUVLUp6SyATwzf806jnvJglNWAYDeYFUs4=";
+    hash = "sha256-m7OTuKCjj7Eh27kTsEfXXbKN6YkPbWRKIXpzz0rnT0c=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/zeroc-ice/default.nix b/pkgs/development/python-modules/zeroc-ice/default.nix
index b6b8d56f87d1..8a61451a6221 100644
--- a/pkgs/development/python-modules/zeroc-ice/default.nix
+++ b/pkgs/development/python-modules/zeroc-ice/default.nix
@@ -10,15 +10,16 @@
 
 buildPythonPackage rec {
   pname = "zeroc-ice";
-  version = "3.7.10";
+  version = "3.7.10.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit version pname;
-    hash = "sha256-Bwn2Y/Bbu6O89iaSNWvMpXBhyJRmj6eL8j6HiPpbQbM=";
+    pname = "zeroc_ice";
+    inherit version;
+    hash = "sha256-sGOq/aNg33EfdpRVKbtUFXbyZr5B5dWi3Xf10yDBhmQ=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   buildInputs = [
     bzip2
diff --git a/pkgs/development/python-modules/zha/default.nix b/pkgs/development/python-modules/zha/default.nix
index 87d5d230d7a0..740aedd89c7a 100644
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@@ -13,7 +13,6 @@
   pytestCheckHook,
   python-slugify,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   universal-silabs-flasher,
   wheel,
@@ -53,7 +52,6 @@ buildPythonPackage rec {
     "zigpy"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/zigpy-deconz/default.nix b/pkgs/development/python-modules/zigpy-deconz/default.nix
index 9ea32dde5b7d..c8779020abc4 100644
--- a/pkgs/development/python-modules/zigpy-deconz/default.nix
+++ b/pkgs/development/python-modules/zigpy-deconz/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-deconz";
-  version = "0.23.1";
+  version = "0.23.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-10EyT3IGdAtF9OUbfZ5OtP+Ot35O0SfMDtsyw5FQ+/8=";
+    hash = "sha256-H3WsprBTfBpxMGqasWbj41Yikt/UMU0cKaROzXE2dLU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zigpy-znp/default.nix b/pkgs/development/python-modules/zigpy-znp/default.nix
index 1df9053e08c5..cefa56354546 100644
--- a/pkgs/development/python-modules/zigpy-znp/default.nix
+++ b/pkgs/development/python-modules/zigpy-znp/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-znp";
-  version = "0.12.1";
+  version = "0.12.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Bs/m9Iyr8x+sMUVXt1whk2E4EJ5bpitMsEWZtmCyIf8=";
+    hash = "sha256-zfoFajRuZ06LLe8+3BUZZbKGpset24QQmqAIY949MF8=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index 9a8729f7515d..f9ecaecd95e3 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -11,14 +11,14 @@
 let
   zipp = buildPythonPackage rec {
     pname = "zipp";
-    version = "3.18.1";
+    version = "3.19.2";
     format = "pyproject";
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-KITtIufYlh3hyaBRQutpokfxICkbwCBqAKdkLwm1txU=";
+      hash = "sha256-vx3PZFD4c6E+lSopUEiHyJ5t51BiCeWxvMNGATXU3hk=";
     };
 
     nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/zodbpickle/default.nix b/pkgs/development/python-modules/zodbpickle/default.nix
index 08ba3dc21ba8..55dcfb7800d9 100644
--- a/pkgs/development/python-modules/zodbpickle/default.nix
+++ b/pkgs/development/python-modules/zodbpickle/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "zodbpickle";
-  version = "3.3";
+  version = "4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dcF5Kse9W89JUFggYqw2hOMiqhOrmEIOO/7EWCJzo2g=";
+    hash = "sha256-6FutlWDWCSpjW+vueKQ7DxySamaRK+OQ6IyrZvTewYA=";
   };
 
   # fails..
diff --git a/pkgs/development/python-modules/zope-exceptions/default.nix b/pkgs/development/python-modules/zope-exceptions/default.nix
index 9952c56d7522..835fa247410e 100644
--- a/pkgs/development/python-modules/zope-exceptions/default.nix
+++ b/pkgs/development/python-modules/zope-exceptions/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "zope-exceptions";
-  version = "5.0.1";
+  version = "5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "zope.exceptions";
     inherit version;
-    hash = "sha256-MPxT5TOfX72dEzXg97afd/FePwbisXt/t++SXMJP3ZY=";
+    hash = "sha256-YRtMSUbDAWDbS3u9TzhhOzJoSvFn0xllCvm3O8ew6Xg=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/zope-interface/default.nix b/pkgs/development/python-modules/zope-interface/default.nix
index 3cc208094d26..c94e4a0366c5 100644
--- a/pkgs/development/python-modules/zope-interface/default.nix
+++ b/pkgs/development/python-modules/zope-interface/default.nix
@@ -2,25 +2,30 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   zope-event,
 }:
 
 buildPythonPackage rec {
   pname = "zope.interface";
-  version = "5.5.2";
+  version = "6.4.post2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v+4fP/YhQ4GUmeNI9bin86oCWfmspeDdrnOR0Fnc5nE=";
+    hash = "sha256-HCB+b239V0mib1pf2WZgLWuCTsANLfhKfpqSTokzZU4=";
   };
 
-  propagatedBuildInputs = [ zope-event ];
+  build-system = [ setuptools ];
+
+  dependencies = [ zope-event ];
 
   doCheck = false; # Circular deps.
 
   meta = with lib; {
+    changelog = "https://github.com/zopefoundation/zope.interface/blob/${version}/CHANGES.rst";
     description = "Zope.Interface";
-    homepage = "https://zope.org/Products/ZopeInterface";
+    homepage = "https://github.com/zopefoundation/zope.interface";
     license = licenses.zpl20;
     maintainers = [ maintainers.goibhniu ];
   };
diff --git a/pkgs/development/python-modules/zope-testbrowser/default.nix b/pkgs/development/python-modules/zope-testbrowser/default.nix
index f2a9e692b083..b63578bb6b83 100644
--- a/pkgs/development/python-modules/zope-testbrowser/default.nix
+++ b/pkgs/development/python-modules/zope-testbrowser/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "zope-testbrowser";
-  version = "6.0";
+  version = "7.0";
 
   format = "setuptools";
 
   src = fetchPypi {
     pname = "zope.testbrowser";
     inherit version;
-    sha256 = "sha256-RLd6XpA3q+3DZHai6j3H6XTWE85Sk913zAL4iO4x+ho=";
+    sha256 = "sha256-WTbSoNd9h4HQATWP0LEUYShbAtxuOzJLhMHtkyax/z8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index cb5cc5220dfe..acd9e6b2d1a9 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -608,7 +608,7 @@ let
     RCurl = [ pkgs.curl.dev ];
     R2SWF = [ pkgs.pkg-config ];
     rDEA = [ pkgs.glpk ];
-    rgl = with pkgs; [ libGLU libGLU.dev libGL xorg.libX11.dev freetype.dev libpng.dev ];
+    rgl = with pkgs; [ libGLU libGL xorg.libX11.dev freetype.dev libpng.dev ];
     RGtk2 = [ pkgs.pkg-config ];
     RProtoBuf = [ pkgs.pkg-config ];
     Rpoppler = [ pkgs.pkg-config ];
diff --git a/pkgs/development/rocm-modules/5/clr/test-opencl-example.nix b/pkgs/development/rocm-modules/5/clr/test-opencl-example.nix
index d6714c6b7d63..65e2e93782e9 100644
--- a/pkgs/development/rocm-modules/5/clr/test-opencl-example.nix
+++ b/pkgs/development/rocm-modules/5/clr/test-opencl-example.nix
@@ -6,7 +6,7 @@
 , cmake
 , pkg-config
 , glew
-, freeglut
+, libglut
 , opencl-headers
 , ocl-icd
 }:
@@ -26,7 +26,7 @@ let
 
     nativeBuildInputs = [ cmake pkg-config ];
 
-    buildInputs = [ glew freeglut opencl-headers ocl-icd ];
+    buildInputs = [ glew libglut opencl-headers ocl-icd ];
 
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/development/rocm-modules/6/clr/test-opencl-example.nix b/pkgs/development/rocm-modules/6/clr/test-opencl-example.nix
index 24fc483847d3..940a670ff579 100644
--- a/pkgs/development/rocm-modules/6/clr/test-opencl-example.nix
+++ b/pkgs/development/rocm-modules/6/clr/test-opencl-example.nix
@@ -6,7 +6,7 @@
 , cmake
 , pkg-config
 , glew
-, freeglut
+, libglut
 , opencl-headers
 , ocl-icd
 }:
@@ -26,7 +26,7 @@ let
 
     nativeBuildInputs = [ cmake pkg-config ];
 
-    buildInputs = [ glew freeglut opencl-headers ocl-icd ];
+    buildInputs = [ glew libglut opencl-headers ocl-icd ];
 
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 7fcf71a73d58..5b31e4ae2de7 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -47,7 +47,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/development/tools/boost-build/default.nix b/pkgs/development/tools/boost-build/default.nix
index 6b485b80ea1c..a74b029d327a 100644
--- a/pkgs/development/tools/boost-build/default.nix
+++ b/pkgs/development/tools/boost-build/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   installPhase = ''
     runHook preInstall
 
-    ./b2 install --prefix="$out"
+    ./b2 ${lib.optionalString (stdenv.cc.isClang) "toolset=clang "}install --prefix="$out"
 
     # older versions of b2 created this symlink,
     # which we want to support building via useBoost.
diff --git a/pkgs/development/tools/build-managers/conan/default.nix b/pkgs/development/tools/build-managers/conan/default.nix
index a2f007a0fcf4..39d974e0f3b8 100644
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/circup/default.nix b/pkgs/development/tools/circup/default.nix
index e63e0d06ea14..29b6cb3d8a38 100644
--- a/pkgs/development/tools/circup/default.nix
+++ b/pkgs/development/tools/circup/default.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/continuous-integration/buildbot/master.nix b/pkgs/development/tools/continuous-integration/buildbot/master.nix
index 258edd412b29..66d347a058d6 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/master.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/master.nix
@@ -8,7 +8,6 @@
 , buildbot
 , pythonOlder
 , python
-, pythonRelaxDepsHook
 , twisted
 , jinja2
 , msgpack
@@ -85,7 +84,6 @@ buildPythonApplication rec {
   };
 
   build-system = [
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/tools/djlint/default.nix b/pkgs/development/tools/djlint/default.nix
index d84afa203e5b..07af36e98cee 100644
--- a/pkgs/development/tools/djlint/default.nix
+++ b/pkgs/development/tools/djlint/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index b2652f6ca9fd..9d5da739745f 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2023.3";
+  version = "2024.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
-    hash = "sha256-TesfCXc/cGJZrGUgUNp7PuWYcbw/1c+3foEdt0mNyOc=";
+    hash = "sha256-hwx3+WIEYszknjVUKkLcFhL8hYcz6D274kjFNUWK7B4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/tools/enochecker-test/default.nix b/pkgs/development/tools/enochecker-test/default.nix
index 7e0f25317eac..ca6a49e3502f 100644
--- a/pkgs/development/tools/enochecker-test/default.nix
+++ b/pkgs/development/tools/enochecker-test/default.nix
@@ -2,7 +2,6 @@
 , buildPythonApplication
 , fetchPypi
 , pythonOlder
-, pythonRelaxDepsHook
 
 , certifi
 , charset-normalizer
@@ -34,7 +33,6 @@ buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/tools/fdroidserver/default.nix b/pkgs/development/tools/fdroidserver/default.nix
index 4bf70a004d3e..e8790999e153 100644
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@@ -4,7 +4,6 @@
 , apksigner
 , buildPythonApplication
 , python3
-, pythonRelaxDepsHook
 , installShellFiles
 , androguard
 , babel
@@ -59,7 +58,6 @@ buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     installShellFiles
   ];
 
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index 32c131cf7859..8d4ec0d1c5a6 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "doc" "man" "dev" "lib" "out" ];
 
+  # https://github.com/jqlang/jq/issues/2871
+  postPatch = lib.optionalString stdenv.isFreeBSD ''
+    substituteInPlace Makefile.am --replace-fail "tests/mantest" "" --replace-fail "tests/optionaltest" ""
+  '';
+
   # Upstream script that writes the version that's eventually compiled
   # and printed in `jq --help` relies on a .git directory which our src
   # doesn't keep.
diff --git a/pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch b/pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch
index e601be3a3308..f487ed708333 100644
--- a/pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch
+++ b/pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch
@@ -1,47 +1,24 @@
-From 33a8dc728eb5da3e1d3439c96810d1f6b2660b89 Mon Sep 17 00:00:00 2001
-From: Andrew Childs <andrew.childs@bibo.com.ph>
-Date: Tue, 22 Feb 2022 12:24:46 +0900
+From 368f26bfece3899a8c992cfec66427266918ab80 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Thu, 4 Jul 2024 12:20:34 -0400
 Subject: [PATCH] libtool.m4: update macos version detection block
 
-Includes upstream change
-9e8c882517082fe5755f2524d23efb02f1522490
 ---
- libtool.m4 | 21 ++++++++-------------
- 1 file changed, 8 insertions(+), 13 deletions(-)
+ libtool.m4 | 1 +
+ 1 file changed, 1 insertion(+)
 
 diff --git a/libtool.m4 b/libtool.m4
-index 7a711249304..f452efb4300 100644
+index e36fdd3c0e2..dd4725f8cd1 100644
 --- a/libtool.m4
 +++ b/libtool.m4
-@@ -996,20 +996,15 @@ _LT_EOF
-     ])
-     case $host_os in
-     rhapsody* | darwin1.[[012]])
--      _lt_dar_allow_undefined='${wl}-undefined ${wl}suppress' ;;
-+      _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
-     darwin1.*)
--      _lt_dar_allow_undefined='${wl}-flat_namespace ${wl}-undefined ${wl}suppress' ;;
--    darwin*) # darwin 5.x on
--      # if running on 10.5 or later, the deployment target defaults
--      # to the OS version, if on x86, and 10.4, the deployment
--      # target defaults to 10.4. Don't you love it?
--      case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
--	10.0,*86*-darwin8*|10.0,*-darwin[[91]]*)
--	  _lt_dar_allow_undefined='${wl}-undefined ${wl}dynamic_lookup' ;;
--	10.[[012]][[,.]]*)
--	  _lt_dar_allow_undefined='${wl}-flat_namespace ${wl}-undefined ${wl}suppress' ;;
--	10.*)
--	  _lt_dar_allow_undefined='${wl}-undefined ${wl}dynamic_lookup' ;;
-+      _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-+    darwin*)
-+      case $MACOSX_DEPLOYMENT_TARGET,$host in
-+        10.[[012]],*|,*powerpc*-darwin[[5-8]]*)
-+          _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-+        *)
-+          _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
-       esac
+@@ -1011,6 +1011,7 @@ _LT_EOF
+ 	  _lt_dar_allow_undefined='${wl}-flat_namespace ${wl}-undefined ${wl}suppress'
+ 	  ;;
+ 	*)
++	  _lt_dar_allow_undefined='${wl}-flat_namespace ${wl}-undefined ${wl}dynamic_lookup'
+ 	  ;;
+      esac
      ;;
-   esac
 -- 
-2.34.1
+2.45.1
 
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index a60457e73591..308ac9d5913f 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -16,6 +16,7 @@ in
 , perl
 , substitute
 , zlib
+, CoreServices
 
 , enableGold ? withGold stdenv.targetPlatform
 , enableGoldDefault ? false
@@ -33,12 +34,12 @@ assert enableGoldDefault -> enableGold;
 let
   inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-  version = "2.41";
+  version = "2.42";
 
   srcs = {
     normal = fetchurl {
       url = "mirror://gnu/binutils/binutils-${version}.tar.bz2";
-      hash = "sha256-pMS+wFL3uDcAJOYDieGUN38/SLVmGEGOpRBn9nqqsws=";
+      hash = "sha256-qlSFDr2lBkxyzU7C2bBWwpQlKZFIY1DZqXqypt/frxI=";
     };
     vc4-none = fetchFromGitHub {
       owner = "itszor";
@@ -66,11 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
   # fetchpatch! All mutable patches (generated by GitHub or cgit) that are
   # needed here should be included directly in Nixpkgs as files.
   patches = [
-    # Upstream patch to fix llvm testsuite failure when loading powerpc
-    # objects:
-    #   https://sourceware.org/PR30794
-    ./gold-powerpc-for-llvm.patch
-
     # Make binutils output deterministic by default.
     ./deterministic.patch
 
@@ -80,9 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-Revert-libtool.m4-fix-the-NM-nm-over-here-B-option-w.patch
     ./0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch
 
-    # Required for newer macos versions
-    ./0001-libtool.m4-update-macos-version-detection-block.patch
-
     # For some reason bfd ld doesn't search DT_RPATH when cross-compiling. It's
     # not clear why this behavior was decided upon but it has the unfortunate
     # consequence that the linker will fail to find transitive dependencies of
@@ -95,6 +88,11 @@ stdenv.mkDerivation (finalAttrs: {
     # not need to know binutils' BINDIR at all. It's an absolute path
     # where libraries are stored.
     ./plugins-no-BINDIR.patch
+  ] ++ lib.optionals buildPlatform.isDarwin [
+    # Note: Conditional to avoid Linux rebuilds on staging-next. Remove the conditional with the next update.
+    # ld64 needs `-undefined dynamic_lookup` to link `libctf-nobfd.dylib`, but the Darwin
+    # version detection in `libtool.m4` fails to detect the Darwin version correctly.
+    ./0001-libtool.m4-update-macos-version-detection-block.patch
   ]
   ++ lib.optional targetPlatform.isiOS ./support-ios.patch
   # Adds AVR-specific options to "size" for compatibility with Atmel's downstream distribution
@@ -128,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals targetPlatform.isVc4 [ flex ]
   ;
 
-  buildInputs = [ zlib gettext ];
+  buildInputs = [ zlib gettext ] ++ lib.optionals buildPlatform.isDarwin [ CoreServices ];
 
   inherit noSysDirs;
 
diff --git a/pkgs/development/tools/misc/distcc/default.nix b/pkgs/development/tools/misc/distcc/default.nix
index 983576a75334..954312b729b5 100644
--- a/pkgs/development/tools/misc/distcc/default.nix
+++ b/pkgs/development/tools/misc/distcc/default.nix
@@ -17,8 +17,11 @@ let
       sha256 = "0zjba1090awxkmgifr9jnjkxf41zhzc4f6mrnbayn3v6s77ca9x4";
     };
 
-    nativeBuildInputs = [ pkg-config autoconf automake ];
-    buildInputs = [popt avahi python3 gtk3 which procps libiberty_static];
+    nativeBuildInputs = [
+      pkg-config autoconf automake which
+      (python3.withPackages (p: [ p.setuptools ]))
+    ];
+    buildInputs = [ popt avahi gtk3 procps libiberty_static ];
     preConfigure =
     ''
       export CPATH=$(ls -d ${gcc.cc}/lib/gcc/*/${gcc.cc.version}/plugin/include)
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 29d0a94e301f..996bfeacb2d1 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -24,14 +24,14 @@ with two "luarocks" derivations.
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "luarocks";
-  version = "3.11.0";
+  pname = "luarocks_bootstrap";
+  version = "3.11.1";
 
   src = fetchFromGitHub {
     owner = "luarocks";
     repo = "luarocks";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mSwwBuLWoMT38iYaV/BTdDmmBz4heTRJzxBHC0Vrvc4=";
+    hash = "sha256-GglygI8HP+aDFEuucOkjQ2Pgfv4+jW+og+2vL3KoZCQ=";
   };
 
   patches = [
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     sed -e "1s@.*@#! ${lua}/bin/lua$LUA_SUFFIX@" -i "$out"/bin/*
     substituteInPlace $out/etc/luarocks/* \
-     --replace '${lua.luaOnBuild}' '${lua}'
+     --replace-fail '${lua.luaOnBuild}' '${lua}'
    ''
     + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd luarocks \
diff --git a/pkgs/development/tools/misc/unixbench/default.nix b/pkgs/development/tools/misc/unixbench/default.nix
index 4edd464a763d..d5f060af82cf 100644
--- a/pkgs/development/tools/misc/unixbench/default.nix
+++ b/pkgs/development/tools/misc/unixbench/default.nix
@@ -6,7 +6,7 @@
 , installShellFiles
 , perl
 , xorg
-, libGL
+, libGLX
 , coreutils
 , unixtools
 , targetPackages
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl ] ++ lib.optionals withGL [
     xorg.libX11
     xorg.libXext
-    libGL
+    libGLX
   ];
 
   runtimeDependencies = [
diff --git a/pkgs/development/tools/prospector/default.nix b/pkgs/development/tools/prospector/default.nix
index 598b2570600e..58fab74c9884 100644
--- a/pkgs/development/tools/prospector/default.nix
+++ b/pkgs/development/tools/prospector/default.nix
@@ -27,7 +27,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index f7c213c13dd5..266cd54fdfd2 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-3rID2epV1pCwpofFf9Wuafs1SlBWH7e7/4HPaSUAriQ=";
+    hash = "sha256-cKX5fDPQElNLAur2PF6J5050QnMNrazMTCVtGmjwmxQ=";
   };
 
-  cargoHash = "sha256-hPyPMQm/Oege0PPjYIrd1fEDOGqoQ1ffS2l6o8je4t4=";
+  cargoHash = "sha256-EuMPcJAGz564cC9UWrlihBxRUJCtqw4jvP/SQgx2L/0=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
diff --git a/pkgs/development/tools/simavr/default.nix b/pkgs/development/tools/simavr/default.nix
index 8c56bb08a976..deab8539ef14 100644
--- a/pkgs/development/tools/simavr/default.nix
+++ b/pkgs/development/tools/simavr/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, makeSetupHook, fetchFromGitHub, libelf, which, pkg-config, freeglut
+{ lib, stdenv, makeSetupHook, fetchFromGitHub, libelf, which, pkg-config, libglut
 , avrgcc, avrlibc
 , libGLU, libGL
 , GLUT }:
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ which pkg-config avrgcc ]
     ++ lib.optional stdenv.isDarwin setupHookDarwin;
-  buildInputs = [ libelf freeglut libGLU libGL ]
+  buildInputs = [ libelf libglut libGLU libGL ]
     ++ lib.optional stdenv.isDarwin GLUT;
 
   # remove forbidden references to $TMPDIR
diff --git a/pkgs/development/tools/skjold/default.nix b/pkgs/development/tools/skjold/default.nix
index 75de1dfe1eb2..bbd5f57a778d 100644
--- a/pkgs/development/tools/skjold/default.nix
+++ b/pkgs/development/tools/skjold/default.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     click
diff --git a/pkgs/development/web/nodejs/bin-sh-node-run-v22.patch b/pkgs/development/web/nodejs/bin-sh-node-run-v22.patch
new file mode 100644
index 000000000000..3fd142a3e440
--- /dev/null
+++ b/pkgs/development/web/nodejs/bin-sh-node-run-v22.patch
@@ -0,0 +1,14 @@
+Fixes test/parallel/test-node-run.js subtest.
+
+Note that this techinically depends on an impurity during build, see
+also https://github.com/NixOS/nix/issues/6081. Currently stdenv allows
+/bin/sh as an impure host dependency on Darwin, so we are guaranteed to
+have it to certain degree, although it is very hacky.
+
+--- a/test/fixtures/run-script/node_modules/.bin/positional-args
++++ b/test/fixtures/run-script/node_modules/.bin/positional-args
+@@ -1,3 +1,3 @@
+-#!/bin/bash
++#!/bin/sh
+ echo "Arguments: '$@'"
+ echo "The total number of arguments are: $#"
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 73867d11a784..28fef6832bef 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -7,6 +7,7 @@
 , gnupg
 , darwin, xcbuild
 , procps, icu
+, installShellFiles
 }:
 
 { enableNpm ? true, version, sha256, patches ? [] } @args:
@@ -69,7 +70,7 @@ let
     buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ApplicationServices ]
       ++ [ zlib libuv openssl http-parser icu bash ];
 
-    nativeBuildInputs = [ which pkg-config python ]
+    nativeBuildInputs = [ installShellFiles pkg-config python which ]
       ++ lib.optionals stdenv.isDarwin [ xcbuild ];
 
     outputs = [ "out" "libv8" ];
@@ -137,14 +138,25 @@ let
       "build-node-api-tests"
       "tooltest"
       "cctest"
+      "test-ci-js"
     ];
 
-    # Do not create __pycache__ when running tests.
-    checkFlags = [ "PYTHONDONTWRITEBYTECODE=1" ];
+    checkFlags = [
+      # Do not create __pycache__ when running tests.
+      "PYTHONDONTWRITEBYTECODE=1"
+      "FLAKY_TESTS=skip"
+      # Skip some tests that are not passing in this context
+      "CI_SKIP_TESTS=test-setproctitle,test-tls-cli-max-version-1.3,test-tls-client-auth,test-child-process-exec-env,test-fs-write-stream-eagain,test-tls-sni-option,test-https-foafssl,test-child-process-uid-gid,test-process-euid-egid,test-process-initgroups,test-process-uid-gid,test-process-setgroups"
+    ];
 
     postInstall = ''
       HOST_PATH=$out/bin patchShebangs --host $out
 
+      ${lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        $out/bin/${self.meta.mainProgram} --completion-bash > ${self.meta.mainProgram}.bash
+        installShellCompletion ${self.meta.mainProgram}.bash
+      ''}
+
       ${lib.optionalString (enableNpm) ''
         mkdir -p $out/share/bash-completion/completions
         ln -s $out/lib/node_modules/npm/lib/utils/completion.sh \
diff --git a/pkgs/development/web/nodejs/use-correct-env-in-tests.patch b/pkgs/development/web/nodejs/use-correct-env-in-tests.patch
new file mode 100644
index 000000000000..d2fda8d2cead
--- /dev/null
+++ b/pkgs/development/web/nodejs/use-correct-env-in-tests.patch
@@ -0,0 +1,24 @@
+`/usr/bin/env` is not available.
+
+--- old/test/common/assertSnapshot.js
++++ new/test/common/assertSnapshot.js
+@@ -81,2 +81,2 @@ async function spawnAndAssert(filename, transform = (x) => x, { tty = false, ...
+-  const executable = tty ? 'tools/pseudo-tty.py' : process.execPath;
+-  const args = tty ? [process.execPath, ...flags, filename] : [...flags, filename];
++  const executable = tty ? 'python3' : process.execPath;
++  const args = tty ? ['tools/pseudo-tty.py', process.execPath, ...flags, filename] : [...flags, filename];
+--- old/test/parallel/test-child-process-default-options.js
++++ new/test/parallel/test-child-process-default-options.js
+@@ -35 +35 @@ if (isWindows) {
+-  child = spawn('/usr/bin/env', [], {});
++  child = spawn('env', [], {});
+--- old/test/parallel/test-child-process-env.js
++++ new/test/parallel/test-child-process-env.js
+@@ -51 +51 @@ if (isWindows) {
+-  child = spawn('/usr/bin/env', [], { env });
++  child = spawn('env', [], { env });
+--- old/test/parallel/test-child-process-exec-env.js
++++ new/test/parallel/test-child-process-exec-env.js
+@@ -47 +47 @@ if (!isWindows) {
+-  child = exec('/usr/bin/env', { env: { 'HELLO': 'WORLD' } }, after);
++  child = exec('env', { env: { 'HELLO': 'WORLD' } }, after);
diff --git a/pkgs/development/web/nodejs/v18-openssl-3.0.14.patch b/pkgs/development/web/nodejs/v18-openssl-3.0.14.patch
new file mode 100644
index 000000000000..b63fb8ad1303
--- /dev/null
+++ b/pkgs/development/web/nodejs/v18-openssl-3.0.14.patch
@@ -0,0 +1,24 @@
+diff --git a/test/parallel/test-tls-alpn-server-client.js b/test/parallel/test-tls-alpn-server-client.js
+index 522dd34ad2..3f0ee2a0f9 100644
+--- a/test/parallel/test-tls-alpn-server-client.js
++++ b/test/parallel/test-tls-alpn-server-client.js
+@@ -195,7 +195,8 @@ function TestALPNCallback() {
+ 
+     // Callback picks 2nd preference => undefined => ALPN rejected:
+     assert.strictEqual(results[1].server, undefined);
+-    assert.strictEqual(results[1].client.error.code, 'ECONNRESET');
++    const allowedErrors = ['ECONNRESET', 'ERR_SSL_TLSV1_ALERT_NO_APPLICATION_PROTOCOL'];
++    assert.ok(allowedErrors.includes(results[1].client.error.code), `'${results[1].client.error.code}' was not one of ${allowedErrors}.`);
+ 
+     TestBadALPNCallback();
+   });
+@@ -218,7 +219,8 @@ function TestBadALPNCallback() {
+   runTest(clientsOptions, serverOptions, function(results) {
+     // Callback returns 'http/5' => doesn't match client ALPN => error & reset
+     assert.strictEqual(results[0].server, undefined);
+-    assert.strictEqual(results[0].client.error.code, 'ECONNRESET');
++    const allowedErrors = ['ECONNRESET', 'ERR_SSL_TLSV1_ALERT_NO_APPLICATION_PROTOCOL'];
++    assert.ok(allowedErrors.includes(results[0].client.error.code), `'${results[0].client.error.code}' was not one of ${allowedErrors}.`);
+ 
+     TestALPNOptionsCallback();
+   });
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 6b3ca7635e43..b44dbc8e51d2 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -1,4 +1,4 @@
-{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, enableNpm ? true }:
+{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python311, fetchpatch2, enableNpm ? true }:
 
 let
   # Clang 16+ cannot build Node v18 due to -Wenum-constexpr-conversion errors.
@@ -14,7 +14,7 @@ let
     inherit openssl;
     stdenv = ensureCompatibleCC pkgs;
     buildPackages = buildPackages // { stdenv = ensureCompatibleCC buildPackages; };
-    python = python3;
+    python = python311;
   };
 in
 buildNodejs {
@@ -27,5 +27,11 @@ buildNodejs {
     ./revert-arm64-pointer-auth.patch
     ./node-npm-build-npm-package-logic.patch
     ./trap-handler-backport.patch
+    ./use-correct-env-in-tests.patch
+    ./v18-openssl-3.0.14.patch
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/534c122de166cb6464b489f3e6a9a544ceb1c913.patch";
+      hash = "sha256-4q4LFsq4yU1xRwNsM1sJoNVphJCnxaVe2IyL6AeHJ/I=";
+    })
   ];
 }
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index b716f9bdd1ed..1fb2d61fba21 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch2, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
@@ -8,12 +8,20 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.12.2";
-  sha256 = "sha256-18vMX7+zHpAB8/AVC77aWavl3XE3qqYnOVjNWc41ztc=";
+  version = "20.14.0";
+  sha256 = "sha256-CGVQKPDYQ26IFj+RhgRNY10/Nqhe5Sjza9BbbF5Gwbs=";
   patches = [
-    ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
     ./bypass-darwin-xcrun-node16.patch
     ./node-npm-build-npm-package-logic.patch
+    ./use-correct-env-in-tests.patch
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/534c122de166cb6464b489f3e6a9a544ceb1c913.patch";
+      hash = "sha256-4q4LFsq4yU1xRwNsM1sJoNVphJCnxaVe2IyL6AeHJ/I=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/14863e80584e579fd48c55f6373878c821c7ff7e.patch";
+      hash = "sha256-I7Wjc7DE059a/ZyXAvAqEGvDudPjxQqtkBafckHCFzo=";
+    })
   ];
 }
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index ec5cc40cc9c2..4bc7c46c15ba 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch2, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
@@ -14,5 +14,13 @@ buildNodejs {
     ./disable-darwin-v8-system-instrumentation-node19.patch
     ./bypass-darwin-xcrun-node16.patch
     ./node-npm-build-npm-package-logic.patch
+    ./use-correct-env-in-tests.patch
+    ./bin-sh-node-run-v22.patch
+    (fetchpatch2 {
+      # Fixes OpenSSL 3.0.14 compatibility in tests.
+      # See https://github.com/nodejs/node/pull/53373
+      url = "https://github.com/nodejs/node/commit/14863e80584e579fd48c55f6373878c821c7ff7e.patch";
+      hash = "sha256-I7Wjc7DE059a/ZyXAvAqEGvDudPjxQqtkBafckHCFzo=";
+    })
   ];
 }
diff --git a/pkgs/games/chromium-bsu/default.nix b/pkgs/games/chromium-bsu/default.nix
index f3dfb41c7792..135110028f43 100644
--- a/pkgs/games/chromium-bsu/default.nix
+++ b/pkgs/games/chromium-bsu/default.nix
@@ -6,7 +6,7 @@
 , SDL2_mixer
 , fontconfig
 , freealut
-, freeglut
+, libglut
 , ftgl
 , gettext
 , glpng
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     SDL2_mixer
     fontconfig
     freealut
-    freeglut
+    libglut
     ftgl
     glpng
     libGL
diff --git a/pkgs/games/construo/default.nix b/pkgs/games/construo/default.nix
index 4c9419a54c65..c4d4c50df393 100644
--- a/pkgs/games/construo/default.nix
+++ b/pkgs/games/construo/default.nix
@@ -5,7 +5,7 @@
 , xorgproto
 , libGL ? null
 , libGLU ? null
-, freeglut ? null
+, libglut ? null
 }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libX11 zlib xorgproto ]
     ++ lib.optional (libGL != null) libGL
     ++ lib.optional (libGLU != null) libGLU
-    ++ lib.optional (freeglut != null) freeglut;
+    ++ lib.optional (libglut != null) libglut;
 
   preConfigure = ''
     substituteInPlace src/Makefile.in \
diff --git a/pkgs/games/crack-attack/default.nix b/pkgs/games/crack-attack/default.nix
index 0aee67a2e407..d3d347066462 100644
--- a/pkgs/games/crack-attack/default.nix
+++ b/pkgs/games/crack-attack/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, gtk2, freeglut, SDL, SDL_mixer, libGLU, libGL, libXi, libXmu }:
+{ lib, stdenv, fetchurl, pkg-config, gtk2, libglut, SDL, SDL_mixer, libGLU, libGL, libXi, libXmu }:
 
 stdenv.mkDerivation rec {
   pname = "crack-attack";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 freeglut SDL SDL_mixer libGLU libGL libXi libXmu ];
+  buildInputs = [ gtk2 libglut SDL SDL_mixer libGLU libGL libXi libXmu ];
 
   hardeningDisable = [ "format" ];
   enableParallelBuilding = true;
diff --git a/pkgs/games/ddnet/default.nix b/pkgs/games/ddnet/default.nix
index 955baea28be8..678e7d6d59b8 100644
--- a/pkgs/games/ddnet/default.nix
+++ b/pkgs/games/ddnet/default.nix
@@ -109,7 +109,8 @@ stdenv.mkDerivation rec {
     "-DCLIENT=${if buildClient then "ON" else "OFF"}"
   ];
 
-  doCheck = true;
+  # Tests loop forever on Darwin for some reason
+  doCheck = !stdenv.isDarwin;
   checkTarget = "run_tests";
 
   postInstall = lib.optionalString (!buildClient) ''
diff --git a/pkgs/games/empty-epsilon/default.nix b/pkgs/games/empty-epsilon/default.nix
index 3bcf14190601..9e2d8ab4216f 100644
--- a/pkgs/games/empty-epsilon/default.nix
+++ b/pkgs/games/empty-epsilon/default.nix
@@ -33,7 +33,8 @@ let
     buildInputs = [ sfml libX11 glm SDL2 ];
 
     cmakeFlags = [
-      "-DFETCHCONTENT_SOURCE_DIR_BASIS=${basis-universal}"
+      (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_BASIS" "${basis-universal}")
+      (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DGLM_ENABLE_EXPERIMENTAL")
     ];
 
     meta = with lib; {
@@ -63,15 +64,16 @@ stdenv.mkDerivation {
   buildInputs = [ serious-proton sfml glew libX11 python3 glm SDL2 ninja ];
 
   cmakeFlags = [
-    "-DSERIOUS_PROTON_DIR=${serious-proton.src}"
-    "-DCPACK_PACKAGE_VERSION=${version.emptyepsilon}"
-    "-DCPACK_PACKAGE_VERSION_MAJOR=${major}"
-    "-DCPACK_PACKAGE_VERSION_MINOR=${minor}"
-    "-DCPACK_PACKAGE_VERSION_PATCH=${patch.emptyepsilon}"
-    "-DFETCHCONTENT_SOURCE_DIR_BASIS=${basis-universal}"
-    "-DFETCHCONTENT_SOURCE_DIR_MESHOPTIMIZER=${meshoptimizer.src}"
-    "-DCMAKE_AR=${stdenv.cc.cc}/bin/gcc-ar"
-    "-DCMAKE_RANLIB=${stdenv.cc.cc}/bin/gcc-ranlib"
+    (lib.cmakeFeature "SERIOUS_PROTON_DIR" "${serious-proton.src}")
+    (lib.cmakeFeature "CPACK_PACKAGE_VERSION" "${version.emptyepsilon}")
+    (lib.cmakeFeature "CPACK_PACKAGE_VERSION_MAJOR" "${major}")
+    (lib.cmakeFeature "CPACK_PACKAGE_VERSION_MINOR" "${minor}")
+    (lib.cmakeFeature "CPACK_PACKAGE_VERSION_PATCH" "${patch.emptyepsilon}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_BASIS" "${basis-universal}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_MESHOPTIMIZER" "${meshoptimizer.src}")
+    (lib.cmakeFeature "CMAKE_AR" "${stdenv.cc.cc}/bin/gcc-ar")
+    (lib.cmakeFeature "CMAKE_RANLIB" "${stdenv.cc.cc}/bin/gcc-ranlib")
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DGLM_ENABLE_EXPERIMENTAL")
     "-G Ninja"
   ];
 
diff --git a/pkgs/games/extremetuxracer/default.nix b/pkgs/games/extremetuxracer/default.nix
index a1322499ea6a..8e774a63ee54 100644
--- a/pkgs/games/extremetuxracer/default.nix
+++ b/pkgs/games/extremetuxracer/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libGLU, libGL, libX11, xorgproto, tcl, freeglut, freetype
+{ lib, stdenv, fetchurl, libGLU, libGL, libX11, xorgproto, tcl, libglut, freetype
 , sfml, libXi
 , libXmu, libXext, libXt, libSM, libICE
 , libpng, pkg-config, gettext, intltool
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
-    libGLU libGL libX11 xorgproto tcl freeglut freetype
+    libGLU libGL libX11 xorgproto tcl libglut freetype
     sfml libXi
     libXmu libXext libXt libSM libICE
     libpng gettext
diff --git a/pkgs/games/flightgear/default.nix b/pkgs/games/flightgear/default.nix
index 5124a8df1358..d81b2774b4ae 100644
--- a/pkgs/games/flightgear/default.nix
+++ b/pkgs/games/flightgear/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, wrapQtAppsHook
-, freeglut, freealut, libGLU, libGL, libICE, libjpeg, openal, openscenegraph, plib
+, libglut, freealut, libGLU, libGL, libICE, libjpeg, openal, openscenegraph, plib
 , libSM, libunwind, libX11, xorgproto, libXext, libXi
 , libXmu, libXt, simgear, zlib, boost, cmake, libpng, udev, fltk13, apr
 , makeDesktopItem, qtbase, qtdeclarative, glew, curl
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake wrapQtAppsHook ];
   buildInputs = [
-    freeglut freealut libGLU libGL libICE libjpeg openal openscenegraph plib
+    libglut freealut libGLU libGL libICE libjpeg openal openscenegraph plib
     libSM libunwind libX11 xorgproto libXext libXi
     libXmu libXt simgear zlib boost libpng udev fltk13 apr qtbase
     glew qtdeclarative curl
diff --git a/pkgs/games/frogatto/engine.nix b/pkgs/games/frogatto/engine.nix
index 1efdb2ceee04..d5e380588176 100644
--- a/pkgs/games/frogatto/engine.nix
+++ b/pkgs/games/frogatto/engine.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation {
     glm
   ];
 
+  env.CXXFLAGS = "-DGLM_ENABLE_EXPERIMENTAL -Wno-error=deprecated-declarations";
+
   enableParallelBuilding = true;
 
   installPhase = ''
diff --git a/pkgs/games/gl-117/default.nix b/pkgs/games/gl-117/default.nix
index 8ce2e228ff86..5ba29fa49af3 100644
--- a/pkgs/games/gl-117/default.nix
+++ b/pkgs/games/gl-117/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl
-, libGLU, libGL, SDL, freeglut, SDL_mixer, autoconf, automake, libtool
+, libGLU, libGL, SDL, libglut, SDL_mixer, autoconf, automake, libtool
 }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ automake autoconf ];
-  buildInputs = [ libGLU libGL SDL freeglut SDL_mixer libtool ];
+  buildInputs = [ libGLU libGL SDL libglut SDL_mixer libtool ];
 
   meta = with lib; {
     description = "Air combat simulator";
diff --git a/pkgs/games/gl-gsync-demo/default.nix b/pkgs/games/gl-gsync-demo/default.nix
index a776a1b13dff..8ea4facb77b7 100644
--- a/pkgs/games/gl-gsync-demo/default.nix
+++ b/pkgs/games/gl-gsync-demo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, libX11, freeglut, glew, libXNVCtrl, libXext, lib }:
+{ stdenv, fetchFromGitHub, libX11, libglut, glew, libXNVCtrl, libXext, lib }:
 
 stdenv.mkDerivation rec {
   pname = "gl-gsync-demo";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1innsmpsd9n9ih80v16rhj2ijrl28jd7x6a4jmxdirba7mjibm8d";
   };
 
-  buildInputs = [ libX11 freeglut glew libXNVCtrl libXext ];
+  buildInputs = [ libX11 libglut glew libXNVCtrl libXext ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/games/hedgewars/default.nix b/pkgs/games/hedgewars/default.nix
index 33c23e051446..a74ef62a77b1 100644
--- a/pkgs/games/hedgewars/default.nix
+++ b/pkgs/games/hedgewars/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, SDL2_image_2_6, SDL2_ttf, SDL2_net, fpc, haskell, ffmpeg_4, freeglut
+{ stdenv, SDL2_image_2_6, SDL2_ttf, SDL2_net, fpc, haskell, ffmpeg_4, libglut
 , lib, fetchurl, cmake, pkg-config, lua5_1, SDL2, SDL2_mixer
 , zlib, libpng, libGL, libGLU, physfs
 , qtbase, qttools, wrapQtAppsHook
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     SDL2_ttf SDL2_net SDL2 SDL2_mixer SDL2_image_2_6
     fpc lua5_1
     llvm # hard-requirement on aarch64, for some reason not strictly necessary on x86-64
-    ffmpeg_4 freeglut physfs
+    ffmpeg_4 libglut physfs
     qtbase
   ] ++ lib.optional withServer ghc;
 
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   ];
 
   qtWrapperArgs = [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libGL libGLU freeglut physfs ]}"
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libGL libGLU libglut physfs ]}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/games/katago/default.nix b/pkgs/games/katago/default.nix
index a633430ee673..6bbe30ce4d30 100644
--- a/pkgs/games/katago/default.nix
+++ b/pkgs/games/katago/default.nix
@@ -53,11 +53,9 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (backend == "cuda") [
     cudaPackages.cudnn
     cudaPackages.cudatoolkit
-    mesa.drivers
   ] ++ lib.optionals (backend == "tensorrt") [
       cudaPackages.cudatoolkit
       cudaPackages.tensorrt
-      mesa.drivers
   ] ++ lib.optionals (backend == "opencl") [
     opencl-headers
     ocl-icd
diff --git a/pkgs/games/mar1d/default.nix b/pkgs/games/mar1d/default.nix
index b069e3fecc46..0bd6026e32d6 100644
--- a/pkgs/games/mar1d/default.nix
+++ b/pkgs/games/mar1d/default.nix
@@ -8,15 +8,16 @@
 , ninja
 , pkg-config
 , fetchFromGitHub
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
   pname = "MAR1D";
-  version = "0.3.1";
+  version = "unstable-2023-02-02";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-c48azBGdnzhEQGUeRJWlNLJhtrYjnpiORuWvowcQK5Y=";
-    rev = "v${version}";
+    hash = "sha256-kZERhwnTpBhjx6MLdf1bYCWMjtTiId/5a69kRt+/6oY=";
+    rev = "fa5dc36e1819a15539ced339ad01672e5a498c5c";
     repo = "MAR1D";
     owner = "Radvendii";
   };
@@ -30,6 +31,15 @@ stdenv.mkDerivation rec {
     libGLU
   ];
 
+  patches = [
+    # Fix the build on Darwin.
+    # https://github.com/Radvendii/MAR1D/pull/4
+    (fetchpatch {
+      url = "https://github.com/Radvendii/MAR1D/commit/baf3269e90eca69f154a43c4c1ef14677a6300fd.patch";
+      hash = "sha256-ybdLA2sO8e0J7w4roSdMWn72OkttD3y+cJ3ScuGiHCI=";
+    })
+  ];
+
   meta = with lib; {
     description = "First person Super Mario Bros";
     mainProgram = "MAR1D";
diff --git a/pkgs/games/methane/default.nix b/pkgs/games/methane/default.nix
index d1e4bb03409d..b3c8fbf34a4b 100644
--- a/pkgs/games/methane/default.nix
+++ b/pkgs/games/methane/default.nix
@@ -7,7 +7,7 @@
 , SDL2_mixer
 , fontconfig
 , freealut
-, freeglut
+, libglut
 , gettext
 , libGL
 , libGLU
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     SDL2_mixer
     fontconfig
     freealut
-    freeglut
+    libglut
     libGL
     libGLU
     openal
diff --git a/pkgs/games/minetest/default.nix b/pkgs/games/minetest/default.nix
index 070cf908fa55..302e989a6570 100644
--- a/pkgs/games/minetest/default.nix
+++ b/pkgs/games/minetest/default.nix
@@ -34,6 +34,7 @@
 , libX11
 , ninja
 , prometheus-cpp
+, mesa
 , OpenGL
 , OpenAL ? openal
 , Carbon
@@ -95,7 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     gmp
     libspatialindex
   ] ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform luajit) luajit
-    ++ lib.optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    mesa # for <KHR/khrplatform.h>
     libiconv
     OpenGL
     OpenAL
@@ -108,6 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
     openal
     libogg
     libvorbis
+  ] ++ lib.optionals (buildClient && !stdenv.hostPlatform.isDarwin) [
     xorg.libX11
   ] ++ lib.optionals buildServer [
     leveldb
diff --git a/pkgs/games/newtonwars/default.nix b/pkgs/games/newtonwars/default.nix
index c9ed0ca0dbc5..62d553f402f6 100644
--- a/pkgs/games/newtonwars/default.nix
+++ b/pkgs/games/newtonwars/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , makeWrapper
-, freeglut
+, libglut
 , libGLU
 , libGL
 }:
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ freeglut libGL libGLU ];
+  buildInputs = [ libglut libGL libGLU ];
 
   patchPhase = ''
     sed -i "s;font24.raw;$out/share/font24.raw;g" display.c
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
     cp font24.raw $out/share
 
     wrapProgram $out/bin/nw \
-      --prefix LD_LIBRARY_PATH ":" ${freeglut}/lib \
+      --prefix LD_LIBRARY_PATH ":" ${libglut}/lib \
       --prefix LD_LIBRARY_PATH ":" ${libGLU}/lib \
       --prefix LD_LIBRARY_PATH ":" ${libGL}/lib
   '';
diff --git a/pkgs/games/solarus/default.nix b/pkgs/games/solarus/default.nix
index fd80b03066ce..b59c20c2b322 100644
--- a/pkgs/games/solarus/default.nix
+++ b/pkgs/games/solarus/default.nix
@@ -22,6 +22,10 @@ mkDerivation rec {
     openal libmodplug libvorbis
     qtbase glm ];
 
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DGLM_ENABLE_EXPERIMENTAL")
+  ];
+
   preFixup = ''
     mkdir $lib/
     mv $out/lib $lib
diff --git a/pkgs/games/space-orbit/default.nix b/pkgs/games/space-orbit/default.nix
index 9cd0892a31bb..74db273bb879 100644
--- a/pkgs/games/space-orbit/default.nix
+++ b/pkgs/games/space-orbit/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl
-, libGLU, libGL, libXi, libXt, libXext, libX11, libXmu, freeglut
+, libGLU, libGL, libXi, libXt, libXext, libX11, libXmu, libglut
 }:
 
 stdenv.mkDerivation rec {
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   version = "1.01";
   patchversion = "9";
 
-  buildInputs = [ libGLU libGL libXi libXt libXext libX11 libXmu freeglut ];
+  buildInputs = [ libGLU libGL libXi libXt libXext libX11 libXmu libglut ];
 
   src = fetchurl {
     url = "mirror://debian/pool/main/s/space-orbit/space-orbit_${version}.orig.tar.gz";
diff --git a/pkgs/games/speed-dreams/default.nix b/pkgs/games/speed-dreams/default.nix
index bdfc68f837d1..f81c2f7f2f34 100644
--- a/pkgs/games/speed-dreams/default.nix
+++ b/pkgs/games/speed-dreams/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, libGLU, libGL, freeglut, libX11, plib, openal, freealut, libXrandr, xorgproto,
+{ fetchurl, lib, stdenv, libGLU, libGL, libglut, libX11, plib, openal, freealut, libXrandr, xorgproto,
 libXext, libSM, libICE, libXi, libXt, libXrender, libXxf86vm, openscenegraph, expat,
 libpng, zlib, bash, SDL2, SDL2_mixer, enet, libjpeg, cmake, pkg-config, libvorbis, runtimeShell, curl, copyDesktopItems, makeDesktopItem }:
 
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config cmake copyDesktopItems ];
 
-  buildInputs = [ libpng libGLU libGL freeglut libX11 plib openal freealut libXrandr xorgproto
+  buildInputs = [ libpng libGLU libGL libglut libX11 plib openal freealut libXrandr xorgproto
     libXext libSM libICE libXi libXt libXrender libXxf86vm zlib bash expat
     SDL2 SDL2_mixer enet libjpeg openscenegraph libvorbis curl ];
 
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index d8e412e57a99..8b504b6c55b6 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -162,7 +162,7 @@ in buildFHSEnv rec {
     gtk2
     bzip2
     flac
-    freeglut
+    libglut
     libjpeg
     libpng
     libpng12
diff --git a/pkgs/games/torcs/default.nix b/pkgs/games/torcs/default.nix
index 9c712ae41a43..46831a503324 100644
--- a/pkgs/games/torcs/default.nix
+++ b/pkgs/games/torcs/default.nix
@@ -1,4 +1,4 @@
-{ fetchpatch, fetchurl, lib, stdenv, libGLU, freeglut, libX11, plib, openal, freealut, libXrandr, xorgproto,
+{ fetchpatch, fetchurl, lib, stdenv, libGLU, libglut, libX11, plib, openal, freealut, libXrandr, xorgproto,
 libXext, libSM, libICE, libXi, libXt, libXrender, libXxf86vm, libvorbis,
 libpng, zlib, makeWrapper }:
 
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ libGLU freeglut libX11 plib openal freealut libXrandr xorgproto
+  buildInputs = [ libGLU libglut libX11 plib openal freealut libXrandr xorgproto
     libXext libSM libICE libXi libXt libXrender libXxf86vm libpng zlib libvorbis ];
 
   installTargets = "install datainstall";
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index 60eb1189391d..c3356cc254e4 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -66,8 +66,8 @@ let
 
     nativeBuildInputs = [ unzip ];
     buildInputs = [ libjpeg zlib libvorbis curl gmp ]
-      ++ lib.optionals withGLX [ libX11.dev libGLU.dev libGL.dev libXpm.dev libXext.dev libXxf86vm.dev alsa-lib.dev ]
-      ++ lib.optionals withSDL [ SDL2.dev ];
+      ++ lib.optionals withGLX [ libX11 libGLU libGL libXpm libXext libXxf86vm alsa-lib ]
+      ++ lib.optionals withSDL [ SDL2 ];
 
     sourceRoot = "Xonotic/source/darkplaces";
 
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index eb3b84d04529..ad98f3fa768f 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -127,7 +127,7 @@ python3Packages.buildPythonApplication {
       -e s,/usr/bin/perl,${perl}/bin/perl,g \
       -e s,/usr/bin/file,${file}/bin/file,g \
       -e s,/usr/bin/gs,${ghostscript}/bin/gs,g \
-      -e s,/usr/share/cups/fonts,${ghostscript}/share/ghostscript/fonts,g \
+      -e s,/usr/share/cups/fonts,${ghostscript.fonts}/share/fonts,g \
       -e "s,ExecStart=/usr/bin/python /usr/bin/hp-config_usb_printer,ExecStart=$out/bin/hp-config_usb_printer,g" \
       -e s,Exec=/usr/bin/hp-uiscan,Exec=hp-uiscan,g \
       -e s,Icon=/usr/share/icons/Humanity/devices/48/printer.svg,Icon=printer,g \
diff --git a/pkgs/misc/flashfocus/default.nix b/pkgs/misc/flashfocus/default.nix
index 753f82f6bd44..20f6846274b7 100644
--- a/pkgs/misc/flashfocus/default.nix
+++ b/pkgs/misc/flashfocus/default.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
   '';
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 8410f77d2c07..64bdf7b0d99e 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     ./doc-no-ref.diff
   ];
 
-  outputs = [ "out" "man" "doc" ];
+  outputs = [ "out" "man" "doc" "fonts" ];
 
   enableParallelBuilding = true;
 
@@ -133,7 +133,9 @@ stdenv.mkDerivation rec {
 
     cp -r Resource "$out/share/ghostscript/${version}"
 
-    ln -s "${fonts}" "$out/share/ghostscript/fonts"
+    mkdir -p $fonts/share/fonts
+    cp -rv ${fonts}/* "$fonts/share/fonts/"
+    ln -s "$fonts/share/fonts" "$out/share/ghostscript/fonts"
   '' + lib.optionalString stdenv.isDarwin ''
     for file in $out/lib/*.dylib* ; do
       install_name_tool -id "$file" $file
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 53b900806ab3..d13c9315b3c3 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, python3Packages, makeWrapper
+{ lib, stdenv, fetchFromGitHub, fetchpatch2, pkg-config, python3Packages, makeWrapper
 , libsamplerate, libsndfile, readline, eigen, celt
 , wafHook
 # Darwin Dependencies
@@ -46,6 +46,15 @@ stdenv.mkDerivation (finalAttrs: {
     aften AudioUnit CoreAudio Accelerate libobjc
   ];
 
+  patches = [
+    (fetchpatch2 {
+      # Python 3.12 support
+      name = "jack2-waf2.0.26.patch";
+      url = "https://github.com/jackaudio/jack2/commit/250420381b1a6974798939ad7104ab1a4b9a9994.patch";
+      hash = "sha256-M/H72lLTeddefqth4BSkEfySZRYMIzLErb7nIgVN0u8=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs --build svnversion_regenerate.sh
   '';
diff --git a/pkgs/misc/lilypond/default.nix b/pkgs/misc/lilypond/default.nix
index acb3a543f68a..e66c76614fb2 100644
--- a/pkgs/misc/lilypond/default.nix
+++ b/pkgs/misc/lilypond/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--disable-documentation"
      # FIXME: these URW fonts are not OTF, configure reports "URW++ OTF files... no".
-    "--with-urwotf-dir=${ghostscript}/share/ghostscript/fonts"
+    "--with-urwotf-dir=${ghostscript.fonts}/share/fonts"
     "--with-texgyre-dir=${gyre-fonts}/share/fonts/truetype/"
   ];
 
diff --git a/pkgs/misc/rich-cli/default.nix b/pkgs/misc/rich-cli/default.nix
index b6cf7684c44d..a76f921dcf99 100644
--- a/pkgs/misc/rich-cli/default.nix
+++ b/pkgs/misc/rich-cli/default.nix
@@ -39,7 +39,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/misc/screensavers/electricsheep/default.nix b/pkgs/misc/screensavers/electricsheep/default.nix
index a231d22d90f5..6691feeec6bb 100644
--- a/pkgs/misc/screensavers/electricsheep/default.nix
+++ b/pkgs/misc/screensavers/electricsheep/default.nix
@@ -13,7 +13,7 @@
 , libgtop
 , boost179
 , tinyxml
-, freeglut
+, libglut
 , libGLU
 , libGL
 , glee
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     libgtop
     boost179
     tinyxml
-    freeglut
+    libglut
     libGLU
     libGL
     glee
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 206f46125b9b..af37143835c5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -59,7 +59,7 @@ appleDerivation' stdenv {
       (cd $dep/include && find . -name '*.h' | copyHierarchy $out/include)
     done
 
-    (cd ${buildPackages.darwin.cctools.dev}/include/mach-o && find . -name '*.h' | copyHierarchy $out/include/mach-o)
+    (cd ${lib.getDev buildPackages.darwin.cctools}/include/mach-o && find . -name '*.h' | copyHierarchy $out/include/mach-o)
 
     for header in pthread.h pthread_impl.h pthread_spis.h sched.h; do
       ln -s "$out/include/pthread/$header" "$out/include/$header"
@@ -142,7 +142,7 @@ appleDerivation' stdenv {
       $out/lib
 
     substituteInPlace $out/lib/libSystem.B.tbd \
-      --replace "/usr/lib/system/" "$out/lib/system/"
+      --replace-fail "/usr/lib/system/" "$out/lib/system/"
     ln -s libSystem.B.tbd $out/lib/libSystem.tbd
 
     # Set up links to pretend we work like a conventional unix (Apple's design, not mine!)
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index 78c510f7da4c..ee9a80518acd 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -1,108 +1,124 @@
-{ lib, stdenv, makeWrapper, binutils-unwrapped, cctools, llvm, clang-unwrapped, dualAs ? false }:
-
-# Make sure both underlying packages claim to have prepended their binaries
-# with the same targetPrefix.
-assert binutils-unwrapped.targetPrefix == cctools.targetPrefix;
+{
+  lib,
+  stdenvNoCC,
+  cctools,
+  clang-unwrapped,
+  llvm,
+  llvm-manpages,
+  makeWrapper,
+  enableManpages ? stdenvNoCC.targetPlatform == stdenvNoCC.hostPlatform,
+}:
 
 let
-  inherit (binutils-unwrapped) targetPrefix;
-  cmds = [
-    "ar" "ranlib" "as" "install_name_tool"
-    "ld" "strip" "otool" "lipo" "nm" "strings" "size"
+  inherit (stdenvNoCC) targetPlatform hostPlatform;
+  targetPrefix = lib.optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-";
+
+  llvm_cmds = [
+    "addr2line"
+    "ar"
+    "c++filt"
+    "dsymutil"
+    "nm"
+    "objcopy"
+    "objdump"
+    "otool"
+    "size"
+    "strings"
+    "strip"
+  ];
+
+  cctools_cmds = [
     "codesign_allocate"
+    "gprof"
+    "ranlib"
+    # Use the cctools versions because the LLVM ones can crash or fail when the cctools ones don’t.
+    # Revisit when LLVM is updated to LLVM 18 on Darwin.
+    "lipo"
+    "install_name_tool"
   ];
-  isCCToolsLLVM = lib.getName cctools == "cctools-llvm";
-in
 
-# TODO: loop over targetPrefixed binaries too
-stdenv.mkDerivation {
-  pname = "${targetPrefix}cctools-binutils-darwin" + lib.optionalString dualAs "-dualas";
+  linkManPages =
+    pkg: source: target:
+    lib.optionalString enableManpages ''
+      sourcePath=${pkg}/share/man/man1/${source}.1.gz
+      targetPath=''${!outputMan}/share/man/man1/${target}.1.gz
+
+      if [ -f "$sourcePath" ]; then
+        mkdir -p "$(dirname "$targetPath")"
+        ln -s "$sourcePath" "$targetPath"
+      fi
+    '';
+in
+stdenvNoCC.mkDerivation {
+  pname = "${targetPrefix}cctools-binutils-darwin";
   inherit (cctools) version;
-  outputs = [ "out" "man" ];
+
+  outputs = [ "out" ] ++ lib.optional enableManpages "man";
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
   buildCommand = ''
     mkdir -p $out/bin $out/include
 
-    ln -s ${binutils-unwrapped.out}/bin/${targetPrefix}c++filt $out/bin/${targetPrefix}c++filt
-
-    # We specifically need:
-    # - ld: binutils doesn't provide it on darwin
-    # - as: as above
-    # - ar: the binutils one produces .a files that the cctools ld doesn't like
-    # - ranlib: for compatibility with ar
-    # - otool: we use it for some of our name mangling
-    # - install_name_tool: we use it to rewrite stuff in our bootstrap tools
-    # - strip: the binutils one seems to break mach-o files
-    # - lipo: gcc build assumes it exists
-    # - nm: the gnu one doesn't understand many new load commands
-    for i in ${lib.concatStringsSep " " (map (e: targetPrefix + e) cmds)}; do
-      ln -sf "${cctools}/bin/$i" "$out/bin/$i"
-    done
+    for tool in ${toString llvm_cmds}; do
+      # Translate between LLVM and traditional tool names (e.g., `c++filt` versus `cxxfilt`).
+      cctoolsTool=''${tool//-/_}
+      llvmTool=''${tool//++/xx}
 
-    ln -s ${llvm}/bin/dsymutil $out/bin/dsymutil
+      # Some tools aren’t prefixed (like `dsymutil`).
+      llvmPath="${lib.getBin llvm}/bin"
+      if [ -e "$llvmPath/llvm-$llvmTool" ]; then
+        llvmTool=llvm-$llvmTool
+      elif [ -e "$llvmPath/${targetPrefix}$llvmTool" ]; then
+        llvmTool=${targetPrefix}$llvmTool
+      fi
 
-    ln -s ${binutils-unwrapped.out}/share $out/share
+      # Not all tools are included in the bootstrap tools. Don’t link them if they don’t exist.
+      if [ -e "$llvmPath/$llvmTool" ]; then
+        ln -s "$llvmPath/$llvmTool" "$out/bin/${targetPrefix}$cctoolsTool"
+      fi
+      ${linkManPages llvm-manpages "$llvmTool" "$cctoolsTool"}
+    done
 
-    mkdir -p "$man"/share/man/man{1,5}
-    for i in ${lib.concatStringsSep " " cmds}; do
-      for path in "${cctools.man}"/share/man/man?/$i.*; do
-        dest_path="$man''${path#${cctools.man}}"
-        ln -sv "$path" "$dest_path"
-      done
+    for tool in ${toString cctools_cmds}; do
+      toolsrc="${lib.getBin cctools}/bin/${targetPrefix}$tool"
+      if [ -e "$toolsrc" ]; then
+        ln -s "${lib.getBin cctools}/bin/${targetPrefix}$tool" "$out/bin/${targetPrefix}$tool"
+      fi
+      ${linkManPages (lib.getMan cctools) "$tool" "$tool"}
     done
-  ''
-  + lib.optionalString (!isCCToolsLLVM) (
-    # cctools-port has a `libexec` folder for `as`, but cctools-llvm uses the clang
-    # assembler on both platforms. Only link it when cctools is cctools-port.
-    ''
-      ln -s ${cctools}/libexec $out/libexec
-    ''
-    # cctools-llvm uses the LLVM assembler on both architectures, so use the assembler
-    # from that instead of relinking it.
-    #
-    # On aarch64-darwin we must use clang, because "as" from cctools just doesn't
-    # handle the arch. Proxying calls to clang produces quite a bit of warnings,
-    # and using clang directly here is a better option than relying on cctools.
-    # On x86_64-darwin the Clang version is too old to support this mode.
-    + lib.optionalString stdenv.isAarch64 ''
-      rm $out/bin/${targetPrefix}as
-      makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
-        --add-flags "-x assembler -integrated-as -c"
-    ''
-    # x86-64 Darwin gnat-bootstrap emits assembly
-    # with MOVQ as the mnemonic for quadword interunit moves
-    # such as `movq %rbp, %xmm0`.
-    # The clang integrated assembler recognises this as valid,
-    # but unfortunately the cctools-port GNU assembler does not;
-    # it instead uses MOVD as the mnemonic.
-    # The assembly that a GCC build emits is determined at build time
-    # and cannot be changed afterwards.
-    #
-    # To build GNAT on x86-64 Darwin, therefore,
-    # we need both the clang _and_ the cctools-port assemblers to be available:
-    # the former to build at least the stage1 compiler,
-    # and the latter at least to be detectable
-    # as the target for the final compiler.
-    #
-    # We choose to match the Aarch64 case above,
-    # wrapping the clang integrated assembler as `as`.
-    # It then seems sensible to wrap the cctools GNU assembler as `gas`.
-    #
-    + lib.optionalString (stdenv.isx86_64 && dualAs) ''
-      mv $out/bin/${targetPrefix}as $out/bin/${targetPrefix}gas
-      makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
-        --add-flags "-x assembler -integrated-as -c"
-    ''
-  );
-
-  nativeBuildInputs = lib.optionals (!isCCToolsLLVM && (stdenv.isAarch64 || dualAs)) [ makeWrapper ];
+    ${
+      # These unprefixed because some tools expect to invoke them without it when cross-compiling to Darwin:
+      # - clang needs `dsymutil` when building with debug information;
+      # - meson needs `lipo` when cross-compiling to Darwin; and
+      # - meson also needs `install_name_tool` and `otool` when performing rpath cleanup on installation.
+      lib.optionalString (targetPrefix != "") ''
+        for bintool in dsymutil install_name_tool lipo otool; do
+          ln -s "$out/bin/${targetPrefix}$bintool" "$out/bin/$bintool"
+        done
+      ''
+    }
+    # Use the clang-integrated assembler. `as` in cctools is deprecated upstream and no longer built in nixpkgs.
+    makeWrapper "${lib.getBin clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
+      --add-flags "-x assembler -integrated-as -c"
+
+    ln -s '${lib.getBin cctools}/bin/${targetPrefix}ld' "$out/bin/${targetPrefix}ld"
+    ${linkManPages (lib.getMan cctools) "ld" "ld"}
+    # ${linkManPages (lib.getMan cctools) "ld-classic" "ld-classic"}
+    ${linkManPages (lib.getMan cctools) "ld64" "ld64"}
+  '';
+
+  __structuredAttrs = true;
 
   passthru = {
-    inherit targetPrefix;
-    isCCTools = true;
+    inherit cctools_cmds llvm_cmds targetPrefix;
+    isCCTools = true; # The fact ld64 is used instead of lld is why this isn’t `isLLVM`.
   };
 
   meta = {
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ reckenrode ];
     priority = 10;
   };
 }
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index 377d84d9bf73..cc162d870a2e 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
     sha256 = "0ns12q7vg9yand4dmdsps1917cavfbw67yl5q7bm6kb4ia5kkx13";
   };
 
-  outputs = [ "out" "dev" "man" ];
+  outputs = [ "out" "dev" "gas" "man" ];
 
   nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ]
     ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ memstreamHook ];
@@ -178,6 +178,12 @@ stdenv.mkDerivation {
     popd
   '';
 
+  postInstall = ''
+    # Move GNU as to its own output to prevent it from being used accidentally.
+    moveToOutput bin/gas "$gas"
+    moveToOutput libexec "$gas"
+  '';
+
   passthru = {
     inherit targetPrefix;
   };
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 4c06ea352ee0..f70ba4c7aad1 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, fetchFromGitLab, fetchpatch, makeWrapper, autoreconfHook
+, autoconf-archive
 , pkg-config, which
 , flex, bison
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
@@ -22,7 +23,7 @@
 }:
 
 let
-  apparmor-version = "3.1.7";
+  apparmor-version = "4.0.1";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -36,7 +37,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-AzY05bcpNYXix2GL4Rhc9d3RBA1pd2fwOa7yoiwc2nQ=";
+    hash = "sha256-0S/P62wi3/aPATvJL6afu+SebjoSHsTMu/WV9m7E1OE=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
@@ -86,6 +87,7 @@ let
     strictDeps = false;
 
     nativeBuildInputs = [
+      autoconf-archive
       autoreconfHook
       bison
       flex
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index d5e38ea62fb8..846d21c56d83 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , autoreconfHook
 , bash
 , buildPackages
@@ -16,13 +17,26 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "3.1.2";
+  version = "4.0";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/audit/audit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-wLF5LR8KiMbxgocQUJy7mHBZ/GhxLJdmnKkOrhA9KH0=";
+    hash = "sha256-v0ItQSard6kqTDrDneVHPyeNw941ck0lGKSMe+FdVNg=";
   };
 
+  patches = lib.optionals (!stdenv.hostPlatform.isGnu) [
+    (fetchpatch {
+      name = "musl.patch";
+      url = "https://github.com/linux-audit/audit-userspace/commit/64cb48e1e5137b8a389c7528e611617a98389bc7.patch";
+      hash = "sha256-DN2F5w+2Llm80FZntH9dvdyT00pVBSgRu8DDFILyrlU=";
+    })
+    (fetchpatch {
+      name = "musl.patch";
+      url = "https://github.com/linux-audit/audit-userspace/commit/4192eb960388458c85d76e5e385cfeef48f02c79.patch";
+      hash = "sha256-G6CJ9nBJSsTyJ0qq14PVo+YdInAvLLQtXcR25Q8V5/4=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace bindings/swig/src/auditswig.i \
       --replace "/usr/include/linux/audit.h" \
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index fb5a6ce28e1d..39f03c475fda 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.7.1";
+  version = "2.7.3";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-2l0UGeKobgGqMv15WCzVTSCIV8tUG8ov1Cal/xqqu8M=";
+    hash = "sha256-t3KuT23wzucgCyjOqWDk2q/yogPS/VAr6rPBMXsHpFY=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index 610f9d31353e..47112a26c203 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -1,39 +1,49 @@
-{ lib
-, stdenv
-, mkDerivation
-, argp-standalone
-, dbus
-, dbus_cplusplus
-, desktop-file-utils
-, fetchurl
-, fetchpatch
-, glibmm
-, libavc1394
-, libconfig
-, libiec61883
-, libraw1394
-, libxmlxx3
-, pkg-config
-, python3
-, scons
-, which
-, wrapQtAppsHook
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  argp-standalone,
+  dbus,
+  dbus_cplusplus,
+  desktop-file-utils,
+  fetchurl,
+  fetchpatch,
+  glibmm,
+  libavc1394,
+  libconfig,
+  libiec61883,
+  libraw1394,
+  libxmlxx3,
+  pkg-config,
+  python311,
+  scons,
+  which,
+  wrapQtAppsHook,
 }:
 
 let
-  python = python3.withPackages (pkgs: with pkgs; [ pyqt5 dbus-python ]);
+  python = python311.withPackages (
+    pkgs: with pkgs; [
+      pyqt5
+      dbus-python
+    ]
+  );
 in
 mkDerivation rec {
   pname = "ffado";
   version = "2.4.8";
 
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+  ];
+
   src = fetchurl {
     url = "http://www.ffado.org/files/libffado-${version}.tgz";
-    hash = "sha256-f0x561ehKw6uMSri0RZip+v1JHZuhixtywl0PVU/N44=";
+    hash = "sha256-0iFXYyGctOoHCdc232Ud80/wV81tiS7ItiS0uLKyq2Y=";
   };
 
-  sourceRoot = "libffado-${version}/libffado";
-
   prePatch = ''
     substituteInPlace ./support/tools/ffado-diag.in \
       --replace /lib/modules/ "/run/booted-system/kernel-modules/lib/modules/"
@@ -51,15 +61,13 @@ mkDerivation rec {
     })
   ];
 
-  outputs = [ "out" "bin" "dev" ];
-
   nativeBuildInputs = [
     desktop-file-utils
-    scons
+    (scons.override { python3 = python311; })
     pkg-config
     which
     python
-    python3.pkgs.pyqt5
+    python.pkgs.pyqt5
     wrapQtAppsHook
   ];
 
@@ -71,7 +79,7 @@ mkDerivation rec {
     "WILL_DEAL_WITH_XDG_MYSELF=True"
     "BUILD_MIXER=True"
     "UDEVDIR=${placeholder "out"}/lib/udev/rules.d"
-    "PYPKGDIR=${placeholder "out"}/${python3.sitePackages}"
+    "PYPKGDIR=${placeholder "out"}/${python.sitePackages}"
     "BINDIR=${placeholder "bin"}/bin"
     "INCLUDEDIR=${placeholder "dev"}/include"
     "PYTHON_INTERPRETER=${python.interpreter}"
@@ -116,7 +124,10 @@ mkDerivation rec {
     homepage = "http://www.ffado.org";
     description = "FireWire audio drivers";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ goibhniu michojel ];
+    maintainers = with maintainers; [
+      goibhniu
+      michojel
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ffado/fix-build.patch b/pkgs/os-specific/linux/ffado/fix-build.patch
index 7e360932613f..db4c47fa38d5 100644
--- a/pkgs/os-specific/linux/ffado/fix-build.patch
+++ b/pkgs/os-specific/linux/ffado/fix-build.patch
@@ -1,9 +1,14 @@
 From b0f2b20b23780dd2e67a01c15462070dd86c4ac1 Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
 Date: Sun, 3 Mar 2019 11:50:27 +0100
-Subject: [PATCH] Fix build on Nix
+Subject: [PATCH] build: Add datadir option for /usr/share
 
-We do not have global /usr.
+Hardcoded /usr/share does not work for platforms that do not have global /usr like Nix.
+Let’s introduce a new DATADIR option, that allows overriding the directory and use it for metainfodir.
+
+While at it, let’s also use it for SHAREDIR and MANDIR for consistency,
+following the GNU directory convention:
+https://www.gnu.org/prep/standards/html_node/Directory-Variables.html
 ---
  SConstruct | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
@@ -12,15 +17,48 @@ diff --git a/SConstruct b/SConstruct
 index 05755e4b..3fbdc1d8 100644
 --- a/SConstruct
 +++ b/SConstruct
-@@ -537,7 +537,7 @@ env['mandir'] = Template( env.destdir + env['MANDIR'] ).safe_substitute( env )
+@@ -49,9 +49,10 @@
+     PathVariable( "BINDIR", "Overwrite the directory where apps are installed to.", "$PREFIX/bin", PathVariable.PathAccept ),
+     PathVariable( "LIBDIR", "Overwrite the directory where libs are installed to.", "$PREFIX/lib", PathVariable.PathAccept ),
+     PathVariable( "INCLUDEDIR", "Overwrite the directory where headers are installed to.", "$PREFIX/include", PathVariable.PathAccept ),
+-    PathVariable( "SHAREDIR", "Overwrite the directory where misc shared files are installed to.", "$PREFIX/share/libffado", PathVariable.PathAccept ),
++    PathVariable( "DATADIR", "Overwrite the directory where platform-independent files are installed to.", "$PREFIX/share", PathVariable.PathAccept ),
++    PathVariable( "SHAREDIR", "Overwrite the directory where misc shared files are installed to.", "$DATADIR/libffado", PathVariable.PathAccept ),
+     PathVariable( "LIBDATADIR", "Location for architecture-dependent data.", "$LIBDIR/libffado", PathVariable.PathAccept ),
+-    PathVariable( "MANDIR", "Overwrite the directory where manpages are installed", "$PREFIX/man", PathVariable.PathAccept ),
++    PathVariable( "MANDIR", "Overwrite the directory where manpages are installed", "$DATADIR/man", PathVariable.PathAccept ),
+     PathVariable( "PYPKGDIR", "The directory where the python modules get installed.",
+         distutils.sysconfig.get_python_lib( prefix="$PREFIX" ), PathVariable.PathAccept ),
+     PathVariable( "UDEVDIR", "Overwrite the directory where udev rules are installed to.", "/lib/udev/rules.d/", PathVariable.PathAccept ),
+@@ -523,6 +524,7 @@
+ env['BINDIR'] = Template( env['BINDIR'] ).safe_substitute( env )
+ env['LIBDIR'] = Template( env['LIBDIR'] ).safe_substitute( env )
+ env['INCLUDEDIR'] = Template( env['INCLUDEDIR'] ).safe_substitute( env )
++env['DATADIR'] = Template( env['DATADIR'] ).safe_substitute( env )
+ env['SHAREDIR'] = Template( env['SHAREDIR'] ).safe_substitute( env )
+ env['LIBDATADIR'] = Template( env['LIBDATADIR'] ).safe_substitute( env )
+ env['UDEVDIR'] = Template( env['UDEVDIR'] ).safe_substitute( env )
+@@ -531,18 +533,21 @@
+ env['bindir'] = Template( env.destdir + env['BINDIR'] ).safe_substitute( env )
+ env['libdir'] = Template( env.destdir + env['LIBDIR'] ).safe_substitute( env )
+ env['includedir'] = Template( env.destdir + env['INCLUDEDIR'] ).safe_substitute( env )
++env['datadir'] = Template( env.destdir + env['DATADIR'] ).safe_substitute( env )
+ env['sharedir'] = Template( env.destdir + env['SHAREDIR'] ).safe_substitute( env )
+ env['libdatadir'] = Template( env.destdir + env['LIBDATADIR'] ).safe_substitute( env )
+ env['mandir'] = Template( env.destdir + env['MANDIR'] ).safe_substitute( env )
  env['pypkgdir'] = Template( env.destdir + env['PYPKGDIR'] ).safe_substitute( env )
  env['udevdir'] = Template( env.destdir + env['UDEVDIR'] ).safe_substitute( env )
  env['PYPKGDIR'] = Template( env['PYPKGDIR'] ).safe_substitute( env )
 -env['metainfodir'] = Template( env.destdir + "/usr/share/metainfo" ).safe_substitute( env )
-+env['metainfodir'] = Template( env.destdir + env['SHAREDIR'] + "/metainfo" ).safe_substitute( env )
- 
+-
++env['metainfodir'] = Template( env.destdir + env['DATADIR'] + "/metainfo" ).safe_substitute( env )
++
++env.Command( target=env['datadir'], source="", action=Mkdir( env['datadir'] ) )
  env.Command( target=env['sharedir'], source="", action=Mkdir( env['sharedir'] ) )
  
--- 
-2.19.2
-
+ env.Alias( "install", env['libdir'] )
+ env.Alias( "install", env['includedir'] )
++env.Alias( "install", env['datadir'] )
+ env.Alias( "install", env['sharedir'] )
+ env.Alias( "install", env['libdatadir'] )
+ env.Alias( "install", env['bindir'] )
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 320f10d55138..484e63bb357c 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.382";
+  version = "0.383";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-j7ITcLilcnV8QCUFC/Ybv1dX6Kl36P0G9vBlrzifhFQ=";
+    hash = "sha256-jYD1/sl9ffe+lmrICLe32NU1u0Hi7ZfZrD4zWH+bxsk=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index effe5eb8526b..15b8987b8cc0 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,17 +6,14 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.8.0";
+  version = "6.9.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-A6bMo9cakI0fFfe0lb4rj+hR+UFFjcRmSQDX9F/PaM4=";
+    hash = "sha256-L2Q9CeoRpKKgQ8kuK0abX3MijL8kGugGdgKW7Q7EE9A=";
   };
 
   postPatch = ''
-    # Don't try to create /var/lib/arpd:
-    sed -e '/ARPDDIR/d' -i Makefile
-
     substituteInPlace Makefile \
       --replace "CC := gcc" "CC ?= $CC"
   '';
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 551d4cffbb92..e4d8706fb6a6 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -671,20 +671,29 @@ let
     };
 
     security = {
+      # Report BUG() conditions and kill the offending process.
+      BUG = yes;
+      BUG_ON_DATA_CORRUPTION = yes;
+
       FORTIFY_SOURCE                   = option yes;
 
       # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
       DEBUG_LIST                       = yes;
+
       HARDENED_USERCOPY                = yes;
       RANDOMIZE_BASE                   = option yes;
+      STRICT_KERNEL_RWX                = yes;
+      STRICT_MODULE_RWX                = yes;
       STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
       IO_STRICT_DEVMEM                 = mkDefault yes;
       SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
+
       # Prevent processes from ptracing non-children processes
       SECURITY_YAMA                    = option yes;
       # The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes.
       # This does not have any effect if a program does not support it
       SECURITY_LANDLOCK                = whenAtLeast "5.13" yes;
+
       DEVKMEM                          = whenOlder "5.13" no; # Disable /dev/kmem
 
       USER_NS                          = yes; # Support for user namespaces
@@ -719,6 +728,10 @@ let
 
       # Enable support for page poisoning. Still needs to be enabled on the command line to actually work.
       PAGE_POISONING                   = yes;
+      # Randomize page allocator when page_alloc.shuffle=1
+      SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
+
+      INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
 
       # Enable stack smashing protections in schedule()
       # See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f
@@ -743,6 +756,10 @@ let
       # Mitigate straight line speculation at the cost of some file size
       SLS = whenBetween "5.17" "6.9" yes;
       MITIGATION_SLS = whenAtLeast "6.9" yes;
+
+      DEFAULT_MMAP_MIN_ADDR = freeform "65536";
+    } // optionalAttrs stdenv.hostPlatform.isAarch64 {
+      DEFAULT_MMAP_MIN_ADDR = freeform "32768";
     };
 
     microcode = {
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index d687366dbe2f..0ab89d23952d 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -17,9 +17,6 @@ with (lib.kernel.whenHelpers version);
 assert (versionAtLeast version "4.9");
 
 {
-  # Report BUG() conditions and kill the offending process.
-  BUG = yes;
-
   # Mark LSM hooks read-only after init.  SECURITY_WRITABLE_HOOKS n
   # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
   # implicitly marks LSM hooks read-only after init.
@@ -31,8 +28,6 @@ assert (versionAtLeast version "4.9");
   SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE
   SECURITY_WRITABLE_HOOKS  = option no;
 
-  STRICT_KERNEL_RWX = yes;
-
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = whenOlder "6.6" yes;
   DEBUG_NOTIFIERS       = yes;
@@ -51,16 +46,11 @@ assert (versionAtLeast version "4.9");
   # restricts loading of line disciplines via TIOCSETD ioctl to CAP_SYS_MODULE
   CONFIG_LDISC_AUTOLOAD = option no;
 
-  # Randomize page allocator when page_alloc.shuffle=1
-  SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
-
   # Wipe higher-level memory allocations on free() with page_poison=1
-  PAGE_POISONING           = yes;
   PAGE_POISONING_NO_SANITY = whenOlder "5.11" yes;
   PAGE_POISONING_ZERO      = whenOlder "5.11" yes;
 
-  # Enable init_on_alloc and init_on_free by default
-  INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
+  # Enable init_on_free by default
   INIT_ON_FREE_DEFAULT_ON  = whenAtLeast "5.3" yes;
 
   # Wipe all caller-used registers on exit from a function
@@ -113,9 +103,6 @@ assert (versionAtLeast version "4.9");
   CC_STACKPROTECTOR_REGULAR = lib.mkForce (whenOlder "4.18" no);
   CC_STACKPROTECTOR_STRONG  = whenOlder "4.18" yes;
 
-  # Detect out-of-bound reads/writes and use-after-free
-  KFENCE = whenAtLeast "5.12" yes;
-
   # CONFIG_DEVMEM=n causes these to not exist anymore.
   STRICT_DEVMEM    = option no;
   IO_STRICT_DEVMEM = option no;
@@ -126,8 +113,4 @@ assert (versionAtLeast version "4.9");
 
   # not needed for less than a decade old glibc versions
   LEGACY_VSYSCALL_NONE = yes;
-
-  # Straight-Line-Speculation
-  # https://lwn.net/Articles/877845/
-  SLS = option yes;
 }
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 323b77e85140..5f20d14137c4 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
+, cpio, elfutils, hexdump, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
 , fetchpatch
 , rustc, rust-bindgen, rustPlatform
 }:
@@ -121,6 +121,7 @@ let
         pahole
         perl
         elfutils
+        hexdump
         # module makefiles often run uname commands to find out the kernel version
         (buildPackages.deterministic-uname.override { inherit modDirVersion; })
       ]
@@ -312,7 +313,7 @@ let
       installTargets = [
         (kernelConf.installTarget or (
           /**/ if kernelConf.target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then "uinstall"
-          else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
+          else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" || kernelConf.target == "vmlinuz.efi" then "zinstall"
           else "install"))
       ];
 
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 6a0ee908347c..032283711cf3 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-PlGr/qZbKnaY37wikdmX/iYtP11WHShn1I7vACUgLG0=";
+    sha256 = "sha256-lcIOgghlBKrDCBDdO0hryjt8KADQd6aroQMun3ein2o=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index 211e03637d4e..9f3d22c8a707 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchzip, qtbase, qtscxml, cmake, asciidoc
-, docbook_xsl, json_c, mesa_glu, freeglut, trace-cmd, pkg-config
+, docbook_xsl, json_c, mesa_glu, libglut, trace-cmd, pkg-config
 , libtraceevent, libtracefs, freefont_ttf, wrapQtAppsHook, qtwayland
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];
 
-  buildInputs = [ qtbase qtscxml qtwayland json_c mesa_glu freeglut libtraceevent libtracefs trace-cmd ];
+  buildInputs = [ qtbase qtscxml qtwayland json_c mesa_glu libglut libtraceevent libtracefs trace-cmd ];
 
   cmakeFlags = [
     "-D_INSTALL_PREFIX=${placeholder "out"}"
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index ba2b243a9408..36cdaf84aab6 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , windows
-, fetchurl
 , autoreconfHook
 , mingw_w64_headers
 }:
diff --git a/pkgs/servers/apache-airflow/default.nix b/pkgs/servers/apache-airflow/default.nix
index 735356f8b778..5021f66390ba 100644
--- a/pkgs/servers/apache-airflow/default.nix
+++ b/pkgs/servers/apache-airflow/default.nix
@@ -17,7 +17,6 @@ let
         };
         nativeBuildInputs = with pySelf; [
           setuptools
-          pythonRelaxDepsHook
         ];
         pythonRelaxDeps = [
           "werkzeug"
diff --git a/pkgs/servers/apache-airflow/python-package.nix b/pkgs/servers/apache-airflow/python-package.nix
index 50d3aaa7fbb5..14c39ede5a85 100644
--- a/pkgs/servers/apache-airflow/python-package.nix
+++ b/pkgs/servers/apache-airflow/python-package.nix
@@ -61,7 +61,6 @@
 , python-slugify
 , python3-openid
 , pythonOlder
-, pythonRelaxDepsHook
 , pyyaml
 , rich
 , rich-argparse
@@ -227,7 +226,6 @@ buildPythonPackage rec {
 
   buildInputs = [
     airflow-frontend
-    pythonRelaxDepsHook
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/servers/gpsd/default.nix b/pkgs/servers/gpsd/default.nix
index ac4d0c066783..ab1668ccfb92 100644
--- a/pkgs/servers/gpsd/default.nix
+++ b/pkgs/servers/gpsd/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 
 # nativeBuildInputs
 , scons
@@ -75,6 +76,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./sconstruct-env-fixes.patch
+
+    # fix build with Python 3.12
+    (fetchpatch {
+      url = "https://gitlab.com/gpsd/gpsd/-/commit/9157b1282d392b2cc220bafa44b656d6dac311df.patch";
+      hash = "sha256-kFMn4HgidQvHwHfcSNH/0g6i1mgvEnZfvAUDPU4gljg=";
+    })
   ];
 
   preBuild = ''
diff --git a/pkgs/servers/home-assistant/appdaemon.nix b/pkgs/servers/home-assistant/appdaemon.nix
index 40c55e9f5d78..c2bb51cc14a0 100644
--- a/pkgs/servers/home-assistant/appdaemon.nix
+++ b/pkgs/servers/home-assistant/appdaemon.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
   pythonRelaxDeps = true;
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index e7db616aa915..bb091fc0d0cb 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,13 +2,12 @@
 # Do not edit!
 
 {
-  version = "2024.6.4";
+  version = "2024.7.1";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
     "abode" = ps: with ps; [
       jaraco-abode
-      jaraco-functools
     ];
     "accuweather" = ps: with ps; [
       accuweather
@@ -111,10 +110,6 @@
       aioairzone-cloud
     ];
     "aladdin_connect" = ps: with ps; [
-      fnv-hash-fast
-      genie-partner-sdk
-      psutil-home-assistant
-      sqlalchemy
     ];
     "alarm_control_panel" = ps: with ps; [
     ];
@@ -220,6 +215,12 @@
     ];
     "apsystems" = ps: with ps; [
     ]; # missing inputs: apsystems-ez1
+    "aquacell" = ps: with ps; [
+      fnv-hash-fast
+      ifaddr
+      psutil-home-assistant
+      sqlalchemy
+    ]; # missing inputs: aioaquacell
     "aqualogic" = ps: with ps; [
       aqualogic
     ];
@@ -627,9 +628,6 @@
     "channels" = ps: with ps; [
       pychannels
     ];
-    "circuit" = ps: with ps; [
-      circuit-webhook
-    ];
     "cisco_ios" = ps: with ps; [
       pexpect
     ];
@@ -689,7 +687,7 @@
     "command_line" = ps: with ps; [
     ];
     "compensation" = ps: with ps; [
-      numpy
+      numpy_1
     ];
     "concord232" = ps: with ps; [
     ]; # missing inputs: concord232
@@ -786,7 +784,7 @@
       home-assistant-intents
       ifaddr
       mutagen
-      numpy
+      numpy_1
       pillow
       psutil-home-assistant
       pynacl
@@ -808,12 +806,8 @@
       deluge-client
     ];
     "demo" = ps: with ps; [
-      fnv-hash-fast
       hassil
       home-assistant-intents
-      pillow
-      psutil-home-assistant
-      sqlalchemy
     ];
     "denon" = ps: with ps; [
     ];
@@ -833,10 +827,7 @@
     "device_automation" = ps: with ps; [
     ];
     "device_sun_light_trigger" = ps: with ps; [
-      fnv-hash-fast
       pillow
-      psutil-home-assistant
-      sqlalchemy
     ];
     "device_tracker" = ps: with ps; [
     ];
@@ -1072,7 +1063,7 @@
       pyemby
     ];
     "emoncms" = ps: with ps; [
-    ];
+    ]; # missing inputs: pyemoncms
     "emoncms_history" = ps: with ps; [
     ];
     "emonitor" = ps: with ps; [
@@ -1578,7 +1569,6 @@
       hassil
       home-assistant-intents
       mutagen
-      voluptuous-openapi
       webrtc-noise-gain
     ];
     "google_mail" = ps: with ps; [
@@ -1667,10 +1657,6 @@
     "greenwave" = ps: with ps; [
     ]; # missing inputs: greenwavereality
     "group" = ps: with ps; [
-      fnv-hash-fast
-      pillow
-      psutil-home-assistant
-      sqlalchemy
     ];
     "growatt_server" = ps: with ps; [
       growattserver
@@ -2147,7 +2133,7 @@
       pyipp
     ];
     "iqvia" = ps: with ps; [
-      numpy
+      numpy_1
       pyiqvia
     ];
     "irish_rail_transport" = ps: with ps; [
@@ -2161,6 +2147,8 @@
     ];
     "iss" = ps: with ps; [
     ]; # missing inputs: pyiss
+    "ista_ecotrend" = ps: with ps; [
+    ]; # missing inputs: pyecotrend-ista
     "isy994" = ps: with ps; [
       pyisy
     ];
@@ -2280,6 +2268,8 @@
     "kmtronic" = ps: with ps; [
       pykmtronic
     ];
+    "knocki" = ps: with ps; [
+    ]; # missing inputs: knocki
     "knx" = ps: with ps; [
       fnv-hash-fast
       home-assistant-frontend
@@ -2637,6 +2627,9 @@
     ];
     "mazda" = ps: with ps; [
     ];
+    "mealie" = ps: with ps; [
+      aiomealie
+    ];
     "meater" = ps: with ps; [
       meater-python
     ];
@@ -3162,8 +3155,7 @@
       pyownet
     ];
     "onkyo" = ps: with ps; [
-      onkyo-eiscp
-    ];
+    ]; # missing inputs: pyeiscp
     "onvif" = ps: with ps; [
       ha-ffmpeg
       onvif-zeep-async
@@ -3178,7 +3170,6 @@
       home-assistant-intents
       mutagen
       openai
-      voluptuous-openapi
       webrtc-noise-gain
     ];
     "openalpr_cloud" = ps: with ps; [
@@ -3512,12 +3503,14 @@
       aiopvpc
     ];
     "pyload" = ps: with ps; [
+      pyloadapi
     ];
     "python_script" = ps: with ps; [
       restrictedpython
     ];
     "qbittorrent" = ps: with ps; [
-    ]; # missing inputs: python-qbittorrent
+      qbittorrent-api
+    ];
     "qingping" = ps: with ps; [
       aioesphomeapi
       aioruuvigateway
@@ -3893,7 +3886,6 @@
     ]; # missing inputs: scsgate
     "search" = ps: with ps; [
       fnv-hash-fast
-      pillow
       psutil-home-assistant
       sqlalchemy
     ];
@@ -4189,8 +4181,7 @@
     "solaredge_local" = ps: with ps; [
     ]; # missing inputs: solaredge-local
     "solarlog" = ps: with ps; [
-      sunwatcher
-    ];
+    ]; # missing inputs: solarlog_cli
     "solax" = ps: with ps; [
       solax
     ];
@@ -4303,7 +4294,7 @@
     ]; # missing inputs: stookwijzer
     "stream" = ps: with ps; [
       ha-av
-      numpy
+      numpy_1
       pyturbojpeg
     ];
     "streamlabswater" = ps: with ps; [
@@ -4472,13 +4463,9 @@
       temperusb
     ];
     "template" = ps: with ps; [
-      fnv-hash-fast
-      pillow
-      psutil-home-assistant
-      sqlalchemy
     ];
     "tensorflow" = ps: with ps; [
-      numpy
+      numpy_1
       pillow
       pycocotools
       tensorflow
@@ -4490,6 +4477,7 @@
       tesla-fleet-api
     ];
     "tessie" = ps: with ps; [
+      tesla-fleet-api
     ]; # missing inputs: tessie-api
     "text" = ps: with ps; [
     ];
@@ -4709,7 +4697,7 @@
     "travisci" = ps: with ps; [
     ]; # missing inputs: TravisPy
     "trend" = ps: with ps; [
-      numpy
+      numpy_1
     ];
     "tts" = ps: with ps; [
       ha-ffmpeg
@@ -5550,6 +5538,7 @@
     "image_processing"
     "image_upload"
     "imap"
+    "incomfort"
     "influxdb"
     "inkbird"
     "input_boolean"
@@ -5634,6 +5623,7 @@
     "matter"
     "maxcube"
     "mazda"
+    "mealie"
     "meater"
     "media_extractor"
     "media_player"
@@ -5667,6 +5657,7 @@
     "motionblinds_ble"
     "motioneye"
     "motionmount"
+    "mpd"
     "mqtt"
     "mqtt_eventstream"
     "mqtt_json"
@@ -5736,6 +5727,7 @@
     "opower"
     "oralb"
     "otbr"
+    "otp"
     "overkiz"
     "ovo_energy"
     "owntracks"
@@ -5771,7 +5763,9 @@
     "pushover"
     "pvoutput"
     "pvpc_hourly_pricing"
+    "pyload"
     "python_script"
+    "qbittorrent"
     "qingping"
     "qld_bushfire"
     "qnap"
@@ -5872,7 +5866,6 @@
     "snips"
     "snmp"
     "snooz"
-    "solarlog"
     "solax"
     "soma"
     "somfy_mylink"
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 82822e1c1ff8..bad91d28c468 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -93,18 +93,6 @@ let
         '';
       });
 
-      aiowithings = super.aiowithings.overridePythonAttrs (oldAttrs: rec {
-        version = "2.1.0";
-        src = fetchFromGitHub {
-          inherit (oldAttrs.src)
-            owner
-            repo
-          ;
-          rev = "refs/tags/${version}";
-          hash = "sha256-+pIIVCR+QsW9M3pH9Ss3dMvkeKM1OdhQ1y+s/T6pHtk=";
-        };
-      });
-
       astral = super.astral.overridePythonAttrs (oldAttrs: rec {
         pname = "astral";
         version = "2.2";
@@ -192,62 +180,13 @@ let
         doCheck = false; # requires asynctest, which does not work on python 3.11
       });
 
-      jaraco-abode = super.jaraco-abode.overridePythonAttrs (oldAttrs: rec {
-        version = "3.3.0";
+      openhomedevice = super.openhomedevice.overridePythonAttrs (oldAttrs: rec {
+        version = "2.2";
         src = fetchFromGitHub {
           inherit (oldAttrs.src) owner repo;
-          rev = "refs/tags/v${version}";
-          hash = "sha256-LnbWzIST+GMtdsHDKg67WWt9GmHUcSuGZ5Spei3nEio=";
-        };
-      });
-
-      jaraco-collections = super.jaraco-collections.overridePythonAttrs (oldAttrs: rec {
-        version = "3.4.0";
-        src = fetchPypi {
-          pname = "jaraco.collections";
-          inherit version;
-          hash = "sha256-NE0Udp1xbnSWr4eaxxs8br3UarxkvZ7CHRUkg2WqOsk=";
-        };
-      });
-
-      jaraco-functools = super.jaraco-functools.overridePythonAttrs (oldAttrs: rec {
-        version = "3.9.0";
-        src = fetchPypi {
-          pname = "jaraco.functools";
-          inherit version;
-          hash = "sha256-ixN7D+rMF/70us7gTAEcnobyNBCZyHCh0S0743sypjg=";
-        };
-      });
-
-      lmcloud = super.lmcloud.overridePythonAttrs (oldAttrs: rec {
-        version = "0.4.35";
-        src = fetchFromGitHub {
-          owner = "zweckj";
-          repo = "lmcloud";
-          rev = "refs/tags/v${version}";
-          hash = "sha256-TUve21yamtEmEceK/V1w7IZjnMgKConMfSY/GlqFpp8=";
-        };
-      });
-
-      lxml = super.lxml.overridePythonAttrs (oldAttrs: rec {
-        version = "5.1.0";
-        pyprojet = true;
-
-        src = fetchFromGitHub {
-          owner = "lxml";
-          repo = "lxml";
-          rev = "refs/tags/lxml-${version}";
-          hash = "sha256-eWLYzZWatYDmhuBTZynsdytlNFKKmtWQ1XIyzVD8sDY=";
+          rev = "refs/tags/${version}";
+          hash = "sha256-GGp7nKFH01m1KW6yMkKlAdd26bDi8JDWva6OQ0CWMIw=";
         };
-
-        nativeBuildInputs = with self; [
-          cython
-          setuptools
-          libxml2.dev
-          libxslt.dev
-        ];
-
-        patches = [];
       });
 
       pymelcloud = super.pymelcloud.overridePythonAttrs (oldAttrs: {
@@ -282,17 +221,6 @@ let
         doCheck = false; # no tests
       });
 
-      # Can probably be removed with 2024.6.0
-      plugwise = super.plugwise.overridePythonAttrs rec {
-        version = "0.37.3";
-        src = fetchFromGitHub {
-          owner = "plugwise";
-          repo = "python-plugwise";
-          rev = "refs/tags/v${version}";
-          hash = "sha256-aQz0p+DNi1XVoFwdFjc3RjpHqA2kGf4pU1QS6m271gU=";
-        };
-      };
-
       # Pinned due to API changes in 0.1.0
       poolsense = super.poolsense.overridePythonAttrs (oldAttrs: rec {
         version = "0.0.8";
@@ -303,6 +231,15 @@ let
         };
       });
 
+      psutil = super.psutil.overridePythonAttrs (oldAttrs: rec {
+        version = "5.9.8";
+        src = fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          hash = "sha256-a+Em4yJUht/yhqj7mgYkalJT9MfFO0depfWsk05kGUw=";
+        };
+      });
+
       pyasn1 = super.pyasn1.overridePythonAttrs (oldAttrs: rec {
         version = "0.4.8";
         src = fetchPypi {
@@ -434,7 +371,6 @@ let
         };
         nativeBuildInputs = with self; [
           flit-core
-          pythonRelaxDepsHook
         ];
         pythonRelaxDeps = [
           "betterproto"
@@ -549,7 +485,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.6.4";
+  hassVersion = "2024.7.1";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -567,17 +503,16 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-WIAFTVNHzrKTRONmOc/lq5PvC34PDKF7UfIokLCVzNY=";
+    hash = "sha256-y3VYxlPit9LuC+9F+fQoJs3WD9LsvrMZMiSCqbzkgmk=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ymv3AlArAD2rSXQwMhEVeynwhAo8ZMrtV1zUK4U8xqQ=";
+    hash = "sha256-pFsv0guypnRPeZOg2WrG2HL27W903iANHkvdQ8dCJHo=";
   };
 
   build-system = with python.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
@@ -664,6 +599,7 @@ in python.pkgs.buildPythonApplication rec {
     ulid-transform
     urllib3
     voluptuous
+    voluptuous-openapi
     voluptuous-serialize
     yarl
     # REQUIREMENTS in homeassistant/auth/mfa_modules/totp.py and homeassistant/auth/mfa_modules/notify.py
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index f3e6062d5b26..b9ce34ab412b 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20240610.1";
+  version = "20240705.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-6XSDKPL+rbtP/jGYbvzc5cakEZC94sDetmPuM7TQQ64=";
+    hash = "sha256-uZs/2/+fmnZzDzEuzEus0LDUNTSQIs/jL4FMBJBpXAE=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/intents.nix b/pkgs/servers/home-assistant/intents.nix
index 88944efe3593..38d237a70440 100644
--- a/pkgs/servers/home-assistant/intents.nix
+++ b/pkgs/servers/home-assistant/intents.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-intents";
-  version = "2024.6.21";
+  version = "2024.7.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "home-assistant";
     repo = "intents-package";
     rev = "refs/tags/${version}";
-    hash = "sha256-tgbZqcxv/uFoNCGq7TySffhqQXzupZodQfQHBqkSHrE=";
+    hash = "sha256-3JnBmSNa9Yrh+5QFQ6KIKZProxMuX+CyTZzqRUAlBcQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 4d14ee508bcb..ac1f5bdf9b84 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.6.3";
+  version = "2024.7.0";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-YMoNoR9LT38nkqoo0seaP88XUOcVmSQN1dBKiW+13SM=";
+    hash = "sha256-p/0OM72XcfGLKWbReMcUCBZTxHFDe0VZk5gmaI0Qx2Q=";
   };
 
   build-system = [
diff --git a/pkgs/servers/home-assistant/update-component-packages.py b/pkgs/servers/home-assistant/update-component-packages.py
index df410fb49862..124771d5fd20 100755
--- a/pkgs/servers/home-assistant/update-component-packages.py
+++ b/pkgs/servers/home-assistant/update-component-packages.py
@@ -41,7 +41,9 @@ PKG_SET = "home-assistant.python.pkgs"
 PKG_PREFERENCES = {
     "fiblary3": "fiblary3-fork",  # https://github.com/home-assistant/core/issues/66466
     "HAP-python": "hap-python",
+    "numpy": "numpy_1",
     "ollama-hass": "ollama",
+    "sentry-sdk": "sentry-sdk",
     "slackclient": "slack-sdk",
     "SQLAlchemy": "sqlalchemy",
     "tensorflow": "tensorflow",
diff --git a/pkgs/servers/ldap/lldap/default.nix b/pkgs/servers/ldap/lldap/default.nix
index 7db37e57c2d2..80d7710ccbaf 100644
--- a/pkgs/servers/ldap/lldap/default.nix
+++ b/pkgs/servers/ldap/lldap/default.nix
@@ -5,7 +5,6 @@
 , nixosTests
 , rustPlatform
 , rustc
-, stdenv
 , wasm-bindgen-cli
 , wasm-pack
 , which
@@ -85,9 +84,6 @@ in rustPlatform.buildRustPackage (commonDerivationAttrs // {
     changelog = "https://github.com/lldap/lldap/blob/v${lldap.version}/CHANGELOG.md";
     license = licenses.gpl3Only;
     platforms = platforms.linux;
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
     maintainers = with maintainers; [ bendlas ];
     mainProgram = "lldap";
   };
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index 7747e4ec092d..ccc9fff51ace 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -1,12 +1,12 @@
 {lib, stdenv, fetchurl, cyrus_sasl, libevent, nixosTests }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.26";
+  version = "1.6.27";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-yTnHhZo8HPYDA+ndCAxjrEo4fuKEbVlc1SY6PcrNwvc=";
+    sha256 = "sha256-dP4UR8hmit+RD6epKftjWKr0pm73NOdRxbgSgHGw97U=";
   };
 
   configureFlags = [
diff --git a/pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix b/pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix
index 3968f0b5c11c..0a5aa5f6f514 100644
--- a/pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix
+++ b/pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/pinnwand/default.nix b/pkgs/servers/pinnwand/default.nix
index c7549e1913a1..bbed9967c2ac 100644
--- a/pkgs/servers/pinnwand/default.nix
+++ b/pkgs/servers/pinnwand/default.nix
@@ -27,7 +27,6 @@ with python3.pkgs; buildPythonApplication rec {
 
   nativeBuildInputs = [
     pdm-pep517
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/servers/web-apps/hedgedoc/default.nix b/pkgs/servers/web-apps/hedgedoc/default.nix
index 7e1c7644fb01..e079ac81b30f 100644
--- a/pkgs/servers/web-apps/hedgedoc/default.nix
+++ b/pkgs/servers/web-apps/hedgedoc/default.nix
@@ -6,7 +6,7 @@
 , yarn
 , makeBinaryWrapper
 , nodejs
-, python3
+, python311
 , nixosTests
 }:
 
@@ -52,7 +52,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [
     makeBinaryWrapper
     yarn
-    python3 # needed for sqlite node-gyp
+    python311 # needed for sqlite node-gyp
   ];
 
   buildInputs = [
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index bf6c041205e4..8566c8c61749 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -3898,11 +3898,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkeyboardconfig = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xkeyboard-config";
-    version = "2.41";
+    version = "2.42";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.41.tar.xz";
-      sha256 = "13vjvyg1fjvsqzqkpxzigvv94v154mcb2gba4d80spi9aywxcb7h";
+      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.42.tar.xz";
+      sha256 = "01q8gs7lnx9d7iz29pal7a3whz7njmgjcpzhy82wa7zhq6znxc56";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index cd7e116c17d5..f1e63de72bd5 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -397,6 +397,7 @@ self: super:
 
   libXpresent = super.libXpresent.overrideAttrs (attrs: {
     buildInputs = with xorg; attrs.buildInputs ++ [ libXext libXfixes libXrandr ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ xorg.libXfixes ];
   });
 
   libxkbfile = super.libxkbfile.overrideAttrs (attrs: {
@@ -636,7 +637,7 @@ self: super:
 
   xkeyboardconfig = super.xkeyboardconfig.overrideAttrs (attrs: {
     prePatch = ''
-      patchShebangs rules/merge.py rules/compat/map-variants.py rules/xml2lst.pl
+      patchShebangs rules/merge.py rules/compat/map-variants.py rules/generate-options-symbols.py rules/xml2lst.pl
     '';
     nativeBuildInputs = attrs.nativeBuildInputs ++ [
       meson
@@ -835,6 +836,7 @@ self: super:
         buildInputs = commonBuildInputs ++ [
           bootstrap_cmds automake autoconf
           Xplugin Carbon Cocoa
+          mesa
         ];
         propagatedBuildInputs = commonPropagatedBuildInputs ++ [
           libAppleWM xorgproto
@@ -904,6 +906,35 @@ self: super:
         };
       }));
 
+  # xvfb is used by a bunch of things to run tests
+  # and doesn't support hardware accelerated rendering
+  # so remove it from the rebuild heavy path for mesa
+  xvfb = super.xorgserver.overrideAttrs(old: {
+    configureFlags = [
+      "--enable-xvfb"
+      "--disable-xorg"
+      "--disable-xquartz"
+      "--disable-xwayland"
+      "--disable-glamor"
+      "--disable-glx"
+      "--disable-dri"
+      "--disable-dri2"
+      "--disable-dri3"
+      "--with-xkb-bin-directory=${xorg.xkbcomp}/bin"
+      "--with-xkb-path=${xorg.xkeyboardconfig}/share/X11/xkb"
+      "--with-xkb-output=$out/share/X11/xkb/compiled"
+    ] ++ lib.optional stdenv.isDarwin [
+      "--without-dtrace"
+    ];
+
+    buildInputs = old.buildInputs ++ (with xorg; [
+      pixman
+      libXfont2
+      xtrans
+      libxcvt
+    ]) ++ lib.optional stdenv.isDarwin [ Xplugin ];
+  });
+
   lndir = super.lndir.overrideAttrs (attrs: {
     buildInputs = [];
     nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index f58c526f7def..8305e1574040 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -73,7 +73,7 @@ mirror://xorg/individual/app/xwininfo-1.1.6.tar.xz
 mirror://xorg/individual/app/xwud-1.0.6.tar.xz
 mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz
 mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.41.tar.xz
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.42.tar.xz
 mirror://xorg/individual/doc/xorg-docs-1.7.3.tar.xz
 mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.1.tar.xz
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 45cc6742c720..753cf96af757 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -233,7 +233,10 @@ in
       # stage should only access the stage that came before it.
       ccWrapperStdenv = self.stdenv;
 
-      bash = bootstrapTools;
+      bash = bootstrapTools // {
+        shellPath = "/bin/bash";
+      };
+
       coreutils = bootstrapTools;
       cpio = bootstrapTools;
       gnugrep = bootstrapTools;
@@ -244,10 +247,6 @@ in
         # will have to manually add it to their build inputs.
         CF = null;
 
-        binutils-unwrapped = bootstrapTools // {
-          version = "boot";
-        };
-
         binutils = super.wrapBintoolsWith {
           name = "bootstrap-stage0-binutils-wrapper";
 
@@ -266,10 +265,98 @@ in
           inherit (selfDarwin) postLinkSignHook signingUtils;
         };
 
-        cctools = bootstrapTools // {
-          targetPrefix = "";
+        binutils-unwrapped = (superDarwin.binutils-unwrapped.overrideAttrs (old: {
+          version = "boot";
+          passthru = (old.passthru or { }) // {
+            isFromBootstrapFiles = true;
+          };
+        })).override { enableManpages = false; };
+
+        cctools = super.stdenv.mkDerivation {
+          pname = "bootstrap-stage0-cctools";
           version = "boot";
-          man = bootstrapTools;
+
+          buildCommand = ''
+            declare -a cctools=(
+              ar
+              bitcode_strip
+              check_dylib
+              checksyms
+              cmpdylib
+              codesign_allocate
+              ctf_insert
+              depinfo
+              diagtest
+              ld
+              gas
+              gprof
+              install_name_tool
+              libtool
+              lipo
+              mtoc
+              mtor
+              nm
+              nmedit
+              otool
+              pagestuff
+              ranlib
+              redo_prebinding
+              seg_addr_table
+              seg_hack
+              segedit
+              size
+              strings
+              strip
+              vtool
+            )
+
+            mkdir -p "$out/bin"
+            for tool in "''${cctools[@]}"; do
+              toolsrc="${bootstrapTools}/bin/$tool"
+              if [ -e "$toolsrc" ]; then
+                ln -s "$toolsrc" "$out/bin"
+              fi
+            done
+
+            # Copy only the required headers to avoid accidentally linking headers that belong to other packages,
+            # which can cause problems when building Libsystem in the source-based SDK.
+            declare -a machohdrs=(
+              arch.h
+              fat.h
+              fixup-chains.h
+              getsect.h
+              ldsyms.h
+              loader.h
+              nlist.h
+              ranlib.h
+              reloc.h
+              stab.h
+              swap.h
+              arm
+              arm64
+              hppa
+              i386
+              i860
+              m68k
+              m88k
+              ppc
+              sparc
+              x86_64
+            )
+
+            mkdir -p "$out/include/mach-o"
+            for header in "''${machohdrs[@]}"; do
+              machosrc="${bootstrapTools}/include-Libsystem/mach-o/$header"
+              if [ -e "$machosrc" ]; then
+                cp -r "$machosrc" "$out/include/mach-o/$header"
+              fi
+            done
+          '';
+
+          passthru = {
+            isFromBootstrapFiles = true;
+            targetPrefix = "";
+          };
         };
 
         locale = self.stdenv.mkDerivation {
@@ -327,22 +414,31 @@ in
               '';
               passthru = {
                 isFromBootstrapFiles = true;
-                hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
+                hardeningUnsupportedFlags = [
+                  "fortify3"
+                  "stackclashprotection"
+                  "zerocallusedregs"
+                ];
               };
             };
-            clang-unwrapped = selfTools.libclang;
             libllvm = self.stdenv.mkDerivation {
               name = "bootstrap-stage0-llvm";
               outputs = [ "out" "lib" ];
               buildCommand = ''
                 mkdir -p $out/bin $out/lib
                 ln -s $out $lib
-                ln -s ${bootstrapTools}/bin/strip    $out/bin/llvm-strip
+                for tool in ${toString super.darwin.binutils-unwrapped.llvm_cmds}; do
+                  cctoolsTool=''${tool//-/_}
+                  toolsrc="${bootstrapTools}/bin/$cctoolsTool"
+                  if [ -e "$toolsrc" ]; then
+                    ln -s "$toolsrc" $out/bin/llvm-$tool
+                  fi
+                done
+                ln -s ${bootstrapTools}/bin/dsymutil $out/bin/dsymutil
                 ln -s ${bootstrapTools}/lib/libLLVM* $out/lib
               '';
               passthru.isFromBootstrapFiles = true;
             };
-            llvm = selfTools.libllvm;
           });
           libraries = super.llvmPackages.libraries.extend (_: _: {
             libcxx = self.stdenv.mkDerivation {
@@ -380,19 +476,9 @@ in
     '';
   })
 
-  # This stage is primarily responsible for building the linker and setting up versions of
-  # certain dependencies needed by the rest of the build process. It is necessary to rebuild the
-  # linker because the `compiler-rt` build process checks the version and attempts to manually
-  # run `codesign` if it detects a version of `ld64` it considers too old. If that happens, the
-  # build process will fail for a few different reasons:
-  #  - sigtool is too old and does not accept the `--sign` argument;
-  #  - sigtool is new enough to accept the `--sign` argument, but it aborts when it is invoked on a
-  #    binary that is already signed; or
-  #  - compiler-rt attempts to invoke `codesign` on x86_64-darwin, but `sigtool` is not currently
-  #    part of the x86_64-darwin bootstrap tools.
-  #
-  # This stage also builds CF and Libsystem to simplify assertions and assumptions for later by
-  # making sure both packages are present on x86_64-darwin and aarch64-darwin.
+  # This stage is primarily responsible for setting up versions of certain dependencies needed
+  # by the rest of the build process. This stage also builds CF and Libsystem to simplify assertions
+  # and assumptions for later by making sure both packages are present on x86_64-darwin and aarch64-darwin.
   (prevStage:
     # previous stage0 stdenv:
     assert lib.all isFromBootstrapFiles (
@@ -419,6 +505,8 @@ in
       inherit (prevStage) ccWrapperStdenv
         coreutils gnugrep;
 
+      binutils-unwrapped = builtins.throw "nothing in the bootstrap should depend on GNU binutils";
+
       # Use this stage’s CF to build CMake. It’s required but can’t be included in the stdenv.
       cmake = self.cmakeMinimal;
       cmakeMinimal = super.cmakeMinimal.overrideAttrs (old: {
@@ -436,18 +524,22 @@ in
 
       ninja = super.ninja.override { buildDocs = false; };
 
-      # Use this stage’s CF to build Python. It’s required but can’t be included in the stdenv.
+      # Use this stage’s CF to build Python. It’s required, but it can’t be included in the stdenv.
       python3 = self.python3Minimal;
-      python3Minimal = super.python3Minimal.overrideAttrs (old: {
-        buildInputs = old.buildInputs ++ [ self.darwin.CF ];
+      python3Minimal = (super.python3Minimal.override {
+        self = self.python3Minimal;
+      }).overrideAttrs (old: {
+        buildInputs = old.buildInputs or [ ] ++ [ self.darwin.CF ];
       });
 
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
+        inherit (prevStage.darwin) cctools;
+
         apple_sdk = superDarwin.apple_sdk // {
           inherit (prevStage.darwin.apple_sdk) sdkRoot;
         };
 
-        # Use this stage’s CF to build configd. It’s required but can’t be included in the stdenv.
+        # Use this stage’s CF to build configd. It’s required, but it can’t be included in the stdenv.
         configd = superDarwin.configd.overrideAttrs (old: {
           buildInputs = old.buildInputs or [ ] ++ [ self.darwin.CF ];
         });
@@ -460,6 +552,7 @@ in
           inherit (selfDarwin) sigtool;
         };
 
+        # Rewrap binutils with the real Libsystem
         binutils = superDarwin.binutils.override {
           inherit (self) coreutils;
           inherit (selfDarwin) postLinkSignHook signingUtils;
@@ -470,11 +563,11 @@ in
           runtimeShell = "${bootstrapTools}/bin/bash";
         };
 
+        # Avoid building unnecessary Python dependencies due to building LLVM manpages.
         binutils-unwrapped = superDarwin.binutils-unwrapped.override {
           inherit (selfDarwin) cctools;
+          enableManpages = false;
         };
-
-        cctools = selfDarwin.cctools-port;
       });
 
       llvmPackages = super.llvmPackages // (
@@ -506,28 +599,28 @@ in
     '';
   })
 
-  # Build cctools, Python, and sysctl for use by LLVM’s check phase. They must be built in
-  # their stage to prevent infinite recursions and to make sure the stdenv used to build
-  # LLVM has the newly built cctools instead of the one from the bootstrap tools.
+  # Build sysctl for use by LLVM’s check phase. It must be built separately to avoid an infinite recursion.
   (prevStage:
     # previous stage1 stdenv:
     assert lib.all isFromBootstrapFiles (with prevStage; [ coreutils gnugrep ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      autoconf automake bash binutils-unwrapped bison brotli cmake cpio cyrus_sasl db
+      autoconf automake bash bison brotli cmake cpio cyrus_sasl db
       ed expat flex gettext gmp groff icu libedit libffi libiconv libidn2 libkrb5 libssh2
       libtool libunistring libxml2 m4 ncurses nghttp2 ninja openldap openssh openssl
       patchutils pbzx perl pkg-config.pkg-config python3 python3Minimal scons serf sqlite
       subversion texinfo unzip which xz zlib zstd
     ]);
 
+    assert lib.all isFromBootstrapFiles (with prevStage.darwin; [ cctools ]);
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
+      locale libtapi print-reexports rewrite-tbd sigtool
     ]);
+
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ Libsystem configd ]);
     assert (! useAppleSDKLibs) -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc]);
-    assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd xnu ]);
+    assert lib.all isFromNixpkgs (with prevStage.darwin; [ binutils-unwrapped dyld launchd xnu ]);
 
     assert lib.all isFromBootstrapFiles (with prevStage.llvmPackages; [
       clang-unwrapped libclang libllvm llvm compiler-rt libcxx
@@ -547,28 +640,18 @@ in
         python3Minimal scons sed serf sharutils sqlite subversion texinfo unzip which xz
         zlib zstd;
 
-      # Support for the SystemConfiguration framework is required to run the LLVM tests, but trying
-      # to override python3Minimal does not appear to work.
-      python3 = (super.python3.override {
-        inherit (self) libffi;
-        inherit (self.darwin) configd;
-        openssl = null;
-        readline = null;
-        ncurses = null;
-        gdbm = null;
-        sqlite = null;
-        tzdata = null;
-        stripConfig = true;
-        stripIdlelib = true;
-        stripTests = true;
-        stripTkinter = true;
-        rebuildBytecode = false;
-        stripBytecode = true;
-        includeSiteCustomize = false;
-        enableOptimizations = false;
+      # Avoid pulling in openldap just to run Meson’s tests.
+      meson = super.meson.overrideAttrs {
+        doInstallCheck = false;
+      };
+
+      # The bootstrap Python needs its own `pythonAttr` to make sure the override works properly.
+      python3 = self.python3-bootstrap;
+      python3-bootstrap = super.python3.override {
+        self = self.python3-bootstrap;
+        pythonAttr = "python3-bootstrap";
         enableLTO = false;
-        mimetypesSupport = false;
-      }).overrideAttrs (_: { pname = "python3-minimal-scproxy"; });
+      };
 
       darwin = super.darwin.overrideScope (_: superDarwin: {
         inherit (prevStage.darwin)
@@ -617,28 +700,27 @@ in
     assert lib.all isFromBootstrapFiles (with prevStage; [ coreutils gnugrep ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      atf autoconf automake bash binutils-unwrapped bison brotli cmake cpio cyrus_sasl db
+      atf autoconf automake bash bison brotli cmake cpio cyrus_sasl db
       ed expat flex gettext gmp groff icu kyua libedit libffi libiconv libidn2 libkrb5 libssh2
-      libtool libunistring libxml2 m4 ncurses nghttp2 ninja openldap openssh openssl
+      libtool libunistring libxml2 m4 meson ncurses nghttp2 ninja openldap openssh openssl
       patchutils pbzx perl pkg-config.pkg-config python3 python3Minimal scons serf sqlite
       subversion sysctl.provider texinfo unzip which xz zlib zstd
     ]);
 
+    assert lib.all isFromBootstrapFiles (with prevStage.darwin; [ cctools ]);
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
+      locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ Libsystem configd ]);
     assert (! useAppleSDKLibs) -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc ]);
-    assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd xnu ]);
+    assert lib.all isFromNixpkgs (with prevStage.darwin; [ binutils-unwrapped dyld launchd xnu ]);
 
     assert lib.all isFromBootstrapFiles (with prevStage.llvmPackages; [
       clang-unwrapped libclang libllvm llvm compiler-rt libcxx
     ]);
 
-    assert lib.getVersion prevStage.stdenv.cc.bintools.bintools == lib.getVersion prevStage.darwin.cctools-port;
-
     stageFun prevStage {
     name = "bootstrap-stage-xclang";
 
@@ -646,12 +728,11 @@ in
       inherit (prevStage) ccWrapperStdenv
         atf autoconf automake bash binutils binutils-unwrapped bison brotli cmake cmakeMinimal
         cpio cyrus_sasl db ed expat flex gettext gmp groff icu kyua libedit libffi libiconv
-        libidn2 libkrb5 libssh2 libtool libunistring libxml2 m4 ncurses nghttp2 ninja
+        libidn2 libkrb5 libssh2 libtool libunistring libxml2 m4 meson ncurses nghttp2 ninja
         openldap openssh openssl patchutils pbzx perl pkg-config python3 python3Minimal
         scons sed serf sharutils sqlite subversion sysctl texinfo unzip which xz zlib zstd;
 
-      # Switch from cctools-port to cctools-llvm now that LLVM has been built.
-      darwin = super.darwin.overrideScope (_: superDarwin: {
+      darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin)
           CF Libsystem configd darwin-stubs dyld launchd libclosure libdispatch libobjc
           locale objc4 postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
@@ -660,8 +741,13 @@ in
           inherit (prevStage.darwin.apple_sdk) sdkRoot;
         };
 
+        binutils = superDarwin.binutils.override {
+          inherit (prevStage) expand-response-params;
+          libc = selfDarwin.Libsystem;
+        };
+
         # Avoid building unnecessary Python dependencies due to building LLVM manpages.
-        cctools-llvm = superDarwin.cctools-llvm.override { enableManpages = false; };
+        binutils-unwrapped = superDarwin.binutils-unwrapped.override { enableManpages = false; };
       });
 
       llvmPackages = super.llvmPackages // (
@@ -679,6 +765,11 @@ in
             nixSupport.cc-ldflags = [ "-lSystem" ];
           });
 
+          tools = super.llvmPackages.tools.extend (selfTools: superTools: {
+            # LLVM’s check phase takes a while to run, so disable it in the first LLVM build to speed up the bootstrap.
+            libllvm = superTools.libllvm.override { doCheck = false; };
+          });
+
           libraries = super.llvmPackages.libraries.extend (selfLib: superLib: {
             compiler-rt = null;
             libcxx = superLib.libcxx.override ({
@@ -686,7 +777,7 @@ in
             });
           });
         in
-        { inherit libraries; } // libraries
+        { inherit tools libraries; } // tools // libraries
       );
     };
 
@@ -706,8 +797,8 @@ in
   (prevStage:
     # previous stage-xclang stdenv:
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      atf autoconf automake bash binutils-unwrapped bison cmake cmakeMinimal coreutils cpio
-      cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu kyua libedit libtool m4 ninja
+      atf autoconf automake bash bison cmake cmakeMinimal coreutils cpio
+      cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu kyua libedit libtool m4 meson ninja
       openbsm openldap openpam openssh patchutils pbzx perl pkg-config.pkg-config python3
       python3Minimal scons serf sqlite subversion sysctl.provider texinfo unzip which xz
     ]);
@@ -718,13 +809,13 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
+      cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ Libsystem configd ]);
     assert (! useAppleSDKLibs) -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc ]);
-    assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd libclosure libdispatch xnu ]);
+    assert lib.all isFromNixpkgs (with prevStage.darwin; [ binutils-unwrapped dyld launchd libclosure libdispatch xnu ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.llvmPackages; [
       clang-unwrapped libclang libllvm llvm
@@ -732,8 +823,6 @@ in
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.llvmPackages; [ libcxx ]);
     assert prevStage.llvmPackages.compiler-rt == null;
 
-    assert lib.getVersion prevStage.stdenv.cc.bintools.bintools == lib.getVersion prevStage.darwin.cctools-port;
-
     stageFun prevStage {
 
     name = "bootstrap-stage2-Libsystem";
@@ -742,7 +831,7 @@ in
       inherit (prevStage) ccWrapperStdenv
         atf autoconf automake binutils-unwrapped bison brotli cmake cmakeMinimal coreutils
         cpio cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu kyua libedit libffi
-        libiconv libidn2 libkrb5 libssh2 libtool libunistring libxml2 m4 ncurses nghttp2
+        libiconv libidn2 libkrb5 libssh2 libtool libunistring libxml2 m4 meson ncurses nghttp2
         ninja openbsm openldap openpam openssh openssl patchutils pbzx perl pkg-config
         python3 python3Minimal scons serf sqlite subversion sysctl texinfo unzip which xz
         zlib zstd;
@@ -807,9 +896,9 @@ in
   (prevStage:
     # previous stage2-Libsystem stdenv:
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      atf autoconf automake binutils-unwrapped bison brotli cmake cmakeMinimal coreutils
+      atf autoconf automake bison brotli cmake cmakeMinimal coreutils
       cpio cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu kyua libedit libidn2
-      libkrb5 libssh2 libtool libunistring m4 nghttp2 ninja openbsm openldap openpam openssh
+      libkrb5 libssh2 libtool libunistring m4 meson nghttp2 ninja openbsm openldap openpam openssh
       openssl patchutils pbzx perl pkg-config.pkg-config python3 python3Minimal scons serf
       sqlite subversion sysctl.provider texinfo unzip which xz zstd
     ]);
@@ -821,14 +910,14 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
+      cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ configd ]);
     assert (! useAppleSDKLibs) -> lib.all        isBuiltByNixpkgsCompiler (with prevStage.darwin; [ Libsystem ]);
     assert (! useAppleSDKLibs) -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc ]);
-    assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd libclosure libdispatch xnu ]);
+    assert lib.all isFromNixpkgs (with prevStage.darwin; [ binutils-unwrapped  dyld launchd libclosure libdispatch xnu ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.llvmPackages; [
       clang-unwrapped libclang libllvm llvm
@@ -836,8 +925,6 @@ in
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.llvmPackages; [ libcxx ]);
     assert prevStage.llvmPackages.compiler-rt == null;
 
-    assert lib.getVersion prevStage.stdenv.cc.bintools.bintools == lib.getVersion prevStage.darwin.cctools-llvm;
-
     stageFun prevStage {
 
     name = "bootstrap-stage2-CF";
@@ -846,7 +933,7 @@ in
       inherit (prevStage) ccWrapperStdenv
         atf autoconf automake bash bison brotli cmake cmakeMinimal coreutils cpio
         cyrus_sasl db ed expat flex gettext gmp gnugrep groff kyua libedit libidn2 libkrb5
-        libssh2 libtool libunistring m4 ncurses nghttp2 ninja openbsm openldap openpam
+        libssh2 libtool libunistring m4 meson ncurses nghttp2 ninja openbsm openldap openpam
         openssh openssl patchutils pbzx perl pkg-config python3 python3Minimal scons serf
         sqlite subversion sysctl texinfo unzip which xz zstd;
 
@@ -865,9 +952,6 @@ in
         } // {
           passthru = { inherit (prevStage.bintools.passthru) isFromBootstrapFiles; };
         };
-
-        # Avoid building unnecessary Python dependencies due to building LLVM manpages.
-        cctools-llvm = superDarwin.cctools-llvm.override { enableManpages = false; };
       });
 
       llvmPackages = super.llvmPackages // (
@@ -931,34 +1015,32 @@ in
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
       autoconf automake bison brotli cmake cmakeMinimal coreutils cpio cyrus_sasl
       db ed expat flex gettext gmp gnugrep groff libedit libidn2 libkrb5 libssh2 libtool
-      libunistring m4 ncurses nghttp2 ninja openbsm openldap openpam openssh openssl
+      libunistring m4 meson ncurses nghttp2 ninja openbsm openldap openpam openssh openssl
       patchutils pbzx perl pkg-config.pkg-config python3 python3Minimal scons serf sqlite
       subversion sysctl.provider texinfo unzip which xz zstd
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage; [
-      bash binutils-unwrapped icu libffi libiconv libxml2 zlib
+      bash icu libffi libiconv libxml2 zlib
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
       locale print-reexports rewrite-tbd sigtool
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools libtapi
+      cctools libtapi
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ configd ]);
     assert (! useAppleSDKLibs) -> lib.all        isBuiltByNixpkgsCompiler (with prevStage.darwin; [ Libsystem ]);
     assert (! useAppleSDKLibs) -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc ]);
-    assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd libclosure libdispatch xnu ]);
+    assert lib.all isFromNixpkgs (with prevStage.darwin; [ binutils-unwrapped dyld launchd libclosure libdispatch xnu ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.llvmPackages; [
       clang-unwrapped libclang libllvm llvm
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.llvmPackages; [ libcxx ]);
 
-    assert lib.getVersion prevStage.stdenv.cc.bintools.bintools == lib.getVersion prevStage.darwin.cctools-llvm;
-
     stageFun prevStage {
 
     name = "bootstrap-stage3";
@@ -967,7 +1049,7 @@ in
       inherit (prevStage) ccWrapperStdenv
         autoconf automake bash binutils binutils-unwrapped bison brotli cmake cmakeMinimal
         coreutils cpio cyrus_sasl db ed expat flex gettext gmp gnugrep groff libedit
-        libidn2 libkrb5 libssh2 libtool libunistring m4 nghttp2 ninja openbsm openldap
+        libidn2 libkrb5 libssh2 libtool libunistring m4 meson nghttp2 ninja openbsm openldap
         openpam openssh openssl patchutils pbzx perl pkg-config python3 python3Minimal scons
         sed serf sharutils sqlite subversion sysctl texinfo unzip which xz zstd
 
@@ -979,7 +1061,7 @@ in
 
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin)
-          CF Libsystem binutils binutils-unwrapped cctools cctools-llvm cctools-port configd
+          CF Libsystem binutils binutils-unwrapped cctools cctools-port configd
           darwin-stubs dyld launchd libclosure libdispatch libobjc libtapi locale objc4
           postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
 
@@ -1015,34 +1097,32 @@ in
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
       autoconf automake bison brotli cmake cmakeMinimal coreutils cpio cyrus_sasl
       db ed expat flex gettext gmp gnugrep groff libedit libidn2 libkrb5 libssh2 libtool
-      libunistring m4 nghttp2 ninja openbsm openldap openpam openssh openssl patchutils pbzx
+      libunistring m4 meson nghttp2 ninja openbsm openldap openpam openssh openssl patchutils pbzx
       perl pkg-config.pkg-config python3 python3Minimal scons serf sqlite subversion
       sysctl.provider texinfo unzip which xz zstd
     ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage; [
-      bash binutils-unwrapped icu libffi libiconv libxml2 zlib
+      bash icu libffi libiconv libxml2 zlib
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
       locale print-reexports rewrite-tbd sigtool
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools libtapi
+      cctools libtapi
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ configd ]);
     assert (! useAppleSDKLibs) -> lib.all        isBuiltByNixpkgsCompiler (with prevStage.darwin; [ Libsystem ]);
     assert (! useAppleSDKLibs) -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc ]);
-    assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd libclosure libdispatch xnu ]);
+    assert lib.all isFromNixpkgs (with prevStage.darwin; [ binutils-unwrapped dyld launchd libclosure libdispatch xnu ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.llvmPackages; [
       clang-unwrapped libclang libllvm llvm compiler-rt libcxx
     ]);
 
-    assert lib.getVersion prevStage.stdenv.cc.bintools.bintools == lib.getVersion prevStage.darwin.cctools-llvm;
-
     stageFun prevStage {
 
     name = "bootstrap-stage4";
@@ -1050,7 +1130,7 @@ in
     overrides = self: super: {
       inherit (prevStage) ccWrapperStdenv
         autoconf automake bash bison cmake cmakeMinimal cyrus_sasl db expat flex groff
-        libedit libtool m4 ninja openldap openssh patchutils perl pkg-config python3 scons
+        libedit libtool m4 meson ninja openldap openssh patchutils perl pkg-config python3 scons
         serf sqlite subversion sysctl texinfo unzip which
 
         # CF dependencies - don’t rebuild them.
@@ -1079,26 +1159,27 @@ in
           libc = selfDarwin.Libsystem;
         };
 
-        # cctools needs to build the LLVM man pages, which requires sphinx. Sphinx
-        # has hatch-vcs as a transitive dependency, which pulls in git (and curl).
-        # Disabling the tests for hatch-vcs allows the stdenv bootstrap to avoid having
-        # any dependency on curl other than the one provided in the bootstrap tools.
-        cctools-llvm = superDarwin.cctools-llvm.override (old: {
-          llvmPackages =
-            let
-              tools = old.llvmPackages.tools.extend (_: superTools: {
-                llvm-manpages = superTools.llvm-manpages.override {
-                  python3Packages = prevStage.python3Packages.overrideScope (_: superPython: {
-                    hatch-vcs = (superPython.hatch-vcs.override {
-                      git = null;
-                      pytestCheckHook = null;
-                    });
-                  });
-                };
-              });
-              inherit (old.llvmPackages) libraries release_version;
-            in
-            { inherit tools libraries release_version; } // tools // libraries;
+        # binutils-unwrapped needs to build the LLVM man pages, which requires a lot of Python stuff
+        # that ultimately ends up depending on git. Fortunately, the git dependency is only for check
+        # inputs. The following set of overrides allow the LLVM documentation to be built without
+        # pulling curl (and other packages like ffmpeg) into the stdenv bootstrap.
+        binutils-unwrapped = superDarwin.binutils-unwrapped.override (old: {
+          llvm-manpages = super.llvmPackages.llvm-manpages.override {
+            python3Packages = self.python3.pkgs.overrideScope (_: superPython: {
+              hatch-vcs = superPython.hatch-vcs.overrideAttrs {
+                doInstallCheck = false;
+              };
+              markdown-it-py = superPython.markdown-it-py.overrideAttrs {
+                doInstallCheck = false;
+              };
+              mdit-py-plugins = superPython.mdit-py-plugins.overrideAttrs {
+                doInstallCheck = false;
+              };
+              myst-parser = superPython.myst-parser.overrideAttrs {
+                doInstallCheck = false;
+              };
+            });
+          };
         });
       });
 
@@ -1177,20 +1258,20 @@ in
   (prevStage:
     # previous stage4 stdenv:
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage; [
-      bash binutils-unwrapped brotli bzip2 cpio diffutils ed file findutils gawk
+      bash brotli bzip2 cpio diffutils ed file findutils gawk
       gettext gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libkrb5
       libssh2 libunistring libxml2 libyaml ncurses nghttp2 openbsm openpam openssl patch
       pbzx pcre python3Minimal xar xz zlib zstd
     ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools libtapi locale print-reexports rewrite-tbd sigtool
+      cctools libtapi locale print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [ Libsystem configd ]);
     assert (! useAppleSDKLibs) -> lib.all            isFromNixpkgs (with prevStage.darwin; [ CF ]);
     assert    useAppleSDKLibs  -> lib.all            isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc ]);
-    assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd libclosure libdispatch xnu ]);
+    assert lib.all isFromNixpkgs (with prevStage.darwin; [ binutils-unwrapped dyld launchd libclosure libdispatch xnu ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.llvmPackages; [
       clang-unwrapped libclang libllvm llvm compiler-rt libcxx
@@ -1198,12 +1279,10 @@ in
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
       autoconf automake bison cmake cmakeMinimal cyrus_sasl db expat flex groff libedit
-      libtool m4 ninja openldap openssh patchutils perl pkg-config.pkg-config python3 scons
+      libtool m4 meson ninja openldap openssh patchutils perl pkg-config.pkg-config python3 scons
       serf sqlite subversion sysctl.provider texinfo unzip which
     ]);
 
-    assert prevStage.darwin.cctools == prevStage.darwin.cctools-llvm;
-
     let
       doSign = localSystem.isAarch64;
 
@@ -1255,8 +1334,6 @@ in
 
       allowedRequisites = (with prevStage; [
         bash
-        binutils.bintools
-        binutils.bintools.lib
         bzip2.bin
         bzip2.out
         cc.expand-response-params
@@ -1312,7 +1389,6 @@ in
       ++ (with prevStage.darwin; [
         CF
         Libsystem
-        cctools-llvm
         cctools-port
         dyld
         libtapi
@@ -1340,7 +1416,7 @@ in
             inherit (prevStage.darwin.apple_sdk) sdkRoot;
           };
         } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
-          inherit (prevStage.darwin) binutils binutils-unwrapped cctools-llvm cctools-port;
+          inherit (prevStage.darwin) binutils binutils-unwrapped cctools-port;
         });
       } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
         inherit (prevStage.llvmPackages) clang llvm;
@@ -1357,8 +1433,6 @@ in
           in
           { inherit tools libraries; } // tools // libraries
         );
-
-        inherit (prevStage) binutils binutils-unwrapped;
       };
     };
   })
@@ -1367,17 +1441,22 @@ in
   (prevStage:
     # previous final stage stdenv:
     assert isBuiltByNixpkgsCompiler prevStage.darwin.sigtool;
-    assert isBuiltByNixpkgsCompiler prevStage.darwin.binutils-unwrapped;
     assert isBuiltByNixpkgsCompiler prevStage.darwin.print-reexports;
     assert isBuiltByNixpkgsCompiler prevStage.darwin.rewrite-tbd;
     assert isBuiltByNixpkgsCompiler prevStage.darwin.cctools;
 
     assert            isFromNixpkgs prevStage.darwin.CF;
     assert            isFromNixpkgs prevStage.darwin.Libsystem;
+    assert            isFromNixpkgs prevStage.darwin.binutils-unwrapped;
 
     assert isBuiltByNixpkgsCompiler prevStage.llvmPackages.clang-unwrapped;
     assert isBuiltByNixpkgsCompiler prevStage.llvmPackages.libllvm;
     assert isBuiltByNixpkgsCompiler prevStage.llvmPackages.libcxx;
     assert isBuiltByNixpkgsCompiler prevStage.llvmPackages.compiler-rt;
+
+    # Make sure these evaluate since they were disabled explicitly in the bootstrap.
+    assert isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert            isFromNixpkgs prevStage.binutils-unwrapped.src;
+
     { inherit (prevStage) config overlays stdenv; })
 ]
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index bacad15a68bc..3d1894315ff1 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -40,8 +40,6 @@ rec {
         NIX_LDFLAGS = (oa.NIX_LDFLAGS or "") + " -headerpad_max_install_names";
       });
 
-      cctools_ = darwin.cctools;
-
       # Avoid messing with libkrb5 and libnghttp2.
       curl_ = curlMinimal.override (args: {
         gssSupport = false;
@@ -112,7 +110,7 @@ rec {
 
       # Copy binutils.
       for i in as ld ar ranlib nm strip otool install_name_tool lipo codesign_allocate; do
-        cp ${getBin cctools_}/bin/$i $out/bin
+        cp ${getBin darwin.binutils-unwrapped}/bin/$i $out/bin
       done
 
       # Copy coreutils, bash, etc.
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index af68bf890ed2..f03c68a4c5cb 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -119,6 +119,7 @@ let
     "pie"
     "relro"
     "stackprotector"
+    "stackclashprotection"
     "strictoverflow"
     "trivialautovarinit"
     "zerocallusedregs"
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 45c73d7709c6..b5b7a7037784 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -47,10 +47,67 @@ getAllOutputNames() {
     fi
 }
 
+if [[ -n "${NIX_LOG_FD:-}" ]]; then
+    # Logs arguments to $NIX_LOG_FD, if it exists, no-op if it does not.
+    nixLog() {
+        echo "$@" >&"$NIX_LOG_FD"
+    }
+
+    # Log a hook, to be run before the hook is actually called.
+    # logging for "implicit" hooks -- the ones specified directly
+    # in derivation's arguments -- is done in _callImplicitHook instead.
+    _logHook() {
+        local hookKind="$1"
+        local hookExpr="$2"
+        shift 2
+
+        if declare -F "$hookExpr" > /dev/null 2>&1; then
+            nixLog "calling '$hookKind' function hook '$hookExpr'" "$@"
+        elif type -p "$hookExpr" > /dev/null; then
+            nixLog "sourcing '$hookKind' script hook '$hookExpr'"
+        elif [[ "$hookExpr" != "_callImplicitHook"* ]]; then
+            # Here we have a string hook to eval.
+            # Join lines onto one with literal \n characters unless NIX_DEBUG >= 2.
+            local exprToOutput
+            if (( "${NIX_DEBUG:-0}" >= 2 )); then
+                exprToOutput="$hookExpr"
+            else
+                # We have `r'\n'.join([line.lstrip() for lines in text.split('\n')])` at home.
+                local hookExprLine
+                while IFS= read -r hookExprLine; do
+                    # These lines often have indentation,
+                    # so let's remove leading whitespace.
+                    hookExprLine="${hookExprLine#"${hookExprLine%%[![:space:]]*}"}"
+                    # If this line wasn't entirely whitespace,
+                    # then add it to our output
+                    if [[ -n "$hookExprLine" ]]; then
+                        exprToOutput+="$hookExprLine\\n "
+                    fi
+                done <<< "$hookExpr"
+
+                # And then remove the final, unnecessary, \n
+                exprToOutput="${exprToOutput%%\\n }"
+            fi
+            nixLog "evaling '$hookKind' string hook '$exprToOutput'"
+        fi
+    }
+else
+    nixLog() {
+        # Stub.
+        # Note: because bash syntax, this colon is load bearing. Removing it
+        # will turn this function into a syntax error.
+        :
+    }
+
+    _logHook() {
+        # Load-bearing colon; same as above.
+        :
+    }
+fi
+
 ######################################################################
 # Hook handling.
 
-
 # Run all hooks with the specified name in the order in which they
 # were added, stopping if any fails (returns a non-zero exit
 # code). The hooks for <hookName> are the shell function or variable
@@ -64,6 +121,7 @@ runHook() {
     # Hack around old bash being bad and thinking empty arrays are
     # undefined.
     for hook in "_callImplicitHook 0 $hookName" ${!hooksSlice+"${!hooksSlice}"}; do
+        _logHook "$hookName" "$hook" "$@"
         _eval "$hook" "$@"
     done
 
@@ -81,6 +139,7 @@ runOneHook() {
     local hook ret=1
     # Hack around old bash like above
     for hook in "_callImplicitHook 1 $hookName" ${!hooksSlice+"${!hooksSlice}"}; do
+        _logHook "$hookName" "$hook" "$@"
         if _eval "$hook" "$@"; then
             ret=0
             break
@@ -100,10 +159,13 @@ _callImplicitHook() {
     local def="$1"
     local hookName="$2"
     if declare -F "$hookName" > /dev/null; then
+        nixLog "calling implicit '$hookName' function hook"
         "$hookName"
     elif type -p "$hookName" > /dev/null; then
+        nixLog "sourcing implicit '$hookName' script hook"
         source "$hookName"
     elif [ -n "${!hookName:-}" ]; then
+        nixLog "evaling implicit '$hookName' string hook"
         eval "${!hookName}"
     else
         return "$def"
@@ -644,6 +706,7 @@ activatePackage() {
     (( hostOffset <= targetOffset )) || exit 1
 
     if [ -f "$pkg" ]; then
+        nixLog "sourcing setup hook '$pkg'"
         source "$pkg"
     fi
 
@@ -667,6 +730,7 @@ activatePackage() {
     fi
 
     if [[ -f "$pkg/nix-support/setup-hook" ]]; then
+        nixLog "sourcing setup hook '$pkg/nix-support/setup-hook'"
         source "$pkg/nix-support/setup-hook"
     fi
 }
@@ -830,7 +894,7 @@ substituteStream() {
                 # deprecated 2023-11-22
                 # this will either get removed, or switch to the behaviour of --replace-fail in the future
                 if ! "$_substituteStream_has_warned_replace_deprecation"; then
-                    echo "substituteStream(): WARNING: '--replace' is deprecated, use --replace-{fail,warn,quiet}. ($description)" >&2
+                    echo "substituteStream() in derivation $name: WARNING: '--replace' is deprecated, use --replace-{fail,warn,quiet}. ($description)" >&2
                     _substituteStream_has_warned_replace_deprecation=true
                 fi
                 replace_mode='--replace-warn'
@@ -845,9 +909,9 @@ substituteStream() {
                 if [ "$pattern" != "$replacement" ]; then
                     if [ "${!var}" == "$savedvar" ]; then
                         if [ "$replace_mode" == --replace-warn ]; then
-                            printf "substituteStream(): WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                            printf "substituteStream() in derivation $name: WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
                         elif [ "$replace_mode" == --replace-fail ]; then
-                            printf "substituteStream(): ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                            printf "substituteStream() in derivation $name: ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
                             return 1
                         fi
                     fi
@@ -859,11 +923,11 @@ substituteStream() {
                 shift 2
                 # check if the used nix attribute name is a valid bash name
                 if ! [[ "$varName" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
-                    echo "substituteStream(): ERROR: substitution variables must be valid Bash names, \"$varName\" isn't." >&2
+                    echo "substituteStream() in derivation $name: ERROR: substitution variables must be valid Bash names, \"$varName\" isn't." >&2
                     return 1
                 fi
                 if [ -z ${!varName+x} ]; then
-                    echo "substituteStream(): ERROR: variable \$$varName is unset" >&2
+                    echo "substituteStream() in derivation $name: ERROR: variable \$$varName is unset" >&2
                     return 1
                 fi
                 pattern="@$varName@"
@@ -879,7 +943,7 @@ substituteStream() {
                 ;;
 
             *)
-                echo "substituteStream(): ERROR: Invalid command line argument: $1" >&2
+                echo "substituteStream() in derivation $name: ERROR: Invalid command line argument: $1" >&2
                 return 1
                 ;;
         esac
@@ -1558,9 +1622,7 @@ runPhase() {
     if [[ "$curPhase" = installCheckPhase && -z "${doInstallCheck:-}" ]]; then return; fi
     if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then return; fi
 
-    if [[ -n $NIX_LOG_FD ]]; then
-        echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&"$NIX_LOG_FD"
-    fi
+    nixLog "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }"
 
     showPhaseHeader "$curPhase"
     dumpVars
diff --git a/pkgs/stdenv/linux/bootstrap-tools/default.nix b/pkgs/stdenv/linux/bootstrap-tools/default.nix
index 6d2490acfa47..4450679983ff 100644
--- a/pkgs/stdenv/linux/bootstrap-tools/default.nix
+++ b/pkgs/stdenv/linux/bootstrap-tools/default.nix
@@ -15,5 +15,10 @@ derivation ({
   langC = true;
   langCC = true;
   isGNU = true;
-  hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" "trivialautovarinit" ];
+  hardeningUnsupportedFlags = [
+    "fortify3"
+    "stackclashprotection"
+    "trivialautovarinit"
+    "zerocallusedregs"
+  ];
 } // extraAttrs)
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 644c997de619..28360b17527c 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -167,7 +167,10 @@ let
     {
       scripts = [ "bin/xdg-screensaver" ];
       interpreter = "${bash}/bin/bash";
-      inputs = commonDeps ++ [ nettools perl procmail procps ];
+      inputs = commonDeps ++ [ nettools perl procps ]
+        # procmail's funky build system is currently broken in cross-build.
+        # xdg-screensaver will gracefully degrade if it's not available.
+        ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) procmail;
       # These are desktop-specific, so we don't want xdg-utils to be able to
       # call them when in a different setup.
       fake.external = commonFakes ++ [
@@ -176,7 +179,7 @@ let
         "xautolock"                 # Xautolock
         "xscreensaver-command"      # Xscreensaver
         "xset"                      # generic-ish X
-      ];
+      ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "lockfile"; # procmail
       keep = {
         "$MV" = true;
         "$XPROP" = true;
diff --git a/pkgs/tools/admin/ansible/doctor.nix b/pkgs/tools/admin/ansible/doctor.nix
index 8a14a049893b..e6a370c46f90 100644
--- a/pkgs/tools/admin/ansible/doctor.nix
+++ b/pkgs/tools/admin/ansible/doctor.nix
@@ -30,7 +30,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/admin/ansible/later.nix b/pkgs/tools/admin/ansible/later.nix
index f040acdfbd0f..d40355e09e81 100644
--- a/pkgs/tools/admin/ansible/later.nix
+++ b/pkgs/tools/admin/ansible/later.nix
@@ -45,7 +45,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/admin/ansible/lint.nix b/pkgs/tools/admin/ansible/lint.nix
index e3ff67eda963..6970abd8a27f 100644
--- a/pkgs/tools/admin/ansible/lint.nix
+++ b/pkgs/tools/admin/ansible/lint.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     setuptools
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 568282fa86ab..f3e5fc97e323 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -9,24 +9,18 @@
 }:
 
 let
-  botocoreVersion = python3.pkgs.botocore.version;
-  # awscli.version should be pinned to 2 minor versions less than the botocoreVersion
-  versionMinor = toString (lib.toInt (lib.versions.minor botocoreVersion) - 2);
-  versionPatch = lib.versions.patch botocoreVersion;
   self = python3.pkgs.buildPythonApplication rec {
     pname = "awscli";
-    version = "1.${versionMinor}.${versionPatch}"; # N.B: if you change this, change botocore and boto3 to a matching version too
+    # N.B: if you change this, change botocore and boto3 to a matching version too
+    # check e.g. https://github.com/aws/aws-cli/blob/1.33.21/setup.py
+    version = "1.33.11";
     pyproject = true;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-96hFvXs3Fcvad+PBEpS9RFMJkcD1qHqfQ+8gtVfEbnc=";
+      hash = "sha256-Q8qtGChOnscOm7m3s7bWwUFmrUwMua9N6uz1Lyc8QIY=";
     };
 
-    nativeBuildInputs = [
-      python3.pkgs.pythonRelaxDepsHook
-    ];
-
     pythonRelaxDeps = [
       # botocore must not be relaxed
       "colorama"
@@ -64,7 +58,7 @@ let
     installCheckPhase = ''
       runHook preInstallCheck
 
-      $out/bin/aws --version | grep "${botocoreVersion}"
+      $out/bin/aws --version | grep "${python3.pkgs.botocore.version}"
       $out/bin/aws --version | grep "${version}"
 
       runHook postInstallCheck
diff --git a/pkgs/tools/admin/gimme-aws-creds/default.nix b/pkgs/tools/admin/gimme-aws-creds/default.nix
index 3b1a334c6be2..ab43e9971d8e 100644
--- a/pkgs/tools/admin/gimme-aws-creds/default.nix
+++ b/pkgs/tools/admin/gimme-aws-creds/default.nix
@@ -37,7 +37,6 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     installShellFiles
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/tools/admin/gixy/default.nix b/pkgs/tools/admin/gixy/default.nix
index 541bcb42f905..dadf70e773ce 100644
--- a/pkgs/tools/admin/gixy/default.nix
+++ b/pkgs/tools/admin/gixy/default.nix
@@ -1,7 +1,7 @@
-{ lib, fetchFromGitHub, python3 }:
+{ lib, fetchFromGitHub, python311 }:
 
 let
-  python = python3.override {
+  python = python311.override {
     packageOverrides = self: super: {
       pyparsing = super.pyparsing.overridePythonAttrs rec {
         version = "2.4.7";
diff --git a/pkgs/tools/admin/turbovnc/default.nix b/pkgs/tools/admin/turbovnc/default.nix
index dc0ec7d987e6..a5f5312502c7 100644
--- a/pkgs/tools/admin/turbovnc/default.nix
+++ b/pkgs/tools/admin/turbovnc/default.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     # to the swrast dri driver in Mesa.
     # Can also be given at runtime to its `Xvnc` as:
     #   -dridir /nix/store/...-mesa-20.1.10-drivers/lib/dri/
-    "-DXORG_DRI_DRIVER_PATH=${mesa.drivers}/lib/dri"
+    "-DXORG_DRI_DRIVER_PATH=${mesa.driverLink}/lib/dri"
     # The build system doesn't find these files automatically.
     "-DTJPEG_JAR=${libjpeg_turbo.out}/share/java/turbojpeg.jar"
     "-DTJPEG_JNILIBRARY=${libjpeg_turbo.out}/lib/libturbojpeg.so"
diff --git a/pkgs/tools/archivers/7zz/default.nix b/pkgs/tools/archivers/7zz/default.nix
index 2cb28910982d..3408ce8c08d1 100644
--- a/pkgs/tools/archivers/7zz/default.nix
+++ b/pkgs/tools/archivers/7zz/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchurl
+, fetchzip
 
   # Only used for Linux's x86/x86_64
 , uasm
@@ -27,31 +27,22 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "7zz";
   version = "24.07";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://7-zip.org/a/7z${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}-src.tar.xz";
     hash = {
-      free = "sha256-qVX4CViXsODmPZIPdHzG3xgCVDVb0qZ+1l3+I9wJg2o=";
-      unfree = "sha256-0bCHSj8cJt8hx2GkowaR3BIT6Fd/GO54MmwUyk1oPis=";
+      free = "sha256-D41Sf437WYRQMdVW7hwcnZI0UG67IJsTTMfxlpkk36M=";
+      unfree = "sha256-iKCs893IFG0I6a2kpUe0qiuCX+YUxIgMIBRykc9XYjA=";
     }.${if enableUnfree then "unfree" else "free"};
-    downloadToTemp = (!enableUnfree);
+    stripRoot = false;
     # remove the unRAR related code from the src drv
     # > the license requires that you agree to these use restrictions,
     # > or you must remove the software (source and binary) from your hard disks
     # https://fedoraproject.org/wiki/Licensing:Unrar
     postFetch = lib.optionalString (!enableUnfree) ''
-      mkdir tmp
-      tar xf $downloadedFile -C ./tmp
-      rm -r ./tmp/CPP/7zip/Compress/Rar*
-      tar cfJ $out -C ./tmp . \
-        --sort=name \
-        --mtime="@$SOURCE_DATE_EPOCH" \
-        --owner=0 --group=0 --numeric-owner \
-        --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime
-    '';
+      rm -r $out/CPP/7zip/Compress/Rar*
+   '';
   };
 
-  sourceRoot = ".";
-
   patches = [
     ./fix-cross-mingw-build.patch
   ];
diff --git a/pkgs/tools/audio/spotdl/default.nix b/pkgs/tools/audio/spotdl/default.nix
index 68235ab3d469..0131d64ba824 100644
--- a/pkgs/tools/audio/spotdl/default.nix
+++ b/pkgs/tools/audio/spotdl/default.nix
@@ -18,8 +18,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
-
   pythonRelaxDeps = true;
 
   # Remove when https://github.com/spotDL/spotify-downloader/issues/2119 is fixed
diff --git a/pkgs/tools/audio/wyoming/faster-whisper.nix b/pkgs/tools/audio/wyoming/faster-whisper.nix
index 563f2ce4562d..4807e50adb42 100644
--- a/pkgs/tools/audio/wyoming/faster-whisper.nix
+++ b/pkgs/tools/audio/wyoming/faster-whisper.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/audio/wyoming/openwakeword.nix b/pkgs/tools/audio/wyoming/openwakeword.nix
index 69f10f1d208f..78fb2e81d9fe 100644
--- a/pkgs/tools/audio/wyoming/openwakeword.nix
+++ b/pkgs/tools/audio/wyoming/openwakeword.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/audio/wyoming/piper.nix b/pkgs/tools/audio/wyoming/piper.nix
index 7905bab5b139..ed79d289c0d8 100644
--- a/pkgs/tools/audio/wyoming/piper.nix
+++ b/pkgs/tools/audio/wyoming/piper.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/backup/tarsnapper/default.nix b/pkgs/tools/backup/tarsnapper/default.nix
index 843e61ecea57..36842b634378 100644
--- a/pkgs/tools/backup/tarsnapper/default.nix
+++ b/pkgs/tools/backup/tarsnapper/default.nix
@@ -26,7 +26,6 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/tools/backup/zfs-autobackup/default.nix b/pkgs/tools/backup/zfs-autobackup/default.nix
index 5999508fabf2..e29813caab27 100644
--- a/pkgs/tools/backup/zfs-autobackup/default.nix
+++ b/pkgs/tools/backup/zfs-autobackup/default.nix
@@ -10,7 +10,6 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-rvtY7fsn2K2hueAsQkaPXcwxUAgE8j+GsQFF3eJKG2o=";
   };
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3Packages; [ colorama ];
 
diff --git a/pkgs/tools/compression/lz4/0001-Create-a-unified-lz4-target.patch b/pkgs/tools/compression/lz4/0001-Create-a-unified-lz4-target.patch
new file mode 100644
index 000000000000..4092d232a0a3
--- /dev/null
+++ b/pkgs/tools/compression/lz4/0001-Create-a-unified-lz4-target.patch
@@ -0,0 +1,34 @@
+From 14fca2e93bd783c0ad2362af6d69801c2073765d Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Sun, 23 Jun 2024 20:16:00 +0200
+Subject: [PATCH] Create a unified lz4 target
+
+Includes changes from
+* https://github.com/lz4/lz4/pull/1372
+* https://github.com/lz4/lz4/pull/1413
+---
+ build/cmake/CMakeLists.txt | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/build/cmake/CMakeLists.txt b/build/cmake/CMakeLists.txt
+index eb7007b..07ddd2b 100644
+--- a/build/cmake/CMakeLists.txt
++++ b/build/cmake/CMakeLists.txt
+@@ -130,6 +130,14 @@ if(BUILD_STATIC_LIBS)
+     POSITION_INDEPENDENT_CODE ${LZ4_POSITION_INDEPENDENT_LIB})
+   list(APPEND LZ4_LIBRARIES_BUILT lz4_static)
+ endif()
++# Add unified target.
++add_library(lz4 INTERFACE)
++list(APPEND LZ4_LIBRARIES_BUILT lz4)
++if(BUILD_SHARED_LIBS)
++  target_link_libraries(lz4 INTERFACE lz4_shared)
++else()
++  target_link_libraries(lz4 INTERFACE lz4_static)
++endif()
+ 
+ if(BUILD_STATIC_LIBS)
+   set(LZ4_LINK_LIBRARY lz4_static)
+-- 
+2.45.1
+
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index f745f4f091ab..67bc9016cace 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -1,58 +1,48 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, valgrind
-, enableStatic ? stdenv.hostPlatform.isStatic
-, enableShared ? !stdenv.hostPlatform.isStatic
+{ lib, stdenv, fetchFromGitHub, cmake
+, valgrind, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lz4";
   version = "1.9.4";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-YiMCD3vvrG+oxBUghSrCmP2LAfAGZrEaKz0YoaQJhpI=";
-    rev = "v${version}";
-    repo = pname;
-    owner = pname;
+    repo = "lz4";
+    owner = "lz4";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-YiMCD3vvrG+oxBUghSrCmP2LAfAGZrEaKz0YoaQJhpI=";
   };
 
-  patches = [
-    (fetchpatch { # https://github.com/lz4/lz4/pull/1162
-      name = "build-shared-no.patch";
-      url = "https://github.com/lz4/lz4/commit/851ef4b23c7cbf4ceb2ba1099666a8b5ec4fa195.patch";
-      sha256 = "sha256-P+/uz3m7EAmHgXF/1Vncc0uKKxNVq6HNIsElx0rGxpw=";
-    })
+  nativeBuildInputs = [
+    cmake
   ];
 
-  # TODO(@Ericson2314): Separate binaries and libraries
-  outputs = [ "bin" "out" "dev" ];
+  buildInputs = lib.optionals finalAttrs.doCheck [
+    valgrind
+  ];
 
-  buildInputs = lib.optional doCheck valgrind;
+  outputs = [ "dev" "lib" "man" "out" ];
 
-  enableParallelBuilding = true;
+  patches = [
+    ./0001-Create-a-unified-lz4-target.patch
+  ];
 
-  makeFlags = [
-    "PREFIX=$(out)"
-    "INCLUDEDIR=$(dev)/include"
-    "BUILD_STATIC=${if enableStatic then "yes" else "no"}"
-    "BUILD_SHARED=${if enableShared then "yes" else "no"}"
-    "WINDRES:=${stdenv.cc.bintools.targetPrefix}windres"
-  ]
-    # TODO make full dictionary
-    ++ lib.optional stdenv.hostPlatform.isMinGW "TARGET_OS=MINGW"
-    ++ lib.optional stdenv.hostPlatform.isLinux "TARGET_OS=Linux"
-    ;
+  cmakeDir = "../build/cmake";
+  cmakeBuildDir = "build-dist";
 
   doCheck = false; # tests take a very long time
   checkTarget = "test";
 
-  # TODO(@Ericson2314): Make resusable setup hook for this issue on Windows.
-  postInstall =
-    lib.optionalString stdenv.hostPlatform.isWindows ''
-      mv $out/bin/*.dll $out/lib
-      ln -s $out/lib/*.dll
-    ''
-    + ''
-      moveToOutput bin "$bin"
-    '';
+  passthru.tests = {
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      version = "v${finalAttrs.version}";
+    };
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "liblz4" ];
+    };
+  };
 
   meta = with lib; {
     description = "Extremely fast compression algorithm";
@@ -66,5 +56,7 @@ stdenv.mkDerivation rec {
     homepage = "https://lz4.github.io/lz4/";
     license = with licenses; [ bsd2 gpl2Plus ];
     platforms = platforms.all;
+    mainProgram = "lz4";
+    maintainers = [ maintainers.tobim ];
   };
-}
+})
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index e5d2fd267a61..6220d56b15a2 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -11,14 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xz";
-  version = "5.4.6"; # Beware of CVE-2024-3094 and related risks!!!
+  version = "5.6.2";
 
   src = fetchurl {
-    url = with finalAttrs;
-      # The original URL has been taken down.
-      # "https://github.com/tukaani-project/xz/releases/download/v${version}/xz-${version}.tar.bz2";
-      "mirror://sourceforge/lzmautils/xz-${version}.tar.bz2";
-    sha256 = "sha256-kThRsnTo4dMXgeyUnxwj6NvPDs9uc6JDbcIXad0+b0k=";
+    url = with finalAttrs; "https://github.com/tukaani-project/xz/releases/download/v${version}/xz-${version}.tar.xz";
+    hash = "sha256-qds7s9ZOJIoPrpY/j7a6hRomuhgi5QTcDv0YqAxibK8=";
   };
 
   strictDeps = true;
@@ -52,10 +49,10 @@ stdenv.mkDerivation (finalAttrs: {
 
       set -eu -o pipefail
 
-      # Expect the text in format of '>xz-5.2.6.tar.bz2</a>'
+      # Expect the text in format of '>xz-5.2.6.tar.xz</a>'
       # We pick first match where a stable release goes first.
       new_version="$(curl -s https://tukaani.org/xz/ |
-          pcregrep -o1 '>xz-([0-9.]+)[.]tar[.]bz2</a>' |
+          pcregrep -o1 '>xz-([0-9.]+)[.]tar[.]xz</a>' |
           head -n1)"
       update-source-version ${finalAttrs.pname} "$new_version"
     '';
@@ -65,9 +62,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
-    homepage = "https://tukaani.org/xz/";
+    changelog = "https://github.com/tukaani-project/xz/releases/tag/v${finalAttrs.version}";
     description = "General-purpose data compression software, successor of LZMA";
-
+    homepage = "https://tukaani.org/xz/";
     longDescription =
       '' XZ Utils is free general-purpose data compression software with high
          compression ratio.  XZ Utils were written for POSIX-like systems,
@@ -81,7 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
          create 30 % smaller output than gzip and 15 % smaller output than
          bzip2.
       '';
-
     license = with licenses; [ gpl2Plus lgpl21Plus ];
     maintainers = with maintainers; [ sander ];
     platforms = platforms.all;
diff --git a/pkgs/tools/filesystems/rmfuse/default.nix b/pkgs/tools/filesystems/rmfuse/default.nix
index 04a4d6273878..7ce74671e5df 100644
--- a/pkgs/tools/filesystems/rmfuse/default.nix
+++ b/pkgs/tools/filesystems/rmfuse/default.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/games/steamback/default.nix b/pkgs/tools/games/steamback/default.nix
index e7cc2c06b910..a41b5f3ca7fb 100644
--- a/pkgs/tools/games/steamback/default.nix
+++ b/pkgs/tools/games/steamback/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonApplication
 , fetchPypi
-, pythonRelaxDepsHook
 , setuptools
 , setuptools-scm
 , wheel
@@ -24,7 +23,6 @@ buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
     wheel
   ];
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 46b8122dd5b6..55fce30cd990 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl
 , autoreconfHook, bison, glm, flex, wrapQtAppsHook, cmake, pkg-config
-, freeglut, ghostscriptX, imagemagick, fftw, eigen, libtirpc
-, boehmgc, libGLU, libGL, mesa, ncurses, readline, gsl, libsigsegv
+, libglut, ghostscriptX, imagemagick, fftw, eigen, libtirpc
+, boehmgc, libGLU, libGL, ncurses, readline, gsl, libsigsegv
 , python3, qtbase, qtsvg, boost
 , zlib, perl, curl
 , texinfo
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [
     glm
   ] ++ lib.optionals stdenv.isLinux [
-    freeglut libGLU libGL mesa.osmesa
+    libglut libGLU libGL
   ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     OpenGL GLUT Cocoa
   ]);
diff --git a/pkgs/tools/graphics/enblend-enfuse/default.nix b/pkgs/tools/graphics/enblend-enfuse/default.nix
index d665c884751e..26645cea6a59 100644
--- a/pkgs/tools/graphics/enblend-enfuse/default.nix
+++ b/pkgs/tools/graphics/enblend-enfuse/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchhg
 , autoreconfHook
 , boost
-, freeglut
+, libglut
 , glew
 , gsl
 , lcms2
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0gCUSdg3HR3YeIbOByEBCZh2zGlYur6DeCOzUM53fdc=";
   };
 
-  buildInputs = [ boost freeglut glew gsl lcms2 libpng libtiff libGLU libGL vigra ];
+  buildInputs = [ boost libglut glew gsl lcms2 libpng libtiff libGLU libGL vigra ];
 
   nativeBuildInputs = [ autoreconfHook help2man perl pkg-config texliveSmall ];
 
diff --git a/pkgs/tools/graphics/mesa-demos/default.nix b/pkgs/tools/graphics/mesa-demos/default.nix
index 0bc30c8773fd..3bbc20bc4cad 100644
--- a/pkgs/tools/graphics/mesa-demos/default.nix
+++ b/pkgs/tools/graphics/mesa-demos/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, freeglut
+, libglut
 , libGL
 , libGLU
 , libX11
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    freeglut
+    libglut
     libX11
     libXext
     libGL
@@ -54,14 +54,12 @@ stdenv.mkDerivation rec {
     vulkan-loader
     libxkbcommon
     libdecor
-  ] ++ lib.optional (mesa ? osmesa) mesa.osmesa;
+  ];
 
   mesonFlags = [
-    "-Degl=${if stdenv.isDarwin then "disabled" else "auto"}"
-    "-Dlibdrm=${if mesa.libdrm == null then "disabled" else "enabled"}"
-    "-Dosmesa=${if mesa ? osmesa then "enabled" else "disabled"}"
-    "-Dwayland=${if wayland.withLibraries then "enabled" else "disabled"}"
     "-Dwith-system-data-files=true"
+    "-Dgles1=disabled"
+    "-Dosmesa=disabled"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/nifskope/default.nix b/pkgs/tools/graphics/nifskope/default.nix
index 90cf811e9130..fdc05cbff04d 100644
--- a/pkgs/tools/graphics/nifskope/default.nix
+++ b/pkgs/tools/graphics/nifskope/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     })
   ] ++ (lib.optional stdenv.isAarch64 ./no-sse-on-arm.patch);
 
-  buildInputs = [ qtbase qttools libGLU.dev ];
+  buildInputs = [ qtbase qttools libGLU ];
   nativeBuildInputs = [ qmake wrapQtAppsHook ];
 
   preConfigure = ''
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index 99debde345fe..ac41fd9c94f6 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, mkDerivation, fetchurl, cmake, pkg-config, darwin
-, openexr, zlib, imagemagick6, libGLU, libGL, freeglut, fftwFloat
+, openexr, zlib, imagemagick6, libGLU, libGL, libglut, fftwFloat
 , fftw, gsl, libexif, perl, qtbase, netpbm
 , enableUnfree ? false, opencv2
 }:
@@ -35,7 +35,7 @@ mkDerivation rec {
   ] ++ (if stdenv.isDarwin then (with darwin.apple_sdk.frameworks; [
     OpenGL GLUT
   ]) else [
-    libGLU libGL freeglut
+    libGLU libGL libglut
   ]) ++ lib.optional enableUnfree (opencv2.override { enableUnfree = true; });
 
   patches = [ ./glut.patch ./threads.patch ./pfstools.patch ./pfsalign.patch ];
diff --git a/pkgs/tools/graphics/piglit/default.nix b/pkgs/tools/graphics/piglit/default.nix
index 8cc125e47da9..69e5c44be69a 100644
--- a/pkgs/tools/graphics/piglit/default.nix
+++ b/pkgs/tools/graphics/piglit/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitLab
 , lib
 , cmake
-, freeglut
+, libglut
 , libGL
 , libGLU
 , libglvnd
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    freeglut
+    libglut
     libGL
     libGLU
     libglvnd
diff --git a/pkgs/tools/graphics/twilight/default.nix b/pkgs/tools/graphics/twilight/default.nix
index 52941f7b96d7..790ef79ea09e 100644
--- a/pkgs/tools/graphics/twilight/default.nix
+++ b/pkgs/tools/graphics/twilight/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub
-, libGL, libGLU, freeglut, libX11 }:
+, libGL, libGLU, libglut, libX11 }:
 
 stdenv.mkDerivation rec {
   pname = "twilight";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0mmmi4jj8yd8wnah6kx5na782sjycszgzim33dfalr0ph361m4pz";
   };
 
-  buildInputs = [ libGL libGLU freeglut libX11 ];
+  buildInputs = [ libGL libGLU libglut libX11 ];
 
   installPhase = ''
     install -Dm755 twilight $out/bin/twilight
diff --git a/pkgs/tools/graphics/vulkan-cts/default.nix b/pkgs/tools/graphics/vulkan-cts/default.nix
index d695682175c3..6579b7e160de 100644
--- a/pkgs/tools/graphics/vulkan-cts/default.nix
+++ b/pkgs/tools/graphics/vulkan-cts/default.nix
@@ -118,9 +118,9 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru.updateScript = ./update.sh;
-  passthru.tests.lavapipe = runCommand "vulkan-cts-tests-lavapipe" { nativeBuildInputs = [ finalAttrs.finalPackage ]; } ''
-    # Expand the wildcard to pick the existing architecture
-    export VK_ICD_FILENAMES=$(echo ${mesa.drivers}/share/vulkan/icd.d/lvp_icd.*.json)
+  passthru.tests.lavapipe = runCommand "vulkan-cts-tests-lavapipe" {
+    nativeBuildInputs = [ finalAttrs.finalPackage mesa.llvmpipeHook ];
+  } ''
     deqp-vk -n dEQP-VK.api.smoke.triangle
     touch $out
   '';
diff --git a/pkgs/tools/misc/csvs-to-sqlite/default.nix b/pkgs/tools/misc/csvs-to-sqlite/default.nix
index 28537e9631ea..2ed4af000f56 100644
--- a/pkgs/tools/misc/csvs-to-sqlite/default.nix
+++ b/pkgs/tools/misc/csvs-to-sqlite/default.nix
@@ -27,7 +27,6 @@ with python3.pkgs; buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/misc/cyclonedx-python/default.nix b/pkgs/tools/misc/cyclonedx-python/default.nix
index fa5be39000af..ba6d137fa5b7 100644
--- a/pkgs/tools/misc/cyclonedx-python/default.nix
+++ b/pkgs/tools/misc/cyclonedx-python/default.nix
@@ -36,7 +36,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with py.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with py.pkgs; [
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index fb41ba8b9e1d..d9d05b161dd0 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -33,7 +33,6 @@ python.pkgs.buildPythonApplication rec {
     setuptools
     argcomplete
     installShellFiles
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/tools/misc/expect/0004-enable-cross-compilation.patch b/pkgs/tools/misc/expect/0004-enable-cross-compilation.patch
new file mode 100644
index 000000000000..c09623d292b2
--- /dev/null
+++ b/pkgs/tools/misc/expect/0004-enable-cross-compilation.patch
@@ -0,0 +1,295 @@
+From: Andrew Ruder <andrew.ruder@elecsyscorp.com>
+Subject: [PATCH] enable cross compilation for expect
+
+This patch was created by running ./configure on a modern Linux machine
+and inserting the results into the cross compilation section of
+each AC_MSG_CHECKING that bombed out with an error.
+
+Signed-off-by: Andrew Ruder <andrew.ruder@elecsyscorp.com>
+
+--
+
+The original patch, and description above, is originally from
+https://github.com/buildroot/buildroot/blob/master/package/expect/0001-enable-cross-compilation.patch
+
+This patch has been further modified to not hard-code Linux assumptions.
+
+---
+
+Index: expect-5.45/configure.in
+===================================================================
+--- expect-5.45.orig/configure.in	2013-11-14 07:59:58.732100595 -0600
++++ expect-5.45/configure.in	2013-11-14 07:59:58.732100595 -0600
+@@ -6,10 +6,12 @@
+ AC_INIT([expect],[5.45.4])
+ 
+ TEA_INIT([3.9])
+ 
+ AC_CONFIG_AUX_DIR(tclconfig)
++
++AC_LANG([C])
+ 
+ #--------------------------------------------------------------------
+ # Configure script for package 'Expect'.
+ # TEA compliant.
+ #--------------------------------------------------------------------
+@@ -465,26 +467,20 @@
+ # Some systems only define WNOHANG if _POSIX_SOURCE is defined
+ # The following merely tests that sys/wait.h can be included
+ # and if so that WNOHANG is not defined.  The only place I've
+ # seen this is ISC.
+ AC_MSG_CHECKING([if WNOHANG requires _POSIX_SOURCE])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ #include <sys/wait.h>
+-int
+-main() {
+ #ifndef WNOHANG
+-	return 0;
+-#else
+-	return 1;
++#  error "WNOHANG requires _POSIX_SOURCE to be defined"
+ #endif
+-}],
++]])],
+ 	AC_MSG_RESULT(yes)
+ 	AC_DEFINE(WNOHANG_REQUIRES_POSIX_SOURCE)
+ ,
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ AC_MSG_CHECKING([if any value exists for WNOHANG])
+ rm -rf wnohang
+ AC_TRY_RUN([
+@@ -504,11 +501,12 @@
+ 	rm -f wnohang
+ ,
+ 	AC_MSG_RESULT(no)
+ 	AC_DEFINE(WNOHANG_BACKUP_VALUE, 1)
+ ,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
++	AC_MSG_RESULT(yes)
++	AC_DEFINE(WNOHANG_BACKUP_VALUE, 1)
+ )
+ 
+ #
+ # check how signals work
+ #
+@@ -572,11 +570,11 @@
+ }],
+ 	AC_MSG_RESULT(yes)
+ 	AC_DEFINE(REARM_SIG)
+ ,
+ 	AC_MSG_RESULT(no)
+-, AC_MSG_WARN([Expect can't be cross compiled])
++, AC_MSG_RESULT(no)
+ )
+ 
+ # HPUX7 has trouble with the big cat so split it
+ # Owen Rees <rtor@ansa.co.uk> 29Mar93 
+ SEDDEFS="${SEDDEFS}CONFEOF
+@@ -710,25 +708,19 @@
+     AC_DEFINE(POSIX)
+ fi
+ 
+ # first check for the pure bsd
+ AC_MSG_CHECKING([for struct sgttyb])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ #include <sgtty.h>
+-int
+-main()
+-{
+-  struct sgttyb tmp;
+-  return 0;
+-}],
++static struct sgttyb tmp;
++]])],
+         AC_MSG_RESULT(yes)
+         AC_DEFINE(HAVE_SGTTYB)
+         PTY_TYPE=sgttyb
+ ,
+         AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ # mach systems have include files for unimplemented features
+ # so avoid doing following test on those systems
+ if test $mach -eq 0 ; then
+@@ -735,116 +728,88 @@
+   # next check for the older style ttys
+   # note that if we detect termio.h (only), we still set PTY_TYPE=termios
+   # since that just controls which of pty_XXXX.c file is use and
+   # pty_termios.c is set up to handle pty_termio.
+   AC_MSG_CHECKING([for struct termio])
+-  AC_TRY_RUN([#include <termio.h>
+-  int
+-  main()
+-  {
+-    struct termio tmp;
+-    return 0;
+-  }],
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
++#include <termio.h>
++static struct termio tmp;
++]])],
+         AC_DEFINE(HAVE_TERMIO)
+         PTY_TYPE=termios
+         AC_MSG_RESULT(yes)
+ ,
+         AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+   # now check for the new style ttys (not yet posix)
+   AC_MSG_CHECKING([for struct termios])
+-  AC_TRY_RUN([
+-  /* including termios.h on Solaris 5.6 fails unless inttypes.h included */
+-#  ifdef HAVE_INTTYPES_H
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
++/* including termios.h on Solaris 5.6 fails unless inttypes.h included */
++#ifdef HAVE_INTTYPES_H
+ #  include <inttypes.h>
+-#  endif
+-#  include <termios.h>
+-  int
+-  main()
+-  {
+-    struct termios tmp;
+-    return 0;
+-  }],
++#endif
++#include <termios.h>
++static struct termios tmp;
++]])],
+         AC_DEFINE(HAVE_TERMIOS)
+         PTY_TYPE=termios
+         AC_MSG_RESULT(yes)
+   ,
+         AC_MSG_RESULT(no)
+-  ,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+   )
+ fi
+ 
+ AC_MSG_CHECKING([if TCGETS or TCGETA in termios.h])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ /* including termios.h on Solaris 5.6 fails unless inttypes.h included */
+ #ifdef HAVE_INTTYPES_H
+-#include <inttypes.h>
++#  include <inttypes.h>
+ #endif
+ #include <termios.h>
+-int
+-main() {
+-#if defined(TCGETS) || defined(TCGETA)
+-	return 0;
+-#else
+-	return 1;
++#
++#if !(defined(TCGETS) || defined(TCGETA))
++#  error "missing both of TCGETS and TCGETA"
+ #endif
+-}],
++]])],
+ 	AC_DEFINE(HAVE_TCGETS_OR_TCGETA_IN_TERMIOS_H)
+ 	AC_MSG_RESULT(yes)
+ ,
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ AC_MSG_CHECKING([if TIOCGWINSZ in termios.h])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ /* including termios.h on Solaris 5.6 fails unless inttypes.h included */
+ #ifdef HAVE_INTTYPES_H
+-#include <inttypes.h>
++#  include <inttypes.h>
+ #endif
+ #include <termios.h>
+-int
+-main() {
+-#ifdef TIOCGWINSZ
+-	return 0;
+-#else
+-	return 1;
++
++#ifndef TIOCGWINSZ
++#  error "missing TIOCGWINSZ"
+ #endif
+-}],
++]])],
+ 	AC_DEFINE(HAVE_TIOCGWINSZ_IN_TERMIOS_H)
+ 	AC_MSG_RESULT(yes)
+ ,
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ # finally check for Cray style ttys
+ AC_MSG_CHECKING([for Cray-style ptys])
+ SETUID=":"
+-AC_TRY_RUN([
+-int
+-main(){
+-#ifdef CRAY
+-	return 0;
+-#else
+-	return 1;
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
++#ifndef CRAY
++#  error "CRAY is not defined"
+ #endif
+-}
+-],
++]])],
+ 	PTY_TYPE=unicos
+ 	SETUID="chmod u+s"
+ 	AC_MSG_RESULT(yes)
+ ,
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ #
+ # Check for select and/or poll. If both exist, we prefer select.
+ # if neither exists, define SIMPLE_EVENT.
+@@ -873,26 +842,24 @@
+ 
+ #
+ # check for timezones
+ #
+ AC_MSG_CHECKING([for SV-style timezone])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ extern char *tzname[2];
+ extern int daylight;
+ int
+ main()
+ {
+   int *x = &daylight;
+   char **y = tzname;
+ 
+   return 0;
+-}],
++}]])],
+ 	AC_DEFINE(HAVE_SV_TIMEZONE)
+ 	AC_MSG_RESULT(yes),
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ 
+ # Following comment stolen from Tcl's configure.in:
+ #   Note:  in the following variable, it's important to use the absolute
+
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 543400380162..102120a8604e 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -10,12 +10,8 @@ tcl.mkTclDerivation rec {
   };
 
   patches = [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/buildroot/buildroot/c05e6aa361a4049eabd8b21eb64a34899ef83fc7/package/expect/0001-enable-cross-compilation.patch";
-      hash = "sha256-yyzE0Jjac5qaj7Svn4VpMiAqSNLYrw7VZbtFqgMVncs=";
-    })
     (substituteAll {
-      src = ./fix-cross-compilation.patch;
+      src = ./fix-build-time-run-tcl.patch;
       tcl = "${buildPackages.tcl}/bin/tclsh";
     })
     # The following patches fix compilation with clang 15+
@@ -27,8 +23,12 @@ tcl.mkTclDerivation rec {
       url = "https://sourceforge.net/p/expect/patches/_discuss/thread/b813ca9895/6759/attachment/expect-configure-c99.patch";
       hash = "sha256-PxQQ9roWgVXUoCMxkXEgu+it26ES/JuzHF6oML/nk54=";
     })
+    ./0004-enable-cross-compilation.patch
     # Include `sys/ioctl.h` and `util.h` on Darwin, which are required for `ioctl` and `openpty`.
-    ./fix-darwin-clang16.patch
+    # Include `termios.h` on FreeBSD for `openpty`
+    ./fix-darwin-bsd-clang16.patch
+    # Remove some code which causes it to link against a file that does not exist at build time on native FreeBSD
+    ./freebsd-unversioned.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/expect/fix-cross-compilation.patch b/pkgs/tools/misc/expect/fix-build-time-run-tcl.patch
index 8edc4bea39d6..8edc4bea39d6 100644
--- a/pkgs/tools/misc/expect/fix-cross-compilation.patch
+++ b/pkgs/tools/misc/expect/fix-build-time-run-tcl.patch
diff --git a/pkgs/tools/misc/expect/fix-darwin-clang16.patch b/pkgs/tools/misc/expect/fix-darwin-bsd-clang16.patch
index 9454769c99c8..a0e11a5f9d6b 100644
--- a/pkgs/tools/misc/expect/fix-darwin-clang16.patch
+++ b/pkgs/tools/misc/expect/fix-darwin-bsd-clang16.patch
@@ -14,16 +14,21 @@ diff -ur a/exp_win.c b/exp_win.c
 diff -ur d/pty_termios.c c/pty_termios.c
 --- d/pty_termios.c	2023-10-10 07:59:23.244452442 -0400
 +++ c/pty_termios.c	2023-10-10 08:00:35.303231582 -0400
-@@ -7,7 +7,13 @@
+@@ -7,7 +7,18 @@
  
  */
  
 -#include <pty.h> /* openpty */
 +/* openpty */
-+#ifdef __APPLE__
-+#include <util.h>
++#if defined(__APPLE__)
++#  include <util.h>
++#elif defined(__FreeBSD__)
++#  include <sys/types.h>
++#  include <sys/ioctl.h>
++#  include <termios.h>
++#  include <libutil.h>
 +#else /* pty.h is Linux-specific */
-+#include <pty.h>
++#  include <pty.h>
 +#endif
 +
  #include <stdio.h>
diff --git a/pkgs/tools/misc/expect/freebsd-unversioned.patch b/pkgs/tools/misc/expect/freebsd-unversioned.patch
new file mode 100644
index 000000000000..345fa4f6277f
--- /dev/null
+++ b/pkgs/tools/misc/expect/freebsd-unversioned.patch
@@ -0,0 +1,14 @@
+--- expect5.45.4/tclconfig/tcl.m4.orig	2024-05-29 11:24:56.150656190 -0700
++++ expect5.45.4/tclconfig/tcl.m4	2024-05-29 11:25:22.850790934 -0700
+@@ -1643,11 +1643,6 @@
+ 		LIBS=`echo $LIBS | sed s/-pthread//`
+ 		CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+ 		LDFLAGS="$LDFLAGS $PTHREAD_LIBS"])
+-	    # Version numbers are dot-stripped by system policy.
+-	    TCL_TRIM_DOTS=`echo ${VERSION} | tr -d .`
+-	    UNSHARED_LIB_SUFFIX='${TCL_TRIM_DOTS}.a'
+-	    SHARED_LIB_SUFFIX='${TCL_TRIM_DOTS}\$\{DBGX\}.so.1'
+-	    TCL_LIB_VERSIONS_OK=nodots
+ 	    ;;
+ 	Darwin-*)
+ 	    CFLAGS_OPTIMIZE="-Os"
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index cfa4105cda0d..0caa589c6013 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "findutils";
-  version = "4.9.0";
+  version = "4.10.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/${pname}-${version}.tar.xz";
-    sha256 = "sha256-or+4wJ1DZ3DtxZ9Q+kg+eFsWGjt7nVR1c8sIBl/UYv4=";
+    sha256 = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index aed9b33584b6..fe626a417ab3 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -29,6 +29,9 @@ stdenv.mkDerivation rec {
       url = "https://github.com/fontforge/fontforge/commit/216eb14b558df344b206bf82e2bdaf03a1f2f429.patch";
       hash = "sha256-aRnir09FSQMT50keoB7z6AyhWAVBxjSQsTRvBzeBuHU=";
     })
+
+    # https://github.com/fontforge/fontforge/pull/5423
+    ./replace-distutils.patch
   ];
 
   # use $SOURCE_DATE_EPOCH instead of non-deterministic timestamps
diff --git a/pkgs/tools/misc/fontforge/replace-distutils.patch b/pkgs/tools/misc/fontforge/replace-distutils.patch
new file mode 100644
index 000000000000..99087c649021
--- /dev/null
+++ b/pkgs/tools/misc/fontforge/replace-distutils.patch
@@ -0,0 +1,13 @@
+diff --git a/pyhook/CMakeLists.txt b/pyhook/CMakeLists.txt
+index dd48054aa..710728f26 100644
+--- a/pyhook/CMakeLists.txt
++++ b/pyhook/CMakeLists.txt
+@@ -21,7 +21,7 @@ target_link_libraries(psMat_pyhook PRIVATE Python3::Module)
+ # So do it ourselves, getting the prefix-relative path instead
+ if(NOT DEFINED PYHOOK_INSTALL_DIR)
+   execute_process(
+-    COMMAND "${Python3_EXECUTABLE}" -c "import distutils.sysconfig as sc; print(sc.get_python_lib(prefix='', plat_specific=True,standard_lib=False))"
++    COMMAND "${Python3_EXECUTABLE}" -c "import sysconfig; print(sysconfig.get_path('platlib', sysconfig.get_preferred_scheme('user'), vars={'userbase': '.'}))"
+     RESULT_VARIABLE _pyhook_install_dir_result
+     OUTPUT_VARIABLE PYHOOK_INSTALL_DIR
+     OUTPUT_STRIP_TRAILING_WHITESPACE)
diff --git a/pkgs/tools/misc/hdaps-gl/default.nix b/pkgs/tools/misc/hdaps-gl/default.nix
index eb8259929e82..d472727ce3ac 100644
--- a/pkgs/tools/misc/hdaps-gl/default.nix
+++ b/pkgs/tools/misc/hdaps-gl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, freeglut, libGL, libGLU }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, libglut, libGL, libGLU }:
 
 stdenv.mkDerivation rec {
   pname = "hdaps-gl";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ freeglut libGL libGLU ];
+  buildInputs = [ libglut libGL libGLU ];
 
   meta = with lib; {
     description = "GL-based laptop model that rotates in real-time via hdaps";
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index bbea88413c77..226143c44be6 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitHub
 , cmake
 , removeReferencesTo
 , cppSupport ? true
@@ -28,21 +28,18 @@ assert !cppSupport || !mpiSupport;
 let inherit (lib) optional optionals; in
 
 stdenv.mkDerivation rec {
-  version = "1.14.3";
+  version = "1.14.4.3";
   pname = "hdf5"
     + lib.optionalString cppSupport "-cpp"
     + lib.optionalString fortranSupport "-fortran"
     + lib.optionalString mpiSupport "-mpi"
     + lib.optionalString threadsafe "-threadsafe";
 
-  src = fetchurl {
-    url =
-      let
-        majorMinor = lib.versions.majorMinor version;
-        majorMinorPatch = with lib.versions; "${major version}.${minor version}.${patch version}";
-      in
-      "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-${majorMinor}/hdf5-${majorMinorPatch}/src/hdf5-${version}.tar.bz2";
-    sha256 = "sha256-lCXyJO110SgLtG1vJpI92Tj5BA5+rr9X5m7HNXwI+Rc=";
+  src = fetchFromGitHub {
+    owner = "HDFGroup";
+    repo = "hdf5";
+    rev = "hdf5_${version}";
+    hash = "sha256-lvz3x04SS0oZmUn/BIxQEHnugaDOws46kfT3NAw7Hos=";
   };
 
   passthru = {
@@ -83,6 +80,9 @@ stdenv.mkDerivation rec {
     ++ lib.optional javaSupport "-DHDF5_BUILD_JAVA=ON"
     ++ lib.optional usev110Api "-DDEFAULT_API_VERSION=v110"
     ++ lib.optionals threadsafe [ "-DDHDF5_ENABLE_THREADSAFE:BOOL=ON" "-DHDF5_BUILD_HL_LIB=OFF" ]
+    # broken in nixpkgs since around 1.14.3 -> 1.14.4.3
+    # https://github.com/HDFGroup/hdf5/issues/4208#issuecomment-2098698567
+    ++ lib.optional (stdenv.isDarwin && stdenv.isx86_64) "-DHDF5_ENABLE_NONSTANDARD_FEATURE_FLOAT16=OFF"
   ;
 
   postInstall = ''
diff --git a/pkgs/tools/misc/nanoemoji/default.nix b/pkgs/tools/misc/nanoemoji/default.nix
index 210eb5d6f8a2..88b1cad12234 100644
--- a/pkgs/tools/misc/nanoemoji/default.nix
+++ b/pkgs/tools/misc/nanoemoji/default.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
-    pythonRelaxDepsHook
 
     pngquant
     resvg
diff --git a/pkgs/tools/misc/parquet-tools/default.nix b/pkgs/tools/misc/parquet-tools/default.nix
index 2e0d5744659a..4775be223afa 100644
--- a/pkgs/tools/misc/parquet-tools/default.nix
+++ b/pkgs/tools/misc/parquet-tools/default.nix
@@ -39,7 +39,6 @@ buildPythonApplication rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/misc/piston-cli/default.nix b/pkgs/tools/misc/piston-cli/default.nix
index 44ec8eabc149..68519f2eb643 100644
--- a/pkgs/tools/misc/piston-cli/default.nix
+++ b/pkgs/tools/misc/piston-cli/default.nix
@@ -18,7 +18,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/misc/pricehist/default.nix b/pkgs/tools/misc/pricehist/default.nix
index fc6c5753b767..6930867cc446 100644
--- a/pkgs/tools/misc/pricehist/default.nix
+++ b/pkgs/tools/misc/pricehist/default.nix
@@ -9,7 +9,6 @@
 , pytest-mock
 , responses
 , pytestCheckHook
-, pythonRelaxDepsHook
 }:
 
 buildPythonApplication rec {
@@ -33,7 +32,6 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/tools/misc/sqlite3-to-mysql/default.nix b/pkgs/tools/misc/sqlite3-to-mysql/default.nix
index 75d554ca4ecb..f2bc903d3d58 100644
--- a/pkgs/tools/misc/sqlite3-to-mysql/default.nix
+++ b/pkgs/tools/misc/sqlite3-to-mysql/default.nix
@@ -23,7 +23,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index 907ca3432aea..c94f94f55f2e 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -32,6 +32,9 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-JCdGmZk2vRn3X1BDxOJaY3Aw8dr0ODVzi0oY20ZWfRs=";
       excludes = [ "NEWS" ];
     })
+
+    # switch to pep517 build tools
+    ./pep517.patch
   ];
 
   buildInputs = [
@@ -44,7 +47,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config gettext libtool autoconf-archive
     xmlto libxml2 docbook_xml_dtd_412 docbook_xsl desktop-file-utils
-    python3Packages.wrapPython
+    python3Packages.wrapPython python3Packages.build python3Packages.installer
+    python3Packages.setuptools python3Packages.wheel
     wrapGAppsHook3 autoreconfHook gobject-introspection
   ];
 
diff --git a/pkgs/tools/misc/system-config-printer/pep517.patch b/pkgs/tools/misc/system-config-printer/pep517.patch
new file mode 100644
index 000000000000..1b02a548564f
--- /dev/null
+++ b/pkgs/tools/misc/system-config-printer/pep517.patch
@@ -0,0 +1,16 @@
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -59,11 +59,11 @@ dbus/org.fedoraproject.Config.Printing.service: dbus/org.fedoraproject.Config.Pr
+ 
+ # Use distutils to build the module.
+ all-local: .stamp-distutils-in-builddir config.py cupshelpers/config.py
+-	$(PYTHON) setup.py build
++	$(PYTHON) -m build --no-isolation --outdir dist/ --wheel
+ 
+ # Use distutils to install the module.
+ install-exec-local: .stamp-distutils-in-builddir
+-	$(PYTHON) setup.py install --prefix=$(DESTDIR)$(prefix)
++	$(PYTHON) -m installer --prefix=$(prefix) dist/*.whl
+ 
+ # Uninstall the module, crossing our fingers that we know enough
+ # about how distutils works to do this.  Unfortunately, distutils
diff --git a/pkgs/tools/misc/xvfb-run/default.nix b/pkgs/tools/misc/xvfb-run/default.nix
index 038cae8f39e6..f168c2826898 100644
--- a/pkgs/tools/misc/xvfb-run/default.nix
+++ b/pkgs/tools/misc/xvfb-run/default.nix
@@ -2,7 +2,7 @@
 , stdenvNoCC
 , fetchFromGitHub
 , makeWrapper
-, xorgserver
+, xorg
 , getopt
 , xauth
 , util-linux
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation rec {
     patchShebangs $out/bin/xvfb-run
     wrapProgram $out/bin/xvfb-run \
       --set-default FONTCONFIG_FILE "${fontsConf}" \
-      --prefix PATH : ${lib.makeBinPath [ getopt xorgserver xauth which util-linux gawk coreutils ]}
+      --prefix PATH : ${lib.makeBinPath [ getopt xorg.xvfb xauth which util-linux gawk coreutils ]}
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/tools/misc/yubikey-manager/default.nix b/pkgs/tools/misc/yubikey-manager/default.nix
index c7476b635ed7..6243a2e4668c 100644
--- a/pkgs/tools/misc/yubikey-manager/default.nix
+++ b/pkgs/tools/misc/yubikey-manager/default.nix
@@ -25,7 +25,6 @@ python3Packages.buildPythonPackage rec {
 
   nativeBuildInputs = with python3Packages; [
     poetry-core
-    pythonRelaxDepsHook
     installShellFiles
   ];
 
diff --git a/pkgs/tools/networking/burpsuite/default.nix b/pkgs/tools/networking/burpsuite/default.nix
index 8f22d042b8d8..b50f61ebc304 100644
--- a/pkgs/tools/networking/burpsuite/default.nix
+++ b/pkgs/tools/networking/burpsuite/default.nix
@@ -62,7 +62,6 @@ buildFHSEnv {
     libdrm
     libudev0-shim
     libxkbcommon
-    mesa.drivers
     nspr
     nss
     pango
diff --git a/pkgs/tools/networking/cloud-custodian/default.nix b/pkgs/tools/networking/cloud-custodian/default.nix
index 587774ec53fa..42ba013670b8 100644
--- a/pkgs/tools/networking/cloud-custodian/default.nix
+++ b/pkgs/tools/networking/cloud-custodian/default.nix
@@ -25,7 +25,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     argcomplete
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index 16bca4c2197d..9ddc2164b456 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -15,12 +15,13 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "offlineimap";
   version = "8.0.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "OfflineIMAP";
     repo = "offlineimap3";
     rev = "v${version}";
-    sha256 = "0y3giaz9i8vvczlxkbwymfkn3vi9fv599dy4pc2pn2afxsl4mg2w";
+    hash = "sha256-XLxKqO5OCXsFu8S3lMp2Ke5hp6uer9npZ3ujmL6Kb3g=";
   };
 
   patches = [
@@ -29,8 +30,30 @@ python3.pkgs.buildPythonApplication rec {
       url = "https://github.com/OfflineIMAP/offlineimap3/pull/139/commits/7cd32cf834b34a3d4675b29bebcd32dc1e5ef128.patch";
       hash = "sha256-xNq4jFHMf9XZaa9BFF1lOzZrEGa5BEU8Dr+gMOBkJE4=";
     })
+    (fetchpatch {
+      # https://github.com/OfflineIMAP/offlineimap3/pull/120
+      name = "python312-comaptibility.patch";
+      url = "https://github.com/OfflineIMAP/offlineimap3/commit/a1951559299b297492b8454850fcfe6eb9822a38.patch";
+      hash = "sha256-CBGMHi+ZzOBJt3TxBf6elrTRMIQ+8wr3JgptL2etkoA=";
+     })
+    (fetchpatch {
+      # https://github.com/OfflineIMAP/offlineimap3/pull/161
+      name = "python312-compatibility.patch";
+      url = "https://github.com/OfflineIMAP/offlineimap3/commit/3dd8ebc931e3f3716a90072bd34e50ac1df629fa.patch";
+      hash = "sha256-2IJ0yzESt+zk+r+Z+9js3oKhFF0+xok0xK8Jd3G/gYY=";
+     })
   ];
 
+  postPatch = ''
+    # Skip xmllint to stop failures due to no network access
+    sed -i docs/Makefile -e "s|a2x -v -d |a2x -L -v -d |"
+
+    # Provide CA certificates (Used when "sslcacertfile = OS-DEFAULT" is configured")
+    sed -i offlineimap/utils/distro_utils.py -e '/def get_os_sslcertfile():/a\ \ \ \ return "${cacert}/etc/ssl/certs/ca-bundle.crt"'
+  '';
+
+  build-system = [ python3.pkgs.setuptools ];
+
   nativeBuildInputs = [
     asciidoc
     docbook_xsl
@@ -39,7 +62,7 @@ python3.pkgs.buildPythonApplication rec {
     libxslt
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     certifi
     distro
     imaplib2
@@ -48,14 +71,6 @@ python3.pkgs.buildPythonApplication rec {
     urllib3
   ];
 
-  postPatch = ''
-    # Skip xmllint to stop failures due to no network access
-    sed -i docs/Makefile -e "s|a2x -v -d |a2x -L -v -d |"
-
-    # Provide CA certificates (Used when "sslcacertfile = OS-DEFAULT" is configured")
-    sed -i offlineimap/utils/distro_utils.py -e '/def get_os_sslcertfile():/a\ \ \ \ return "${cacert}/etc/ssl/certs/ca-bundle.crt"'
-  '';
-
   postInstall = ''
     make -C docs man
     installManPage docs/offlineimap.1
diff --git a/pkgs/tools/package-management/poetry/unwrapped.nix b/pkgs/tools/package-management/poetry/unwrapped.nix
index 3c27faaaf3a2..71f1653dbdee 100644
--- a/pkgs/tools/package-management/poetry/unwrapped.nix
+++ b/pkgs/tools/package-management/poetry/unwrapped.nix
@@ -54,6 +54,11 @@ buildPythonPackage rec {
     installShellFiles
   ];
 
+  pythonRelaxDeps = [
+    "dulwich"
+    "keyring"
+  ];
+
   propagatedBuildInputs = [
     build
     cachecontrol
diff --git a/pkgs/tools/security/amoco/default.nix b/pkgs/tools/security/amoco/default.nix
index c78cc8a60576..d3c687bcc8ee 100644
--- a/pkgs/tools/security/amoco/default.nix
+++ b/pkgs/tools/security/amoco/default.nix
@@ -16,7 +16,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index a1c9f9484981..d835d416c8b2 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -25,7 +25,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 689719237ed2..304b10ca8abb 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -23,6 +23,11 @@ python3.pkgs.buildPythonApplication rec {
 
   patches = lib.optionals withDriver [ ./ko-path.diff ./compile-ko.diff ];
 
+  postPatch = ''
+    substituteInPlace tests/software/util.py \
+      --replace-fail "assertRegexpMatches" "assertRegex"
+  '';
+
   KSRC = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/coercer/default.nix b/pkgs/tools/security/coercer/default.nix
index e0d921e62e2d..c2e8ee3dfe21 100644
--- a/pkgs/tools/security/coercer/default.nix
+++ b/pkgs/tools/security/coercer/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/security/crackmapexec/default.nix b/pkgs/tools/security/crackmapexec/default.nix
index 7db3c804f911..0a72fdff89aa 100644
--- a/pkgs/tools/security/crackmapexec/default.nix
+++ b/pkgs/tools/security/crackmapexec/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/crackql/default.nix b/pkgs/tools/security/crackql/default.nix
index cb3ecc1cb0a7..121ed522afae 100644
--- a/pkgs/tools/security/crackql/default.nix
+++ b/pkgs/tools/security/crackql/default.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index 7ef13bce4307..20582a6d5c6b 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -18,7 +18,6 @@ let
 
   # used of both wrappers and libpath
   libPath = lib.makeLibraryPath (with xorg; [
-    mesa.drivers
     libGLU libGL
     fontconfig
     freetype
diff --git a/pkgs/tools/security/expliot/default.nix b/pkgs/tools/security/expliot/default.nix
index 88fd1cf84b61..9a23087aa10d 100644
--- a/pkgs/tools/security/expliot/default.nix
+++ b/pkgs/tools/security/expliot/default.nix
@@ -40,7 +40,6 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/security/faraday-agent-dispatcher/default.nix b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
index ad451c076d0d..be6b1d9a72fc 100644
--- a/pkgs/tools/security/faraday-agent-dispatcher/default.nix
+++ b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
@@ -29,7 +29,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/tools/security/gallia/default.nix b/pkgs/tools/security/gallia/default.nix
index be66306c331b..2f8c6da988c0 100644
--- a/pkgs/tools/security/gallia/default.nix
+++ b/pkgs/tools/security/gallia/default.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     aiofiles
diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/tools/security/ggshield/default.nix
index 22e3921be7bc..1b874921cce7 100644
--- a/pkgs/tools/security/ggshield/default.nix
+++ b/pkgs/tools/security/ggshield/default.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     appdirs
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 59e7bcc13d66..475545526d37 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     "--with-libgcrypt-prefix=${libgcrypt.dev}"
     "--with-libassuan-prefix=${libassuan.dev}"
     "--with-ksba-prefix=${libksba.dev}"
-    "--with-npth-prefix=${npth}"
+    "GPGRT_CONFIG=${lib.getDev libgpg-error}/bin/gpgrt-config"
   ]
   ++ lib.optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentry.binaryPath or "bin/pinentry"}"
   ++ lib.optional stdenv.isDarwin "--disable-ccid-driver";
diff --git a/pkgs/tools/security/ioccheck/default.nix b/pkgs/tools/security/ioccheck/default.nix
index 3f899c33b557..2637fea90528 100644
--- a/pkgs/tools/security/ioccheck/default.nix
+++ b/pkgs/tools/security/ioccheck/default.nix
@@ -46,7 +46,6 @@ in py.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with py.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/security/knockpy/default.nix b/pkgs/tools/security/knockpy/default.nix
index 3f503ec6c44a..57b653035725 100644
--- a/pkgs/tools/security/knockpy/default.nix
+++ b/pkgs/tools/security/knockpy/default.nix
@@ -24,9 +24,9 @@ python3.pkgs.buildPythonApplication rec {
     "tqdm"
   ];
 
-  build-system = with python3.pkgs; [ setuptools ];
-
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
+  build-system = with python3.pkgs; [
+    setuptools
+  ];
 
   dependencies = with python3.pkgs; [
     beautifulsoup4
diff --git a/pkgs/tools/security/knowsmore/default.nix b/pkgs/tools/security/knowsmore/default.nix
index 4c460eabcbe5..c3df59cf141f 100644
--- a/pkgs/tools/security/knowsmore/default.nix
+++ b/pkgs/tools/security/knowsmore/default.nix
@@ -25,7 +25,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     aioconsole
diff --git a/pkgs/tools/security/ldeep/default.nix b/pkgs/tools/security/ldeep/default.nix
index 098b811eb3f8..5bb73911f0f9 100644
--- a/pkgs/tools/security/ldeep/default.nix
+++ b/pkgs/tools/security/ldeep/default.nix
@@ -25,7 +25,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     cython
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/tools/security/maigret/default.nix b/pkgs/tools/security/maigret/default.nix
index f2d706bfe510..cdbf6df4dd0f 100644
--- a/pkgs/tools/security/maigret/default.nix
+++ b/pkgs/tools/security/maigret/default.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
-  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
     aiodns
diff --git a/pkgs/tools/security/mitmproxy2swagger/default.nix b/pkgs/tools/security/mitmproxy2swagger/default.nix
index 0c940692f9e8..6731d7c21c53 100644
--- a/pkgs/tools/security/mitmproxy2swagger/default.nix
+++ b/pkgs/tools/security/mitmproxy2swagger/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/security/netexec/default.nix b/pkgs/tools/security/netexec/default.nix
index 625cd3974252..3ac0eebda954 100644
--- a/pkgs/tools/security/netexec/default.nix
+++ b/pkgs/tools/security/netexec/default.nix
@@ -48,7 +48,6 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python.pkgs; [
diff --git a/pkgs/tools/security/ospd-openvas/default.nix b/pkgs/tools/security/ospd-openvas/default.nix
index f047958c2492..5d7b517ec286 100644
--- a/pkgs/tools/security/ospd-openvas/default.nix
+++ b/pkgs/tools/security/ospd-openvas/default.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
     defusedxml
diff --git a/pkgs/tools/security/quark-engine/default.nix b/pkgs/tools/security/quark-engine/default.nix
index c01704d0add6..b2325c0a9a69 100644
--- a/pkgs/tools/security/quark-engine/default.nix
+++ b/pkgs/tools/security/quark-engine/default.nix
@@ -19,7 +19,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     androguard
diff --git a/pkgs/tools/security/semgrep/default.nix b/pkgs/tools/security/semgrep/default.nix
index 13307d310102..5baf13c2b833 100644
--- a/pkgs/tools/security/semgrep/default.nix
+++ b/pkgs/tools/security/semgrep/default.nix
@@ -3,7 +3,6 @@
 , semgrep-core
 , buildPythonApplication
 , pythonPackages
-, pythonRelaxDepsHook
 
 , pytestCheckHook
 , git
@@ -42,7 +41,6 @@ buildPythonApplication rec {
     cd cli
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   # tell cli/setup.py to not copy semgrep-core into the result
   # this means we can share a copy of semgrep-core and avoid an issue where it
   # copies the binary but doesn't retain the executable bit
diff --git a/pkgs/tools/security/tell-me-your-secrets/default.nix b/pkgs/tools/security/tell-me-your-secrets/default.nix
index 1d723aae52df..30bd9d48fd23 100644
--- a/pkgs/tools/security/tell-me-your-secrets/default.nix
+++ b/pkgs/tools/security/tell-me-your-secrets/default.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/trueseeing/default.nix b/pkgs/tools/security/trueseeing/default.nix
index e5d89ab3ac0c..c80abb6c3164 100644
--- a/pkgs/tools/security/trueseeing/default.nix
+++ b/pkgs/tools/security/trueseeing/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/tools/security/wapiti/default.nix b/pkgs/tools/security/wapiti/default.nix
index 1ddfbb703b96..77be8d9d5358 100644
--- a/pkgs/tools/security/wapiti/default.nix
+++ b/pkgs/tools/security/wapiti/default.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies =
     with python3.pkgs;
diff --git a/pkgs/tools/security/yaralyzer/default.nix b/pkgs/tools/security/yaralyzer/default.nix
index 47b5576e7bec..9854a696ac99 100644
--- a/pkgs/tools/security/yaralyzer/default.nix
+++ b/pkgs/tools/security/yaralyzer/default.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/tools/system/nvitop/default.nix b/pkgs/tools/system/nvitop/default.nix
index 1c7ed6083daf..a89f5d04d65b 100644
--- a/pkgs/tools/system/nvitop/default.nix
+++ b/pkgs/tools/system/nvitop/default.nix
@@ -16,7 +16,6 @@ python3Packages.buildPythonApplication rec {
 
   pythonRelaxDeps = [ "nvidia-ml-py" ];
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3Packages; [
     cachetools
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 5290455390c3..e556d8e7bdb6 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, zlib, kmod, which
+{ lib, stdenv, fetchFromGitHub, pkg-config, zlib, kmod, which
 , hwdata
 , static ? stdenv.hostPlatform.isStatic
 , IOKit
@@ -7,11 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pciutils";
-  version = "3.12.0"; # with release-date database
+  version = "3.13.0"; # with release-date database
 
-  src = fetchurl {
-    url = "mirror://kernel/software/utils/pciutils/pciutils-${version}.tar.xz";
-    hash = "sha256-8YXRFtX/mbeXSX786PGfHujMxaZouXoVnj0TRy9nQVQ=";
+  src = fetchFromGitHub {
+    owner = "pciutils";
+    repo = "pciutils";
+    rev = "v${version}";
+    hash = "sha256-buhq7SN6eH+sckvT5mJ8eP4C1EP/4CUFt3gooJohJW0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -23,6 +25,8 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace 'CC=$(CROSS_COMPILE)gcc' ""
   '';
 
+  enableParallelBuilding = true;
+
   makeFlags = [
     "SHARED=${if static then "no" else "yes"}"
     "PREFIX=\${out}"
diff --git a/pkgs/tools/text/frogmouth/default.nix b/pkgs/tools/text/frogmouth/default.nix
index b2551b6387d6..8a93e86be66c 100644
--- a/pkgs/tools/text/frogmouth/default.nix
+++ b/pkgs/tools/text/frogmouth/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3.pkgs.poetry-core
-    python3.pkgs.pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/typesetting/tex/dblatex/default.nix b/pkgs/tools/typesetting/tex/dblatex/default.nix
index 4574b44f8448..39069029e57c 100644
--- a/pkgs/tools/typesetting/tex/dblatex/default.nix
+++ b/pkgs/tools/typesetting/tex/dblatex/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python3, libxslt, texliveBasic
+{ lib, stdenv, fetchurl, python311, libxslt, texliveBasic
 , enableAllFeatures ? false, imagemagick, fig2dev, inkscape, fontconfig, ghostscript
 
 , tex ? texliveBasic.withPackages (ps: with ps; [ # satisfy all packages that ./configure mentions
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     sha256 = "0yd09nypswy3q4scri1dg7dr99d7gd6r2dwx0xm81l9f4y32gs0n";
   };
 
-  buildInputs = [ python3 libxslt tex ]
+  buildInputs = [ python311 libxslt tex ]
     ++ lib.optionals enableAllFeatures [ imagemagick fig2dev ];
 
   # TODO: dblatex tries to execute texindy command, but nixpkgs doesn't have
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   dontBuild = true;
 
   installPhase = ''
-    ${python3.interpreter} ./setup.py install --prefix="$out" --use-python-path --verbose
+    ${python311.interpreter} ./setup.py install --prefix="$out" --use-python-path --verbose
   '';
 
   passthru = { inherit tex; };
diff --git a/pkgs/tools/typesetting/tex/nix/default.nix b/pkgs/tools/typesetting/tex/nix/default.nix
index e9017333c943..feb444b98ff4 100644
--- a/pkgs/tools/typesetting/tex/nix/default.nix
+++ b/pkgs/tools/typesetting/tex/nix/default.nix
@@ -243,7 +243,7 @@ rec {
   # fonts.
   fontsConf = pkgs.makeFontsConf {
     fontDirectories = [
-      "${pkgs.ghostscript}/share/ghostscript/fonts"
+      "${pkgs.ghostscript.fonts}/share/fonts"
     ];
   };
 
diff --git a/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix b/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
index e289f9171c15..1356fc325047 100644
--- a/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
+++ b/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
@@ -233,7 +233,7 @@ let
     # if the container is missing (that is, outputs == [ ]), create a file, to prevent passing the package to .withPackages
     ''
       for outputName in ''${!outputs[@]} ; do
-        if [[ -z ''${outputDrvs[$outputName]} ]] ; then
+        if [[ -n ''${outputDrvs[$outputName]} ]] ; then
           ln -s "''${outputDrvs[$outputName]}" "''${outputs[$outputName]}"
         else
           touch "''${outputs[$outputName]}"
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index d53c974a18d4..04dda18e6b78 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -11,7 +11,9 @@ let
   localPython = python3.override {
     self = localPython;
     packageOverrides = self: super: {
-      cement = changeVersion super.cement.overridePythonAttrs "2.8.2" "sha256-h2XtBSwGHXTk0Bia3cM9Jo3lRMohmyWdeXdB9yXkItI=";
+      cement =
+        changeVersion super.cement.overridePythonAttrs "2.10.14"
+          "sha256-NC4n21SmYW3RiS7QuzWXoifO4z3C2FVgQm3xf8qQcFg=";
     };
   };
 
@@ -35,7 +37,6 @@ localPython.pkgs.buildPythonApplication rec {
   '';
 
   nativeBuildInputs = with localPython.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 58db991f9729..2498822c47fd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1361,7 +1361,7 @@ with pkgs;
 
   fixDarwinDylibNames = makeSetupHook {
     name = "fix-darwin-dylib-names-hook";
-    substitutions = { inherit (binutils) targetPrefix; };
+    substitutions = { inherit (darwin.binutils) targetPrefix; };
     meta.platforms = lib.platforms.darwin;
   } ../build-support/setup-hooks/fix-darwin-dylib-names.sh;
 
@@ -1530,6 +1530,7 @@ with pkgs;
     admin-fe = callPackage ../servers/akkoma/admin-fe {
       nodejs = nodejs_18;
       yarn = yarn.override { nodejs = nodejs_18; };
+      python3 = python311;
     };
   };
   akkoma-emoji = recurseIntoAttrs {
@@ -2843,7 +2844,7 @@ with pkgs;
   x16-run = x16.run;
 
   yabause = libsForQt5.callPackage ../applications/emulators/yabause {
-    freeglut = null;
+    libglut = null;
     openal = null;
   };
 
@@ -7770,8 +7771,6 @@ with pkgs;
 
   expliot = callPackage ../tools/security/expliot { };
 
-  f2fs-tools = callPackage ../tools/filesystems/f2fs-tools { };
-
   Fabric = with python3Packages; toPythonApplication fabric;
 
   fail2ban = callPackage ../tools/security/fail2ban { };
@@ -8003,9 +8002,7 @@ with pkgs;
 
   fortune = callPackage ../tools/misc/fortune { };
 
-  fox = callPackage ../development/libraries/fox {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  fox = callPackage ../development/libraries/fox {};
 
   fox_1_6 = callPackage ../development/libraries/fox/fox-1.6.nix {
     inherit (darwin.apple_sdk.frameworks) CoreServices;
@@ -14615,20 +14612,6 @@ with pkgs;
 
   xvfb-run = callPackage ../tools/misc/xvfb-run {
     inherit (texFunctions) fontsConf;
-
-    # xvfb-run is used by a bunch of things to run tests
-    # and doesn't support hardware accelerated rendering
-    # so remove it from the rebuild heavy path for mesa
-    xorgserver = xorg.xorgserver.overrideAttrs(old: {
-      buildInputs = lib.filter (pkg: lib.getName pkg != "mesa") old.buildInputs;
-      configureFlags = old.configureFlags ++ [
-        "--disable-glamor"
-        "--disable-glx"
-        "--disable-dri"
-        "--disable-dri2"
-        "--disable-dri3"
-      ];
-    });
   };
 
   xvkbd = callPackage ../tools/X11/xvkbd { };
@@ -14946,6 +14929,9 @@ with pkgs;
 
   ### DEVELOPMENT / COMPILERS
 
+  temurin-bin-22 = javaPackages.compiler.temurin-bin.jdk-22;
+  temurin-jre-bin-22 = javaPackages.compiler.temurin-bin.jre-22;
+
   temurin-bin-21 = javaPackages.compiler.temurin-bin.jdk-21;
   temurin-jre-bin-21 = javaPackages.compiler.temurin-bin.jre-21;
 
@@ -14967,8 +14953,8 @@ with pkgs;
   temurin-bin-8 = javaPackages.compiler.temurin-bin.jdk-8;
   temurin-jre-bin-8 = javaPackages.compiler.temurin-bin.jre-8;
 
-  temurin-bin = temurin-bin-21;
-  temurin-jre-bin = temurin-jre-bin-21;
+  temurin-bin = temurin-bin-22;
+  temurin-jre-bin = temurin-jre-bin-22;
 
   semeru-bin-21 = javaPackages.compiler.semeru-bin.jdk-21;
   semeru-jre-bin-21 = javaPackages.compiler.semeru-bin.jre-21;
@@ -17267,11 +17253,11 @@ with pkgs;
   # available as `pythonPackages.tkinter` and can be used as any other Python package.
   # When switching these sets, please update docs at ../../doc/languages-frameworks/python.md
   python2 = python27;
-  python3 = python311;
+  python3 = python312;
 
   # pythonPackages further below, but assigned here because they need to be in sync
   python2Packages = dontRecurseIntoAttrs python27Packages;
-  python3Packages = dontRecurseIntoAttrs python311Packages;
+  python3Packages = dontRecurseIntoAttrs python312Packages;
 
   pypy = pypy2;
   pypy2 = pypy27;
@@ -17974,11 +17960,13 @@ with pkgs;
 
   binutils-unwrapped = callPackage ../development/tools/misc/binutils {
     autoreconfHook = autoreconfHook269;
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
     # FHS sys dirs presumably only have stuff for the build platform
     noSysDirs = (stdenv.targetPlatform != stdenv.hostPlatform) || noSysDirs;
   };
   binutils-unwrapped-all-targets = callPackage ../development/tools/misc/binutils {
     autoreconfHook = if targetPlatform.isiOS then autoreconfHook269 else autoreconfHook;
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
     # FHS sys dirs presumably only have stuff for the build platform
     noSysDirs = (stdenv.targetPlatform != stdenv.hostPlatform) || noSysDirs;
     withAllTargets = true;
@@ -19983,7 +19971,7 @@ with pkgs;
 
   bicpl = callPackage ../development/libraries/science/biology/bicpl { };
 
-  bicgl = callPackage ../development/libraries/science/biology/bicgl { inherit (darwin.apple_sdk.frameworks) GLUT; };
+  bicgl = callPackage ../development/libraries/science/biology/bicgl { };
 
   # TODO(@Ericson2314): Build bionic libc from source
   bionic = if stdenv.hostPlatform.useAndroidPrebuilt
@@ -20420,7 +20408,9 @@ with pkgs;
   # TODO: Fix references and add justStaticExecutables https://github.com/NixOS/nixpkgs/issues/318013
   emanote = haskellPackages.emanote;
 
-  enchant2 = callPackage ../development/libraries/enchant/2.x.nix { };
+  enchant2 = callPackage ../development/libraries/enchant/2.x.nix {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
   enchant = enchant2;
 
   enet = callPackage ../development/libraries/enet { };
@@ -20531,8 +20521,6 @@ with pkgs;
 
   flint3 = callPackage ../development/libraries/flint/3.nix { };
 
-  flite = callPackage ../development/libraries/flite { };
-
   fltk13 = callPackage ../development/libraries/fltk {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon Cocoa OpenGL;
   };
@@ -20791,7 +20779,7 @@ with pkgs;
   glfw-wayland-minecraft = callPackage ../development/libraries/glfw/3.x-wayland-minecraft.nix {};
   glfw2 = callPackage ../development/libraries/glfw/2.x.nix { };
   glfw3 = callPackage ../development/libraries/glfw/3.x.nix {
-    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa Kernel OpenGL;
+    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa Kernel;
   };
 
   glibc = callPackage ../development/libraries/glibc {
@@ -21294,7 +21282,7 @@ with pkgs;
     icu74
   ;
 
-  icu = icu73;
+  icu = icu74;
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
@@ -23105,26 +23093,59 @@ with pkgs;
 
   ## libGL/libGLU/Mesa stuff
 
-  # Default libGL implementation, should provide headers and
-  # libGL.so/libEGL.so/... to link agains them. Android NDK provides
-  # an OpenGL implementation, we can just use that.
-  libGL = if stdenv.hostPlatform.useAndroidPrebuilt then stdenv
-          else callPackage ../development/libraries/mesa/stubs.nix {
-            inherit (darwin.apple_sdk.frameworks) OpenGL;
-          };
+  # Default libGL implementation.
+  #
+  # Android NDK provides an OpenGL implementation, we can just use that.
+  #
+  # On macOS, we use the OpenGL framework. Packages that still need GLX
+  # specifically can pull in libGLX instead. If you have a package that
+  # should work without X11 but it can’t find the library, it may help
+  # to add the path to `NIX_CFLAGS_COMPILE`:
+  #
+  #     -L${libGL}/Library/Frameworks/OpenGL.framework/Versions/Current/Libraries
+  #
+  # If you still can’t get it working, please don’t hesitate to ping
+  # @NixOS/darwin-maintainers to ask an expert to take a look.
+  libGL =
+    if stdenv.hostPlatform.useAndroidPrebuilt then
+      stdenv
+    else if stdenv.hostPlatform.isDarwin then
+      darwin.apple_sdk.frameworks.OpenGL
+    else
+      libglvnd;
 
-  # Default libGLU
-  libGLU = mesa_glu;
+  # On macOS, we use the OpenGL framework. Packages that use libGLX on
+  # macOS may need to depend on mesa_glu directly if this doesn’t work.
+  libGLU =
+    if stdenv.hostPlatform.isDarwin then
+      darwin.apple_sdk.frameworks.OpenGL
+    else
+      mesa_glu;
+
+  # libglvnd does not work (yet?) on macOS.
+  libGLX =
+    if stdenv.hostPlatform.isDarwin then
+      mesa
+    else
+      libglvnd;
+
+  # On macOS, we use the GLUT framework. Packages that use libGLX on
+  # macOS may need to depend on freeglut directly if this doesn’t work.
+  libglut =
+    if stdenv.hostPlatform.isDarwin then
+      darwin.apple_sdk.frameworks.GLUT
+    else
+      freeglut;
+
+  mesa = if stdenv.isDarwin
+    then darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/darwin.nix {
+      inherit (darwin.apple_sdk_11_0.libs) Xplugin;
+    }
+    else callPackage ../development/libraries/mesa {};
 
-  mesa = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa {
-    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
-    inherit (darwin.apple_sdk_11_0.libs) Xplugin;
-  };
   mesa_i686 = pkgsi686Linux.mesa; # make it build on Hydra
 
-  mesa_glu =  callPackage ../development/libraries/mesa-glu {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  mesa_glu = callPackage ../development/libraries/mesa-glu {};
 
   ## End libGL/libGLU/Mesa stuff
 
@@ -24777,8 +24798,6 @@ with pkgs;
 
   xlslib = callPackage ../development/libraries/xlslib { };
 
-  xsimd = callPackage ../development/libraries/xsimd { };
-
   xtensor = callPackage ../development/libraries/xtensor { };
 
   xtl = callPackage ../development/libraries/xtl { };
@@ -36234,11 +36253,11 @@ with pkgs;
   construoBase = lowPrio (callPackage ../games/construo {
     libGL = null;
     libGLU = null;
-    freeglut = null;
+    libglut = null;
   });
 
   construo = construoBase.override {
-    inherit libGL libGLU freeglut;
+    inherit libGL libGLU libglut;
   };
 
   crack_attack = callPackage ../games/crack-attack { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index cca74e047dbd..69d22c8b9625 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -83,8 +83,8 @@ impure-cmds // appleSourcePackages // chooseLibs // {
   };
 
   binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
-    inherit (pkgs) binutils-unwrapped;
-    inherit (pkgs.llvmPackages) llvm clang-unwrapped;
+    inherit (self) cctools;
+    inherit (pkgs.llvmPackages) clang-unwrapped llvm llvm-manpages;
   };
 
   binutils = pkgs.wrapBintoolsWith {
@@ -95,17 +95,29 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     bintools = self.binutils-unwrapped;
   };
 
-  binutilsDualAs-unwrapped = callPackage ../os-specific/darwin/binutils {
-    inherit (pkgs) binutils-unwrapped;
-    inherit (pkgs.llvmPackages) llvm clang-unwrapped;
-    dualAs = true;
+  # x86-64 Darwin gnat-bootstrap emits assembly
+  # with MOVQ as the mnemonic for quadword interunit moves
+  # such as `movq %rbp, %xmm0`.
+  # The clang integrated assembler recognises this as valid,
+  # but unfortunately the cctools.gas GNU assembler does not;
+  # it instead uses MOVD as the mnemonic.
+  # The assembly that a GCC build emits is determined at build time
+  # and cannot be changed afterwards.
+  #
+  # To build GNAT on x86-64 Darwin, therefore,
+  # we need both the clang _and_ the cctools.gas assemblers to be available:
+  # the former to build at least the stage1 compiler,
+  # and the latter at least to be detectable
+  # as the target for the final compiler.
+  binutilsDualAs-unwrapped = pkgs.buildEnv {
+    name = "${lib.getName self.binutils-unwrapped}-dualas-${lib.getVersion self.binutils-unwrapped}";
+    paths = [
+      self.binutils-unwrapped
+      (lib.getOutput "gas" self.cctools)
+    ];
   };
 
-  binutilsDualAs = pkgs.wrapBintoolsWith {
-    libc =
-      if stdenv.targetPlatform != stdenv.hostPlatform
-      then pkgs.libcCross
-      else pkgs.stdenv.cc.libc;
+  binutilsDualAs = self.binutils.override {
     bintools = self.binutilsDualAs-unwrapped;
   };
 
@@ -114,7 +126,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     bintools = self.binutils-unwrapped;
   };
 
-  cctools = self.cctools-llvm;
+  cctools = self.cctools-port;
 
   cctools-apple = callPackage ../os-specific/darwin/cctools/apple.nix {
     stdenv = if stdenv.isDarwin then stdenv else pkgs.libcxxStdenv;
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index b924a29f2616..ad8a4b947964 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -78,7 +78,8 @@ in {
           packages.ghc865Binary
         else
           packages.ghc8107Binary;
-      inherit (buildPackages.python3Packages) sphinx;
+      inherit (buildPackages.python311Packages) sphinx; # a distutils issue with 3.12
+      python3 = buildPackages.python311; # so that we don't have two of them
       # Need to use apple's patched xattr until
       # https://github.com/xattr/xattr/issues/44 and
       # https://github.com/xattr/xattr/issues/55 are solved.
@@ -94,7 +95,8 @@ in {
           packages.ghc810
         else
           packages.ghc8107Binary;
-      inherit (buildPackages.python3Packages) sphinx;
+      inherit (buildPackages.python311Packages) sphinx; # a distutils issue with 3.12
+      python3 = buildPackages.python311; # so that we don't have two of them
       inherit (buildPackages.darwin) autoSignDarwinBinariesHook xattr;
       buildTargetLlvmPackages = pkgsBuildTarget.llvmPackages_12;
       llvmPackages = pkgs.llvmPackages_12;
@@ -106,7 +108,8 @@ in {
           packages.ghc810
         else
           packages.ghc8107Binary;
-      inherit (buildPackages.python3Packages) sphinx;
+      inherit (buildPackages.python311Packages) sphinx; # a distutils issue with 3.12
+      python3 = buildPackages.python311; # so that we don't have two of them
       # Need to use apple's patched xattr until
       # https://github.com/xattr/xattr/issues/44 and
       # https://github.com/xattr/xattr/issues/55 are solved.
@@ -120,7 +123,8 @@ in {
           packages.ghc810
         else
           packages.ghc8107Binary;
-      inherit (buildPackages.python3Packages) sphinx;
+      inherit (buildPackages.python311Packages) sphinx; # a distutils issue with 3.12
+      python3 = buildPackages.python311; # so that we don't have two of them
       # Need to use apple's patched xattr until
       # https://github.com/xattr/xattr/issues/44 and
       # https://github.com/xattr/xattr/issues/55 are solved.
@@ -134,7 +138,8 @@ in {
           packages.ghc810
         else
           packages.ghc8107Binary;
-      inherit (buildPackages.python3Packages) sphinx;
+      inherit (buildPackages.python311Packages) sphinx; # a distutils issue with 3.12
+      python3 = buildPackages.python311; # so that we don't have two of them
       # Need to use apple's patched xattr until
       # https://github.com/xattr/xattr/issues/44 and
       # https://github.com/xattr/xattr/issues/55 are solved.
@@ -148,7 +153,8 @@ in {
           packages.ghc810
         else
           packages.ghc8107Binary;
-      inherit (buildPackages.python3Packages) sphinx;
+      inherit (buildPackages.python311Packages) sphinx; # a distutils issue with 3.12
+      python3 = buildPackages.python311; # so that we don't have two of them
       # Need to use apple's patched xattr until
       # https://github.com/xattr/xattr/issues/44 and
       # https://github.com/xattr/xattr/issues/55 are solved.
@@ -172,7 +178,8 @@ in {
           packages.ghc902
         else
           packages.ghc8107Binary;
-      inherit (buildPackages.python3Packages) sphinx;
+      inherit (buildPackages.python311Packages) sphinx; # a distutils issue with 3.12
+      python3 = buildPackages.python311; # so that we don't have two of them
       # Need to use apple's patched xattr until
       # https://github.com/xattr/xattr/issues/44 and
       # https://github.com/xattr/xattr/issues/55 are solved.
@@ -196,7 +203,8 @@ in {
           packages.ghc902
         else
           packages.ghc8107Binary;
-      inherit (buildPackages.python3Packages) sphinx;
+      inherit (buildPackages.python311Packages) sphinx; # a distutils issue with 3.12
+      python3 = buildPackages.python311; # so that we don't have two of them
       # Need to use apple's patched xattr until
       # https://github.com/xattr/xattr/issues/44 and
       # https://github.com/xattr/xattr/issues/55 are solved.
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index 2d59c358863b..c80d6c28f840 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -227,7 +227,7 @@ in {
       ../development/compilers/openjdk/22.nix
       ../development/compilers/zulu/22.nix
       {
-        openjdk22-bootstrap = temurin-bin.jdk-21;
+        openjdk22-bootstrap = temurin-bin.jdk-22;
         openjfx = openjfx22;
       };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a7d2bfd6bff2..76a44d4ec416 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -19591,7 +19591,7 @@ with self; {
     };
 
     # FIXME: try with libGL + libGLU instead of libGLU libGL
-    buildInputs = [ pkgs.libGLU pkgs.libGL pkgs.libGLU pkgs.freeglut pkgs.xorg.libX11 pkgs.xorg.libXi pkgs.xorg.libXmu pkgs.xorg.libXext pkgs.xdummy ];
+    buildInputs = [ pkgs.libGLU pkgs.libGL pkgs.libGLU pkgs.libglut pkgs.xorg.libX11 pkgs.xorg.libXi pkgs.xorg.libXmu pkgs.xorg.libXext pkgs.xdummy ];
 
     patches = [ ../development/perl-modules/perl-opengl.patch ];
 
@@ -20295,10 +20295,11 @@ with self; {
         --replace 'WITH_PROJ => undef' 'WITH_PROJ => 0'
     '';
 
-    nativeBuildInputs = with pkgs; [ autoPatchelfHook libGL.dev glibc.dev mesa_glu.dev ];
+    # FIXME: Why are these libraries in `nativeBuildInputs`?
+    nativeBuildInputs = with pkgs; [ autoPatchelfHook (lib.getDev libGL) (lib.getDev glibc) (lib.getDev mesa_glu) ];
 
     buildInputs = [ DevelChecklib TestDeep TestException TestWarn ] ++
-                  (with pkgs; [ gsl freeglut xorg.libXmu xorg.libXi ]);
+                  (with pkgs; [ gsl libglut xorg.libXmu xorg.libXi ]);
 
     propagatedBuildInputs = [
       AstroFITSHeader
@@ -20319,7 +20320,7 @@ with self; {
       homepage = "https://pdl.perl.org";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
       mainProgram = "pdl2";
-      platforms = lib.platforms.linux;
+      platforms = lib.platforms.unix;
     };
   };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 2a126eec9987..e0e30fa1b1e6 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -423,6 +423,7 @@ mapAliases ({
   pytest_6 = pytest; # added 2022-02-10
   pytestcov = pytest-cov; # added 2021-01-04
   pytest-ordering = throw "pytest-ordering has been removed, since it is no longer maintained and broken"; # added 2023-06-22
+  pytest-openfiles = throw "pytest-openfiles has been removed, since it is unmaintained and archived"; # added 2024-06-19
   pytest-pep8 = pytestpep8; # added 2021-01-04
   pytest-pep257 = throw "pytest-pep257 was removed, as the pep257 package was migrated into pycodestyle"; # added 2022-04-12
   pytest-pythonpath = throw "pytest-pythonpath is obsolete as of pytest 7.0.0 and has been removed"; # added 2022-03-09
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5fab3b99fce5..0dc82d4d4016 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1397,6 +1397,8 @@ self: super: with self; {
 
   backports-strenum = callPackage ../development/python-modules/backports-strenum { };
 
+  backports-tarfile = callPackage ../development/python-modules/backports-tarfile { };
+
   backports-zoneinfo = callPackage ../development/python-modules/backports-zoneinfo { };
 
   bacpypes = callPackage ../development/python-modules/bacpypes { };
@@ -2507,6 +2509,8 @@ self: super: with self; {
 
   convertdate = callPackage ../development/python-modules/convertdate { };
 
+  convertertools = callPackage ../development/python-modules/convertertools { };
+
   cookiecutter = callPackage ../development/python-modules/cookiecutter { };
 
   cookies = callPackage ../development/python-modules/cookies { };
@@ -2861,8 +2865,12 @@ self: super: with self; {
 
   dbglib = callPackage ../development/python-modules/dbglib { };
 
+  dbt-adapters = callPackage ../development/python-modules/dbt-adapters { };
+
   dbt-bigquery = callPackage ../development/python-modules/dbt-bigquery { };
 
+  dbt-common = callPackage ../development/python-modules/dbt-common { };
+
   dbt-core = callPackage ../development/python-modules/dbt-core { };
 
   dbt-extractor = callPackage ../development/python-modules/dbt-extractor { };
@@ -4151,6 +4159,8 @@ self: super: with self; {
 
   fastapi = callPackage ../development/python-modules/fastapi { };
 
+  fastapi-cli = callPackage ../development/python-modules/fastapi-cli { };
+
   fastapi-mail = callPackage ../development/python-modules/fastapi-mail { };
 
   fastapi-sso = callPackage ../development/python-modules/fastapi-sso { };
@@ -4459,10 +4469,10 @@ self: super: with self; {
 
   flexcache = callPackage ../development/python-modules/flexcache { };
 
-  flexparser = callPackage ../development/python-modules/flexparser { };
-
   flexmock = callPackage ../development/python-modules/flexmock { };
 
+  flexparser = callPackage ../development/python-modules/flexparser { };
+
   flickrapi = callPackage ../development/python-modules/flickrapi { };
 
   flipr-api = callPackage ../development/python-modules/flipr-api { };
@@ -6178,6 +6188,8 @@ self: super: with self; {
 
   jishaku = callPackage ../development/python-modules/jishaku { };
 
+  jiter = callPackage ../development/python-modules/jiter { };
+
   jiwer = callPackage ../development/python-modules/jiwer { };
 
   jmespath = callPackage ../development/python-modules/jmespath { };
@@ -7636,6 +7648,8 @@ self: super: with self; {
 
   mkdocs-exclude = callPackage ../development/python-modules/mkdocs-exclude { };
 
+  mkdocs-get-deps = callPackage ../development/python-modules/mkdocs-get-deps { };
+
   mkdocs-git-authors-plugin = callPackage ../development/python-modules/mkdocs-git-authors-plugin { };
 
   mkdocs-git-revision-date-localized-plugin = callPackage ../development/python-modules/mkdocs-git-revision-date-localized-plugin { };
@@ -9076,7 +9090,9 @@ self: super: with self; {
 
   numpydoc = callPackage ../development/python-modules/numpydoc { };
 
-  numpy = callPackage ../development/python-modules/numpy { };
+  numpy_1 = callPackage ../development/python-modules/numpy/1.nix { };
+  numpy_2 = callPackage ../development/python-modules/numpy/2.nix { };
+  numpy = if self.pythonOlder "3.13" then numpy_1 else numpy_2;
 
   numpy-stl = callPackage ../development/python-modules/numpy-stl { };
 
@@ -11634,9 +11650,7 @@ self: super: with self; {
 
   phonemizer = callPackage ../development/python-modules/phonemizer { };
 
-  pyopencl = callPackage ../development/python-modules/pyopencl {
-    mesa_drivers = pkgs.mesa.drivers;
-  };
+  pyopencl = callPackage ../development/python-modules/pyopencl { };
 
   pyopengl = callPackage ../development/python-modules/pyopengl { };
 
@@ -12294,6 +12308,8 @@ self: super: with self; {
 
   pytest-lazy-fixture = callPackage ../development/python-modules/pytest-lazy-fixture { };
 
+  pytest-lazy-fixtures = callPackage ../development/python-modules/pytest-lazy-fixtures { };
+
   pytest-localserver = callPackage ../development/python-modules/pytest-localserver { };
 
   pytest-logdog = callPackage ../development/python-modules/pytest-logdog { };
@@ -12316,8 +12332,6 @@ self: super: with self; {
 
   pytest-notebook = callPackage ../development/python-modules/pytest-notebook { };
 
-  pytest-openfiles = callPackage ../development/python-modules/pytest-openfiles { };
-
   pytest-order = callPackage ../development/python-modules/pytest-order { };
 
   pytest-param-files = callPackage ../development/python-modules/pytest-param-files { };
@@ -17362,9 +17376,7 @@ self: super: with self; {
 
   xtensor-python = callPackage ../development/python-modules/xtensor-python { };
 
-  xvfbwrapper = callPackage ../development/python-modules/xvfbwrapper {
-    inherit (pkgs.xorg) xorgserver;
-  };
+  xvfbwrapper = callPackage ../development/python-modules/xvfbwrapper {};
 
   xxhash = callPackage ../development/python-modules/xxhash { };
 
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 087b43c3cb14..b0c7ec03827b 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -292,7 +292,7 @@ let
           pkgsExtraHardening = super';
           stdenv = super'.withDefaultHardeningFlags (
             super'.stdenv.cc.defaultHardeningFlags ++ [
-              "zerocallusedregs"
+              "stackclashprotection"
               "trivialautovarinit"
             ]
           ) super'.stdenv;