Merge #275620: staging-next 2023-12-20

1366 files changed, 11715 insertions, 7036 deletions

diff --git a/pkgs/applications/audio/ardour/7.nix b/pkgs/applications/audio/ardour/7.nix
index ab9b2ebcd9619..86a50ef0606e2 100644
--- a/pkgs/applications/audio/ardour/7.nix
+++ b/pkgs/applications/audio/ardour/7.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchgit
 , fetchzip
+, fetchpatch
 , alsa-lib
 , aubio
 , boost
@@ -79,6 +80,12 @@ stdenv.mkDerivation rec {
     # AS=as in the environment causes build failure https://tracker.ardour.org/view.php?id=8096
     ./as-flags.patch
     ./default-plugin-search-paths.patch
+
+    # Fix build with libxml2 2.12.
+    (fetchpatch {
+      url = "https://github.com/Ardour/ardour/commit/e995daa37529715214c6c4a2587e4134aaaba02f.patch";
+      hash = "sha256-EpXOIIObOwwcNgNma0E3nvaBad3930sagDjBpa+78WI=";
+    })
   ];
 
   # Ardour's wscript requires git revision and date to be available.
diff --git a/pkgs/applications/audio/quodlibet/default.nix b/pkgs/applications/audio/quodlibet/default.nix
index eacce636df4e9..67a597b623881 100644
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@@ -66,6 +66,7 @@ python3.pkgs.buildPythonApplication rec {
   ] ++ (with python3.pkgs; [
     sphinx-rtd-theme
     sphinxHook
+    setuptools
   ]);
 
   buildInputs = [
diff --git a/pkgs/applications/audio/whipper/default.nix b/pkgs/applications/audio/whipper/default.nix
index eb179bfa54964..53d7262d78df7 100644
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@@ -64,10 +64,6 @@ in python3.pkgs.buildPythonApplication rec {
     "--prefix" "PATH" ":" (lib.makeBinPath bins)
   ];
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
-  '';
-
   outputs = [ "out" "man" ];
   postBuild = ''
     make -C man
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index d46117edc1dab..82ff04e4ed4cf 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -4,7 +4,7 @@
 , rocksdb
 , rust-jemalloc-sys-unprefixed
 , rustPlatform
-, rustc-wasm32
+, rustc
 , stdenv
 , Security
 , SystemConfiguration
@@ -63,8 +63,8 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
-    rustc-wasm32
-    rustc-wasm32.llvmPackages.lld
+    rustc
+    rustc.llvmPackages.lld
   ];
 
   # NOTE: jemalloc is used by default on Linux with unprefixed enabled
diff --git a/pkgs/applications/editors/scite/default.nix b/pkgs/applications/editors/scite/default.nix
index 67ebd13134b2f..9c230a2984eb9 100644
--- a/pkgs/applications/editors/scite/default.nix
+++ b/pkgs/applications/editors/scite/default.nix
@@ -13,6 +13,12 @@ stdenv.mkDerivation {
   buildInputs = [ gtk2 ];
   sourceRoot = "scintilla/gtk";
 
+  CXXFLAGS = [
+    # GCC 13: error: 'intptr_t' does not name a type
+    "-include cstdint"
+    "-include system_error"
+  ];
+
   buildPhase = ''
     make
     cd ../../lexilla/src
diff --git a/pkgs/applications/graphics/hdrmerge/default.nix b/pkgs/applications/graphics/hdrmerge/default.nix
index a8db24c35283f..827ee15af60aa 100644
--- a/pkgs/applications/graphics/hdrmerge/default.nix
+++ b/pkgs/applications/graphics/hdrmerge/default.nix
@@ -37,6 +37,11 @@ mkDerivation rec {
     "-DALGLIB_DIR:PATH=${alglib}"
   ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'uint32_t' does not name a type
+    "-include cstdint"
+  ];
+
   patches = [
     # https://github.com/jcelaya/hdrmerge/pull/222
     (fetchpatch {
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 81a34579c5b01..35000a06de02e 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , desktopToDarwinBundle
 , fetchurl
+, fetchpatch
 , gettext
 , ghostscript
 , glib
@@ -92,6 +93,13 @@ stdenv.mkDerivation rec {
       src = ./fix-ps2pdf-path.patch;
       inherit ghostscript;
     })
+
+    # Fix build with libxml2 2.12
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/6089
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/694d8ae43d06efff21adebf377ce614d660b24cd.patch";
+      hash = "sha256-9IXJzpZbNU5fnt7XKgqCzUDrwr08qxGwo8TqnL+xc6E=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index df78c3108fb88..affa411aaa3c1 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -21,6 +21,15 @@ mkDerivation rec {
     inherit hash;
   };
 
+  patches = [
+    # Fixes build with SIP 6.8
+    (fetchpatch {
+      name = "bump-SIP-ABI-version-to-12.8.patch";
+      url = "https://invent.kde.org/graphics/krita/-/commit/2d71c47661d43a4e3c1ab0c27803de980bdf2bb2.diff";
+      hash = "sha256-U3E44nj4vra++PJV20h4YHjES78kgrJtr4ktNeQfOdA=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip makeWrapper ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/meshlab/default.nix b/pkgs/applications/graphics/meshlab/default.nix
index 656713fb25e4e..bee1e35ec129a 100644
--- a/pkgs/applications/graphics/meshlab/default.nix
+++ b/pkgs/applications/graphics/meshlab/default.nix
@@ -75,6 +75,11 @@ mkDerivation rec {
     "-DALLOW_BUNDLED_LEVMAR=ON"
   ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'int16_t' has not been declared in 'std'
+    "-include cstdint"
+  ];
+
   postFixup = ''
     patchelf --add-needed $out/lib/meshlab/libmeshlab-common.so $out/bin/.meshlab-wrapped
   '';
diff --git a/pkgs/applications/graphics/tesseract/tesseract4.nix b/pkgs/applications/graphics/tesseract/tesseract4.nix
index aecdf58186d05..5bd682988526a 100644
--- a/pkgs/applications/graphics/tesseract/tesseract4.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract4.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
   # great, but tesseract4's days are numbered anyway
   postPatch = ''
     sed -i '/allheaders.h/a#include "pix_internal.h"' src/textord/devanagari_processing.cpp
+
+    # gcc-13 compat fix, simulate this upstream patch:
+    #   https://github.com/tesseract-ocr/tesseract/commit/17e795aaae7d40dbcb7d3365835c2f55ecc6355d.patch
+    #   https://github.com/tesseract-ocr/tesseract/commit/c0db7b7e930322826e09981360e39fdbd16cc9b0.patch
+
+    sed -i src/ccutil/helpers.h -e '1i #include <climits>'
+    sed -i src/ccutil/helpers.h -e '1i #include <cstdint>'
+    sed -i src/dict/matchdefs.h -e '1i #include <cstdint>'
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/ablog/default.nix b/pkgs/applications/misc/ablog/default.nix
index a57bae8aa9b1f..8ad7a6232bebe 100644
--- a/pkgs/applications/misc/ablog/default.nix
+++ b/pkgs/applications/misc/ablog/default.nix
@@ -34,6 +34,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   pytestFlagsArray = [
+    "-W" "ignore::sphinx.deprecation.RemovedInSphinx90Warning"
     "--rootdir" "src/ablog"
   ];
 
diff --git a/pkgs/applications/misc/acpic/default.nix b/pkgs/applications/misc/acpic/default.nix
index 6b37ef6b8e653..7d05f0a05702e 100644
--- a/pkgs/applications/misc/acpic/default.nix
+++ b/pkgs/applications/misc/acpic/default.nix
@@ -6,15 +6,21 @@
 python3Packages.buildPythonApplication rec {
   pname = "acpic";
   version = "1.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version pname;
     hash = "sha256-vQ9VxCNbOmqHIY3e1wq1wNJl5ywfU2tm62gDg3vKvcg=";
   };
 
-  nativeBuildInputs = [
-    python3Packages.pbr
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pbr>=5.8.1,<6" "pbr"
+  '';
+
+  nativeBuildInputs = with python3Packages; [
+    pbr
+    setuptools
   ];
 
   # no tests
diff --git a/pkgs/applications/misc/audio/sox/default.nix b/pkgs/applications/misc/audio/sox/default.nix
index 1b8e0541346a5..bb751ae01c9d7 100644
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@@ -79,6 +79,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional enableLibpulseaudio libpulseaudio
     ++ lib.optional stdenv.isDarwin CoreAudio;
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Sample Rate Converter for audio";
     homepage = "https://sox.sourceforge.net/";
diff --git a/pkgs/applications/misc/barrier/default.nix b/pkgs/applications/misc/barrier/default.nix
index f068667948c21..d02712848b72a 100644
--- a/pkgs/applications/misc/barrier/default.nix
+++ b/pkgs/applications/misc/barrier/default.nix
@@ -26,6 +26,11 @@ mkDerivation rec {
     })
   ];
 
+  CXXFLAGS = [
+    # error: 'uint8_t' is not a member of 'std'; did you mean 'wint_t'?
+    "-include cstdint"
+  ];
+
   buildInputs = [ curl xorg.libX11 xorg.libXext xorg.libXtst avahiWithLibdnssdCompat qtbase ];
   nativeBuildInputs = [ cmake wrapGAppsHook ];
 
diff --git a/pkgs/applications/misc/buku/default.nix b/pkgs/applications/misc/buku/default.nix
index 2ada67daa1e2c..ddf2b9f528dad 100644
--- a/pkgs/applications/misc/buku/default.nix
+++ b/pkgs/applications/misc/buku/default.nix
@@ -19,6 +19,7 @@ in
 with python3.pkgs; buildPythonApplication rec {
   version = "4.8";
   pname = "buku";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jarun";
@@ -27,6 +28,10 @@ with python3.pkgs; buildPythonApplication rec {
     sha256 = "sha256-kPVlfTYUusf5CZnKB53WZcCHo3MEnA2bLUHTRPGPn+8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     hypothesis
     pytest
diff --git a/pkgs/applications/misc/keepmenu/default.nix b/pkgs/applications/misc/keepmenu/default.nix
index 1e6735d656166..d10c10c231d6d 100644
--- a/pkgs/applications/misc/keepmenu/default.nix
+++ b/pkgs/applications/misc/keepmenu/default.nix
@@ -17,8 +17,6 @@ python3Packages.buildPythonApplication rec {
     hatch-vcs
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = with python3Packages; [
     pykeepass
     pynput
diff --git a/pkgs/applications/misc/khal/default.nix b/pkgs/applications/misc/khal/default.nix
index 27bf5d1db267e..c892f046c895c 100644
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@@ -17,8 +17,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-yI33pB/t+UISvSbLUzmsZqBxLF6r8R3j9iPNeosKcYw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     glibcLocales
     installShellFiles
diff --git a/pkgs/applications/misc/khard/default.nix b/pkgs/applications/misc/khard/default.nix
index 0654974eb9390..6bd9b2089f18e 100644
--- a/pkgs/applications/misc/khard/default.nix
+++ b/pkgs/applications/misc/khard/default.nix
@@ -9,7 +9,6 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-WfMKDaPD2j6wT02+GO5HY5E7aF2Z7IQY/VdKiMSRxJA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
     sphinxHook
diff --git a/pkgs/applications/misc/mozphab/default.nix b/pkgs/applications/misc/mozphab/default.nix
index 28f1e4b2d98cf..05f04ed0aba05 100644
--- a/pkgs/applications/misc/mozphab/default.nix
+++ b/pkgs/applications/misc/mozphab/default.nix
@@ -30,8 +30,6 @@ python3.pkgs.buildPythonApplication rec {
     setuptools-scm
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = with python3.pkgs; [
     colorama
     distro
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index e4bf829191e30..7e172f279d44b 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -165,10 +165,14 @@ stdenv.mkDerivation rec {
     EOF
 
     moveToOutput "bin" "$bin"
-  '' + lib.optionalString (enableX11 || enableGL) ''
+  '' + (lib.optionalString (stdenv.isDarwin) ''
+    for exe in $bin/bin/*; do
+      install_name_tool -change build/shared-release/libmupdf.dylib $out/lib/libmupdf.dylib "$exe"
+    done
+  '') + (lib.optionalString (enableX11 || enableGL) ''
     mkdir -p $bin/share/icons/hicolor/48x48/apps
     cp docs/logo/mupdf.png $bin/share/icons/hicolor/48x48/apps
-  '' + (if enableGL then ''
+  '') + (if enableGL then ''
     ln -s "$bin/bin/mupdf-gl" "$bin/bin/mupdf"
   '' else lib.optionalString (enableX11) ''
     ln -s "$bin/bin/mupdf-x11" "$bin/bin/mupdf"
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index e7daa60198d11..5b42f1d08c3cf 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -163,7 +163,7 @@ let
                 zeroconf
                 zipstream-ng
                 class-doc
-                pydantic
+                pydantic_1
               ] ++ lib.optionals stdenv.isDarwin [
                 py.pkgs.appdirs
               ] ++ lib.optionals (!stdenv.isDarwin) [
diff --git a/pkgs/applications/misc/pagefind/default.nix b/pkgs/applications/misc/pagefind/default.nix
index 06f62da1ffb6a..1d1a91e9e4b5c 100644
--- a/pkgs/applications/misc/pagefind/default.nix
+++ b/pkgs/applications/misc/pagefind/default.nix
@@ -7,7 +7,7 @@
 , binaryen
 , gzip
 , nodejs
-, rustc-wasm32
+, rustc
 , wasm-bindgen-cli
 , wasm-pack
 }:
@@ -66,8 +66,8 @@ rustPlatform.buildRustPackage rec {
     binaryen
     gzip
     nodejs
-    rustc-wasm32
-    rustc-wasm32.llvmPackages.lld
+    rustc
+    rustc.llvmPackages.lld
     wasm-bindgen-84
     wasm-pack
   ];
diff --git a/pkgs/applications/misc/pysentation/default.nix b/pkgs/applications/misc/pysentation/default.nix
index c02fec3c01663..1a84c06c94ff4 100644
--- a/pkgs/applications/misc/pysentation/default.nix
+++ b/pkgs/applications/misc/pysentation/default.nix
@@ -15,9 +15,14 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-TwHDXWgGWuQVgatBDc1iympnb6dy4xYThLR5MouEZHA=";
   };
 
-  nativeBuildInputs = [
-    python3.pkgs.setuptools
-    python3.pkgs.wheel
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "click"
+    "rich"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/misc/urlscan/default.nix b/pkgs/applications/misc/urlscan/default.nix
index cd69643251063..3715ef27524e9 100644
--- a/pkgs/applications/misc/urlscan/default.nix
+++ b/pkgs/applications/misc/urlscan/default.nix
@@ -15,8 +15,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-OzcoOIgEiadWrsUPIxBJTuZQYjScJBYKyqCu1or6fz8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = with python3.pkgs; [
     hatchling
     hatch-vcs
diff --git a/pkgs/applications/misc/yambar/default.nix b/pkgs/applications/misc/yambar/default.nix
index 7d974bf87fd4e..8feb3995070cd 100644
--- a/pkgs/applications/misc/yambar/default.nix
+++ b/pkgs/applications/misc/yambar/default.nix
@@ -82,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
   mesonBuildType = "release";
 
   mesonFlags = [
+    (lib.mesonBool "werror" false)
     (lib.mesonEnable "backend-x11" x11Support)
     (lib.mesonEnable "backend-wayland" waylandSupport)
   ];
diff --git a/pkgs/applications/networking/cloudflare-dyndns/default.nix b/pkgs/applications/networking/cloudflare-dyndns/default.nix
index 2be03621a016f..087b3c66f00dd 100644
--- a/pkgs/applications/networking/cloudflare-dyndns/default.nix
+++ b/pkgs/applications/networking/cloudflare-dyndns/default.nix
@@ -24,7 +24,7 @@ python3.pkgs.buildPythonApplication rec {
     attrs
     click
     cloudflare
-    pydantic
+    pydantic_1
     requests
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
index 5343fd1c4daeb..8e496c6c11012 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@@ -23,8 +23,6 @@ python3.pkgs.buildPythonApplication rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = with python3.pkgs; [
     appdirs
     deltachat
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index 37c90f1b2f0f7..b2970b02f7dbd 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -85,19 +85,26 @@ stdenv.mkDerivation rec {
     patchShebangs notmuch-git
   '';
 
-  preCheck = let
-    test-database = fetchurl {
-      url = "https://notmuchmail.org/releases/test-databases/database-v1.tar.xz";
-      sha256 = "1lk91s00y4qy4pjh8638b5lfkgwyl282g1m27srsf7qfn58y16a2";
-    };
-  in ''
-    mkdir -p test/test-databases
-    ln -s ${test-database} test/test-databases/database-v1.tar.xz
-  ''
-  # Issues since gnupg: 2.4.0 -> 2.4.1
-  + ''
-    rm test/{T350-crypto,T357-index-decryption}.sh
-  '';
+  preCheck =
+    let
+      test-database = fetchurl {
+        url = "https://notmuchmail.org/releases/test-databases/database-v1.tar.xz";
+        sha256 = "1lk91s00y4qy4pjh8638b5lfkgwyl282g1m27srsf7qfn58y16a2";
+      };
+    in
+    ''
+      mkdir -p test/test-databases
+      ln -s ${test-database} test/test-databases/database-v1.tar.xz
+    ''
+    + ''
+      # Issues since gnupg: 2.4.0 -> 2.4.1
+      rm test/{T350-crypto,T357-index-decryption}.sh
+      # Issues since pbr 6.0.0 bump (ModuleNotFoundError: No module named 'notmuch2')
+      rm test/T055-path-config.sh
+      # Flaky, seems to get its paths wrong sometimes (?)
+      # *ERROR*: Opening output file: Permission denied, /nix/store/bzy21v2cd5sq1djzwa9b19q08wpp9mm0-emacs-29.1/bin/OUTPUT
+      rm test/T460-emacs-tree.sh
+    '';
 
   doCheck = !stdenv.hostPlatform.isDarwin && (lib.versionAtLeast gmime3.version "3.0.3");
   checkTarget = "test";
diff --git a/pkgs/applications/networking/newsreaders/liferea/default.nix b/pkgs/applications/networking/newsreaders/liferea/default.nix
index de651cab98add..d7643a6f07e86 100644
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , intltool
 , python3Packages
@@ -31,6 +32,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-7lanrs63N6ZnqxvjcW/+cUZVDqUbML2gftQUc/sLr3Q=";
   };
 
+  patches = [
+    # Pull upstream fix for libxml2-2.12 compatibility:
+    #   https://github.com/lwindolf/liferea/pull/1329
+    (fetchpatch {
+      name = "libxml2-2.12.patch";
+      url = "https://github.com/lwindolf/liferea/commit/be8ef494586d9ef73c04ec4ca058a9a158ae3562.patch";
+      hash = "sha256-K1R7dJMm7ui6QKQqAHCo/ZrLCW3PhPU1EKRPEICtCsQ=";
+    })
+  ];
+
   nativeBuildInputs = [
     wrapGAppsHook
     python3Packages.wrapPython
diff --git a/pkgs/applications/office/abiword/default.nix b/pkgs/applications/office/abiword/default.nix
index b90b23a3905a4..8f62a4187611d 100644
--- a/pkgs/applications/office/abiword/default.nix
+++ b/pkgs/applications/office/abiword/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , gtk3
 , fribidi
@@ -28,6 +29,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-ElckfplwUI1tFFbT4zDNGQnEtCsl4PChvDJSbW86IbQ=";
   };
 
+  patches = [
+    # Fix build with libxml2 2.12
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/World/AbiWord/-/commit/2a06be6a10a0718f8a3d8e00c317f5042c99a467.patch";
+      hash = "sha256-vfh81tGXe9dgnjcAtoWHOK8CtW7MZ75FFjnfKTkiKkk=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 6be1d11ae3b68..e7fa0c53f7302 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -13,6 +13,7 @@
 , IOCompress
 , zlib
 , libjpeg
+, liblangtag
 , expat
 , freetype
 , libwpd
@@ -225,6 +226,17 @@ in stdenv.mkDerivation (finalAttrs: {
       url = "https://cgit.freedesktop.org/libreoffice/core/patch/?id=ececb678b8362e3be8e02768ddd5e4197d87dc2a";
       hash = "sha256-TUfKlwNxUTOJ95VLqwVD+ez1xhu7bW6xZlgIaCyIiNg=";
     })
+
+    # Backport libxml 2.12 build fixes
+    # FIXME: remove in next release
+    (fetchpatch {
+      url = "https://cgit.freedesktop.org/libreoffice/core/patch/?id=c8f7408db73d2f2ccacb25a2b4fef8dfebdfc6cb";
+      hash = "sha256-uEgRx1eyS3Wx2ZDWEsUmpIbuKezVrIbO++qSL2QI8Lk=";
+    })
+    (fetchpatch {
+      url = "https://cgit.freedesktop.org/libreoffice/core/patch/?id=cbb17a548b5cc6a99b6ed7735479bb4f2bc40f26";
+      hash = "sha256-ofhif37uvQI+gidaUpyr6XlyBc3gTJUDBRb3ootrzz0=";
+    })
   ];
 
   # libreoffice tries to reference the BUILDCONFIG (e.g. PKG_CONFIG_PATH)
@@ -436,6 +448,7 @@ in stdenv.mkDerivation (finalAttrs: {
     "--with-system-headers"
     "--with-system-openssl"
     "--with-system-libabw"
+    "--with-system-liblangtag"
     "--without-system-libcmis"
     "--with-system-libwps"
     "--with-system-openldap"
@@ -466,7 +479,6 @@ in stdenv.mkDerivation (finalAttrs: {
     "--without-system-lpsolve"
     "--without-system-libetonyek"
     "--without-system-libfreehand"
-    "--without-system-liblangtag"
     "--without-system-libmspub"
     "--without-system-libnumbertext"
     "--without-system-libpagemaker"
@@ -566,6 +578,7 @@ in stdenv.mkDerivation (finalAttrs: {
     libepoxy
     libexttextcat
     libjpeg
+    liblangtag
     libmspack
     libmwaw
     libmysqlclient
diff --git a/pkgs/applications/office/paperwork/openpaperwork-core.nix b/pkgs/applications/office/paperwork/openpaperwork-core.nix
index d434e000da5e6..ed9a7d6ed5ad0 100644
--- a/pkgs/applications/office/paperwork/openpaperwork-core.nix
+++ b/pkgs/applications/office/paperwork/openpaperwork-core.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     patchShebangs ../tools
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     distro
     setuptools
diff --git a/pkgs/applications/office/paperwork/openpaperwork-gtk.nix b/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
index cd0290f08746c..95d5effa151ff 100644
--- a/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     patchShebangs ../tools
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     pkgs.gettext
     pkgs.which
diff --git a/pkgs/applications/office/paperwork/paperwork-backend.nix b/pkgs/applications/office/paperwork/paperwork-backend.nix
index 95608b26e2fee..4460e50ab6246 100644
--- a/pkgs/applications/office/paperwork/paperwork-backend.nix
+++ b/pkgs/applications/office/paperwork/paperwork-backend.nix
@@ -44,8 +44,6 @@ buildPythonPackage rec {
     patchShebangs ../tools
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     distro
     gtk3
diff --git a/pkgs/applications/office/paperwork/paperwork-gtk.nix b/pkgs/applications/office/paperwork/paperwork-gtk.nix
index 9950075d6b273..e21379678a175 100644
--- a/pkgs/applications/office/paperwork/paperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/paperwork-gtk.nix
@@ -42,8 +42,6 @@ python3Packages.buildPythonApplication rec {
 
   sourceRoot = "${src.name}/paperwork-gtk";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     chmod a+w -R ..
     patchShebangs ../tools
diff --git a/pkgs/applications/office/paperwork/paperwork-shell.nix b/pkgs/applications/office/paperwork/paperwork-shell.nix
index 7a1d82a5eb31e..cbda78976b5b1 100644
--- a/pkgs/applications/office/paperwork/paperwork-shell.nix
+++ b/pkgs/applications/office/paperwork/paperwork-shell.nix
@@ -32,8 +32,6 @@ buildPythonPackage rec {
     chmod a+w -R ..
     patchShebangs ../tools
   '';
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     openpaperwork-core
     paperwork-backend
diff --git a/pkgs/applications/office/todoman/default.nix b/pkgs/applications/office/todoman/default.nix
index f2940b1e3fb9b..d53306e77904e 100644
--- a/pkgs/applications/office/todoman/default.nix
+++ b/pkgs/applications/office/todoman/default.nix
@@ -19,8 +19,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-5tQaNT6QVN9mxa9t6OvMux4ZGy4flUqszTAwet2QL0w=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     installShellFiles
   ] ++ (with python3.pkgs; [
diff --git a/pkgs/applications/science/electronics/nanovna-saver/default.nix b/pkgs/applications/science/electronics/nanovna-saver/default.nix
index f65f5e5149ca8..e9e693fcf5118 100644
--- a/pkgs/applications/science/electronics/nanovna-saver/default.nix
+++ b/pkgs/applications/science/electronics/nanovna-saver/default.nix
@@ -31,8 +31,6 @@ python3.pkgs.buildPythonApplication rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   doCheck = false;
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/science/machine-learning/fasttext/default.nix b/pkgs/applications/science/machine-learning/fasttext/default.nix
index a04ac5a6945ec..301308f901369 100644
--- a/pkgs/applications/science/machine-learning/fasttext/default.nix
+++ b/pkgs/applications/science/machine-learning/fasttext/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fasttext";
-  version = "0.9.2";
+  version = "0.9.2-unstable-2023-11-28";
 
   src = fetchFromGitHub {
     owner = "facebookresearch";
     repo = "fastText";
-    rev = "v${version}";
-    sha256 = "07cz2ghfq6amcljaxpdr5chbd64ph513y8zqmibfx2xwfp74xkhn";
+    rev = "6c2204ba66776b700095ff73e3e599a908ffd9c3";
+    hash = "sha256-lSIah4T+QqZwCRpeI3mxJ7PZT6pSHBO26rcEFfK8DSk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/math/gmsh/default.nix b/pkgs/applications/science/math/gmsh/default.nix
index 4d9b3afe31ca4..62a0c3c405dff 100644
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, blas, lapack, gfortran, gmm, fltk, libjpeg
+{ lib, stdenv, fetchurl, fetchpatch, cmake, blas, lapack, gfortran, gmm, fltk, libjpeg
 , zlib, libGL, libGLU, xorg, opencascade-occt
 , python ? null, enablePython ? false }:
 
@@ -24,7 +24,22 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  patches = [ ./fix-python.patch ];
+  patches = [
+    ./fix-python.patch
+
+    # Pull upstream fix git gcc-13:
+    #   https://gitlab.onelab.info/gmsh/gmsh/-/issues/2416
+    (fetchpatch {
+      name = "gcc-13-p1.patch";
+      url = "https://gitlab.onelab.info/gmsh/gmsh/-/commit/fb81a9c9026700e078de947b4522cb39e543a86b.patch";
+      hash = "sha256-1GInFqQZvOgflC3eQTjmZ9uBGFASRNCpCwDACN3yTQ4=";
+    })
+    (fetchpatch {
+      name = "gcc-13-p2.patch";
+      url = "https://gitlab.onelab.info/gmsh/gmsh/-/commit/aceb09c807b78ea26555f99fcb16c4f87c31fb5a.patch";
+      hash = "sha256-6FI0hIvj8hglCvxoKV0GzT2/F/Wz+ddkxV/TLzzJBLU=";
+    })
+  ];
 
   postPatch = ''
     substituteInPlace api/gmsh.py --subst-var-by LIBPATH ${placeholder "out"}/lib/libgmsh.so
diff --git a/pkgs/applications/search/recoll/default.nix b/pkgs/applications/search/recoll/default.nix
index 0560793132d17..902571dd33f1c 100644
--- a/pkgs/applications/search/recoll/default.nix
+++ b/pkgs/applications/search/recoll/default.nix
@@ -97,7 +97,10 @@ mkDerivation rec {
     (lib.withFeature stdenv.isLinux "inotify")
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [ "-DNIXPKGS" ];
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-DNIXPKGS"
+    "-fpermissive" # libxml2-2.12 changed const qualifiers
+  ];
 
   patches = [
     # fix "No/bad main configuration file" error
diff --git a/pkgs/applications/terminal-emulators/guake/default.nix b/pkgs/applications/terminal-emulators/guake/default.nix
index d030c7add9660..667da3ec229fd 100644
--- a/pkgs/applications/terminal-emulators/guake/default.nix
+++ b/pkgs/applications/terminal-emulators/guake/default.nix
@@ -52,8 +52,6 @@ python3.pkgs.buildPythonApplication rec {
     pyyaml
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   makeFlags = [
     "PREFIX=${placeholder "out"}"
   ];
diff --git a/pkgs/applications/version-management/git-cola/default.nix b/pkgs/applications/version-management/git-cola/default.nix
index 56a89f7eec815..e9db7812cca5b 100644
--- a/pkgs/applications/version-management/git-cola/default.nix
+++ b/pkgs/applications/version-management/git-cola/default.nix
@@ -11,8 +11,6 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-PtV2mzxOfZ88THiFD4K+qtOi41GeLF1GcdiFFhUR8Ak=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = lib.optionals stdenv.isLinux [ qt5.qtwayland ];
   propagatedBuildInputs = with python3Packages; [ git pyqt5 qtpy send2trash ];
   nativeBuildInputs = with python3Packages; [ setuptools-scm gettext qt5.wrapQtAppsHook ];
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 1b92778e65ccb..24eb5c15f5e68 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -29,7 +29,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.42.0";
+  version = "2.43.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-MnghDp/SmUuEhN1+Pd2eqLlA71IXDNtgbaqU2IfJOw0=";
+    hash = "sha256-VEZgPnPZEXgdJZ5WV1Dc0nekKDbI45LKyRzxN6qbduw=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/applications/version-management/gitlint/default.nix b/pkgs/applications/version-management/gitlint/default.nix
index 37783a92ab3e1..d29bf08855f07 100644
--- a/pkgs/applications/version-management/gitlint/default.nix
+++ b/pkgs/applications/version-management/gitlint/default.nix
@@ -17,8 +17,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-4SGkkC4LjZXTDXwK6jMOIKXR1qX76CasOwSqv8XUrjs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # Upstream splitted the project into gitlint and gitlint-core to
   # simplify the dependency handling
   sourceRoot = "${src.name}/gitlint-core";
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 82417f59352b1..1051dc6da886a 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -1,6 +1,8 @@
 { lib, stdenv, fetchurl, fetchpatch, python3Packages, makeWrapper, gettext, installShellFiles
 , re2Support ? true
-, rustSupport ? stdenv.hostPlatform.isLinux, cargo, rustPlatform, rustc
+# depends on rust-cpython which won't support python312
+# https://github.com/dgrunwald/rust-cpython/commit/e815555629e557be084813045ca1ddebc2f76ef9
+, rustSupport ? (stdenv.hostPlatform.isLinux && python3Packages.pythonOlder "3.12"), cargo, rustPlatform, rustc
 , fullBuild ? false
 , gitSupport ? fullBuild
 , guiSupport ? fullBuild, tk
@@ -21,11 +23,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.5.3";
+    version = "6.6.1";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-LNyB+t4SnPVrEoQXUn8ZC6cv13ZWc5TOVO7XZOZn59U=";
+      sha256 = "sha256-opRlo/5Ao+jUm6g0MTSsKrooa2g//rg42gz25FIflpU=";
     };
 
     format = "other";
@@ -35,7 +37,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-ob81zMUY4AVNIbkFKyImnj7QhHTh7LVOCcGeZDtTAXc=";
+      sha256 = "sha256-wLV0qdCfMgGpZRxnZik/lRwZHm/66p0sJn/mYVRvRkQ=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
@@ -43,7 +45,7 @@ let
     propagatedBuildInputs = lib.optional re2Support fb-re2
       ++ lib.optional gitSupport pygit2
       ++ lib.optional highlightSupport pygments;
-    nativeBuildInputs = [ makeWrapper gettext installShellFiles ]
+    nativeBuildInputs = [ makeWrapper gettext installShellFiles python3Packages.setuptools ]
       ++ lib.optionals rustSupport [
            rustPlatform.cargoSetupHook
            cargo
diff --git a/pkgs/applications/video/deface/default.nix b/pkgs/applications/video/deface/default.nix
index 8b9e822070cf1..428275535af49 100644
--- a/pkgs/applications/video/deface/default.nix
+++ b/pkgs/applications/video/deface/default.nix
@@ -42,9 +42,6 @@ python3.pkgs.buildPythonApplication rec {
     substituteInPlace pyproject.toml requirements.txt --replace "opencv-python" "opencv"
   '';
 
-  # Let setuptools know deface version
-  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
-
   pythonImportsCheck = [ "deface" "onnx" "onnxruntime" ];
 
   meta = with lib; {
diff --git a/pkgs/applications/video/frigate/default.nix b/pkgs/applications/video/frigate/default.nix
index 5414193640f0e..81798df47f27a 100644
--- a/pkgs/applications/video/frigate/default.nix
+++ b/pkgs/applications/video/frigate/default.nix
@@ -25,6 +25,12 @@ let
 
   python = python3.override {
     packageOverrides = self: super: {
+      pydantic = super.pydantic_1;
+
+      versioningit = super.versioningit.overridePythonAttrs {
+        # checkPhase requires pydantic>=2
+        doCheck = false;
+      };
     };
   };
 
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 483d165f947bc..54216cf73ad68 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -10,6 +10,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
   # For tests
 , testers
 , runCommand
@@ -135,6 +136,11 @@ let
       "${src}/contrib/ffmpeg/A28-avcodec-amfenc-HDR-metadata.patch"
       # This patch is not applying since ffmpeg 5.1.1, probably it was backported by upstream
       # "${src}/contrib/ffmpeg/A30-svt-av1-backports.patch"
+      (fetchpatch {
+        name = "vulkan-remove-extensions.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/eb0455d64690";
+        hash = "sha256-qvLrb7b+9/bel8A2lZuSmBiJtHXsABw0Lvgn1ggnmCU=";
+      })
     ];
   });
 
diff --git a/pkgs/applications/video/obs-studio/default.nix b/pkgs/applications/video/obs-studio/default.nix
index dad21756b24ca..e530a0e0c5427 100644
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -2,10 +2,11 @@
 , lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , addOpenGLRunpath
 , cmake
 , fdk_aac
-, ffmpeg_4
+, ffmpeg
 , jansson
 , libjack2
 , libxkbcommon
@@ -74,6 +75,25 @@ stdenv.mkDerivation (finalAttrs: {
     # Lets obs-browser build against CEF 90.1.0+
     ./Enable-file-access-and-universal-access-for-file-URL.patch
     ./fix-nix-plugin-path.patch
+
+    # Backport ffmpeg 6.1 / GCC 13 build fixes
+    # FIXME: remove in next release
+    (fetchpatch {
+      url = "https://github.com/obsproject/obs-studio/commit/cd784644f5e82b9988043f229c19603289c6d32c.patch";
+      hash = "sha256-S4JE5kgr4x3uMHY2GRh0GBJpb7o/wYZb/v0CDITFNnQ=";
+    })
+    (fetchpatch {
+      url = "https://github.com/obsproject/obs-studio/commit/758b47d4ed9a25b8d64ad481d8d039990b9e57c9.patch";
+      hash = "sha256-jYpjwhx6e+dhN3kzbd6FcdjQ+WhIX0/BOu9PSkt+2yI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/obsproject/obs-studio/commit/4b5be75c7e4b8cee908ed4a02fe0078285b4e8c9.patch";
+      hash = "sha256-tuOevhyxchwG42ilrplbiWoiDAKaY4HgzShlvp4VSQI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/obsproject/obs-studio/commit/6e080a68067b27fe5463f0f4eee7df690451f3d7.patch";
+      hash = "sha256-nbn/q3uszoHaDvaW8Et1MS1sgQzMsJRmjGSMHzUxV70=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -87,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     curl
-    ffmpeg_4
+    ffmpeg
     jansson
     libcef
     libjack2
diff --git a/pkgs/applications/virtualization/kvmtool/default.nix b/pkgs/applications/virtualization/kvmtool/default.nix
index 9aeb21e3f06a9..f546c32042e32 100644
--- a/pkgs/applications/virtualization/kvmtool/default.nix
+++ b/pkgs/applications/virtualization/kvmtool/default.nix
@@ -1,13 +1,12 @@
-{ stdenv, fetchgit, lib, dtc }:
+{ stdenv, fetchzip, lib, dtc }:
 
 stdenv.mkDerivation {
   pname = "kvmtool";
   version = "unstable-2023-07-12";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git";
-    rev = "106e2ea7756d980454d68631b87d5e25ba4e4881";
-    sha256 = "sha256-wpc5DfHnui0lBVH4uOq6a7pXVUZStjNLRvauu6QpRvE=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git/snapshot/kvmtool-106e2ea7756d980454d68631b87d5e25ba4e4881.tar.gz";
+    hash = "sha256-wpc5DfHnui0lBVH4uOq6a7pXVUZStjNLRvauu6QpRvE=";
   };
 
   patches = [ ./strlcpy-glibc-2.38-fix.patch ];
diff --git a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
index 286a521be0541..1a36aa8fd6c05 100644
--- a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
+++ b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
@@ -1,8 +1,6 @@
 { lib
 , fetchFromGitHub
 , hostPlatform
-, cargo
-, rustc
 , lld
 }:
 
@@ -24,12 +22,7 @@ let
     };
   };
 
-  # inherit (cross) rustPlatform;
-  # ^ breaks because we are doing a no_std embedded build with a custom sysroot,
-  # but the fast_cross rustc wrapper already passes a sysroot argument
-  rustPlatform = cross.makeRustPlatform {
-    inherit rustc cargo;
-  };
+  inherit (cross) rustPlatform;
 
 in
 
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 525b44fe04800..5b185b09a4c54 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -33,6 +33,28 @@
 , useMacosReexportHack ? false
 , wrapGas ? false
 
+# Note: the hardening flags are part of the bintools-wrapper, rather than
+# the cc-wrapper, because a few of them are handled by the linker.
+, defaultHardeningFlags ? with stdenvNoCC; [
+    "bindnow"
+    "format"
+    "fortify"
+    "fortify3"
+    "pic"
+    "relro"
+    "stackprotector"
+    "strictoverflow"
+  ] ++ lib.optional (
+    # Musl-based platforms will keep "pie", other platforms will not.
+    # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
+    # in the nixpkgs manual to inform users about the defaults.
+    targetPlatform.libc == "musl"
+    # Except when:
+    #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
+    #    - static armv7l, where compilation fails.
+    && !(targetPlatform.isAarch && targetPlatform.isStatic)
+  ) "pie"
+
 # Darwin code signing support utilities
 , postLinkSignHook ? null, signingUtils ? null
 }:
@@ -124,6 +146,8 @@ stdenv.mkDerivation {
             (setenv "NIX_LDFLAGS_${suffixSalt}" (concat (getenv "NIX_LDFLAGS_${suffixSalt}") " -L" arg "/lib64"))))
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
+
+    inherit defaultHardeningFlags;
   };
 
   dontBuild = true;
@@ -380,6 +404,7 @@ stdenv.mkDerivation {
     wrapperName = "BINTOOLS_WRAPPER";
     inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
     inherit bintools_bin libc_bin libc_dev libc_lib;
+    default_hardening_flags_str = builtins.toString defaultHardeningFlags;
   };
 
   meta =
diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index 7e9547b96c259..c146cbea80e4f 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -65,7 +65,7 @@ do
 done
 
 # If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
+: ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 8cd63e4609518..2eae278da1604 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format)
+  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 539c29a0a7743..56075a032971c 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -218,6 +218,8 @@ let
        then guess
        else null;
 
+  defaultHardeningFlags = bintools.defaultHardeningFlags or [];
+
   darwinPlatformForCC = optionalString stdenv.targetPlatform.isDarwin (
     if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx"
     else targetPlatform.darwinPlatform
@@ -271,6 +273,8 @@ stdenv.mkDerivation {
     inherit expand-response-params;
 
     inherit nixSupport;
+
+    inherit defaultHardeningFlags;
   };
 
   dontBuild = true;
@@ -706,6 +710,7 @@ stdenv.mkDerivation {
     inherit suffixSalt coreutils_bin bintools;
     inherit libc_bin libc_dev libc_lib;
     inherit darwinPlatformForCC darwinMinVersion darwinMinVersionVariable;
+    default_hardening_flags_str = builtins.toString defaultHardeningFlags;
   };
 
   meta =
diff --git a/pkgs/build-support/cc-wrapper/fortran-hook.sh b/pkgs/build-support/cc-wrapper/fortran-hook.sh
index d72f314c01ce6..02da7fd0dc34c 100644
--- a/pkgs/build-support/cc-wrapper/fortran-hook.sh
+++ b/pkgs/build-support/cc-wrapper/fortran-hook.sh
@@ -4,8 +4,7 @@ getTargetRoleWrapper
 export FC${role_post}=@named_fc@
 
 # If unset, assume the default hardening flags.
-# These are different for fortran.
-: ${NIX_HARDENING_ENABLE="stackprotector pic strictoverflow relro bindnow"}
+: ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
 export NIX_HARDENING_ENABLE
 
 unset -v role_post
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 9326d76e2a8ff..33a2b62a49b00 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -111,7 +111,7 @@ export CC${role_post}=@named_cc@
 export CXX${role_post}=@named_cxx@
 
 # If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify fortify3 stackprotector pic strictoverflow format relro bindnow"}
+: ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
diff --git a/pkgs/build-support/emacs/melpa.nix b/pkgs/build-support/emacs/melpa.nix
index 178f532d08712..323c6e65d9d90 100644
--- a/pkgs/build-support/emacs/melpa.nix
+++ b/pkgs/build-support/emacs/melpa.nix
@@ -11,8 +11,8 @@ let
     src = fetchFromGitHub {
       owner = "melpa";
       repo = "package-build";
-      rev = "c3c535e93d9dc92acd21ebc4b15016b5c3b90e7d";
-      sha256 = "17z0wbqdd6fspbj43yq8biff6wfggk74xgnaf1xx6ynsp1i74is5";
+      rev = "c48aa078c01b4f07b804270c4583a0a58ffea1c0";
+      sha256 = "sha256-MzPj375upIiYXdQR+wWXv3A1zMqbSrZlH0taLuxx/1M=";
     };
 
     patches = [ ./package-build-dont-use-mtime.patch ];
diff --git a/pkgs/build-support/emacs/melpa2nix.el b/pkgs/build-support/emacs/melpa2nix.el
index 72667dea652c1..3de77dbf5e5c6 100644
--- a/pkgs/build-support/emacs/melpa2nix.el
+++ b/pkgs/build-support/emacs/melpa2nix.el
@@ -11,22 +11,22 @@
 ;; Allow installing package tarfiles larger than 10MB
 (setq large-file-warning-threshold nil)
 
-(defun melpa2nix-build-package-1 (rcp version commit)
-  (let ((source-dir (package-recipe--working-tree rcp)))
+(defun melpa2nix-build-package-1 (rcp)
+  (let* ((default-directory (package-recipe--working-tree rcp)))
     (unwind-protect
         (let ((files (package-build-expand-files-spec rcp t)))
-          (cond
-           ((= (length files) 1)
-            (package-build--build-single-file-package
-             rcp version commit files source-dir))
-           ((> (length files) 1)
-            (package-build--build-multi-file-package
-             rcp version commit files source-dir))
-           (t (error "Unable to find files matching recipe patterns")))))))
+          (unless files
+            (error "Unable to find files matching recipe patterns"))
+          (if (> (length files) 1)
+              (package-build--build-multi-file-package rcp files)
+            (package-build--build-single-file-package rcp files))))))
 
 (defun melpa2nix-build-package ()
-  (if (not noninteractive)
-      (error "`melpa2nix-build-package' is to be used only with -batch"))
+  (unless noninteractive
+    (error "`melpa2nix-build-package' is to be used only with -batch"))
   (pcase command-line-args-left
     (`(,package ,version ,commit)
-     (melpa2nix-build-package-1 (package-recipe-lookup package) version commit))))
+     (let ((recipe (package-recipe-lookup package)))
+       (setf (oref recipe commit) commit)
+       (setf (oref recipe version) version)
+       (melpa2nix-build-package-1 recipe)))))
diff --git a/pkgs/build-support/emacs/package-build-dont-use-mtime.patch b/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
index fe94de57a3002..1ace7771ea3ac 100644
--- a/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
+++ b/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
@@ -1,40 +1,21 @@
 diff --git a/package-build.el b/package-build.el
-index e572045..9eb0f82 100644
+index 29cdb61..c19be1b 100644
 --- a/package-build.el
 +++ b/package-build.el
-@@ -415,7 +415,7 @@ (defun package-build--write-pkg-file (desc dir)
-       (princ ";; Local Variables:\n;; no-byte-compile: t\n;; End:\n"
-              (current-buffer)))))
- 
--(defun package-build--create-tar (name version directory mtime)
-+(defun package-build--create-tar (name version directory)
-   "Create a tar file containing the contents of VERSION of package NAME.
- DIRECTORY is a temporary directory that contains the directory
- that is put in the tarball.  MTIME is used as the modification
-@@ -434,7 +434,7 @@ (defun package-build--create-tar (name version directory mtime)
-        ;; prevent a reproducable tarball as described at
+@@ -923,7 +923,6 @@ DIRECTORY is a temporary directory that contains the directory
+ that is put in the tarball."
+   (let* ((name (oref rcp name))
+          (version (oref rcp version))
+-         (time (oref rcp time))
+          (tar (expand-file-name (concat name "-" version ".tar")
+                                 package-build-archive-dir))
+          (dir (concat name "-" version)))
+@@ -939,7 +938,7 @@ that is put in the tarball."
+        ;; prevent a reproducible tarball as described at
         ;; https://reproducible-builds.org/docs/archives.
         "--sort=name"
--       (format "--mtime=@%d" mtime)
+-       (format "--mtime=@%d" time)
 +       "--mtime=@0"
         "--owner=0" "--group=0" "--numeric-owner"
         "--pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime"))
      (when (and package-build-verbose noninteractive)
-@@ -848,12 +848,11 @@ (defun package-build--build-multi-file-package (rcp version commit files source-
-                            (package-build--desc-from-library
-                             name version commit files 'tar)
-                            (error "%s[-pkg].el matching package name is missing"
--                                  name))))
--               (mtime (package-build--get-commit-time rcp commit)))
-+                                  name)))))
-           (package-build--copy-package-files files source-dir target)
-           (package-build--write-pkg-file desc target)
-           (package-build--generate-info-files files source-dir target)
--          (package-build--create-tar name version tmp-dir mtime)
-+          (package-build--create-tar name version tmp-dir)
-           (package-build--write-pkg-readme name files source-dir)
-           (package-build--write-archive-entry desc))
-       (delete-directory tmp-dir t nil))))
--- 
-2.37.2
-
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 2546b8e6dc99c..af0468b3e4944 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -125,6 +125,7 @@
 
   # Mirrors from https://download.kde.org/ls-lR.mirrorlist
   kde = [
+    "https://cdn.download.kde.org/"
     "https://download.kde.org/download.php?url="
     "https://ftp.gwdg.de/pub/linux/kde/"
     "https://mirrors.ocf.berkeley.edu/kde/"
diff --git a/pkgs/build-support/rust/hooks/maturin-build-hook.sh b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
index d5ff069290ba5..028441d18160e 100644
--- a/pkgs/build-support/rust/hooks/maturin-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
@@ -25,7 +25,7 @@ maturinBuildHook() {
 
     # Move the wheel to dist/ so that regular Python tooling can find it.
     mkdir -p dist
-    mv target/wheels/*.whl dist/
+    mv ${cargoRoot:+$cargoRoot/}target/wheels/*.whl dist/
 
     # These are python build hooks and may depend on ./dist
     runHook postBuild
diff --git a/pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh b/pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh
index a62e35b8736f7..2082f3126a538 100644
--- a/pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh
+++ b/pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh
@@ -1,6 +1,19 @@
 #!@shell@
 
-extraBefore=(@sysroot@)
+defaultSysroot=(@sysroot@)
+
+for arg; do
+    case "$arg" in
+        --sysroot)
+            defaultSysroot=()
+            ;;
+        --)
+            break
+            ;;
+    esac
+done
+
+extraBefore=("${defaultSysroot[@]}")
 extraAfter=($NIX_RUSTFLAGS)
 
 # Optionally print debug info.
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 371389df427bc..9f6366b3feaed 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -53,17 +53,30 @@ autoPatchelf() {
         esac
     done
 
-    readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
-    if [ "$autoPatchelfIgnoreMissingDeps" == "1" ]; then
-        echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
-             "= true;' is deprecated and will be removed in a future release." \
-             "Use 'autoPatchelfIgnoreMissingDeps = [ \"*\" ];' instead." >&2
-        ignoreMissingDepsArray=( "*" )
+    if [ -n "$__structuredAttrs" ]; then
+        local ignoreMissingDepsArray=( "${autoPatchelfIgnoreMissingDeps[@]}" )
+        local appendRunpathsArray=( "${appendRunpaths[@]}" )
+        local runtimeDependenciesArray=( "${runtimeDependencies[@]}" )
+        local patchelfFlagsArray=( "${patchelfFlags[@]}" )
+    else
+        readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
+        local appendRunpathsArray=($appendRunpaths)
+        local runtimeDependenciesArray=($runtimeDependencies)
+        local patchelfFlagsArray=($patchelfFlags)
     fi
 
-    local appendRunpathsArray=($appendRunpaths)
-    local runtimeDependenciesArray=($runtimeDependencies)
-    local patchelfFlagsArray=($patchelfFlags)
+    # Check if ignoreMissingDepsArray contains "1" and if so, replace it with
+    # "*", printing a deprecation warning.
+    for dep in "${ignoreMissingDepsArray[@]}"; do
+        if [ "$dep" == "1" ]; then
+            echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
+                 "= true;' is deprecated and will be removed in a future release." \
+                 "Use 'autoPatchelfIgnoreMissingDeps = [ \"*\" ];' instead." >&2
+            ignoreMissingDepsArray=( "*" )
+            break
+        fi
+    done
+
     @pythonInterpreter@ @autoPatchelfScript@                            \
         ${norecurse:+--no-recurse}                                      \
         --ignore-missing "${ignoreMissingDepsArray[@]}"                 \
diff --git a/pkgs/by-name/ai/airlift/package.nix b/pkgs/by-name/ai/airlift/package.nix
index 81ac5acc2efad..9ab35cc2a4622 100644
--- a/pkgs/by-name/ai/airlift/package.nix
+++ b/pkgs/by-name/ai/airlift/package.nix
@@ -1,7 +1,6 @@
 { lib
 , python3
 , fetchPypi
-, argparse
 , kubernetes-helm
 , kind
 , docker
@@ -17,16 +16,22 @@ python3.pkgs.buildPythonApplication rec {
     inherit pname version;
     hash = "sha256-1LE3fpfX4NExJdUdSjt4BXvxQTLJ8zrRkGHkxo/6Pb8=";
   };
+
+  postPatch = ''
+    sed -i '/argparse/d' pyproject.toml
+  '';
+
+   nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
   buildInputs = [
     kubernetes-helm
     kind
     docker
   ];
-  nativeBuildInputs = [
-    python3.pkgs.poetry-core
-  ];
+
   propagatedBuildInputs = with python3.pkgs; [
-    argparse
     halo
     pyyaml
     hiyapyco
diff --git a/pkgs/by-name/bi/bitbake-language-server/package.nix b/pkgs/by-name/bi/bitbake-language-server/package.nix
index 4847f3464b0d9..97cc8a63fc66c 100644
--- a/pkgs/by-name/bi/bitbake-language-server/package.nix
+++ b/pkgs/by-name/bi/bitbake-language-server/package.nix
@@ -26,8 +26,6 @@ python3.pkgs.buildPythonApplication rec {
     pygls
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index cc69b4de4ad27..51db582b68f2a 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -138,8 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     "CFLAGS=-D_FILE_OFFSET_BITS=64"
     "CXXFLAGS=-D_FILE_OFFSET_BITS=64"
   ]
-  # Workaround missing atomic ops with gcc <13
-  ++ lib.optional stdenv.hostPlatform.isRiscV "LDFLAGS=-latomic"
   ++ [
     "--"
     # We should set the proper `CMAKE_SYSTEM_NAME`.
diff --git a/pkgs/by-name/ho/homeassistant-satellite/package.nix b/pkgs/by-name/ho/homeassistant-satellite/package.nix
index 26f90237f5218..c5a6026d8ec37 100644
--- a/pkgs/by-name/ho/homeassistant-satellite/package.nix
+++ b/pkgs/by-name/ho/homeassistant-satellite/package.nix
@@ -16,8 +16,12 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
     setuptools
-    wheel
+  ];
+
+  pythonRelaxDeps = [
+    "aiohttp"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch b/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
new file mode 100644
index 0000000000000..aea0348f4b638
--- /dev/null
+++ b/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
@@ -0,0 +1,27 @@
+From a908a574daf8bac10bb2a0ee3771052d2167a85f Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Sun, 3 Dec 2023 15:41:20 -0500
+Subject: [PATCH] Fix test failure on Darwin on a case-sensitive fs
+
+This was encountered while looking into an issue with
+https://github.com/NixOS/nixpkgs/pull/268583.
+
+I run my Nix store on case-sensitive APFS, so the test fails due to
+trying to link `-framework ldap` instead of `-framework LDAP`.
+---
+ test cases/osx/5 extra frameworks/meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/test cases/osx/5 extra frameworks/meson.build b/test cases/osx/5 extra frameworks/meson.build
+index f6c01e63a1bd..96532846c632 100644
+--- a/test cases/osx/5 extra frameworks/meson.build	
++++ b/test cases/osx/5 extra frameworks/meson.build	
+@@ -7,7 +7,7 @@ dep_main = dependency('Foundation')
+ assert(dep_main.type_name() == 'extraframeworks', 'type_name is ' + dep_main.type_name())
+ 
+ # https://github.com/mesonbuild/meson/issues/10002
+-ldap_dep = dependency('ldap', method : 'extraframework')
++ldap_dep = dependency('LDAP', method : 'extraframework')
+ assert(ldap_dep.type_name() == 'extraframeworks', 'type_name is ' + ldap_dep.type_name())
+ 
+ stlib = static_library('stat', 'stat.c', install : true, dependencies: [opengl_dep, ldap_dep])
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 6239927848aa5..86ac76ffafbb6 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , installShellFiles
 , coreutils
 , darwin
 , libxcrypt
+, openldap
 , ninja
 , pkg-config
 , python3
@@ -14,17 +14,17 @@
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation OpenGL;
+  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation LDAP OpenGL;
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.2.3";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-dgYYz3tQDG6Z4eE77WO2dXdardxVzzGaFLQ5znPcTlw=";
+    hash = "sha256-Jt3PWnbv/8P6Rvf3E/Yli2vdtfgx3CmsW+jlc9CK5KA=";
   };
 
   patches = [
@@ -66,15 +66,8 @@ python3.pkgs.buildPythonApplication rec {
     # Nixpkgs cctools does not have bitcode support.
     ./006-disable-bitcode.patch
 
-    # Fix passing multiple --define-variable arguments to pkg-config.
-    # https://github.com/mesonbuild/meson/pull/10670
-    (fetchpatch {
-      url = "https://github.com/mesonbuild/meson/commit/d5252c5d4cf1c1931fef0c1c98dd66c000891d21.patch";
-      hash = "sha256-GiUNVul1N5Fl8mfqM7vA/r1FdKqImiDYLXMVDt77gvw=";
-      excludes = [
-        "docs/yaml/objects/dep.yaml"
-      ];
-    })
+    # https://github.com/mesonbuild/meson/pull/12587
+    ./007-darwin-case-sensitivity.patch
   ];
 
   buildInputs = lib.optionals (python3.pythonOlder "3.9") [
@@ -95,7 +88,9 @@ python3.pkgs.buildPythonApplication rec {
     AppKit
     Cocoa
     Foundation
+    LDAP
     OpenGL
+    openldap
   ];
 
   checkPhase = lib.concatStringsSep "\n" ([
diff --git a/pkgs/by-name/si/sirius/package.nix b/pkgs/by-name/si/sirius/package.nix
index ee6052cf09c16..c09b9360419ef 100644
--- a/pkgs/by-name/si/sirius/package.nix
+++ b/pkgs/by-name/si/sirius/package.nix
@@ -85,6 +85,11 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ mpi ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'uintptr_t' in namespace 'std' does not name a type
+    "-include cstdint"
+  ];
+
   cmakeFlags = [
     "-DUSE_SCALAPACK=ON"
     "-DBUILD_TESTING=ON"
diff --git a/pkgs/by-name/uc/ucode/package.nix b/pkgs/by-name/uc/ucode/package.nix
new file mode 100644
index 0000000000000..9998b24df0826
--- /dev/null
+++ b/pkgs/by-name/uc/ucode/package.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, json_c
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ucode";
+  version = "0.0.20231102";
+
+  src = fetchFromGitHub {
+    owner = "jow-";
+    repo = "ucode";
+    rev = "v${version}";
+    hash = "sha256-dJjlwuQLS73D6W/bmhWLPPaT7himQyO1RvD+MXVxBMw=";
+  };
+
+  buildInputs = [
+    json_c
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  meta = with lib; {
+    description = "JavaScript-like language with optional templating";
+    homepage = "https://github.com/jow-/ucode";
+    license = licenses.isc;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mkg20001 ];
+  };
+}
diff --git a/pkgs/by-name/ud/udebug/package.nix b/pkgs/by-name/ud/udebug/package.nix
new file mode 100644
index 0000000000000..12de722bf68d6
--- /dev/null
+++ b/pkgs/by-name/ud/udebug/package.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, cmake
+, fetchgit
+, pkg-config
+, ubus
+, libubox
+, ucode
+, json_c
+}:
+
+stdenv.mkDerivation {
+  pname = "udebug";
+  version = "unstable-2023-11-28";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/udebug.git";
+    rev = "d49aadabb7a147b99a3e6299a77d7fda4e266091";
+    hash = "sha256-5I50q+oUQ5f82ngKl7bX50J+3pBviNk3iVEChNjt5wY=";
+  };
+
+  buildInputs = [
+    ubus
+    libubox
+    ucode
+    json_c
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  meta = with lib; {
+    description = "OpenWrt debugging helper library/service";
+    homepage = "https://git.openwrt.org/?p=project/udebug.git;a=summary";
+    license = licenses.free;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mkg20001 ];
+  };
+}
diff --git a/pkgs/by-name/we/websecprobe/package.nix b/pkgs/by-name/we/websecprobe/package.nix
index fb81063526cf1..544d56f0114be 100644
--- a/pkgs/by-name/we/websecprobe/package.nix
+++ b/pkgs/by-name/we/websecprobe/package.nix
@@ -5,18 +5,17 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "websecprobe";
-  version = "0.0.10";
+  version = "0.0.11";
   pyproject = true;
 
   src = fetchPypi {
     pname = "WebSecProbe";
     inherit version;
-    hash = "sha256-QvXOyQUptMyim/bgvhihjgGs7vX0qX8MqK2ol8q9ePc=";
+    hash = "sha256-OKbKz3HSTtwyx/JNUtLJBTaHQcxkUWroMg9/msVWgk4=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
     setuptools
-    wheel
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index f04005af7452b..b90a560045bbf 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2023c";
+  version = "2023d";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-P1ELXRtK6bs45IWqMCp3azF/s2N722QExK33tsrdllw=";
+      hash = "sha256-28ohlwsKi4wM7O7B17kfqQO+D27KWucytTKWciMqCPM=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-RtF/K7Ga1zKQ8DogMAYVLg+g17EeW3FGfEqCOBGyFOc=";
+      hash = "sha256-6aX54RiIbS3pK2K7BVEKKMxsBY15HJO9a4TTKSw8Fh4=";
     })
   ];
 
diff --git a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
index ab05d40677ec7..be7896f6b11a5 100644
--- a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
@@ -9,7 +9,6 @@
 , itstool
 , desktop-file-utils
 , vala
-, gobject-introspection
 , libxml2
 , gtk4
 , glib
@@ -43,7 +42,6 @@ stdenv.mkDerivation rec {
     wrapGAppsHook4
     desktop-file-utils
     libxml2
-    gobject-introspection # for finding vapi files
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/apps/seahorse/default.nix b/pkgs/desktops/gnome/apps/seahorse/default.nix
index bbab612b9c8d8..1207d79696107 100644
--- a/pkgs/desktops/gnome/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome/apps/seahorse/default.nix
@@ -57,10 +57,6 @@ stdenv.mkDerivation rec {
     gnupg
     desktop-file-utils
     gcr
-    # error: Package `...' not found in specified Vala API directories or GObject-Introspection GIR directories
-    # TODO: the vala setuphook should look for vala filess in targetOffset instead of hostOffset
-    libhandy
-    libsecret
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/baobab/default.nix b/pkgs/desktops/gnome/core/baobab/default.nix
index e813f5f591ab4..b459677a3e36f 100644
--- a/pkgs/desktops/gnome/core/baobab/default.nix
+++ b/pkgs/desktops/gnome/core/baobab/default.nix
@@ -36,10 +36,6 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     wrapGAppsHook4
-    # Prevents “error: Package `libadwaita-1' not found in specified Vala API
-    # directories or GObject-Introspection GIR directories” with strictDeps,
-    # even though it should only be a runtime dependency.
-    libadwaita
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-calculator/default.nix b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
index 73863ccfaf337..0ea86b7b45118 100644
--- a/pkgs/desktops/gnome/core/gnome-calculator/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
@@ -12,7 +12,6 @@
 , glib
 , gtksourceview5
 , wrapGAppsHook4
-, gobject-introspection
 , gnome
 , mpfr
 , gmp
@@ -40,7 +39,6 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     wrapGAppsHook4
-    gobject-introspection # for finding vapi files
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/games/gnome-mines/default.nix b/pkgs/desktops/gnome/games/gnome-mines/default.nix
index dd214f38071f8..4640c5842493b 100644
--- a/pkgs/desktops/gnome/games/gnome-mines/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-mines/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, meson, ninja, vala, gobject-introspection, pkg-config, gnome, gtk3, wrapGAppsHook
+{ lib, stdenv, fetchurl, meson, ninja, vala, pkg-config, gnome, gtk3, wrapGAppsHook
 , librsvg, gettext, itstool, python3, libxml2, libgnome-games-support, libgee, desktop-file-utils }:
 
 stdenv.mkDerivation rec {
@@ -10,9 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "NQLps/ccs7LnEcDmAZGH/rzCvKh349RW3KtwD3vjEnI=";
   };
 
-  # gobject-introspection for finding vapi files
   nativeBuildInputs = [
-    meson ninja vala gobject-introspection pkg-config gettext itstool python3
+    meson ninja vala pkg-config gettext itstool python3
     libxml2 wrapGAppsHook desktop-file-utils
   ];
   buildInputs = [ gtk3 librsvg gnome.adwaita-icon-theme libgnome-games-support libgee ];
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index bb933eac9af00..bd59b66f51fac 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -13,13 +13,20 @@ stdenv.mkDerivation rec {
     hash = "sha256-gMwbWiP+YDCVafQMBWhTuJGWmkYtnhEdn/oofKaUT08=";
   };
 
-  # Fix build with Node 20
   # FIXME: remove for next release
   patches = [
     (fetchpatch {
+      name = "nodejs-20.patch";
       url = "https://github.com/WebAssembly/binaryen/commit/889422e0c92552ff484659f9b41e777ba7ab35c1.patch";
       hash = "sha256-acM8mytL9nhm4np9tpUbd1X0wJ7y308HV2fvgcAW1lY=";
     })
+
+    # Fix fmin tests on gcc-13: https://github.com/WebAssembly/binaryen/pull/5994
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/WebAssembly/binaryen/commit/1e17dfb695a19d5d41f1f88411fbcbc5f2408c8f.patch";
+      hash = "sha256-5JZh15CXkg5XdTG8eRJXPwO+zmymYeFjKbHutRPTmlU=";
+    })
   ];
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/compilers/blueprint/default.nix b/pkgs/development/compilers/blueprint/default.nix
index 99b275db2aa6a..f52b43f49a82a 100644
--- a/pkgs/development/compilers/blueprint/default.nix
+++ b/pkgs/development/compilers/blueprint/default.nix
@@ -45,7 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # requires xvfb-run
-  doCheck = !stdenv.isDarwin;
+  doCheck = !stdenv.isDarwin
+  && false;  # tests time out
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index d9013895becc2..adc3ed7aaac89 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchgit
+, fetchzip
 , fetchpatch
 , meson
 , ninja
@@ -18,9 +18,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "dtc";
   version = "1.7.0";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/utils/dtc/dtc.git";
-    rev = "refs/tags/v${finalAttrs.version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/dtc/dtc.git/snapshot/dtc-v${finalAttrs.version}.tar.gz";
     sha256 = "sha256-FMh3VvlY3fUK8fbd0M+aCmlUrmG9YegiOOQ7MOByffc=";
   };
 
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index eef6faf26424e..e0ca04a138787 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -406,8 +406,9 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
   passthru = {
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
     isGNU = true;
-  } // lib.optionalAttrs (!atLeast12) {
-    hardeningUnsupportedFlags = lib.optionals is48 [ "stackprotector" ] ++ [ "fortify3" ];
+    hardeningUnsupportedFlags = lib.optional is48 "stackprotector"
+      ++ lib.optional (!atLeast12) "fortify3"
+      ++ lib.optionals (langFortran) [ "fortify" "format" ];
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/ghc/8.10.2-binary.nix b/pkgs/development/compilers/ghc/8.10.2-binary.nix
index d04e85777775e..c8d645cfa361a 100644
--- a/pkgs/development/compilers/ghc/8.10.2-binary.nix
+++ b/pkgs/development/compilers/ghc/8.10.2-binary.nix
@@ -252,6 +252,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     # Note [musl bindists have no .buildinfo]
diff --git a/pkgs/development/compilers/ghc/8.10.7-binary.nix b/pkgs/development/compilers/ghc/8.10.7-binary.nix
index f373d963ed285..3376671d65b41 100644
--- a/pkgs/development/compilers/ghc/8.10.7-binary.nix
+++ b/pkgs/development/compilers/ghc/8.10.7-binary.nix
@@ -250,6 +250,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     # Note that musl bindists do not contain them,
diff --git a/pkgs/development/compilers/ghc/8.6.5-binary.nix b/pkgs/development/compilers/ghc/8.6.5-binary.nix
index 58e61604cd61a..5f9d6c824d428 100644
--- a/pkgs/development/compilers/ghc/8.6.5-binary.nix
+++ b/pkgs/development/compilers/ghc/8.6.5-binary.nix
@@ -102,6 +102,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
 
     # We have to patch the GMP paths for the integer-gmp package.
diff --git a/pkgs/development/compilers/ghc/9.2.4-binary.nix b/pkgs/development/compilers/ghc/9.2.4-binary.nix
index 909d090c17040..77d70d2950707 100644
--- a/pkgs/development/compilers/ghc/9.2.4-binary.nix
+++ b/pkgs/development/compilers/ghc/9.2.4-binary.nix
@@ -236,6 +236,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     ''
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index 0f75d09098be7..ff55201ebd03f 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -26,9 +26,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake python3 bison jq ];
 
-  # Workaround missing atomic ops with gcc <13
-  env.LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
-
   postPatch = ''
     cp --no-preserve=mode -r "${spirv-tools.src}" External/spirv-tools
     ln -s "${spirv-headers.src}" External/spirv-tools/external/spirv-headers
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index a4fe7199e080d..0e61930f1c0e7 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -50,7 +50,7 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index 7ecd4efc08378..c46776d38ac3d 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -47,7 +47,7 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index a070e64c7ddd9..6604ae0efc3f1 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -43,7 +43,7 @@ let
       ./revert-malloc-alignment-assumption.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/14/clang/default.nix b/pkgs/development/compilers/llvm/14/clang/default.nix
index 976ff7580ac31..9f0da7a9f46cb 100644
--- a/pkgs/development/compilers/llvm/14/clang/default.nix
+++ b/pkgs/development/compilers/llvm/14/clang/default.nix
@@ -46,7 +46,7 @@ let
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/15/clang/default.nix b/pkgs/development/compilers/llvm/15/clang/default.nix
index 894db1a4975f6..c49d6368cb97c 100644
--- a/pkgs/development/compilers/llvm/15/clang/default.nix
+++ b/pkgs/development/compilers/llvm/15/clang/default.nix
@@ -52,7 +52,7 @@ let
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/16/clang/default.nix b/pkgs/development/compilers/llvm/16/clang/default.nix
index b801bdda52923..5f28e810f603f 100644
--- a/pkgs/development/compilers/llvm/16/clang/default.nix
+++ b/pkgs/development/compilers/llvm/16/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -51,11 +51,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index 9994076bbdab7..a6faf9fd635d4 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -325,7 +325,8 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
+    # For LLVMgold plugin
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/17/clang/default.nix b/pkgs/development/compilers/llvm/17/clang/default.nix
index a576c07d36617..3184437830a20 100644
--- a/pkgs/development/compilers/llvm/17/clang/default.nix
+++ b/pkgs/development/compilers/llvm/17/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -52,11 +52,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/17/llvm/default.nix b/pkgs/development/compilers/llvm/17/llvm/default.nix
index 3d05837d45da5..b38fef333135e 100644
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/17/llvm/default.nix
@@ -8,8 +8,7 @@
 , python3
 , python3Packages
 , libffi
-# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
-, enableGoldPlugin ? false
+, enableGoldPlugin ? true
 , libbfd
 , libpfm
 , libxml2
@@ -66,8 +65,8 @@ let
   else python3;
 
 in
-  assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
-  stdenv.mkDerivation (rec {
+
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -325,7 +324,8 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
+    # For LLVMgold plugin
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/clang-11-12-LLVMgold-path.patch b/pkgs/development/compilers/llvm/clang-11-15-LLVMgold-path.patch
index 8f8991976f33c..8f8991976f33c 100644
--- a/pkgs/development/compilers/llvm/clang-11-12-LLVMgold-path.patch
+++ b/pkgs/development/compilers/llvm/clang-11-15-LLVMgold-path.patch
diff --git a/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch b/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch
new file mode 100644
index 0000000000000..74cdbacc8a717
--- /dev/null
+++ b/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch
@@ -0,0 +1,14 @@
+diff --git a/lib/Driver/ToolChains/CommonArgs.cpp b/lib/Driver/ToolChains/CommonArgs.cpp
+index 34640b3c450d..93c4a4f4ec5c 100644
+--- a/lib/Driver/ToolChains/CommonArgs.cpp
++++ b/lib/Driver/ToolChains/CommonArgs.cpp
+@@ -589,8 +589,7 @@ void tools::addLTOOptions(const ToolChain &ToolChain, const ArgList &Args,
+ #endif
+ 
+     SmallString<1024> Plugin;
+-    llvm::sys::path::native(Twine(D.Dir) +
+-                                "/../" CLANG_INSTALL_LIBDIR_BASENAME +
++    llvm::sys::path::native(Twine("@libllvmLibdir@") +
+                                 PluginName + Suffix,
+                             Plugin);
+     CmdArgs.push_back(Args.MakeArgString(Twine(PluginPrefix) + Plugin));
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index b193ebba3d6d1..d8fe08569f3f7 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -52,11 +52,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 3d05837d45da5..36edfee8a091a 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -8,8 +8,7 @@
 , python3
 , python3Packages
 , libffi
-# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
-, enableGoldPlugin ? false
+, enableGoldPlugin ? true
 , libbfd
 , libpfm
 , libxml2
@@ -66,8 +65,8 @@ let
   else python3;
 
 in
-  assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
-  stdenv.mkDerivation (rec {
+
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -325,7 +324,7 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/rust/1_74.nix b/pkgs/development/compilers/rust/1_74.nix
deleted file mode 100644
index 163c64c249b7e..0000000000000
--- a/pkgs/development/compilers/rust/1_74.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, targetPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, wrapRustcWith
-, llvmPackages_16, llvm_16
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.74.0";
-  rustcSha256 = "sha256-iCtYS8Mhxdz+d82qafJ3kGuTYlXveAj81cdJKSXPEEk=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-
-  # For use at runtime
-  llvmShared = llvm_16.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_16;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.73.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "6a088acbbda734d27e8b431499f1d746de7781673b88fead3aeae072be1d1a5a";
-    x86_64-unknown-linux-gnu = "aa4cf0b7e66a9f5b7c623d4b340bb1ac2864a5f2c2b981f39f796245dc84f2cb";
-    x86_64-unknown-linux-musl = "c888457d106ccd40288ca8db1cb966b23d719c9a128daca701ecc574c53773d4";
-    arm-unknown-linux-gnueabihf = "9c29bb42786aedbb16ea71564eb06068a8b01cca6c6b8857f0c37f91dfba7134";
-    armv7-unknown-linux-gnueabihf = "092b32b82c602c18279d76d9a96763e85030aa62cda64c1bc73fc1f6355bb99c";
-    aarch64-unknown-linux-gnu = "e54d7d886ba413ae573151f668e76ea537f9a44406d3d29598269a4a536d12f6";
-    aarch64-unknown-linux-musl = "f4e9ff895aa55558777585ad4debe2ccf3c0298cb5d65db67814f62428de4a5b";
-    x86_64-apple-darwin = "ece9646bb153d4bc0f7f1443989de0cbcd8989a7d0bf3b7fb9956e1223954f0c";
-    aarch64-apple-darwin = "9c96e4c57328fb438ee2d87aa75970ce89b4426b49780ccb3c16af0d7c617cc6";
-    powerpc64le-unknown-linux-gnu = "8fa215ee3e274fb64364e7084613bc570369488fa22cf5bc8e0fe6dc810fe2b9";
-    riscv64gc-unknown-linux-gnu = "381379a2381835428b2e7a396b3046581517356b7cc851e39e385aebd5700623";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_74;
-
-  rustcPatches = [ ];
-}
-
-(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])
diff --git a/pkgs/development/compilers/rust/1_75.nix b/pkgs/development/compilers/rust/1_75.nix
new file mode 100644
index 0000000000000..829b26cac3674
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_75.nix
@@ -0,0 +1,61 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, targetPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, wrapRustcWith
+, llvmPackages_17, llvm_17
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.75.0";
+  rustcSha256 = "sha256-W3OfRbydNB4tHFcNZdI3VZHiLC0j71uKN3EaA4arwIg=";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+
+  # For use at runtime
+  llvmShared = llvm_17.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackages = llvmPackages_17;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.74.1";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "b883b98372c91bc6aa9dc6ebb2b4e02e7dacbbc2ac1ebe55923dc37134df70a4";
+    x86_64-unknown-linux-gnu = "d206888a2a9d55113940151ba16117ce2456d7de021bab18cfcb06dc48d3157c";
+    x86_64-unknown-linux-musl = "5af3115a1f16431630f288821bd7f3be8cf7e08a7611b3c3bce3976774aa6cd2";
+    arm-unknown-linux-gnueabihf = "1dd7d835af4afe9adb7f785046c907090ace66f1c975cfe9e8886847310d8ec9";
+    armv7-unknown-linux-gnueabihf = "a5038ae004bf86eed64ef67329f7ba047bb4d188663bfd260320d53a2fed33c4";
+    aarch64-unknown-linux-gnu = "0dbdfce647f3c7d9ff00a7aa5d6dbbd7010486f803a9749cff46189f5ecb438c";
+    aarch64-unknown-linux-musl = "02674b8e4311780464313c5773d43606fbf6880d5c4512930d59b6d5d369f0de";
+    x86_64-apple-darwin = "54e1ef01d73f6031fbee36bbecd9af4209eb682dea478696e8282ca64d5792e5";
+    aarch64-apple-darwin = "af6a982cbed85807fb8e5c4ba85b8a76162b58945f4787e0a7dec32e901e8b3b";
+    powerpc64le-unknown-linux-gnu = "bb1c9f0ab1016a2817afe8f72c03f8f1787fe44d0f9999669e0c1957a08e6213";
+    riscv64gc-unknown-linux-gnu = "86561a8d630f634fdd7cb5899d40027103c907d9763a32770b7e2fd57dbd8473";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_75;
+
+  rustcPatches = [ ];
+}
+
+(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_17" "llvm_17"])
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 7fe33a4011e56..6e0afa1b8f571 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -65,6 +65,8 @@ in stdenv.mkDerivation (finalAttrs: {
   # Increase codegen units to introduce parallelism within the compiler.
   RUSTFLAGS = "-Ccodegen-units=10";
 
+  RUSTDOCFLAGS = "-A rustdoc::broken-intra-doc-links";
+
   # We need rust to build rust. If we don't provide it, configure will try to download it.
   # Reference: https://github.com/rust-lang/rust/blob/master/src/bootstrap/configure.py
   configureFlags = let
@@ -100,6 +102,10 @@ in stdenv.mkDerivation (finalAttrs: {
     "--target=${concatStringsSep "," ([
       stdenv.targetPlatform.rust.rustcTargetSpec
 
+    # Other targets that don't need any extra dependencies to build.
+    ] ++ optionals (!fastCross) [
+      "wasm32-unknown-unknown"
+
     # (build!=target): When cross-building a compiler we need to add
     # the build platform as well so rustc can compile build.rs
     # scripts.
@@ -201,7 +207,7 @@ in stdenv.mkDerivation (finalAttrs: {
     # to do this when rustc's target platform is dynamically linked musl.
     #
     # [1]: https://github.com/rust-lang/compiler-team/issues/422
-    substituteInPlace compiler/rustc_target/src/spec/linux_musl_base.rs \
+    substituteInPlace compiler/rustc_target/src/spec/base/linux_musl.rs \
         --replace "base.crt_static_default = true" "base.crt_static_default = false"
   '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
     # See https://github.com/jemalloc/jemalloc/issues/1997
diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index f19501a6d7d82..4db3b93217d7f 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -7,6 +7,7 @@
 , llvm
 , spirv-headers
 , spirv-tools
+, disable-warnings-if-gcc13
 }:
 
 let
@@ -28,16 +29,16 @@ let
       rev = "v${version}";
       hash = "sha256-OsDohXRxovtEXaWiRGp8gJ0dXmoALyO+ZimeSO8aPVI=";
     } else if llvmMajor == "14" then rec{
-      version = "14.0.0";
-      rev = "v${version}";
-      hash = "sha256-BhNAApgZ/w/92XjpoDY6ZEIhSTwgJ4D3/EfNvPmNM2o=";
+      version = "14.0.0+unstable-2023-06-22";
+      rev = "23f398bf369093b1fd67459db8071ffcc6b92658";
+      hash = "sha256-o7cVj5/ZMER2CvfxL4pRb2qCIxC/HFUPiitf2fKtCyk=";
     } else if llvmMajor == "11" then {
-      version = "unstable-2022-05-04";
+      version = "11.0.0+unstable-2022-05-04";
       rev = "4ef524240833abfeee1c5b9fff6b1bd53f4806b3"; # 267 commits ahead of v11.0.0
       hash = "sha256-NoIoa20+2sH41rEnr8lsMhtfesrtdPINiXtUnxYVm8s=";
     } else throw "Incompatible LLVM version.";
 in
-stdenv.mkDerivation {
+disable-warnings-if-gcc13 (stdenv.mkDerivation {
   pname = "SPIRV-LLVM-Translator";
   inherit (branch) version;
 
@@ -47,12 +48,19 @@ stdenv.mkDerivation {
     inherit (branch) rev hash;
   };
 
-  patches = lib.optionals (llvmMajor == "16")[
+  patches = lib.optionals (llvmMajor == "16") [
     # Fixes builds that link against external LLVM dynamic library
     (fetchpatch {
       url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/f3b9b604d7eda18d0d1029d94a6eebd33aa3a3fe.patch";
       hash = "sha256-opDjyZcy7O4wcSfm/A51NCIiDyIvbcmbv9ns1njdJbc=";
     })
+  ] ++ lib.optionals (llvmMajor == "14") [
+    (fetchpatch {
+      # tries to install llvm-spirv into llvm nix store path
+      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/cce9a2f130070d799000cac42fe24789d2b777ab.patch";
+      revert = true;
+      hash = "sha256-GbFacttZRDCgA0jkUoFA4/B3EDn3etweKvM09OwICJ8=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config cmake ]
@@ -70,7 +78,7 @@ stdenv.mkDerivation {
     "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
     # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ] ++ lib.optionals (llvmMajor != "11") [ "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}" ];
+  ] ++ lib.optional (llvmMajor != "11") "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}";
 
   # FIXME: CMake tries to run "/llvm-lit" which of course doesn't exist
   doCheck = false;
@@ -91,4 +99,4 @@ stdenv.mkDerivation {
     platforms   = platforms.unix;
     maintainers = with maintainers; [ gloaming ];
   };
-}
+})
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index 30fb18db8fd22..76c2da0a656af 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -311,6 +311,13 @@ in stdenv.mkDerivation {
       sha256 = "1rma1al0rbm3s3ql6bnvbcighp74lri1lcrwbyacgdqp80fgw1b6";
     }}
 
+   # gcc-13 build fixes
+    patch -p2 -d llvm-project/llvm -i ${fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/llvm/llvm-project/commit/ff1681ddb303223973653f7f5f3f3435b48a1983.patch";
+      hash = "sha256-nkRPWx8gNvYr7mlvEUiOAb1rTrf+skCZjAydJVUHrcI=";
+    }}
+
     ${lib.optionalString stdenv.isLinux ''
     substituteInPlace llvm-project/clang/lib/Driver/ToolChains/Linux.cpp \
       --replace 'SysRoot + "/lib' '"${glibc}/lib" "' \
diff --git a/pkgs/development/compilers/vala/setup-hook.sh b/pkgs/development/compilers/vala/setup-hook.sh
index 33acdf1daee02..53976e5cd0db4 100644
--- a/pkgs/development/compilers/vala/setup-hook.sh
+++ b/pkgs/development/compilers/vala/setup-hook.sh
@@ -5,7 +5,7 @@ make_vala_find_vapi_files() {
     fi
 }
 
-addEnvHooks "$hostOffset" make_vala_find_vapi_files
+addEnvHooks "$targetOffset" make_vala_find_vapi_files
 
 disable_incompabile_pointer_conversion_warning() {
     # Work around incompatible function pointer conversion errors with clang 16
diff --git a/pkgs/development/embedded/fpga/tinyprog/default.nix b/pkgs/development/embedded/fpga/tinyprog/default.nix
index 4872111b811c5..b242d6ebc1b4f 100644
--- a/pkgs/development/embedded/fpga/tinyprog/default.nix
+++ b/pkgs/development/embedded/fpga/tinyprog/default.nix
@@ -30,10 +30,6 @@ with python3Packages; buildPythonApplication rec {
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/tinyfpga/TinyFPGA-Bootloader/tree/master/programmer";
     description = "Programmer for FPGA boards using the TinyFPGA USB Bootloader";
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index c262752991420..4091fdd49e0e4 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation (finalAttrs:
   {
   pname = "lua";
   inherit version;
+  outputs = [ "out" "doc" ];
 
   src = fetchurl {
     url = "https://www.lua.org/ftp/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
@@ -135,6 +136,9 @@ stdenv.mkDerivation (finalAttrs:
     ln -s "$out/lib/pkgconfig/lua.pc" "$out/lib/pkgconfig/lua-${luaversion}.pc"
     ln -s "$out/lib/pkgconfig/lua.pc" "$out/lib/pkgconfig/lua${luaversion}.pc"
     ln -s "$out/lib/pkgconfig/lua.pc" "$out/lib/pkgconfig/lua${lib.replaceStrings [ "." ] [ "" ] luaversion}.pc"
+
+    # Make documentation outputs of different versions co-installable.
+    mv $out/share/doc/lua $out/share/doc/lua-${version}
   '';
 
   # copied from python
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 6a201b066f8f2..2674971670fe6 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -30,10 +30,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "6";
+        patch = "7";
         suffix = "";
       };
-      hash = "sha256-D6t4+n8TP084IQxiYNkNfA1ccZhEZBnOBX7HrC5vXzg=";
+      hash = "sha256-GOGqfmb/OlhCPVntIoFaaVTlM0ISLEXfIMlod8Biubc=";
     };
   };
 
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index d06f3db334da7..0557c62eeff42 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -173,6 +173,16 @@ in {
       };
     } ./python-remove-tests-dir-hook.sh) {};
 
+  pythonRuntimeDepsCheckHook = callPackage ({ makePythonHook, packaging }:
+    makePythonHook {
+      name = "python-runtime-deps-check-hook.sh";
+      propagatedBuildInputs = [ packaging ];
+      substitutions = {
+        inherit pythonInterpreter pythonSitePackages;
+        hook = ./python-runtime-deps-check-hook.py;
+      };
+    } ./python-runtime-deps-check-hook.sh) {};
+
   setuptoolsBuildHook = callPackage ({ makePythonHook, setuptools, wheel }:
     makePythonHook {
       name = "setuptools-setup-hook";
diff --git a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
index 1ac91fb40e4e5..293bd5cebd500 100644
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@@ -52,7 +52,7 @@ _pythonRelaxDeps() {
     else
         for dep in $pythonRelaxDeps; do
             sed -i "$metadata_file" -r \
-                -e "s/(Requires-Dist: $dep\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/"
+                -e "s/(Requires-Dist: $dep\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/i"
         done
     fi
 }
diff --git a/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.py b/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.py
new file mode 100644
index 0000000000000..5a3a919391753
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.py
@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""
+The runtimeDependenciesHook validates, that all dependencies specified
+in wheel metadata are available in the local environment.
+
+In case that does not hold, it will print missing dependencies and
+violated version constraints.
+"""
+
+
+import importlib.metadata
+import re
+import sys
+import tempfile
+from argparse import ArgumentParser
+from zipfile import ZipFile
+
+from packaging.metadata import Metadata, parse_email
+from packaging.requirements import Requirement
+
+argparser = ArgumentParser()
+argparser.add_argument("wheel", help="Path to the .whl file to test")
+
+
+def error(msg: str) -> None:
+    print(f"  - {msg}", file=sys.stderr)
+
+
+def normalize_name(name: str) -> str:
+    """
+    Normalize package names according to PEP503
+    """
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def get_manifest_text_from_wheel(wheel: str) -> str:
+    """
+    Given a path to a wheel, this function will try to extract the
+    METADATA file in the wheels .dist-info directory.
+    """
+    with ZipFile(wheel) as zipfile:
+        for zipinfo in zipfile.infolist():
+            if zipinfo.filename.endswith(".dist-info/METADATA"):
+                with tempfile.TemporaryDirectory() as tmp:
+                    path = zipfile.extract(zipinfo, path=tmp)
+                    with open(path, encoding="utf-8") as fd:
+                        return fd.read()
+
+    raise RuntimeError("No METADATA file found in wheel")
+
+
+def get_metadata(wheel: str) -> Metadata:
+    """
+    Given a path to a wheel, returns a parsed Metadata object.
+    """
+    text = get_manifest_text_from_wheel(wheel)
+    raw, _ = parse_email(text)
+    metadata = Metadata.from_raw(raw)
+
+    return metadata
+
+
+def test_requirement(requirement: Requirement) -> bool:
+    """
+    Given a requirement specification, tests whether the dependency can
+    be resolved in the local environment, and whether it satisfies the
+    specified version constraints.
+    """
+    if requirement.marker and not requirement.marker.evaluate():
+        # ignore requirements with incompatible markers
+        return True
+
+    package_name = normalize_name(requirement.name)
+
+    try:
+        package = importlib.metadata.distribution(requirement.name)
+    except importlib.metadata.PackageNotFoundError:
+        error(f"{package_name} not installed")
+        return False
+
+    if package.version not in requirement.specifier:
+        error(
+            f"{package_name}{requirement.specifier} not satisfied by version {package.version}"
+        )
+        return False
+
+    return True
+
+
+if __name__ == "__main__":
+    args = argparser.parse_args()
+
+    metadata = get_metadata(args.wheel)
+    tests = [test_requirement(requirement) for requirement in metadata.requires_dist]
+
+    if not all(tests):
+        sys.exit(1)
diff --git a/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.sh
new file mode 100644
index 0000000000000..43a2f9b88745e
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.sh
@@ -0,0 +1,20 @@
+# Setup hook for PyPA installer.
+echo "Sourcing python-runtime-deps-check-hook"
+
+pythonRuntimeDepsCheckHook() {
+    echo "Executing pythonRuntimeDepsCheck"
+
+    export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
+
+    for wheel in dist/*.whl; do
+        echo "Checking runtime dependencies for $(basename $wheel)"
+        @pythonInterpreter@ @hook@ "$wheel"
+    done
+
+    echo "Finished executing pythonRuntimeDepsCheck"
+}
+
+if [ -z "${dontCheckRuntimeDeps-}" ]; then
+    echo "Using pythonRuntimeDepsCheckHook"
+    preInstallPhases+=" pythonRuntimeDepsCheckHook"
+fi
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index c14c6bc096fd3..e6f9087de866e 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -19,6 +19,7 @@
 , pythonOutputDistHook
 , pythonRemoveBinBytecodeHook
 , pythonRemoveTestsDirHook
+, pythonRuntimeDepsCheckHook
 , setuptoolsBuildHook
 , setuptoolsCheckHook
 , wheelUnpackHook
@@ -229,6 +230,13 @@ let
         }
       else
         pypaBuildHook
+    ) (
+      if isBootstrapPackage then
+        pythonRuntimeDepsCheckHook.override {
+          inherit (python.pythonOnBuildForHost.pkgs.bootstrap) packaging;
+        }
+      else
+        pythonRuntimeDepsCheckHook
     )] ++ lib.optionals (format' == "wheel") [
       wheelUnpackHook
     ] ++ lib.optionals (format' == "egg") [
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index 84af77bade9e7..c64c65df350ef 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -1,9 +1,12 @@
 { lib, stdenv, substituteAll, fetchurl
-, zlib ? null, zlibSupport ? true, bzip2, pkg-config, libffi, libunwind, Security
+, zlibSupport ? true, zlib
+, bzip2, pkg-config, libffi, libunwind, Security
 , sqlite, openssl, ncurses, python, expat, tcl, tk, tix, libX11
-, self, gdbm, db, xz
-, python-setup-hook
+, gdbm, db, xz, python-setup-hook
+, optimizationLevel ? "jit", boehmgc
 # For the Python package set
+, hash
+, self
 , packageOverrides ? (self: super: {})
 , pkgsBuildBuild
 , pkgsBuildHost
@@ -12,7 +15,6 @@
 , pkgsTargetTarget
 , sourceVersion
 , pythonVersion
-, hash
 , passthruFun
 , pythonAttr ? "pypy${lib.substring 0 1 pythonVersion}${lib.substring 2 3 pythonVersion}"
 }:
@@ -59,6 +61,8 @@ in with passthru; stdenv.mkDerivation rec {
     stdenv.cc.libc
   ] ++ lib.optionals zlibSupport [
     zlib
+  ] ++ lib.optionals (lib.any (l: l == optimizationLevel) [ "0" "1" "2" "3"]) [
+    boehmgc
   ] ++ lib.optionals stdenv.isDarwin [
     libunwind Security
   ];
@@ -102,7 +106,7 @@ in with passthru; stdenv.mkDerivation rec {
 
     ${pythonForPypy.interpreter} rpython/bin/rpython \
       --make-jobs="$NIX_BUILD_CORES" \
-      -Ojit \
+      -O${optimizationLevel} \
       --batch pypy/goal/targetpypystandalone.py
 
     runHook postBuild
@@ -195,10 +199,11 @@ in with passthru; stdenv.mkDerivation rec {
   enableParallelBuilding = true;  # almost no parallelization without STM
 
   meta = with lib; {
-    homepage = "http://pypy.org/";
+    homepage = "https://www.pypy.org/";
     description = "Fast, compliant alternative implementation of the Python language (${pythonVersion})";
     license = licenses.mit;
     platforms = [ "aarch64-linux" "x86_64-linux" "aarch64-darwin" "x86_64-darwin" ];
+    broken = optimizationLevel == "0"; # generates invalid code
     maintainers = with maintainers; [ andersk ];
   };
 }
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 3c9aba07df20f..9fe47eda13b17 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -131,7 +131,6 @@ let
         postUnpack = opString rubygemsSupport ''
           rm -rf $sourceRoot/{lib,test}/rubygems*
           cp -r ${rubygems}/lib/rubygems* $sourceRoot/lib
-          cp -r ${rubygems}/test/rubygems $sourceRoot/test
         '';
 
         postPatch = ''
diff --git a/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch b/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
index 6b7b209348775..fef2c558e2467 100644
--- a/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
+++ b/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
@@ -14,15 +14,15 @@ diff --git a/lib/rubygems/dependency_installer.rb b/lib/rubygems/dependency_inst
 index 34620860..00ab31d9 100644
 --- a/lib/rubygems/dependency_installer.rb
 +++ b/lib/rubygems/dependency_installer.rb
-@@ -18,7 +18,7 @@ class Gem::DependencyInstaller
+@@ -17,7 +17,7 @@ class Gem::DependencyInstaller
    extend Gem::Deprecate
  
    DEFAULT_OPTIONS = { # :nodoc:
--    :env_shebang => false,
-+    :env_shebang => true,
-     :document => %w[ri],
-     :domain => :both, # HACK dup
-     :force => false,
+-    env_shebang: false,
++    env_shebang: true,
+     document: %w[ri],
+     domain: :both, # HACK: dup
+     force: false,
 -- 
 2.21.0
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch b/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
index 138d432c82037..e155ff27b916e 100644
--- a/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
+++ b/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
@@ -12,15 +12,15 @@ diff --git a/lib/rubygems/path_support.rb b/lib/rubygems/path_support.rb
 index ed680d65..749b9ea6 100644
 --- a/lib/rubygems/path_support.rb
 +++ b/lib/rubygems/path_support.rb
-@@ -23,7 +23,7 @@ class Gem::PathSupport
+@@ -24,7 +24,7 @@ class Gem::PathSupport
    # hashtable, or defaults to ENV, the system environment.
    #
    def initialize(env)
--    @home = env["GEM_HOME"] || Gem.default_dir
-+    @home = env["GEM_HOME"] || Gem.user_dir
+-    @home = normalize_home_dir(env["GEM_HOME"] || Gem.default_dir)
++    @home = normalize_home_dir(env["GEM_HOME"] || Gem.user_dir || Gem.default_dir)
+     @path = split_gem_path env["GEM_PATH"], @home
  
-     if File::ALT_SEPARATOR
-       @home = @home.gsub(File::ALT_SEPARATOR, File::SEPARATOR)
+     @spec_cache_dir = env["GEM_SPEC_CACHE"] || Gem.default_spec_cache_dir
 -- 
 2.21.0
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 8e9e35dae59a4..95a6fb077eb12 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.22";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-gD+nd3bRHT0btWOCZhbIERJEJeAzGtH9mDxBRARqYVY=";
+    hash = "sha256-8xFe6AgJkvJXwBYbgR4HsBLyAXXtiTSfsayYl33cXJw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aspell/default.nix b/pkgs/development/libraries/aspell/default.nix
index b839092228b30..8c152d32ef6c3 100644
--- a/pkgs/development/libraries/aspell/default.nix
+++ b/pkgs/development/libraries/aspell/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, fetchzip, perl, ncurses
+{ lib, stdenv, fetchurl, fetchzip, perl, ncurses
 
   # for tests
 , aspell, glibc, runCommand
@@ -20,21 +20,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aspell";
-  version = "0.60.8";
+  version = "0.60.8.1";
 
   src = fetchurl {
     url = "mirror://gnu/aspell/aspell-${version}.tar.gz";
-    sha256 = "1wi60ankalmh8ds7nplz434jd7j94gdvbahdwsr539rlad8pxdzr";
+    hash = "sha256-1toSs01C1Ff6YE5DWtSEp0su/80SD/QKzWuz+yiH0hs=";
   };
 
-  patches = [
-    (fetchpatch {
-      #  objstack: assert that the alloc size will fit within a chunk
-      name = "CVE-2019-25051.patch";
-      url = "https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a.patch";
-      sha256 = "03z259xrk41x3j190gaprf3mqysyfgh3a04rjmch3h625vj95x39";
-    })
-  ] ++ lib.optional searchNixProfiles ./data-dirs-from-nix-profiles.patch;
+  patches = lib.optional searchNixProfiles ./data-dirs-from-nix-profiles.patch;
 
   postPatch = ''
     patch interfaces/cc/aspell.h < ${./clang.patch}
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 9827e6f52a77b..3c691c245ce57 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -31,7 +31,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libsndfile serd sord sratom ];
   propagatedBuildInputs = [ lv2 ];
 
-  mesonFlags = [ "-Ddocs=disabled" ];
+  mesonFlags = [
+    "-Ddocs=disabled"
+    # Tests require building a shared library.
+    (lib.mesonEnable "tests" (!stdenv.hostPlatform.isStatic))
+  ];
 
   passthru = {
     tests = {
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 7a57315a5f4da..284671b43f171 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.0";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    sha256 = "sha256-DzUobQ8qZNb83CwVKK9E1V51uHHo22nlBGKdN55W7UY=";
+    sha256 = "sha256-GO3Sfbi1dwsqQM6rlnEHyE7wolQjdVwD5BAu5ychEuY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-cal/default.nix b/pkgs/development/libraries/aws-c-cal/default.nix
index a76ee7ab003cf..6340545e3667a 100644
--- a/pkgs/development/libraries/aws-c-cal/default.nix
+++ b/pkgs/development/libraries/aws-c-cal/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-cal";
-  version = "0.6.0";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qsYQViMto5j6piCg6gBjzFfPJlLkJt4949o217QsV6Q=";
+    sha256 = "sha256-m/RwGXeSjYOJQwCxfPyL4TdJ3gV66zHgVkWd3bpSaJE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 1df8bef5be129..5c3abbc580879 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.8.23";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HkRaQnlasayg5Nu2KaEA18360rxAH/tdJ1iqzoi6i2E=";
+    sha256 = "sha256-xqNqyVtibR8oSMvl5RTU166FIxcbvGjZJOjJ9j6fU78=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-event-stream/default.nix b/pkgs/development/libraries/aws-c-event-stream/default.nix
index 6b3c8af43f50c..7f273ac80fa0b 100644
--- a/pkgs/development/libraries/aws-c-event-stream/default.nix
+++ b/pkgs/development/libraries/aws-c-event-stream/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-event-stream";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2MPTr1vSUPuemdlQIalZTp6eGXJl3Xr1eUEnZjikBzg=";
+    sha256 = "sha256-uKprdBJn9yHDm2HCBOiuanizCtLi/VKrvUUScNv6OPY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-http/default.nix b/pkgs/development/libraries/aws-c-http/default.nix
index 045f5f97a8064..52d3507b55706 100644
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
-  version = "0.7.11";
+  version = "0.7.14";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    sha256 = "sha256-gKuWhXxWHqTS66yANdKLsCZRk7jeDmyYMlme4WXT5Wc=";
+    sha256 = "sha256-HrNdePWNw/5tDBeybnUjK3LgftnGQ4CBXPG0URaxIeU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index e1eb1939c2126..abb51d0df4176 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.13.29";
+  version = "0.13.36";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZeogbjgpbqdCioLeb34CRol1Fa5BJOloAxxgE50yfQs=";
+    sha256 = "sha256-TwPcsTMBOE1uIInH6/eQdUMV6uD7d60773THzc1/G9Y=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-mqtt/default.nix b/pkgs/development/libraries/aws-c-mqtt/default.nix
index 082887ee3a3d9..eb20be82f353b 100644
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-mqtt";
-  version = "0.8.14";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${version}";
-    sha256 = "sha256-LPhd4ygh/3BtqDZwWtigXWUGZ0fzkcWkFl6dpJIspow=";
+    sha256 = "sha256-hxisqBUARJLtmZniXaZ2th0hqWiKn4XQIy6I0Oz/kUs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index ca07b930109ee..b3051916fbb8c 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.3.13";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-SXMDyzQ8hjPx9q9GhE11lYjj3IZY35mvUWELlYQmgGU=";
+    sha256 = "sha256-tb9h78Gd4N11DPB2ETq241lvDQqHIy2HYBsJrBlLpxA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch b/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
index 9b61316ffb91d..2b06ce0aec635 100644
--- a/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
+++ b/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
@@ -1,6 +1,6 @@
-From 2370ee92e78cfb0d55e3958b63ac71b16567b5fd Mon Sep 17 00:00:00 2001
+From fd3f3a28e7fce7fe4e10ed2d7edc4bfda8ab27df Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
-Date: Wed, 9 Nov 2022 17:59:17 +0100
+Date: Sun, 9 Jan 2022 01:57:18 +0100
 Subject: [PATCH] build: Make includedir properly overrideable
 
 This is required by some package managers like Nix.
@@ -9,33 +9,33 @@ This is required by some package managers like Nix.
  1 file changed, 13 insertions(+), 9 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 9f13d21..f6e62c7 100644
+index ec6d172..6514c23 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -66,6 +66,10 @@ elseif(NOT DEFINED CMAKE_INSTALL_LIBDIR)
-     set(CMAKE_INSTALL_LIBDIR "lib")
+@@ -49,6 +49,10 @@ if(${CMAKE_INSTALL_LIBDIR} STREQUAL "lib64")
+     set(FIND_LIBRARY_USE_LIB64_PATHS true)
  endif()
-
+ 
 +if(NOT DEFINED CMAKE_INSTALL_INCLUDEDIR)
 +    set(CMAKE_INSTALL_INCLUDEDIR "include")
 +endif()
 +
- if(${CMAKE_INSTALL_LIBDIR} STREQUAL "lib64")
-     set(FIND_LIBRARY_USE_LIB64_PATHS true)
+ if(NOT CMAKE_CXX_STANDARD)
+     set(CMAKE_CXX_STANDARD 11)
  endif()
-@@ -322,7 +326,7 @@ endif()
-
+@@ -307,7 +311,7 @@ endif()
  target_include_directories(${PROJECT_NAME} PUBLIC
      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
+     $<BUILD_INTERFACE:${GENERATED_INCLUDE_DIR}>
 -    $<INSTALL_INTERFACE:include>)
 +    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
-
+ 
  aws_use_package(aws-c-http)
  aws_use_package(aws-c-mqtt)
-@@ -336,14 +340,14 @@ aws_use_package(aws-c-s3)
-
- target_link_libraries(${PROJECT_NAME} ${DEP_AWS_LIBS})
-
+@@ -324,14 +328,14 @@ aws_add_sanitizers(${PROJECT_NAME})
+ 
+ target_link_libraries(${PROJECT_NAME} PUBLIC ${DEP_AWS_LIBS})
+ 
 -install(FILES ${AWS_CRT_HEADERS} DESTINATION "include/aws/crt" COMPONENT Development)
 -install(FILES ${AWS_CRT_AUTH_HEADERS} DESTINATION "include/aws/crt/auth" COMPONENT Development)
 -install(FILES ${AWS_CRT_CRYPTO_HEADERS} DESTINATION "include/aws/crt/crypto" COMPONENT Development)
@@ -52,8 +52,8 @@ index 9f13d21..f6e62c7 100644
 +install(FILES ${AWS_CRT_MQTT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/mqtt" COMPONENT Development)
 +install(FILES ${AWS_CRT_HTTP_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/http" COMPONENT Development)
 +install(FILES ${AWS_CRT_ENDPOINT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/endpoints" COMPONENT Development)
-
+ 
  install(
      TARGETS ${PROJECT_NAME}
---
-2.37.3
+-- 
+2.42.0
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index 0f44dab59db4b..0cd6e4940c4dc 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
-  version = "0.20.3";
+  version = "0.24.7";
 
   outputs = [ "out" "dev" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-70AchkuhuyumwpBYaj9mOVPJ8+6VSLTLtr3ghwqG3wM=";
+    sha256 = "sha256-AYO0ckqEx2jG7HduvaxASQMOsxuHGkRkyVsUP5WOs98=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch b/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch
deleted file mode 100644
index b2f12e77025cb..0000000000000
--- a/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch
+++ /dev/null
@@ -1,65 +0,0 @@
---- a/cmake/AWSSDKConfig.cmake
-+++ b/cmake/AWSSDKConfig.cmake
-@@ -97,14 +98,18 @@ if (NOT AWSSDK_CORE_HEADER_FILE)
-     message(FATAL_ERROR "AWS SDK for C++ is missing, please install it first")
- endif()
- 
--# based on core header file path, inspects the actual AWSSDK_ROOT_DIR
--get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_CORE_HEADER_FILE}" PATH)
--get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
--get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
--get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
--
--if (NOT AWSSDK_ROOT_DIR)
--    message(FATAL_ERROR "AWSSDK_ROOT_DIR is not set or can't be calculated from the path of core header file")
-+if (IS_ABSOLUTE ${AWSSDK_INSTALL_LIBDIR})
-+    set(AWSSDK_ROOT_DIR "")
-+else()
-+    # based on core header file path, inspects the actual AWSSDK_ROOT_DIR
-+    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_CORE_HEADER_FILE}" PATH)
-+    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
-+    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
-+    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
-+
-+    if (NOT AWSSDK_ROOT_DIR)
-+	message(FATAL_ERROR "AWSSDK_ROOT_DIR is not set or can't be calculated from the path of core header file")
-+    endif()
- endif()
- 
- 
-diff --git a/cmake/utilities.cmake b/cmake/utilities.cmake
-index 283a14a138..646aea1da3 100644
---- a/cmake/utilities.cmake
-+++ b/cmake/utilities.cmake
-@@ -43,7 +43,8 @@ macro(setup_install)
-                 EXPORT "${PROJECT_NAME}-targets"
-                 ARCHIVE DESTINATION ${ARCHIVE_DIRECTORY}
-                 LIBRARY DESTINATION ${LIBRARY_DIRECTORY}
--                RUNTIME DESTINATION ${BINARY_DIRECTORY} )
-+                RUNTIME DESTINATION ${BINARY_DIRECTORY}
-+                INCLUDES DESTINATION ${INCLUDE_DIRECTORY} )
- 
-         if (BUILD_SHARED_LIBS)
-             install(
-@@ -57,7 +58,8 @@ macro(setup_install)
-             install (TARGETS ${PROJECT_NAME}
-                      ARCHIVE DESTINATION ${ARCHIVE_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
-                      LIBRARY DESTINATION ${LIBRARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
--                     RUNTIME DESTINATION ${BINARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME})
-+                     RUNTIME DESTINATION ${BINARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
-+                     INCLUDES DESTINATION ${INCLUDE_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME})
-         endif()
-     endif()
- endmacro()
-diff --git a/toolchains/pkg-config.pc.in b/toolchains/pkg-config.pc.in
-index 9b519d2772..a61069225c 100644
---- a/toolchains/pkg-config.pc.in
-+++ b/toolchains/pkg-config.pc.in
-@@ -1,5 +1,5 @@
--includedir=@CMAKE_INSTALL_PREFIX@/@INCLUDE_DIRECTORY@
--libdir=@CMAKE_INSTALL_PREFIX@/@LIBRARY_DIRECTORY@
-+includedir=@INCLUDE_DIRECTORY@
-+libdir=@LIBRARY_DIRECTORY@
- 
- Name: @PROJECT_NAME@
- Description: @PROJECT_DESCRIPTION@
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 8fdb63f165e84..448139358e65c 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -8,6 +8,9 @@
 , aws-crt-cpp
 , CoreAudio
 , AudioToolbox
+, nix
+, arrow-cpp
+, aws-sdk-cpp
 , # Allow building a limited set of APIs, e.g. ["s3" "ec2"].
   apis ? ["*"]
 , # Whether to enable AWS' custom memory management.
@@ -24,19 +27,15 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.11.118";
+  version = "1.11.207";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "sha256-jqGXh8xLD2gIjV9kSvlldrxA5TxTTXQoC/B66FVprvk=";
+    sha256 = "sha256-IsPDQJo+TZ2noLefroiWl/Jx8fXmrmY73WHNRO41sik=";
   };
 
-  patches = [
-    ./cmake-dirs.patch
-  ];
-
   postPatch = ''
     # Append the dev output to path hints in finding Aws.h to avoid
     # having to pass `AWS_CORE_HEADER_FILE` explicitly to cmake configure
@@ -79,8 +78,6 @@ stdenv.mkDerivation rec {
 
   # propagation is needed for Security.framework to be available when linking
   propagatedBuildInputs = [ aws-crt-cpp ];
-  # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
 
   cmakeFlags = [
     "-DBUILD_DEPS=OFF"
@@ -109,6 +106,42 @@ stdenv.mkDerivation rec {
   # Builds in 2+h with 2 cores, and ~10m with a big-parallel builder.
   requiredSystemFeatures = [ "big-parallel" ];
 
+  passthru = {
+    tests = {
+      inherit nix arrow-cpp;
+      cmake-find-package = stdenv.mkDerivation {
+        pname = "aws-sdk-cpp-cmake-find-package-test";
+        version = "0";
+        dontUnpack = true;
+        nativeBuildInputs = [ cmake ];
+        buildInputs = [ aws-sdk-cpp ];
+        buildCommand = ''
+          cat > CMakeLists.txt <<'EOF'
+          find_package(AWSSDK)
+          EOF
+
+          # Intentionally not using 'cmakeConfigurePhase' to test that find_package works without it.
+          mkdir build && cd build
+          if output=$(cmake -Wno-dev .. 2>&1); then
+            if grep -Fw -- "Found AWS" - <<< "$output"; then
+              touch "$out"
+            else
+              echo "'Found AWS' not found in the cmake output!" >&2
+              echo "The output was:" >&2
+              echo "$output" >&2
+              exit 1
+            fi
+          else
+            echo -n "'cmake -Wno-dev ..'" >&2
+            echo " returned a non-zero exit code." >&2
+            echo "$output" >&2
+            exit 1
+          fi
+        '';
+      };
+    };
+  };
+
   meta = with lib; {
     description = "A C++ interface for Amazon Web Services";
     homepage = "https://github.com/aws/aws-sdk-cpp";
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index 883b30c6a576c..7eb13f7136c72 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     ./cyrus-sasl-ac-try-run-fix.patch
     # make compatible with openssl3. can probably be dropped with any release after 2.1.28
     (fetchpatch {
-      url = "https://github.com/cyrusimap/cyrus-sasl/compare/cb549ef71c5bb646fe583697ebdcaba93267a237...c2bd3afbca57f176d8c650670ce371444bb7fcc0.patch";
-      hash = "sha256-bYeIkvle1Ms7Lnoob4eLd4RbPFHtPkKRZvfHNCBJY/s=";
+      url = "https://github.com/cyrusimap/cyrus-sasl/compare/cb549ef71c5bb646fe583697ebdcaba93267a237...dfaa62392e7caecc6ecf0097b4d73738ec4fc0a8.patch";
+      hash = "sha256-pc0cZqj1QoxDqgd/j/5q3vWONEPrTm4Pr6MzHlfjRCc=";
     })
   ];
 
diff --git a/pkgs/development/libraries/directx-headers/default.nix b/pkgs/development/libraries/directx-headers/default.nix
index 946385ab0917d..b15a6baa7cab5 100644
--- a/pkgs/development/libraries/directx-headers/default.nix
+++ b/pkgs/development/libraries/directx-headers/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja }:
 stdenv.mkDerivation rec {
   pname = "directx-headers";
-  version = "1.610.2";
+  version = "1.611.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "DirectX-Headers";
     rev = "v${version}";
-    hash = "sha256-se+/TgqKdatTnBlHcBC1K4aOGGfPEW+E1efpP34+xc0=";
+    hash = "sha256-HG2Zj8hvsgv8oeSDp1eK+1A5bvFL6oQIh5mMFWOFsvk=";
   };
 
   nativeBuildInputs = [ meson ninja ];
diff --git a/pkgs/development/libraries/draco/default.nix b/pkgs/development/libraries/draco/default.nix
index 1cc8a843dcd54..ee2c5b8e5b726 100644
--- a/pkgs/development/libraries/draco/default.nix
+++ b/pkgs/development/libraries/draco/default.nix
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DDRACO_TINYGLTF_PATH=${tinygltf}"
   ];
 
+  CXXFLAGS = [
+    # error: expected ')' before 'value' in 'explicit GltfValue(uint8_t value)'
+    "-include cstdint"
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index d4ab53f37bcd3..43f9093848b8f 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , aspell
 , groff
 , pkg-config
@@ -14,23 +13,15 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.6.2";
+  version = "2.6.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-ZoanKOVudg+N7gmiLw+1O0bunb59ZM+eW7NaZYv/fh0=";
+    hash = "sha256-wcVxnypZfOPgbJOM+5n7aX2gk96nuFfMAE3B3PG7oYI=";
   };
 
-  patches = [
-    # fix build with clang 16
-    (fetchpatch {
-      url = "https://github.com/AbiWord/enchant/commit/f71eb22e4af7f9917011807a41cf295d3ce0ccbc.patch";
-      hash = "sha256-9WWvpU3HKzPlxNBYQAKPppW6G3kOIC2A+MqX5eheBDA=";
-    })
-  ];
-
   nativeBuildInputs = [
     groff
     pkg-config
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 8dc42dea247d4..e57c0fcff5bc4 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
   version = "4.4.4";
-  sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
+  hash = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
   extraPatches = [
     {
       name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index a3ff054f1e60a..68edb0fd37e4f 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
   version = "5.1.3";
-  sha256 = "sha256-twfJvANLQGO7TiyHPMPqApfHLFUlOGZTTIIGEnjyvuE=";
+  hash = "sha256-twfJvANLQGO7TiyHPMPqApfHLFUlOGZTTIIGEnjyvuE=";
   extraPatches = [
     {
       name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
diff --git a/pkgs/development/libraries/ffmpeg/6.nix b/pkgs/development/libraries/ffmpeg/6.nix
index 37bdf5b060f77..62d3919c06466 100644
--- a/pkgs/development/libraries/ffmpeg/6.nix
+++ b/pkgs/development/libraries/ffmpeg/6.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "6.0";
-  sha256 = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
+  version = "6.1";
+  hash = "sha256-NzhD2D16bCVCyCXo0TRwZYp3Ta5eFSfoQPa+iRkeNZg=";
 }
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index e713ca1413fb3..8b810120b80b1 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,4 +1,4 @@
-{ version, sha256, extraPatches ? [] }:
+{ version, hash, extraPatches ? [] }:
 
 { lib, stdenv, buildPackages, removeReferencesTo, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
 
@@ -27,6 +27,7 @@
   # Feature flags
 , withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
 , withAom ? withFullDeps # AV1 reference encoder
+, withAribcaption ? withFullDeps && lib.versionAtLeast version "6.1" # ARIB STD-B24 Caption Decoder/Renderer
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
 , withBluray ? withFullDeps # BluRay reading
 , withBs2b ? withFullDeps # bs2b DSP library
@@ -179,8 +180,8 @@
  */
 , alsa-lib
 , bzip2
-, clang
 , celt
+, clang
 , dav1d
 , fdk_aac
 , fontconfig
@@ -188,27 +189,32 @@
 , frei0r
 , fribidi
 , game-music-emu
+, glslang
 , gnutls
 , gsm
-, libjack2
+, intel-media-sdk
 , ladspaH
 , lame
-, libass
 , libaom
+, libaribcaption
+, libass
 , libbluray
 , libbs2b
 , libcaca
 , libdc1394
-, libraw1394
 , libdrm
+, libGL
+, libGLU
 , libiconv
-, intel-media-sdk
+, libjack2
 , libmodplug
 , libmysofa
 , libogg
 , libopenmpt
 , libopus
 , libplacebo
+, libpulseaudio
+, libraw1394
 , librsvg
 , libssh
 , libtensorflow
@@ -223,41 +229,37 @@
 , libwebp
 , libX11
 , libxcb
-, libXv
 , libXext
 , libxml2
-, xz
+, libXv
 , nv-codec-headers
-, nv-codec-headers-11
-, openal
+, nv-codec-headers-12
 , ocl-icd # OpenCL ICD
+, openal
 , opencl-headers  # OpenCL headers
 , opencore-amr
-, libGL
-, libGLU
 , openh264
 , openjpeg
-, libpulseaudio
 , rav1e
-, svt-av1
 , rtmpdump
 , samba
 , SDL2
 , soxr
 , speex
 , srt
+, svt-av1
 , vid-stab
 , vo-amrwbenc
+, vulkan-headers
+, vulkan-loader
 , x264
 , x265
 , xavs
 , xvidcore
+, xz
 , zeromq4
 , zimg
 , zlib
-, vulkan-headers
-, vulkan-loader
-, glslang
 /*
  *  Darwin frameworks
  */
@@ -334,7 +336,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchgit {
     url = "https://git.ffmpeg.org/ffmpeg.git";
     rev = "n${finalAttrs.version}";
-    inherit sha256;
+    inherit hash;
   };
 
   postPatch = ''
@@ -344,10 +346,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
     substituteInPlace doc/filters.texi \
       --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-  '' + lib.optionalString withVulkan ''
-    # FIXME: horrible hack, remove for next release
-    substituteInPlace libavutil/hwcontext_vulkan.c \
-      --replace VK_EXT_VIDEO_DECODE VK_KHR_VIDEO_DECODE
   '';
 
   patches = map (patch: fetchpatch patch) (extraPatches
@@ -357,6 +355,13 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/814178f92647be2411516bbb82f48532373d2554";
         hash = "sha256-FQV9/PiarPXCm45ldtCsxGHjlrriL8DKpn1LaKJ8owI=";
       }
+    )
+    ++ (lib.optional (stdenv.isDarwin && lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
+      { # this can be removed post 6.1
+        name = "fix_build_failure_due_to_PropertyKey_EncoderID";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
+        hash = "sha256-Ittka0mId1N/BwJ0FQ0ygpTSS6Y11u2SjWDpbGN+KXo=";
+      }
     ));
 
   configurePlatforms = [];
@@ -441,6 +446,8 @@ stdenv.mkDerivation (finalAttrs: {
      *  External libraries
      */
     (enableFeature withAlsa "alsa")
+    # FIXME: see if jellyfin-ffmpeg is already on a version >= 6.1 to use enableFeature
+    (optionalString withAribcaption "--enable-libaribcaption")
     (enableFeature withBzlib "bzlib")
     (enableFeature withCelt "libcelt")
     (enableFeature withCuda "cuda")
@@ -553,9 +560,10 @@ stdenv.mkDerivation (finalAttrs: {
   # TODO This was always in buildInputs before, why?
   buildInputs = optionals withFullDeps [ libdc1394 ]
   ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
-  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-11 else nv-codec-headers) ]
+  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
+  ++ optionals withAribcaption [ libaribcaption ]
   ++ optionals withAss [ libass ]
   ++ optionals withBluray [ libbluray ]
   ++ optionals withBs2b [ libbs2b ]
@@ -698,7 +706,7 @@ stdenv.mkDerivation (finalAttrs: {
       ++ optional withUnfree unfreeRedistributable;
     pkgConfigModules = [ "libavutil" ];
     platforms = platforms.all;
-    maintainers = with maintainers; [ atemu ];
+    maintainers = with maintainers; [ atemu arthsmn ];
     mainProgram = "ffmpeg";
   };
 })
diff --git a/pkgs/development/libraries/futuresql/default.nix b/pkgs/development/libraries/futuresql/default.nix
index fb6e4061e6f62..ed6a7033909ad 100644
--- a/pkgs/development/libraries/futuresql/default.nix
+++ b/pkgs/development/libraries/futuresql/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, extra-cmake-modules, qtbase }:
+{ stdenv, lib, fetchurl, cmake, extra-cmake-modules, qtbase }:
 stdenv.mkDerivation rec {
   pname = "futuresql";
   version = "0.1.1";
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ qtbase ];
+  cmakeFlags = ["-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}"];
 
   # a library, nothing to wrap
   dontWrapQtApps = true;
diff --git a/pkgs/development/libraries/gbenchmark/default.nix b/pkgs/development/libraries/gbenchmark/default.nix
index f53868a0926fa..7292b34528268 100644
--- a/pkgs/development/libraries/gbenchmark/default.nix
+++ b/pkgs/development/libraries/gbenchmark/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gbenchmark";
-  version = "1.8.0";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
     rev = "v${version}";
-    sha256 = "sha256-pUW9YVaujs/y00/SiPqDgK4wvVsaM7QUp/65k0t7Yr0=";
+    sha256 = "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -29,7 +29,8 @@ stdenv.mkDerivation rec {
       --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
   '';
 
-  doCheck = true;
+  # Tests fail on 32-bit due to not enough precision
+  doCheck = stdenv.is64bit;
 
   passthru.tests = {
     inherit prometheus-cpp;
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index c168113fa3c45..600ca69f46d04 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -10,6 +10,7 @@ let
     "--disable-intl"
     "--enable-threads=posix"
     "--with-glibc-version=${glibc.version}"
+    "--disable-plugin"
 
     # these are required in order to prevent inhibit_libc=true,
     # which will cripple libgcc's unwinder; see:
diff --git a/pkgs/development/libraries/gjs/default.nix b/pkgs/development/libraries/gjs/default.nix
index ae0730873b8e5..b7f91afa3710c 100644
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@@ -32,13 +32,13 @@ let
   ];
 in stdenv.mkDerivation (finalAttrs: {
   pname = "gjs";
-  version = "1.78.0";
+  version = "1.78.1";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-+6og4JF2aIMIAPkpUWiPn8CPASlq/9XNtLNfdQvifck=";
+    hash = "sha256-fpBRHEKRJ8OerABoxKyaNT335vu8ZG9fGOiWKILBhkE=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index a2e4ad8f47cf4..2e9a3702449a3 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -50,11 +50,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.78.1";
+  version = "2.78.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "kVvD0PhQfWUOrTgy4vj7Zw/OWarE13VKfatvHm/teLI=";
+    sha256 = "YJgB3Tc3luUVlyv5X8Cy2qRFRUge4vRlxPIE0iSyvCE=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/glib/split-dev-programs.patch b/pkgs/development/libraries/glib/split-dev-programs.patch
index f3497e6a78112..0333c5c9ca295 100644
--- a/pkgs/development/libraries/glib/split-dev-programs.patch
+++ b/pkgs/development/libraries/glib/split-dev-programs.patch
@@ -1,5 +1,5 @@
 diff --git a/gio/gdbus-2.0/codegen/meson.build b/gio/gdbus-2.0/codegen/meson.build
-index 65faae9..4297513 100644
+index 65faae9b2..4297513d4 100644
 --- a/gio/gdbus-2.0/codegen/meson.build
 +++ b/gio/gdbus-2.0/codegen/meson.build
 @@ -20,7 +20,7 @@ gdbus_codegen_conf.set('DATADIR', glib_datadir)
@@ -12,12 +12,12 @@ index 65faae9..4297513 100644
    configuration : gdbus_codegen_conf
  )
 diff --git a/gio/meson.build b/gio/meson.build
-index b19c59f..3b20e84 100644
+index 75686bb3e..2f1a73482 100644
 --- a/gio/meson.build
 +++ b/gio/meson.build
-@@ -879,14 +879,15 @@ pkg.generate(libgio,
-     'datadir=' + '${prefix}' / get_option('datadir'),
+@@ -882,14 +882,15 @@ pkg.generate(libgio,
      'schemasdir=' + '${datadir}' / schemas_subdir,
+     'dtdsdir=' + '${datadir}' / dtds_subdir,
      'bindir=' + '${prefix}' / get_option('bindir'),
 +    'devbindir=' + get_option('devbindir'),
      'giomoduledir=' + pkgconfig_giomodulesdir,
@@ -36,7 +36,7 @@ index b19c59f..3b20e84 100644
      'gsettings=' + '${bindir}' / 'gsettings',
    ],
    version : glib_version,
-@@ -989,6 +990,7 @@ executable('gio', gio_tool_sources,
+@@ -992,6 +993,7 @@ executable('gio', gio_tool_sources,
  
  executable('gresource', 'gresource-tool.c',
    install : true,
@@ -44,7 +44,7 @@ index b19c59f..3b20e84 100644
    install_tag : 'bin',
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
-@@ -996,7 +998,7 @@ executable('gresource', 'gresource-tool.c',
+@@ -999,7 +1001,7 @@ executable('gresource', 'gresource-tool.c',
  
  gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodule-priv.c',
    install : true,
@@ -53,7 +53,7 @@ index b19c59f..3b20e84 100644
    install_tag : 'bin',
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
-@@ -1006,7 +1008,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
+@@ -1009,7 +1011,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
  glib_compile_schemas = executable('glib-compile-schemas',
    ['glib-compile-schemas.c'],
    install : true,
@@ -62,7 +62,7 @@ index b19c59f..3b20e84 100644
    install_tag : 'bin',
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
-@@ -1015,6 +1017,7 @@ glib_compile_schemas = executable('glib-compile-schemas',
+@@ -1018,6 +1020,7 @@ glib_compile_schemas = executable('glib-compile-schemas',
  glib_compile_resources = executable('glib-compile-resources',
    [gconstructor_as_data_h, 'glib-compile-resources.c'],
    install : true,
@@ -70,8 +70,49 @@ index b19c59f..3b20e84 100644
    install_tag : 'bin-devel',
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
+diff --git a/gio/tests/meson.build b/gio/tests/meson.build
+index 4ef3343ab..2a0a6b56b 100644
+--- a/gio/tests/meson.build
++++ b/gio/tests/meson.build
+@@ -1131,16 +1131,18 @@ if have_bash and have_pkg_config
+ 
+   gio_binaries = [
+     'gio',
+-    'glib-compile-resources',
+     'gdbus',
+-    'gdbus-codegen',
+-    'gresource',
+     'gsettings',
+   ]
+-  gio_multiarch_binaries = [
++  gio_dev_binaries = [
++    'glib-compile-resources',
++    'gdbus-codegen',
++    'gresource',
+     'gio-querymodules',
+     'glib-compile-schemas',
+   ]
++  gio_multiarch_binaries = [
++  ]
+ 
+   foreach binary: gio_binaries
+     pkg_config_tests += [
+@@ -1149,6 +1151,13 @@ if have_bash and have_pkg_config
+         prefix / get_option('bindir') / binary)
+     ]
+   endforeach
++  foreach binary: gio_dev_binaries
++    pkg_config_tests += [
++      'test "$(pkg-config --variable=@0@ gio-2.0)" = "@1@"'.format(
++        binary.underscorify(),
++        prefix / get_option('devbindir') / binary)
++    ]
++  endforeach
+ 
+   foreach binary: gio_multiarch_binaries
+     pkg_config_tests += [
 diff --git a/glib/meson.build b/glib/meson.build
-index c26a35e..38effe1 100644
+index c26a35e42..38effe12a 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -447,9 +447,10 @@ pkg.generate(libglib,
@@ -105,8 +146,24 @@ index c26a35e..38effe1 100644
    install_tag : 'bin-devel',
    configuration: report_conf,
    install_mode: 'rwxr-xr-x'
+diff --git a/glib/tests/meson.build b/glib/tests/meson.build
+index 09ecd5ab3..9748d4122 100644
+--- a/glib/tests/meson.build
++++ b/glib/tests/meson.build
+@@ -508,9 +508,9 @@ if have_bash and have_pkg_config
+         'test "$(pkg-config --variable=datadir glib-2.0)" = "@0@"'.format(
+           prefix / get_option('datadir')),
+         'test "$(pkg-config --variable=gobject_query glib-2.0)" = "@0@"'.format(
+-          prefix / get_option('bindir') / 'gobject-query'),
++          prefix / get_option('devbindir') / 'gobject-query'),
+         'test "$(pkg-config --variable=glib_mkenums glib-2.0)" = "@0@"'.format(
+-          prefix / get_option('bindir') / 'glib-mkenums'),
++          prefix / get_option('devbindir') / 'glib-mkenums'),
+         'test "$(pkg-config --variable=glib_valgrind_suppressions glib-2.0)" = "@0@"'.format(
+           prefix / get_option('datadir') /
+           valgrind_suppression_file_install_subdir / fs.name(valgrind_suppression_file)),
 diff --git a/gobject/meson.build b/gobject/meson.build
-index 2129aaf..da84624 100644
+index 2129aaf8a..da8462428 100644
 --- a/gobject/meson.build
 +++ b/gobject/meson.build
 @@ -94,7 +94,7 @@ foreach tool: python_tools
@@ -127,7 +184,7 @@ index 2129aaf..da84624 100644
    dependencies : [libglib_dep, libgobject_dep])
  
 diff --git a/meson_options.txt b/meson_options.txt
-index 517d575..198cc1b 100644
+index 517d5757c..198cc1b3c 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -4,6 +4,11 @@ option('runtime_libdir',
@@ -143,7 +200,7 @@ index 517d575..198cc1b 100644
         type : 'string',
         value : '',
 diff --git a/tools/meson.build b/tools/meson.build
-index 257312e..f831539 100644
+index 257312ebf..f8315392b 100644
 --- a/tools/meson.build
 +++ b/tools/meson.build
 @@ -8,7 +8,7 @@ if have_sh
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 9aa1284bbee9d..0a6be882120ba 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , c-ares
 , cmake
 , crc32c
@@ -18,6 +19,7 @@
 , staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
+  # defined in cmake/GoogleapisConfig.cmake
   googleapisRev = "85f8c758016c279fb7fa8f0d51ddc7ccc0dd5e05";
   googleapis = fetchFromGitHub {
     name = "googleapis-src";
@@ -39,6 +41,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0SoOaAqvk8cVC5W3ejTfe4O/guhrro3uAzkeIpAkCpg=";
   };
 
+  patches = [
+    # https://github.com/googleapis/google-cloud-cpp/pull/12554, tagged in 2.16.0
+    (fetchpatch {
+      name = "prepare-for-GCC-13.patch";
+      url = "https://github.com/googleapis/google-cloud-cpp/commit/ae30135c86982c36e82bb0f45f99baa48c6a780b.patch";
+      hash = "sha256-L0qZfdhP8Zt/gYBWvJafteVgBHR8Kup49RoOrLDtj3k=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace external/googleapis/CMakeLists.txt \
       --replace "https://github.com/googleapis/googleapis/archive/\''${_GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz" "file://${googleapis}"
@@ -69,7 +80,7 @@ stdenv.mkDerivation rec {
   ];
 
   # https://hydra.nixos.org/build/222679737/nixlog/3/tail
-  NIX_CFLAGS_COMPILE = if stdenv.isAarch64 then "-Wno-error=maybe-uninitialized" else null;
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isAarch64 "-Wno-error=maybe-uninitialized";
 
   doInstallCheck = true;
 
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 4dec79e0e2da1..ca359fcc912b6 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -19,6 +19,7 @@
 , swig2 ? null
 # only for passthru.tests
 , libsForQt5
+, qt6Packages
 , python3
 }:
 let
@@ -26,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.23.0";
+  version = "1.23.2";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-BD4u/hi0rSK5bUNN3nY/vtMs+NbCINxp3w0P+53Gb8Y=";
+    hash = "sha256-lJnosfM8zLaBVSehvBYEnTWmGYpsX64BhfK9VhvOUiQ=";
   };
 
   patches = [
@@ -109,7 +110,8 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     python = python3.pkgs.gpgme;
-    qt = libsForQt5.qgpgme;
+    qt5 = libsForQt5.qgpgme;
+    qt6 = qt6Packages.qgpgme;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 2874f0d2fa049..7706975ca0566 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -109,13 +109,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-xxb43/qPrD+2RpQa8cbscv/wWgRRMTEb8tBJ/ch7zi4=";
+    hash = "sha256-RYeD+CNgaJkePilu3Wccjt24vm+skzwcLhUDRihk6g8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index e87555fef57b5..c68693681ee13 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -45,7 +45,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [ "out" "dev" ];
 
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-YlGeDY+Wnr9iqaeZby0j792jMCF6Y19KMsC/HHFXdGg=";
+    hash = "sha256-62eS5cc8be+5FZw26m5LeKL4r2USZ4tL07AsjS1JKs8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 6a44f3e01a278..9979184b089a8 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [
     "bin"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-AeQsY1Kga9+kRW5ksGq32YxcSHolVXx2FVRjHL2mQhc=";
+    hash = "sha256-rU49sXcRObHbF7Gvp8BdsIOuAQC9TaJEtx8WLczkG/w=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/default.nix
index 662009005e36b..1bfdf5b24de35 100644
--- a/pkgs/development/libraries/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/default.nix
@@ -14,6 +14,7 @@
 , Security
 , VideoToolbox
 , ipu6ep-camera-hal
+, ipu6epmtl-camera-hal
 }:
 
 {
@@ -47,6 +48,9 @@
   icamerasrc-ipu6ep = callPackage ./icamerasrc {
     ipu6-camera-hal = ipu6ep-camera-hal;
   };
+  icamerasrc-ipu6epmtl = callPackage ./icamerasrc {
+    ipu6-camera-hal = ipu6epmtl-camera-hal;
+  };
 
   # note: gst-python is in ../../python-modules/gst-python - called under python3Packages
 }
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 87097dddd8d3a..6ce4723b5a325 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-FXz5P7J0HPDD3qcxvjry/65wPJ8s08DJGzgPvGheufk=";
+    hash = "sha256-zWNAVvyxbQNbPfWVPsha6L1Wxo8pkgtyDvkgynHqdqc=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 764bd78c083ae..317fc4e537286 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-/sVqLDeiU80EjSiNTH7abv8ZECKwnbl14HosEF0bUh4=";
+    hash = "sha256-0dXnXhkOsL4/1JQJ5Bo6qOaM+03qpzU0iFVGdJVs0d8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 7e4c7d77363d9..6bea243146953 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -54,13 +54,13 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch32);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-ttsOGOOYtSZlt83OMBw0qHUEg9X0+6we3p+AsDdDzRU=";
+    hash = "sha256-4wW58H9SdDykgdoKTgx2w179YK2vGwaU6zuwIeITfjk=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
index b03dd953e1407..4d6c5671f0e28 100644
--- a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
+++ b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
@@ -8,15 +8,15 @@
 , libdrm
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "icamerasrc-${ipu6-camera-hal.ipuVersion}";
-  version = "unstable-2023-03-09";
+  version = "unstable-2023-10-23";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "icamerasrc";
-    rev = "17841ab6249aaa69bd9b3959262bf182dee74111";
-    hash = "sha256-j8ZYe4nyy5yfo10CGeXDwbAaAPvdr0ptMWB8hQDyESQ=";
+    rev = "528a6f177732def4d5ebc17927220d8823bc8fdc";
+    hash = "sha256-Ezcm5OpF/NKvJf5sFeJyvNc2Uq0166GukC9MuNUV2Fs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index c183f8ee48a2d..f3dfac82c799a 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-FSW5FxQbiV/lz2GP6IZ2IrJSgnigKG6fcntfNzF9rKE=";
+    hash = "sha256-vjk0m8B6tM29ml/W6phIxgHHVguloFd61SALg71CSYE=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 1420a438b6f6d..6b0dfcc8598f1 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-9/rAAeIK0h420YOXdBxGV8XUNXHrHMO0n5qTrhJ9yI8=";
+    hash = "sha256-cFF3BRwimXbxca3Nerl2Kua8xLt33DCKC9gKY9psM38=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index b92bb9dc0d4cf..cc78a6ec0f805 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-UgtGvKY3GJrYaimP8kWy2JN128rIsF102uqRD4Gp6do=";
+    hash = "sha256-B2HZa6UI4BwCcYgbJoKMK//X2K/VCHIhnwiPdVslLKc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index b779d132210d3..b3a7142edae95 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-Dp//douJ3m0xizQUbk54HYK5oPQCXcVBssg0nHvLf2c=";
+    hash = "sha256-Epi6NHpwxCuIzev5G2Wf6gKxu3Jp6r+OKePAvVgniSg=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 27afba7833e8a..c244414c55087 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -64,7 +64,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk+3";
-  version = "3.24.38";
+  version = "3.24.39";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
   outputBin = "dev";
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
   in fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-zhHezwGLJb3YUFVEpPhyQoVOyIvgVNmt5fOiBETdjuc=";
+    sha256 = "sha256-HKw+VmubLzZTpFjAjC3N/cqfkIA3rAPJ2FZLQpV3jXk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 218efb6559fb0..2d14823accf40 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -3,7 +3,6 @@
 , buildPackages
 , substituteAll
 , fetchurl
-, fetchpatch
 , pkg-config
 , gettext
 , graphene
@@ -69,7 +68,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.12.3";
+  version = "4.12.4";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -81,19 +80,12 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "FIziYvbIZIdFX7HZeTw/WLw+HaR3opYX+tsEIPWHCok=";
+    sha256 = "umfGSY5Vmfko7a+54IoyCt+qUKsvDab8arIlL8LVdSA=";
   };
 
   patches = [
     # https://github.com/NixOS/nixpkgs/pull/218143#issuecomment-1501059486
     ./patches/4.0-fix-darwin-build.patch
-
-    # gdk: Fix compilation on macos
-    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/6208
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/aa888c0b3f775776fe3b71028396b7a8c6adb1d6.patch";
-      sha256 = "sha256-Jw6BvWDX0wIs4blUiX3qdQCR574yhcaO06Vy/IqfbJo=";
-    })
   ];
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gumbo/default.nix b/pkgs/development/libraries/gumbo/default.nix
index b8cfef1f3247e..68416ef2edc03 100644
--- a/pkgs/development/libraries/gumbo/default.nix
+++ b/pkgs/development/libraries/gumbo/default.nix
@@ -1,20 +1,21 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool }:
+{ lib
+, stdenv
+, fetchFromGitea
+, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "gumbo";
-  version = "0.10.1";
+  version = "0.12.1";
 
-  src = fetchFromGitHub {
-    owner = "google";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "grisha";
     repo = "gumbo-parser";
-    rev = "v${version}";
-    sha256 = "0xslckwdh2i0g2qjsb6rnm8mjmbagvziz0hjlf7d1lbljfms1iw1";
+    rev = version;
+    hash = "sha256-d4V4bI08Prmg3U0KGu4yIwpHcvTJT3NAd4lbzdBU/AE=";
   };
 
-  strictDeps = true;
-  nativeBuildInputs = [ autoconf automake libtool ];
-
-  preConfigure = "./autogen.sh";
+  nativeBuildInputs = [ autoreconfHook ];
 
   meta = with lib; {
     description = "C99 HTML parsing algorithm";
diff --git a/pkgs/development/libraries/hfst-ospell/default.nix b/pkgs/development/libraries/hfst-ospell/default.nix
index ad07025cc35d0..f0a0bc6bef48a 100644
--- a/pkgs/development/libraries/hfst-ospell/default.nix
+++ b/pkgs/development/libraries/hfst-ospell/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , autoreconfHook
 , fetchFromGitHub
+, fetchpatch
 , icu
 , libarchive
 , pkg-config
@@ -18,6 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-16H1nbAIe+G71+TnlLG0WnH9LktZwmc0d0O+oYduH1k=";
   };
 
+  patches = [
+    # Pull upstream fix for gcc-13
+    (fetchpatch {
+      name = "cstdint.patch";
+      url = "https://github.com/hfst/hfst-ospell/commit/7481bffbf622bc9aee3547183fbe8db9cf8b22ce.patch";
+      hash = "sha256-q/B5mLx8Oc0nIRe3n3gl0OTyjIaEMCBsPc1GvpE226c=";
+    })
+  ];
+
   buildInputs = [
     icu
     libarchive
diff --git a/pkgs/development/libraries/intel-media-sdk/default.nix b/pkgs/development/libraries/intel-media-sdk/default.nix
index da8568bc8dc5c..b20b6782d9b06 100644
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, gtest, libdrm, libpciaccess, libva, libX11
-, libXau, libXdmcp, libpthreadstubs }:
+, libXau, libXdmcp, libpthreadstubs, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "intel-media-sdk";
@@ -12,6 +12,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-wno3a/ZSKvgHvZiiJ0Gq9GlrEbfHCizkrSiHD6k/Loo=";
   };
 
+  patches = [
+    # https://github.com/Intel-Media-SDK/MediaSDK/pull/3005
+    (fetchpatch {
+      name = "include-cstdint-explicitly.patch";
+      url = "https://github.com/Intel-Media-SDK/MediaSDK/commit/a4f37707c1bfdd5612d3de4623ffb2d21e8c1356.patch";
+      hash = "sha256-OPwGzcMTctJvHcKn5bHqV8Ivj4P7+E4K9WOKgECqf04=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     libdrm libva libpciaccess libX11 libXau libXdmcp libpthreadstubs
diff --git a/pkgs/development/libraries/ipu6-camera-hal/default.nix b/pkgs/development/libraries/ipu6-camera-hal/default.nix
index 7fce11d21a43d..3ec63fd0807d3 100644
--- a/pkgs/development/libraries/ipu6-camera-hal/default.nix
+++ b/pkgs/development/libraries/ipu6-camera-hal/default.nix
@@ -8,20 +8,32 @@
 
 # runtime
 , expat
-, ipu6-camera-bin
+, ipu6-camera-bins
 , libtool
 , gst_all_1
-}:
 
+# Pick one of
+# - ipu6 (Tiger Lake)
+# - ipu6ep (Alder Lake)
+# - ipu6epmtl (Meteor Lake)
+, ipuVersion ? "ipu6"
+}:
+let
+  ipuTarget = {
+    "ipu6" = "ipu_tgl";
+    "ipu6ep" = "ipu_adl";
+    "ipu6epmtl" = "ipu_mtl";
+  }.${ipuVersion};
+in
 stdenv.mkDerivation {
-  pname = "${ipu6-camera-bin.ipuVersion}-camera-hal";
-  version = "unstable-2023-02-08";
+  pname = "${ipuVersion}-camera-hal";
+  version = "unstable-2023-09-25";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipu6-camera-hal";
-    rev = "884b81aae0ea19a974eb8ccdaeef93038136bdd4";
-    hash = "sha256-AePL7IqoOhlxhfPRLpCman5DNh3wYS4MUcLgmgBUcCM=";
+    rev = "9fa05a90886d399ad3dda4c2ddc990642b3d20c9";
+    hash = "sha256-yS1D7o6dsQ4FQkjfwcisOxcP7Majb+4uQ/iW5anMb5c=";
   };
 
   nativeBuildInputs = [
@@ -29,25 +41,23 @@ stdenv.mkDerivation {
     pkg-config
   ];
 
+  PKG_CONFIG_PATH = "${lib.makeLibraryPath [ ipu6-camera-bins ]}/${ipuTarget}/pkgconfig";
+
   cmakeFlags = [
-    "-DIPU_VER=${ipu6-camera-bin.ipuVersion}"
+    "-DIPU_VER=${ipuVersion}"
     # missing libiacss
     "-DUSE_PG_LITE_PIPE=ON"
-    # missing libipu4
-    "-DENABLE_VIRTUAL_IPU_PIPE=OFF"
   ];
 
   NIX_CFLAGS_COMPILE = [
     "-Wno-error"
-    "-I${lib.getDev ipu6-camera-bin}/include/ia_imaging"
-    "-I${lib.getDev ipu6-camera-bin}/include/ia_camera"
   ];
 
   enableParallelBuilding = true;
 
   buildInputs = [
     expat
-    ipu6-camera-bin
+    ipu6-camera-bins
     libtool
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
@@ -59,12 +69,13 @@ stdenv.mkDerivation {
   '';
 
   postFixup = ''
-    substituteInPlace $out/lib/pkgconfig/libcamhal.pc \
-      --replace 'prefix=/usr' "prefix=$out"
+    for lib in $out/lib/*.so; do
+      patchelf --add-rpath "${lib.makeLibraryPath [ ipu6-camera-bins ]}/${ipuTarget}" $lib
+    done
   '';
 
   passthru = {
-    inherit (ipu6-camera-bin) ipuVersion;
+    inherit ipuVersion;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index f89152820698d..af99944dae721 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -13,12 +13,12 @@ stdenv.mkDerivation rec {
     patchShebangs test_jbig2dec.py
   '';
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
-
   nativeBuildInputs = [ autoconf automake libtool ];
 
+  # `autogen.sh` runs `configure`, and expects that any flags needed
+  # by `configure` (like `--host`) are passed to `autogen.sh`.
+  configureScript = "./autogen.sh";
+
   nativeCheckInputs = [ python3 ];
   doCheck = true;
 
diff --git a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
index a33a55d63e7dd..7109a5d6dfd11 100644
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@@ -1,21 +1,18 @@
 { ffmpeg_6-full
-, nv-codec-headers-12
 , chromaprint
 , fetchFromGitHub
 , lib
 }:
 
-(ffmpeg_6-full.override {
-  nv-codec-headers-11 = nv-codec-headers-12;
-}).overrideAttrs (old: rec {
+ffmpeg_6-full.overrideAttrs (old: rec {
   pname = "jellyfin-ffmpeg";
-  version = "6.0-7";
+  version = "6.0.1-1";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    sha256 = "sha256-Z4getn/mVYIRANkIOyt7jMpcqHBvq5GXLK/ST5zV1r4=";
+    hash = "sha256-LMwGxx++z6TpZLnpeRGraid4653Mp8T4pY5EP4Z7GXY=";
   };
 
   buildInputs = old.buildInputs ++ [ chromaprint ];
diff --git a/pkgs/development/libraries/json-c/default.nix b/pkgs/development/libraries/json-c/default.nix
index 785548c211a93..ab3d2be6f0102 100644
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@@ -1,24 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "json-c";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner = "json-c";
     repo = "json-c";
-    rev = "json-c-0.16-20220414";
-    sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
+    rev = "json-c-0.17-20230812";
+    hash = "sha256-R5KIJ0xVgGqffjzJaZvvvhAneJ+ZBuanyF6KYTTxb58=";
   };
 
-  patches = [
-    # needed for emscripten, which uses LLVM 15+
-    (fetchpatch {
-      url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
-      sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
-    })
-  ];
-
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
@@ -31,9 +27,10 @@ stdenv.mkDerivation rec {
       and parse JSON formatted strings back into the C representation of JSON
       objects.
     '';
-    homepage    = "https://github.com/json-c/json-c/wiki";
+    homepage = "https://github.com/json-c/json-c/wiki";
+    changelog = "https://github.com/json-c/json-c/blob/${finalAttrs.src.rev}/ChangeLog";
     maintainers = with maintainers; [ lovek323 ];
-    platforms   = platforms.unix;
+    platforms = platforms.unix;
     license = licenses.mit;
   };
-}
+})
diff --git a/pkgs/development/libraries/kde-frameworks/default.nix b/pkgs/development/libraries/kde-frameworks/default.nix
index 4245aa0ed20ec..cc87ec2afa57b 100644
--- a/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/default.nix
@@ -120,7 +120,8 @@ let
       kwindowsystem = callPackage ./kwindowsystem {};
       modemmanager-qt = callPackage ./modemmanager-qt.nix {};
       networkmanager-qt = callPackage ./networkmanager-qt.nix {};
-      oxygen-icons5 = callPackage ./oxygen-icons5.nix {};
+      oxygen-icons = callPackage ./oxygen-icons.nix {};
+      oxygen-icons5 = oxygen-icons;
       prison = callPackage ./prison.nix {};
       qqc2-desktop-style = callPackage ./qqc2-desktop-style.nix {};
       solid = callPackage ./solid {};
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index f53e0d6c16bff..590818546a4bf 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.112/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.113/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix b/pkgs/development/libraries/kde-frameworks/oxygen-icons.nix
index 7121944d5d39f..4760c51abe542 100644
--- a/pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix
+++ b/pkgs/development/libraries/kde-frameworks/oxygen-icons.nix
@@ -5,7 +5,7 @@
 }:
 
 mkDerivation {
-  pname = "oxygen-icons5";
+  pname = "oxygen-icons";
   meta.license = lib.licenses.lgpl3Plus;
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index f6909957ba445..06b5e6b04cfa9 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/attica-5.112.0.tar.xz";
-      sha256 = "0syg508bjfq5ycr246p3f4q37ihvqk5j7n66vkn7h7dvgwspjff5";
-      name = "attica-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/attica-5.113.0.tar.xz";
+      sha256 = "0p6n2jvky5x9gpwmp31mdxf0bzywaljgnkszgbklyc35xk9i6j14";
+      name = "attica-5.113.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/baloo-5.112.0.tar.xz";
-      sha256 = "17h83s5r70hg8qjv9vli43zv854jll40cmmh2pjcg7nlfi1ypcbz";
-      name = "baloo-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/baloo-5.113.0.tar.xz";
+      sha256 = "1jv7202dj2w0vcv49bgp0iv1sfy3kdqr974rcr77pcfzhhda9bix";
+      name = "baloo-5.113.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/bluez-qt-5.112.0.tar.xz";
-      sha256 = "03kzvklzj9h4sl1850c1lh4b3z9lis7d6l9fb9cfnffh3wjpjagb";
-      name = "bluez-qt-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/bluez-qt-5.113.0.tar.xz";
+      sha256 = "1y6nkl9zc5298jc6klxz88h6srmma085w1q5l4jmjihgys2zkcx7";
+      name = "bluez-qt-5.113.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/breeze-icons-5.112.0.tar.xz";
-      sha256 = "0n3xdja42hzn3hssj0a8d97kkb790kinp2xmslfl7w8izsz53p39";
-      name = "breeze-icons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/breeze-icons-5.113.0.tar.xz";
+      sha256 = "0kb3wchx84dpi77zsi1b9pzlkhg3sjagxcsf1pdappagq3xn1p48";
+      name = "breeze-icons-5.113.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/extra-cmake-modules-5.112.0.tar.xz";
-      sha256 = "1qn2shanzsv06q34zwhkjhb88j7crdp83qp265gpxmc049vq845c";
-      name = "extra-cmake-modules-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/extra-cmake-modules-5.113.0.tar.xz";
+      sha256 = "1i1vpf9860cwrq5b01yrgf94hmzk9dx637j638shgjmyxr058pi6";
+      name = "extra-cmake-modules-5.113.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/frameworkintegration-5.112.0.tar.xz";
-      sha256 = "1kiy4vcr8lj82mhpgn99yw4w6lwr26yjmsfdv3n6ha667gqv2gn6";
-      name = "frameworkintegration-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/frameworkintegration-5.113.0.tar.xz";
+      sha256 = "17i7frachq23kfg78ar33x5acwf7pmwl1a5c02qif44mml8b09hi";
+      name = "frameworkintegration-5.113.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kactivities-5.112.0.tar.xz";
-      sha256 = "0nzbvby11f14h5w2q5wa5kij7bpx01ffqsi8mmjk71imhq5mzkfz";
-      name = "kactivities-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kactivities-5.113.0.tar.xz";
+      sha256 = "1d9lkhp344wdss9vab3gh9h31f1k6fifdhp17fblpkykgyvbb26y";
+      name = "kactivities-5.113.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kactivities-stats-5.112.0.tar.xz";
-      sha256 = "0czic2s147nhjphdkfymnakrw73bzi0pbmb8s3frrxsf4yp7gvzy";
-      name = "kactivities-stats-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kactivities-stats-5.113.0.tar.xz";
+      sha256 = "136z2njw3k2l71xp4vg10sm5q925xh8yfr9a784wnr0kwngdb71i";
+      name = "kactivities-stats-5.113.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kapidox-5.112.0.tar.xz";
-      sha256 = "0fa80ncx4h5izhw6vjjglmxcs9h4rvf2q1bcm0m4zcpky5h8bdqi";
-      name = "kapidox-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kapidox-5.113.0.tar.xz";
+      sha256 = "05407c01wnjyslbbz0w5wipjpx6ng3izya41mg13g700ainj9q1x";
+      name = "kapidox-5.113.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/karchive-5.112.0.tar.xz";
-      sha256 = "0rzxxgp5hcs63yfqisvf1m2m0qyrj2ri9966h5hc25jh5ajrgmi7";
-      name = "karchive-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/karchive-5.113.0.tar.xz";
+      sha256 = "03a3p85hmx4ycfp0y5l9yw4cy3i9jwy7jd27psmckr4q0538k91d";
+      name = "karchive-5.113.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kauth-5.112.0.tar.xz";
-      sha256 = "1xq5jhnp3dyykx84p5ijhi6kj0x2iz8k665bkkz4zcv9l8gf9jv7";
-      name = "kauth-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kauth-5.113.0.tar.xz";
+      sha256 = "0ncpyq2l53p4yhhxkvk23x0ji9amrbnm6kbz8dp573cqww79pih2";
+      name = "kauth-5.113.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kbookmarks-5.112.0.tar.xz";
-      sha256 = "12m8wx8sv12mwj2xprbr3ywr66mq3415byjfsz8f5yx4lhywkcfi";
-      name = "kbookmarks-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kbookmarks-5.113.0.tar.xz";
+      sha256 = "1fgnh8amy2ghn50i59al0iyqvj05pzdxai9qxqzbvi65f1pibi7d";
+      name = "kbookmarks-5.113.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcalendarcore-5.112.0.tar.xz";
-      sha256 = "0najg934lylb5m64lmkpv3v7ri2g3ncsg8ycg7gkm8r93nypa60r";
-      name = "kcalendarcore-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcalendarcore-5.113.0.tar.xz";
+      sha256 = "18psjzqcfzaplcfjpjda983mrpv306il0j49q3rm9hj9ycj54wc2";
+      name = "kcalendarcore-5.113.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcmutils-5.112.0.tar.xz";
-      sha256 = "0b4l5hf90jrbj4bbrkmyz1va6znwd8dpp2w0i5h002xbpf6vwp2y";
-      name = "kcmutils-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcmutils-5.113.0.tar.xz";
+      sha256 = "1xbfzw2zfl966zp70jzfp3hjzn334zf4hnwr82priffafgrin57s";
+      name = "kcmutils-5.113.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcodecs-5.112.0.tar.xz";
-      sha256 = "0pnmqq5asj361x9fk1vapwssafbb2zxjr0nh8lp8666f675wg2yx";
-      name = "kcodecs-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcodecs-5.113.0.tar.xz";
+      sha256 = "1xvaq0yg4n4lwyq3yx2m8jrvfg7f0qrwgxxam4rmp2l245bvn34i";
+      name = "kcodecs-5.113.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcompletion-5.112.0.tar.xz";
-      sha256 = "1k09ahwgz1fipdc1l2k13r97hgyvwjsr5dlvhkbrd384sip84q8j";
-      name = "kcompletion-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcompletion-5.113.0.tar.xz";
+      sha256 = "016280h98j1ssvc3a4b3vyh4s93s9y9hn1jrpbfbkm9xxnvi7k79";
+      name = "kcompletion-5.113.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kconfig-5.112.0.tar.xz";
-      sha256 = "080qv53727ijdz9325kzl81nxchds3cpy6siv1h5s4scbb92dpl6";
-      name = "kconfig-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kconfig-5.113.0.tar.xz";
+      sha256 = "0fwhn3yp4gfwjiy5dx7gs0zd65yjlrrzkqpy7fpg7n97qf99q2a8";
+      name = "kconfig-5.113.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kconfigwidgets-5.112.0.tar.xz";
-      sha256 = "0yk84f9pwb600pligwa2022r9srz4fd7kkf90r7q7vmf5r3hl3r9";
-      name = "kconfigwidgets-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kconfigwidgets-5.113.0.tar.xz";
+      sha256 = "0bmk5qxiss7a71xpfsbqj831wkcf94b7wfbw9xisvnxlfmf60y4v";
+      name = "kconfigwidgets-5.113.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcontacts-5.112.0.tar.xz";
-      sha256 = "0q20xnj43ysq1wdymvl8j8zyvycsqs4hm2x72gz42hd9dlbp77s5";
-      name = "kcontacts-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcontacts-5.113.0.tar.xz";
+      sha256 = "1y9cdv1g2ypwl4b0hk1sxk7lvb5qkbm4n1gh62plqsran62jsimm";
+      name = "kcontacts-5.113.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcoreaddons-5.112.0.tar.xz";
-      sha256 = "032n4fl4d8lhgmd08f7nfa18izrccggxhdbgk33vnf1lw7c6yamp";
-      name = "kcoreaddons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcoreaddons-5.113.0.tar.xz";
+      sha256 = "1bhanzfjw2i49sx2hjnim8k72vvbs7gyig7nkqkgbaxzpa8qgwrf";
+      name = "kcoreaddons-5.113.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcrash-5.112.0.tar.xz";
-      sha256 = "1sarh8ncibl8bz7pkd5xs4dd5vciyj82pckazxx4f482irdzyxzx";
-      name = "kcrash-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcrash-5.113.0.tar.xz";
+      sha256 = "1mg90xm6ckcd30s07psn30sgh81lx8kfs0p1h6cblg4q8bkgkndv";
+      name = "kcrash-5.113.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdav-5.112.0.tar.xz";
-      sha256 = "1m6basdd6p0yaij9jdsc35sj198gsackk3dx4kci3a8zlvvag32g";
-      name = "kdav-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdav-5.113.0.tar.xz";
+      sha256 = "1djng9c741xairr84nvjbkq4dk551p7yk91g8d4nndy8s1kiz1dv";
+      name = "kdav-5.113.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdbusaddons-5.112.0.tar.xz";
-      sha256 = "0n04z0srf3xzd0m9sa9f3q7hrzbjrg1hbajzm89p71hfr7dmcgjq";
-      name = "kdbusaddons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdbusaddons-5.113.0.tar.xz";
+      sha256 = "101a406f8i0wgaxd0ilvfcb3plzjgvxw9bhhm5pin6fpr0xkjrnk";
+      name = "kdbusaddons-5.113.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdeclarative-5.112.0.tar.xz";
-      sha256 = "1wzhqp5mzbk9lz7ks4ggzb1k6c3fkxwwyzdapwfgn79k5qrhqvjk";
-      name = "kdeclarative-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdeclarative-5.113.0.tar.xz";
+      sha256 = "1wj9arkmjdrac04cq2w5bw5184jnlq5xn2cw6n7lajc31yrbc0rk";
+      name = "kdeclarative-5.113.0.tar.xz";
     };
   };
   kded = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kded-5.112.0.tar.xz";
-      sha256 = "16qiybj9q1v6j5csyx2f7pdpxih60psszyyvq9yj4ycdzjhjzmmn";
-      name = "kded-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kded-5.113.0.tar.xz";
+      sha256 = "1vb3z7r2l206n7p70a4cbkrm7fvyk7hqqf0bz7514r4g86l4l5n4";
+      name = "kded-5.113.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kdelibs4support-5.112.0.tar.xz";
-      sha256 = "0rrzqyawck0mmh8xfs73jx6jghv5bm1346h3xkhgw6ydfzdv3kcv";
-      name = "kdelibs4support-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kdelibs4support-5.113.0.tar.xz";
+      sha256 = "1z843zq1g5n3b8gb20y8266hyikvbzdsgc77gvcgzvqfdxk19l24";
+      name = "kdelibs4support-5.113.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kdesignerplugin-5.112.0.tar.xz";
-      sha256 = "0rrk7d06m1ywxf6n1crf510imidhfkpfb58qpaby2fzwb1ifmlyj";
-      name = "kdesignerplugin-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kdesignerplugin-5.113.0.tar.xz";
+      sha256 = "05hwq8rpm1f9ad5fyk2gjqxm6gvvx2gx2zdbklww9ghlh8qndl9i";
+      name = "kdesignerplugin-5.113.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdesu-5.112.0.tar.xz";
-      sha256 = "1yn16q3yrycrh6xsfh7faa5n9cr0lafiwh9dwr5p8rm62nmas83g";
-      name = "kdesu-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdesu-5.113.0.tar.xz";
+      sha256 = "085d3d6qpl4m7z8smm0bq9khfjjglpb1gd9n8q0d541127y2cpq4";
+      name = "kdesu-5.113.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kdewebkit-5.112.0.tar.xz";
-      sha256 = "11za35zxaa3mlvmrkp4rx47sl6ihbc1xgcaf18r6a0cyn4zhx2fz";
-      name = "kdewebkit-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kdewebkit-5.113.0.tar.xz";
+      sha256 = "18bmg88xj07h8y5f3f2ckjs9m61mf8jrxrg4vg8hrf4nabxz20xn";
+      name = "kdewebkit-5.113.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdnssd-5.112.0.tar.xz";
-      sha256 = "0cd1dm44f12n29d8idh29djhfd2z6lj4hc4l42hxx2nasi009p2s";
-      name = "kdnssd-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdnssd-5.113.0.tar.xz";
+      sha256 = "1hbb9zy1f13m45b6kzndxw619vnmx0s418brqgkdaxgsh12j5anq";
+      name = "kdnssd-5.113.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdoctools-5.112.0.tar.xz";
-      sha256 = "1cinjrbg31pilzlir9vmigf86ypgpxr9mmyqpjfvq6yxvxfnq7li";
-      name = "kdoctools-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdoctools-5.113.0.tar.xz";
+      sha256 = "0cfs4znhp7psrz99j3brp8q39gg0bpzvkrdx90zl6vvrc06d2zaa";
+      name = "kdoctools-5.113.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kemoticons-5.112.0.tar.xz";
-      sha256 = "037xj9i1x81npm7fyqizkyi7k4slakx1c5x9drp0py5133a0k6z8";
-      name = "kemoticons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kemoticons-5.113.0.tar.xz";
+      sha256 = "127frvsp1h9hg755vz2i609wxqqgzgsz15iqr7hcpbmmf6xvm8i2";
+      name = "kemoticons-5.113.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kfilemetadata-5.112.0.tar.xz";
-      sha256 = "1yvz3439jmg8m0ry9z0930ya679fahphb6s7mci23xf5zjpczgy4";
-      name = "kfilemetadata-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kfilemetadata-5.113.0.tar.xz";
+      sha256 = "1ap25y66y1r185fghvkkkkp4f6acnkazny8wxw5hv1gg25ilpsir";
+      name = "kfilemetadata-5.113.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kglobalaccel-5.112.0.tar.xz";
-      sha256 = "0flb0rkw5bh1xb706pgzsjq41slma4xwg3ghmvrdr622qf87w9hh";
-      name = "kglobalaccel-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kglobalaccel-5.113.0.tar.xz";
+      sha256 = "0ibm1wd7fhi3j5za0agyq2zrs9nx5a8b47iijkzgkpz9ylxniwrs";
+      name = "kglobalaccel-5.113.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kguiaddons-5.112.0.tar.xz";
-      sha256 = "0yw4ikb14f2q1z0hr64bxnxvg770jjllqfvhbnl5hn3m7l61psmb";
-      name = "kguiaddons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kguiaddons-5.113.0.tar.xz";
+      sha256 = "1ykhxgx89x1qv916pcz3j0q14ylalg9v23jjw0dbwpg5hlj4qlyc";
+      name = "kguiaddons-5.113.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kholidays-5.112.0.tar.xz";
-      sha256 = "1b5jdss17wvm66gwzh6qb0caz9b3fnr6cd902bvqa7dr1aby4j52";
-      name = "kholidays-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kholidays-5.113.0.tar.xz";
+      sha256 = "1wq397j3m3s9a45k9h5hsdsfansvb3a5q8biag2w3fsb1i84id0i";
+      name = "kholidays-5.113.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/khtml-5.112.0.tar.xz";
-      sha256 = "0rw6286w971q61gahm1qzic0gsfmfz8x449jw6zy38d9k17h7s2n";
-      name = "khtml-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/khtml-5.113.0.tar.xz";
+      sha256 = "0m284rwq8f49j71lcapzr4qi0f72a0adnv67mfg5blar867161mq";
+      name = "khtml-5.113.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/ki18n-5.112.0.tar.xz";
-      sha256 = "06wng9mpr2ln9dd1ayvwglc6071iqg5285jisg95vgf2c3kl5m9k";
-      name = "ki18n-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/ki18n-5.113.0.tar.xz";
+      sha256 = "0hl0qp3653xiwa5ndk82ygy2kgrc0pygqkknb1cx5w54s56bm57w";
+      name = "ki18n-5.113.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kiconthemes-5.112.0.tar.xz";
-      sha256 = "04nqw9a2c7bba5y7y741wqwm95jfpbva71q1fj43grd6hcqlff53";
-      name = "kiconthemes-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kiconthemes-5.113.0.tar.xz";
+      sha256 = "0q2c1s8pwl7dnx9v7q061zn5n1prk0vv0j77kki9wfncjaf15g0g";
+      name = "kiconthemes-5.113.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kidletime-5.112.0.tar.xz";
-      sha256 = "0pch2baf9867w6llk98mxag2y3sjz6irqci88rrsnwn4s1vcs356";
-      name = "kidletime-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kidletime-5.113.0.tar.xz";
+      sha256 = "1cdfhn3mcxvizba1gpf0viba3g0mnva3l226lkca3p9ps8c4z3rm";
+      name = "kidletime-5.113.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kimageformats-5.112.0.tar.xz";
-      sha256 = "1lw9vvmb032ymy0a1443q3p9nwn8shc9kbaz05jw4jwa74wp7i65";
-      name = "kimageformats-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kimageformats-5.113.0.tar.xz";
+      sha256 = "0gys83sazgbj7h3yiaacqr464z951ixygrhzcw16cnqjm8phic44";
+      name = "kimageformats-5.113.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kinit-5.112.0.tar.xz";
-      sha256 = "1mij6nw1w0zyv724096pfbb0r95300yqb884bx3wlm5nibawwpz7";
-      name = "kinit-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kinit-5.113.0.tar.xz";
+      sha256 = "1ydmgxyr5j9zi0a5vlb64kkjxka3rsyvzj10y3dww92qyapnn2bv";
+      name = "kinit-5.113.0.tar.xz";
     };
   };
   kio = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kio-5.112.0.tar.xz";
-      sha256 = "16gv0f8l4jn19mrwc52c6gw2n8hb28n6v7x6kx7qbs3z0wf57f44";
-      name = "kio-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kio-5.113.0.tar.xz";
+      sha256 = "1bjmv3wdpmzqbv1xzzl0ydirccbknnjyqn6wzb057zgy7kpi1cd8";
+      name = "kio-5.113.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kirigami2-5.112.0.tar.xz";
-      sha256 = "048f3sji3dx7q415fkmkj0xmnl0dxacdr9d08d5rqkxz2d94hzk3";
-      name = "kirigami2-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kirigami2-5.113.0.tar.xz";
+      sha256 = "0zy3s841q2xw4d048a3qh4cfh9kb3qaqxml4ny5zi73crm173h8y";
+      name = "kirigami2-5.113.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kitemmodels-5.112.0.tar.xz";
-      sha256 = "130avvp4lq8f8pag39mna0p3rjyvhbq6akng9d4l01nf8287zv2s";
-      name = "kitemmodels-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kitemmodels-5.113.0.tar.xz";
+      sha256 = "01i1s7rw7ndp3gnl3bg0pv8a9qz95rmz0jxkw97p72gcah2q2yvk";
+      name = "kitemmodels-5.113.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kitemviews-5.112.0.tar.xz";
-      sha256 = "1xpk5xfrp38bjgsyvc3wmcq7vj1sa2wxz0wld2bby3nsixbrdq68";
-      name = "kitemviews-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kitemviews-5.113.0.tar.xz";
+      sha256 = "0wnmgm72kv7vxadsrkdbnjknb4lkzrmn6gk7car7jx2i91kz7xdd";
+      name = "kitemviews-5.113.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kjobwidgets-5.112.0.tar.xz";
-      sha256 = "1x1ip1c1v7mydvrz620gaajx6c1p88vlbi3i66fdfnxvhkcrqzqv";
-      name = "kjobwidgets-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kjobwidgets-5.113.0.tar.xz";
+      sha256 = "0f5shrapjvwp8bc34vypzfsfl07pj7nmdflf9lcwc8h3kwf2rxqr";
+      name = "kjobwidgets-5.113.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kjs-5.112.0.tar.xz";
-      sha256 = "00nr7darrijxm7czvjwvs4jrw8yd8ypz49l4xym19fvslcb5d0x9";
-      name = "kjs-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kjs-5.113.0.tar.xz";
+      sha256 = "0h50jyd9mddnavafikn9haqqcq1mql2v8qcc1c233ffplkx1f6hb";
+      name = "kjs-5.113.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kjsembed-5.112.0.tar.xz";
-      sha256 = "0hs6ka5qj1w3kha6rssvvpw6dh4pw001wfpfjzn8klawjwndjv1r";
-      name = "kjsembed-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kjsembed-5.113.0.tar.xz";
+      sha256 = "0bwsj0n3d038vs3n2mw6x8srbg4da40bw59q14cpv70ws1sg2r2n";
+      name = "kjsembed-5.113.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kmediaplayer-5.112.0.tar.xz";
-      sha256 = "1bdanmrbzyh6hbpkflq7gwrjm03647pbbiv670li0cmyfmnz904r";
-      name = "kmediaplayer-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kmediaplayer-5.113.0.tar.xz";
+      sha256 = "1nyn7x28j17yrb7zx31519h2ghp5h3pwk6baxais0q1mv9azyfay";
+      name = "kmediaplayer-5.113.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/knewstuff-5.112.0.tar.xz";
-      sha256 = "1l417xsqpwxv73wm0fdgjpfnvs19casm1x2xsl299pj66kcm1y7l";
-      name = "knewstuff-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/knewstuff-5.113.0.tar.xz";
+      sha256 = "0fj17rxyp9wmmc9jh8zjpgwpia9r4xlvabvkb4ynd1vhy58k8w51";
+      name = "knewstuff-5.113.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/knotifications-5.112.0.tar.xz";
-      sha256 = "1xlx91rn826gw3mqddvfs884mx95rhksf70wc1m5jd49cdcgw1mz";
-      name = "knotifications-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/knotifications-5.113.0.tar.xz";
+      sha256 = "1yzpf12wsi3h3v7z68b42rjdrnfkah6avq4y611b0r004shgkl1x";
+      name = "knotifications-5.113.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/knotifyconfig-5.112.0.tar.xz";
-      sha256 = "18qikgc5lp5xjmar823j0cgwqpgc8b5sr8rq1x2p23pbb9ywfpqj";
-      name = "knotifyconfig-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/knotifyconfig-5.113.0.tar.xz";
+      sha256 = "1gdzyxcc371lmnzc153k8wdyxgsv7r2y44j8d5srld36amssxnc6";
+      name = "knotifyconfig-5.113.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kpackage-5.112.0.tar.xz";
-      sha256 = "0g84q54yhm9a1h48pim371rjbl208ka56a6xx23zqis20wqjs0kp";
-      name = "kpackage-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kpackage-5.113.0.tar.xz";
+      sha256 = "04605kr2w0yhwx64lqq1qc1zmmip7vkxnxv3fs2846864814fkk2";
+      name = "kpackage-5.113.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kparts-5.112.0.tar.xz";
-      sha256 = "0mr45zk4i7jfazkawi7i2ry88y9a17wsny4ck0zln3ggb6wra32c";
-      name = "kparts-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kparts-5.113.0.tar.xz";
+      sha256 = "0mx95xrr6pad4q5p0sn2iqmc59787bpfkvkyiz9li56wynh1jf48";
+      name = "kparts-5.113.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kpeople-5.112.0.tar.xz";
-      sha256 = "0xfczzy2pwdszzzmyj8ldr1178d93za26j0rqbj3wnqsnji9yn6n";
-      name = "kpeople-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kpeople-5.113.0.tar.xz";
+      sha256 = "08g44hq1iywycf44imdqkql4gx2vyg87n1nxxqq6ssva0kybia7n";
+      name = "kpeople-5.113.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kplotting-5.112.0.tar.xz";
-      sha256 = "0a18ly62ilsmaihm398q1jvj10ccw00di3rywq0wq45n0ghnx7zx";
-      name = "kplotting-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kplotting-5.113.0.tar.xz";
+      sha256 = "16pfia711y9iqnl0svyg00g7a2x4ln8yaxmrmy74xj7y0dj5jcyj";
+      name = "kplotting-5.113.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kpty-5.112.0.tar.xz";
-      sha256 = "1p6rm94hvq6w54h84vhcqbbnj2gmypipj05vx7c9bnijy0d4nfxf";
-      name = "kpty-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kpty-5.113.0.tar.xz";
+      sha256 = "0hzn18lidiiaxr08fjhk0r5zh0m01ls46w1fyjnv42bvf7vd7v5y";
+      name = "kpty-5.113.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kquickcharts-5.112.0.tar.xz";
-      sha256 = "1c634jda7lqmv009jg2jdarkd08q1hf4fb3wnj35hilj37c57b5a";
-      name = "kquickcharts-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kquickcharts-5.113.0.tar.xz";
+      sha256 = "0v47c6mdx72rdz441zk4csc6a2bj6wi7772vlpz2yr3ay70l8f5d";
+      name = "kquickcharts-5.113.0.tar.xz";
     };
   };
   kross = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kross-5.112.0.tar.xz";
-      sha256 = "1b887bx4d3nr55305mk91wnm6bfhbgnqjmbc3a9jkv65c78j9hsa";
-      name = "kross-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kross-5.113.0.tar.xz";
+      sha256 = "1cqdcm086a4kjrb9k6cwqn05fg5ij3zppc8bi7dxrgrfxc494c8s";
+      name = "kross-5.113.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/krunner-5.112.0.tar.xz";
-      sha256 = "00bfszbpr2w21nz3vhih8hp0f9gzn1906axvib3jm1w3kjmy2avn";
-      name = "krunner-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/krunner-5.113.0.tar.xz";
+      sha256 = "0z7d6nyvrlgr7aw9ibz1xgp62220iwzvhqpqikwlxhc9hjggmdlh";
+      name = "krunner-5.113.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kservice-5.112.0.tar.xz";
-      sha256 = "01aj0yrlxlwr5sm1z0pq6caa4ijj3nsgqhza1zr4mzrx2ybf753z";
-      name = "kservice-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kservice-5.113.0.tar.xz";
+      sha256 = "09ph72jb40pkw1nzayvzzav4m6240amkj6jvx390dmsvr7jzn0nb";
+      name = "kservice-5.113.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/ktexteditor-5.112.0.tar.xz";
-      sha256 = "0d0cw9qd7mmnhdqayx4lcpd60hp1al5zwy565rsvxmjly564l3i9";
-      name = "ktexteditor-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/ktexteditor-5.113.0.tar.xz";
+      sha256 = "02nclhfgqximsl8w6la5w0fshzcj71nrz5kjb2p1s28xdf1ahvgg";
+      name = "ktexteditor-5.113.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/ktextwidgets-5.112.0.tar.xz";
-      sha256 = "0x83f0ih3c25yggmvyibyfaiikk4zc0k5gf6yr87c62ihgv7gniz";
-      name = "ktextwidgets-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/ktextwidgets-5.113.0.tar.xz";
+      sha256 = "060grfna4kj8nhxgk38yf3csqfgxg0358dkwmg8aw5y5k0jys2az";
+      name = "ktextwidgets-5.113.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kunitconversion-5.112.0.tar.xz";
-      sha256 = "1zi47yd3aydy2mcmgfgwp4g12w7681lyc1niq5p13670mxhlkrwc";
-      name = "kunitconversion-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kunitconversion-5.113.0.tar.xz";
+      sha256 = "1x7gwrz43wvd3r87x545bxxyzhqj87mhhx05dqh0b09vqk6gxzza";
+      name = "kunitconversion-5.113.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kwallet-5.112.0.tar.xz";
-      sha256 = "1v38wyz9hhhvzwrpxsjkd8yqyy4yv9hii1413ffcm9x971nliq2s";
-      name = "kwallet-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kwallet-5.113.0.tar.xz";
+      sha256 = "0aq8d5c5p9j19bzspd205gh297n7fh5f26m49826fx5mp1im4lwn";
+      name = "kwallet-5.113.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kwayland-5.112.0.tar.xz";
-      sha256 = "0nzpg4x9hg9jd1kg6sq0lh658kz3cz25z5kji7hpq2h0svmxx709";
-      name = "kwayland-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kwayland-5.113.0.tar.xz";
+      sha256 = "1anhvz4b1q835py451jznnfj9z2jh1fwnx4lfwhi67viaplpiwqg";
+      name = "kwayland-5.113.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kwidgetsaddons-5.112.0.tar.xz";
-      sha256 = "0x5mz04dwlpl0h75v0c5w04qjpcb3fbpjk7hbslwgfwr7gviqyib";
-      name = "kwidgetsaddons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kwidgetsaddons-5.113.0.tar.xz";
+      sha256 = "01rabfl2v5l9r3fgwgy75krib1486mdc4k3kfi035s6dvg8iy015";
+      name = "kwidgetsaddons-5.113.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kwindowsystem-5.112.0.tar.xz";
-      sha256 = "08ihg6zq979h4v6c157n80pi3cfsg9w9qiyqaw3h79365zji73j1";
-      name = "kwindowsystem-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kwindowsystem-5.113.0.tar.xz";
+      sha256 = "1hzavawsl14rsl9qb874zahvsvkrbcin7fg1xn1d7ssypphlis51";
+      name = "kwindowsystem-5.113.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kxmlgui-5.112.0.tar.xz";
-      sha256 = "17jsqzxn5wgwsm3lrfgdygyzvqibzv9vfgg11s2gc5bq9x4s0j8g";
-      name = "kxmlgui-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kxmlgui-5.113.0.tar.xz";
+      sha256 = "022l557z9jgrz2hj8hh9z7cjkvfhl5rdp81jhk2gd3wzmyf5zzmq";
+      name = "kxmlgui-5.113.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kxmlrpcclient-5.112.0.tar.xz";
-      sha256 = "09zwgrh336bk5cfab2zcdzcfdzjvlqa47ljfrciyh4h8m5f7y12h";
-      name = "kxmlrpcclient-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kxmlrpcclient-5.113.0.tar.xz";
+      sha256 = "141vlxxnyll5q0wg2va5prg0wf0hpymlzfkg37h1ngjwjs2x2yc1";
+      name = "kxmlrpcclient-5.113.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/modemmanager-qt-5.112.0.tar.xz";
-      sha256 = "0323zp03wj4ignfc94qg89h3j4qmh3mkdac5snr1axjaaf6sk6w8";
-      name = "modemmanager-qt-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/modemmanager-qt-5.113.0.tar.xz";
+      sha256 = "069irg7ckws06qzq5mwkxvzx4r2xqwagwif6dq284hjihrz38l8b";
+      name = "modemmanager-qt-5.113.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/networkmanager-qt-5.112.0.tar.xz";
-      sha256 = "1larg78j7rlbbscv04imc1k6f1srapr2yrbyxif38d4iipfg04f9";
-      name = "networkmanager-qt-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/networkmanager-qt-5.113.0.tar.xz";
+      sha256 = "03wdbw6dr9a49qcs1j2lm9q894rvdl8xqjpwm3yrrjb866yyhcg1";
+      name = "networkmanager-qt-5.113.0.tar.xz";
     };
   };
-  oxygen-icons5 = {
-    version = "5.112.0";
+  oxygen-icons = {
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/oxygen-icons5-5.112.0.tar.xz";
-      sha256 = "0yw2mixy5p8pw9866rfr0wcjhvilznakd0h6934svv0dk3lv054a";
-      name = "oxygen-icons5-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/oxygen-icons-5.113.0.tar.xz";
+      sha256 = "0grdn0gz59lfp4n5mmlan71x3iwgm87dnhk8mla02dn7hv0fl0xx";
+      name = "oxygen-icons-5.113.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/plasma-framework-5.112.0.tar.xz";
-      sha256 = "0nq8dzqk1hxzm8yngzgm9zqw8155fy38zq6k3613af5mgj7jmdhj";
-      name = "plasma-framework-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/plasma-framework-5.113.0.tar.xz";
+      sha256 = "0iijawnh9ri1n6qgdrraf3lq5sy7z0jy5ihmfzk22pn10ba992ky";
+      name = "plasma-framework-5.113.0.tar.xz";
     };
   };
   prison = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/prison-5.112.0.tar.xz";
-      sha256 = "1blgs0k4kz3smsf0qb9y6krzbssyv1hbqvjc7qvk4qwk81qhyfvq";
-      name = "prison-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/prison-5.113.0.tar.xz";
+      sha256 = "18y4gxj5zml59a8i7gzr5cbbzi5wyknbva2ihfdpqf85vw3x2wdp";
+      name = "prison-5.113.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/purpose-5.112.0.tar.xz";
-      sha256 = "1cqcmhbb26xypllmk3z4r0z8sw79idzz6nz72ahwa4ha0pqbl8p3";
-      name = "purpose-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/purpose-5.113.0.tar.xz";
+      sha256 = "0p5zcvrkaw71w8795x2a4lx3z977j6jcnwbi9wi1956gcx4avhhf";
+      name = "purpose-5.113.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/qqc2-desktop-style-5.112.0.tar.xz";
-      sha256 = "1k74vwj07xf3fjfj8ff9zx5ndzq5m3bdnj4zgymkxm1gk3r6gl5y";
-      name = "qqc2-desktop-style-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/qqc2-desktop-style-5.113.0.tar.xz";
+      sha256 = "0sk0sk7cq511m0rjmgsg1z8s4sy064qmbql472ljyblafm71wj6p";
+      name = "qqc2-desktop-style-5.113.0.tar.xz";
     };
   };
   solid = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/solid-5.112.0.tar.xz";
-      sha256 = "0hpm5akhk24fzbg27p6ql598s5mxa6n8h359ajf45afabimhjx0y";
-      name = "solid-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/solid-5.113.0.tar.xz";
+      sha256 = "0vhhkn15axfvlwrf9np91hnipw1lb2x9zh0ajpngvxzcnj6kvn7r";
+      name = "solid-5.113.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/sonnet-5.112.0.tar.xz";
-      sha256 = "026iivz27d7v4kpwkl6qwbcqnd71kvg77szy91fch37iki7z6361";
-      name = "sonnet-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/sonnet-5.113.0.tar.xz";
+      sha256 = "17v3a2j0vhx7mzv0wfgqky248m57gasyv1xbjqpzjdr3x2f1zhy6";
+      name = "sonnet-5.113.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/syndication-5.112.0.tar.xz";
-      sha256 = "03if949klq28kaf3xzcva917fqv7cn6pzjwsgymya3nc730kfsc8";
-      name = "syndication-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/syndication-5.113.0.tar.xz";
+      sha256 = "1nzcfk4qsjvrgci3vk78jjpbig61pm0y73h3qs83yld1zw3az3jx";
+      name = "syndication-5.113.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/syntax-highlighting-5.112.0.tar.xz";
-      sha256 = "1m88nfmf4kxliqkgm78f95yvsjv76xm2rmg92v9mg00r9d00y95h";
-      name = "syntax-highlighting-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/syntax-highlighting-5.113.0.tar.xz";
+      sha256 = "1blifnqikvrlkcskwjdk54mvh8yd4r0vzz282mi64w7alimlilgl";
+      name = "syntax-highlighting-5.113.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/threadweaver-5.112.0.tar.xz";
-      sha256 = "1i3qj6qf0sv5pf8d5wx6gy11dqyp4x4b4759gwbhlrizkm4fa7f9";
-      name = "threadweaver-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/threadweaver-5.113.0.tar.xz";
+      sha256 = "1x7i7mdg5v22y04m720k9fqj7xagm8qnlssb1xjs9nj0aqif8jgp";
+      name = "threadweaver-5.113.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/kdsoap/default.nix b/pkgs/development/libraries/kdsoap/default.nix
index 80eb6d6832075..c2f94b8e69276 100644
--- a/pkgs/development/libraries/kdsoap/default.nix
+++ b/pkgs/development/libraries/kdsoap/default.nix
@@ -1,11 +1,15 @@
-{ mkDerivation
+{ stdenv
 , lib
 , fetchurl
 , cmake
 , qtbase
+, wrapQtAppsHook
 }:
 
-mkDerivation rec {
+let
+  isQt6 = lib.versions.major qtbase.version == "6";
+  cmakeName = if isQt6 then "KDSoap-qt6" else "KDSoap";
+in stdenv.mkDerivation rec {
   pname = "kdsoap";
   version = "2.1.1";
 
@@ -16,15 +20,17 @@ mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
 
   buildInputs = [ qtbase ];
 
+  cmakeFlags = [ (lib.cmakeBool "KDSoap_QT6" isQt6) ];
+
   postInstall = ''
-    moveToOutput bin/kdwsdl2cpp "$dev"
-    sed -i "$out/lib/cmake/KDSoap/KDSoapTargets.cmake" \
+    moveToOutput bin/kdwsdl2cpp* "$dev"
+    sed -i "$out/lib/cmake/${cmakeName}/KDSoapTargets.cmake" \
         -e "/^  INTERFACE_INCLUDE_DIRECTORIES/ c   INTERFACE_INCLUDE_DIRECTORIES \"$dev/include\""
-    sed -i "$out/lib/cmake/KDSoap/KDSoapTargets-release.cmake" \
+    sed -i "$out/lib/cmake/${cmakeName}/KDSoapTargets-release.cmake" \
         -e "s@$out/bin@$dev/bin@"
   '';
 
diff --git a/pkgs/development/libraries/kquickimageedit/default.nix b/pkgs/development/libraries/kquickimageedit/default.nix
index 7b81d8ca7c63a..cd43904a123e9 100644
--- a/pkgs/development/libraries/kquickimageedit/default.nix
+++ b/pkgs/development/libraries/kquickimageedit/default.nix
@@ -1,10 +1,12 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitLab
 , extra-cmake-modules
+, qtbase
+, qtdeclarative
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "kquickimageeditor";
   version = "0.3.0";
 
@@ -17,6 +19,9 @@ mkDerivation rec {
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [ qtbase qtdeclarative ];
+  cmakeFlags = ["-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}"];
+  dontWrapQtApps = true;
 
   meta = with lib; {
     description = "Set of QtQuick components providing basic image editing capabilities";
diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index e1f6c3d2212c8..ab984884073a3 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.15";
+  version = "2.16";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    sha256 = "sha256-sgy8vQ9QNDO+Kk6BRiEG+mEFCjUHTcJKTjVnktlxqzk=";
+    hash = "sha256-2HPTSti5tM6gEGMfGmIo0gh0deTcXnY+uBrMI9nUWlE=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/libao/default.nix b/pkgs/development/libraries/libao/default.nix
index 4a07ba9da7d89..63cb0401aae40 100644
--- a/pkgs/development/libraries/libao/default.nix
+++ b/pkgs/development/libraries/libao/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkg-config, libpulseaudio, alsa-lib, libcap
+{ stdenv, lib, fetchFromGitHub, fetchpatch
+, autoreconfHook, pkg-config, libpulseaudio, alsa-lib, libcap
 , CoreAudio, CoreServices, AudioUnit
 , usePulseAudio }:
 
@@ -14,6 +15,15 @@ stdenv.mkDerivation rec {
     sha256 = "0svgk4sc9kdhcsfyvbvgm5vpbg3sfr6z5rliflrw49v3x2i4vxq5";
   };
 
+  patches = [
+    # add header time.h for nanosecond
+    (fetchpatch {
+      name = "nanosecond-header.patch";
+      url = "https://github.com/xiph/libao/commit/1f998f5d6d77674dad01b181811638578ad68242.patch";
+      hash = "sha256-cvlyhQq1YS4pVya44LfsKD1R6iSOONsHJGRbP5LlanQ=";
+    })
+  ];
+
   configureFlags = [
     "--disable-broken-oss"
     "--enable-alsa-mmap"
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 826dc544a88f0..78aac8754787b 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.7.1";
+  version = "3.8.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    hash = "sha256-v2SBiDE4zZe3LMrlo/tP9GzmG/PJZ42rKi1svKJR6ZA=";
+    hash = "sha256-JxMz+XnjmUvk8TlTqdU2HP1Gq3bXfcLkXp5AEv9+7hM=";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/libaom/outputs.patch b/pkgs/development/libraries/libaom/outputs.patch
index bbf660aaa5c95..7b34338403f2a 100644
--- a/pkgs/development/libraries/libaom/outputs.patch
+++ b/pkgs/development/libraries/libaom/outputs.patch
@@ -43,7 +43,7 @@ index e8fff2e77..b8a73aad4 100644
 -                  "CMAKE_INSTALL_LIBDIR" "CMAKE_PROJECT_NAME"
 +                  "CMAKE_INSTALL_BINDIR" "CMAKE_INSTALL_FULL_INCLUDEDIR"
 +                  "CMAKE_INSTALL_FULL_LIBDIR" "CMAKE_PROJECT_NAME"
-                   "CONFIG_MULTITHREAD" "HAVE_PTHREAD_H")
+                   "CONFIG_MULTITHREAD")
  
  foreach(arg ${REQUIRED_ARGS})
 @@ -35,15 +35,15 @@ else()
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index 02e069a352906..2cb7920cb5f9e 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -19,13 +19,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libavif";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "AOMediaCodec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ku0UgVBba1tHBzHjx5yf9hRAtbmXf2n4gEdAaGr3qTY=";
+    hash = "sha256-0MLr9wdIs3c4pOAF4rlC8QNQXlrK3YGXILS9foVKfVM=";
   };
 
   # reco: encode libaom slowest but best, decode dav1d fastest
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index de366da98b962..6259fa5b48393 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, autoreconfHook
+, cmake
 , pkg-config
 
 , callPackage
@@ -14,17 +14,17 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: rec {
-  version = "1.0.14";
+  version = "1.0.15";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aZRtF4wYWxi/6ORNu7yVxFFdkvJTvBwPinL5lC0Mlqg=";
+    hash = "sha256-guiLM4RNe5O0qpeCoQUbs1Z7j0wp8iK9za2+6NIB8yY=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index a7ead8f227472..5cb8f2cbad8e8 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.118";
+  version = "2.4.119";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-p3e9hfK1/JxX+IbIIFgwBXgxfK/bx30Kdp1+mpVnq4g=";
+    hash = "sha256-CknxLwm1tuaOqq/z8Cynz/mqkmk5shLTQxYdPorFYpE=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libe57format/default.nix b/pkgs/development/libraries/libe57format/default.nix
index fe5558681ffff..cbbdd4dcc0263 100644
--- a/pkgs/development/libraries/libe57format/default.nix
+++ b/pkgs/development/libraries/libe57format/default.nix
@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-4vVhKrCxnWO106DSAk+xxo4uk6zC89m9VQAPaDJ8Ed4=";
     })
   ];
+  CXXFLAGS = [
+    # GCC 13: error: 'int16_t' has not been declared in 'std'
+    "-include cstdint"
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/libraries/libei/default.nix b/pkgs/development/libraries/libei/default.nix
index b216cd231c22e..3b687fcd8edcb 100644
--- a/pkgs/development/libraries/libei/default.nix
+++ b/pkgs/development/libraries/libei/default.nix
@@ -11,7 +11,6 @@
 , protobuf
 , protobufc
 , python3
-, python3Packages
 , systemd
 }:
 let
@@ -42,19 +41,18 @@ stdenv.mkDerivation rec {
     systemd
   ];
   nativeBuildInputs = [
-    attr
     meson
     ninja
     pkg-config
-    python3
-  ] ++
-  (with python3Packages; [
-    jinja2
-    pytest
-    python-dbusmock
-    strenum
-    structlog
-  ]);
+    (python3.withPackages(ps: with ps; [
+      attrs
+      jinja2
+      pytest
+      python-dbusmock
+      strenum
+      structlog
+    ]))
+  ];
 
   postPatch = ''
     ln -s "${munit}" ./subprojects/munit
diff --git a/pkgs/development/libraries/libelf/default.nix b/pkgs/development/libraries/libelf/default.nix
index 0a1a7175296ef..fdfa4fda0def4 100644
--- a/pkgs/development/libraries/libelf/default.nix
+++ b/pkgs/development/libraries/libelf/default.nix
@@ -2,11 +2,6 @@
 , fetchurl, autoreconfHook, gettext, freebsd, netbsd
 }:
 
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
-
 stdenv.mkDerivation rec {
   pname = "libelf";
   version = "0.8.13";
@@ -52,18 +47,10 @@ stdenv.mkDerivation rec {
     (if stdenv.hostPlatform.isFreeBSD then [ freebsd.gencat ]
      else if stdenv.hostPlatform.isNetBSD then [ netbsd.gencat ]
      else [ gettext ])
-       # Need to regenerate configure script with newer version in order to pass
-       # "mr_cv_target_elf=yes" and determine integer sizes correctly when
-       # cross-compiling, but `autoreconfHook` brings in `makeWrapper` which
-       # doesn't work with the bootstrapTools bash, so can only do this for
-       # cross builds when `stdenv.shell` is a newer bash.
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform
        # The provided `configure` script fails on clang 16 because some tests have a `main`
        # returning an implicit `int`, which clang 16 treats as an error. Running `autoreconf` fixes
        # the test and allows `configure` to detect clang properly.
-       # This is done only for clang on Darwin because the Darwin stdenv bootstrap does not use
-       # libelf, so should be safe because it will always be run with a compatible version of bash.
-       || (stdenv.cc.isClang && stdenv.isDarwin)) autoreconfHook;
+    ++ [ autoreconfHook ];
 
   meta = {
     description = "ELF object file access library";
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 28cee5c7dfd61..3605d48a2fd1b 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation rec {
         -e 's/NOEXECSTACK_FLAGS=$/NOEXECSTACK_FLAGS="-Wa,--noexecstack"/'
   '';
 
+  enableParallelBuilding = true;
+
   # Make sure libraries are correct for .pc and .la files
   # Also make sure includes are fixed for callers who don't use libgpgcrypt-config
   postFixup = ''
@@ -66,6 +68,7 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
+  enableParallelChecking = true;
 
   passthru.tests = {
     inherit gnupg libotr rsyslog;
diff --git a/pkgs/development/libraries/libgnome-games-support/default.nix b/pkgs/development/libraries/libgnome-games-support/default.nix
index edfd21a469689..e63d7f8fe656f 100644
--- a/pkgs/development/libraries/libgnome-games-support/default.nix
+++ b/pkgs/development/libraries/libgnome-games-support/default.nix
@@ -2,7 +2,6 @@
 , fetchurl
 , pkg-config
 , glib
-, gobject-introspection
 , gtk3
 , libgee
 , gettext
@@ -24,7 +23,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     gettext
-    gobject-introspection
     meson
     ninja
     pkg-config
diff --git a/pkgs/development/libraries/libimobiledevice/default.nix b/pkgs/development/libraries/libimobiledevice/default.nix
index 0006491003130..a229bb1fef084 100644
--- a/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/pkgs/development/libraries/libimobiledevice/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , openssl
@@ -26,6 +27,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-mIsB+EaGJlGMOpz3OLrs0nAmhOY1BwMs83saFBaejwc=";
   };
 
+  patches = [
+    # Pull upstream fix for clang-16 and upcoming gcc-14 support:
+    #   https://github.com/libimobiledevice/libimobiledevice/pull/1444
+    (fetchpatch {
+      name = "usleep-decl.patch";
+      url = "https://github.com/libimobiledevice/libimobiledevice/commit/db623184c0aa09c27697f5a2e81025db223075d5.patch";
+      hash = "sha256-TgdgBkEDXzQDSgJxcZc+pZncfmBVXarhHOByGFs6p0Q=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/development/libraries/libjodycode/default.nix b/pkgs/development/libraries/libjodycode/default.nix
new file mode 100644
index 0000000000000..2a99ed5feca3c
--- /dev/null
+++ b/pkgs/development/libraries/libjodycode/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, stdenv
+, fetchFromGitea
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libjodycode";
+  version = "3.1";
+
+  outputs = [ "out" "man" "dev" ];
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "jbruchon";
+    repo = "libjodycode";
+    rev = "v${version}";
+    hash = "sha256-uhWQh5YwLwYRm34nY5HvcEepqlTSDt9s3PSoD403kQM=";
+  };
+
+  env.PREFIX = placeholder "out";
+
+  meta = with lib; {
+    description = "Shared code used by several utilities written by Jody Bruchon";
+    homepage = "https://github.com/jbruchon/libjodycode";
+    changelog = "https://github.com/jbruchon/libjodycode/blob/${src.rev}/CHANGES.txt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 9be574e9eaa00..820f466d84473 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -117,7 +117,6 @@ stdenv.mkDerivation rec {
     "-DJPEGXL_FORCE_NEON=ON"
   ];
 
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
   CXXFLAGS = lib.optionalString stdenv.hostPlatform.isAarch32 "-mfp16-format=ieee";
 
   # FIXME x86_64-darwin:
diff --git a/pkgs/development/libraries/liblangtag/default.nix b/pkgs/development/libraries/liblangtag/default.nix
index efd914ca7b106..0988bb9259d74 100644
--- a/pkgs/development/libraries/liblangtag/default.nix
+++ b/pkgs/development/libraries/liblangtag/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, gtk-doc, gettext
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, gtk-doc, gettext
 , pkg-config, glib, libxml2, gobject-introspection, gnome-common, unzip
 }:
 
@@ -23,6 +23,20 @@ stdenv.mkDerivation rec {
     sha256 = "0y9x5gra6jri4sk16f0dp69p06almnsl48rs85605f035kf539qm";
   };
 
+  patches = [
+    # Pull upstream fix for gcc-13 build compatibility
+    (fetchpatch {
+      name = "gcc-13-p1.patch";
+      url = "https://bitbucket.org/tagoh/liblangtag/commits/0b6e9f4616a34146e7443c4e9a7197153645e40b/raw";
+      hash = "sha256-69wJDVwDCP5OPHKoRn9WZNrvfCvmlX3SwtRmcpJHn2o=";
+    })
+    (fetchpatch {
+      name = "gcc-13-p1.patch";
+      url = "https://bitbucket.org/tagoh/liblangtag/commits/1497c4477d0fa0b7df1886951b953dd3cea54427/raw";
+      hash = "sha256-k0Uaeg6YLxVze4fgf0kiyuiZJ5wh2Jq3h7cFPQPtwyo=";
+    })
+  ];
+
   postPatch = ''
     gtkdocize
     cp "${core_zip}" data/core.zip
diff --git a/pkgs/development/libraries/libmusicbrainz/5.x.nix b/pkgs/development/libraries/libmusicbrainz/5.x.nix
index 3e7a2f1a0ba01..14a6cc16c8371 100644
--- a/pkgs/development/libraries/libmusicbrainz/5.x.nix
+++ b/pkgs/development/libraries/libmusicbrainz/5.x.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, neon, libdiscid, libxml2, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, neon, libdiscid, libxml2, pkg-config }:
 
 stdenv.mkDerivation rec {
   version = "5.1.0";
@@ -14,6 +14,18 @@ stdenv.mkDerivation rec {
     rev    = "release-${version}";
   };
 
+  patches = [
+    # Fix build with libxml2 2.12
+    (fetchpatch {
+      url = "https://github.com/metabrainz/libmusicbrainz/commit/9ba00067a15479a52262a5126bcb6889da5884b7.patch";
+      hash = "sha256-4VxTohLpjUNnNZGIoRpBjUz71mLP3blg4oFL7itnJnY=";
+    })
+    (fetchpatch {
+      url = "https://github.com/metabrainz/libmusicbrainz/commit/558c9ba0e6d702d5c877f75be98176f57abf1b02.patch";
+      hash = "sha256-hKYY4BJLh/Real3NugLwzc4gPBQ3NB/F63iI/aV8Wh8=";
+    })
+  ];
+
   dontUseCmakeBuildDir=true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libosinfo/default.nix b/pkgs/development/libraries/libosinfo/default.nix
index 3fe89f891f8cb..498f26a7caf09 100644
--- a/pkgs/development/libraries/libosinfo/default.nix
+++ b/pkgs/development/libraries/libosinfo/default.nix
@@ -61,6 +61,12 @@ stdenv.mkDerivation rec {
       src = ./osinfo-db-data-dir.patch;
       osinfo_db_data_dir = "${osinfo-db}/share";
     })
+
+    # Fix build with libxml 2.12
+    (fetchpatch {
+      url = "https://gitlab.com/libosinfo/libosinfo/-/commit/5bbdd06503456784c5ffa22409e8bab50470d673.patch";
+      hash = "sha256-KqgHXI+lD5VYp2wtA58Drp15TgNK1O3xCaYBy4/B9wc=";
+    })
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/libqaccessibilityclient/default.nix b/pkgs/development/libraries/libqaccessibilityclient/default.nix
index 1977a62f5c09c..e05400114d060 100644
--- a/pkgs/development/libraries/libqaccessibilityclient/default.nix
+++ b/pkgs/development/libraries/libqaccessibilityclient/default.nix
@@ -2,15 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "libqaccessibilityclient";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/libqaccessibilityclient/libqaccessibilityclient-${version}.tar.xz";
-    sha256 = "sha256-HHaLT0MU/K4qB8t958sq4FIrXwK0Fzrz7ti/sqTYNCk=";
+    hash = "sha256-cEdyVDo7AFuUBhpT6vn51klE5oGLBMWcD7ClA8gaxKA=";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ qtbase ];
+  cmakeFlags = ["-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}"];
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/libquotient/default.nix b/pkgs/development/libraries/libquotient/default.nix
index e154ab8eafe2c..b461a3c078642 100644
--- a/pkgs/development/libraries/libquotient/default.nix
+++ b/pkgs/development/libraries/libquotient/default.nix
@@ -1,6 +1,8 @@
 { stdenv, lib, fetchFromGitHub, cmake, olm, openssl, qtbase, qtmultimedia, qtkeychain }:
 
-stdenv.mkDerivation rec {
+let
+  isQt6 = lib.versions.major qtbase.version == "6";
+in stdenv.mkDerivation rec {
   pname = "libquotient";
   version = "0.8.1.2";
 
@@ -19,6 +21,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DQuotient_ENABLE_E2EE=ON"
+    (lib.cmakeBool "BUILD_WITH_QT6" isQt6)
   ];
 
   # https://github.com/quotient-im/libQuotient/issues/551
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index e8658558f69af..415f097f3318d 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.57.0";
+  version = "2.57.1";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -50,13 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-M1/i4MLL8be/BmhlEiSiPhNUUfCxeTzYE2Sb4r/6dOg=";
+    hash = "sha256-B0Zxo+1vvNZ8ripA5TkQf08JfKikqxqJTAXiUk/zQO8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-P8W4z/MwSpP0xqrxoVZPAip7ymdIUL2+uP88Q2Y3hVU=";
+    hash = "sha256-zICI7sps5KYe8/yWXbCJv529KxGLjoyDOmpCgVAIsTs=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };
diff --git a/pkgs/development/libraries/libsass/default.nix b/pkgs/development/libraries/libsass/default.nix
index 92f3853b5f719..57e58adb8c7e2 100644
--- a/pkgs/development/libraries/libsass/default.nix
+++ b/pkgs/development/libraries/libsass/default.nix
@@ -1,5 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
 , testers
+
+# for passthru.tests
+, gtk3
+, gtk4
+, sassc
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -18,13 +27,24 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-26592.CVE-2022-43357.CVE-2022-43358.patch";
+      url = "https://github.com/sass/libsass/pull/3184/commits/5bb0ea0c4b2ebebe542933f788ffacba459a717a.patch";
+      hash = "sha256-DR6pKFWL70uJt//drzq34LeTzT8rUqgUTpgfUHpD2s4=";
+    })
+  ];
+
   preConfigure = ''
     export LIBSASS_VERSION=${finalAttrs.version}
   '';
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru.tests = {
+    inherit gtk3 gtk4 sassc;
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
 
   meta = with lib; {
     description = "A C/C++ implementation of a Sass compiler";
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index 954242d81fb4f..e5a8f42940e0a 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "sha256-2CkCQAQFzwBoV07z3B/l9ZJiB1Q7oa5vjnoVdjUdy9s=";
+    hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index 2818e27ae4cf2..733fcafaf2904 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
-  version = "0.21.1";
+  version = "0.21.2";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Z09RMjpfdOTLfjJ32mi1r93TM+yiW8n9LYIKkpcvkLE=";
+    hash = "sha256-5KNBSWoIFeZMjTuPq6sz17rn796rd7hDZpcx1bGB3O4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index 00cb7e042c970..15f8fab508896 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh";
-  version = "0.10.5";
+  version = "0.10.6";
 
   src = fetchurl {
-    url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-tg4v9/Nnue7itWNNOmMwPd/t4OahjfyojESodw5+QjQ=";
+    url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/libssh-${version}.tar.xz";
+    hash = "sha256-GGHUmPW28XQbarxz5ghHhJHtz5ydS2Yw7vbnRZbencE=";
   };
 
   # Do not split 'dev' output until lib/cmake/libssh/libssh-config.cmake
diff --git a/pkgs/development/libraries/libssh2/CVE-2023-48795.patch b/pkgs/development/libraries/libssh2/CVE-2023-48795.patch
new file mode 100644
index 0000000000000..c89e4a137b721
--- /dev/null
+++ b/pkgs/development/libraries/libssh2/CVE-2023-48795.patch
@@ -0,0 +1,459 @@
+From d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a Mon Sep 17 00:00:00 2001
+From: Michael Buckley <michael@buckleyisms.com>
+Date: Thu, 30 Nov 2023 15:08:02 -0800
+Subject: [PATCH] src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack"
+
+Refs:
+https://terrapin-attack.com/
+https://seclists.org/oss-sec/2023/q4/292
+https://osv.dev/list?ecosystem=&q=CVE-2023-48795
+https://github.com/advisories/GHSA-45x7-px36-x8w8
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795
+
+Fixes #1290
+Closes #1291
+---
+ src/kex.c          | 63 +++++++++++++++++++++++------------
+ src/libssh2_priv.h | 18 +++++++---
+ src/packet.c       | 83 +++++++++++++++++++++++++++++++++++++++++++---
+ src/packet.h       |  2 +-
+ src/session.c      |  3 ++
+ src/transport.c    | 12 ++++++-
+ 6 files changed, 149 insertions(+), 32 deletions(-)
+
+diff --git a/src/kex.c b/src/kex.c
+index 8e7b7f0af3..a7b301e157 100644
+--- a/src/kex.c
++++ b/src/kex.c
+@@ -3032,6 +3032,13 @@ kex_method_extension_negotiation = {
+     0,
+ };
+ 
++static const LIBSSH2_KEX_METHOD
++kex_method_strict_client_extension = {
++    "kex-strict-c-v00@openssh.com",
++    NULL,
++    0,
++};
++
+ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
+ #if LIBSSH2_ED25519
+     &kex_method_ssh_curve25519_sha256,
+@@ -3050,6 +3057,7 @@ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
+     &kex_method_diffie_helman_group1_sha1,
+     &kex_method_diffie_helman_group_exchange_sha1,
+     &kex_method_extension_negotiation,
++    &kex_method_strict_client_extension,
+     NULL
+ };
+ 
+@@ -3302,13 +3310,13 @@ static int kexinit(LIBSSH2_SESSION * session)
+     return 0;
+ }
+ 
+-/* kex_agree_instr
++/* _libssh2_kex_agree_instr
+  * Kex specific variant of strstr()
+  * Needle must be preceded by BOL or ',', and followed by ',' or EOL
+  */
+-static unsigned char *
+-kex_agree_instr(unsigned char *haystack, size_t haystack_len,
+-                const unsigned char *needle, size_t needle_len)
++unsigned char *
++_libssh2_kex_agree_instr(unsigned char *haystack, size_t haystack_len,
++                         const unsigned char *needle, size_t needle_len)
+ {
+     unsigned char *s;
+     unsigned char *end_haystack;
+@@ -3393,7 +3401,7 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
+         while(s && *s) {
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+-            if(kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
+                 const LIBSSH2_HOSTKEY_METHOD *method =
+                     (const LIBSSH2_HOSTKEY_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3427,9 +3435,9 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
+     }
+ 
+     while(hostkeyp && (*hostkeyp) && (*hostkeyp)->name) {
+-        s = kex_agree_instr(hostkey, hostkey_len,
+-                            (unsigned char *) (*hostkeyp)->name,
+-                            strlen((*hostkeyp)->name));
++        s = _libssh2_kex_agree_instr(hostkey, hostkey_len,
++                                     (unsigned char *) (*hostkeyp)->name,
++                                     strlen((*hostkeyp)->name));
+         if(s) {
+             /* So far so good, but does it suit our purposes? (Encrypting vs
+                Signing) */
+@@ -3463,6 +3471,12 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+ {
+     const LIBSSH2_KEX_METHOD **kexp = libssh2_kex_methods;
+     unsigned char *s;
++    const unsigned char *strict =
++        (unsigned char *)"kex-strict-s-v00@openssh.com";
++
++    if(_libssh2_kex_agree_instr(kex, kex_len, strict, 28)) {
++        session->kex_strict = 1;
++    }
+ 
+     if(session->kex_prefs) {
+         s = (unsigned char *) session->kex_prefs;
+@@ -3470,7 +3484,7 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+         while(s && *s) {
+             unsigned char *q, *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+-            q = kex_agree_instr(kex, kex_len, s, method_len);
++            q = _libssh2_kex_agree_instr(kex, kex_len, s, method_len);
+             if(q) {
+                 const LIBSSH2_KEX_METHOD *method = (const LIBSSH2_KEX_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3504,9 +3518,9 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+     }
+ 
+     while(*kexp && (*kexp)->name) {
+-        s = kex_agree_instr(kex, kex_len,
+-                            (unsigned char *) (*kexp)->name,
+-                            strlen((*kexp)->name));
++        s = _libssh2_kex_agree_instr(kex, kex_len,
++                                     (unsigned char *) (*kexp)->name,
++                                     strlen((*kexp)->name));
+         if(s) {
+             /* We've agreed on a key exchange method,
+              * Can we agree on a hostkey that works with this kex?
+@@ -3550,7 +3564,7 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(crypt, crypt_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(crypt, crypt_len, s, method_len)) {
+                 const LIBSSH2_CRYPT_METHOD *method =
+                     (const LIBSSH2_CRYPT_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3572,9 +3586,9 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
+     }
+ 
+     while(*cryptp && (*cryptp)->name) {
+-        s = kex_agree_instr(crypt, crypt_len,
+-                            (unsigned char *) (*cryptp)->name,
+-                            strlen((*cryptp)->name));
++        s = _libssh2_kex_agree_instr(crypt, crypt_len,
++                                     (unsigned char *) (*cryptp)->name,
++                                     strlen((*cryptp)->name));
+         if(s) {
+             endpoint->crypt = *cryptp;
+             return 0;
+@@ -3614,7 +3628,7 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(mac, mac_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(mac, mac_len, s, method_len)) {
+                 const LIBSSH2_MAC_METHOD *method = (const LIBSSH2_MAC_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+                                            (const LIBSSH2_COMMON_METHOD **)
+@@ -3635,8 +3649,9 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
+     }
+ 
+     while(*macp && (*macp)->name) {
+-        s = kex_agree_instr(mac, mac_len, (unsigned char *) (*macp)->name,
+-                            strlen((*macp)->name));
++        s = _libssh2_kex_agree_instr(mac, mac_len,
++                                     (unsigned char *) (*macp)->name,
++                                     strlen((*macp)->name));
+         if(s) {
+             endpoint->mac = *macp;
+             return 0;
+@@ -3667,7 +3682,7 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(comp, comp_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(comp, comp_len, s, method_len)) {
+                 const LIBSSH2_COMP_METHOD *method =
+                     (const LIBSSH2_COMP_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3689,8 +3704,9 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
+     }
+ 
+     while(*compp && (*compp)->name) {
+-        s = kex_agree_instr(comp, comp_len, (unsigned char *) (*compp)->name,
+-                            strlen((*compp)->name));
++        s = _libssh2_kex_agree_instr(comp, comp_len,
++                                     (unsigned char *) (*compp)->name,
++                                     strlen((*compp)->name));
+         if(s) {
+             endpoint->comp = *compp;
+             return 0;
+@@ -3871,6 +3887,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                 session->local.kexinit = key_state->oldlocal;
+                 session->local.kexinit_len = key_state->oldlocal_len;
+                 key_state->state = libssh2_NB_state_idle;
++                session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+                 session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+                 session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+                 return -1;
+@@ -3896,6 +3913,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                 session->local.kexinit = key_state->oldlocal;
+                 session->local.kexinit_len = key_state->oldlocal_len;
+                 key_state->state = libssh2_NB_state_idle;
++                session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+                 session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+                 session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+                 return -1;
+@@ -3944,6 +3962,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+         session->remote.kexinit = NULL;
+     }
+ 
++    session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+     session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+     session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+ 
+diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h
+index 7660366954..18d9ab2130 100644
+--- a/src/libssh2_priv.h
++++ b/src/libssh2_priv.h
+@@ -736,6 +736,9 @@ struct _LIBSSH2_SESSION
+     /* key signing algorithm preferences -- NULL yields server order */
+     char *sign_algo_prefs;
+ 
++    /* Whether to use the OpenSSH Strict KEX extension */
++    int kex_strict;
++
+     /* (remote as source of data -- packet_read ) */
+     libssh2_endpoint_data remote;
+ 
+@@ -908,6 +911,7 @@ struct _LIBSSH2_SESSION
+     int fullpacket_macstate;
+     size_t fullpacket_payload_len;
+     int fullpacket_packet_type;
++    uint32_t fullpacket_required_type;
+ 
+     /* State variables used in libssh2_sftp_init() */
+     libssh2_nonblocking_states sftpInit_state;
+@@ -948,10 +952,11 @@ struct _LIBSSH2_SESSION
+ };
+ 
+ /* session.state bits */
+-#define LIBSSH2_STATE_EXCHANGING_KEYS   0x00000001
+-#define LIBSSH2_STATE_NEWKEYS           0x00000002
+-#define LIBSSH2_STATE_AUTHENTICATED     0x00000004
+-#define LIBSSH2_STATE_KEX_ACTIVE        0x00000008
++#define LIBSSH2_STATE_INITIAL_KEX       0x00000001
++#define LIBSSH2_STATE_EXCHANGING_KEYS   0x00000002
++#define LIBSSH2_STATE_NEWKEYS           0x00000004
++#define LIBSSH2_STATE_AUTHENTICATED     0x00000008
++#define LIBSSH2_STATE_KEX_ACTIVE        0x00000010
+ 
+ /* session.flag helpers */
+ #ifdef MSG_NOSIGNAL
+@@ -1182,6 +1187,11 @@ ssize_t _libssh2_send(libssh2_socket_t socket, const void *buffer,
+ int _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                           key_exchange_state_t * state);
+ 
++unsigned char *_libssh2_kex_agree_instr(unsigned char *haystack,
++                                        size_t haystack_len,
++                                        const unsigned char *needle,
++                                        size_t needle_len);
++
+ /* Let crypt.c/hostkey.c expose their method structs */
+ const LIBSSH2_CRYPT_METHOD **libssh2_crypt_methods(void);
+ const LIBSSH2_HOSTKEY_METHOD **libssh2_hostkey_methods(void);
+diff --git a/src/packet.c b/src/packet.c
+index eccb8c56a8..6da14e9fa1 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -624,14 +624,13 @@ packet_authagent_open(LIBSSH2_SESSION * session,
+  * layer when it has received a packet.
+  *
+  * The input pointer 'data' is pointing to allocated data that this function
+- * is asked to deal with so on failure OR success, it must be freed fine.
+- * The only exception is when the return code is LIBSSH2_ERROR_EAGAIN.
++ * will be freed unless return the code is LIBSSH2_ERROR_EAGAIN.
+  *
+  * This function will always be called with 'datalen' greater than zero.
+  */
+ int
+ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+-                    size_t datalen, int macstate)
++                    size_t datalen, int macstate, uint32_t seq)
+ {
+     int rc = 0;
+     unsigned char *message = NULL;
+@@ -676,6 +675,70 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         break;
+     }
+ 
++    if(session->state & LIBSSH2_STATE_INITIAL_KEX) {
++        if(msg == SSH_MSG_KEXINIT) {
++            if(!session->kex_strict) {
++                if(datalen < 17) {
++                    LIBSSH2_FREE(session, data);
++                    session->packAdd_state = libssh2_NB_state_idle;
++                    return _libssh2_error(session,
++                                          LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                          "Data too short extracting kex");
++                }
++                else {
++                    const unsigned char *strict =
++                    (unsigned char *)"kex-strict-s-v00@openssh.com";
++                    struct string_buf buf;
++                    unsigned char *algs = NULL;
++                    size_t algs_len = 0;
++
++                    buf.data = (unsigned char *)data;
++                    buf.dataptr = buf.data;
++                    buf.len = datalen;
++                    buf.dataptr += 17; /* advance past type and cookie */
++
++                    if(_libssh2_get_string(&buf, &algs, &algs_len)) {
++                        LIBSSH2_FREE(session, data);
++                        session->packAdd_state = libssh2_NB_state_idle;
++                        return _libssh2_error(session,
++                                              LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                              "Algs too short");
++                    }
++
++                    if(algs_len == 0 ||
++                       _libssh2_kex_agree_instr(algs, algs_len, strict, 28)) {
++                        session->kex_strict = 1;
++                    }
++                }
++            }
++
++            if(session->kex_strict && seq) {
++                LIBSSH2_FREE(session, data);
++                session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
++                session->packAdd_state = libssh2_NB_state_idle;
++                libssh2_session_disconnect(session, "strict KEX violation: "
++                                           "KEXINIT was not the first packet");
++
++                return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                      "strict KEX violation: "
++                                      "KEXINIT was not the first packet");
++            }
++        }
++
++        if(session->kex_strict && session->fullpacket_required_type &&
++            session->fullpacket_required_type != msg) {
++            LIBSSH2_FREE(session, data);
++            session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
++            session->packAdd_state = libssh2_NB_state_idle;
++            libssh2_session_disconnect(session, "strict KEX violation: "
++                                       "unexpected packet type");
++
++            return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                  "strict KEX violation: "
++                                  "unexpected packet type");
++        }
++    }
++
+     if(session->packAdd_state == libssh2_NB_state_allocated) {
+         /* A couple exceptions to the packet adding rule: */
+         switch(msg) {
+@@ -1364,6 +1427,15 @@ _libssh2_packet_ask(LIBSSH2_SESSION * session, unsigned char packet_type,
+ 
+             return 0;
+         }
++        else if(session->kex_strict &&
++                (session->state & LIBSSH2_STATE_INITIAL_KEX)) {
++            libssh2_session_disconnect(session, "strict KEX violation: "
++                                       "unexpected packet type");
++
++            return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                  "strict KEX violation: "
++                                  "unexpected packet type");
++        }
+         packet = _libssh2_list_next(&packet->node);
+     }
+     return -1;
+@@ -1425,7 +1497,10 @@ _libssh2_packet_require(LIBSSH2_SESSION * session, unsigned char packet_type,
+     }
+ 
+     while(session->socket_state == LIBSSH2_SOCKET_CONNECTED) {
+-        int ret = _libssh2_transport_read(session);
++        int ret;
++        session->fullpacket_required_type = packet_type;
++        ret = _libssh2_transport_read(session);
++        session->fullpacket_required_type = 0;
+         if(ret == LIBSSH2_ERROR_EAGAIN)
+             return ret;
+         else if(ret < 0) {
+diff --git a/src/packet.h b/src/packet.h
+index 1d90b8af12..955351e5f6 100644
+--- a/src/packet.h
++++ b/src/packet.h
+@@ -72,6 +72,6 @@ int _libssh2_packet_burn(LIBSSH2_SESSION * session,
+ int _libssh2_packet_write(LIBSSH2_SESSION * session, unsigned char *data,
+                           unsigned long data_len);
+ int _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+-                        size_t datalen, int macstate);
++                        size_t datalen, int macstate, uint32_t seq);
+ 
+ #endif /* LIBSSH2_PACKET_H */
+diff --git a/src/session.c b/src/session.c
+index 35e7929fe7..9d89ade8ec 100644
+--- a/src/session.c
++++ b/src/session.c
+@@ -469,6 +469,8 @@ libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)),
+         session->abstract = abstract;
+         session->api_timeout = 0; /* timeout-free API by default */
+         session->api_block_mode = 1; /* blocking API by default */
++        session->state = LIBSSH2_STATE_INITIAL_KEX;
++        session->fullpacket_required_type = 0;
+         session->packet_read_timeout = LIBSSH2_DEFAULT_READ_TIMEOUT;
+         session->flag.quote_paths = 1; /* default behavior is to quote paths
+                                           for the scp subsystem */
+@@ -1223,6 +1225,7 @@ libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, int reason,
+                               const char *desc, const char *lang)
+ {
+     int rc;
++    session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+     session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+     BLOCK_ADJUST(rc, session,
+                  session_disconnect(session, reason, desc, lang));
+diff --git a/src/transport.c b/src/transport.c
+index 21be9d2b80..a8bb588a4b 100644
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -186,6 +186,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+     struct transportpacket *p = &session->packet;
+     int rc;
+     int compressed;
++    uint32_t seq = session->remote.seqno;
+ 
+     if(session->fullpacket_state == libssh2_NB_state_idle) {
+         session->fullpacket_macstate = LIBSSH2_MAC_CONFIRMED;
+@@ -317,7 +318,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+     if(session->fullpacket_state == libssh2_NB_state_created) {
+         rc = _libssh2_packet_add(session, p->payload,
+                                  session->fullpacket_payload_len,
+-                                 session->fullpacket_macstate);
++                                 session->fullpacket_macstate, seq);
+         if(rc == LIBSSH2_ERROR_EAGAIN)
+             return rc;
+         if(rc) {
+@@ -328,6 +329,11 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+ 
+     session->fullpacket_state = libssh2_NB_state_idle;
+ 
++    if(session->kex_strict &&
++        session->fullpacket_packet_type == SSH_MSG_NEWKEYS) {
++        session->remote.seqno = 0;
++    }
++
+     return session->fullpacket_packet_type;
+ }
+ 
+@@ -1093,6 +1099,10 @@ int _libssh2_transport_send(LIBSSH2_SESSION *session,
+ 
+     session->local.seqno++;
+ 
++    if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS) {
++        session->local.seqno = 0;
++    }
++
+     ret = LIBSSH2_SEND(session, p->outbuf, total_length,
+                        LIBSSH2_SOCKET_SEND_FLAGS(session));
+     if(ret < 0)
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index 091885a1f084a..f7a51da9fa672 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -9,6 +9,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NzYWHkHiaTMk3rOMJs/cPv5iCdY0ukJY2xzs/2pa1GE=";
   };
 
+  patches = [
+    # fetchpatch cannot be used due to infinite recursion
+    # https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a
+    ./CVE-2023-48795.patch
+  ];
+
   outputs = [ "out" "dev" "devdoc" ];
 
   propagatedBuildInputs = [ openssl ]; # see Libs: in libssh2.pc
diff --git a/pkgs/development/libraries/libtins/default.nix b/pkgs/development/libraries/libtins/default.nix
index b96c02a35bfd4..b27ad6634797a 100644
--- a/pkgs/development/libraries/libtins/default.nix
+++ b/pkgs/development/libraries/libtins/default.nix
@@ -1,4 +1,4 @@
-{ boost, cmake, fetchFromGitHub, gtest, libpcap, openssl, lib, stdenv }:
+{ boost, cmake, fetchFromGitHub, fetchpatch, gtest, libpcap, openssl, lib, stdenv }:
 
 stdenv.mkDerivation rec {
   pname = "libtins";
@@ -11,6 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-mXbinXh/CO0SZZ71+K+FozbHCCoi12+AIa2o+P0QmUw=";
   };
 
+  patches = [
+    # Pull gcc-13 fixes:
+    #   https://github.com/mfontanini/libtins/pull/496
+    # TODO: remove when upgrade to the next version.
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/mfontanini/libtins/commit/812be7966d445ec56e88eab512f8fd2d57152427.patch";
+      hash = "sha256-5RCFPe95r1CBrAocjTPR2SvUlgaGa1aBc8RazyxUj3M=";
+    })
+  ];
+
   postPatch = ''
     rm -rf googletest
     cp -r ${gtest.src} googletest
diff --git a/pkgs/development/libraries/libubox/default.nix b/pkgs/development/libraries/libubox/default.nix
index f54e5c5a5afa8..2bcc5d0498c4c 100644
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "libubox";
-  version = "unstable-2023-11-03";
+  version = "unstable-2023-11-28";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libubox.git";
-    rev = "f7d1569113110ea8df071d2ea64fd17aaf5b42c9";
-    hash = "sha256-W0+QXI0gJ4WwrlRMPAJOChvilZ4zlAf4kXrfgBAkQAE=";
+    rev = "e80dc00ee90c29ef56ae28f414b0e5bb361206e7";
+    hash = "sha256-R4Yz4C63LQTNBKyNyiLMQHfc5KJBPFldP1trmtEBb9U=";
   };
 
   cmakeFlags = [ "-DBUILD_EXAMPLES=OFF" (if with_lua then "-DLUAPATH=${placeholder "out"}/lib/lua" else "-DBUILD_LUA=OFF") ];
diff --git a/pkgs/development/libraries/libvirt-glib/default.nix b/pkgs/development/libraries/libvirt-glib/default.nix
index bb855ac767ee9..b01a9a788bad7 100644
--- a/pkgs/development/libraries/libvirt-glib/default.nix
+++ b/pkgs/development/libraries/libvirt-glib/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -20,23 +19,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libvirt-glib";
-  version = "4.0.0";
+  version = "5.0.0";
 
   outputs = [ "out" "dev" ] ++ lib.optional withDocs "devdoc";
 
   src = fetchurl {
     url = "https://libvirt.org/sources/glib/${pname}-${version}.tar.xz";
-    sha256 = "hCP3Bp2qR2MHMh0cEeLswoU0DNMsqfwFIHdihD7erL0=";
+    sha256 = "m/7DRjgkFqNXXYcpm8ZBsqRkqlGf2bEofjGKpDovO4s=";
   };
 
-  patches = [
-    # Fix build with GLib 2.70
-    (fetchpatch {
-      url = "https://gitlab.com/libvirt/libvirt-glib/-/commit/9a34c4ea55e0246c34896e48b8ecd637bc559ac7.patch";
-      sha256 = "UU70uTi55EzPMuLYVKRzpVcd3WogeAtWAWEC2hWlR7k=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -69,9 +60,6 @@ stdenv.mkDerivation rec {
     (lib.mesonEnable "introspection" withIntrospection)
   ];
 
-  # https://gitlab.com/libvirt/libvirt-glib/-/issues/4
-  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=pointer-sign" ];
-
   meta = with lib; {
     description = "Library for working with virtual machines";
     longDescription = ''
diff --git a/pkgs/development/libraries/libvmaf/default.nix b/pkgs/development/libraries/libvmaf/default.nix
index 79b2e2ec29517..0c71611e47722 100644
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@@ -1,26 +1,27 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm, xxd }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, fetchFromGitHub
+, ffmpeg-full
+, libaom
+, meson
+, nasm
+, ninja
+, testers
+, xxd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "libvmaf";
-  version = "2.3.1";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "netflix";
     repo = "vmaf";
-    rev = "v${version}";
-    sha256 = "sha256-TkMy2tEdG1FPPWfH/wPnVbs5kocqe4Y0jU4yvbiRZ9k=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-6mwU2so1YM2pyWkJbDHVl443GgWtQazbBv3gTMBq5NA=";
   };
 
-  sourceRoot = "${src.name}/libvmaf";
-
-  patches = [
-    # Backport fix for non-Linux, non-Darwin platforms.
-    (fetchpatch {
-      url = "https://github.com/Netflix/vmaf/commit/f47640f9ffee9494571bd7c9622e353660c93fc4.patch";
-      stripLen = 1;
-      sha256 = "rsTKuqp8VJG5DBDpixPke3LrdfjKzUO945i+iL0n7CY=";
-    })
-  ];
+  sourceRoot = "${finalAttrs.src.name}/libvmaf";
 
   nativeBuildInputs = [ meson ninja nasm xxd ];
 
@@ -29,14 +30,24 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
   doCheck = false;
 
+  passthru.tests = {
+    inherit libaom ffmpeg-full;
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "libvmaf" ];
+    };
+  };
+
   meta = with lib; {
     description = "Perceptual video quality assessment based on multi-method fusion (VMAF)";
     homepage = "https://github.com/Netflix/vmaf";
-    changelog = "https://github.com/Netflix/vmaf/raw/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Netflix/vmaf/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = licenses.bsd2Patent;
     maintainers = [ maintainers.cfsmp3 maintainers.marsam ];
     mainProgram = "vmaf";
     platforms = platforms.unix;
   };
-
-}
+})
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 2fbb29347d42f..ed5413464e1d3 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -6,14 +6,16 @@
 , glib
 , pkg-config
 , udev
+, libevdev
 , libgudev
+, libxml2
 , python3
 , valgrind
 }:
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.8.0";
+  version = "2.9.0";
 
   outputs = [ "out" "dev" ];
 
@@ -21,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    hash = "sha256-VjFZBlOIG1L4dXPJ8DWxrbfVqdQC+X7zVXFryo43FFc=";
+    hash = "sha256-oM3dd22hQaAXdNoO2Q2JvO2lJCkmfw8f0NWxYcVT3lA=";
   };
 
   postPatch = ''
@@ -38,6 +40,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     udev
+    libevdev
     libgudev
   ];
 
@@ -50,13 +53,18 @@ stdenv.mkDerivation rec {
     "-Dtests=${if doCheck then "enabled" else "disabled"}"
   ];
 
+  checkInputs = [
+    libxml2
+  ];
+
   nativeCheckInputs = [
     valgrind
-  ] ++ (with python3.pkgs; [
-    libevdev
-    pytest
-    pyudev
-  ]);
+    (python3.withPackages (ps: with ps; [
+      ps.libevdev
+      pytest
+      pyudev
+    ]))
+  ];
 
   meta = with lib; {
     platforms = platforms.linux;
@@ -64,6 +72,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/linuxwacom/libwacom/blob/${src.rev}/NEWS";
     description = "Libraries, configuration, and diagnostic tools for Wacom tablets running under Linux";
     maintainers = teams.freedesktop.members;
-    license = licenses.mit;
+    license = licenses.hpnd;
   };
 }
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 3f8e27789b8ce..d06c45e819906 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchFromGitLab
 , zlib
 , pkg-config
 , autoreconfHook
@@ -34,16 +35,19 @@ in
 let
 libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.11.5";
+  version = "2.12.3-unstable-2023-12-14";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
   outputMan = "bin";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-    sha256 = "NyeweMNg7Gn6hp3hS9b3XX7o02mHsHHmko1HIKKN86Y=";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libxml2";
+    rev = "f006355eda722cae204606b9f95ba51f5ce9189b";
+    hash = "sha256-3WE90KDZq4Uaawuulc3t2+R8duCqgjEGUDN4HSXxohY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/mesa/backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch b/pkgs/development/libraries/mesa/backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch
new file mode 100644
index 0000000000000..c0b239c925981
--- /dev/null
+++ b/pkgs/development/libraries/mesa/backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch
@@ -0,0 +1,56 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "duncan.hopkins" <duncan.hopkins@foundry.com>
+Date: Tue, 17 Oct 2023 09:34:31 +0100
+Subject: [PATCH] dri: added build dependencies for systems using non-standard
+ prefixed X11 libs.
+
+To get MacOS to build, some extra dependencies need to be added to a couple of build targets.
+This mainly shows up when not installing the dependencies in the default prefix locations.
+On MacOS, this happens when using a custom build of brew to install the dependencies to 'odd' locations.
+
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25992>
+---
+ src/gallium/targets/dri/meson.build | 2 +-
+ src/glx/meson.build                 | 2 +-
+ src/loader/meson.build              | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/gallium/targets/dri/meson.build b/src/gallium/targets/dri/meson.build
+index 66619bba0db..6d3ef197e74 100644
+--- a/src/gallium/targets/dri/meson.build
++++ b/src/gallium/targets/dri/meson.build
+@@ -49,7 +49,7 @@ libgallium_dri = shared_library(
+   link_depends : gallium_dri_link_depends,
+   link_with : [
+     libdri, libmesa, libgalliumvl,
+-    libgallium, libglapi, libpipe_loader_static, libws_null, libwsw, libswdri,
++    libgallium, libglapi, libloader, libpipe_loader_static, libws_null, libwsw, libswdri,
+     libswkmsdri,
+   ],
+   dependencies : [
+diff --git a/src/glx/meson.build b/src/glx/meson.build
+index 7ec3e3e0d88..1a5e9833956 100644
+--- a/src/glx/meson.build
++++ b/src/glx/meson.build
+@@ -136,7 +136,7 @@ libglx = static_library(
+   ],
+   dependencies : [
+     idep_mesautil, idep_xmlconfig,
+-    dep_libdrm, dep_dri2proto, dep_glproto, dep_x11, dep_glvnd, dep_xxf86vm, dep_xshmfence
++    dep_libdrm, dep_dri2proto, dep_glproto, dep_x11, dep_xext, dep_glvnd, dep_xxf86vm, dep_xshmfence
+   ],
+ )
+ 
+diff --git a/src/loader/meson.build b/src/loader/meson.build
+index 35f9991ba2f..043cc852112 100644
+--- a/src/loader/meson.build
++++ b/src/loader/meson.build
+@@ -47,6 +47,6 @@ libloader = static_library(
+   c_args : loader_c_args,
+   gnu_symbol_visibility : 'hidden',
+   include_directories : [inc_include, inc_src, inc_util],
+-  dependencies : [dep_libdrm, dep_thread, dep_xcb_xrandr],
++  dependencies : [dep_libdrm, dep_thread, dep_xcb, dep_xcb_xrandr],
+   build_by_default : false,
+ )
diff --git a/pkgs/development/libraries/mesa/backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch b/pkgs/development/libraries/mesa/backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch
new file mode 100644
index 0000000000000..5a48ace8fbbcb
--- /dev/null
+++ b/pkgs/development/libraries/mesa/backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch
@@ -0,0 +1,103 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "duncan.hopkins" <duncan.hopkins@foundry.com>
+Date: Tue, 17 Oct 2023 14:36:39 +0100
+Subject: [PATCH] util: Update util/libdrm.h stubs to allow loader.c to compile
+ on MacOS.
+
+MacOS does not have the libdrm libraries so is missing xf86drm.h.
+util/libdrm.h already has a collection of stubs for systems that do not support the libraries.
+
+A compile on MacOS will fail with the source that uses newer drm functions and structures.
+Update adds in missing items that MacOS code needs to compile and run.
+New code is copied from the public repository: https://gitlab.freedesktop.org/mesa/drm/-/blob/main/xf86drm.h
+
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25992>
+---
+ src/util/libdrm.h | 57 +++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 57 insertions(+)
+
+diff --git a/src/util/libdrm.h b/src/util/libdrm.h
+index cc153cf88ab..e3af494b8d1 100644
+--- a/src/util/libdrm.h
++++ b/src/util/libdrm.h
+@@ -44,22 +44,79 @@
+ #define DRM_BUS_PLATFORM  2
+ #define DRM_BUS_HOST1X    3
+ 
++typedef struct _drmPciDeviceInfo {
++    uint16_t vendor_id;
++    uint16_t device_id;
++    uint16_t subvendor_id;
++    uint16_t subdevice_id;
++    uint8_t revision_id;
++} drmPciDeviceInfo, *drmPciDeviceInfoPtr;
++
++#define DRM_PLATFORM_DEVICE_NAME_LEN 512
++
++typedef struct _drmPlatformBusInfo {
++    char fullname[DRM_PLATFORM_DEVICE_NAME_LEN];
++} drmPlatformBusInfo, *drmPlatformBusInfoPtr;
++
++typedef struct _drmPlatformDeviceInfo {
++    char **compatible; /* NULL terminated list of compatible strings */
++} drmPlatformDeviceInfo, *drmPlatformDeviceInfoPtr;
++
++#define DRM_HOST1X_DEVICE_NAME_LEN 512
++
++typedef struct _drmHost1xBusInfo {
++    char fullname[DRM_HOST1X_DEVICE_NAME_LEN];
++} drmHost1xBusInfo, *drmHost1xBusInfoPtr;
++
++typedef struct _drmPciBusInfo {
++   uint16_t domain;
++   uint8_t bus;
++   uint8_t dev;
++   uint8_t func;
++} drmPciBusInfo, *drmPciBusInfoPtr;
++
+ typedef struct _drmDevice {
+     char **nodes; /* DRM_NODE_MAX sized array */
+     int available_nodes; /* DRM_NODE_* bitmask */
+     int bustype;
++    union {
++       drmPciBusInfoPtr pci;
++       drmPlatformBusInfoPtr platform;
++       drmHost1xBusInfoPtr host1x;
++    } businfo;
++    union {
++        drmPciDeviceInfoPtr pci;
++    } deviceinfo;
+     /* ... */
+ } drmDevice, *drmDevicePtr;
+ 
++static inline int
++drmGetDevice2(int fd, uint32_t flags, drmDevicePtr *device)
++{
++   return -ENOENT;
++}
++
+ static inline int
+ drmGetDevices2(uint32_t flags, drmDevicePtr devices[], int max_devices)
+ {
+    return -ENOENT;
+ }
+ 
++static inline int
++drmGetDeviceFromDevId(dev_t dev_id, uint32_t flags, drmDevicePtr *device)
++{
++   return -ENOENT;
++}
++
++static inline void
++drmFreeDevice(drmDevicePtr *device) {}
++
+ static inline void
+ drmFreeDevices(drmDevicePtr devices[], int count) {}
+ 
++static inline char*
++drmGetDeviceNameFromFd2(int fd) { return NULL;}
++
+ typedef struct _drmVersion {
+     int     version_major;        /**< Major version */
+     int     version_minor;        /**< Minor version */
diff --git a/pkgs/development/libraries/mesa/backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch b/pkgs/development/libraries/mesa/backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch
new file mode 100644
index 0000000000000..c7bde6411d8e4
--- /dev/null
+++ b/pkgs/development/libraries/mesa/backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch
@@ -0,0 +1,53 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "duncan.hopkins" <duncan.hopkins@foundry.com>
+Date: Wed, 1 Nov 2023 11:31:13 +0000
+Subject: [PATCH] glx: fix automatic zink fallback loading between hw and sw
+ drivers on MacOS
+
+The combination of defines used when compile the code on MacOS is hiding variables.
+Patch allows basic MacOS build to compile and run.
+
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25992>
+---
+ src/glx/glxext.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/glx/glxext.c b/src/glx/glxext.c
+index 7712e54c1d6..454f2c36a77 100644
+--- a/src/glx/glxext.c
++++ b/src/glx/glxext.c
+@@ -878,12 +878,16 @@ __glXInitialize(Display * dpy)
+ 
+    dpyPriv->glXDrawHash = __glxHashCreate();
+ 
++   Bool zink = False;
++   Bool try_zink = False;
++
+ #if defined(GLX_DIRECT_RENDERING) && !defined(GLX_USE_APPLEGL)
+    Bool glx_direct = !debug_get_bool_option("LIBGL_ALWAYS_INDIRECT", false);
+    Bool glx_accel = !debug_get_bool_option("LIBGL_ALWAYS_SOFTWARE", false);
+    const char *env = getenv("MESA_LOADER_DRIVER_OVERRIDE");
+-   Bool zink = env && !strcmp(env, "zink");
+-   Bool try_zink = False;
++
++   zink = env && !strcmp(env, "zink");
++   try_zink = False;
+ 
+    dpyPriv->drawHash = __glxHashCreate();
+ 
+@@ -928,12 +932,14 @@ __glXInitialize(Display * dpy)
+ 
+    if (!AllocAndFetchScreenConfigs(dpy, dpyPriv, zink | try_zink)) {
+       Bool fail = True;
++#if defined(GLX_DIRECT_RENDERING) && !defined(GLX_USE_APPLEGL)
+       if (try_zink) {
+          free(dpyPriv->screens);
+          dpyPriv->driswDisplay->destroyDisplay(dpyPriv->driswDisplay);
+          dpyPriv->driswDisplay = driswCreateDisplay(dpy, false);
+          fail = !AllocAndFetchScreenConfigs(dpy, dpyPriv, False);
+       }
++#endif
+       if (fail) {
+          free(dpyPriv);
+          return NULL;
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index b4b70fcab4f55..28656a5b78a69 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -2,7 +2,7 @@
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
-, llvmPackages_16, libffi, libomxil-bellagio, libva-minimal
+, llvmPackages, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
 , libglvnd, libunwind, lm_sensors
 , vulkan-loader, glslang
@@ -43,7 +43,7 @@
     ++ lib.optionals (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") [
       # QEMU virtualized GPU (aka VirGL)
       # Requires ATOMIC_INT_LOCK_FREE == 2.
-      "virtio-experimental"
+      "virtio"
     ]
     ++ lib.optionals stdenv.isAarch64 [
       "broadcom" # Broadcom VC5 (Raspberry Pi 4, aka V3D)
@@ -65,6 +65,7 @@
 , enableOpenCL ? stdenv.isLinux && stdenv.isx86_64
 , enablePatentEncumberedCodecs ? true
 , jdupes
+, rust-bindgen
 , rustc
 , spirv-llvm-translator
 , zstd
@@ -84,8 +85,8 @@
 */
 
 let
-  version = "23.1.9";
-  hash = "sha256-KVuifCgUbtCSFOjOea+hZZ7fnRQt7MPJH4BFUtZPdRA=";
+  version = "23.3.2";
+  hash = "sha256-PPy4H6FvicVqvjhV0mN9OW7k4DhJtlkACmuOX1fmmtw=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
@@ -93,19 +94,6 @@ let
 
   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
 
-  llvmPackages = llvmPackages_16;
-  # Align all the Mesa versions used. Required to prevent explosions when
-  # two different LLVMs are loaded in the same process.
-  # FIXME: these should really go into some sort of versioned LLVM package set
-  rust-bindgen' = buildPackages.rust-bindgen.override {
-    rust-bindgen-unwrapped = buildPackages.rust-bindgen.unwrapped.override {
-      clang = buildPackages.llvmPackages_15.clang;
-    };
-  };
-  spirv-llvm-translator' = spirv-llvm-translator.override {
-    inherit (llvmPackages) llvm;
-  };
-
   haveWayland = lib.elem "wayland" eglPlatforms;
   haveZink = lib.elem "zink" galliumDrivers;
   haveDozen = (lib.elem "d3d12" galliumDrivers) || (lib.elem "microsoft-experimental" vulkanDrivers);
@@ -133,29 +121,14 @@ self = stdenv.mkDerivation {
 
     ./opencl.patch
     ./disk_cache-include-dri-driver-path-in-cache-key.patch
-  ] ++ lib.optionals stdenv.isDarwin [
-    # https://gitlab.freedesktop.org/mesa/mesa/-/issues/8634
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/robclark/mesa/-/commit/44734d1fe98ef47019fe2c56d867d1645c526e4e.diff";
-      hash = "sha256-ipaISEY5xcnGvrwFxNY80JVlYWddfiHofkYEBuPkyDY=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/robclark/mesa/-/commit/d2a46afbfc44121aa491a2b4d1a3249d26fc6a11.diff";
-      hash = "sha256-i00s9oUhZXXf/A4cHwWN6uRDP70cHjz+kgVpiDM/eMw=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/robclark/mesa/-/commit/17cde1ee87cc0cbb896ca81949b8f192d5496271.diff";
-      hash = "sha256-ao2pWQwMBskOjWJsjWqwFYAeqpTWAyJbEtSryDO+xyo=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/robclark/mesa/-/commit/4489d737d5c12eb0a3441ed0b303f9f1100a7166.diff";
-      hash = "sha256-WxqwEngd79NHLedQOWMjjroaN0gr6Upd96uteSvr4Yw=";
-    })
-    # fixes a linking error
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/c8b64452c076c1768beb23280de25faf2bcbe2c8.diff";
-      hash = "sha256-mqivdzyoLtkfkAb+r57gjPwg8d7whgFAahiUhGVOOvo=";
-    })
+
+    # Backports to fix build
+    # FIXME: remove when applied upstream
+
+    # Fix build on macOS
+    ./backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch
+    ./backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch
+    ./backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch
   ];
 
   postPatch = ''
@@ -257,7 +230,7 @@ self = stdenv.mkDerivation {
     python3Packages.python # for shebang
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
-    ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator' ]
+    ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader
     ++ lib.optional haveDozen directx-headers;
@@ -270,7 +243,7 @@ self = stdenv.mkDerivation {
     intltool bison flex file
     python3Packages.python python3Packages.mako python3Packages.ply
     jdupes glslang
-  ] ++ lib.optionals enableOpenCL [ rust-bindgen' rustc ]
+  ] ++ lib.optionals enableOpenCL [ rust-bindgen rustc ]
     ++ lib.optional haveWayland wayland-scanner;
 
   propagatedBuildInputs = with xorg; [
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index fe51c79d7a06e..05f5ec7b6a034 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -1,17 +1,8 @@
-Author: David McFarland <corngood@gmail.com>
-Date:   Mon Aug 6 15:52:11 2018 -0300
-
-    [PATCH] disk_cache: include dri driver path in cache key
-    
-    This fixes invalid cache hits on NixOS where all shared library
-    timestamps in /nix/store are zero.
-
 diff --git a/meson_options.txt b/meson_options.txt
-index b8f753e2e1a..70d9071c8be 100644
+index 591ed957c85..6cb550593e3 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -452,7 +452,14 @@ option(
-   value : true,
+@@ -519,6 +519,13 @@ option(
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
  
@@ -26,10 +17,10 @@ index b8f753e2e1a..70d9071c8be 100644
    type : 'string',
    value : '',
 diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index 8dbe0938d11..498fe42de70 100644
+index 1d23b92af7e..fbb4b04f3cf 100644
 --- a/src/util/disk_cache.c
 +++ b/src/util/disk_cache.c
-@@ -194,8 +194,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -218,8 +218,10 @@ disk_cache_type_create(const char *gpu_name,
  
     /* Create driver id keys */
     size_t id_size = strlen(driver_id) + 1;
@@ -40,7 +31,7 @@ index 8dbe0938d11..498fe42de70 100644
     cache->driver_keys_blob_size += gpu_name_size;
  
     /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -216,6 +218,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -240,6 +242,7 @@ disk_cache_type_create(const char *gpu_name,
     uint8_t *drv_key_blob = cache->driver_keys_blob;
     DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
     DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
@@ -49,13 +40,13 @@ index 8dbe0938d11..498fe42de70 100644
     DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
     DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
 diff --git a/src/util/meson.build b/src/util/meson.build
-index cd44e49bfb4..f17115515a5 100644
+index eb88f235c47..eae5c54cc10 100644
 --- a/src/util/meson.build
 +++ b/src/util/meson.build
-@@ -268,7 +268,12 @@ _libmesa_util = static_library(
-   include_directories : [inc_include, inc_src, inc_mapi, inc_mesa, inc_gallium, inc_gallium_aux],
+@@ -286,7 +286,12 @@ _libmesa_util = static_library(
+   include_directories : [inc_util, include_directories('format')],
    dependencies : deps_for_libmesa_util,
-   link_with: [libmesa_format, libmesa_util_sse41],
+   link_with: [libmesa_util_sse41],
 -  c_args : [c_msvc_compat_args],
 +  c_args : [
 +    c_msvc_compat_args,
diff --git a/pkgs/development/libraries/mesa/opencl.patch b/pkgs/development/libraries/mesa/opencl.patch
index fb4da5cf7a0aa..cd27f0a2e86f4 100644
--- a/pkgs/development/libraries/mesa/opencl.patch
+++ b/pkgs/development/libraries/mesa/opencl.patch
@@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index 172c64a7c70..05961e56926 100644
+index fbb0b29322d..b4825056449 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1900,7 +1900,7 @@ endif
+@@ -1805,7 +1805,7 @@ endif
  
  dep_clang = null_dep
  if with_clc
@@ -12,12 +12,12 @@ index 172c64a7c70..05961e56926 100644
    dep_clang = cpp.find_library('clang-cpp', dirs : llvm_libdir, required : false)
  
 diff --git a/meson_options.txt b/meson_options.txt
-index 6f307018815..ab84eb1006c 100644
+index e885ba61a8a..591ed957c85 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -18,6 +18,12 @@
- # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- # SOFTWARE.
+@@ -23,6 +23,12 @@ option(
+   description : 'the window system EGL assumes for EGL_DEFAULT_DISPLAY',
+ )
  
 +option(
 +  'clang-libdir',
@@ -26,10 +26,10 @@ index 6f307018815..ab84eb1006c 100644
 +  description : 'Locations to search for clang libraries.'
 +)
  option(
-   'platforms',
-   type : 'array',
+   'android-stub',
+   type : 'boolean',
 diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
-index db3586bd7fb..4d914206d21 100644
+index 7c14135898e..74dc6850603 100644
 --- a/src/gallium/targets/opencl/meson.build
 +++ b/src/gallium/targets/opencl/meson.build
 @@ -39,7 +39,8 @@ if dep_llvm.version().version_compare('>=10.0.0')
@@ -48,19 +48,19 @@ index db3586bd7fb..4d914206d21 100644
      output : 'mesa.icd',
 -    install : true,
 +    install : false,
+     install_tag : 'runtime',
      install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
    )
- 
 diff --git a/src/gallium/targets/rusticl/meson.build b/src/gallium/targets/rusticl/meson.build
-index a968dee52db..69475cf3133 100644
+index b2963fe6dfa..99d6d801b94 100644
 --- a/src/gallium/targets/rusticl/meson.build
 +++ b/src/gallium/targets/rusticl/meson.build
-@@ -58,7 +58,7 @@ configure_file(
+@@ -76,7 +76,7 @@ configure_file(
    configuration : _config,
    input : 'rusticl.icd.in',
    output : 'rusticl.icd',
 -  install : true,
 +  install : false,
+   install_tag : 'runtime',
    install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
  )
- 
diff --git a/pkgs/development/libraries/mlt/default.nix b/pkgs/development/libraries/mlt/default.nix
index 22a38921ec498..abe368f2ea62a 100644
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@@ -30,8 +30,7 @@
 , enablePython ? false
 , python3
 , swig
-, enableQt ? false
-, libsForQt5
+, qt ? null
 , enableSDL1 ? stdenv.isLinux
 , SDL
 , enableSDL2 ? true
@@ -60,8 +59,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals enablePython [
     python3
     swig
-  ] ++ lib.optionals enableQt [
-    libsForQt5.wrapQtAppsHook
+  ] ++ lib.optionals (qt != null) [
+    qt.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -87,9 +86,10 @@ stdenv.mkDerivation rec {
     glib
     ladspa-sdk
     ladspaPlugins
-  ] ++ lib.optionals enableQt [
-    libsForQt5.qtbase
-    libsForQt5.qtsvg
+  ] ++ lib.optionals (qt != null) [
+    qt.qtbase
+    qt.qtsvg
+    (qt.qt5compat or null)
   ] ++ lib.optionals enableSDL1 [
     SDL
   ] ++ lib.optionals enableSDL2 [
@@ -104,13 +104,15 @@ stdenv.mkDerivation rec {
     "-DMOD_OPENCV=ON"
   ] ++ lib.optionals enablePython [
     "-DSWIG_PYTHON=ON"
+  ] ++ lib.optionals (qt != null) [
+    "-DMOD_QT${lib.versions.major qt.qtbase.version}=ON"
   ];
 
   preFixup = ''
     wrapProgram $out/bin/melt \
       --prefix FREI0R_PATH : ${frei0r}/lib/frei0r-1 \
       ${lib.optionalString enableJackrack "--prefix LADSPA_PATH : ${ladspaPlugins}/lib/ladspa"} \
-      ${lib.optionalString enableQt "\${qtWrapperArgs[@]}"}
+      ${lib.optionalString (qt != null) "\${qtWrapperArgs[@]}"}
 
   '';
 
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index 55e09511aab15..63308f385036d 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.90";
-  hash = "sha256-ZEG6ZcEymQ8Yw02ziT2LFWuvwZ1rRuT93rRHGYM22yQ=";
+  version = "3.90.1";
+  hash = "sha256-5Fx0p2WP/LbGIqfhm6+zEab71UZPWBubCUGBEKQIsX8=";
 }
diff --git a/pkgs/development/libraries/nv-codec-headers/12_x.nix b/pkgs/development/libraries/nv-codec-headers/12_x.nix
index 1ad0076eeb208..dcbb34e33cdb0 100644
--- a/pkgs/development/libraries/nv-codec-headers/12_x.nix
+++ b/pkgs/development/libraries/nv-codec-headers/12_x.nix
@@ -5,12 +5,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nv-codec-headers";
-  version = "12.0.16.0";
+  version = "12.1.14.0";
 
   src = fetchgit {
     url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
     rev = "n${version}";
-    sha256 = "sha256-8YZU9pb0kzat0JBVEotaZUkNicQvLNIrIyPU9KTTjwg=";
+    sha256 = "sha256-WJYuFmMGSW+B32LwE7oXv/IeTln6TNEeXSkquHh85Go=";
   };
 
   makeFlags = [
diff --git a/pkgs/development/libraries/opencollada/default.nix b/pkgs/development/libraries/opencollada/default.nix
index d058221743394..340b1299e8329 100644
--- a/pkgs/development/libraries/opencollada/default.nix
+++ b/pkgs/development/libraries/opencollada/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libxml2, pcre
+{ lib, stdenv, fetchFromGitHub, fetchurl, cmake, pkg-config, libxml2, pcre
 , darwin}:
 
 stdenv.mkDerivation rec {
@@ -13,12 +13,20 @@ stdenv.mkDerivation rec {
     sha256 = "1ym16fxx9qhf952vva71sdzgbm7ifis0h1n5fj1bfdj8zvvkbw5w";
   };
 
+  patches = [
+    # fix build with gcc 13
+    (fetchurl {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/opencollada/files/opencollada-1.6.68-gcc13.patch?id=b76590f9fb8615da3da9d783ad841c0e3881a27b";
+      hash = "sha256-uimeLGHgXaFi61mmoaloJ5vo83c8EIQmtHEMngC2Nq4=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ AGL ]);
 
   propagatedBuildInputs = [ libxml2 pcre ];
 
-  patchPhase = ''
+  postPatch = ''
     patch -p1 < ${./pcre.patch}
   '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace GeneratedSaxParser/src/GeneratedSaxParserUtils.cpp \
diff --git a/pkgs/development/libraries/plasma-wayland-protocols/default.nix b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
index d749744d51ede..9f2798ce51b61 100644
--- a/pkgs/development/libraries/plasma-wayland-protocols/default.nix
+++ b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
@@ -7,11 +7,11 @@
 
 mkDerivation rec {
   pname = "plasma-wayland-protocols";
-  version = "1.10.0";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-MZSIZ8mgRhPm3g0jrfy8Ws7N3vCzn5hrNF7GwZcnNv4=";
+    hash = "sha256-FIO/0nnLkTyDV5tdccWPmVh2T5ukMDs2R+EAfLcNT54=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 80badcdd4dbde..dabba056b4876 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -9,7 +9,6 @@
 , mesonEmulatorHook
 , ninja
 , perl
-, rsync
 , python3
 , fetchpatch
 , gettext
@@ -72,7 +71,6 @@ stdenv.mkDerivation rec {
     meson
     ninja
     perl
-    rsync
 
     # man pages
     libxslt
@@ -131,7 +129,7 @@ stdenv.mkDerivation rec {
   # at install time but Meson does not support this
   # so we need to convince it to install all files to a temporary
   # location using DESTDIR and then move it to proper one in postInstall.
-  DESTDIR = "${placeholder "out"}/dest";
+  env.DESTDIR = "dest";
 
   inherit doCheck;
 
@@ -165,19 +163,15 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # Move stuff from DESTDIR to proper location.
-    # We use rsync to merge the directories.
-    rsync --archive "${DESTDIR}/etc" "$out"
-    rm --recursive "${DESTDIR}/etc"
-    rsync --archive "${DESTDIR}${system}"/* "$out"
-    rm --recursive "${DESTDIR}${system}"/*
-    rmdir --parents --ignore-fail-on-non-empty "${DESTDIR}${system}"
+    # We need to be careful with the ordering to merge without conflicts.
     for o in $(getAllOutputNames); do
-        rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
-        rm --recursive "${DESTDIR}/''${!o}"
+        mv "$DESTDIR/''${!o}" "''${!o}"
     done
-    # Ensure the DESTDIR is removed.
-    destdirContainer="$(dirname "${DESTDIR}")"
-    pushd "$destdirContainer"; rmdir --parents "''${DESTDIR##$destdirContainer/}${builtins.storeDir}"; popd
+    mv "$DESTDIR/etc" "$out"
+    mv "$DESTDIR${system}/share"/* "$out/share"
+    # Ensure we did not forget to install anything.
+    rmdir --parents --ignore-fail-on-non-empty "$DESTDIR${builtins.storeDir}" "$DESTDIR${system}/share"
+    ! test -e "$DESTDIR"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/precice/default.nix b/pkgs/development/libraries/precice/default.nix
index 28b5c3fa85e13..885945599e938 100644
--- a/pkgs/development/libraries/precice/default.nix
+++ b/pkgs/development/libraries/precice/default.nix
@@ -18,7 +18,11 @@ stdenv.mkDerivation rec {
     "-DPYTHON_INCLUDE_DIR=${python3}/include/${python3.libPrefix}"
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [ "-D_GNU_SOURCE" ]);
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.isDarwin [ "-D_GNU_SOURCE" ]
+    # libxml2-2.12 changed const qualifiers
+    ++ [ "-fpermissive" ]
+  );
 
   nativeBuildInputs = [ cmake gcc ];
   buildInputs = [ boost eigen libxml2 mpi python3 python3.pkgs.numpy ];
diff --git a/pkgs/development/libraries/proj/7.nix b/pkgs/development/libraries/proj/7.nix
index 4e1ade0bd56b0..cfd1156388024 100644
--- a/pkgs/development/libraries/proj/7.nix
+++ b/pkgs/development/libraries/proj/7.nix
@@ -46,6 +46,10 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DUSE_EXTERNAL_GTEST=ON"
   ];
+  CXXFLAGS = [
+    # GCC 13: error: 'int64_t' in namespace 'std' does not name a type
+    "-include cstdint"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/proj/default.nix b/pkgs/development/libraries/proj/default.nix
index fedb1b003d96e..e07a3cd49ef7b 100644
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@@ -45,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: rec {
     "-DNLOHMANN_JSON_ORIGIN=external"
     "-DEXE_SQLITE3=${buildPackages.sqlite}/bin/sqlite3"
   ];
+  CXXFLAGS = [
+    # GCC 13: error: 'int64_t' in namespace 'std' does not name a type
+    "-include cstdint"
+  ];
 
   preCheck =
     let
diff --git a/pkgs/development/libraries/qca-qt5/default.nix b/pkgs/development/libraries/qca-qt5/default.nix
deleted file mode 100644
index 336a9e63ca63f..0000000000000
--- a/pkgs/development/libraries/qca-qt5/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib, stdenv, fetchurl, cmake, openssl, pkg-config, qtbase }:
-
-stdenv.mkDerivation rec {
-  pname = "qca-qt5";
-  version = "2.3.6";
-
-  src = fetchurl {
-    url = "http://download.kde.org/stable/qca/${version}/qca-${version}.tar.xz";
-    sha256 = "sha256-7lnVMdS4L7FoX02NdMLKoHd/UBgA90JuqjchCaQwUkk=";
-  };
-
-  buildInputs = [ openssl qtbase ];
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  dontWrapQtApps = true;
-
-  # tells CMake to use this CA bundle file if it is accessible
-  preConfigure = "export QC_CERTSTORE_PATH=/etc/ssl/certs/ca-certificates.crt";
-
-  # tricks CMake into using this CA bundle file if it is not accessible (in a sandbox)
-  cmakeFlags = [ "-Dqca_CERTSTORE=/etc/ssl/certs/ca-certificates.crt" ];
-
-  meta = with lib; {
-    description = "Qt 5 Cryptographic Architecture";
-    homepage = "http://delta.affinix.com/qca";
-    maintainers = with maintainers; [ ttuegel ];
-    license = licenses.lgpl21Plus;
-    platforms = with platforms; unix;
-  };
-}
diff --git a/pkgs/development/libraries/qca/default.nix b/pkgs/development/libraries/qca/default.nix
new file mode 100644
index 0000000000000..6e2afe6f0deb1
--- /dev/null
+++ b/pkgs/development/libraries/qca/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchurl, cmake, openssl, pkg-config, qtbase, qt5compat ? null }:
+
+let
+  isQt6 = lib.versions.major qtbase.version == "6";
+in stdenv.mkDerivation rec {
+  pname = "qca";
+  version = "2.3.7";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/qca/${version}/qca-${version}.tar.xz";
+    sha256 = "sha256-/uI0O1RofVvj4w+zPOKW7lCseuXiPXq3JfY//fevP0M=";
+  };
+
+  buildInputs = [ openssl qtbase qt5compat ];
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  dontWrapQtApps = true;
+
+  # tells CMake to use this CA bundle file if it is accessible
+  preConfigure = "export QC_CERTSTORE_PATH=/etc/ssl/certs/ca-certificates.crt";
+
+  cmakeFlags = [
+    (lib.cmakeBool "QT6" isQt6)
+    # tricks CMake into using this CA bundle file if it is not accessible (in a sandbox)
+    "-Dqca_CERTSTORE=/etc/ssl/certs/ca-certificates.crt"
+  ];
+
+  meta = with lib; {
+    description = "Qt Cryptographic Architecture";
+    homepage = "https://invent.kde.org/libraries/qca";
+    maintainers = with maintainers; [ ttuegel ];
+    license = licenses.lgpl21Plus;
+    platforms = with platforms; unix;
+  };
+}
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 8171293497181..55ff3497baba9 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,202 +1,202 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "c1f8fa2578d99e07f5e581f26bd532695b9534f9",
-    "sha256": "19wsf9capc8i5157hfp8g735scpcms329ylp0fg86j9qalg7ccwg"
+    "rev": "e1b1a0d2970fd384bd52c734a72536d8452ad070",
+    "sha256": "14q7xf6n8giz5v1s23ndibiv4d6g0ds4v88bx5v984319qxyvpqh"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "2ed4be9e852d2533b982493a26bf061b245dc106",
-    "sha256": "0v6fwykibl4d20sdh10inaavpzwp5ijpyw8k31078shw3hsgkqxf"
+    "rev": "4fc1cba4c415d84a5879da29f7c459b70fbc15e9",
+    "sha256": "0mrw7rr6fnjkjxx882ga253kzn4di1agikyq6h9ixwfn2j242qlq"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "3d30862e761afd5fe8451857bb531b6fb8f63dc3",
-    "sha256": "0sq4dgk88n96wja1wp6j5swxhz8wksf1v4sibywvg7v431nfy82p"
+    "rev": "12d064b16117c6f3418b494c927ef72cf1927929",
+    "sha256": "1rcpldpzwbmyww50rh58avmhgj93ks40bwm0bqz7dgwakm4n76lj"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "ea7a183732c17005f08ca14fd70cdd305c90396d",
-    "sha256": "0lblir4zcnxc2ix9frcsygkhfs5qx7xibpflapmi6d978jjfxjmx"
+    "rev": "8907dedc858cc344d770a2e826d6acc516429540",
+    "sha256": "185fmglzb3blfpk6vjd716xr4cx4grxpbqji5idddl4887w18s91"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "e17308d5ce83a8b66aeeaaaf16ce16d4ee6b2826",
-    "sha256": "1igna3qdwpaf67lhj0m743cj127hyg73ynjhadhjk3gz34h12r09"
+    "rev": "393a84ad5b16a9ec93d8a44bebf1ae86e881bc06",
+    "sha256": "1ki307wkm3wxf3jc508zgdr5p7fb297hf0rdg5x1hyv7qb03bvxx"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "e33b82889625b6a72e0be91c5023a30d53136a80",
-    "sha256": "17yxmj1xd2q0a2in6aygp88bsg1vivklmzjwi97llbmvcxxvzhfn"
+    "rev": "70020cb64f71dcf2fd65a8a167cb785d2127e159",
+    "sha256": "10kajc98avdz8a7f5ifrrrzwrkdlbsdmiamh7blsnfcix1063ihq"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "d7af24d26b9fbb83bf57b2b7245d280eb78e8b22",
-    "sha256": "1h85cn4qabva8fcr69b35cmy9c7vbk2fz8licw5ca42bq141k4kw"
+    "rev": "c887477198cae44585fe9db371db0ddf4c3b205e",
+    "sha256": "0fkw096w81lzdj7zgc6xfy719lh10x3f7mqm832mjq86h8f3gyc5"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "1b0e366092bcfae0392592c3b7891f0e47af1018",
-    "sha256": "0fif6gbin3clvy7rfvrs5qdjqvi3ql9yciiwdbm7z0by2kzz1qsg"
+    "rev": "792a55bb701d233116c3731c7a53ffdb8c67e407",
+    "sha256": "1d87mkl3dj3ysham1rrfxw07jvc5jqh8g2w8psv5858i29aclyqn"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "c8af0c56f1765302f8bdf874dfacb11c4e0bf4e3",
-    "sha256": "161wm1pq732nnbx8jbmiv1g1ziqzjwy48dpasy3zgj4i83qyvdas"
+    "rev": "8a3dfe33cb4f1e81b609f41716a3f0610a50db72",
+    "sha256": "18x3gn6wv8vm5wfa6hjfzbkxcpclnwi4s3mbbc3hj9yar53hznqp"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "4b52913503e3713200265cd6bc19b301792dbf96",
-    "sha256": "1n5pafxarhb4rsvr18al4hyc6xmm5nhjkknrnhdldy9vz7w50bgs"
+    "rev": "8ed95136b3c265b01db6cc33869228f41878e173",
+    "sha256": "1m774ah9c1didj60rph6p4gibyqgynmdqngqkq1bv1p7m2jkq1ss"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "cce7d784237cd2dd4af1abe2757d048e34e02685",
-    "sha256": "1yvxpkfxd44z9z44mfv77lfsbgjlmxz1rilblpp8h276zc5w6l5z"
+    "rev": "e33716bd6bb8926688fef20cb568e11618d08a35",
+    "sha256": "1klm5rhx6lpc0knhc15lz6sj07znv2d601gbi360wfqkvbi3g78p"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "b22bf4d0d77c7dafe8b4622f8bb45ac0b9cc9bdd",
-    "sha256": "0gz1par4gkcwwbxh0g1n1lrzyjjmi53gqfmbb222gkf5k8kf0r2i"
+    "rev": "142040e8a652e708ff6e004361f6bcfe85fefdf9",
+    "sha256": "1vc1ahanm40bh8qj3x2x4d4niihsrjai298alxfcxinfrsmw9m32"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "48a17e88fc1df5b6ae82a9787466226c830bcbf2",
-    "sha256": "0gn4zsf01xr0g8divixk2zpq97dnqs1cdc3q577ijczd2rcs6z4f"
+    "rev": "5b27b8921f1f2de93573df903c47aee634209f80",
+    "sha256": "1w8hq3mdlrdkkykhza4dx0f21j6k697xqqvpm2g2xyk2izadq2m0"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "909b79f4810b8ac62baa3544837793cfb132593b",
-    "sha256": "1bh5418nshzlgc3xf8yg1c0n70xcazr3ya9fdfn1xs3yhxdxcd8h"
+    "rev": "db33cc9a4c0bad1006dbc9ed46d71b80ee284df3",
+    "sha256": "1wjzhk6zn0vh9fjldpi5gi7qlpgfc2gcznh3a7icpbx7n9cc9qh5"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "cc717d0093d796e6bafb65892e6825f146c1d3cd",
-    "sha256": "1cdal8yfjwgl30fh2s5s45hy1mw70n8bfdsbx8q6j4g062dr16zd"
+    "rev": "4cb89b861dbdbe8733c62bcdadc0a8d6617528a5",
+    "sha256": "1pygs8l1nk7mgqcgv7ilwx87i9i8jxwxn2h8fcqqvgn96c5sd9kg"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "f587b18db4abd68cb6d4d77fbcec1b94c38d2a51",
-    "sha256": "16b3yaq7i0cs9sw8q5f98g9kzphy3kwy0nw6hzznnzpkmg0pgkv1"
+    "rev": "36603a39aa590c12cbe2b192b56b29edd09a7a6b",
+    "sha256": "1i6hfddkwf0x74kxz5vrjkc3r507m6icr59p8b6n1bms5y5731j6"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "1e3f2196bd45a5ee272b08b1d82cef29aaa89b61",
-    "sha256": "1jshzvsa2nnckakiybh6q7f0wdl5p04b6mymxvjzzphr0q32qn75"
+    "rev": "3fccc9b8fdaff1252fb4a9c516868d0bbbd4384d",
+    "sha256": "0h0i6r5w2vdmm9nxyk8vzdim739fja4ddf42s9pa25r1vs6i9rdw"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "736144c5827385000e391e9a55a0f0162b7e8112",
-    "sha256": "1djvj4glxc360my597g81aqjmrhk46447x5s2jj81yiflppvkbny"
+    "rev": "f563e7f2d1668a3d216e9d396e050df25fd15532",
+    "sha256": "1kbzf8nadia31sfc4r53p3p733i85w23yznwp2fc2117z81vd9p7"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "f3c3c2041f4800a7fc1904771f5c6af036167dc9",
-    "sha256": "1xsxhx20spj50jmsqd5f2qa7kmr9rn08c22zkckhrgic73188dpg"
+    "rev": "d4f5966ba085a1146a04f2ea8449bbf14833a593",
+    "sha256": "05617q59ldzavm79bf3vgz2sc4paa6d4s0q7adqzpnib6pryr2xj"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "dcc90558d9c0cba41eec7df290943994289b0e87",
-    "sha256": "0xccglsr1c519lyfg58hj6aa34zfyxc4zff360kd84yxmp8r4y9i"
+    "rev": "1ca962198a703f591efc7c8f7540fc4120746a00",
+    "sha256": "1r4z0lfcs1mhdmxgd7saw49p5y2009a0vxn043v0z2w47yrqprb6"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "a2d56960dd76c94a5115b5415be5ee174d377718",
-    "sha256": "03wikwwf329wzml59hw0mqqzqjqfp95k8bvifi21zgrnjfl8rsrr"
+    "rev": "134ca5dbef9d137a9c46faa79b0225bc650d9283",
+    "sha256": "09r6a0vdpyxzrhx6h49v9nyky3xzgm0z1wd320qi3zh7baxxrzm4"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "b1b4b882dabaa036c3fb73c4a879ba8efbb02ded",
-    "sha256": "07zaziin88y5cq9xy4dsfw2y7njs92qq00mg42350g1s6zqrlbv2"
+    "rev": "58f4f22662023efe6f223d5ef4a6d0be3708182b",
+    "sha256": "15braxxp4ldvfqxz7a1xywskycmkwv88cypgaxfipkis9jvaykdi"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "bdc316aca82769b43cb7821c10d80a1ca02b846e",
-    "sha256": "136izb42sdy42lr5amh343f97s59fwf3mv44dg5n8jwg0mg7s67b"
+    "rev": "f64e34be9ac4b7e92c63e47235c04471a1d40c93",
+    "sha256": "1hjg1vimipszcdk89ivq1iym05m9yz2li6chyg52n1wqjm628gx1"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "e8727aabe55526956295407d27317ec15e12b283",
-    "sha256": "1gyas1prkvnmxlvb90s9qzpy1frk8c4b7n0wnjn0vkfp0cmv3w52"
+    "rev": "3f56c6b4bd1e3883581340243b4a7289807fffc9",
+    "sha256": "15yhdp77p4i1as53cssx038hwmqjh2zgh35hrad4mhk4g6za85na"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "a41492b23cde20d1e00427d31e4637d06aea3638",
-    "sha256": "1p9w444bzgixw6a8qarznnr15ayn22k2limsi5mzqanf3j3bd3ml"
+    "rev": "3011b16d63cadbb473b6aa3a535b9f0e33170c09",
+    "sha256": "06d5x03bzbal4npbdl8y74fdizl9phz76q29f798196hjyb0kz05"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "c41785c9f36560722b917d373ee97eed8cc4089a",
-    "sha256": "05nvzh9lbkbsghpdb3q26nbxgdq5007xak8zxwd3cz9mhqy8xnyc"
+    "rev": "c64de6ad9f646aaa66fca0500d21cde802a7bb17",
+    "sha256": "09jp80yrql450bz7c2rfjyyfy0zd59kmrc0lww5ws0lyp95n116y"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "3380465d5d4977326616c5e57789a81681be650e",
-    "sha256": "06dzraplqhidkngl3sjb3sppqpvc8v8ahrjz06dnsh1dwj8hizh7"
+    "rev": "c3a7debff7a4c6ddaedb795290180dd99d7ac4be",
+    "sha256": "1aslr9msddnrkxrlzplbzpfydjkiw1haa67mcsmr2phxkfh05329"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "3b163bfd46d96bc9ee848dcee49e9cabe6699287",
-    "sha256": "03d4qvxfzwcfgbjdrpq0hvnhbz8bj6diphwiywdp16kvfmp13g9f"
+    "rev": "c41437acf07c2c4703351b07925fce3ce0e6b75d",
+    "sha256": "1ihv2k4swbhd4kiaprrjgq8kmx3vrg64y2dqkvg6nd26dfwhxr0f"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "7d6e373c7db9c05ef586db0eb50c87cd894229ad",
-    "sha256": "1aw9xxfjhm14raj7nivrr1ljnqcmibbbjyrx4bawp58mqbq4as4x"
+    "rev": "5b1b4a99d6bc98c42a11b7a3f6c9f0b0f9e56f34",
+    "sha256": "0ji4kaphlqmlpcvcvlqklhzmdlwv712cvsdxnv41fdab6b49yghw"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "38ae810be3fb4984f75b55a16d3413e35d701af1",
-    "sha256": "0hc65pidlp6lnb3srr2hg3dnas3hdj9cxkp7azcndj3wi36mclwf"
+    "rev": "bd0ceb7de5d0c918ae596150e95b069dca8b9150",
+    "sha256": "100qhcdcnnx0l3sl9zl5p3l7707h7vdbjjk7dmy7ap1r0218m5zy"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "56065158ffc4cd0fd78f9edf4b21b77b969f8dbb",
-    "sha256": "1lyh8hryi6hgw50gz9l6qxjfb72k4a7cg10vw18iffi7yv262g0z"
+    "rev": "f7745c117041e7adf9705e1de8d71086c160dd9f",
+    "sha256": "0nx8qdg3m4wf8pynh4pr1j0m0p1y5pws7fnx5mpqccvwgj4bwrdj"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "817378aa10176fd26eed36542bc657e48d9dd42e",
-    "sha256": "0ihgm8y19zlkp3677rp9hnzm56y74djsnpr78yk0mrbcbxv1hpwb"
+    "rev": "8b885af5ad3c2f2ff500c060a41e312ea7276e50",
+    "sha256": "0mh4bva1msczgwl2x3b960rml5rmxnvvzi1wk94cc51888vyajiv"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "4de268cbaf6ff3b633429577f06d3d746a3b202a",
-    "sha256": "1ris6yxd4igrjvjv7bnxkdr402lk1k0djalkbk5s4z8l4qpavn3y"
+    "rev": "c84d171fa84065fb3b4b6b3d33e7707676d87e47",
+    "sha256": "0vxqp5577xig4m0x9pmc04svjy58pi5f0wvc1b4sk61jhj8vib23"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "f84887c1aee4ab04af375e639ae965c9ea2186a5",
-    "sha256": "0pn4ly4lyf0db9pfb80q45zssifjg3466hnw7ryxnm4331izvbja"
+    "rev": "6d2f0c3a36d9b2cdcd759a464c608365a0afda98",
+    "sha256": "1aqhvniysjc14xqcwvqhylcd4lpsl5vsym0spfahxs55s9jsvbyl"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "ddcff45e8f2ca9f229017b3ded62327d2fb50af2",
-    "sha256": "1ybc94jidzqhrkm0v2daqq0nm34ydqpcgd8q4qhz9abi0ccj17s4"
+    "rev": "8f879e6bcf941a612c568fbfe2b49ddb1bb409cd",
+    "sha256": "02glac0m95naxl5c6n22xclxhp7fjl1whf6sf3388h41wwdhv11c"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "d41bb9f4f7ab9d5ff184ef94cf2f6ff7cf01de00",
-    "sha256": "0pc14sd1dzrw599kdjg1309l9hf9ylp0pnyv7i6s2pyfqqq0x85r"
+    "rev": "9a7b9972a54137d5f2e0d49559fe58d07c90662e",
+    "sha256": "1hcf18cls9kmq4xjxzjm2viqs80pxr4ykrzx0vg1bd83bc509vqp"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "f078642eb9a440f6aa88f2beaf10f445de1e29bb",
-    "sha256": "0qak3y3qaxs6lf34y8rcp922sqd08nvag0lvl7znxm8d5b7qmnn6"
+    "rev": "53fa44709992faae54e4f5c8a128cea7b6f0cbd5",
+    "sha256": "12w6znmy2hijcnwqqva8abydcryh6jcp8lhx0kz0m3cvhwpq1fbx"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "1bf19cc6a7972d8543485786418b6631459d3469",
-    "sha256": "09a6xacb0zsp44w5zz15lkh6sypy7y1xg7m1fkxj2n26wbdc2p52"
+    "rev": "ee931eba5d129284d5c33157cd7d0b9232fbee7b",
+    "sha256": "17fyfkm8qfl9jmlq3ppnqwdx47230bk2laikfbq2188vn42yxnqv"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "5fb2e067a38d3583684310130f5d8aad064f512f",
-    "sha256": "1whfsdmyihnzzy3ijh5wcbsw9ppg3s5nx2insw5yrx36iz0y054d"
+    "rev": "aaa54153970d1d63a44b873cad5f62ffa71ef9b8",
+    "sha256": "0q34pi4mqqi4vzk57f59xsk303jgpk1fkxvnvm9r08jkckxxbisw"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "5a1948ddc05bf44017ac12bd5c2b9bc79fbcb9a2",
-    "sha256": "0613zb8lzd1i2g5kbn7h39warx7hn1z5qi28zk8l88ivpn84dx4q"
+    "rev": "6e0917d518e07f737cc663b8d632c8021634fd3b",
+    "sha256": "062riy66z3v1fxrdnbdhafqdv67xqz12pscidj4fhhp9fzi92a45"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 130fcd332ba4c..5ac474afeda32 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,7 +1,7 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.11";
+  version = "5.15.12";
 
   mk = name: args:
     {
@@ -70,24 +70,24 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
   };
 
   qtscript = rec {
-    version = "5.15.15";
+    version = "5.15.16";
 
     src = fetchFromGitHub {
       owner = "qt";
       repo = "qtscript";
       rev = "v${version}-lts";
-      hash = "sha256-o2YG1m3LuG9Kq9Bqi1wRa6ceHsivK+hJR7w08NE/kBo=";
+      hash = "sha256-4Jqsmk5EBQ2Biv69yYCNx7l7AWFikRMBfl0fbZcsSaA=";
     };
   };
 
   qtwebengine = rec {
-    version = "5.15.15";
+    version = "5.15.16";
 
     src = fetchFromGitHub {
       owner = "qt";
       repo = "qtwebengine";
       rev = "v${version}-lts";
-      hash = "sha256-AmW3u8D9Y8lXZu0aiuxYXNPzZ5GCXeBQGfAcgFuXAh4=";
+      hash = "sha256-Arg/tfJcx9+CSV1VXBieHNoCSwmWNTnyBdgSkthOdfA=";
       fetchSubmodules = true;
     };
   };
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
index 4adcf8ab0a3b7..affb512a22f27 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@@ -131,6 +131,10 @@ qtModule {
 
     # Override locales install path so they go to QtWebEngine's $out
     ../patches/qtwebengine-locales-path.patch
+
+    # Cherry-pick libxml 2.12 build fix
+    # FIXME: remove for 6.7
+    ../patches/qtwebengine-libxml-2.12.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch b/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch
new file mode 100644
index 0000000000000..1fc7d837f8f34
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch
@@ -0,0 +1,22 @@
+--- a/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor.h
++++ b/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor.h
+@@ -77,7 +77,7 @@ class XSLTProcessor final : public ScriptWrappable {
+ 
+   void reset();
+ 
+-  static void ParseErrorFunc(void* user_data, xmlError*);
++  static void ParseErrorFunc(void* user_data, const xmlError*);
+   static void GenericErrorFunc(void* user_data, const char* msg, ...);
+ 
+   // Only for libXSLT callbacks
+--- a/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
++++ b/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
+@@ -66,7 +66,7 @@ void XSLTProcessor::GenericErrorFunc(void*, const char*, ...) {
+   // It would be nice to do something with this error message.
+ }
+ 
+-void XSLTProcessor::ParseErrorFunc(void* user_data, xmlError* error) {
++void XSLTProcessor::ParseErrorFunc(void* user_data, const xmlError* error) {
+   FrameConsole* console = static_cast<FrameConsole*>(user_data);
+   if (!console)
+     return;
diff --git a/pkgs/development/libraries/qtforkawesome/default.nix b/pkgs/development/libraries/qtforkawesome/default.nix
index 0841c0d457fd7..432023a2ac65c 100644
--- a/pkgs/development/libraries/qtforkawesome/default.nix
+++ b/pkgs/development/libraries/qtforkawesome/default.nix
@@ -40,6 +40,7 @@ in stdenv.mkDerivation (finalAttrs: {
     qtutilities
   ];
   cmakeFlags = [
+    "-DQT_PACKAGE_PREFIX=Qt${lib.versions.major qtbase.version}"
     # Current freetype used by NixOS users doesn't support the `.woff2` font
     # format, so we use ttf. See
     # https://github.com/NixOS/nixpkgs/pull/174875#discussion_r883423881
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index cbbd79eb504f0..797e9fb891b67 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
+    "-DQT_PACKAGE_PREFIX=Qt${lib.versions.major qtbase.version}"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index 73092a803d66c..6c6fa1d6be950 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.56";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VS/85qu0Dc3HSeD0DYm2f4ur+ZRPhb1Srf7BeK7Pdfk=";
+    hash = "sha256-Kq4jl/ss+Xf5/zv18QWuIyXZDyz8mk3av4mdRoQrvJY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index ec4cc458c4b51..eb4d975a6e01a 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.43.2";
+  version = "3.44.2";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-bUIrb2LE3iyoDWGGDjo/tpNVTS91uxqsp0PMxNb2CfA=";
+    hash = "sha256-HGcZoUi8Qc8PK7vjkm184/XKCdh48SRvzCB2exdbtAc=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 6028c638a7ec2..dd092dd0f0431 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.43.2";
+    version = "3.44.2";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-62ZRUj9XpccPJC/Ba8QWuB7QLVkmOb+34JnyAeL5otM=";
+      hash = "sha256-cxh0c/63RQk1fo+my5/WcVOy0BDQCusv3bbO6xirryc=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index d25aab35da220..5ba8039ccff80 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     # (setting it to an absolute path causes include files to go to $out/$out/include,
     #  because the absolute path is interpreted with root at $out).
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DENABLE_SHARED=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
     # TODO Remove this when https://github.com/Haivision/srt/issues/538 is fixed and available to nixpkgs
     # Workaround for the fact that srt incorrectly disables GNUInstallDirs when LIBDIR is specified,
     # see https://github.com/NixOS/nixpkgs/pull/54463#discussion_r249878330
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index b6cc969b9f783..5523ae429c265 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -34,6 +34,16 @@ stdenv.mkDerivation rec {
       url = "https://patch-diff.githubusercontent.com/raw/oneapi-src/oneTBB/pull/866.patch";
       hash = "sha256-e44Yv84Hfl5xoxWWTnLJLSGeNA1RBbah4/L43gPLS+c=";
     })
+
+    # Fix build with GCC 13
+    (fetchpatch {
+      url = "https://github.com/oneapi-src/oneTBB/commit/154cc73ca4d359621202399cc0c3c91058e56e79.patch";
+      hash = "sha256-BVQQXgBg8T19DGw2gmFkm3KKOuzzJJNOTf/iNIcnHag=";
+    })
+    (fetchpatch {
+      url = "https://github.com/oneapi-src/oneTBB/commit/e131071769ee3df51b56b053ba6bfa06ae9eff25.patch";
+      hash = "sha256-IfV/DDb0luxE1l6TofAbQIeJEVxCxZfZqcONGwQEndY=";
+    })
   ];
 
   # Fix build with modern gcc
diff --git a/pkgs/development/libraries/termcolor/default.nix b/pkgs/development/libraries/termcolor/default.nix
index fbae29f4ca583..f29776226dc29 100644
--- a/pkgs/development/libraries/termcolor/default.nix
+++ b/pkgs/development/libraries/termcolor/default.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [ "-DTERMCOLOR_TESTS=ON" ];
+  CXXFLAGS = [
+    # GCC 13: error: 'uint8_t' has not been declared
+    "-include cstdint"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/ubus/default.nix b/pkgs/development/libraries/ubus/default.nix
index bdfe4aa585520..4419b4e67a66c 100644
--- a/pkgs/development/libraries/ubus/default.nix
+++ b/pkgs/development/libraries/ubus/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "ubus";
-  version = "unstable-2023-11-14";
+  version = "unstable-2023-11-28";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/ubus.git";
-    rev = "b3e8c4ef07ebb6f0f34a5c1f0dc1539068363619";
-    hash = "sha256-H/QrLMhdEC1LnSxHpp/90OdKbfHRqLVWUnzyQlsVO8c=";
+    rev = "f84eb5998c6ea2d34989ca2d3254e56c66139313";
+    hash = "sha256-5pIovqIeJczWAA9KQPKFnTnGRrIZVdSNdxBR8AEFtO4=";
   };
 
   cmakeFlags = [ "-DBUILD_LUA=OFF" ];
diff --git a/pkgs/development/libraries/unittest-cpp/default.nix b/pkgs/development/libraries/unittest-cpp/default.nix
index e9f67a74f9a3e..6a6407eb32ff0 100644
--- a/pkgs/development/libraries/unittest-cpp/default.nix
+++ b/pkgs/development/libraries/unittest-cpp/default.nix
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # Fix 'Version:' setting in .pc file. TODO: remove once upstreamed:
+  #     https://github.com/unittest-cpp/unittest-cpp/pull/188
+  cmakeFlags = [ "-DPACKAGE_VERSION=${version}" ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = false;
diff --git a/pkgs/development/libraries/ustream-ssl/default.nix b/pkgs/development/libraries/ustream-ssl/default.nix
index 6e9655efe442e..638685434463c 100644
--- a/pkgs/development/libraries/ustream-ssl/default.nix
+++ b/pkgs/development/libraries/ustream-ssl/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation {
   pname = "ustream-ssl";
-  version = "unstable-2023-02-25";
+  version = "unstable-2023-11-11";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/ustream-ssl.git";
-    rev = "498f6e268d4d2b0ad33b430f4ba1abe397d31496";
-    hash = "sha256-qwF3pzJ/nUTaJ8NZtgLyXnSozekY3dovxK3ZWHPGORM=";
+    rev = "263b9a97cf7e1e2467319c23832b705fc01190b5";
+    hash = "sha256-RLHU6swNbS3DL3QbKnwU4BbD0EFGKCrHHp0hbnoSssw=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index 02309b275bdcb..73fc650844dbe 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -55,6 +55,18 @@ in stdenv.mkDerivation {
 
   patches = map fetchpatch patchesToFetch;
 
+  # GCC 13: error: 'int64_t' in namespace 'std' does not name a type
+  postPatch = ''
+    sed '1i#include <cstdint>' \
+      -i ThirdParty/libproj/vtklibproj/src/proj_json_streaming_writer.hpp \
+      -i IO/Image/vtkSEPReader.h
+  ''
+  + optionalString stdenv.isDarwin ''
+    sed -i 's|COMMAND vtkHashSource|COMMAND "DYLD_LIBRARY_PATH=''${VTK_BINARY_DIR}/lib" ''${VTK_BINARY_DIR}/bin/vtkHashSource-${majorVersion}|' ./Parallel/Core/CMakeLists.txt
+    sed -i 's/fprintf(output, shift)/fprintf(output, "%s", shift)/' ./ThirdParty/libxml2/vtklibxml2/xmlschemas.c
+    sed -i 's/fprintf(output, shift)/fprintf(output, "%s", shift)/g' ./ThirdParty/libxml2/vtklibxml2/xpath.c
+  '';
+
   dontWrapQtApps = true;
 
   # Shared libraries don't work, because of rpath troubles with the current
@@ -87,12 +99,6 @@ in stdenv.mkDerivation {
     NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
   };
 
-  postPatch = optionalString stdenv.isDarwin ''
-    sed -i 's|COMMAND vtkHashSource|COMMAND "DYLD_LIBRARY_PATH=''${VTK_BINARY_DIR}/lib" ''${VTK_BINARY_DIR}/bin/vtkHashSource-${majorVersion}|' ./Parallel/Core/CMakeLists.txt
-    sed -i 's/fprintf(output, shift)/fprintf(output, "%s", shift)/' ./ThirdParty/libxml2/vtklibxml2/xmlschemas.c
-    sed -i 's/fprintf(output, shift)/fprintf(output, "%s", shift)/g' ./ThirdParty/libxml2/vtklibxml2/xpath.c
-  '';
-
   postInstall = optionalString enablePython ''
     substitute \
       ${./vtk.egg-info} \
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index 90fe559c3cf41..a011cf9c20003 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -32,6 +32,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs .
+  ''
+  # Darwin uses `llvm-strip`, which results in a crash at runtime in assembly-based routines when `-x` is specified.
+  + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile --replace '$(if $(STRIP), $(STRIP) -x $@)' '$(if $(STRIP), $(STRIP) -S $@)'
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/xapian/default.nix b/pkgs/development/libraries/xapian/default.nix
index 73c3b1b571737..243ec53a3234c 100644
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -25,6 +25,8 @@ let
     buildInputs = [ libuuid zlib ];
     nativeBuildInputs = [ autoreconfHook ];
 
+    enableParallelBuilding = true;
+
     doCheck = true;
     env.AUTOMATED_TESTING = true; # https://trac.xapian.org/changeset/8be35f5e1/git
 
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index 92b662ac4484f..2cf0cc3ef8df9 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libxml2, gnutls, libxslt, pkg-config, libgcrypt, libtool
+{ stdenv, fetchurl, fetchpatch, libxml2, gnutls, libxslt, pkg-config, libgcrypt, libtool
 , openssl, nss, lib, runCommandCC, writeText }:
 
 lib.fix (self:
@@ -13,6 +13,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./lt_dladdsearchdir.patch
+
+    # Fix build with libxml2 2.12
+    (fetchpatch {
+      url = "https://github.com/lsh123/xmlsec/commit/ffb327376f5bb69e8dfe7f805529e45a40118c2b.patch";
+      hash = "sha256-o8CLemOiGIHJsYfVQtNzJNVyk03fdmCbvgA8c3OYxo4=";
+    })
   ] ++ lib.optionals stdenv.isDarwin [ ./remove_bsd_base64_decode_flag.patch ];
   postPatch = ''
     substituteAllInPlace src/dl.c
diff --git a/pkgs/development/libraries/xsimd/default.nix b/pkgs/development/libraries/xsimd/default.nix
index 3a9a90fbe2bc8..87da2c546b866 100644
--- a/pkgs/development/libraries/xsimd/default.nix
+++ b/pkgs/development/libraries/xsimd/default.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xsimd";
-  version = "11.2.0";
+  version = "12.1.1";
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     rev = finalAttrs.version;
-    sha256 = "sha256-CzgfxXGZXoJ56dX+mDPsHZC31YudrZXpX2tovh/Vjr0=";
+    hash = "sha256-ofUFieeRtpnzNv3Ad5oYwKWb2XcqQHoj601TIhydJyI=";
   };
   patches = [
     # Ideally, Accelerate/Accelerate.h should be used for this implementation,
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 27e3c85695fa7..2afd4582c3613 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1,11 +1,9 @@
 /* pkgs/development/lua-modules/generated-packages.nix is an auto-generated file -- DO NOT EDIT!
-Regenerate it with:
-nixpkgs$ ./maintainers/scripts/update-luarocks-packages
-
+Regenerate it with: nix run nixpkgs#update-luarocks-packages
 You can customize the generated packages in pkgs/development/lua-modules/overrides.nix
 */
 
-{ stdenv, lib, fetchurl, fetchgit, callPackage, ... }:
+{ stdenv, lib, fetchurl, fetchgit, callPackage, ... } @ args:
 final: prev:
 {
 alt-getopt = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
@@ -144,21 +142,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-busted = callPackage({ buildLuarocksPackage, dkjson, fetchgit, fetchurl, lua, lua-term, luaOlder, lua_cliargs, luafilesystem, luassert, luasystem, mediator_lua, penlight, say }:
+busted = callPackage({ buildLuarocksPackage, dkjson, fetchgit, fetchurl, lua, lua-term, luaOlder, lua_cliargs, luassert, luasystem, mediator_lua, penlight, say }:
 buildLuarocksPackage {
   pname = "busted";
-  version = "2.1.2-3";
+  version = "2.2.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/busted-2.1.2-3.rockspec";
-    sha256 = "0ll8jzbpp6a9zdbbjglmq30jmx2zvr0rs83jgsjxmlfzzylkry8p";
+    url    = "mirror://luarocks/busted-2.2.0-1.rockspec";
+    sha256 = "0h4zk4lcm40wg3l0vgjn6lsyh9yayhljx65a0pz5n99dxal8lgnf";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/busted.git",
-  "rev": "673cb6bad2ee3876d45e004fcac1c2f8a816344f",
-  "date": "2023-03-20T10:00:33+01:00",
-  "path": "/nix/store/k7xnpg0s36gxk5mb59wx1dj8ikiz92ja-busted",
-  "sha256": "1wsiiiw26yqglqkkailksinzcb9gaffcldrcfhga3zawf2518h8y",
-  "hash": "sha256-HkEUinBc/aEedCw3ypxTLy32bdSTRjUnpg97I3iMUfM=",
+  "rev": "02f31a9c103a44e166617cfdb6ba1b8994a9c912",
+  "date": "2023-11-06T14:24:47+03:00",
+  "path": "/nix/store/59a4spix6yw8lvkxq7q1fkdv0gfqd72k-busted",
+  "sha256": "0pwyidy7l223ydsfbf5xsjqgyhm73942ks44d3bivh8ldam4zg74",
+  "hash": "sha256-5LxPqmoUwR3XaIToKUgap0L/sNS9uOV080MIenyLnl8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -167,7 +165,7 @@ buildLuarocksPackage {
  '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ dkjson lua lua-term lua_cliargs luafilesystem luassert luasystem mediator_lua penlight say ];
+  propagatedBuildInputs = [ dkjson lua lua-term lua_cliargs luassert luasystem mediator_lua penlight say ];
 
   meta = {
     homepage = "https://lunarmodules.github.io/busted/";
@@ -245,21 +243,21 @@ buildLuarocksPackage {
 compat53 = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "compat53";
-  version = "0.7-1";
+  version = "0.12-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/compat53-0.7-1.rockspec";
-    sha256 = "1r7a3q1cjrcmdycrv2ikgl83irjhxs53sa88v2fdpr9aaamlb101";
+    url    = "mirror://luarocks/compat53-0.12-1.rockspec";
+    sha256 = "0ijp8ch3927rnj872l6cq79fd53dyfc2qg82y9b0g6kqs7cdl348";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/keplerproject/lua-compat-5.3/archive/v0.7.zip";
-    sha256 = "02a14nvn7aggg1yikj9h3dcf8aqjbxlws1bfvqbpfxv9d5phnrpz";
+    url    = "https://github.com/lunarmodules/lua-compat-5.3/archive/v0.12.zip";
+    sha256 = "177zk7rww76wqxqsd2kxwfzb0nd7wfacm81vxwqsc84bfccsl3j4";
   };
 
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "https://github.com/keplerproject/lua-compat-5.3";
+    homepage = "https://github.com/lunarmodules/lua-compat-5.3";
     description = "Compatibility module providing Lua-5.3-style APIs for Lua 5.2 and 5.1";
     maintainers = with lib.maintainers; [ vcunat ];
     license.fullName = "MIT";
@@ -331,17 +329,17 @@ buildLuarocksPackage {
 cqueues = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "cqueues";
-  version = "20200726.52-0";
+  version = "20200726.51-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/cqueues-20200726.52-0.rockspec";
-    sha256 = "0w2kq9w0wda56k02rjmvmzccz6bc3mn70s9v7npjadh85i5zlhhp";
+    url    = "mirror://luarocks/cqueues-20200726.51-0.rockspec";
+    sha256 = "1y7dqvw75cj9ifn7cyhd98znaga4lksnbddcqmh512crawlf5sxv";
   }).outPath;
   src = fetchurl {
     url    = "https://github.com/wahern/cqueues/archive/rel-20200726.tar.gz";
     sha256 = "0lhd02ag3r1sxr2hx847rdjkddm04l1vf5234v5cz9bd4kfjw4cy";
   };
 
-  disabled = (lua.luaversion != "5.2");
+  disabled = (lua.luaversion != "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
@@ -362,11 +360,11 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/teal-language/cyan",
-  "rev": "31c9eccfc5bf26725e4e8a76ff5d5beaa175da8d",
-  "date": "2023-02-19T18:58:20-06:00",
-  "path": "/nix/store/smpj81z2a2blb3qfpjwx9n52d50rp39w-cyan",
-  "sha256": "0pskargvjn2phgz481b08ndhp3z23s7lqfs8qlwailr7a4f2fc7h",
-  "hash": "sha256-8DAnHFEn06g4xUg7TI8e4o8Lm0VgBUT+g1dYuV9WU18=",
+  "rev": "57650a3a0314a5e894c6ead30a5a52f7825f009c",
+  "date": "2023-12-07T02:47:54-06:00",
+  "path": "/nix/store/g3rqlf5cj06y2qqjlhkms51y4l142waf-cyan",
+  "sha256": "0xww1p3l0rbm7xiyax37524zybgmbrsjkpvgg327w8yndqysidfd",
+  "hash": "sha256-zbWoPW7WI37EeG/fKXVe9S3/iShndOVjP3VlQMcNnHc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -438,14 +436,14 @@ buildLuarocksPackage {
 fennel = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "fennel";
-  version = "1.3.1-1";
+  version = "1.4.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fennel-1.3.1-1.rockspec";
-    sha256 = "1dsavrsvngwx8vf1l2sj44arvip3bqkhsfh2sdkwa6r9mnw9zx87";
+    url    = "mirror://luarocks/fennel-1.4.0-1.rockspec";
+    sha256 = "1ldbcrzap8ajgwmxf70g0nw7sjdpabba56y2lg3z4hpnxccpb80n";
   }).outPath;
   src = fetchurl {
-    url    = "https://fennel-lang.org/downloads/fennel-1.3.1.tar.gz";
-    sha256 = "1c7iwyc9f3a9k34fjq77zjk0minl3bl3f7wqlj8i1n2x7598nzgx";
+    url    = "https://fennel-lang.org/downloads/fennel-1.4.0.tar.gz";
+    sha256 = "0g1lzkpmzhvhkc08kmn48k3m02pkcwgslz29fb23apbhydkavlx2";
   };
 
   disabled = (luaOlder "5.1");
@@ -459,6 +457,30 @@ buildLuarocksPackage {
   };
 }) {};
 
+fidget-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
+buildLuarocksPackage {
+  pname = "fidget.nvim";
+  version = "1.0.0-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/fidget.nvim-1.0.0-1.rockspec";
+    sha256 = "09hhm95gvdxd6n9mz2y012gmvs05mpfr4w0qgwcr8zb4kz11nqlw";
+  }).outPath;
+  src = fetchzip {
+    url    = "https://github.com/j-hui/fidget.nvim/archive/fa1445fe7230845ea66b2c8bec3398fe5d900307.zip";
+    sha256 = "0krvmyww42dx4q0gxv0qdyv14zxbbl5g4g8pa5dl5qdlznw9vagq";
+  };
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/j-hui/fidget.nvim";
+    description = "Extensible UI for Neovim notifications and LSP progress messages.";
+    maintainers = with lib.maintainers; [ mrcjkb ];
+    license.fullName = "MIT";
+  };
+}) {};
+
 fifo = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua }:
 buildLuarocksPackage {
   pname = "fifo";
@@ -554,11 +576,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lewis6991/gitsigns.nvim",
-  "rev": "ff01d34daaed72f271a8ffa088a7e839a60c640f",
-  "date": "2023-10-06T09:04:46+01:00",
-  "path": "/nix/store/2m4fyzkkg6bdbfb4kpjrqgbawvs3khqg-gitsigns.nvim",
-  "sha256": "0clyngmmz0qilnjykqc8n7c5kidspywazwy3axsikgh4x8wzdn17",
-  "hash": "sha256-J9j2OeoEvhl1V8Pzr7i/usVZ2LGI4emlpRGDX+uznjI=",
+  "rev": "6ef8c54fb526bf3a0bc4efb0b2fe8e6d9a7daed2",
+  "date": "2023-11-29T12:07:41+00:00",
+  "path": "/nix/store/2ihnjknz2xdwsijjimqk8i3pi9cbpvhf-gitsigns.nvim",
+  "sha256": "086jmhzgpavwjvp7ssd8ga0wxgnz480zzjiv84h4ivva2nv3lnvi",
+  "hash": "sha256-cVs6thVq70ggQTvK/wEi377OgXqoaX3ulnyr+z6s0iA=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -576,21 +598,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-haskell-tools-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, plenary-nvim }:
+haskell-tools-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "haskell-tools.nvim";
-  version = "2.4.0-1";
+  version = "3.0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/haskell-tools.nvim-2.4.0-1.rockspec";
-    sha256 = "1sapapkz3ay9yrljmc1lwxjglv27f1zbh6m014r2z59px4ir61dz";
+    url    = "mirror://luarocks/haskell-tools.nvim-3.0.2-1.rockspec";
+    sha256 = "1gls4dc4b8p0827jsvzf1n3gxfmqn1r7n8hi1rnfxwcragjxxn8x";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/2.4.0.zip";
-    sha256 = "054vfqsccq1qmqmglnppi2n7ksckldx8b5p62y35y0cbcdyh7wz3";
+    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/3.0.2.zip";
+    sha256 = "1rv1r0laizq866lj06akhy97zr9wdfczp1caql36k2xk4d8sbzx7";
   };
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua plenary-nvim ];
+  propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "https://github.com/mrcjkb/haskell-tools.nvim";
@@ -734,18 +756,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-ldoc = callPackage({ buildLuarocksPackage, fetchgit, markdown, penlight }:
+ldoc = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, markdown, penlight }:
 buildLuarocksPackage {
   pname = "ldoc";
-  version = "dev-1";
-
+  version = "1.5.0-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/ldoc-1.5.0-1.rockspec";
+    sha256 = "1c0yx9j3yqlzxpmspz7n7l1nvh2sww84zhkb1fsbg042sr8h9bxp";
+  }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/ldoc.git",
-  "rev": "e4940daf748affb86489b0782ed8abab2e88bebc",
-  "date": "2023-05-13T08:12:31+03:00",
-  "path": "/nix/store/sqhilwlh0glw1dxcx6w98wjkp65amvil-ldoc",
-  "sha256": "0an92jxvhbw2lvg269x6z3874x3wqmbmx52j4gsgxf9ldpizssgd",
-  "hash": "sha256-7Wn94200uf70I1KUXlfFfHRy0PimJyPepoIvuLsUySo=",
+  "rev": "09f82c959c50d8c3d5a968c379b1c75de66b002d",
+  "date": "2023-05-03T00:05:39+03:00",
+  "path": "/nix/store/7l5xpw1grnwr5m8myll63gyy4311glb1-ldoc",
+  "sha256": "0g65dd51l42693jr3251p6s40950wcwfr1kspjvc2frkwm7qpv9i",
+  "hash": "sha256-Me2LT+UzO8G2vHqG7DjjoCRAtLmhiJHlSEYQGkprxTw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -990,18 +1015,18 @@ buildLuarocksPackage {
 lrexlib-gnu = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-gnu";
-  version = "2.9.1-1";
+  version = "2.9.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lrexlib-gnu-2.9.1-1.rockspec";
-    sha256 = "1jfjxh26iwsavipkwmscwv52l77qxzvibfmlvpskcpawyii7xcw8";
+    url    = "mirror://luarocks/lrexlib-gnu-2.9.2-1.rockspec";
+    sha256 = "14dp5lzpz2prvimpcbqjygbyh9h791h0ywjknj9wgrjjd62qsy6i";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rrthomas/lrexlib.git",
-  "rev": "69d5c442c5a4bdc1271103e88c5c798b605e9ed2",
-  "date": "2020-08-07T12:10:29+03:00",
-  "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
-  "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
-  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
+  "rev": "9aa5e7e9ca47da1bd0e023dfa0b1b2d43aa358f3",
+  "date": "2023-11-05T17:32:50+00:00",
+  "path": "/nix/store/z74bw029468iizgrv19wllpzsvazj3bg-lrexlib",
+  "sha256": "15y9ha28qq08b100a32s72h6rx1bqs7gl5h7j3zacy5ixyyl6cqg",
+  "hash": "sha256-DzNDve+xeKb+kAcW+o7GK/RsoDhaDAVAWAhgjISCyZc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1013,7 +1038,7 @@ buildLuarocksPackage {
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://github.com/rrthomas/lrexlib";
+    homepage = "https://github.com/rrthomas/lrexlib";
     description = "Regular expression library binding (GNU flavour).";
     license.fullName = "MIT/X11";
   };
@@ -1022,18 +1047,18 @@ buildLuarocksPackage {
 lrexlib-pcre = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-pcre";
-  version = "2.9.1-1";
+  version = "2.9.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lrexlib-pcre-2.9.1-1.rockspec";
-    sha256 = "036k27xaplxn128b3p67xiqm8k40s7bxvh87wc8v2cx1cc4b9ia4";
+    url    = "mirror://luarocks/lrexlib-pcre-2.9.2-1.rockspec";
+    sha256 = "1214ssm6apgprryqvijjjn82ikb27ylq94yijqf7qjyiy6pz7dc1";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rrthomas/lrexlib.git",
-  "rev": "69d5c442c5a4bdc1271103e88c5c798b605e9ed2",
-  "date": "2020-08-07T12:10:29+03:00",
-  "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
-  "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
-  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
+  "rev": "9aa5e7e9ca47da1bd0e023dfa0b1b2d43aa358f3",
+  "date": "2023-11-05T17:32:50+00:00",
+  "path": "/nix/store/z74bw029468iizgrv19wllpzsvazj3bg-lrexlib",
+  "sha256": "15y9ha28qq08b100a32s72h6rx1bqs7gl5h7j3zacy5ixyyl6cqg",
+  "hash": "sha256-DzNDve+xeKb+kAcW+o7GK/RsoDhaDAVAWAhgjISCyZc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1045,7 +1070,7 @@ buildLuarocksPackage {
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://github.com/rrthomas/lrexlib";
+    homepage = "https://github.com/rrthomas/lrexlib";
     description = "Regular expression library binding (PCRE flavour).";
     maintainers = with lib.maintainers; [ vyp ];
     license.fullName = "MIT/X11";
@@ -1055,18 +1080,18 @@ buildLuarocksPackage {
 lrexlib-posix = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-posix";
-  version = "2.9.1-1";
+  version = "2.9.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lrexlib-posix-2.9.1-1.rockspec";
-    sha256 = "1zxrx9yifm9ry4wbjgv86rlvq3ff6qivldvib3ha4767azla0j0r";
+    url    = "mirror://luarocks/lrexlib-posix-2.9.2-1.rockspec";
+    sha256 = "1i11cdvz09a3wjhfjgc88g0mdmdrk13fnhhgskzgm5cmhsdx4s0i";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rrthomas/lrexlib.git",
-  "rev": "69d5c442c5a4bdc1271103e88c5c798b605e9ed2",
-  "date": "2020-08-07T12:10:29+03:00",
-  "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
-  "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
-  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
+  "rev": "9aa5e7e9ca47da1bd0e023dfa0b1b2d43aa358f3",
+  "date": "2023-11-05T17:32:50+00:00",
+  "path": "/nix/store/z74bw029468iizgrv19wllpzsvazj3bg-lrexlib",
+  "sha256": "15y9ha28qq08b100a32s72h6rx1bqs7gl5h7j3zacy5ixyyl6cqg",
+  "hash": "sha256-DzNDve+xeKb+kAcW+o7GK/RsoDhaDAVAWAhgjISCyZc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1078,7 +1103,7 @@ buildLuarocksPackage {
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://github.com/rrthomas/lrexlib";
+    homepage = "https://github.com/rrthomas/lrexlib";
     description = "Regular expression library binding (POSIX flavour).";
     license.fullName = "MIT/X11";
   };
@@ -1205,10 +1230,10 @@ buildLuarocksPackage {
 lua-iconv = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-iconv";
-  version = "7.0.0-2";
+  version = "7.0.0-4";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-iconv-7.0.0-2.rockspec";
-    sha256 = "1bj512kqcj2cxna7si4648fci51fs4bqvdn592i9cahscsc0kk9g";
+    url    = "mirror://luarocks/lua-iconv-7.0.0-4.rockspec";
+    sha256 = "0j34zf98wdr6ks6snsrqi00vwm3ngsa5f74kadsn178iw7hd8c3q";
   }).outPath;
   src = fetchurl {
     url    = "https://github.com/lunarmodules/lua-iconv/archive/v7.0.0/lua-iconv-7.0.0.tar.gz";
@@ -1260,14 +1285,14 @@ buildLuarocksPackage {
 lua-messagepack = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-messagepack";
-  version = "0.5.3-1";
+  version = "0.5.4-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-messagepack-0.5.3-1.rockspec";
-    sha256 = "0sc11ckizivijgdnqvb0xnagrak6d2caxc5j8jz8ad1b2plp50pq";
+    url    = "mirror://luarocks/lua-messagepack-0.5.4-1.rockspec";
+    sha256 = "1jygn6f8ab69z0nn1gib45wvjp075gzxp54vdmgxb3qfar0q70kr";
   }).outPath;
   src = fetchurl {
-    url    = "https://framagit.org/fperrad/lua-MessagePack/raw/releases/lua-messagepack-0.5.3.tar.gz";
-    sha256 = "17qdigs2pzi38rfqgs63xh44n1vylb6bcmmbz3sby68f0n9p8kq6";
+    url    = "https://framagit.org/fperrad/lua-MessagePack/raw/releases/lua-messagepack-0.5.4.tar.gz";
+    sha256 = "0kk1n9kf6wip8k2xx4wjlv7647biji2p86v4jf0h6d6wkaypq0kz";
   };
 
   disabled = (luaOlder "5.1");
@@ -1412,18 +1437,18 @@ buildLuarocksPackage {
 lua-resty-openssl = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "lua-resty-openssl";
-  version = "0.8.25-1";
+  version = "1.0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-openssl-0.8.25-1.rockspec";
-    sha256 = "0wy0fjb50kpcyk6mkjj364p4lrfxl0b34xnv2n0wib1brk536s1l";
+    url    = "mirror://luarocks/lua-resty-openssl-1.0.2-1.rockspec";
+    sha256 = "000ak4rfm56z7g2b7jr7k2m4hp6kcx970cnv29acjazrz6kr60r2";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/fffonion/lua-resty-openssl.git",
-  "rev": "f9a153288238e9b7e3d5d40144610410a06a83cd",
-  "date": "2023-09-05T15:19:20+08:00",
-  "path": "/nix/store/jnvr2pzvxl2psd5w030m4qnv5dsm8spb-lua-resty-openssl",
-  "sha256": "08fqgdfi0dr3n2lqrbgwa94dd2f6crn1kb0cfpccphknaypaw7dp",
-  "hash": "sha256-tx2urld2wsvYdQysGWxmxonWSFL8rYypsCM3EF172CE=",
+  "rev": "5aba923e78ae0f213f3b4719effa879e3971821f",
+  "date": "2023-11-22T15:44:01+08:00",
+  "path": "/nix/store/fww02frnja73z8bhxqz5nyji5nam77ab-lua-resty-openssl",
+  "sha256": "10fxfjafl9wyv2jz7j25xkklx1c2ykvi0yqskyij45d0rzimil5z",
+  "hash": "sha256-v9BY48+gFSKjnxp7EPf0goVO5+xFyPOl2J4n6pR03YE=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1471,23 +1496,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-rtoml = callPackage({ luaOlder, luarocks-build-rust-mlua, buildLuarocksPackage, lua, fetchgit }:
+lua-rtoml = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder, luarocks-build-rust-mlua }:
 buildLuarocksPackage {
   pname = "lua-rtoml";
   version = "0.2-0";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lblasc/lua-rtoml.git",
-  "rev": "e59ad00f5df8426767ddfb355f4ba6093468a168",
-  "date": "2023-11-02T14:17:41+01:00",
-  "path": "/nix/store/ynn6bvnwyqrackvyxzysxy294gh9prg1-lua-rtoml",
-  "sha256": "1y2ncdl3mpwqc1h5xm0rf9g1ns2vswgqffsj9sqrqidmg984jkr4",
+  "rev": "c83f56b9519d85968d663308e303f384c55c7b18",
+  "date": "2023-11-02T14:28:19+01:00",
+  "path": "/nix/store/x6mm838p27gwk45j23jkd0cpzxncxgci-lua-rtoml",
+  "sha256": "11i2km1k686nbh2ylfrcn3grd816vdhnigjjaiykkgwj0i8il6ix",
+  "hash": "sha256-PRoaUQSSvzl9VFK+aGHbJqCW37AsO+oFXNYgM0OdIoY=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua luarocks-build-rust-mlua ];
@@ -1653,7 +1679,10 @@ lua_cliargs = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua_cliargs";
   version = "3.0-2";
-
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/lua_cliargs-3.0-2.rockspec";
+    sha256 = "0vlmwrldwlxdfkak9kapydfs4ny4pwg3qpkv5agn6lw6gq0aq5za";
+  }).outPath;
   src = fetchurl {
     url    = "https://github.com/amireh/lua_cliargs/archive/v3.0-2.tar.gz";
     sha256 = "0vhpgmy9a8wlxp8a15pnfqfk0aj7pyyb5m41nnfxynx580a6y7cp";
@@ -2046,18 +2075,18 @@ buildLuarocksPackage {
 lualdap = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lualdap";
-  version = "1.3.1-1";
+  version = "1.4.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lualdap-1.3.1-1.rockspec";
-    sha256 = "0c0j9dmrphg0dil4yhahcqzzyxhrv525g65jsz0q6iqwyx10bqbp";
+    url    = "mirror://luarocks/lualdap-1.4.0-1.rockspec";
+    sha256 = "0n924gxm6ccr9hjk4bi5z70vgh7g75dl7293pab41a2qcrlsj9nk";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lualdap/lualdap",
-  "rev": "5c21b3e0d97a07b103f63edc7e649018e0453427",
-  "date": "2023-03-15T09:02:07+01:00",
-  "path": "/nix/store/ah7y5wpp3l0v5bk0gwzdvgzfpczb691k-lualdap",
-  "sha256": "1y3ap9si894xjlbrwx3c6bcfg60y80av802rscldg9scvm984jrg",
-  "hash": "sha256-L0uCUt1Mp9co01kAtBVAHpjn2DJsdJ4XlZ0kFHW6avg=",
+  "rev": "7a73c883012f9d12a05563afbb3481a57055368c",
+  "date": "2023-11-04T09:38:06+01:00",
+  "path": "/nix/store/7j6wl1f9qg4kh9zwm8fnc0ky7zhf7qbf-lualdap",
+  "sha256": "0xq0xi3ymg5lk6dh7782ddjnz5bjycd2xnc5dp1cwssi37nm7pdv",
+  "hash": "sha256-u91T7RlRa87CbYXZLhrzcpVvZWsCnQObmbS86kfsAHc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2493,11 +2522,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rktjmp/lush.nvim",
-  "rev": "966aad1accd47fa11fbe2539234f81f678fef2de",
-  "date": "2023-09-23T12:10:39+10:00",
-  "path": "/nix/store/67046ilc92czfvwc5zdkkxg7iw2xjj45-lush.nvim",
-  "sha256": "0g1xib2k42py9qqccjz11qk52ri0drgdk5rb0ls7wzx4v636k15h",
-  "hash": "sha256-sIRphtmkf340BSuX2V5uIGZRJg7hS8YwTv4KMsWKPTw=",
+  "rev": "f76741886b356586f9dfe8e312fbd1ab0fd1084f",
+  "date": "2023-12-06T09:56:43+11:00",
+  "path": "/nix/store/m0zsbahbzqxfzvbgw93qw78g7r4fjhdb-lush.nvim",
+  "sha256": "1jvfycqg5s72gmib8038kzyy8fyanl06mkz74rjy878zv8r6nf59",
+  "hash": "sha256-qThrMtofHeRlJufPagC1yjvk/Z9oALRifeLo8jDzbss=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2516,7 +2545,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luuid = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
+luuid = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder}:
 buildLuarocksPackage {
   pname = "luuid";
   version = "20120509-2";
@@ -2704,11 +2733,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/leafo/moonscript.git",
-  "rev": "fbd8ad48737651114a3d3a672b9f8f8b3a7022b7",
-  "date": "2023-06-23T09:33:37-07:00",
-  "path": "/nix/store/sy1dkcfp3rg7lvazba36sivpk0bs12r5-moonscript",
-  "sha256": "02w6lp5kid73dcd5x71666my7413l05ak0xvva6hp8ixbn6qraqn",
-  "hash": "sha256-FquMjV09oguN2ruDqQqgI5DjqzEmnF4aa+O0OMulhgs=",
+  "rev": "d5341c9093c49d3724072b209cde28b5cb0f47c9",
+  "date": "2023-11-06T12:54:51-08:00",
+  "path": "/nix/store/djmh6brp03gy8nyzxjfvzkpy440fj05z-moonscript",
+  "sha256": "1h65cxh5rhnxx99asdydkc9yf6gnf61m97jvl03g31f65jl22lxi",
+  "hash": "sha256-sVMhqCzGhfEGoFueVINx9hnnE5vNN61S6t3CXGBnxcA=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2809,11 +2838,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/hrsh7th/nvim-cmp",
-  "rev": "5dce1b778b85c717f6614e3f4da45e9f19f54435",
-  "date": "2023-08-26T15:31:42+00:00",
-  "path": "/nix/store/lvpzc5q7mv66knxh1igvzkrcwkpg8l8q-nvim-cmp",
-  "sha256": "1yl5b680p6vhk1741riiwjnw7a4wn0nimjvcab0ij6mx3kf28rsq",
-  "hash": "sha256-WGck3By9GhnBUmzLGi2wnKjDreQx5kBOmHCbC5BZhfo=",
+  "rev": "0b751f6beef40fd47375eaf53d3057e0bfa317e4",
+  "date": "2023-11-06T17:58:22+09:00",
+  "path": "/nix/store/4z8lkalcj6sk2s5aw2xcalimh3rcgixj-nvim-cmp",
+  "sha256": "1qp7s2iam9zzdlw5sgkk6c623z7vjgga0rcg63ja0f836l90grba",
+  "hash": "sha256-auUHEjUDOaDkMI9loN6T+/whDDNzPl04bf+nqqLQ5+I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2868,11 +2897,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-lua/plenary.nvim",
-  "rev": "50012918b2fc8357b87cff2a7f7f0446e47da174",
-  "date": "2023-10-11T15:43:47+02:00",
-  "path": "/nix/store/jsgaq274w8pbl4pnmpii3izxafpl346g-plenary.nvim",
-  "sha256": "1sn7vpsbwpyndsjyxb4af8fvz4sfhlbavvw6jjsv3h18sdvkh7nd",
-  "hash": "sha256-zR44d9MowLG1lIbvrRaFTpO/HXKKrO6lbtZfvvTdx+o=",
+  "rev": "55d9fe89e33efd26f532ef20223e5f9430c8b0c0",
+  "date": "2023-11-30T12:17:20+01:00",
+  "path": "/nix/store/wf35h8i4s3fdskvcy376vvzp5gi6s6mx-plenary.nvim",
+  "sha256": "1f6vqqafk78njpl47xgsf8p199mmvw4h4b9axab9rl86fdlibikz",
+  "hash": "sha256-f8YVaXMG0ZyW6iotAgnftaYULnL69UPolRad6RTG27g=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2943,17 +2972,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-rustaceanvim = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchzip }:
+rustaceanvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "rustaceanvim";
-  version = "3.0.0-1";
+  version = "3.9.6-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rustaceanvim-3.0.0-1.rockspec";
-    sha256 = "1v1k08spq3zalgya6q3qny6zpwhn0nb5nl5dn0rkcvnc4imvnyfy";
+    url    = "mirror://luarocks/rustaceanvim-3.9.6-1.rockspec";
+    sha256 = "1wlzqm8x2w9clskj2k9n9i4f0pn17dsp99a3gwwrypdlbvm9x77k";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/rustaceanvim/archive/3.0.0.zip";
-    sha256 = "1prpklbijr7p890nflr9jixf955dlp3ph9zl2rq3xxyl20ncyqbk";
+    url    = "https://github.com/mrcjkb/rustaceanvim/archive/3.9.6.zip";
+    sha256 = "0qmifxb0xgyym0zbizqds5scy4qrnp0hr17rg0synp2fk5iv6s5b";
   };
 
   disabled = (luaOlder "5.1");
@@ -3170,14 +3199,14 @@ buildLuarocksPackage {
 telescope-manix = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, telescope-nvim }:
 buildLuarocksPackage {
   pname = "telescope-manix";
-  version = "0.5.0-1";
+  version = "1.0.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/telescope-manix-0.5.0-1.rockspec";
-    sha256 = "0i5q9sr0vn0w6yqg530jx2fx52k9jr7rss4ibl49f1x3wv6sckv1";
+    url    = "mirror://luarocks/telescope-manix-1.0.0-1.rockspec";
+    sha256 = "0fhcglrnsjyhg1g2ldlb24fck9b5fnzy7kc67yjgkw62d557vjgk";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/telescope-manix/archive/0.5.0.zip";
-    sha256 = "093vkh822ycnc1pri3zmzzqnz235xxam3z1l67zyyqlc1apbarax";
+    url    = "https://github.com/mrcjkb/telescope-manix/archive/1.0.0.zip";
+    sha256 = "1svw724jlhchsl191bmgr50zbjl9vghkaxk3j8g0nzvrn9677b22";
   };
 
   disabled = (luaOlder "5.1");
@@ -3200,11 +3229,11 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-telescope/telescope.nvim",
-  "rev": "74ce793a60759e3db0d265174f137fb627430355",
-  "date": "2023-10-11T12:29:23+02:00",
-  "path": "/nix/store/7k50qqgamc2ldxdf54jqs8sy8m8vcfzr-telescope.nvim",
-  "sha256": "1m4v097y8ypjm572k1qqii3z56w4x1dsjxd6gp0z24xqyvd4kpa4",
-  "hash": "sha256-RN1J2va4E/HBfaZ1qVvohJvyR4wYhylOqfJ65E8Cm9Q=",
+  "rev": "6213322ab56eb27356fdc09a5078e41e3ea7f3bc",
+  "date": "2023-12-06T03:50:38+00:00",
+  "path": "/nix/store/h1v5377aylxb6vq8v7m7wrl585vb1dzi-telescope.nvim",
+  "sha256": "074bq8p1bkyr12z1wy31bipb97vmqia4lsmdp2aj1v1r5x5ph736",
+  "hash": "sha256-Zhx4Sy857CCVuK1qSlTEdZ+0blxheB6+CNnPFS7Cixw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3225,18 +3254,18 @@ buildLuarocksPackage {
 tl = callPackage({ argparse, buildLuarocksPackage, compat53, fetchgit, fetchurl, luafilesystem }:
 buildLuarocksPackage {
   pname = "tl";
-  version = "0.15.2-1";
+  version = "0.15.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/tl-0.15.2-1.rockspec";
-    sha256 = "1qisdflgikry0jdqvnzdcqib2svbafp10n0gfwm3fcrzqsdxy0xr";
+    url    = "mirror://luarocks/tl-0.15.3-1.rockspec";
+    sha256 = "15p67r5bjp997pymjq80yn1gyf7r5g2nwkachkwx88100ihblqrc";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/teal-language/tl",
-  "rev": "d2fc36b5ff9a52d7265e63eb74cce70fd1cdbcb2",
-  "date": "2023-04-27T11:28:21-03:00",
-  "path": "/nix/store/ramhj3a29lrn0bblbgyxn4712a7caq8k-tl",
-  "sha256": "1dgldi9pgg23iz3xis4i43bnvkwirh7kkycmr5xp75s2cc85zhg0",
-  "hash": "sha256-4MFfEGNCl3N7yZX5OQ/Mkc9t1yCR6NjHj0O8d1Ns9LU=",
+  "rev": "28f8fd9eb1a756267b8cde25990dfae27f8f5bcc",
+  "date": "2023-11-05T23:31:17-03:00",
+  "path": "/nix/store/8qbkpkni2ci042ryzjh0nfxnrmmckg3l-tl",
+  "sha256": "0spr0zajy8i91n0jqmjpgdcsryrlras6fv60np9ml1rfirh0yk4y",
+  "hash": "sha256-nkwPYI4uB1rTtcBsZ7TKNPusWXtXViyBDSkiL9UH+Wo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3351,18 +3380,18 @@ buildLuarocksPackage {
 vusted = callPackage({ buildLuarocksPackage, busted, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "vusted";
-  version = "2.3.1-1";
+  version = "2.3.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/vusted-2.3.1-1.rockspec";
-    sha256 = "03h7l12xk43rql9vxb5nzfimx9srwaazx2r3j2zm1ba2qz06h0qc";
+    url    = "mirror://luarocks/vusted-2.3.3-1.rockspec";
+    sha256 = "0h1v9p327yfqnbwi2rw3k47vwbpqx5rn679rfx5dszn3s6wp5g6p";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/notomo/vusted.git",
-  "rev": "2bc6818a756e47240d9284f1dfac21b011ca84ea",
-  "date": "2023-10-09T11:47:28+09:00",
-  "path": "/nix/store/jq2yl4adpnyilp3yyw161j1a29bwahqi-vusted",
-  "sha256": "04lxc78n3h1qhby6b4k9x8hb1c3sgqdid71fsvyg4y6j7rb55a8z",
-  "hash": "sha256-H6lSVj7SePL81i6cFht+erCwIOppkmX8gjjAYdFhnRI=",
+  "rev": "69a5a5f453cf2fc2984e1ba4eea91384e59f9da1",
+  "date": "2023-11-06T21:06:04+09:00",
+  "path": "/nix/store/85m6md82nl3jj853s9mhsc4dy0isws8b-vusted",
+  "sha256": "012n09hy4q0im2bv0vprkanv6xqdppaz6f7gwp87nxsmk88q8mxv",
+  "hash": "sha256-u1eEEZpVd3vQ5e8489W9DXezrZr5brCXqBFg4mECVgQ=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 9ea1e6f193489..1b8dce7e1fa5d 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -2,6 +2,11 @@
 { stdenv
 , cargo
 , cmake
+
+# plenary utilities
+, which
+, findutils
+, coreutils
 , curl
 , cyrus_sasl
 , dbus
@@ -449,6 +454,32 @@ with prev;
   });
 
 
+  plenary-nvim = prev.plenary-nvim.overrideAttrs (oa: {
+    postPatch = ''
+      sed -Ei lua/plenary/curl.lua \
+          -e 's@(command\s*=\s*")curl(")@\1${curl}/bin/curl\2@'
+    '';
+
+    # disabled for now because too flaky
+    doCheck = false;
+    # for env/find/ls
+    checkInputs = [
+      which
+      neovim-unwrapped
+      coreutils
+      findutils
+    ];
+
+    checkPhase = ''
+      runHook preCheck
+      # remove failing tests, need internet access for instance
+      rm tests/plenary/job_spec.lua tests/plenary/scandir_spec.lua tests/plenary/curl_spec.lua
+      export HOME="$TMPDIR"
+      make test
+      runHook postCheck
+    '';
+  });
+
   # as advised in https://github.com/luarocks/luarocks/issues/1402#issuecomment-1080616570
   # we shouldn't use luarocks machinery to build complex cmake components
   libluv = stdenv.mkDerivation {
diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix
index a937b016ce897..a2f22062d3bf2 100644
--- a/pkgs/development/python-modules/absl-py/default.nix
+++ b/pkgs/development/python-modules/absl-py/default.nix
@@ -2,20 +2,25 @@
 , lib
 , pythonOlder
 , fetchPypi
+, setuptools
 , six
 , enum34
 }:
 
 buildPythonPackage rec {
   pname = "absl-py";
-  version = "1.4.0";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0sJE0BBIukdufAgL0sbfXhQdIR3oAiNGDVs7iipYQz0=";
+    hash = "sha256-2WkCEcX8/vzdGkVHCsK1xazUUkHDr3Hu2WvFRBdGwNU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     six
   ] ++ lib.optionals (pythonOlder "3.4") [
diff --git a/pkgs/development/python-modules/acquire/default.nix b/pkgs/development/python-modules/acquire/default.nix
index 4aacc5c46b21b..aabd6216c904c 100644
--- a/pkgs/development/python-modules/acquire/default.nix
+++ b/pkgs/development/python-modules/acquire/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-0aLPDh9lrKpHo97VFFwCmPXyXXNFGgkdjoppzm3BCTo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/adafruit-io/default.nix b/pkgs/development/python-modules/adafruit-io/default.nix
index 59bdcc46e8bbc..3315df4212ce5 100644
--- a/pkgs/development/python-modules/adafruit-io/default.nix
+++ b/pkgs/development/python-modules/adafruit-io/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-vfjyU+czLtUA0WDEvc0iYmJ2Tn75o/OsX909clfDsUE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 672854ce6a989..fcd55c0f7a3b1 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-tw95VnxsK57KBMw0fzzgJnFe8O8Ef0rQ9qBMIeYrkHQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/adext/default.nix b/pkgs/development/python-modules/adext/default.nix
index 1aa9368f347b7..c5a05d19bee85 100644
--- a/pkgs/development/python-modules/adext/default.nix
+++ b/pkgs/development/python-modules/adext/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     sha256 = "0h5k9kzms2f0r48pdhsgv8pimk0vsxw8vs0k6880mank8ij914wr";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/aenum/default.nix b/pkgs/development/python-modules/aenum/default.nix
index d1ff94519646b..c299864830afc 100644
--- a/pkgs/development/python-modules/aenum/default.nix
+++ b/pkgs/development/python-modules/aenum/default.nix
@@ -3,13 +3,15 @@
 , fetchPypi
 , pyparsing
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "aenum";
   version = "3.1.15";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,6 +20,10 @@ buildPythonPackage rec {
     hash = "sha256-jL12zRjE+HD/ObJChNPqAo++hzGljfOqWB5DTFdblVk=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pyparsing
     pytestCheckHook
@@ -36,6 +42,9 @@ buildPythonPackage rec {
     "test_arduino_headers"
     "test_c_header_scanner"
     "test_extend_flag_backwards_stdlib"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # AttributeError: <enum 'Color'> has no attribute 'value'. Did you mean: 'blue'?
+    "test_extend_enum_shadow_property_stdlib"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index 556261277ea09..1bd2b71d25fb4 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -1,8 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
-, fetchPypi
-, fetchpatch
+, fetchFromGitHub
 , pythonOlder
 , fonttools
 , defcon
@@ -34,14 +33,16 @@
 
 buildPythonPackage rec {
   pname = "afdko";
-  version = "4.0.0";
+  version = "4.0.0+unstable-2023-11-07";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-66faoWBuCW0lQZP8/mBJLT+ErRGBl396HdG1RfPOYcM=";
+  src = fetchFromGitHub {
+    owner = "adobe-type-tools";
+    repo = pname;
+    rev = "6c832edbd81ecf689dbe66e840bf18ae61cf4bca";
+    hash = "sha256-XXkksHggUIs2O0/OSGsft8ofogcbtAa3w5JdldIAJAI=";
   };
 
   nativeBuildInputs = [
@@ -64,6 +65,11 @@ buildPythonPackage rec {
     ./use-dynamic-system-antlr4-runtime.patch
   ];
 
+  # Happy new year
+  postPatch = ''
+    substituteInPlace tests/tx_data/expected_output/alt-missing-glif.pfb --replace 2023 2024
+  '';
+
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (toString [
     "-Wno-error=incompatible-function-pointer-types"
     "-Wno-error=int-conversion"
@@ -98,6 +104,9 @@ buildPythonPackage rec {
 
   preCheck = ''
     export PATH=$PATH:$out/bin
+
+    # Remove build artifacts to prevent them from messing with the tests
+    rm -rf _skbuild
   '';
 
   disabledTests = lib.optionals (!runAllTests) [
diff --git a/pkgs/development/python-modules/afsapi/default.nix b/pkgs/development/python-modules/afsapi/default.nix
index 8d40361c6d06f..d971bc5b5e039 100644
--- a/pkgs/development/python-modules/afsapi/default.nix
+++ b/pkgs/development/python-modules/afsapi/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-eE5BsXNtSU6YUhRn4/SKpMrqaYf8tyfLKdxxGOmNJ9I=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/aiobotocore/default.nix b/pkgs/development/python-modules/aiobotocore/default.nix
index 5f226d26018e5..006bd358d7c25 100644
--- a/pkgs/development/python-modules/aiobotocore/default.nix
+++ b/pkgs/development/python-modules/aiobotocore/default.nix
@@ -16,16 +16,16 @@
 
 buildPythonPackage rec {
   pname = "aiobotocore";
-  version = "2.6.0";
+  version = "2.8.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-e8FBUG08yWNL9B51Uv4ftYx1C0kcdoweOreUtvvvTAk=";
+    hash = "sha256-mVG3dCz9DnExteUFhvTGjZu81E0KbrObP3OX0w/OVzU=";
   };
 
   # Relax version constraints: aiobotocore works with newer botocore versions
@@ -82,6 +82,8 @@ buildPythonPackage rec {
     "test_sso_credential_fetcher_can_fetch_credentials"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Python client for amazon services";
     homepage = "https://github.com/aio-libs/aiobotocore";
diff --git a/pkgs/development/python-modules/aioconsole/default.nix b/pkgs/development/python-modules/aioconsole/default.nix
index 870ae00612d26..aa9e05a982b51 100644
--- a/pkgs/development/python-modules/aioconsole/default.nix
+++ b/pkgs/development/python-modules/aioconsole/default.nix
@@ -56,9 +56,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/vxgmichel/aioconsole/releases/tag/v${version}";
     description = "Asynchronous console and interfaces for asyncio";
     homepage = "https://github.com/vxgmichel/aioconsole";
-    changelog = "https://github.com/vxgmichel/aioconsole/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ catern ];
   };
diff --git a/pkgs/development/python-modules/aiocron/default.nix b/pkgs/development/python-modules/aiocron/default.nix
index acb53f02ecc85..a9a135e28f21f 100644
--- a/pkgs/development/python-modules/aiocron/default.nix
+++ b/pkgs/development/python-modules/aiocron/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , python
 , croniter
 , tzlocal
@@ -10,13 +11,17 @@
 buildPythonPackage rec {
   pname = "aiocron";
   version = "1.8";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-SFRlE/ry63kB5lpk66e2U8gBBu0A7ZyjQZw9ELZVWgE=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     croniter
     tzlocal
diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 5fc14b4f66bdd..1da999978b58d 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -3,36 +3,43 @@
 , fetchFromGitHub
 , pycares
 , pythonOlder
-, typing
+, setuptools
+
 }:
 
 buildPythonPackage rec {
   pname = "aiodns";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.1.1";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "saghul";
-    repo = pname;
-    rev = "aiodns-${version}";
-    sha256 = "1i91a43gsq222r8212jn4m6bxc3fl04z1mf2h7s39nqywxkggvlp";
+    repo = "aiodns";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-JZS53kICsrXDot3CKjG30AOjkYycKpMJvC9yS3c1v5Q=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pycares
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    typing
   ];
 
   # Could not contact DNS servers
   doCheck = false;
 
-  pythonImportsCheck = [ "aiodns" ];
+  pythonImportsCheck = [
+    "aiodns"
+  ];
 
   meta = with lib; {
     description = "Simple DNS resolver for asyncio";
     homepage = "https://github.com/saghul/aiodns";
+    changelog = "https://github.com/saghul/aiodns/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index d700c29071cc4..a640c978764a6 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -1,18 +1,24 @@
 { lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, cython_3
+, setuptools
+
+# dependencies
 , aiohappyeyeballs
 , async-timeout
-, buildPythonPackage
 , chacha20poly1305-reuseable
-, cython_3
-, fetchFromGitHub
-, mock
 , noiseprotocol
 , protobuf
+, zeroconf
+
+# tests
+, mock
 , pytest-asyncio
 , pytestCheckHook
-, pythonOlder
-, setuptools
-, zeroconf
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/aiogithubapi/default.nix b/pkgs/development/python-modules/aiogithubapi/default.nix
index ba943865a444d..3eb23c4a66419 100644
--- a/pkgs/development/python-modules/aiogithubapi/default.nix
+++ b/pkgs/development/python-modules/aiogithubapi/default.nix
@@ -9,11 +9,12 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, sigstore
 }:
 
 buildPythonPackage rec {
   pname = "aiogithubapi";
-  version = "23.2.1";
+  version = "23.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +23,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-J6kcEVqADmVJZDbU9eqLCL0rohMSA/Ig7FSp/Ye5Sfk=";
+    hash = "sha256-SbpfHKD4QJuCe3QG0GTvsffkuFiGPLEUXOVW9f1gyTI=";
   };
 
   postPatch = ''
@@ -41,6 +42,7 @@ buildPythonPackage rec {
     aiohttp
     async-timeout
     backoff
+    sigstore
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index 7638c4efb48fd..0dc72bc2006ab 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -6,6 +6,7 @@
 , aiohttp
 , aiohttp-socks
 , aioredis
+, aiofiles
 , aresponses
 , babel
 , certifi
@@ -13,12 +14,16 @@
 , pytest-asyncio
 , pytest-lazy-fixture
 , redis
+, hatchling
+, pydantic
+, pytz
+, gitUpdater
 }:
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -26,21 +31,20 @@ buildPythonPackage rec {
     owner = "aiogram";
     repo = "aiogram";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bWwK761gn7HsR9ObcBDfvQH0fJfTAo0QAcL/HcNdHik=";
+    hash = "sha256-8SYrg+gfNSTR0CTPf4cYDa4bfA0LPBmZtPcATF22fqw=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "aiohttp>=3.8.0,<3.9.0" "aiohttp" \
-      --replace "Babel>=2.9.1,<2.10.0" "Babel" \
-      --replace "magic-filter>=1.0.9" "magic-filter"
-  '';
+  nativeBuildInputs = [
+    hatchling
+  ];
 
   propagatedBuildInputs = [
+    aiofiles
     aiohttp
     babel
     certifi
     magic-filter
+    pydantic
   ];
 
   nativeCheckInputs = [
@@ -50,17 +54,20 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-lazy-fixture
     pytestCheckHook
+    pytz
     redis
   ];
 
-  # requires network
+  # import failures
   disabledTests = [
-    "test_download_file_404"
-    "test_download_404"
+    "test_aiohtt_server"
+    "test_deep_linking"
   ];
 
   pythonImportsCheck = [ "aiogram" ];
 
+  passthru.updateScript = gitUpdater { };
+
   meta = with lib; {
     description = "Modern and fully asynchronous framework for Telegram Bot API";
     homepage = "https://github.com/aiogram/aiogram";
diff --git a/pkgs/development/python-modules/aioguardian/default.nix b/pkgs/development/python-modules/aioguardian/default.nix
index 4e7ec48ac5851..8047a91fb2c42 100644
--- a/pkgs/development/python-modules/aioguardian/default.nix
+++ b/pkgs/development/python-modules/aioguardian/default.nix
@@ -3,6 +3,7 @@
 , async-timeout
 , asyncio-dgram
 , buildPythonPackage
+, certifi
 , docutils
 , fetchFromGitHub
 , poetry-core
@@ -35,6 +36,7 @@ buildPythonPackage rec {
     aiohttp
     async-timeout
     asyncio-dgram
+    certifi
     docutils
     voluptuous
   ];
diff --git a/pkgs/development/python-modules/aiohappyeyeballs/default.nix b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
index 214f12bcd6d0d..a2be5384a04ce 100644
--- a/pkgs/development/python-modules/aiohappyeyeballs/default.nix
+++ b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
@@ -1,10 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+
+# build-system
 , poetry-core
+
+# optional-dependencies
+, furo
+, myst-parser
+, sphinx-autobuild
+, sphinxHook
+
+# tests
 , pytest-asyncio
 , pytestCheckHook
-, pythonOlder
 }:
 
 buildPythonPackage rec {
@@ -21,6 +31,11 @@ buildPythonPackage rec {
     hash = "sha256-3Lj1eUDPoVCElrxowBhhrS0GCjD5qeUCiSB/gHoqC3Q=";
   };
 
+  outputs = [
+    "out"
+    "doc"
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov=aiohappyeyeballs --cov-report=term-missing:skip-covered" ""
@@ -28,7 +43,16 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-  ];
+  ] ++ passthru.optional-dependencies.docs;
+
+  passthru.optional-dependencies = {
+    docs = [
+      furo
+      myst-parser
+      sphinx-autobuild
+      sphinxHook
+    ];
+  };
 
   nativeCheckInputs = [
     pytest-asyncio
@@ -40,15 +64,15 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    # Test has typos
+    # https://github.com/bdraco/aiohappyeyeballs/issues/30
     "tests/test_impl.py"
   ];
 
   meta = with lib; {
-    description = "Modul for connecting with Happy Eyeballs";
+    description = "Happy Eyeballs for pre-resolved hosts";
     homepage = "https://github.com/bdraco/aiohappyeyeballs";
     changelog = "https://github.com/bdraco/aiohappyeyeballs/blob/v${version}/CHANGELOG.md";
     license = licenses.psfl;
-    maintainers = with maintainers; [ fab ];
+    maintainers = with maintainers; [ fab hexa ];
   };
 }
diff --git a/pkgs/development/python-modules/aiohttp-jinja2/default.nix b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
index 6008b94179fb0..8e78784457ca4 100644
--- a/pkgs/development/python-modules/aiohttp-jinja2/default.nix
+++ b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "aiohttp-jinja2";
-  version = "1.5.1";
+  version = "1.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jRSbKlfZH3lLM6OU6lvGa1Z/OMdKWmqUd6/CRQ8QXAE=";
+    hash = "sha256-o6f/UmTlvKUuiuVHu/0HYbcklSMNQ40FtsCRW+YZsOI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiohttp-socks/default.nix b/pkgs/development/python-modules/aiohttp-socks/default.nix
index b81ff0065277d..6b96d06ea482b 100644
--- a/pkgs/development/python-modules/aiohttp-socks/default.nix
+++ b/pkgs/development/python-modules/aiohttp-socks/default.nix
@@ -1,23 +1,46 @@
-{ lib, fetchPypi, buildPythonPackage, pythonOlder, aiohttp, python-socks, attrs }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, aiohttp
+, attrs
+, python-socks
+}:
 
 buildPythonPackage rec {
   pname = "aiohttp-socks";
-  version = "0.8.3";
-  format = "setuptools";
+  version = "0.8.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit version;
     pname = "aiohttp_socks";
-    hash = "sha256-aqtSj2aeCHMBj9N3c7gzouK6KEJDvmcoF/pAG8eUHsY=";
+    hash = "sha256-a2EdTOg46c8sL+1eDbpEfMhIJKbLqV3FdHYGIB2kbLQ=";
   };
 
-  propagatedBuildInputs = [ aiohttp attrs python-socks ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    attrs
+    python-socks
+  ];
 
   # Checks needs internet access
   doCheck = false;
-  pythonImportsCheck = [ "aiohttp_socks" ];
 
-  disabled = pythonOlder "3.5.3";
+  pythonImportsCheck = [
+    "aiohttp_socks"
+  ];
 
   meta = {
     description = "SOCKS proxy connector for aiohttp";
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index ebbcf6ea82a41..691345d65a163 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -1,15 +1,15 @@
 { lib
 , stdenv
 , buildPythonPackage
-, fetchPypi
-, fetchpatch
 , pythonOlder
+, fetchFromGitHub
+, substituteAll
+, llhttp
 # build_requires
+, cython
 , setuptools
-, wheel
 # install_requires
 , attrs
-, charset-normalizer
 , multidict
 , async-timeout
 , yarl
@@ -17,70 +17,74 @@
 , aiosignal
 , aiodns
 , brotli
-, faust-cchardet
-, typing-extensions
 # tests_require
-, async-generator
-, freezegun
 , gunicorn
 , pytest-mock
 , pytestCheckHook
+, python-on-whales
 , re-assert
+, time-machine
 , trustme
 }:
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.8.6";
-  format = "pyproject";
+  version = "3.9.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-sM8qRQG/+TMKilJItM6VGFHkFb3M6dwVjnbP1V4VCFw=";
+  src = fetchFromGitHub {
+    owner = "aio-libs";
+    repo = "aiohttp";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uiqBUDbmROrhkanfBz4avvTSrnKxgVqw54k4jKhfRGY=";
   };
 
   patches = [
-    (fetchpatch {
-      # https://github.com/aio-libs/aiohttp/pull/7260
-      # Merged upstream, should be dropped once updated to 3.9.0
-      url = "https://github.com/aio-libs/aiohttp/commit/7dcc235cafe0c4521bbbf92f76aecc82fee33e8b.patch";
-      hash = "sha256-ZzhlE50bmA+e2XX2RH1FuWQHZIAa6Dk/hZjxPoX5t4g=";
+    (substituteAll {
+      src = ./unvendor-llhttp.patch;
+      llhttpDev = lib.getDev llhttp;
+      llhttpLib = lib.getLib llhttp;
     })
   ];
 
   postPatch = ''
     sed -i '/--cov/d' setup.cfg
+
+    rm -r vendor
+    patchShebangs tools
+    touch .git  # tools/gen.py uses .git to find the project root
   '';
 
   nativeBuildInputs = [
+    cython
     setuptools
-    wheel
   ];
 
+  preBuild = ''
+    make cythonize
+  '';
+
   propagatedBuildInputs = [
     attrs
-    charset-normalizer
     multidict
     async-timeout
     yarl
-    typing-extensions
     frozenlist
     aiosignal
     aiodns
     brotli
-    faust-cchardet
   ];
 
   # NOTE: pytest-xdist cannot be added because it is flaky. See https://github.com/NixOS/nixpkgs/issues/230597 for more info.
   nativeCheckInputs = [
-    async-generator
-    freezegun
     gunicorn
     pytest-mock
     pytestCheckHook
+    python-on-whales
     re-assert
+    time-machine
   ] ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) [
     # Optional test dependency. Depends indirectly on pyopenssl, which is
     # broken on aarch64-darwin.
@@ -100,6 +104,8 @@ buildPythonPackage rec {
     "test_static_file_if_none_match"
     "test_static_file_if_match"
     "test_static_file_if_modified_since_past_date"
+    # don't run benchmarks
+    "test_import_time"
   ] ++ lib.optionals stdenv.is32bit [
     "test_cookiejar"
   ] ++ lib.optionals stdenv.isDarwin [
@@ -108,15 +114,15 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    "test_proxy_functional.py" # FIXME package proxy.py
+    "tests/test_proxy_functional.py" # FIXME package proxy.py
   ];
 
   __darwinAllowLocalNetworking = true;
 
   # aiohttp in current folder shadows installed version
-  # Probably because we run `python -m pytest` instead of `pytest` in the hook.
   preCheck = ''
-    cd tests
+    rm -r aiohttp
+    touch tests/data.unknown_mime_type # has to be modified after 1 Jan 1990
   '' + lib.optionalString stdenv.isDarwin ''
     # Work around "OSError: AF_UNIX path too long"
     export TMPDIR="/tmp"
diff --git a/pkgs/development/python-modules/aiohttp/unvendor-llhttp.patch b/pkgs/development/python-modules/aiohttp/unvendor-llhttp.patch
new file mode 100644
index 0000000000000..49b3e9154ded3
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp/unvendor-llhttp.patch
@@ -0,0 +1,60 @@
+diff --git a/Makefile b/Makefile
+index 5769d2a1..f505dd81 100644
+--- a/Makefile
++++ b/Makefile
+@@ -71,7 +71,7 @@ vendor/llhttp/node_modules: vendor/llhttp/package.json
+ generate-llhttp: .llhttp-gen
+ 
+ .PHONY: cythonize
+-cythonize: .install-cython $(PYXS:.pyx=.c)
++cythonize: $(PYXS:.pyx=.c)
+ 
+ .install-deps: .install-cython $(PYXS:.pyx=.c) $(call to-hash,$(CYS) $(REQS))
+ 	@python -m pip install -r requirements/dev.txt -c requirements/constraints.txt
+diff --git a/aiohttp/_cparser.pxd b/aiohttp/_cparser.pxd
+index 165dd61d..bc6bf86d 100644
+--- a/aiohttp/_cparser.pxd
++++ b/aiohttp/_cparser.pxd
+@@ -10,7 +10,7 @@ from libc.stdint cimport (
+ )
+ 
+ 
+-cdef extern from "../vendor/llhttp/build/llhttp.h":
++cdef extern from "@llhttpDev@/include/llhttp.h":
+ 
+     struct llhttp__internal_s:
+         int32_t _index
+diff --git a/setup.py b/setup.py
+index 4d59a022..d87d5b69 100644
+--- a/setup.py
++++ b/setup.py
+@@ -17,13 +17,6 @@ if sys.implementation.name != "cpython":
+     NO_EXTENSIONS = True
+ 
+ 
+-if IS_GIT_REPO and not (HERE / "vendor/llhttp/README.md").exists():
+-    print("Install submodules when building from git clone", file=sys.stderr)
+-    print("Hint:", file=sys.stderr)
+-    print("  git submodule update --init", file=sys.stderr)
+-    sys.exit(2)
+-
+-
+ # NOTE: makefile cythonizes all Cython modules
+ 
+ extensions = [
+@@ -33,12 +26,11 @@ extensions = [
+         [
+             "aiohttp/_http_parser.c",
+             "aiohttp/_find_header.c",
+-            "vendor/llhttp/build/c/llhttp.c",
+-            "vendor/llhttp/src/native/api.c",
+-            "vendor/llhttp/src/native/http.c",
+         ],
+         define_macros=[("LLHTTP_STRICT_MODE", 0)],
+-        include_dirs=["vendor/llhttp/build"],
++        include_dirs=["@llhttpDev@/include"],
++        library_dirs=["@llhttpLib@/lib"],
++        libraries=["llhttp"],
+     ),
+     Extension("aiohttp._helpers", ["aiohttp/_helpers.c"]),
+     Extension("aiohttp._http_writer", ["aiohttp/_http_writer.c"]),
diff --git a/pkgs/development/python-modules/aiojobs/default.nix b/pkgs/development/python-modules/aiojobs/default.nix
index 1061b4f777a72..b4ccb7b7fb4e2 100644
--- a/pkgs/development/python-modules/aiojobs/default.nix
+++ b/pkgs/development/python-modules/aiojobs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "aiojobs";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "aiojobs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/+PTHLrZyf2UuYkLWkNgzf9amFywDJnP2OKVWvARcAA=";
+    hash = "sha256-LwFXb/SHP6bbqPg1tqYwE03FKHf4Mv1PPOxnPdESH0I=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aionotion/default.nix b/pkgs/development/python-modules/aionotion/default.nix
index c99a317d2ca1b..2d8f1835554ad 100644
--- a/pkgs/development/python-modules/aionotion/default.nix
+++ b/pkgs/development/python-modules/aionotion/default.nix
@@ -2,8 +2,8 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , pydantic
 , pytest-aiohttp
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "aionotion";
-  version = "2023.05.5";
+  version = "2023.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,30 +23,17 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
-    rev = version;
-    hash = "sha256-/2sF8m5R8YXkP89bi5zR3h13r5LrFOl1OsixAcX0D4o=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-SxlMsntiG/geDDWDx5dyXkDaOkTEaDJI2zHlv4/+SDQ=";
   };
 
-  patches = [
-    # This patch removes references to setuptools and wheel that are no longer
-    # necessary and changes poetry to poetry-core, so that we don't need to add
-    # unnecessary nativeBuildInputs.
-    #
-    #   https://github.com/bachya/aionotion/pull/269
-    #
-    (fetchpatch {
-      name = "clean-up-build-dependencies.patch";
-      url = "https://github.com/bachya/aionotion/commit/53c7285110d12810f9b43284295f71d052a81b83.patch";
-      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
-    })
-  ];
-
   nativeBuildInputs = [
     poetry-core
   ];
 
   propagatedBuildInputs = [
     aiohttp
+    certifi
     pydantic
   ];
 
@@ -71,6 +58,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for Notion Home Monitoring";
     homepage = "https://github.com/bachya/aionotion";
+    changelog = "https://github.com/bachya/aionotion/releases/tag/${src.rev}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiooss2/default.nix b/pkgs/development/python-modules/aiooss2/default.nix
index 91c71fb2bcd61..0c0e512dae984 100644
--- a/pkgs/development/python-modules/aiooss2/default.nix
+++ b/pkgs/development/python-modules/aiooss2/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-PwgbUZAuk2woEmLYDdWF5hTs19DASxxUv3Ga844ai7g=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "aiohttp"
     "oss2"
diff --git a/pkgs/development/python-modules/aiopurpleair/default.nix b/pkgs/development/python-modules/aiopurpleair/default.nix
index bdbc83fd2ab3e..2fd8515b237a9 100644
--- a/pkgs/development/python-modules/aiopurpleair/default.nix
+++ b/pkgs/development/python-modules/aiopurpleair/default.nix
@@ -2,8 +2,8 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , pydantic
 , pytest-aiohttp
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiopurpleair";
-  version = "2022.12.1";
+  version = "2023.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,28 +23,9 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-YmJH4brWkTpgzyHwu9UnIWrY5qlDCmMtvF+KxQFXwfk=";
+    hash = "sha256-2Ngo2pvzwcgQvpyW5Q97VQN/tGSVhVJwRj0DMaPn+O4=";
   };
 
-  patches = [
-    # This patch removes references to setuptools and wheel that are no longer
-    # necessary and changes poetry to poetry-core, so that we don't need to add
-    # unnecessary nativeBuildInputs.
-    #
-    #   https://github.com/bachya/aiopurpleair/pull/207
-    #
-    (fetchpatch {
-      name = "clean-up-build-dependencies.patch";
-      url = "https://github.com/bachya/aiopurpleair/commit/8c704c51ea50da266f52a7f53198d29d643b30c5.patch";
-      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'pydantic = "^1.10.2"' 'pydantic = "*"'
-  '';
-
   nativeBuildInputs = [
     poetry-core
   ];
@@ -52,6 +33,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     aiohttp
     pydantic
+    certifi
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/aiopurpleair/pydantic_2-compatibility.patch b/pkgs/development/python-modules/aiopurpleair/pydantic_2-compatibility.patch
new file mode 100644
index 0000000000000..090014778fa62
--- /dev/null
+++ b/pkgs/development/python-modules/aiopurpleair/pydantic_2-compatibility.patch
@@ -0,0 +1,111 @@
+diff --git a/aiopurpleair/api.py b/aiopurpleair/api.py
+index d3b276b..c557015 100644
+--- a/aiopurpleair/api.py
++++ b/aiopurpleair/api.py
+@@ -5,7 +5,10 @@ from typing import Any, cast
+ 
+ from aiohttp import ClientSession, ClientTimeout
+ from aiohttp.client_exceptions import ClientError
+-from pydantic import BaseModel, ValidationError
++try:
++    from pydantic.v1 import BaseModel, ValidationError
++except ModuleNotFoundError:
++    from pydantic import BaseModel, ValidationError
+ 
+ from aiopurpleair.const import LOGGER
+ from aiopurpleair.endpoints.sensors import SensorsEndpoints
+diff --git a/aiopurpleair/endpoints/__init__.py b/aiopurpleair/endpoints/__init__.py
+index 4d263e1..6632310 100644
+--- a/aiopurpleair/endpoints/__init__.py
++++ b/aiopurpleair/endpoints/__init__.py
+@@ -4,7 +4,10 @@ from __future__ import annotations
+ from collections.abc import Awaitable, Callable, Iterable
+ from typing import Any
+ 
+-from pydantic import BaseModel, ValidationError
++try:
++    from pydantic.v1 import BaseModel, ValidationError
++except ModuleNotFoundError:
++    from pydantic import BaseModel, ValidationError
+ 
+ from aiopurpleair.errors import InvalidRequestError
+ from aiopurpleair.helpers.typing import ModelT
+diff --git a/aiopurpleair/helpers/typing.py b/aiopurpleair/helpers/typing.py
+index 4ae01e6..49f59e6 100644
+--- a/aiopurpleair/helpers/typing.py
++++ b/aiopurpleair/helpers/typing.py
+@@ -1,6 +1,9 @@
+ """Define typing helpers."""
+ from typing import TypeVar
+ 
+-from pydantic import BaseModel
++try:
++    from pydantic.v1 import BaseModel
++except ModuleNotFoundError:
++    from pydantic import BaseModel
+ 
+ ModelT = TypeVar("ModelT", bound=BaseModel)
+diff --git a/aiopurpleair/models/keys.py b/aiopurpleair/models/keys.py
+index 591ae01..ffadbcc 100644
+--- a/aiopurpleair/models/keys.py
++++ b/aiopurpleair/models/keys.py
+@@ -3,7 +3,10 @@ from __future__ import annotations
+ 
+ from datetime import datetime
+ 
+-from pydantic import BaseModel, validator
++try:
++    from pydantic.v1 import BaseModel, validator
++except ModuleNotFoundError:
++    from pydantic import BaseModel, validator
+ 
+ from aiopurpleair.backports.enum import StrEnum
+ from aiopurpleair.helpers.validators import validate_timestamp
+diff --git a/aiopurpleair/models/sensors.py b/aiopurpleair/models/sensors.py
+index 5b99b51..d435996 100644
+--- a/aiopurpleair/models/sensors.py
++++ b/aiopurpleair/models/sensors.py
+@@ -5,7 +5,10 @@ from __future__ import annotations
+ from datetime import datetime
+ from typing import Any, Optional
+ 
+-from pydantic import BaseModel, root_validator, validator
++try:
++    from pydantic.v1 import BaseModel, root_validator, validator
++except ModuleNotFoundError:
++    from pydantic import BaseModel, root_validator, validator
+ 
+ from aiopurpleair.const import SENSOR_FIELDS, ChannelFlag, ChannelState, LocationType
+ from aiopurpleair.helpers.validators import validate_timestamp
+diff --git a/tests/models/test_keys.py b/tests/models/test_keys.py
+index 0d7d7c8..b2e30c1 100644
+--- a/tests/models/test_keys.py
++++ b/tests/models/test_keys.py
+@@ -5,7 +5,10 @@ from datetime import datetime
+ from typing import Any
+ 
+ import pytest
+-from pydantic import ValidationError
++try:
++    from pydantic.v1 import ValidationError
++except ModuleNotFoundError:
++    from pydantic import ValidationError
+ 
+ from aiopurpleair.models.keys import ApiKeyType, GetKeysResponse
+ 
+diff --git a/tests/models/test_sensors.py b/tests/models/test_sensors.py
+index a984b36..7b2c84f 100644
+--- a/tests/models/test_sensors.py
++++ b/tests/models/test_sensors.py
+@@ -5,7 +5,10 @@ from datetime import datetime
+ from typing import Any
+ 
+ import pytest
+-from pydantic import ValidationError
++try:
++    from pydantic.v1 import ValidationError
++except ModuleNotFoundError:
++    from pydantic import ValidationError
+ 
+ from aiopurpleair.models.sensors import (
+     GetSensorsRequest,
diff --git a/pkgs/development/python-modules/aiopvapi/default.nix b/pkgs/development/python-modules/aiopvapi/default.nix
index 055239052ddb8..710421cd366ee 100644
--- a/pkgs/development/python-modules/aiopvapi/default.nix
+++ b/pkgs/development/python-modules/aiopvapi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aiopvapi";
-  version = "2.0.4";
+  version = "3.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sander76";
     repo = "aio-powerview-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cghfNi5T343/7GxNLDrE0iAewMlRMycQTP7SvDVpU2M=";
+    hash = "sha256-+jhfp8gLEmL8TGPPN7QY8lw1SkV4sMSDb4VSq2OJ6PU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioquic/default.nix b/pkgs/development/python-modules/aioquic/default.nix
index 9aeb06a1382d8..fc0fe63de4e5b 100644
--- a/pkgs/development/python-modules/aioquic/default.nix
+++ b/pkgs/development/python-modules/aioquic/default.nix
@@ -7,24 +7,31 @@
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, service-identity
 }:
 
 buildPythonPackage rec {
   pname = "aioquic";
-  version = "0.9.21";
-  format = "setuptools";
+  version = "0.9.23";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ecfsBjGOeFYnZlyk6HI63zR7ciW30AbjMtJXWh9RbvU=";
+    hash = "sha256-UsnaYO0IN/6LimoNfc8N++vsjpoCfhDr9yBPBWnFj6g=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     certifi
     pylsqpack
     pyopenssl
+    service-identity
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/aioresponses/default.nix b/pkgs/development/python-modules/aioresponses/default.nix
index 572d88044356d..6cbcad24bdc4c 100644
--- a/pkgs/development/python-modules/aioresponses/default.nix
+++ b/pkgs/development/python-modules/aioresponses/default.nix
@@ -1,33 +1,43 @@
 { lib
-, aiohttp
 , buildPythonPackage
-, ddt
 , fetchPypi
-, pbr
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, pbr
 , setuptools
+
+# dependencies
+, aiohttp
+
+# tests
+, ddt
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "aioresponses";
-  version = "0.7.4";
-  format = "setuptools";
+  version = "0.7.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-m4wQizY1TARjO60Op1K1XZVqdgL+PjI0uTn8RK+W8dg=";
+    hash = "sha256-95XZ29otYXdIQOfjL1Nm9FdS0a3Bt0yTYq/QFylsfuE=";
   };
 
   nativeBuildInputs = [
     pbr
+    setuptools
   ];
 
   propagatedBuildInputs = [
     aiohttp
-    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "aioresponses"
   ];
 
   nativeCheckInputs = [
@@ -41,10 +51,6 @@ buildPythonPackage rec {
     "test_pass_through_with_origin_params"
   ];
 
-  pythonImportsCheck = [
-    "aioresponses"
-  ];
-
   meta = {
     description = "A helper to mock/fake web requests in python aiohttp package";
     homepage = "https://github.com/pnuckowski/aioresponses";
diff --git a/pkgs/development/python-modules/aioridwell/default.nix b/pkgs/development/python-modules/aioridwell/default.nix
index d96add82b7d26..63f14b1991315 100644
--- a/pkgs/development/python-modules/aioridwell/default.nix
+++ b/pkgs/development/python-modules/aioridwell/default.nix
@@ -2,6 +2,7 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
 , freezegun
 , poetry-core
@@ -35,6 +36,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
+    certifi
     pyjwt
     pytz
     titlecase
diff --git a/pkgs/development/python-modules/aiormq/default.nix b/pkgs/development/python-modules/aiormq/default.nix
index 3a5b809c13feb..14c0d0f7b5133 100644
--- a/pkgs/development/python-modules/aiormq/default.nix
+++ b/pkgs/development/python-modules/aiormq/default.nix
@@ -6,9 +6,7 @@
 , pytestCheckHook
 , pamqp
 , yarl
-, setuptools
 , poetry-core
-, aiomisc
 }:
 
 buildPythonPackage rec {
@@ -20,13 +18,13 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "mosquito";
-    repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-X5Uy1DGxvsyEFR1UgVYqxOX6mESLnNzQl7sVkvzjcw4=";
+    repo = "aiormq";
+    # https://github.com/mosquito/aiormq/issues/189
+    rev = "72c44f55313fc14e2a760a45a09831237b64c48d";
+    hash = "sha256-IIlna8aQY6bIA7OZHthfvMFFWnf3DDRBP1uiFCD7+Do=";
   };
 
   nativeBuildInputs = [
-    setuptools
     poetry-core
   ];
 
diff --git a/pkgs/development/python-modules/aioshutil/default.nix b/pkgs/development/python-modules/aioshutil/default.nix
index 0fc144ac6f2b3..84813ff04c970 100644
--- a/pkgs/development/python-modules/aioshutil/default.nix
+++ b/pkgs/development/python-modules/aioshutil/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-XIGjiLjoyS/7vUDIyBPvHNMyHOBa0gsg/c/vGgrhZAg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/aiounittest/default.nix b/pkgs/development/python-modules/aiounittest/default.nix
index 4358c22f8be02..0456138379027 100644
--- a/pkgs/development/python-modules/aiounittest/default.nix
+++ b/pkgs/development/python-modules/aiounittest/default.nix
@@ -1,17 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
+, setuptools
 , nose
 , coverage
-, isPy27
 , wrapt
 }:
 
 buildPythonPackage rec {
   pname = "aiounittest";
   version = "1.4.2";
-  format = "setuptools";
-  disabled = isPy27;
+  pyproject = true;
+
+  # requires the imp module
+  disabled = pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "kwarunek";
@@ -20,6 +23,10 @@ buildPythonPackage rec {
     hash = "sha256-7lDOI1SHPpRZLTHRTmfbKlZH18T73poJdFyVmb+HKms=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     wrapt
   ];
diff --git a/pkgs/development/python-modules/aiowatttime/default.nix b/pkgs/development/python-modules/aiowatttime/default.nix
index fd5da5c330d56..1b6866b654b48 100644
--- a/pkgs/development/python-modules/aiowatttime/default.nix
+++ b/pkgs/development/python-modules/aiowatttime/default.nix
@@ -2,49 +2,38 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , pytest-aiohttp
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, yarl
 }:
 
 buildPythonPackage rec {
   pname = "aiowatttime";
-  version = "2023.08.0";
+  version = "2023.10.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-/ulDImbLOTcoA4iH8e65A01aqqnCLn+01DWuM/4H4p4=";
+    hash = "sha256-3cVs/mIMkHx5jyfICL+I9pOr0uCV2uzasrEcAN4UFGg=";
   };
 
-  patches = [
-    # This patch removes references to setuptools and wheel that are no longer
-    # necessary and changes poetry to poetry-core, so that we don't need to add
-    # unnecessary nativeBuildInputs.
-    #
-    #   https://github.com/bachya/aiowatttime/pull/206
-    #
-    (fetchpatch {
-      name = "clean-up-build-dependencies.patch";
-      url = "https://github.com/bachya/aiowatttime/commit/c3cd53f794964c5435148caacd04f4e0ab8f550a.patch";
-      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
-    })
-  ];
-
   nativeBuildInputs = [
     poetry-core
   ];
 
   propagatedBuildInputs = [
     aiohttp
+    certifi
+    yarl
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/alembic/default.nix b/pkgs/development/python-modules/alembic/default.nix
index 004d025062c95..1b5dc8514414b 100644
--- a/pkgs/development/python-modules/alembic/default.nix
+++ b/pkgs/development/python-modules/alembic/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "alembic";
-  version = "1.12.0";
+  version = "1.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jnZFwy5PIAZ15p8HRUFTNetZo2Y/X+tIer+gswxFiIs=";
+    hash = "sha256-q0s7lNLh5fgeNL6Km3t1dfyd1TmPzLC+81HsmxSHJiM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/amazon-ion/default.nix b/pkgs/development/python-modules/amazon-ion/default.nix
index e69de9cfea339..6e28c5da99787 100644
--- a/pkgs/development/python-modules/amazon-ion/default.nix
+++ b/pkgs/development/python-modules/amazon-ion/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "amazon-ion";
-  version = "0.11.2";
+  version = "0.11.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     rev = "refs/tags/v${version}";
     # Test vectors require git submodule
     fetchSubmodules = true;
-    hash = "sha256-0/+bX02qTbOydWDxex4OWL7woP7dW1yJZBmDZAivE7U=";
+    hash = "sha256-wA24ASd6+rTAqHNQ9ZGMnCK9ykJjogCtEWfrXY1B87o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/amberelectric/default.nix b/pkgs/development/python-modules/amberelectric/default.nix
index 1f1422a6b36a0..ac32a8cc7824c 100644
--- a/pkgs/development/python-modules/amberelectric/default.nix
+++ b/pkgs/development/python-modules/amberelectric/default.nix
@@ -5,21 +5,26 @@
 , pytestCheckHook
 , python-dateutil
 , pythonOlder
+, setuptools
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "amberelectric";
-  version = "1.0.4";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5SWJnTxRm6mzP0RxrgA+jnV+Gp23WjqQA57wbT2V9Dk=";
+    hash = "sha256-HujjqJ3nkPIj8P0qAiQnQzLhji5l8qOAO2Gh53OJ7UY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     urllib3
     python-dateutil
@@ -30,7 +35,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "amberelectric" ];
+  pythonImportsCheck = [
+    "amberelectric"
+  ];
 
   meta = with lib; {
     description = "Python Amber Electric API interface";
diff --git a/pkgs/development/python-modules/amqtt/default.nix b/pkgs/development/python-modules/amqtt/default.nix
index b25c1fa46ed25..0daef6d77aa02 100644
--- a/pkgs/development/python-modules/amqtt/default.nix
+++ b/pkgs/development/python-modules/amqtt/default.nix
@@ -2,13 +2,13 @@
 , buildPythonPackage
 , docopt
 , fetchFromGitHub
-, fetchpatch
 , hypothesis
 , passlib
 , poetry-core
 , pytest-logdog
 , pytest-asyncio
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , pyyaml
 , setuptools
@@ -60,6 +60,19 @@ buildPythonPackage rec {
     "--asyncio-mode=auto"
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # stuck in epoll
+    "test_publish_qos0"
+    "test_publish_qos1"
+    "test_publish_qos1_retry"
+    "test_publish_qos2"
+    "test_publish_qos2_retry"
+    "test_receive_qos0"
+    "test_receive_qos1"
+    "test_receive_qos2"
+    "test_start_stop"
+  ];
+
   disabledTestPaths = [
     # Test are not ported from hbmqtt yet
     "tests/test_client.py"
diff --git a/pkgs/development/python-modules/ansible-vault-rw/default.nix b/pkgs/development/python-modules/ansible-vault-rw/default.nix
index 23281c3ed0701..9e0005e04e858 100644
--- a/pkgs/development/python-modules/ansible-vault-rw/default.nix
+++ b/pkgs/development/python-modules/ansible-vault-rw/default.nix
@@ -1,15 +1,35 @@
-{ lib, buildPythonPackage, fetchPypi, ansible-core, ... }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
+, ansible-core
+
+# tests
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "ansible-vault-rw";
   version = "2.1.0";
-  format = "setuptools";
+  pyproject = true;
+
   src = fetchPypi {
     pname = "ansible-vault";
     inherit version;
-    sha256 = "sha256-XOj9tUcPFEm3a/B64qvFZIDa1INWrkBchbaG77ZNvV4";
+    hash = "sha256-XOj9tUcPFEm3a/B64qvFZIDa1INWrkBchbaG77ZNvV4";
   };
-  propagatedBuildInputs = [ ansible-core ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    ansible-core
+  ];
 
   # Otherwise tests will fail to create directory
   # Permission denied: '/homeless-shelter'
@@ -17,6 +37,13 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
   '';
 
+  # no tests in sdist, no 2.1.0 tag on git
+  doCheck = false;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   meta = with lib; {
     description = "This project aim to R/W an ansible-vault yaml file.";
     homepage = "https://github.com/tomoh1r/ansible-vault";
diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix
index 5c08a0f5bf078..42f4d0032cfdf 100644
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@@ -21,7 +21,7 @@
 
 let
   pname = "ansible";
-  version = "8.6.0";
+  version = "9.0.1";
 in
 buildPythonPackage {
   inherit pname version;
@@ -31,7 +31,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lfTlkydNWdU/NvYiB1NbfScq3CcBrHoO169qbYFjemA=";
+    hash = "sha256-zAbCUfFCg3z1QLeXdyRZapTz0P6dqWGRdeneZTnNBwU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ansiwrap/default.nix b/pkgs/development/python-modules/ansiwrap/default.nix
index 7e55912bed208..8dbfa99687c86 100644
--- a/pkgs/development/python-modules/ansiwrap/default.nix
+++ b/pkgs/development/python-modules/ansiwrap/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , textwrap3
 }:
@@ -12,7 +13,7 @@ buildPythonPackage rec {
   version = "0.8.4";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/antlr4-python3-runtime/default.nix b/pkgs/development/python-modules/antlr4-python3-runtime/default.nix
index 20daf71c8cda0..3b8ed13b1ad83 100644
--- a/pkgs/development/python-modules/antlr4-python3-runtime/default.nix
+++ b/pkgs/development/python-modules/antlr4-python3-runtime/default.nix
@@ -19,12 +19,22 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  postPatch = ''
+    substituteInPlace tests/TestIntervalSet.py \
+      --replace "assertEquals" "assertEqual"
+  '';
+
   # We use an asterisk because this expression is used also for old antlr
   # versions, where there the tests directory is `test` and not `tests`.
   # See e.g in package `baserow`.
   checkPhase = ''
-    cd test*
+    runHook preCheck
+
+    pushd tests
     ${python.interpreter} run.py
+    popd
+
+    runHook postCheck
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 06112cccdc3fb..f645a416e8344 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -28,20 +28,18 @@
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "4.0.0";
-  format = "pyproject";
+  version = "4.1.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "agronholm";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-gUFd2gHWIElYfzOvg7Yx7iJyhU6+iAcJpHTVsJtxTsk=";
+    hash = "sha256-PEDPliWJX3QypwsvJTAJhrQnJx8lWXQQSdyjN0I8L+I=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -64,13 +62,13 @@ buildPythonPackage rec {
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
 
   nativeCheckInputs = [
+    exceptiongroup
     hypothesis
     psutil
     pytest-mock
     pytest-xdist
     pytestCheckHook
     trustme
-  ] ++ lib.optionals (pythonOlder "3.12") [
     uvloop
   ] ++ passthru.optional-dependencies.trio;
 
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index bff63bb84b79a..bd53a6f0b48aa 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -39,6 +39,7 @@
 , requests
 , requests-mock
 , scikit-learn
+, setuptools
 , sqlalchemy
 , tenacity
 , testcontainers
@@ -48,14 +49,14 @@
 
 buildPythonPackage rec {
   pname = "apache-beam";
-  version = "2.50.0";
-  format = "setuptools";
+  version = "2.52.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "beam";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qaxYWPVdMlegvH/W66UBoQbcQ5Ac/3DNoQs8xo+KfLc=";
+    hash = "sha256-s/DgTMsJc3c3dqR5Ak9p+xmLm72uNL3AofGzR26B3nI=";
   };
 
   patches = [
@@ -95,6 +96,7 @@ buildPythonPackage rec {
     grpcio-tools
     mypy-protobuf
     pythonRelaxDepsHook
+    setuptools
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/apipkg/default.nix b/pkgs/development/python-modules/apipkg/default.nix
index 0edddd68be32a..b37c1b11fe6fe 100644
--- a/pkgs/development/python-modules/apipkg/default.nix
+++ b/pkgs/development/python-modules/apipkg/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-ANLD7fUMKN3RmAVjVkcpwUH6U9ASalXdwKtPpoC8Urs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index c4b0f14dc4c4e..014fa13d6e2d5 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-idie99ditHJG/6rv97LDaF71iTjjgJyhLiTrbkQmbts=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index 9d83199ed5cb1..336a08e0532fc 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   '';
 
   pythonRelaxDeps = [
+    "msgpack"
     "semver"
   ];
 
diff --git a/pkgs/development/python-modules/apricot-select/default.nix b/pkgs/development/python-modules/apricot-select/default.nix
index 105f6a71c9153..5680b15530e96 100644
--- a/pkgs/development/python-modules/apricot-select/default.nix
+++ b/pkgs/development/python-modules/apricot-select/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, nose
 , numba
 , numpy
 , pytestCheckHook
@@ -26,6 +27,10 @@ buildPythonPackage rec {
     hash = "sha256-v9BHFxmlbwXVipPze/nV35YijdFBuka3gAl85AlsffQ=";
   };
 
+  postPatch = ''
+    sed -i '/"nose"/d' setup.py
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
@@ -38,6 +43,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    nose
     pytestCheckHook
     torchvision
     scikit-learn
diff --git a/pkgs/development/python-modules/apsw/default.nix b/pkgs/development/python-modules/apsw/default.nix
index 59576a129d68d..aafdf6ac72b22 100644
--- a/pkgs/development/python-modules/apsw/default.nix
+++ b/pkgs/development/python-modules/apsw/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.43.1.0";
+  version = "3.44.2.0";
   format = "setuptools";
 
   disabled = isPyPy;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "rogerbinns";
     repo = "apsw";
     rev = "refs/tags/${version}";
-    hash = "sha256-x+bSft37DgF2tXXCL6ac86g1+mj/wJeDLoCSiVSXedA=";
+    hash = "sha256-H7aqZHU4SXNrfbv6iwHckkNm5MeGkro42+njSoFJgS4=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/argcomplete/default.nix b/pkgs/development/python-modules/argcomplete/default.nix
index 765a7848ac56a..7c5bf54369965 100644
--- a/pkgs/development/python-modules/argcomplete/default.nix
+++ b/pkgs/development/python-modules/argcomplete/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-Akwa6dsf8w/Sw0ydUrqKEP5+dzHYX4hS8vcl7Gw4ePc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/argh/default.nix b/pkgs/development/python-modules/argh/default.nix
index a03e441c8fdaa..2a0ba451d28ac 100644
--- a/pkgs/development/python-modules/argh/default.nix
+++ b/pkgs/development/python-modules/argh/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "argh";
-  version = "0.29.4";
+  version = "0.30.4";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aVwK5FNCcMriaXhBtKVvQ0qZBpSgAmTqEOu7zcAsE/c=";
+    hash = "sha256-n8qOacTa1PjSp7373YCwdURitTUQoD4bXPK0Oofm6WA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ariadne/default.nix b/pkgs/development/python-modules/ariadne/default.nix
index 0e0bf1140a64b..ecfb0c32bc46e 100644
--- a/pkgs/development/python-modules/ariadne/default.nix
+++ b/pkgs/development/python-modules/ariadne/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ariadne";
-  version = "0.20.1";
+  version = "0.21.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "mirumee";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-v3CaLMTo/zbNEoE3K+aWnFTCgLetcnN7vOU/sFqLq2k=";
+    hash = "sha256-T5J0xAF33PDkC8sDOzHADpQJxwdXwKary0y/jaUJ9Fk=";
   };
   patches = [
     ./remove-opentracing.patch
diff --git a/pkgs/development/python-modules/array-record/default.nix b/pkgs/development/python-modules/array-record/default.nix
index 3abe60f64d5e2..c37eec6baba02 100644
--- a/pkgs/development/python-modules/array-record/default.nix
+++ b/pkgs/development/python-modules/array-record/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , pythonOlder
+, pythonAtLeast
 , python
 , fetchPypi
 , absl-py
@@ -16,7 +17,7 @@ buildPythonPackage rec {
   format = "wheel";
 
   # As of 2023-10-31, PyPI includes wheels for Python 3.9, 3.10, and 3.11.
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.9" || pythonAtLeast "3.12";
 
   src = let
     pyShortVersion = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
diff --git a/pkgs/development/python-modules/arrow/default.nix b/pkgs/development/python-modules/arrow/default.nix
index 1801900dcdeff..77aa1f6ca4ac0 100644
--- a/pkgs/development/python-modules/arrow/default.nix
+++ b/pkgs/development/python-modules/arrow/default.nix
@@ -2,8 +2,9 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, flit-core
 , python-dateutil
-, typing-extensions
+, types-python-dateutil
 , pytestCheckHook
 , pytest-mock
 , pytz
@@ -12,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "arrow";
-  version = "1.2.3";
-  format = "setuptools";
+  version = "1.3.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OTSzDKG58pI3bZ2xWxlEYIjRLsWGKbw/DaKP1V+2M6E=";
+    hash = "sha256-1FQGF2SMtfiVcw8a2MgqZfLa0BZvV7dfPKVHWcTWeoU=";
   };
 
   postPatch = ''
@@ -27,8 +28,14 @@ buildPythonPackage rec {
     sed -i "/addopts/d" tox.ini
   '';
 
-  propagatedBuildInputs = [ python-dateutil ]
-    ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    python-dateutil
+    types-python-dateutil
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/asdf/default.nix b/pkgs/development/python-modules/asdf/default.nix
index f4a45ecaf9ade..a6508229a3f0e 100644
--- a/pkgs/development/python-modules/asdf/default.nix
+++ b/pkgs/development/python-modules/asdf/default.nix
@@ -33,8 +33,6 @@ buildPythonPackage rec {
     hash = "sha256-u8e7ot5NDRqQFH0eLVnGinBQmQD73BlR5K9HVjA7SIg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   patches = [
     # Fix default validation, https://github.com/asdf-format/asdf/pull/1203
     (fetchpatch {
diff --git a/pkgs/development/python-modules/asn1crypto/default.nix b/pkgs/development/python-modules/asn1crypto/default.nix
index 4822c5a16ac8d..58bfe11458dbc 100644
--- a/pkgs/development/python-modules/asn1crypto/default.nix
+++ b/pkgs/development/python-modules/asn1crypto/default.nix
@@ -1,22 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# tests
 , pytestCheckHook
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "asn1crypto";
-  version = "1.5.1";
-  format = "setuptools";
+  version = "1.5.1-unstable-2023-11-03";
+  pyproject = true;
 
   # Pulling from Github to run tests
   src = fetchFromGitHub {
     owner = "wbond";
     repo = "asn1crypto";
-    rev = version;
-    hash = "sha256-M8vASxhaJPgkiTrAckxz7gk/QHkrFlNz7fFbnLEBT+M=";
+    # https://github.com/wbond/asn1crypto/issues/269
+    rev = "b763a757bb2bef2ab63620611ddd8006d5e9e4a2";
+    hash = "sha256-11WajEDtisiJsKQjZMSd5sDog3DuuBzf1PcgSY+uuXY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/aspectlib/default.nix b/pkgs/development/python-modules/aspectlib/default.nix
index 70fd8e8db2e22..3f4a87e0a334e 100644
--- a/pkgs/development/python-modules/aspectlib/default.nix
+++ b/pkgs/development/python-modules/aspectlib/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.7";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -47,12 +47,16 @@ buildPythonPackage rec {
     "aspectlib.test"
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     process-tests
     pytestCheckHook
     tornado
   ];
 
+  pytestFlagsArray = [
+    "-W ignore::DeprecationWarning"
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   meta = {
diff --git a/pkgs/development/python-modules/asteval/default.nix b/pkgs/development/python-modules/asteval/default.nix
index 49abd982a0f0f..0fc6631dd5904 100644
--- a/pkgs/development/python-modules/asteval/default.nix
+++ b/pkgs/development/python-modules/asteval/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-XIRDm/loZOOPQ7UO/XAo86TzhtHHRrnWFU7MNI4f1vM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace " --cov=asteval --cov-report xml" ""
diff --git a/pkgs/development/python-modules/astroid/default.nix b/pkgs/development/python-modules/astroid/default.nix
index 5fd0a5281b2c0..6d5c11104315f 100644
--- a/pkgs/development/python-modules/astroid/default.nix
+++ b/pkgs/development/python-modules/astroid/default.nix
@@ -2,55 +2,38 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, isPyPy
-, lazy-object-proxy
 , setuptools
-, wheel
 , typing-extensions
-, typed-ast
 , pip
 , pylint
 , pytestCheckHook
-, wrapt
 }:
 
 buildPythonPackage rec {
   pname = "astroid";
-  version = "2.15.6"; # Check whether the version is compatible with pylint
-  format = "pyproject";
+  version = "3.0.1"; # Check whether the version is compatible with pylint
+  pyproject = true;
 
-  disabled = pythonOlder "3.7.2";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
-    repo = pname;
+    repo = "astroid";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0oNNEVD8rYGkM11nGUD+XMwE7xgk7mJIaplrAXaECFg=";
+    hash = "sha256-z6FmB3I3VmiIx0MSsrkvHmDVv2h3CaaeXlDG3DewGXw=";
   };
 
   nativeBuildInputs = [
     setuptools
-    wheel
   ];
 
-  propagatedBuildInputs = [
-    lazy-object-proxy
-    wrapt
-  ] ++ lib.optionals (pythonOlder "3.11") [
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.11") [
     typing-extensions
-  ] ++ lib.optionals (!isPyPy && pythonOlder "3.8") [
-    typed-ast
   ];
 
   nativeCheckInputs = [
     pip
     pytestCheckHook
-    typing-extensions
-  ];
-
-  disabledTests = [
-    # DeprecationWarning: Deprecated call to `pkg_resources.declare_namespace('tests.testdata.python3.data.path_pkg_resources_1.package')`.
-    "test_identify_old_namespace_package_protocol"
   ];
 
   passthru.tests = {
@@ -62,6 +45,6 @@ buildPythonPackage rec {
     description = "An abstract syntax tree for Python with inference support";
     homepage = "https://github.com/PyCQA/astroid";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ GaetanLepage ];
   };
 }
diff --git a/pkgs/development/python-modules/astropy-extension-helpers/default.nix b/pkgs/development/python-modules/astropy-extension-helpers/default.nix
index d02ed1236154e..9f7280185aedd 100644
--- a/pkgs/development/python-modules/astropy-extension-helpers/default.nix
+++ b/pkgs/development/python-modules/astropy-extension-helpers/default.nix
@@ -6,16 +6,18 @@
 , pytestCheckHook
 , pythonOlder
 , pip
+, setuptools
 , setuptools-scm
+, tomli
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "extension-helpers";
   version = "1.1.0";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -33,10 +35,15 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
     wheel
   ];
 
+  propagatedBuildInputs = [
+    tomli
+  ];
+
   nativeCheckInputs = [
     findutils
     pip
diff --git a/pkgs/development/python-modules/astropy-healpix/default.nix b/pkgs/development/python-modules/astropy-healpix/default.nix
index 6944ee4d8683e..c081463632171 100644
--- a/pkgs/development/python-modules/astropy-healpix/default.nix
+++ b/pkgs/development/python-modules/astropy-healpix/default.nix
@@ -6,6 +6,7 @@
 , numpy
 , astropy
 , astropy-extension-helpers
+, setuptools
 , setuptools-scm
 , pytestCheckHook
 , pytest-doctestplus
@@ -14,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "astropy-healpix";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = lib.replaceStrings ["-"] ["_"] pname;
-    hash = "sha256-9ILvYqEOaGMD84xm8I3xe53e5a2CIZwjVx7oDXar7qM=";
+    hash = "sha256-74k4vfcpdXw4CowXNHlNc3StAOB2f8Si+mOma+8SYkI=";
   };
 
   patches = [
@@ -35,6 +36,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     astropy-extension-helpers
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/astropy-iers-data/default.nix b/pkgs/development/python-modules/astropy-iers-data/default.nix
new file mode 100644
index 0000000000000..4089c6bc6cce1
--- /dev/null
+++ b/pkgs/development/python-modules/astropy-iers-data/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, setuptools-scm
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "astropy-iers-data";
+  version = "0.2023.12.04.00.30.20";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "astropy";
+    repo = "astropy-iers-data";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-r4YCBeAyqzwQghLK56d+nJ/TkoSIHmtiW5Gi5xXM2QM=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  pythonImportsCheck = [ "astropy_iers_data" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "IERS data maintained by @astrofrog and astropy.utils.iers maintainers";
+    homepage = "https://github.com/astropy/astropy-iers-data";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index 0a70e40e9e8a0..4814e1e70c40b 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -1,12 +1,11 @@
 { lib
 , fetchPypi
-, fetchpatch
 , buildPythonPackage
 , pythonOlder
 
 # build time
 , astropy-extension-helpers
-, cython
+, cython_3
 , jinja2
 , oldest-supported-numpy
 , setuptools-scm
@@ -15,9 +14,9 @@
 , pytestCheckHook
 , pytest-xdist
 , pytest-astropy
-, python
 
 # runtime
+, astropy-iers-data
 , numpy
 , packaging
 , pyerfa
@@ -26,26 +25,19 @@
 
 buildPythonPackage rec {
   pname = "astropy";
-  version = "5.3.4";
-  format = "pyproject";
+  version = "6.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8"; # according to setup.cfg
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1JD34vqsLMwBySRCAtYpFUJZr4qXkQTO2J3ErOTm8dg=";
+    hash = "sha256-A82AGlUwXaUjzY14DXY1n1clXc3Fn+C91x/VFU/Hd9k=";
   };
-  # Relax cython dependency to allow this to build, upstream only doesn't
-  # support cython 3 as of writing. See:
-  # https://github.com/astropy/astropy/issues/15315
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'cython==' 'cython>='
-  '';
 
   nativeBuildInputs = [
     astropy-extension-helpers
-    cython
+    cython_3
     jinja2
     oldest-supported-numpy
     setuptools-scm
@@ -53,6 +45,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    astropy-iers-data
     numpy
     packaging
     pyerfa
diff --git a/pkgs/development/python-modules/asttokens/default.nix b/pkgs/development/python-modules/asttokens/default.nix
index 452abd626e0bd..53fe96ff4d03b 100644
--- a/pkgs/development/python-modules/asttokens/default.nix
+++ b/pkgs/development/python-modules/asttokens/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "asttokens";
-  version = "2.4.0";
+  version = "2.4.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LgFxuZGyyVmsxsSTGASSNoRKXaHWW6JnLEiAwciUg04=";
+    hash = "sha256-sDhpcYuppusCfhNL/fafOKI21oHIPBYNUQdorxElS6A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/async-generator/default.nix b/pkgs/development/python-modules/async-generator/default.nix
index 5ddb6df48ee92..92c281580d9e8 100644
--- a/pkgs/development/python-modules/async-generator/default.nix
+++ b/pkgs/development/python-modules/async-generator/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonOlder
 , pytestCheckHook
 }:
@@ -22,6 +23,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    "test_aclose_on_unstarted_generator"
+  ];
+
   pythonImportsCheck = [ "async_generator" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/async-tkinter-loop/default.nix b/pkgs/development/python-modules/async-tkinter-loop/default.nix
index d376ec154263c..9d469ca43bc06 100644
--- a/pkgs/development/python-modules/async-tkinter-loop/default.nix
+++ b/pkgs/development/python-modules/async-tkinter-loop/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "async-tkinter-loop";
-  version = "0.9.2";
+  version = "0.9.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "async_tkinter_loop";
-    hash = "sha256-YwmW+zXAx9TAxgoRLEr7/3o1rrO4eSNScuoTh3ud2Vo=";
+    hash = "sha256-UJxBgTmEe8suR6WmttJKLi3KKQvEaNrWtrgCnoqGW/0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/asyncclick/default.nix b/pkgs/development/python-modules/asyncclick/default.nix
index 48ba646b74127..2d0066a86e13e 100644
--- a/pkgs/development/python-modules/asyncclick/default.nix
+++ b/pkgs/development/python-modules/asyncclick/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-by1clF+WAfN/gjOg/F60O1tCZ3qAhWqiiJJY04iMzQ8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/asyncio-mqtt/default.nix b/pkgs/development/python-modules/asyncio-mqtt/default.nix
index 8274f5493967a..309e74ba4cc1b 100644
--- a/pkgs/development/python-modules/asyncio-mqtt/default.nix
+++ b/pkgs/development/python-modules/asyncio-mqtt/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-f3JqocjOEwNjo6Uv17ij6oEdrjb6Z2wTzdhdVhx46iM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -65,6 +63,9 @@ buildPythonPackage rec {
     "test_multiple_messages_generators"
   ];
 
+  # newer version are packaged as aiomqtt
+  passthru.skipBulkUpdate = true;
+
   meta = with lib; {
     description = "Idomatic asyncio wrapper around paho-mqtt";
     homepage = "https://github.com/sbtinstruments/asyncio-mqtt";
diff --git a/pkgs/development/python-modules/asyncpg/default.nix b/pkgs/development/python-modules/asyncpg/default.nix
index 9e43c0494d149..88591af61bbd8 100644
--- a/pkgs/development/python-modules/asyncpg/default.nix
+++ b/pkgs/development/python-modules/asyncpg/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "asyncpg";
-  version = "0.28.0";
+  version = "0.29.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-clLNw6yy9S/qo2ZCgNO814pGvWwQv9aBrP/++hEg4ng=";
+    hash = "sha256-0cSeH0T/+v2aVeGpsQFZCFnYgdY56ikiUW9dnFEtNU4=";
   };
 
   # sandboxing issues on aarch64-darwin, see https://github.com/NixOS/nixpkgs/issues/198495
diff --git a/pkgs/development/python-modules/atom/default.nix b/pkgs/development/python-modules/atom/default.nix
index 4232716d48292..b6be40bc6c93c 100644
--- a/pkgs/development/python-modules/atom/default.nix
+++ b/pkgs/development/python-modules/atom/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-NXjvRVYcWU9p7b8y2ICOzYe6TeMh1S70Edy/JvTG7a4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/audible/default.nix b/pkgs/development/python-modules/audible/default.nix
index 69da14683a095..bd82dabbc83f3 100644
--- a/pkgs/development/python-modules/audible/default.nix
+++ b/pkgs/development/python-modules/audible/default.nix
@@ -1,27 +1,52 @@
-{ lib, fetchFromGitHub, buildPythonPackage, beautifulsoup4, httpx, pbkdf2, pillow, pyaes, rsa }:
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+
+  # build-system
+, poetry-core
+
+  # dependencies
+, beautifulsoup4
+, httpx
+, pbkdf2
+, pillow
+, pyaes
+, rsa
+
+  # test dependencies
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "audible";
-  version = "0.8.2";
-  format = "setuptools";
+  version = "0.9.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkb79";
     repo = "Audible";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SIEDBuMCC/Hap2mGVbKEFic96ClN369SEsV06Sg+poY=";
+    hash = "sha256-qLU8FjJBPKFgjpumPqRiiMBwZi+zW46iEmWM8UerMgs=";
   };
 
-  propagatedBuildInputs = [ beautifulsoup4 httpx pbkdf2 pillow pyaes rsa ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
-  postPatch = ''
-    sed -i "s/httpx.*/httpx',/" setup.py
-  '';
+  propagatedBuildInputs = [
+    pillow
+    beautifulsoup4
+    httpx
+    pbkdf2
+    pyaes
+    rsa
+  ];
 
-  # has no tests
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "audible"];
+  pythonImportsCheck = [ "audible" ];
 
   meta = with lib; {
     description = "A(Sync) Interface for internal Audible API written in pure Python";
diff --git a/pkgs/development/python-modules/audioread/default.nix b/pkgs/development/python-modules/audioread/default.nix
index f3e74462f42e1..851839f0a7976 100644
--- a/pkgs/development/python-modules/audioread/default.nix
+++ b/pkgs/development/python-modules/audioread/default.nix
@@ -1,18 +1,23 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, flit-core
 }:
 
 buildPythonPackage rec {
   pname = "audioread";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EhmVvSB+sf2j1Wa+uFHTU0J1klvDWk+22gyxHeD3JRo=";
+    hash = "sha256-rFRgpUmMSL3y6OdnQCWDpNzRP0QU0ob0LOQ3nos1Bm0=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   # No tests, need to disable or py3k breaks
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index 03f2cb571b155..7f0540b6d0969 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -3,14 +3,17 @@
 , aioresponses
 , buildPythonPackage
 , callee
+, cryptography
 , fetchFromGitHub
 , mock
 , poetry-core
 , poetry-dynamic-versioning
 , pyjwt
+, pyopenssl
 , pytestCheckHook
 , pythonOlder
 , requests
+, urllib3
 }:
 
 buildPythonPackage rec {
@@ -33,8 +36,12 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    requests
+    aiohttp
+    cryptography
     pyjwt
+    pyopenssl
+    requests
+    urllib3
   ] ++ pyjwt.optional-dependencies.crypto;
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/autocommand/default.nix b/pkgs/development/python-modules/autocommand/default.nix
index eeee08ec4927f..11ee55d6417df 100644
--- a/pkgs/development/python-modules/autocommand/default.nix
+++ b/pkgs/development/python-modules/autocommand/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 , pythonOlder
 }:
@@ -8,7 +9,7 @@
 buildPythonPackage rec {
   pname = "autocommand";
   version = "2.2.2";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -19,6 +20,15 @@ buildPythonPackage rec {
     hash = "sha256-9bv9Agj4RpeyNJvTLUaMwygQld2iZZkoLb81rkXOd3E=";
   };
 
+  postPatch = ''
+    #  _MissingDynamic: `license` defined outside of `pyproject.toml` is ignored.
+    rm setup.py
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # fails with: SyntaxError: invalid syntax
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/autopage/default.nix b/pkgs/development/python-modules/autopage/default.nix
index 0973220438ae8..c8fbd6b9473df 100644
--- a/pkgs/development/python-modules/autopage/default.nix
+++ b/pkgs/development/python-modules/autopage/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "autopage";
-  version = "0.5.1";
+  version = "0.5.2";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ab4+5hu3FOkJD8xcEPTPVGw5YzHGIMauUKIyGyjtMZk=";
+    hash = "sha256-gmmW10xaqfS2kWGVVHMSrGOEusOBC4UXBj8pMkgle3I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/avidtools/default.nix b/pkgs/development/python-modules/avidtools/default.nix
index acb2ea9c99985..c0edd6033de7e 100644
--- a/pkgs/development/python-modules/avidtools/default.nix
+++ b/pkgs/development/python-modules/avidtools/default.nix
@@ -6,7 +6,6 @@
 , pydantic
 , pythonOlder
 , setuptools
-, typing
 , typing-extensions
 }:
 
@@ -22,6 +21,10 @@ buildPythonPackage rec {
     hash = "sha256-t+ohPjOBwY8i+g7VC30ehEu6SFIsn1SwGR/ICkV9blg=";
   };
 
+  postPatch = ''
+    sed -i "/'typing'/d" setup.py
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
@@ -30,7 +33,6 @@ buildPythonPackage rec {
     datetime
     nvdlib
     pydantic
-    typing
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/avro/default.nix b/pkgs/development/python-modules/avro/default.nix
index e59a7d4750793..4158600e182f4 100644
--- a/pkgs/development/python-modules/avro/default.nix
+++ b/pkgs/development/python-modules/avro/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "avro";
-  version = "1.11.2";
+  version = "1.11.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-U9zVv/zLmnITbwjQsYdxeV6vTu+wKLuq7V9OF4fw4mg=";
+    hash = "sha256-M5O7UTn5zweR0gV1bOHjmltYWGr1sVPWo7WhmWEOnRc=";
   };
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
diff --git a/pkgs/development/python-modules/aw-core/default.nix b/pkgs/development/python-modules/aw-core/default.nix
index 9707e7978601b..61ea5bbfaf094 100644
--- a/pkgs/development/python-modules/aw-core/default.nix
+++ b/pkgs/development/python-modules/aw-core/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 , poetry-core
 , jsonschema
 , peewee
@@ -34,6 +35,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
@@ -48,6 +50,11 @@ buildPythonPackage rec {
     timeslot
   ];
 
+  pythonRelaxDeps = [
+    "platformdirs"
+    "iso8601"
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/awesomeversion/default.nix b/pkgs/development/python-modules/awesomeversion/default.nix
index 790a9c4bbb1dd..164b89ae4cc69 100644
--- a/pkgs/development/python-modules/awesomeversion/default.nix
+++ b/pkgs/development/python-modules/awesomeversion/default.nix
@@ -1,14 +1,19 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+
+# build-system
 , poetry-core
+
+# tests
+, pytest-snapshot
 , pytestCheckHook
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "awesomeversion";
-  version = "23.8.0";
+  version = "23.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,27 +22,28 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-7JJNO25UfzLs1jEO7XpqFFuEqpY4UecUk25hpONRjrI=";
+    hash = "sha256-glnM32ha5eXVpoaDkEsbwdH1oiG9qMxFwbtqLx+Kl98=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
   postPatch = ''
     # Upstream doesn't set a version
     substituteInPlace pyproject.toml \
       --replace 'version = "0"' 'version = "${version}"'
   '';
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   pythonImportsCheck = [
     "awesomeversion"
   ];
 
+  nativeCheckInputs = [
+    pytest-snapshot
+    pytestCheckHook
+  ];
+
   meta = with lib; {
     description = "Python module to deal with versions";
     homepage = "https://github.com/ludeeus/awesomeversion";
diff --git a/pkgs/development/python-modules/aws-adfs/default.nix b/pkgs/development/python-modules/aws-adfs/default.nix
index 2fe56084de747..d583a97a41a01 100644
--- a/pkgs/development/python-modules/aws-adfs/default.nix
+++ b/pkgs/development/python-modules/aws-adfs/default.nix
@@ -11,6 +11,7 @@
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , requests
 , requests-kerberos
 , toml
@@ -32,6 +33,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "configparser"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 72930b85bb6d3..12e0a88035527 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -77,6 +77,8 @@ buildPythonPackage rec {
     "test_unexpected_sar_error_stops_processing"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Python library to transform SAM templates into AWS CloudFormation templates";
     homepage = "https://github.com/aws/serverless-application-model";
diff --git a/pkgs/development/python-modules/aws-xray-sdk/default.nix b/pkgs/development/python-modules/aws-xray-sdk/default.nix
index de02fdf8a88eb..53e69baa91820 100644
--- a/pkgs/development/python-modules/aws-xray-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-xray-sdk/default.nix
@@ -14,6 +14,7 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 , sqlalchemy
 , webtest
 , wrapt
@@ -22,7 +23,7 @@
 buildPythonPackage rec {
   pname = "aws-xray-sdk";
   version = "2.12.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -33,6 +34,10 @@ buildPythonPackage rec {
     hash = "sha256-NLFNst4Yqsz2u5IXwe8OdJPW77irLRO5tWWn1uV3tMg=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     botocore
     jsonpickle
diff --git a/pkgs/development/python-modules/awslambdaric/default.nix b/pkgs/development/python-modules/awslambdaric/default.nix
index f63ed81b76fa9..3e20875ac15d5 100644
--- a/pkgs/development/python-modules/awslambdaric/default.nix
+++ b/pkgs/development/python-modules/awslambdaric/default.nix
@@ -11,20 +11,22 @@
 , gcc
 , libtool
 , perl
+, setuptools
 , simplejson
 }:
 
 buildPythonPackage rec {
   pname = "awslambdaric";
-  version = "2.0.7";
-  format = "setuptools";
+  version = "2.0.8";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lambda-python-runtime-interface-client";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-9PgdLzeSafglguXksMetzopbDlBWlGDSSXiZHfuWgE8=";
+    sha256 = "sha256-0ej+Gy9nF96SaGhohHF9EJObSpHdxIe9QXHNHejVwbQ=";
   };
 
   patches = [
@@ -42,7 +44,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ simplejson ];
 
-  nativeBuildInputs = [ autoconf automake cmake libtool perl ];
+  nativeBuildInputs = [ autoconf automake cmake libtool perl setuptools ];
 
   buildInputs = [ gcc ];
 
diff --git a/pkgs/development/python-modules/ax/default.nix b/pkgs/development/python-modules/ax/default.nix
index 2e06b3a0f8b34..a0315a561fba7 100644
--- a/pkgs/development/python-modules/ax/default.nix
+++ b/pkgs/development/python-modules/ax/default.nix
@@ -46,8 +46,6 @@ buildPythonPackage rec {
     pyre-extensions
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   checkInputs = [
     hypothesis
     mercurial
diff --git a/pkgs/development/python-modules/azure-storage-blob/default.nix b/pkgs/development/python-modules/azure-storage-blob/default.nix
index e0846bc605143..dfca02bc5b3f5 100644
--- a/pkgs/development/python-modules/azure-storage-blob/default.nix
+++ b/pkgs/development/python-modules/azure-storage-blob/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-storage-blob";
-  version = "12.18.2";
+  version = "12.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4Rk1NImB/8AFuEi1XbJcBPLR+Q4e4zAAZZkGt2PPFMg=";
+    hash = "sha256-JsCkMgo0o8Kht0UoumgS68tjKgTNZ7HHN3IyxLAaWJc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index 0664362dd167b..2e13666af1406 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -11,6 +11,7 @@
 , pytest-mock
 , pythonOlder
 , requests
+, setuptools
 , setuptools-scm
 , tqdm
 , typing-extensions
@@ -19,7 +20,7 @@
 buildPythonPackage rec {
   pname = "b2sdk";
   version = "1.29.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -29,12 +30,14 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
   propagatedBuildInputs = [
     logfury
     requests
+    tqdm
   ] ++ lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ] ++ lib.optionals (pythonOlder "3.12") [
diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index a97224b5c8604..97dfc7a1daf2c 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -4,27 +4,34 @@
 , isPyPy
 , pythonAtLeast
 , pythonOlder
-, tzdata
+
+# build-system
+, setuptools
 
 # tests
 , freezegun
 , pytestCheckHook
 , pytz
+, tzdata
 }:
 
 buildPythonPackage rec {
   pname = "babel";
-  version = "2.12.1";
-  format = "setuptools";
+  version = "2.14.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Babel";
     inherit version;
-    hash = "sha256-zC2ZmZzQHURCCuclohyeNxGzqtx5dtYUf2IthYGWNFU=";
+    hash = "sha256-aRmGfbA2OYuiHrXHoPayirjLw656c6ROvjSudKTn02M=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [
     pytz
   ];
diff --git a/pkgs/development/python-modules/backports-cached-property/default.nix b/pkgs/development/python-modules/backports-cached-property/default.nix
index 27ad57237063a..dcce9b5fc6f0b 100644
--- a/pkgs/development/python-modules/backports-cached-property/default.nix
+++ b/pkgs/development/python-modules/backports-cached-property/default.nix
@@ -17,8 +17,6 @@ buildPythonPackage rec {
     hash = "sha256-rdgKbVQaELilPrN4ve8RbbaLiT14Xex0esy5vUX2ZBc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix b/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
index 88e140ad82f5c..febf3d50bb4f3 100644
--- a/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
+++ b/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
@@ -1,25 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# tests
 , pytz
-, unittestCheckHook
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "backports-datetime-fromisoformat";
-  version = "2.0.0";
-  format = "setuptools";
+  version = "2.0.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "movermeyer";
     repo = "backports.datetime_fromisoformat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aHF3E/fLN+j/T4W9lvuVSMy6iRSEn+ARWmL01rY+ixs=";
+    hash = "sha256-c3LCTOKva99+x96iLHNnL1e1Ft1M1CsjQX+nEqAlXUs=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytz
-    unittestCheckHook
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+      # ModuleNotFoundError: No module named 'developmental_release'
+    "release/test_developmental_release.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/bacpypes/default.nix b/pkgs/development/python-modules/bacpypes/default.nix
index 9804dd20f576c..9a30c1bbd6a94 100644
--- a/pkgs/development/python-modules/bacpypes/default.nix
+++ b/pkgs/development/python-modules/bacpypes/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , wheel
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 }:
 
@@ -11,7 +12,8 @@ buildPythonPackage rec {
   version = "0.18.6";
   format = "setuptools";
 
-  disabled = pythonOlder "3.9";
+  # uses the removed asyncore module
+  disabled = pythonOlder "3.9" || pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "JoelBender";
diff --git a/pkgs/development/python-modules/bagit/default.nix b/pkgs/development/python-modules/bagit/default.nix
index 7f671bb8a4704..0a07c39482db3 100644
--- a/pkgs/development/python-modules/bagit/default.nix
+++ b/pkgs/development/python-modules/bagit/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ gettext setuptools-scm ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     mock
     pytestCheckHook
diff --git a/pkgs/development/python-modules/barectf/default.nix b/pkgs/development/python-modules/barectf/default.nix
index 429e03fbe9407..d2083c08fa60f 100644
--- a/pkgs/development/python-modules/barectf/default.nix
+++ b/pkgs/development/python-modules/barectf/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , poetry-core
 , pytestCheckHook
+, pythonRelaxDepsHook
 , setuptools
 , jsonschema
 , pyyaml
@@ -22,8 +23,16 @@ buildPythonPackage rec {
     hash = "sha256-JelFfd3WS012dveNlIljhLdyPmgE9VEOXoZE3MBA/Gw=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "jsonschema"
+    "pyyaml"
+    "termcolor"
+  ];
 
   propagatedBuildInputs = [
     setuptools # needs pkg_resources at runtime
@@ -33,7 +42,13 @@ buildPythonPackage rec {
     termcolor
   ];
 
-  pythonImportsCheck = [ "barectf" ];
+  pythonImportsCheck = [
+    "barectf"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "Generator of ANSI C tracers which output CTF data streams ";
diff --git a/pkgs/development/python-modules/bbox/default.nix b/pkgs/development/python-modules/bbox/default.nix
index df28d568b0103..93eb8d272887e 100644
--- a/pkgs/development/python-modules/bbox/default.nix
+++ b/pkgs/development/python-modules/bbox/default.nix
@@ -26,8 +26,14 @@ buildPythonPackage rec {
     hash = "sha256-FrJ8FhlqwmnEB/QvPlkDfqZncNGPhwY9aagM9yv1LGs=";
   };
 
-  propagatedBuildInputs = [ pyquaternion numpy ];
-  buildInputs = [ poetry-core ];
+  nativebuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    pyquaternion
+    numpy
+  ];
 
   nativeCheckInputs = [
     matplotlib
@@ -36,7 +42,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "bbox" ];
+  disabledTests = [
+    # performance test, racy on busy machines
+    "test_multi_jaccard_index_2d_performance"
+  ];
+
+  pythonImportsCheck = [
+    "bbox"
+  ];
 
   meta = with lib; {
     description = "Python library for 2D/3D bounding boxes";
diff --git a/pkgs/development/python-modules/bcrypt/default.nix b/pkgs/development/python-modules/bcrypt/default.nix
index f0e23e713c3a1..fa440cc7fd2d1 100644
--- a/pkgs/development/python-modules/bcrypt/default.nix
+++ b/pkgs/development/python-modules/bcrypt/default.nix
@@ -5,10 +5,8 @@
 , rustc
 , setuptools
 , setuptools-rust
-, isPyPy
 , fetchPypi
 , pythonOlder
-, cffi
 , pytestCheckHook
 , libiconv
 , stdenv
@@ -51,14 +49,6 @@ buildPythonPackage rec {
   # Remove when https://github.com/NixOS/nixpkgs/pull/190093 lands.
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  propagatedBuildInputs = [
-    cffi
-  ];
-
-  propagatedNativeBuildInputs = [
-    cffi
-  ];
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/beautifulsoup4/default.nix b/pkgs/development/python-modules/beautifulsoup4/default.nix
index e803bcf154e17..9e9d15bec0cb6 100644
--- a/pkgs/development/python-modules/beautifulsoup4/default.nix
+++ b/pkgs/development/python-modules/beautifulsoup4/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , chardet
 , hatchling
 , html5lib
@@ -33,6 +34,18 @@ buildPythonPackage rec {
     hash = "sha256-SSu8adyjXRLarHHE2xv/8Mh2wA70ov+sziJtRjjrcto=";
   };
 
+  patches = [
+    # Fix test with libxml 2.12.
+    # https://bugs.launchpad.net/beautifulsoup/+bug/2045481
+    (fetchpatch {
+      url = "https://bugs.launchpad.net/beautifulsoup/+bug/2045481/+attachment/5726132/+files/2045481.diff";
+      hash = "sha256-f/Wkh7El4r1iWM2/CSi5AKE1+NsEP3D5pxWgBcZ//Vs=";
+      excludes = [
+        "CHANGELOG"
+      ];
+    })
+  ];
+
   nativeBuildInputs = [
     hatchling
     sphinxHook
diff --git a/pkgs/development/python-modules/bentoml/default.nix b/pkgs/development/python-modules/bentoml/default.nix
index c5201d3b11b7f..8441d25e71c68 100644
--- a/pkgs/development/python-modules/bentoml/default.nix
+++ b/pkgs/development/python-modules/bentoml/default.nix
@@ -204,5 +204,7 @@ buildPythonPackage {
     changelog = "https://github.com/bentoml/BentoML/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ happysalada natsukium ];
+    # https://github.com/bentoml/BentoML/issues/3885
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/bids-validator/default.nix b/pkgs/development/python-modules/bids-validator/default.nix
index 115c80553cc5e..c70268dea0b54 100644
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@@ -2,20 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+
+# build-system
+, setuptools
+, versioneer
 }:
 
 buildPythonPackage rec {
   pname = "bids-validator";
-  version = "1.13.1";
-  format = "setuptools";
+  version = "1.14.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cgXOTmj7oXIhUzLHhvGsFmUCW3Arbf8rHhWPAKLfmJA=";
+    hash = "sha256-M7D4ZcGqPjn7klGN8WP6a3lHjRqhAq9S/VNwSl7y6kY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    versioneer
+  ];
+
   # needs packages which are not available in nixpkgs
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/billiard/default.nix b/pkgs/development/python-modules/billiard/default.nix
index 6c641a16f9bea..15ccd234a7ac0 100644
--- a/pkgs/development/python-modules/billiard/default.nix
+++ b/pkgs/development/python-modules/billiard/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "billiard";
-  version = "4.1.0";
+  version = "4.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GtLuro4oBT1ym6M3PTTZ1uIQ9uTYvwqcZPkr0FPx7fU=";
+    hash = "sha256-mjwxhMsnWqF6cy+T9lsgxSXT2fJTci0mqCGUgDreWiw=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/bimmer-connected/default.nix b/pkgs/development/python-modules/bimmer-connected/default.nix
index ade9544f32d03..5fe28afbb5742 100644
--- a/pkgs/development/python-modules/bimmer-connected/default.nix
+++ b/pkgs/development/python-modules/bimmer-connected/default.nix
@@ -60,6 +60,11 @@ buildPythonPackage rec {
     time-machine
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
+  disabledTests = [
+    # presumably regressed in pytest-asyncio 0.23.0
+    "test_get_remote_position_too_old"
+  ];
+
   preCheck = ''
     export TZDIR=${tzdata}/${python.sitePackages}/tzdata/zoneinfo
   '';
diff --git a/pkgs/development/python-modules/bitstring/default.nix b/pkgs/development/python-modules/bitstring/default.nix
index 537905778ba3d..52fdaece66ff3 100644
--- a/pkgs/development/python-modules/bitstring/default.nix
+++ b/pkgs/development/python-modules/bitstring/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "bitstring";
-  version = "4.1.3";
+  version = "4.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "scott-griffiths";
     repo = pname;
     rev = "refs/tags/bitstring-${version}";
-    hash = "sha256-RbHy36AnDlu/Ym5Ty2O9XfPj5xXd9hTgoClvISPoGBc=";
+    hash = "sha256-CO7R2SCb232OW1DCLo45UIarFG5FhR4WkwuQieXha0Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/blackjax/default.nix b/pkgs/development/python-modules/blackjax/default.nix
index f9521db79cb8a..cae11bd30c8d7 100644
--- a/pkgs/development/python-modules/blackjax/default.nix
+++ b/pkgs/development/python-modules/blackjax/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     fastprogress
     jax
diff --git a/pkgs/development/python-modules/bleach/default.nix b/pkgs/development/python-modules/bleach/default.nix
index 901eb76417ff7..c1fb4d77e8061 100644
--- a/pkgs/development/python-modules/bleach/default.nix
+++ b/pkgs/development/python-modules/bleach/default.nix
@@ -13,15 +13,20 @@
 
 buildPythonPackage rec {
   pname = "bleach";
-  version = "6.0.0";
-  format = "setuptools";
-  disabled = pythonOlder "3.7";
+  version = "6.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GhqFwVleB9jbFMXwnwnmQzUCxRxZWXDtwJBVHw25lBQ=";
+    hash = "sha256-CjHxg3ljxB1Gu/EzG4d44TCOoHkdsDzE5zV7l89CqP4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     html5lib
     packaging
@@ -64,6 +69,7 @@ buildPythonPackage rec {
     '';
     homepage = "https://github.com/mozilla/bleach";
     downloadPage = "https://github.com/mozilla/bleach/releases";
+    changelog = "https://github.com/mozilla/bleach/blob/v${version}/CHANGES";
     license = licenses.asl20;
     maintainers = with maintainers; [ prikhi ];
   };
diff --git a/pkgs/development/python-modules/blinker/default.nix b/pkgs/development/python-modules/blinker/default.nix
index 9864bbae3c616..2e5707d153890 100644
--- a/pkgs/development/python-modules/blinker/default.nix
+++ b/pkgs/development/python-modules/blinker/default.nix
@@ -1,23 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, flit-core
+
+# tests
 , pytestCheckHook
 , pytest-asyncio
-, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "blinker";
-  version = "1.6.2";
+  version = "1.7.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Sv095m7zqfgGdVn7ehy+VVwX3L4VlxsF0bYlw+er4hM=";
+    hash = "sha256-5oIP9vpOTR2OJ0fCKDdJw/VH5P7hErmFVc3NrjKZYYI=";
   };
 
   nativeBuildInputs = [
-    setuptools
+    flit-core
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/blinkpy/default.nix b/pkgs/development/python-modules/blinkpy/default.nix
index eaca06056f365..37b01b3860551 100644
--- a/pkgs/development/python-modules/blinkpy/default.nix
+++ b/pkgs/development/python-modules/blinkpy/default.nix
@@ -28,7 +28,8 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace ', "wheel~=0.40.0"' ""
+      --replace ', "wheel~=0.40.0"' "" \
+      --replace "setuptools~=68.0" "setuptools"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/blosc2/default.nix b/pkgs/development/python-modules/blosc2/default.nix
index a4c1db3d7b700..1bc55fbdcf0a6 100644
--- a/pkgs/development/python-modules/blosc2/default.nix
+++ b/pkgs/development/python-modules/blosc2/default.nix
@@ -4,7 +4,7 @@
 
 # build-system
 , cmake
-, cython
+, cython_3
 , ninja
 , oldest-supported-numpy
 , scikit-build
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "blosc2";
-  version = "2.2.7";
+  version = "2.3.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     repo = "python-blosc2";
     rev = "refs/tags/v${version}";
     fetchSubmodules = true;
-    hash = "sha256-5a94Zm6sYl/nSfkcFbKG7PkyXwLB6bAoIvfaq0yVGHo=";
+    hash = "sha256-tRcyntJlmLPbqnX7nzdBQ/50uXy0fVLb2YGVOIwJjxU=";
   };
 
   postPatch = ''
@@ -44,7 +44,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
-    cython
+    cython_3
     ninja
     oldest-supported-numpy
     scikit-build
diff --git a/pkgs/development/python-modules/bokeh/default.nix b/pkgs/development/python-modules/bokeh/default.nix
index adca1fe308b05..a697a15c54b93 100644
--- a/pkgs/development/python-modules/bokeh/default.nix
+++ b/pkgs/development/python-modules/bokeh/default.nix
@@ -48,14 +48,14 @@
 buildPythonPackage rec {
   pname = "bokeh";
   # update together with panel which is not straightforward
-  version = "3.2.2";
+  version = "3.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-spWbhSTWnsTniGvDZAdEXwqS4fGVMNO/xARSNqG3pv8=";
+    hash = "sha256-rhgPhvd2Ul9+uBZzofJ+DrVoh9czdxZixRLsDYKkM/U=";
   };
 
   src_test = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/bootstrap/packaging/default.nix b/pkgs/development/python-modules/bootstrap/packaging/default.nix
new file mode 100644
index 0000000000000..f8a10d4ddd121
--- /dev/null
+++ b/pkgs/development/python-modules/bootstrap/packaging/default.nix
@@ -0,0 +1,30 @@
+{ stdenv
+, python
+, flit-core
+, installer
+, packaging
+}:
+
+stdenv.mkDerivation {
+  pname = "${python.libPrefix}-bootstrap-${packaging.pname}";
+  inherit (packaging) version src meta;
+
+  buildPhase = ''
+    runHook preBuild
+
+    PYTHONPATH="${flit-core}/${python.sitePackages}" \
+      ${python.interpreter} -m flit_core.wheel
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    PYTHONPATH="${installer}/${python.sitePackages}" \
+      ${python.interpreter} -m installer \
+        --destdir "$out" --prefix "" dist/*.whl
+
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/development/python-modules/bork/default.nix b/pkgs/development/python-modules/bork/default.nix
index 29357c0cc439b..060ac57ae00ed 100644
--- a/pkgs/development/python-modules/bork/default.nix
+++ b/pkgs/development/python-modules/bork/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 
 , build
 , coloredlogs
@@ -26,6 +27,16 @@ buildPythonPackage rec {
     hash = "sha256-sHCPT6nTenE6mbTifNPtg0OMNIJCs7LRcF8Xuk+MwLs=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "packaging"
+    "twine"
+    "wheel"
+  ];
+
   propagatedBuildInputs = [
     build
     coloredlogs
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 779871db10edb..717bb264283f9 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.28.57"; # N.B: if you change this, change botocore and awscli to a matching version
+  version = "1.33.6"; # N.B: if you change this, change botocore and awscli to a matching version
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-+kuILCUK10tvpfTEAHZGvKKmpw6Pgn+v2kQkwCkPMKg=";
+    hash = "sha256-oOrUVBh1sbaOibU8A+bGZ4z7IEiE4gjHwZ+8889Hv60=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,10 @@ buildPythonPackage rec {
     "tests/integration"
   ];
 
+  passthru.optional-dependencies = {
+    crt = [ botocore.optional-dependencies.crt ];
+  };
+
   meta = with lib; {
     homepage = "https://github.com/boto/boto3";
     changelog = "https://github.com/boto/boto3/blob/${version}/CHANGELOG.rst";
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index ddb9d35d05fd8..ea7ea23fc40d6 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -6,16 +6,17 @@
 , urllib3
 , pytestCheckHook
 , jsonschema
+, awscrt
 }:
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.31.57"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.33.6"; # N.B: if you change this, change boto3 and awscli to a matching version
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MBQ2F0Y1vsc5siW4QPw2XKAOXBpj5bKhnuZ50gTgG3g=";
+    hash = "sha256-k4BWurgxgp+Q4J7NcN1rKVr9UrFIL1WC7noR2CQ9lmE=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +42,10 @@ buildPythonPackage rec {
     "botocore"
   ];
 
+  passthru.optional-dependencies = {
+    crt = [ awscrt ];
+  };
+
   meta = with lib; {
     homepage = "https://github.com/boto/botocore";
     changelog = "https://github.com/boto/botocore/blob/${version}/CHANGELOG.rst";
diff --git a/pkgs/development/python-modules/botorch/default.nix b/pkgs/development/python-modules/botorch/default.nix
index 7d2170d3355eb..c62fef2478aec 100644
--- a/pkgs/development/python-modules/botorch/default.nix
+++ b/pkgs/development/python-modules/botorch/default.nix
@@ -40,8 +40,6 @@ buildPythonPackage rec {
     torch
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   checkInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/bottle/default.nix b/pkgs/development/python-modules/bottle/default.nix
index e64883140316a..9e8d84950e5e6 100644
--- a/pkgs/development/python-modules/bottle/default.nix
+++ b/pkgs/development/python-modules/bottle/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pytestCheckHook
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
   pname = "bottle";
   version = "0.12.25";
-
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-4anJSXCubXELP7RSYpTf64byy0qB7/OkuY3ED7Dl4CE=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -29,6 +34,12 @@ buildPythonPackage rec {
     "test_error_in_generator_callback"
     # timing sensitive
     "test_ims"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/bottlepy/bottle/issues/1422
+    # ModuleNotFoundError: No module named 'bottle.ext'
+    "test_data_import"
+    "test_direkt_import"
+    "test_from_import"
   ];
 
   __darwinAllowLocalNetworking = true;
@@ -36,6 +47,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://bottlepy.org/";
     description = "A fast and simple micro-framework for small web-applications";
+    downloadPage = "https://github.com/bottlepy/bottle";
     license = licenses.mit;
     maintainers = with maintainers; [ koral ];
   };
diff --git a/pkgs/development/python-modules/branca/default.nix b/pkgs/development/python-modules/branca/default.nix
index 119e166e38455..3bd46a26b83bb 100644
--- a/pkgs/development/python-modules/branca/default.nix
+++ b/pkgs/development/python-modules/branca/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-DH+XBj+VcS56+nAOGjjrKG0dnSKrqiU6N5vkILm+vSE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     # We don't want flake8
     rm setup.cfg
diff --git a/pkgs/development/python-modules/broadbean/default.nix b/pkgs/development/python-modules/broadbean/default.nix
index cb2dff1b06e9c..edf4ca1080ce6 100644
--- a/pkgs/development/python-modules/broadbean/default.nix
+++ b/pkgs/development/python-modules/broadbean/default.nix
@@ -57,6 +57,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # on a 200ms deadline
+    "test_points"
+  ];
+
   pythonImportsCheck = [ "broadbean" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 4b06298f1d26f..42c7786d78ae3 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -31,6 +31,11 @@ buildPythonPackage rec {
     hash = "sha256-SGWpm+AGIfqKMpDfmz2aMYmcs+XVREbHIXSuU4R7U/k=";
   };
 
+  postPatch = ''
+    # not strictly required, causes circular dependency cycle
+    sed -i '/importlib-metadata >= 4.6/d' pyproject.toml
+  '';
+
   nativeBuildInputs = [
     flit-core
   ];
diff --git a/pkgs/development/python-modules/buildcatrust/default.nix b/pkgs/development/python-modules/buildcatrust/default.nix
index b875185ed2ff3..cb997ab801348 100644
--- a/pkgs/development/python-modules/buildcatrust/default.nix
+++ b/pkgs/development/python-modules/buildcatrust/default.nix
@@ -1,27 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, flit-core
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "buildcatrust";
   version = "0.1.3";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
+    hash = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
+
   disabledTestPaths = [
     # Non-hermetic, needs internet access (e.g. attempts to retrieve NSS store).
     "buildcatrust/tests/test_nonhermetic.py"
   ];
 
-  pythonImportsCheck = [ "buildcatrust" "buildcatrust.cli" ];
+  pythonImportsCheck = [
+    "buildcatrust"
+    "buildcatrust.cli"
+  ];
 
   meta = with lib; {
     description = "Build SSL/TLS trust stores";
diff --git a/pkgs/development/python-modules/bwapy/default.nix b/pkgs/development/python-modules/bwapy/default.nix
index d52c2a9e2a92d..600fd1467b9c3 100644
--- a/pkgs/development/python-modules/bwapy/default.nix
+++ b/pkgs/development/python-modules/bwapy/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , pythonOlder
 , fetchPypi
 , bwa
@@ -11,7 +12,9 @@ buildPythonPackage rec {
   pname = "bwapy";
   version = "0.1.4";
   format = "setuptools";
-  disabled = pythonOlder "3.6";
+
+  # uses the removed imp module
+  disabled = pythonOlder "3.6" || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
@@ -35,7 +38,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "bwapy" ];
 
   meta = with lib; {
-    homepage = "https://github.com/ACEnglish/acebinf";
+    homepage = "https://github.com/ACEnglish/bwapy";
     description = "Python bindings to bwa mem aligner";
     license = licenses.mpl20;
     maintainers = with maintainers; [ ris ];
diff --git a/pkgs/development/python-modules/bytecode/default.nix b/pkgs/development/python-modules/bytecode/default.nix
index 4df83b9e45dfa..868279f4422c3 100644
--- a/pkgs/development/python-modules/bytecode/default.nix
+++ b/pkgs/development/python-modules/bytecode/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-Jzsh0m00SiJjTP7hXMDmuR4XHmsCYdURuFDkVopGyIE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/bytewax/Cargo.lock b/pkgs/development/python-modules/bytewax/Cargo.lock
index 2837d3c6ca95a..618736f138a56 100644
--- a/pkgs/development/python-modules/bytewax/Cargo.lock
+++ b/pkgs/development/python-modules/bytewax/Cargo.lock
@@ -20,17 +20,21 @@ dependencies = [
 ]
 
 [[package]]
-name = "ahash"
-version = "0.7.6"
+name = "addr2line"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "f4fa78e18c64fce05e902adecd7a5eed15a5e0a3439f7b0e169f0252214865e3"
 dependencies = [
- "getrandom",
- "once_cell",
- "version_check",
+ "gimli",
 ]
 
 [[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
 name = "ahash"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -42,6 +46,21 @@ dependencies = [
 ]
 
 [[package]]
+name = "aho-corasick"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56fc6cf8dc8c4158eed8649f9b8b0ea1518eb62b544fe9490d66fa0b349eafe9"
+
+[[package]]
 name = "android-tzdata"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -63,45 +82,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c7d0618f0e0b7e8ff11427422b64564d5fb0be1940354bfe2e0529b18a9d9b8"
 
 [[package]]
-name = "async-stream"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd56dd203fef61ac097dd65721a419ddccb106b2d2b70ba60a6b529f03961a51"
-dependencies = [
- "async-stream-impl",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-stream-impl"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.18",
-]
-
-[[package]]
 name = "async-trait"
-version = "0.1.68"
+version = "0.1.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9ccdd8f2a161be9bd5c023df56f1b2a0bd1d83872ae53b71a84a12c9bf6e842"
+checksum = "a564d521dd56509c4c47480d00b80ee55f7e385ae48db5744c67ad50c92d2ebf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
-]
-
-[[package]]
-name = "atoi"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c57d12312ff59c811c0643f4d80830505833c9ffaebd193d819392b265be8e"
-dependencies = [
- "num-traits",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -118,7 +106,7 @@ checksum = "acee9fd5073ab6b045a275b3e709c163dd36c90685219cb21804a147b58dba43"
 dependencies = [
  "async-trait",
  "axum-core 0.2.9",
- "bitflags",
+ "bitflags 1.3.2",
  "bytes",
  "futures-util",
  "http",
@@ -149,7 +137,7 @@ checksum = "f8175979259124331c1d7bf6586ee7e0da434155e4b2d48ec2c8386281d8df39"
 dependencies = [
  "async-trait",
  "axum-core 0.3.4",
- "bitflags",
+ "bitflags 1.3.2",
  "bytes",
  "futures-util",
  "http",
@@ -203,10 +191,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "base64"
-version = "0.13.1"
+name = "backtrace"
+version = "0.3.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+checksum = "4319208da049c43661739c5fade2ba182f09d1dc2299b32298d3a31692b17e12"
+dependencies = [
+ "addr2line",
+ "cc",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+]
 
 [[package]]
 name = "base64"
@@ -230,13 +227,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
-name = "block-buffer"
-version = "0.10.4"
+name = "bitflags"
+version = "2.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
+checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
 
 [[package]]
 name = "bumpalo"
@@ -258,23 +252,23 @@ checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
 
 [[package]]
 name = "bytewax"
-version = "0.16.2"
+version = "0.17.2"
 dependencies = [
  "axum 0.5.17",
  "bincode",
  "chrono",
- "futures",
+ "fastrand",
  "num",
- "openssl-src",
  "opentelemetry",
  "opentelemetry-jaeger",
  "opentelemetry-otlp",
  "pyo3",
- "rdkafka",
- "sasl2-sys",
+ "rusqlite",
+ "rusqlite_migration",
+ "seahash",
  "serde",
+ "serde_json",
  "serde_test",
- "sqlx",
  "timely",
  "tokio",
  "tracing",
@@ -308,15 +302,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "cmake"
-version = "0.1.50"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31c789563b815f77f4250caee12365734369f942439b7defd71e18a48197130"
-dependencies = [
- "cc",
-]
-
-[[package]]
 name = "columnation"
 version = "0.1.0"
 source = "git+https://github.com/frankmcsherry/columnation#eb8e20c10e748dcbfe6266be8e24e14422d3de0f"
@@ -331,30 +316,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
 
 [[package]]
-name = "cpufeatures"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e4c1eaa2012c47becbbad2ab175484c2a84d1185b566fb2cc5b8707343dfe58"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crc"
-version = "3.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86ec7a15cbe22e59248fc7eadb1907dab5ba09372595da4d73dd805ed4417dfe"
-dependencies = [
- "crc-catalog",
-]
-
-[[package]]
-name = "crc-catalog"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cace84e55f07e7301bae1c519df89cdad8cc3cd868413d3fdbdeca9ff3db484"
-
-[[package]]
 name = "crossbeam-channel"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -365,94 +326,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "crossbeam-queue"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
 name = "crossbeam-utils"
-version = "0.8.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c063cd8cc95f5c377ed0d4b49a4b21f632396ff690e8470c29b3359b346984b"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.6"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "dashmap"
-version = "5.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "907076dfda823b0b36d2a1bb5f90c96660a5bbcd7729e10727f07858f22c4edc"
+checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
 dependencies = [
  "cfg-if",
- "hashbrown 0.12.3",
- "lock_api",
- "once_cell",
- "parking_lot_core 0.9.7",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
- "subtle",
-]
-
-[[package]]
-name = "dirs"
-version = "4.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3aa72a6f96ea37bbc5aa912f6788242832f75369bdfdadcb0e38423f100059"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "dotenvy"
-version = "0.15.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
-
-[[package]]
-name = "duct"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37ae3fc31835f74c2a7ceda3aeede378b0ae2e74c8f1c36559fcc9ae2a4e7d3e"
-dependencies = [
- "libc",
- "once_cell",
- "os_pipe",
- "shared_child",
 ]
 
 [[package]]
@@ -471,31 +350,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "errno"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
+name = "fallible-iterator"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
 
 [[package]]
-name = "event-listener"
-version = "2.5.3"
+name = "fallible-streaming-iterator"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
 [[package]]
 name = "fastrand"
@@ -507,24 +371,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "fixedbitset"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
-
-[[package]]
-name = "flume"
-version = "0.10.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1657b4441c3403d9f7b3409e47575237dac27b1b5726df654a6ecbf92f0f7577"
-dependencies = [
- "futures-core",
- "futures-sink",
- "pin-project",
- "spin 0.9.8",
-]
-
-[[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -532,36 +378,20 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
 dependencies = [
  "percent-encoding",
 ]
 
 [[package]]
-name = "futures"
-version = "0.3.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-io",
- "futures-sink",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
 name = "futures-channel"
 version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
 dependencies = [
  "futures-core",
- "futures-sink",
 ]
 
 [[package]]
@@ -582,17 +412,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "futures-intrusive"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a604f7a68fbf8103337523b1fadc8ade7361ee3f112f7c680ad179651616aed5"
-dependencies = [
- "futures-core",
- "lock_api",
- "parking_lot 0.11.2",
-]
-
-[[package]]
 name = "futures-io"
 version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -606,7 +425,7 @@ checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -627,7 +446,6 @@ version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
 dependencies = [
- "futures-channel",
  "futures-core",
  "futures-io",
  "futures-macro",
@@ -640,16 +458,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
 name = "getopts"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -660,9 +468,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c85e1d9ab2eadba7e5040d4e09cbd6d072b76a557ad64e797c2cb9d4da21d7e4"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
  "cfg-if",
  "libc",
@@ -670,10 +478,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "gimli"
+version = "0.27.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c80984affa11d98d1b88b66ac8853f143217b399d3c74116778ff8fdb4ed2e"
+
+[[package]]
 name = "h2"
-version = "0.3.19"
+version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d357c7ae988e7d2182f7d7871d0b963962420b0678b0997ce7de72001aeab782"
+checksum = "97ec8491ebaf99c8eaa73058b045fe58073cd6be7f596ac993ced0b0a0c01049"
 dependencies = [
  "bytes",
  "fnv",
@@ -696,69 +510,28 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.13.2"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e"
+checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
 dependencies = [
- "ahash 0.8.3",
+ "ahash",
+ "allocator-api2",
 ]
 
 [[package]]
 name = "hashlink"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0761a1b9491c4f2e3d66aa0f62d0fba0af9a0e2852e4d48ea506632a4b56e6aa"
-dependencies = [
- "hashbrown 0.13.2",
-]
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.2.6"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+checksum = "312f66718a2d7789ffef4f4b7b213138ed9f1eb3aa1d0d82fc99f88fb3ffd26f"
 dependencies = [
- "libc",
+ "hashbrown 0.14.0",
 ]
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
-
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
-[[package]]
-name = "hkdf"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
-dependencies = [
- "hmac",
-]
-
-[[package]]
-name = "hmac"
-version = "0.12.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
-dependencies = [
- "digest",
-]
+checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
 
 [[package]]
 name = "http"
@@ -802,9 +575,9 @@ checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
 
 [[package]]
 name = "hyper"
-version = "0.14.26"
+version = "0.14.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab302d72a6f11a3b910431ff93aae7e773078c769f0a3ef15fb9ec692ed147d4"
+checksum = "ffb1cfd654a8219eaef89881fdb3bb3b1cdc5fa75ded05d6933b2b382e395468"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -838,9 +611,9 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.56"
+version = "0.1.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0722cd7114b7de04316e7ea5456a0bbb20e4adb46fd27a3697adb812cff0f37c"
+checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -861,9 +634,9 @@ dependencies = [
 
 [[package]]
 name = "idna"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
@@ -901,21 +674,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
 
 [[package]]
-name = "io-lifetimes"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
-dependencies = [
- "hermit-abi 0.3.1",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
 name = "ipnet"
-version = "2.7.2"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12b6ee2129af8d4fb011108c73d99a1b83a85977f23b82460c0ae2e25bb4b57f"
+checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
 
 [[package]]
 name = "itertools"
@@ -928,29 +690,20 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.6"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "453ad9f582a441959e5f0d088b02ce04cfe8d51a8eaf077f12ac6d3e94164ca6"
+checksum = "62b02a5381cc465bd3041d84623d0fa3b66738b52b8e2fc3bab8ad63ab032f4a"
 
 [[package]]
 name = "js-sys"
-version = "0.3.63"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f37a4a5928311ac501dee68b3c7613a1037d0edb30c8e5427bd832d55d1b790"
+checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
-name = "krb5-src"
-version = "0.3.2+1.19.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44cd3b7e7735d48bc3793837041294f2eb747bd0f63bbc081e89972abb9e48fb"
-dependencies = [
- "duct",
-]
-
-[[package]]
 name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -958,44 +711,25 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.144"
+version = "0.2.147"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b00cc1c228a6782d0f076e7b232802e0c5689d41bb5df366f2a6b6621cfdfe1"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "898745e570c7d0453cc1fbc4a701eb6c662ed54e8fec8b7d14be137ebeeb9d14"
-dependencies = [
- "cc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "libz-sys"
-version = "1.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56ee889ecc9568871456d42f603d6a0ce59ff328d291063a45cbdf0036baf6db"
+version = "0.26.0"
+source = "git+https://github.com/rusqlite/rusqlite.git?rev=7b0393210be4bce17156a08fde732083d6342a75#7b0393210be4bce17156a08fde732083d6342a75"
 dependencies = [
  "cc",
- "libc",
  "pkg-config",
  "vcpkg",
 ]
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
-
-[[package]]
 name = "lock_api"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1003,9 +737,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.18"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "518ef76f2f87365916b142844c16d8fefd85039bc5699050210a7778ee1cd1de"
+checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
 
 [[package]]
 name = "matchers"
@@ -1013,7 +747,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
 dependencies = [
- "regex-automata",
+ "regex-automata 0.1.10",
 ]
 
 [[package]]
@@ -1029,15 +763,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b87248edafb776e59e6ee64a79086f65890d3510f2c656c000bf2a7e8a0aea40"
 
 [[package]]
-name = "md-5"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6365506850d44bff6e2fbcb5176cf63650e48bd45ef2fe2665ae1570e0f4b9ca"
-dependencies = [
- "digest",
-]
-
-[[package]]
 name = "memchr"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1045,9 +770,9 @@ checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
 
 [[package]]
 name = "memoffset"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
 dependencies = [
  "autocfg",
 ]
@@ -1059,10 +784,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
-name = "minimal-lexical"
-version = "0.2.1"
+name = "miniz_oxide"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+dependencies = [
+ "adler",
+]
 
 [[package]]
 name = "mio"
@@ -1072,23 +800,7 @@ checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
 dependencies = [
  "libc",
  "wasi",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "multimap"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ce46fe64a9d73be07dcbe690a38ce1b293be448fd8ce1e6c1b8062c9f72c6a"
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
+ "windows-sys",
 ]
 
 [[package]]
@@ -1179,68 +891,34 @@ dependencies = [
 
 [[package]]
 name = "num_cpus"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi 0.2.6",
+ "hermit-abi",
  "libc",
 ]
 
 [[package]]
-name = "num_enum"
-version = "0.5.11"
+name = "object"
+version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f646caf906c20226733ed5b1374287eb97e3c2a5c227ce668c1f2ce20ae57c9"
+checksum = "8bda667d9f2b5051b8833f59f3bf748b28ef54f850f4fcb389a252aa383866d1"
 dependencies = [
- "num_enum_derive",
-]
-
-[[package]]
-name = "num_enum_derive"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcbff9bc912032c62bf65ef1d5aea88983b420f4f839db1e9b0c281a25c9c799"
-dependencies = [
- "proc-macro-crate",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
+ "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.17.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9670a07f94779e00908f3e686eab508878ebb390ba6e604d3a284c00e8d0487b"
-
-[[package]]
-name = "openssl-src"
-version = "111.26.0+1.1.1u"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efc62c9f12b22b8f5208c23a7200a442b2e5999f8bdf80233852122b5a4f6f37"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "openssl-sys"
-version = "0.9.88"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2ce0f250f34a308dcfdbb351f511359857d4ed2134ba715a4eadd46e1ffd617"
-dependencies = [
- "cc",
- "libc",
- "openssl-src",
- "pkg-config",
- "vcpkg",
-]
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "opentelemetry"
-version = "0.18.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69d6c3d7288a106c0a363e4b0e8d308058d56902adefb16f4936f417ffef086e"
+checksum = "9591d937bc0e6d2feb6f71a559540ab300ea49955229c347a517a28d27784c54"
 dependencies = [
  "opentelemetry_api",
  "opentelemetry_sdk",
@@ -1248,9 +926,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-http"
-version = "0.7.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edc79add46364183ece1a4542592ca593e6421c60807232f5b8f7a31703825d"
+checksum = "c7594ec0e11d8e33faf03530a4c49af7064ebba81c1480e01be67d90b356508b"
 dependencies = [
  "async-trait",
  "bytes",
@@ -1261,34 +939,33 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-jaeger"
-version = "0.17.0"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e785d273968748578931e4dc3b4f5ec86b26e09d9e0d66b55adda7fce742f7a"
+checksum = "876958ba9084f390f913fcf04ddf7bbbb822898867bb0a51cc28f2b9e5c1b515"
 dependencies = [
  "async-trait",
- "futures",
- "futures-executor",
- "once_cell",
+ "futures-core",
+ "futures-util",
  "opentelemetry",
  "opentelemetry-semantic-conventions",
- "thiserror",
  "thrift",
  "tokio",
 ]
 
 [[package]]
 name = "opentelemetry-otlp"
-version = "0.11.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1c928609d087790fc936a1067bdc310ae702bdf3b090c3f281b713622c8bbde"
+checksum = "7e5e5a5c4135864099f3faafbe939eb4d7f9b80ebf68a8448da961b32a7c1275"
 dependencies = [
  "async-trait",
- "futures",
- "futures-util",
+ "futures-core",
  "http",
- "opentelemetry",
  "opentelemetry-http",
  "opentelemetry-proto",
+ "opentelemetry-semantic-conventions",
+ "opentelemetry_api",
+ "opentelemetry_sdk",
  "prost",
  "reqwest",
  "thiserror",
@@ -1298,34 +975,31 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-proto"
-version = "0.1.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d61a2f56df5574508dd86aaca016c917489e589ece4141df1b5e349af8d66c28"
+checksum = "b1e3f814aa9f8c905d0ee4bde026afd3b2577a97c10e1699912e3e44f0c4cbeb"
 dependencies = [
- "futures",
- "futures-util",
- "opentelemetry",
+ "opentelemetry_api",
+ "opentelemetry_sdk",
  "prost",
  "tonic",
- "tonic-build",
 ]
 
 [[package]]
 name = "opentelemetry-semantic-conventions"
-version = "0.10.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b02e0230abb0ab6636d18e2ba8fa02903ea63772281340ccac18e0af3ec9eeb"
+checksum = "73c9f9340ad135068800e7f1b24e9e09ed9e7143f5bf8518ded3d3ec69789269"
 dependencies = [
  "opentelemetry",
 ]
 
 [[package]]
 name = "opentelemetry_api"
-version = "0.18.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c24f96e21e7acc813c7a8394ee94978929db2bcc46cf6b5014fc612bf7760c22"
+checksum = "8a81f725323db1b1206ca3da8bb19874bbd3f57c3bcd59471bfb04525b265b9b"
 dependencies = [
- "fnv",
  "futures-channel",
  "futures-util",
  "indexmap",
@@ -1333,25 +1007,27 @@ dependencies = [
  "once_cell",
  "pin-project-lite",
  "thiserror",
+ "urlencoding",
 ]
 
 [[package]]
 name = "opentelemetry_sdk"
-version = "0.18.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ca41c4933371b61c2a2f214bf16931499af4ec90543604ec828f7a625c09113"
+checksum = "fa8e705a0612d48139799fcbaba0d4a90f06277153e43dd2bdc16c6f0edd8026"
 dependencies = [
  "async-trait",
  "crossbeam-channel",
- "dashmap",
- "fnv",
  "futures-channel",
  "futures-executor",
  "futures-util",
  "once_cell",
  "opentelemetry_api",
+ "ordered-float 3.7.0",
  "percent-encoding",
  "rand",
+ "regex",
+ "serde_json",
  "thiserror",
  "tokio",
  "tokio-stream",
@@ -1359,21 +1035,20 @@ dependencies = [
 
 [[package]]
 name = "ordered-float"
-version = "1.1.1"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3305af35278dd29f46fcdd139e0b1fbfae2153f0e5928b39b035542dd31e37b7"
+checksum = "7940cf2ca942593318d07fcf2596cdca60a85c9e7fab408a5e21a4f9dcd40d87"
 dependencies = [
  "num-traits",
 ]
 
 [[package]]
-name = "os_pipe"
-version = "1.1.4"
+name = "ordered-float"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ae859aa07428ca9a929b936690f8b12dc5f11dd8c6992a18ca93919f28bc177"
+checksum = "2fc2dbde8f8a79f2102cc474ceb0ad68e3b80b85289ea62389b60e66777e4213"
 dependencies = [
- "libc",
- "windows-sys 0.48.0",
+ "num-traits",
 ]
 
 [[package]]
@@ -1384,99 +1059,64 @@ checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
 name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core 0.8.6",
-]
-
-[[package]]
-name = "parking_lot"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
 dependencies = [
  "lock_api",
- "parking_lot_core 0.9.7",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall 0.2.16",
- "smallvec",
- "winapi",
+ "parking_lot_core",
 ]
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.7"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9069cbb9f99e3a5083476ccb29ceb1de18b9118cafa53e90c9551235de2b9521"
+checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.2.16",
+ "redox_syscall",
  "smallvec",
- "windows-sys 0.45.0",
+ "windows-targets",
 ]
 
 [[package]]
 name = "paste"
-version = "1.0.12"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f746c4065a8fa3fe23974dd82f15431cc8d40779821001404d10d2e79ca7d79"
+checksum = "b4b27ab7be369122c218afc2079489cdcb4b517c0a3fc386ff11e1fedfcc2b35"
 
 [[package]]
 name = "percent-encoding"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
-
-[[package]]
-name = "petgraph"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dd7d28ee937e54fe3080c91faa1c3a46c06de6252988a7f4592ba2310ef22a4"
-dependencies = [
- "fixedbitset",
- "indexmap",
-]
+checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
 
 [[package]]
 name = "pin-project"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c95a7476719eab1e366eaf73d0260af3021184f18177925b07f54b30089ceead"
+checksum = "030ad2bc4db10a8944cb0d837f158bdfec4d4a4873ab701a95046770d11f8842"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39407670928234ebc5e6e580247dd567ad73a3578460c5990f9503df207e8f07"
+checksum = "ec2e072ecce94ec471b13398d5402c188e76ac03cf74dd1a975161b23a3f6d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+checksum = "4c40d25201921e5ff0c862a505c6557ea88568a4e3ace775ab55e93f2f4f9d57"
 
 [[package]]
 name = "pin-utils"
@@ -1497,30 +1137,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
-name = "prettyplease"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8646e95016a7a6c4adea95bafa8a16baab64b583356217f2c85db4a39d9a86"
-dependencies = [
- "proc-macro2",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "proc-macro-crate"
-version = "1.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
-dependencies = [
- "once_cell",
- "toml_edit",
-]
-
-[[package]]
 name = "proc-macro2"
-version = "1.0.59"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aeca18b86b413c660b781aa319e4e2648a3e6f9eadc9b47e9038e6fe9f3451b"
+checksum = "7b368fba921b0dce7e60f5e04ec15e565b3303972b42bcfde1d0713b881959eb"
 dependencies = [
  "unicode-ident",
 ]
@@ -1536,28 +1156,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "prost-build"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "119533552c9a7ffacc21e099c24a0ac8bb19c2a2a3f363de84cd9b844feab270"
-dependencies = [
- "bytes",
- "heck",
- "itertools",
- "lazy_static",
- "log",
- "multimap",
- "petgraph",
- "prettyplease",
- "prost",
- "prost-types",
- "regex",
- "syn 1.0.109",
- "tempfile",
- "which",
-]
-
-[[package]]
 name = "prost-derive"
 version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1571,26 +1169,17 @@ dependencies = [
 ]
 
 [[package]]
-name = "prost-types"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "213622a1460818959ac1181aaeb2dc9c7f63df720db7d788b3e24eacd1983e13"
-dependencies = [
- "prost",
-]
-
-[[package]]
 name = "pyo3"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3b1ac5b3731ba34fdaa9785f8d74d17448cd18f30cf19e0c7e7b1fdb5272109"
+checksum = "e681a6cfdc4adcc93b4d3cf993749a4552018ee0a9b65fc0ccfad74352c72a38"
 dependencies = [
  "cfg-if",
  "chrono",
  "indoc",
  "libc",
  "memoffset",
- "parking_lot 0.12.1",
+ "parking_lot",
  "pyo3-build-config",
  "pyo3-ffi",
  "pyo3-macros",
@@ -1599,9 +1188,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cb946f5ac61bb61a5014924910d936ebd2b23b705f7a4a3c40b05c720b079a3"
+checksum = "076c73d0bc438f7a4ef6fdd0c3bb4732149136abd952b110ac93e4edb13a6ba5"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -1609,9 +1198,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd4d7c5337821916ea2a1d21d1092e8443cf34879e53a0ac653fbb98f44ff65c"
+checksum = "e53cee42e77ebe256066ba8aa77eff722b3bb91f3419177cf4cd0f304d3284d9"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -1619,9 +1208,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d39c55dab3fc5a4b25bbd1ac10a2da452c4aca13bb450f22818a002e29648d"
+checksum = "dfeb4c99597e136528c6dd7d5e3de5434d1ceaf487436a3f03b2d56b6fc9efd1"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -1631,9 +1220,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97daff08a4c48320587b5224cc98d609e3c27b6d437315bd40b605c98eeb5918"
+checksum = "947dc12175c254889edc0c02e399476c2f652b4b9ebd123aa655c224de259536"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1642,9 +1231,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.28"
+version = "1.0.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ab9c7eadfd8df19006f1cf1a4aed13540ed5cbc047010ece5826e10825488"
+checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
 dependencies = [
  "proc-macro2",
 ]
@@ -1680,82 +1269,44 @@ dependencies = [
 ]
 
 [[package]]
-name = "rdkafka"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1de127f294f2dba488ed46760b129d5ecbeabbd337ccbf3739cb29d50db2161c"
-dependencies = [
- "futures",
- "libc",
- "log",
- "rdkafka-sys",
- "serde",
- "serde_derive",
- "serde_json",
- "slab",
- "tokio",
-]
-
-[[package]]
-name = "rdkafka-sys"
-version = "4.4.0+1.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ac9d87c3aba1748e3112318459f2ac8bff80bfff7359e338e0463549590249"
-dependencies = [
- "cmake",
- "libc",
- "libz-sys",
- "num_enum",
- "openssl-sys",
- "pkg-config",
- "sasl2-sys",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
 name = "redox_syscall"
 version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
-name = "redox_users"
-version = "0.4.3"
+name = "regex"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+checksum = "89089e897c013b3deb627116ae56a6955a72b8bed395c9526af31c9fe528b484"
 dependencies = [
- "getrandom",
- "redox_syscall 0.2.16",
- "thiserror",
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.3.0",
+ "regex-syntax 0.7.3",
 ]
 
 [[package]]
-name = "regex"
-version = "1.8.3"
+name = "regex-automata"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81ca098a9821bd52d6b24fd8b10bd081f47d39c22778cafaa75a2857a62c6390"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
 dependencies = [
- "regex-syntax 0.7.2",
+ "regex-syntax 0.6.29",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.1.10"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+checksum = "fa250384981ea14565685dea16a9ccc4d1c541a13f82b9c168572264d1df8c56"
 dependencies = [
- "regex-syntax 0.6.29",
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.7.3",
 ]
 
 [[package]]
@@ -1766,9 +1317,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436b050e76ed2903236f032a59761c1eb99e1b0aead2c257922771dab1fc8c78"
+checksum = "2ab07dc67230e4a4718e70fd5c20055a4334b121f1f9db8fe63ef39ce9b8c846"
 
 [[package]]
 name = "reqwest"
@@ -1776,7 +1327,7 @@ version = "0.11.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cde824a14b7c14f85caff81225f411faacc04a2013f41670f41443742b1c1c55"
 dependencies = [
- "base64 0.21.2",
+ "base64",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -1805,80 +1356,45 @@ dependencies = [
 ]
 
 [[package]]
-name = "ring"
-version = "0.16.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+name = "rusqlite"
+version = "0.29.0"
+source = "git+https://github.com/rusqlite/rusqlite.git?rev=7b0393210be4bce17156a08fde732083d6342a75#7b0393210be4bce17156a08fde732083d6342a75"
 dependencies = [
- "cc",
- "libc",
- "once_cell",
- "spin 0.5.2",
- "untrusted",
- "web-sys",
- "winapi",
-]
-
-[[package]]
-name = "rustix"
-version = "0.37.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acf8729d8542766f1b2cf77eb034d52f40d375bb8b615d0b147089946e16613d"
-dependencies = [
- "bitflags",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.48.0",
+ "bitflags 2.3.3",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
 ]
 
 [[package]]
-name = "rustls"
-version = "0.20.8"
+name = "rusqlite_migration"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fff78fc74d175294f4e83b28343315ffcfb114b156f0185e9741cb5570f50e2f"
+checksum = "ef7dd29a4426624704d5966416682fb7ab3682f724986e9e3893eaca44accabc"
 dependencies = [
  "log",
- "ring",
- "sct",
- "webpki",
+ "rusqlite",
 ]
 
 [[package]]
-name = "rustls-pemfile"
-version = "1.0.2"
+name = "rustc-demangle"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d194b56d58803a43635bdc398cd17e383d6f71f9182b9a192c127ca42494a59b"
-dependencies = [
- "base64 0.21.2",
-]
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustversion"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f3208ce4d8448b3f3e7d168a73f5e0c43a61e32930de3bceeccedb388b6bf06"
-
-[[package]]
-name = "ryu"
 version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
+checksum = "dc31bd9b61a32c31f9650d18add92aa83a49ba979c143eefd27fe7177b05bd5f"
 
 [[package]]
-name = "sasl2-sys"
-version = "0.1.20+2.1.28"
+name = "ryu"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e645bd98535fc8fd251c43ba7c7c1f9be1e0369c99b6a5ea719052a773e655c"
-dependencies = [
- "cc",
- "duct",
- "krb5-src",
- "libc",
- "openssl-sys",
- "pkg-config",
-]
+checksum = "fe232bdf6be8c8de797b22184ee71118d63780ea42ac85b61d1baa6d3b782ae9"
 
 [[package]]
 name = "scopeguard"
@@ -1887,40 +1403,36 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
 
 [[package]]
-name = "sct"
-version = "0.7.0"
+name = "seahash"
+version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
-dependencies = [
- "ring",
- "untrusted",
-]
+checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
 [[package]]
 name = "serde"
-version = "1.0.163"
+version = "1.0.166"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2113ab51b87a539ae008b5c6c02dc020ffa39afd2d83cffcb3f4eb2722cebec2"
+checksum = "d01b7404f9d441d3ad40e6a636a7782c377d2abdbe4fa2440e2edcc2f4f10db8"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.163"
+version = "1.0.166"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c805777e3930c8883389c602315a24224bcc738b63905ef87cd1420353ea93e"
+checksum = "5dd83d6dde2b6b2d466e14d9d1acce8816dedee94f735eac6395808b3483c6d6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.96"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "057d394a50403bcac12672b2b18fb387ab6d289d957dab67dd201875391e52f1"
+checksum = "0f1e14e89be7aa4c4b78bdbdc9eb5bf8517829a600ae8eaa39a6e1d960b5185c"
 dependencies = [
  "itoa",
  "ryu",
@@ -1929,9 +1441,9 @@ dependencies = [
 
 [[package]]
 name = "serde_test"
-version = "1.0.163"
+version = "1.0.166"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "100168a8017b89fd4bcbeb8d857d95a8cfcbde829a7147c09cc82d3ab8d8cb41"
+checksum = "65c75585b65852643a745182a6fa82b0420165a70f67c5d3af80139c74ee12cc"
 dependencies = [
  "serde",
 ]
@@ -1949,28 +1461,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "sha1"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
 name = "sharded-slab"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1980,16 +1470,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "shared_child"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0d94659ad3c2137fef23ae75b03d5241d633f8acded53d672decfa0e6e0caef"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
 name = "signal-hook-registry"
 version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2009,9 +1489,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
 
 [[package]]
 name = "socket2"
@@ -2024,145 +1504,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "spin"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
-
-[[package]]
-name = "spin"
-version = "0.9.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
-dependencies = [
- "lock_api",
-]
-
-[[package]]
-name = "sqlformat"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c12bc9199d1db8234678b7051747c07f517cdcf019262d1847b94ec8b1aee3e"
-dependencies = [
- "itertools",
- "nom",
- "unicode_categories",
-]
-
-[[package]]
-name = "sqlx"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8de3b03a925878ed54a954f621e64bf55a3c1bd29652d0d1a17830405350188"
-dependencies = [
- "sqlx-core",
- "sqlx-macros",
-]
-
-[[package]]
-name = "sqlx-core"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa8241483a83a3f33aa5fff7e7d9def398ff9990b2752b6c6112b83c6d246029"
-dependencies = [
- "ahash 0.7.6",
- "atoi",
- "base64 0.13.1",
- "bitflags",
- "byteorder",
- "bytes",
- "chrono",
- "crc",
- "crossbeam-queue",
- "dirs",
- "dotenvy",
- "either",
- "event-listener",
- "flume",
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-intrusive",
- "futures-util",
- "hashlink",
- "hex",
- "hkdf",
- "hmac",
- "indexmap",
- "itoa",
- "libc",
- "libsqlite3-sys",
- "log",
- "md-5",
- "memchr",
- "once_cell",
- "paste",
- "percent-encoding",
- "rand",
- "rustls",
- "rustls-pemfile",
- "serde",
- "serde_json",
- "sha1",
- "sha2",
- "smallvec",
- "sqlformat",
- "sqlx-rt",
- "stringprep",
- "thiserror",
- "tokio-stream",
- "url",
- "webpki-roots",
- "whoami",
-]
-
-[[package]]
-name = "sqlx-macros"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9966e64ae989e7e575b19d7265cb79d7fc3cbbdf179835cb0d716f294c2049c9"
-dependencies = [
- "dotenvy",
- "either",
- "heck",
- "once_cell",
- "proc-macro2",
- "quote",
- "sha2",
- "sqlx-core",
- "sqlx-rt",
- "syn 1.0.109",
- "url",
-]
-
-[[package]]
-name = "sqlx-rt"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "804d3f245f894e61b1e6263c84b23ca675d96753b5abfd5cc8597d86806e8024"
-dependencies = [
- "once_cell",
- "tokio",
- "tokio-rustls",
-]
-
-[[package]]
-name = "stringprep"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee348cb74b87454fff4b551cbf727025810a004f88aeacae7f85b87f4e9a1c1"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "subtle"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
-
-[[package]]
 name = "syn"
 version = "1.0.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2175,9 +1516,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.18"
+version = "2.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32d41677bcbe24c20c52e7c70b0d8db04134c5d1066bf98662e2871ad200ea3e"
+checksum = "59fb7d6d8281a51045d62b8eb3a7d1ce347b76f312af50cd3dc0af39c87c1737"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2204,41 +1545,28 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.7"
+version = "0.12.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd1ba337640d60c3e96bc6f0638a939b9c9a7f2c316a1598c279828b3d1dc8c5"
-
-[[package]]
-name = "tempfile"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9fbec84f381d5795b08656e4912bec604d162bff9291d6189a78f4c8ab87998"
-dependencies = [
- "cfg-if",
- "fastrand",
- "redox_syscall 0.3.5",
- "rustix",
- "windows-sys 0.45.0",
-]
+checksum = "1b1c7f239eb94671427157bd93b3694320f3668d4e1eff08c7285366fd777fac"
 
 [[package]]
 name = "thiserror"
-version = "1.0.40"
+version = "1.0.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978c9a314bd8dc99be594bc3c175faaa9794be04a5a5e153caba6915336cebac"
+checksum = "c16a64ba9387ef3fdae4f9c1a7f07a0997fce91985c0336f1ddc1822b3b37802"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.40"
+version = "1.0.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
+checksum = "d14928354b01c4d6a4f0e549069adef399a284e7995c7ccca94e8a07a5346c59"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -2262,14 +1590,14 @@ dependencies = [
 
 [[package]]
 name = "thrift"
-version = "0.16.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09678c4cdbb4eed72e18b7c2af1329c69825ed16fcbac62d083fc3e2b0590ff0"
+checksum = "7e54bc85fc7faa8bc175c4bab5b92ba8d9a3ce893d0e9f42cc455c8ab16a9e09"
 dependencies = [
  "byteorder",
  "integer-encoding",
  "log",
- "ordered-float",
+ "ordered-float 2.10.0",
  "threadpool",
 ]
 
@@ -2343,21 +1671,22 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.28.2"
+version = "1.29.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94d7b1cfd2aa4011f2de74c2c4c63665e27a71006b0a192dcd2710272e73dfa2"
+checksum = "532826ff75199d5833b9d2c5fe410f29235e25704ee5f0ef599fb51c21f4a4da"
 dependencies = [
  "autocfg",
+ "backtrace",
  "bytes",
  "libc",
  "mio",
  "num_cpus",
- "parking_lot 0.12.1",
+ "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
- "windows-sys 0.48.0",
+ "windows-sys",
 ]
 
 [[package]]
@@ -2378,18 +1707,7 @@ checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.23.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c43ee83903113e03984cb9e5cebe6c04a5116269e900e3ddba8f068a62adda59"
-dependencies = [
- "rustls",
- "tokio",
- "webpki",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -2418,32 +1736,14 @@ dependencies = [
 ]
 
 [[package]]
-name = "toml_datetime"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a76a9312f5ba4c2dec6b9161fdf25d87ad8a09256ccea5a556fef03c706a10f"
-
-[[package]]
-name = "toml_edit"
-version = "0.19.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2380d56e8670370eee6566b0bfd4265f65b3f432e8c6d85623f728d4fa31f739"
-dependencies = [
- "indexmap",
- "toml_datetime",
- "winnow",
-]
-
-[[package]]
 name = "tonic"
-version = "0.8.3"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f219fad3b929bef19b1f86fbc0358d35daed8f2cac972037ac0dc10bbb8d5fb"
+checksum = "3082666a3a6433f7f511c7192923fa1fe07c69332d3c6a2e6bb040b569199d5a"
 dependencies = [
- "async-stream",
  "async-trait",
  "axum 0.6.18",
- "base64 0.13.1",
+ "base64",
  "bytes",
  "futures-core",
  "futures-util",
@@ -2455,28 +1755,12 @@ dependencies = [
  "percent-encoding",
  "pin-project",
  "prost",
- "prost-derive",
  "tokio",
  "tokio-stream",
- "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
  "tracing",
- "tracing-futures",
-]
-
-[[package]]
-name = "tonic-build"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bf5e9b9c0f7e0a7c027dcfaba7b2c60816c7049171f679d99ee2ff65d0de8c4"
-dependencies = [
- "prettyplease",
- "proc-macro2",
- "prost-build",
- "quote",
- "syn 1.0.109",
 ]
 
 [[package]]
@@ -2505,7 +1789,7 @@ version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f873044bf02dd1e8239e9c1293ea39dad76dc594ec16185d0a1bf31d8dc8d858"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "bytes",
  "futures-core",
  "futures-util",
@@ -2545,13 +1829,13 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.24"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f57e3ca2a01450b1a921183a9c9cbfda207fd822cef4ccb00a65402cbba7a74"
+checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -2565,16 +1849,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "tracing-futures"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97d095ae15e245a057c8e8451bab9b3ee1e1f68e9ba2b4fbc18d0ac5237835f2"
-dependencies = [
- "pin-project",
- "tracing",
-]
-
-[[package]]
 name = "tracing-log"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2587,9 +1861,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-opentelemetry"
-version = "0.18.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21ebb87a95ea13271332df069020513ab70bdb5637ca42d6e492dc3bbbad48de"
+checksum = "fc09e402904a5261e42cf27aea09ccb7d5318c6717a9eec3d8e2e65c56b18f19"
 dependencies = [
  "once_cell",
  "opentelemetry",
@@ -2624,12 +1898,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
 
 [[package]]
-name = "typenum"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
-
-[[package]]
 name = "unicode-bidi"
 version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2637,9 +1905,9 @@ checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15811caf2415fb889178633e7724bad2509101cde276048e013b9def5e51fa0"
+checksum = "22049a19f4a68748a168c0fc439f9516686aa045927ff767eca0a85101fb6e73"
 
 [[package]]
 name = "unicode-normalization"
@@ -2651,12 +1919,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "unicode-segmentation"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
-
-[[package]]
 name = "unicode-width"
 version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2669,28 +1931,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
 
 [[package]]
-name = "unicode_categories"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
-
-[[package]]
 name = "unindent"
 version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1766d682d402817b5ac4490b3c3002d91dfa0d22812f341609f97b08757359c"
 
 [[package]]
-name = "untrusted"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
-
-[[package]]
 name = "url"
-version = "2.3.1"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+checksum = "50bff7831e19200a85b17131d085c25d7811bc4e186efdaf54bbd132994a88cb"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2698,6 +1948,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
 name = "valuable"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2717,11 +1973,10 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "want"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ce8a968cb1cd110d136ff8b819a556d6fb6d919363c61534f6860c7eb172ba0"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
 dependencies = [
- "log",
  "try-lock",
 ]
 
@@ -2733,9 +1988,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bba0e8cb82ba49ff4e229459ff22a191bbe9a1cb3a341610c9c33efc27ddf73"
+checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -2743,24 +1998,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b04bc93f9d6bdee709f6bd2118f57dd6679cf1176a1af464fca3ab0d66d8fb"
+checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.36"
+version = "0.4.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d1985d03709c53167ce907ff394f5316aa22cb4e12761295c5dc57dacb6297e"
+checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2770,9 +2025,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14d6b024f1a526bb0234f52840389927257beb670610081360e5a03c5df9c258"
+checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2780,74 +2035,34 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e128beba882dd1eb6200e1dc92ae6c5dbaa4311aa7bb211ca035779e5efc39f8"
+checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9d5b4305409d1fc9482fee2d7f9bcbf24b3972bf59817ef757e23982242a93"
+checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
 
 [[package]]
 name = "web-sys"
-version = "0.3.63"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bdd9ef4e984da1187bf8110c5cf5b845fbc87a23602cdf912386a76fcd3a7c2"
+checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
 ]
 
 [[package]]
-name = "webpki"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
-dependencies = [
- "ring",
- "untrusted",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "0.22.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c71e40d7d2c34a5106301fb632274ca37242cd0c9d3e64dbece371a40a2d87"
-dependencies = [
- "webpki",
-]
-
-[[package]]
-name = "which"
-version = "4.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2441c784c52b289a054b7201fc93253e288f094e2f4be9058343127c4226a269"
-dependencies = [
- "either",
- "libc",
- "once_cell",
-]
-
-[[package]]
-name = "whoami"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c70234412ca409cc04e864e89523cb0fc37f5e1344ebed5a3ebf4192b6b9f68"
-dependencies = [
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
 name = "winapi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2875,16 +2090,7 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
 dependencies = [
- "windows-targets 0.48.0",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
+ "windows-targets",
 ]
 
 [[package]]
@@ -2893,133 +2099,67 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets 0.48.0",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows-targets"
-version = "0.42.2"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
 dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b1eb6f0cd7c80c79759c929114ef071b87354ce476d9d94271031c0497adfd5"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.0",
- "windows_aarch64_msvc 0.48.0",
- "windows_i686_gnu 0.48.0",
- "windows_i686_msvc 0.48.0",
- "windows_x86_64_gnu 0.48.0",
- "windows_x86_64_gnullvm 0.48.0",
- "windows_x86_64_msvc 0.48.0",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
-[[package]]
-name = "windows_aarch64_msvc"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
-[[package]]
-name = "windows_i686_gnu"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
-[[package]]
-name = "windows_i686_msvc"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
-[[package]]
-name = "windows_x86_64_gnu"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
-[[package]]
-name = "windows_x86_64_msvc"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
 
 [[package]]
-name = "winnow"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61de7bac303dc551fe038e2b3cef0f571087a47571ea6e79a87692ac99b99699"
-dependencies = [
- "memchr",
-]
-
-[[package]]
 name = "winreg"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/pkgs/development/python-modules/bytewax/default.nix b/pkgs/development/python-modules/bytewax/default.nix
index c27d756070de4..ea0bfe9e32da9 100644
--- a/pkgs/development/python-modules/bytewax/default.nix
+++ b/pkgs/development/python-modules/bytewax/default.nix
@@ -1,22 +1,33 @@
 { lib
 , stdenv
 , buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
 , cmake
-, confluent-kafka
+, pkg-config
+, rustPlatform
+
+# native dependencies
 , cyrus_sasl
-, fetchFromGitHub
 , openssl
-, pkg-config
 , protobuf
+
+# dependencies
+, jsonpickle
+
+# optional dependencies
+, confluent-kafka
+
+# test
+, myst-docutils
 , pytestCheckHook
-, pythonOlder
-, rustPlatform
-, setuptools-rust
 }:
 
 buildPythonPackage rec {
   pname = "bytewax";
-  version = "0.17.1";
+  version = "0.17.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +36,7 @@ buildPythonPackage rec {
     owner = "bytewax";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Cv2bTgs3XfYOcHK628/RgGol7S6E4WfHb7gHXXjBhig=";
+    hash = "sha256-BecZvBJsaTHIhJhWM9GZldSL6Irrc7fiedulTN9e76I=";
   };
 
   env = {
@@ -34,13 +45,16 @@ buildPythonPackage rec {
 
   # Remove docs tests, myst-docutils in nixpkgs is not compatible with package requirements.
   # Package uses old version.
-  patches = [ ./remove-docs-test.patch ];
+  patches = [
+    ./remove-docs-test.patch
+  ];
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "columnation-0.1.0" = "sha256-RAyZKR+sRmeWGh7QYPZnJgX9AtWqmca85HcABEFUgX8=";
       "timely-0.12.0" = "sha256-sZuVLBDCXurIe38m4UAjEuFeh73VQ5Jawy+sr3U/HbI=";
+      "libsqlite3-sys-0.26.0" = "sha256-WpJA+Pm5dWKcdUrP0xS5ps/oE/yAXuQvvsdyDfDet1o=";
     };
   };
 
@@ -59,6 +73,10 @@ buildPythonPackage rec {
     protobuf
   ];
 
+  propagatedBuildInputs = [
+    jsonpickle
+  ];
+
   passthru.optional-dependencies = {
     kafka = [
       confluent-kafka
@@ -70,9 +88,15 @@ buildPythonPackage rec {
   '';
 
   checkInputs = [
+    myst-docutils
     pytestCheckHook
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
+  disabledTestPaths = [
+    # dependens on an old myst-docutils version
+    "docs"
+  ];
+
   pythonImportsCheck = [
     "bytewax"
   ];
diff --git a/pkgs/development/python-modules/bytewax/remove-docs-test.patch b/pkgs/development/python-modules/bytewax/remove-docs-test.patch
index d5c9269a01b2e..93b2adad18dc6 100644
--- a/pkgs/development/python-modules/bytewax/remove-docs-test.patch
+++ b/pkgs/development/python-modules/bytewax/remove-docs-test.patch
@@ -1,10 +1,12 @@
 diff --git a/pyproject.toml b/pyproject.toml
-index 41b5c90..e7c7b2d 100644
+index 107cab8..34cc544 100644
 --- a/pyproject.toml
 +++ b/pyproject.toml
-@@ -50,6 +50,5 @@ doctest_optionflags = "NORMALIZE_WHITESPACE"
+@@ -66,7 +66,6 @@ long_description_content_type = "text/markdown"
+ addopts = "-v --doctest-modules"
+ doctest_optionflags = "NORMALIZE_WHITESPACE"
  testpaths = [
-     "pytests",
-     "pysrc",
 -    "docs",
+     "pysrc",
+     "pytests",
  ]
diff --git a/pkgs/development/python-modules/cachetools/default.nix b/pkgs/development/python-modules/cachetools/default.nix
index 14682f23001f9..8a2f5397d6e12 100644
--- a/pkgs/development/python-modules/cachetools/default.nix
+++ b/pkgs/development/python-modules/cachetools/default.nix
@@ -1,14 +1,19 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, setuptools
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "cachetools";
-  version = "5.3.0";
-  format = "setuptools";
+  version = "5.3.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -16,9 +21,13 @@ buildPythonPackage rec {
     owner = "tkem";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7MbP3jz17lGwjAeWo8QmS5v1vGqIQmYLbKVcK/q89Z4=";
+    hash = "sha256-CmyAW9uV63OV/zZsWwZkXOWbHfHAJdYFGJsRhpqQ1f4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/cattrs/default.nix b/pkgs/development/python-modules/cattrs/default.nix
index b637f714d26d7..304069b660d28 100644
--- a/pkgs/development/python-modules/cattrs/default.nix
+++ b/pkgs/development/python-modules/cattrs/default.nix
@@ -4,12 +4,13 @@
 , cbor2
 , fetchFromGitHub
 , exceptiongroup
+, hatchling
+, hatch-vcs
 , hypothesis
 , immutables
 , motor
 , msgpack
 , orjson
-, poetry-core
 , pytest-xdist
 , pytestCheckHook
 , pythonOlder
@@ -21,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "cattrs";
-  version = "23.1.2";
+  version = "23.2.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -29,12 +30,13 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "python-attrs";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-YO4Clbo5fmXbysxwwM2qCHJwO5KwDC05VctRVFruJcw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-zWM5zmZr2EiJb/4Dc6KjDL89p0C1V0Dsz949byz5OVM=";
   };
 
   nativeBuildInputs = [
-    poetry-core
+    hatchling
+    hatch-vcs
   ];
 
   propagatedBuildInputs = [
@@ -62,9 +64,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "-l --benchmark-sort=fullname --benchmark-warmup=true --benchmark-warmup-iterations=5  --benchmark-group-by=fullname" "" \
-      --replace 'orjson = "^3.5.2"' "" \
-      --replace "[tool.poetry.group.dev.dependencies]" "[tool.poetry.dev-dependencies]"
+      --replace "-l --benchmark-sort=fullname --benchmark-warmup=true --benchmark-warmup-iterations=5  --benchmark-group-by=fullname" ""
     substituteInPlace tests/test_preconf.py \
       --replace "from orjson import dumps as orjson_dumps" "" \
       --replace "from orjson import loads as orjson_loads" ""
diff --git a/pkgs/development/python-modules/cbor2/default.nix b/pkgs/development/python-modules/cbor2/default.nix
index fe320063362c4..5523d4f5e0a21 100644
--- a/pkgs/development/python-modules/cbor2/default.nix
+++ b/pkgs/development/python-modules/cbor2/default.nix
@@ -2,50 +2,59 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, setuptools
 , setuptools-scm
+
+# tests
+, hypothesis
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "cbor2";
-  version = "5.4.6";
-  format = "setuptools";
+  version = "5.5.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uJNQDbD+Az5XDDrclWr27vxX4oACa9LYb9U9qfHllNc=";
+    hash = "sha256-+eGS9GGp+PYILfKMA1sAbRU5BCE9yGQL7Ypy1yu8lHU=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov" ""
+  '';
+
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
+  pythonImportsCheck = [
+    "cbor2"
+  ];
+
   nativeCheckInputs = [
+    hypothesis
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov" ""
-  '';
-
   # https://github.com/agronholm/cbor2/issues/99
   disabledTests = lib.optionals stdenv.is32bit [
     "test_huge_truncated_bytes"
     "test_huge_truncated_string"
   ];
 
-  pythonImportsCheck = [
-    "cbor2"
-  ];
-
   meta = with lib; {
+    changelog = "https://github.com/agronholm/cbor2/releases/tag/${version}";
     description = "Python CBOR (de)serializer with extensive tag support";
     homepage = "https://github.com/agronholm/cbor2";
     license = licenses.mit;
-    maintainers = with maintainers; [ taneb ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index b9b703af622ec..c6eaa72d2df12 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -3,13 +3,14 @@
 , cacert
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2023.07.22";
-  format = "setuptools";
+  version = "2023.11.17";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -17,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    hash = "sha256-V3bptJDNMGXlCMg6GHj792IrjfsG9+F/UpQKxeM0QOc=";
+    hash = "sha256-H3zsFJjWt2+tT7yqQOOZZwSL5y0AtfDz6Fqxwpm4Wl8=";
   };
 
   patches = [
@@ -31,6 +32,10 @@ buildPythonPackage rec {
     ln -snvf "${cacert}/etc/ssl/certs/ca-bundle.crt" "certifi/cacert.pem"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedNativeBuildInputs = [
     # propagate cacerts setup-hook to set up `NIX_SSL_CERT_FILE`
     cacert
diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index f52bf2f667aeb..98f8208335e9a 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -20,16 +20,16 @@
 
 buildPythonPackage rec {
   pname = "cfn-lint";
-  version = "0.79.11";
+  version = "0.83.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
-    repo = "cfn-python-lint";
+    repo = "cfn-lint";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dVLKMoZzP2q3bejEIslgpQgkPJOJUeEsXyyk8HRP6h0=";
+    hash = "sha256-0NHD8P+lKsrsEX/ypUS5dIwHOLudQcqkH8zG5RxANxE=";
   };
 
   propagatedBuildInputs = [
@@ -57,12 +57,6 @@ buildPythonPackage rec {
   '';
 
   disabledTests = [
-    # These tests depend on the current date, for example because of issues like this.
-    # This makes it possible for them to succeed on hydra and then begin to fail without
-    # any code changes.
-    # https://github.com/aws-cloudformation/cfn-python-lint/issues/1705
-    # See also: https://github.com/NixOS/nixpkgs/issues/108076
-    "TestQuickStartTemplates"
     # Requires git directory
     "test_update_docs"
     # Tests depend on network access (fails in getaddrinfo)
@@ -82,7 +76,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Checks cloudformation for practices and behaviour that could potentially be improved";
-    homepage = "https://github.com/aws-cloudformation/cfn-python-lint";
+    homepage = "https://github.com/aws-cloudformation/cfn-lint";
     changelog = "https://github.com/aws-cloudformation/cfn-lint/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/cftime/default.nix b/pkgs/development/python-modules/cftime/default.nix
index b827c48531aa9..4291f805d2c0d 100644
--- a/pkgs/development/python-modules/cftime/default.nix
+++ b/pkgs/development/python-modules/cftime/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , cython
 , fetchPypi
-, fetchpatch
 , numpy
 , pytestCheckHook
 , pythonOlder
@@ -10,29 +9,20 @@
 
 buildPythonPackage rec {
   pname = "cftime";
-  version = "1.6.2";
+  version = "1.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hhTAD7ilBG3jBP3Ybb0iT5lAgYXXskWsZijQJ2WW5tI=";
+    hash = "sha256-0Kayn3KhPwjgCLm+z/JHzHXISsshMzLt4Yh5xbaqTf0=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Fix test_num2date_precision by checking per platform precision
-      url = "https://github.com/Unidata/cftime/commit/221ff2195d588a43a7984597033b678f330fbc41.patch";
-      hash = "sha256-3XTJuET20g9QElM/8WGnNzJBFZ0oUN4ikhWKppwcyNM=";
-    })
-  ];
-
   postPatch = ''
     sed -i "/--cov/d" setup.cfg
   '';
 
-
   nativeBuildInputs = [
     cython
     numpy
diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index c2856a49060fc..2f6c3533dd77e 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "charset-normalizer";
-  version = "3.2.0";
+  version = "3.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Ousret";
     repo = "charset_normalizer";
     rev = "refs/tags/${version}";
-    hash = "sha256-CfL5rlrwJs9453z+1xPUzs1B3OyjFBaU6klzY7gJCzA=";
+    hash = "sha256-T9lnlS05Ogb2eLLHYWFnjBtRaB/OBqGWHQ/2WLunrNY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/chart-studio/default.nix b/pkgs/development/python-modules/chart-studio/default.nix
index 0c493e320ed55..fc563153a49ca 100644
--- a/pkgs/development/python-modules/chart-studio/default.nix
+++ b/pkgs/development/python-modules/chart-studio/default.nix
@@ -1,28 +1,35 @@
-{ lib, buildPythonPackage, fetchFromGitHub
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
 , mock
 , nose
 , plotly
 , pytest
 , requests
 , retrying
+, setuptools
 , six
 }:
 
 buildPythonPackage rec {
   pname = "chart-studio";
-  version = "5.17.0";
-  format = "setuptools";
+  version = "5.18.0";
+  pyproject = true;
 
   # chart-studio was split from plotly
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Vaa/MgauSoSpzNtRVXq3fQSVqMYzLTqDtIbiHBgrXQY=";
+    hash = "sha256-hY8R4UjcTI5RBaaRU/oR63taKEgYRI3+oOxNuDWzg20=";
   };
 
   sourceRoot = "${src.name}/packages/python/chart-studio";
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     plotly
     requests
diff --git a/pkgs/development/python-modules/cheroot/default.nix b/pkgs/development/python-modules/cheroot/default.nix
index 839894e1505b8..89d4d69b91614 100644
--- a/pkgs/development/python-modules/cheroot/default.nix
+++ b/pkgs/development/python-modules/cheroot/default.nix
@@ -14,7 +14,6 @@
 , requests-toolbelt
 , requests-unixsocket
 , setuptools-scm
-, setuptools-scm-git-archive
 , six
 }:
 
@@ -30,9 +29,19 @@ buildPythonPackage rec {
     hash = "sha256-WcShh3/vmWmzw8CAyqrzd+J4CRlDeFP8DTKp30CzEfA=";
   };
 
+  # remove setuptools-scm-git-archive dependency
+  # https://github.com/cherrypy/cheroot/commit/f0c51af263e20f332c6f675aa90ec6705ae4f5d1
+  # there is a difference between the github source and the pypi tarball source,
+  # and it is not easy to apply patches.
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"setuptools_scm_git_archive>=1.1",' ""
+    substituteInPlace setup.cfg \
+      --replace "setuptools_scm_git_archive>=1.0" ""
+  '';
+
   nativeBuildInputs = [
     setuptools-scm
-    setuptools-scm-git-archive
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cirq-core/default.nix b/pkgs/development/python-modules/cirq-core/default.nix
index 31077bd109e4b..0563c2f1a71c1 100644
--- a/pkgs/development/python-modules/cirq-core/default.nix
+++ b/pkgs/development/python-modules/cirq-core/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "cirq-core";
-  version = "1.2.0";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "quantumlib";
     repo = "cirq";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KEei5PJ0ammsduZVmMh2vaW3f58DYI4BCrFCl/SjUoo=";
+    hash = "sha256-JAJJciFg3BuRha1wTKixtKWcYy3NA2mNpniPyPHTTe8=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/click-odoo-contrib/default.nix b/pkgs/development/python-modules/click-odoo-contrib/default.nix
index 275f6ccc77dc1..a01a3e88b1974 100644
--- a/pkgs/development/python-modules/click-odoo-contrib/default.nix
+++ b/pkgs/development/python-modules/click-odoo-contrib/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     manifestoo-core
   ] ++ lib.optionals (pythonOlder "3.9") [ importlib-resources ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   pythonImportsCheck = [ "click_odoo_contrib" ];
diff --git a/pkgs/development/python-modules/click-odoo/default.nix b/pkgs/development/python-modules/click-odoo/default.nix
index a618359735f1b..2dd211d24a01d 100644
--- a/pkgs/development/python-modules/click-odoo/default.nix
+++ b/pkgs/development/python-modules/click-odoo/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     click
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/click-repl/default.nix b/pkgs/development/python-modules/click-repl/default.nix
index f8a8fc1c49f8c..aa375423769bc 100644
--- a/pkgs/development/python-modules/click-repl/default.nix
+++ b/pkgs/development/python-modules/click-repl/default.nix
@@ -1,24 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
 , click
 , prompt-toolkit
 , six
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "click-repl";
-  version = "0.2.0";
-  format = "setuptools";
+  version = "0.3.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "click-contrib";
     repo = "click-repl";
-    rev = version;
-    hash = "sha256-kaTUKaIomJL0u3NX40bL0I54vkR+Utcdw1QKSbnVy5s=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xCT3w0DDY73dtDL5jbssXM05Zlr44OOcy4vexgHyWiE=";
   };
 
+  postPatch = ''
+    sed -i '/--cov=/d' pyproject.toml
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     click
     prompt-toolkit
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index 8569eede0bbb8..eb32212cde237 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -35,6 +35,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # test fails with filename normalization on zfs
+    "test_file_surrogates"
+  ];
+
   passthru.tests = {
     inherit black flask magic-wormhole mitmproxy typer;
   };
diff --git a/pkgs/development/python-modules/clickgen/default.nix b/pkgs/development/python-modules/clickgen/default.nix
index 864414a0596b2..7711d08e69f1c 100644
--- a/pkgs/development/python-modules/clickgen/default.nix
+++ b/pkgs/development/python-modules/clickgen/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, attrs
 , pillow
 , toml
 , numpy
@@ -25,9 +26,17 @@ buildPythonPackage rec {
     hash = "sha256-mae/bO6aAMyYw42FYNlLMWm/ZC92LDgWVSSRKGR0tFM=";
   };
 
-  propagatedBuildInputs = [ pillow toml numpy pyyaml ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
+  propagatedBuildInputs = [
+    attrs
+    numpy
+    pillow
+    pyyaml
+    toml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   postInstall = ''
     # Copying scripts directory needed by clickgen script at $out/bin/
diff --git a/pkgs/development/python-modules/clickhouse-cli/default.nix b/pkgs/development/python-modules/clickhouse-cli/default.nix
index 3c807716e03de..8abe4c1b3aa6a 100644
--- a/pkgs/development/python-modules/clickhouse-cli/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cli/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonRelaxDepsHook
+, setuptools
 , click
 , prompt-toolkit
 , pygments
@@ -18,6 +20,15 @@ buildPythonPackage rec {
     hash = "sha256-gkgLAedUtzGv/4P+D56M2Pb5YecyqyVYp06ST62sjdY=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "sqlparse"
+  ];
+
   propagatedBuildInputs = [
     click
     prompt-toolkit
diff --git a/pkgs/development/python-modules/cliff/default.nix b/pkgs/development/python-modules/cliff/default.nix
index 9c6d88c9dab69..9715a41852b66 100644
--- a/pkgs/development/python-modules/cliff/default.nix
+++ b/pkgs/development/python-modules/cliff/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "cliff";
-  version = "4.3.0";
+  version = "4.4.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/FtuvI+4FTMncLJIXuNsCXU5N8N8zk8yJ83U4Qsz6sw=";
+    hash = "sha256-qo1ASqLWtNhjnGG9bcR6yzZW68P8Alsbe7B68rrveF8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cloudpickle/default.nix b/pkgs/development/python-modules/cloudpickle/default.nix
index 2acfe17327b6c..fc8f92f3fa8da 100644
--- a/pkgs/development/python-modules/cloudpickle/default.nix
+++ b/pkgs/development/python-modules/cloudpickle/default.nix
@@ -1,23 +1,34 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, flit-core
+
+# tests
 , psutil
 , pytestCheckHook
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "cloudpickle";
-  version = "2.2.1";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-2JaEuN6eNKKkOzRg+8oH0J1uJc6FjfTVpEJAQDthePU=";
+  src = fetchFromGitHub {
+    owner = "cloudpipe";
+    repo = "cloudpickle";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UeKVwzT0m4fhEVnG7TvQsFR99JsmwwoXmr+rWnTCeJU=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   nativeCheckInputs = [
     psutil
     pytestCheckHook
@@ -28,16 +39,12 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    # ModuleNotFoundError: No module named '_cloudpickle_testpkg'
+    # ModuleNotFoundError: No module named 'psutil'
     "tests/cloudpickle_test.py"
   ];
 
-  disabledTests = [
-    # TypeError: cannot pickle 'EncodedFile' object
-    "test_pickling_special_file_handles"
-  ];
-
   meta = with lib; {
+    changelog = "https://github.com/cloudpipe/cloudpickle/blob/v${version}/CHANGES.md";
     description = "Extended pickling support for Python objects";
     homepage = "https://github.com/cloudpipe/cloudpickle";
     license = with licenses; [ bsd3 ];
diff --git a/pkgs/development/python-modules/coconut/default.nix b/pkgs/development/python-modules/coconut/default.nix
index 1c930529a31e5..3a00891e60dd2 100644
--- a/pkgs/development/python-modules/coconut/default.nix
+++ b/pkgs/development/python-modules/coconut/default.nix
@@ -8,25 +8,42 @@
 , pygments
 , pytestCheckHook
 , prompt-toolkit
+, setuptools
 , tkinter
 , watchdog
 }:
 
 buildPythonPackage rec {
   pname = "coconut";
-  version = "3.0.3";
-  format = "setuptools";
+  version = "3.0.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "evhub";
     repo = "coconut";
     rev = "refs/tags/v${version}";
-    hash = "sha256-u1tcIu0U1VZrUx2hVdtRDv1N4jVf176kQSw47/7lOXY=";
+    hash = "sha256-TIYep9EuCfcN8bp0vkaoB5W626lrD4PVh+oYKmVrfeY=";
   };
 
-  propagatedBuildInputs = [ cpyparsing ipykernel mypy pygments prompt-toolkit watchdog ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    cpyparsing
+    ipykernel
+    mypy
+    pygments
+    prompt-toolkit
+    setuptools
+    watchdog
+  ];
 
-  nativeCheckInputs = [ pexpect pytestCheckHook tkinter ];
+  nativeCheckInputs = [
+    pexpect
+    pytestCheckHook
+    tkinter
+  ];
 
   # Currently most tests have performance issues
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/coffea/default.nix b/pkgs/development/python-modules/coffea/default.nix
index ab10055187d03..0d4dc1450d9f8 100644
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -76,8 +76,6 @@ buildPythonPackage rec {
     cachetools
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     distributed
     pyinstrument
diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index 36e7a27446850..133721ca4d741 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "4.32";
+  version = "4.37";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OAd0e+mE8hHc6RHBM1vXE68qwrcPcpZ4OB5v9uRQ5oE=";
+    hash = "sha256-eIAh2dmSxsMdGYXZXMyyd8cmWILErNekmz5H2ne0vsg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/colorlog/default.nix b/pkgs/development/python-modules/colorlog/default.nix
index 452908a62c69e..8a7ff6494e4df 100644
--- a/pkgs/development/python-modules/colorlog/default.nix
+++ b/pkgs/development/python-modules/colorlog/default.nix
@@ -1,22 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "colorlog";
-  version = "6.7.0";
-  format = "setuptools";
+  version = "6.8.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vZS9IcHhP6x70xU/S8On3A6wl0uLwv3xqYnkdPblguU=";
+    hash = "sha256-+7b9+dVoXyUX84j7Kbsn1U6GVN0x9YvCo7IX6WepXKY=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  pythonImportsCheck = [ "colorlog" ];
+  pythonImportsCheck = [
+    "colorlog"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "Log formatting with colors";
diff --git a/pkgs/development/python-modules/colout/default.nix b/pkgs/development/python-modules/colout/default.nix
index 0679270200d86..e01193cd36ecc 100644
--- a/pkgs/development/python-modules/colout/default.nix
+++ b/pkgs/development/python-modules/colout/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-7Dtf87erBElqVgqRx8BYHYOWv1uI84JJ0LHrcneczCI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/comm/default.nix b/pkgs/development/python-modules/comm/default.nix
index 627c1630489d2..e03eae5ffdbb1 100644
--- a/pkgs/development/python-modules/comm/default.nix
+++ b/pkgs/development/python-modules/comm/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "comm";
-  version = "0.1.4";
+  version = "0.2.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -18,7 +18,7 @@ buildPythonPackage {
     owner = "ipython";
     repo = "comm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6GvAyiTm+zQ5sSynuJhAg50PaMTY9EFqVVsD3K2wTkY=";
+    hash = "sha256-bErZNTm0spO0A/Lc8kq5u7sB0FMXm/WMWtFbCNGJVXE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/confight/default.nix b/pkgs/development/python-modules/confight/default.nix
index 8ee09009fb974..5933ffc5d842d 100644
--- a/pkgs/development/python-modules/confight/default.nix
+++ b/pkgs/development/python-modules/confight/default.nix
@@ -1,19 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , toml
 }:
 
 buildPythonPackage rec {
   pname = "confight";
   version = "2.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-iodoexnh9tG4dgkjDXCUzWRFDhRlJ3HRgaNhxG2lwPY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     toml
   ];
diff --git a/pkgs/development/python-modules/confluent-kafka/default.nix b/pkgs/development/python-modules/confluent-kafka/default.nix
index 33e3caf90cae9..b610f1d405909 100644
--- a/pkgs/development/python-modules/confluent-kafka/default.nix
+++ b/pkgs/development/python-modules/confluent-kafka/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "confluent-kafka";
-  version = "2.2.0";
+  version = "2.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "confluentinc";
     repo = "confluent-kafka-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6CdalNFKkgF7JUqCGtt4nB1/H3u4SVqt9xCAg5DR3T0=";
+    hash = "sha256-sPlLlp0niR45lQPCvVd6NPtGI1cFbmPeQpIF1RnnY0I=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/connexion/default.nix b/pkgs/development/python-modules/connexion/default.nix
index d4eb668d73edb..40a166c14be44 100644
--- a/pkgs/development/python-modules/connexion/default.nix
+++ b/pkgs/development/python-modules/connexion/default.nix
@@ -1,30 +1,40 @@
 { lib
-, aiohttp
-, aiohttp-jinja2
-, aiohttp-remotes
-, aiohttp-swagger
-, buildPythonPackage
-, clickclick
-, decorator
 , fetchFromGitHub
-, flask
+, buildPythonPackage
+, pythonOlder
+
+# build-system
+, poetry-core
+
+# dependencies
+, asgiref
+, httpx
 , inflection
 , jsonschema
-, openapi-spec-validator
-, packaging
-, pytest-aiohttp
-, pytestCheckHook
-, pythonOlder
+, jinja2
+, python-multipart
 , pyyaml
 , requests
+, starlette
+, typing-extensions
+, werkzeug
+
+# optional-dependencies
+, a2wsgi
+, flask
 , swagger-ui-bundle
+, uvicorn
+
+# tests
+, pytest-aiohttp
+, pytestCheckHook
 , testfixtures
 }:
 
 buildPythonPackage rec {
   pname = "connexion";
-  version = "2.14.2";
-  format = "setuptools";
+  version = "3.0.5";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -32,31 +42,45 @@ buildPythonPackage rec {
     owner = "spec-first";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-1v1xCHY3ZnZG/Vu9wN/it7rLKC/StoDefoMNs+hMjIs=";
+    hash = "sha256-VaHdUxZ72JCm9zFMSEg3EW1uwfn+IIYy3yrtW9qC6rA=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
-    aiohttp
-    aiohttp-jinja2
-    aiohttp-swagger
-    clickclick
-    flask
+    asgiref
+    httpx
     inflection
     jsonschema
-    openapi-spec-validator
-    packaging
+    jinja2
+    python-multipart
     pyyaml
     requests
-    swagger-ui-bundle
+    starlette
+    typing-extensions
+    werkzeug
   ];
 
+  passthru.optional-dependencies = {
+    flask = [
+      a2wsgi
+      flask
+    ];
+    swagger-ui = [
+      swagger-ui-bundle
+    ];
+    uvicorn = [
+      uvicorn
+    ];
+  };
+
   nativeCheckInputs = [
-    aiohttp-remotes
-    decorator
     pytest-aiohttp
     pytestCheckHook
     testfixtures
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "connexion"
diff --git a/pkgs/development/python-modules/constantly/default.nix b/pkgs/development/python-modules/constantly/default.nix
index 4aad363632c23..bee00f7d4fa2b 100644
--- a/pkgs/development/python-modules/constantly/default.nix
+++ b/pkgs/development/python-modules/constantly/default.nix
@@ -1,36 +1,60 @@
-{ lib, buildPythonPackage, fetchFromGitHub, twisted }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, setuptools
+, versioneer
+
+# tests
+, twisted
+}:
 
 let
   self = buildPythonPackage rec {
     pname = "constantly";
-    version = "15.1.0";
-    format = "setuptools";
+    version = "23.10.4";
+    pyproject = true;
+
+    disabled = pythonOlder "3.8";
 
     src = fetchFromGitHub {
       owner = "twisted";
       repo = "constantly";
-      rev = version;
-      hash = "sha256-0RPK5Vy0b6V4ubvm+vfNOAua7Qpa6j+G+QNExFuHgUU=";
+      rev = "refs/tags/${version}";
+      hash = "sha256-HTj6zbrCrxvh0PeSkeCSOCloTrVGUX6+o57snrKf6PA=";
     };
 
+    nativeBuildInputs = [
+      setuptools
+      versioneer
+    ] ++ versioneer.optional-dependencies.toml;
+
     # would create dependency loop with twisted
     doCheck = false;
 
-    nativeCheckInputs = [ twisted ];
+    nativeCheckInputs = [
+      twisted
+    ];
 
     checkPhase = ''
+      runHook preCheck
       trial constantly
+      runHook postCheck
     '';
 
-    pythonImportsCheck = [ "constantly" ];
+    pythonImportsCheck = [
+      "constantly"
+    ];
 
     passthru.tests.constantly = self.overridePythonAttrs { doCheck = true; };
 
     meta = with lib; {
+      description = "Module for symbolic constant support";
       homepage = "https://github.com/twisted/constantly";
-      description = "symbolic constant support";
       license = licenses.mit;
-      maintainers = [ ];
+      maintainers =  with maintainers; [ ];
     };
   };
 in
diff --git a/pkgs/development/python-modules/construct/default.nix b/pkgs/development/python-modules/construct/default.nix
index f6c5bb50b59dc..917a6f4f95dba 100644
--- a/pkgs/development/python-modules/construct/default.nix
+++ b/pkgs/development/python-modules/construct/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "construct";
-  version = "2.10.69";
+  version = "2.10.70";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "construct";
     repo = "construct";
     rev = "refs/tags/v${version}";
-    hash = "sha256-v1ieZytX9I2BR6UBD6TztCBT4KWtqfFZVKNtXIRNEB0=";
+    hash = "sha256-5otjjIyje0+z/Y/C2ivmu08PNm0oJcSSvZkQfGxHDuQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/container-inspector/default.nix b/pkgs/development/python-modules/container-inspector/default.nix
index 12375681c58f4..4a3f6918b9e8b 100644
--- a/pkgs/development/python-modules/container-inspector/default.nix
+++ b/pkgs/development/python-modules/container-inspector/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-J9glnfs6l36/IQoIvE8a+Cw4B8x/6r5UeAU8+T/OiQg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontConfigure = true;
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/contourpy/default.nix b/pkgs/development/python-modules/contourpy/default.nix
index f5af82e55ff31..5e12a4531b33c 100644
--- a/pkgs/development/python-modules/contourpy/default.nix
+++ b/pkgs/development/python-modules/contourpy/default.nix
@@ -25,7 +25,7 @@
 
 let countourpy = buildPythonPackage rec {
   pname = "contourpy";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ let countourpy = buildPythonPackage rec {
     owner = "contourpy";
     repo = "contourpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7M+5HMDqQI4UgVfW/MXsVyz/yM6wjTcJEdw7vPvzuNY=";
+    hash = "sha256-5yZrIwwe9dL5vtdSJnOhY9X4BdK/cdEY4DkVVjCq1uw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cookiecutter/default.nix b/pkgs/development/python-modules/cookiecutter/default.nix
index 8d3374b9c9101..35e14b394e2e4 100644
--- a/pkgs/development/python-modules/cookiecutter/default.nix
+++ b/pkgs/development/python-modules/cookiecutter/default.nix
@@ -1,6 +1,7 @@
 { lib, buildPythonPackage, fetchPypi, isPyPy
+, setuptools
 , pytest, pytest-cov, pytest-mock, freezegun, safety, pre-commit
-, jinja2, future, binaryornot, click, jinja2-time, requests
+, jinja2, binaryornot, click, jinja2-time, requests
 , python-slugify
 , pyyaml
 , arrow
@@ -9,17 +10,21 @@
 
 buildPythonPackage rec {
   pname = "cookiecutter";
-  version = "2.3.0";
-  format = "setuptools";
+  version = "2.5.0";
+  pyproject = true;
 
   # not sure why this is broken
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lCp5SYF0f21/Q51uSdOdyRqaZBKDYUFgyTxHTHLCliE=";
+    hash = "sha256-5h6QNHSOP0G4vSwR8A0DB4S0hxHE1cQjY8UJiaZTMew=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytest
     pytest-cov
diff --git a/pkgs/development/python-modules/correctionlib/default.nix b/pkgs/development/python-modules/correctionlib/default.nix
index 7a79c38554782..15f48da9264fd 100644
--- a/pkgs/development/python-modules/correctionlib/default.nix
+++ b/pkgs/development/python-modules/correctionlib/default.nix
@@ -47,8 +47,6 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     awkward
     pytestCheckHook
@@ -64,5 +62,6 @@ buildPythonPackage rec {
     homepage = "https://cms-nanoaod.github.io/correctionlib/";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ veprbl ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index cd761b45e1013..eba9e13865d8d 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -3,20 +3,26 @@
 , fetchPypi
 , mock
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.3.1";
-  format = "setuptools";
+  version = "7.3.2";
+  pyproject = true;
+
   # uses f strings
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bLf+FYHetnt4LBUxNlQeIJAaoxLO7a8UZ9yzUlV4eVI=";
+    hash = "sha256-vjKtKTQbAXDnlcpZDhwH6B/AYctbEMdM5yA0kUhEBO8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # No tests in archive
   doCheck = false;
   nativeCheckInputs = [ mock ];
diff --git a/pkgs/development/python-modules/cpyparsing/default.nix b/pkgs/development/python-modules/cpyparsing/default.nix
index 1ee4fe1658787..cd34ebf1da1f0 100644
--- a/pkgs/development/python-modules/cpyparsing/default.nix
+++ b/pkgs/development/python-modules/cpyparsing/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "cpyparsing";
-  version = "2.4.7.2.1.2";
+  version = "2.4.7.2.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "evhub";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Y3EyX9Gjssez0DkD6dIaOpazNLy7rDYzjKO1u+lLGFI=";
+    hash = "sha256-vnzZdJ7pZz1QxlTqw5UKjxB4GVcXuCfKWX4lu3ORWas=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/croniter/default.nix b/pkgs/development/python-modules/croniter/default.nix
index 12268dc72aee2..6ac6f5db0509e 100644
--- a/pkgs/development/python-modules/croniter/default.nix
+++ b/pkgs/development/python-modules/croniter/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pytestCheckHook
 , python-dateutil
 , pythonOlder
@@ -10,23 +11,27 @@
 
 buildPythonPackage rec {
   pname = "croniter";
-  version = "1.4.1";
-  format = "setuptools";
+  version = "2.0.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Gm32DqzsO3oKpSqPLvJRrj3Sp8fIuYdOc+eRY21Vo2E=";
+    hash = "sha256-0Zmy7D6l6CmI0fcgIkM8X5MCs7Pqnmv9ahUY9upecAo=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-dateutil
+    pytz
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    pytz
     tzlocal
   ];
 
diff --git a/pkgs/development/python-modules/curio/default.nix b/pkgs/development/python-modules/curio/default.nix
index 501cdd442ab92..0c006b281e2d5 100644
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , isPy3k
 , pytestCheckHook
 , sphinx
@@ -18,6 +19,15 @@ buildPythonPackage rec {
     hash = "sha256-VipYbbICFrp9K+gmPeuesHnlYEj5uJBtEdX0WqgcUkc=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Add support for Python 3.12
+      # https://github.com/dabeaz/curio/pull/363
+      url = "https://github.com/dabeaz/curio/commit/a5590bb04de3f1f201fd1fd0ce9cfe5825db80ac.patch";
+      hash = "sha256-dwatxLOPAWLQSyNqJvkx6Cbl327tX9OpZXM5aaDX58I=";
+    })
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
     sphinx
diff --git a/pkgs/development/python-modules/curtsies/default.nix b/pkgs/development/python-modules/curtsies/default.nix
index 4a17769e18e82..2dd039f00ee2f 100644
--- a/pkgs/development/python-modules/curtsies/default.nix
+++ b/pkgs/development/python-modules/curtsies/default.nix
@@ -8,6 +8,7 @@
 , pyte
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -22,6 +23,10 @@ buildPythonPackage rec {
     hash = "sha256-br4zIVvXyShRpQYEnHIMykz1wZLBZlwdepigTEcCdg4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     blessed
     cwcwidth
diff --git a/pkgs/development/python-modules/cvelib/default.nix b/pkgs/development/python-modules/cvelib/default.nix
index b44c51e4014c1..0f9d292a51514 100644
--- a/pkgs/development/python-modules/cvelib/default.nix
+++ b/pkgs/development/python-modules/cvelib/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-hJPcxnc4iQzsYNNVJ9fw6yQl+5K7pdtjHT6oMmBx/Zs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
-
   propagatedBuildInputs = [
     click
     jsonschema
diff --git a/pkgs/development/python-modules/cwl-upgrader/default.nix b/pkgs/development/python-modules/cwl-upgrader/default.nix
index 97f2ff499c3e2..cfd1cebd66200 100644
--- a/pkgs/development/python-modules/cwl-upgrader/default.nix
+++ b/pkgs/development/python-modules/cwl-upgrader/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-upgrader";
-  version = "1.2.9";
+  version = "1.2.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-yvgGMGo4QK+PRDzqlOH4rP49fnJUlbYB9B5AnlX+LF8=";
+    hash = "sha256-D/MIvn/jyxK++CMgKM8EYDVo94WFgdlTtMZjsXoQ4W4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cwl-utils/default.nix b/pkgs/development/python-modules/cwl-utils/default.nix
index 77f81963eefc0..aaa57e86ae00d 100644
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-utils";
-  version = "0.29";
+  version = "0.32";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XxfeBikJcRcUCIVDAmPTtcrrgvZYrRKpjs5bmMokeeI=";
+    hash = "sha256-CM2UlJ86FcjsOm0msBNpY2li8bhm5T/aMD1q292HpLM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cycler/default.nix b/pkgs/development/python-modules/cycler/default.nix
index 07be526f659b9..18e9fa7ed5980 100644
--- a/pkgs/development/python-modules/cycler/default.nix
+++ b/pkgs/development/python-modules/cycler/default.nix
@@ -1,34 +1,38 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, coverage
-, nose
-, six
-, python
+, fetchFromGitHub
+
+# build-system
+, setuptools
+
+# tests
+, pytest-xdist
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "cycler";
-  version = "0.11.0";
-  format = "setuptools";
+  version = "0.12.1";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "9c87405839a19696e837b3b818fed3f5f69f16f1eec1a1ad77e043dcea9c772f";
+  src = fetchFromGitHub {
+    owner = "matplotlib";
+    repo = "cycler";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5L0APSi/mJ85SuKCVz+c6Fn8zZNpRm6vCeBO0fpGKxg=";
   };
 
-  nativeCheckInputs = [ coverage nose ];
-  propagatedBuildInputs = [ six ];
-
-  checkPhase = ''
-    ${python.interpreter} run_tests.py
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  # Tests were not included in release.
-  # https://github.com/matplotlib/cycler/issues/31
-  doCheck = false;
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
 
   meta = {
+    changelog = "https://github.com/matplotlib/cycler/releases/tag/v${version}";
     description = "Composable style cycles";
     homepage = "https://github.com/matplotlib/cycler";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/python-modules/cysignals/default.nix b/pkgs/development/python-modules/cysignals/default.nix
index dc6d412f24593..fe0ca2e17a098 100644
--- a/pkgs/development/python-modules/cysignals/default.nix
+++ b/pkgs/development/python-modules/cysignals/default.nix
@@ -2,7 +2,7 @@
 , autoreconfHook
 , fetchPypi
 , buildPythonPackage
-, cython
+, cython_3
 , pariSupport ? true, pari # for interfacing with the PARI/GP signal handler
 }:
 
@@ -10,12 +10,12 @@ assert pariSupport -> pari != null;
 
 buildPythonPackage rec {
   pname = "cysignals";
-  version = "1.11.2";
+  version = "1.11.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5858b1760fbe21848121b826b2463a67ac5a45caf3d73105497a68618c5a6fa6";
+    hash = "sha256-Dx4yHlWgf5AchqNqHkSX9v+d/nAGgdATCjjDbk6yOMM=";
   };
 
   # explicit check:
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    cython
+    cython_3
   ] ++ lib.optionals pariSupport [
     # When cysignals is built with pari, including cysignals into the
     # buildInputs of another python package will cause cython to link against
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/cython/default.nix
index c2bb5811336d2..72ba4a68f038f 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , fetchpatch
+, setuptools
 , python
 , pkg-config
 , gdb
@@ -25,6 +26,7 @@ let
 in buildPythonPackage rec {
   pname = "cython";
   version = "0.29.36";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "Cython";
@@ -34,6 +36,7 @@ in buildPythonPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    setuptools
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/Cython/setup-hook.sh b/pkgs/development/python-modules/cython/setup-hook.sh
index c26330a536446..c26330a536446 100644
--- a/pkgs/development/python-modules/Cython/setup-hook.sh
+++ b/pkgs/development/python-modules/cython/setup-hook.sh
diff --git a/pkgs/development/python-modules/Cython/trashcan.patch b/pkgs/development/python-modules/cython/trashcan.patch
index 398422e76f395..398422e76f395 100644
--- a/pkgs/development/python-modules/Cython/trashcan.patch
+++ b/pkgs/development/python-modules/cython/trashcan.patch
diff --git a/pkgs/development/python-modules/daiquiri/default.nix b/pkgs/development/python-modules/daiquiri/default.nix
index 9c5a0abdbd1c5..c7d6602de5fee 100644
--- a/pkgs/development/python-modules/daiquiri/default.nix
+++ b/pkgs/development/python-modules/daiquiri/default.nix
@@ -3,20 +3,22 @@
 , fetchPypi
 , pytestCheckHook
 , python-json-logger
+, setuptools
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "daiquiri";
-  version = "3.2.1";
-  format = "setuptools";
+  version = "3.2.3";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QIxNKOyPDqI+llN0R5gpvSI2TQwI15HL63u6JFlj4P0=";
+    hash = "sha256-P8rvN2/WgIi5I5E3R6t+4S2Lf7Kvf4xfIOWYCZfp6DU=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/dask-awkward/default.nix b/pkgs/development/python-modules/dask-awkward/default.nix
index e22c973499e7c..8b7b772fa9034 100644
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-LxkiEQDHuVCRUoYgRwvMgBff22mzOvPmDoqczRweWB8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "awkward"
   ];
diff --git a/pkgs/development/python-modules/dask-histogram/default.nix b/pkgs/development/python-modules/dask-histogram/default.nix
index 5bdcb2458e45c..c465baf233091 100644
--- a/pkgs/development/python-modules/dask-histogram/default.nix
+++ b/pkgs/development/python-modules/dask-histogram/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     dask
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/databricks-cli/default.nix b/pkgs/development/python-modules/databricks-cli/default.nix
index d088850fc58ed..92d6adf55a11e 100644
--- a/pkgs/development/python-modules/databricks-cli/default.nix
+++ b/pkgs/development/python-modules/databricks-cli/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "databricks-cli";
-  version = "0.17.7";
+  version = "0.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "databricks";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Eg6qpoEvWlbOJbMIkbJiHfHVrglVfVNq/TCOhQxukl0=";
+    hash = "sha256-dH95C2AY/B6F9BROr6rh+gVtKqxsg1gyEU5MzCd5aqs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/databricks-sql-connector/default.nix b/pkgs/development/python-modules/databricks-sql-connector/default.nix
index f47949a6198ed..01b565df96e9a 100644
--- a/pkgs/development/python-modules/databricks-sql-connector/default.nix
+++ b/pkgs/development/python-modules/databricks-sql-connector/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "databricks-sql-connector";
-  version = "2.9.3";
+  version = "3.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "databricks";
     repo = "databricks-sql-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-y4Pmkgq3hv6mVu0zBsoiqNOcsHM0mxTNiJOCCZ+rwA8=";
+    hash = "sha256-ymR/PL+LC7Bt+thtCJs5kfbJgKDgioUo+T79E7ZUQWY=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/datasets/default.nix b/pkgs/development/python-modules/datasets/default.nix
index 0802ae5cf6f60..0505ea7e13ccd 100644
--- a/pkgs/development/python-modules/datasets/default.nix
+++ b/pkgs/development/python-modules/datasets/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "datasets";
-  version = "2.14.5";
+  version = "2.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -30,9 +30,15 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-oLB6laY/Si071mBKoWlZpd1fqr/wNtAnhRvBKLjeEuE=";
+    hash = "sha256-Q8cSgupfj6xKD0bYgL6bvYBwdYDdNaiWEWWUrRvwc4g=";
   };
 
+  # remove pyarrow<14.0.1 vulnerability fix
+  postPatch = ''
+    substituteInPlace src/datasets/features/features.py \
+      --replace "import pyarrow_hotfix" "#import pyarrow_hotfix"
+  '';
+
   propagatedBuildInputs = [
     aiohttp
     dill
diff --git a/pkgs/development/python-modules/dbt-bigquery/default.nix b/pkgs/development/python-modules/dbt-bigquery/default.nix
index 5b1e9aeeb9463..9e276cf143f2c 100644
--- a/pkgs/development/python-modules/dbt-bigquery/default.nix
+++ b/pkgs/development/python-modules/dbt-bigquery/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-bigquery";
-  version = "1.6.4";
+  version = "1.7.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-m458gg5TQ7jznhA9QNi8KQ+ICxdQn58mS0jvyZ88Fmg=";
+    hash = "sha256-CzRcnS/aECBq/9L8U+mLuHYo00HyBtKK6jmU8S03feM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
index eb6c269dd2907..6dc4c6155adfe 100644
--- a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
+++ b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
@@ -59,5 +59,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/dbt-labs/dbt-semantic-interfaces";
     license = licenses.asl20;
     maintainers = with maintainers; [ pbsds ];
+    # https://github.com/dbt-labs/dbt-semantic-interfaces/issues/134
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/dbt-snowflake/default.nix b/pkgs/development/python-modules/dbt-snowflake/default.nix
index dccf0ed7f989a..028050eea7c14 100644
--- a/pkgs/development/python-modules/dbt-snowflake/default.nix
+++ b/pkgs/development/python-modules/dbt-snowflake/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-snowflake";
-  version = "1.6.2";
+  version = "1.7.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-AOO3VbU1R3/snH7U7K9XXokBGXtf9Udpv7eR5HCBxss=";
+    hash = "sha256-v+9uxHeROZU7vZvvB7UYUFNM6ez97qiZmgDiunUKf04=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbus-deviation/default.nix b/pkgs/development/python-modules/dbus-deviation/default.nix
index 164c543a5ed79..739c9ba43aca8 100644
--- a/pkgs/development/python-modules/dbus-deviation/default.nix
+++ b/pkgs/development/python-modules/dbus-deviation/default.nix
@@ -2,14 +2,14 @@
 , buildPythonPackage
 , fetchPypi
 , lxml
+, setuptools
 , setuptools-git
-, sphinx
 }:
 
 buildPythonPackage rec {
   pname = "dbus-deviation";
   version = "0.6.1";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-git
-    sphinx
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbus/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index f929f58de1c38..be7504e5dc372 100644
--- a/pkgs/development/python-modules/dbus/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -1,11 +1,12 @@
 { lib, stdenv, fetchPypi, buildPythonPackage, python, pkg-config, dbus, dbus-glib, isPyPy
-, ncurses, pygobject3, isPy3k }:
+, ncurses, pygobject3, isPy3k, pythonAtLeast }:
 
 buildPythonPackage rec {
   pname = "dbus-python";
   version = "1.2.18";
 
-  disabled = isPyPy;
+  # ModuleNotFoundError: No module named 'distutils'
+  disabled = isPyPy || pythonAtLeast "3.12";
   format = "other";
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/python-modules/dbus/fix-includedir.patch b/pkgs/development/python-modules/dbus-python/fix-includedir.patch
index e3bb0682b5c44..e3bb0682b5c44 100644
--- a/pkgs/development/python-modules/dbus/fix-includedir.patch
+++ b/pkgs/development/python-modules/dbus-python/fix-includedir.patch
diff --git a/pkgs/development/python-modules/ddt/default.nix b/pkgs/development/python-modules/ddt/default.nix
index 6e1f2b154a53f..f0def3a3ad38b 100644
--- a/pkgs/development/python-modules/ddt/default.nix
+++ b/pkgs/development/python-modules/ddt/default.nix
@@ -1,34 +1,46 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, six, pyyaml, mock
+, pythonOlder
+
+# build-system
+, setuptools
+
+# tests
+, aiounittest
+, mock
 , pytestCheckHook
-, enum34
-, isPy3k
+, pyyaml
+, six
 }:
 
 buildPythonPackage rec {
   pname = "ddt";
-  version = "1.6.0";
-  format = "setuptools";
+  version = "1.7.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9xs0hzG4x4wxAL/72VGnafvUOQiNH9uzhB7uAZr4Cs0=";
+    hash = "sha256-0XjRFavyWhuDJ+lPhaA+8JsdewyiVvYgMoSwJPL8cN8=";
   };
 
-  propagatedBuildInputs = lib.optionals (!isPy3k) [
-    enum34
+  nativeBuildInputs = [
+    setuptools
   ];
 
-  nativeCheckInputs = [ six pyyaml mock pytestCheckHook ];
+  # aiounittest is not compatible with Python 3.12.
+  doCheck = pythonOlder "3.12";
 
-  preCheck = ''
-    # pytest can't import one file even with PYTHONPATH set
-    rm test/test_named_data.py
-  '';
+  nativeCheckInputs = [
+    aiounittest
+    mock
+    pytestCheckHook
+    pyyaml
+    six
+  ];
 
   meta = with lib; {
+    changelog = "https://github.com/datadriventests/ddt/releases/tag/${version}";
     description = "Data-Driven/Decorated Tests, a library to multiply test cases";
     homepage = "https://github.com/txels/ddt";
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/deal/default.nix b/pkgs/development/python-modules/deal/default.nix
index 13704b20939a8..941efb1311119 100644
--- a/pkgs/development/python-modules/deal/default.nix
+++ b/pkgs/development/python-modules/deal/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "deal";
-  version = "4.24.2";
+  version = "4.24.3";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "life4";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-bdIoKOOC7qSer9Cp9A55HG960xunKXT2WiXp0UC6tsI=";
+    hash = "sha256-QlM3d/jmg6v3L3D45+cgcCej71U1dl4uZ6sAYGGm3tU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/debian-inspector/default.nix b/pkgs/development/python-modules/debian-inspector/default.nix
index cc6a4fffc422d..eb0b89ba9871c 100644
--- a/pkgs/development/python-modules/debian-inspector/default.nix
+++ b/pkgs/development/python-modules/debian-inspector/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-RglPlTRksmm7CYVere7jySy2tIegv6JuulN7Usw9a0c=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontConfigure = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/deepdiff/default.nix b/pkgs/development/python-modules/deepdiff/default.nix
index 93deb8c10b815..64cae1af74c1d 100644
--- a/pkgs/development/python-modules/deepdiff/default.nix
+++ b/pkgs/development/python-modules/deepdiff/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "deepdiff";
-  version = "6.4.1";
+  version = "6.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "seperman";
     repo = "deepdiff";
     rev = "refs/tags/${version}";
-    hash = "sha256-oO5+ZCDgqonxaHR95tSrPkZDar/fzr1FXtl6J2W3PeU=";
+    hash = "sha256-YGYprSC5j06Ozg0dUJN5xnba0HUgiXa+d9Ci3czGWoY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/deepmerge/default.nix b/pkgs/development/python-modules/deepmerge/default.nix
index 2ef1e6aa51823..0a22573e2dfab 100644
--- a/pkgs/development/python-modules/deepmerge/default.nix
+++ b/pkgs/development/python-modules/deepmerge/default.nix
@@ -1,24 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy27
+
+# build-system
+, setuptools
 , setuptools-scm
-, vcver
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "deepmerge";
-  version = "1.1.0";
-  disabled = isPy27;
-  format = "pyproject";
+  version = "1.1.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TCeg213iheGnzqx9vBUx3qpVa2J96kkAyCRFgezf6i0=";
+    hash = "sha256-U6SJ3JRJY25ICnhDWa4qqzGRdIySBklVHI43hiLw7KQ=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -26,10 +29,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "deepmerge" ];
+  pythonImportsCheck = [
+    "deepmerge"
+  ];
 
   meta = with lib; {
+    changelog = "https://github.com/toumorokoshi/deepmerge/releases/tag/v${version}";
     description = "A toolset to deeply merge python dictionaries.";
+    downloadPage = "https://github.com/toumorokoshi/deepmerge";
     homepage = "http://deepmerge.readthedocs.io/en/latest/";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ];
diff --git a/pkgs/development/python-modules/deltachat/default.nix b/pkgs/development/python-modules/deltachat/default.nix
index 034be82d7e391..8d3f0cf20e11f 100644
--- a/pkgs/development/python-modules/deltachat/default.nix
+++ b/pkgs/development/python-modules/deltachat/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     libdeltachat
   ];
diff --git a/pkgs/development/python-modules/demetriek/default.nix b/pkgs/development/python-modules/demetriek/default.nix
index b553a1b0837a8..42205ac652f9a 100644
--- a/pkgs/development/python-modules/demetriek/default.nix
+++ b/pkgs/development/python-modules/demetriek/default.nix
@@ -5,6 +5,7 @@
 , buildPythonPackage
 , pydantic
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , yarl
 , aresponses
@@ -27,6 +28,16 @@ buildPythonPackage rec {
     hash = "sha256-LCHHBcZgO9gw5jyaJiiS4lKyb0ut+PJvKTylIvIKHhc=";
   };
 
+  patches = [
+    # https://github.com/frenck/python-demetriek/pull/531
+    (fetchpatch {
+      name = "pydantic_2-compatibility.patch";
+      url = "https://github.com/frenck/python-demetriek/commit/e677fe5b735b6b28572e3e5fd6aab56fc056f5e6.patch";
+      excludes = [ "pyproject.toml" "poetry.lock" ];
+      hash = "sha256-oMVR45KHDhcPId/0X9obJXCPE8s1gk5IgsGsgZesdZw=";
+    })
+  ];
+
   postPatch = ''
     # Upstream doesn't set a version for the pyproject.toml
     substituteInPlace pyproject.toml \
@@ -56,6 +67,8 @@ buildPythonPackage rec {
     "demetriek"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Python client for LaMetric TIME devices";
     homepage = "https://github.com/frenck/python-demetriek";
diff --git a/pkgs/development/python-modules/dependency-injector/default.nix b/pkgs/development/python-modules/dependency-injector/default.nix
index ff00a9fd200ab..0b575412e8541 100644
--- a/pkgs/development/python-modules/dependency-injector/default.nix
+++ b/pkgs/development/python-modules/dependency-injector/default.nix
@@ -78,5 +78,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/ets-labs/python-dependency-injector/blob/${version}/docs/main/changelog.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ gerschtli ];
+    # https://github.com/ets-labs/python-dependency-injector/issues/726
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/devolo-home-control-api/default.nix b/pkgs/development/python-modules/devolo-home-control-api/default.nix
index e614f206f3285..8d06b409d5781 100644
--- a/pkgs/development/python-modules/devolo-home-control-api/default.nix
+++ b/pkgs/development/python-modules/devolo-home-control-api/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-4AyC1DDYtKl8SwJf75BbzoOAhbZXmBZ05ma9YmLzksM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index 5fac8fd6aa0fb..ad34b49280f6b 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -33,8 +33,6 @@ buildPythonPackage rec {
       --replace "protobuf>=4.22.0" "protobuf"
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dictdiffer/default.nix b/pkgs/development/python-modules/dictdiffer/default.nix
index 2bb16eb097b99..acbc3996fbc6b 100644
--- a/pkgs/development/python-modules/dictdiffer/default.nix
+++ b/pkgs/development/python-modules/dictdiffer/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-lQyPs3lQWtsvNPuvvwJUTDzrFaOX5uwGuRHe3yWUheU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index bab6cd3f6c7bb..7a7c28fbe4bc0 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "diff-cover";
-  version = "7.7.0";
+  version = "8.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "diff_cover";
     inherit version;
-    hash = "sha256-YGFM9+ciz3+xveSXr6wLUUKU4eJlNESWItrE2ilhI/s=";
+    hash = "sha256-zDnRmety/kG83P7hZOtbWRUztMYlWA4/mprMaGkGTXw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dirty-equals/default.nix b/pkgs/development/python-modules/dirty-equals/default.nix
index 9f40226e6bb36..8ef6259761678 100644
--- a/pkgs/development/python-modules/dirty-equals/default.nix
+++ b/pkgs/development/python-modules/dirty-equals/default.nix
@@ -12,7 +12,7 @@
 let
   dirty-equals = buildPythonPackage rec {
     pname = "dirty-equals";
-    version = "0.7.0";
+    version = "0.7.1-post0";
     format = "pyproject";
 
     disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ let
       owner = "samuelcolvin";
       repo = pname;
       rev = "refs/tags/v${version}";
-      hash = "sha256-ShbkPGj1whOQ11bFLUSTfvVEVlvc3JUzRDICbBohgMM=";
+      hash = "sha256-U6DNluthDgxzh6IOaKrN/JhX4u+ztY/jVp9IKh0iP34=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/diskcache/default.nix b/pkgs/development/python-modules/diskcache/default.nix
index 6f275a01fa70a..328777370782f 100644
--- a/pkgs/development/python-modules/diskcache/default.nix
+++ b/pkgs/development/python-modules/diskcache/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "diskcache";
-  version = "5.4.0";
+  version = "5.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "grantjenks";
     repo = "python-diskcache";
     rev = "v${version}";
-    hash = "sha256-c/k8mx/T4RkseDobJ2gtcuom0A6Ewyw4aP2Bk9pxV+o=";
+    hash = "sha256-1cDpdf+rLaG14TDd1wEHAiYXb69NFTFeOHD1Ib1oOVY=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/dissect-cim/default.nix b/pkgs/development/python-modules/dissect-cim/default.nix
index 37de761ca567f..acac46050a273 100644
--- a/pkgs/development/python-modules/dissect-cim/default.nix
+++ b/pkgs/development/python-modules/dissect-cim/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-+HHjDUSepAEebMD5ckjXbfgA4AKlNMBYHwxDq+jdhxw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-clfs/default.nix b/pkgs/development/python-modules/dissect-clfs/default.nix
index 8dc3c9e20c123..0f44c587c7464 100644
--- a/pkgs/development/python-modules/dissect-clfs/default.nix
+++ b/pkgs/development/python-modules/dissect-clfs/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-JdfO9KVuK1TsDyqEQkuHPJtSHDCym63imvLSHsVwQ3k=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-cobaltstrike/default.nix b/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
index c232bdb0bf4ae..7b25a817aa649 100644
--- a/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
+++ b/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-CS50c3r7sdxp3CRS6XJ4QUmUFtmhFg6rSdKfYzJSOV4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-cstruct/default.nix b/pkgs/development/python-modules/dissect-cstruct/default.nix
index a40b806ab01d5..cecc7dffef3fb 100644
--- a/pkgs/development/python-modules/dissect-cstruct/default.nix
+++ b/pkgs/development/python-modules/dissect-cstruct/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-cdBojvFI0cN6mEZ98xLa3XldvIoR+Jv1c0/hvVkKVoQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-esedb/default.nix b/pkgs/development/python-modules/dissect-esedb/default.nix
index 76e9eae46fa4f..1253b9ebb9c8b 100644
--- a/pkgs/development/python-modules/dissect-esedb/default.nix
+++ b/pkgs/development/python-modules/dissect-esedb/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-RlXnUD+KiBmntM/f7jEzdZ0Tdb8vPGvW0e3XoANaPnk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-etl/default.nix b/pkgs/development/python-modules/dissect-etl/default.nix
index de6a49ba9e262..1e110a915f9a9 100644
--- a/pkgs/development/python-modules/dissect-etl/default.nix
+++ b/pkgs/development/python-modules/dissect-etl/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-z6P7XpA+j9JIJJsp/Z4uewFw9OAPSZV+57eJu7rd17I=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-eventlog/default.nix b/pkgs/development/python-modules/dissect-eventlog/default.nix
index 9c11a3ee87781..60f9d52cac74d 100644
--- a/pkgs/development/python-modules/dissect-eventlog/default.nix
+++ b/pkgs/development/python-modules/dissect-eventlog/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-h1LrBt8f9YFkc1uAAb4WwY3LjPuvsdVFvxji3QxKF0A=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-evidence/default.nix b/pkgs/development/python-modules/dissect-evidence/default.nix
index b1d8bb2b1b843..e60f81e419626 100644
--- a/pkgs/development/python-modules/dissect-evidence/default.nix
+++ b/pkgs/development/python-modules/dissect-evidence/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-b7Ls3Xfd0scMe/gccjvRfuADITnz5QpJNLUaIgmZtpI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-executable/default.nix b/pkgs/development/python-modules/dissect-executable/default.nix
index d8f3e6cb08c2d..7b3757d0f3ad5 100644
--- a/pkgs/development/python-modules/dissect-executable/default.nix
+++ b/pkgs/development/python-modules/dissect-executable/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-h9eOTWJR0Bd3DY8WDYWqLCl1jYJcqP6cRTgWubf/rKI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-extfs/default.nix b/pkgs/development/python-modules/dissect-extfs/default.nix
index 1523749bf8bb1..86206ee27ac14 100644
--- a/pkgs/development/python-modules/dissect-extfs/default.nix
+++ b/pkgs/development/python-modules/dissect-extfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-RsAWqtoarn/2sZU5dkQYt794dXGOr5fe68VgMNDBst4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-fat/default.nix b/pkgs/development/python-modules/dissect-fat/default.nix
index 0a22c7b8b7baf..be5043fd27de5 100644
--- a/pkgs/development/python-modules/dissect-fat/default.nix
+++ b/pkgs/development/python-modules/dissect-fat/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-YfWshytfj4p2MqLpzE3b1/RtrL1/+Xd/5+RNbrH/Jfc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-ffs/default.nix b/pkgs/development/python-modules/dissect-ffs/default.nix
index 8e5dbaac04450..3d1afcf31ccbe 100644
--- a/pkgs/development/python-modules/dissect-ffs/default.nix
+++ b/pkgs/development/python-modules/dissect-ffs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-eyqqsOKcRmzOY+fj1FYudh9FUanD0Z59zZPtsNz6I0s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-hypervisor/default.nix b/pkgs/development/python-modules/dissect-hypervisor/default.nix
index e7f17cb0286c2..975526db71581 100644
--- a/pkgs/development/python-modules/dissect-hypervisor/default.nix
+++ b/pkgs/development/python-modules/dissect-hypervisor/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-Ml5U7yc4iqqilL6Y9qF3VU+pa0AXnYVQjVas90TpG30=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-ntfs/default.nix b/pkgs/development/python-modules/dissect-ntfs/default.nix
index 96b3cb3a67455..4d69844c9884d 100644
--- a/pkgs/development/python-modules/dissect-ntfs/default.nix
+++ b/pkgs/development/python-modules/dissect-ntfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-bnFimn5ektIKiX73NZ+1Iz3Uoew138a0nFJgypffC4o=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-ole/default.nix b/pkgs/development/python-modules/dissect-ole/default.nix
index d76e11cb3f530..3d47252b829f8 100644
--- a/pkgs/development/python-modules/dissect-ole/default.nix
+++ b/pkgs/development/python-modules/dissect-ole/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-4shxYKR6IrrMj2BIb5yFD7+C0SNyqsGOoBkWpad1EbI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-regf/default.nix b/pkgs/development/python-modules/dissect-regf/default.nix
index 94881ca3ca42a..a2050fe6bd3c0 100644
--- a/pkgs/development/python-modules/dissect-regf/default.nix
+++ b/pkgs/development/python-modules/dissect-regf/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-4tKu7oPkpNcWr2XJvZg94yZZcbTeeXBphPCLoZYzg6U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-shellitem/default.nix b/pkgs/development/python-modules/dissect-shellitem/default.nix
index ad2fb1ed7a750..77e1e6344fe29 100644
--- a/pkgs/development/python-modules/dissect-shellitem/default.nix
+++ b/pkgs/development/python-modules/dissect-shellitem/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-g8o6W5MZ7E8AKYs5QGQGw3IQhZehrOcY6wJrt9TJf4s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-sql/default.nix b/pkgs/development/python-modules/dissect-sql/default.nix
index 173170396f726..208096a56e52b 100644
--- a/pkgs/development/python-modules/dissect-sql/default.nix
+++ b/pkgs/development/python-modules/dissect-sql/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-BHwm88IPtfg/bi5veFGnciQeH4s0asVnxiMVsIi8vV8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-squashfs/default.nix b/pkgs/development/python-modules/dissect-squashfs/default.nix
index cc1f4999d8589..d42058f952cc4 100644
--- a/pkgs/development/python-modules/dissect-squashfs/default.nix
+++ b/pkgs/development/python-modules/dissect-squashfs/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-MJKC05/8NnJFdyBB5YPbqe8mp1zlIoS2FglKEPSSYd8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-target/default.nix b/pkgs/development/python-modules/dissect-target/default.nix
index 3aa4c39b9f521..62f4a745156c6 100644
--- a/pkgs/development/python-modules/dissect-target/default.nix
+++ b/pkgs/development/python-modules/dissect-target/default.nix
@@ -51,8 +51,6 @@ buildPythonPackage rec {
     hash = "sha256-vp1upVwohMXFKxlHy5lWmigdq9MUk1UknSsPpCXt50s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-thumbcache/default.nix b/pkgs/development/python-modules/dissect-thumbcache/default.nix
index e63e7bb4ac916..1e6d36a0cdc6d 100644
--- a/pkgs/development/python-modules/dissect-thumbcache/default.nix
+++ b/pkgs/development/python-modules/dissect-thumbcache/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-q35VL3BUZrxNBB5mHegqVObG76BYG4FAk/KIAvdm6B8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-util/default.nix b/pkgs/development/python-modules/dissect-util/default.nix
index 94c193b5b1911..495294db9c3f7 100644
--- a/pkgs/development/python-modules/dissect-util/default.nix
+++ b/pkgs/development/python-modules/dissect-util/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-GUDYr3lP0BV7zJaaUen78CplRA7jfn1zYes7kczNGEU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-vmfs/default.nix b/pkgs/development/python-modules/dissect-vmfs/default.nix
index d3efbcdf6420c..740b9f668f0c5 100644
--- a/pkgs/development/python-modules/dissect-vmfs/default.nix
+++ b/pkgs/development/python-modules/dissect-vmfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-FDxB87TeAMUp0hP9YS/nrqNx71+ZlHf3Bsaqvuwx36U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-volume/default.nix b/pkgs/development/python-modules/dissect-volume/default.nix
index 1ef6ffb449982..1a2ce1e273550 100644
--- a/pkgs/development/python-modules/dissect-volume/default.nix
+++ b/pkgs/development/python-modules/dissect-volume/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-5ZO++l6BWA085U5IkghjCT46YhKc85SB7sNU2h4Fpec=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-xfs/default.nix b/pkgs/development/python-modules/dissect-xfs/default.nix
index d4f36cbc04d5c..1f46b745edc35 100644
--- a/pkgs/development/python-modules/dissect-xfs/default.nix
+++ b/pkgs/development/python-modules/dissect-xfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-unrkmhLvjWWKHiqJWCEVEVcUjxWXMznjOytRbDwAxKw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect/default.nix b/pkgs/development/python-modules/dissect/default.nix
index 54787ec221828..2d15c4f5a7202 100644
--- a/pkgs/development/python-modules/dissect/default.nix
+++ b/pkgs/development/python-modules/dissect/default.nix
@@ -44,8 +44,6 @@ buildPythonPackage rec {
     hash = "sha256-6y+p+Ulc1Viu5s1AL/ecVtO4YRnmem/ZleY8xC4CJrU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 074a450a39e4e..c5be90d0af98a 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -10,6 +10,7 @@
 , packaging
 , psutil
 , pythonOlder
+, pythonRelaxDepsHook
 , pyyaml
 , setuptools
 , setuptools-scm
@@ -43,11 +44,16 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     versioneer
   ] ++ versioneer.optional-dependencies.toml;
 
+  pythonRelaxDeps = [
+    "dask"
+  ];
+
   propagatedBuildInputs = [
     click
     cloudpickle
diff --git a/pkgs/development/python-modules/dj-rest-auth/default.nix b/pkgs/development/python-modules/dj-rest-auth/default.nix
index 5e1e1a57928d4..bbbb2aeabd032 100644
--- a/pkgs/development/python-modules/dj-rest-auth/default.nix
+++ b/pkgs/development/python-modules/dj-rest-auth/default.nix
@@ -9,18 +9,19 @@
 , responses
 , unittest-xml-reporting
 , python
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "dj-rest-auth";
-  version = "5.0.1";
-  format = "setuptools";
+  version = "5.0.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iMerica";
     repo = "dj-rest-auth";
     rev = "refs/tags/${version}";
-    hash = "sha256-PTFUZ54vKlufKCQyJb+QB/+hI15r+Z0auTjnc38yMLg=";
+    hash = "sha256-TqeNpxXn+v89fEiJ4AVNhp8blCfYQKFQfYmZ6/QlRbQ=";
   };
 
   patches = [
@@ -37,6 +38,10 @@ buildPythonPackage rec {
       --replace "==" ">="
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   buildInputs = [
     django
   ];
diff --git a/pkgs/development/python-modules/django-anymail/default.nix b/pkgs/development/python-modules/django-anymail/default.nix
index 572df39481868..799881ebee357 100644
--- a/pkgs/development/python-modules/django-anymail/default.nix
+++ b/pkgs/development/python-modules/django-anymail/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, six
 , requests
 , django
 , boto3
@@ -13,15 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-anymail";
-  version = "10.1";
-
+  version = "10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anymail";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-unmbYQFLeqfqE1uFLMPLUad1UqA+sgbTzwRfpRhM3ik=";
+    hash = "sha256-k4C82OYm2SdjxeLScrkkitumjYgWkMNFlNeGW+C1Z8o=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +42,7 @@ buildPythonPackage rec {
 
   checkPhase = ''
     runHook preCheck
-    CONTINUOUS_INTEGRATION=1 python runtests.py
+    CONTINUOUS_INTEGRATION=1 ${python.interpreter} runtests.py
     runHook postCheck
   '';
 
diff --git a/pkgs/development/python-modules/django-auditlog/default.nix b/pkgs/development/python-modules/django-auditlog/default.nix
index fa52f1b3d59cc..4a176b0b14ec3 100644
--- a/pkgs/development/python-modules/django-auditlog/default.nix
+++ b/pkgs/development/python-modules/django-auditlog/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-QHSGqtpkOgltAg+RlG/Ik3DfEjtSWt45sqlD+Zw4Bh0=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/django-bootstrap3/default.nix b/pkgs/development/python-modules/django-bootstrap3/default.nix
index ccb1ffd3c1a7e..6a29fc7630aa1 100644
--- a/pkgs/development/python-modules/django-bootstrap3/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap3/default.nix
@@ -3,7 +3,8 @@
 , fetchFromGitHub
 
 # build-system
-, hatchling
+, setuptools
+, setuptools-scm
 
 # non-propagates
 , django
@@ -15,22 +16,19 @@
 
 buildPythonPackage rec {
   pname = "django-bootstrap3";
-  version = "23.4";
+  version = "23.6";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "zostera";
     repo = "django-bootstrap3";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1/JQ17GjBHH0JbY4EnHOS2B3KhEJdG2yL6O2nc1HNNc=";
+    hash = "sha256-qqG9w0bQYoQgWXCks/WwwQVoh2DhIMLaFXDQ4z6D84g=";
   };
 
-  postPatch = ''
-    sed -i '/beautifulsoup4/d' pyproject.toml
-  '';
-
   nativeBuildInputs = [
-    hatchling
+    setuptools
+    setuptools-scm
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/django-bootstrap4/default.nix b/pkgs/development/python-modules/django-bootstrap4/default.nix
index 568ce0df30489..66cff8029757f 100644
--- a/pkgs/development/python-modules/django-bootstrap4/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap4/default.nix
@@ -3,7 +3,8 @@
 , fetchFromGitHub
 
 # build-system
-, hatchling
+, setuptools
+, setuptools-scm
 
 # non-propagates
 , django
@@ -17,18 +18,19 @@
 
 buildPythonPackage rec {
   pname = "django-bootstrap4";
-  version = "23.2";
+  version = "23.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "zostera";
     repo = "django-bootstrap4";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RYGwi+hRfTqPAikrv33w27v1/WLwRvXexSusJKdr2o8=";
+    hash = "sha256-ccZ/73u4c6E6pfRv+f3Pu8SorF/d7zQBexGAlFcIwTo=";
   };
 
   nativeBuildInputs = [
-    hatchling
+    setuptools
+    setuptools-scm
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-ckeditor/default.nix b/pkgs/development/python-modules/django-ckeditor/default.nix
index b0df11aefd0c8..530efc2a56140 100644
--- a/pkgs/development/python-modules/django-ckeditor/default.nix
+++ b/pkgs/development/python-modules/django-ckeditor/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-mZQ5s3YbumYmT0zRWPFIvzt2TbtDLvVcJjZVAwn31E8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-hijack/default.nix b/pkgs/development/python-modules/django-hijack/default.nix
index 60e04b184e9fa..a5c85a485695b 100644
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@@ -43,8 +43,6 @@ buildPythonPackage rec {
     hash = "sha256-X3bJ6STFq6zGIzXHSd2C67d4kSOVJJR5aBSM3o5T850=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     gettext
     nodejs
diff --git a/pkgs/development/python-modules/django-js-asset/default.nix b/pkgs/development/python-modules/django-js-asset/default.nix
index f579a31dc3e7c..54c4c4b90eb45 100644
--- a/pkgs/development/python-modules/django-js-asset/default.nix
+++ b/pkgs/development/python-modules/django-js-asset/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "django-js-asset";
-  version = "2.1";
+  version = "2.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matthiask";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-rxJ9TgVBiJByiFSLTg/dtAR31Fs14D4sh2axyBcKGTU=";
+    hash = "sha256-qAkE5ubzfTNO1LuMQXMW2Sot1cn/bhuXlWa/J/wD5SI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-login-required-middleware/default.nix b/pkgs/development/python-modules/django-login-required-middleware/default.nix
index 6c69ef7ef27af..b288e79290599 100644
--- a/pkgs/development/python-modules/django-login-required-middleware/default.nix
+++ b/pkgs/development/python-modules/django-login-required-middleware/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-WFQ/JvKh6gkUxPV27QBd2TzwFS8hfQGmcTInTnmh6iA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index f5942b9b9bf4a..74a2dd61f7cd0 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "django-mailman3";
-  version = "1.3.9";
+  version = "1.3.11";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GpI1W0O9aJpLF/mcS23ktJDZsP69S2zQy7drOiWBnTM=";
+    hash = "sha256-uIjJaZHWL2evj+oISLprvKWT5Sm5f2EKgUD1twL1VbQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-maintenance-mode/default.nix b/pkgs/development/python-modules/django-maintenance-mode/default.nix
index 8dd2ad71b242e..e6940c53b4309 100644
--- a/pkgs/development/python-modules/django-maintenance-mode/default.nix
+++ b/pkgs/development/python-modules/django-maintenance-mode/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "django-maintenance-mode";
-  version = "0.18.0";
+  version = "0.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Mcj8O20hCINGf5T3PCG9jq0onSrm4R+Ke5CLMqMDmuU=";
+    hash = "sha256-NAm3xMcHePTYxysihYj48bk7r9ykEtPcxPjSEju/zMM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-model-utils/default.nix b/pkgs/development/python-modules/django-model-utils/default.nix
index 648634b0f32cc..6c82422cf0e09 100644
--- a/pkgs/development/python-modules/django-model-utils/default.nix
+++ b/pkgs/development/python-modules/django-model-utils/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-p3/JO6wNwZPYX7MIgMj/0caHt5s+uL51Sxa28/VITxo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-ninja/default.nix b/pkgs/development/python-modules/django-ninja/default.nix
index 620960797ea04..2aa349e71bc71 100644
--- a/pkgs/development/python-modules/django-ninja/default.nix
+++ b/pkgs/development/python-modules/django-ninja/default.nix
@@ -13,15 +13,16 @@
 
 buildPythonPackage rec {
   pname = "django-ninja";
-  version = "0.22.2";
-  format = "pyproject";
+  version = "1.0.1";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "vitalik";
     repo = "django-ninja";
     rev = "v${version}";
-    hash = "sha256-oeisurp9seSn3X/5jFF9DMm9nU6uDYIU1b6/J3o2be0=";
+    hash = "sha256-hF6Z8i8M4mQtVPIupTSEIkJh0i/oMFFuE9PpODxq4fw=";
   };
 
   propagatedBuildInputs = [ django pydantic ];
@@ -38,7 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     changelog = "https://github.com/vitalik/django-ninja/releases/tag/v${version}";
     description = "Web framework for building APIs with Django and Python type hints";
-    homepage = "https://django-ninja.rest-framework.com/";
+    homepage = "https://django-ninja.dev";
     license = licenses.mit;
     maintainers = with maintainers; [ elohmeier ];
   };
diff --git a/pkgs/development/python-modules/django-pattern-library/default.nix b/pkgs/development/python-modules/django-pattern-library/default.nix
index 76d376d11c092..89f998c058b9c 100644
--- a/pkgs/development/python-modules/django-pattern-library/default.nix
+++ b/pkgs/development/python-modules/django-pattern-library/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "django-pattern-library";
-  version = "1.0.1";
+  version = "1.1.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "torchbox";
     repo = "django-pattern-library";
-    rev = "v${version}";
-    hash = "sha256-Q8rv7RDlstTSlwmbmHV0vrnCV/lwz6VJf27BUllA34Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9uuLYwG0/NYGouncuaN8S+3CBABSxSOkcrP59p5v84U=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-payments/default.nix b/pkgs/development/python-modules/django-payments/default.nix
index 577a2ca5132ef..d470bb57a2e50 100644
--- a/pkgs/development/python-modules/django-payments/default.nix
+++ b/pkgs/development/python-modules/django-payments/default.nix
@@ -33,8 +33,6 @@ buildPythonPackage rec {
       --replace "django-phonenumber-field[phonenumberslite]" "django-phonenumber-field"
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-simple-history/default.nix b/pkgs/development/python-modules/django-simple-history/default.nix
index 5ed17c5f6425b..a38671d97c0ff 100644
--- a/pkgs/development/python-modules/django-simple-history/default.nix
+++ b/pkgs/development/python-modules/django-simple-history/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-XY6YNajwX5z3AXkYYGFtrURDqxub9EQwu52jQ7CZwrI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-tables2/default.nix b/pkgs/development/python-modules/django-tables2/default.nix
index 96811351269df..a6a873bee00ef 100644
--- a/pkgs/development/python-modules/django-tables2/default.nix
+++ b/pkgs/development/python-modules/django-tables2/default.nix
@@ -2,41 +2,73 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
 , django
 , tablib
-, python
+
+# tests
+, lxml
+, openpyxl
+, psycopg2
+, pytz
+, pyyaml
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-tables2";
-  version = "2.6.0";
-  format = "setuptools";
+  version = "2.7.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "jieter";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-n8qvsm/i+2VclFc00jQGO0Z4l6Ke8qZ03EYuEQcPuVQ=";
+    hash = "sha256-VB7xmcBncTUYllzKS4o7G7u+KoivMiiEQGZ4x+Rnces=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     django
-    tablib
   ];
 
-  pythonImportsCheck = [
-    # Requested setting DJANGO_TABLES2_TEMPLATE, but settings are not configured.
-  ];
+  passthru.optional-dependencies = {
+    tablib = [
+      tablib
+    ]
+    ++ tablib.optional-dependencies.xls
+    ++ tablib.optional-dependencies.yaml;
+  };
 
-  doCheck = false; # needs django-boostrap{3,4} packages
+  env.DJANGO_SETTINGS_MODULE = "tests.app.settings";
 
-  # Leave this in! Discovering how to run tests is annoying in Django apps
-  checkPhase = ''
-    ${python.interpreter} example/manage.py test
-  '';
+  nativeCheckInputs = [
+    lxml
+    openpyxl
+    psycopg2
+    pytz
+    pyyaml
+    pytest-django
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  disabledTestPaths = [
+    # requires django-filters
+    "tests/test_views.py"
+  ];
 
   meta = with lib; {
+    changelog = "https://github.com/jieter/django-tables2/blob/v${version}/CHANGELOG.md";
     description = "Django app for creating HTML tables";
     homepage = "https://github.com/jieter/django-tables2";
     license = licenses.bsd2;
diff --git a/pkgs/development/python-modules/django-types/default.nix b/pkgs/development/python-modules/django-types/default.nix
index 5c16312538ace..908fb1bd0ed1f 100644
--- a/pkgs/development/python-modules/django-types/default.nix
+++ b/pkgs/development/python-modules/django-types/default.nix
@@ -2,23 +2,31 @@
 , buildPythonPackage
 , fetchPypi
 , poetry-core
+, types-psycopg2
 }:
 
 buildPythonPackage rec {
   pname = "django-types";
-  version = "0.18.0";
-  format = "pyproject";
+  version = "0.19.1";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-uOIzTIEIZNer8RzTzbHaOyAVtn5/EnAAfjN3f/G9hlQ=";
+    pname = "django_types";
+    inherit version;
+    hash = "sha256-WueYhhLPb7w1ewGLvDs6h4tl4EJ1zEbg011mpwja/xI=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    types-psycopg2
+  ];
 
   meta = with lib; {
     description = "Type stubs for Django";
-    homepage = "https://pypi.org/project/django-types";
+    homepage = "https://github.com/sbdchd/django-types";
     license = licenses.mit;
     maintainers = with maintainers; [ thubrecht ];
   };
diff --git a/pkgs/development/python-modules/django-vite/default.nix b/pkgs/development/python-modules/django-vite/default.nix
index 88dc763aa15fb..beb49f409270d 100644
--- a/pkgs/development/python-modules/django-vite/default.nix
+++ b/pkgs/development/python-modules/django-vite/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "django-vite";
-  version = "2.1.3";
+  version = "3.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "MrBin99";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-HrcQt0Mdko+/XJd0srQTBYMtHaLZyImMuQn39HIwDfY=";
+    hash = "sha256-S7n14nv6DZgusntVXh65PM/oaYZGCxaFylPbVXxmLj4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-widget-tweaks/default.nix b/pkgs/development/python-modules/django-widget-tweaks/default.nix
index b77af5e47491c..547df7c7fdfbd 100644
--- a/pkgs/development/python-modules/django-widget-tweaks/default.nix
+++ b/pkgs/development/python-modules/django-widget-tweaks/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-/3UIsg75X3R9YGv9cEcoPw3IN2vkhUb+HCy68813d2E=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 69c438739f23f..47c079328a175 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.2.7";
+  version = "4.2.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jg8cLCeGtcDjn+GvziTJJgQPrUfI6orTCq8RiN8p/EE=";
+    hash = "sha256-EkmMw8uLyAOFOf756Q6V9QdQJDbB8MOmc0ETJPpnXRQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/djangorestframework-stubs/default.nix b/pkgs/development/python-modules/djangorestframework-stubs/default.nix
index c5e5b0d967f4d..6cb2e76e857ca 100644
--- a/pkgs/development/python-modules/djangorestframework-stubs/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-stubs/default.nix
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    django-stubs
     requests
     types-pyyaml
     types-requests
@@ -43,7 +44,6 @@ buildPythonPackage rec {
 
   passthru.optional-dependencies = {
     compatible-mypy = [
-      django-stubs
       mypy
     ] ++ django-stubs.optional-dependencies.compatible-mypy;
     coreapi = [
diff --git a/pkgs/development/python-modules/docker/default.nix b/pkgs/development/python-modules/docker/default.nix
index 80c73f2fe0a61..579584c531049 100644
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@@ -3,28 +3,38 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+
+# build-system
+, setuptools
+, setuptools-scm
+
+# dependencies
 , packaging
-, paramiko
-, pytestCheckHook
 , requests
-, setuptools-scm
 , urllib3
+
+# optional-dependenices
+, paramiko
 , websocket-client
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "docker";
-  version = "6.1.3";
+  version = "7.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qm0XgwBFul7wFo1eqjTTe+6xE5SMQTr/4dWZH8EfmiA=";
+    hash = "sha256-Mjc2+5LNlBj8XnEzvJU+EanaBPRIP4KLUn21U/Hn5aM=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -32,16 +42,24 @@ buildPythonPackage rec {
     packaging
     requests
     urllib3
-    websocket-client
   ];
 
-  passthru.optional-dependencies.ssh = [
-    paramiko
+  passthru.optional-dependencies = {
+    ssh = [
+      paramiko
+    ];
+    websockets = [
+      websocket-client
+    ];
+  };
+
+  pythonImportsCheck = [
+    "docker"
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pytestFlagsArray = [
     "tests/unit"
@@ -49,16 +67,13 @@ buildPythonPackage rec {
 
   # Deselect socket tests on Darwin because it hits the path length limit for a Unix domain socket
   disabledTests = lib.optionals stdenv.isDarwin [
-    "api_test" "stream_response" "socket_file"
-  ];
-
-  dontUseSetuptoolsCheck = true;
-
-  pythonImportsCheck = [
-    "docker"
+    "api_test"
+    "stream_response"
+    "socket_file"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/docker/docker-py/releases/tag/${version}";
     description = "An API client for docker written in Python";
     homepage = "https://github.com/docker/docker-py";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/dockerspawner/default.nix b/pkgs/development/python-modules/dockerspawner/default.nix
index b2c5b2790fbea..44f269d50c642 100644
--- a/pkgs/development/python-modules/dockerspawner/default.nix
+++ b/pkgs/development/python-modules/dockerspawner/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , jupyterhub
 , escapism
 , docker
@@ -9,13 +10,17 @@
 buildPythonPackage rec {
   pname = "dockerspawner";
   version = "13.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-POlTZ9luS9wQ/vt9w8VMfTEqGzg/DhfB45ePfvnyito=";
+    hash = "sha256-POlTZ9luS9wQ/vt9w8VMfTEqGzg/DhfB45ePfvnyito=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jupyterhub
     escapism
diff --git a/pkgs/development/python-modules/docstring-to-markdown/default.nix b/pkgs/development/python-modules/docstring-to-markdown/default.nix
index 2832228394c31..958adb3ffbf19 100644
--- a/pkgs/development/python-modules/docstring-to-markdown/default.nix
+++ b/pkgs/development/python-modules/docstring-to-markdown/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "docstring-to-markdown";
-  version = "0.12";
+  version = "0.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "python-lsp";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-c0gk1s/+25+pWUpi8geDQZ0f9JBeuvvFQ9MFskRnY6U=";
+    hash = "sha256-r+TRYofTRDCBC0s+bJRhagepEQbbj5WeI5FRtaVPt24=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/dominate/default.nix b/pkgs/development/python-modules/dominate/default.nix
index 38aaccf4b15a7..24aa9efa2a848 100644
--- a/pkgs/development/python-modules/dominate/default.nix
+++ b/pkgs/development/python-modules/dominate/default.nix
@@ -1,22 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "dominate";
-  version = "2.8.0";
-  format = "setuptools";
+  version = "2.9.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TJDDvvr4jmErcfSzmve8vviXes+oVc7JVyJaj79QQAc=";
+    hash = "sha256-sVeR6+pDIhhUOhcC12rkXS/5X/mU5SAUuGhqadrXcv0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/dtschema/default.nix b/pkgs/development/python-modules/dtschema/default.nix
index 1e890aba3309c..cb4fa7fcdf47d 100644
--- a/pkgs/development/python-modules/dtschema/default.nix
+++ b/pkgs/development/python-modules/dtschema/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     ./fix_libfdt_name.patch
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 5ff9956849926..a7cd1aa36dd45 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -32,7 +32,6 @@ buildPythonPackage rec {
   '';
 
   BUILD_HTTPFS = 1;
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     pybind11
diff --git a/pkgs/development/python-modules/dunamai/default.nix b/pkgs/development/python-modules/dunamai/default.nix
index 46e2361d9db99..7cbd3ea50efcc 100644
--- a/pkgs/development/python-modules/dunamai/default.nix
+++ b/pkgs/development/python-modules/dunamai/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dunamai";
-  version = "1.18.0";
+  version = "1.19.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mtkennerly";
     repo = "dunamai";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QKXEFwOAa5nIQZA6DHNqnWyshnN+/6qovdqjCd9WF4k=";
+    hash = "sha256-wMIqm1bUub89ExnbvJBzuZ9479el8EgwVcfPpI+SD5Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/duo-client/default.nix b/pkgs/development/python-modules/duo-client/default.nix
index 129ec14cd0a79..4339f69183049 100644
--- a/pkgs/development/python-modules/duo-client/default.nix
+++ b/pkgs/development/python-modules/duo-client/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "duo-client";
-  version = "5.0.1";
+  version = "5.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "duosecurity";
     repo = "duo_client_python";
     rev = "refs/tags/${version}";
-    hash = "sha256-G0XLZZaQTPD64WXN34wq2z+YtzECgtC2nJXzDxAlgyg=";
+    hash = "sha256-MnSAFxKgExq+e8TOwgsPAoO4GEfsc3sjPNGLxzch5f0=";
   };
 
   postPatch = ''
@@ -53,6 +53,11 @@ buildPythonPackage rec {
     # Tests require network access
     "test_server_hostname"
     "test_server_hostname_with_port"
+    "test_get_billing_edition"
+    "test_get_telephony_credits"
+    "test_set_business_billing_edition"
+    "test_set_enterprise_billing_edition"
+    "test_set_telephony_credits"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index 9a5f831023914..c7b41c27823a9 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-ycC6NWvU00yUEHu62H5VLKDEZEHyIo4+TBwj5XaswII=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvc-http/default.nix b/pkgs/development/python-modules/dvc-http/default.nix
index 49737d9b21ce6..efe97c502cec3 100644
--- a/pkgs/development/python-modules/dvc-http/default.nix
+++ b/pkgs/development/python-modules/dvc-http/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-ru/hOFv/RcS/7SBpTJU8xFxdllmaiH4dV1ouS6GGKkY=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvc-objects/default.nix b/pkgs/development/python-modules/dvc-objects/default.nix
index 3a62161c871fd..34848b020c630 100644
--- a/pkgs/development/python-modules/dvc-objects/default.nix
+++ b/pkgs/development/python-modules/dvc-objects/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-JQ3UDUOpuxPavXkoJqbS0T7y3kpwuJ8NvqAl3DahoLU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --benchmark-skip" ""
diff --git a/pkgs/development/python-modules/dvc-render/default.nix b/pkgs/development/python-modules/dvc-render/default.nix
index 1d7de80cf6612..a4527cd1b6c58 100644
--- a/pkgs/development/python-modules/dvc-render/default.nix
+++ b/pkgs/development/python-modules/dvc-render/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-OrfepQuLBNa5m3Sy4NzFOArtFFvaNtNNVJ8DNN3yT6s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvc-studio-client/default.nix b/pkgs/development/python-modules/dvc-studio-client/default.nix
index bfc3cc84e67a9..cc4b2149b1c3d 100644
--- a/pkgs/development/python-modules/dvc-studio-client/default.nix
+++ b/pkgs/development/python-modules/dvc-studio-client/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-ZgjNshF5UFOY5TewNMlJDOajjI1Bfd/a4v7HrAKwaMw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvc-task/default.nix b/pkgs/development/python-modules/dvc-task/default.nix
index 6cec59e72ac1f..9596957b96125 100644
--- a/pkgs/development/python-modules/dvc-task/default.nix
+++ b/pkgs/development/python-modules/dvc-task/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-nrE8PdvzhH7lO0flvNkGC61NOVT4aj2E2gKEDRkp+b4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvclive/default.nix b/pkgs/development/python-modules/dvclive/default.nix
index ebe26e2b057fa..67f70fffb3e0d 100644
--- a/pkgs/development/python-modules/dvclive/default.nix
+++ b/pkgs/development/python-modules/dvclive/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-QsA8HZ6wIWKvtQ+f3nyRKKZRNJS56eZ1sKw+KNHxfXc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dynalite-devices/default.nix b/pkgs/development/python-modules/dynalite-devices/default.nix
index 111e7f69e13cf..bd2c964605f45 100644
--- a/pkgs/development/python-modules/dynalite-devices/default.nix
+++ b/pkgs/development/python-modules/dynalite-devices/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -20,6 +21,14 @@ buildPythonPackage rec {
     hash = "sha256-i88aIsRNsToSceQdwfspJg+Y5MO5zC4O6EkyhrYR27g=";
   };
 
+  patches = [
+    (fetchpatch {
+      # remove asynctest from tests
+      url = "https://github.com/ziv1234/python-dynalite-devices/commit/1729035f2b435b345b4e694aeae5d1823d732208.patch";
+      hash = "sha256-LqFXrJrZTPPjPnWT4+blHFYS3W1fD9T+iwaLUauxjNE=";
+    })
+  ];
+
   postPatch = ''
     sed -i '/^addopts/d' setup.cfg
   '';
diff --git a/pkgs/development/python-modules/echo/default.nix b/pkgs/development/python-modules/echo/default.nix
index a025eb3873084..abf6c957b0479 100644
--- a/pkgs/development/python-modules/echo/default.nix
+++ b/pkgs/development/python-modules/echo/default.nix
@@ -42,8 +42,6 @@ buildPythonPackage rec {
     qtpy
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # collecting ... qt.qpa.xcb: could not connect to display
   # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
   doCheck = false;
diff --git a/pkgs/development/python-modules/edk2-pytool-library/default.nix b/pkgs/development/python-modules/edk2-pytool-library/default.nix
index 4b032f3822018..a42b0cced7cfd 100644
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@@ -55,8 +55,6 @@ buildPythonPackage rec {
     "test_basic_parse"
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonImportsCheck = [ "edk2toollib" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index e93388a1bbcc9..f2e5a4b599a68 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -1,25 +1,51 @@
-{ buildPythonPackage
+{ lib
+, aiohttp
+, buildPythonPackage
+, certifi
+, elastic-transport
 , fetchPypi
-, urllib3, requests
-, nosexcover, mock
-, lib
+, pythonOlder
+, requests
+, urllib3
 }:
 
-buildPythonPackage (rec {
+buildPythonPackage rec {
   pname = "elasticsearch";
-  version = "8.9.0";
+  version = "8.11.0";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-0zZ/wBPgT8eq00mm3p+tHuBPttYnsOeJaqUFwS/eXgQ=";
+    sha256 = "sha256-nghBO+r/Oka8EMbFcGmoRwTfaqqTCFxzffB/WKKBG3g=";
+  };
+
+  nativeBuildInputs = [
+    elastic-transport
+  ];
+
+  propagatedBuildInputs = [
+    urllib3
+    certifi
+  ];
+
+  passthru.optional-dependencies = {
+    requests = [
+      requests
+    ];
+    async = [
+      aiohttp
+    ];
   };
 
+  pythonImportsCheck = [
+    "elasticsearch"
+  ];
+
   # Check is disabled because running them destroy the content of the local cluster!
   # https://github.com/elasticsearch/elasticsearch-py/tree/master/test_elasticsearch
   doCheck = false;
-  propagatedBuildInputs = [ urllib3 requests ];
-  buildInputs = [ nosexcover mock ];
 
   meta = with lib; {
     description = "Official low-level client for Elasticsearch";
@@ -28,4 +54,4 @@ buildPythonPackage (rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ desiderius ];
   };
-})
+}
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
index 99ae071f4ae3c..0f176e45fd077 100644
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "email-validator";
-  version = "2.0.0";
+  version = "2.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "JoshData";
     repo = "python-${pname}";
     rev = "refs/tags/v${version}";
-    hash = "sha256-o7UREa+IBiFjmqx0p+4XJCcoHQ/R6r2RtoezEcWvgbg=";
+    hash = "sha256-58DuQslADM7glrnlSSP6TtIDTlwuS0/GK8+izatqDxI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/emcee/default.nix b/pkgs/development/python-modules/emcee/default.nix
index 3dbf9c9b65460..772fb64d1f14d 100644
--- a/pkgs/development/python-modules/emcee/default.nix
+++ b/pkgs/development/python-modules/emcee/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-K2cPSbR7jnl9Vzf2sEiPZqk2vTwgChNWAf6CAerhZCg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/enaml/default.nix b/pkgs/development/python-modules/enaml/default.nix
index fb192e100c5a9..4479f50659279 100644
--- a/pkgs/development/python-modules/enaml/default.nix
+++ b/pkgs/development/python-modules/enaml/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-DYLDQ9QwdK/a8eY0bFX31UNgxm8FUOaeNAnisFcyFNI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index 35c702ea06d87..07f19e3493d9b 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -2,12 +2,19 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
+, fetchpatch
+, pythonAtLeast
+
+# build-system
+, setuptools
+
+# dependencies
 , dnspython
 , greenlet
 , isPyPy
-, monotonic
 , six
+
+# tests
 , nose3
 , iana-etc
 , pytestCheckHook
@@ -17,7 +24,7 @@
 buildPythonPackage rec {
   pname = "eventlet";
   version = "0.33.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eventlet";
@@ -26,12 +33,25 @@ buildPythonPackage rec {
     hash = "sha256-iSSEZgPkK7RrZfU11z7hUk+JbFsCPH/SD16e+/f6TFU=";
   };
 
+  patches = [
+    # Python 3.12 fixes:
+    # - remove usage of distutils
+    # - replace ssl.wrap_socket usage
+    ./remove-distutils-usage.patch
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/python-eventlet/raw/rawhide/f/python3.12.patch";
+      hash = "sha256-MxzprFaVcV1uamjjTeIz+2gPvfPy+Y1QaA20znMdwoA=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     dnspython
     greenlet
     six
-  ] ++ lib.optionals (pythonOlder "3.5") [
-    monotonic
   ];
 
   nativeCheckInputs = [
@@ -41,7 +61,8 @@ buildPythonPackage rec {
 
   # libredirect is not available on darwin
   # tests hang on pypy indefinitely
-  doCheck = !stdenv.isDarwin && !isPyPy;
+  # nose3 is incompatible with Python 3.12.
+  doCheck = !stdenv.isDarwin && !isPyPy && !(pythonAtLeast "3.12");
 
   preCheck = lib.optionalString doCheck ''
     echo "nameserver 127.0.0.1" > resolv.conf
@@ -95,6 +116,7 @@ buildPythonPackage rec {
   # pythonImportsCheck = [ "eventlet" ];
 
   meta = with lib; {
+    changelog = "https://github.com/eventlet/eventlet/blob/v${version}/NEWS";
     description = "A concurrent networking library for Python";
     homepage = "https://github.com/eventlet/eventlet/";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/eventlet/remove-distutils-usage.patch b/pkgs/development/python-modules/eventlet/remove-distutils-usage.patch
new file mode 100644
index 0000000000000..614a41f0a9785
--- /dev/null
+++ b/pkgs/development/python-modules/eventlet/remove-distutils-usage.patch
@@ -0,0 +1,143 @@
+diff --git a/eventlet/hubs/hub.py b/eventlet/hubs/hub.py
+index db55958..c27b81f 100644
+--- a/eventlet/hubs/hub.py
++++ b/eventlet/hubs/hub.py
+@@ -21,7 +21,7 @@ else:
+ 
+ import eventlet.hubs
+ from eventlet.hubs import timer
+-from eventlet.support import greenlets as greenlet, clear_sys_exc_info
++from eventlet.support import greenlets as greenlet
+ try:
+     from monotonic import monotonic
+ except ImportError:
+@@ -309,7 +309,6 @@ class BaseHub(object):
+                 cur.parent = self.greenlet
+         except ValueError:
+             pass  # gets raised if there is a greenlet parent cycle
+-        clear_sys_exc_info()
+         return self.greenlet.switch()
+ 
+     def squelch_exception(self, fileno, exc_info):
+@@ -397,13 +396,11 @@ class BaseHub(object):
+         if self.debug_exceptions:
+             traceback.print_exception(*exc_info)
+             sys.stderr.flush()
+-            clear_sys_exc_info()
+ 
+     def squelch_timer_exception(self, timer, exc_info):
+         if self.debug_exceptions:
+             traceback.print_exception(*exc_info)
+             sys.stderr.flush()
+-            clear_sys_exc_info()
+ 
+     def add_timer(self, timer):
+         scheduled_time = self.clock() + timer.seconds
+@@ -478,7 +475,6 @@ class BaseHub(object):
+                 raise
+             except:
+                 self.squelch_timer_exception(timer, sys.exc_info())
+-                clear_sys_exc_info()
+ 
+     # for debugging:
+ 
+diff --git a/eventlet/hubs/kqueue.py b/eventlet/hubs/kqueue.py
+index bad4a87..8438805 100644
+--- a/eventlet/hubs/kqueue.py
++++ b/eventlet/hubs/kqueue.py
+@@ -109,4 +109,3 @@ class Hub(hub.BaseHub):
+                 raise
+             except:
+                 self.squelch_exception(fileno, sys.exc_info())
+-                support.clear_sys_exc_info()
+diff --git a/eventlet/hubs/poll.py b/eventlet/hubs/poll.py
+index 1bbd401..d3f9c6a 100644
+--- a/eventlet/hubs/poll.py
++++ b/eventlet/hubs/poll.py
+@@ -113,7 +113,6 @@ class Hub(hub.BaseHub):
+                 raise
+             except:
+                 self.squelch_exception(fileno, sys.exc_info())
+-                support.clear_sys_exc_info()
+ 
+         if self.debug_blocking:
+             self.block_detect_post()
+diff --git a/eventlet/hubs/selects.py b/eventlet/hubs/selects.py
+index 0ead5b8..0386a1e 100644
+--- a/eventlet/hubs/selects.py
++++ b/eventlet/hubs/selects.py
+@@ -61,4 +61,3 @@ class Hub(hub.BaseHub):
+                     raise
+                 except:
+                     self.squelch_exception(fileno, sys.exc_info())
+-                    support.clear_sys_exc_info()
+diff --git a/eventlet/support/__init__.py b/eventlet/support/__init__.py
+index 43bac91..b1c1607 100644
+--- a/eventlet/support/__init__.py
++++ b/eventlet/support/__init__.py
+@@ -30,15 +30,6 @@ def get_errno(exc):
+         return None
+ 
+ 
+-if sys.version_info[0] < 3 and not greenlets.preserves_excinfo:
+-    from sys import exc_clear as clear_sys_exc_info
+-else:
+-    def clear_sys_exc_info():
+-        """No-op In py3k.
+-        Exception information is not visible outside of except statements.
+-        sys.exc_clear became obsolete and removed."""
+-        pass
+-
+ if sys.version_info[0] < 3:
+     def bytes_to_str(b, encoding='ascii'):
+         return b
+diff --git a/eventlet/support/greenlets.py b/eventlet/support/greenlets.py
+index d4e1793..b939328 100644
+--- a/eventlet/support/greenlets.py
++++ b/eventlet/support/greenlets.py
+@@ -1,8 +1,4 @@
+-import distutils.version
+-
+ import greenlet
+ getcurrent = greenlet.greenlet.getcurrent
+ GreenletExit = greenlet.greenlet.GreenletExit
+-preserves_excinfo = (distutils.version.LooseVersion(greenlet.__version__)
+-                     >= distutils.version.LooseVersion('0.3.2'))
+ greenlet = greenlet.greenlet
+diff --git a/setup.py b/setup.py
+index a8f4684..9b927e0 100644
+--- a/setup.py
++++ b/setup.py
+@@ -19,7 +19,7 @@ setuptools.setup(
+     packages=setuptools.find_packages(exclude=['benchmarks', 'tests', 'tests.*']),
+     install_requires=(
+         'dnspython >= 1.15.0',
+-        'greenlet >= 0.3',
++        'greenlet >= 1.0',
+         'monotonic >= 1.4;python_version<"3.5"',
+         'six >= 1.10.0',
+     ),
+diff --git a/tests/hub_test.py b/tests/hub_test.py
+index a531b75..05c0024 100644
+--- a/tests/hub_test.py
++++ b/tests/hub_test.py
+@@ -194,7 +194,6 @@ class TestExceptionInMainloop(tests.LimitedTestCase):
+ 
+ class TestExceptionInGreenthread(tests.LimitedTestCase):
+ 
+-    @skip_unless(greenlets.preserves_excinfo)
+     def test_exceptionpreservation(self):
+         # events for controlling execution order
+         gt1event = eventlet.Event()
+diff --git a/tests/test__refcount.py b/tests/test__refcount.py
+index 1090a1f..5c1c002 100644
+--- a/tests/test__refcount.py
++++ b/tests/test__refcount.py
+@@ -57,7 +57,6 @@ def run_interaction(run_client):
+ 
+ def run_and_check(run_client):
+     w = run_interaction(run_client=run_client)
+-    # clear_sys_exc_info()
+     gc.collect()
+     fd = w()
+     print('run_and_check: weakref fd:', fd)
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index 61eef0a05abee..f19abc446058f 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.1.2";
+  version = "1.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,15 +18,13 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "exceptiongroup";
     rev = version;
-    hash = "sha256-19taP6adzmO4zH2As1OTXeYNFj6KwjhxBr09X+SrZRk=";
+    hash = "sha256-iGeaRVJeFAWfJpwr7N4kST7d8YxpX3WgDqQemlR0cLU=";
   };
 
   nativeBuildInputs = [
     flit-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   doCheck = pythonAtLeast "3.11"; # infinite recursion with pytest
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/executing/default.nix b/pkgs/development/python-modules/executing/default.nix
index 484f5690054ae..aad9455156d1f 100644
--- a/pkgs/development/python-modules/executing/default.nix
+++ b/pkgs/development/python-modules/executing/default.nix
@@ -1,18 +1,23 @@
 { lib
-, asttokens
 , buildPythonPackage
 , fetchFromGitHub
-, littleutils
-, pytestCheckHook
 , pythonAtLeast
 , pythonOlder
-, rich
+
+# build-system
+, setuptools
 , setuptools-scm
+
+# tests
+, asttokens
+, littleutils
+, rich
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "executing";
-  version = "1.2.0";
+  version = "2.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,12 +26,11 @@ buildPythonPackage rec {
     owner = "alexmojaki";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3M3uSJ5xQ5Ciy8Lz21u9zjju/7SBSFHobCqSiJ6AP8M=";
+    hash = "sha256-PBvfkv9GQ5Vj5I5SygtmHXtqqHMJ4XgNV1/I+lSU0/U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -38,6 +42,11 @@ buildPythonPackage rec {
     rich
   ];
 
+  disabledTests = [
+    # requires ipython, which causes a circular dependency
+    "test_two_statement_lookups"
+  ];
+
   pythonImportsCheck = [
     "executing"
   ];
diff --git a/pkgs/development/python-modules/expandvars/default.nix b/pkgs/development/python-modules/expandvars/default.nix
index 60055c6547ba3..14d637fa63cec 100644
--- a/pkgs/development/python-modules/expandvars/default.nix
+++ b/pkgs/development/python-modules/expandvars/default.nix
@@ -2,34 +2,39 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, setuptools
-, wheel
+
+# build-system
+, hatchling
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "expandvars";
-  version = "0.11.0";
+  version = "0.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Q7Qn9dMnqzYAY98mFR+Y0qbwj+GPKJWjKn9fDxF7W1I=";
+    hash = "sha256-fRrfpVcoz0tdgS7OPQh3A/rqlT4MChp4QV3p31Ak2EQ=";
   };
 
   nativeBuildInputs = [
-    setuptools
-    wheel
+    hatchling
   ];
 
-  # The PyPi package does not supply any tests
-  doCheck = false;
-
   pythonImportsCheck = [
     "expandvars"
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+
   meta = with lib; {
     description = "Expand system variables Unix style";
     homepage = "https://github.com/sayanarijit/expandvars";
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index 7f414741b39eb..68e0e4e3b5ea4 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -5,6 +5,7 @@
 , pillow
 , pytestCheckHook
 , python-dateutil
+, setuptools
 , text-unidecode
 , ukpostcodeparser
 , validators
@@ -12,15 +13,19 @@
 
 buildPythonPackage rec {
   pname = "faker";
-  version = "19.6.1";
-  format = "setuptools";
+  version = "20.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "Faker";
     inherit version;
-    hash = "sha256-XWt4gLO+pwgHXd+Rk4QkRT8HBTpZ+PoEU8GHDfb/MpI=";
+    hash = "sha256-Vio6CcPtOhp7IOE9efkE39/F50D3KBPs+V5M9x5aL1I=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-dateutil
     text-unidecode
diff --git a/pkgs/development/python-modules/farm-haystack/default.nix b/pkgs/development/python-modules/farm-haystack/default.nix
index 43988b76e7d55..efc68f4cb0ad3 100644
--- a/pkgs/development/python-modules/farm-haystack/default.nix
+++ b/pkgs/development/python-modules/farm-haystack/default.nix
@@ -286,5 +286,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/deepset-ai/haystack";
     license = licenses.asl20;
     maintainers = with maintainers; [ happysalada ];
+    # https://github.com/deepset-ai/haystack/issues/5304
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/fast-histogram/default.nix b/pkgs/development/python-modules/fast-histogram/default.nix
index 7eb3944d690af..229e448ea704f 100644
--- a/pkgs/development/python-modules/fast-histogram/default.nix
+++ b/pkgs/development/python-modules/fast-histogram/default.nix
@@ -42,8 +42,6 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [ "${builtins.placeholder "out"}/${python.sitePackages}" ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonImportsCheck = [ "fast_histogram" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/fastapi-mail/default.nix b/pkgs/development/python-modules/fastapi-mail/default.nix
index 52d3c44357244..258425e35f852 100644
--- a/pkgs/development/python-modules/fastapi-mail/default.nix
+++ b/pkgs/development/python-modules/fastapi-mail/default.nix
@@ -11,6 +11,7 @@
 , jinja2
 , poetry-core
 , pydantic
+, pydantic-settings
 , pytest-asyncio
 , pytestCheckHook
 , python-multipart
@@ -19,23 +20,23 @@
 
 buildPythonPackage rec {
   pname = "fastapi-mail";
-  version = "1.3.1";
-  format = "pyproject";
+  version = "1.4.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "sabuhish";
-    repo = pname;
+    repo = "fastapi-mail";
     rev = "refs/tags/${version}";
-    hash = "sha256-m8d4y75+mSh9A+YVaV/yZhN3ckOe2mV1jdtfeNFtU/w=";
+    hash = "sha256-2iTZqZIxlt1GKhElasTcnys18UbNNDwHoZziHBOIGBo=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace 'version = "1.2.5"' 'version = "${version}"' \
       --replace 'aiosmtplib = "^2.0"' 'aiosmtplib = "*"' \
-      --replace 'pydantic = "^1.8"' 'pydantic = "*"' \
+      --replace 'pydantic = "^2.0"' 'pydantic = "*"' \
   '';
 
   nativeBuildInputs = [
@@ -52,6 +53,7 @@ buildPythonPackage rec {
     httpx
     jinja2
     pydantic
+    pydantic-settings
     python-multipart
   ];
 
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 428cf9f8d91d1..89c1c2ffbe409 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 
 # build-system
 , hatchling
@@ -31,11 +32,13 @@
 , orjson
 , email-validator
 , uvicorn
+, pydantic-settings
+, pydantic-extra-types
 }:
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.103.1";
+  version = "0.104.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -44,11 +47,18 @@ buildPythonPackage rec {
     owner = "tiangolo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-2J8c3S4Ca+c5bI0tyjMJArJKux9qPmu+ohqve5PhSGI=";
+    hash = "sha256-xTTFBc+fswLYUhKRkWP/eiYSbG3j1E7CASkEtHVNTlk=";
   };
 
   nativeBuildInputs = [
     hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "anyio"
+    # https://github.com/tiangolo/fastapi/pull/9636
+    "starlette"
   ];
 
   propagatedBuildInputs = [
@@ -67,8 +77,9 @@ buildPythonPackage rec {
     orjson
     email-validator
     uvicorn
-    # pydantic-settings
-    # pydantic-extra-types
+  ] ++ lib.optionals (lib.versionAtLeast pydantic.version "2") [
+    pydantic-settings
+    pydantic-extra-types
   ] ++ uvicorn.optional-dependencies.standard;
 
   nativeCheckInputs = [
@@ -87,6 +98,9 @@ buildPythonPackage rec {
     # ignoring deprecation warnings to avoid test failure from
     # tests/test_tutorial/test_testing/test_tutorial001.py
     "-W ignore::DeprecationWarning"
+
+    # http code mismatches
+    "--deselect=tests/test_annotated.py::test_get"
   ];
 
   disabledTestPaths = [
@@ -112,6 +126,10 @@ buildPythonPackage rec {
     "test_warn_duplicate_operation_id"
     # assert state["except"] is True
     "test_dependency_gets_exception"
+    # Fixtures drift
+    "test_openapi_schema_sub"
+    # 200 != 404
+    "test_flask"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index 54a475c08b017..f685d210b87bc 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.8.3";
+  version = "1.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-W+fFZAQU7W6gDqB6LOrG8se6mBATFZWmepTt1HSphbE=";
+    hash = "sha256-10r12Ya+FKMgdOTmgYH1xb6vOXNLLw073VzCvo2x9kg=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/fasteners/default.nix b/pkgs/development/python-modules/fasteners/default.nix
index 38d09c47705cf..3dcdb073aeea6 100644
--- a/pkgs/development/python-modules/fasteners/default.nix
+++ b/pkgs/development/python-modules/fasteners/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "fasteners";
-  version = "0.18";
+  version = "0.19";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "harlowja";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-FGcGGRfObOqXuURyEuNt/KDn51POpdNPUJJKtMcLJNI=";
+    hash = "sha256-XFa1ItFqkSYE940p/imWFp5e9gS6n+D1uM6Cj+Vzmmg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fastjsonschema/default.nix b/pkgs/development/python-modules/fastjsonschema/default.nix
index 8c1be492ec156..93edef365178d 100644
--- a/pkgs/development/python-modules/fastjsonschema/default.nix
+++ b/pkgs/development/python-modules/fastjsonschema/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "fastjsonschema";
-  version = "2.16.2";
+  version = "2.18.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     repo = "python-fastjsonschema";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-Gojayel/xQ5gRI0nbwsroeSMdRndjb+8EniX1Qs4nbg=";
+    hash = "sha256-t6JnqQgsWAL8oL8+LO0xrXMYsZOlTF3DlXkRiqUzYtU=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/fastnumbers/default.nix b/pkgs/development/python-modules/fastnumbers/default.nix
index 7be3e25698ba2..69cdd4c3e3782 100644
--- a/pkgs/development/python-modules/fastnumbers/default.nix
+++ b/pkgs/development/python-modules/fastnumbers/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "fastnumbers";
-  version = "5.0.1";
+  version = "5.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "SethMMorton";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-y9QnFh44zHC+CSlYtKPmkhLSFBUquYZv4qP/pQxu9e0=";
+    hash = "sha256-TC9+xOvskABpChlrSJcHy6O7D7EnIKL6Ekt/vaLBX2E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fastparquet/default.nix b/pkgs/development/python-modules/fastparquet/default.nix
index 05cb76f1dd48f..9105fbd406121 100644
--- a/pkgs/development/python-modules/fastparquet/default.nix
+++ b/pkgs/development/python-modules/fastparquet/default.nix
@@ -32,8 +32,6 @@ buildPythonPackage rec {
     hash = "sha256-pJ0zK0upEV7TyuNMIcozugkwBlYpK/Dg6BdB0kBpn9k=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     cython
     oldest-supported-numpy
diff --git a/pkgs/development/python-modules/filecheck/default.nix b/pkgs/development/python-modules/filecheck/default.nix
index b7b9c2948ae2e..9d8c22756fb9a 100644
--- a/pkgs/development/python-modules/filecheck/default.nix
+++ b/pkgs/development/python-modules/filecheck/default.nix
@@ -1,30 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, poetry-core
+, hatchling
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "filecheck";
-  version = "0.0.23";
+  version = "0.0.24";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "mull-project";
     repo = "FileCheck.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-R+e4Z1EX6Nk7INLar3gtkUpk+30xIJO7yiZbUvrhN74=";
+    hash = "sha256-VbMlCqGd3MVpj0jEKjSGC2L0s/3e/d53b+2eZcXZneo=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "poetry>=0.12" "poetry-core" \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api"
-  '';
-
   nativeBuildInputs = [
-    poetry-core
+    hatchling
   ];
 
   nativeCheckInputs = [
@@ -36,6 +30,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/mull-project/FileCheck.py/releases/tag/v${version}";
     homepage = "https://github.com/mull-project/FileCheck.py";
     license = licenses.asl20;
     description = "Python port of LLVM's FileCheck, flexible pattern matching file verifier";
diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index 74cd6e727dbd6..b32335bb24754 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "3.12.4";
+  version = "3.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Lm8knx82VCkWBuBGsJ8f1erDmzYGZMJ/Wq0HIBL4vL0=";
+    hash = "sha256-Uh9fVsUPhCb14DrTsoG0kKh+8VvGxSbxaCkPDHFI1E4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flasgger/default.nix b/pkgs/development/python-modules/flasgger/default.nix
index 4bb5e9fe30d96..1be41854b52ea 100644
--- a/pkgs/development/python-modules/flasgger/default.nix
+++ b/pkgs/development/python-modules/flasgger/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
       url = "https://github.com/flasgger/flasgger/commit/ab77be7c6de1d4b361f0eacfa37290239963f890.patch";
       hash = "sha256-ZbE5pPUP23nZAP/qcdeWkwzrZgqJSRES7oFta8U1uVQ=";
     })
+    (fetchpatch {
+      # python 3.12 compat
+      url = "https://github.com/flasgger/flasgger/commit/6f5fcf24c1d816cf7ab529b3a8a764f86df4458d.patch";
+      hash = "sha256-37Es1sgBQ9qX3YHQYub4HJkSNTSt3MbtCfV+XdTQZyY=";
+    })
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-appbuilder/default.nix b/pkgs/development/python-modules/flask-appbuilder/default.nix
index 6309e0ddd2c07..68c9895f2b905 100644
--- a/pkgs/development/python-modules/flask-appbuilder/default.nix
+++ b/pkgs/development/python-modules/flask-appbuilder/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "flask-appbuilder";
-  version = "4.3.6";
+  version = "4.3.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Flask-AppBuilder";
     inherit version;
-    hash = "sha256-jKlxD6fScEdH0ZXhG0h9RaVx9AVZ2DmdnV36QuofPHg=";
+    hash = "sha256-QXPIeOVrgcasrF48gMEz9Bg/Q0Qv2URVK9n0Aj9brOs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-assets/default.nix b/pkgs/development/python-modules/flask-assets/default.nix
index 33caa223ea3bc..def8f7b7754fb 100644
--- a/pkgs/development/python-modules/flask-assets/default.nix
+++ b/pkgs/development/python-modules/flask-assets/default.nix
@@ -1,14 +1,22 @@
-{ lib, buildPythonPackage, fetchPypi, flask, webassets, flask-script, nose }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, flask
+, webassets
+, flask-script
+, nose
+}:
 
 buildPythonPackage rec {
   pname = "flask-assets";
-  version = "2.0";
-  format = "setuptools";
+  version = "2.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "Flask-Assets";
     inherit version;
-    hash = "sha256-Hf3qNeQHRNRqracoMfdhPWe/OOiyDMqqnpH9w3qjuMI=";
+    hash = "sha256-+E1lMv/lnJ/zUoheh0D/TaJcC8+s2AXwqAaBXkQ1SBM=";
   };
 
   patchPhase = ''
@@ -17,7 +25,16 @@ buildPythonPackage rec {
     substituteInPlace tests/test_integration.py --replace "'/foo'" "'/x/foo'"
   '';
 
-  propagatedBuildInputs = [ flask webassets flask-script nose ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    flask
+    webassets
+    flask-script
+    nose
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/miracle2k/flask-assets";
diff --git a/pkgs/development/python-modules/flask-compress/default.nix b/pkgs/development/python-modules/flask-compress/default.nix
index fe23711495238..2810ab2270081 100644
--- a/pkgs/development/python-modules/flask-compress/default.nix
+++ b/pkgs/development/python-modules/flask-compress/default.nix
@@ -43,8 +43,6 @@ buildPythonPackage rec {
     "flask_compress"
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   meta = with lib; {
     description = "Compress responses in your Flask app with gzip, deflate or brotli";
     homepage = "https://github.com/colour-science/flask-compress";
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
index a904f4f2c6bb7..b8f375dbcf091 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pythonOlder
 , setuptools
+, pydantic
 
 # extras: babel
 , babel
@@ -127,5 +128,7 @@ buildPythonPackage rec {
     description = "Simple security for Flask apps (fork)";
     license = licenses.mit;
     maintainers = with maintainers; [ gador ];
+    # https://github.com/Flask-Middleware/flask-security/pull/851
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/flask-sqlalchemy/default.nix b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
index 7146c38e5a30d..7f1775418f1c1 100644
--- a/pkgs/development/python-modules/flask-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
@@ -5,6 +5,7 @@
 , mock
 , flit-core
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , sqlalchemy
 }:
@@ -43,6 +44,11 @@ buildPythonPackage rec {
     "test_persist_selectable"
   ];
 
+  pytestFlagsArray = lib.optionals (pythonAtLeast "3.12") [
+    # datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version.
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   pythonImportsCheck = [
     "flask_sqlalchemy"
   ];
diff --git a/pkgs/development/python-modules/flit-scm/default.nix b/pkgs/development/python-modules/flit-scm/default.nix
index 6b7c57100017c..24075891c61e9 100644
--- a/pkgs/development/python-modules/flit-scm/default.nix
+++ b/pkgs/development/python-modules/flit-scm/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-2nx9kWq/2TzauOW+c67g9a3JZ2dhBM4QzKyK/sqWOPo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     flit-core
     setuptools-scm
diff --git a/pkgs/development/python-modules/flow-record/default.nix b/pkgs/development/python-modules/flow-record/default.nix
index f52dee034d57e..4dbce567c700b 100644
--- a/pkgs/development/python-modules/flow-record/default.nix
+++ b/pkgs/development/python-modules/flow-record/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-8XQeXfrgTk+jHR1ABlEEIn3E/MkUkGnvkgzePws4qhQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/folium/default.nix b/pkgs/development/python-modules/folium/default.nix
index d5384fc221c60..3efaaa38cbe1c 100644
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@@ -32,8 +32,6 @@ buildPythonPackage rec {
     hash = "sha256-CHPHxp8xEZhEEMLvhs/xAiOr2Hw6B+5svFNY+QvQa+U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index 3c167debba37c..db66e46f3d9d4 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "fonttools";
-  version = "4.42.1";
+  version = "4.46.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner  = pname;
     repo   = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-fcFFJi9Hr0m74LwFIhhhm/bMfxepAvg4/ymU53MmsPg=";
+    hash = "sha256-QpC1OWpqhJpzS59OG8A/nndWDoeYyAFUTIcsppLzM8Y=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/formulaic/default.nix b/pkgs/development/python-modules/formulaic/default.nix
index a90c6b9f8d982..f6aa82c9682c5 100644
--- a/pkgs/development/python-modules/formulaic/default.nix
+++ b/pkgs/development/python-modules/formulaic/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-qivWv1LtFkW55tVKD/Zjd8Q5gVbxhDpZ0inkV6NR7bA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/fpylll/default.nix b/pkgs/development/python-modules/fpylll/default.nix
index 8450d4b78c01e..2de77cfbd69d9 100644
--- a/pkgs/development/python-modules/fpylll/default.nix
+++ b/pkgs/development/python-modules/fpylll/default.nix
@@ -1,30 +1,42 @@
-{ stdenv
-, lib
+{ lib
 , fetchFromGitHub
 , buildPythonPackage
+
+# build-system
+, cysignals
+, cython_3
 , pkgconfig
+, setuptools
+
 , gmp
 , pari
 , mpfr
 , fplll
-, cython
-, cysignals
 , numpy
-, pytest
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "fpylll";
-  version = "0.5.9";
-  format = "setuptools";
+  version = "0.6.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fplll";
     repo = "fpylll";
-    rev = version;
-    hash = "sha256-T6l6hKzRDevlLyLu5H+bnEdl0OhsPer1coCDiftbPAk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-EyReCkVRb3CgzIRal5H13OX/UdwWi+evDe7PoS1qP4A=";
   };
 
+  nativeBuildInputs = [
+    cython_3
+    cysignals
+    pkgconfig
+    setuptools
+  ];
+
   buildInputs = [
     gmp
     pari
@@ -33,25 +45,19 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    cython
-    cysignals
     numpy
   ];
 
-  nativeBuildInputs = [
-    pkgconfig
-  ];
-
   nativeCheckInputs = [
-    pytest
+    pytestCheckHook
   ];
 
-  checkPhase = ''
+  preCheck = ''
     # Since upstream introduced --doctest-modules in
     # https://github.com/fplll/fpylll/commit/9732fdb40cf1bd43ad1f60762ec0a8401743fc79,
     # it is necessary to ignore import mismatches. Not sure why, but the files
     # should be identical anyway.
-    PY_IGNORE_IMPORTMISMATCH=1 pytest
+    export PY_IGNORE_IMPORTMISMATCH=1
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/freezegun/default.nix b/pkgs/development/python-modules/freezegun/default.nix
index 112b5210173b1..e8c564a477bab 100644
--- a/pkgs/development/python-modules/freezegun/default.nix
+++ b/pkgs/development/python-modules/freezegun/default.nix
@@ -1,31 +1,26 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
 , pytestCheckHook
 , python-dateutil
-, pythonAtLeast
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "freezegun";
-  version = "1.2.2";
-  format = "setuptools";
+  version = "1.3.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zSLRugaUE4RBDNln2KmdWuJEL1ffr+/y/aXejcXAVEY=";
+    hash = "sha256-SJhDl7O1jvXfxkXWowSwBg9hK87P2q9Fzor/AHemy2o=";
   };
 
-  patches = lib.optionals (pythonAtLeast "3.10") [
-    # Staticmethods in 3.10+ are now callable, prevent freezegun to attempt to decorate them
-    (fetchpatch {
-      url = "https://github.com/spulec/freezegun/pull/397/commits/e63874ce75a74a1159390914045fe8e7955b24c4.patch";
-      hash = "sha256-FNABqVN5DFqVUR88lYzwbfsZj3xcB9/MvQtm+I2VjnI=";
-    })
+  nativeBuildInputs = [
+    setuptools
   ];
 
   propagatedBuildInputs = [
@@ -43,6 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library that allows your Python tests to travel through time";
     homepage = "https://github.com/spulec/freezegun";
+    changelog = "https://github.com/spulec/freezegun/blob/${version}/CHANGELOG";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ftfy/default.nix b/pkgs/development/python-modules/ftfy/default.nix
index 14a356e21e224..f0a096ae87d98 100644
--- a/pkgs/development/python-modules/ftfy/default.nix
+++ b/pkgs/development/python-modules/ftfy/default.nix
@@ -1,23 +1,34 @@
 { lib
 , buildPythonPackage
-, isPy3k
 , fetchPypi
+, pythonOlder
+
+# build-system
+, poetry-core
+
+# dependencies
 , wcwidth
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "ftfy";
-  version = "6.1.1";
-  format = "setuptools";
+  version = "6.1.3";
+  pyproject = true;
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v8IBn4T82FFBkVIyCmN1YEoPFFnCgbWxmbLNDS5yf48=";
+    hash = "sha256-aTJ0rq2BHP8kweh4QWWqdVzS9uRCpexTXH1pf2QipCI=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     wcwidth
   ];
diff --git a/pkgs/development/python-modules/fugashi/default.nix b/pkgs/development/python-modules/fugashi/default.nix
index 264771ed5a4b3..021ac6dd1d118 100644
--- a/pkgs/development/python-modules/fugashi/default.nix
+++ b/pkgs/development/python-modules/fugashi/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-4i7Q+TtXTQNSJ1EIcS8KHrVPdCJAgZh86Y6lB8772XU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ cython mecab setuptools-scm ];
 
   nativeCheckInputs = [ ipadic pytestCheckHook ]
diff --git a/pkgs/development/python-modules/future/default.nix b/pkgs/development/python-modules/future/default.nix
index 7c4a5507b5404..7c6c21d4d356e 100644
--- a/pkgs/development/python-modules/future/default.nix
+++ b/pkgs/development/python-modules/future/default.nix
@@ -1,19 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
+
+# build-system
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "future";
   version = "0.18.3";
-
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-NKF0Nu0elml6hvnePRWjsL4B2LyN6cHf/Vn7gjTtUwc=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/PythonCharmers/python-future/commit/1901c1c347bcad603e8404b64656994eb2cc0439.patch";
+      hash = "sha256-wUSWVs7+KTsTmEM4OkpViAjDGWqx5h0SLPIacMZCpWU=";
+      excludes = [
+        "build.sh"
+        "docs/whatsnew.rst"
+      ];
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = [
     "future.builtins"
     "future.moves"
diff --git a/pkgs/development/python-modules/galois/default.nix b/pkgs/development/python-modules/galois/default.nix
index 2273e6bd6eff1..cfb4ac57d5636 100644
--- a/pkgs/development/python-modules/galois/default.nix
+++ b/pkgs/development/python-modules/galois/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-dWYnD+Byh0orRg20/nhu8ILooFBeHysxQ403boDVqYk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
     pythonRelaxDepsHook
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index 62319647e3941..39904aec9363c 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -40,10 +40,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ passthru.optional-dependencies.shapely;
 
-  env = {
-    SETUPTOOLS_SCM_PRETEND_VERSION = version;
-  };
-
   disabledTestPaths = [
     # tests require live databases
     "tests/gallery/test_decipher_raster.py"
diff --git a/pkgs/development/python-modules/geocachingapi/default.nix b/pkgs/development/python-modules/geocachingapi/default.nix
index 61e2a1f7a80ab..d7ad9cb5fd8a0 100644
--- a/pkgs/development/python-modules/geocachingapi/default.nix
+++ b/pkgs/development/python-modules/geocachingapi/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     aiohttp
     backoff
diff --git a/pkgs/development/python-modules/geojson/default.nix b/pkgs/development/python-modules/geojson/default.nix
index 69cd2ed30653f..28e05315861da 100644
--- a/pkgs/development/python-modules/geojson/default.nix
+++ b/pkgs/development/python-modules/geojson/default.nix
@@ -1,22 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, glibcLocales
+, setuptools
 , unittestCheckHook
  }:
 
 buildPythonPackage rec {
   pname = "geojson";
-  version = "3.0.1";
-  format = "setuptools";
+  version = "3.1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "geojson";
     rev = "refs/tags/${version}";
-    hash = "sha256-VlP/odzRH6Eg0BMZPBQkbHL/O2cIwWTKJcL5SfZoUWQ=";
+    hash = "sha256-OL+7ntgzpA63ALQ8whhKRePsKxcp81PLuU1bHJvxN9U=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = [
     "geojson"
   ];
diff --git a/pkgs/development/python-modules/geopy/default.nix b/pkgs/development/python-modules/geopy/default.nix
index 52adbbe07eed2..4616dd3866c8d 100644
--- a/pkgs/development/python-modules/geopy/default.nix
+++ b/pkgs/development/python-modules/geopy/default.nix
@@ -1,10 +1,10 @@
 { lib
-, async-generator
 , buildPythonPackage
 , docutils
 , fetchFromGitHub
 , geographiclib
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , pytz
 }:
@@ -27,7 +27,6 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    async-generator
     docutils
     pytestCheckHook
     pytz
@@ -38,6 +37,10 @@ buildPythonPackage rec {
     "test_user_agent_default"
   ];
 
+  disabledTestPaths = lib.optionals (pythonAtLeast "3.12") [
+    "test/test_init.py"
+  ];
+
   pytestFlagsArray = [ "--skip-tests-requiring-internet" ];
 
   pythonImportsCheck = [ "geopy" ];
diff --git a/pkgs/development/python-modules/geventhttpclient/default.nix b/pkgs/development/python-modules/geventhttpclient/default.nix
index 906fcdbdb6080..ad732575b4e12 100644
--- a/pkgs/development/python-modules/geventhttpclient/default.nix
+++ b/pkgs/development/python-modules/geventhttpclient/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "geventhttpclient";
-  version = "2.0.10";
+  version = "2.0.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-t8l7JlEZV6NqiU7FRlHAiJCmnhGLaXVfjnS/w3xjORs=";
+    hash = "sha256-VJ0POvCEILmtK+7aIRFTx2BbW6QJsijbfxuByL++xrQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gitdb/default.nix b/pkgs/development/python-modules/gitdb/default.nix
index dc6be575153c6..996387f45135c 100644
--- a/pkgs/development/python-modules/gitdb/default.nix
+++ b/pkgs/development/python-modules/gitdb/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , setuptools
 , smmap
 }:
@@ -21,6 +22,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "smmap"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gitpython/default.nix b/pkgs/development/python-modules/gitpython/default.nix
index 43925e357a90a..50afd5ea4aa86 100644
--- a/pkgs/development/python-modules/gitpython/default.nix
+++ b/pkgs/development/python-modules/gitpython/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "gitpython";
-  version = "3.1.37";
+  version = "3.1.40";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "gitpython-developers";
     repo = "GitPython";
     rev = "refs/tags/${version}";
-    hash = "sha256-w3aSgIaD6tkxhYctkvvsdKlWXS8xU4+F0cCYeYTNHig=";
+    hash = "sha256-a5Ez6SuSqrJE306FrFjEnSoVhALVvubF1pLW4awK4gM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/glueviz/default.nix b/pkgs/development/python-modules/glueviz/default.nix
index e066240fa6e0b..bb25d2edd3a91 100644
--- a/pkgs/development/python-modules/glueviz/default.nix
+++ b/pkgs/development/python-modules/glueviz/default.nix
@@ -65,8 +65,6 @@ buildPythonPackage rec {
 
   dontConfigure = true;
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # collecting ... qt.qpa.xcb: could not connect to display
   # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
   doCheck = false;
diff --git a/pkgs/development/python-modules/glyphslib/default.nix b/pkgs/development/python-modules/glyphslib/default.nix
index 054f5db667f1f..7cf9adbb3bf6e 100644
--- a/pkgs/development/python-modules/glyphslib/default.nix
+++ b/pkgs/development/python-modules/glyphslib/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-2Y7JhaZJXKERQXEI9cDCx7m95El6AicU0t+X3Gntbxk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-api-core/default.nix b/pkgs/development/python-modules/google-api-core/default.nix
index 9df9562c3d15e..76fbdf7fa4254 100644
--- a/pkgs/development/python-modules/google-api-core/default.nix
+++ b/pkgs/development/python-modules/google-api-core/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-api-core";
-  version = "2.11.1";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JdKeBaAFjtXxnGHAp4sbU63qTZNktGTQFPvalB9tHJo=";
+    hash = "sha256-U2ikUCt5PZu/gSpZEuE+Tmn5vYf277UIRgxD9bvRzkE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-api-python-client/default.nix b/pkgs/development/python-modules/google-api-python-client/default.nix
index ecf2b36ab9db5..b6f73cc406ebc 100644
--- a/pkgs/development/python-modules/google-api-python-client/default.nix
+++ b/pkgs/development/python-modules/google-api-python-client/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-api-python-client";
-  version = "2.99.0";
+  version = "2.109.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5zP9DyyHk7GgANXmmsgbG57AZltEW37YO9u7ADiXMwY=";
+    hash = "sha256-0GOQwlR3w2HVJjn+AO+RLD+rja/H+/KVgMEUTpJSOnk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 7edbedb80c6a3..5eeb88cd9d0f9 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.11.4";
+  version = "3.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aX3xFyQaIoO8u5OyHhC63BTlHJqQgA0qfho+HH2EKXQ=";
+    hash = "sha256-eUzPyTzLDgrWiUQviW+cgt5W2g/hihlVMbs3CWwmV9Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-iam/default.nix b/pkgs/development/python-modules/google-cloud-iam/default.nix
index ec412c732dddc..9e1ca821bdae7 100644
--- a/pkgs/development/python-modules/google-cloud-iam/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam";
-  version = "2.12.1";
+  version = "2.12.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/lBwhUR+z0Ydr9LNS4AWxYmeWOUgvQS1G7Orb2sI+v8=";
+    hash = "sha256-YDHQwZEfx5zguLuPb+FkUoO5wakYi0g9rmI7U7TYGBw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index 5daa5fe466f61..32949b14c332c 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-kms";
-  version = "2.19.1";
+  version = "2.19.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ia3XCpLUXJ93AGEHdDaOidQEagUkMVAnb2UYK+ktzKc=";
+    hash = "sha256-F6UDRZLoXvADHSW75YlL2y1xlGCFWYC/62iqTo/8Er0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index ebcb32bf2b455..42ffe46a97b76 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -11,21 +11,32 @@
 , protobuf
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , requests
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "2.10.0";
-  format = "setuptools";
+  version = "2.13.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-k0sx6tXzmU5TYPn/V1CYLFtrEWBNwHK8RSwlll4Hbcc=";
+    hash = "sha256-9i3Ex7bNQ2DQcuPesoA1+9rUkaw9mwsYFaEtrqEPN8c=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "google-auth"
+  ];
+
   propagatedBuildInputs = [
     google-auth
     google-cloud-core
diff --git a/pkgs/development/python-modules/googleapis-common-protos/default.nix b/pkgs/development/python-modules/googleapis-common-protos/default.nix
index 60233f91fbbcb..e8a469e51b06f 100644
--- a/pkgs/development/python-modules/googleapis-common-protos/default.nix
+++ b/pkgs/development/python-modules/googleapis-common-protos/default.nix
@@ -1,21 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , grpc
 , protobuf
 }:
 
 buildPythonPackage rec {
   pname = "googleapis-common-protos";
-  version = "1.60.0";
-  format = "setuptools";
+  version = "1.61.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5z67QECY20BbqV0eGuCqkcPhWnHaAxou62suI+e8Nwg=";
+    hash = "sha256-imSGapf2MEpxeYc6Rl1u7pe3ok7Gz9eOD1delrghJAs=";
   };
 
-  propagatedBuildInputs = [ grpc protobuf ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    grpc
+    protobuf
+  ];
 
   # does not contain tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/gpsoauth/default.nix b/pkgs/development/python-modules/gpsoauth/default.nix
index 80b8350410f1d..e8b84b492bcae 100644
--- a/pkgs/development/python-modules/gpsoauth/default.nix
+++ b/pkgs/development/python-modules/gpsoauth/default.nix
@@ -1,24 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pycryptodomex
 , pythonOlder
 , requests
 }:
 
 buildPythonPackage rec {
-  version = "1.0.2";
-  format = "setuptools";
   pname = "gpsoauth";
+  version = "1.0.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-68rnLrMlp/BsvqlbnV5kvsJTcDEtsV6OLkbE1U5ynno=";
+    hash = "sha256-SWYXNYrnzK8P4oK9f7bmOiVdWUQHp8WvhNzIS7Y0msg=";
   };
 
-  propagatedBuildInputs = [ pycryptodomex requests ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    pycryptodomex
+    requests
+  ];
 
   # upstream tests are not very comprehensive
   doCheck = false;
diff --git a/pkgs/development/python-modules/gpytorch/default.nix b/pkgs/development/python-modules/gpytorch/default.nix
index e4ce55bb2c843..c4664bc04ee7a 100644
--- a/pkgs/development/python-modules/gpytorch/default.nix
+++ b/pkgs/development/python-modules/gpytorch/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-cpkfjx5G/4duL1Rr4nkHTHi03TDcYbcx3bKP2Ny7Ijo=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/gradio-pdf/default.nix b/pkgs/development/python-modules/gradio-pdf/default.nix
new file mode 100644
index 0000000000000..d2bbfecefdc38
--- /dev/null
+++ b/pkgs/development/python-modules/gradio-pdf/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, hatch-fancy-pypi-readme
+, hatch-requirements-txt
+, hatchling
+, gradio
+, gradio-client
+}:
+
+buildPythonPackage rec {
+  pname = "gradio-pdf";
+  version = "0.0.3";
+  format = "pyproject";
+
+  src = fetchPypi {
+    pname = "gradio_pdf";
+    inherit version;
+    hash = "sha256-l9bcH/6paEdKk9Q7HM3ap9MI1Qi7rPZ/ucAibBUEPKI=";
+  };
+
+  nativeBuildInputs = [
+    hatch-fancy-pypi-readme
+    hatch-requirements-txt
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    gradio-client
+  ];
+
+  buildInputs = [
+    gradio.sans-reverse-dependencies
+  ];
+  disallowedReferences = [
+    gradio.sans-reverse-dependencies
+  ];
+
+  pythonImportsCheck = [ "gradio_pdf" ];
+
+  # tested in `gradio`
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Python library for easily interacting with trained machine learning models";
+    homepage = "https://pypi.org/project/gradio-pdf/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index ce866a67b4cc2..e68f793f73012 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -20,28 +20,14 @@
 , pytestCheckHook
 , pytest-asyncio
 , pydub
+, rich
+, tomlkit
 , gradio
 }:
 
-let
-
-  # Cyclic dependencies are fun!
-  # This is gradio without gradio-client, only needed for checkPhase
-  gradio' = (gradio.override (old: {
-    gradio-client = null;
-  })).overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pythonRelaxDepsHook ];
-    pythonRemoveDeps = (old.pythonRemoveDeps or []) ++ [ "gradio_client" ];
-    doInstallCheck = false;
-    doCheck = false;
-    pythonImportsCheck = null;
-  });
-
-in
-
 buildPythonPackage rec {
-  pname = "gradio_client";
-  version = "0.5.0";
+  pname = "gradio-client";
+  version = "0.7.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -51,18 +37,26 @@ buildPythonPackage rec {
     owner = "gradio-app";
     repo = "gradio";
     #rev = "refs/tags/v${gradio.version}";
-    rev = "ba4c6d9e65138c97062d1757d2a588c4fc449daa"; # v3.43.1 is not tagged...
+    rev = "dc131b64f05062447643217819ca630e483a11df"; # v4.9.1 is not tagged...
     sparseCheckout = [ "client/python" ];
-    hash = "sha256-savka4opyZKSWPeBqc2LZqvwVXLYIZz5dS1OWJSwvHo=";
+    hash = "sha256-Zp1Zl53Va0pyyZEHDUpnldi4dtH2uss7PZQD+Le8+cA=";
   };
   prePatch = ''
     cd client/python
   '';
 
+  # upstream adds upper constraints because they can, not because the need to
+  # https://github.com/gradio-app/gradio/pull/4885
+  pythonRelaxDeps = [
+    # only backward incompat is dropping py3.7 support
+    "websockets"
+  ];
+
   nativeBuildInputs = [
     hatchling
     hatch-requirements-txt
     hatch-fancy-pypi-readme
+    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
@@ -71,20 +65,20 @@ buildPythonPackage rec {
     httpx
     huggingface-hub
     packaging
-    requests
     typing-extensions
     websockets
   ];
 
-  nativeCheckInputs =[
+  nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio
     pydub
-    gradio'
-  ];
-  disallowedReferences = [
-    gradio' # ensuring we don't propagate this intermediate build
+    rich
+    tomlkit
+    gradio.sans-reverse-dependencies
   ];
+  # ensuring we don't propagate this intermediate build
+  disallowedReferences = [ gradio.sans-reverse-dependencies ];
 
   # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
   preCheck = ''
@@ -94,7 +88,7 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [
     "test/"
-    #"-m" "not flaky" # doesn't work, even when advertised
+    "-m 'not flaky'"
     #"-x" "-W" "ignore" # uncomment for debugging help
   ];
 
diff --git a/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
index 4738de3175526..eb2385bca8d6f 100644
--- a/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
+++ b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
@@ -28,6 +28,8 @@ def pytest_runtest_makereport(item, call):
         for exc in iterate_exc_chain(call.excinfo.value):
             if isinstance(exc, NixNetworkAccessDeniedError):
                 tr.outcome, tr.wasxfail = 'skipped', "reason: Requires network access."
+            if isinstance(exc, httpx.ConnectError):
+                tr.outcome, tr.wasxfail = 'skipped', "reason: Requires network access."
             if isinstance(exc, FileNotFoundError):  # gradio specific
                 tr.outcome, tr.wasxfail = 'skipped', "reason: Pypi dist bad."
     return tr
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 19474d8d9fbfe..78e6f99505e3b 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -3,6 +3,8 @@
 , fetchPypi
 , pythonOlder
 , pythonRelaxDepsHook
+, writeShellScriptBin
+, gradio
 
 # pyproject
 , hatchling
@@ -31,15 +33,16 @@
 , python-multipart
 , pydub
 , pyyaml
-, requests
 , semantic-version
 , typing-extensions
 , uvicorn
-, websockets
+, typer
+, tomlkit
 
 # check
 , pytestCheckHook
 , boto3
+, gradio-pdf
 , ffmpeg
 , ipython
 , pytest-asyncio
@@ -53,23 +56,30 @@
 
 buildPythonPackage rec {
   pname = "gradio";
-  version = "3.44.3";
+  version = "4.9.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  # We use the Pypi release, as it provides prebuilt webui assets,
-  # and has more frequent releases compared to github tags
+  # We use the Pypi release, since it provides prebuilt webui assets,
+  # and upstream has stopped tagging releases since 3.41.0
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3mXs9PwlzUo89VosBWtnsOzDQf/T22Yv7s5j6OLLp3M=";
+    hash = "sha256-KosxlmU5pYvuy5zysscuWM25IGXin7RLGEM9V2xPQrU=";
   };
 
   # fix packaging.ParserSyntaxError, which can't handle comments
   postPatch = ''
     sed -ie "s/ #.*$//g" requirements*.txt
+
+    # they bundle deps?
+    rm -rf venv/
   '';
 
+  pythonRelaxDeps = [
+    "tomlkit"
+  ];
+
   nativeBuildInputs = [
     pythonRelaxDepsHook
     hatchling
@@ -99,16 +109,17 @@ buildPythonPackage rec {
     python-multipart
     pydub
     pyyaml
-    requests
     semantic-version
     typing-extensions
     uvicorn
-    websockets
-  ];
+    typer
+    tomlkit
+  ] ++ typer.passthru.optional-dependencies.all;
 
   nativeCheckInputs = [
     pytestCheckHook
     boto3
+    gradio-pdf
     ffmpeg
     ipython
     pytest-asyncio
@@ -119,7 +130,10 @@ buildPythonPackage rec {
     tqdm
     transformers
     vega-datasets
-  ];
+
+    # mock npm to make `shutil.which("npm")` pass
+    (writeShellScriptBin "npm" "false")
+  ] ++ pydantic.passthru.optional-dependencies.email;
 
   # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
   # We additionally xfail FileNotFoundError, since the gradio devs often fail to upload test assets to pypi.
@@ -148,12 +162,14 @@ buildPythonPackage rec {
     "test_shapley_text"
   ];
   disabledTestPaths = [
+    # 100% touches network
+    "test/test_networking.py"
     # makes pytest freeze 50% of the time
     "test/test_interfaces.py"
   ];
   pytestFlagsArray = [
     "-x"  # abort on first failure
-    #"-m" "not flaky" # doesn't work, even when advertised
+    "-m 'not flaky'"
     #"-W" "ignore" # uncomment for debugging help
   ];
 
@@ -165,6 +181,23 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "gradio" ];
 
+  # Cyclic dependencies are fun!
+  # This is gradio without gradio-client and gradio-pdf
+  passthru = {
+    sans-reverse-dependencies = (gradio.override (old: {
+      gradio-client = null;
+      gradio-pdf = null;
+    })).overridePythonAttrs (old: {
+      pname = old.pname + "-sans-client";
+      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pythonRelaxDepsHook ];
+      pythonRemoveDeps = (old.pythonRemoveDeps or []) ++ [ "gradio-client" ];
+      doInstallCheck = false;
+      doCheck = false;
+      pythonImportsCheck = null;
+      dontCheckRuntimeDeps = true;
+    });
+  };
+
   meta = with lib; {
     homepage = "https://www.gradio.app/";
     description = "Python library for easily interacting with trained machine learning models";
diff --git a/pkgs/development/python-modules/graphviz/default.nix b/pkgs/development/python-modules/graphviz/default.nix
index 6af54cbb6d6da..8f145c13e7220 100644
--- a/pkgs/development/python-modules/graphviz/default.nix
+++ b/pkgs/development/python-modules/graphviz/default.nix
@@ -3,11 +3,13 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , graphviz
 , xdg-utils
 , makeFontsConf
 , freefont_ttf
+, setuptools
 , mock
 , pytest
 , pytest-mock
@@ -17,7 +19,7 @@
 buildPythonPackage rec {
   pname = "graphviz";
   version = "0.20.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -35,6 +37,12 @@ buildPythonPackage rec {
       inherit graphviz;
       xdgutils = xdg-utils;
     })
+    # https://github.com/xflr6/graphviz/issues/209
+    (fetchpatch {
+      name = "fix-tests-with-python312.patch";
+      url = "https://github.com/xflr6/graphviz/commit/5ce9fc5de4f2284baa27d7a8d68ab0885d032868.patch";
+      hash = "sha256-jREPACSc4aoHY3G+39e8Axqajw4eeKkAeVu2s40v1nI=";
+    })
   ];
 
   postPatch = ''
@@ -46,6 +54,10 @@ buildPythonPackage rec {
     fontDirectories = [ freefont_ttf ];
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     mock
     pytest
diff --git a/pkgs/development/python-modules/graspologic/default.nix b/pkgs/development/python-modules/graspologic/default.nix
index 513a60bd432e9..745cf90b4b9e6 100644
--- a/pkgs/development/python-modules/graspologic/default.nix
+++ b/pkgs/development/python-modules/graspologic/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPy27
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 , pytest-cov
 , hyppo
@@ -15,8 +16,8 @@
 
 buildPythonPackage rec {
   pname = "graspologic";
-  version = "3.2.0";
-  format = "setuptools";
+  version = "3.3.0";
+  pyproject = true;
 
   disabled = isPy27;
 
@@ -24,9 +25,13 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "graspologic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yXhEI/8qm526D+Ehqqfb+j+sbbh83Q4OWC+UM7cgCjU=";
+    hash = "sha256-hd3OyV95N8vhc4s50HbKkrcUOeSegn66Dkw7dixim00=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     hyppo
     matplotlib
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index 98c9b5bf302fc..3bbaf7e8ab356 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-j0j13bJtHlPc00pjmfpg/QJKzYQQcyA+jE7q538Uu08=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     pdm-backend
   ];
diff --git a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
index 96be86458422a..e94278fec3104 100644
--- a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
+++ b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
@@ -1,21 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , grpcio
 , googleapis-common-protos
 }:
 
 buildPythonPackage rec {
   pname = "grpc-google-iam-v1";
-  version = "0.12.6";
-  format = "setuptools";
+  version = "0.12.7";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-K8S4/fIhFaZddRyTFzKTImAsObfIaiicm3LSKNlg718=";
+    hash = "sha256-AJGXp/HqqiIUnJbl4FSsWTS6ckGXTpJmPY01KKISA9E=";
   };
 
-  propagatedBuildInputs = [ grpcio googleapis-common-protos ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    grpcio
+    googleapis-common-protos
+  ];
 
   # no tests run
   doCheck = false;
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 0915851d7a706..a6aaa9e28d5fd 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.59.3";
+  version = "1.60.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZcOUukM4DWvfjATGHvxJMQS1U1VSrtNYF6G03GZZih8=";
+    hash = "sha256-8Q4LbbOtwP3CRLcZYoFO6YKZbvBhhkRrVpW5+mNaoas=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 9c808eb8d718a..2ab692a2c715a 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.59.3";
+  version = "1.60.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zRYKxCgc0a53osiAN3p3KDSTQLTJHiQoUDe1fBjp9lE=";
+    hash = "sha256-7TBJk0AijXM/9p/PSmZZDteSH5TrWiv2kiWLEoC52sc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index a003d4659d60a..77be060cfd2d9 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -18,11 +18,11 @@
 buildPythonPackage rec {
   pname = "grpcio";
   format = "setuptools";
-  version = "1.59.3";
+  version = "1.60.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eAD5lWinSgbr3M1BndG25jm0d9yvbad+pwL4+xTOX4A=";
+    hash = "sha256-IZkWWhr/tmaqJK3wyXQ2aG0KYbxfwRPAN3Aft8f865Y=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 16f99016fed34..03062ea264be9 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -14,15 +14,15 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.22.7";
+  version = "1.22.8";
 
   format = "other";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "${meta.homepage}/src/gst-python/${pname}-${version}.tar.xz";
-    hash = "sha256-HvjfdggBL6RpMpeZyVDsCHc3ptq60wA8IwZYtYxxAXI=";
+    url = "https://gstreamer.freedesktop.org/src/gst-python/${pname}-${version}.tar.xz";
+    hash = "sha256-1cuPFEBUoqEQ5mcr1RLksV1bG42YecGSuXI1Ne+3C48=";
   };
 
   # Python 2.x is not supported.
diff --git a/pkgs/development/python-modules/gunicorn/default.nix b/pkgs/development/python-modules/gunicorn/default.nix
index 9a425be27878a..ec2ed2aaf63d6 100644
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@@ -1,17 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, packaging
 , pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, packaging
+
+# optional-dependencies
 , eventlet
 , gevent
+, tornado
+, setproctitle
+
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "gunicorn";
   version = "21.2.0";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
@@ -26,19 +37,40 @@ buildPythonPackage rec {
       --replace "--cov=gunicorn --cov-report=xml" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     packaging
   ];
 
-  nativeCheckInputs = [
-    eventlet
-    gevent
-    pytestCheckHook
+  passthru.optional-dependencies = {
+    gevent = [
+      gevent
+    ];
+    eventlet = [
+      eventlet
+    ];
+    tornado = [
+      tornado
+    ];
+    gthread = [];
+    setproctitle = [
+      setproctitle
+    ];
+  };
+
+  pythonImportsCheck = [
+    "gunicorn"
   ];
 
-  pythonImportsCheck = [ "gunicorn" ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   meta = with lib; {
+    changelog = "https://github.com/benoitc/gunicorn/releases/tag/${version}";
     homepage = "https://github.com/benoitc/gunicorn";
     description = "gunicorn 'Green Unicorn' is a WSGI HTTP Server for UNIX, fast clients and sleepy applications";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/guppy3/default.nix b/pkgs/development/python-modules/guppy3/default.nix
index 5c102f10a5517..2c4389549afff 100644
--- a/pkgs/development/python-modules/guppy3/default.nix
+++ b/pkgs/development/python-modules/guppy3/default.nix
@@ -2,13 +2,15 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, setuptools
 , tkinter
 }:
 
 buildPythonPackage rec {
   pname = "guppy3";
   version = "3.1.4.post1";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
@@ -18,6 +20,10 @@ buildPythonPackage rec {
     hash = "sha256-HHy57P6WEHZKygAbdjEh6XAApFlQueiYGr02eSQMWfc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ tkinter ];
 
   # Tests are starting a Tkinter GUI
diff --git a/pkgs/development/python-modules/h5netcdf/default.nix b/pkgs/development/python-modules/h5netcdf/default.nix
index 1c97861f1eee4..334289b034e2d 100644
--- a/pkgs/development/python-modules/h5netcdf/default.nix
+++ b/pkgs/development/python-modules/h5netcdf/default.nix
@@ -11,18 +11,16 @@
 
 buildPythonPackage rec {
   pname = "h5netcdf";
-  version = "1.2.0";
+  version = "1.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f2snM73gbqJXW3mmRQ2b1cOJGP9MsqNVvyK76Mhsa88=";
+    hash = "sha256-oXHAJ9rrNLJMJKO2MEGVuOq7tvEMdIJW7Tz+GYBjg88=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/h5py/default.nix b/pkgs/development/python-modules/h5py/default.nix
index 3fb20fad4c3bb..fc30a7536a335 100644
--- a/pkgs/development/python-modules/h5py/default.nix
+++ b/pkgs/development/python-modules/h5py/default.nix
@@ -21,7 +21,7 @@ let
   mpi = hdf5.mpi;
   mpiSupport = hdf5.mpiSupport;
 in buildPythonPackage rec {
-  version = "3.9.0";
+  version = "3.10.0";
   pname = "h5py";
   format = "pyproject";
 
@@ -29,7 +29,7 @@ in buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5gTbZSHB42fGvX+tI5yEf1PMRmRvLSZRNy0Frl6V+Bc=";
+    hash = "sha256-2TrcSM7rMzR+skpjT7eH78euRkTm6kunM9CZYFBFwEk=";
   };
 
   # avoid strict pinning of numpy
diff --git a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
index 02e876ade8645..1420362dc622f 100644
--- a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
+++ b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
@@ -49,5 +49,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/unixorn/ha-mqtt-discoverable/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 06c7504ebdec2..61b1fdf58a1ab 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -12,6 +12,7 @@
 , pytest-timeout
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , setuptools
 , snitun
 , syrupy
@@ -34,6 +35,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "acme"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hatch-vcs/default.nix b/pkgs/development/python-modules/hatch-vcs/default.nix
index 4fa2c56cabfb9..25884829b5d2b 100644
--- a/pkgs/development/python-modules/hatch-vcs/default.nix
+++ b/pkgs/development/python-modules/hatch-vcs/default.nix
@@ -10,15 +10,15 @@
 
 buildPythonPackage rec {
   pname = "hatch-vcs";
-  version = "0.3.0";
+  version = "0.4.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "hatch_vcs";
     inherit version;
-    hash = "sha256-zsUQfPzkgsZ/i8lvGLvDIMmqDQaBgOFK0xe77loVP+4=";
+    hash = "sha256-CTgQdI/gHbDUUfq88sGsJojK79Iy1O3pZwkLHBsH2fc=";
   };
 
   nativeBuildInputs = [
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/ofek/hatch-vcs/releases/tag/v${version}";
     description = "A plugin for Hatch that uses your preferred version control system (like Git) to determine project versions";
     homepage = "https://github.com/ofek/hatch-vcs";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 8a886112fed99..221c266287f9b 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "hatchling";
-  version = "1.18.0";
+  version = "1.21.0";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UOmcMRDOCvw/e9ut/xxxwXdY5HZzHCdgeUDPpmhkico=";
+    hash = "sha256-XAhncjV6UHI7gl/V2lJ4rH42l833eX0HVBpskLb/dUw=";
   };
 
   # listed in backend/pyproject.toml
diff --git a/pkgs/development/python-modules/help2man/default.nix b/pkgs/development/python-modules/help2man/default.nix
index 38cff88b4a12c..edcd479458fef 100644
--- a/pkgs/development/python-modules/help2man/default.nix
+++ b/pkgs/development/python-modules/help2man/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-BIDn+LQzBtDHUtFvIRL3NMXNouO3cMLibuYBoFtCUxI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     jinja2
     setuptools-scm
diff --git a/pkgs/development/python-modules/histoprint/default.nix b/pkgs/development/python-modules/histoprint/default.nix
index 3c65fbf0eb801..66f06feac946e 100644
--- a/pkgs/development/python-modules/histoprint/default.nix
+++ b/pkgs/development/python-modules/histoprint/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     uhi
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   checkInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/hiyapyco/default.nix b/pkgs/development/python-modules/hiyapyco/default.nix
index 72b206e297c8f..9dc8ae08c7245 100644
--- a/pkgs/development/python-modules/hiyapyco/default.nix
+++ b/pkgs/development/python-modules/hiyapyco/default.nix
@@ -1,30 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pyyaml
 , jinja2
 }:
 
 buildPythonPackage rec {
   pname = "hiyapyco";
-  version = "0.5.1";
-  format = "setuptools";
+  version = "0.5.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zerwes";
     repo = pname;
     rev = "refs/tags/release-${version}";
-    hash = "sha256-MVJoMnEi+319ZkhffYWYVi/wj0Ihm0nfVeEXvx7Ac/4=";
+    hash = "sha256-hKTqdclWMKTGeRtQuNj0gYdiGFovFh5FQ2rRjCgbvBM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyyaml
     jinja2
   ];
 
   checkPhase = ''
+    runHook preCheck
+
     set -e
     find test -name 'test_*.py' -exec python {} \;
+
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "hiyapyco" ];
diff --git a/pkgs/development/python-modules/hledger-utils/default.nix b/pkgs/development/python-modules/hledger-utils/default.nix
index cea6592b42b80..c2485c217a4c8 100644
--- a/pkgs/development/python-modules/hledger-utils/default.nix
+++ b/pkgs/development/python-modules/hledger-utils/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-Qu4nUcAGTACmLhwc7fkLxITOyFnUHv85qMhtViFumVs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/html5tagger/default.nix b/pkgs/development/python-modules/html5tagger/default.nix
index 42bc3aa18ad6c..e9a96b8ddd113 100644
--- a/pkgs/development/python-modules/html5tagger/default.nix
+++ b/pkgs/development/python-modules/html5tagger/default.nix
@@ -16,8 +16,6 @@ buildPythonPackage rec {
     hash = "sha256-Or0EizZC9FMjTcbgecDvgGB09KNGyxHreSDojgB7ysg=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/http-message-signatures/default.nix b/pkgs/development/python-modules/http-message-signatures/default.nix
index d88832f81acd4..bc3351feb3d84 100644
--- a/pkgs/development/python-modules/http-message-signatures/default.nix
+++ b/pkgs/development/python-modules/http-message-signatures/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-acTziJM5H5Td+eG/LNrlNwgpVvFDyl/tf6//YuE1XZk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/httpbin/default.nix b/pkgs/development/python-modules/httpbin/default.nix
index cc15e00748c0c..48de08ee3b4c5 100644
--- a/pkgs/development/python-modules/httpbin/default.nix
+++ b/pkgs/development/python-modules/httpbin/default.nix
@@ -1,18 +1,26 @@
 { lib
-, brotlicffi
 , buildPythonPackage
-, decorator
 , fetchPypi
-, flask
-, flask-limiter
+, pythonRelaxDepsHook
+
+# build-system
+, setuptools
+
+# dependencies
+, brotlicffi
+, decorator
 , flasgger
-, itsdangerous
-, markupsafe
-, raven
+, flask
+, greenlet
 , six
-, pytestCheckHook
-, setuptools
 , werkzeug
+
+# optional-dependencies
+, gunicorn
+, gevent
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -27,20 +35,29 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "greenlet"
   ];
 
   propagatedBuildInputs = [
     brotlicffi
     decorator
     flask
-    flask-limiter
     flasgger
-    itsdangerous
-    markupsafe
-    raven
+    greenlet
     six
     werkzeug
-  ] ++ raven.optional-dependencies.flask;
+  ];
+
+  passthru.optional-dependencies = {
+    mainapp = [
+      gunicorn
+      gevent
+    ];
+  };
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/httpcore/default.nix b/pkgs/development/python-modules/httpcore/default.nix
index 91cd904e3afe6..d9fd192b7bd1b 100644
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@@ -13,8 +13,8 @@
 , pytest-trio
 , pytestCheckHook
 , pythonOlder
-, sniffio
 , socksio
+, trio
 # for passthru.tests
 , httpx
 , httpx-socks
@@ -22,16 +22,16 @@
 
 buildPythonPackage rec {
   pname = "httpcore";
-  version = "0.18.0";
+  version = "1.0.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "encode";
-    repo = pname;
+    repo = "httpcore";
     rev = "refs/tags/${version}";
-    hash = "sha256-UEpERsB7jZlMqRtyHxLYBisfDbTGaAiTtsgU1WUpvtA=";
+    hash = "sha256-gjAScRBzAuNiTSxspX6vzwTAdBIwVQbaSLEUFV1QP+E=";
   };
 
   nativeBuildInputs = [
@@ -40,19 +40,23 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    anyio
     certifi
     h11
-    sniffio
   ];
 
   passthru.optional-dependencies = {
+    asyncio = [
+      anyio
+    ];
     http2 = [
       h2
     ];
     socks = [
       socksio
     ];
+    trio = [
+      trio
+    ];
   };
 
   nativeCheckInputs = [
@@ -61,19 +65,7 @@ buildPythonPackage rec {
     pytest-httpbin
     pytest-trio
     pytestCheckHook
-  ] ++ passthru.optional-dependencies.http2
-    ++ passthru.optional-dependencies.socks;
-
-  disabledTests = [
-    # https://github.com/encode/httpcore/discussions/813
-    "test_connection_pool_timeout_during_request"
-    "test_connection_pool_timeout_during_response"
-    "test_h11_timeout_during_request"
-    "test_h11_timeout_during_response"
-    "test_h2_timeout_during_handshake"
-    "test_h2_timeout_during_request"
-    "test_h2_timeout_during_response"
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "httpcore"
@@ -86,7 +78,7 @@ buildPythonPackage rec {
   };
 
   meta = with lib; {
-    changelog = "https://github.com/encode/httpcore/releases/tag/${version}";
+    changelog = "https://github.com/encode/httpcore/blob/${version}/CHANGELOG.md";
     description = "A minimal low-level HTTP client";
     homepage = "https://github.com/encode/httpcore";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index c201bc3126c83..aa4abf313d201 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.21.0";
+  version = "0.22.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1Pl+l28J7crfO2UY/9/D019IzOHWOwjR+UvVEHICTqU=";
+    hash = "sha256-76gdiRbF535CEaNXwNqsVeVc0dKglovMPQpGsOkbd/4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/httptools/default.nix b/pkgs/development/python-modules/httptools/default.nix
index c516267629cdc..116ab28dc9895 100644
--- a/pkgs/development/python-modules/httptools/default.nix
+++ b/pkgs/development/python-modules/httptools/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "httptools";
-  version = "0.6.0";
+  version = "0.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-n8bkCa04y9aLF3zVFY/EBCx5a4LKiNmex48HvtbGt5Y=";
+    hash = "sha256-xuJsMEVWALldlLG4NghROOgvF3NRRU7oQcFI+TqbrVo=";
   };
 
   # Tests are not included in pypi tarball
diff --git a/pkgs/development/python-modules/httpx/default.nix b/pkgs/development/python-modules/httpx/default.nix
index 7e451532af04a..0bbb64652737d 100644
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, anyio
 , brotli
 , brotlicffi
 , buildPythonPackage
@@ -11,12 +12,12 @@
 , hatch-fancy-pypi-readme
 , hatchling
 , httpcore
+, idna
 , isPyPy
 , multipart
 , pygments
 , python
 , pythonOlder
-, rfc3986
 , rich
 , sniffio
 , socksio
@@ -29,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "httpx";
-  version = "0.25.0";
+  version = "0.25.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +39,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-zQVavjU66ksO0FB1h32e0YUhOGiQ4jHPvjgLhtxjU6s=";
+    hash = "sha256-rGtIrs4dffs7Ndtjb400q7JrZh+HG9k0uwHw9pRlC5s=";
   };
 
   nativeBuildInputs = [
@@ -47,9 +48,10 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    anyio
     certifi
     httpcore
-    rfc3986
+    idna
     sniffio
   ];
 
@@ -83,14 +85,7 @@ buildPythonPackage rec {
     pytest-trio
     trustme
     uvicorn
-  ] ++ passthru.optional-dependencies.http2
-    ++ passthru.optional-dependencies.brotli
-    ++ passthru.optional-dependencies.socks;
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "rfc3986[idna2008]>=1.3,<2" "rfc3986>=1.3"
-  '';
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   # testsuite wants to find installed packages for testing entrypoint
   preCheck = ''
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index aa11d109dbc3a..a15a8988a7900 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.18.0";
+  version = "0.19.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/KbD3TNSbQ9ueXYFLoXnIRIoi/y3l0w72GZ1+JC8ULk=";
+    hash = "sha256-bK/Cg+ZFhf9TrTVlDU35cLMDuTmdH4bN/QuPVeUVDsI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/humanize/default.nix b/pkgs/development/python-modules/humanize/default.nix
index ca06ac2abfd77..1ae941be385d4 100644
--- a/pkgs/development/python-modules/humanize/default.nix
+++ b/pkgs/development/python-modules/humanize/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-sLlgR6c65RmUNZdH2pHuxzo7dm71uUZXGqzcqyxCrk4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/huum/default.nix b/pkgs/development/python-modules/huum/default.nix
index 9b08af43c54f8..72f65940a5e33 100644
--- a/pkgs/development/python-modules/huum/default.nix
+++ b/pkgs/development/python-modules/huum/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , mashumaro
 , poetry-core
+, pydantic
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -47,5 +48,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/frwickst/pyhuum/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 4cc5aab3bffe7..c74631817866d 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPyPy
 , fetchFromGitHub
+, setuptools
 , attrs
 , exceptiongroup
 , pexpect
@@ -21,9 +22,8 @@
 
 buildPythonPackage rec {
   pname = "hypothesis";
-  version = "6.84.3";
-  outputs = [ "out" ];
-  format = "setuptools";
+  version = "6.91.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "HypothesisWorks";
     repo = "hypothesis";
     rev = "hypothesis-python-${version}";
-    hash = "sha256-wymZ/tJBGcP57B3BuDlBT7kbUxNwW4/SSmvwLSa5PvM=";
+    hash = "sha256-2iBeB5pLVOunOJb6aGNQ/ZTj8HyeH+UkqvLPF3YVuLk=";
   };
 
   # I tried to package sphinx-selective-exclude, but it throws
@@ -49,6 +49,10 @@ buildPythonPackage rec {
 
   postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     attrs
     sortedcontainers
diff --git a/pkgs/development/python-modules/hypothesmith/default.nix b/pkgs/development/python-modules/hypothesmith/default.nix
index d6ce47e380506..5754612b1f29d 100644
--- a/pkgs/development/python-modules/hypothesmith/default.nix
+++ b/pkgs/development/python-modules/hypothesmith/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "hypothesmith";
-  version = "0.3.0";
+  version = "0.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Uj2gTAY7hzko1sKO8WUGz2S/MXdwOYN+F+a73G4szNs=";
+    hash = "sha256-h5kXemST6DLIF0aEKoaGdSs7G7lTDW6DK64XWEENrzo=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/iaqualink/default.nix b/pkgs/development/python-modules/iaqualink/default.nix
index 6e72b5a8519b5..56dde70d3e3be 100644
--- a/pkgs/development/python-modules/iaqualink/default.nix
+++ b/pkgs/development/python-modules/iaqualink/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-ewPP2Xq+ecZGc5kokvLEsRokGqTWlymrzkwk480tapk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index 9b77a6be51d0d..8c2e49a6e4e5a 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -63,14 +63,15 @@ let
     name = "ibis-testing-data";
     owner = "ibis-project";
     repo = "testing-data";
-    rev = "2b3968deaa1a28791b2901dbbcc9bfd3d2f23e9b";
-    hash = "sha256-q1b5IcOl5oIFXP7/P5RufncjHEVrWp4NjoU2uo/BE9U=";
+    # https://github.com/ibis-project/ibis/blob/7.1.0/nix/overlay.nix#L20-L26
+    rev = "2c6a4bb5d5d525058d8d5b2312a9fee5dafc5476";
+    hash = "sha256-Lq503bqh9ESZJSk6yVq/uZwkAubzmSmoTBZSsqMm0DY=";
   };
 in
 
 buildPythonPackage rec {
   pname = "ibis-framework";
-  version = "6.1.0";
+  version = "7.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -80,7 +81,7 @@ buildPythonPackage rec {
     repo = "ibis";
     owner = "ibis-project";
     rev = "refs/tags/${version}";
-    hash = "sha256-+AtXgRNxPryP/fd/GQlLNxWbP6ozikqG2yBCp3dE0tY=";
+    hash = "sha256-E7jryoidw6+CjTIex4wcTXcU+8Kg8LDwg7wJvcwj+7Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/icecream/default.nix b/pkgs/development/python-modules/icecream/default.nix
index 601a55e80f6e9..db9e56bb8b6e3 100644
--- a/pkgs/development/python-modules/icecream/default.nix
+++ b/pkgs/development/python-modules/icecream/default.nix
@@ -1,18 +1,56 @@
-{ lib, buildPythonPackage, fetchPypi
-, asttokens, colorama, executing, pygments
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
+, asttokens
+, colorama
+, executing
+, pygments
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "icecream";
   version = "2.1.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-CqSnwzdOw2FTodCPgeMIDoPYrB7v2X0vT+lUTo+bSd4=";
   };
 
-  propagatedBuildInputs = [ asttokens colorama executing pygments ];
+  postPatch = ''
+    substituteInPlace tests/test_icecream.py \
+      --replace assertRegexpMatches assertRegex
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    asttokens
+    colorama
+    executing
+    pygments
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # icecream.icecream.NoSourceAvailableError
+    "testSingledispatchArgumentToString"
+    # AssertionError: assert [[('REPL (e.g...ion?', None)]] == [[('a', '1')], [('c', '3')]]
+    "testEnableDisable"
+  ];
 
   meta = with lib; {
     description = "A little library for sweet and creamy print debugging";
diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index a21125c2379e4..77aeb4483dc3d 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.4";
+  version = "3.6";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gU9Sjo3q19MpgzuRxfqofWC/cYJM0Sp1MLVSYGPQLLQ=";
+    hash = "sha256-ns270IOwZ5iuHoaty/6KsUec+GTk7jD+TkagA9Ekkco=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ifcopenshell/default.nix b/pkgs/development/python-modules/ifcopenshell/default.nix
index eb1c71601c923..99f2ae1c62765 100644
--- a/pkgs/development/python-modules/ifcopenshell/default.nix
+++ b/pkgs/development/python-modules/ifcopenshell/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "ifcopenshell";
-  version = "230915";
+  version = "231201";
   format = "other";
 
   src = fetchFromGitHub {
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     repo   = "IfcOpenShell";
     rev = "refs/tags/blenderbim-${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-dHw+5AlJbeuUeaxv7eE2XfLjR/K5S00dMSCtoWVcEB8=";
+    sha256 = "sha256-T7XT5gvfzhagecB3jrTyWOawOm4iye7SCsmYhnjtOTE=";
   };
 
   nativeBuildInputs = [ gcc10 cmake ];
diff --git a/pkgs/development/python-modules/immutabledict/default.nix b/pkgs/development/python-modules/immutabledict/default.nix
index 555fa80acd64f..5d762be3fb860 100644
--- a/pkgs/development/python-modules/immutabledict/default.nix
+++ b/pkgs/development/python-modules/immutabledict/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "immutabledict";
-  version = "3.0.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "corenting";
     repo = "immutabledict";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DsvKtiy9sawGKpQu3f5OMUtE2Emq3Br8FupopUcLVew=";
+    hash = "sha256-z03s2mOJiMVnvLmeFJFgCRvkP+9VUcALiIoIPBAHUPw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index b4c20163cb7a9..8e8346fffdd78 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "6.8.0";
+  version = "6.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    hash = "sha256-26zniS2MDErBrQlmYiMvgx1OZPTEVFvVMBaj6dRlR0M=";
+    hash = "sha256-6Ky1I8M1qRgiZ04Um0bAOZ7E0yjE0fbknCc9pf8CAbk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 8b6afb522b6a7..80533173c9bb7 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "importlib-resources";
-  version = "6.0.1";
+  version = "6.1.1";
   format = "pyproject";
   disabled = isPy27;
 
   src = fetchPypi {
     pname = "importlib_resources";
     inherit version;
-    hash = "sha256-Q1lFfkJwhGK5YmoEZXxiCK15nOtB5cWMV/+g5qCYpdQ=";
+    hash = "sha256-OJOgASLq/eaJTFmRREalEvcooMGkX5u5tjchtrrPC0o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/imread/default.nix b/pkgs/development/python-modules/imread/default.nix
index 9d5ea1bebd203..4e3b4294991cd 100644
--- a/pkgs/development/python-modules/imread/default.nix
+++ b/pkgs/development/python-modules/imread/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "python-imread";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchPypi {
     inherit version;
     pname = "imread";
-    sha256 = "0kvlpy62vc16i0mysv1b2gv746in41q75hb815q6h8d227psv1q4";
+    sha256 = "sha256-GiWpA128GuLlbBW1CQQHHVVeoZfu9Yyh2RFzSdtHDbc=";
   };
 
 
diff --git a/pkgs/development/python-modules/inflect/default.nix b/pkgs/development/python-modules/inflect/default.nix
index 10f5a56763ef7..d6317d00841ba 100644
--- a/pkgs/development/python-modules/inflect/default.nix
+++ b/pkgs/development/python-modules/inflect/default.nix
@@ -24,6 +24,11 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = [
+    # https://errors.pydantic.dev/2.5/v/string_too_short
+    "inflect.engine.compare"
+  ];
+
   pythonImportsCheck = [ "inflect" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ipadic/default.nix b/pkgs/development/python-modules/ipadic/default.nix
index 841eccc9e1573..bb7724a505768 100644
--- a/pkgs/development/python-modules/ipadic/default.nix
+++ b/pkgs/development/python-modules/ipadic/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
   # no tests
   doCheck = false;
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ cython mecab setuptools-scm ];
 
   pythonImportsCheck = [ "ipadic" ];
diff --git a/pkgs/development/python-modules/ipython-genutils/default.nix b/pkgs/development/python-modules/ipython-genutils/default.nix
index e3a7b6c0a4449..c11c63797f0a6 100644
--- a/pkgs/development/python-modules/ipython-genutils/default.nix
+++ b/pkgs/development/python-modules/ipython-genutils/default.nix
@@ -4,6 +4,7 @@
 , setuptools
 , nose
 , pytestCheckHook
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
@@ -11,6 +12,9 @@ buildPythonPackage rec {
   version = "0.2.0";
   pyproject = true;
 
+  # uses the imp module, upstream says "DO NOT USE"
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     pname = "ipython_genutils";
     inherit version;
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index a730531bf8737..09121fb1f24a7 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -29,13 +29,13 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "8.15.0";
+  version = "8.18.1";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-K661vmlJ7uv1MhUPgXRvgzPizM4C3hx+7d4/I+1enx4=";
+    sha256 = "sha256-ym8Hm7M0V8ZuIz5FgOv8QSiFW0z2Nw3d1zhCqVY+iic=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/islpy/default.nix b/pkgs/development/python-modules/islpy/default.nix
index c91e44f7825f0..ca84beae2eeff 100644
--- a/pkgs/development/python-modules/islpy/default.nix
+++ b/pkgs/development/python-modules/islpy/default.nix
@@ -10,13 +10,14 @@
 
 buildPythonPackage rec {
   pname = "islpy";
-  version = "2023.1.2";
+  version = "2023.2.5";
   format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-NsNI1N9ZuNYWr1i3dl7hSaTP3jdsTYsIpoF98vrZG9Y=";
+    sha256 = "sha256-3XQ5i682k4q7fCqdmCjMGi5UnGyASFzsiwaymr+q0Y8=";
   };
 
   postConfigure = ''
diff --git a/pkgs/development/python-modules/iso8601/default.nix b/pkgs/development/python-modules/iso8601/default.nix
index ade0c71ee887d..a4982c27f852b 100644
--- a/pkgs/development/python-modules/iso8601/default.nix
+++ b/pkgs/development/python-modules/iso8601/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "iso8601";
-  version = "2.0.0";
+  version = "2.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-c5lg03x0x3vZvVRqdlYsy1gf49SCD/XDFB60nIOf2o8=";
+    hash = "sha256-ax04Ke6JIcQwGZjJCfeCn6ntPL2sDTsWry10Ou0bqN8=";
   };
 
   nativeBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Simple module to parse ISO 8601 dates";
     homepage = "https://pyiso8601.readthedocs.io/";
+    changelog = "https://github.com/micktwomey/pyiso8601/blob/${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/iterative-telemetry/default.nix b/pkgs/development/python-modules/iterative-telemetry/default.nix
index c6e2115391030..670b473e61953 100644
--- a/pkgs/development/python-modules/iterative-telemetry/default.nix
+++ b/pkgs/development/python-modules/iterative-telemetry/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-n67nc9a/Qrz2v1EYbHZb+pGhuMDqofUMpgfD/0BwqLM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/itsdangerous/default.nix b/pkgs/development/python-modules/itsdangerous/default.nix
index 3810eabf46c71..cfc364a4a3997 100644
--- a/pkgs/development/python-modules/itsdangerous/default.nix
+++ b/pkgs/development/python-modules/itsdangerous/default.nix
@@ -22,6 +22,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   meta = with lib; {
     description = "Safely pass data to untrusted environments and back";
     homepage = "https://itsdangerous.palletsprojects.com";
diff --git a/pkgs/development/python-modules/jaraco-abode/default.nix b/pkgs/development/python-modules/jaraco-abode/default.nix
index cbd739d5a955f..821c11b01e272 100644
--- a/pkgs/development/python-modules/jaraco-abode/default.nix
+++ b/pkgs/development/python-modules/jaraco-abode/default.nix
@@ -3,7 +3,6 @@
 , bx-py-utils
 , colorlog
 , fetchFromGitHub
-, fetchPypi
 , importlib-resources
 , jaraco-classes
 , jaraco-collections
@@ -40,6 +39,10 @@ buildPythonPackage rec {
   postPatch = ''
     # https://github.com/jaraco/jaraco.abode/issues/19
     echo "graft jaraco" > MANIFEST.in
+
+    # https://github.com/jaraco/jaraco.abode/commit/9e3e789efc96cddcaa15f920686bbeb79a7469e0
+    substituteInPlace jaraco/abode/helpers/timeline.py \
+      --replace "call_aside" "invoke"
   '';
 
   nativeBuildInputs = [
@@ -47,8 +50,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     requests
     lomond
diff --git a/pkgs/development/python-modules/jaraco-classes/default.nix b/pkgs/development/python-modules/jaraco-classes/default.nix
index 317fc3e3dc1a5..6364f89e4cac0 100644
--- a/pkgs/development/python-modules/jaraco-classes/default.nix
+++ b/pkgs/development/python-modules/jaraco-classes/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
 
   pythonNamespaces = [ "jaraco" ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   propagatedBuildInputs = [ more-itertools ];
diff --git a/pkgs/development/python-modules/jaraco-collections/default.nix b/pkgs/development/python-modules/jaraco-collections/default.nix
index 1d8f9a8f22417..3c0d0b6a9aa6a 100644
--- a/pkgs/development/python-modules/jaraco-collections/default.nix
+++ b/pkgs/development/python-modules/jaraco-collections/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     jaraco-classes
     jaraco-text
diff --git a/pkgs/development/python-modules/jaraco-context/default.nix b/pkgs/development/python-modules/jaraco-context/default.nix
index 7a882c80195c1..637e23b2cdd86 100644
--- a/pkgs/development/python-modules/jaraco-context/default.nix
+++ b/pkgs/development/python-modules/jaraco-context/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-YdbkpKv7k62uyhmjKoxeA9uf5BWnRD/rK+z46FJN4xk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonNamespaces = [
     "jaraco"
   ];
diff --git a/pkgs/development/python-modules/jaraco-email/default.nix b/pkgs/development/python-modules/jaraco-email/default.nix
index b23d9504dea1d..7e4ca68deb04c 100644
--- a/pkgs/development/python-modules/jaraco-email/default.nix
+++ b/pkgs/development/python-modules/jaraco-email/default.nix
@@ -45,8 +45,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     jaraco-text
     jaraco-collections
diff --git a/pkgs/development/python-modules/jaraco-functools/default.nix b/pkgs/development/python-modules/jaraco-functools/default.nix
index 0cc2fa124db50..28a7d64e11f96 100644
--- a/pkgs/development/python-modules/jaraco-functools/default.nix
+++ b/pkgs/development/python-modules/jaraco-functools/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "jaraco-functools";
-  version = "3.9.0";
+  version = "4.0.0";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "jaraco.functools";
     inherit version;
-    hash = "sha256-ixN7D+rMF/70us7gTAEcnobyNBCZyHCh0S0743sypjg=";
+    hash = "sha256-wnnLJMk9aU73Jw+XDUmcq004E/TggnP5U5hlGmNPCSU=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/jaraco-net/default.nix b/pkgs/development/python-modules/jaraco-net/default.nix
index 565395d84023a..4765c1dc301c0 100644
--- a/pkgs/development/python-modules/jaraco-net/default.nix
+++ b/pkgs/development/python-modules/jaraco-net/default.nix
@@ -49,8 +49,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     more-itertools
     beautifulsoup4
diff --git a/pkgs/development/python-modules/jaraco-text/default.nix b/pkgs/development/python-modules/jaraco-text/default.nix
index eacbf2cbfd966..5f6bc4021c0ff 100644
--- a/pkgs/development/python-modules/jaraco-text/default.nix
+++ b/pkgs/development/python-modules/jaraco-text/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "jaraco-text";
-  version = "3.11.1";
+  version = "3.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "jaraco.text";
     inherit version;
-    hash = "sha256-Mzpd8hSPcTlxhgfN81L+HZUWKXGnKZw4Dcwk2rAWiYA=";
+    hash = "sha256-OJ4lyNSzLpcVv1MFlvqw9c06pHKW5DlpOS4YpUGvWSw=";
   };
 
   pythonNamespaces = [
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index 1fb7b26db5b3b..1b154f90d3864 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, python
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
@@ -10,13 +11,11 @@
 , pallets-sphinx-themes
 , sphinxcontrib-log-cabinet
 , sphinx-issues
-, enableDocumentation ? false
 }:
 
 buildPythonPackage rec {
   pname = "Jinja2";
   version = "3.1.2";
-  outputs = [ "out" ] ++ lib.optional enableDocumentation "doc";
 
   disabled = pythonOlder "3.7";
 
@@ -25,20 +24,11 @@ buildPythonPackage rec {
     hash = "sha256-MTUacCpAip51laj8YVD8P0O7a/fjGXcMvA2535Q36FI=";
   };
 
-  patches = lib.optionals enableDocumentation [ ./patches/import-order.patch ];
-
   propagatedBuildInputs = [
     babel
     markupsafe
   ];
 
-  nativeBuildInputs = lib.optionals enableDocumentation [
-    sphinxHook
-    sphinxcontrib-log-cabinet
-    pallets-sphinx-themes
-    sphinx-issues
-  ];
-
   # Multiple tests run out of stack space on 32bit systems with python2.
   # See https://github.com/pallets/jinja/issues/1158
   doCheck = !stdenv.is32bit;
@@ -54,6 +44,35 @@ buildPythonPackage rec {
     "-p no:warnings"
   ];
 
+  passthru = {
+    doc = stdenv.mkDerivation {
+      # Forge look and feel of multi-output derivation as best as we can.
+      #
+      # Using 'outputs = [ "doc" ];' breaks a lot of assumptions.
+      name = "${pname}-${version}-doc";
+      inherit src pname version;
+
+      patches = [
+        # Fix import of "sphinxcontrib-log-cabinet"
+        ./patches/import-order.patch
+      ];
+
+      postInstallSphinx = ''
+        mv $out/share/doc/* $out/share/doc/python$pythonVersion-$pname-$version
+      '';
+
+      nativeBuildInputs = [
+        sphinxHook
+        sphinxcontrib-log-cabinet
+        pallets-sphinx-themes
+        sphinx-issues
+      ];
+
+      inherit (python) pythonVersion;
+      inherit meta;
+    };
+  };
+
   meta = with lib; {
     homepage = "https://jinja.palletsprojects.com/";
     description = "Stand-alone template engine";
diff --git a/pkgs/development/python-modules/jira/default.nix b/pkgs/development/python-modules/jira/default.nix
index fa7e2b18e6f4c..9b8a808b878fc 100644
--- a/pkgs/development/python-modules/jira/default.nix
+++ b/pkgs/development/python-modules/jira/default.nix
@@ -3,22 +3,28 @@
 , fetchFromGitHub
 , defusedxml
 , flaky
+, ipython
 , keyring
+, packaging
+, pyjwt
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-futures
 , requests-mock
 , requests-oauthlib
 , requests-toolbelt
+, setuptools
 , setuptools-scm
-, setuptools-scm-git-archive
-, pytestCheckHook
-, pythonOlder
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "jira";
   version = "3.5.2";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pycontribs";
@@ -28,19 +34,35 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
-    setuptools-scm-git-archive
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     defusedxml
-    keyring
+    packaging
+    requests
     requests-oauthlib
     requests-toolbelt
+    typing-extensions
   ];
 
+  passthru.optional-dependencies = {
+    cli = [
+      ipython
+      keyring
+    ];
+    opt = [
+      # filemagic
+      pyjwt
+      # requests-jwt
+      # requests-keyberos
+    ];
+    async = [
+      requests-futures
+    ];
+  };
+
   nativeCheckInputs = [
     flaky
     pytestCheckHook
@@ -65,5 +87,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/pycontribs/jira/releases/tag/${version}";
     license = licenses.bsd2;
     maintainers = with maintainers; [ ];
+    mainProgram = "jirashell";
   };
 }
diff --git a/pkgs/development/python-modules/joblib/default.nix b/pkgs/development/python-modules/joblib/default.nix
index 76eea5097581d..298a2ce83adfb 100644
--- a/pkgs/development/python-modules/joblib/default.nix
+++ b/pkgs/development/python-modules/joblib/default.nix
@@ -2,6 +2,8 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, fetchpatch
+, pythonAtLeast
 , stdenv
 
 # build-system
@@ -30,6 +32,14 @@ buildPythonPackage rec {
     hash = "sha256-kvhl5iHhd4TnlVCAttBCSJ47jilJScxExurDBPWXcrE=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "suppress-deprecation-warnings-with-python312.patch";
+      url = "https://github.com/joblib/joblib/commit/05caf0772d605799e5d2337018fd32ac829b37aa.patch";
+      hash = "sha256-bfqxCLFkCnuWMIkIbcjh+nCTv38A8jxvyCHeJPxoZwg=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];
@@ -54,6 +64,10 @@ buildPythonPackage rec {
     "test_nested_parallel_warnings" # tests is flaky under load
   ] ++ lib.optionals stdenv.isDarwin [
     "test_dispatch_multiprocessing" # test_dispatch_multiprocessing is broken only on Darwin.
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # deprecation warnings with python3.12 https://github.com/joblib/joblib/issues/1478
+    "test_main_thread_renamed_no_warning"
+    "test_background_thread_parallelism"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/josepy/default.nix b/pkgs/development/python-modules/josepy/default.nix
index f8a76641f537b..1206c816b3d83 100644
--- a/pkgs/development/python-modules/josepy/default.nix
+++ b/pkgs/development/python-modules/josepy/default.nix
@@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
 , cryptography
-, fetchpatch
 , fetchPypi
+, poetry-core
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
@@ -10,24 +10,18 @@
 
 buildPythonPackage rec {
   pname = "josepy";
-  version = "1.13.0";
-  format = "setuptools";
+  version = "1.14.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iTHa84+KTIUnSg6LfLJa3f2NHyj5+4++0FPdUa7HXck=";
+    hash = "sha256-MIs7+c6CWtTUu6djcs8ZtdwcLOlqnSmPlkKXXmS9E90=";
   };
 
-  patches = [
-    # https://github.com/certbot/josepy/pull/158
-    (fetchpatch {
-      name = "fix-setuptools-deprecation.patch";
-      url = "https://github.com/certbot/josepy/commit/8f1b4b57a29a868a87fd6eee19a67a7ebfc07ea1.patch";
-      hash = "sha256-9d+Bk/G4CJXpnjJU0YkXLsg0G3tPxR8YN2niqriQQkI=";
-      includes = [ "tests/test_util.py" ];
-    })
+  nativeBuildInputs = [
+    poetry-core
   ];
 
   propagatedBuildInputs = [
@@ -39,20 +33,15 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pytest.ini \
-      --replace " --flake8 --cov-report xml --cov-report=term-missing --cov=josepy --cov-config .coveragerc" ""
-    sed -i '/flake8-ignore/d' pytest.ini
-  '';
-
   pythonImportsCheck = [
     "josepy"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/certbot/josepy/blob/v${version}/CHANGELOG.rst";
     description = "JOSE protocol implementation in Python";
-    homepage = "https://github.com/jezdez/josepy";
+    homepage = "https://github.com/certbot/josepy";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/jproperties/default.nix b/pkgs/development/python-modules/jproperties/default.nix
index c67fea93b13a8..b7c2a1e296efe 100644
--- a/pkgs/development/python-modules/jproperties/default.nix
+++ b/pkgs/development/python-modules/jproperties/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-O+ALeGHMNjW1dc9IRyLzO81k8DW2vbGjuZqXxgrhYjo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/jq/default.nix b/pkgs/development/python-modules/jq/default.nix
index d7dc37b068528..5b369d513cb13 100644
--- a/pkgs/development/python-modules/jq/default.nix
+++ b/pkgs/development/python-modules/jq/default.nix
@@ -2,15 +2,15 @@
 , buildPythonPackage
 , cython
 , fetchFromGitHub
-, fetchpatch
 , jq
+, oniguruma
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "jq";
-  version = "1.5.0";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,18 +19,10 @@ buildPythonPackage rec {
     owner = "mwilliamson";
     repo = "jq.py";
     rev = "refs/tags/${version}";
-    hash = "sha256-mITk5y2AdUc9kZ/WrsnHxS1GRRmO4FDbPRgTtV2gIXI=";
+    hash = "sha256-c6tJI/mPlBGIYTk5ObIQ1CUTq73HouQ2quMZVWG8FFg=";
   };
 
-  patches = [
-    # Removes vendoring
-    ./jq-py-setup.patch
-    (fetchpatch {
-      url = "https://github.com/mwilliamson/jq.py/commit/805705dde4beb9db9a1743663d415198fb02eb1a.patch";
-      includes = [ "tests/*" ];
-      hash = "sha256-AgdpwmtOTeJ4nSbM6IknKaIVqqtWkpxTTtblXjlbWeA=";
-    })
-  ];
+  env.JQPY_USE_SYSTEM_LIBS = 1;
 
   nativeBuildInputs = [
     cython
@@ -38,6 +30,7 @@ buildPythonPackage rec {
 
   buildInputs = [
     jq
+    oniguruma
   ];
 
   preBuild = ''
@@ -48,6 +41,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # intentional behavior change in jq 1.7.1 not reflected upstream
+    "test_given_json_text_then_strings_containing_null_characters_are_preserved"
+  ];
+
   pythonImportsCheck = [
     "jq"
   ];
diff --git a/pkgs/development/python-modules/js2py/default.nix b/pkgs/development/python-modules/js2py/default.nix
index e0769f4ffa191..3630c0b38eaf5 100644
--- a/pkgs/development/python-modules/js2py/default.nix
+++ b/pkgs/development/python-modules/js2py/default.nix
@@ -1,6 +1,8 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+, pythonAtLeast
+, setuptools
 , tzlocal
 , six
 , pyjsparser
@@ -9,7 +11,11 @@
 buildPythonPackage rec {
   pname = "js2py";
   version = "0.74";
-  format = "setuptools";
+  pyproject = true;
+
+  # broken with Python 3.12
+  # https://github.com/PiotrDabkowski/Js2Py/issues/317
+  disabled = pythonAtLeast "3.12";
 
   src = fetchPypi {
     pname = "Js2Py";
@@ -17,6 +23,10 @@ buildPythonPackage rec {
     hash = "sha256-OfOmqoRpGA77o8hncnHfJ8MTMv0bRx3xryr1i4e4ly8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyjsparser
     six
diff --git a/pkgs/development/python-modules/jsonpickle/default.nix b/pkgs/development/python-modules/jsonpickle/default.nix
index 7b925777b2d71..bff05f2562473 100644
--- a/pkgs/development/python-modules/jsonpickle/default.nix
+++ b/pkgs/development/python-modules/jsonpickle/default.nix
@@ -1,42 +1,49 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytest
+, pythonAtLeast
+
+# build-system
+, setuptools
 , setuptools-scm
-, toml
-, importlib-metadata
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "jsonpickle";
   version = "3.0.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-43q7pL+zykpGR9KLufRwZDb3tGyKgzO0pxirr6jkazc=";
   };
 
-  nativeCheckInputs = [ pytest ];
-
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
-    toml
-  ];
-
-  propagatedBuildInputs = [
-    importlib-metadata
   ];
 
-  checkPhase = ''
+  preCheck = ''
     rm pytest.ini
-    pytest tests/jsonpickle_test.py
   '';
 
-  meta = {
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # imports distutils
+    "test_thing_with_submodule"
+  ];
+
+  meta = with lib; {
     description = "Python library for serializing any arbitrary object graph into JSON";
+    downloadPage = "https://github.com/jsonpickle/jsonpickle";
     homepage = "http://jsonpickle.github.io/";
-    license = lib.licenses.bsd3;
+    license = licenses.bsd3;
   };
 
 }
diff --git a/pkgs/development/python-modules/jsonschema-path/default.nix b/pkgs/development/python-modules/jsonschema-path/default.nix
new file mode 100644
index 0000000000000..598b0fdf3e834
--- /dev/null
+++ b/pkgs/development/python-modules/jsonschema-path/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, poetry-core
+, pathable
+, pyyaml
+, referencing
+, pytestCheckHook
+, responses
+}:
+
+buildPythonPackage rec {
+  pname = "jsonschema-path";
+  version = "0.3.2";
+
+  disabled = pythonOlder "3.8";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "p1c2u";
+    repo = "jsonschema-path";
+    rev = version;
+    hash = "sha256-HC0yfACKFIQEQoIa8/FUKyV8YS8TQ0BY7i3n9xCdKz8=";
+  };
+
+  postPatch = ''
+    sed -i '/--cov/d' pyproject.toml
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    pathable
+    pyyaml
+    referencing
+  ];
+
+  pythonImportsCheck = [ "jsonschema_path" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    responses
+  ];
+
+  meta = {
+    description = "JSONSchema Spec with object-oriented paths";
+    homepage = "https://github.com/p1c2u/jsonschema-path";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/jsonschema-spec/default.nix b/pkgs/development/python-modules/jsonschema-spec/default.nix
index 0da22f2cf98f0..7e8c668a07915 100644
--- a/pkgs/development/python-modules/jsonschema-spec/default.nix
+++ b/pkgs/development/python-modules/jsonschema-spec/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 
 # build
 , poetry-core
@@ -40,6 +41,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "referencing"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jsonschema-specifications/default.nix b/pkgs/development/python-modules/jsonschema-specifications/default.nix
index 54b8d6df6ea1e..07fd3dcd58954 100644
--- a/pkgs/development/python-modules/jsonschema-specifications/default.nix
+++ b/pkgs/development/python-modules/jsonschema-specifications/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "jsonschema-specifications";
-  version = "2023.7.1";
+  version = "2023.11.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "jsonschema_specifications";
     inherit version;
-    hash = "sha256-yRpQQE6Iofa6QGNneOLuCPbiTFYT/kxTrCRXilp/crs=";
+    hash = "sha256-lHL8T+pHTNdL6korGQ2uzLWp5NsuqA7896G1gvyagbg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index d8c235efed235..10074463f80a1 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "4.19.0";
+  version = "4.20.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bh51aawTvoE5st0sIaVdNQBm7j+A3wbGCLOYzcbzDo8=";
+    hash = "sha256-T2FP1G2NYSWGEJmJl3Q+xUkqZIszz0eMHdwj7UWYpfo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jupyter-book/default.nix b/pkgs/development/python-modules/jupyter-book/default.nix
index 631a853833d46..69d0734bfa00e 100644
--- a/pkgs/development/python-modules/jupyter-book/default.nix
+++ b/pkgs/development/python-modules/jupyter-book/default.nix
@@ -65,7 +65,10 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "docutils"
-    "sphinx-design"
+    "myst-nb"
+    "sphinx"
+    "sphinx-thebe"
+    "sphinxcontrib-bibtex"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/jupyter-lsp/default.nix b/pkgs/development/python-modules/jupyter-lsp/default.nix
index fd8820bcb1d45..1cc43ebc60013 100644
--- a/pkgs/development/python-modules/jupyter-lsp/default.nix
+++ b/pkgs/development/python-modules/jupyter-lsp/default.nix
@@ -1,20 +1,24 @@
-{ stdenv
-, lib
+{ lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , jupyter-server
 }:
 
 buildPythonPackage rec {
   pname = "jupyter-lsp";
-  version = "2.2.0";
-  format = "setuptools";
+  version = "2.2.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jrvLUzrbQeXWNeuP6ClWsKr78P1EO2xL+pBu3uuGNaE=";
+    hash = "sha256-sX+rbXD+g8iJawz/WSN2QAOCR8GWBWtDaEoJArap4Ps=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jupyter-server
   ];
diff --git a/pkgs/development/python-modules/jupyterlab-lsp/default.nix b/pkgs/development/python-modules/jupyterlab-lsp/default.nix
index 82d912923895f..004bddfbe8acf 100644
--- a/pkgs/development/python-modules/jupyterlab-lsp/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-lsp/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , jupyterlab
 , jupyter-lsp
 }:
 
 buildPythonPackage rec {
   pname = "jupyterlab-lsp";
-  version = "5.0.0";
-  format = "setuptools";
+  version = "5.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-D4jiaAPQ8+TIyL7wip+GHycGp3ym1NkvZQJsCelYFks=";
+    hash = "sha256-jQ8mhTfZ+6F9EgDfBWVI6I/I3n2lIlJs+mM0OJ0MKTQ=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jupyterlab
     jupyter-lsp
diff --git a/pkgs/development/python-modules/jupyterlab-server/default.nix b/pkgs/development/python-modules/jupyterlab-server/default.nix
index a408137650ac5..4eed7af804c03 100644
--- a/pkgs/development/python-modules/jupyterlab-server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-server/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab-server";
-  version = "2.25.1";
+  version = "2.25.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "jupyterlab_server";
     inherit version;
-    hash = "sha256-ZJEoOwAAaY6uGjjEhQeTBWDfz3RhrqABU2hpiqs03Zw=";
+    hash = "sha256-vQ7HqZ687ci8/5Oe+G5Sw3jkTCcH4FP82B0EbOl57mM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/kanidm/default.nix b/pkgs/development/python-modules/kanidm/default.nix
index eb60f61d5f3c9..fc53fc81ed709 100644
--- a/pkgs/development/python-modules/kanidm/default.nix
+++ b/pkgs/development/python-modules/kanidm/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, fetchpatch
+, fetchFromGitHub
 , pythonOlder
 
 # build
@@ -9,6 +8,7 @@
 
 # propagates
 , aiohttp
+, authlib
 , pydantic
 , toml
 
@@ -20,25 +20,30 @@
 
 let
   pname = "kanidm";
-  version = "0.0.3";
+  version = "0.0.3-unstable-2023-08-23";
 in
 buildPythonPackage {
   inherit pname version;
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-sTkAKxtJa7CVYKuXC//eMmf3l8ABsrEr2mdf1r2Gf9A=";
+  src = fetchFromGitHub {
+    owner = "kanidm";
+    repo = "kanidm";
+    rev = "def4420c4c5c3ec4f9b02776e1d5fdb07aa3a729";
+    hash = "sha256-5qQb+Itguw2v1Wdvc2vp00zglfvNd3LFEDvaweRJcOc=";
   };
 
+  sourceRoot = "source/pykanidm";
+
   nativeBuildInputs = [
     poetry-core
   ];
 
   propagatedBuildInputs = [
     aiohttp
+    authlib
     pydantic
     toml
   ];
diff --git a/pkgs/development/python-modules/kbcstorage/default.nix b/pkgs/development/python-modules/kbcstorage/default.nix
index 04d5b17c55e99..ec41ce9f27f94 100644
--- a/pkgs/development/python-modules/kbcstorage/default.nix
+++ b/pkgs/development/python-modules/kbcstorage/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     hash = "sha256-74sChw6eMkBtfHV6hiaaLNOr/J0Sa73LB93Z8muLaiI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-git-versioning
diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index f5275ea1a2a67..b91925b574e6d 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "keras";
-  version = "2.14.0";
+  version = "3.0.0";
   format = "wheel";
 
   src = fetchPypi {
     inherit format pname version;
-    hash = "sha256-10KdHSExzH6x8uouwzAifH2dONqz398ueN7+5OzEP80=";
+    hash = "sha256-/z8++iqlzBNLHYuFaTqrMlWLHZyGBjChP1iTTm0ckI0=";
     python = "py3";
     dist = "py3";
   };
diff --git a/pkgs/development/python-modules/keystoneauth1/default.nix b/pkgs/development/python-modules/keystoneauth1/default.nix
index 815ef3aa3104f..c3e13d8b0fc4a 100644
--- a/pkgs/development/python-modules/keystoneauth1/default.nix
+++ b/pkgs/development/python-modules/keystoneauth1/default.nix
@@ -15,6 +15,7 @@
 , requests
 , requests-kerberos
 , requests-mock
+, setuptools
 , six
 , stestr
 , stevedore
@@ -24,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "keystoneauth1";
-  version = "5.3.0";
-  format = "setuptools";
+  version = "5.4.0";
+  pyproject= true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AXwrm1mUU8kpQHUO27IPF2hxIbKJARS/nTbfFKBicRc=";
+    hash = "sha256-GsE0FRzrAuULaK143smCG/if5TvTb8hlhQHEewfL31M=";
   };
 
   postPatch = ''
@@ -38,6 +39,10 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     betamax
     iso8601
diff --git a/pkgs/development/python-modules/kiss-headers/default.nix b/pkgs/development/python-modules/kiss-headers/default.nix
index 5f2906cc8cca3..84eb2697eaac5 100644
--- a/pkgs/development/python-modules/kiss-headers/default.nix
+++ b/pkgs/development/python-modules/kiss-headers/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "kiss-headers";
-  version = "2.3.1";
+  version = "2.4.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Ousret";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-xPjw/uJTmvmQZDrI3i1KTUeAZuDF1mc13hvFBl8Erh0=";
+    hash = "sha256-WeAzlC1yT+0nPSuB278z8T0XvPjbre051f/Rva5ujAk=";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/kubernetes/default.nix b/pkgs/development/python-modules/kubernetes/default.nix
index 2b28f76d051ae..bb3bd33e469ec 100644
--- a/pkgs/development/python-modules/kubernetes/default.nix
+++ b/pkgs/development/python-modules/kubernetes/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "kubernetes";
-  version = "27.2.0";
+  version = "28.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "kubernetes-client";
     repo = "python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KqQ7wUu5Se4WYOdtk9vMU3M5oyz0WgIltSEliCD7s10=";
+    hash = "sha256-NKrxv5a5gkgpNG7yViTKYBYnU249taWl6fkPJa7/Rzo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index d79aba465eeed..76c51b77a92db 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -99,5 +99,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/Labelbox/labelbox-python/blob/v.${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ rakesh4g ];
+    # https://github.com/Labelbox/labelbox-python/issues/1246
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/labgrid/default.nix b/pkgs/development/python-modules/labgrid/default.nix
index 4a66ff5a364ac..15474fa5b6593 100644
--- a/pkgs/development/python-modules/labgrid/default.nix
+++ b/pkgs/development/python-modules/labgrid/default.nix
@@ -57,10 +57,6 @@ buildPythonPackage rec {
     xmodem
   ];
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
-  '';
-
   nativeCheckInputs = [
     mock
     psutil
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index c2fabc40c03a1..429689452a83e 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -84,7 +84,7 @@
 
 buildPythonPackage rec {
   pname = "langchain";
-  version = "0.0.334";
+  version = "0.0.344";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -93,7 +93,7 @@ buildPythonPackage rec {
     owner = "hwchase17";
     repo = "langchain";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mXPqc8wF9DhEtITm8h5R9kHBcMJ7AEK4kL5Z7V2p8NE=";
+    hash = "sha256-pvoY2QuGTZhqeCi9oLOH1XrxfT4FMfHwNkIGIaYTEo8=";
   };
 
   sourceRoot = "${src.name}/libs/langchain";
diff --git a/pkgs/development/python-modules/lark/default.nix b/pkgs/development/python-modules/lark/default.nix
index 3158b626c2a63..5366311fed3ca 100644
--- a/pkgs/development/python-modules/lark/default.nix
+++ b/pkgs/development/python-modules/lark/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , regex
 , pytestCheckHook
 , js2py
@@ -10,25 +9,16 @@
 
 buildPythonPackage rec {
   pname = "lark";
-  version = "1.1.7";
+  version = "1.1.8";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "lark-parser";
     repo = "lark";
     rev = "refs/tags/${version}";
-    hash = "sha256-k74tozIgJuwtUqKKmYHlfLpCWyT2hdoygRJiIpw+GDE=";
+    hash = "sha256-bGNoQeiAC2JIFOhgYUnc+nApa2ovFzXnpl9JQAE11hM=";
   };
 
-  patches = [
-    # include .lark files in package data
-    # https://github.com/lark-parser/lark/pull/1308
-    (fetchpatch {
-      url = "https://github.com/lark-parser/lark/commit/656334cb8793fd4e08a12843eaced5a7bb518be3.patch";
-      hash = "sha256-pYeNnFfXJ8xkR0KsU/KMWJ8nF+BhP9PXEANiVhT254s=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/leidenalg/default.nix b/pkgs/development/python-modules/leidenalg/default.nix
index f1b55e0ae817e..336fb029c4766 100644
--- a/pkgs/development/python-modules/leidenalg/default.nix
+++ b/pkgs/development/python-modules/leidenalg/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "leidenalg";
-  version = "0.9.1";
+  version = "0.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-flz+O2+A8yuQ9V81xo1KmQsEibEoLPP6usjNpJiJdfM=";
+    hash = "sha256-RXrZaYKoC9XGVxifQt/rd+6807dEoRDlosFhjS64C0c=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/libcst/default.nix b/pkgs/development/python-modules/libcst/default.nix
index abad21fe6760d..d1fc8ec75e33c 100644
--- a/pkgs/development/python-modules/libcst/default.nix
+++ b/pkgs/development/python-modules/libcst/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , cargo
 , hypothesis
 , libiconv
@@ -40,14 +41,21 @@ buildPythonPackage rec {
 
   cargoRoot = "native";
 
+  patches = [
+    # https://github.com/Instagram/LibCST/pull/1042
+    (fetchpatch {
+      name = "remove-distutils.patch";
+      url = "https://github.com/Instagram/LibCST/commit/a6834aa0e6eb78e41549fd1087d7ba60ca4dd237.patch";
+      hash = "sha256-lyIXJhm4UMwdCOso6McDslIvtK7Ar8sF5Zy7qo1nicQ=";
+    })
+  ];
+
   postPatch = ''
     # avoid infinite recursion by not formatting the release files
     substituteInPlace libcst/codegen/generate.py \
       --replace '"ufmt"' '"true"'
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-rust
     setuptools-scm
diff --git a/pkgs/development/python-modules/libretranslate/default.nix b/pkgs/development/python-modules/libretranslate/default.nix
index 12e33f45895f6..9dab13428a955 100644
--- a/pkgs/development/python-modules/libretranslate/default.nix
+++ b/pkgs/development/python-modules/libretranslate/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "libretranslate";
-  version = "1.3.11";
+  version = "1.5.2";
 
   format = "setuptools";
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "LibreTranslate";
     repo = "LibreTranslate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-S2J7kcoZFHOjVm2mb3TblWf9/FzkxZEB3h27BCaPYgY=";
+    hash = "sha256-8bbVpC53wH9GvwwHHlPEYQd/zqMXIqrwixwn4HY6FMg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/libtmux/default.nix b/pkgs/development/python-modules/libtmux/default.nix
index f94608c1b452a..c0df7019ed963 100644
--- a/pkgs/development/python-modules/libtmux/default.nix
+++ b/pkgs/development/python-modules/libtmux/default.nix
@@ -12,18 +12,18 @@
 
 buildPythonPackage rec {
   pname = "libtmux";
-  version = "0.23.2";
+  version = "0.25.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tmux-python";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-W1gBhukBooPo8uej6i8i3UxLuDeBBeSX5xU50SyjjlA=";
+    hash = "sha256-cAogRdhJdXC0lMQRlWwSHQj205mG9uwd1XkFJYsAetA=";
   };
 
   postPatch = ''
-    sed -i '/addopts/d' setup.cfg
+    sed -i '/addopts/d' pyproject.toml
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/license-expression/default.nix b/pkgs/development/python-modules/license-expression/default.nix
index 71443bb0144a1..4988a3d25674c 100644
--- a/pkgs/development/python-modules/license-expression/default.nix
+++ b/pkgs/development/python-modules/license-expression/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-vsQsHi2jdB0OiV6stm1APjQvr+238UoKgaaeXVx/isI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontConfigure = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index 2146f1b9a0bca..f55fd087cad9d 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "limits";
-  version = "3.6.0";
+  version = "3.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/limits/_version.py"
     '';
-    hash = "sha256-VLfFWFcwLgEEvPUKQ00QjEq1HN28OpE6Eu1eyF+TwXU=";
+    hash = "sha256-0h3ofungHkjycUvNJ3jf+VB/GSrshgUDECN2YoPGzzg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/linear-operator/default.nix b/pkgs/development/python-modules/linear-operator/default.nix
index 7bd1f62453431..907cb9c44d735 100644
--- a/pkgs/development/python-modules/linear-operator/default.nix
+++ b/pkgs/development/python-modules/linear-operator/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-OuE6jx9Q4IU+b2a+mrglRdBOReN1tt/thetNXxwk1GI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/linode-api/default.nix b/pkgs/development/python-modules/linode-api/default.nix
index 0f210be88119f..c0c54862c6e85 100644
--- a/pkgs/development/python-modules/linode-api/default.nix
+++ b/pkgs/development/python-modules/linode-api/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, setuptools
 , requests
 , pytestCheckHook
 , mock
@@ -9,8 +10,9 @@
 
 buildPythonPackage rec {
   pname = "linode-api";
-  version = "5.7.2";
-  format = "setuptools";
+  version = "5.10.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   # Sources from Pypi exclude test fixtures
@@ -18,10 +20,16 @@ buildPythonPackage rec {
     owner = "linode";
     repo = "python-linode-api";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-RU/GyNYV05iYVNanMqKMmoksXWrxTQ2H2XvaIwSSslA=";
+    hash = "sha256-LQW1AKgCbsE2OxZHtuU6zSHv7/Ak2S07O8YuoC9mS+U=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    requests
+  ];
 
   nativeCheckInputs = [
     mock
diff --git a/pkgs/development/python-modules/liquidctl/default.nix b/pkgs/development/python-modules/liquidctl/default.nix
index f6e5379fb2710..70d4fc1862f01 100644
--- a/pkgs/development/python-modules/liquidctl/default.nix
+++ b/pkgs/development/python-modules/liquidctl/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     hash = "sha256-LU8rQmXrEIoOBTTFotGvMeHqksYGrtNo2YSl2l2e/UI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     installShellFiles
     setuptools
diff --git a/pkgs/development/python-modules/lit/default.nix b/pkgs/development/python-modules/lit/default.nix
index 695a23d90ac58..d7dd857c360b3 100644
--- a/pkgs/development/python-modules/lit/default.nix
+++ b/pkgs/development/python-modules/lit/default.nix
@@ -1,19 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , python
 }:
 
 buildPythonPackage rec {
   pname = "lit";
-  version = "17.0.1";
-  format = "setuptools";
+  version = "17.0.6";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RIZ65Xa1eQVnsSC8Pw2fAh2slCTRsIQMdazYX0YQrAQ=";
+    hash = "sha256-36mvm1X8RQmla+e/I0bwedf0okLVg7ny4LB4/Qq64xs=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   passthru = {
     inherit python;
   };
diff --git a/pkgs/development/python-modules/lizard/default.nix b/pkgs/development/python-modules/lizard/default.nix
index 39b35e3306a9b..fa3140a9f6617 100644
--- a/pkgs/development/python-modules/lizard/default.nix
+++ b/pkgs/development/python-modules/lizard/default.nix
@@ -27,12 +27,19 @@ buildPythonPackage rec {
     mock
   ];
 
+  disabledTestPaths = [
+    # re.error: global flags not at the start of the expression at position 14
+    "test/test_languages/testFortran.py"
+  ];
+
   pythonImportsCheck = [
     "lizard"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/terryyin/lizard/blob/${version}/CHANGELOG.md";
     description = "Code analyzer without caring the C/C++ header files";
+    downloadPage = "https://github.com/terryyin/lizard";
     homepage = "http://www.lizard.ws";
     license = licenses.mit;
     maintainers = with maintainers; [ jpetrucciani ];
diff --git a/pkgs/development/python-modules/llvmlite/default.nix b/pkgs/development/python-modules/llvmlite/default.nix
index 925c449ae9988..ac74a6e3403b4 100644
--- a/pkgs/development/python-modules/llvmlite/default.nix
+++ b/pkgs/development/python-modules/llvmlite/default.nix
@@ -2,34 +2,36 @@
 , stdenv
 , fetchFromGitHub
 , buildPythonPackage
-, python
-, llvm
-, pythonOlder
 , isPyPy
-, enum34
-, isPy3k
+, pythonAtLeast
+
+# build-system
+, llvm
+, setuptools
+
+# tests
+, python
 }:
 
 buildPythonPackage rec {
   pname = "llvmlite";
-  # The main dependency of llvmlite is numba, which we currently package an
-  # untagged version of it (for numpy>1.25 support). That numba version
-  # requires at least this version of llvmlite (also not yet officially
-  # released, but at least tagged).
-  version = "0.41.0dev0";
-  format = "setuptools";
+  version = "0.41.1";
+  pyproject = true;
 
-  disabled = isPyPy || !isPy3k;
+  # uses distutils in setup.py
+  disabled = isPyPy || pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "numba";
     repo = "llvmlite";
-    rev = "v${version}";
-    hash = "sha256-fsH+rqouweNENU+YlWr7m0bC0YdreQLNp1n2rwrOiFw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RBgs8L5kOJ8BhEDLB8r8/iVhwuVIPT/rUSmwmBWm4D0=";
   };
 
-  nativeBuildInputs = [ llvm ];
-  propagatedBuildInputs = lib.optional (pythonOlder "3.4") enum34;
+  nativeBuildInputs = [
+    llvm
+    setuptools
+  ];
 
   # Disable static linking
   # https://github.com/numba/llvmlite/issues/93
@@ -45,7 +47,9 @@ buildPythonPackage rec {
   '';
 
   checkPhase = ''
+    runHook preCheck
     ${python.executable} runtests.py
+    runHook postCheck
   '';
 
   __impureHostDeps = lib.optionals stdenv.isDarwin [ "/usr/lib/libm.dylib" ];
@@ -53,7 +57,9 @@ buildPythonPackage rec {
   passthru.llvm = llvm;
 
   meta = with lib; {
+    changelog = "https://github.com/numba/llvmlite/blob/v${version}/CHANGE_LOG";
     description = "A lightweight LLVM python binding for writing JIT compilers";
+    downloadPage = "https://github.com/numba/llvmlite";
     homepage = "http://llvmlite.pydata.org/";
     license = licenses.bsd2;
     maintainers = with maintainers; [ fridh ];
diff --git a/pkgs/development/python-modules/localstack-ext/default.nix b/pkgs/development/python-modules/localstack-ext/default.nix
index 90e743f839e72..1386ce2cb7120 100644
--- a/pkgs/development/python-modules/localstack-ext/default.nix
+++ b/pkgs/development/python-modules/localstack-ext/default.nix
@@ -1,14 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, setuptools
+, plux
+
+# dependencies
+, cachetools
+, click
+, cryptography
 , dill
 , dnslib
 , dnspython
-, plux
-, pyaes
-, python-jose
+, psutil
+, python-dotenv
+, pyyaml
 , requests
-, tabulate
+, rich
+, semver
+, stevedore
+, tailer
 
 # Sensitive downstream dependencies
 , localstack
@@ -16,12 +28,12 @@
 
 buildPythonPackage rec {
   pname = "localstack-ext";
-  version = "2.3.2";
-  format = "setuptools";
+  version = "3.0.2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ex5ZPlteDaiyex90QumucVdTTbpp9uWiBrvw1kMr++8=";
+    hash = "sha256-KNM/HjSWVwenLqtXbaRP70k7b7YXk//aKGEkBxPp1fA=";
   };
 
   postPatch = ''
@@ -38,15 +50,27 @@ buildPythonPackage rec {
       --replace "requests>=2.20.0,<2.26" "requests~=2.20"
   '';
 
+  nativeBuildInputs = [
+    plux
+    setuptools
+  ];
+
   propagatedBuildInputs = [
+    cachetools
+    click
+    cryptography
     dill
     dnslib
     dnspython
     plux
-    pyaes
-    python-jose
+    psutil
+    python-dotenv
+    pyyaml
+    rich
     requests
-    tabulate
+    semver
+    stevedore
+    tailer
   ];
 
   pythonImportsCheck = [ "localstack_ext" ];
diff --git a/pkgs/development/python-modules/localstack/default.nix b/pkgs/development/python-modules/localstack/default.nix
index 6a408c9359205..39b27be9f93fa 100644
--- a/pkgs/development/python-modules/localstack/default.nix
+++ b/pkgs/development/python-modules/localstack/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , apispec
 , boto3
 , cachetools
@@ -20,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "localstack";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.0.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "localstack";
     repo = "localstack";
     rev = "refs/tags/v${version}";
-    hash = "sha256-N/Mc1bubCcq38VxUqkO9LGG25pEetEyJ+VJMdg/7hrU=";
+    hash = "sha256-HncD/lhYfBrqtXF8F1Gz7JqwrASoHbsXvp1HXM5rldw=";
   };
 
   postPatch = ''
@@ -37,6 +38,10 @@ buildPythonPackage rec {
       --replace "boto3>=1.20,<1.25.0" "boto3~=1.20"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     apispec
     boto3
diff --git a/pkgs/development/python-modules/luddite/default.nix b/pkgs/development/python-modules/luddite/default.nix
index 9996e3574ce37..d6ff66594f47c 100644
--- a/pkgs/development/python-modules/luddite/default.nix
+++ b/pkgs/development/python-modules/luddite/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , packaging
 , pytestCheckHook
 , pytest-mock
@@ -14,7 +15,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jumptrading";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-JXIM7/5LO95oabM16GwAt3v3a8uldGpGXDWmVic8Ins=";
   };
 
@@ -24,10 +25,22 @@ buildPythonPackage rec {
       --replace "--disable-socket" ""
   '';
 
-  propagatedBuildInputs = [ packaging ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook pytest-mock ];
-  pythonImportsCheck = [ "luddite" ];
+  propagatedBuildInputs = [
+    packaging
+  ];
+
+  pythonImportsCheck = [
+    "luddite"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mock
+  ];
 
   meta = with lib; {
     description = "Checks for out-of-date package versions";
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index f6016ae3a9ed6..7cfef1d56cfd6 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -8,20 +8,30 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.9.3-3";
+  version = "4.9.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/lxml-${version}";
-    hash = "sha256-Vrizi+6jUUEx7qODU4PAH5ZmvBIyT9H18+QpYB0m1f4=";
+    hash = "sha256-qS20wb83eFapiPZe25BViHpYkjgvnCIZpiYkPNIPHZg=";
   };
 
+  patches = [
+    # fix compile error with libxml 2.12
+    # backport of: https://github.com/lxml/lxml/commit/b0861bea17769584a85f57eb00235ce0ca9811af
+    ./libxml-2.12.patch
+  ];
+
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
   nativeBuildInputs = [ libxml2.dev libxslt.dev cython ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
   buildInputs = [ libxml2 libxslt zlib ];
 
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
+  };
+
   # tests are meant to be ran "in-place" in the same directory as src
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/lxml/libxml-2.12.patch b/pkgs/development/python-modules/lxml/libxml-2.12.patch
new file mode 100644
index 0000000000000..d0d211c9fe38b
--- /dev/null
+++ b/pkgs/development/python-modules/lxml/libxml-2.12.patch
@@ -0,0 +1,94 @@
+From 3b8807306d79d2ae2e9fa28c5ecd3b40b32ee65b Mon Sep 17 00:00:00 2001
+From: Stefan Behnel <stefan_ml@behnel.de>
+Date: Wed, 29 Nov 2023 10:28:47 +0100
+Subject: [PATCH] Follow changes in libxml2 2.12 and make xmlError usages
+ 'const'. This mostly impacts the error callback functions.
+
+---
+ src/lxml/extensions.pxi | 4 ++--
+ src/lxml/parser.pxi     | 4 ++--
+ src/lxml/xmlerror.pxi   | 8 ++++----
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/lxml/extensions.pxi b/src/lxml/extensions.pxi
+index 35a321b7..42b4c4f6 100644
+--- a/src/lxml/extensions.pxi
++++ b/src/lxml/extensions.pxi
+@@ -393,7 +393,7 @@ cdef tuple LIBXML2_XPATH_ERROR_MESSAGES = (
+     b"?? Unknown error ??\n",
+ )
+ 
+-cdef void _forwardXPathError(void* c_ctxt, xmlerror.xmlError* c_error) with gil:
++cdef void _forwardXPathError(void* c_ctxt, const xmlerror.xmlError* c_error) with gil:
+     cdef xmlerror.xmlError error
+     cdef int xpath_code
+     if c_error.message is not NULL:
+@@ -414,7 +414,7 @@ cdef void _forwardXPathError(void* c_ctxt, xmlerror.xmlError* c_error) with gil:
+ 
+     (<_BaseContext>c_ctxt)._error_log._receive(&error)
+ 
+-cdef void _receiveXPathError(void* c_context, xmlerror.xmlError* error) nogil:
++cdef void _receiveXPathError(void* c_context, const xmlerror.xmlError* error) nogil:
+     if not __DEBUG:
+         return
+     if c_context is NULL:
+diff --git a/src/lxml/parser.pxi b/src/lxml/parser.pxi
+index 22463c7d..1566b6df 100644
+--- a/src/lxml/parser.pxi
++++ b/src/lxml/parser.pxi
+@@ -626,10 +626,10 @@ cdef _initParserContext(_ParserContext context,
+     if c_ctxt is not NULL:
+         context._initParserContext(c_ctxt)
+ 
+-cdef void _forwardParserError(xmlparser.xmlParserCtxt* _parser_context, xmlerror.xmlError* error) with gil:
++cdef void _forwardParserError(xmlparser.xmlParserCtxt* _parser_context, const xmlerror.xmlError* error) with gil:
+     (<_ParserContext>_parser_context._private)._error_log._receive(error)
+ 
+-cdef void _receiveParserError(void* c_context, xmlerror.xmlError* error) nogil:
++cdef void _receiveParserError(void* c_context, const xmlerror.xmlError* error) nogil:
+     if __DEBUG:
+         if c_context is NULL or (<xmlparser.xmlParserCtxt*>c_context)._private is NULL:
+             _forwardError(NULL, error)
+diff --git a/src/lxml/xmlerror.pxi b/src/lxml/xmlerror.pxi
+index 1b50444f..4cd745f9 100644
+--- a/src/lxml/xmlerror.pxi
++++ b/src/lxml/xmlerror.pxi
+@@ -66,7 +66,7 @@ cdef class _LogEntry:
+         tree.xmlFree(self._c_path)
+ 
+     @cython.final
+-    cdef _setError(self, xmlerror.xmlError* error):
++    cdef _setError(self, const xmlerror.xmlError* error):
+         self.domain   = error.domain
+         self.type     = error.code
+         self.level    = <int>error.level
+@@ -198,7 +198,7 @@ cdef class _BaseErrorLog:
+         pass
+ 
+     @cython.final
+-    cdef void _receive(self, xmlerror.xmlError* error):
++    cdef void _receive(self, const xmlerror.xmlError* error):
+         cdef bint is_error
+         cdef _LogEntry entry
+         cdef _BaseErrorLog global_log
+@@ -634,7 +634,7 @@ def use_global_python_log(PyErrorLog log not None):
+ 
+ 
+ # local log functions: forward error to logger object
+-cdef void _forwardError(void* c_log_handler, xmlerror.xmlError* error) with gil:
++cdef void _forwardError(void* c_log_handler, const xmlerror.xmlError* error) with gil:
+     cdef _BaseErrorLog log_handler
+     if c_log_handler is not NULL:
+         log_handler = <_BaseErrorLog>c_log_handler
+@@ -645,7 +645,7 @@ cdef void _forwardError(void* c_log_handler, xmlerror.xmlError* error) with gil:
+     log_handler._receive(error)
+ 
+ 
+-cdef void _receiveError(void* c_log_handler, xmlerror.xmlError* error) nogil:
++cdef void _receiveError(void* c_log_handler, const xmlerror.xmlError* error) nogil:
+     # no Python objects here, may be called without thread context !
+     if __DEBUG:
+         _forwardError(c_log_handler, error)
+-- 
+2.42.0
+
diff --git a/pkgs/development/python-modules/lz4/default.nix b/pkgs/development/python-modules/lz4/default.nix
index ed06dca7c4c5a..8bc09d315a3a7 100644
--- a/pkgs/development/python-modules/lz4/default.nix
+++ b/pkgs/development/python-modules/lz4/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-aVnXCrTh+0Ip+FgYWN7hLw8N3iQCmXSywhReD5RTUfI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     sed -i '/pytest-cov/d' setup.py
   '';
diff --git a/pkgs/development/python-modules/magic-filter/default.nix b/pkgs/development/python-modules/magic-filter/default.nix
index e9d2fb8b86967..8b4cc8068965e 100644
--- a/pkgs/development/python-modules/magic-filter/default.nix
+++ b/pkgs/development/python-modules/magic-filter/default.nix
@@ -20,6 +20,11 @@ buildPythonPackage rec {
     hash = "sha256-MSYIZ/bzngRu6mG3EGblUotSCA+6bi+l3EymFA8NRZA=";
   };
 
+  postPatch = ''
+    substituteInPlace magic_filter/__init__.py \
+      --replace '"1"' '"${version}"'
+  '';
+
   nativeBuildInputs = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/magicgui/default.nix b/pkgs/development/python-modules/magicgui/default.nix
index ef327dd0f08b3..2e8f1b529a14b 100644
--- a/pkgs/development/python-modules/magicgui/default.nix
+++ b/pkgs/development/python-modules/magicgui/default.nix
@@ -22,8 +22,6 @@
     hash = "sha256-fVfBQaaT8/lUGqZRXjOPgvkC01Izb8Sxqn7RCqnW9bo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ typing-extensions qtpy pyside2 psygnal docstring-parser ];
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/maison/default.nix b/pkgs/development/python-modules/maison/default.nix
index fc868ffefd2c4..79be6d7b5bc75 100644
--- a/pkgs/development/python-modules/maison/default.nix
+++ b/pkgs/development/python-modules/maison/default.nix
@@ -47,5 +47,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/dbatten5/maison/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/makefun/default.nix b/pkgs/development/python-modules/makefun/default.nix
index 03d6e587eafe7..bc26604826acb 100644
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@@ -1,18 +1,23 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+
+# build-system
+, setuptools
 , setuptools-scm
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "makefun";
-  version = "1.15.1";
-  format = "setuptools";
+  version = "1.15.2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QLDxGLbe0NjXjHjx62ebi2skYuPBs+BfsbLajNRrSKU=";
+    hash = "sha256-FvKis02e4MK1eMlgoYCMl04oIs959um5xFWqzhCILUU=";
   };
 
   postPatch = ''
@@ -21,6 +26,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/mako/default.nix b/pkgs/development/python-modules/mako/default.nix
index d9b3ecefc9ed5..0a84359b27b6a 100644
--- a/pkgs/development/python-modules/mako/default.nix
+++ b/pkgs/development/python-modules/mako/default.nix
@@ -4,32 +4,39 @@
 , fetchPypi
 , isPyPy
 
+# build-system
+, setuptools
+
 # propagates
 , markupsafe
 
-# extras: Babel
+# optional-dependencies
 , babel
+, lingua
 
 # tests
+, chameleon
 , mock
 , pytestCheckHook
-, lingua
-, chameleon
 }:
 
 buildPythonPackage rec {
   pname = "mako";
-  version = "1.2.4";
-  format = "setuptools";
+  version = "1.3.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Mako";
     inherit version;
-    hash = "sha256-1go5A9w7sBoYrWqJzb4uTq3GnAvI7x43c7pT1Ew/ejQ=";
+    hash = "sha256-46nTiP0A6HBD7b6HkvRYgKwBFOnErcafbpv7LFXjsRs=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     markupsafe
   ];
@@ -38,14 +45,16 @@ buildPythonPackage rec {
     babel = [
       babel
     ];
+    lingua = [
+      lingua
+    ];
   };
 
   nativeCheckInputs = [
     chameleon
-    lingua
     mock
     pytestCheckHook
-  ] ++ passthru.optional-dependencies.babel;
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   disabledTests = lib.optionals isPyPy [
     # https://github.com/sqlalchemy/mako/issues/315
diff --git a/pkgs/development/python-modules/manifestoo-core/default.nix b/pkgs/development/python-modules/manifestoo-core/default.nix
index a7b2c624b0e06..fae1981b1a86e 100644
--- a/pkgs/development/python-modules/manifestoo-core/default.nix
+++ b/pkgs/development/python-modules/manifestoo-core/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     lib.optionals (pythonOlder "3.7") [ importlib-resources ]
     ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/manifestoo/default.nix b/pkgs/development/python-modules/manifestoo/default.nix
index c9499eb113103..63383eb76ee09 100644
--- a/pkgs/development/python-modules/manifestoo/default.nix
+++ b/pkgs/development/python-modules/manifestoo/default.nix
@@ -38,8 +38,6 @@ buildPythonPackage rec {
   ++ typer.passthru.optional-dependencies.all
   ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/markdown-include/default.nix b/pkgs/development/python-modules/markdown-include/default.nix
index 20bc7c4b971fc..96c4599d8252d 100644
--- a/pkgs/development/python-modules/markdown-include/default.nix
+++ b/pkgs/development/python-modules/markdown-include/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-1MEk0U00a5cpVhqnDZkwBIk4NYgsRXTVsI/ANNQ/OH0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/markdown/default.nix b/pkgs/development/python-modules/markdown/default.nix
index 7de193bbbbd79..4041a1aa3035b 100644
--- a/pkgs/development/python-modules/markdown/default.nix
+++ b/pkgs/development/python-modules/markdown/default.nix
@@ -6,27 +6,25 @@
 , pyyaml
 , setuptools
 , unittestCheckHook
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "markdown";
-  version = "3.4.4";
+  version = "3.5.1";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Python-Markdown";
     repo = "markdown";
     rev = "refs/tags/${version}";
-    hash = "sha256-5PIIhbJVsotGwZ3BQ4x0I7WjgnGF3opNrn8J+xZCflg=";
+    hash = "sha256-OeCr72N3ygYYJnI+bIXCt63tSLDFLKznYekTk1sYHZI=";
   };
 
   nativeBuildInputs = [
     setuptools
-    wheel
   ];
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [
@@ -38,7 +36,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "markdown" ];
 
   meta = with lib; {
-    changelog = "https://github.com/Python-Markdown/markdown/blob/${src.rev}/docs/change_log/index.md";
+    changelog = "https://github.com/Python-Markdown/markdown/blob/${src.rev}/docs/changelog.md";
     description = "Python implementation of John Gruber's Markdown";
     homepage = "https://github.com/Python-Markdown/markdown";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 4ac081e26a200..1100d1bdbc99d 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -79,7 +79,7 @@ let
 in
 
 buildPythonPackage rec {
-  version = "3.8.0";
+  version = "3.8.2";
   pname = "matplotlib";
   format = "pyproject";
 
@@ -87,7 +87,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-34UF4cGdXCwmr/NJeny9PM/C6XBD0eTbPnavo5kWS2k=";
+    hash = "sha256-Aal4uHG4ge52AXFS8fGgy/a9X3uP+Mlt8N8b1X2HVaE=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";
diff --git a/pkgs/development/python-modules/maxminddb/default.nix b/pkgs/development/python-modules/maxminddb/default.nix
index b5f7fb9d5db03..1bd579afe70c7 100644
--- a/pkgs/development/python-modules/maxminddb/default.nix
+++ b/pkgs/development/python-modules/maxminddb/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "maxminddb";
-  version = "2.4.0";
+  version = "2.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-geVOU0CL1QJlDllpzLoWeAr2WewdscRLLJl+QzCl7ZY=";
+    hash = "sha256-SAfTdOZFvWgzTk9Ie6haJxidvBJnqY5kSqaGp5J+BVk=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index cff34c84442d9..865e2a6ee774e 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "mcstatus";
-  version = "11.0.1";
+  version = "11.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "py-mine";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-1jPIsFEJ17kjtCBiX4IvSf2FxYw9DkH3MrrJ85N71tc=";
+    hash = "sha256-LYhd35FsredNaMgMfkj7LntNK3NRoVpniEUT6WHoXx8=";
   };
 
   postPatch = ''
@@ -56,6 +56,8 @@ buildPythonPackage rec {
     # DNS features are limited in the sandbox
     "test_query"
     "test_query_retry"
+    "test_resolve_localhost"
+    "test_async_resolve_localhost"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/measurement/default.nix b/pkgs/development/python-modules/measurement/default.nix
index 3323e8c198ff2..c16b03d8e829b 100644
--- a/pkgs/development/python-modules/measurement/default.nix
+++ b/pkgs/development/python-modules/measurement/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     sphinx
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "--cov=measurement" ""
diff --git a/pkgs/development/python-modules/mesa/default.nix b/pkgs/development/python-modules/mesa/default.nix
index fe4e8dd598d5c..4a9001ff1b9c0 100644
--- a/pkgs/development/python-modules/mesa/default.nix
+++ b/pkgs/development/python-modules/mesa/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "mesa";
-  version = "2.1.1";
+  version = "2.1.5";
   format = "setuptools";
 
   # According to their docs, this library is for Python 3+.
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Mesa";
     inherit version;
-    hash = "sha256-1wyXndB7xQy1jnfHsIqMQgsvmGYUhjDuSBB2M0GcXC4=";
+    hash = "sha256-UMf3z1bEElygfqwgY65qhOEK4i9K9gH42muId3mZUjY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 84031db71b808..9d34cb27c8cdc 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "meson-python";
-  version = "0.14.0";
+  version = "0.15.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "meson_python";
-    hash = "sha256-uWhmaQMmVE3+RSWDdTrD9DMTIn6f2UFnAajfkK8hIjQ=";
+    hash = "sha256-/dtz7s1J6JwcQch5N82JwtC2WhxjuigjhoHUvZSE0m8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/miauth/default.nix b/pkgs/development/python-modules/miauth/default.nix
index 380fe8e23e1fc..a48690ab0b07a 100644
--- a/pkgs/development/python-modules/miauth/default.nix
+++ b/pkgs/development/python-modules/miauth/default.nix
@@ -1,14 +1,21 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+, pythonRelaxDepsHook
+
+# build-system
 , setuptools
-, wheel
+
+# dependencies
 , bluepy
-, pythonOlder
 , cryptography
+
+# tests
+, pytestCheckHook
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "miauth";
   version = "0.9.1";
   pyproject = true;
@@ -26,7 +33,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    wheel
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "cryptography"
   ];
 
   propagatedBuildInputs = [
@@ -38,6 +49,8 @@ buildPythonPackage rec {
     "miauth"
   ];
 
+  doCheck = false; # no tests
+
   meta = with lib; {
     description = "Authenticate and interact with Xiaomi devices over BLE";
     homepage = "https://github.com/dnandha/miauth";
diff --git a/pkgs/development/python-modules/minio/default.nix b/pkgs/development/python-modules/minio/default.nix
index 5181d8bef54e0..ddb2905bc1d95 100644
--- a/pkgs/development/python-modules/minio/default.nix
+++ b/pkgs/development/python-modules/minio/default.nix
@@ -1,23 +1,27 @@
 { lib
 , buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, argon2-cffi
 , certifi
-, configparser
+, urllib3
+, pycryptodome
+
+# test
 , faker
-, fetchFromGitHub
-, future
 , mock
-, nose
 , pytestCheckHook
-, python-dateutil
-, pythonOlder
-, pytz
-, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "minio";
-  version = "7.1.17";
-  format = "setuptools";
+  version = "7.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -25,22 +29,23 @@ buildPythonPackage rec {
     owner = "minio";
     repo = "minio-py";
     rev = "refs/tags/${version}";
-    hash = "sha256-I0Q1SkZ1zQ9s2HbMTc2EzUnnOti14zQBxHVJasaukug=";
+    hash = "sha256-hZn1T75JbnJ5lIyWnX3f8r6OET/d6ZltuRr6jjYOp2o=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
+    argon2-cffi
     certifi
-    configparser
-    future
-    python-dateutil
-    pytz
     urllib3
+    pycryptodome
   ];
 
   nativeCheckInputs = [
     faker
     mock
-    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 86b6bcac9f3f5..085078429cd55 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -4,7 +4,7 @@
 , buildPythonPackage
 , pythonOlder
   # Mitmproxy requirements
-, aioquic
+, aioquic-mitmproxy
 , asgiref
 , blinker
 , brotli
@@ -29,7 +29,7 @@
 , setuptools
 , sortedcontainers
 , tornado
-, urwid
+, urwid-mitmproxy
 , wsproto
 , zstandard
   # Additional check requirements
@@ -57,7 +57,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    aioquic
+    aioquic-mitmproxy
     asgiref
     blinker
     brotli
@@ -81,7 +81,7 @@ buildPythonPackage rec {
     setuptools
     sortedcontainers
     tornado
-    urwid
+    urwid-mitmproxy
     wsproto
     zstandard
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/mkdocs-material/default.nix b/pkgs/development/python-modules/mkdocs-material/default.nix
index 59c433145b02f..e8df6bbc82537 100644
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@@ -1,54 +1,86 @@
 { lib
-, callPackage
 , buildPythonPackage
 , fetchFromGitHub
-, colorama
+
+# build-system
 , hatch-requirements-txt
 , hatch-nodejs-version
 , hatchling
+, trove-classifiers
+
+# dependencies
+, babel
+, colorama
 , jinja2
 , markdown
 , mkdocs
 , mkdocs-material-extensions
+, paginate
 , pygments
 , pymdown-extensions
 , pythonOlder
 , regex
 , requests
+
+# optional-dependencies
+, mkdocs-minify-plugin
+, mkdocs-redirects
+, mkdocs-git-revision-date-localized-plugin
+, pillow
+, cairosvg
 }:
 
 buildPythonPackage rec {
   pname = "mkdocs-material";
-  version = "9.3.1";
-  format = "pyproject";
+  version = "9.4.14";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "squidfunk";
-    repo = pname;
+    repo = "mkdocs-material";
     rev = "refs/tags/${version}";
-    hash = "sha256-2Z1U71agXxkYp1OFYd/xInAfN5SVI9FQf39b8DkX10o=";
+    hash = "sha256-oP0DeSRgoLx6boEOa3if5BitGXmJ11DoUVZK16Sjlwg=";
   };
 
   nativeBuildInputs = [
     hatch-requirements-txt
     hatch-nodejs-version
     hatchling
+    trove-classifiers
   ];
 
   propagatedBuildInputs = [
+    babel
     colorama
     jinja2
     markdown
     mkdocs
     mkdocs-material-extensions
+    paginate
     pygments
     pymdown-extensions
     regex
     requests
   ];
 
+  passthru.optional-dependencies = {
+    recommended = [
+      mkdocs-minify-plugin
+      mkdocs-redirects
+      # TODO: mkdocs-rss-plugin
+    ];
+    git = [
+      # TODO: gmkdocs-git-committers-plugin
+      mkdocs-git-revision-date-localized-plugin
+    ];
+    imaging = [
+      cairosvg
+      pillow
+    ];
+  };
+
   # No tests for python
   doCheck = false;
 
@@ -57,7 +89,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/squidfunk/mkdocs-material/blob/${src.rev}/CHANGELOG";
     description = "Material for mkdocs";
+    downloadPage = "https://github.com/squidfunk/mkdocs-material";
     homepage = "https://squidfunk.github.io/mkdocs-material/";
     license = licenses.mit;
     maintainers = with maintainers; [ dandellion ];
diff --git a/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix b/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix
index 4e1c47a8c49d4..239d3507d59b3 100644
--- a/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix
+++ b/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-material-extensions";
-  version = "1.1.1";
+  version = "1.3.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-FHI6WEQRd/Ff6pmU13f8f0zPSeFhhbmDdk4/0rdIl4I=";
+    hash = "sha256-/jU30Ol10/4haR3ZPJWZ3iWRfXG/RUOU1oclOYGjjAY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-minify/default.nix b/pkgs/development/python-modules/mkdocs-minify-plugin/default.nix
index fcab8677cffa4..dbb09cc5795b9 100644
--- a/pkgs/development/python-modules/mkdocs-minify/default.nix
+++ b/pkgs/development/python-modules/mkdocs-minify-plugin/default.nix
@@ -9,13 +9,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "mkdocs-minify";
+  pname = "mkdocs-minify-plugin";
   version = "0.7.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "byrnereese";
-    repo = "${pname}-plugin";
+    repo = "mkdocs-minify-plugin";
     rev = "refs/tags/${version}";
     hash = "sha256-LDCAWKVbFsa6Y/tmY2Zne4nOtxe4KvNplZuWxg4e4L8=";
   };
diff --git a/pkgs/development/python-modules/mkdocs/default.nix b/pkgs/development/python-modules/mkdocs/default.nix
index 61c8bdcd13c15..8a402510ec18d 100644
--- a/pkgs/development/python-modules/mkdocs/default.nix
+++ b/pkgs/development/python-modules/mkdocs/default.nix
@@ -3,6 +3,7 @@
   lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 
 # buildtime
@@ -23,23 +24,27 @@
 , pyyaml-env-tag
 , watchdog
 
-# testing deps
+# optional-dependencies
 , babel
+, setuptools
+
+# testing deps
 , mock
 , unittestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "mkdocs";
-  version = "1.5.2";
-  format = "pyproject";
-  disabled = pythonOlder "3.6";
+  version = "1.5.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-9sV1bewsHVJEc2kTyGxDM6SjDTEKEc/HSY6gWBC5tvE=";
+    hash = "sha256-axH4AeL+osxoUIVJbW6YjiTfUr6TAXMB4raZ3oO0fyw=";
   };
 
   nativeBuildInputs = [
@@ -63,18 +68,27 @@ buildPythonPackage rec {
     importlib-metadata
   ];
 
+  passthru.optional-dependencies = {
+    i18n = [
+      babel
+    ] ++ lib.optionals (pythonAtLeast "3.12") [
+      setuptools
+    ];
+  };
+
   nativeCheckInputs = [
     unittestCheckHook
-    babel
     mock
-  ];
+  ] ++ passthru.optional-dependencies.i18n;
 
   unittestFlagsArray = [ "-v" "-p" "'*tests.py'" "mkdocs" ];
 
   pythonImportsCheck = [ "mkdocs" ];
 
   meta = with lib; {
+    changelog = "https://github.com/mkdocs/mkdocs/releases/tag/${version}";
     description = "Project documentation with Markdown / static website generator";
+    downloadPage = "https://github.com/mkdocs/mkdocs";
     longDescription = ''
       MkDocs is a fast, simple and downright gorgeous static site generator that's
       geared towards building project documentation. Documentation source files
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index 7070f1fd1cf77..d13831de33015 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -38,14 +38,14 @@
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "2.7.0";
+  version = "2.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3q8PXydgjpUm1p//zKcMgirJDqKQpvPkuz36GyCbARE=";
+    hash = "sha256-5OW90tnvsLOG7Lzi335D8ExGoyCAIIQU3FO1/XFVlng=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mlxtend/default.nix b/pkgs/development/python-modules/mlxtend/default.nix
index 7a17e9a81925d..7f84aaac49ba1 100644
--- a/pkgs/development/python-modules/mlxtend/default.nix
+++ b/pkgs/development/python-modules/mlxtend/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , isPy27
+, setuptools
 , pytestCheckHook
 , scipy
 , numpy
@@ -13,23 +14,21 @@
 
 buildPythonPackage rec {
   pname = "mlxtend";
-  version = "0.22.0";
-  format = "setuptools";
+  version = "0.23.0";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "rasbt";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-YLCNLpg2qrdFon0/gdggJd9XovHwRHAdleBFQc18qzE=";
+    hash = "sha256-TUZ8SdQAOV1CaIlDl4uXYVHvdlEkOz6E48S3pUS6UE0=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  # image tests download files over the network
-  pytestFlagsArray = [ "-sv" "--ignore=mlxtend/image" ];
-  # Fixed in master, but failing in release version
-  # see: https://github.com/rasbt/mlxtend/pull/721
-  disabledTests = [ "test_variance_explained_ratio" ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     scipy
@@ -40,6 +39,19 @@ buildPythonPackage rec {
     joblib
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "-sv"
+  ];
+
+  disabledTestPaths = [
+    # image tests download files over the network
+    "mlxtend/image"
+  ];
+
   meta = with lib; {
     description = "A library of Python tools and extensions for data science";
     homepage = "https://github.com/rasbt/mlxtend";
diff --git a/pkgs/development/python-modules/mmengine/default.nix b/pkgs/development/python-modules/mmengine/default.nix
index ff071c0669541..a73d1fff7d358 100644
--- a/pkgs/development/python-modules/mmengine/default.nix
+++ b/pkgs/development/python-modules/mmengine/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "mmengine";
-  version = "0.8.4";
+  version = "0.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "open-mmlab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kJhcw6Hpzx3s5WHeLTF8pydbAKXwfVgvxo7SsSN5gls=";
+    hash = "sha256-PG6KSoM5VUyU84z66eZknQfMhS4YWAmyWCIIpRwUOpU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mne-python/default.nix b/pkgs/development/python-modules/mne-python/default.nix
index 940c633d4115f..8a85f487d2d22 100644
--- a/pkgs/development/python-modules/mne-python/default.nix
+++ b/pkgs/development/python-modules/mne-python/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "mne-python";
-  version = "1.5.1";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "mne-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-djVQkj8ktIOxe1xmi+XuIvdS1WdDzozgTJNJhWAhuBo=";
+    hash = "sha256-OoaXNHGL2svOpNL5GHcVRfQc9GxIRpZRhpZ5Hi1JTzM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mocket/default.nix b/pkgs/development/python-modules/mocket/default.nix
index 37a8c8d9cc746..fe7ca40ccf056 100644
--- a/pkgs/development/python-modules/mocket/default.nix
+++ b/pkgs/development/python-modules/mocket/default.nix
@@ -34,12 +34,12 @@
 
 buildPythonPackage rec {
   pname = "mocket";
-  version = "3.12.0";
+  version = "3.12.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-brvBWwTWT2F/usVBRr7wz9L0kct4X1Fddl4mu5LUENA=";
+    hash = "sha256-BN9S5/mku+HT1vglyobgHZPWsY0yvbfQfpMRUKrnJQQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mockfs/default.nix b/pkgs/development/python-modules/mockfs/default.nix
index 234a3d14d696f..680a6c9fc795b 100644
--- a/pkgs/development/python-modules/mockfs/default.nix
+++ b/pkgs/development/python-modules/mockfs/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , setuptools
 , setuptools-scm
-, wheel
+, importlib-metadata
 , pytestCheckHook
 }:
 
@@ -23,12 +23,13 @@ buildPythonPackage rec {
     sed -i '/addopts/d' pytest.ini
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
-    wheel
+  ];
+
+  propagatedBuildInputs = [
+    importlib-metadata
   ];
 
   pythonImportsCheck = [ "mockfs" ];
diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index cebb9c382c7c2..8e9ac1b408d23 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "monty";
-  version = "2023.9.5";
+  version = "2023.11.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "materialsvirtuallab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-VzOu0gLQcobWQs8uMFzI4CyN+1OVx94VqhJYB+rMpMI=";
+    hash = "sha256-SENrAHCCWYEMWqPQSy61E8bMYkCBJepK5otb7B7UGXA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/moreorless/default.nix b/pkgs/development/python-modules/moreorless/default.nix
index 8f849b42f1378..39e467a59963e 100644
--- a/pkgs/development/python-modules/moreorless/default.nix
+++ b/pkgs/development/python-modules/moreorless/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-N11iqsxMGgzwW2QYeOoHQaR/aDEuoUnnd/2Mc5culN0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index a76f39fc2a52f..7f5b42e4d2f04 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "moto";
-  version = "4.2.10";
+  version = "4.2.11";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kllf4odHSjGsPvhHlB67CX6P+ww9bBBuR89XPbBpM7I=";
+    hash = "sha256-LaYtUuqnZd/idiySDwqIpY86CeBFgckduWfZL67ISPE=";
   };
 
   nativeBuildInputs = [
@@ -113,6 +113,9 @@ buildPythonPackage rec {
     # Fails at local name resolution
     "--deselect=tests/test_s3/test_multiple_accounts_server.py::TestAccountIdResolution::test_with_custom_request_header"
     "--deselect=tests/test_s3/test_server.py::test_s3_server_post_cors_multiple_origins"
+    "--deselect=tests/test_s3/test_s3_file_handles.py::TestS3FileHandleClosuresUsingMocks::test_create_multipart"
+    "--deselect=tests/test_core/test_responses_module.py::TestResponsesMockWithPassThru::test_aws_and_http_requests"
+    "--deselect=tests/test_core/test_responses_module.py::TestResponsesMockWithPassThru::test_http_requests"
 
     # Fails at resolving google.com
     "--deselect=tests/test_firehose/test_firehose_put.py::test_put_record_http_destination"
@@ -125,13 +128,12 @@ buildPythonPackage rec {
     # Connection Reset by Peer, when connecting to localhost:5678
     "--deselect=tests/test_moto_api/recorder/test_recorder.py::TestRecorder::test_replay"
 
-    # Requires docker, but isn't marked
-    # https://github.com/getmoto/moto/pull/6938
-    "--deselect=tests/test_awslambda/test_lambda_layers_invoked.py::test_invoke_local_lambda_layers"
-
     # Flaky under parallel execution
     "--deselect=tests/test_cloudformation/test_server.py::test_cloudformation_server_get"
     "--deselect=tests/test_core/test_moto_api.py::TestModelDataResetForClassDecorator::test_should_find_bucket"
+
+    # AssertionError: assert ResourceWarning not in [<class 'ResourceWarning'>, <class 'ResourceWarning'>]
+    "--deselect=ests/test_s3/test_s3_file_handles.py::TestS3FileHandleClosuresUsingMocks::test_delete_object_with_version"
   ];
 
   disabledTestPaths = [
@@ -151,7 +153,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Allows your tests to easily mock out AWS Services";
-    homepage = "https://github.com/spulec/moto";
+    homepage = "https://github.com/getmoto/moto";
     changelog = "https://github.com/getmoto/moto/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = [ ];
diff --git a/pkgs/development/python-modules/motor/default.nix b/pkgs/development/python-modules/motor/default.nix
index 3e4cf4d574add..1725547b1d7b0 100644
--- a/pkgs/development/python-modules/motor/default.nix
+++ b/pkgs/development/python-modules/motor/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "motor";
-  version = "3.3.1";
+  version = "3.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "mongodb";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-iJz3JiW9cVT3G1rLQwWQXcPfPBRGsIwVLs4gauM+pYo=";
+    hash = "sha256-ajlZleaaq0LIEW5PdTRQWL312guYA+7+x1xtPNKZQC0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mpl-scatter-density/default.nix b/pkgs/development/python-modules/mpl-scatter-density/default.nix
index 48d05b1e6ca58..152c07f10a7eb 100644
--- a/pkgs/development/python-modules/mpl-scatter-density/default.nix
+++ b/pkgs/development/python-modules/mpl-scatter-density/default.nix
@@ -44,8 +44,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ matplotlib numpy fast-histogram ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     pytestCheckHook
     pytest-mpl
diff --git a/pkgs/development/python-modules/mpris-server/default.nix b/pkgs/development/python-modules/mpris-server/default.nix
index 783fc6aab959f..e792426491f1b 100644
--- a/pkgs/development/python-modules/mpris-server/default.nix
+++ b/pkgs/development/python-modules/mpris-server/default.nix
@@ -9,13 +9,13 @@
 }:
 buildPythonPackage rec {
   pname = "mpris-server";
-  version = "0.4.2";
+  version = "0.8.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "mpris_server";
     inherit version;
-    hash = "sha256-p3nM80fOMtRmeKvOXuX40Fu9xH8gPgYyneXbUS678fE=";
+    hash = "sha256-dfnFX+u7PhQb4ScHIkRHnGVpCABZhhlw/R+ks63zcec=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index ab54e9e5adea3..c489f5b75b2db 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "msal";
-  version = "1.24.1";
+  version = "1.25.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qglyiEs8b97FPZoL0VwS5b17cawbZtdG9U0Shwnz+Pg=";
+    hash = "sha256-9EMp/bWfTwRMd5Fko0R0uKRK2eSUCvvEw6Oiu+kDJNk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/msgpack/default.nix b/pkgs/development/python-modules/msgpack/default.nix
index d44166b82f7de..7bcdb42095b33 100644
--- a/pkgs/development/python-modules/msgpack/default.nix
+++ b/pkgs/development/python-modules/msgpack/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "msgpack";
-  version = "1.0.5";
+  version = "1.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wHVUQoTq3Fzdxw9HVzMdmdy8FrK71ISdFfiq5M820xw=";
+    hash = "sha256-Vy78k9t6TSfkBFAZdcptLZd1cFwtkiOQ2Hj892jZLIc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index 863e005d4a4b0..79646183fa18b 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , fetchPypi
 , buildPythonPackage
 , pytestCheckHook
@@ -22,6 +23,11 @@ buildPythonPackage rec {
     sed -i '/^addopts/d' setup.cfg
   '';
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [
+    # error: incompatible pointer to integer conversion initializing 'int' with an expression of type 'void *'
+    "-Wno-error=int-conversion"
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "multidict" ];
diff --git a/pkgs/development/python-modules/munch/default.nix b/pkgs/development/python-modules/munch/default.nix
index b754514649a23..368cc0eff5ada 100644
--- a/pkgs/development/python-modules/munch/default.nix
+++ b/pkgs/development/python-modules/munch/default.nix
@@ -1,24 +1,39 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, six
+, fetchFromGitHub
+
+# build-system
 , pbr
+, setuptools
+
+# tests
+, pytestCheckHook
+, pyyaml
 }:
 
 buildPythonPackage rec {
   pname = "munch";
   version = "4.0.0";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-VCyxUUYSYyFqTjfD/Zr8Ql/urziqowJc0qmB+ttCIjU=";
+  src = fetchFromGitHub {
+    owner = "Infinidat";
+    repo = "munch";
+    rev = "refs/tags/${version}";
+    hash = "sha256-p7DvOGRhkCmtJ32EfttyKXGGmO5kfb2bQGqok/RJtU8=";
   };
 
-  propagatedBuildInputs = [ six pbr ];
+  env.PBR_VERSION = version;
+
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
-  # No tests in archive
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    pyyaml
+  ];
 
   meta = with lib; {
     description = "A dot-accessible dictionary (a la JavaScript objects)";
diff --git a/pkgs/development/python-modules/mutagen/default.nix b/pkgs/development/python-modules/mutagen/default.nix
index 236af1eb5d1ff..2ffaadaffeaac 100644
--- a/pkgs/development/python-modules/mutagen/default.nix
+++ b/pkgs/development/python-modules/mutagen/default.nix
@@ -3,6 +3,9 @@
 , pythonOlder
 , fetchPypi
 
+# build-system
+, setuptools
+
 # docs
 , python
 , sphinx
@@ -31,6 +34,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
+    setuptools
     sphinx
     sphinx-rtd-theme
   ];
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index f3c06701eb65c..d63e6f9791e5b 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.19.1";
+  version = "7.21.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-Gz6OJ2ER60R14aTmhPfodX22FlbicUClBtlqNglTjC4=";
+    hash = "sha256-lj9Jkp1AGWIAdGzakpt0BMnmdwe1Uf04PI9sMfEBTbw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/napari-console/default.nix b/pkgs/development/python-modules/napari-console/default.nix
index acefdcc14bca0..9072ada93f420 100644
--- a/pkgs/development/python-modules/napari-console/default.nix
+++ b/pkgs/development/python-modules/napari-console/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-vHLCVMgrcs54pGb48wQpc0h7QBIfE6r7hCSoDNI3QvA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/napari-npe2/default.nix b/pkgs/development/python-modules/napari-npe2/default.nix
index 53fffeaadcbad..64659858258bf 100644
--- a/pkgs/development/python-modules/napari-npe2/default.nix
+++ b/pkgs/development/python-modules/napari-npe2/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "napari-npe2";
-  version = "0.7.2";
+  version = "0.7.2-unstable-2023-10-20";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,11 +25,12 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "napari";
     repo = "npe2";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-PjoLocNTkcAnBNRbPi+MZqZtQ2bjWPIUVz0+k8nIn2A=";
+    rev = "9d29e4d6dbbec75c2d36273647efd9ddfb59ded0";
+    hash = "sha256-JLu/5pXijPdpKY2z2rREtSKPiP33Yy4viegbxUiQg7Y=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  # fix this in the next release
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = "0.7.2";
 
   nativeBuildInputs = [
     hatchling
diff --git a/pkgs/development/python-modules/napari-plugin-engine/default.nix b/pkgs/development/python-modules/napari-plugin-engine/default.nix
index 8b9a015e00657..499f87ecf716f 100644
--- a/pkgs/development/python-modules/napari-plugin-engine/default.nix
+++ b/pkgs/development/python-modules/napari-plugin-engine/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-cKpCAEYYRq3UPje7REjzhEe1J9mmrtXs8TBnxWukcNE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/napari-svg/default.nix b/pkgs/development/python-modules/napari-svg/default.nix
index b07ca1e2cf188..9150abfb252b0 100644
--- a/pkgs/development/python-modules/napari-svg/default.nix
+++ b/pkgs/development/python-modules/napari-svg/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-lvI6RWT9oUE95vL6WO75CASc/Z+1G5UMm2p8vhqIjA0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/napari/default.nix b/pkgs/development/python-modules/napari/default.nix
index 9df87e357dd36..9997d58eb50be 100644
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@@ -50,8 +50,6 @@ mkDerivationWith buildPythonPackage rec {
     hash = "sha256-xF0DYK+226MZpB050IukNvTg2iHMQAIZW0serKRJd/0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "scikit-image>=0.19.1" "scikit-image" \
diff --git a/pkgs/development/python-modules/nbclient/default.nix b/pkgs/development/python-modules/nbclient/default.nix
index 745de65f4b2e4..e2d4fc2810c50 100644
--- a/pkgs/development/python-modules/nbclient/default.nix
+++ b/pkgs/development/python-modules/nbclient/default.nix
@@ -19,7 +19,7 @@
 
 let nbclient = buildPythonPackage rec {
   pname = "nbclient";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ let nbclient = buildPythonPackage rec {
     owner = "jupyter";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-uBCYmrl/Zfw58hd12z20jLVwGSPv+M3fMo1mfV2GO/M=";
+    hash = "sha256-m0Tke/JlTeKE3PJZ1rBejra/HPEXCSS0ur/cPiSBJZw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index e1bb3e84079be..582d46b521089 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "nbdime";
-  version = "3.2.1";
+  version = "4.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MUCaMPhI/8azJUBpfoLVoKG4TcwycWynTni8xLRXxFM=";
+    hash = "sha256-8adgwLAMG6m0lFwWzpJXfzk/tR0YTzUbdoW6boUCCY4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ncclient/default.nix b/pkgs/development/python-modules/ncclient/default.nix
index 4b656fd72fd04..c3040475cf2e3 100644
--- a/pkgs/development/python-modules/ncclient/default.nix
+++ b/pkgs/development/python-modules/ncclient/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "ncclient";
-  version = "0.6.13";
+  version = "0.6.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-NrilXB1NFcqNCGrwshhuLdhQoeHJ12PSp4MBScT9kYc=";
+    hash = "sha256-mdFoSTUS4QhY05rY0fqKTpRQTR9oLvOMTVr4kWJbiUQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nengo/default.nix b/pkgs/development/python-modules/nengo/default.nix
index da5d79e31e655..86231c3f04017 100644
--- a/pkgs/development/python-modules/nengo/default.nix
+++ b/pkgs/development/python-modules/nengo/default.nix
@@ -1,4 +1,7 @@
-{ lib, fetchFromGitHub, buildPythonPackage
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, setuptools
 , numpy
 , scipySupport ? false, scipy
 , scikitSupport ? false, scikit-learn
@@ -6,16 +9,20 @@
 
 buildPythonPackage rec {
   pname = "nengo";
-  version = "3.2.0";
-  format = "setuptools";
+  version = "4.0.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nengo";
     repo = "nengo";
-    rev = "v${version}";
-    sha256 = "12lz8lzirxvwnpa74k9k48c64gs6gi092928rh97siya3i6gjs6i";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-b9mPjKdewIqIeRrddV1/M3bghSyox7Lz6VbfSLCHZjA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ numpy ]
     ++ lib.optionals scipySupport [ scipy ]
     ++ lib.optionals scikitSupport [ scikit-learn ];
diff --git a/pkgs/development/python-modules/netaddr/default.nix b/pkgs/development/python-modules/netaddr/default.nix
index 98c886d2825e3..65f4fcd61421b 100644
--- a/pkgs/development/python-modules/netaddr/default.nix
+++ b/pkgs/development/python-modules/netaddr/default.nix
@@ -2,32 +2,40 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, glibcLocales
-, importlib-resources
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "netaddr";
-  version = "0.8.0";
-  format = "setuptools";
+  version = "0.9.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0hx2npi0wnhwlcybilgwlddw6qffx1mb7a3sj4p9s7bvl33mgk6n";
+    sha256 = "sha256-e0b6mxotcf1d6eSjeE7zOXAKU6CMgEDwi69fEZTaASg=";
   };
 
-  LC_ALL = "en_US.UTF-8";
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.7") [ importlib-resources ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  nativeCheckInputs = [ glibcLocales pytestCheckHook ];
+  pythonImportsCheck = [
+    "netaddr"
+  ];
 
   meta = with lib; {
-    homepage = "https://netaddr.readthedocs.io/en/latest/";
-    downloadPage = "https://github.com/netaddr/netaddr/releases";
-    changelog = "https://netaddr.readthedocs.io/en/latest/changes.html";
     description = "A network address manipulation library for Python";
+    homepage = "https://netaddr.readthedocs.io/";
+    downloadPage = "https://github.com/netaddr/netaddr/releases";
+    changelog = "https://github.com/netaddr/netaddr/blob/${version}/CHANGELOG";
     license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/netmiko/default.nix b/pkgs/development/python-modules/netmiko/default.nix
index 7c2fbda27ced6..f893ce204455b 100644
--- a/pkgs/development/python-modules/netmiko/default.nix
+++ b/pkgs/development/python-modules/netmiko/default.nix
@@ -1,18 +1,47 @@
-{ lib, buildPythonPackage, fetchPypi, setuptools, paramiko, scp, tenacity
-, textfsm, ntc-templates, pyserial, pytestCheckHook, pyyaml }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, poetry-core
+
+# dependencies
+, ntc-templates
+, paramiko
+, pyserial
+, pyyaml
+, scp
+, textfsm
+}:
 
 buildPythonPackage rec {
   pname = "netmiko";
-  version = "4.2.0";
-  format = "setuptools";
+  version = "4.3.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-et3m/j6mMzYij0moY2UMLYP7DmgODw0Vi1sPsExBAOE=";
+    hash = "sha256-2pD2798ztBQOts1/InJ3PCzhRPp0rDTV7KwbTUYH8fs=";
   };
 
-  buildInputs = [ setuptools ];
-  propagatedBuildInputs = [ paramiko scp tenacity pyyaml textfsm ntc-templates pyserial ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry==1.3.2" "poetry-core" \
+      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    ntc-templates
+    paramiko
+    pyserial
+    pyyaml
+    scp
+    textfsm
+  ];
 
   # tests require closed-source pyats and genie packages
   doCheck = false;
diff --git a/pkgs/development/python-modules/networkx/default.nix b/pkgs/development/python-modules/networkx/default.nix
index 20c73fb6adf86..51e580af4eb29 100644
--- a/pkgs/development/python-modules/networkx/default.nix
+++ b/pkgs/development/python-modules/networkx/default.nix
@@ -1,30 +1,67 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, nose
-, pytestCheckHook
-, decorator
-, setuptools
 , pythonOlder
+
+# build-system
+, setuptools
+
+# optional-dependencies
+, lxml
+, matplotlib
+, numpy
+, pandas
+, pydot
+, pygraphviz
+, scipy
+, sympy
+
+# tests
+, pytest-xdist
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "networkx";
   # upgrade may break sage, please test the sage build or ping @timokau on upgrade
-  version = "3.1";
-  format = "setuptools";
+  version = "3.2.1";
+  pyproject = true;
+
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3jRjNUCPhN4Orab/n6+v/5vNoR8KDfqpMRM967FGq2E=";
+    hash = "sha256-nxu1zzQJvzJOCnIsIL20wg7jm/HDDOiuSZyFArC14MY=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  passthru.optional-dependencies = {
+    default = [
+      numpy
+      scipy
+      matplotlib
+      pandas
+    ];
+    extra = [
+      lxml
+      pygraphviz
+      pydot
+      sympy
+    ];
   };
 
-  propagatedBuildInputs = [ decorator setuptools ];
-  nativeCheckInputs = [ nose pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
 
   meta = {
+    changelog = "https://github.com/networkx/networkx/blob/networkx-${version}/doc/release/release_${version}.rst";
     homepage = "https://networkx.github.io/";
+    downloadPage = "https://github.com/networkx/networkx";
     description = "Library for the creation, manipulation, and study of the structure, dynamics, and functions of complex networks";
     license = lib.licenses.bsd3;
   };
diff --git a/pkgs/development/python-modules/nose/default.nix b/pkgs/development/python-modules/nose/default.nix
index 376e56041b614..dc9dc51da5b8e 100644
--- a/pkgs/development/python-modules/nose/default.nix
+++ b/pkgs/development/python-modules/nose/default.nix
@@ -4,8 +4,8 @@
 , isPy3k
 , isPyPy
 , python
+ ,pythonAtLeast
 , coverage
-, buildPackages
 }:
 
 buildPythonPackage rec {
@@ -13,6 +13,9 @@ buildPythonPackage rec {
   format = "setuptools";
   pname = "nose";
 
+  # unmaintained, relies on the imp module
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "f1bffef9cbc82628f6e7d7b40d7e255aefaa1adb6a1b1d26c69a8b79e6208a98";
diff --git a/pkgs/development/python-modules/nose2/default.nix b/pkgs/development/python-modules/nose2/default.nix
index b49900e1576f0..28dd8df3e263d 100644
--- a/pkgs/development/python-modules/nose2/default.nix
+++ b/pkgs/development/python-modules/nose2/default.nix
@@ -1,16 +1,22 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
-, six
 , pythonOlder
+
+# build-system
+, setuptools
+
+# optional-dependencies
 , coverage
+
+# tests
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "nose2";
   version = "0.14.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -19,21 +25,32 @@ buildPythonPackage rec {
     hash = "sha256-XCjXcKC5pwKGK9bDdVuizS95lN1RjJguXOKY1/N0ZqQ=";
   };
 
-  propagatedBuildInputs = [
-    coverage
-    six
+  nativeBuildInputs = [
+    setuptools
   ];
 
-  __darwinAllowLocalNetworking = true;
-
-  checkPhase = ''
-    ${python.interpreter} -m unittest
-  '';
+  passthru.optional-dependencies = {
+    coverage = [
+      coverage
+    ];
+  };
 
   pythonImportsCheck = [
     "nose2"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  preCheck = ''
+    # https://github.com/nose-devs/nose2/issues/588
+    substituteInPlace nose2/tests/functional/test_junitxml_plugin.py \
+      --replace "test_skip_reason_in_message" "dont_test_skip_reason_in_message"
+  '';
+
   meta = with lib; {
     description = "Test runner for Python";
     homepage = "https://github.com/nose-devs/nose2";
diff --git a/pkgs/development/python-modules/nosexcover/default.nix b/pkgs/development/python-modules/nosexcover/default.nix
index 21d11f0d6d907..19d34904739ba 100644
--- a/pkgs/development/python-modules/nosexcover/default.nix
+++ b/pkgs/development/python-modules/nosexcover/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , coverage
 , nose
 }:
@@ -10,6 +11,9 @@ buildPythonPackage rec {
   version = "1.0.11";
   format = "setuptools";
 
+  # requires the imp module
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "298c3c655da587f6cab8a666e9f4b150320032431062dea91353988d45c8b883";
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index 88f4c975a8588..e26ec900682a6 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "7.0.3";
+  version = "7.0.6";
   disabled = pythonOlder "3.8";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B/PFBi/Q5uaYZEN6A0erxIXZkaroepLEfWWWmfVxtyk=";
+    hash = "sha256-7GETsGUpAZ9/KHgZrwbJeiuvepWsIaj24yGSiY6fmlg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/notion-client/default.nix b/pkgs/development/python-modules/notion-client/default.nix
index 9848868f0062e..0e24bb60ad48d 100644
--- a/pkgs/development/python-modules/notion-client/default.nix
+++ b/pkgs/development/python-modules/notion-client/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pythonOlder
 , pytestCheckHook
+, setuptools
 , anyio
 , httpx
 , pytest-asyncio
@@ -11,17 +12,22 @@
 
 buildPythonPackage rec {
   pname = "notion-client";
-  version = "2.0.0";
-  format = "setuptools";
+  version = "2.1.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ramnes";
     repo = "notion-sdk-py";
-    rev = version;
-    hash = "sha256-zfG1OgH/2ytDUC+ogIY9/nP+xkgjiMt9+HVcWEMXoj8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-u10iPSbFPv9RewEYru3V6MpwhhySzmnymmv4CsefGC8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     httpx
   ];
diff --git a/pkgs/development/python-modules/ntc-templates/default.nix b/pkgs/development/python-modules/ntc-templates/default.nix
index c7cf3b23ae61f..38927877146a2 100644
--- a/pkgs/development/python-modules/ntc-templates/default.nix
+++ b/pkgs/development/python-modules/ntc-templates/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ntc-templates";
-  version = "3.5.0";
+  version = "4.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "networktocode";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FhKMDSAW+MifAy2EnHePbSfY56rdK1SfOe85bFte6ps=";
+    hash = "sha256-tenztWqSjVVDJygBvJpdLFbKmz+TPKYu0UhscqJBhLc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/numcodecs/default.nix b/pkgs/development/python-modules/numcodecs/default.nix
index d5722053c6e1a..a0a452a0ecc22 100644
--- a/pkgs/development/python-modules/numcodecs/default.nix
+++ b/pkgs/development/python-modules/numcodecs/default.nix
@@ -1,30 +1,40 @@
 { lib
 , stdenv
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
-, isPy27
 , setuptools
 , setuptools-scm
 , cython
-, entrypoints
 , numpy
 , msgpack
 , py-cpuinfo
 , pytestCheckHook
 , python
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "numcodecs";
-  version = "0.11.0";
-  format ="pyproject";
-  disabled = isPy27;
+  version = "0.12.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bAWLMh3oShcpKZsOrk1lKy5I6hyn+d8NplyxNHDmNes=";
+    hash = "sha256-BdkaQzcz5+7yaNfoDsImoCMtokQolhSo84JpAa7BCY4=";
   };
 
+  patches = [
+    # https://github.com/zarr-developers/numcodecs/pull/487
+    (fetchpatch {
+      name = "fix-tests.patch";
+      url = "https://github.com/zarr-developers/numcodecs/commit/4896680087d3ff1f959401c51cf5aea0fd56554e.patch";
+      hash = "sha256-+lMWK5IsNzJ7H2SmLckgxbSSRIIcC7FtGYSBKQtuo+Y=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -33,17 +43,21 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    entrypoints
     numpy
-    msgpack
   ];
 
+  passthru.optional-dependencies = {
+    msgpack = [ msgpack ];
+    # zfpy = [ zfpy ];
+  };
+
   preBuild = if (stdenv.hostPlatform.isx86 && !stdenv.hostPlatform.avx2Support) then ''
     export DISABLE_NUMCODECS_AVX2=
   '' else null;
 
   nativeCheckInputs = [
     pytestCheckHook
+    msgpack
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/numexpr/default.nix b/pkgs/development/python-modules/numexpr/default.nix
index 6acc3e53f4e4a..6316ba29356c9 100644
--- a/pkgs/development/python-modules/numexpr/default.nix
+++ b/pkgs/development/python-modules/numexpr/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "numexpr";
-  version = "2.8.6";
+  version = "2.8.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Yzb426P0VuQaT/w8l+tj2JxzWJ/24XBxQSJLkwJjJg0=";
+    hash = "sha256-WW7rO7/ryRL0tuqvhCthunIs69uLxC3++mV9OnSVOEk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/numpy/0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch b/pkgs/development/python-modules/numpy/0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch
new file mode 100644
index 0000000000000..b9bc53e0b84df
--- /dev/null
+++ b/pkgs/development/python-modules/numpy/0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch
@@ -0,0 +1,71 @@
+From 0d0476328a1a2e3dd3e96340bd4ddd04d98c067b Mon Sep 17 00:00:00 2001
+From: Ralf Gommers <ralf.gommers@gmail.com>
+Date: Thu, 26 Oct 2023 16:57:03 +0200
+Subject: [PATCH] BLD: remove last usage of `distutils` in
+ `_core/code_generators/`
+
+---
+ numpy/core/code_generators/genapi.py             | 9 ---------
+ numpy/core/code_generators/generate_numpy_api.py | 7 +------
+ numpy/core/code_generators/generate_ufunc_api.py | 7 +------
+ 3 files changed, 2 insertions(+), 21 deletions(-)
+
+diff --git a/numpy/core/code_generators/genapi.py b/numpy/core/code_generators/genapi.py
+index 2cdaba52d..d9d7862b2 100644
+--- a/numpy/core/code_generators/genapi.py
++++ b/numpy/core/code_generators/genapi.py
+@@ -304,15 +304,6 @@ def find_functions(filename, tag='API'):
+     fo.close()
+     return functions
+ 
+-def should_rebuild(targets, source_files):
+-    from distutils.dep_util import newer_group
+-    for t in targets:
+-        if not os.path.exists(t):
+-            return True
+-    sources = API_FILES + list(source_files) + [__file__]
+-    if newer_group(sources, targets[0], missing='newer'):
+-        return True
+-    return False
+ 
+ def write_file(filename, data):
+     """
+diff --git a/numpy/core/code_generators/generate_numpy_api.py b/numpy/core/code_generators/generate_numpy_api.py
+index ae38c4efc..640bae9e5 100644
+--- a/numpy/core/code_generators/generate_numpy_api.py
++++ b/numpy/core/code_generators/generate_numpy_api.py
+@@ -148,12 +148,7 @@ def generate_api(output_dir, force=False):
+     targets = (h_file, c_file)
+ 
+     sources = numpy_api.multiarray_api
+-
+-    if (not force and not genapi.should_rebuild(targets, [numpy_api.__file__, __file__])):
+-        return targets
+-    else:
+-        do_generate_api(targets, sources)
+-
++    do_generate_api(targets, sources)
+     return targets
+ 
+ def do_generate_api(targets, sources):
+diff --git a/numpy/core/code_generators/generate_ufunc_api.py b/numpy/core/code_generators/generate_ufunc_api.py
+index e03299a52..3734cbd6a 100644
+--- a/numpy/core/code_generators/generate_ufunc_api.py
++++ b/numpy/core/code_generators/generate_ufunc_api.py
+@@ -125,12 +125,7 @@ def generate_api(output_dir, force=False):
+     targets = (h_file, c_file)
+ 
+     sources = ['ufunc_api_order.txt']
+-
+-    if (not force and not genapi.should_rebuild(targets, sources + [__file__])):
+-        return targets
+-    else:
+-        do_generate_api(targets, sources)
+-
++    do_generate_api(targets, sources)
+     return targets
+ 
+ def do_generate_api(targets, sources):
+-- 
+2.42.0
+
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 62ffc91e87677..ff50cf872f9cb 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -53,17 +53,20 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.26.1";
+  version = "1.26.2";
   pyproject = true;
   disabled = pythonOlder "3.9" || pythonAtLeast "3.13";
 
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-yMbHLUqfgx8yjvsTEmQqHK+vqoiYHZq3Y2jVDQfZPL4=";
+    hash = "sha256-9lc4RHZ2q1d38R5ru9uM4Rt4XhBfaQvEWWZXSBa20+o=";
   };
 
   patches = [
+    # Remove last usage of distutils to enable numpy on Python 3.12
+    ./0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch
+
     # Disable `numpy/core/tests/test_umath.py::TestComplexFunctions::test_loss_of_precision[complex256]`
     # on x86_64-darwin because it fails under Rosetta 2 due to issues with trig functions and
     # 80-bit long double complex numbers.
diff --git a/pkgs/development/python-modules/numpydoc/default.nix b/pkgs/development/python-modules/numpydoc/default.nix
index f189c16eafb20..428ea03ed2870 100644
--- a/pkgs/development/python-modules/numpydoc/default.nix
+++ b/pkgs/development/python-modules/numpydoc/default.nix
@@ -2,36 +2,41 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
+, setuptools
 , jinja2
 , sphinx
+, tabulate
 , pytestCheckHook
 , matplotlib
 }:
 
 buildPythonPackage rec {
   pname = "numpydoc";
-  version = "1.5.0";
-  format = "setuptools";
+  version = "1.6.0";
+  pyproject = true;
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname;
     inherit version;
-    hash = "sha256-sNt7daMjZ6DiXCOzl4QsZeNEoSBlJNFsgGnwockbX0w=";
+    hash = "sha256-rnpTgPCgY3PDr+FszRW9ebxrB/JwTLxvHn7MlLT1/A0=";
   };
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace "Jinja2>=2.10,<3.1" "Jinja2>=2.10,<3.2"
-    substituteInPlace setup.cfg \
+    substituteInPlace pyproject.toml \
       --replace "--cov-report=" "" \
       --replace "--cov=numpydoc" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jinja2
     sphinx
+    tabulate
   ];
 
   nativeCheckInputs = [
@@ -51,6 +56,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
+    changelog = "https://github.com/numpy/numpydoc/releases/tag/v${version}";
     description = "Sphinx extension to support docstrings in Numpy format";
     homepage = "https://github.com/numpy/numpydoc";
     license = lib.licenses.free;
diff --git a/pkgs/development/python-modules/nutils/default.nix b/pkgs/development/python-modules/nutils/default.nix
index 421131e7f8e23..803a4f1c04fd1 100644
--- a/pkgs/development/python-modules/nutils/default.nix
+++ b/pkgs/development/python-modules/nutils/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "nutils";
-  version = "8.3";
+  version = "8.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "evalf";
     repo = "nutils";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6VvzUKKUB5SkmvC7PFPqGayc51t3PTMPwrxgZI5+jHA=";
+    hash = "sha256-cwMo3ixTK7UO9sxhcQBN4/gNZNAoBH/xL2tZ1Orh8LE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oca-port/default.nix b/pkgs/development/python-modules/oca-port/default.nix
index 7b948c4ffdf3d..13a146b1dce67 100644
--- a/pkgs/development/python-modules/oca-port/default.nix
+++ b/pkgs/development/python-modules/oca-port/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   pythonImportsCheck = [ "oca_port" ];
diff --git a/pkgs/development/python-modules/oci/default.nix b/pkgs/development/python-modules/oci/default.nix
index f75cd25f21ece..8ead56fdae902 100644
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@@ -9,6 +9,7 @@
 , pythonOlder
 , pythonRelaxDepsHook
 , pytz
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -32,6 +33,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 93e3b0bf22f94..1104bcc02f823 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -31,11 +31,11 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "15.4.0";
+  version = "15.4.4";
 
   disabled = pythonOlder "3.9";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ocrmypdf";
@@ -47,11 +47,9 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-cbKqisaRAeT8ljANbYiUDrptAoQmmIkMu1ya8O6nXvQ=";
+    hash = "sha256-Ff0OrSJFglVPpSNB0KvDMnatj+P57zWdcVAFaM+Sg0s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   patches = [
     (substituteAll {
       src = ./paths.patch;
diff --git a/pkgs/development/python-modules/ocrmypdf/paths.patch b/pkgs/development/python-modules/ocrmypdf/paths.patch
index a1db7c690bcfa..1701a73215d0e 100644
--- a/pkgs/development/python-modules/ocrmypdf/paths.patch
+++ b/pkgs/development/python-modules/ocrmypdf/paths.patch
@@ -1,16 +1,16 @@
 diff --git a/src/ocrmypdf/_exec/ghostscript.py b/src/ocrmypdf/_exec/ghostscript.py
-index 92b73a0a..9f04555c 100644
+index 94eec244..4bb15db9 100644
 --- a/src/ocrmypdf/_exec/ghostscript.py
 +++ b/src/ocrmypdf/_exec/ghostscript.py
-@@ -58,7 +58,7 @@ log.addFilter(DuplicateFilter(log))
- 
- 
+@@ -31,7 +31,7 @@ COLOR_CONVERSION_STRATEGIES = frozenset(
+     ]
+ )
  # Ghostscript executable - gswin32c is not supported
 -GS = 'gswin64c' if os.name == 'nt' else 'gs'
 +GS = '@gs@'
  
  
- def version() -> Version:
+ log = logging.getLogger(__name__)
 diff --git a/src/ocrmypdf/_exec/jbig2enc.py b/src/ocrmypdf/_exec/jbig2enc.py
 index 5a34a95a..5ee1b333 100644
 --- a/src/ocrmypdf/_exec/jbig2enc.py
diff --git a/pkgs/development/python-modules/oemthermostat/default.nix b/pkgs/development/python-modules/oemthermostat/default.nix
index b97ddf64eb5bc..f40e39f10bf63 100644
--- a/pkgs/development/python-modules/oemthermostat/default.nix
+++ b/pkgs/development/python-modules/oemthermostat/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     sha256 = "vrMw3/X8MtejO1WyUA1DOlfVCPTCPgcK5p3+OlTWcM4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/oldest-supported-numpy/default.nix b/pkgs/development/python-modules/oldest-supported-numpy/default.nix
index 5d6e11c34daf8..7349a63a2c2a0 100644
--- a/pkgs/development/python-modules/oldest-supported-numpy/default.nix
+++ b/pkgs/development/python-modules/oldest-supported-numpy/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "oldest-supported-numpy";
-  version = "2023.8.3";
+  version = "2023.10.25";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yJp+wzsihagnI3crGPDBo+CqbVO4Xhxulj/o/NitxU0=";
+    hash = "sha256-dBqJrxLoyCMl9zEmtTORXc4QYNoPnk7GQtpGZoBoYpY=";
   };
 
   # The purpose of oldest-supported-numpy is to build a project against the
diff --git a/pkgs/development/python-modules/omegaconf/default.nix b/pkgs/development/python-modules/omegaconf/default.nix
index c6dfada82bd28..8ee54d3c6925e 100644
--- a/pkgs/development/python-modules/omegaconf/default.nix
+++ b/pkgs/development/python-modules/omegaconf/default.nix
@@ -1,6 +1,7 @@
 { lib
 , antlr4
 , antlr4-python3-runtime
+, attrs
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
@@ -55,6 +56,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    attrs
     pydevd
     pytest-mock
     pytestCheckHook
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
index d0866f6c0a83d..810ddbf62cf27 100644
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -20,7 +20,7 @@ let
   gtestStatic = gtest.override { static = true; };
 in buildPythonPackage rec {
   pname = "onnx";
-  version = "1.14.1";
+  version = "1.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ in buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZVSdk6LeAiZpQrrzLxphMbc1b3rNUMpcxcXPP8s/5tE=";
+    hash = "sha256-Jzga1IiUO5LN5imSUmnbsjYtapRatTihx38EOUjm9Os=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 2bab76a391d19..1488eed8440c3 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 , hatchling
 # propagated
 , httpx
@@ -28,6 +29,7 @@ buildPythonPackage rec {
   version = "1.6.1";
   pyproject = true;
 
+
   disabled = pythonOlder "3.7.1";
 
   src = fetchFromGitHub {
@@ -39,6 +41,12 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    # https://github.com/openai/openai-python/issues/921
+    "anyio"
   ];
 
   propagatedBuildInputs = [
@@ -72,6 +80,10 @@ buildPythonPackage rec {
     dirty-equals
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   OPENAI_API_KEY = "sk-foo";
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/openapi-core/default.nix b/pkgs/development/python-modules/openapi-core/default.nix
index 282c659291a4e..a6ddc2f5a61c6 100644
--- a/pkgs/development/python-modules/openapi-core/default.nix
+++ b/pkgs/development/python-modules/openapi-core/default.nix
@@ -28,8 +28,8 @@
 
 buildPythonPackage rec {
   pname = "openapi-core";
-  version = "0.18.1";
-  format = "pyproject";
+  version = "0.18.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "p1c2u";
     repo = "openapi-core";
     rev = "refs/tags/${version}";
-    hash = "sha256-8zD4SDGH7Pcu54CcBTJ9Q2sbYfWP4OyNh5STatZ7pAk=";
+    hash = "sha256-5sNI6ujqDQ5L4afVHYZkm2pKa8yATtHFo7MF3eFF8Ig=";
   };
 
   postPatch = ''
@@ -104,7 +104,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Client-side and server-side support for the OpenAPI Specification v3";
-    homepage = "https://github.com/p1c2u/openapi-core";
+    homepage = "https://github.com/python-openapi/openapi-core";
     license = licenses.bsd3;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/openapi-schema-validator/default.nix b/pkgs/development/python-modules/openapi-schema-validator/default.nix
index 39074543b42f6..4b0608c7572e4 100644
--- a/pkgs/development/python-modules/openapi-schema-validator/default.nix
+++ b/pkgs/development/python-modules/openapi-schema-validator/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "openapi-schema-validator";
-  version = "0.6.0";
+  version = "0.6.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "p1c2u";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-859v6KqIRfUq4d/KbkvGnGqlxz6BXTl+tKQHPhtkTH0=";
+    hash = "sha256-CfSlF6DWkYxxVNTNBkr0+KVeKpqxEEqkz4VBenqo+l0=";
   };
 
   postPatch = ''
@@ -47,12 +47,19 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # https://github.com/python-openapi/openapi-schema-validator/issues/153
+    "test_array_prefixitems_invalid"
+  ];
+
+  pytestFlagsArray = [ "-vvv" ];
+
   pythonImportsCheck = [ "openapi_schema_validator" ];
 
   meta = with lib; {
     changelog = "https://github.com/python-openapi/openapi-schema-validator/releases/tag/${version}";
     description = "Validates OpenAPI schema against the OpenAPI Schema Specification v3.0";
-    homepage = "https://github.com/p1c2u/openapi-schema-validator";
+    homepage = "https://github.com/python-openapi/openapi-schema-validator";
     license = licenses.bsd3;
     maintainers = with maintainers; [ AluisioASG ];
   };
diff --git a/pkgs/development/python-modules/openapi-spec-validator/default.nix b/pkgs/development/python-modules/openapi-spec-validator/default.nix
index 9312f4b1b2b94..4c89b69999075 100644
--- a/pkgs/development/python-modules/openapi-spec-validator/default.nix
+++ b/pkgs/development/python-modules/openapi-spec-validator/default.nix
@@ -9,7 +9,7 @@
 # propagates
 , importlib-resources
 , jsonschema
-, jsonschema-spec
+, jsonschema-path
 , lazy-object-proxy
 , openapi-schema-validator
 
@@ -19,17 +19,17 @@
 
 buildPythonPackage rec {
   pname = "openapi-spec-validator";
-  version = "0.6.0";
-  format = "pyproject";
+  version = "0.7.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   # no tests via pypi sdist
   src = fetchFromGitHub {
-    owner = "p1c2u";
+    owner = "python-openapi";
     repo = "openapi-spec-validator";
     rev = "refs/tags/${version}";
-    hash = "sha256-sGr4dH6Twyi4OeCAXZiboN75dYZ6wJ0pWMzV9zOfee0=";
+    hash = "sha256-X0ePdHQeBSWjsCFQgCoNloQZRhKbvPBE43aavBppvmg=";
   };
 
   postPatch = ''
@@ -42,7 +42,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     jsonschema
-    jsonschema-spec
+    jsonschema-path
     lazy-object-proxy
     openapi-schema-validator
   ] ++ lib.optionals (pythonOlder "3.9") [
diff --git a/pkgs/development/python-modules/openllm-core/default.nix b/pkgs/development/python-modules/openllm-core/default.nix
index ccf6aceef8bf3..c807f668b2711 100644
--- a/pkgs/development/python-modules/openllm-core/default.nix
+++ b/pkgs/development/python-modules/openllm-core/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 , accelerate
 , attrs
 , bitsandbytes
@@ -41,6 +42,17 @@ buildPythonPackage rec {
     hatch-fancy-pypi-readme
     hatch-vcs
     hatchling
+    pythonRelaxDepsHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "hatch-vcs==0.3.0" "hatch-vcs" \
+      --replace "hatchling==1.18.0" "hatchling"
+  '';
+
+  pythonRelaxDeps = [
+    "cattrs"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openpyxl/default.nix b/pkgs/development/python-modules/openpyxl/default.nix
index 799c991e40fe5..82af53c551190 100644
--- a/pkgs/development/python-modules/openpyxl/default.nix
+++ b/pkgs/development/python-modules/openpyxl/default.nix
@@ -1,12 +1,16 @@
 { lib
 , buildPythonPackage
-, et-xmlfile
 , fetchFromGitLab
-, jdcal
+, pythonOlder
+
+# dependencies
+, et-xmlfile
+
+# tests
 , lxml
+, pandas
 , pillow
 , pytestCheckHook
-, pythonOlder
 }:
 
 buildPythonPackage rec {
@@ -25,16 +29,33 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    jdcal
     et-xmlfile
-    lxml
   ];
 
   nativeCheckInputs = [
+    lxml
+    pandas
     pillow
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    # broken since lxml 2.12; https://foss.heptapod.net/openpyxl/openpyxl/-/issues/2116
+    "--deselect=openpyxl/chart/tests/test_reader.py::test_read"
+    "--deselect=openpyxl/comments/tests/test_comment_reader.py::test_read_comments"
+    "--deselect=openpyxl/drawing/tests/test_spreadsheet_drawing.py::TestSpreadsheetDrawing::test_ignore_external_blip"
+    "--deselect=openpyxl/packaging/tests/test_manifest.py::TestManifest::test_from_xml"
+    "--deselect=openpyxl/packaging/tests/test_manifest.py::TestManifest::test_filenames"
+    "--deselect=openpyxl/packaging/tests/test_manifest.py::TestManifest::test_exts"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_from_complex"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_merge_named_styles"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_unprotected_cell"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_none_values"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_rgb_colors"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_named_styles"
+    "--deselect=openpyxl/workbook/external_link/tests/test_external.py::test_read_ole_link"
+  ];
+
   pythonImportsCheck = [
     "openpyxl"
   ];
diff --git a/pkgs/development/python-modules/openstacksdk/default.nix b/pkgs/development/python-modules/openstacksdk/default.nix
index 748149ae1f44e..6ad0aeca07d9f 100644
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , callPackage
 , fetchPypi
-, appdirs
+, platformdirs
 , cryptography
 , dogpile-cache
 , jmespath
@@ -19,18 +19,18 @@
 
 buildPythonPackage rec {
   pname = "openstacksdk";
-  version = "1.5.0";
+  version = "2.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FBtR+ijGsc3rmOvcOMHO5qTnVL1ryEq3qqDQwrzlRD4=";
+    hash = "sha256-aXy2JRXFSNO3/Fyz+GXiebkw05433OsR2HH4H5+lkeg=";
   };
 
   propagatedBuildInputs = [
-    appdirs
+    platformdirs
     cryptography
     dogpile-cache
     jmespath
diff --git a/pkgs/development/python-modules/opentelemetry-api/default.nix b/pkgs/development/python-modules/opentelemetry-api/default.nix
index 289784d4ac414..72957901af41d 100644
--- a/pkgs/development/python-modules/opentelemetry-api/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-api/default.nix
@@ -14,7 +14,7 @@
 let
   self = buildPythonPackage rec {
     pname = "opentelemetry-api";
-    version = "1.20.0";
+    version = "1.21.0";
     disabled = pythonOlder "3.7";
 
     # to avoid breakage, every package in opentelemetry-python must inherit this version, src, and meta
@@ -22,7 +22,7 @@ let
       owner = "open-telemetry";
       repo = "opentelemetry-python";
       rev = "refs/tags/v${version}";
-      hash = "sha256-tOg3G6BjHInY5TFYyS7/JA4mQajeP0b1QjrZBGqiqnM=";
+      hash = "sha256-igG0oHRa6M4d7pMp7fgBo13x5XADZeYgFAL8WzDXsyw=";
     };
 
     sourceRoot = "${src.name}/opentelemetry-api";
diff --git a/pkgs/development/python-modules/openwebifpy/default.nix b/pkgs/development/python-modules/openwebifpy/default.nix
index 8672e8a7695f4..48d5ba86ff755 100644
--- a/pkgs/development/python-modules/openwebifpy/default.nix
+++ b/pkgs/development/python-modules/openwebifpy/default.nix
@@ -1,11 +1,17 @@
 { lib
-, aiohttp
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
 , setuptools
+
+# dependencies
+, aiohttp
 , yarl
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -44,7 +50,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Provides a python interface to interact with a device running OpenWebIf";
-    homepage = "https://github.com/autinerd/openwebifpy";
+    downloadPage = "https://github.com/autinerd/openwebifpy";
+    homepage = "https://openwebifpy.readthedocs.io/";
     changelog = "https://github.com/autinerd/openwebifpy/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ];
diff --git a/pkgs/development/python-modules/opt-einsum/default.nix b/pkgs/development/python-modules/opt-einsum/default.nix
index fd51ead5a0e3b..e943d67c7baa2 100644
--- a/pkgs/development/python-modules/opt-einsum/default.nix
+++ b/pkgs/development/python-modules/opt-einsum/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
+, setuptools
 , numpy
 , pytestCheckHook
 , pythonOlder
@@ -9,7 +11,7 @@
 buildPythonPackage rec {
   version = "3.3.0";
   pname = "opt-einsum";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -19,6 +21,19 @@ buildPythonPackage rec {
     hash = "sha256-WfZHX3e7w33PfNdIUZwOxgci6R5jyhFOaIIcDFSkZUk=";
   };
 
+  patches = [
+    # https://github.com/dgasmith/opt_einsum/pull/208
+    (fetchpatch {
+      name = "python312-compatibility.patch";
+      url = "https://github.com/dgasmith/opt_einsum/commit/0beacf96923bbb2dd1939a9c59398a38ce7a11b1.patch";
+      hash = "sha256-dmmEzhy17huclo1wOubpBUDc2L7vqEU5b/6a5loM47A=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     numpy
   ];
diff --git a/pkgs/development/python-modules/oscrypto/default.nix b/pkgs/development/python-modules/oscrypto/default.nix
index 92edbdf84eb9e..c3cea1d5bcde5 100644
--- a/pkgs/development/python-modules/oscrypto/default.nix
+++ b/pkgs/development/python-modules/oscrypto/default.nix
@@ -3,6 +3,7 @@
 , asn1crypto
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , openssl
 , pytestCheckHook
 , pythonOlder
@@ -24,6 +25,12 @@ buildPythonPackage rec {
 
   patches = [
     ./support-openssl-3.0.10.patch
+
+    (fetchpatch {
+      # backport removal of imp module usage
+      url = "https://github.com/wbond/oscrypto/commit/3865f5d528740aa1205d16ddbee84c5b48aeb078.patch";
+      hash = "sha256-lQGoPM7EicwCPWapEDkqWEqMqXk4tijiImxndcDFqY4=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/oslo-db/default.nix b/pkgs/development/python-modules/oslo-db/default.nix
index 351c213faffd8..708bbd62c36fa 100644
--- a/pkgs/development/python-modules/oslo-db/default.nix
+++ b/pkgs/development/python-modules/oslo-db/default.nix
@@ -7,6 +7,7 @@
 , oslo-utils
 , oslotest
 , pbr
+, setuptools
 , sqlalchemy
 , sqlalchemy-migrate
 , stestr
@@ -16,16 +17,19 @@
 
 buildPythonPackage rec {
   pname = "oslo-db";
-  version = "14.0.0";
-  format = "setuptools";
+  version = "14.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.db";
     inherit version;
-    hash = "sha256-nAipzYOOv/rSHrMBL64AKg93v5Vpb6RNBbG2OiJ+n8E=";
+    hash = "sha256-UFilywqwhXaGnle8K5VNdZqMvhklkTMdHPMDMvz62h8=";
   };
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     alembic
diff --git a/pkgs/development/python-modules/oslo-i18n/default.nix b/pkgs/development/python-modules/oslo-i18n/default.nix
index 6c7f2065a8368..99e22ea549938 100644
--- a/pkgs/development/python-modules/oslo-i18n/default.nix
+++ b/pkgs/development/python-modules/oslo-i18n/default.nix
@@ -3,19 +3,20 @@
 , fetchPypi
 , oslotest
 , pbr
+, setuptools
 , testscenarios
 , stestr
 }:
 
 buildPythonPackage rec {
   pname = "oslo-i18n";
-  version = "6.1.0";
-  format = "setuptools";
+  version = "6.2.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.i18n";
     inherit version;
-    hash = "sha256-4rgp8gW/HrYgR1bMNAJ9EZSUti0nH+7oYL+BbKegfq0=";
+    hash = "sha256-cPikzphxKRvGCdB+MeblAyZmVWmS/xrlPnjy7SpavoI=";
   };
 
   postPatch = ''
@@ -24,7 +25,10 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
   nativeCheckInputs = [
     oslotest
diff --git a/pkgs/development/python-modules/oslo-utils/default.nix b/pkgs/development/python-modules/oslo-utils/default.nix
index 688402199bfc9..196228ce37cef 100644
--- a/pkgs/development/python-modules/oslo-utils/default.nix
+++ b/pkgs/development/python-modules/oslo-utils/default.nix
@@ -14,8 +14,10 @@
 , pbr
 , pyparsing
 , pytz
+, setuptools
 , stestr
 , testscenarios
+, tzdata
 , pyyaml
 , iana-etc
 , libredirect
@@ -23,13 +25,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-utils";
-  version = "6.2.1";
-  format = "setuptools";
+  version = "6.3.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.utils";
     inherit version;
-    hash = "sha256-EyK6BfoP88Gor8cn/PlF31qoLWWEcn0uBK8Di1roQkQ=";
+    hash = "sha256-dY2UWyutW+qBq+2ArTP/6h0deTNIrF61s4Zrp0WxHVU=";
   };
 
   postPatch = ''
@@ -38,7 +40,10 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     debtcollector
@@ -49,6 +54,7 @@ buildPythonPackage rec {
     packaging
     pyparsing
     pytz
+    tzdata
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/osqp/default.nix b/pkgs/development/python-modules/osqp/default.nix
index ac933f65e1c22..13797c4d17f83 100644
--- a/pkgs/development/python-modules/osqp/default.nix
+++ b/pkgs/development/python-modules/osqp/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-A+Rg5oPsLOD4OTU936PEyP+lCauM9qKyr7tYb6RT4YA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontUseCmakeConfigure = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ossfs/default.nix b/pkgs/development/python-modules/ossfs/default.nix
index 17b3ad2c8b05b..97f61f62199b4 100644
--- a/pkgs/development/python-modules/ossfs/default.nix
+++ b/pkgs/development/python-modules/ossfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-N1NkpI8inGJCf0xuc+FFmVX85CS7vqzoNddxZ9kqEk0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "aiooss2"
     "fsspec"
diff --git a/pkgs/development/python-modules/outcome/default.nix b/pkgs/development/python-modules/outcome/default.nix
index f081bbed2bcb6..0fa4ba74deabc 100644
--- a/pkgs/development/python-modules/outcome/default.nix
+++ b/pkgs/development/python-modules/outcome/default.nix
@@ -1,19 +1,27 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools
 , attrs
 , pytest
 }:
 
 buildPythonPackage rec {
   pname = "outcome";
-  version = "1.2.0";
-  format = "setuptools";
+  version = "1.3.0.post0";
+
   disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b4K9PeRdowPPH3ceyvoWM3UKNYQ2qLtg4Goc63RdJnI=";
+    hash = "sha256-nc8C5l8pcbgAR7N3Ro5yomjhXArzzxI45v8U9/kRQ7g=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [ pytest ];
   propagatedBuildInputs = [ attrs ];
   # Has a test dependency on trio, which depends on outcome.
diff --git a/pkgs/development/python-modules/overrides/default.nix b/pkgs/development/python-modules/overrides/default.nix
index 7fc464143081b..8109a428140d9 100644
--- a/pkgs/development/python-modules/overrides/default.nix
+++ b/pkgs/development/python-modules/overrides/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 , pytestCheckHook
 }:
@@ -23,6 +24,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # KeyError: 'assertRaises'
+    "test_enforcing_when_incompatible"
+  ];
+
   pythonImportsCheck = [
     "overrides"
   ];
diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index 0c4678a460acf..123c1230fc87a 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -1,23 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
+
+# build-system
 , flit-core
+
+# tests
 , pretend
 , pytestCheckHook
-, pythonOlder
 }:
 
 let
   packaging = buildPythonPackage rec {
     pname = "packaging";
-    version = "23.1";
-    format = "pyproject";
+    version = "23.2";
+    pyproject = true;
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-o5KYDSts/6ZEQxiYvlSwBFFRMZ0efsNPDP7Uh2fdM08=";
+      hash = "sha256-BI+w6UBQNlGOqvSKVZU8dQwR4aG2jg3RqdYu0MCSz8U=";
     };
 
     nativeBuildInputs = [
@@ -29,18 +33,27 @@ let
       pretend
     ];
 
+    pythonImportsCheck = [
+      "packaging"
+      "packaging.metadata"
+      "packaging.requirements"
+      "packaging.specifiers"
+      "packaging.tags"
+      "packaging.version"
+    ];
+
     # Prevent circular dependency with pytest
     doCheck = false;
 
-    pythonImportsCheck = [ "packaging" ];
-
     passthru.tests = packaging.overridePythonAttrs (_: { doCheck = true; });
 
     meta = with lib; {
+      changelog = "https://github.com/pypa/packaging/blob/${version}/CHANGELOG.rst";
       description = "Core utilities for Python packages";
-      homepage = "https://github.com/pypa/packaging";
+      downloadPage = "https://github.com/pypa/packaging";
+      homepage = "https://packaging.pypa.io/";
       license = with licenses; [ bsd2 asl20 ];
-      maintainers = with maintainers; [ bennofs ];
+      maintainers = teams.python.members ++ (with maintainers; [ bennofs ]);
     };
   };
 in
diff --git a/pkgs/development/python-modules/paginate/default.nix b/pkgs/development/python-modules/paginate/default.nix
new file mode 100644
index 0000000000000..ad22a818aee32
--- /dev/null
+++ b/pkgs/development/python-modules/paginate/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonAtLeast
+
+# build-system
+, setuptools
+
+# tests
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "paginate";
+  version = "0.5.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Pylons";
+    repo = "paginate";
+    rev = version;
+    hash = "sha256-HZWwOYOCk4mAmz8OnM9hhlf8HA+jC75dYVeo0l4a09o=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "paginate"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/Pylons/paginate/issues/19
+    "test_wrong_collection"
+    "test_unsliceable_sequence3"
+  ];
+
+  meta = with lib; {
+    description = "Python pagination module";
+    homepage = "https://github.com/Pylons/paginate";
+    changelog = "https://github.com/Pylons/paginate/blob/${src.rev}/CHANGELOG.txt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 588dae7b7840d..7351e6536416a 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -2,10 +2,12 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 
 # build-system
 , cython
+, cython_3
 , meson-python
 , meson
 , oldest-supported-numpy
@@ -23,7 +25,6 @@
 , beautifulsoup4
 , bottleneck
 , blosc2
-, brotlipy
 , fsspec
 , gcsfs
 , html5lib
@@ -39,7 +40,6 @@
 , pymysql
 , pyqt5
 , pyreadstat
-, python-snappy
 , qtpy
 , s3fs
 , scipy
@@ -63,9 +63,9 @@
 , runtimeShell
 }:
 
-buildPythonPackage rec {
+let pandas = buildPythonPackage rec {
   pname = "pandas";
-  version = "2.1.1";
+  version = "2.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -74,17 +74,19 @@ buildPythonPackage rec {
     owner = "pandas-dev";
     repo = "pandas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6SgW4BtO7EFnS8P8LL4AGk5EdPwOQ0+is0wXgqsm9w0=";
+    hash = "sha256-okGYzPJC3mpG+Sq4atjWwLlocUDnpjgGRPmQ+4ehQX0=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace "Cython>=0.29.33,<3" "Cython" \
       --replace "meson-python==0.13.1" "meson-python>=0.13.1" \
       --replace "meson==1.2.1" "meson>=1.2.1"
   '';
 
   nativeBuildInputs = [
-    cython
+    # TODO: hack to support pandas on python3.12, remove with pandas 2.2.0
+    (if pythonAtLeast "3.12" then cython_3 else cython)
     meson-python
     meson
     numpy
@@ -116,8 +118,6 @@ buildPythonPackage rec {
         qtpy
       ];
       compression = [
-        brotlipy
-        python-snappy
         zstandard
       ];
       computation = [
@@ -187,16 +187,23 @@ buildPythonPackage rec {
     all = lib.concatLists (lib.attrValues extras);
   };
 
+  doCheck = false; # various infinite recursions
+
+  passthru.tests.pytest = pandas.overridePythonAttrs (_: { doCheck = true; });
+
   nativeCheckInputs = [
     glibcLocales
     hypothesis
     pytest-asyncio
     pytest-xdist
     pytestCheckHook
-  ] ++ lib.optionals (stdenv.isLinux) [
+  ]
+  ++ lib.flatten (lib.attrValues passthru.optional-dependencies)
+  ++ lib.optionals (stdenv.isLinux) [
     # for locale executable
     glibc
-  ] ++ lib.optionals (stdenv.isDarwin) [
+  ]
+  ++ lib.optionals (stdenv.isDarwin) [
     # for locale executable
     adv_cmds
   ];
@@ -263,4 +270,5 @@ buildPythonPackage rec {
     '';
     maintainers = with maintainers; [ raskin fridh knedlsepp ];
   };
-}
+};
+in pandas
diff --git a/pkgs/development/python-modules/panel/default.nix b/pkgs/development/python-modules/panel/default.nix
index 7fe1be6f7458d..c47cea4567a83 100644
--- a/pkgs/development/python-modules/panel/default.nix
+++ b/pkgs/development/python-modules/panel/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "panel";
-  version = "1.2.3";
+  version = "1.3.4";
 
   format = "wheel";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   # tries to fetch even more artifacts
   src = fetchPypi {
     inherit pname version format;
-    hash = "sha256-CAW6z0phPohpFjv4D1DlmomDiv52vb5qBatWN/Mmg/c=";
+    hash = "sha256-FK/ekqXCtTHyzLeFs0tHEeH0VXk0yFcns1lOLa5z0KU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/papermill/default.nix b/pkgs/development/python-modules/papermill/default.nix
index d5c2f3018d302..65b5f7c0035d8 100644
--- a/pkgs/development/python-modules/papermill/default.nix
+++ b/pkgs/development/python-modules/papermill/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "papermill";
-  version = "2.4.0";
+  version = "2.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b4+KmwazlnfyB8CRAMjThrz1kvDLvdqfD1DoFEVpdic=";
+    hash = "sha256-6ntwwFU/Vv6RsPqcxeFwEs1pkyCosBU3PnhwxeYIbHI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/param/default.nix b/pkgs/development/python-modules/param/default.nix
index a37cf7c7f03dc..c05f906d5b106 100644
--- a/pkgs/development/python-modules/param/default.nix
+++ b/pkgs/development/python-modules/param/default.nix
@@ -1,14 +1,23 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, hatchling
+, hatch-vcs
+
+# tests
+, numpy
+, pandas
+, pytest-asyncio
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "param";
-  version = "1.13.0";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -16,19 +25,21 @@ buildPythonPackage rec {
     owner = "holoviz";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5b3UTzb7OXBwcyYyDVCGLUpWxNOYZ3cv8Gfw+x7jsBI=";
+    hash = "sha256-8R1+utY3e3py4iJTgOVfzt5Y7bp2Rn6OfoITGuOsb5c=";
   };
 
+  nativeBuildInputs = [
+    hatchling
+    hatch-vcs
+  ];
+
   nativeCheckInputs = [
+    numpy
+    pandas
+    pytest-asyncio
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # Version is not set properly
-    substituteInPlace setup.py \
-      --replace 'version=get_setup_version("param"),' 'version="${version}",'
-  '';
-
   pythonImportsCheck = [
     "param"
   ];
diff --git a/pkgs/development/python-modules/parameter-expansion-patched/default.nix b/pkgs/development/python-modules/parameter-expansion-patched/default.nix
index 19149d8db2411..8e73457557f7e 100644
--- a/pkgs/development/python-modules/parameter-expansion-patched/default.nix
+++ b/pkgs/development/python-modules/parameter-expansion-patched/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-/128ifveWC8zNlYtGWtxB3HpK6p7bVk1ahSwhaC2dAs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/parameterized/default.nix b/pkgs/development/python-modules/parameterized/default.nix
index fb08e07ec04b2..9f8fa4ad1e9fb 100644
--- a/pkgs/development/python-modules/parameterized/default.nix
+++ b/pkgs/development/python-modules/parameterized/default.nix
@@ -20,10 +20,12 @@ buildPythonPackage rec {
   };
 
   postPatch = ''
-    # broken with pytest 7
+    # broken with pytest 7 and python 3.12
     # https://github.com/wolever/parameterized/issues/167
+    # https://github.com/wolever/parameterized/pull/162
     substituteInPlace parameterized/test.py \
-      --replace 'assert_equal(missing, [])' ""
+      --replace 'assert_equal(missing, [])' "" \
+      --replace "assertRaisesRegexp" "assertRaisesRegex"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/parse/default.nix b/pkgs/development/python-modules/parse/default.nix
index 7956a2971b514..9c6272e94a5cd 100644
--- a/pkgs/development/python-modules/parse/default.nix
+++ b/pkgs/development/python-modules/parse/default.nix
@@ -5,16 +5,20 @@
 }:
 buildPythonPackage rec {
   pname = "parse";
-  version = "1.19.1";
+  version = "1.20.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "r1chardj0n3s";
     repo = "parse";
     rev = "refs/tags/${version}";
-    hash = "sha256-f08SlkGnwhSh0ajTKFqBAGGFvLj8nWBZVb6uClbRaP4=";
+    hash = "sha256-InYOgqTvMvQ/HWIa0WrJ4M2LL4LL87KwBst8yYnt3dk=";
   };
 
+  postPatch = ''
+    rm .pytest.ini
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/partd/default.nix b/pkgs/development/python-modules/partd/default.nix
index db823218a61b8..728ed09b735c0 100644
--- a/pkgs/development/python-modules/partd/default.nix
+++ b/pkgs/development/python-modules/partd/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
+, setuptools
 , pytest
 , locket
 , numpy
@@ -12,15 +13,20 @@
 
 buildPythonPackage rec {
   pname = "partd";
-  version = "1.4.0";
-  format = "setuptools";
+  version = "1.4.1";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qg/zXbvMgHrjdNtWMy9MGzm0b2e/KXX1FR4LQYau0NU=";
+    hash = "sha256-VsJd1J5v6lcn5zEgPEZsbgkvMI2PACThmdAvaqIWf2c=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [ pytest ];
 
   propagatedBuildInputs = [ locket numpy pandas pyzmq toolz ];
diff --git a/pkgs/development/python-modules/pathvalidate/default.nix b/pkgs/development/python-modules/pathvalidate/default.nix
index 31ec1f003144d..c3098c24b56d1 100644
--- a/pkgs/development/python-modules/pathvalidate/default.nix
+++ b/pkgs/development/python-modules/pathvalidate/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pathvalidate";
-  version = "3.1.0";
+  version = "3.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QmlwIm4kGZ/ZDZOZXSI8Hii9qWfN9DcHVaFM33KiqO4=";
+    hash = "sha256-XoN4z2cSv/Z/vnqDB9mfqMGgyyiqR3BW+Pw3Tw3/JK0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/patsy/default.nix b/pkgs/development/python-modules/patsy/default.nix
index a1ed788dda12d..ae4022f860020 100644
--- a/pkgs/development/python-modules/patsy/default.nix
+++ b/pkgs/development/python-modules/patsy/default.nix
@@ -1,6 +1,7 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+, setuptools
 , six
 , numpy
 , scipy # optional, allows spline-related features (see patsy's docs)
@@ -9,14 +10,18 @@
 
 buildPythonPackage rec {
   pname = "patsy";
-  version = "0.5.3";
-  format = "setuptools";
+  version = "0.5.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vcGAAYdeMZvJHIEsHrahC+S7E8uB63Y/RmF53KO2cnc=";
+    hash = "sha256-favFJ1lzCN4OjxiPqiCvfgaom9qjBnVt/HeDaT6havQ=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     six
     numpy
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index bda6c9080f0c5..dbf6afe6f3302 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -7,16 +7,17 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "5.11.1";
-  format = "setuptools";
+  version = "6.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rvxRZ1sLUz1Wu1/RyMbAUi/jGJZnmILhxMY9XkoPzLM=";
+    hash = "sha256-0TdxIqWgDi+UDuSCmZUY7+FtdF1COmcMJ3c9+8PJp9k=";
   };
 
-  # importlib-metadata could be added here if it wouldn't cause an infinite recursion
-  propagatedBuildInputs = [ setuptools ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   # check in passthru.tests.pytest to escape infinite recursion with fixtures
   doCheck = false;
diff --git a/pkgs/development/python-modules/pdm-backend/default.nix b/pkgs/development/python-modules/pdm-backend/default.nix
index 0572a1e633b83..3d32a02768b41 100644
--- a/pkgs/development/python-modules/pdm-backend/default.nix
+++ b/pkgs/development/python-modules/pdm-backend/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.1.6";
+  version = "2.1.7";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZEci8VeKYuORs9iAzaEqrtVBh9fMWHlLsFH1e5PRLwA=";
+    hash = "sha256-1YM/vba+8+2wKcWzPKzkpaWVmHqbFsYdhQSY/VBBAfo=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;
diff --git a/pkgs/development/python-modules/pegen/default.nix b/pkgs/development/python-modules/pegen/default.nix
index 2a7a3062741fb..9ac25c2880b61 100644
--- a/pkgs/development/python-modules/pegen/default.nix
+++ b/pkgs/development/python-modules/pegen/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-P4zX8za9lBlXhNPkQe9p136ggZEJh6fHfBr+DQKvtTg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pelican/default.nix b/pkgs/development/python-modules/pelican/default.nix
index a2aac534366e8..71682cd62c41b 100644
--- a/pkgs/development/python-modules/pelican/default.nix
+++ b/pkgs/development/python-modules/pelican/default.nix
@@ -1,42 +1,51 @@
 { lib
-, beautifulsoup4
-, blinker
 , buildPythonPackage
-, docutils
-, feedgenerator
 , fetchFromGitHub
-, git
+, pythonOlder
+, pythonRelaxDepsHook
+
+# build-system
+, pdm-backend
+
+# native dependencies
 , glibcLocales
+, git
+, pandoc
+, typogrify
+
+# dependencies
+, backports-zoneinfo
+, blinker
+, docutils
+, feedgenerator
 , jinja2
-, lxml
 , markdown
-, markupsafe
-, mock
-, pytestCheckHook
-, pandoc
-, pillow
+, ordered-set
 , pygments
 , python-dateutil
-, pythonOlder
-, pytz
 , rich
-, pytest-xdist
-, six
-, typogrify
+, tzdata
 , unidecode
+, watchfiles
+
+# tests
+, mock
+, pytestCheckHook
+, pytest-xdist
 }:
 
 buildPythonPackage rec {
   pname = "pelican";
-  version = "4.8.0";
-  format = "setuptools";
-  disabled = pythonOlder "3.6";
+  version = "4.9.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "getpelican";
-    repo = pname;
+    repo = "pelican";
     rev = "refs/tags/${version}";
-    hash = "sha256-T+XBRBfroG1gh9ZHU7V5wsgnI1xuNTXYAe6g5Xk8Qyg=";
+    hash = "sha256-nz2OnxJ4mGgnafz4Xp8K/BTyVgXNpNYqteNL1owP8Hk=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -44,43 +53,51 @@ buildPythonPackage rec {
     '';
   };
 
+  postPatch = ''
+    substituteInPlace pelican/tests/test_pelican.py \
+      --replace "'git'" "'${git}/bin/git'"
+  '';
+
+  nativeBuildInputs = [
+    pdm-backend
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "unidecode"
+  ];
+
   buildInputs = [
     glibcLocales
     pandoc
     git
-    mock
     markdown
     typogrify
   ];
 
   propagatedBuildInputs = [
-    beautifulsoup4
     blinker
     docutils
     feedgenerator
     jinja2
-    lxml
-    markupsafe
-    pillow
+    ordered-set
     pygments
     python-dateutil
-    pytz
     rich
-    six
+    tzdata
     unidecode
+    watchfiles
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    backports-zoneinfo
   ];
 
   nativeCheckInputs = [
+    mock
     pytest-xdist
     pytestCheckHook
     pandoc
   ];
 
-  postPatch = ''
-    substituteInPlace pelican/tests/test_pelican.py \
-      --replace "'git'" "'${git}/bin/git'"
-  '';
-
   pytestFlagsArray = [
     # DeprecationWarning: 'jinja2.Markup' is deprecated and...
     "-W ignore::DeprecationWarning"
@@ -93,7 +110,7 @@ buildPythonPackage rec {
     "test_custom_locale_generation_works"
   ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   # We only want to patch shebangs in /bin, and not those
   # of the project scripts that are created by Pelican.
diff --git a/pkgs/development/python-modules/pem/default.nix b/pkgs/development/python-modules/pem/default.nix
index f4608995dd73c..84500acaccb0f 100644
--- a/pkgs/development/python-modules/pem/default.nix
+++ b/pkgs/development/python-modules/pem/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-rVYlnvISGugh9qvf3mdrIyELmeOUU4g6291HeoMkoQc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-fancy-pypi-readme
diff --git a/pkgs/development/python-modules/pendulum/3.nix b/pkgs/development/python-modules/pendulum/3.nix
new file mode 100644
index 0000000000000..78e9c675ea8db
--- /dev/null
+++ b/pkgs/development/python-modules/pendulum/3.nix
@@ -0,0 +1,99 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, isPyPy
+
+# build-system
+, poetry-core
+, rustPlatform
+
+# native dependencies
+, iconv
+
+# dependencies
+, backports-zoneinfo
+, importlib-resources
+, python-dateutil
+, time-machine
+, tzdata
+
+# tests
+, pytestCheckHook
+, pytz
+}:
+
+buildPythonPackage rec {
+  pname = "pendulum";
+  version = "3.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sdispater";
+    repo = "pendulum";
+    rev = "refs/tags/${version}";
+    hash = "sha256-v0kp8dklvDeC7zdTDOpIbpuj13aGub+oCaYz2ytkEpI=";
+  };
+
+  postPatch = ''
+    substituteInPlace rust/Cargo.lock \
+      --replace "3.0.0-beta-1" "3.0.0"
+  '';
+
+  cargoRoot = "rust";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    sourceRoot = "source/rust";
+    name = "${pname}-${version}";
+    hash = "sha256-6fw0KgnPIMfdseWcunsGjvjVB+lJNoG3pLDqkORPJ0I=";
+    postPatch = ''
+      substituteInPlace Cargo.lock \
+        --replace "3.0.0-beta-1" "3.0.0"
+    '';
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+    rustPlatform.maturinBuildHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    iconv
+  ];
+
+  propagatedBuildInputs = [
+    python-dateutil
+    tzdata
+  ] ++ lib.optional (!isPyPy) [
+    time-machine
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    backports-zoneinfo
+    importlib-resources
+  ];
+
+  pythonImportsCheck = [
+    "pendulum"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytz
+  ];
+
+  disabledTestPaths = [
+    "tests/benchmarks"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # PermissionError: [Errno 1] Operation not permitted: '/etc/localtime'
+    "tests/testing/test_time_travel.py"
+  ];
+
+  meta = with lib; {
+    description = "Python datetimes made easy";
+    homepage = "https://github.com/sdispater/pendulum";
+    changelog = "https://github.com/sdispater/pendulum/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/pexpect/default.nix b/pkgs/development/python-modules/pexpect/default.nix
index ebe63b4a4170b..e8c5efc3cba3f 100644
--- a/pkgs/development/python-modules/pexpect/default.nix
+++ b/pkgs/development/python-modules/pexpect/default.nix
@@ -1,19 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , ptyprocess
 }:
 
 buildPythonPackage (rec {
   pname = "pexpect";
-  version = "4.8.0";
-  format = "setuptools";
+  version = "4.9.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fc65a43959d153d0114afe13997d439c22823a27cefceb5ff35c2178c6784c0c";
+    hash = "sha256-7n1BEj88mREFDqLC2sEHVo3EOy07DHVXozISw5jq0w8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # Wants to run pythonin a subprocess
   doCheck = false;
 
@@ -22,6 +27,7 @@ buildPythonPackage (rec {
   meta = with lib; {
     homepage = "http://www.noah.org/wiki/Pexpect";
     description = "Automate interactive console applications such as ssh, ftp, etc";
+    downloadPage = "https://github.com/pexpect/pexpect";
     license = licenses.mit;
     maintainers = with maintainers; [ zimbatm ];
 
diff --git a/pkgs/development/python-modules/pg8000/default.nix b/pkgs/development/python-modules/pg8000/default.nix
index ee580829bbe00..12144a0bb8d2d 100644
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pg8000";
-  version = "1.30.1";
+  version = "1.30.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wEKA5mocz7UWbbXBZBZMLhuPYq+u3/0hFFGlMproSik=";
+    hash = "sha256-Tnx1dHpDpJwVYj+SWDu24dAj6ubq8sLh5t5Nf7f6QE8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index 0942dd0662c80..6370a8fa72cc2 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.13.20";
+  version = "8.13.26";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vys1qAbTeXnlNhEJQp2kbZoEflnZr5hjnXM8g059qyI=";
+    hash = "sha256-k31wrs6zF/WDHf7CjehVpgJg70qdVRlkvsjnp9DPgc0=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/picobox/default.nix b/pkgs/development/python-modules/picobox/default.nix
index a70fc8eecbe19..221493eb2194c 100644
--- a/pkgs/development/python-modules/picobox/default.nix
+++ b/pkgs/development/python-modules/picobox/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-JtrwUVo3b4G34OUShX4eJS2IVubl4vBmEtB/Jhk4eJI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 0891ad28ec3f9..4ba20f5aef315 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -5,9 +5,10 @@
 , hypothesis
 , pythonOlder
 , jbig2dec
-, deprecation
+, deprecated
 , lxml
 , mupdf
+, numpy
 , packaging
 , pillow
 , psutil
@@ -24,8 +25,8 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.4.0";
-  format = "pyproject";
+  version = "8.9.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -39,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-48tb5bhmBdKVjMld07303qIi5C16yaf+5TpRPVC6EQk=";
+    hash = "sha256-ia+D0OeB/MQWRniYkBEWZsDCwEApYGgu0++I/HupK6w=";
   };
 
   patches = [
@@ -68,6 +69,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     attrs
     hypothesis
+    numpy
     pytest-xdist
     psutil
     pytestCheckHook
@@ -76,7 +78,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    deprecation
+    deprecated
     lxml
     packaging
     pillow
diff --git a/pkgs/development/python-modules/pikepdf/paths.patch b/pkgs/development/python-modules/pikepdf/paths.patch
index 43e472f5598ac..c9c61176aa6f4 100644
--- a/pkgs/development/python-modules/pikepdf/paths.patch
+++ b/pkgs/development/python-modules/pikepdf/paths.patch
@@ -1,8 +1,8 @@
 diff --git a/src/pikepdf/_methods.py b/src/pikepdf/_methods.py
-index 2a170c6..5ee3ba1 100644
+index d27c660..6796984 100644
 --- a/src/pikepdf/_methods.py
 +++ b/src/pikepdf/_methods.py
-@@ -80,7 +80,7 @@ def _mudraw(buffer, fmt) -> bytes:
+@@ -72,7 +72,7 @@ def _mudraw(buffer, fmt) -> bytes:
          tmp_in.flush()
  
          proc = run(
@@ -12,22 +12,22 @@ index 2a170c6..5ee3ba1 100644
              check=True,
          )
 diff --git a/src/pikepdf/jbig2.py b/src/pikepdf/jbig2.py
-index 28c596b..aff3565 100644
+index f89b4f9..f187ebd 100644
 --- a/src/pikepdf/jbig2.py
 +++ b/src/pikepdf/jbig2.py
-@@ -28,7 +28,7 @@ def _extract_jbig2_bytes(jbig2: bytes, jbig2_globals: bytes) -> bytes:
-         output_path = Path(tmpdir) / "outfile"
-
-         args = [
--            "jbig2dec",
-+            "@jbig2dec@",
-             "--embedded",
-             "--format",
-             "png",
-@@ -88,7 +88,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
+@@ -63,7 +63,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
+             output_path = Path(tmpdir) / "outfile"
+ 
+             args = [
+-                "jbig2dec",
++                "@jbig2dec@",
+                 "--embedded",
+                 "--format",
+                 "png",
+@@ -90,7 +90,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
      def _version(self) -> Version:
          try:
-             proc = run(
+             proc = self._run(
 -                ['jbig2dec', '--version'], stdout=PIPE, check=True, encoding='ascii'
 +                ['@jbig2dec@', '--version'], stdout=PIPE, check=True, encoding='ascii'
              )
diff --git a/pkgs/development/python-modules/pillow-heif/default.nix b/pkgs/development/python-modules/pillow-heif/default.nix
index 1d0505e22ed58..2496bd1b36096 100644
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -6,6 +6,7 @@
 # build-system
 , cmake
 , nasm
+, pkg-config
 
 # native dependencies
 , libheif
@@ -25,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "pillow-heif";
-  version = "0.13.0";
+  version = "0.14.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bigcat88";
     repo = "pillow_heif";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GbOW29rGpLMS7AfShuO6UCzcspdHtFS7hyNKori0otI=";
+    hash = "sha256-HFcywrH687CBGTbZQ2rQrr/AdJ2+pFoI+NvYhUCanic=";
   };
 
   postPatch = ''
@@ -42,6 +43,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     cmake
     nasm
+    pkg-config
   ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 3b5dffb42cf07..7cf0bb9420fee 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -5,7 +5,7 @@
 , fetchPypi
 , isPyPy
 , defusedxml, olefile, freetype, libjpeg, zlib, libtiff, libwebp, libxcrypt, tcl, lcms2, tk, libX11
-, libxcb, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook, setuptools
+, libxcb, openjpeg, libimagequant, numpy, pytestCheckHook, setuptools
 # for passthru.tests
 , imageio, matplotlib, pilkit, pydicom, reportlab
 }@args:
diff --git a/pkgs/development/python-modules/pillow/generic.nix b/pkgs/development/python-modules/pillow/generic.nix
index 5186e8a476bb3..33276d3abd08e 100644
--- a/pkgs/development/python-modules/pillow/generic.nix
+++ b/pkgs/development/python-modules/pillow/generic.nix
@@ -37,7 +37,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ olefile ]
     ++ lib.optionals (lib.versionAtLeast version "8.2.0") [ defusedxml ];
 
-  nativeCheckInputs = [ pytestCheckHook pyroma numpy ];
+  nativeCheckInputs = [ pytestCheckHook numpy ];
 
   nativeBuildInputs = [ setuptools ];
 
@@ -73,10 +73,5 @@ buildPythonPackage rec {
   '' + lib.optionalString (lib.versionAtLeast version "7.1.0") ''
     export LDFLAGS="$LDFLAGS -L${libxcb}/lib"
     export CFLAGS="$CFLAGS -I${libxcb.dev}/include"
-  '' + lib.optionalString stdenv.isDarwin ''
-    # Remove impurities
-    substituteInPlace setup.py \
-      --replace '"/Library/Frameworks",' "" \
-      --replace '"/System/Library/Frameworks"' ""
   '';
 }
diff --git a/pkgs/development/python-modules/pinecone-client/default.nix b/pkgs/development/python-modules/pinecone-client/default.nix
index 91ca5ca0e75fa..2b75974996320 100644
--- a/pkgs/development/python-modules/pinecone-client/default.nix
+++ b/pkgs/development/python-modules/pinecone-client/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , numpy
 , pyyaml
 , python-dateutil
@@ -13,14 +14,18 @@
 }:
 buildPythonPackage rec {
   pname = "pinecone-client";
-  version = "2.2.4";
-  format = "setuptools";
+  version = "2.2.5";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LBzB1mSLK+ZulE2y/6WRZqN7kWTRE1rVJdnNix4pgWg=";
+    hash = "sha256-F2mWUpFMn2ipopa3UjvzrmNZsHtdRrUwfkuHbDYBElo=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     numpy
     pyyaml
diff --git a/pkgs/development/python-modules/pint-pandas/default.nix b/pkgs/development/python-modules/pint-pandas/default.nix
index 6cc7cd22a97da..d446483502236 100644
--- a/pkgs/development/python-modules/pint-pandas/default.nix
+++ b/pkgs/development/python-modules/pint-pandas/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-FuH6wksSCkkL2AyQN46hwTnfeAZFwkWRl6KEEhsxmUY=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pip-requirements-parser/default.nix b/pkgs/development/python-modules/pip-requirements-parser/default.nix
index 21d0679ce8ef9..84cc2ed513a17 100644
--- a/pkgs/development/python-modules/pip-requirements-parser/default.nix
+++ b/pkgs/development/python-modules/pip-requirements-parser/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-UMrwDXxk+sD3P2jk7s95y4OX6DRBjWWZZ8IhkR6tnZ4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontConfigure = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pip/default.nix b/pkgs/development/python-modules/pip/default.nix
index 484a15e858769..f597887ddd2ca 100644
--- a/pkgs/development/python-modules/pip/default.nix
+++ b/pkgs/development/python-modules/pip/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pip";
-  version = "23.2.1";
+  version = "23.3.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-mUlzfYmq1FE3X1/2o7sYJzMgwHRI4ib4EMhpg83VvrI=";
+    hash = "sha256-mJesZxFyZkGTR1s8/C88eWprW6WVGlwORXoKXc6NnoM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index 7e15814fa6849..c1131e6592d23 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-rlnJmGe9LYwIJxV02IjiKtT1iS1O9ik8dAfjsPHsa8U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/pipx/default.nix b/pkgs/development/python-modules/pipx/default.nix
index ef4e789249ceb..ae575ec0a2635 100644
--- a/pkgs/development/python-modules/pipx/default.nix
+++ b/pkgs/development/python-modules/pipx/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pipx";
-  version = "1.2.1";
+  version = "1.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pipxproject";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-eNZJXznKgamGR9yrswrrLEqUTxFhLGxWTkYbi13bebY=";
+    hash = "sha256-JZt4I0zw/Kmdgpd5tw6c+fHrHuxkN6jvN3fDmk0//vc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index 777ba72bcc2c8..6cf9822c5e417 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "3.10.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,11 +20,9 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Ytilbs29oxuwLfoKTXNQxlh8qBF39F2ZRK8imd57A1w=";
+    hash = "sha256-27Cy8VEmbrO96G2mVStxkoWSRXlwZLWirI3tH6kBsus=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index 555f7aa301970..31ded41872f1c 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -11,6 +11,7 @@
 , setuptools
 , setuptools-scm
 , playwright-driver
+, pythonRelaxDepsHook
 }:
 
 let
@@ -54,10 +55,7 @@ buildPythonPackage rec {
 
     substituteInPlace pyproject.toml \
       --replace 'requires = ["setuptools==68.2.2", "setuptools-scm==8.0.4", "wheel==0.41.2", "auditwheel==5.4.0"]' \
-                'requires = ["setuptools", "setuptools-scm", "wheel"]' \
-      --replace 'version_file = "playwright/_repo_version.py"' ""
-    # FIXME version_file is available in setuptools-scm>=8.0.0
-    echo "__version__ = version = '${version}'" > playwright/_repo_version.py
+                'requires = ["setuptools", "setuptools-scm", "wheel"]'
 
     # Skip trying to download and extract the driver.
     # This is done manually in postInstall instead.
@@ -70,8 +68,16 @@ buildPythonPackage rec {
   '';
 
 
-  nativeBuildInputs = [ git setuptools-scm setuptools ]
-    ++ lib.optionals stdenv.isLinux [ auditwheel ];
+  nativeBuildInputs = [
+    git
+    setuptools-scm
+    setuptools
+    pythonRelaxDepsHook
+  ] ++ lib.optionals stdenv.isLinux [ auditwheel ];
+
+  pythonRelaxDeps = [
+    "pyee"
+  ];
 
   propagatedBuildInputs = [
     greenlet
@@ -82,8 +88,6 @@ buildPythonPackage rec {
     ln -s ${driver} $out/${python.sitePackages}/playwright/driver
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # Skip tests because they require network access.
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index fc2c8b49069d3..13d9334fd9501 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "5.16.1";
+  version = "5.18.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KVrCXt6xjIk6u3Hcrc6gdbeP1v3wfO5CF6ThAJZnkls=";
+    hash = "sha256-Ngox5vu0nRKwBwNutpKVITQ9a+4iNvhFmRWCG676LLs=";
   };
 
   propagatedBuildInputs = [
@@ -29,6 +29,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python plotting library for collaborative, interactive, publication-quality graphs";
+    downloadPage = "https://github.com/plotly/plotly.py";
     homepage = "https://plot.ly/python/";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/pluggy/default.nix b/pkgs/development/python-modules/pluggy/default.nix
index 1128d1c69eaf8..6b1c8e67f1eb5 100644
--- a/pkgs/development/python-modules/pluggy/default.nix
+++ b/pkgs/development/python-modules/pluggy/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # To prevent infinite recursion with pytest
   doCheck = false;
   passthru.tests = {
diff --git a/pkgs/development/python-modules/plumbum/default.nix b/pkgs/development/python-modules/plumbum/default.nix
index e6ffa43b32935..7fb6a0ec82404 100644
--- a/pkgs/development/python-modules/plumbum/default.nix
+++ b/pkgs/development/python-modules/plumbum/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
       --replace '"--cov-config=setup.cfg", ' ""
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/plyfile/default.nix b/pkgs/development/python-modules/plyfile/default.nix
index 050d6ef56f6bc..2eff69c4ad8da 100644
--- a/pkgs/development/python-modules/plyfile/default.nix
+++ b/pkgs/development/python-modules/plyfile/default.nix
@@ -1,17 +1,40 @@
-{ lib, fetchPypi, buildPythonPackage, numpy
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+
+# build-system
+, pdm-pep517
+
+# dependencies
+, numpy
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "plyfile";
-  version = "1.0.1";
-  format = "setuptools";
+  version = "1.0.2";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-TOrt8e2Ss6Jrdm/IxWzaG5sjkOwpmxbe3i5f1FCXJho=";
+  src = fetchFromGitHub {
+    owner = "dranjan";
+    repo = "python-plyfile";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-HlyqljfjuaZoG5f2cfDQj+7KS0en7pW2PPEnpvH8U+E=";
   };
 
-  propagatedBuildInputs = [ numpy ];
+  nativeBuildInputs = [
+    pdm-pep517
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "NumPy-based text/binary PLY file reader/writer for Python";
diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index fc8da7447ffba..9b3174a3b3bd8 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "1.7.0";
+  version = "1.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    hash = "sha256-OfY2zc+5CgOrgbiPVnvMdT4h1S7Aek8S7iThl6azmsk=";
+    hash = "sha256-RnCJ67jaL2knwv+Uo7p0zOejHAT73f40weaJnfqOYoM=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
index 9c6440cd4c326..052cb9c4d7d61 100644
--- a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
+++ b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "poetry-dynamic-versioning";
-  version = "1.0.1";
+  version = "1.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "mtkennerly";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BGAo3c0TzyhIiDtZjoEP+Eeu51WJB3Wg71poFMWJ+VM=";
+    hash = "sha256-qkRnlLLzbYf7C2VjPDjYfllej8an4WftNahPLz/Wkxw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index 9a9bc9f3ead47..6f66b024f28b9 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -38,7 +38,6 @@ buildPythonPackage {
   # thus the `sed` command
   # Make sure to check that the right substitutions are made when updating the package
   preBuild = ''
-    cd py-polars
     #sed -i 's/version = "0.18.0"/version = "${version}"/g' Cargo.lock
   '';
 
@@ -49,7 +48,7 @@ buildPythonPackage {
     };
   };
 
-  cargoRoot = "py-polars";
+  sourceRoot = "source/py-polars";
 
   # Revisit this whenever package or Rust is upgraded
   RUSTC_BOOTSTRAP = 1;
diff --git a/pkgs/development/python-modules/polyline/default.nix b/pkgs/development/python-modules/polyline/default.nix
index 5ab360ae7e379..6ed2daae7e887 100644
--- a/pkgs/development/python-modules/polyline/default.nix
+++ b/pkgs/development/python-modules/polyline/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pytestCheckHook
 , pythonOlder
 , setuptools
@@ -10,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "polyline";
-  version = "2.0.0";
+  version = "2.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,19 +17,10 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "frederickjansen";
     repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-e9ZDqcS3MaMlXi2a2JHI6NtRPqIV7rjsucGXEH6V8LA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fbGGfZdme4OiIGNlXG1uVl1xP+rPVI9l5hjHM0gwAsE=";
   };
 
-  patches = [
-    # https://github.com/frederickjansen/polyline/pull/15
-    (fetchpatch {
-      name = "relax-build-dependencies.patch";
-      url = "https://github.com/frederickjansen/polyline/commit/cb9fc80606c33dbbcaa0d94de25ae952358443b6.patch";
-      hash = "sha256-epg2pZAG+9QuICa1ms+/EO2DDmYEz+KEtxxnvG7rsWY=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov=polyline --cov-report term-missing" ""
diff --git a/pkgs/development/python-modules/pomegranate/default.nix b/pkgs/development/python-modules/pomegranate/default.nix
index 57d6dd0b9ab60..93c42374876c5 100644
--- a/pkgs/development/python-modules/pomegranate/default.nix
+++ b/pkgs/development/python-modules/pomegranate/default.nix
@@ -2,14 +2,20 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
+, apricot-select
+, networkx
 , numpy
+, scikit-learn
 , scipy
-, cython
-, networkx
-, joblib
-, pandas
-, nose
-, pyyaml
+, torch
+
+# tests
+, pytestCheckHook
 }:
 
 
@@ -26,9 +32,22 @@ buildPythonPackage rec {
     sha256 = "sha256-EnxKlRRfsOIDLAhYOq7bUSbI/NvPoSyYCZ9D5VCXFGQ=";
   };
 
-  propagatedBuildInputs = [ numpy scipy cython networkx joblib pyyaml ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    apricot-select
+    networkx
+    numpy
+    scikit-learn
+    scipy
+    torch
+  ];
 
-  nativeCheckInputs = [ pandas nose ];  # as of 0.13.5, it depends explicitly on nose, rather than pytest.
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     broken = stdenv.isDarwin;
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index 70cf9bc721ddb..7166577d8c74f 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -13,21 +13,20 @@
 , semver
 , rich
 , tomlkit
-, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "23.9.1";
-  format = "pyproject";
+  version = "23.12.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "greenbone";
-    repo = pname;
+    repo = "pontos";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HRIGS2B6tc4qaOMTud5/uhEr1k7puqJUugDj1WuacqU=";
+    hash = "sha256-N10Jn5jq/PktpmeRNlqZyN/rUyAeW+ghY3/RK9Aas7I=";
   };
 
   nativeBuildInputs = [
@@ -42,10 +41,7 @@ buildPythonPackage rec {
     python-dateutil
     semver
     rich
-    typing-extensions
     tomlkit
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
   ] ++ httpx.optional-dependencies.http2;
 
   nativeCheckInputs = [
@@ -70,6 +66,9 @@ buildPythonPackage rec {
     # Tests require git executable
     "test_github_action_output"
     "test_initial_release"
+    # Tests are out-dated
+    "test_getting_version_without_version_config"
+    "test_verify_version_does_not_match"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pooch/default.nix b/pkgs/development/python-modules/pooch/default.nix
index b8ba613ba350e..6c3e28cd9b4cd 100644
--- a/pkgs/development/python-modules/pooch/default.nix
+++ b/pkgs/development/python-modules/pooch/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pooch";
-  version = "1.7.0";
+  version = "1.8.0";
   format = "pyproject";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8XShBBtkR/Du+IYPdtF/YO0vhX3A76OHp/CCKK8F2Zg=";
+    hash = "sha256-9ZmB/VubXQMtzej0oR6qSSwqxjQ/rjWWov2uNfxUsKA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/portalocker/default.nix b/pkgs/development/python-modules/portalocker/default.nix
index 34845722ce4fc..cd66b0950eefb 100644
--- a/pkgs/development/python-modules/portalocker/default.nix
+++ b/pkgs/development/python-modules/portalocker/default.nix
@@ -1,40 +1,56 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, setuptools
+, setuptools-scm
+
+# dependencies
 , redis
+
+# tests
+, pygments
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "portalocker";
-  version = "2.7.0";
-  format = "setuptools";
+  version = "2.8.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ay6B1TSojsFzbQP3gLoHPwR6BsR4sG4pN0hvM06VXFE=";
+    hash = "sha256-KwNap4KORsWOmzE5DuHxabmOEGarELmmqGH+fiXuTzM=";
   };
 
+  postPatch = ''
+    sed -i "/--cov/d" pytest.ini
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
     redis
   ];
 
   nativeCheckInputs = [
+    pygments
     pytestCheckHook
   ];
 
-  disabledTests = [
-    "test_combined" # no longer compatible with setuptools>=58
-  ];
-
   pythonImportsCheck = [
     "portalocker"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/wolph/portalocker/releases/tag/v${version}";
     description = "A library to provide an easy API to file locking";
     homepage = "https://github.com/WoLpH/portalocker";
     license = licenses.psfl;
diff --git a/pkgs/development/python-modules/prance/default.nix b/pkgs/development/python-modules/prance/default.nix
index 1fffa8cde714c..33ad076f93387 100644
--- a/pkgs/development/python-modules/prance/default.nix
+++ b/pkgs/development/python-modules/prance/default.nix
@@ -36,8 +36,6 @@ buildPythonPackage rec {
       --replace "--cov=prance --cov-report=term-missing --cov-fail-under=90" ""
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/preshed/default.nix b/pkgs/development/python-modules/preshed/default.nix
index e0d37c51a2b12..557045649425f 100644
--- a/pkgs/development/python-modules/preshed/default.nix
+++ b/pkgs/development/python-modules/preshed/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "preshed";
-  version = "3.0.9";
+  version = "4.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-chhjxSRP/NJlGtCSiVGix8d7EC9OEaJRrYXTfudiFmA=";
+    hash = "sha256-XisLKgfdGo3uqtZhIBmEXGAu4kkH9pNuqvF6q9VuVEw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/prettytable/default.nix b/pkgs/development/python-modules/prettytable/default.nix
index b0efbcb373d4f..91d2d5a427a71 100644
--- a/pkgs/development/python-modules/prettytable/default.nix
+++ b/pkgs/development/python-modules/prettytable/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "prettytable";
-  version = "3.8.0";
+  version = "3.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,11 +20,9 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "prettytable";
     rev = "refs/tags/${version}";
-    hash= "sha256-JnxUjUosQJgprIbA9szSfw1Fi21Qc4WljoRAQv4x5YM=";
+    hash= "sha256-yIO4eO2VdOnUt9qoNQOeq/c0os2LQ3mqAkCOIuoGpyg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/process-tests/default.nix b/pkgs/development/python-modules/process-tests/default.nix
index 436ca00267584..acffc0dca510d 100644
--- a/pkgs/development/python-modules/process-tests/default.nix
+++ b/pkgs/development/python-modules/process-tests/default.nix
@@ -1,18 +1,23 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "process-tests";
-  version = "2.1.2";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a3747ad947bdfc93e5c986bdb17a6d718f3f26e8577a0807a00962f29e26deba";
+    hash = "sha256-5dV96nFhJR6RytuEvz7MhSdfsSH9R45Xn4AHd7HUJL0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # No tests
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/prometheus-client/default.nix b/pkgs/development/python-modules/prometheus-client/default.nix
index b3e1e12400c21..4c4c2338445a8 100644
--- a/pkgs/development/python-modules/prometheus-client/default.nix
+++ b/pkgs/development/python-modules/prometheus-client/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "prometheus-client";
-  version = "0.17.1";
+  version = "0.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "prometheus";
     repo = "client_python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ag9gun47Ar0Sw3ZGIXAHjtv4GdhX8x51UVkgwdQ8A+s=";
+    hash = "sha256-7mVqfzK0E8RQAlQyQD8/DIcPJZ52V13JqU22tsQJp+Q=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/prompt-toolkit/default.nix b/pkgs/development/python-modules/prompt-toolkit/default.nix
index 2869c042d2d08..034203068baa6 100644
--- a/pkgs/development/python-modules/prompt-toolkit/default.nix
+++ b/pkgs/development/python-modules/prompt-toolkit/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "prompt-toolkit";
-  version = "3.0.39";
+  version = "3.0.41";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "prompt_toolkit";
     inherit version;
-    hash = "sha256-BFBa3mh9wm3EKEsa0ZqDvi8q/oPnqCis4McvOh33Kqw=";
+    hash = "sha256-lBNn2X/IFVSIIqomwqJp/cTrIensBfxdRHzwm61ddfA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/propka/default.nix b/pkgs/development/python-modules/propka/default.nix
index 21488f696f471..08a85586411c0 100644
--- a/pkgs/development/python-modules/propka/default.nix
+++ b/pkgs/development/python-modules/propka/default.nix
@@ -9,7 +9,7 @@
 buildPythonPackage rec {
   pname = "propka";
   version = "3.5.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     hash = "sha256-EJQqCe4WPOpqsSxxfbTjF0qETpSPYqpixpylweTCjko=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/psycopg/default.nix b/pkgs/development/python-modules/psycopg/default.nix
index d66f21ca26790..b651412571e6b 100644
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@@ -35,13 +35,13 @@
 
 let
   pname = "psycopg";
-  version = "3.1.14";
+  version = "3.1.15";
 
   src = fetchFromGitHub {
     owner = "psycopg";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-zocRBnrQoJDWI4qhxDnxxIeiLdaWolvsujqfHBYQc/A=";
+    hash = "sha256-8M2Rm9AtOvZwZhKGuR96XiOOmllqcWAZJuEmUXxzsRw=";
   };
 
   patches = [
@@ -50,12 +50,6 @@ let
       libpq = "${postgresql.lib}/lib/libpq${stdenv.hostPlatform.extensions.sharedLibrary}";
       libc = "${stdenv.cc.libc}/lib/libc.so.6";
     })
-
-    (fetchpatch {
-      # add fixture to mark flaky ref count tests
-      url = "https://github.com/psycopg/psycopg/commit/70ef364324ba3448ef9ac0e29329c9d802380e4b.patch";
-      hash = "sha256-8PlrBcIumlxFjNXCAfm4NpSIxAnvLR8TopHzneJyzf0=";
-    })
   ];
 
   baseMeta = {
diff --git a/pkgs/development/python-modules/psycopg2/default.nix b/pkgs/development/python-modules/psycopg2/default.nix
index 43a06e5a9e4d4..88f3a8b24483e 100644
--- a/pkgs/development/python-modules/psycopg2/default.nix
+++ b/pkgs/development/python-modules/psycopg2/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "psycopg2";
-  version = "2.9.7";
+  version = "2.9.9";
   format = "setuptools";
 
   # Extension modules don't work well with PyPy. Use psycopg2cffi instead.
@@ -24,7 +24,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8AzDW9cRnx/tF7hb0QB4VRlN3iy9jeAauOuxdIdECtg=";
+    hash = "sha256-0UVL3pP7HiJBZoEWlNYA50ZDDABvuwMeoG7MLqQb8VY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/psygnal/default.nix b/pkgs/development/python-modules/psygnal/default.nix
index 36ae22a67b680..890d397c532ff 100644
--- a/pkgs/development/python-modules/psygnal/default.nix
+++ b/pkgs/development/python-modules/psygnal/default.nix
@@ -11,6 +11,7 @@
 , toolz
 , typing-extensions
 , wrapt
+, attrs
 }:
 
 buildPythonPackage rec {
@@ -27,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-eDfGWmTKJrkkzRy1I3wl3WYPCxtPHSRzqAoOiO7QQ9Y=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     hatch-vcs
     hatchling
@@ -45,6 +44,7 @@ buildPythonPackage rec {
     pytestCheckHook
     toolz
     wrapt
+    attrs
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index dd053d439070d..a0c0e144c3ba8 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "6.1.0";
+  version = "6.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-W3gfHCbScAZ/j6gNzrPwhcmrYoTXi+0BuSEzjOKSo4M=";
+    hash = "sha256-K1Ov8yp6cD7h2kAXNRfcoJp24WA9VpO/y0Aga+9BHz4=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/pure-eval/default.nix b/pkgs/development/python-modules/pure-eval/default.nix
index f21f4d7fe4cc8..60615c0a0640b 100644
--- a/pkgs/development/python-modules/pure-eval/default.nix
+++ b/pkgs/development/python-modules/pure-eval/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-9N+UcgAv30s4ctgsBrOHiix4BoXhKPgxH/GOz/NIFdU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pure-protobuf/default.nix b/pkgs/development/python-modules/pure-protobuf/default.nix
index c2d7f7e3d8ad1..ba8b1836ba624 100644
--- a/pkgs/development/python-modules/pure-protobuf/default.nix
+++ b/pkgs/development/python-modules/pure-protobuf/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pure-protobuf";
-  version = "2.3.0";
+  version = "3.0.0";
 
   format = "pyproject";
   disabled = pythonOlder "3.7";
@@ -21,11 +21,9 @@ buildPythonPackage rec {
     owner = "eigenein";
     repo = "protobuf";
     rev = "refs/tags/${version}";
-    hash = "sha256-nJ3F8dUrqMeWqTV9ErGqrMvofJwBKwNUDfxWIqFh4nY=";
+    hash = "sha256-MjxJTX672LSEqZkH39vTD/+IhCTp6FL2z15S7Lxj6Dc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/pvextractor/default.nix b/pkgs/development/python-modules/pvextractor/default.nix
index 592a5c107dad7..4d39db14d7145 100644
--- a/pkgs/development/python-modules/pvextractor/default.nix
+++ b/pkgs/development/python-modules/pvextractor/default.nix
@@ -40,8 +40,6 @@ buildPythonPackage rec {
     spectral-cube
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # collecting ... qt.qpa.xcb: could not connect to display
   # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
   doCheck = false;
diff --git a/pkgs/development/python-modules/py-desmume/default.nix b/pkgs/development/python-modules/py-desmume/default.nix
index 1ed79995b4eea..6d63a7db9c8f0 100644
--- a/pkgs/development/python-modules/py-desmume/default.nix
+++ b/pkgs/development/python-modules/py-desmume/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "py-desmume";
-  version = "0.0.5.post0";
+  version = "0.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "SkyTemple";
     repo = pname;
-    rev = version;
-    hash = "sha256-q6E7J7e0yXt+jo1KNqqAw2cG/Us+Tw0dLfTqAKWfAlc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-AgUdILCqpmuVI3uMSdGl+lIfUVXnIo/egm/48FMRF3M=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/py-tree-sitter/default.nix b/pkgs/development/python-modules/py-tree-sitter/default.nix
index f8c1997220a74..9358a0fbca887 100644
--- a/pkgs/development/python-modules/py-tree-sitter/default.nix
+++ b/pkgs/development/python-modules/py-tree-sitter/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "py-tree-sitter";
-  version = "0.20.1";
+  version = "0.20.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "py-tree-sitter";
-    rev = "v${version}";
-    hash = "sha256-mdV5zGvVI1MltmOD1BtXxsKB/yigk8d56WwLlX6Uizg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-R97WcsHQMcuEOCg/QQ9YbGTRD30G9PRv0xAbxuoFyC4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/py-ubjson/default.nix b/pkgs/development/python-modules/py-ubjson/default.nix
index 175b635257619..f9518fdead937 100644
--- a/pkgs/development/python-modules/py-ubjson/default.nix
+++ b/pkgs/development/python-modules/py-ubjson/default.nix
@@ -20,9 +20,18 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [ "test/test.py" ];
+  disabledTests = [
+    # https://github.com/Iotic-Labs/py-ubjson/issues/18
+    "test_recursion"
+  ];
+
+  pytestFlagsArray = [
+    "test/test.py"
+  ];
 
-  pythonImportsCheck = [ "ubjson" ];
+  pythonImportsCheck = [
+    "ubjson"
+  ];
 
   meta = with lib; {
     description = "Universal Binary JSON draft-12 serializer for Python";
diff --git a/pkgs/development/python-modules/pyairnow/default.nix b/pkgs/development/python-modules/pyairnow/default.nix
index f425eaeaa17ca..c4a549847a26a 100644
--- a/pkgs/development/python-modules/pyairnow/default.nix
+++ b/pkgs/development/python-modules/pyairnow/default.nix
@@ -3,6 +3,7 @@
 , aioresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytest-aiohttp
 , poetry-core
 , pytest-asyncio
@@ -22,6 +23,16 @@ buildPythonPackage rec {
     hash = "sha256-aab+3xrEiCjysa+DzXWelQwz8V2tr74y8v0NpDZiuTk=";
   };
 
+  patches = [
+    (fetchpatch {
+      # remove setuptools, wheel from build-system requirements
+      # https://github.com/asymworks/pyairnow/pull/7
+      name = "pyairnow-build-system.patch";
+      url = "https://github.com/asymworks/pyairnow/commit/e3cc892ffce855d8213264248b6b4ed78ee791bd.patch";
+      hash = "sha256-L0MV2okkf6Nf1S4zS7lb4lt5eSfTF10yDJLzpyDrSl8=";
+    })
+  ];
+
   nativeBuildInputs = [ poetry-core ];
 
   propagatedBuildInputs = [ aiohttp ];
diff --git a/pkgs/development/python-modules/pyaml/default.nix b/pkgs/development/python-modules/pyaml/default.nix
index 3fcf2468aea31..70c660e0daad4 100644
--- a/pkgs/development/python-modules/pyaml/default.nix
+++ b/pkgs/development/python-modules/pyaml/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pyyaml
 , unidecode
 }:
 
 buildPythonPackage rec {
   pname = "pyaml";
-  version = "23.9.6";
-  format = "setuptools";
+  version = "23.9.7";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Kyw5AXtxihJ775+WvFX4lBTZYIdmaNaYgKrmb0upiVc=";
+    hash = "sha256-WB6k6Z8OMIhkQH4EwDxgkkGu+joV37qJZNp2RLrzshc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyyaml
   ];
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index 39c0420542074..fc424376477ee 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -17,8 +17,9 @@
 , pytest-lazy-fixture
 , pkg-config
 , scipy
-, fetchpatch
+, setuptools
 , setuptools-scm
+, oldest-supported-numpy
 }:
 
 let
@@ -27,18 +28,25 @@ in
 
 buildPythonPackage rec {
   pname = "pyarrow";
-  format = "setuptools";
   inherit (arrow-cpp) version src;
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   sourceRoot = "apache-arrow-${version}/python";
 
+  postPatch = ''
+    substituteInPlace pyproject.toml setup.py \
+      --replace "setuptools_scm < 8.0.0" "setuptools_scm"
+  '';
+
   nativeBuildInputs = [
     cmake
     cython
     pkg-config
+    setuptools
     setuptools-scm
+    oldest-supported-numpy
   ];
 
   buildInputs = [ arrow-cpp ];
diff --git a/pkgs/development/python-modules/pyasn1/default.nix b/pkgs/development/python-modules/pyasn1/default.nix
index 3888f66d776a4..d4fb73d509986 100644
--- a/pkgs/development/python-modules/pyasn1/default.nix
+++ b/pkgs/development/python-modules/pyasn1/default.nix
@@ -2,20 +2,25 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pyasn1";
-  version = "0.5.0";
-  format = "setuptools";
+  version = "0.5.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-l7cpDKaOYqgyVY7Dl28Vy/kRv118cDnYuGHCoOzmn94=";
+    hash = "sha256-bTkaluWbIxMKXPp01v1/OI274mzI8e3zn93fCNnWZ2w=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = [
     "pyasn1"
   ];
diff --git a/pkgs/development/python-modules/pyatag/default.nix b/pkgs/development/python-modules/pyatag/default.nix
index 47cbf5b6c7976..1920466295e68 100644
--- a/pkgs/development/python-modules/pyatag/default.nix
+++ b/pkgs/development/python-modules/pyatag/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyatag";
-  version = "0.3.7.1";
+  version = "3.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "MatsNl";
     repo = "pyatag";
     rev = "refs/tags/${version}";
-    hash = "sha256-3h9mpopTbEULCx7rcEt/I/ZnUA0L/fJ7Y3L5h/6EuC4=";
+    hash = "sha256-hyGos0LFVKv63jf1ODPFfk+R47oyHea+8MGvxeKpop8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 74098c5ba877c..eabe5a872f4f5 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-AKpDXfNF2t/3F4SmMWIgfkxHgcJobYs225gIeJ31l6k=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "oauthlib~=3.1" "oauthlib" \
diff --git a/pkgs/development/python-modules/pyaussiebb/default.nix b/pkgs/development/python-modules/pyaussiebb/default.nix
index 1fcb88c0c77ed..4443dfee6252c 100644
--- a/pkgs/development/python-modules/pyaussiebb/default.nix
+++ b/pkgs/development/python-modules/pyaussiebb/default.nix
@@ -11,8 +11,8 @@
 
 buildPythonPackage rec {
   pname = "pyaussiebb";
-  version = "0.0.18";
-  format = "pyproject";
+  version = "0.1.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "yaleman";
     repo = "aussiebb";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tEdddVsLFCHRvyLCctDakioiop2xWaJlfGE16P1ukHc=";
+    hash = "sha256-XNf9vYMlTLqhYIVNw9GjPcXpOm5EYCcC4aGukR8g3zc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyavm/default.nix b/pkgs/development/python-modules/pyavm/default.nix
index ef8a82a1cd429..45cf827a82a8a 100644
--- a/pkgs/development/python-modules/pyavm/default.nix
+++ b/pkgs/development/python-modules/pyavm/default.nix
@@ -1,39 +1,44 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
+
+# build-system
+, setuptools
+, setuptools-scm
+
+# tests
 , astropy
-, astropy-helpers
+, numpy
 , pillow
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pyavm";
-  version = "0.9.5";
-  format = "setuptools";
+  version = "0.9.6";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "PyAVM";
     inherit version;
-    hash = "sha256-gV78ypvYwohHmdjP3lN5F97PfmxuV91tvw5gsYeZ7i8=";
+    hash = "sha256-s7eLPoAHDbY9tPt3RA5zJg+NuTtVV/SqpUUR3NrG8m0=";
   };
 
-  propagatedBuildInputs = [
-    astropy-helpers
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
   ];
 
   nativeCheckInputs = [
     astropy
+    numpy
     pillow
     pytestCheckHook
   ];
 
-  # Disable automatic update of the astropy-helper module
-  postPatch = ''
-    substituteInPlace setup.cfg --replace "auto_use = True" "auto_use = False"
-  '';
-
-  pythonImportsCheck = [ "pyavm" ];
+  pythonImportsCheck = [
+    "pyavm"
+  ];
 
   meta = with lib; {
     description = "Simple pure-python AVM meta-data handling";
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index e60079ed24179..9519ca65e2469 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -1,7 +1,7 @@
 { buildPythonPackage
 , lib
 , fetchPypi
-, fetchpatch
+, setuptools
 , formulaic
 , click
 , num2words
@@ -9,7 +9,6 @@
 , scipy
 , pandas
 , nibabel
-, patsy
 , bids-validator
 , sqlalchemy
 , pytestCheckHook
@@ -18,35 +17,43 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.16.3";
-  format = "setuptools";
   pname = "pybids";
+  version = "0.16.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EOJ5NQyNFMpgLA1EaaXkv3/zk+hkPIMaVGrnNba4LMM=";
+    hash = "sha256-pahl8wi6Sf8AuVqkvi7H90ViHr+9utb14ZVmKK3rFm4=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+    versioneer
+  ] ++ versioneer.optional-dependencies.toml;
 
   pythonRelaxDeps = [ "sqlalchemy" ];
 
   propagatedBuildInputs = [
+    bids-validator
     click
     formulaic
+    nibabel
     num2words
     numpy
-    scipy
     pandas
-    nibabel
-    patsy
-    bids-validator
+    scipy
     sqlalchemy
-    versioneer
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  pythonImportsCheck = [ "bids" ];
+  pythonImportsCheck = [
+    "bids"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   disabledTests = [
     # looks for missing data:
     "test_config_filename"
diff --git a/pkgs/development/python-modules/pybullet/default.nix b/pkgs/development/python-modules/pybullet/default.nix
index 197d079071287..3c11dd822c211 100644
--- a/pkgs/development/python-modules/pybullet/default.nix
+++ b/pkgs/development/python-modules/pybullet/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , libGLU, libGL
 , xorg
 , numpy
@@ -8,14 +9,18 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "3.2.5";
-  format = "setuptools";
+  version = "3.2.6";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-G8ua+4eghr4bLeGPCE0f2rgZTaG/cfJkdDyia6o5w1E=";
+    hash = "sha256-2idSVDPIhpjcn9i8IPpK5NB3OLRlZjNlnr2CwtKITgg=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   buildInputs = [
     libGLU libGL
     xorg.libX11
@@ -30,6 +35,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Open-source software for robot simulation, integrated with OpenAI Gym";
+    downloadPage = "https://github.com/bulletphysics/bullet3";
     homepage = "https://pybullet.org/";
     license = licenses.zlib;
     maintainers = with maintainers; [ timokau ];
diff --git a/pkgs/development/python-modules/pycairo/default.nix b/pkgs/development/python-modules/pycairo/default.nix
index 6aa58056cad91..628853a89ce01 100644
--- a/pkgs/development/python-modules/pycairo/default.nix
+++ b/pkgs/development/python-modules/pycairo/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pycairo";
-  version = "1.24.0";
+  version = "1.25.1";
 
   disabled = pythonOlder "3.6";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pygobject";
     repo = "pycairo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eAE0YPZAV90MP6g1V1T80suaRV15ts38kYt6Djb78Xk=";
+    hash = "sha256-HH4BjdSkdL8lI8L/Z2ltuuWWOkfetfgv4WQm6PIoEa0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pycares/default.nix b/pkgs/development/python-modules/pycares/default.nix
index 84a7cbe1ba42c..fcd6327bd2224 100644
--- a/pkgs/development/python-modules/pycares/default.nix
+++ b/pkgs/development/python-modules/pycares/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pycares";
-  version = "4.3.0";
+  version = "4.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xUJpb22sl46dmRkjhHRaZfgKfZRQUBFR5KdWPgYBDUU=";
+    hash = "sha256-9HV51Qjy9W7d0WznIEV4KtOxs7Z4CYaZ4rahswcz4cI=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 5482375dabb2a..f169f91b1a479 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -54,5 +54,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/pyclipper/default.nix b/pkgs/development/python-modules/pyclipper/default.nix
index 45e5ff27ee558..b7b15c260fdbf 100644
--- a/pkgs/development/python-modules/pyclipper/default.nix
+++ b/pkgs/development/python-modules/pyclipper/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-FKpP+tgJFzhij3wDQsAgwrTNnny7lgmN+tlSQ9JgG+Q=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
     cython
diff --git a/pkgs/development/python-modules/pycodestyle/default.nix b/pkgs/development/python-modules/pycodestyle/default.nix
index 250537774c2a4..761e9c0562a4d 100644
--- a/pkgs/development/python-modules/pycodestyle/default.nix
+++ b/pkgs/development/python-modules/pycodestyle/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pycodestyle";
-  version = "2.11.0";
+  version = "2.11.1";
 
   disabled = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JZvMF4V9ios7SiMnMkt55fAgoTwWB0Zw+cjI+HLqdtA=";
+    hash = "sha256-QboOevyXUt+1PO1UieifgYa+AOWZ5xJmBpW3p1/yZj8=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 47e90eb8726a9..4b37a0765f0e4 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -10,14 +10,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.18.0";
+  version = "3.19.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Legrandin";
     repo = "pycryptodome";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6oXXy18KlSjfyZhfMnIgnu34u/9sG0TPYvPJ8ovTqMA=";
+    hash = "sha256-WD+OEjePVtqlmn7h1CIfraLuEQlodkvjmYQ8q7nNoGU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycyphal/default.nix b/pkgs/development/python-modules/pycyphal/default.nix
index c84b22b7b54d2..fa95336d3b3fa 100644
--- a/pkgs/development/python-modules/pycyphal/default.nix
+++ b/pkgs/development/python-modules/pycyphal/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pycyphal";
-  version = "1.15.2";
+  version = "1.15.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KVX+DwcJp1sjpcG1Utl9me1LwWDZPof+O6hoUt1xlXA=";
+    hash = "sha256-0Mp8d/rNOOPLg0gUPWdOgp/d5n148dxcLceW1VtjrkQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydantic-core/default.nix b/pkgs/development/python-modules/pydantic-core/default.nix
index 6e273aaef4c90..4569ea3286b8d 100644
--- a/pkgs/development/python-modules/pydantic-core/default.nix
+++ b/pkgs/development/python-modules/pydantic-core/default.nix
@@ -17,14 +17,14 @@
 let
   pydantic-core = buildPythonPackage rec {
     pname = "pydantic-core";
-    version = "2.6.3";
+    version = "2.14.5";
     format = "pyproject";
 
     src = fetchFromGitHub {
       owner = "pydantic";
       repo = "pydantic-core";
       rev = "refs/tags/v${version}";
-      hash = "sha256-bEVACTlzELXPoCtEHMR1s87KJn/qnE0lO1O4RmdjmPM=";
+      hash = "sha256-UguZpA3KEutOgIavjx8Ie//0qJq+4FTZNQTwb/ZIgb8=";
     };
 
     patches = [
@@ -34,7 +34,7 @@ let
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${pname}-${version}";
-      hash = "sha256-h9SmMLg/W11h/SQz8Te5OoCKdyG6Fctc5ftqbVQFSwU=";
+      hash = "sha256-mMgw922QjHmk0yimXfolLNiYZntTsGydQywe7PTNnwc=";
     };
 
     nativeBuildInputs = [
@@ -78,6 +78,7 @@ let
     ];
 
     meta = with lib; {
+      changelog = "https://github.com/pydantic/pydantic-core/releases/tag/v${version}";
       description = "Core validation logic for pydantic written in rust";
       homepage = "https://github.com/pydantic/pydantic-core";
       license = licenses.mit;
diff --git a/pkgs/development/python-modules/pydantic-scim/default.nix b/pkgs/development/python-modules/pydantic-scim/default.nix
index 9441bcc0eb845..b8ac4c729a69a 100644
--- a/pkgs/development/python-modules/pydantic-scim/default.nix
+++ b/pkgs/development/python-modules/pydantic-scim/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace 'version=get_version(),' 'version="${version}",'
diff --git a/pkgs/development/python-modules/pydantic-settings/default.nix b/pkgs/development/python-modules/pydantic-settings/default.nix
index c27bb5f275766..3034b2f927119 100644
--- a/pkgs/development/python-modules/pydantic-settings/default.nix
+++ b/pkgs/development/python-modules/pydantic-settings/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 , hatchling
 , pydantic
 , python-dotenv
@@ -11,14 +12,16 @@
 
 buildPythonPackage rec {
   pname = "pydantic-settings";
-  version = "2.0.3";
-  format = "pyproject";
+  version = "2.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-settings";
     rev = "v${version}";
-    hash = "sha256-3V6daCibvVr8RKo2o+vHC++QgIYKAOyRg11ATrCzM5Y=";
+    hash = "sha256-hU7u/AzaqCHKSUDHybsgXTW8IWi9hzBttPYDmMqdZbI=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +41,11 @@ buildPythonPackage rec {
     pytest-mock
   ];
 
+  disabledTests = [
+    # expected to fail
+    "test_docs_examples[docs/index.md:212-246]"
+  ];
+
   preCheck = ''
     export HOME=$TMPDIR
   '';
diff --git a/pkgs/development/python-modules/pydantic/1.nix b/pkgs/development/python-modules/pydantic/1.nix
new file mode 100644
index 0000000000000..e1fc840f0ee14
--- /dev/null
+++ b/pkgs/development/python-modules/pydantic/1.nix
@@ -0,0 +1,76 @@
+{ lib
+, buildPythonPackage
+, cython
+, email-validator
+, fetchFromGitHub
+, pytest-mock
+, pytestCheckHook
+, python-dotenv
+, pythonOlder
+, setuptools
+, typing-extensions
+, libxcrypt
+}:
+
+buildPythonPackage rec {
+  pname = "pydantic";
+  version = "1.10.13";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "pydantic";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ruDVcCLPVuwIkHOjYVuKOoP3hHHr7ItIY55Y6hUgR74=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    cython
+  ];
+
+  buildInputs = lib.optionals (pythonOlder "3.9") [
+    libxcrypt
+  ];
+
+  propagatedBuildInputs = [
+    typing-extensions
+  ];
+
+  passthru.optional-dependencies = {
+    dotenv = [
+      python-dotenv
+    ];
+    email = [
+      email-validator
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  pytestFlagsArray = [
+    # https://github.com/pydantic/pydantic/issues/4817
+    "-W" "ignore::pytest.PytestReturnNotNoneWarning"
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  enableParallelBuilding = true;
+
+  pythonImportsCheck = [ "pydantic" ];
+
+  meta = with lib; {
+    description = "Data validation and settings management using Python type hinting";
+    homepage = "https://github.com/pydantic/pydantic";
+    changelog = "https://github.com/pydantic/pydantic/blob/v${version}/HISTORY.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wd15 ];
+  };
+}
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 4384e51db22b5..d58ec6e53f5f5 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -1,124 +1,87 @@
 { lib
-, stdenv
 , buildPythonPackage
-, autoflake
-, cython
-, devtools
-, email-validator
 , fetchFromGitHub
-, fetchpatch
-, pytest-mock
-, pytestCheckHook
-, python-dotenv
-, pythonAtLeast
 , pythonOlder
-, pyupgrade
-, typing-extensions
-# dependencies for building documentation.
-# docs fail to build in Darwin sandbox: https://github.com/samuelcolvin/pydantic/issues/4245
-, withDocs ? (stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.isDarwin && pythonAtLeast "3.10")
-, ansi2html
-, markdown-include
-, mike
-, mkdocs
-, mkdocs-exclude
-, mkdocs-material
-, mdx-truly-sane-lists
-, sqlalchemy
-, ujson
-, orjson
-, hypothesis
+
+# build-system
+, hatchling
+, hatch-fancy-pypi-readme
+
+# native dependencies
 , libxcrypt
+
+# dependencies
+, annotated-types
+, pydantic-core
+, typing-extensions
+
+# tests
+, cloudpickle
+, email-validator
+, dirty-equals
+, faker
+, pytestCheckHook
+, pytest-mock
 }:
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "1.10.12";
-  format = "setuptools";
-
-  outputs = [
-    "out"
-  ] ++ lib.optionals withDocs [
-    "doc"
-  ];
+  version = "2.5.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pydantic";
-    repo = pname;
+    repo = "pydantic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3XnbPGU90wLCPEryFAOky6Iy73Dvgzzh+GbOKW8hZ4U=";
+    hash = "sha256-D0gYcyrKVVDhBgV9sCVTkGq/kFmIoT9l0i5bRM1qxzM=";
   };
 
-  postPatch = ''
-    sed -i '/flake8/ d' Makefile
-  '';
-
   buildInputs = lib.optionals (pythonOlder "3.9") [
     libxcrypt
   ];
 
   nativeBuildInputs = [
-    cython
-  ] ++ lib.optionals withDocs [
-    # dependencies for building documentation
-    autoflake
-    ansi2html
-    markdown-include
-    mdx-truly-sane-lists
-    mike
-    mkdocs
-    mkdocs-exclude
-    mkdocs-material
-    sqlalchemy
-    ujson
-    orjson
-    hypothesis
+    hatch-fancy-pypi-readme
+    hatchling
   ];
 
   propagatedBuildInputs = [
-    devtools
-    pyupgrade
+    annotated-types
+    pydantic-core
     typing-extensions
   ];
 
   passthru.optional-dependencies = {
-    dotenv = [
-      python-dotenv
-    ];
     email = [
       email-validator
     ];
   };
 
   nativeCheckInputs = [
+    cloudpickle
+    dirty-equals
+    faker
     pytest-mock
     pytestCheckHook
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
-  pytestFlagsArray = [
-    # https://github.com/pydantic/pydantic/issues/4817
-    "-W" "ignore::pytest.PytestReturnNotNoneWarning"
-  ];
-
   preCheck = ''
     export HOME=$(mktemp -d)
+    substituteInPlace pyproject.toml \
+      --replace "'--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations'," "" \
+      --replace "'--benchmark-group-by', 'group'," "" \
+      --replace "'--benchmark-warmup', 'on'," "" \
+      --replace "'--benchmark-disable'," ""
   '';
 
-  # Must include current directory into PYTHONPATH, since documentation
-  # building process expects "import pydantic" to work.
-  preBuild = lib.optionalString withDocs ''
-    PYTHONPATH=$PWD:$PYTHONPATH make docs
-  '';
+  disabledTestPaths = [
+    "tests/benchmarks"
 
-  # Layout documentation in same way as "sphinxHook" does.
-  postInstall = lib.optionalString withDocs ''
-    mkdir -p $out/share/doc/$name
-    mv ./site $out/share/doc/$name/html
-  '';
-
-  enableParallelBuilding = true;
+    # avoid cyclic dependency
+    "tests/test_docs.py"
+  ];
 
   pythonImportsCheck = [ "pydantic" ];
 
diff --git a/pkgs/development/python-modules/pydevd/default.nix b/pkgs/development/python-modules/pydevd/default.nix
index 8ee2f8d98acf4..df840a24db8f7 100644
--- a/pkgs/development/python-modules/pydevd/default.nix
+++ b/pkgs/development/python-modules/pydevd/default.nix
@@ -2,10 +2,11 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
+, setuptools
 , numpy
 , psutil
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , trio
 , untangle
@@ -13,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "pydevd";
-  version = "2.9.6";
-  format = "setuptools";
+  version = "2.10.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -22,16 +23,11 @@ buildPythonPackage rec {
     owner = "fabioz";
     repo = "PyDev.Debugger";
     rev = "pydev_debugger_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-TDU/V7kY7zVxiP4OVjGqpsRVYplpkgCly2qAOqhZONo=";
+    hash = "sha256-1tWiPj30x/ZXIBu2qzUCpyF1bLsJ0wW1QaxklD3h3A8=";
   };
 
-  patches = [
-    # https://github.com/fabioz/PyDev.Debugger/pull/258
-    (fetchpatch {
-      name = "numpy-1.25-test-compatibility.patch";
-      url = "https://github.com/fabioz/PyDev.Debugger/commit/6f637d951cda62dc2202a2c7b6af526c4d1e8a00.patch";
-      hash = "sha256-DLzZZwQHtqGZGA8nsBLNQqamuI4xUfQ89Gd21sJa9/s=";
-    })
+  nativeBuildInputs = [
+    setuptools
   ];
 
   __darwinAllowLocalNetworking = true;
@@ -61,6 +57,11 @@ buildPythonPackage rec {
     # AssertionError pydevd_tracing.set_trace_to_threads(tracing_func) == 0
     "test_tracing_other_threads"
     "test_tracing_basic"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    "test_case_handled_and_unhandled_exception_generator"
+    "test_case_stop_async_iteration_exception"
+    "test_case_unhandled_exception_generator"
+    "test_function_breakpoints_async"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_multiprocessing_simple"
     "test_evaluate_exception_trace"
diff --git a/pkgs/development/python-modules/pydexcom/default.nix b/pkgs/development/python-modules/pydexcom/default.nix
index 3a22435412910..bd639205c1116 100644
--- a/pkgs/development/python-modules/pydexcom/default.nix
+++ b/pkgs/development/python-modules/pydexcom/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-46+Ml73F6EUbMwRJB93FD+No/g65RJwnCnFzH4Pb5ek=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pydrawise/default.nix b/pkgs/development/python-modules/pydrawise/default.nix
index f3a4563eeef79..c7fedf9080b15 100644
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-FbnCo0kdAkm//OHINeEL8ibEH0BxVb9cOypyo54kXY4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pyee/default.nix b/pkgs/development/python-modules/pyee/default.nix
index 0efcb94259fec..281611c31bddd 100644
--- a/pkgs/development/python-modules/pyee/default.nix
+++ b/pkgs/development/python-modules/pyee/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyee";
-  version = "11.0.0";
+  version = "11.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J8aCvOYL2txdPiPqzUEB3zKMAoCISj2cB/Ok4+WV3ic=";
+    hash = "sha256-tTr5j2mQyBDt2bVrh3kQIaj1T9E9tO3RFCQ41EuiJj8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyelftools/default.nix b/pkgs/development/python-modules/pyelftools/default.nix
index 817a39cedf9e9..206062b5316fd 100644
--- a/pkgs/development/python-modules/pyelftools/default.nix
+++ b/pkgs/development/python-modules/pyelftools/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyelftools";
-  version = "0.29";
+  version = "0.30";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "eliben";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tPY0C5CoA9hGHeEA/KWQ1RAVT5kqMlAwuWpOSH+KJ9Y=";
+    hash = "sha256-A9etnN7G24/Gu8YlV/YDpxZV+TG2eVXGx2ZjVnA9ZD4=";
   };
 
   doCheck = stdenv.hostPlatform.system == "x86_64-linux" && stdenv.hostPlatform.isGnu;
diff --git a/pkgs/development/python-modules/pyerfa/default.nix b/pkgs/development/python-modules/pyerfa/default.nix
index fda4be537d921..8561738f8428c 100644
--- a/pkgs/development/python-modules/pyerfa/default.nix
+++ b/pkgs/development/python-modules/pyerfa/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , jinja2
 , oldest-supported-numpy
 , setuptools-scm
@@ -16,21 +15,13 @@
 buildPythonPackage rec {
   pname = "pyerfa";
   format = "pyproject";
-  version = "2.0.0.3";
+  version = "2.0.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-13+7+lg1DBlMy5nl2TqgXTwrFNWq2LZi2Txq2f/0Hzk=";
+    hash = "sha256-26x07409Ow8i7wrTu72zCyqeEFcLH6Wpi+NMe+Nsmms=";
   };
 
-  patches = [
-    # Sort of helps maybe for https://github.com/liberfa/pyerfa/issues/112
-    (fetchpatch {
-      url = "https://github.com/liberfa/pyerfa/commit/4866342b94c5e7344711146f1186a4c3e7534da8.patch";
-      hash = "sha256-uPFFdLYfRweQdeEApBAw6Ulqh31NTQwwmnaU+x/M+C0=";
-    })
-  ];
-
   nativeBuildInputs = [
     jinja2
     oldest-supported-numpy
diff --git a/pkgs/development/python-modules/pyfaidx/default.nix b/pkgs/development/python-modules/pyfaidx/default.nix
index c1d081baaadbb..d16b02d1c3a41 100644
--- a/pkgs/development/python-modules/pyfaidx/default.nix
+++ b/pkgs/development/python-modules/pyfaidx/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, importlib-metadata
 , nose
 , numpy
 , setuptools
@@ -26,6 +27,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    importlib-metadata
     six
   ];
 
diff --git a/pkgs/development/python-modules/pyfakefs/default.nix b/pkgs/development/python-modules/pyfakefs/default.nix
index f1c07d89d2dcf..fdd7982a78983 100644
--- a/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/pkgs/development/python-modules/pyfakefs/default.nix
@@ -2,19 +2,25 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, setuptools
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  version = "5.2.4";
-  format = "setuptools";
   pname = "pyfakefs";
+  version = "5.3.2";
+  pyproject = true;
+
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PgQPN5IIYIag3CGRsF/nCUOOFoqv4ulPzb7444WSCNg=";
+    hash = "sha256-qDd2o8EEbU0QPy9TACmqbN/18Dht/9WcFe4WkmE1STw=";
   };
 
   postPatch = ''
@@ -30,21 +36,26 @@ buildPythonPackage rec {
       --replace "test_rename_dir_to_existing_dir" "notest_rename_dir_to_existing_dir"
   '');
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  # https://github.com/jmcgeheeiv/pyfakefs/issues/581 (OSError: [Errno 9] Bad file descriptor)
-  disabledTests = [ "test_open_existing_pipe" ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pyfakefs"
+  ];
 
-  disabledTestPaths = [
-    # try to import opentimelineio but nixpkgs doesn't have it as of 2023-09-16
-    "pyfakefs/pytest_tests/segfault_test.py"
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pyfakefs" ];
+  # https://github.com/jmcgeheeiv/pyfakefs/issues/581 (OSError: [Errno 9] Bad file descriptor)
+  #disabledTests = [ "test_open_existing_pipe" ];
+
 
   meta = with lib; {
     description = "Fake file system that mocks the Python file system modules";
     homepage = "http://pyfakefs.org/";
-    changelog = "https://github.com/jmcgeheeiv/pyfakefs/blob/master/CHANGES.md";
+    changelog = "https://github.com/jmcgeheeiv/pyfakefs/blob/v${version}/CHANGES.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ gebner ];
   };
diff --git a/pkgs/development/python-modules/pygal/default.nix b/pkgs/development/python-modules/pygal/default.nix
index 4470ac383042a..4b6de769859b4 100644
--- a/pkgs/development/python-modules/pygal/default.nix
+++ b/pkgs/development/python-modules/pygal/default.nix
@@ -1,20 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
+, importlib-metadata
+
+# optional-dependencies
 , lxml
 , cairosvg
+
+# tests
 , pyquery
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pygal";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.0.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KSP5XS5RWTCqWplyGdzO+/PZK36vX8HJ/ruVsJk1/bI=";
+    hash = "sha256-bF2jPxBB6LMMvJgPijSRDZ7cWEuDMkApj2ol32VCUok=";
   };
 
   postPatch = ''
@@ -22,6 +32,14 @@ buildPythonPackage rec {
       --replace pytest-runner ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    importlib-metadata
+  ];
+
   passthru.optional-dependencies = {
     lxml = [ lxml ];
     png = [ cairosvg ];
@@ -38,6 +56,8 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://github.com/Kozea/pygal/blob/${version}/docs/changelog.rst";
+    downloadPage = "https://github.com/Kozea/pygal";
     description = "Sexy and simple python charting";
     homepage = "http://www.pygal.org";
     license = licenses.lgpl3Plus;
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index ad506999d5958..ab5727b33add7 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -1,17 +1,39 @@
-{ stdenv, lib, substituteAll, fetchFromGitHub, buildPythonPackage, python, pkg-config, libX11
-, SDL2, SDL2_image, SDL2_mixer, SDL2_ttf, libpng, libjpeg, portmidi, freetype, fontconfig
-, AppKit
+{ stdenv
+, lib
+, substituteAll
+, fetchFromGitHub
+, buildPythonPackage
 , pythonOlder
+
+# build-system
+, cython_3
+, setuptools
+, pkg-config
+
+# native dependencies
+, AppKit
+, fontconfig
+, freetype
+, libjpeg
+, libpng
+, libX11
+, portmidi
+, SDL2
+, SDL2_image
+, SDL2_mixer
+, SDL2_ttf
+
+# tests
+, python
 }:
 
 buildPythonPackage rec {
   pname = "pygame";
-  version = "2.5.1";
+  version = "2.5.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
-  format = "setuptools";
-
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
@@ -19,7 +41,7 @@ buildPythonPackage rec {
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The documentation
     # has such files and will be removed.
-    hash = "sha256-0mVbjfNYTfuo8uyd7NFKlneUZMt78mcitQ5nCgPxmFs=";
+    hash = "sha256-+gRv3Rim+2aL2uhPPGfVD0QDgB013lTf6wPx8rOwgXg=";
     postFetch = "rm -rf $out/docs/reST";
   };
 
@@ -46,12 +68,22 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pkg-config SDL2
+    cython_3
+    pkg-config
+    SDL2
+    setuptools
   ];
 
   buildInputs = [
-    SDL2 SDL2_image SDL2_mixer SDL2_ttf libpng libjpeg
-    portmidi libX11 freetype
+    freetype
+    libjpeg
+    libpng
+    libX11
+    portmidi
+    SDL2
+    SDL2_image
+    SDL2_mixer
+    SDL2_ttf
   ] ++ lib.optionals stdenv.isDarwin [
     AppKit
   ];
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index 5505b1c3a83fd..50211bda64002 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pygit2";
-  version = "1.13.0";
+  version = "1.13.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bd43Q2+rFCZK09bLxarj/VVeualoCnv91uVkzXe14rg=";
+    hash = "sha256-AlfGJgEeSvuZvbIIdUQ/cG+EIB1MkmN/AiFbmOrBPe0=";
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/pygithub/default.nix b/pkgs/development/python-modules/pygithub/default.nix
index cbfacc2c4f362..1efcb940f1a4b 100644
--- a/pkgs/development/python-modules/pygithub/default.nix
+++ b/pkgs/development/python-modules/pygithub/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-ysa1RAWuFFQCF6bYwAUVFou7nxCKHLZbUtrUtXiSpPk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pyglm/default.nix b/pkgs/development/python-modules/pyglm/default.nix
index f5d0d0aa21623..17fe906a47c5f 100644
--- a/pkgs/development/python-modules/pyglm/default.nix
+++ b/pkgs/development/python-modules/pyglm/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyglm";
-  version = "2.7.1";
+  version = "2.7.1-rev1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Zuzu-Typ";
     repo = "PyGLM";
     rev = "refs/tags/${version}";
-    hash = "sha256-nCkwYZLibQcmlF1Nvv2I6qi+97ue7Q1HVxpw32G5qpo=";
+    hash = "sha256-MA/NoeKv6yxXL9A36SBqU7GNuPbCKDvxpOkWP8OmED4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/pygmars/default.nix b/pkgs/development/python-modules/pygmars/default.nix
index e186cd99d98d7..1cfa0838dac82 100644
--- a/pkgs/development/python-modules/pygmars/default.nix
+++ b/pkgs/development/python-modules/pygmars/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-PiH1lV1Vt9VTSOB+jep8FHIdk8qnauxj4nP3CIi/m7o=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     # https://github.com/nexB/pygmars/pull/9
     substituteInPlace setup.cfg \
diff --git a/pkgs/development/python-modules/pygments/default.nix b/pkgs/development/python-modules/pygments/default.nix
index f2b89cbcefd50..4be48e1c93309 100644
--- a/pkgs/development/python-modules/pygments/default.nix
+++ b/pkgs/development/python-modules/pygments/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 
 # build-system
-, setuptools
+, hatchling
 
 # tests
 , pytestCheckHook
@@ -13,17 +13,16 @@
 let pygments = buildPythonPackage
   rec {
     pname = "pygments";
-    version = "2.16.1";
-    format = "pyproject";
+    version = "2.17.2";
+    pyproject = true;
 
     src = fetchPypi {
-      pname = "Pygments";
-      inherit version;
-      hash = "sha256-Ha/wSUggxpvIlB5AeqIPV3N07og2TuEKmP2+Cuzpbik=";
+      inherit pname version;
+      hash = "sha256-2kbOyf0t5b46inhPQ05MSrZwtP9U1gXEwnF+nUnEw2c=";
     };
 
     nativeBuildInputs = [
-      setuptools
+      hatchling
     ];
 
     # circular dependencies if enabled by default
diff --git a/pkgs/development/python-modules/pygti/default.nix b/pkgs/development/python-modules/pygti/default.nix
index 6db8efa7aa310..5c7631a31c3ef 100644
--- a/pkgs/development/python-modules/pygti/default.nix
+++ b/pkgs/development/python-modules/pygti/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     aiohttp
     pytz
diff --git a/pkgs/development/python-modules/pyhamcrest/default.nix b/pkgs/development/python-modules/pyhamcrest/default.nix
index f9111d7f74081..951bd81e02e85 100644
--- a/pkgs/development/python-modules/pyhamcrest/default.nix
+++ b/pkgs/development/python-modules/pyhamcrest/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyhamcrest";
-  version = "2.0.4";
+  version = "2.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "hamcrest";
     repo = "PyHamcrest";
     rev = "refs/tags/V${version}";
-    hash = "sha256-CIkttiijbJCR0zdmwM5JvFogQKYuHUXHJhdyWonHcGk=";
+    hash = "sha256-VkfHRo4k8g9/QYG4r79fXf1NXorVdpUKUgVrbV2ELMU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyheos/default.nix b/pkgs/development/python-modules/pyheos/default.nix
index a5b58dc5cdaef..1600baba392d6 100644
--- a/pkgs/development/python-modules/pyheos/default.nix
+++ b/pkgs/development/python-modules/pyheos/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pytest-asyncio
 , pytestCheckHook
 }:
@@ -25,6 +26,10 @@ buildPythonPackage rec {
   disabledTests = [
     # accesses network
     "test_connect_timeout"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # stuck in epoll
+    "test_disconnect"
+    "test_commands_fail_when_disconnected"
   ];
 
   pythonImportsCheck = [ "pyheos" ];
diff --git a/pkgs/development/python-modules/pyhepmc/default.nix b/pkgs/development/python-modules/pyhepmc/default.nix
index 76197c47c2fdb..1019d573a46e5 100644
--- a/pkgs/development/python-modules/pyhepmc/default.nix
+++ b/pkgs/development/python-modules/pyhepmc/default.nix
@@ -44,7 +44,6 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
   CMAKE_ARGS = [ "-DEXTERNAL_PYBIND11=ON" ];
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/pyicu/default.nix b/pkgs/development/python-modules/pyicu/default.nix
index 901bec161445b..c44bfcd29974b 100644
--- a/pkgs/development/python-modules/pyicu/default.nix
+++ b/pkgs/development/python-modules/pyicu/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "pyicu";
-  version = "2.11";
+  version = "2.12";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "PyICU";
     inherit version;
-    hash = "sha256-OrUxJkz+kTKz0qxdcI2ppGSdJfbmgTcwrIjPBAoIqEQ=";
+    hash = "sha256-vXq176k61pLm2qKc0kk2TlISGDKSIXJqETyjyygchhE=";
   };
 
   nativeBuildInputs = [ icu ]; # for icu-config, but should be replaced with pkg-config
diff --git a/pkgs/development/python-modules/pyisy/default.nix b/pkgs/development/python-modules/pyisy/default.nix
index 0841559769212..13a5a9e8f9d84 100644
--- a/pkgs/development/python-modules/pyisy/default.nix
+++ b/pkgs/development/python-modules/pyisy/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-OvWdKr8RlXRnAUMHSPhJDacvKeRa8QGPmGPQWLG2ouk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace 'version_format="{tag}"' 'version="${version}"'
diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 836f3449754ac..f970605eb412a 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , cryptography
 , pytestCheckHook
 , pythonOlder
@@ -32,6 +33,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
+    setuptools
     sphinxHook
     sphinx-rtd-theme
     zope-interface
diff --git a/pkgs/development/python-modules/pykakasi/default.nix b/pkgs/development/python-modules/pykakasi/default.nix
index 385239b5ad521..76e2711ee18c2 100644
--- a/pkgs/development/python-modules/pykakasi/default.nix
+++ b/pkgs/development/python-modules/pykakasi/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-ivlenHPD00bxc0c9G368tfTEckOC3vqDB5kMQzHXbVM==";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pykdtree/default.nix b/pkgs/development/python-modules/pykdtree/default.nix
index 0ba615277e360..46e4b24ceef66 100644
--- a/pkgs/development/python-modules/pykdtree/default.nix
+++ b/pkgs/development/python-modules/pykdtree/default.nix
@@ -1,25 +1,51 @@
-{ lib, buildPythonPackage, fetchPypi, numpy, pytestCheckHook, openmp }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, cython_3
+, numpy
+, setuptools
+
+# native dependencies
+, openmp
+
+# tests
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pykdtree";
-  version = "1.3.7.post0";
-  format = "setuptools";
+  version = "1.3.10";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7KHWHTPbYh74An62ka6I25xl0ZarpLLMkMGQy5C7UI4=";
+    hash = "sha256-QefF1mnK3CGIrMS7tLC03K9JLYRRLx5lF6erLRIskR0=";
   };
 
-  buildInputs = [ openmp ];
+  nativeBuildInputs = [
+    cython_3
+    numpy
+    setuptools
+  ];
+
+  buildInputs = [
+    openmp
+  ];
 
-  propagatedBuildInputs = [ numpy ];
+  propagatedBuildInputs = [
+    numpy
+  ];
 
   preCheck = ''
     # make sure we don't import pykdtree from the source tree
     mv pykdtree tests
   '';
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "kd-tree implementation for fast nearest neighbour search in Python";
diff --git a/pkgs/development/python-modules/pylast/default.nix b/pkgs/development/python-modules/pylast/default.nix
index 54fabf00b0b87..9d4ef111f7e1a 100644
--- a/pkgs/development/python-modules/pylast/default.nix
+++ b/pkgs/development/python-modules/pylast/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-6yxsqruosSOJ5LeIBbvuEko4s9qU/ObNZiJD5YH/hvY=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/pylint-django/default.nix b/pkgs/development/python-modules/pylint-django/default.nix
index 978394e60e27a..d12e7268a24f8 100644
--- a/pkgs/development/python-modules/pylint-django/default.nix
+++ b/pkgs/development/python-modules/pylint-django/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pylint-django";
-  version = "2.5.3";
+  version = "2.5.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-5xEXjNMkOetRM9NDz0S4DsC6v39YQi34s2s+Fs56hYU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-MNgu3LvFoohXA+JzUiHIaYFw0ssEe+H5T8Ea56LcGuI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index d4a89aa000bf5..948b2afc5a15b 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -2,7 +2,6 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pythonOlder
 , astroid
 , dill
@@ -19,40 +18,24 @@
 , pytest-timeout
 , pytest-xdist
 , pytestCheckHook
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "pylint";
-  version = "2.17.5";
-  format = "pyproject";
+  version = "3.0.3";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7.2";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pylint-dev";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-cmH6Q6/XJXx8EXDIsik1Aheu9hYGvvlNvWBUCdmC3P8=";
+    repo = "pylint";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-JwSzit4oDxAqrQFlvTNF7lrirhaHbJ15MRKbl7c7bEg=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "update-setuptools.patch";
-      url = "https://github.com/pylint-dev/pylint/commit/1d029b594aa258fa01570632d001e801f9257d60.patch";
-      hash = "sha256-brQwelZVkSX9h0POH8OJeapZuWZ8p7BY/ZzhYzGbiHY=";
-    })
-    # https://github.com/pylint-dev/pylint/pull/8961
-    (fetchpatch {
-      name = "unpin-setuptools.patch";
-      url = "https://github.com/pylint-dev/pylint/commit/a0ac282d6f8df381cc04adc0a753bec66fc4db63.patch";
-      hash = "sha256-15O72LE2WQK590htNc3jghdbVoGLHUIngERDpqT8pK8=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
-    wheel
   ];
 
   propagatedBuildInputs = [
@@ -123,6 +106,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://pylint.readthedocs.io/en/stable/";
     description = "A bug and style checker for Python";
+    changelog = "https://github.com/pylint-dev/pylint/releases/tag/v${version}";
     longDescription = ''
       Pylint is a Python static code analysis tool which looks for programming errors,
       helps enforcing a coding standard, sniffs for code smells and offers simple
diff --git a/pkgs/development/python-modules/pylsp-mypy/default.nix b/pkgs/development/python-modules/pylsp-mypy/default.nix
index 3a58796331143..e93e244063414 100644
--- a/pkgs/development/python-modules/pylsp-mypy/default.nix
+++ b/pkgs/development/python-modules/pylsp-mypy/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , setuptools
 , mypy
 , pytestCheckHook
@@ -12,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pylsp-mypy";
-  version = "0.6.7";
+  version = "0.6.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,18 +20,9 @@ buildPythonPackage rec {
     owner = "python-lsp";
     repo = "pylsp-mypy";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZsNIw0xjxnU9Ue0C7TlhzVOCOCKEbCa2CsiiqeMb14I=";
+    hash = "sha256-oEWUXkE8U7/ye6puJZRSkQFi10BPGuc8XZQbHwqOPEI=";
   };
 
-  patches = [
-    # https://github.com/python-lsp/pylsp-mypy/pull/64
-    (fetchpatch {
-      name = "fix-hanging-test.patch";
-      url = "https://github.com/python-lsp/pylsp-mypy/commit/90d28edb474135007804f1e041f88713a95736f9.patch";
-      hash = "sha256-3DVyUXVImRemXCuyoXlYbPJm6p8OnhBdEKmwjx88ets=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
   ];
@@ -40,7 +30,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     mypy
     python-lsp-server
-  ] ++ lib.optionals (pythonOlder "3.11") [
     tomli
   ];
 
diff --git a/pkgs/development/python-modules/pylsqpack/default.nix b/pkgs/development/python-modules/pylsqpack/default.nix
index 54123b656e1b2..f1e595f88b472 100644
--- a/pkgs/development/python-modules/pylsqpack/default.nix
+++ b/pkgs/development/python-modules/pylsqpack/default.nix
@@ -1,19 +1,24 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pylsqpack";
-  version = "0.3.17";
-  format = "setuptools";
+  version = "0.3.18";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LyB3jblW3H5LGop5ci1XpGUMRZl/tlwTUsv4XreqPOI=";
+    hash = "sha256-Ra5V5yGHdQX01czUlZHWk1PypUioZz36+yUdOFs8CX8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pylsqpack" ];
diff --git a/pkgs/development/python-modules/pymatting/default.nix b/pkgs/development/python-modules/pymatting/default.nix
index 0d10efd616a4c..5e3b39dd523a7 100644
--- a/pkgs/development/python-modules/pymatting/default.nix
+++ b/pkgs/development/python-modules/pymatting/default.nix
@@ -10,14 +10,14 @@
 }:
 buildPythonPackage rec {
   pname = "pymatting";
-  version = "1.1.2";
+  version = "1.1.10";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pymatting";
     repo = "pymatting";
-    rev = "v${version}";
-    hash = "sha256-9eRpsWwXAkp6aw1ZWJsUFf0BMIN0UBFc2rW1lltL2cw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-wHCTqcBvVN/pTXH3iW57DPpMEsnehutRQB5NaugS6Zs=";
   };
 
   patches = [ ./01-kdtree-signature.patch ];
diff --git a/pkgs/development/python-modules/pymdown-extensions/default.nix b/pkgs/development/python-modules/pymdown-extensions/default.nix
index f6fea35270e5a..3a06e511a344f 100644
--- a/pkgs/development/python-modules/pymdown-extensions/default.nix
+++ b/pkgs/development/python-modules/pymdown-extensions/default.nix
@@ -44,14 +44,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pymdown-extensions";
-  version = "10.3";
+  version = "10.5";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = "pymdown-extensions";
     rev = "refs/tags/${version}";
-    hash = "sha256-R35R2dHfjcVQbEa2319FEMjPGl1Y5/u2KEHeR0wTYEo=";
+    hash = "sha256-S9xnGzX9VHRWDfrlIVcywiyuyyxIFYitwTMdGZ2NEqo=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index b1605fac01b5a..f62b039bbb45b 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pymilvus";
-  version = "2.3.0";
+  version = "2.3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,11 +28,9 @@ buildPythonPackage rec {
     owner = "milvus-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-hp00iUT1atyTQk532z7VAajpfvtnKE8W2la9MW7NxoE=";
+    hash = "sha256-qnm6JaeF2Li2NgVGZ6yJ2yz1n3pVZqkF4Ee+q4v/kdA=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "grpcio"
   ];
diff --git a/pkgs/development/python-modules/pymongo/default.nix b/pkgs/development/python-modules/pymongo/default.nix
index bb6196f775a23..6d69cc3556c49 100644
--- a/pkgs/development/python-modules/pymongo/default.nix
+++ b/pkgs/development/python-modules/pymongo/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pymongo";
-  version = "4.5.0";
+  version = "4.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aB8lLkOz7wVMqRYWNfgbcw9NjK3Siz8rIAT1py+FOYI=";
+    hash = "sha256-Mdqx8+HQzdV+jfAbZF9S1DzBtlPtOv1TXSiR9PxPlxI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index 1c21e6b90c1a4..fb9603c18d5fb 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -3,10 +3,15 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, pytestCheckHook
 , python
+
+# build-system
+, libclang
+, psutil
+, setuptools
 , swig
-, mupdf
+
+# native dependencies
 , freetype
 , harfbuzz
 , openjpeg
@@ -14,7 +19,13 @@
 , libjpeg_turbo
 , gumbo
 , memstreamHook
+
+# dependencies
+, mupdf
+
+# tests
 , fonttools
+, pytestCheckHook
 }:
 
 let
@@ -22,21 +33,31 @@ let
   mupdf-cxx = mupdf.override { enableOcr = true; enableCxx = true; enablePython = true; python3 = python; };
 in buildPythonPackage rec {
   pname = "pymupdf";
-  version = "1.23.6";
-  format = "setuptools";
+  version = "1.23.7";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pymupdf";
     repo = "PyMuPDF";
-    rev = version;
-    hash = "sha256-60KT5+EGP+s7HD4UIeaf9x2QVNU9IUbC5WKEJbrIBCI=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-XVf9nKbcTS/rxRCD2u5u8ecCf0bWZ3FXXN/YulI9etU=";
   };
 
+  # swig is not wrapped as python package
+  # libclang calls itself just clang in wheel metadata
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"swig",' "" \
+      --replace "libclang" "clang"
+  '';
+
   nativeBuildInputs = [
-    pytestCheckHook
+    libclang
     swig
+    psutil
+    setuptools
   ];
 
   buildInputs = [
@@ -69,13 +90,16 @@ in buildPythonPackage rec {
     done
   '';
 
-  checkInputs = [
+  nativeCheckInputs = [
+    pytestCheckHook
     fonttools
   ];
 
   disabledTests = [
     # fails for indeterminate reasons
     "test_color_count"
+    "test_2753"
+    "test_2548"
   ] ++ lib.optionals stdenv.isDarwin [
     # darwin does not support OCR right now
     "test_tesseract"
diff --git a/pkgs/development/python-modules/pynetbox/default.nix b/pkgs/development/python-modules/pynetbox/default.nix
index 2759ff5066437..0a08f4affa595 100644
--- a/pkgs/development/python-modules/pynetbox/default.nix
+++ b/pkgs/development/python-modules/pynetbox/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-QIvh24ZqnF8uF9HOuY0yt3QT/jHgJ2C916d+rBqezWQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pyngo/default.nix b/pkgs/development/python-modules/pyngo/default.nix
index 81bddae490d3a..3616d5eaec6bb 100644
--- a/pkgs/development/python-modules/pyngo/default.nix
+++ b/pkgs/development/python-modules/pyngo/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+, pythonRelaxDepsHook
 
 # build-system
 , hatchling
@@ -18,18 +20,25 @@
 
 buildPythonPackage rec {
   pname = "pyngo";
-  version = "1.7.0";
+  version = "2.0.0";
   pyproject = true;
 
+  disabled = pythonOlder "3.10";
+
   src = fetchFromGitHub {
     owner = "yezz123";
     repo = "pyngo";
     rev = "refs/tags/${version}";
-    hash = "sha256-cMWYmCbkhJmz+RMCh3NIhOkC5bX46nwz09WhTV+Mz6w=";
+    hash = "sha256-jHPZjS/J1VLpsLN2wg5UJCgavoSEs4Uogo4GI6bZMuY=";
   };
 
   nativeBuildInputs = [
     hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "pydantic"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index 5763fa91f24a0..04f474a8aed52 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -2,13 +2,14 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, setuptools
 , pyyaml
 }:
 
 buildPythonPackage rec {
   pname = "pyngrok";
   version = "7.0.5";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -17,6 +18,10 @@ buildPythonPackage rec {
     hash = "sha256-YTe9n5cZLYQ9ghTOF8MHg/1d8iRElPHNnAQj0pnEjR4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyyaml
   ];
diff --git a/pkgs/development/python-modules/pynisher/default.nix b/pkgs/development/python-modules/pynisher/default.nix
index 6c7f1c0f59a2f..34a6f158f1217 100644
--- a/pkgs/development/python-modules/pynisher/default.nix
+++ b/pkgs/development/python-modules/pynisher/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pynisher";
-  version = "1.0.9";
+  version = "1.0.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hlN5uUlgmcipQqmr22rB245oEXOUe5WB9jWo7MXXViE=";
+    hash = "sha256-JyK3ldIhKd3VJHA4u6cnrgbs2zpZQgcIF758jUpoDjE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pynndescent/default.nix b/pkgs/development/python-modules/pynndescent/default.nix
index fb796ab6c331b..9817ba9935d9b 100644
--- a/pkgs/development/python-modules/pynndescent/default.nix
+++ b/pkgs/development/python-modules/pynndescent/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pynndescent";
-  version = "0.5.10";
+  version = "0.5.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XV3Gg8A+9V/j3faThZcgyhj4XG5uW7C08UhwJ41SiK0=";
+    hash = "sha256-b0TO2dWp2iyH2bL/8wu1MIVAwGV2BeTVzeftMnW7rVA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pyocr/default.nix b/pkgs/development/python-modules/pyocr/default.nix
index 8dc1ee0f8780a..407166e98c901 100644
--- a/pkgs/development/python-modules/pyocr/default.nix
+++ b/pkgs/development/python-modules/pyocr/default.nix
@@ -34,8 +34,6 @@ buildPythonPackage rec {
     })
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [ pillow ];
 
   nativeBuildInputs = [ setuptools setuptools-scm ];
diff --git a/pkgs/development/python-modules/pyodbc/default.nix b/pkgs/development/python-modules/pyodbc/default.nix
index d8cf1f260da2e..b20d4618167db 100644
--- a/pkgs/development/python-modules/pyodbc/default.nix
+++ b/pkgs/development/python-modules/pyodbc/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyodbc";
-  version = "4.0.39";
+  version = "5.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7" || isPyPy; # use pypypdbc instead
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5Si7cN1tYpnuQphokl3whm4+kZx3K57/ecjheSDY8RY=";
+    hash = "sha256-A9fQsE1akVYJnOjQPpLzlWeDdG+pI0629bXPwStkUBE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index 428bd4084ae0b..10333862bb8db 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "pyopengl";
-  version = "3.1.6";
+  version = "3.1.7";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "PyOpenGL";
     inherit version;
-    hash = "sha256-jqbIdzkn7adAW//G9buTvoFWmnsFyMrFDNlOlp3OXic=";
+    hash = "sha256-7vMaOIjmmE/U2ObJlhsYTJgTyoJgTTf+PagOsACnbIY=";
   };
 
   propagatedBuildInputs = [ pillow ];
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index bc841cc2fd4e0..611666e851d3a 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "23.2.0";
+  version = "23.3.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "pyOpenSSL";
     inherit version;
-    hash = "sha256-J2+TH1WkUufeppxxc+mE6ypEB85BPJGKo0tV+C+bi6w=";
+    hash = "sha256-ayy6XMRugidQ7D5age4SgZhQsRMDYw1XXpgQigecKxI=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/pyopenuv/default.nix b/pkgs/development/python-modules/pyopenuv/default.nix
index 37ec8b60f0f37..db03bb04b422a 100644
--- a/pkgs/development/python-modules/pyopenuv/default.nix
+++ b/pkgs/development/python-modules/pyopenuv/default.nix
@@ -3,6 +3,7 @@
 , aresponses
 , backoff
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
 , poetry-core
 , pytest-aiohttp
@@ -32,6 +33,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     aiohttp
     backoff
+    certifi
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/pyosmium/default.nix b/pkgs/development/python-modules/pyosmium/default.nix
index 40090532fea1b..d35b5d7241b6e 100644
--- a/pkgs/development/python-modules/pyosmium/default.nix
+++ b/pkgs/development/python-modules/pyosmium/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "pyosmium";
-  version = "3.6.0";
+  version = "3.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6" || isPyPy;
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "osmcode";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+YJQGPQm2FGOPhNzlXX2GM+ad4QdipJhwViOKGHtqBk=";
+    hash = "sha256-DBFDAKNrD93MRXjoM8dIJQ/HJ9Aj8oMJuPVQxTrKYfI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
index e621a80d7acd5..9fbf388e7d2dd 100644
--- a/pkgs/development/python-modules/pyparsing/default.nix
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyparsing";
-  version = "3.0.9";
+  version = "3.1.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pyparsing";
     repo = pname;
-    rev = "pyparsing_${version}";
-    hash = "sha256-aCRyJQyLf8qQ6NO41q+HC856TjIHzIt0vyVBLV+3teE=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-54XMw5ahMZH4cevTFg2GXhgSu0QX1mfITWFezWirt1E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
index 0cfb41097c4f2..5ff98d82eb3c1 100644
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -89,6 +89,8 @@ buildPythonPackage rec {
   disabledTests = [
     # requires fpdf2 which we don't package yet
     "test_compression"
+    # infinite recursion when including fpdf2
+    "test_merging_many_temporary_files"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyproject-api/default.nix b/pkgs/development/python-modules/pyproject-api/default.nix
index 4ba62fc1e3101..efcc356320152 100644
--- a/pkgs/development/python-modules/pyproject-api/default.nix
+++ b/pkgs/development/python-modules/pyproject-api/default.nix
@@ -44,8 +44,6 @@ buildPythonPackage rec {
     "doc"
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/pypytools/default.nix b/pkgs/development/python-modules/pypytools/default.nix
index ecc86e4fe2f89..870768dc81129 100644
--- a/pkgs/development/python-modules/pypytools/default.nix
+++ b/pkgs/development/python-modules/pypytools/default.nix
@@ -2,18 +2,20 @@
 , buildPythonPackage
 , fetchpatch
 , fetchPypi
+, attrs
 , freezegun
 , numpy
 , py
 , pytestCheckHook
 , pythonAtLeast
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pypytools";
   version = "0.6.2";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,7 +24,13 @@ buildPythonPackage rec {
     hash = "sha256-oUDAU+TRwLroNfQGYusAQKdRkHcazysqiDLfp77v5Sk=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
+    # attrs is an implicit dependency
+    attrs
     py
   ];
 
diff --git a/pkgs/development/python-modules/pyqt-builder/default.nix b/pkgs/development/python-modules/pyqt-builder/default.nix
index ad1ed8e170381..1bf96713a4fe5 100644
--- a/pkgs/development/python-modules/pyqt-builder/default.nix
+++ b/pkgs/development/python-modules/pyqt-builder/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "pyqt-builder";
-  version = "1.15.3";
+  version = "1.15.4";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "PyQt-builder";
     inherit version;
-    hash = "sha256-WzPpnty3fUpjo4YF9EV6BM/04lTHce1SnryViZBszbE=";
+    hash = "sha256-OfjHXbF9nOF8trvz3xZQtc68HqTlvXOEPSHMlmErKuE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyqt/sip.nix b/pkgs/development/python-modules/pyqt/sip.nix
index ea8a518afd0db..3702bad5cac7a 100644
--- a/pkgs/development/python-modules/pyqt/sip.nix
+++ b/pkgs/development/python-modules/pyqt/sip.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "pyqt5-sip";
-  version = "12.11.0";
+  version = "12.13.0";
 
   src = fetchPypi {
     pname = "PyQt5_sip";
     inherit version;
-    hash = "sha256-tHEP2FtX7e9xbMVfrkW/1b+sb8e6kQNvHcw/Mxyg6zk=";
+    hash = "sha256-fzIdr4S5ydvKYbgOHvN72v/A6TMS7a4s19oluVOXHZE=";
   };
 
   # There is no test code and the check phase fails with:
diff --git a/pkgs/development/python-modules/pyquery/default.nix b/pkgs/development/python-modules/pyquery/default.nix
index 699bcd0fbc592..f1de975c418bf 100644
--- a/pkgs/development/python-modules/pyquery/default.nix
+++ b/pkgs/development/python-modules/pyquery/default.nix
@@ -4,6 +4,7 @@
 , fetchPypi
 , lxml
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , requests
 , webob
@@ -52,6 +53,11 @@ buildPythonPackage rec {
     "--deselect=tests/test_pyquery.py::TestWebScrappingEncoding::test_get"
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/gawel/pyquery/issues/249
+    "pyquery.pyquery.PyQuery.serialize_dict"
+  ];
+
   meta = with lib; {
     description = "A jquery-like library for Python";
     homepage = "https://github.com/gawel/pyquery";
diff --git a/pkgs/development/python-modules/pyquil/default.nix b/pkgs/development/python-modules/pyquil/default.nix
index c822014dd843f..f980365202dd8 100644
--- a/pkgs/development/python-modules/pyquil/default.nix
+++ b/pkgs/development/python-modules/pyquil/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "pyquil";
-  version = "3.5.4";
+  version = "4.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "rigetti";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-GQ7vzuUu0PCeLkqKWUSNJyJ01wseOwNL2jJaVTNGF9s=";
+    hash = "sha256-LLhTK/wE42mBTrqjBbnkPvqSG8gP7Vx/3ip66hKHxXc=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pyregion/default.nix b/pkgs/development/python-modules/pyregion/default.nix
index 6f1affd9063ee..4d875032ef94c 100644
--- a/pkgs/development/python-modules/pyregion/default.nix
+++ b/pkgs/development/python-modules/pyregion/default.nix
@@ -32,9 +32,7 @@ buildPythonPackage rec {
     hash = "sha256-r2STKnZwNvonXATrQ5q9NVD9QftlWI1RWl4F+GZSxVg=";
   };
 
-  env = {
-    SETUPTOOLS_SCM_PRETEND_VERSION = version;
-  } // lib.optionalAttrs stdenv.cc.isClang {
+  env = lib.optionalAttrs stdenv.cc.isClang {
     # Try to remove on next update.  generated code returns a NULL in a
     # function where an int is expected.
     NIX_CFLAGS_COMPILE = "-Wno-error=int-conversion";
diff --git a/pkgs/development/python-modules/pyrfc3339/default.nix b/pkgs/development/python-modules/pyrfc3339/default.nix
index 9885d4f5443fa..9345b819f75cc 100644
--- a/pkgs/development/python-modules/pyrfc3339/default.nix
+++ b/pkgs/development/python-modules/pyrfc3339/default.nix
@@ -1,21 +1,41 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
 , pytz
+
+# tests
 , nose
 }:
 
 buildPythonPackage rec {
   pname = "pyRFC3339";
   version = "1.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "06jv7ar7lpvvk0dixzwdr3wgm0g1lipxs429s2z7knwwa7hwpf41";
   };
 
-  propagatedBuildInputs = [ pytz ];
-  buildInputs = [ nose ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    pytz
+  ];
+
+  doCheck = pythonOlder "3.12";
+
+  nativeCheckInputs = [
+    nose
+  ];
 
   meta = with lib; {
     description = "Generate and parse RFC 3339 timestamps";
diff --git a/pkgs/development/python-modules/pyrmvtransport/default.nix b/pkgs/development/python-modules/pyrmvtransport/default.nix
index 888ad2f43ceb0..60415585b1cdf 100644
--- a/pkgs/development/python-modules/pyrmvtransport/default.nix
+++ b/pkgs/development/python-modules/pyrmvtransport/default.nix
@@ -42,6 +42,11 @@ buildPythonPackage rec {
     pytest-httpx
   ];
 
+  disabledTests = [
+    # should fail, but times out
+    "test__query_rmv_api_fail"
+  ];
+
   patches = [
     # Can be removed with next release, https://github.com/cgtobi/PyRMVtransport/pull/55
     (fetchpatch {
diff --git a/pkgs/development/python-modules/pyroma/default.nix b/pkgs/development/python-modules/pyroma/default.nix
index b9669e41d3b22..99fb8bec5f095 100644
--- a/pkgs/development/python-modules/pyroma/default.nix
+++ b/pkgs/development/python-modules/pyroma/default.nix
@@ -1,37 +1,59 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
+
+# build-system
+, setuptools
+
+# dependencies
+, build
 , docutils
-, python
+, flit-core
+, packaging
 , pygments
-, setuptools
 , requests
+, trove-classifiers
+
+# test
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pyroma";
-  version = "3.2";
-  format = "setuptools";
+  version = "4.2";
+  pyproject = true;
+
+  # https://github.com/regebro/pyroma/issues/104
+  disabled = pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "regebro";
-    repo = pname;
+    repo = "pyroma";
     rev = version;
-    sha256 = "0ln9w984n48nyxwzd1y48l6b18lnv52radcyizaw56lapcgxrzdr";
+    sha256 = "sha256-ElSw+bY6fbHJPTX7O/9JZ4drttfbUQsU/fv3Cqqb/J4=";
   };
 
   propagatedBuildInputs = [
+    build
     docutils
+    flit-core
+    packaging
     pygments
     setuptools
     requests
+    trove-classifiers
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  # https://github.com/regebro/pyroma/blob/3.2/Makefile#L23
-  # PyPITest requires network access
-  checkPhase = ''
-    ${python.interpreter} -m unittest -k 'not PyPITest' pyroma.tests
-  '';
+  disabledTests = [
+    # tries to reach pypi
+    "test_complete"
+    "test_distribute"
+  ];
 
   pythonImportsCheck = [ "pyroma" ];
 
diff --git a/pkgs/development/python-modules/pyrsistent/default.nix b/pkgs/development/python-modules/pyrsistent/default.nix
index 2f21caa001d39..fae4bba430d36 100644
--- a/pkgs/development/python-modules/pyrsistent/default.nix
+++ b/pkgs/development/python-modules/pyrsistent/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
+, setuptools
 , six
 , pytestCheckHook
 , hypothesis
@@ -9,26 +10,24 @@
 
 buildPythonPackage rec {
   pname = "pyrsistent";
-  version = "0.19.3";
-  format = "setuptools";
+  version = "0.20.0";
+  pyproject = true;
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GimUdzcGu7SZXDGpe8lPFBgxSSO9EEjG2WSDcEA3ZEA=";
+    hash = "sha256-TEj3j2KrWWxnkIYITQ3RMlSuTz1scqg//fXr3vjyZaQ=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ six ];
 
   nativeCheckInputs = [ pytestCheckHook hypothesis ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'pytest<5' 'pytest' \
-      --replace 'hypothesis<5' 'hypothesis'
-  '';
-
   pythonImportsCheck = [ "pyrsistent" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pysam/default.nix b/pkgs/development/python-modules/pysam/default.nix
index 50661d9246919..d2887eda58474 100644
--- a/pkgs/development/python-modules/pysam/default.nix
+++ b/pkgs/development/python-modules/pysam/default.nix
@@ -4,19 +4,20 @@
 , bzip2
 , bcftools
 , curl
-, cython
+, cython_3
 , htslib
 , libdeflate
 , xz
 , pytestCheckHook
+, setuptools
 , samtools
 , zlib
 }:
 
 buildPythonPackage rec {
   pname   = "pysam";
-  version = "0.21.0";
-  format = "setuptools";
+  version = "0.22.0";
+  pyproject = true;
 
   # Fetching from GitHub instead of PyPi cause the 0.13 src release on PyPi is
   # missing some files which cause test failures.
@@ -25,10 +26,14 @@ buildPythonPackage rec {
     owner = "pysam-developers";
     repo = "pysam";
     rev = "refs/tags/v${version}";
-    hash = "sha256-C4/AJwcUyLoUEUEnsATLHJb5F8mltP8X2XfktYu0OTo=";
+    hash = "sha256-TLqZF5NS9ROH8z7c2ZxfOYNRIe5pabMNBuhQ4azFmDU=";
   };
 
-  nativeBuildInputs = [ samtools ];
+  nativeBuildInputs = [
+    cython_3
+    samtools
+    setuptools
+  ];
 
   buildInputs = [
     bzip2
@@ -38,8 +43,6 @@ buildPythonPackage rec {
     zlib
   ];
 
-  propagatedBuildInputs = [ cython ];
-
   # Use nixpkgs' htslib instead of the bundled one
   # See https://pysam.readthedocs.io/en/latest/installation.html#external
   # NOTE that htslib should be version compatible with pysam
@@ -73,6 +76,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "A python module for reading, manipulating and writing genome data sets";
+    downloadPage = "https://github.com/pysam-developers/pysam";
     homepage = "https://pysam.readthedocs.io/";
     maintainers = with maintainers; [ unode ];
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/pyschlage/default.nix b/pkgs/development/python-modules/pyschlage/default.nix
index 5007426971636..5344a06bdb8e4 100644
--- a/pkgs/development/python-modules/pyschlage/default.nix
+++ b/pkgs/development/python-modules/pyschlage/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-RWM/76uqljWgKBWsMvGTggJllX0Qa9QaMM0hJbCvZgQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pysmart/default.nix b/pkgs/development/python-modules/pysmart/default.nix
index 3edc3b57cc4de..42854750bbbbf 100644
--- a/pkgs/development/python-modules/pysmart/default.nix
+++ b/pkgs/development/python-modules/pysmart/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-1k+5XnIT/AfZmzKUxkyU/uc0eW05CvugpY6OdJCoALc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pySMART/utils.py \
       --replace "which('smartctl')" '"${smartmontools}/bin/smartctl"'
diff --git a/pkgs/development/python-modules/pysml/default.nix b/pkgs/development/python-modules/pysml/default.nix
index 58381f99db3e8..cfdfc1b476297 100644
--- a/pkgs/development/python-modules/pysml/default.nix
+++ b/pkgs/development/python-modules/pysml/default.nix
@@ -1,4 +1,5 @@
 { lib
+, aiohttp
 , async-timeout
 , bitstring
 , buildPythonPackage
@@ -27,6 +28,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    aiohttp
     async-timeout
     bitstring
     pyserial-asyncio
diff --git a/pkgs/development/python-modules/pysolcast/default.nix b/pkgs/development/python-modules/pysolcast/default.nix
index f4121a53e7948..5e740e78e6a87 100644
--- a/pkgs/development/python-modules/pysolcast/default.nix
+++ b/pkgs/development/python-modules/pysolcast/default.nix
@@ -1,4 +1,5 @@
 { lib
+, anyconfig
 , buildPythonPackage
 , fetchFromGitHub
 , isodate
@@ -29,6 +30,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    anyconfig
     isodate
     pyyaml
     requests
diff --git a/pkgs/development/python-modules/pyspnego/default.nix b/pkgs/development/python-modules/pyspnego/default.nix
index 650af9af50a6b..ae1d4f2d1beb7 100644
--- a/pkgs/development/python-modules/pyspnego/default.nix
+++ b/pkgs/development/python-modules/pyspnego/default.nix
@@ -8,13 +8,14 @@
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , glibcLocales
 }:
 
 buildPythonPackage rec {
   pname = "pyspnego";
-  version = "0.9.2";
-  format = "setuptools";
+  version = "0.10.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,14 +23,29 @@ buildPythonPackage rec {
     owner = "jborean93";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-A0vVpEI8TKelZ96dIqSc01SX1gU3pDUVSOV6jap2WtU=";
+    hash = "sha256-60aIRrhRynbuuFZzzBhJTlmU74CWuao8jWhr126cPrc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     cryptography
-    gssapi
-    krb5
-    ruamel-yaml
+  ];
+
+  passthru.optional-dependencies = {
+    kerberos = [
+      gssapi
+      krb5
+    ];
+    yaml = [
+      ruamel-yaml
+    ];
+  };
+
+  pythonImportsCheck = [
+    "spnego"
   ];
 
   nativeCheckInputs = [
@@ -38,16 +54,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # struct.error: unpack requires a buffer of 1 bytes
-    "test_credssp_invalid_client_authentication"
-  ];
-
-  LC_ALL = "en_US.UTF-8";
-
-  pythonImportsCheck = [ "spnego" ];
+  env.LC_ALL = "en_US.UTF-8";
 
   meta = with lib; {
+    changelog = "https://github.com/jborean93/pyspnego/blob/v${version}/CHANGELOG.md";
     description = "Python SPNEGO authentication library";
     homepage = "https://github.com/jborean93/pyspnego";
     license = with licenses; [ mit ];
diff --git a/pkgs/development/python-modules/pystardict/default.nix b/pkgs/development/python-modules/pystardict/default.nix
index 4e5cbd64e4b62..c36dac0e7ae2e 100644
--- a/pkgs/development/python-modules/pystardict/default.nix
+++ b/pkgs/development/python-modules/pystardict/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-YrZpIhyxfA3G7rP0SJ+EvzGwAXlne80AYilkj6cIDnA=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [ six ];
 
   nativeBuildInputs = [ setuptools setuptools-scm ];
diff --git a/pkgs/development/python-modules/pysuez/default.nix b/pkgs/development/python-modules/pysuez/default.nix
index 34f6de519266a..a8f8774256b7f 100644
--- a/pkgs/development/python-modules/pysuez/default.nix
+++ b/pkgs/development/python-modules/pysuez/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
+, regex
 , requests
 , pythonOlder
 }:
@@ -20,11 +21,17 @@ buildPythonPackage rec {
     hash = "sha256-Xgd0E/oFO2yyytBjuwr1vDJfKWC0Iw8P6GStCuCni/g=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace ", 'datetime'" ""
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
 
   propagatedBuildInputs = [
+    regex
     requests
   ];
 
diff --git a/pkgs/development/python-modules/pytautulli/default.nix b/pkgs/development/python-modules/pytautulli/default.nix
index 5d2c51675c43b..ae39788541e22 100644
--- a/pkgs/development/python-modules/pytautulli/default.nix
+++ b/pkgs/development/python-modules/pytautulli/default.nix
@@ -27,6 +27,10 @@ buildPythonPackage rec {
     # are not in their focus
     substituteInPlace setup.py \
       --replace 'version="main",' 'version="${version}",'
+
+    # yarl 1.9.4 requires ports to be ints
+    substituteInPlace pytautulli/models/host_configuration.py \
+      --replace "str(self.port)" "int(self.port)"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-aiohttp/default.nix b/pkgs/development/python-modules/pytest-aiohttp/default.nix
index 9cd6ec0491a92..85dd9b7bf5375 100644
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     pytest
   ];
diff --git a/pkgs/development/python-modules/pytest-ansible/default.nix b/pkgs/development/python-modules/pytest-ansible/default.nix
index 3b1def125e0f0..1a83d0ed064f2 100644
--- a/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/pkgs/development/python-modules/pytest-ansible/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
       --replace '/usr/bin/env' '${coreutils}/bin/env'
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pytest-arraydiff/default.nix b/pkgs/development/python-modules/pytest-arraydiff/default.nix
index 7984a390a6883..2fc73552d5495 100644
--- a/pkgs/development/python-modules/pytest-arraydiff/default.nix
+++ b/pkgs/development/python-modules/pytest-arraydiff/default.nix
@@ -9,18 +9,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-arraydiff";
-  version = "0.5.0";
+  version = "0.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "714149beffd0dfa085477c65791c1139b619602b049536353ce1a91397fb3bd2";
+    sha256 = "sha256-KTexRQ/JNWIPJHCdh9QMZ+BVoEPXuFQaJf36mU3aZ94=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-astropy/default.nix b/pkgs/development/python-modules/pytest-astropy/default.nix
index 40fb270b199a5..33ffb661d73ed 100644
--- a/pkgs/development/python-modules/pytest-astropy/default.nix
+++ b/pkgs/development/python-modules/pytest-astropy/default.nix
@@ -12,22 +12,25 @@
 , pytest-mock
 , pytest-openfiles
 , pytest-remotedata
+, setuptools
 , setuptools-scm
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pytest-astropy";
-  version = "0.10.0";
-  format = "setuptools";
+  version = "0.11.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hePGbO7eTOZo9HOzzzd/yyqjxI4k8oqqN3roYATM4hE=";
+    hash = "sha256-Tq6qme2RFj7Y+arBMscKgfJbxMEvPNVNujKfwmxnObU=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/pytest-asyncio/default.nix b/pkgs/development/python-modules/pytest-asyncio/default.nix
index 96179595a9aed..e373e5b1f6544 100644
--- a/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -2,17 +2,14 @@
 , buildPythonPackage
 , callPackage
 , fetchFromGitHub
-, flaky
-, hypothesis
 , pytest
-, pytestCheckHook
 , pythonOlder
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "0.21.1";
+  version = "0.21.1"; # N.B.: when updating, tests bleak and aioesphomeapi tests
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -29,8 +26,6 @@ buildPythonPackage rec {
     "testout"
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-cases/default.nix b/pkgs/development/python-modules/pytest-cases/default.nix
index c1813c6994c4e..bbc67a2788559 100644
--- a/pkgs/development/python-modules/pytest-cases/default.nix
+++ b/pkgs/development/python-modules/pytest-cases/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-cases";
-  version = "3.6.14";
-  format = "setuptools";
+  version = "3.8.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dFXmylelRMG/3YtWrOCMHBzkxlcqiquPG9NR3CWhC2s=";
+    hash = "sha256-Sdf2+K1TTlpuc/uPX9OJhmBvF7Ru5V9+vuB6VcZ3ygE=";
   };
 
   nativeBuildInputs = [
@@ -33,11 +33,6 @@ buildPythonPackage rec {
     makefun
   ];
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "pytest-runner" ""
-  '';
-
   # Tests have dependencies (pytest-harvest, pytest-steps) which
   # are not available in Nixpkgs. Most of the packages (decopatch,
   # makefun, pytest-*) have circular dependencies.
diff --git a/pkgs/development/python-modules/pytest-console-scripts/default.nix b/pkgs/development/python-modules/pytest-console-scripts/default.nix
index 5170a7a902acd..81b31c256cfdf 100644
--- a/pkgs/development/python-modules/pytest-console-scripts/default.nix
+++ b/pkgs/development/python-modules/pytest-console-scripts/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-WoJu2EzAr6IC655EOB19di973ajgwj+feafx9Ez0qJU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-datadir/default.nix b/pkgs/development/python-modules/pytest-datadir/default.nix
index 90b7e6f55e2b8..4adaee73ceaee 100644
--- a/pkgs/development/python-modules/pytest-datadir/default.nix
+++ b/pkgs/development/python-modules/pytest-datadir/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-sRLqL+8Jf5Kz+qscuG3hClUuPA+33PQa+ob1ht/7CJE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pytest-django/default.nix b/pkgs/development/python-modules/pytest-django/default.nix
index 048bd9d483380..a9c8743badf85 100644
--- a/pkgs/development/python-modules/pytest-django/default.nix
+++ b/pkgs/development/python-modules/pytest-django/default.nix
@@ -1,29 +1,55 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytest
 , django
+, setuptools
 , setuptools-scm
 , django-configurations
+, pytest
+, pytestCheckHook
 , pytest-xdist
-, six
 }:
 buildPythonPackage rec {
   pname = "pytest-django";
-  version = "4.5.2";
-  format = "setuptools";
+  version = "4.7.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d9076f759bb7c36939dbdd5ae6633c18edfc2902d1a69fdbefd2426b970ce6c2";
+    hash = "sha256-ktb9RrHXm1T7awYLuzlCgHM5bOxxfV8uEiqZDUtqpeg=";
   };
 
-  nativeBuildInputs = [ pytest setuptools-scm ];
-  nativeCheckInputs = [ pytest django-configurations pytest-xdist six ];
-  propagatedBuildInputs = [ django ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  buildInputs = [
+    pytest
+  ];
+
+  propagatedBuildInputs = [
+    django
+  ];
+
+  nativeCheckInputs = [
+    django-configurations
+    pytestCheckHook
+    pytest-xdist
+  ];
+
+  preCheck = ''
+    # bring pytest_django_test module into PYTHONPATH
+    export PYTHONPATH="$(pwd):$PYTHONPATH"
+
+    # test the lightweight sqlite flavor
+    export DJANGO_SETTINGS_MODULE="pytest_django_test.settings_sqlite"
+  '';
 
-  # Complicated. Requires Django setup.
-  doCheck = false;
+  disabledTests = [
+    # AttributeError: type object 'TestLiveServer' has no attribute '_test_settings_before_run'
+    "test_settings_restored"
+  ];
 
   meta = with lib; {
     description = "py.test plugin for testing of Django applications";
diff --git a/pkgs/development/python-modules/pytest-env/default.nix b/pkgs/development/python-modules/pytest-env/default.nix
index 92ed531c6fbf6..c5589f1cccd4b 100644
--- a/pkgs/development/python-modules/pytest-env/default.nix
+++ b/pkgs/development/python-modules/pytest-env/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "pytest-env";
-  version = "1.0.1";
+  version = "1.1.3";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "pytest_env";
     inherit version;
-    hash = "sha256-YD/iFujgOl0TSYnLQTF8Waq+8BPSJQxxuGSrB5j75vY=";
+    hash = "sha256-/NfcI7tx79PTVjK94bvl7oyNxEidZhf7AQZ0iA2WIWs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-forked/default.nix b/pkgs/development/python-modules/pytest-forked/default.nix
index e4727abadb7c4..2aa92cc3e21f6 100644
--- a/pkgs/development/python-modules/pytest-forked/default.nix
+++ b/pkgs/development/python-modules/pytest-forked/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     pytest
   ];
diff --git a/pkgs/development/python-modules/pytest-html/default.nix b/pkgs/development/python-modules/pytest-html/default.nix
index 3375a7a0a0bd4..6d4233e043b17 100644
--- a/pkgs/development/python-modules/pytest-html/default.nix
+++ b/pkgs/development/python-modules/pytest-html/default.nix
@@ -11,12 +11,12 @@
 }:
 let
   pname = "pytest-html";
-  version = "4.0.2";
+  version = "4.1.1";
 
   src = fetchPypi {
     pname = "pytest_html";
     inherit version;
-    hash = "sha256-iGgrno5ROSRyVGpwohObJ9a8GDSkr9PkHaM8nZ+R5KQ=";
+    hash = "sha256-cKAeiuWAD0oHS1akyxAlyPT5sDi7pf4x48mOuZZobwc=";
   };
 
   web-assets = buildNpmPackage {
diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index 01ef1025904e6..2c825897edb10 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-httpserver";
-  version = "1.0.7";
+  version = "1.0.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "csernazs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-bjysG+7niSUBl8YMWR8pr7oOz9GDbSfq3PeloYBkq3s=";
+    hash = "sha256-hbhS1kL5VNiGjvnYkDI1LwgkqqfBMqgcao3zy716q+A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-httpx/default.nix b/pkgs/development/python-modules/pytest-httpx/default.nix
index dbcfafc0a5fed..186c81a93c602 100644
--- a/pkgs/development/python-modules/pytest-httpx/default.nix
+++ b/pkgs/development/python-modules/pytest-httpx/default.nix
@@ -7,24 +7,26 @@
 , pytestCheckHook
 , pythonOlder
 , pythonRelaxDepsHook
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pytest-httpx";
-  version = "0.25.0";
-  format = "setuptools";
+  version = "0.27.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Colin-b";
     repo = "pytest_httpx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8cuXsHyS9OaYXzKXgwan+mBFocyr39B9G8wr8I1pmg4=";
+    hash = "sha256-5CDmIjehW9/aBxoFVbo8W2fAwgIrPPxEqHQjxsTPlpY=";
   };
 
   nativeBuildInputs = [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-localserver/default.nix b/pkgs/development/python-modules/pytest-localserver/default.nix
index 4ab9c74be35e7..d550b4b274693 100644
--- a/pkgs/development/python-modules/pytest-localserver/default.nix
+++ b/pkgs/development/python-modules/pytest-localserver/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-localserver";
-  version = "0.8.0";
+  version = "0.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XZDOfQhddB51n6hU29LnxbVXMh1pUXmJTrQOIQ6i/zA=";
+    hash = "sha256-ZlacNP7zGldQsW7/0c0SiKepC1kVXQBef5FqzNPe5PE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-logdog/default.nix b/pkgs/development/python-modules/pytest-logdog/default.nix
index f9bd63d8ee66a..176bde51525b3 100644
--- a/pkgs/development/python-modules/pytest-logdog/default.nix
+++ b/pkgs/development/python-modules/pytest-logdog/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-Tmoq+KAGzn0MMj29rukDfAc4LSIwC8DoMTuBAppV32I=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-mock/default.nix b/pkgs/development/python-modules/pytest-mock/default.nix
index 260c71ac71ff5..f956a62e1a5a0 100644
--- a/pkgs/development/python-modules/pytest-mock/default.nix
+++ b/pkgs/development/python-modules/pytest-mock/default.nix
@@ -1,28 +1,31 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , pythonOlder
 , fetchPypi
-, fetchpatch
 , pytest
 , pytest-asyncio
 , pytestCheckHook
+, setuptools
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pytest-mock";
-  version = "3.11.1";
+  version = "3.12.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  format = "setuptools";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f2sSVgKsbXQ+Ujrgv6ceGml6L1U0BkUoxv+EwvfC/H8=";
+    hash = "sha256-MaQPA4wiytMih7tDkyBURR/1WD/wlLym9nXfL4vBpuk=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
   buildInputs = [
     pytest
@@ -33,6 +36,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.11") [
+    # Regression in 3.11.7 and 3.12.1; https://github.com/pytest-dev/pytest-mock/issues/401
+    "test_failure_message_with_name"
+    "test_failure_message_with_no_name"
+  ];
+
   pythonImportsCheck = [ "pytest_mock" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pytest-mpl/default.nix b/pkgs/development/python-modules/pytest-mpl/default.nix
index 9e90f9533d855..f0ea49d1b7672 100644
--- a/pkgs/development/python-modules/pytest-mpl/default.nix
+++ b/pkgs/development/python-modules/pytest-mpl/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     pytest
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION=version;
-
   propagatedBuildInputs = [
     jinja2
     matplotlib
diff --git a/pkgs/development/python-modules/pytest-openfiles/default.nix b/pkgs/development/python-modules/pytest-openfiles/default.nix
index 29ea593acc374..da894eff91e35 100644
--- a/pkgs/development/python-modules/pytest-openfiles/default.nix
+++ b/pkgs/development/python-modules/pytest-openfiles/default.nix
@@ -1,7 +1,9 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , isPy27
+, packaging
 , pytest
 , pytestCheckHook
 , psutil
@@ -19,11 +21,21 @@ buildPythonPackage rec {
     sha256 = "179c2911d8aee3441fee051aba08e0d9b4dab61b829ae4811906d5c49a3b0a58";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "replace-distutils-with-packaging.patch";
+      url = "https://github.com/astropy/pytest-openfiles/commit/e17e8123936689b0b0ecfb713976588d6793d8bb.patch";
+      includes = [ "pytest_openfiles/plugin.py" ];
+      hash = "sha256-+6xqOwnBO+jxenXxPdDhLqqm3w+ZRjWeVqqgz8j22bU=";
+    })
+  ];
+
   nativeBuildInputs = [ setuptools-scm ];
 
   buildInputs = [ pytest ];
 
   propagatedBuildInputs = [
+    packaging
     psutil
   ];
 
diff --git a/pkgs/development/python-modules/pytest-playwright/default.nix b/pkgs/development/python-modules/pytest-playwright/default.nix
index 3e27b075efa7f..ff4cde9c73e5b 100644
--- a/pkgs/development/python-modules/pytest-playwright/default.nix
+++ b/pkgs/development/python-modules/pytest-playwright/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-5qjfZGDM1OqXXNyj81O49ClKKGiAPdgyZZu6TgpskGs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-pytestrail/default.nix b/pkgs/development/python-modules/pytest-pytestrail/default.nix
index 228e952436daa..618bccfa3bc5e 100644
--- a/pkgs/development/python-modules/pytest-pytestrail/default.nix
+++ b/pkgs/development/python-modules/pytest-pytestrail/default.nix
@@ -11,8 +11,6 @@ buildPythonPackage rec {
   version = "0.10.5";
   format = "setuptools";
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   src = fetchFromGitHub {
     owner = "tolstislon";
     repo = "pytest-pytestrail";
diff --git a/pkgs/development/python-modules/pytest-regressions/default.nix b/pkgs/development/python-modules/pytest-regressions/default.nix
index c306f8ef8f6d0..e9950b01fdf18 100644
--- a/pkgs/development/python-modules/pytest-regressions/default.nix
+++ b/pkgs/development/python-modules/pytest-regressions/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonOlder
 , matplotlib
 , numpy
@@ -25,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-gYx4hMHP87q/ie67AsvCezB4VrGYVCfCTVLLgSoQb9k=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
@@ -47,6 +46,15 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
+  disabledTestPathss = lib.optionals (pythonAtLeast "3.12") [
+    # AttributeError: partially initialized module 'pandas' has no attribute '_pandas_datetime_CAPI' (most likely due to a circular import)
+    "tests/test_num_regression.py"
+  ];
+
   pythonImportsCheck = [
     "pytest_regressions"
     "pytest_regressions.plugin"
diff --git a/pkgs/development/python-modules/pytest-remotedata/default.nix b/pkgs/development/python-modules/pytest-remotedata/default.nix
index bc8c89caacc14..581145212f906 100644
--- a/pkgs/development/python-modules/pytest-remotedata/default.nix
+++ b/pkgs/development/python-modules/pytest-remotedata/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-remotedata";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-viHFWONNfBGw9q61CVbAlSC//NArf86cb46FMaQBocg=";
+    hash = "sha256-BcCL9jjN0e1m6wFzihZHw8cUc3w+w6vgCdLB95O0u1k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-repeat/default.nix b/pkgs/development/python-modules/pytest-repeat/default.nix
index 7db1992d5f852..1c020428c4b8e 100644
--- a/pkgs/development/python-modules/pytest-repeat/default.nix
+++ b/pkgs/development/python-modules/pytest-repeat/default.nix
@@ -1,26 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, hatchling
+, hatch-vcs
 , pytest
 , pytestCheckHook
 , pythonOlder
-, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pytest-repeat";
-  version = "0.9.2";
-  format = "setuptools";
+  version = "0.9.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-eWc0Ra6ZruMzuBHH0AN660CPkzuImDdf8vT/8eO6aGs=";
+    pname = "pytest_repeat";
+    inherit version;
+    hash = "sha256-/9ODbfzWe7JwvsZIszDiC+N9KWZEjEFIxAktHoq6gYU=";
   };
 
   nativeBuildInputs = [
-    setuptools-scm
+    hatchling
+    hatch-vcs
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index f030960df6553..59d459adb6c92 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "12.0";
+  version = "13.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eE9GL6h/6b33gdACfYVrR6S/5sEq8Qj2vYhwV6kXtI4=";
+    hash = "sha256-4TLb5CC8R29US5bnA27dCmlwdXQgm2Z3JjyVDRmwkZk=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytest-snapshot/default.nix b/pkgs/development/python-modules/pytest-snapshot/default.nix
index 7047eef03eef5..f8f207c64b6a9 100644
--- a/pkgs/development/python-modules/pytest-snapshot/default.nix
+++ b/pkgs/development/python-modules/pytest-snapshot/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-0PZu9wL29iEppLxxbl4D0E4WfOHe61KUUld003cRBRU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-subprocess/default.nix b/pkgs/development/python-modules/pytest-subprocess/default.nix
index 6a1d75be5315a..966ca16dd0ba3 100644
--- a/pkgs/development/python-modules/pytest-subprocess/default.nix
+++ b/pkgs/development/python-modules/pytest-subprocess/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , pytest
 , pytestCheckHook
 , docutils
@@ -14,7 +15,7 @@
 buildPythonPackage rec {
   pname = "pytest-subprocess";
   version = "1.5.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -25,6 +26,10 @@ buildPythonPackage rec {
     hash = "sha256-u9d9RhbikOyknMWs18j2efYJb9YdHsQrp31LfcbudoA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   buildInputs = [
     pytest
   ];
@@ -38,6 +43,10 @@ buildPythonPackage rec {
     anyio
   ];
 
+  pytestFlagsArray = [
+    "-W ignore::DeprecationWarning"
+  ];
+
   meta = with lib; {
     description = "A plugin to fake subprocess for pytest";
     homepage = "https://github.com/aklajnert/pytest-subprocess";
diff --git a/pkgs/development/python-modules/pytest-subtests/default.nix b/pkgs/development/python-modules/pytest-subtests/default.nix
index b391ece3556aa..eb292e61537da 100644
--- a/pkgs/development/python-modules/pytest-subtests/default.nix
+++ b/pkgs/development/python-modules/pytest-subtests/default.nix
@@ -1,10 +1,17 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
 , setuptools
 , setuptools-scm
+
+# dependencies
+, attrs
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -24,6 +31,10 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  propagatedBuildInputs = [
+    attrs
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pytest-test-utils/default.nix b/pkgs/development/python-modules/pytest-test-utils/default.nix
index cf2322d39a8c1..127b0c1633561 100644
--- a/pkgs/development/python-modules/pytest-test-utils/default.nix
+++ b/pkgs/development/python-modules/pytest-test-utils/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-5gB+hnJR2+NQd/n7RGrX1bzfKt8Np7IbWw61SZgNVJY=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pytest-timeout/default.nix b/pkgs/development/python-modules/pytest-timeout/default.nix
index 9064b4283ba82..c0a97dd414ac1 100644
--- a/pkgs/development/python-modules/pytest-timeout/default.nix
+++ b/pkgs/development/python-modules/pytest-timeout/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-timeout";
-  version = "2.1.0";
+  version = "2.2.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wHygdATGEvirviIpSyPDaOLlEEtSHBeQGVVh834aw9k=";
+    hash = "sha256-OwuV2r88tQusnvXKkS+gz8KGUmrxevyAaCTfIML3LJA=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-trio/default.nix b/pkgs/development/python-modules/pytest-trio/default.nix
index 243ea9781f3e6..291b10f9b1b87 100644
--- a/pkgs/development/python-modules/pytest-trio/default.nix
+++ b/pkgs/development/python-modules/pytest-trio/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub, pythonOlder
-, trio, async-generator, hypothesis, outcome, pytest }:
+, trio, hypothesis, outcome, pytest }:
 
 buildPythonPackage rec {
   pname = "pytest-trio";
@@ -18,7 +18,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     trio
-    async-generator
     outcome
   ];
 
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index 5c260f4321612..947040fbf5fd6 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-xdist";
-  version = "3.3.1";
+  version = "3.5.0";
   disabled = pythonOlder "3.7";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1e4FIOsbe8ylCmClGKt6dweZKBLFeBmPi0T9+seOjJM=";
+    hash = "sha256-y7NvPWfgxHi6pX+k7ciEOIfg9s/ELWd1MKNtdHKzLYo=";
   };
 
   nativeBuildInputs = [
@@ -60,6 +60,8 @@ buildPythonPackage rec {
     "test_rsyncignore"
     # flakey
     "test_internal_errors_propagate_to_controller"
+    # https://github.com/pytest-dev/pytest-xdist/issues/985
+    "test_workqueue_ordered_by_size"
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/python-modules/pytest-xprocess/default.nix b/pkgs/development/python-modules/pytest-xprocess/default.nix
index 734acd5f8f4e3..601eaecd3e05c 100644
--- a/pkgs/development/python-modules/pytest-xprocess/default.nix
+++ b/pkgs/development/python-modules/pytest-xprocess/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-xprocess";
-  version = "0.22.2";
+  version = "0.23.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WZ7iW5OOjyWeGNnFtNY4SIT4pqKMpR7tMtDZUmvc93w=";
+    hash = "sha256-+NQEGiChwe8ZQwVOSj33rHtD5/KR9kD0PDTp3MSzTfo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index a00b59c425b7f..67fb6989df01a 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -5,18 +5,26 @@
 , fetchPypi
 , writeText
 
-# build
+# build-system
 , setuptools
 , setuptools-scm
 
-# propagates
+# dependencies
 , attrs
 , exceptiongroup
 , iniconfig
 , packaging
 , pluggy
-, py
 , tomli
+
+# optional-dependencies
+, argcomplete
+, hypothesis
+, mock
+, nose
+, pygments
+, requests
+, xmlschema
 }:
 
 buildPythonPackage rec {
@@ -40,16 +48,28 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    attrs
     iniconfig
     packaging
     pluggy
-    py
-    tomli
   ] ++ lib.optionals (pythonOlder "3.11") [
     exceptiongroup
+    tomli
   ];
 
+  passthru.optional-dependencies = {
+    testing = [
+      argcomplete
+      attrs
+      hypothesis
+      mock
+      nose
+      pygments
+      requests
+      setuptools
+      xmlschema
+    ];
+  };
+
   postInstall = ''
     mkdir $testout
     cp -R testing $testout/testing
diff --git a/pkgs/development/python-modules/pytest/tests.nix b/pkgs/development/python-modules/pytest/tests.nix
index 3fc078148b203..8bf8dafdf9279 100644
--- a/pkgs/development/python-modules/pytest/tests.nix
+++ b/pkgs/development/python-modules/pytest/tests.nix
@@ -1,23 +1,19 @@
 { buildPythonPackage
 , isPyPy
 , pytest
-, hypothesis
-, pygments
 }:
 
 buildPythonPackage rec {
   pname = "pytest-tests";
   inherit (pytest) version;
+  format = "other";
 
   src = pytest.testout;
 
   dontBuild = true;
   dontInstall = true;
 
-  nativeCheckInputs = [
-    hypothesis
-    pygments
-  ];
+  nativeCheckInputs = pytest.optional-dependencies.testing;
 
   doCheck = !isPyPy; # https://github.com/pytest-dev/pytest/issues/3460
 
@@ -25,7 +21,7 @@ buildPythonPackage rec {
   # test_missing_required_plugins will emit deprecation warning which is treated as error
   checkPhase = ''
     runHook preCheck
-    ${pytest.out}/bin/py.test -x testing/ \
+    ${pytest.out}/bin/pytest -x testing/ \
       --ignore=testing/test_junitxml.py \
       --ignore=testing/test_argcomplete.py \
       -k "not test_collect_pyargs_with_testpaths and not test_missing_required_plugins"
diff --git a/pkgs/development/python-modules/python-arango/default.nix b/pkgs/development/python-modules/python-arango/default.nix
index 2949b8b7ea9d5..d21408c2c6781 100644
--- a/pkgs/development/python-modules/python-arango/default.nix
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -32,7 +32,7 @@ in
 
 buildPythonPackage rec {
   pname = "python-arango";
-  version = "7.8.0";
+  version = "7.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -41,11 +41,9 @@ buildPythonPackage rec {
     owner = "ArangoDB-Community";
     repo = "python-arango";
     rev = "refs/tags/${version}";
-    hash = "sha256-lZ+9l1kPE/Piw1QLYW+qjFQmTtZd4m/kDOTOxkTsla0=";
+    hash = "sha256-R/59SMEVPZow9aG32gqQApuvB2zQLmPCxf/Mz70ubUU=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index b100ba2292c92..65a27c9b53cfa 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-benedict";
-  version = "0.32.1";
+  version = "0.33.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-q9EIOMmUcttL1ohxQD+SkZTxKv8PwdN29+ez2xB7rvM=";
+    hash = "sha256-SJBU7jMnyLBdWQPQ/UGbVklKUOrCM3fMnOkXKHQnyPI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index a987dc12e6bbb..7d296d4be06d0 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -30,8 +30,6 @@ in buildPythonPackage rec {
     hash = "sha256-sfvVLPTSTXjwyB0a2NyDIONv01FXZ40nHZwwo3oqI90=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/python-docx/default.nix b/pkgs/development/python-modules/python-docx/default.nix
index 79ba5c871a5ff..37a10bdd542c8 100644
--- a/pkgs/development/python-modules/python-docx/default.nix
+++ b/pkgs/development/python-modules/python-docx/default.nix
@@ -3,33 +3,55 @@
 , buildPythonPackage
 , fetchPypi
 , lxml
-, pytest
-, pyparsing
 , mock
+, pyparsing
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "python-docx";
-  version = "0.8.11";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1105d233a0956dd8dd1e710d20b159e2d72ac3c301041b95f4d4ceb3e0ebebc4";
+    hash = "sha256-WCm3IhQc8at5rt8MNNn+mSSyl2RYTA8hZOsrAtzfF8k=";
   };
 
-  nativeCheckInputs = [ behave mock pyparsing pytest ];
-  propagatedBuildInputs = [ lxml ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  checkPhase = ''
-    py.test tests
+  propagatedBuildInputs = [
+    lxml
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    behave
+    mock
+    pyparsing
+    pytestCheckHook
+  ];
+
+  postCheck = ''
     behave --format progress --stop --tags=-wip
   '';
 
-  meta = {
+  pythonImportsCheck = [
+    "docx"
+  ];
+
+  meta = with lib; {
     description = "Create and update Microsoft Word .docx files";
-    homepage = "https://python-docx.readthedocs.io/en/latest/";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.alexchapman ];
+    homepage = "https://python-docx.readthedocs.io/";
+    changelog = "https://github.com/python-openxml/python-docx/blob/v${version}/HISTORY.rst";
+    license = licenses.mit;
+    maintainers = with maintainers; [ alexchapman ];
   };
 }
diff --git a/pkgs/development/python-modules/python-engineio/default.nix b/pkgs/development/python-modules/python-engineio/default.nix
index 990cbd1be317e..59cd210a0a04e 100644
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , aiohttp
 , buildPythonPackage
+, setuptools
 , eventlet
 , fetchFromGitHub
 , iana-etc
@@ -17,8 +18,8 @@
 
 buildPythonPackage rec {
   pname = "python-engineio";
-  version = "4.7.1";
-  format = "setuptools";
+  version = "4.8.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -26,9 +27,13 @@ buildPythonPackage rec {
     owner = "miguelgrinberg";
     repo = "python-engineio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jHXpPnrQlIpmQ2sY4y6AUx/6W8Pf+683s4NmmlwZO58=";
+    hash = "sha256-btXwx9GRLBcjtcGdgckb2Y/MxC0E/rKTWKgkP8olezo=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     simple-websocket
   ];
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index 0c0ded8af09f3..9c708b735ce28 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -2,6 +2,11 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
 , argcomplete
 , requests
 , requests-toolbelt
@@ -10,16 +15,20 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "3.15.0";
-  format = "setuptools";
+  version = "4.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yeZet2Eqn7uKvwM5ly7Kf9enPU2mbJtEb/5SiTCv9TQ=";
+    hash = "sha256-+HDXb5jJXQXEM5nXOx6qtZxnGzJ5ODDNL53fMsyTVB4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
     requests-toolbelt
diff --git a/pkgs/development/python-modules/python-izone/default.nix b/pkgs/development/python-modules/python-izone/default.nix
index 19dbbf733dc6c..0173c277a5261 100644
--- a/pkgs/development/python-modules/python-izone/default.nix
+++ b/pkgs/development/python-modules/python-izone/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     aiohttp
     netifaces
diff --git a/pkgs/development/python-modules/python-json-logger/default.nix b/pkgs/development/python-modules/python-json-logger/default.nix
index b9400a2239ae0..0a02ccb688add 100644
--- a/pkgs/development/python-modules/python-json-logger/default.nix
+++ b/pkgs/development/python-modules/python-json-logger/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
@@ -16,6 +17,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/madzak/python-json-logger/issues/185
+    "test_custom_object_serialization"
+    "test_percentage_format"
+    "test_rename_reserved_attrs"
+  ];
+
   meta = with lib; {
     description = "Json Formatter for the standard python logger";
     homepage = "https://github.com/madzak/python-json-logger";
diff --git a/pkgs/development/python-modules/python-linux-procfs/default.nix b/pkgs/development/python-modules/python-linux-procfs/default.nix
index 2eacf7a0d69d0..f6593574a7f2b 100644
--- a/pkgs/development/python-modules/python-linux-procfs/default.nix
+++ b/pkgs/development/python-modules/python-linux-procfs/default.nix
@@ -1,14 +1,13 @@
-{ lib, buildPythonPackage, fetchgit, six }:
+{ lib, buildPythonPackage, fetchzip, six }:
 
 buildPythonPackage rec {
   pname = "python-linux-procfs";
   version = "0.6.3";
   format = "setuptools";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/libs/python/${pname}/${pname}.git";
-    rev = "v${version}";
-    hash = "sha256-PPgMlL9oj4HYUsr444ZrGo1LSZBl9hL5SE98IASUpbc=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/libs/python/python-linux-procfs/python-linux-procfs.git/snapshot/python-linux-procfs-v${version}.tar.gz";
+    hash = "sha256-iaKL7CWJbIvvcUCah7bKdwKZoZJehbQpZ7n0liO8N64=";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix b/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
index 27057d92ea12b..040d901a7e73f 100644
--- a/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
+++ b/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-5WN/31e6WCgXVzevMuQbNjyo/2jjWDF+m48nrLKS+64=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "--cov-report html --cov-report term --junitxml=pytest.xml --cov pylsp_jsonrpc --cov test" ""
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 763154732943a..96ba4c3670333 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -53,8 +53,6 @@ buildPythonPackage rec {
       --replace "--cov pylsp --cov test" ""
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "autopep8"
     "flake8"
diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index 60be5e80c8c78..3a6648373fb1a 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "python-manilaclient";
-  version = "4.6.0";
+  version = "4.7.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JFdpPX2lVSGN/jVsKMOOKrPm51fwpD476TnQo/0AYWQ=";
+    hash = "sha256-blkE+pLzZQ8BCHAmk6yNjzqbBAlK2ab1FySGFB/kN2c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-osc/default.nix b/pkgs/development/python-modules/python-osc/default.nix
index 86c5894d81789..b82549955bdad 100644
--- a/pkgs/development/python-modules/python-osc/default.nix
+++ b/pkgs/development/python-modules/python-osc/default.nix
@@ -1,9 +1,12 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
-, pythonOlder
+
+# build-system
 , setuptools
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -11,8 +14,6 @@ buildPythonPackage rec {
   version = "1.8.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-pc4bpWyNgt9Ryz8pRrXdM6cFInkazEuFZOYtKyCtnKo=";
@@ -22,14 +23,14 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
   pythonImportsCheck = [
     "pythonosc"
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   meta = with lib; {
     description = "Open Sound Control server and client in pure python";
     homepage = "https://github.com/attwad/python-osc";
diff --git a/pkgs/development/python-modules/python-pkcs11/default.nix b/pkgs/development/python-modules/python-pkcs11/default.nix
index 788ab4a35f916..260b26730728d 100644
--- a/pkgs/development/python-modules/python-pkcs11/default.nix
+++ b/pkgs/development/python-modules/python-pkcs11/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     sha256 = "0kncbipfpsb7m7mhv5s5b9wk604h1j08i2j26fn90pklgqll0xhv";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     cython
     setuptools-scm
diff --git a/pkgs/development/python-modules/python-socketio/default.nix b/pkgs/development/python-modules/python-socketio/default.nix
index f046f7c811892..f8e189f4bd8cc 100644
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@@ -1,31 +1,46 @@
 { lib
-, aiohttp
-, bidict
 , buildPythonPackage
 , fetchFromGitHub
-, mock
-, msgpack
-, pytestCheckHook
-, python-engineio
 , pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, bidict
+, python-engineio
+
+# optional-dependencies
+, aiohttp
 , requests
 , websocket-client
+
+# tests
+, msgpack
+, pytestCheckHook
+, simple-websocket
+, uvicorn
+
 }:
 
 buildPythonPackage rec {
   pname = "python-socketio";
-  version = "5.9.0";
-  format = "setuptools";
+  version = "5.10.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = "python-socketio";
-    rev = "v${version}";
-    hash = "sha256-1lyTZwkRpGRbeBqt6Thv5o+bUzkD1sC3T9T1GbWMEkI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nlzTzIswMRjvJ9l9TOtVvRvbKlQPvNH0/P1NIbQCmy8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     bidict
     python-engineio
@@ -42,10 +57,11 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    mock
     msgpack
     pytestCheckHook
-  ];
+    uvicorn
+    simple-websocket
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "socketio"
diff --git a/pkgs/development/python-modules/python-socks/default.nix b/pkgs/development/python-modules/python-socks/default.nix
index c6b59b0ac985d..77f694dbb2497 100644
--- a/pkgs/development/python-modules/python-socks/default.nix
+++ b/pkgs/development/python-modules/python-socks/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "python-socks";
-  version = "2.4.2";
+  version = "2.4.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6.2";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "romis2012";
     repo = "python-socks";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HnZrnsxPmRJzrvJbKS5r+di+msykDwWS7TB5CitIve8=";
+    hash = "sha256-go8MH/ZW+W4aBOqscvcGim8KOW249sSCrmvCMLrQ5HU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-trovo/default.nix b/pkgs/development/python-modules/python-trovo/default.nix
index ae2b610ca3c7b..b4e7194b842ce 100644
--- a/pkgs/development/python-modules/python-trovo/default.nix
+++ b/pkgs/development/python-modules/python-trovo/default.nix
@@ -2,21 +2,26 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, poetry-core
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "python-trovo";
-  version = "0.1.6";
-  format = "setuptools";
+  version = "0.1.7";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-g1RDHSNGbGT1G2ej7A8WzyR17FaNPySfsAuKbHddmtQ=";
+    hash = "sha256-3EVSF4+nLvvM2RocNM2xz9Us5VrRRTCu/MWCcqwwikw=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [ requests ];
 
   # No tests found
diff --git a/pkgs/development/python-modules/python-ulid/default.nix b/pkgs/development/python-modules/python-ulid/default.nix
index db1456dc3186c..e70c1004ecf77 100644
--- a/pkgs/development/python-modules/python-ulid/default.nix
+++ b/pkgs/development/python-modules/python-ulid/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-d5jCPxWUOfw/OCtbA9Db9+s1D5DAdL+vbPR8zavgbbo=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-fancy-pypi-readme
     hatch-vcs
diff --git a/pkgs/development/python-modules/python-vagrant/default.nix b/pkgs/development/python-modules/python-vagrant/default.nix
index 61d780809db5e..dcf29a4662d9a 100644
--- a/pkgs/development/python-modules/python-vagrant/default.nix
+++ b/pkgs/development/python-modules/python-vagrant/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-apvYzH0IY6ZyUP/FiOVbGN3dXejgN7gn7Mq2tlEaTww=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/python-xz/default.nix b/pkgs/development/python-modules/python-xz/default.nix
index b5a2ed4e21f92..a66ddd6ea8573 100644
--- a/pkgs/development/python-modules/python-xz/default.nix
+++ b/pkgs/development/python-modules/python-xz/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "python-xz";
-  version = "0.4.0";
+  version = "0.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OYdGWTtwb6n6xZuMmI6rhgPh/iupGVERwLRSJ6OnfbM=";
+    hash = "sha256-oYjwQ26BFFXxvaYdzp2+bw/BQwM0v/n1r9DmaLs1R3Q=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/python3-saml/default.nix b/pkgs/development/python-modules/python3-saml/default.nix
index 7a5d8bccaa316..cca583157ef8e 100644
--- a/pkgs/development/python-modules/python3-saml/default.nix
+++ b/pkgs/development/python-modules/python3-saml/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , freezegun
 , isodate
 , lxml
@@ -11,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "python3-saml";
-  version = "1.15.0";
+  version = "1.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,29 +19,9 @@ buildPythonPackage rec {
     owner = "onelogin";
     repo = "python3-saml";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xPPR2z3h8RpoAROpKpu9ZoDxGq5Stm9wQVt4Stj/6fg=";
+    hash = "sha256-KyDGmqhg/c29FaXPKK8rWKSBP6BOCpKKpOujCavXUcc=";
   };
 
-  patches = [
-    # skip tests with expired test data
-    # upstream issue: https://github.com/SAML-Toolkits/python3-saml/issues/373
-    (fetchpatch {
-      name = "test-expired.patch";
-      url = "https://github.com/SAML-Toolkits/python3-saml/commit/bd65578e5a21494c89320094c61c1c77250bea33.diff";
-      hash = "sha256-9Trew6R5JDjtc0NRGoklqMVDEI4IEqFOdK3ezyBU6gI=";
-    })
-    (fetchpatch {
-      name = "test-expired.patch";
-      url = "https://github.com/SAML-Toolkits/python3-saml/commit/ea3a6d4ee6ea0c5cfb0f698d8c0ed25638150f47.patch";
-      hash = "sha256-Q9+GM+mCEZK0QVp7ulH2hORVig2411OvkC4+o36DeXg=";
-    })
-    (fetchpatch {
-      name = "test-expired.patch";
-      url = "https://github.com/SAML-Toolkits/python3-saml/commit/feb0d1d954ee4d0ad1ad1d7d536bf9e83fa9431b.patch";
-      hash = "sha256-NURGI4FUnFlWRZfkioU9IYmZ+Zk9FKfZchjdn7N9abU=";
-    })
-  ];
-
   propagatedBuildInputs = [
     isodate
     lxml
diff --git a/pkgs/development/python-modules/pythonfinder/default.nix b/pkgs/development/python-modules/pythonfinder/default.nix
index 25e0484041a70..c9e0ca669c9ad 100644
--- a/pkgs/development/python-modules/pythonfinder/default.nix
+++ b/pkgs/development/python-modules/pythonfinder/default.nix
@@ -3,6 +3,7 @@
 , cached-property
 , click
 , fetchFromGitHub
+, fetchpatch
 , packaging
 , pydantic
 , pytest-timeout
@@ -13,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "pythonfinder";
-  version = "2.0.5";
-  format = "pyproject";
+  version = "2.0.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,11 +23,20 @@ buildPythonPackage rec {
     owner = "sarugaku";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-L/+6w5lLqHO5c9CThoUPOHXRPVxBlOWFDAmfoYxRw5g=";
+    hash = "sha256-C/Em8Vmv7q030hmH3jU/apBRSSC9QFK9mbBWjBjJHXg=";
   };
 
+  patches = [
+    # https://github.com/sarugaku/pythonfinder/issues/142
+    (fetchpatch {
+      name = "pydantic_2-compatibility.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/python-pythonfinder/-/raw/2.0.6-1/python-pythonfinder-2.0.6-pydantic2.patch";
+      hash = "sha256-mON1MeA+pj6VTB3zpBjF3LfB30wG0QH9nU4bD1djWwg=";
+    })
+  ];
+
   postPatch = ''
-    substituteInPlace setup.cfg \
+    substituteInPlace pyproject.toml \
       --replace " --cov" ""
   '';
 
@@ -35,9 +45,10 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    cached-property
     packaging
     pydantic
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    cached-property
   ];
 
   passthru.optional-dependencies = {
diff --git a/pkgs/development/python-modules/pythran/default.nix b/pkgs/development/python-modules/pythran/default.nix
index 2c4095b532f5b..047a4ea1af07e 100644
--- a/pkgs/development/python-modules/pythran/default.nix
+++ b/pkgs/development/python-modules/pythran/default.nix
@@ -2,14 +2,22 @@
 , python
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
+, isPy3k
+, substituteAll
+
+# build-system
+, setuptools
+
+# native dependencies
 , openmp
+, xsimd
+
+# dependencies
 , ply
 , gast
 , numpy
 , beniget
-, xsimd
-, isPy3k
-, substituteAll
 }:
 
 let
@@ -17,14 +25,14 @@ let
 
 in buildPythonPackage rec {
   pname = "pythran";
-  version = "0.13.1";
-  format = "setuptools";
+  version = "0.14.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "serge-sans-paille";
     repo = "pythran";
     rev = version;
-    hash = "sha256-baDrReJgQXbaKA8KNhHiFjr0X34yb8WK/nUJmiM9EZs=";
+    hash = "sha256-in0ty0aBAIx7Is13hjiHZGS8eKbhxb6TL3bENzfx5vQ=";
   };
 
   patches = [
@@ -33,6 +41,11 @@ in buildPythonPackage rec {
       src = ./0001-hardcode-path-to-libgomp.patch;
       gomp = "${if stdenv.cc.isClang then openmp else stdenv.cc.cc.lib}/lib/libgomp${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
+    (fetchpatch {
+      # Python 3.12 support
+      url = "https://github.com/serge-sans-paille/pythran/commit/258ab9aaf26172f669eab1bf2a346b5f65db3ac0.patch";
+      hash = "sha256-T+FLptDYIgzHBSXShULqHr/G8ttBFamq1M5JlB2HxDM=";
+    })
   ];
 
   # xsimd: unvendor this header-only C++ lib
@@ -41,11 +54,16 @@ in buildPythonPackage rec {
     ln -s '${lib.getDev xsimd}'/include/xsimd third_party/
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     ply
     gast
     numpy
     beniget
+    setuptools
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
index 69f33db742a6a..fad1ff1d13fd6 100644
--- a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
+++ b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
@@ -1,6 +1,7 @@
 { buildPythonPackage
 , fetchFromGitHub
 , lib
+, setuptools
 , numpy
 , onnx
 , packaging
@@ -13,16 +14,20 @@
 
 buildPythonPackage rec {
   pname = "pytorch-pfn-extras";
-  version = "0.7.2";
-  format = "setuptools";
+  version = "0.7.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pfnet";
-    repo = pname;
+    repo = "pytorch-pfn-extras";
     rev = "refs/tags/v${version}";
-    hash = "sha256-juoLw/qfq4YF7opyR7cTYCVzUa9pXVvQnvGntcQhBr4=";
+    hash = "sha256-X7N2RQS8he9FJPfEjPJH6GdxkAPV6uxOIfRVOnJId0U=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ numpy packaging torch typing-extensions ];
 
   nativeCheckInputs = [ onnx pytestCheckHook torchvision ];
diff --git a/pkgs/development/python-modules/pytradfri/default.nix b/pkgs/development/python-modules/pytradfri/default.nix
index 83ab0a9879f34..b4de887f54559 100644
--- a/pkgs/development/python-modules/pytradfri/default.nix
+++ b/pkgs/development/python-modules/pytradfri/default.nix
@@ -48,5 +48,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/home-assistant-libs/pytradfri/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
+    # https://github.com/home-assistant-libs/pytradfri/issues/720
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/pyu2f/default.nix b/pkgs/development/python-modules/pyu2f/default.nix
index 609d8bfcebae9..ef09f1285183d 100644
--- a/pkgs/development/python-modules/pyu2f/default.nix
+++ b/pkgs/development/python-modules/pyu2f/default.nix
@@ -24,6 +24,24 @@ buildPythonPackage rec {
     six
   ];
 
+  postPatch = ''
+    for path in \
+      customauthenticator_test.py \
+      hardware_test.py \
+      hidtransport_test.py \
+      localauthenticator_test.py \
+      model_test.py \
+      u2f_test.py \
+      util_test.py \
+      hid/macos_test.py; \
+    do
+      # https://docs.python.org/3/whatsnew/3.12.html#id3
+      substituteInPlace pyu2f/tests/$path \
+        --replace "assertEquals" "assertEqual" \
+        --replace "assertRaisesRegexp" "assertRaisesRegex"
+    done
+  '';
+
   nativeCheckInputs = [
     mock
     pyfakefs
diff --git a/pkgs/development/python-modules/pyvicare/default.nix b/pkgs/development/python-modules/pyvicare/default.nix
index 0fa3895caa58d..56f74a93b21e5 100644
--- a/pkgs/development/python-modules/pyvicare/default.nix
+++ b/pkgs/development/python-modules/pyvicare/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-qK5JCaCL+gbgNcBo5IjhlRrXD1IhA1B56hmcjvPie6Y=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace "version_config=True," 'version="${version}",' \
diff --git a/pkgs/development/python-modules/pyvisa-py/default.nix b/pkgs/development/python-modules/pyvisa-py/default.nix
index 626d87b796aeb..58d538ec98ade 100644
--- a/pkgs/development/python-modules/pyvisa-py/default.nix
+++ b/pkgs/development/python-modules/pyvisa-py/default.nix
@@ -51,8 +51,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   meta = with lib; {
     description = "Module that implements the Virtual Instrument Software Architecture";
     homepage = "https://github.com/pyvisa/pyvisa-py";
diff --git a/pkgs/development/python-modules/pyvisa-sim/default.nix b/pkgs/development/python-modules/pyvisa-sim/default.nix
index 55d6ff6b5db61..9fcce19d6a202 100644
--- a/pkgs/development/python-modules/pyvisa-sim/default.nix
+++ b/pkgs/development/python-modules/pyvisa-sim/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyvisa-sim";
-  version = "0.5.1";
+  version = "0.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyVISA-sim";
     inherit version;
-    hash = "sha256-vWxW941/1e58pqL/Rzq+eoZJpwsvLphgIe48SuJtohY=";
+    hash = "sha256-kHahaRKoEUtDxEsdMolPwfEy1DidiytxmvYiQeQhYcE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvisa/default.nix b/pkgs/development/python-modules/pyvisa/default.nix
index a104726ac8034..3d017f8ad2e50 100644
--- a/pkgs/development/python-modules/pyvisa/default.nix
+++ b/pkgs/development/python-modules/pyvisa/default.nix
@@ -10,8 +10,8 @@
 
 buildPythonPackage rec {
   pname = "pyvisa";
-  version = "1.13.0";
-  format = "setuptools";
+  version = "1.14.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -19,16 +19,16 @@ buildPythonPackage rec {
     owner = "pyvisa";
     repo = "pyvisa";
     rev = "refs/tags/${version}";
-    hash = "sha256-TBu3Xko0IxFBT2vzrsOxqEG3y4XfPzISEtbkWkIaCvM=";
+    hash = "sha256-GKrgUK2nSZi+8oJoS45MjpU9+INEgcla9Kaw6ceNVp0=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
   propagatedBuildInputs = [
     typing-extensions
-    setuptools
   ];
 
   nativeCheckInputs = [
@@ -40,10 +40,6 @@ buildPythonPackage rec {
     "test_visa_info"
   ];
 
-  postConfigure = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="v${version}"
-  '';
-
   meta = with lib; {
     description = "Python package for support of the Virtual Instrument Software Architecture (VISA)";
     homepage = "https://github.com/pyvisa/pyvisa";
diff --git a/pkgs/development/python-modules/pyvo/default.nix b/pkgs/development/python-modules/pyvo/default.nix
index e16505006c479..c2058a374a31d 100644
--- a/pkgs/development/python-modules/pyvo/default.nix
+++ b/pkgs/development/python-modules/pyvo/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-heTWWyxmRaDlI9NHzZab5OLOBIbVdb45v67Rq5ckzc8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pywebview/default.nix b/pkgs/development/python-modules/pywebview/default.nix
index 9db835f1d5471..93b881435cb5b 100644
--- a/pkgs/development/python-modules/pywebview/default.nix
+++ b/pkgs/development/python-modules/pywebview/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pywebview";
-  version = "4.3.3";
+  version = "4.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "r0x0r";
     repo = "pywebview";
     rev = "refs/tags/${version}";
-    hash = "sha256-8BkbO7C8cYDIQWWCKaXFjfD45L5KVG1tDZJl+uW5g9g=";
+    hash = "sha256-uanv6v/xwi4COY0WjoyxG4khK1kAucBmpr/plCKYxkQ=";
   };
 
   nativeBuildInputs = [
@@ -50,8 +50,6 @@ buildPythonPackage rec {
     xvfb-run
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   checkPhase = ''
     # Cannot create directory /homeless-shelter/.... Error: FILE_ERROR_ACCESS_DENIED
     export HOME=$TMPDIR
diff --git a/pkgs/development/python-modules/pyyaml-include/default.nix b/pkgs/development/python-modules/pyyaml-include/default.nix
index 176d402e99c19..3b5b9faeec9ef 100644
--- a/pkgs/development/python-modules/pyyaml-include/default.nix
+++ b/pkgs/development/python-modules/pyyaml-include/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-xsNMIEBYqMVQp+H8R7XpFCwROXA8I6bFvAuHrRvC+DI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pyzmq/default.nix b/pkgs/development/python-modules/pyzmq/default.nix
index 88fbf7d63c05d..442577fcc5e3c 100644
--- a/pkgs/development/python-modules/pyzmq/default.nix
+++ b/pkgs/development/python-modules/pyzmq/default.nix
@@ -1,6 +1,17 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, isPyPy
+
+# build-system
+, cython_3
+, setuptools
+, setuptools-scm
+, packaging
+, cffi
+
+# dependencies
+
 , py
 , pytestCheckHook
 , python
@@ -13,7 +24,7 @@
 buildPythonPackage rec {
   pname = "pyzmq";
   version = "25.1.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -22,12 +33,22 @@ buildPythonPackage rec {
     hash = "sha256-JZwiSFtxq6zfqL95cgzXvPS50SizDqVU8BrnH9v9qiM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    packaging
+  ] ++ (if isPyPy then [
+    cffi
+  ] else [
+    cython_3
+  ]);
+
   buildInputs = [
     zeromq
   ];
 
-  propagatedBuildInputs = [
-    py
+  propagatedBuildInputs = lib.optionals isPyPy [
+    cffi
   ];
 
   nativeCheckInputs = [
@@ -45,6 +66,7 @@ buildPythonPackage rec {
     # pytest.ini is missing in pypi's sdist
     # https://github.com/zeromq/pyzmq/issues/1853#issuecomment-1592731986
     "--asyncio-mode auto"
+    "--ignore=$out/lib/python3.12/site-packages/zmq/tests/test_mypy.py"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/qasync/default.nix b/pkgs/development/python-modules/qasync/default.nix
index 182e1b209df4f..d8eb5b4c7c694 100644
--- a/pkgs/development/python-modules/qasync/default.nix
+++ b/pkgs/development/python-modules/qasync/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "qasync";
-  version = "0.27.0";
+  version = "0.27.1";
 
   format = "pyproject";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "CabbageDevelopment";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kU8QgcBZSzQQO3V4zKaIBuodUCQS4CLHOH7qHYU8ja0=";
+    hash = "sha256-oXzwilhJ1PhodQpOZjnV9gFuoDy/zXWva9LhhK3T00g=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/qbittorrent-api/default.nix b/pkgs/development/python-modules/qbittorrent-api/default.nix
index 16ad74dd24695..d7b733f83322b 100644
--- a/pkgs/development/python-modules/qbittorrent-api/default.nix
+++ b/pkgs/development/python-modules/qbittorrent-api/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "qbittorrent-api";
-  version = "2023.10.54";
+  version = "2023.11.57";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xCHB/pPURc1+vje6IhBHZ6HogUsmYfBE9977Qtwoc2w=";
+    hash = "sha256-fmFJW4PDQc7szu0ymE+fV9k6wUDLRHkOriEHDnzDSQg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qcodes/default.nix b/pkgs/development/python-modules/qcodes/default.nix
index 7db5c72f80c51..779e7b390b219 100644
--- a/pkgs/development/python-modules/qcodes/default.nix
+++ b/pkgs/development/python-modules/qcodes/default.nix
@@ -48,7 +48,7 @@
 
 buildPythonPackage rec {
   pname = "qcodes";
-  version = "0.42.0";
+  version = "0.42.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -57,7 +57,7 @@ buildPythonPackage rec {
     owner = "QCoDeS";
     repo = "Qcodes";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+NtPE9mQKWftk3vR5WFZgM+7jl8HWr9MxVA+VpbuHvE=";
+    hash = "sha256-oNQLIL5L3gtFS6yxqgLDI1s4s9UYqxGc8ASqHuZv6Rk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qiskit-aer/default.nix b/pkgs/development/python-modules/qiskit-aer/default.nix
index ecd8905583e2b..c8c6883342f66 100644
--- a/pkgs/development/python-modules/qiskit-aer/default.nix
+++ b/pkgs/development/python-modules/qiskit-aer/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-aer";
-  version = "0.12.2";
+  version = "0.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit-aer";
     rev = "refs/tags/${version}";
-    hash = "sha256-K8Avh1j9j5CGdEYIeJJRF+PjUFXvVILkZLqX1QClInE=";
+    hash = "sha256-GxQgqCUDwalgM9m+XeRiZCRL93KrCSUPoLvDgHJJGCQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/qiskit-finance/default.nix b/pkgs/development/python-modules/qiskit-finance/default.nix
index 559ed8f69bbea..115a3dd9e5fc5 100644
--- a/pkgs/development/python-modules/qiskit-finance/default.nix
+++ b/pkgs/development/python-modules/qiskit-finance/default.nix
@@ -2,6 +2,10 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
   # Python Inputs
 , fastdtw
 , numpy
@@ -22,8 +26,8 @@
 
 buildPythonPackage rec {
   pname = "qiskit-finance";
-  version = "0.3.4";
-  format = "setuptools";
+  version = "0.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -31,13 +35,17 @@ buildPythonPackage rec {
     owner = "qiskit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Ijoqn6nANLsEVKA5nycd1xbW5htJ+TQm6LkiMUWTsSs=";
+    hash = "sha256-V0o3U2Tn8OXTe2n84tqAhQql4sQ3UBZ8bLNt8S9Iz9w=";
   };
 
   postPatch = ''
     substituteInPlace requirements.txt --replace "pandas<1.4.0" "pandas"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     fastdtw
     numpy
diff --git a/pkgs/development/python-modules/qiskit-machine-learning/default.nix b/pkgs/development/python-modules/qiskit-machine-learning/default.nix
index da26fa3a27318..16ed373894e91 100644
--- a/pkgs/development/python-modules/qiskit-machine-learning/default.nix
+++ b/pkgs/development/python-modules/qiskit-machine-learning/default.nix
@@ -1,9 +1,11 @@
 { lib
 , pythonOlder
-, pythonAtLeast
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
+
+# build-system
+, setuptools
+
   # Python Inputs
 , fastdtw
 , numpy
@@ -21,8 +23,8 @@
 
 buildPythonPackage rec {
   pname = "qiskit-machine-learning";
-  version = "0.6.1";
-  format = "setuptools";
+  version = "0.7.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -30,9 +32,13 @@ buildPythonPackage rec {
     owner = "qiskit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-oSLQvZGEq/nBj7ktDEq3BMk7xyYiLGpBDmKxuXtMTfs=";
+    hash = "sha256-qTHacEUTp0RY2piplE6XoYKpJyeFswTPBvjfQ9Gvwt0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     fastdtw
     numpy
diff --git a/pkgs/development/python-modules/qiskit-nature/default.nix b/pkgs/development/python-modules/qiskit-nature/default.nix
index b9083bdcd51fd..660762f2d2fd1 100644
--- a/pkgs/development/python-modules/qiskit-nature/default.nix
+++ b/pkgs/development/python-modules/qiskit-nature/default.nix
@@ -2,6 +2,10 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
   # Python Inputs
 , h5py
 , numpy
@@ -21,8 +25,8 @@
 
 buildPythonPackage rec {
   pname = "qiskit-nature";
-  version = "0.6.2";
-  format = "setuptools";
+  version = "0.7.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -30,9 +34,13 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-X/4jA/e2nmmaVEiCgd/4KJc/sAdcYDkyKzvyVztovXM=";
+    hash = "sha256-RspjHEFYdu1k6azmifbpd57tH+SxPeepw5EQzWP/Yc8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     h5py
     numpy
diff --git a/pkgs/development/python-modules/qiskit-optimization/default.nix b/pkgs/development/python-modules/qiskit-optimization/default.nix
index bd3d8251f10a0..f377a2b9cabaa 100644
--- a/pkgs/development/python-modules/qiskit-optimization/default.nix
+++ b/pkgs/development/python-modules/qiskit-optimization/default.nix
@@ -2,6 +2,10 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
   # Python Inputs
 , decorator
 , docplex
@@ -18,8 +22,8 @@
 
 buildPythonPackage rec {
   pname = "qiskit-optimization";
-  version = "0.5.0";
-  format = "setuptools";
+  version = "0.6.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -27,13 +31,17 @@ buildPythonPackage rec {
     owner = "qiskit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-N4mf5ins0x+yUAIq+yyjSnUrHcaEhH/Jpid/QMhIjE0=";
+    hash = "sha256-vVSFvLVjptSgGocGR6i1Fp0BSRaT3uBBxf0OrFaF9EQ=";
   };
 
   postPatch = ''
     substituteInPlace requirements.txt --replace "networkx>=2.2,<2.6" "networkx"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     docplex
     decorator
diff --git a/pkgs/development/python-modules/qiskit/default.nix b/pkgs/development/python-modules/qiskit/default.nix
index 13d70a2d472aa..b7c0a2677bf69 100644
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@@ -2,6 +2,10 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
   # Python Inputs
 , qiskit-aer
 , qiskit-ibmq-provider
@@ -28,8 +32,8 @@ in
 buildPythonPackage rec {
   pname = "qiskit";
   # NOTE: This version denotes a specific set of subpackages. See https://qiskit.org/documentation/release_notes.html#version-history
-  version = "0.41.1";
-  format = "setuptools";
+  version = "0.45.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -37,9 +41,13 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit";
     rev = "refs/tags/${version}";
-    hash = "sha256-ICJJvbekvpaBMnSf+NHbTiarb+Ye3NtktcRYAq8KaCs=";
+    hash = "sha256-XAAQc6oX9zy9MFze1UQbalUBfhbkY5u/0xOmc5J66kM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     qiskit-aer
     qiskit-ibmq-provider
diff --git a/pkgs/development/python-modules/qmk-dotty-dict/default.nix b/pkgs/development/python-modules/qmk-dotty-dict/default.nix
index 8b7a7b553699f..39b7fe21b88c7 100644
--- a/pkgs/development/python-modules/qmk-dotty-dict/default.nix
+++ b/pkgs/development/python-modules/qmk-dotty-dict/default.nix
@@ -1,15 +1,24 @@
-{ buildPythonPackage, fetchPypi, lib, setuptools-scm }:
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, poetry-core
+}:
 
 buildPythonPackage rec {
   pname = "qmk_dotty_dict";
-  version = "1.3.0.post1";
+  version = "1.3.1";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-O2EeOTZgv6poNcaOlHhLroD+B7hJCXi17KsDoNL8fqI=";
+  src = fetchFromGitHub  {
+    owner = "pawelzny";
+    repo = "dotty_dict";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kY7o9wgfsV7oc5twOeuhG47C0Js6JzCt02S9Sd8dSGc=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index a49b63eaeb159..101239257853d 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "qtconsole";
-  version = "5.4.4";
+  version = "5.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-t/+1PXTyPO4p9M21Xdb6vI7DEtlPPEa6OOHd5FhpPfs=";
+    hash = "sha256-oOgGxpUduUkGKOTfgMrslmm2UUnHukD5vwM8AlpbVrw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qtile-extras/default.nix b/pkgs/development/python-modules/qtile-extras/default.nix
index 9555ef07c36af..aa6eed8ec5731 100644
--- a/pkgs/development/python-modules/qtile-extras/default.nix
+++ b/pkgs/development/python-modules/qtile-extras/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-WI1z8vrbZiJw6fDHK27mKA+1FyZEQTMttIDNzSIX+PU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/qtile/default.nix b/pkgs/development/python-modules/qtile/default.nix
index 15806119cb787..ef1df14b21847 100644
--- a/pkgs/development/python-modules/qtile/default.nix
+++ b/pkgs/development/python-modules/qtile/default.nix
@@ -58,8 +58,6 @@ buildPythonPackage rec {
         --replace /usr/include/libdrm ${lib.getDev libdrm}/include/libdrm
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     pkg-config
     setuptools
diff --git a/pkgs/development/python-modules/quaternion/default.nix b/pkgs/development/python-modules/quaternion/default.nix
index ad53a085d3277..4b7eef5c5ab2e 100644
--- a/pkgs/development/python-modules/quaternion/default.nix
+++ b/pkgs/development/python-modules/quaternion/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "quaternion";
-  version = "2022.4.3";
+  version = "2022.4.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "moble";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-iLjVQ6eGwpLQXi8Sr5ShJdXMqYNclGEuq/oxR4ExDLA=";
+    hash = "sha256-fgyi50purfqUIe7zuz/52K6Sw3TjuvAX0EnzkXD//B4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/questionary/default.nix b/pkgs/development/python-modules/questionary/default.nix
index 6f9b0488c5d27..98a50c6079ca0 100644
--- a/pkgs/development/python-modules/questionary/default.nix
+++ b/pkgs/development/python-modules/questionary/default.nix
@@ -6,6 +6,7 @@
 , prompt-toolkit
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -24,6 +25,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "prompt_toolkit"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/raincloudy/default.nix b/pkgs/development/python-modules/raincloudy/default.nix
index 6a223bb4fb762..3a247bc6a81ed 100644
--- a/pkgs/development/python-modules/raincloudy/default.nix
+++ b/pkgs/development/python-modules/raincloudy/default.nix
@@ -35,8 +35,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     # https://github.com/vanstinator/raincloudy/pull/60
     substituteInPlace setup.py \
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 6bde7864d2af9..97f2a09e55e21 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -30,6 +30,11 @@ buildPythonPackage rec {
     hash = "sha256-D7Z0xKqAJAPKSAEK+3Mpz/LaEKqKYczp+m6SqfzufwA=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "Cython==3.0.3" "Cython"
+  '';
+
   nativeBuildInputs = [
     cmake
     cython_3
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index 0e216ce185087..e9e611cb19bce 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "rasterio";
-  version = "1.3.9";
+  version = "4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -38,8 +38,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rasterio";
     repo = "rasterio";
-    rev = "refs/tags/${version}";
-    hash = "sha256-Tp6BSU33FaszrIXQgU0Asb7IMue0C939o/atAKz+3Q4=";
+    rev = "refs/tags/release-test-${version}";
+    hash = "sha256-YO0FnmIEt+88f6k2mdXDSQg7UKq1Swr8wqVUGdRyQR4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/rdflib/default.nix b/pkgs/development/python-modules/rdflib/default.nix
index 471439b28e5ce..04f5206b96a5e 100644
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@@ -24,6 +24,7 @@
 , pip
 , pytest-cov
 , pytestCheckHook
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -67,6 +68,7 @@ buildPythonPackage rec {
     pip
     pytest-cov
     pytestCheckHook
+    setuptools
   ]
   ++ passthru.optional-dependencies.networkx
   ++ passthru.optional-dependencies.html;
diff --git a/pkgs/development/python-modules/readchar/default.nix b/pkgs/development/python-modules/readchar/default.nix
index 8517bb34654f2..aab318a38178f 100644
--- a/pkgs/development/python-modules/readchar/default.nix
+++ b/pkgs/development/python-modules/readchar/default.nix
@@ -2,6 +2,9 @@
 , buildPythonPackage
 , fetchFromGitHub
 
+# build-system
+, setuptools
+
 # tests
 , pytestCheckHook
 , pexpect
@@ -10,7 +13,7 @@
 buildPythonPackage rec {
   pname = "readchar";
   version = "4.0.5";
-  format = "setuptools";
+  pyproject = true;
 
   # Don't use wheels on PyPI
   src = fetchFromGitHub {
@@ -22,13 +25,18 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "--cov=readchar" ""
+      --replace "--cov=readchar" "" \
+      --replace "attr: readchar.__version__" "${version}"
     # run Linux tests on Darwin as well
     # see https://github.com/magmax/python-readchar/pull/99 for why this is not upstreamed
     substituteInPlace tests/linux/conftest.py \
       --replace 'sys.platform.startswith("linux")' 'sys.platform.startswith(("darwin", "linux"))'
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = [ "readchar" ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
index 0ce923663f886..3490b6a914b98 100644
--- a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
+++ b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
@@ -1,29 +1,36 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , requests
-, pytest
+, pytestCheckHook
 , mock
 , sphinx
 }:
 
 buildPythonPackage rec {
   pname = "readthedocs-sphinx-ext";
-  version = "2.2.2";
-  format = "setuptools";
+  version = "2.2.3";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kiF77xTZE3e88nvffaNj5XSzseQYC2Xu9ufPpV8P0Lg=";
+    hash = "sha256-ZYPCZ5GlhT7p5Xzp24ZOL7BoCLpHD4BddNU/xQgR4BI=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  nativeCheckInputs = [ pytest mock sphinx ];
+  propagatedBuildInputs = [
+    requests
+  ];
 
-  checkPhase = ''
-    py.test
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+    mock
+    sphinx
+  ];
 
   meta = with lib; {
     description = "Sphinx extension for Read the Docs overrides";
diff --git a/pkgs/development/python-modules/recipe-scrapers/default.nix b/pkgs/development/python-modules/recipe-scrapers/default.nix
index c5b7fcb88b762..b9f29be757fec 100644
--- a/pkgs/development/python-modules/recipe-scrapers/default.nix
+++ b/pkgs/development/python-modules/recipe-scrapers/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "14.46.0";
+  version = "14.52.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "hhursev";
     repo = "recipe-scrapers";
     rev = "refs/tags/${version}";
-    hash = "sha256-XCcunwqmcvPC5AVxR9mit06BRDTYfu/CeTXg3IH7Dy0=";
+    hash = "sha256-VdJZnwo+DwVDZuuuqk0X26CXs7ZrUFXqC8qEYaX74Zc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 2616e1da9f4d2..d987092e48f02 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "redis";
-  version = "5.0.0";
+  version = "5.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XOpsDTNcmnMypGDthynOq7TQxInHKFsKhtu/igF70SA=";
+    hash = "sha256-DatJXNV1MGnTvGUKDd6Kj57d4W/FaRtomlZu2lgQDQ8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/redshift-connector/default.nix b/pkgs/development/python-modules/redshift-connector/default.nix
index 4bd4b3c146190..f0845e50d5190 100644
--- a/pkgs/development/python-modules/redshift-connector/default.nix
+++ b/pkgs/development/python-modules/redshift-connector/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "redshift-connector";
-  version = "2.0.914";
+  version = "2.0.917";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "amazon-redshift-python-driver";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fGOo9FgVMI6ayyB3EMN6RGThwWciShcBZzWTZWtOt8E=";
+    hash = "sha256-Qrh6ruB/e7ZeZ33fD9VmtAX+I6OUL5I/zjRv9oh1bO0=";
   };
 
   # remove addops as they add test directory and coverage parameters to pytest
diff --git a/pkgs/development/python-modules/referencing/default.nix b/pkgs/development/python-modules/referencing/default.nix
index dc09aa3594a4b..8de065b054f21 100644
--- a/pkgs/development/python-modules/referencing/default.nix
+++ b/pkgs/development/python-modules/referencing/default.nix
@@ -15,7 +15,7 @@
 let
   self = buildPythonPackage rec {
     pname = "referencing";
-    version = "0.30.2";
+    version = "0.31.1";
     format = "pyproject";
 
     disabled = pythonOlder "3.7";
@@ -25,11 +25,9 @@ let
       repo = "referencing";
       rev = "refs/tags/v${version}";
       fetchSubmodules = true;
-      hash = "sha256-C2gKjoaMcUWz/QOsqpv4TkozQyI+zEIQf3GMf5w40aw=";
+      hash = "sha256-6Kol8TdOxImRq0aff+aAR/jbDrkHX/EPrIv1ZEMRWZU=";
     };
 
-    SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
     nativeBuildInputs = [
       hatch-vcs
       hatchling
diff --git a/pkgs/development/python-modules/regenmaschine/default.nix b/pkgs/development/python-modules/regenmaschine/default.nix
index 2b702284be7d3..e3fb2889470e4 100644
--- a/pkgs/development/python-modules/regenmaschine/default.nix
+++ b/pkgs/development/python-modules/regenmaschine/default.nix
@@ -2,6 +2,7 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
 , poetry-core
 , pytest-aiohttp
@@ -32,6 +33,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
+    certifi
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index 2df8bf922ea7e..66bb26fb60071 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2023.8.8";
+  version = "2023.10.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/L3F8rDxzQ9qVs20b+QdLM4eZE47aIMvPu68X7D3cS4=";
+    hash = "sha256-P+9PhE0ikO4LpXrdzsF+7J499z8QonSEhd/Wo6GIzA8=";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/regress/default.nix b/pkgs/development/python-modules/regress/default.nix
new file mode 100644
index 0000000000000..4526c735a1898
--- /dev/null
+++ b/pkgs/development/python-modules/regress/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, rustPlatform
+}:
+
+buildPythonPackage rec {
+  pname = "regress";
+  version = "0.4.5";
+
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-tCrFBjkK6obzaYkYiJ3WQ5yi3KkC86/cbXCSnRRGZu8=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-wHObfXWgcbSYxk5d17s44+1qIGYD/Ygefxp+el0fsEc=";
+  };
+
+  meta = with lib; {
+    description = "Python bindings to the Rust regress crate, exposing ECMA regular expressions.";
+    homepage = "https://github.com/Julian/regress";
+    license = licenses.mit;
+    maintainers = [ maintainers.matthiasbeyer ];
+  };
+}
diff --git a/pkgs/development/python-modules/reportlab/default.nix b/pkgs/development/python-modules/reportlab/default.nix
index 664d87040c452..af73624d1ae6a 100644
--- a/pkgs/development/python-modules/reportlab/default.nix
+++ b/pkgs/development/python-modules/reportlab/default.nix
@@ -13,7 +13,7 @@ let
   ft = freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; });
 in buildPythonPackage rec {
   pname = "reportlab";
-  version = "4.0.4";
+  version = "4.0.7";
   format = "pyproject";
 
   # See https://bitbucket.org/pypy/compatibility/wiki/reportlab%20toolkit
@@ -21,7 +21,7 @@ in buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f3CztWr/XxHLQTbFGg9aVv5uTI+7rHuQMHbbmajvMcE=";
+    hash = "sha256-lnx38A79kYzCMc+LbY9OR33Jc7XBZVfjvRjfrrWnAjQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/reproject/default.nix b/pkgs/development/python-modules/reproject/default.nix
index 81ab320c77f97..488a045211a18 100644
--- a/pkgs/development/python-modules/reproject/default.nix
+++ b/pkgs/development/python-modules/reproject/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "reproject";
-  version = "0.12.0";
+  version = "0.13.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jb4efKT5jMY0ECV+ab5rpUHEk+tT4T2MioCRxs92TbI=";
+    hash = "sha256-lL6MkKVSWmV6KPkG/9fjc2c2dFQ14i9fiJAr3VFfcuI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/requests-cache/default.nix b/pkgs/development/python-modules/requests-cache/default.nix
index d04f25ae0e013..f3ec2c4123a8f 100644
--- a/pkgs/development/python-modules/requests-cache/default.nix
+++ b/pkgs/development/python-modules/requests-cache/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "requests-cache";
-  version = "1.1.0";
+  version = "1.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "requests-cache";
     repo = "requests-cache";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kJqy7aK67JFtmsrwMtze/wTM9qch9YYj2eUzGJRJreQ=";
+    hash = "sha256-0KBx6nplD/l8GZfMbyUtgHj2e4/vH9EAgdyNFm+kPyM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/requests-http-signature/default.nix b/pkgs/development/python-modules/requests-http-signature/default.nix
index 36b993d795530..d0eda6329cda2 100644
--- a/pkgs/development/python-modules/requests-http-signature/default.nix
+++ b/pkgs/development/python-modules/requests-http-signature/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-sW2vYqT/nY27DvEKHdptc3dUpuqKmD7PLMs+Xp+cpeU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/requirements-detector/default.nix b/pkgs/development/python-modules/requirements-detector/default.nix
index 5acc7ae6ae260..bc6054ffad1b6 100644
--- a/pkgs/development/python-modules/requirements-detector/default.nix
+++ b/pkgs/development/python-modules/requirements-detector/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitHub
 , packaging
 , poetry-core
-, poetry-semver
+, semver
 , pytestCheckHook
 , pythonOlder
 , toml
@@ -31,8 +31,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     astroid
     packaging
-    poetry-semver
     toml
+    semver
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index a35b03680a448..37294dba1e215 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -7,20 +7,20 @@
 , pythonOlder
 , pyyaml
 , requests
+, setuptools
 , tomli
 , tomli-w
 , types-pyyaml
 , types-toml
-, typing-extensions
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.23.3";
-  format = "setuptools";
+  version = "0.24.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   __darwinAllowLocalNetworking = true;
 
@@ -28,20 +28,21 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-VJmcRMn0O+3mDwzkCwxIX7RU3/I9T9p9N8t6USWDZJQ=";
+    hash = "sha256-fvfEHJioyjQoEvIgZZKt9/AKtzTgo0APGUK7lDrbahs=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyyaml
     requests
     types-pyyaml
     types-toml
     urllib3
-  ]  ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
   ];
 
-
   nativeCheckInputs = [
     pytest-asyncio
     pytest-httpserver
diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index 889c729950e08..f419a3afbaa33 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -1,28 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, looseversion
 , six
 , setuptools
 }:
 
 buildPythonPackage rec {
   pname = "rethinkdb";
-  version = "2.4.9";
-  format = "setuptools";
+  version = "2.4.10";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dV8I9xdTWlXAUSj2vmwoJI+pr/JningWqrh+H59YFcE=";
+    hash = "sha256-Vez3RH3BH+wOLOmqxLpMC1f9xcnFfXfuZz1Z0kXHRmY=";
   };
 
-  propagatedBuildInputs = [ six setuptools ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    looseversion
+    six
+  ];
 
   doCheck = false;
+
   pythonImportsCheck = [ "rethinkdb" ];
 
   meta = with lib; {
     description = "Python driver library for the RethinkDB database server";
-    homepage = "https://pypi.python.org/pypi/rethinkdb";
+    homepage = "https://github.com/RethinkDB/rethinkdb-python";
     license = licenses.asl20;
   };
 
diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index 86c3ac1ffeeb7..0fb67ed8a805a 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -2,10 +2,20 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, markdown-it-py
+
+# build-system
 , poetry-core
+
+# dependencies
+, markdown-it-py
 , pygments
 , typing-extensions
+
+# optional-dependencies
+, ipywidgets
+
+# tests
+, attrs
 , pytestCheckHook
 , setuptools
 
@@ -18,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "rich";
-  version = "13.5.2";
+  version = "13.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +37,7 @@ buildPythonPackage rec {
     owner = "Textualize";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ycDmFJa68OOrNqIy/hGKxbjoaIbiniiO4UAPNSyZvDk=";
+    hash = "sha256-L72an7vHC+aBj8NlLOjofDrQGvmFxJpdbfiEubfg0GM=";
   };
 
   nativeBuildInputs = [
@@ -37,13 +47,20 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     markdown-it-py
     pygments
-    setuptools
   ] ++ lib.optionals (pythonOlder "3.9") [
     typing-extensions
   ];
 
+  passthru.optional-dependencies = {
+    jupyter = [
+      ipywidgets
+    ];
+  };
+
   nativeCheckInputs = [
+    attrs
     pytestCheckHook
+    setuptools
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/riscv-config/default.nix b/pkgs/development/python-modules/riscv-config/default.nix
index 397259d30fe35..f2ddbff5d43fb 100644
--- a/pkgs/development/python-modules/riscv-config/default.nix
+++ b/pkgs/development/python-modules/riscv-config/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "riscv-config";
-  version = "3.13.3";
+  version = "3.14.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "riscv-software-src";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-tMV5mRqOLURkr8HQN1yvq5Cf3yz2NRBY6uaaxNKCy2c=";
+    hash = "sha256-a6rTKCLAHrdfP/M8Q8YYSck4q+7tmospMFcCdIdNyy0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rnginline/default.nix b/pkgs/development/python-modules/rnginline/default.nix
index d006fc950d805..acea2482f32cf 100644
--- a/pkgs/development/python-modules/rnginline/default.nix
+++ b/pkgs/development/python-modules/rnginline/default.nix
@@ -2,6 +2,7 @@
 , fetchPypi
 , buildPythonPackage
 , poetry-core
+, pythonRelaxDepsHook
 , lxml
 , docopt-ng
 , typing-extensions
@@ -14,21 +15,20 @@
 buildPythonPackage rec {
   pname = "rnginline";
   version = "1.0.0";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-JWqzs+OqOynIAWYVgGrZiuiCqObAgGe6rBt0DcP3U6E=";
   };
 
-  format = "pyproject";
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'importlib-metadata = "^6.6.0"' 'importlib-metadata = "^6.0.0"'
-  '';
-
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "docopt-ng"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/robotframework-databaselibrary/default.nix b/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
index 0586fccd8853f..d24bcf5bfc7a5 100644
--- a/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
@@ -1,24 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , robotframework
 }:
 
 buildPythonPackage rec {
-  version = "1.3.1";
-  format = "setuptools";
   pname = "robotframework-databaselibrary";
+  version = "1.4.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-C+shwpGbiA+YS8t9ApJEv6mYQVd3fVvY3qWzDF6vYqU=";
+    sha256 = "sha256-/n4+xA/eLrcVEwlWyLQLrkX5waYaJKRkphwT22b7hTU=";
   };
 
+  nativeBuildInputs = [
+    robotframework
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    robotframework
+  ];
+
   # unit tests are impure
   doCheck = false;
 
-  propagatedBuildInputs = [ robotframework ];
-
   meta = with lib; {
     description = "Database Library contains utilities meant for Robot Framework";
     homepage = "https://github.com/franz-see/Robotframework-Database-Library";
diff --git a/pkgs/development/python-modules/robotframework-requests/default.nix b/pkgs/development/python-modules/robotframework-requests/default.nix
index e1c43eb66b875..6d009c61a80cc 100644
--- a/pkgs/development/python-modules/robotframework-requests/default.nix
+++ b/pkgs/development/python-modules/robotframework-requests/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "robotframework-requests";
-  version = "0.9.5";
+  version = "0.9.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "MarketSquare";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-PvhMo1r/4962nntPQb4fQxcMMXIvKjp0FdNyOA43Euc=";
+    hash = "sha256-TuKfR+pUcQ4kf9HsX6s9WYukhwLBbJkwModoreAgo60=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
index 1412fbe22a7f3..d014d04419759 100644
--- a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
@@ -1,8 +1,7 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, setuptools
 , robotframework
 , robotframework-pythonlibcore
 , selenium
@@ -13,18 +12,22 @@
 }:
 
 buildPythonPackage rec {
-  version = "6.1.2";
-  format = "setuptools";
   pname = "robotframework-seleniumlibrary";
+  version = "6.2.0";
+  pyproject = true;
 
   # no tests included in PyPI tarball
   src = fetchFromGitHub {
     owner = "robotframework";
     repo = "SeleniumLibrary";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-QbAwPm1Y76KPIcHkopiyISULQSwUet021erFa/zi8Zw=";
+    sha256 = "sha256-lvtu6z/PD2Ckj70SgDF69BwrhaoA36SDrAvj0XJsmCc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     robotframework
     robotframework-pythonlibcore
diff --git a/pkgs/development/python-modules/rotary-embedding-torch/default.nix b/pkgs/development/python-modules/rotary-embedding-torch/default.nix
index 814f178c81f36..91bb5a00231cb 100644
--- a/pkgs/development/python-modules/rotary-embedding-torch/default.nix
+++ b/pkgs/development/python-modules/rotary-embedding-torch/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "rotary-embedding-torch";
-  version = "0.3.6";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lucidrains";
     repo = "rotary-embedding-torch";
     rev = "refs/tags/${version}";
-    hash = "sha256-sbkUHFUv/+nY6AT3wu/ipuDF45VUjQalsYcIvUFR9PE=";
+    hash = "sha256-bwRfu3SM/+Y9B06vjwqOjd9YmmO+EwBVvhWSdHTaRAk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rpds-py/default.nix b/pkgs/development/python-modules/rpds-py/default.nix
index 6cd3f5dea28ef..b86ed00e3594a 100644
--- a/pkgs/development/python-modules/rpds-py/default.nix
+++ b/pkgs/development/python-modules/rpds-py/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "rpds-py";
-  version = "0.10.3";
+  version = "0.10.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,13 +20,13 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "rpds_py";
     inherit version;
-    hash = "sha256-/MHrt1YaPiSmWI98be0V2ArsIsZqBwx1dVm1exf/0cs=";
+    hash = "sha256-TOWnCNZajb83SNJHS1gNYGsbn5G1xqsqMW4LDPekulA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-iWy6BHVsKsZB0SVrh3CVhryaavk4gAQVvRdu9xBiDRg=";
+    hash = "sha256-8bXCTrZErdE7JhuoudU/4dDndCMwvjy2a+2IY0DWDzg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rstcheck-core/default.nix b/pkgs/development/python-modules/rstcheck-core/default.nix
index 0a250a83fa5b8..74a1dd2dbff2e 100644
--- a/pkgs/development/python-modules/rstcheck-core/default.nix
+++ b/pkgs/development/python-modules/rstcheck-core/default.nix
@@ -5,38 +5,45 @@
 , fetchFromGitHub
 , importlib-metadata
 , mock
-, poetry-core
 , pydantic
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
-, types-docutils
+, setuptools
+, setuptools-scm
 , typing-extensions
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "rstcheck-core";
-  version = "1.0.3";
-  format = "pyproject";
+  version = "1.2.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "rstcheck";
-    repo = pname;
+    repo = "rstcheck-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9U+GhkwBr+f3yEe7McOxqPRUuTp9vP+3WT5wZ92n32w=";
+    hash = "sha256-cKJNktIB4vXt1MPRgYrJQ0aksmrVu7Y2uTyUjdx5YdA=";
   };
 
   nativeBuildInputs = [
-    poetry-core
+    setuptools
+    setuptools-scm
+    wheel
   ];
 
+  env = {
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-strict-prototypes";
+  };
+
   propagatedBuildInputs = [
     docutils
-    importlib-metadata
     pydantic
-    types-docutils
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-metadata
     typing-extensions
   ];
 
@@ -46,10 +53,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.isDarwin [
-    # Disabled until https://github.com/rstcheck/rstcheck-core/issues/19 is resolved.
-    "test_error_without_config_file_macos"
-    "test_file_1_is_bad_without_config_macos"
+  disabledTests = [
+    # https://github.com/rstcheck/rstcheck-core/issues/84
+    "test_check_yaml_returns_error_on_bad_code_block"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/ruamel-yaml/default.nix b/pkgs/development/python-modules/ruamel-yaml/default.nix
index 56df9d20c5911..e06aaff73dc86 100644
--- a/pkgs/development/python-modules/ruamel-yaml/default.nix
+++ b/pkgs/development/python-modules/ruamel-yaml/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , ruamel-base
 , ruamel-yaml-clib
 , isPyPy
@@ -8,15 +9,19 @@
 
 buildPythonPackage rec {
   pname = "ruamel-yaml";
-  version = "0.17.32";
-  format = "setuptools";
+  version = "0.18.5";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "ruamel.yaml";
     inherit version;
-    hash = "sha256-7JOQY3YZFOFFQpcqXLptM8I7CFmrY0L2HPBwz8YA78I=";
+    hash = "sha256-YZF+OjWlacETOo93LhImlhv1oRmL6n4j8GoIQd6hqw4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # Tests use relative paths
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/ruyaml/default.nix b/pkgs/development/python-modules/ruyaml/default.nix
index 8779325d9b23d..e5b2108831df1 100644
--- a/pkgs/development/python-modules/ruyaml/default.nix
+++ b/pkgs/development/python-modules/ruyaml/default.nix
@@ -2,10 +2,10 @@
 , buildPythonPackage
 , distro
 , fetchFromGitHub
+, fetchpatch
 , pytestCheckHook
 , pythonOlder
 , setuptools-scm
-, setuptools-scm-git-archive
 }:
 
 buildPythonPackage rec {
@@ -22,13 +22,26 @@ buildPythonPackage rec {
     sha256 = "0gxvwry7n1gczxkjzyfrr3fammllkvnnamja4yln8xrg3n1h89al";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "remove-setuptools-scm-git-archive-from-setupcfg.patch";
+      url = "https://github.com/pycontribs/ruyaml/commit/8922dd826cbb97b29e9826b00fb28a65d584e985.patch";
+      includes = [ "setup.cfg" ];
+      hash = "sha256-XAsORoPvYRElHswlZ4S377UwuJNCU1JuCz5iyFXoXOQ=";
+    })
+
+    # https://github.com/pycontribs/ruyaml/pull/107
+    (fetchpatch {
+      name = "remove-setuptools-scm-git-archive-from-pyproject.patch";
+      url = "https://github.com/pycontribs/ruyaml/commit/4d605bf63f799696c8ba3c1f0a0f505db0ca33ce.patch";
+      hash = "sha256-X6HWXBot5ZIo+odoSHhXMb03tgpQfRw/Ze8nFgH43ZI=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools-scm
-    setuptools-scm-git-archive
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     distro
   ];
diff --git a/pkgs/development/python-modules/rxv/default.nix b/pkgs/development/python-modules/rxv/default.nix
index 50e5f1482cecf..9f947a78ad2a1 100644
--- a/pkgs/development/python-modules/rxv/default.nix
+++ b/pkgs/development/python-modules/rxv/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     sha256 = "0jldnlzbfg5jm1nbgv91mlvcqkswd9f2n3qj9aqlbmj1cxq19yz8";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/s3transfer/default.nix b/pkgs/development/python-modules/s3transfer/default.nix
index 748b6abecf452..0400ab4b8cd87 100644
--- a/pkgs/development/python-modules/s3transfer/default.nix
+++ b/pkgs/development/python-modules/s3transfer/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "s3transfer";
-  version = "0.7.0";
+  version = "0.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-EvLqRvm9E1Taf+JvbhQbfJqIlbu2a+rB2MX0IO90x98=";
+    hash = "sha256-sdoPjkZHN5wVCK9V6V+fkGvQvEQo2ABy2lqefEKfg6o=";
   };
 
   propagatedBuildInputs = [ botocore ];
@@ -36,6 +36,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "s3transfer" ];
 
+  passthru.optional-dependencies = {
+    crt = [ botocore.optional-dependencies.crt ];
+  };
+
   meta = with lib; {
     description = "Library for managing Amazon S3 transfers";
     homepage = "https://github.com/boto/s3transfer";
diff --git a/pkgs/development/python-modules/sabctools/default.nix b/pkgs/development/python-modules/sabctools/default.nix
index 9dad229707b53..d5e684bbbb46d 100644
--- a/pkgs/development/python-modules/sabctools/default.nix
+++ b/pkgs/development/python-modules/sabctools/default.nix
@@ -2,18 +2,23 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   sabnzbd,
 }:
 buildPythonPackage rec {
   pname = "sabctools";
   version = "8.1.0"; # needs to match version sabnzbd expects, e.g. https://github.com/sabnzbd/sabnzbd/blob/4.0.x/requirements.txt#L3
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-PYfbmR9wT3SHT+oFyQF2F13g7FgdvY/l9p0D65c/+RU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = ["sabctools"];
 
   passthru.tests = {inherit sabnzbd;};
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 0f6dd64690462..db1d0b3f0abd0 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.198.0";
+  version = "2.199.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "sagemaker-python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-iaO+wbMs2FsnPB3Y4zwC49fWqP/zHQGzGisxNtPxOUA=";
+    hash = "sha256-zAYO8zf3FpEI1sr6Iv9WP56NFmwYGH2dtRTSJhsSYC8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index 39a35038fb0ad..2e617fa8c3fc6 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "schema-salad";
-  version = "8.4.20230808163024";
+  version = "8.5.20231201181309";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ai4vv6EFX4yTR8sgRspiG+M8a8oa83LIlJPGX7q+Kd0=";
+    hash = "sha256-q4djcBt+8PEUekWNKlivKnDXrJBAUKGZ1252ym/E4bI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/schwifty/default.nix b/pkgs/development/python-modules/schwifty/default.nix
index 5344c1de3b4cb..9f07bb88d58e3 100644
--- a/pkgs/development/python-modules/schwifty/default.nix
+++ b/pkgs/development/python-modules/schwifty/default.nix
@@ -1,55 +1,63 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, importlib-resources
-, importlib-metadata
+
+# build-system
+, hatchling
+, hatch-vcs
+
+# dependencies
 , iso3166
 , pycountry
+
+# optional-dependencies
+, pydantic
+
+# tests
 , pytestCheckHook
 , pytest-cov
 , pythonOlder
-, setuptools
-, setuptools-scm
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "schwifty";
-  version = "2023.6.0";
+  version = "2023.11.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hDNAoITt2Ak5aVWmMgqg2oA9rDFsiuum5JXc7v7sspU=";
+    hash = "sha256-lyyAx8VDIRO72xW64gjcsZw2C31hV3YCLIGSmdlIJeI=";
   };
 
   nativeBuildInputs = [
-    setuptools
-    setuptools-scm
-    wheel
+    hatchling
+    hatch-vcs
   ];
 
   propagatedBuildInputs = [
     iso3166
     pycountry
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-resources
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    importlib-metadata
   ];
 
+  passthru.optional-dependencies = {
+    pydantic = [
+      pydantic
+    ];
+  };
+
   nativeCheckInputs = [
     pytest-cov
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "schwifty"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/mdomke/schwifty/blob/${version}/CHANGELOG.rst";
     description = "Validate/generate IBANs and BICs";
     homepage = "https://github.com/mdomke/schwifty";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/scikit-build/default.nix b/pkgs/development/python-modules/scikit-build/default.nix
index 5b868bb42a6fc..7ced95754fe51 100644
--- a/pkgs/development/python-modules/scikit-build/default.nix
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@@ -34,6 +34,12 @@ buildPythonPackage rec {
     hash = "sha256-tRpRo2s3xCZQmUtQR5EvWbIuMhCyPjIfKHYR+e9uXJ0=";
   };
 
+  patches = [
+    # https://github.com/scikit-build/scikit-build/pull/1032
+    # https://github.com/scikit-build/scikit-build/issues/1047
+    ./python312-compatibility.patch
+  ];
+
   # This line in the filterwarnings section of the pytest configuration leads to this error:
   #  E   UserWarning: Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.
   postPatch = ''
diff --git a/pkgs/development/python-modules/scikit-build/python312-compatibility.patch b/pkgs/development/python-modules/scikit-build/python312-compatibility.patch
new file mode 100644
index 0000000000000..8e86eccf010b7
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-build/python312-compatibility.patch
@@ -0,0 +1,40 @@
+diff --git a/skbuild/resources/cmake/FindPythonExtensions.cmake b/skbuild/resources/cmake/FindPythonExtensions.cmake
+index 59b30c2..62298d5 100644
+--- a/skbuild/resources/cmake/FindPythonExtensions.cmake
++++ b/skbuild/resources/cmake/FindPythonExtensions.cmake
+@@ -254,19 +254,23 @@ endif()
+ include(targetLinkLibrariesWithDynamicLookup)
+ 
+ set(_command "
+-import distutils.sysconfig
++import sys
++
++if sys.version_info >= (3,10):
++  import sysconfig
++else:
++  from distutils import sysconfig
+ import itertools
+ import os
+ import os.path
+ import site
+-import sys
+ 
+ result = None
+ rel_result = None
+ candidate_lists = []
+ 
+ try:
+-    candidate_lists.append((distutils.sysconfig.get_python_lib(),))
++    candidate_lists.append((sysconfig.get_python_lib(),))
+ except AttributeError: pass
+ 
+ try:
+@@ -293,7 +297,7 @@ sys.stdout.write(\";\".join((
+     sys.prefix,
+     result,
+     rel_result,
+-    distutils.sysconfig.get_config_var('EXT_SUFFIX')
++    sysconfig.get_config_var('EXT_SUFFIX')
+ )))
+ ")
+ 
diff --git a/pkgs/development/python-modules/scikit-hep-testdata/default.nix b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
index 520c83575005f..de78e1dc93604 100644
--- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix
+++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "scikit-hep-testdata";
-  version = "0.4.34";
+  version = "0.4.35";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -20,11 +20,9 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kHpJXqFQI3vtDJIcH2ebzbaReHecwItDh73/NcoPk9A=";
+    hash = "sha256-1SROsrl7zBaZRDju1M6wlKLZypk9OswA8kromiJGeqw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/scikit-image/default.nix b/pkgs/development/python-modules/scikit-image/default.nix
index 9d57c585c2fcd..f29f9870b26a5 100644
--- a/pkgs/development/python-modules/scikit-image/default.nix
+++ b/pkgs/development/python-modules/scikit-image/default.nix
@@ -43,7 +43,7 @@ let
     src = fetchFromGitHub {
       owner = "scikit-image";
       repo = "scikit-image";
-      rev = "v${version}";
+      rev = "refs/tags/v${version}";
       hash = "sha256-M18y5JBPf3DR7SlJcCf82nG2MzwILg2w1AhJMzZXslg=";
     };
 
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index 6a7c5fa705735..cd66ed54be76c 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -2,30 +2,36 @@
 , lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
+
+# build-system
+, cython
 , gfortran
-, glibcLocales
 , numpy
+, oldest-supported-numpy
 , scipy
+, setuptools
+
+# native dependencies
+, glibcLocales
+, llvmPackages
 , pytestCheckHook
 , pytest-xdist
 , pillow
-, cython
 , joblib
-, llvmPackages
 , threadpoolctl
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "scikit-learn";
-  version = "1.3.0";
-  format = "setuptools";
+  version = "1.3.2";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-i+VJiG9e2kZDa25VWw5Ic7TxCqIcB99FxLwXNa+8zXo=";
+    hash = "sha256-ovVMdqzMFaNL+5Bm5selbB5yNd2ldiuZB5IzC1LM+wU=";
   };
 
   buildInputs = [
@@ -38,19 +44,26 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     cython
     gfortran
+    numpy
+    oldest-supported-numpy
+    scipy
+    setuptools
   ];
 
   propagatedBuildInputs = [
+    joblib
     numpy
-    scipy
     numpy.blas
-    joblib
+    scipy
     threadpoolctl
   ];
 
-  nativeCheckInputs = [ pytestCheckHook pytest-xdist ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-xdist
+  ];
 
-  LC_ALL="en_US.UTF-8";
+  env.LC_ALL="en_US.UTF-8";
 
   preBuild = ''
     export SKLEARN_BUILD_PARALLEL=$NIX_BUILD_CORES
diff --git a/pkgs/development/python-modules/scikit-posthocs/default.nix b/pkgs/development/python-modules/scikit-posthocs/default.nix
index d7df6518903e0..17f0c2a1764e7 100644
--- a/pkgs/development/python-modules/scikit-posthocs/default.nix
+++ b/pkgs/development/python-modules/scikit-posthocs/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-posthocs";
-  version = "0.7.0";
+  version = "0.8.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "maximtrp";
     repo = "scikit-posthocs";
-    rev = "v${version}";
-    hash = "sha256-IkvAc684AWEK427OGAa4qVy6leWmd3b8Dnhd5bYAt5I=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ojXVrsZsvX7UytldcWkhOndix4by1uBeVpG7nQrcvmA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/scikit-rf/default.nix b/pkgs/development/python-modules/scikit-rf/default.nix
index a2cf6d82a35be..6ab88fea48b87 100644
--- a/pkgs/development/python-modules/scikit-rf/default.nix
+++ b/pkgs/development/python-modules/scikit-rf/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "scikit-rf";
-  version = "0.29.1";
+  version = "0.30.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "scikit-rf";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-sLE6rcBGUKmk5y7oO06rHON3GVIjcvnKlr6Tgddj64Y=";
+    hash = "sha256-rJjuraiTvCmZgz8ysFBbYPowkLIuwt8RaFNl+gDSfLk=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 2c5ecd42585c5..caca48153b72b 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -13,7 +13,6 @@
 , pkg-config
 , pythran
 , wheel
-, nose
 , pytestCheckHook
 , pytest-xdist
 , numpy
@@ -32,8 +31,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.11.3";
-  srcHash = "sha256-swxRfFjTcKjKQv6GFdWNR6IKhdJQYhZSR7UWLtcnrXw=";
+  version = "1.11.4";
+  srcHash = "sha256-hNAZOMDFYqZpb67Pzg/WALWagFYvqYO1jOmcipDDRbE=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
@@ -79,7 +78,7 @@ in buildPythonPackage {
   # Relax deps a bit
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'meson-python>=0.12.1,<0.14.0' 'meson-python' \
+      --replace 'meson-python>=0.12.1,<0.15.0' 'meson-python' \
       --replace 'numpy==' 'numpy>=' \
       --replace "pybind11>=2.10.4,<2.11.1" "pybind11>=2.10.4,<2.12.0" \
       --replace 'wheel<0.41.0' 'wheel'
@@ -109,7 +108,6 @@ in buildPythonPackage {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
-    nose
     pytestCheckHook
     pytest-xdist
   ];
@@ -214,6 +212,7 @@ in buildPythonPackage {
   SCIPY_USE_G77_ABI_WRAPPER = 1;
 
   meta = with lib; {
+    changelog = "https://github.com/scipy/scipy/releases/tag/v${version}";
     description = "SciPy (pronounced 'Sigh Pie') is open-source software for mathematics, science, and engineering";
     downloadPage = "https://github.com/scipy/scipy";
     homepage = "https://www.scipy.org/";
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index e30c367a1bdfb..281ff4cb18145 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -2,6 +2,8 @@
 , asyncssh
 , buildPythonPackage
 , dulwich
+, dvc-http
+, dvc-objects
 , fetchFromGitHub
 , fsspec
 , funcy
@@ -29,8 +31,6 @@ buildPythonPackage rec {
     hash = "sha256-P+Mbf8adSvQPkUgnTSPrqzvHc6lR0ns2mJ0/x9YGPKs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -39,6 +39,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     asyncssh
     dulwich
+    dvc-http
+    dvc-objects
     fsspec
     funcy
     gitpython
diff --git a/pkgs/development/python-modules/scooby/default.nix b/pkgs/development/python-modules/scooby/default.nix
index f1f6716c917f5..6140fd13323c7 100644
--- a/pkgs/development/python-modules/scooby/default.nix
+++ b/pkgs/development/python-modules/scooby/default.nix
@@ -38,8 +38,6 @@ buildPythonPackage rec {
     scipy
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   preCheck = ''
     export PATH="$PATH:$out/bin";
   '';
diff --git a/pkgs/development/python-modules/screed/default.nix b/pkgs/development/python-modules/screed/default.nix
index 307844854d87a..cc1b80153d3a6 100644
--- a/pkgs/development/python-modules/screed/default.nix
+++ b/pkgs/development/python-modules/screed/default.nix
@@ -18,7 +18,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [ setuptools-scm ];
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   pythonImportsCheck = [ "screed" ];
   checkInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/screenlogicpy/default.nix b/pkgs/development/python-modules/screenlogicpy/default.nix
index 020e6a43cb7dc..ad36d8d3347c3 100644
--- a/pkgs/development/python-modules/screenlogicpy/default.nix
+++ b/pkgs/development/python-modules/screenlogicpy/default.nix
@@ -2,6 +2,7 @@
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 , pytest-asyncio
 , setuptools
@@ -43,6 +44,12 @@ buildPythonPackage rec {
     "test_discovery_async_discover"
     "test_gateway_discovery"
     "test_gateway"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # Tests block on Python 3.12
+    "test_sub_unsub"
+    "test_attach_existing"
+    "test_login_async_connect_to_gateway"
+    "test_login_async_gateway_connect"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/seabreeze/default.nix b/pkgs/development/python-modules/seabreeze/default.nix
index 9101c654b9c6d..78750d84b24f9 100644
--- a/pkgs/development/python-modules/seabreeze/default.nix
+++ b/pkgs/development/python-modules/seabreeze/default.nix
@@ -1,13 +1,21 @@
 { lib
 , fetchFromGitHub
 , buildPythonPackage
-, cython
+
+# build-system
+, cython_3
 , git
 , pkgconfig
+, setuptools
 , setuptools-scm
-, future
+
+# dependneices
 , numpy
+
+# optional-dependenices
 , pyusb
+
+# tests
 , mock
 , pytestCheckHook
 , zipp
@@ -20,35 +28,35 @@
 
 buildPythonPackage rec {
   pname = "seabreeze";
-  version = "1.3.0";
-  format = "setuptools";
+  version = "2.5.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ap--";
     repo = "python-seabreeze";
-    rev = "v${version}";
-    sha256 = "1hm9aalpb9sdp8s7ckn75xvyiacp5678pv9maybm5nz0z2h29ibq";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-25rFGpfwJKj9lLDO/ZsqJ2NfCsgSSJghLZxffjX/+7w=";
     leaveDotGit = true;
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"pytest-runner",' ""
-  '';
-
   nativeBuildInputs = [
-    cython
+    cython_3
     git
     pkgconfig
+    setuptools
     setuptools-scm
   ];
 
   propagatedBuildInputs = [
-    future
     numpy
-    pyusb
   ];
 
+  passthru.optional-dependencies = {
+    pyseabreeze = [
+      pyusb
+    ];
+  };
+
   postInstall = ''
     mkdir -p $out/etc/udev/rules.d
     cp os_support/10-oceanoptics.rules $out/etc/udev/rules.d/10-oceanoptics.rules
@@ -59,7 +67,7 @@ buildPythonPackage rec {
     pytestCheckHook
     mock
     zipp
-  ];
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   setupPyBuildFlags = [ "--without-cseabreeze" ];
 
diff --git a/pkgs/development/python-modules/seatconnect/default.nix b/pkgs/development/python-modules/seatconnect/default.nix
index 981b2d7da8691..0acce07138e6d 100644
--- a/pkgs/development/python-modules/seatconnect/default.nix
+++ b/pkgs/development/python-modules/seatconnect/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-HITVrI0o94a61gy/TYSGFtLBYX4Rw/dK1o2/KsvHLTQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/securesystemslib/default.nix b/pkgs/development/python-modules/securesystemslib/default.nix
index 17689019a4065..ccc89a2900356 100644
--- a/pkgs/development/python-modules/securesystemslib/default.nix
+++ b/pkgs/development/python-modules/securesystemslib/default.nix
@@ -30,6 +30,11 @@ buildPythonPackage rec {
     hash = "sha256-REi38rIVZmWawFGcrPl9QzSthW4jHZDr/0ug7kJRz3Y=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "hatchling==1.18.0" "hatchling"
+  '';
+
   nativeBuildInputs = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/segno/default.nix b/pkgs/development/python-modules/segno/default.nix
index 3e7bb08164486..98c332af73895 100644
--- a/pkgs/development/python-modules/segno/default.nix
+++ b/pkgs/development/python-modules/segno/default.nix
@@ -1,10 +1,14 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 
 # build-system
 , setuptools
 
+# dependencies
+, importlib-metadata
+
 # tests
 , pytestCheckHook
 , pypng
@@ -13,26 +17,35 @@
 
 buildPythonPackage rec {
   pname = "segno";
-  version = "1.5.3";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "heuer";
     repo = "segno";
-    rev = version;
-    hash = "sha256-j7DUCeMoYziu19WfJu/9YiIMa2ysOPYfqW8AMcE5LaU=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-lgitNnVHvvPLKtDqJvc/zsVlFu9Gw0D3S4lt/20TlhE=";
   };
 
   nativeBuildInputs = [
     setuptools
   ];
 
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [
+    importlib-metadata
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
     pypng
     pyzbar
   ];
 
+  disabledTests = [
+    # https://github.com/heuer/segno/issues/132
+    "test_plugin"
+  ];
+
   pythonImportsCheck = [
     "segno"
   ];
diff --git a/pkgs/development/python-modules/segyio/default.nix b/pkgs/development/python-modules/segyio/default.nix
index 8f73ebd5e5ae5..fb1f4d28e6165 100644
--- a/pkgs/development/python-modules/segyio/default.nix
+++ b/pkgs/development/python-modules/segyio/default.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "segyio";
-  version = "1.9.11";
+  version = "1.9.12";
 
   postPatch = ''
     # Removing unecessary build dependency
@@ -26,8 +26,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "equinor";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-4izeMRgg5nJ9pRfSEMDlKSYYNWkhbKEzIz7czea6Vrc=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-+N2JvHBxpdbysn4noY/9LZ4npoQ9143iFEzaxoafnms=";
   };
 
   nativeBuildInputs = [ cmake ninja python scikit-build ];
diff --git a/pkgs/development/python-modules/selenium/default.nix b/pkgs/development/python-modules/selenium/default.nix
index 086c53108976e..5a5c4304c636a 100644
--- a/pkgs/development/python-modules/selenium/default.nix
+++ b/pkgs/development/python-modules/selenium/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "selenium";
-  version = "4.14.0";
+  version = "4.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     repo = "selenium";
     # check if there is a newer tag with or without -python suffix
     rev = "refs/tags/selenium-${version}";
-    hash = "sha256-cTMCKfFLUlJDbTUQA3Z/pKCE1RQQRMb4K8hKKn9HqvU=";
+    hash = "sha256-AacpHZw6N6RruuBO+bZ3/cxOODe9VPGblKmIm1ffqrc=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/semver/default.nix b/pkgs/development/python-modules/semver/default.nix
index c33db77b72d23..3c752df0a62a4 100644
--- a/pkgs/development/python-modules/semver/default.nix
+++ b/pkgs/development/python-modules/semver/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "semver";
-  version = "3.0.1";
+  version = "3.0.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "python-semver";
     repo = "python-semver";
     rev = "refs/tags/${version}";
-    hash = "sha256-vVi0+Pq8VpYMy73JSrvi9ranOzvFaHpcPZRt8gMkkFs=";
+    hash = "sha256-772PSUq1dqtn9aOol+Bo0S0OItBmoiCNP8q/YCBvKU4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 90fd136996b39..a4027953796bc 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -4,7 +4,6 @@
 , apache-beam
 , asttokens
 , blinker
-, botocore
 , bottle
 , buildPythonPackage
 , celery
@@ -15,13 +14,11 @@
 , falcon
 , fetchFromGitHub
 , flask
-, flask-login
 , gevent
 , httpx
 , jsonschema
 , mock
 , pure-eval
-, pyramid
 , pyrsistent
 , pyspark
 , pysocks
@@ -32,17 +29,16 @@
 , pythonOlder
 , rq
 , sanic
+, setuptools
 , sqlalchemy
 , tornado
-, trytond
 , urllib3
-, werkzeug
 }:
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
   version = "1.39.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -53,6 +49,10 @@ buildPythonPackage rec {
     hash = "sha256-tYfnQ6L91KrRCR32dgzcDtA7eO+LHRAHBklxU8cXkK8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     certifi
     urllib3
diff --git a/pkgs/development/python-modules/setproctitle/default.nix b/pkgs/development/python-modules/setproctitle/default.nix
index 09d29ad34533a..dfbee6e92469d 100644
--- a/pkgs/development/python-modules/setproctitle/default.nix
+++ b/pkgs/development/python-modules/setproctitle/default.nix
@@ -2,25 +2,34 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "setproctitle";
-  version = "1.3.2";
-  format = "setuptools";
+  version = "1.3.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ufuXkHyDDSYPoGWO1Yr9SKhrK4iqxSETXDUv9/00d/0=";
+    hash = "sha256-yRPhUefqAVZ4N/8DeiPKh0AZKIAZi3+7kLFtGBYHyq4=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   # tries to compile programs with dependencies that aren't available
-  pytestFlagsArray = [ "--ignore=tests/setproctitle_test.py" ];
+  disabledTestPaths = [
+    "tests/setproctitle_test.py"
+  ];
 
   meta = with lib; {
     description = "Allows a process to change its title (as displayed by system tools such as ps and top)";
diff --git a/pkgs/development/python-modules/setuptools-generate/default.nix b/pkgs/development/python-modules/setuptools-generate/default.nix
index e4293bd118cd5..9f2b71697e9bb 100644
--- a/pkgs/development/python-modules/setuptools-generate/default.nix
+++ b/pkgs/development/python-modules/setuptools-generate/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-xDjxkWy/n0jStI9eLcM6WduyU9vGjtBOmJ86dpXjceQ=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/setuptools-gettext/default.nix b/pkgs/development/python-modules/setuptools-gettext/default.nix
index 725c71eeafdc3..aff7572d3f62b 100644
--- a/pkgs/development/python-modules/setuptools-gettext/default.nix
+++ b/pkgs/development/python-modules/setuptools-gettext/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "setuptools-gettext";
-  version = "0.1.5";
+  version = "0.1.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "breezy-team";
     repo = "setuptools-gettext";
     rev = "refs/tags/v${version}";
-    hash = "sha256-16kzKB0xq3ApQlGQYp12oB7K99QCQMUwqpP54QiI3gg=";
+    hash = "sha256-R1zgE1Ai2r23bve+sKo27XkUcIAmlWSreHZNt5yh2DY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/setuptools-odoo/default.nix b/pkgs/development/python-modules/setuptools-odoo/default.nix
index 5e262daa580e3..5a6a9ac88819f 100644
--- a/pkgs/development/python-modules/setuptools-odoo/default.nix
+++ b/pkgs/development/python-modules/setuptools-odoo/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
   ];
 
   # HACK https://github.com/NixOS/nixpkgs/pull/229460
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   patchPhase = ''
     runHook prePatch
 
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index e1c04780b8e82..ddfcdcb4f67ba 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.7.0";
+  version = "1.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xxAJmZSCNaOK5+VV/hmapmwlPcOEsSX12FRzv4Hq46M=";
+    hash = "sha256-lLHdXVMIsxONW5M8OitV5taSfRoiYy5Qn86p3dD35IY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/setuptools-scm-git-archive/default.nix b/pkgs/development/python-modules/setuptools-scm-git-archive/default.nix
index 7e555298907aa..c5b9808440c85 100644
--- a/pkgs/development/python-modules/setuptools-scm-git-archive/default.nix
+++ b/pkgs/development/python-modules/setuptools-scm-git-archive/default.nix
@@ -1,30 +1,45 @@
-{ lib, buildPythonPackage, fetchPypi, setuptools-scm, pytestCheckHook }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "setuptools-scm-git-archive";
-  version = "1.4";
-  format = "setuptools";
+  version = "1.4.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "setuptools_scm_git_archive";
-    sha256 = "b048b27b32e1e76ec865b0caa4bb85df6ddbf4697d6909f567ac36709f6ef2f0";
+    hash = "sha256-xBi8d7OXTTrGXyaPBY8j4B3F+ZHyIzEosOFqad4iewk=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pytestFlagsArray = [
     "tests.py"
   ];
 
-  pythonImportsCheck = [ "setuptools_scm_git_archive" ];
+  pythonImportsCheck = [
+    "setuptools_scm_git_archive"
+  ];
 
   meta = with lib; {
     description = "setuptools_scm plugin for git archives";
     homepage = "https://github.com/Changaco/setuptools_scm_git_archive";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
+    # https://github.com/Changaco/setuptools_scm_git_archive/pull/22
+    broken = versionAtLeast setuptools-scm.version "8";
   };
 }
diff --git a/pkgs/development/python-modules/setuptools-scm/default.nix b/pkgs/development/python-modules/setuptools-scm/default.nix
index 36373efda5302..01a1f0ff0d4b4 100644
--- a/pkgs/development/python-modules/setuptools-scm/default.nix
+++ b/pkgs/development/python-modules/setuptools-scm/default.nix
@@ -1,29 +1,35 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , callPackage
 , fetchPypi
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
 , packaging
 , typing-extensions
 , tomli
-, setuptools
-, pythonOlder
-, lib
+
+# optional-dependencies
+, rich
 }:
 
 buildPythonPackage rec {
   pname = "setuptools-scm";
-  version = "7.1.0";
-  format = "pyproject";
+  version = "8.0.4";
+  pyproject = true;
 
   src = fetchPypi {
-    pname = "setuptools_scm";
-    inherit version;
-    hash = "sha256-bFCDRadxqtfVbr/w5wYovysOx1c3Yr6ZYCFHMN4njyc=";
+    inherit pname version;
+    hash = "sha256-tfQ/9oAGaVlRk/0JiRVk7p0dfcsZbKtLJQbVOi4clcc=";
   };
 
   nativeBuildInputs = [
-    packaging
     setuptools
-    typing-extensions
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    tomli
   ];
 
   propagatedBuildInputs = [
@@ -34,6 +40,12 @@ buildPythonPackage rec {
     tomli
   ];
 
+  passthru.optional-dependencies = {
+    rich = [
+      rich
+    ];
+  };
+
   pythonImportsCheck = [
     "setuptools_scm"
   ];
@@ -45,7 +57,10 @@ buildPythonPackage rec {
     pytest = callPackage ./tests.nix { };
   };
 
+  setupHook = ./setup-hook.sh;
+
   meta = with lib; {
+    changelog = "https://github.com/pypa/setuptools_scm/blob/${version}/CHANGELOG.md";
     homepage = "https://github.com/pypa/setuptools_scm/";
     description = "Handles managing your python package versions in scm metadata";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/setuptools-scm/setup-hook.sh b/pkgs/development/python-modules/setuptools-scm/setup-hook.sh
new file mode 100644
index 0000000000000..f8c30f91ca07b
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools-scm/setup-hook.sh
@@ -0,0 +1,32 @@
+# Let built package know its version.
+# Usually, when a package uses setuptools-scm as a build-time dependency, it
+# expects to get the package version from SCM data. However, while doing a nix
+# build, the source tree doesn't contain SCM data, so we should almost always
+# get the version from the derivation attribute.
+version-pretend-hook() {
+    if [ -z "$dontPretendSetuptoolsSCMVersion" -a -z "$SETUPTOOLS_SCM_PRETEND_VERSION" ]; then
+        echo Setting SETUPTOOLS_SCM_PRETEND_VERSION to $version
+        export SETUPTOOLS_SCM_PRETEND_VERSION="$version"
+    fi
+}
+
+# Include all tracked files.
+# When a package uses setuptools-scm as a build-time dependency, it usually
+# expects it to include all scm-tracked files in the built package, by default.
+# This is the official setuptools-scm behavior, documented in
+# https://setuptools-scm.readthedocs.io/en/latest/usage/#file-finders-hook-makes-most-of-manifestin-unnecessary
+# and https://setuptools.pypa.io/en/latest/userguide/datafiles.html.
+# However, while doing a nix build, the source tree doesn't contain SCM data,
+# so it would include only `.py` files by default.
+# We generate a MANIFEST.in automatically that includes all tracked files to
+# emulate this behavior of setuptools-scm.
+include-tracked-files-hook() {
+    if [ -z "$dontIncludeSetuptoolsSCMTrackedFiles" ]; then
+        echo Including all tracked files automatically
+        old_manifest="$(if [ -f MANIFEST.in ]; then cat MANIFEST.in; fi)"
+        echo 'global-include **' > MANIFEST.in
+        echo "$old_manifest" >> MANIFEST.in
+    fi
+}
+
+preBuildHooks+=(version-pretend-hook include-tracked-files-hook)
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 93912d4b4ad31..231580cf9675e 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "setuptools";
-  version = "68.2.2";
+  version = "69.0.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "setuptools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PpZbITlYp/cA+8jmObw8g69TK+oE9YEXD3NNJixExB4=";
+    hash = "sha256-7xOZC85glpXPKdPTYOpwjQHRpkKL1hgbMFgJF3q5EW0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/shazamio/default.nix b/pkgs/development/python-modules/shazamio/default.nix
index ee1616f7b775d..05c9784b367f1 100644
--- a/pkgs/development/python-modules/shazamio/default.nix
+++ b/pkgs/development/python-modules/shazamio/default.nix
@@ -72,5 +72,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/dotX12/ShazamIO/releases/tag/${src.rev}";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/shellingham/default.nix b/pkgs/development/python-modules/shellingham/default.nix
index ee368852422a7..71b5d5e438bf4 100644
--- a/pkgs/development/python-modules/shellingham/default.nix
+++ b/pkgs/development/python-modules/shellingham/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "shellingham";
-  version = "1.5.1";
+  version = "1.5.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sarugaku";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-7hMlKw9oSGp57FQmbxdAgUsm5cFRr1oTW1ymJyYsgOg=";
+    hash = "sha256-xeBo3Ok+XPrHN4nQd7M8/11leSV/8z1f7Sj33+HFVtQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/shtab/default.nix b/pkgs/development/python-modules/shtab/default.nix
index e50717d5a8079..ebfbd86aeb03a 100644
--- a/pkgs/development/python-modules/shtab/default.nix
+++ b/pkgs/development/python-modules/shtab/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "shtab";
-  version = "1.6.4";
+  version = "1.6.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,11 +20,9 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BMwi3a7CPq58G30XlkJdSfSP6oc6u2AuSPAwEExI9zM=";
+    hash = "sha256-jplcKVXWogSrYRGch0qypWGNzO9HErR5B9S1iT4eFcM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov=shtab --cov-report=term-missing --cov-report=xml" ""
diff --git a/pkgs/development/python-modules/sigstore/default.nix b/pkgs/development/python-modules/sigstore/default.nix
new file mode 100644
index 0000000000000..ae64e1eb057bc
--- /dev/null
+++ b/pkgs/development/python-modules/sigstore/default.nix
@@ -0,0 +1,74 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# build-system
+, flit-core
+
+# dependencies
+, appdirs
+, cryptography
+, id
+, importlib-resources
+, pydantic
+, pyjwt
+, pyopenssl
+, requests
+, rich
+, securesystemslib
+, sigstore-protobuf-specs
+, sigstore-rekor-types
+, tuf
+
+# tests
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "sigstore-python";
+  version = "2.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sigstore";
+    repo = "sigstore-python";
+    rev = "v${version}";
+    hash = "sha256-WH6Pme8ZbfW5xqBT056eVJ3HZP1D/lAULtyN6k0uMaA=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    appdirs
+    cryptography
+    id
+    importlib-resources
+    pydantic
+    pyjwt
+    pyopenssl
+    requests
+    rich
+    securesystemslib
+    sigstore-protobuf-specs
+    sigstore-rekor-types
+    tuf
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sigstore"
+  ];
+
+  meta = with lib; {
+    description = "A codesigning tool for Python packages";
+    homepage = "https://github.com/sigstore/sigstore-python";
+    changelog = "https://github.com/sigstore/sigstore-python/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index 03acfc90c5d8d..59a24e96feb01 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -4,6 +4,7 @@
 , backoff
 , beautifulsoup4
 , buildPythonPackage
+, certifi
 , docutils
 , fetchFromGitHub
 , poetry-core
@@ -40,6 +41,7 @@ buildPythonPackage rec {
     aiohttp
     backoff
     beautifulsoup4
+    certifi
     docutils
     pytz
     voluptuous
diff --git a/pkgs/development/python-modules/simpy/default.nix b/pkgs/development/python-modules/simpy/default.nix
index e1544a0b89a64..91b1b6c7002ee 100644
--- a/pkgs/development/python-modules/simpy/default.nix
+++ b/pkgs/development/python-modules/simpy/default.nix
@@ -5,26 +5,24 @@
 , setuptools
 , setuptools-scm
 , py
-, pytestCheckHook }:
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "simpy";
-  version = "4.0.2";
-  format = "setuptools";
+  version = "4.1.1";
+  pyproject = true;
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-bYrcAinfawL7fibc0TOHA7T09j8WelrCpyE8uAq6RIQ=";
+    hash = "sha256-BtB1CniEsR4OjiDOC8fG1O1fF0PUVmlTQNE/3/lQAaY=";
   };
 
   nativeBuildInputs = [
-    setuptools-scm
-  ];
-
-  propagatedBuildInputs = [
     setuptools
+    setuptools-scm
   ];
 
   nativeCheckInputs = [
@@ -33,6 +31,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    downloadPage = "https://github.com/simpx/simpy";
     homepage = "https://simpy.readthedocs.io/en/${version}/";
     description = "Process-based discrete-event simulation framework based on standard Python";
     license = [ licenses.mit ];
diff --git a/pkgs/development/python-modules/sip/default.nix b/pkgs/development/python-modules/sip/default.nix
index ec9c843dc885e..4053e20a08d09 100644
--- a/pkgs/development/python-modules/sip/default.nix
+++ b/pkgs/development/python-modules/sip/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "sip";
-  version = "6.7.12";
+  version = "6.8.0";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-COZvdCWS64GKyP2kFz4u1kyfLUC3C+4R2xxJkSfZhFA=";
+    hash = "sha256-LtGQSCDLZhtyB+sdzPrr7BpUY9ytkDukSK0ZRVAtCJw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/smbprotocol/default.nix b/pkgs/development/python-modules/smbprotocol/default.nix
index 471f02e50bd86..f72eef539134d 100644
--- a/pkgs/development/python-modules/smbprotocol/default.nix
+++ b/pkgs/development/python-modules/smbprotocol/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "smbprotocol";
-  version = "1.11.0";
+  version = "1.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "jborean93";
     repo = "smbprotocol";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MhkeizBorDAlTLrvbsuzvrwrbBZv/dYA7Khvg/FrKoI=";
+    hash = "sha256-1huM+/WDrVJsB4ARh6fB6rLFOe9IqSQWr/A78FAk/Ag=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/smmap/default.nix b/pkgs/development/python-modules/smmap/default.nix
index 5cfc8917a8c1d..70b538e43fa04 100644
--- a/pkgs/development/python-modules/smmap/default.nix
+++ b/pkgs/development/python-modules/smmap/default.nix
@@ -1,15 +1,27 @@
-{ lib, fetchPypi, buildPythonPackage, nosexcover }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, setuptools
+, nosexcover
+}:
 
 buildPythonPackage rec {
   pname = "smmap";
-  version = "5.0.0";
-  format = "setuptools";
+  version = "6.0.0";
+  pyproject = true;
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c840e62059cd3be204b0c9c9f74be2c09d5648eddd4580d9314c3ecde0b30936";
+    hash = "sha256-jXkCjqbMEx2l6rCZpdlamY1DxneZVv/+O0VQQJEQdto=";
   };
 
-  nativeCheckInputs = [ nosexcover ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    nosexcover
+  ];
 
   meta = {
     description = "A pure python implementation of a sliding window memory map manager";
diff --git a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
index 41f7c2e10c3d7..d8857b971a31a 100644
--- a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "snowflake-sqlalchemy";
-  version = "1.5.0";
+  version = "1.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PtD3fQnIqd79NcYFdDMlpNwhCY6PHGL/wDR/QnKdsFo=";
+    hash = "sha256-TxODQC/8iTEZdL2BDe4iADrvSvDzEqD9tVd4MzrRq/c=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/snscrape/default.nix b/pkgs/development/python-modules/snscrape/default.nix
index cb07518e95d7d..cb39e27373a7f 100644
--- a/pkgs/development/python-modules/snscrape/default.nix
+++ b/pkgs/development/python-modules/snscrape/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-9xAUMr1SWFePEvIz6DFEexk9Txex3u8wPNfMAdxEUCA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/snuggs/default.nix b/pkgs/development/python-modules/snuggs/default.nix
index 17b2c4bd8f3ce..8824645973ede 100644
--- a/pkgs/development/python-modules/snuggs/default.nix
+++ b/pkgs/development/python-modules/snuggs/default.nix
@@ -1,6 +1,12 @@
-{ buildPythonPackage, lib, fetchFromGitHub
-, click, numpy, pyparsing
-, pytest, hypothesis
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, click
+, numpy
+, pyparsing
+, pytestCheckHook
+, hypothesis
 }:
 
 buildPythonPackage rec {
@@ -16,10 +22,18 @@ buildPythonPackage rec {
     sha256 = "1p3lh9s2ylsnrzbs931y2vn7mp2y2xskgqmh767c9l1a33shfgwf";
   };
 
+  patches = [
+    # Use non-strict xfail for failing tests
+    # https://github.com/mapbox/snuggs/pull/28
+    (fetchpatch {
+      url = "https://github.com/sebastic/snuggs/commit/3b8e04a35ed33a7dd89f0194542b22c7bde867f4.patch";
+      hash = "sha256-SfW4l4BH94rPdskRVHEsZM0twmlV9IPftRU/BBZsjBU=";
+    })
+  ];
+
   propagatedBuildInputs = [ click numpy pyparsing ];
 
-  nativeCheckInputs = [ pytest hypothesis ];
-  checkPhase = "pytest test_snuggs.py";
+  nativeCheckInputs = [ pytestCheckHook hypothesis ];
 
   meta = with lib; {
     description = "S-expressions for Numpy";
diff --git a/pkgs/development/python-modules/social-auth-core/default.nix b/pkgs/development/python-modules/social-auth-core/default.nix
index d81101ac9a9dc..e92218f0dfea3 100644
--- a/pkgs/development/python-modules/social-auth-core/default.nix
+++ b/pkgs/development/python-modules/social-auth-core/default.nix
@@ -14,12 +14,13 @@
 , pythonOlder
 , requests
 , requests-oauthlib
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "social-auth-core";
-  version = "4.5.0";
-  format = "setuptools";
+  version = "4.5.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -27,9 +28,13 @@ buildPythonPackage rec {
     owner = "python-social-auth";
     repo = "social-core";
     rev = "refs/tags/${version}";
-    hash = "sha256-5WEXXLl0IUPMbji8bWjTbAjY8VSLOTQvrfSCE9+ui5Y=";
+    hash = "sha256-yji10s3oHwUcKUs1njctkkmODyQRgiQDSRqolJFTifw=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     cryptography
     defusedxml
diff --git a/pkgs/development/python-modules/soxr/default.nix b/pkgs/development/python-modules/soxr/default.nix
index 941b6e596a2f0..b5d01a5ddbb2c 100644
--- a/pkgs/development/python-modules/soxr/default.nix
+++ b/pkgs/development/python-modules/soxr/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-H2sueQq32o/9EHENANKVoiWlFoSF88P0LZ7DfEh/Esg=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     cython_3
     gnutar
diff --git a/pkgs/development/python-modules/spdx-tools/default.nix b/pkgs/development/python-modules/spdx-tools/default.nix
index 06faf6ca261fd..415534bff531f 100644
--- a/pkgs/development/python-modules/spdx-tools/default.nix
+++ b/pkgs/development/python-modules/spdx-tools/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-KB+tfuz0ZnoQcMX3H+IZXjcmPZ4x2ecl8ofz1/3r0/8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/spectral-cube/default.nix b/pkgs/development/python-modules/spectral-cube/default.nix
index f0eda6956e2cb..007528e228659 100644
--- a/pkgs/development/python-modules/spectral-cube/default.nix
+++ b/pkgs/development/python-modules/spectral-cube/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-gJzrr3+/FsQN/HHDERxf/NECArwOaTqFwmI/Q2Z9HTM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index 59f832b999d64..7fff4b80debd2 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "sphinx-autodoc-typehints";
-  version = "1.24.1";
+  version = "1.25.2";
 in
 
 buildPythonPackage {
@@ -22,7 +22,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "sphinx_autodoc_typehints";
     inherit version;
-    hash = "sha256-Bmg6K3bDx7GTG3XkDgIRhm+7ULpMToAtCQHZtOhJrdI=";
+    hash = "sha256-PKvCU34XmJsvkuZKOZQlxMi/Vh7XPwh7x0FKUANhalA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-mdinclude/default.nix b/pkgs/development/python-modules/sphinx-mdinclude/default.nix
index d20446e91bb04..64928f4379081 100644
--- a/pkgs/development/python-modules/sphinx-mdinclude/default.nix
+++ b/pkgs/development/python-modules/sphinx-mdinclude/default.nix
@@ -1,11 +1,17 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
+
+# build-system
 , flit-core
+
+# dependencies
 , docutils
 , mistune
 , pygments
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -19,13 +25,24 @@ buildPythonPackage rec {
     hash = "sha256-KZjj0YswIsmYPRtyGR/jfiX/zNVBZcvjrLIszu3ZGvQ=";
   };
 
-  nativeBuildInputs = [ flit-core ];
-  propagatedBuildInputs = [ mistune docutils ];
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    docutils
+    mistune
+    pygments
+  ];
 
-  nativeCheckInputs = [ pygments ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/miyakogi/m2r";
+    broken = true; # https://github.com/omnilib/sphinx-mdinclude/issues/22
+    homepage = "https://github.com/omnilib/sphinx-mdinclude";
+    changelog = "https://github.com/omnilib/sphinx-mdinclude/blob/v${version}/CHANGELOG.md";
     description = "Sphinx extension for including or writing pages in Markdown format.";
     longDescription = ''
       A simple Sphinx extension that enables including Markdown documents from within
diff --git a/pkgs/development/python-modules/sphinx-prompt/default.nix b/pkgs/development/python-modules/sphinx-prompt/default.nix
index 776752d74c459..4d96a831d6263 100644
--- a/pkgs/development/python-modules/sphinx-prompt/default.nix
+++ b/pkgs/development/python-modules/sphinx-prompt/default.nix
@@ -1,9 +1,19 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonRelaxDepsHook
+
+# build-system
 , poetry-core
 , poetry-dynamic-versioning
+
+# dependencies
+, docutils
+, pygments
 , sphinx
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -26,9 +36,27 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     poetry-core
     poetry-dynamic-versioning
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "docutils"
+    "pygments"
+    "Sphinx"
+  ];
+
+  propagatedBuildInputs = [
+    docutils
+    pygments
+    sphinx
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  propagatedBuildInputs = [ sphinx ];
+  # versions >=1.8.0 cannot be build from source
+  passthru.skipBulkUpdate = true;
 
   meta = with lib; {
     description = "A sphinx extension for creating unselectable prompt";
diff --git a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
index fe056b3e70bca..1e8e0cd4b1e71 100644
--- a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
+++ b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "sphinx-rtd-theme";
-  version = "1.3.0";
+  version = "2.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "sphinx_rtd_theme";
     inherit version;
-    hash = "sha256-WQsDDHq7nPA47AU7leU4C1xw1hWR6wtVIGP758QfCTE=";
+    hash = "sha256-vV17gGIkBnYgc6BO+PrcX5FRJhVj1HAn3gmRDOA6/ms=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 6dac59106f5f2..90dfcb1e6ef64 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -100,6 +100,11 @@ buildPythonPackage rec {
   disabledTests = [
     # requires network access
     "test_latex_images"
+    # racy
+    "test_defaults"
+    "test_check_link_response_only"
+    "test_anchors_ignored_for_url"
+    "test_autodoc_default_options"
   ] ++ lib.optionals isPyPy [
     # PyPy has not __builtins__ which get asserted
     # https://doc.pypy.org/en/latest/cpython_differences.html#miscellaneous
diff --git a/pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix b/pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix
index 3e8fe11d192fe..8a47fc39c5d74 100644
--- a/pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix b/pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix
index b254d4b64327b..8d326fe1e0f92 100644
--- a/pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix b/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
index 56fae964eca0c..5a6b90fd3454a 100644
--- a/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix b/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
index 16c57f5886b78..fef662c85daef 100644
--- a/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
@@ -26,9 +26,10 @@ buildPythonPackage rec {
       hash = "sha256-dc9bhr/af3NmrIfoVabM1lNpXbGVsJoj7jq0E1BAtHw=";
     })
     (fetchpatch {
-      name = "fix-tests-with-sphinx7.2.patch";
-      url = "https://github.com/sphinx-contrib/jquery/commit/03f1595b3793e087a407933fbcb757bdd3f558fc.patch";
-      hash = "sha256-4gNG1DL/63N2FwXDy5fMApZpf/AGOGBruwPuVqgnVkc=";
+      # https://github.com/sphinx-contrib/jquery/pull/28
+      name = "fix-tests-with-sphinx7.2-and-python312.patch";
+      url = "https://github.com/sphinx-contrib/jquery/commit/3318a82854fccec528cd73e12ab2ab96d8e71064.patch";
+      hash = "sha256-pNeKE50sm4b/KhNDAEQ3oJYGV4I8CVHnbR76z0obT3E=";
     })
   ];
 
diff --git a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
index 30c94a088fbff..9420c9882cbd2 100644
--- a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-katex";
-  version = "0.9.7";
+  version = "0.9.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OmdUsc/JDhQeP3Pgg16vyCYtpfr+ekxnT6cI+rec69c=";
+    hash = "sha256-1ZTILfVLBI1Z1I5GsQn2IhezEaublSCMq5bZAvmj/ik=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix b/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
index 7fd16c67bdd46..3cba5c5011da6 100644
--- a/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
@@ -33,8 +33,6 @@ buildPythonPackage rec {
     sphinxcontrib-httpdomain
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix b/pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix
index d526f8aad8ee6..e098f7c919bdb 100644
--- a/pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix b/pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix
index 4604eec5f1842..0f06dce774c51 100644
--- a/pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-websupport/default.nix b/pkgs/development/python-modules/sphinxcontrib-websupport/default.nix
index bd9ae779c081a..fec28e068154a 100644
--- a/pkgs/development/python-modules/sphinxcontrib-websupport/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-websupport/default.nix
@@ -26,6 +26,8 @@ buildPythonPackage rec {
     sphinxcontrib-serializinghtml
   ];
 
+  # circular dependency on sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxext-opengraph/default.nix b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
index 58312bdce739c..570cf5b95b599 100644
--- a/pkgs/development/python-modules/sphinxext-opengraph/default.nix
+++ b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-B+bJ1tKqTTlbNeJLxk56o2a21n3Yg6OHwJiFfCx46aw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index a05a02966e07a..5015535680fb0 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -27,6 +27,7 @@
 , pypemicro
 , pyserial
 , ruamel-yaml
+, setuptools
 , sly
 , spsdk
 , testers
@@ -37,18 +38,19 @@
 
 buildPythonPackage rec {
   pname = "spsdk";
-  version = "1.11.0";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nxp-mcuxpresso";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-B3qedAXSG3A8rcWu1O2GnZ1ZqHN+7fQK43qXzGnDEY0=";
+    hash = "sha256-1aW5ivdpnSscTaMIRn4tlsBG6StN95gHAyRIzmAO9Uo=";
   };
 
   nativeBuildInputs = [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix b/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
index 1821ed3ef8dfb..54422df03e5a6 100644
--- a/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-4zLXB3UQh6pgQ80KrxkLeC5yiv1R8t2+JmSukmGXr7I=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index ffa9c12755b05..9ea29db26c8dc 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -52,6 +52,10 @@ buildPythonPackage rec {
     hash = "sha256-ldBn+pdZfqnBKdYkOcG47ScH/hBgeJBeIvn1hCIBw/A=";
   };
 
+  postPatch = ''
+    sed -i '/tag_build = dev/d' setup.cfg
+  '';
+
   nativeBuildInputs =[
     setuptools
   ] ++ lib.optionals (!isPyPy) [
diff --git a/pkgs/development/python-modules/sqlglot/default.nix b/pkgs/development/python-modules/sqlglot/default.nix
index b0bb24399122b..76c6027fca4b1 100644
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-aImshQ5jf0k62ucpK4X8G7uHGAFQkhGgjMYo4mvSvew=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   # optional dependency used in the sqlglot optimizer
diff --git a/pkgs/development/python-modules/sqltrie/default.nix b/pkgs/development/python-modules/sqltrie/default.nix
index 65470114c14f5..6c8ee069a8cfe 100644
--- a/pkgs/development/python-modules/sqltrie/default.nix
+++ b/pkgs/development/python-modules/sqltrie/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-QR5IlMHrDNsauKW3VQG0ibMUwetATuwX4fszGPzKuxg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/ssdp/default.nix b/pkgs/development/python-modules/ssdp/default.nix
index 295ebc98a9415..cc7c4e5667dff 100644
--- a/pkgs/development/python-modules/ssdp/default.nix
+++ b/pkgs/development/python-modules/ssdp/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-mORjMEg7Q/2CKZBLICSGF8dcdl98S6mBgJ4jujPGs6M=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "--cov" ""
diff --git a/pkgs/development/python-modules/sshfs/default.nix b/pkgs/development/python-modules/sshfs/default.nix
index 07c8f6a6c5849..c9550c57715ba 100644
--- a/pkgs/development/python-modules/sshfs/default.nix
+++ b/pkgs/development/python-modules/sshfs/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-6MueDHR+jZFDZg4zufEVhBtSwcgDd7KnW9gJp2hDu0A=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/stack-data/default.nix b/pkgs/development/python-modules/stack-data/default.nix
index 370aaf8746f96..d6cbacf3abd08 100644
--- a/pkgs/development/python-modules/stack-data/default.nix
+++ b/pkgs/development/python-modules/stack-data/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-brXFrk1UU5hxCVeRvGK7wzRA0Hoj9fgqoxTIwInPrEc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     git
     setuptools-scm
diff --git a/pkgs/development/python-modules/stanio/default.nix b/pkgs/development/python-modules/stanio/default.nix
index 83fcc79031071..daf889dba6889 100644
--- a/pkgs/development/python-modules/stanio/default.nix
+++ b/pkgs/development/python-modules/stanio/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "stanio";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DFBK5nG41Sah2nEYWsAqJ3VQj/5tPbkfJC6shbz2BG8=";
+    hash = "sha256-i1hqwUs1zeGq0Yjb+FgkUVxoQtyVGitBHdE4+1w1/J8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index acac9c99f13ab..137bd59c703c7 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.31.1";
+  version = "0.32.0.post1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Tq414cEpXX8MQDR0KYyB+J7lFqorbiwP/sGnUFvs7wA=";
+    hash = "sha256-1twyN3fSlxwfDtyqaFFuCAVehLZ8vCV4voCT7CVSEbk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/starline/default.nix b/pkgs/development/python-modules/starline/default.nix
index cdaca053ee1da..3ec25b5061e8b 100644
--- a/pkgs/development/python-modules/starline/default.nix
+++ b/pkgs/development/python-modules/starline/default.nix
@@ -2,14 +2,13 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
-, fetchpatch
 , setuptools
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "starline";
-  version = "0.1.5";
+  version = "0.2.0";
 
   disabled = pythonOlder "3.5";
 
@@ -17,17 +16,9 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-F1P1/NKml2rtd1r7A/g5IVnwQMZzkXzAxjRRDZXBPLk=";
+    hash = "sha256-VQsAq5XPWdkz93CKurQKTkHleQ5itlNHGv6Go68zIOY=";
   };
 
-  patches = [
-    # https://github.com/Anonym-tsk/starline/pull/5
-    (fetchpatch {
-      url = "https://github.com/Anonym-tsk/starline/commit/4e6cdf8e05c5fb8509ee384e77b39a2495587160.patch";
-      hash = "sha256-y9b6ePH3IEgmt3ALHQGwH102rlm4KfmH4oIoIC93cWU=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/steamship/default.nix b/pkgs/development/python-modules/steamship/default.nix
index bd430bedd3e9e..3501f9f4d85e0 100644
--- a/pkgs/development/python-modules/steamship/default.nix
+++ b/pkgs/development/python-modules/steamship/default.nix
@@ -58,5 +58,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/steamship-core/python-client/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ natsukium ];
+    # https://github.com/steamship-core/python-client/issues/503
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/stestr/default.nix b/pkgs/development/python-modules/stestr/default.nix
index 160b3d15b1133..8f23b10060514 100644
--- a/pkgs/development/python-modules/stestr/default.nix
+++ b/pkgs/development/python-modules/stestr/default.nix
@@ -5,20 +5,22 @@
 , fixtures
 , future
 , pbr
+, setuptools
 , subunit
 , testtools
+, tomlkit
 , voluptuous
 , callPackage
 }:
 
 buildPythonPackage rec {
   pname = "stestr";
-  version = "4.0.1";
-  format = "setuptools";
+  version = "4.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wsHHO/x8/KORJxWeP7x0GTrr8s0C2KBCfy5YZI42zyY=";
+    hash = "sha256-X2HDae7OY8KS0TWZ4SqhWK92hZkGQ/JN1vp/q/406Yo=";
   };
 
   postPatch = ''
@@ -27,6 +29,11 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     cliff
     fixtures
@@ -34,6 +41,7 @@ buildPythonPackage rec {
     pbr
     subunit
     testtools
+    tomlkit
     voluptuous
   ];
 
diff --git a/pkgs/development/python-modules/stm32loader/default.nix b/pkgs/development/python-modules/stm32loader/default.nix
index 55a86231aa708..00de51ea66f5b 100644
--- a/pkgs/development/python-modules/stm32loader/default.nix
+++ b/pkgs/development/python-modules/stm32loader/default.nix
@@ -1,30 +1,53 @@
 { lib
 , buildPythonPackage
-, isPy27
 , fetchPypi
+
+# build-system
+, flit-core
+
+# dependenices
 , progress
 , pyserial
-, pytest
-, mock
+
+# optional-dependencies
+, intelhex
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "stm32loader";
-  version = "0.5.1";
-  format = "setuptools";
+  version = "0.7.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0135qzxlrivvkq6wgkw7shfz94n755qs2c1754p1hc2jk0nqayrg";
+    hash = "sha256-QTLSEjdJtDH4GCamnKHN5pEjW41rRtAMXxyZZMM5K3w=";
   };
 
-  propagatedBuildInputs = [ progress pyserial ];
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    progress
+    pyserial
+  ];
+
+  passthru.optional-dependencies = {
+    hex = [
+      intelhex
+    ];
+  };
 
-  nativeCheckInputs = [ pytest ] ++ lib.optional isPy27 mock;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
-  checkPhase = ''
-    pytest --strict tests/unit
-  '';
+  pytestFlagsArray = [
+    "tests/unit"
+  ];
 
   meta = with lib; {
     description = "Flash firmware to STM32 microcontrollers in Python";
diff --git a/pkgs/development/python-modules/strawberry-graphql/default.nix b/pkgs/development/python-modules/strawberry-graphql/default.nix
index 8954713338025..194d942669ad6 100644
--- a/pkgs/development/python-modules/strawberry-graphql/default.nix
+++ b/pkgs/development/python-modules/strawberry-graphql/default.nix
@@ -61,6 +61,12 @@ buildPythonPackage rec {
       url = "https://github.com/strawberry-graphql/strawberry/commit/710bb96f47c244e78fc54c921802bcdb48f5f421.patch";
       hash = "sha256-ekUZ2hDPCqwXp9n0YjBikwSkhCmVKUzQk7LrPECcD7Y=";
     })
+    (fetchpatch {
+      # https://github.com/strawberry-graphql/strawberry/pull/3255
+      name = "fix-tests-with-pydantic_2.patch";
+      url = "https://github.com/strawberry-graphql/strawberry/commit/0a0dc284ee6d31d4e82ac7ff1ed9fea4dff39fa6.patch";
+      hash = "sha256-LACWD7XA6YL/apJwhpx3LPCKxKUfa+XWyTLK+Zkxlaw=";
+    })
   ];
 
   postPatch = ''
@@ -176,6 +182,8 @@ buildPythonPackage rec {
     "tests/websockets/test_graphql_transport_ws.py"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "A GraphQL library for Python that leverages type annotations";
     homepage = "https://strawberry.rocks";
diff --git a/pkgs/development/python-modules/streaming-form-data/default.nix b/pkgs/development/python-modules/streaming-form-data/default.nix
index 8c631510ec430..18df3a778da2b 100644
--- a/pkgs/development/python-modules/streaming-form-data/default.nix
+++ b/pkgs/development/python-modules/streaming-form-data/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, buildPythonPackage, pythonOlder,
-cython, smart-open, pytestCheckHook, moto, requests-toolbelt }:
+cython, pytestCheckHook, requests-toolbelt }:
 
 buildPythonPackage rec {
   pname = "streaming-form-data";
@@ -14,11 +14,16 @@ buildPythonPackage rec {
     hash = "sha256-Ntiad5GZtfRd+2uDPgbDzLBzErGFroffK6ZAmMcsfXA=";
   };
 
-  nativeBuildInputs = [ cython ];
+  # streaming-form-data has a small bit of code that uses smart_open, which has a massive closure.
+  # The only consumer of streaming-form-data is Moonraker, which doesn't use that code.
+  # So, just drop the dependency to not have to deal with it.
+  patches = [
+    ./drop-smart-open.patch
+  ];
 
-  propagatedBuildInputs = [ smart-open ];
+  nativeBuildInputs = [ cython ];
 
-  nativeCheckInputs = [ pytestCheckHook moto requests-toolbelt ];
+  nativeCheckInputs = [ pytestCheckHook requests-toolbelt ];
 
   pytestFlagsArray = [ "tests" ];
 
diff --git a/pkgs/development/python-modules/streaming-form-data/drop-smart-open.patch b/pkgs/development/python-modules/streaming-form-data/drop-smart-open.patch
new file mode 100644
index 0000000000000..6c0946c926ecb
--- /dev/null
+++ b/pkgs/development/python-modules/streaming-form-data/drop-smart-open.patch
@@ -0,0 +1,40 @@
+diff --git a/streaming_form_data/targets.py b/streaming_form_data/targets.py
+index a399f3a..b816714 100644
+--- a/streaming_form_data/targets.py
++++ b/streaming_form_data/targets.py
+@@ -1,6 +1,5 @@
+ import hashlib
+ from pathlib import Path
+-import smart_open  # type: ignore
+ from typing import Callable, List, Optional
+ 
+ 
+@@ -164,6 +163,7 @@ class S3Target(BaseTarget):
+     S3Target enables chunked uploads to S3 buckets (using smart_open)"""
+ 
+     def __init__(self, file_path, mode, transport_params=None, **kwargs):
++        raise Exception("Nixpkgs: disabled")
+         super().__init__(**kwargs)
+ 
+         self._file_path = file_path
+diff --git a/tests/test_targets.py b/tests/test_targets.py
+index 0cc79ab..78ab40b 100644
+--- a/tests/test_targets.py
++++ b/tests/test_targets.py
+@@ -2,8 +2,6 @@ import os.path
+ import tempfile
+ 
+ import pytest
+-from moto import mock_s3
+-import boto3
+ 
+ from streaming_form_data.targets import (
+     BaseTarget,
+@@ -271,6 +269,7 @@ def mock_client():
+         yield client
+ 
+ 
++@pytest.mark.skip
+ def test_s3_upload(mock_client):
+     test_key = "test.txt"
+     path = f"s3://{BUCKET_NAME}/{test_key}"
diff --git a/pkgs/development/python-modules/stringparser/default.nix b/pkgs/development/python-modules/stringparser/default.nix
index 44e6d6baa52f4..900f102088060 100644
--- a/pkgs/development/python-modules/stringparser/default.nix
+++ b/pkgs/development/python-modules/stringparser/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-gj0ooeb869JhlB9Mf5nBydiV2thTes8ys+BLJ516iSA=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/structlog/default.nix b/pkgs/development/python-modules/structlog/default.nix
index 20d1ba2c0a56e..f53e3c90945dd 100644
--- a/pkgs/development/python-modules/structlog/default.nix
+++ b/pkgs/development/python-modules/structlog/default.nix
@@ -8,9 +8,9 @@
 , pretend
 , pytest-asyncio
 , pytestCheckHook
-, pythonAtLeast
 , pythonOlder
 , simplejson
+, twisted
 , typing-extensions
 }:
 
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-KSHKgkv+kObKCdWZDg5o6QYe0AMND9VLdEuseY/GyDY=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-fancy-pypi-readme
     hatch-vcs
@@ -46,6 +44,12 @@ buildPythonPackage rec {
     pytest-asyncio
     pytestCheckHook
     simplejson
+    twisted
+  ];
+
+  disabledTests = [
+    # _pickle.PicklingError: Only BytesLoggers to sys.stdout and sys.stderr can be pickled.
+    "test_pickle"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/subunit/default.nix b/pkgs/development/python-modules/subunit/default.nix
index eb27ffdfb9829..299d7a2ecd29c 100644
--- a/pkgs/development/python-modules/subunit/default.nix
+++ b/pkgs/development/python-modules/subunit/default.nix
@@ -7,6 +7,7 @@
 , pythonOlder
 
 # python dependencies
+, extras
 , fixtures
 , hypothesis
 , pytestCheckHook
@@ -32,7 +33,11 @@ buildPythonPackage {
   ];
 
   buildInputs = [ check cppunit ];
-  propagatedBuildInputs = [ testtools ];
+
+  propagatedBuildInputs = [
+    extras
+    testtools
+  ];
 
   nativeCheckInputs = [
     testscenarios
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index a676f28d2758b..732828e908ac1 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "5.0.1";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7tmyywyfQw1T9qr5UbPH/KR+AmmhSaHunkeUGRKDl+Q=";
+    hash = "sha256-C5UnKp0EqzxSHTokdSJmfIOMBI6yXpWSazTxcSLOIvI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/superqt/default.nix b/pkgs/development/python-modules/superqt/default.nix
index f0d65a96ddc53..e7c3aaa04589a 100644
--- a/pkgs/development/python-modules/superqt/default.nix
+++ b/pkgs/development/python-modules/superqt/default.nix
@@ -36,8 +36,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "superqt" ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   meta = with lib; {
     description = "Missing widgets and components for Qt-python (napari/superqt)";
     homepage = "https://github.com/napari/superqt";
diff --git a/pkgs/development/python-modules/sure/default.nix b/pkgs/development/python-modules/sure/default.nix
index 55638abad0031..aaa7cba6494e5 100644
--- a/pkgs/development/python-modules/sure/default.nix
+++ b/pkgs/development/python-modules/sure/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     six
   ];
 
+  doCheck = pythonOlder "3.12"; # nose requires imp module
+
   nativeCheckInputs = [
     nose
   ];
diff --git a/pkgs/development/python-modules/swagger-ui-bundle/default.nix b/pkgs/development/python-modules/swagger-ui-bundle/default.nix
index 6f3cd92d90eda..13ebaed72c6d4 100644
--- a/pkgs/development/python-modules/swagger-ui-bundle/default.nix
+++ b/pkgs/development/python-modules/swagger-ui-bundle/default.nix
@@ -1,22 +1,37 @@
-{ lib, buildPythonPackage, fetchPypi, jinja2, flake8 }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+
+# build-system
+, poetry-core
+
+# dependencies
+, importlib-resources
+, jinja2
+
+ }:
 
 buildPythonPackage rec {
   pname = "swagger-ui-bundle";
-  version = "0.0.9";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "swagger_ui_bundle";
     inherit version;
-    sha256 = "b462aa1460261796ab78fd4663961a7f6f347ce01760f1303bbbdf630f11f516";
+    hash = "sha256-IGc8NDHIcz1dFhXs952azzDP91ICrK8hp9nH9IlxRSk=";
   };
 
-  # patch away unused test requirements since package contains no tests
-  postPatch = ''
-    substituteInPlace setup.py --replace "setup_requires=['pytest-runner', 'flake8']" "setup_requires=[]"
-  '';
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
-  propagatedBuildInputs = [ jinja2 ];
+  propagatedBuildInputs = [
+    jinja2
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-resources
+  ];
 
   # package contains no tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/tables/default.nix b/pkgs/development/python-modules/tables/default.nix
index 3879520b25100..56cb2898bf1f4 100644
--- a/pkgs/development/python-modules/tables/default.nix
+++ b/pkgs/development/python-modules/tables/default.nix
@@ -12,6 +12,7 @@
 , numpy
 , numexpr
 , packaging
+, setuptools
 , sphinx
   # Test inputs
 , python
@@ -21,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "tables";
-  version = "3.8.0";
-  format = "setuptools";
+  version = "3.9.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NPP6I2bOILGPHfVzp3wdJzBs4fKkHZ+e/2IbUZLqh4g=";
+    hash = "sha256-1HAmPC5QxLfIY1oNmawf8vnnBMJNceX6M8RSnn0K2cM=";
   };
 
   patches = [
@@ -48,6 +49,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     blosc2
     cython
+    setuptools
     sphinx
   ];
 
diff --git a/pkgs/development/python-modules/tabula-py/default.nix b/pkgs/development/python-modules/tabula-py/default.nix
index 3ce734237ce4d..bdc31012cf2d0 100644
--- a/pkgs/development/python-modules/tabula-py/default.nix
+++ b/pkgs/development/python-modules/tabula-py/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
       --replace '"java"' '"${lib.getExe jre}"'
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/tabulate/default.nix b/pkgs/development/python-modules/tabulate/default.nix
index 99420e9e32feb..f857585c9b238 100644
--- a/pkgs/development/python-modules/tabulate/default.nix
+++ b/pkgs/development/python-modules/tabulate/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-AJWxK/WWbeUpwP6x+ghnFnGzNo7sd9fverEUviwGizw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/tank-utility/default.nix b/pkgs/development/python-modules/tank-utility/default.nix
index 03d9c6c77d732..358ebbb0d82c7 100644
--- a/pkgs/development/python-modules/tank-utility/default.nix
+++ b/pkgs/development/python-modules/tank-utility/default.nix
@@ -13,7 +13,7 @@
 buildPythonPackage rec {
   pname = "tank-utility";
   version = "1.5.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -24,11 +24,14 @@ buildPythonPackage rec {
     hash = "sha256-h9y3X+FSzSFt+bd/chz+x0nocHaKZ8DvreMxAYMs8/E=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
     urllib3
-    setuptools
-  ] ++ urllib3.optional-dependencies.secure;
+  ];
 
   nativeCheckInputs = [
     mock
diff --git a/pkgs/development/python-modules/tatsu/default.nix b/pkgs/development/python-modules/tatsu/default.nix
index 4d376dc6d2ca0..635f9f34fcf9f 100644
--- a/pkgs/development/python-modules/tatsu/default.nix
+++ b/pkgs/development/python-modules/tatsu/default.nix
@@ -5,12 +5,13 @@
 , pytestCheckHook
 , pythonOlder
 , regex
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "tatsu";
-  version = "5.8.3";
-  format = "setuptools";
+  version = "5.10.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.10";
 
@@ -18,9 +19,13 @@ buildPythonPackage rec {
     owner = "neogeny";
     repo = "TatSu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cKEMRbH/xNtYM0lmNVazv3i0Q1tmVrVPrB6F2s02Sro=";
+    hash = "sha256-oCYvDP8TbafyJAgl3k7fZ8MKk9prPytvl971s2BCyWA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     colorama
     regex
diff --git a/pkgs/development/python-modules/tblib/default.nix b/pkgs/development/python-modules/tblib/default.nix
index e735f6aae217a..283bfcd83e402 100644
--- a/pkgs/development/python-modules/tblib/default.nix
+++ b/pkgs/development/python-modules/tblib/default.nix
@@ -1,15 +1,25 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, setuptools
+}:
 
 buildPythonPackage rec {
   pname = "tblib";
-  version = "2.0.0";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-pt8w8nLAi/i+ZuB3X62GIAXZUKa4RJuU98eIcx1w7Nc=";
+    hash = "sha256-k2InkKCingTwNGRY+s4eFE3E0y9JNxTGw9/4Kkrbd+Y=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   meta = with lib; {
     description = "Traceback fiddling library. Allows you to pickle tracebacks.";
     homepage = "https://github.com/ionelmc/python-tblib";
diff --git a/pkgs/development/python-modules/tcxreader/default.nix b/pkgs/development/python-modules/tcxreader/default.nix
index 9442567eec085..1334708fc7f72 100644
--- a/pkgs/development/python-modules/tcxreader/default.nix
+++ b/pkgs/development/python-modules/tcxreader/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "tcxreader";
-  version = "0.4.5";
+  version = "0.4.6";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "alenrajsp";
     repo = "tcxreader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CiOLcev9fo2BPgnPZZ2borU25f/gKISqRAapAHgLN3w=";
+    hash = "sha256-J7yzJfJr2EK/0hZLVgk+Poqr/vY/9bsgA6cePTQ45U0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tensorboard-data-server/default.nix b/pkgs/development/python-modules/tensorboard-data-server/default.nix
index 5ff48c7cc3d12..6277049f92a0e 100644
--- a/pkgs/development/python-modules/tensorboard-data-server/default.nix
+++ b/pkgs/development/python-modules/tensorboard-data-server/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "tensorboard-data-server";
-  version = "0.7.1";
+  version = "0.7.2";
   format = "wheel";
   disabled = pythonOlder "3.6";
 
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     inherit version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-mTi9OfUEF5ezOSEGb7oOqwOg3RDRiHoF5irliEGtTD8=";
+    hash = "sha256-fgYQ0gWIlYiYODbsBdwJjoD5e357v/fplOu3j1eNDds=";
   };
 
   pythonImportsCheck = [ "tensorboard_data_server" ];
diff --git a/pkgs/development/python-modules/tensorboard/default.nix b/pkgs/development/python-modules/tensorboard/default.nix
index 73c76d74771c4..d06c9e6d7d8ed 100644
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "tensorboard";
-  version = "2.14.0";
+  version = "2.15.1";
   format = "wheel";
   disabled = pythonOlder "3.6";
 
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-Nmf5dF2ZKAg2rWcwIjYshA9g7Y/v1aPjC/Bx9aj9ABc=";
+    hash = "sha256-xGwdHPE6RYxCmGiniyUx2P9faCBY1p7AhAsLx6OPHA8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tensorboardx/default.nix b/pkgs/development/python-modules/tensorboardx/default.nix
index 6097d2ecfd811..e0a72af7a1358 100644
--- a/pkgs/development/python-modules/tensorboardx/default.nix
+++ b/pkgs/development/python-modules/tensorboardx/default.nix
@@ -36,8 +36,6 @@ buildPythonPackage rec {
   # required to make tests deterministic
   env.PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION = "python";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     crc32c
     numpy
diff --git a/pkgs/development/python-modules/termcolor/default.nix b/pkgs/development/python-modules/termcolor/default.nix
index 0d40a1b44f96c..9a0af4e558e23 100644
--- a/pkgs/development/python-modules/termcolor/default.nix
+++ b/pkgs/development/python-modules/termcolor/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "termcolor";
-  version = "2.3.0";
+  version = "2.4.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tbCPaJN/E4/pL2wIm5nx4toK5WxSt4v3B1/ZVCD9mlo=";
+    hash = "sha256-qrnlYEfIrEHteY+jbYkqN6yms+kVnz4MJLxkqbOse3o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/terminado/default.nix b/pkgs/development/python-modules/terminado/default.nix
index 3c75305e9078f..3de51ffcad2cc 100644
--- a/pkgs/development/python-modules/terminado/default.nix
+++ b/pkgs/development/python-modules/terminado/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "terminado";
-  version = "0.17.1";
+  version = "0.18.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bMu806T4olpewEmR85oLjbUt/NSH6g5XjZd+Z1I4AzM=";
+    hash = "sha256-HqCKibg13RuMDJANkoSBR87yU3JDNhsuP03BXfm2/e0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tesla-powerwall/default.nix b/pkgs/development/python-modules/tesla-powerwall/default.nix
index 50fc9b2be6bbe..1feefef49b6f5 100644
--- a/pkgs/development/python-modules/tesla-powerwall/default.nix
+++ b/pkgs/development/python-modules/tesla-powerwall/default.nix
@@ -5,12 +5,13 @@
 , pythonOlder
 , requests
 , responses
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "tesla-powerwall";
-  version = "0.3.19";
-  format = "setuptools";
+  version = "0.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,9 +19,13 @@ buildPythonPackage rec {
     owner = "jrester";
     repo = "tesla_powerwall";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ClrMgPAMBtDMfD6hCJIN1u4mp75QW+c3re28v3FreQg=";
+    hash = "sha256-IqUxWwEvrSEbLAEnHG84oCV75qO0L5LmgpHOfaM6G8o=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
   ];
diff --git a/pkgs/development/python-modules/testfixtures/default.nix b/pkgs/development/python-modules/testfixtures/default.nix
index 64b49efbd1de9..911d1496165f1 100644
--- a/pkgs/development/python-modules/testfixtures/default.nix
+++ b/pkgs/development/python-modules/testfixtures/default.nix
@@ -1,10 +1,12 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , mock
 , pytestCheckHook
 , pythonAtLeast
 , pythonOlder
+, setuptools
 , sybil
 , twisted
 , zope-component
@@ -12,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "testfixtures";
-  version = "7.2.0";
-  format = "setuptools";
+  version = "7.2.2";
+  pyproject = true;
   # DO NOT CONTACT upstream.
   # https://github.com/simplistix/ is only concerned with internal CI process.
   # Any attempt by non-standard pip workflows to comment on issues will
@@ -25,9 +27,22 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jIwg3TDqETVIUHWEodqud5JI26pXEmcseruXCfD7+LI=";
+    hash = "sha256-gHdK7LAklFgnWreD9TCT++dXlf8rMhjSLOP/8KEsTaY=";
   };
 
+  patches = [
+    # https://github.com/simplistix/testfixtures/pull/188
+    (fetchpatch {
+      name = "python3.12-compatibility.patch";
+      url = "https://github.com/simplistix/testfixtures/commit/2b80b195e30e12c739dc4f98e9de17dec8f3558a.patch";
+      hash = "sha256-LrC0uI4k3F6ZGTqbKi319tRbVk5557xbyzQN36Y1160=";
+     })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     mock
     pytestCheckHook
diff --git a/pkgs/development/python-modules/testrail-api/default.nix b/pkgs/development/python-modules/testrail-api/default.nix
index b6bb8a1b22568..e23563de6ec8a 100644
--- a/pkgs/development/python-modules/testrail-api/default.nix
+++ b/pkgs/development/python-modules/testrail-api/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-lIlTrAdNtBJdwiSFwpcHA2e+fRC+MbHS0PX7prAN+RY=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/testresources/default.nix b/pkgs/development/python-modules/testresources/default.nix
index 4a9d43d6246d6..724a6c3643583 100644
--- a/pkgs/development/python-modules/testresources/default.nix
+++ b/pkgs/development/python-modules/testresources/default.nix
@@ -1,23 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, python
-, pbr, fixtures, testtools }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, pbr
+, fixtures
+, testtools
+, unittestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "testresources";
   version = "2.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "ee9d1982154a1e212d4e4bac6b610800bfb558e4fb853572a827bc14a96e4417";
   };
 
-  propagatedBuildInputs = [ pbr ];
+  postPatch = ''
+    substituteInPlace testresources/tests/test_resourced_test_case.py \
+      --replace "failIf" "assertFalse"
+  '';
 
-  nativeCheckInputs = [ fixtures testtools ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  checkPhase = ''
-    ${python.interpreter} -m testtools.run discover
-  '';
+  propagatedBuildInputs = [
+    pbr
+  ];
+
+  nativeCheckInputs = [
+    fixtures
+    testtools
+    unittestCheckHook
+  ];
 
   meta = with lib; {
     description = "Pyunit extension for managing expensive test resources";
diff --git a/pkgs/development/python-modules/testscenarios/default.nix b/pkgs/development/python-modules/testscenarios/default.nix
index 4e7dcef3e90d8..8218947d68683 100644
--- a/pkgs/development/python-modules/testscenarios/default.nix
+++ b/pkgs/development/python-modules/testscenarios/default.nix
@@ -1,13 +1,22 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, pbr
+, setuptools
+
+# dependencies
 , testtools
+
+# tests
+, python
 }:
 
 buildPythonPackage rec {
   pname = "testscenarios";
   version = "0.5.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -20,11 +29,27 @@ buildPythonPackage rec {
       --replace "catch = 1" ""
   '';
 
-  propagatedBuildInputs = [ testtools ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    pbr
+    testtools
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    ${python.interpreter} -m testtools.run testscenarios.tests.test_suite
+
+    runHook postCheck
+  '';
 
   meta = with lib; {
     description = "A pyunit extension for dependency injection";
-    homepage = "https://pypi.python.org/pypi/testscenarios";
+    homepage = "https://github.com/testing-cabal/testscenarios";
     license = licenses.asl20;
   };
 
diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index 24fa17a446239..ffc007af7acf6 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -1,33 +1,43 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonRelaxDepsHook
-, pbr
-, python-mimeparse
-, extras
-, traceback2
-, testscenarios
+
+# build-system
+, hatchling
+, hatch-vcs
+
+# dependencies
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "testtools";
-  version = "2.6.0";
-  format = "setuptools";
+  version = "2.7.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KLZeFMDy0+y7+19VydzeXk+qgKwWo3qCOQmh/jy8swo=";
+    sha256 = "sha256-323pYBDinuIfY3oUfqvzDVCyXjhB3R1o+T7onOd+Nmw=";
   };
 
-  propagatedBuildInputs = [ pbr python-mimeparse extras ];
-  buildInputs = [ traceback2 ];
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    hatchling
+    hatch-vcs
+    pythonRelaxDepsHook
+  ];
+
+  pythonRemoveDeps = [
+    "fixtures"
+  ];
+
+  propagatedBuildInputs = lib.optionals (pythonAtLeast "3.12") [
+    setuptools
+  ];
 
   # testscenarios has a circular dependency on testtools
   doCheck = false;
-  nativeCheckInputs = [ testscenarios ];
-
-  pythonRemoveDeps = [ "fixtures" ];
 
   meta = {
     description = "A set of extensions to the Python standard library's unit testing framework";
diff --git a/pkgs/development/python-modules/textfsm/default.nix b/pkgs/development/python-modules/textfsm/default.nix
index 953eb31ddc672..d5bd84a8c634b 100644
--- a/pkgs/development/python-modules/textfsm/default.nix
+++ b/pkgs/development/python-modules/textfsm/default.nix
@@ -19,6 +19,12 @@ buildPythonPackage rec {
     hash = "sha256-IHgKG8v0X+LSK6purWBdwDnI/BCs5XA12ZJixuqqXWg=";
   };
 
+  # upstream forgot to update the release version
+  postPatch = ''
+    substituteInPlace textfsm/__init__.py \
+      --replace "1.1.2" "1.1.3"
+  '';
+
   propagatedBuildInputs = [
     six
     future
diff --git a/pkgs/development/python-modules/thelogrus/default.nix b/pkgs/development/python-modules/thelogrus/default.nix
index 1dc3f301dfea1..5fe496bda795f 100644
--- a/pkgs/development/python-modules/thelogrus/default.nix
+++ b/pkgs/development/python-modules/thelogrus/default.nix
@@ -5,6 +5,7 @@
 , poetry-core
 , pyaml
 , pythonOlder
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -23,6 +24,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "pyaml"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/threat9-test-bed/default.nix b/pkgs/development/python-modules/threat9-test-bed/default.nix
index 4eab16c304e37..b7d523b376846 100644
--- a/pkgs/development/python-modules/threat9-test-bed/default.nix
+++ b/pkgs/development/python-modules/threat9-test-bed/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-0YSjMf2gDdrvkDaT77iwfCkiDDXKHnZyI8d7JmBSuCg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/tifffile/default.nix b/pkgs/development/python-modules/tifffile/default.nix
index 1b9582a71c8b9..20858e870c73e 100644
--- a/pkgs/development/python-modules/tifffile/default.nix
+++ b/pkgs/development/python-modules/tifffile/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2023.8.30";
+  version = "2023.9.26";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aoxTsBKihrddCaFJirMvIC8kzGJwoQW11ZEdxEJvFio=";
+    hash = "sha256-Z+NV5Flaqzl/hAXQSv4bSufG9ipE4i2TP+4aVxpIx64=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tiledb/default.nix b/pkgs/development/python-modules/tiledb/default.nix
index 516a22f44ccef..d7c724ab25d2e 100644
--- a/pkgs/development/python-modules/tiledb/default.nix
+++ b/pkgs/development/python-modules/tiledb/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "tiledb";
-  version = "0.23.0";
+  version = "0.24.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "TileDB-Inc";
     repo = "TileDB-Py";
     rev = "refs/tags/${version}";
-    hash = "sha256-QxqUYu8y+k5SLRFtxpcs57gnAHgXIre0smURlqUzC1s=";
+    hash = "sha256-EcWqh/xFyFvTuyzsPuAkT67O0y8TPWt2MvXVPnaQzrg=";
   };
 
   nativeBuildInputs = [
@@ -48,8 +48,6 @@ buildPythonPackage rec {
 
   TILEDB_PATH = tiledb;
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   disabled = !isPy3k; # Not bothering with python2 anymore
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/time-machine/default.nix b/pkgs/development/python-modules/time-machine/default.nix
index 799570ada1b85..6ce2e7194c8cd 100644
--- a/pkgs/development/python-modules/time-machine/default.nix
+++ b/pkgs/development/python-modules/time-machine/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pythonAtLeast
 , pythonOlder
+, setuptools
 , backports-zoneinfo
 , python-dateutil
 , pytestCheckHook
@@ -10,18 +11,22 @@
 
 buildPythonPackage rec {
   pname = "time-machine";
-  version = "2.12.0";
-  format = "setuptools";
+  version = "2.13.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "adamchainz";
     repo = pname;
     rev = version;
-    hash = "sha256-vBww78/3vC3IA4Nh9Ne+rBo/CO9FggjP+TUUV2/ih9c=";
+    hash = "sha256-SjenPLLr4JoWK5HAokwgW+bw3mfAZiuDb1N7Za5wtrw=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-dateutil
   ] ++ lib.optionals (pythonOlder "3.9") [
@@ -33,6 +38,8 @@ buildPythonPackage rec {
   ];
 
   disabledTests = lib.optionals (pythonAtLeast "3.9") [
+    # https://github.com/adamchainz/time-machine/issues/405
+    "test_destination_string_naive"
     # Assertion Errors related to Africa/Addis_Ababa
     "test_destination_datetime_tzinfo_zoneinfo_nested"
     "test_destination_datetime_tzinfo_zoneinfo_no_orig_tz"
@@ -45,6 +52,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/adamchainz/time-machine/blob/${src.rev}/CHANGELOG.rst";
     description = "Travel through time in your tests";
     homepage = "https://github.com/adamchainz/time-machine";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/timetagger/default.nix b/pkgs/development/python-modules/timetagger/default.nix
index 04c14fe5f0680..d51cb5b35eeeb 100644
--- a/pkgs/development/python-modules/timetagger/default.nix
+++ b/pkgs/development/python-modules/timetagger/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "timetagger";
-  version = "23.11.2";
+  version = "23.11.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-PPB/BTZLuHmbKmUIe5gZMAwV+TUDqXBYg6fKsokTotg=";
+    hash = "sha256-YzS69Sapwbg29usIz93hSEPiDjulFdCTeXbX4I8ZW+Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/titlecase/default.nix b/pkgs/development/python-modules/titlecase/default.nix
index 6cd8e7faa1e13..026a033357fd2 100644
--- a/pkgs/development/python-modules/titlecase/default.nix
+++ b/pkgs/development/python-modules/titlecase/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-aJbbfNnQvmmYPXVOO+xx7ADetsxE+jnVQOVDzV5jUp8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/tldextract/default.nix b/pkgs/development/python-modules/tldextract/default.nix
index 58dffe94a66b9..12b6c51a76791 100644
--- a/pkgs/development/python-modules/tldextract/default.nix
+++ b/pkgs/development/python-modules/tldextract/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-/VBbU8FuB8MEuX6MgGO44+gfqVjl1aHHDHncHY2Jo38=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/toggl-cli/default.nix b/pkgs/development/python-modules/toggl-cli/default.nix
index c3b08bad24e00..ee0dfefab6456 100644
--- a/pkgs/development/python-modules/toggl-cli/default.nix
+++ b/pkgs/development/python-modules/toggl-cli/default.nix
@@ -83,6 +83,9 @@ buildPythonPackage rec {
     "toggl"
   ];
 
+  # updates to a bogus tag
+  passthru.skipBulkUpdate = true;
+
   meta = with lib; {
     description = "Command line tool and set of Python wrapper classes for interacting with toggl's API";
     homepage = "https://toggl.uhlir.dev/";
diff --git a/pkgs/development/python-modules/tokenize-rt/default.nix b/pkgs/development/python-modules/tokenize-rt/default.nix
index 46af9553fcd15..695ce44c20a83 100644
--- a/pkgs/development/python-modules/tokenize-rt/default.nix
+++ b/pkgs/development/python-modules/tokenize-rt/default.nix
@@ -2,23 +2,31 @@
 , lib
 , fetchFromGitHub
 , isPy27
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "tokenize-rt";
-  version = "4.2.1";
-  format = "setuptools";
+  version = "5.2.0";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "asottile";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YNt4YwkuA3DVq4EjJaIES9V3A6ENa3k6/qVKisjA5Pc=";
+    hash = "sha256-G4Dn6iZLVOovzfEt9eMzp93mTX+bo0tHI5cCbaJLxBQ=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "A wrapper around the stdlib `tokenize` which roundtrips";
diff --git a/pkgs/development/python-modules/tokenizers/Cargo.lock b/pkgs/development/python-modules/tokenizers/Cargo.lock
index ced7f15387348..295d232e6b38e 100644
--- a/pkgs/development/python-modules/tokenizers/Cargo.lock
+++ b/pkgs/development/python-modules/tokenizers/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
@@ -79,15 +79,18 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
 
 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "cfg-if"
@@ -97,9 +100,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "clap"
-version = "4.4.6"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d04704f56c2cde07f43e8e2c154b43f216dc5c92fc98ada720177362f953b956"
+checksum = "2275f18819641850fa26c89acc84d465c1bf91ce57bc2748b28c420473352f64"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -107,9 +110,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.6"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e231faeaca65ebd1ea3c737966bf858971cd38c3849107aa3ea7de90a804e45"
+checksum = "07cdf1b148b25c1e1f7a42225e30a0d99a615cd4637eae7365548dd4529b95bc"
 dependencies = [
  "anstream",
  "anstyle",
@@ -119,21 +122,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.4.2"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.25",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
 
 [[package]]
 name = "colorchoice"
@@ -255,9 +258,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "encode_unicode"
@@ -267,9 +270,9 @@ checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
 
 [[package]]
 name = "env_logger"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85cdab6a89accf66733ad5a1693a4dcced6aeff64602b634530dd73c1f3ee9f0"
+checksum = "95b3f3e67048839cb0d0781f445682a35113da7121f7c949db0e2be96a4fbece"
 dependencies = [
  "humantime",
  "is-terminal",
@@ -280,26 +283,15 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.3.1"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+checksum = "7c18ee0ed65a5f1f81cac6b1d213b69c35fa47d4252ad41f1486dbd8226fe36e"
 dependencies = [
- "errno-dragonfly",
  "libc",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
 name = "esaxx-rs"
 version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -322,9 +314,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
 dependencies = [
  "cfg-if",
  "libc",
@@ -339,9 +331,9 @@ checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
 
 [[package]]
 name = "humantime"
@@ -405,9 +397,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b02a5381cc465bd3041d84623d0fa3b66738b52b8e2fc3bab8ad63ab032f4a"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
 [[package]]
 name = "lazy_static"
@@ -417,21 +409,21 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.8"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3852614a3bd9ca9804678ba6be5e3b8ce76dfc902cae004e3e0c44051b6e88db"
+checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -439,9 +431,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "macro_rules_attribute"
@@ -461,9 +453,9 @@ checksum = "b8dd856d451cc0da70e2ef2ce95a18e39a93b7558bedf10201ad28503f918568"
 
 [[package]]
 name = "matrixmultiply"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "090126dc04f95dc0d1c1c91f61bdd474b3930ca064c1edc8a849da2c6cbe1e77"
+checksum = "7574c1cf36da4798ab73da5b215bbf444f50718207754cb522201d78d1cd0ff2"
 dependencies = [
  "autocfg",
  "rawpointer",
@@ -471,9 +463,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
 
 [[package]]
 name = "memoffset"
@@ -508,7 +500,7 @@ checksum = "371717c0a5543d6a800cac822eac735aa7d2d2fbb41002e9856a4089532dbdce"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.25",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -536,9 +528,9 @@ dependencies = [
 
 [[package]]
 name = "num-complex"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02e0d21255c828d6f128a1e41534206671e8c3ea0c62f32291e808dc82cff17d"
+checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
 dependencies = [
  "num-traits",
 ]
@@ -555,9 +547,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.15"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
 ]
@@ -623,15 +615,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-targets 0.48.1",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -648,9 +640,9 @@ checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
 
 [[package]]
 name = "portable-atomic"
-version = "1.4.3"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31114a898e107c51bb1609ffaf55a0e011cf6a4d7f1170d0015a165082c0338b"
+checksum = "3bccab0e7fd7cc19f820a1c8c91720af652d0c88dc9664dd72aef2614f04af3b"
 
 [[package]]
 name = "ppv-lite86"
@@ -660,9 +652,9 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.64"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78803b62cbf1f46fde80d7c0e803111524b9877184cfe7c3033659490ac7a7da"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
  "unicode-ident",
 ]
@@ -729,9 +721,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.29"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
  "proc-macro2",
 ]
@@ -805,41 +797,47 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
  "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "regex"
-version = "1.9.1"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2eae68fc220f7cf2532e4494aded17545fce192d59cd996e0fe7887f4ceb575"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.3.3"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39354c10dd07468c2e73926b23bb9c2caca74c5501e38a35da70406f1d923310"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rustc-hash"
@@ -849,11 +847,11 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.38.13"
+version = "0.38.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7db8590df6dfcd144d22afd1b83b36c21a18d7cbc1dc4bb5295a8712e9eb662"
+checksum = "ffb93593068e9babdad10e4fce47dc9b3ac25315a72a59766ffd9e9a71996a04"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -862,41 +860,41 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe232bdf6be8c8de797b22184ee71118d63780ea42ac85b61d1baa6d3b782ae9"
+checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
 
 [[package]]
 name = "scopeguard"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.171"
+version = "1.0.192"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30e27d1e4fd7659406c492fd6cfaf2066ba8773de45ca75e855590f856dc34a9"
+checksum = "bca2a08484b285dcb282d0f67b26cadc0df8b19f8c12502c13d966bf9482f001"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.171"
+version = "1.0.192"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389894603bd18c46fa56231694f8d827779c0951a667087194cf9de94ed24682"
+checksum = "d6c7207fbec9faa48073f3e3074cbe553af6ea512d7c21ba46e434e70ea9fbc1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.25",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.102"
+version = "1.0.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5062a995d481b2308b6064e9af76011f2921c35f97b0468811ed9f6cd91dfed"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
 dependencies = [
  "itoa",
  "ryu",
@@ -905,9 +903,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
 
 [[package]]
 name = "spm_precompiled"
@@ -940,9 +938,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.25"
+version = "2.0.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15e3fc8c0c74267e2df136e5e5fb656a464158aa57624053375eb9c8c6e25ae2"
+checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -951,15 +949,15 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.9"
+version = "0.12.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df8e77cb757a61f51b947ec4a7e3646efd825b73561db1c232a8ccb639e611a0"
+checksum = "14c39fd04924ca3a864207c66fc2cd7d22d7c016007f9ce846cbb9326331930a"
 
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
 dependencies = [
  "cfg-if",
  "fastrand",
@@ -970,36 +968,36 @@ dependencies = [
 
 [[package]]
 name = "termcolor"
-version = "1.2.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+checksum = "ff1bc3d3f05aff0403e8ac0d92ced918ec05b666a43f83297ccef5bea8a3d449"
 dependencies = [
  "winapi-util",
 ]
 
 [[package]]
 name = "thiserror"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
+checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
+checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.25",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "tokenizers"
-version = "0.14.1"
+version = "0.15.0"
 dependencies = [
  "aho-corasick",
  "clap",
@@ -1018,7 +1016,7 @@ dependencies = [
  "rayon",
  "rayon-cond",
  "regex",
- "regex-syntax",
+ "regex-syntax 0.7.5",
  "serde",
  "serde_json",
  "spm_precompiled",
@@ -1030,7 +1028,7 @@ dependencies = [
 
 [[package]]
 name = "tokenizers-python"
-version = "0.14.1"
+version = "0.15.0"
 dependencies = [
  "env_logger",
  "itertools",
@@ -1048,9 +1046,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.10"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22049a19f4a68748a168c0fc439f9516686aa045927ff767eca0a85101fb6e73"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization-alignments"
@@ -1115,9 +1113,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
  "winapi",
 ]
@@ -1143,7 +1141,7 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets 0.48.1",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -1163,17 +1161,17 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.48.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
- "windows_aarch64_gnullvm 0.48.0",
- "windows_aarch64_msvc 0.48.0",
- "windows_i686_gnu 0.48.0",
- "windows_i686_msvc 0.48.0",
- "windows_x86_64_gnu 0.48.0",
- "windows_x86_64_gnullvm 0.48.0",
- "windows_x86_64_msvc 0.48.0",
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
 ]
 
 [[package]]
@@ -1184,9 +1182,9 @@ checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -1196,9 +1194,9 @@ checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -1208,9 +1206,9 @@ checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -1220,9 +1218,9 @@ checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -1232,9 +1230,9 @@ checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -1244,9 +1242,9 @@ checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -1256,6 +1254,6 @@ checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
diff --git a/pkgs/development/python-modules/tokenizers/default.nix b/pkgs/development/python-modules/tokenizers/default.nix
index 4711cfe00dd0a..a008e15b37048 100644
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@@ -63,7 +63,7 @@ let
 in
 buildPythonPackage rec {
   pname = "tokenizers";
-  version = "0.14.1";
+  version = "0.15.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -72,7 +72,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cq7dQLttNkV5UUhXujxKKMuzhD7hz+zTTKxUKlvz1s0=";
+    hash = "sha256-+yfX12eKtgZV1OQvPOlMVTONbpFuigHcl4SjoCIZkSk=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/development/python-modules/tololib/default.nix b/pkgs/development/python-modules/tololib/default.nix
index 6d2ad4815b5a2..040dc6c1ed296 100644
--- a/pkgs/development/python-modules/tololib/default.nix
+++ b/pkgs/development/python-modules/tololib/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-2OQaJR70bx8qWs1IPErF+B3X1iRvHW74axTqtdvum3U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/tomlkit/default.nix b/pkgs/development/python-modules/tomlkit/default.nix
index 605291edda0b5..fa978be73bbd2 100644
--- a/pkgs/development/python-modules/tomlkit/default.nix
+++ b/pkgs/development/python-modules/tomlkit/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "tomlkit";
-  version = "0.12.1";
+  version = "0.12.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OOH/jtuZEnPsn2GBJEpqORrDDp9QmOdTVkDqa+l6fIY=";
+    hash = "sha256-dbr1AS0GUB8HvuW/joAbnzQ+eqxaklgfIPgM5jLmtaQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/total-connect-client/default.nix b/pkgs/development/python-modules/total-connect-client/default.nix
index f9635d5617d46..f6f3baaefe252 100644
--- a/pkgs/development/python-modules/total-connect-client/default.nix
+++ b/pkgs/development/python-modules/total-connect-client/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "total-connect-client";
-  version = "2023.11.1";
+  version = "2023.12.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "craigjmidwinter";
     repo = "total-connect-client";
     rev = "refs/tags/${version}";
-    hash = "sha256-XyoyPMhp7KZrizAehuFnBAWYliv9A7D2JjGA+lO3p7Y=";
+    hash = "sha256-iEQC02KuBWtk8yQwM/fU28ilbmCWeAjilvR6fHVexuI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tox/default.nix b/pkgs/development/python-modules/tox/default.nix
index 1b0bf1755ab73..8d227bb5df85c 100644
--- a/pkgs/development/python-modules/tox/default.nix
+++ b/pkgs/development/python-modules/tox/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "tox";
-  version = "4.11.3";
+  version = "4.11.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "tox";
     rev = "refs/tags/${version}";
-    hash = "sha256-VLoWRAiQ1TP9S0f8TKwQ0H2Lgemd+dTzSM+TjhioDMk=";
+    hash = "sha256-pZmT8392YuHzCrAquPpveByYw3x6bkMGCUToCAqAGc8=";
   };
 
   postPatch = ''
@@ -39,8 +39,6 @@ buildPythonPackage rec {
       --replace "packaging>=22" "packaging"
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index 640e62212081f..6cf4c9713f9e4 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , setuptools
 , setuptools-scm
 , wheel
@@ -19,6 +20,9 @@ buildPythonPackage rec {
   version = "4.66.1";
   format = "pyproject";
 
+  # https://github.com/tqdm/tqdm/issues/1537
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-2I5lH5242FUaYlVtPP+eMDQnTKXWbpMZfPJJDi3Lacc=";
diff --git a/pkgs/development/python-modules/tracerite/default.nix b/pkgs/development/python-modules/tracerite/default.nix
index 981cd2087456d..9b98e986bb362 100644
--- a/pkgs/development/python-modules/tracerite/default.nix
+++ b/pkgs/development/python-modules/tracerite/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-rI1MNdYl/P64tUHyB3qV9gfLbGbCVOXnEFoqFTkaqgg=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/traitlets/default.nix b/pkgs/development/python-modules/traitlets/default.nix
index 6df71a041b253..f138489cf2bf0 100644
--- a/pkgs/development/python-modules/traitlets/default.nix
+++ b/pkgs/development/python-modules/traitlets/default.nix
@@ -1,27 +1,46 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
 , hatchling
+
+# tests
+, argcomplete
+, pytest-mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "traitlets";
-  version = "5.10.0";
+  version = "5.14.0";
   format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9YTqIJJARm5m6R88gap9AEukz3lJkLDHdZOKFUQhfNE=";
+    hash = "sha256-/NqorEnATfoO0+4zhO9t/bXW83QVAr4kcnlAdnkpZ3I=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  nativeCheckInputs = [
+    argcomplete
+    pytest-mock
+    pytestCheckHook
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  disabledTestPaths = [
+    # requires mypy-testing
+    "tests/test_typing.py"
+  ];
 
   meta = {
+    changelog = "https://github.com/ipython/traitlets/blob/v${version}/CHANGELOG.md";
     description = "Traitlets Python config system";
     homepage = "https://github.com/ipython/traitlets";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index efee6e3d1fa47..c6d8e538e6a60 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -51,7 +51,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.35.2";
+  version = "4.36.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-h1RMSEcuali05AWeTm1wyZQJz6XrHamCF1eHrSnFnfM=";
+    hash = "sha256-sVWDpChLjiSZQXyXsZtTUZMF/CckTaJzitk3hpagM64=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/treq/default.nix b/pkgs/development/python-modules/treq/default.nix
index 69e0c2c9d40d6..b2f020a8e3793 100644
--- a/pkgs/development/python-modules/treq/default.nix
+++ b/pkgs/development/python-modules/treq/default.nix
@@ -1,25 +1,41 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+
+# build-system
+, incremental
+, setuptools
+
+# dependenices
+, attrs
+, hyperlink
 , requests
 , twisted
-, incremental
+
+# tests
 , httpbin
 }:
 
 buildPythonPackage rec {
   pname = "treq";
-  version = "22.2.0";
-  format = "setuptools";
+  version = "23.11.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-33V+PxQfx4Lt4HamBFIRlP/LQPomRc9I5aNwYDB/Uuw=";
+    hash = "sha256-CRT/kp/RYyzhZ5cjUmD4vBnSD/fEWcHeq9ZbjGjL6sU=";
   };
 
+  nativeBuildInputs = [
+    incremental
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    requests
+    attrs
+    hyperlink
     incremental
+    requests
     twisted
   ] ++ twisted.optional-dependencies.tls;
 
@@ -29,7 +45,11 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
+
     trial treq
+
+    runHook postCheck
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/trio-asyncio/default.nix b/pkgs/development/python-modules/trio-asyncio/default.nix
index 3585e2519918a..de238ddc7c23f 100644
--- a/pkgs/development/python-modules/trio-asyncio/default.nix
+++ b/pkgs/development/python-modules/trio-asyncio/default.nix
@@ -1,9 +1,11 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , trio
 , outcome
 , sniffio
+, exceptiongroup
 , pytest-trio
 , pytestCheckHook
 , pythonAtLeast
@@ -12,15 +14,15 @@
 
 buildPythonPackage rec {
   pname = "trio-asyncio";
-  version = "0.12.0";
-  format = "setuptools";
+  version = "0.13.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "trio_asyncio";
     inherit version;
-    sha256 = "824be23b0c678c0df942816cdb57b92a8b94f264fffa89f04626b0ba2d009768";
+    hash = "sha256-fKJLIaGxes3mV1LWkziGuiQoTlL0srDe/k6o7YpjSmI=";
   };
 
   postPatch = ''
@@ -28,10 +30,16 @@ buildPythonPackage rec {
       --replace "'pytest-runner'" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     trio
     outcome
     sniffio
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    exceptiongroup
   ];
 
   nativeCheckInputs = [
@@ -39,26 +47,16 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
-    # https://github.com/python-trio/trio-asyncio/issues/112
-    "-W" "ignore::DeprecationWarning"
-    # trio.MultiError is deprecated since Trio 0.22.0; use BaseExceptionGroup (on Python 3.11 and later) or exceptiongroup.BaseExceptionGroup (earlier versions) instead (https://github.com/python-trio/trio/issues/2211)
-    "-W" "ignore::trio.TrioDeprecationWarning"
-  ];
-
   disabledTestPaths = [
     "tests/python" # tries to import internal API test.test_asyncio
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    "test_run_task"
-  ];
-
   pythonImportsCheck = [
     "trio_asyncio"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/python-trio/trio-asyncio/blob/v${version}/docs/source/history.rst";
     description = "Re-implementation of the asyncio mainloop on top of Trio";
     homepage = "https://github.com/python-trio/trio-asyncio";
     license = with licenses; [ asl20 /* or */ mit ];
diff --git a/pkgs/development/python-modules/trio/default.nix b/pkgs/development/python-modules/trio/default.nix
index c01db3259a7d9..648f91f07b9ba 100644
--- a/pkgs/development/python-modules/trio/default.nix
+++ b/pkgs/development/python-modules/trio/default.nix
@@ -1,20 +1,29 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, stdenv
+
+# build-system
+, setuptools
+
+# dependencies
 , attrs
-, sortedcontainers
-, async-generator
 , exceptiongroup
 , idna
 , outcome
+, sniffio
+, sortedcontainers
+
+# tests
+, astor
+, coreutils
+, jedi
+, pyopenssl
 , pytestCheckHook
 , pytest-trio
-, pyopenssl
 , trustme
-, sniffio
-, stdenv
-, jedi
-, astor
 , yapf
-, coreutils
 }:
 
 let
@@ -28,22 +37,26 @@ let
 in
 buildPythonPackage rec {
   pname = "trio";
-  version = "0.22.2";
-  format = "setuptools";
-  disabled = pythonOlder "3.7";
+  version = "0.23.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OIfPGMi8yJRDNCAwVGg4jax2ky6WaK+hxJqjgGtqzLM=";
+    hash = "sha256-FviffcyPe53N7B/Nhj4MA5r20PmiL439Vvdddexz/Ug=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     attrs
-    sortedcontainers
-    async-generator
     idna
     outcome
     sniffio
+    sortedcontainers
   ] ++ lib.optionals (pythonOlder "3.11") [
     exceptiongroup
   ];
@@ -81,6 +94,11 @@ buildPythonPackage rec {
     "test_static_tool_sees_class_members"
   ];
 
+  disabledTestPaths = [
+    # linters
+    "trio/_tests/tools/test_gen_exports.py"
+  ];
+
   pytestFlagsArray = [
     "-W" "ignore::DeprecationWarning"
   ];
diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 041f3db4c803b..3485c0f1fd2ce 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -4,19 +4,20 @@
 , calver
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2023.11.22";
-    format = "setuptools";
+    version = "2023.11.29";
+    pyproject = true;
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-wxp+kvll8GCiRLV9jtXub1P8tBPuF855DgBXfLNprZk=";
+      hash = "sha256-/49/2Cx5MhE7RufvZ0LHAJHMY2QMjGXbANkfLpQLlRQ=";
     };
 
     postPatch = ''
@@ -26,6 +27,7 @@ let
 
     nativeBuildInputs = [
       calver
+      setuptools
     ];
 
     doCheck = false; # avoid infinite recursion with hatchling
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index 790a9e4f1a07d..bb1835ff7b9be 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "trytond";
-  version = "6.8.5";
+  version = "7.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-o/U8bmCAotgDYY81eX+vXOxJC3f4aQvOF6ohMOHLuLY=";
+    hash = "sha256-/Xb6YOQ8nV+bXTdt/iAgYkBkmV6fRVFjR+86SfKU+aw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/twill/default.nix b/pkgs/development/python-modules/twill/default.nix
index fdc750fa89627..f15a45509e58b 100644
--- a/pkgs/development/python-modules/twill/default.nix
+++ b/pkgs/development/python-modules/twill/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "twill";
-  version = "3.1";
+  version = "3.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tWcZRvBvkRyQ7gD5zjocBzFVlzQ0Mhf1unF3gUkhB94=";
+    hash = "sha256-JJheUl/Ar8BWNpzJzMvVgk4KeitoQZ8GjbFPN9dEd+g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index a8047e62c25d9..f641afea9b661 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -54,7 +54,7 @@
 
 buildPythonPackage rec {
   pname = "twisted";
-  version = "23.8.0";
+  version = "23.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -62,16 +62,11 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-PHM2Ct0XM2piLA2BHCos4phmtuWbESX9ZQmxclIJiiQ=";
+    hash = "sha256-mHhHoHkKLFlxl2E2huJ4T9VBZ986VdD7F8hBIwXXbOU=";
   };
 
   patches = [
     (fetchpatch {
-      name = "11787.diff";
-      url = "https://github.com/twisted/twisted/commit/da3bf3dc29f067e7019b2a1c205834ab64b2139a.diff";
-      hash = "sha256-bQgUmbvDa61Vg8p/o/ivfkOAHyj1lTgHkrRVEGLM9aU=";
-    })
-    (fetchpatch {
       # Conditionally skip tests that require METHOD_CRYPT
       # https://github.com/twisted/twisted/pull/11827
       url = "https://github.com/mweinelt/twisted/commit/e69e652de671aac0abf5c7e6c662fc5172758c5a.patch";
@@ -112,6 +107,8 @@ buildPythonPackage rec {
     echo 'FileObserverTests.test_getTimezoneOffsetWestOfUTC.skip = "mktime argument out of range"'>> src/twisted/test/test_log.py
     echo 'FileObserverTests.test_getTimezoneOffsetWithoutDaylightSavingTime.skip = "tuple differs, values not"'>> src/twisted/test/test_log.py
 
+    echo 'FileDescriptorTests.test_expectedFDs.skip = "Expected duplicate file descriptor to be greater than original"' >> src/twisted/internet/test/test_posixprocess.py
+
     echo 'MulticastTests.test_joinLeave.skip = "No such device"'>> src/twisted/test/test_udp.py
     echo 'MulticastTests.test_loopback.skip = "No such device"'>> src/twisted/test/test_udp.py
     echo 'MulticastTests.test_multicast.skip = "Reactor was unclean"'>> src/twisted/test/test_udp.py
@@ -127,6 +124,10 @@ buildPythonPackage rec {
     # tests for missing https support in usage
     echo 'ServiceTests.test_HTTPSFailureOnMissingSSL.skip = "Expectation Mismatch"' >> src/twisted/web/test/test_tap.py
 
+    # fail on Python 3.12
+    echo 'WorkerReporterTests.test_addSkipPyunit.skip = "'WorkerReporter' object has no attribute '_testStarted'"' >> src/twisted/trial/_dist/test/test_workerreporter.py
+    echo 'LocalWorkerAMPTests.test_runSkip.skip = "twisted.protocols.amp.UnknownRemoteError: Code<UNKNOWN>: Unknown Error"' >> src/twisted/trial/_dist/test/test_worker.py
+
     # not packaged
     substituteInPlace src/twisted/test/test_failure.py \
       --replace "from cython_test_exception_raiser import raiser  # type: ignore[import]" "raiser = None"
@@ -143,6 +144,8 @@ buildPythonPackage rec {
   '' + lib.optionalString stdenv.isDarwin ''
     echo 'ProcessTestsBuilder_AsyncioSelectorReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
     echo 'ProcessTestsBuilder_SelectReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
+    echo 'ProcessTestsBuilder_AsyncioSelectorReactorTests.test_processEnded.skip = "exit code 120"' >> src/twisted/internet/test/test_process.py
+    echo 'ProcessTestsBuilder_SelectReactorTests.test_processEnded.skip = "exit code 120"' >> src/twisted/internet/test/test_process.py
   '';
 
   # Generate Twisted's plug-in cache. Twisted users must do it as well. See
@@ -197,6 +200,7 @@ buildPythonPackage rec {
   };
 
   meta = with lib; {
+    changelog = "https://github.com/twisted/twisted/blob/twisted-${version}/NEWS.rst";
     homepage = "https://github.com/twisted/twisted";
     description = "Asynchronous networking framework written in Python";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/txi2p-tahoe/default.nix b/pkgs/development/python-modules/txi2p-tahoe/default.nix
index 3d891c6eeed1d..9ddc10885788a 100644
--- a/pkgs/development/python-modules/txi2p-tahoe/default.nix
+++ b/pkgs/development/python-modules/txi2p-tahoe/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     parsley
     twisted
diff --git a/pkgs/development/python-modules/typed-settings/default.nix b/pkgs/development/python-modules/typed-settings/default.nix
index 3511a87127ba4..6415e590af064 100644
--- a/pkgs/development/python-modules/typed-settings/default.nix
+++ b/pkgs/development/python-modules/typed-settings/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "typed-settings";
-  version = "23.0.1";
+  version = "23.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "typed_settings";
     inherit version;
-    hash = "sha256-gnwiSCVWU0mpUDiHt9GE2DtfFd2xpOsDL5r/fFctkg4=";
+    hash = "sha256-0esWiZ0dVnIJ+TDSD+0+zq63I1JcKH3iVe34pFRQX9U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-psutil/default.nix b/pkgs/development/python-modules/types-psutil/default.nix
index 8e01ec2c3ff34..fcfd7f5d0a658 100644
--- a/pkgs/development/python-modules/types-psutil/default.nix
+++ b/pkgs/development/python-modules/types-psutil/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-psutil";
-  version = "5.9.5.16";
+  version = "5.9.5.17";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TpshnvtiXT0E9r8QaTT4fKtJqkGpSwo7MIlAP0enkig=";
+    hash = "sha256-99h2mBLXKktRPX7J61WA/i9gE/wnA5SmA8tlNIEfPk0=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-psycopg2/default.nix b/pkgs/development/python-modules/types-psycopg2/default.nix
new file mode 100644
index 0000000000000..4050efead48db
--- /dev/null
+++ b/pkgs/development/python-modules/types-psycopg2/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "types-psycopg2";
+  version = "2.9.21.20";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-c7rqaJV1v1uxuRW3g/sFJARMYkKSiu7xrlqeMvB4DT0=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "psycopg2-stubs"
+  ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Typing stubs for psycopg2";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/types-pyyaml/default.nix b/pkgs/development/python-modules/types-pyyaml/default.nix
index 58a66197d00b7..c8735dbfe6de4 100644
--- a/pkgs/development/python-modules/types-pyyaml/default.nix
+++ b/pkgs/development/python-modules/types-pyyaml/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyyaml";
-  version = "6.0.12.11";
+  version = "6.0.12.12";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-PyYAML";
     inherit version;
-    hash = "sha256-fTQLGcoozd/bpDjuY4zUCEveIT5QGjl4c4VD4nCUd1s=";
+    hash = "sha256-M0Nz05L94P35WvXD8WYYhfoQxSFnsUWT64ViieGFUGI=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index 42e1bcb61d244..74ebca264a619 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, urllib3
 , types-urllib3
 }:
 
@@ -17,6 +18,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    urllib3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-setuptools/default.nix b/pkgs/development/python-modules/types-setuptools/default.nix
index 2d7dbc81c5c1d..d98aea408b941 100644
--- a/pkgs/development/python-modules/types-setuptools/default.nix
+++ b/pkgs/development/python-modules/types-setuptools/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-setuptools";
-  version = "69.0.0.20240106";
+  version = "68.2.0.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4Hf5CJV43zyZOPbkqhYz8YK6Z0Cm/bEzPxYrrl38utw=";
+    hash = "sha256-Ce/DgK1cf3jjC8oVRvcGRpVozyYITPq3Ps+D3qHShEY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index 72302723c855c..6a908dfd8e540 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -2,21 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , flit-core
-, python
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "typing-extensions";
-  version = "4.7.1";
-  format = "pyproject";
+  version = "4.8.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "typing_extensions";
     inherit version;
-    hash = "sha256-t13cJk8LpWFdt7ohfa65lwGtKVNTxF+elZYzN87u/7I=";
+    hash = "sha256-345DOenLdzV1WMvbzsozwwNxTPhh0e7xXhBwBVrot+8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/uasiren/default.nix b/pkgs/development/python-modules/uasiren/default.nix
index b6771266f2ab7..25f28f3d15d32 100644
--- a/pkgs/development/python-modules/uasiren/default.nix
+++ b/pkgs/development/python-modules/uasiren/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage {
     hash = "sha256-NHrnG5Vhz+JZgcTJyfIgGz0Ye+3dFVv2zLCCqw2++oM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/uharfbuzz/default.nix b/pkgs/development/python-modules/uharfbuzz/default.nix
index 34bb5fef6df46..c7e823b74a2df 100644
--- a/pkgs/development/python-modules/uharfbuzz/default.nix
+++ b/pkgs/development/python-modules/uharfbuzz/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-876gFYyMqeGYoXMdBguV6bi7DJKHJs9HNLw9xRu+Mxk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     cython
     setuptools-scm
diff --git a/pkgs/development/python-modules/unidic/default.nix b/pkgs/development/python-modules/unidic/default.nix
index c138ea8e8d0cd..cd8363d6fc972 100644
--- a/pkgs/development/python-modules/unidic/default.nix
+++ b/pkgs/development/python-modules/unidic/default.nix
@@ -35,8 +35,6 @@ buildPythonPackage rec {
   # no tests
   doCheck = false;
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [ requests tqdm wasabi plac platformdirs ];
 
   nativeBuildInputs = [ cython mecab setuptools-scm ];
diff --git a/pkgs/development/python-modules/uqbar/default.nix b/pkgs/development/python-modules/uqbar/default.nix
index e6633ab2e6768..3af7ba636e9e6 100644
--- a/pkgs/development/python-modules/uqbar/default.nix
+++ b/pkgs/development/python-modules/uqbar/default.nix
@@ -21,6 +21,10 @@ buildPythonPackage rec {
     hash = "sha256-cEhWXGtMSXVjT5QigDedjT/lwYQnVqPCE5vbctXWznk=";
   };
 
+  postPatch = ''
+    sed -i '/"black"/d' pyproject.toml
+  '';
+
   propagatedBuildInputs = [
     unidecode
     sphinx
diff --git a/pkgs/development/python-modules/uri-template/default.nix b/pkgs/development/python-modules/uri-template/default.nix
index 7bebffce194a3..a403417b10934 100644
--- a/pkgs/development/python-modules/uri-template/default.nix
+++ b/pkgs/development/python-modules/uri-template/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-38HFFqM6yfpsPrhIpE639ePy/NbLqKw7gbnE3y8sL3w=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 7a374f7c0c2c5..3c7da587cdded 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -1,18 +1,20 @@
 { lib
-, backports-zoneinfo
-, brotli
-, brotlicffi
 , buildPythonPackage
-, certifi
-, cryptography
 , fetchPypi
-, hatchling
-, idna
 , isPyPy
-, pyopenssl
+
+# build-system
+, hatchling
+
+# optional-dependencies
+, brotli
+, brotlicffi
 , pysocks
-, pytest-timeout
+
+# tests
+, backports-zoneinfo
 , pytestCheckHook
+, pytest-timeout
 , pythonOlder
 , tornado
 , trustme
@@ -20,12 +22,12 @@
 
 let self = buildPythonPackage rec {
   pname = "urllib3";
-  version = "2.0.7";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yX394fe9Q6ccjSpY42npsr9pLRM06p+crlWt19DdD4Q=";
+    hash = "sha256-33qor7AUj6eEiOeJmyxZtfT/z6gubFTMud03wde1LVQ=";
   };
 
   nativeBuildInputs = [
@@ -38,13 +40,6 @@ let self = buildPythonPackage rec {
     ] else [
       brotli
     ];
-    # Use carefully since pyopenssl is not supported aarch64-darwin
-    secure = [
-      certifi
-      cryptography
-      idna
-      pyopenssl
-    ];
     socks = [
       pysocks
     ];
diff --git a/pkgs/development/python-modules/urwid/default.nix b/pkgs/development/python-modules/urwid/default.nix
index 7f9512be2cb18..66a8d830cc2da 100644
--- a/pkgs/development/python-modules/urwid/default.nix
+++ b/pkgs/development/python-modules/urwid/default.nix
@@ -1,11 +1,10 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 
 # build-system
 , setuptools
 , setuptools-scm
-, wheel
 
 # tests
 , glibcLocales
@@ -14,12 +13,14 @@
 
 buildPythonPackage rec {
   pname = "urwid";
-  version = "2.2.1";
+  version = "2.2.3";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-4zkRqxjyxz/dvpvyFtAh504gstWqm+MEA8WPVRMbuKE=";
+  src = fetchFromGitHub {
+    owner = "urwid";
+    repo = "urwid";
+    rev = "refs/tags/${version}";
+    hash = "sha256-oPb2h/+gaqkZTXIiESjExMfBNnOzDvoMkXvkZ/+KVwo=";
   };
 
   postPatch = ''
@@ -29,7 +30,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools
     setuptools-scm
-    wheel
   ];
 
   nativeCheckInputs = [
@@ -39,9 +39,13 @@ buildPythonPackage rec {
 
   env.LC_ALL = "en_US.UTF8";
 
+  pytestFlagsArray = [
+    "tests"
+  ];
+
   disabledTestPaths = [
     # expect call hangs
-    "urwid/tests/test_vterm.py"
+    "tests/test_vterm.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/usort/default.nix b/pkgs/development/python-modules/usort/default.nix
index d8369260587e3..2bea93e08275b 100644
--- a/pkgs/development/python-modules/usort/default.nix
+++ b/pkgs/development/python-modules/usort/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-emnrghdsUs+VfvYiJExG13SKQNrXAEtGNAJQLScADnw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/uvicorn/default.nix b/pkgs/development/python-modules/uvicorn/default.nix
index bbec8df096fa2..11df7fd78c6e1 100644
--- a/pkgs/development/python-modules/uvicorn/default.nix
+++ b/pkgs/development/python-modules/uvicorn/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "uvicorn";
-  version = "0.23.2";
+  version = "0.24.0.post1";
   disabled = pythonOlder "3.8";
 
   format = "pyproject";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-98Ahb6syD/J9StwaOqVj/MCdzbHOgey0sixp7SJnROE=";
+    hash = "sha256-WMXOmQOTj/yPazPEAuteho4UH9enXcIa1mMDDl2eaIk=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/vallox-websocket-api/default.nix b/pkgs/development/python-modules/vallox-websocket-api/default.nix
index 21e99902929fa..fb3197b6b9e57 100644
--- a/pkgs/development/python-modules/vallox-websocket-api/default.nix
+++ b/pkgs/development/python-modules/vallox-websocket-api/default.nix
@@ -2,6 +2,7 @@
 , aiohttp
 , buildPythonPackage
 , pythonOlder
+, pythonRelaxDepsHook
 , fetchFromGitHub
 , setuptools
 , construct
@@ -26,6 +27,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "websockets"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/venusian/default.nix b/pkgs/development/python-modules/venusian/default.nix
index 5b48ee52fadc7..b992f518c5fbe 100644
--- a/pkgs/development/python-modules/venusian/default.nix
+++ b/pkgs/development/python-modules/venusian/default.nix
@@ -2,22 +2,31 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
-, pytest
+, pytestCheckHook
 , pytest-cov
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "venusian";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.1.0";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f6842b7242b1039c0c28f6feef29016e7e7dd3caaeb476a193acf737db31ee38";
+    hash = "sha256-63LNym8xOaFdyA+cldPBD4pUoLqIHu744uxbQtPuOpU=";
   };
 
-  nativeCheckInputs = [ pytest pytest-cov ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov
+  ];
 
   checkPhase = ''
     pytest
diff --git a/pkgs/development/python-modules/versioningit/default.nix b/pkgs/development/python-modules/versioningit/default.nix
index 74a29ae175e9c..b87ec1e1a9aa6 100644
--- a/pkgs/development/python-modules/versioningit/default.nix
+++ b/pkgs/development/python-modules/versioningit/default.nix
@@ -8,6 +8,7 @@
 , tomli
 , pytestCheckHook
 , build
+, hatchling
 , pydantic
 , pytest-mock
 , git
@@ -16,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "versioningit";
-  version = "2.2.0";
+  version = "2.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6xjnunJoqIC/HM/pLlNOlqs04Dl/KNy8s/wNpPaltr0=";
+    hash = "sha256-HQ1xz6PCvE+N+z1KFcFE64qmoJ2dqYkj1BCZSi74Juo=";
   };
 
   postPatch = ''
@@ -33,9 +34,12 @@ buildPythonPackage rec {
       --replace "--no-cov-on-fail" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     packaging
-    setuptools
   ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ] ++ lib.optionals (pythonOlder "3.11") [
@@ -45,6 +49,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     build
+    hatchling
     pydantic
     pytest-mock
     git
diff --git a/pkgs/development/python-modules/vilfo-api-client/default.nix b/pkgs/development/python-modules/vilfo-api-client/default.nix
index 5c0d66e7c0cfc..99a10fd320d3c 100644
--- a/pkgs/development/python-modules/vilfo-api-client/default.nix
+++ b/pkgs/development/python-modules/vilfo-api-client/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     getmac
     requests
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 18db218039d3f..a79b5bcd6cc14 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.24.5";
+  version = "20.25.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6DYZZ/bab73xQmSDv+n8qCh8JCrAvDBCmQVyHO+/91I=";
+    hash = "sha256-v1HA2cfdY+qORAhvoeT7EJOjHpY7hpWSVzeK7wIOHxs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/vispy/default.nix b/pkgs/development/python-modules/vispy/default.nix
index ae52494d78cd2..ad8d696f91d90 100644
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@@ -3,22 +3,25 @@
 , buildPythonPackage
 , substituteAll
 , fetchPypi
-, cython
+, cython_3
 , fontconfig
 , freetype-py
 , hsluv
 , kiwisolver
 , libGL
 , numpy
+, oldest-supported-numpy
+, packaging
 , pythonOlder
+, setuptools
 , setuptools-scm
-, setuptools-scm-git-archive
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "vispy";
   version = "0.14.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -36,9 +39,11 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    cython
+    cython_3
+    oldest-supported-numpy
+    setuptools
     setuptools-scm
-    setuptools-scm-git-archive
+    wheel
   ];
 
   buildInputs = [
@@ -46,11 +51,11 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    fontconfig
     freetype-py
     hsluv
     kiwisolver
     numpy
+    packaging
   ];
 
   doCheck = false;  # otherwise runs OSX code on linux.
diff --git a/pkgs/development/python-modules/voluptuous/default.nix b/pkgs/development/python-modules/voluptuous/default.nix
index 452d95eede33f..47e3d029106b7 100644
--- a/pkgs/development/python-modules/voluptuous/default.nix
+++ b/pkgs/development/python-modules/voluptuous/default.nix
@@ -1,21 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "voluptuous";
-  version = "0.13.1";
-  format = "setuptools";
+  version = "0.14.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "alecthomas";
-    repo = pname;
-    rev = version;
-    hash = "sha256-cz3Bd+/yPh+VOHxzi/W+gbDh/H5Nl/n4jvxDOirmAVk=";
+    repo = "voluptuous";
+    rev = "refs/tags/${version}";
+    hash = "sha256-7KXuypcKoqZboHTzoNKK5sYUR57wWGJu6y9zkLecep0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -30,7 +38,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python data validation library";
+    downloadPage = "https://github.com/alecthomas/voluptuous";
     homepage = "http://alecthomas.github.io/voluptuous/";
+    changelog = "https://github.com/alecthomas/voluptuous/blob/${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 935c79b1f2338..c0720c4757a54 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -52,7 +52,7 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.15.11";
+  version = "0.16.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -61,7 +61,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-WaVgyF+pQgFCqIsi5Tcu+btyUKU2e3/qJi4Ma8dnx8M=";
+    hash = "sha256-XXs9KjiAPzZ932r4UJ87RpM+qhg/bNDWEYsq2Ua6SRw=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/wavedrom/default.nix b/pkgs/development/python-modules/wavedrom/default.nix
index 25e7222608b0f..32fa68a9dabd4 100644
--- a/pkgs/development/python-modules/wavedrom/default.nix
+++ b/pkgs/development/python-modules/wavedrom/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-MntNXcpZPIElfCAv6lFvepCHR/sRUnw1nwNPW3r39Hs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/wavefile/default.nix b/pkgs/development/python-modules/wavefile/default.nix
index 4ced79638a826..4a8272e2f6681 100644
--- a/pkgs/development/python-modules/wavefile/default.nix
+++ b/pkgs/development/python-modules/wavefile/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "wavefile";
-  version = "1.5";
-  format = "setuptools";
+  version = "1.6.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vokimon";
     repo = "python-wavefile";
-    rev = "python-wavefile-${version}";
-    sha256 = "9sHj1gb93mCVpejRGSdLJzeFDCeTflZctE7kMWfqFrE=";
+    rev = "refs/tags/python-wavefile-${version}";
+    hash = "sha256-TLSWhLARY+3sHkl2p3d3LDGzLu6DggjTJWFpyrwRXSI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wcwidth/default.nix b/pkgs/development/python-modules/wcwidth/default.nix
index badb09bbef11a..ee12162a0632a 100644
--- a/pkgs/development/python-modules/wcwidth/default.nix
+++ b/pkgs/development/python-modules/wcwidth/default.nix
@@ -4,17 +4,21 @@
 
 buildPythonPackage rec {
   pname = "wcwidth";
-  version = "0.2.6";
-  format = "setuptools";
+  version = "0.2.12";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pSIHgKQE2+M1N4mHCXjkcs/kd3YfBu5VB3JW5QmxVtA=";
+    hash = "sha256-8BwQTv31eXG8t1bwVN1Y3exSBN0V+jHWUD6leUfZfAI=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [ setuptools ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   # To prevent infinite recursion with pytest
   doCheck = false;
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index 28c3a7547e083..e87694dfe50e1 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-7oCb8tH1pQDJpoxe3C6xdKtRQqNoAuJ0qySv5nX/sos=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "validators>=0.18.2,<=0.21.0" "validators>=0.18.2" \
diff --git a/pkgs/development/python-modules/webdav4/default.nix b/pkgs/development/python-modules/webdav4/default.nix
index 22c1ea8a964e6..cc353777f632f 100644
--- a/pkgs/development/python-modules/webdav4/default.nix
+++ b/pkgs/development/python-modules/webdav4/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-Le/gABaUxMmSW2SjgucsBKqjxOq1h9UCAWl5YyUsCPk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov" ""
diff --git a/pkgs/development/python-modules/websocket-client/default.nix b/pkgs/development/python-modules/websocket-client/default.nix
index 26c27825f7bd9..f4d33df531445 100644
--- a/pkgs/development/python-modules/websocket-client/default.nix
+++ b/pkgs/development/python-modules/websocket-client/default.nix
@@ -1,23 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
 , pytestCheckHook
 , python-socks
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "websocket-client";
-  version = "1.6.3";
-  format = "setuptools";
+  version = "1.6.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Oq0l0xKEJmvPz9H9inQ/YygjBaNkuNCUikO9YGrMZS8=";
+    hash = "sha256-szJAGbPChXIIbEoxn5HR3NRObhHNNAIyl4xoSnZQ0N8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-socks
    ];
diff --git a/pkgs/development/python-modules/websockets/default.nix b/pkgs/development/python-modules/websockets/default.nix
index ec6e429f5945e..770e6e654caf5 100644
--- a/pkgs/development/python-modules/websockets/default.nix
+++ b/pkgs/development/python-modules/websockets/default.nix
@@ -4,12 +4,13 @@
 , fetchFromGitHub
 , unittestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "websockets";
-  version = "11.0.3";
-  format = "setuptools";
+  version = "12.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -17,9 +18,13 @@ buildPythonPackage rec {
     owner = "aaugustin";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-RdkbIiZI/UYsWdnnl5gJPsnJ/6adfFtkiXC7MO/HwcI=";
+    hash = "sha256-sOL3VI9Ib/PncZs5KN4dAIHOrBc7LfXqT15LO4M6qKg=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   patchPhase = ''
     # Disable all tests that need to terminate within a predetermined amount of
     # time. This is nondeterministic.
diff --git a/pkgs/development/python-modules/webtest/default.nix b/pkgs/development/python-modules/webtest/default.nix
index ce34b045fd678..52d48505df473 100644
--- a/pkgs/development/python-modules/webtest/default.nix
+++ b/pkgs/development/python-modules/webtest/default.nix
@@ -2,6 +2,7 @@
 , beautifulsoup4
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pastedeploy
 , pyquery
 , pytestCheckHook
@@ -25,6 +26,15 @@ buildPythonPackage rec {
     hash = "sha256-VL2WlyWDjZhhqfon+Nlx950nXZSuJV9cUB9Tu22ZKes=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Replace deprecated unittest aliases for Python 3.12
+      name = "webtest-python312-compat.patch";
+      url = "https://github.com/Pylons/webtest/commit/d82ec5bd2cf3c7109a1d49ad9fa802ae1eae1763.patch";
+      hash = "sha256-hSwxAxAI3Eo28I8S+r2k/hFG8TlzrVYup3MuTsE+xXk=";
+    })
+  ];
+
   propagatedBuildInputs = [
     beautifulsoup4
     six
diff --git a/pkgs/development/python-modules/werkzeug/default.nix b/pkgs/development/python-modules/werkzeug/default.nix
index db045e77c52fe..35c5f943cb190 100644
--- a/pkgs/development/python-modules/werkzeug/default.nix
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "werkzeug";
-  version = "2.3.7";
+  version = "2.3.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-K4wORHtLnbzIXdl7butNy69si2w74L1lTiVVPgohV9g=";
+    hash = "sha256-VUslfHS763oNJUFgpPj/4YUkP1KlIDUGC3Ycpi2XfwM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 16c6c2dc087d1..2b96261905005 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.41.1";
+  version = "0.42.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
-    rev = version;
-    hash = "sha256-/EaDJ2zI/ly2BrrGhiZGwiBYDVPYWTki+87UqtCS3bw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-WML3/gAK1R9DEeRVZWeO0VRFuNVKP52i5I5mYV6vQcI=";
     postFetch = ''
       cd $out
       mv tests/testdata/unicode.dist/unicodedist/åäö_日本語.py \
diff --git a/pkgs/development/python-modules/wikitextparser/default.nix b/pkgs/development/python-modules/wikitextparser/default.nix
index b7af5aeeb652e..5f4435c91694e 100644
--- a/pkgs/development/python-modules/wikitextparser/default.nix
+++ b/pkgs/development/python-modules/wikitextparser/default.nix
@@ -1,6 +1,7 @@
 { buildPythonPackage
 , fetchFromGitHub
 , lib
+, setuptools
 , pytestCheckHook
 , regex
 , wcwidth
@@ -18,6 +19,10 @@ buildPythonPackage rec {
     hash = "sha256-cmzyRbq4tCbuyrNnT0UYxoxuwXrFkIcWdrogSTfxSys=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     wcwidth
     regex
diff --git a/pkgs/development/python-modules/willow/default.nix b/pkgs/development/python-modules/willow/default.nix
index 1787faa38905a..7f5b06223ee69 100644
--- a/pkgs/development/python-modules/willow/default.nix
+++ b/pkgs/development/python-modules/willow/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "willow";
-  version = "1.6.2";
+  version = "1.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "2.7";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "wagtail";
     repo = "Willow";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dW2FVN3/mBAhVQ094uBsnXzdyTRKgHUDx0SWLm3g374=";
+    hash = "sha256-+ubylc/Zuw3DSSgtTg2dO3Zj0gpTJcLbb1J++caxS7w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/withings-api/default.nix b/pkgs/development/python-modules/withings-api/default.nix
index 5be701fa298ff..226907f9e95da 100644
--- a/pkgs/development/python-modules/withings-api/default.nix
+++ b/pkgs/development/python-modules/withings-api/default.nix
@@ -52,5 +52,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/vangorra/python_withings_api";
     license = licenses.mit;
     maintainers = with maintainers; [ kittywitch ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/wrapt/default.nix b/pkgs/development/python-modules/wrapt/default.nix
index 268f2775d5cf9..3995e291bc3ad 100644
--- a/pkgs/development/python-modules/wrapt/default.nix
+++ b/pkgs/development/python-modules/wrapt/default.nix
@@ -8,15 +8,15 @@
 
 buildPythonPackage rec {
   pname = "wrapt";
-  version = "1.14.1";
+  version = "1.16.0";
   outputs = [ "out" "doc" ];
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "GrahamDumpleton";
     repo = pname;
-    rev = version;
-    hash = "sha256-nXwDuNo4yZxgjnkus9bVwIZltPaSH93D+PcZMGT2nGM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-lVpSriXSvRwAKX4iPOIBvJwhqhKjdrUdGaEG4QoTQyo=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/wsme/default.nix b/pkgs/development/python-modules/wsme/default.nix
index 764977051635d..7af0f410969b0 100644
--- a/pkgs/development/python-modules/wsme/default.nix
+++ b/pkgs/development/python-modules/wsme/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pythonAtLeast
 , pbr
+, setuptools
 , six
 , simplegeneric
 , netaddr
@@ -22,18 +23,21 @@
 
 buildPythonPackage rec {
   pname = "wsme";
-  version = "0.11.0";
-  format = "setuptools";
+  version = "0.12.1";
+  pyproject = true;
 
   disabled = pythonAtLeast "3.9";
 
   src = fetchPypi {
     pname = "WSME";
     inherit version;
-    sha256 = "bd2dfc715bedcc8f4649611bc0c8a238f483dc01cff7102bc1efa6bea207b64b";
+    hash = "sha256-m36yJErzxwSskUte0iGVS7aK3QqLKy84okSwZ7M3mS0=";
   };
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     netaddr
diff --git a/pkgs/development/python-modules/wtforms/default.nix b/pkgs/development/python-modules/wtforms/default.nix
index deffda6ef5fee..4b724ce6acbd2 100644
--- a/pkgs/development/python-modules/wtforms/default.nix
+++ b/pkgs/development/python-modules/wtforms/default.nix
@@ -1,29 +1,45 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, markupsafe
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
 , babel
-, pytestCheckHook
+, hatchling
+, setuptools
+
+# dependencies
+, markupsafe
+
+# optional-dependencies
 , email-validator
-, pythonOlder
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "wtforms";
-  version = "3.0.1";
-  format = "setuptools";
+  version = "3.1.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    pname = "WTForms";
-    inherit version;
-    hash = "sha256-azUbuxLdWK9X/+8FvHhCXQjRkU4P1o7hQUO3reAjxbw=";
+  src = fetchFromGitHub {
+    owner = "wtforms";
+    repo = "wtforms";
+    rev = "refs/tags/${version}";
+    hash = "sha256-9EryEXGlGCtDH/XPM4Oihla42HnY0nho9DaauHfYnNQ=";
   };
 
+  nativeBuildInputs = [
+    babel
+    hatchling
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     markupsafe
-    babel
   ];
 
   passthru.optional-dependencies = {
@@ -34,7 +50,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "wtforms"
diff --git a/pkgs/development/python-modules/xarray/default.nix b/pkgs/development/python-modules/xarray/default.nix
index 12cefa0332aa0..70b99d5091f64 100644
--- a/pkgs/development/python-modules/xarray/default.nix
+++ b/pkgs/development/python-modules/xarray/default.nix
@@ -13,18 +13,16 @@
 
 buildPythonPackage rec {
   pname = "xarray";
-  version = "2023.8.0";
+  version = "2023.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-glxtZCAqcxpOSTIe3R6d+r9L4GgC8bjIo8AKPr/Izt8=";
+    hash = "sha256-mkXhB0GES1+UjY4edotGDffpBpbRji7/LB1H9dnVAlI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/xbox-webapi/default.nix b/pkgs/development/python-modules/xbox-webapi/default.nix
index c2caa4fb37784..c5180c1f15c0d 100644
--- a/pkgs/development/python-modules/xbox-webapi/default.nix
+++ b/pkgs/development/python-modules/xbox-webapi/default.nix
@@ -2,54 +2,51 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, aiohttp
+, setuptools
 , appdirs
 , ecdsa
+, httpx
 , ms-cv
 , pydantic
-, aresponses
 , pytest-asyncio
 , pytestCheckHook
+, respx
 }:
 
 buildPythonPackage rec {
   pname = "xbox-webapi";
-  version = "2.0.11";
-  format = "setuptools";
+  version = "2.1.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "OpenXbox";
     repo = "xbox-webapi-python";
     rev = "v${version}";
-    sha256 = "0li0bq914xizx9fj49s1iwfrv4bpzvl74bwsi5a34r9yizw02cvz";
+    hash = "sha256-9A3gdSlRjBCx5fBW+jkaSWsFuGieXQKvbEbZzGzLf94=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pytest-runner" ""
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
-    aiohttp
     appdirs
     ecdsa
+    httpx
     ms-cv
     pydantic
   ];
 
   nativeCheckInputs = [
-    aresponses
     pytest-asyncio
     pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    "--asyncio-mode=auto"
+    respx
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/OpenXbox/xbox-webapi-python/blob/${src.rev}/CHANGELOG.md";
     description = "Library to authenticate with Windows Live/Xbox Live and use their API";
     homepage = "https://github.com/OpenXbox/xbox-webapi-python";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/xformers/default.nix b/pkgs/development/python-modules/xformers/default.nix
index bf2d415b3e7d5..164513da94c87 100644
--- a/pkgs/development/python-modules/xformers/default.nix
+++ b/pkgs/development/python-modules/xformers/default.nix
@@ -25,7 +25,7 @@
 #, flash-attn
 }:
 let
-  version = "0.0.22.post7";
+  version = "0.03";
 in
 buildPythonPackage {
   pname = "xformers";
@@ -38,7 +38,7 @@ buildPythonPackage {
     owner = "facebookresearch";
     repo = "xformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7lZi3+2dVDZJFYCUlxsyDU8t9qdnl+b2ERRXKA6Zp7U=";
+    hash = "sha256-G8f7tny5B8SAQ6+2uOjhY7nD0uOT4sskIwtTdwivQXo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/xxhash/default.nix b/pkgs/development/python-modules/xxhash/default.nix
index 4f226e7312959..6eb774677bfc8 100644
--- a/pkgs/development/python-modules/xxhash/default.nix
+++ b/pkgs/development/python-modules/xxhash/default.nix
@@ -1,27 +1,35 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, setuptools-scm
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
-  version = "3.3.0";
-  format = "setuptools";
   pname = "xxhash";
+  version = "3.4.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w/njIrHr7r1E49nS2bEk4MVQwe9BvVUq/c3XGVFu5Bo=";
+    hash = "sha256-A3nWzx/5h81CFgmiZM4CXnTzRuPhRd0QbAzC4+w/mak=";
   };
 
   nativeBuildInputs = [
-    setuptools-scm
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "xxhash"
   ];
 
   meta = with lib; {
+    description = "Python Binding for xxHash";
     homepage = "https://github.com/ifduyue/python-xxhash";
-    description = "Python Binding for xxHash https://pypi.org/project/xxhash/";
+    changelog = "https://github.com/ifduyue/python-xxhash/blob/v${version}/CHANGELOG.rst";
     license = licenses.bsd2;
-    maintainers = [ maintainers.teh ];
+    maintainers = with maintainers; [ teh ];
   };
 }
diff --git a/pkgs/development/python-modules/xyzservices/default.nix b/pkgs/development/python-modules/xyzservices/default.nix
index 797242993f925..8836d5195fc2a 100644
--- a/pkgs/development/python-modules/xyzservices/default.nix
+++ b/pkgs/development/python-modules/xyzservices/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "xyzservices";
-  version = "2023.7.0";
+  version = "2023.10.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DskodCIn1vXUNn6ntFf8/tlDQp9N4pSbWwKoLN9VadY=";
+    hash = "sha256-CRIpJpBDvIJYBC7b7a1Py0RoSwRz7eAntWcq1A3J+gI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yapf/default.nix b/pkgs/development/python-modules/yapf/default.nix
index 0084082c1687f..70f31fe5308b0 100644
--- a/pkgs/development/python-modules/yapf/default.nix
+++ b/pkgs/development/python-modules/yapf/default.nix
@@ -1,25 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPyPy
-, nose
+
+# build-system
+, setuptools
+
+# dependencies
 , importlib-metadata
 , platformdirs
 , tomli
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "yapf";
-  version = "0.40.1";
-  format = "setuptools";
+  version = "0.40.2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lYWH61yOxshgEZqcJdAq3fMKRPdaoVKkIg0w5WqYA3w=";
+    hash = "sha256-TauKXtcTTibVfBZHx0g6+z8TaHi1eQYreGyboWuUY3s=";
   };
 
-  # nose is unavailable on pypy
-  doCheck = !isPyPy;
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     importlib-metadata
@@ -27,11 +34,15 @@ buildPythonPackage rec {
     tomli
   ];
 
+  # nose is unavailable on pypy
+  #doCheck = !isPyPy;
+
   nativeCheckInputs = [
-    nose
+    pytestCheckHook
   ];
 
   meta = {
+    changelog = "https://github.com/google/yapf/blob/v${version}/CHANGELOG.md";
     homepage = "https://github.com/google/yapf";
     description = "Yet Another Python Formatter";
     longDescription = ''
diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index c4d8dac9995c2..6b8e17d2ed194 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -1,40 +1,40 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, pythonAtLeast
 , pythonOlder
+, cython_3
+, expandvars
+, setuptools
 , idna
 , multidict
 , typing-extensions
+, pytest-xdist
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.9.2";
+  version = "1.9.4";
 
   disabled = pythonOlder "3.7";
 
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BKudS59YfAbYAcKr/pMXt3zfmWxlqQ1ehOzEUBCCNXE=";
+    hash = "sha256-Vm24ZxfPgIC5m1iwg7dzqQiuQPBmgeh+WJqXb6+CRr8=";
   };
 
-  patches = [
-    # https://github.com/aio-libs/yarl/issues/876
-    (fetchpatch {
-      url = "https://github.com/aio-libs/yarl/commit/0a94c6e4948e00fff072c0cf367afbf4ac36f906.patch";
-      hash = "sha256-bqT46OLZLkBef8FQ1L95ITD70mC3+WIkr3+h2ekKrvE=";
-    })
-  ];
-
   postPatch = ''
-    sed -i '/^addopts/d' setup.cfg
+    sed -i '/cov/d' pytest.ini
   '';
 
+  nativeBuildInputs = [
+    cython_3
+    expandvars
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     idna
     multidict
@@ -48,6 +48,7 @@ buildPythonPackage rec {
   '';
 
   nativeCheckInputs = [
+    pytest-xdist
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/ytmusicapi/default.nix b/pkgs/development/python-modules/ytmusicapi/default.nix
index 0ba3d4fd7f895..d0aebbc5138cc 100644
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     requests
   ];
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index 78610073af012..8be14e23e7d01 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -4,6 +4,7 @@
 , fasteners
 , fetchPypi
 , numcodecs
+, msgpack
 , numpy
 , pytestCheckHook
 , pythonOlder
@@ -31,7 +32,7 @@ buildPythonPackage rec {
     numpy
     fasteners
     numcodecs
-  ];
+  ] ++ numcodecs.optional-dependencies.msgpack;
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/zeep/default.nix b/pkgs/development/python-modules/zeep/default.nix
index e94f5f23834ba..75e23838c0a4b 100644
--- a/pkgs/development/python-modules/zeep/default.nix
+++ b/pkgs/development/python-modules/zeep/default.nix
@@ -76,6 +76,15 @@ buildPythonPackage rec {
   ]
   ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
+  disabledTests = [
+    # Failed: External connections not allowed during tests.
+    "test_has_expired"
+    "test_has_not_expired"
+    "test_memory_cache_timeout"
+    "test_bytes_like_password_digest"
+    "test_password_digest"
+  ];
+
   preCheck = ''
     export HOME=$TMPDIR
   '';
diff --git a/pkgs/development/python-modules/zeroc-ice/default.nix b/pkgs/development/python-modules/zeroc-ice/default.nix
index b830634eb52ad..39ee5b6cba7d4 100644
--- a/pkgs/development/python-modules/zeroc-ice/default.nix
+++ b/pkgs/development/python-modules/zeroc-ice/default.nix
@@ -1,16 +1,30 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, openssl, bzip2 }:
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, bzip2
+, openssl
+}:
 
 buildPythonPackage rec {
   pname = "zeroc-ice";
-  version = "3.7.9.1";
-  format = "setuptools";
+  version = "3.7.10";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version pname;
-    hash = "sha256-MOVsYfUq3n62hPEUIOGA75RviGofHcXaJKMnYERxg74=";
+    hash = "sha256-Bwn2Y/Bbu6O89iaSNWvMpXBhyJRmj6eL8j6HiPpbQbM=";
   };
 
-  buildInputs = [ openssl bzip2 ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  buildInputs = [
+    bzip2
+    openssl
+  ];
 
   pythonImportsCheck = [ "Ice" ];
 
diff --git a/pkgs/development/python-modules/zfec/default.nix b/pkgs/development/python-modules/zfec/default.nix
index 12253f43d8681..fc3b710919bc1 100644
--- a/pkgs/development/python-modules/zfec/default.nix
+++ b/pkgs/development/python-modules/zfec/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pyutil
 , twisted
 }:
 
 buildPythonPackage rec {
   pname = "zfec";
-  version = "1.5.7.2";
-  format = "setuptools";
+  version = "1.5.7.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TuUZvg3MfaLohIK8/Av5d6Ql4dfoJ4z1u7uNAPiir7Y=";
+    hash = "sha256-EGmFchj4ur5AhEOXEnIIA6Ef6RsU8gvHepak5vThER8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ pyutil ];
 
   nativeCheckInputs = [ twisted ];
diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index 1b033810b5b48..6555d172ce2e1 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -9,14 +9,14 @@
 
 let zipp = buildPythonPackage rec {
   pname = "zipp";
-  version = "3.16.2";
+  version = "3.17.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-68FZRqp4vWNFiZL8gew7b3sektUcNebeHDgE5zt5kUc=";
+    hash = "sha256-hOZKHCjPfpHtIHi7jMjCWcsZt2lCCWyNe4SUdpDKuvA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zope-hookable/default.nix b/pkgs/development/python-modules/zope-hookable/default.nix
index 0d1e5a7ddb420..8ee46c58943f0 100644
--- a/pkgs/development/python-modules/zope-hookable/default.nix
+++ b/pkgs/development/python-modules/zope-hookable/default.nix
@@ -1,21 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , zope-testing
 }:
 
 buildPythonPackage rec {
   pname = "zope-hookable";
-  version = "5.4";
-  format = "setuptools";
+  version = "6.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "zope.hookable";
     inherit version;
-    hash = "sha256-+2AfAKyH5apYKoExXtlnaM41EygHKdP1H3kxLiuLlKw=";
+    hash = "sha256-FmiZPUCnz9yGeEPdVyWSnn+DpbDBlccJrx2u+CdPQ8s=";
   };
 
-  nativeCheckInputs = [ zope-testing ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    zope-testing
+  ];
 
   meta = with lib; {
     description = "Supports the efficient creation of “hookable” objects";
diff --git a/pkgs/development/python-modules/zope-i18nmessageid/default.nix b/pkgs/development/python-modules/zope-i18nmessageid/default.nix
index 3331be330db3e..0b0ef641d3296 100644
--- a/pkgs/development/python-modules/zope-i18nmessageid/default.nix
+++ b/pkgs/development/python-modules/zope-i18nmessageid/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "zope-i18nmessageid";
-  version = "6.0.1";
+  version = "6.1.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "zope.i18nmessageid";
     inherit version;
-    hash = "sha256-LVvOb7MfHOoO+iZEZJvIZ9KXIwPx272f/vzlsuueAXY=";
+    hash = "sha256-Rawm/chvq997ePHBvM/B1DctGlSDi7rt2p26dEStiUE=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/zstandard/default.nix b/pkgs/development/python-modules/zstandard/default.nix
index 2bc20be4d4ed2..ae75db9f7b137 100644
--- a/pkgs/development/python-modules/zstandard/default.nix
+++ b/pkgs/development/python-modules/zstandard/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "zstandard";
-  version = "0.21.0";
+  version = "0.22.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8I46ENAaJHh35MthqCoxnqdGw1ajeGVYvtJIHmxAVUY=";
+    hash = "sha256-giajPFQry1TNa9CjZgZ7YQtBcTtkyavsG8RTPWn1HnA=";
   };
 
   propagatedNativeBuildInputs = [
diff --git a/pkgs/development/python2-modules/wcwidth/default.nix b/pkgs/development/python2-modules/wcwidth/default.nix
index 8424fa4625039..023b92a869071 100644
--- a/pkgs/development/python2-modules/wcwidth/default.nix
+++ b/pkgs/development/python2-modules/wcwidth/default.nix
@@ -3,7 +3,7 @@
 }:
 
 wcwidth.overridePythonAttrs(oldAttrs: {
-  propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [
+  propagatedBuildInputs = oldAttrs.propagatedBuildInputs or [] ++ [
     backports-functools-lru-cache
   ];
 })
diff --git a/pkgs/development/rocm-modules/5/default.nix b/pkgs/development/rocm-modules/5/default.nix
index 204e0ee2abbec..aaf000b79f138 100644
--- a/pkgs/development/rocm-modules/5/default.nix
+++ b/pkgs/development/rocm-modules/5/default.nix
@@ -1,4 +1,5 @@
-{ callPackage
+{ gcc12Stdenv # FIXME: Try removing this with a new ROCm release https://github.com/NixOS/nixpkgs/issues/271943
+, callPackage
 , recurseIntoAttrs
 , symlinkJoin
 , fetchFromGitHub
@@ -73,10 +74,11 @@ in rec {
   # Broken, too many errors
   rdc = callPackage ./rdc {
     inherit rocmUpdateScript rocm-smi rocm-runtime;
+    stdenv = gcc12Stdenv;
     # stdenv = llvm.rocmClangStdenv;
   };
 
-  rocm-docs-core = python3Packages.callPackage ./rocm-docs-core { };
+  rocm-docs-core = python3Packages.callPackage ./rocm-docs-core { stdenv = gcc12Stdenv; };
 
   hip-common = callPackage ./hip-common {
     inherit rocmUpdateScript;
@@ -106,17 +108,20 @@ in rec {
   rocprofiler = callPackage ./rocprofiler {
     inherit rocmUpdateScript clr rocm-core rocm-thunk rocm-device-libs roctracer rocdbgapi rocm-smi hsa-amd-aqlprofile-bin;
     inherit (llvm) clang;
+    stdenv = gcc12Stdenv;
   };
 
   # Needs GCC
   roctracer = callPackage ./roctracer {
     inherit rocmUpdateScript rocm-device-libs rocm-runtime clr;
+    stdenv = gcc12Stdenv;
   };
 
   # Needs GCC
   rocgdb = callPackage ./rocgdb {
     inherit rocmUpdateScript;
     elfutils = elfutils.override { enableDebuginfod = true; };
+    stdenv = gcc12Stdenv;
   };
 
   rocdbgapi = callPackage ./rocdbgapi {
diff --git a/pkgs/development/rocm-modules/5/llvm/base.nix b/pkgs/development/rocm-modules/5/llvm/base.nix
index 6174963fd998c..796a73e1d2c35 100644
--- a/pkgs/development/rocm-modules/5/llvm/base.nix
+++ b/pkgs/development/rocm-modules/5/llvm/base.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, gcc12Stdenv
 , fetchFromGitHub
 , rocmUpdateScript
 , pkg-config
@@ -44,6 +45,13 @@
 , isBroken ? false
 }:
 
+let stdenv' = stdenv; in
+let stdenv =
+      if stdenv'.cc.cc.isGNU or false && lib.versionAtLeast stdenv'.cc.cc.version "13.0"
+      then gcc12Stdenv
+      else stdenv';
+in
+
 let
   llvmNativeTarget =
     if stdenv.isx86_64 then "X86"
diff --git a/pkgs/development/rocm-modules/5/llvm/default.nix b/pkgs/development/rocm-modules/5/llvm/default.nix
index 9226fb87802c7..9c8919165a516 100644
--- a/pkgs/development/rocm-modules/5/llvm/default.nix
+++ b/pkgs/development/rocm-modules/5/llvm/default.nix
@@ -1,4 +1,5 @@
-{ stdenv
+{ # stdenv FIXME: Try changing back to this with a new ROCm release https://github.com/NixOS/nixpkgs/issues/271943
+  gcc12Stdenv
 , callPackage
 , rocmUpdateScript
 , wrapBintoolsWith
@@ -12,18 +13,18 @@
 let
   ## Stage 1 ##
   # Projects
-  llvm = callPackage ./stage-1/llvm.nix { inherit rocmUpdateScript; };
-  clang-unwrapped = callPackage ./stage-1/clang-unwrapped.nix { inherit rocmUpdateScript llvm; };
-  lld = callPackage ./stage-1/lld.nix { inherit rocmUpdateScript llvm; };
+  llvm = callPackage ./stage-1/llvm.nix { inherit rocmUpdateScript; stdenv = gcc12Stdenv; };
+  clang-unwrapped = callPackage ./stage-1/clang-unwrapped.nix { inherit rocmUpdateScript llvm; stdenv = gcc12Stdenv; };
+  lld = callPackage ./stage-1/lld.nix { inherit rocmUpdateScript llvm; stdenv = gcc12Stdenv; };
 
   # Runtimes
-  runtimes = callPackage ./stage-1/runtimes.nix { inherit rocmUpdateScript llvm; };
+  runtimes = callPackage ./stage-1/runtimes.nix { inherit rocmUpdateScript llvm; stdenv = gcc12Stdenv; };
 
   ## Stage 2 ##
   # Helpers
   bintools-unwrapped = callPackage ./stage-2/bintools-unwrapped.nix { inherit llvm lld; };
   bintools = wrapBintoolsWith { bintools = bintools-unwrapped; };
-  rStdenv = callPackage ./stage-2/rstdenv.nix { inherit llvm clang-unwrapped lld runtimes bintools; };
+  rStdenv = callPackage ./stage-2/rstdenv.nix { inherit llvm clang-unwrapped lld runtimes bintools; stdenv = gcc12Stdenv; };
 in rec {
   inherit
   llvm
@@ -40,8 +41,8 @@ in rec {
 
   ## Stage 3 ##
   # Helpers
-  clang = callPackage ./stage-3/clang.nix { inherit llvm lld clang-unwrapped bintools libc libunwind libcxxabi libcxx compiler-rt; };
-  rocmClangStdenv = overrideCC stdenv clang;
+  clang = callPackage ./stage-3/clang.nix { inherit llvm lld clang-unwrapped bintools libc libunwind libcxxabi libcxx compiler-rt; stdenv = gcc12Stdenv; };
+  rocmClangStdenv = overrideCC gcc12Stdenv clang;
 
   # Projects
   clang-tools-extra = callPackage ./stage-3/clang-tools-extra.nix { inherit rocmUpdateScript llvm clang-unwrapped; stdenv = rocmClangStdenv; };
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix b/pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix
index 113313f4e0665..5a61732ffd2d4 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix
@@ -1,10 +1,11 @@
-{ callPackage
+{ stdenv
+, callPackage
 , rocmUpdateScript
 , llvm
 }:
 
 callPackage ../base.nix rec {
-  inherit rocmUpdateScript;
+  inherit stdenv rocmUpdateScript;
   targetName = "clang-unwrapped";
   targetDir = "clang";
   extraBuildInputs = [ llvm ];
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix b/pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix
index a7b042eabfe65..5ca8bca25a338 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix
@@ -1,10 +1,11 @@
-{ callPackage
+{ stdenv
+, callPackage
 , rocmUpdateScript
 , llvm
 }:
 
 callPackage ../base.nix rec {
-  inherit rocmUpdateScript;
+  inherit stdenv rocmUpdateScript;
   buildMan = false; # No man pages to build
   targetName = "lld";
   targetDir = targetName;
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix b/pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix
index 6160e34c1b51c..f601e96f0a352 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix
@@ -4,7 +4,7 @@
 }:
 
 callPackage ../base.nix {
-  inherit rocmUpdateScript;
+  inherit stdenv rocmUpdateScript;
   requiredSystemFeatures = [ "big-parallel" ];
   isBroken = stdenv.isAarch64; # https://github.com/ROCm/ROCm/issues/1831#issuecomment-1278205344
 }
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix b/pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix
index 5f6f278ab10e4..0364a02e6e59b 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix
@@ -1,11 +1,12 @@
 { lib
+, stdenv
 , callPackage
 , rocmUpdateScript
 , llvm
 }:
 
 callPackage ../base.nix rec {
-  inherit rocmUpdateScript;
+  inherit stdenv rocmUpdateScript;
   buildDocs = false;
   buildMan = false;
   buildTests = false;
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix b/pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix
index 45d369a6541c3..3820d45a2b814 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix
@@ -12,6 +12,7 @@ overrideCC stdenv (wrapCCWith rec {
   inherit bintools;
   libcxx = runtimes;
   cc = clang-unwrapped;
+  gccForLibs = stdenv.cc.cc;
 
   extraPackages = [
     llvm
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index c4c3cd8b8d23b..05d1bfbf64e64 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.22";
-  source.sha256 = "sha256-dHulCw5n3yXL07SPlYMad6TVOlgdVfBjly/LFG0ULF8=";
+  version = "2.5.3";
+  source.sha256 = "sha256-JJzQdaxPM1rnD3iMm+D0wYgJOk2n0FvVO+K67z8l58s=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/aws-sam-cli/default.nix b/pkgs/development/tools/aws-sam-cli/default.nix
index 9d2e2e0bb821f..093c5a1ab9e03 100644
--- a/pkgs/development/tools/aws-sam-cli/default.nix
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@@ -24,12 +24,19 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   pythonRelaxDeps = [
     "aws-sam-translator"
     "boto3-stubs"
     "tzlocal"
+    "cookiecutter"
+    "docker"
+    "aws-lambda-builders"
+    "tomlkit"
+    "rich"
+    "jsonschema"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/build-managers/gn/generic.nix b/pkgs/development/tools/build-managers/gn/generic.nix
index 4214bb822b994..bb72e4bb20b4d 100644
--- a/pkgs/development/tools/build-managers/gn/generic.nix
+++ b/pkgs/development/tools/build-managers/gn/generic.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchgit, darwin, writeText
 , ninja, python3
+, disable-warnings-if-gcc13
 , ...
 }:
 
@@ -17,7 +18,7 @@ let
     #endif  // OUT_LAST_COMMIT_POSITION_H_
   '';
 
-in stdenv.mkDerivation {
+in disable-warnings-if-gcc13 (stdenv.mkDerivation {
   pname = "gn-unstable";
   inherit version;
 
@@ -57,4 +58,4 @@ in stdenv.mkDerivation {
     platforms = platforms.unix;
     maintainers = with maintainers; [ stesie matthewbauer primeos ];
   };
-}
+})
diff --git a/pkgs/development/tools/build-managers/scons/3.1.2.nix b/pkgs/development/tools/build-managers/scons/3.1.2.nix
index 097a8ffd519eb..0bac0685b0d1f 100644
--- a/pkgs/development/tools/build-managers/scons/3.1.2.nix
+++ b/pkgs/development/tools/build-managers/scons/3.1.2.nix
@@ -1,16 +1,25 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "3.1.2";
-  src = fetchurl {
-    url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
-    hash = "sha256-eAHz9i9lRSjict94C+EMDpM36JdlC2Ldzunzn94T+Ps=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-C3U4N7+9vplzoJoevQe5Zeuz0TDmB6/miMwBJLzA3WA=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
+  preConfigure = ''
+    python bootstrap.py
+    cd build/scons
+  '';
+
   setupHook = ./setup-hook.sh;
 
   doCheck = true;
@@ -36,3 +45,4 @@ python3.pkgs.buildPythonApplication {
     maintainers = with lib.maintainers; [ AndersonTorres ];
   };
 }
+# TODO: patch to get rid of distutils and other deprecations
diff --git a/pkgs/development/tools/build-managers/scons/4.1.0.nix b/pkgs/development/tools/build-managers/scons/4.1.0.nix
index 65499280c2c4a..f2edf5161aafa 100644
--- a/pkgs/development/tools/build-managers/scons/4.1.0.nix
+++ b/pkgs/development/tools/build-managers/scons/4.1.0.nix
@@ -1,25 +1,32 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "4.1.0";
-  src = fetchurl {
-    url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
-    hash = "sha256-ctKNdi4hJnh/Fz49WeCJI5+LL06e8xFNV/ELEgaYXYU=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-ldus/9ghqAMB7A+NrHiCQm7saCdIpqzufGCLxWRhYKU=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "build/dist" "dist" \
-      --replace "build/doc/man/" ""
+      --replace "build/dist" "dist"
+  '';
+
+  preConfigure = ''
+    python scripts/scons.py
   '';
 
   postInstall = ''
-    mkdir -p "$out/share/man/man1"
-    mv "$out/"*.1 "$out/share/man/man1/"
+    mkdir -pv "$man/share/man/man1"
+    mv -v "$out/"*.1 "$man/share/man/man1/"
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/build-managers/scons/4.5.2.nix b/pkgs/development/tools/build-managers/scons/4.5.2.nix
index 61d1719642e08..f63702cb7ef44 100644
--- a/pkgs/development/tools/build-managers/scons/4.5.2.nix
+++ b/pkgs/development/tools/build-managers/scons/4.5.2.nix
@@ -1,16 +1,20 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "4.5.2";
-  src = fetchurl {
-    url = "mirror://sourceforge/project/scons/scons/${version}/SCons-${version}.tar.gz";
-    hash = "sha256-ziaqyV01CnmkGSGWsL6sPLJPTMq84BI+so0zcPV28HI=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-vxJsz24jDsPcttwPXq9+ztc/N7W4Gkydgykk/FLgZLo=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
   patches = [
     ./env.patch
   ];
@@ -21,9 +25,13 @@ python3.pkgs.buildPythonApplication {
       --replace "build/doc/man/" ""
   '';
 
+  preConfigure = ''
+    python scripts/scons.py
+  '';
+
   postInstall = ''
-    mkdir -p "$out/share/man/man1"
-    mv "$out/"*.1 "$out/share/man/man1/"
+    mkdir -p "$man/share/man/man1"
+    mv "$out/"*.1 "$man/share/man/man1/"
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/check-jsonschema/default.nix b/pkgs/development/tools/check-jsonschema/default.nix
index 01b31266d0a39..3731e3e7e5f35 100644
--- a/pkgs/development/tools/check-jsonschema/default.nix
+++ b/pkgs/development/tools/check-jsonschema/default.nix
@@ -4,7 +4,7 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "check-jsonschema";
-  version = "0.25.0";
+  version = "0.27.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -13,7 +13,7 @@ buildPythonApplication rec {
     owner = "python-jsonschema";
     repo = "check-jsonschema";
     rev = version;
-    hash = "sha256-Hss4MgE09v2KvL8OIapFgocO+5EWE2WEr5xBAjhwNeE=";
+    hash = "sha256-WXvhlkU1dRNKhW3sMakd644W56xv8keMjSZL4MrQEc8=";
   };
 
   propagatedBuildInputs = [
@@ -21,6 +21,7 @@ buildPythonApplication rec {
     jsonschema
     requests
     click
+    regress
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/tools/circup/default.nix b/pkgs/development/tools/circup/default.nix
index f960106629147..08ea01ca240b5 100644
--- a/pkgs/development/tools/circup/default.nix
+++ b/pkgs/development/tools/circup/default.nix
@@ -15,8 +15,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-kax4gnvRkHSqj0Y6Rk8eyPpT7Wia2QngCQtxpqWSl9s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "semver"
   ];
diff --git a/pkgs/development/tools/codespell/default.nix b/pkgs/development/tools/codespell/default.nix
index aff3646340ed8..158e0971e633b 100644
--- a/pkgs/development/tools/codespell/default.nix
+++ b/pkgs/development/tools/codespell/default.nix
@@ -33,8 +33,6 @@ python3.pkgs.buildPythonApplication rec {
     pytest-dependency
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   preCheck = ''
     export ASPELL_CONF="dict-dir ${aspellDicts.en}/lib/aspell"
   '';
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index 05da1f3aa0c10..bed6606151791 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2023.1";
+  version = "2023.3";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
-    sha256 = "qaaHwbfEpBOaIUvUUeAcqGExoxYfaKo+BzJbBgArv7Y=";
+    hash = "sha256-TesfCXc/cGJZrGUgUNp7PuWYcbw/1c+3foEdt0mNyOc=";
   };
 
   depsBuildBuild = [
@@ -30,6 +30,7 @@ python3.pkgs.buildPythonApplication rec {
     jinja2
     markdown
     markupsafe
+    packaging
     pygments
     toml # remove once python311 is the default
     typogrify
diff --git a/pkgs/development/tools/hatch/default.nix b/pkgs/development/tools/hatch/default.nix
index c145504015c25..2e967097d065f 100644
--- a/pkgs/development/tools/hatch/default.nix
+++ b/pkgs/development/tools/hatch/default.nix
@@ -2,19 +2,25 @@
 , stdenv
 , fetchPypi
 , python3
+, cargo
 , git
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hatch";
-  version = "1.7.0";
+  version = "1.9.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-evxwH9WzNoSmZQ4eyriVfhloX4JCQLp0WNys1m+Q+0Y=";
+    hash = "sha256-4ealEeFS7HzU26vE9Pahh0hwvUnJfRfTkLkjLdpoXOM=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    hatchling
+    hatch-vcs
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     click
     hatchling
@@ -24,21 +30,25 @@ python3.pkgs.buildPythonApplication rec {
     packaging
     pexpect
     platformdirs
-    pyperclip
     rich
     shellingham
     tomli-w
     tomlkit
     userpath
     virtualenv
+    zstandard
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = [
+    cargo
+  ] ++ (with python3.pkgs; [
+    binary
     git
     pytestCheckHook
     pytest-mock
     pytest-xdist
-  ];
+    setuptools
+  ]);
 
   preCheck = ''
     export HOME=$(mktemp -d);
@@ -61,10 +71,17 @@ python3.pkgs.buildPythonApplication rec {
     "test_editable_pth"
     # AssertionError: assert len(extract_installed_requirements(output.splitlines())) > 0
     "test_creation_allow_system_packages"
-    # tomlkit 0.12 changes
-    "test_no_strict_naming"
-    "test_project_location_basic_set_first_project"
-    "test_project_location_complex_set_first_project"
+    # cli table output mismatch
+    "test_context_formatting"
+    # expects sh, finds bash
+    "test_all"
+    "test_already_installed_update_flag"
+    "test_already_installed_update_prompt"
+    # unmet expectations about the binary module we provide
+    "test_dependency_not_found"
+    "test_marker_unmet"
+    # output capturing mismatch, likely stdout/stderr mixup
+    "test_no_compatibility_check_if_exists"
   ] ++ lib.optionals stdenv.isDarwin [
     # https://github.com/NixOS/nixpkgs/issues/209358
     "test_scripts_no_environment"
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/development/tools/hotdoc/default.nix
index 6758f1b44e9b2..4f58f961b9f84 100644
--- a/pkgs/development/tools/hotdoc/default.nix
+++ b/pkgs/development/tools/hotdoc/default.nix
@@ -100,7 +100,7 @@ buildPythonApplication rec {
   postPatch = ''
     substituteInPlace hotdoc/extensions/c/c_extension.py \
       --replace "shutil.which('llvm-config')" 'True' \
-      --replace "subprocess.check_output(['llvm-config', '--version']).strip().decode()" '"${llvmPackages.libclang.version}"' \
+      --replace "subprocess.check_output(['llvm-config', '--version']).strip().decode()" '"${lib.versions.major llvmPackages.libclang.version}"' \
       --replace "subprocess.check_output(['llvm-config', '--prefix']).strip().decode()" '"${llvmPackages.libclang.lib}"' \
       --replace "subprocess.check_output(['llvm-config', '--libdir']).strip().decode()" '"${llvmPackages.libclang.lib}/lib"'
   '';
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index 4a57c0f5a0c3a..432fe6826bd73 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "jq";
-  version = "1.7";
+  version = "1.7.1";
 
   # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
   src = fetchurl {
     url = "https://github.com/jqlang/jq/releases/download/jq-${version}/jq-${version}.tar.gz";
-    hash = "sha256-QCoNaXXZRub05ITRqEMgQUoP+Ots9J0sEdFE1NNE22I=";
+    hash = "sha256-R4ycoSn9LjRD/icxS0VeIR4NjGC8j/ffcDhz3u7lgMI=";
   };
 
   outputs = [ "bin" "doc" "man" "dev" "lib" "out" ];
diff --git a/pkgs/development/tools/language-servers/fortls/default.nix b/pkgs/development/tools/language-servers/fortls/default.nix
index 9aed276a63fa5..74f07f84ffc1f 100644
--- a/pkgs/development/tools/language-servers/fortls/default.nix
+++ b/pkgs/development/tools/language-servers/fortls/default.nix
@@ -21,8 +21,6 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [ json5 packaging ];
 
-  preBuild = "export SETUPTOOLS_SCM_PRETEND_VERSION=${version}";
-
   doCheck = true;
   checkPhase = "$out/bin/fortls --help 1>/dev/null";
 
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 93d61b638bea3..849f44ea9bc0d 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -4,7 +4,7 @@
 , fetchurl, fetchpatch, pkg-config, perl, texinfo, setupDebugInfoDirs, buildPackages
 
 # Run time
-, ncurses, readline, gmp, mpfr, expat, libipt, zlib, zstd, dejagnu, sourceHighlight, libiconv
+, ncurses, readline, gmp, mpfr, expat, libipt, zlib, zstd, xz, dejagnu, sourceHighlight, libiconv
 
 , pythonSupport ? stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isCygwin, python3 ? null
 , enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform elfutils, elfutils
@@ -30,11 +30,11 @@ assert pythonSupport -> python3 != null;
 
 stdenv.mkDerivation rec {
   pname = targetPrefix + basename + lib.optionalString hostCpuOnly "-host-cpu-only";
-  version = "13.2";
+  version = "14.1";
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}-${version}.tar.xz";
-    hash = "sha256-/Vvrt74YM6vbbgI8L0mKNUSYKB350FUj2JFbq+uJPwo=";
+    hash = "sha256-1m31EnYUNFH8v/RkzIcj1o8enfRaai1WNaVOcWQ+24A=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config texinfo perl setupDebugInfoDirs ];
 
-  buildInputs = [ ncurses readline gmp mpfr expat libipt zlib zstd guile sourceHighlight ]
+  buildInputs = [ ncurses readline gmp mpfr expat libipt zlib zstd xz guile sourceHighlight ]
     ++ lib.optional pythonSupport python3
     ++ lib.optional doCheck dejagnu
     ++ lib.optional enableDebuginfod (elfutils.override { enableDebuginfod = true; })
diff --git a/pkgs/development/tools/misc/gpuvis/default.nix b/pkgs/development/tools/misc/gpuvis/default.nix
index d4476a9635255..c0a10a09b02b9 100644
--- a/pkgs/development/tools/misc/gpuvis/default.nix
+++ b/pkgs/development/tools/misc/gpuvis/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL2 gtk3 freetype ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'uint32_t' has not been declared
+    "-include cstdint"
+  ];
+
   meta = with lib; {
     description = "GPU Trace Visualizer";
     homepage = "https://github.com/mikesart/gpuvis";
diff --git a/pkgs/development/tools/ofono-phonesim/default.nix b/pkgs/development/tools/ofono-phonesim/default.nix
index 62d8667ffbda5..395211cd13c1c 100644
--- a/pkgs/development/tools/ofono-phonesim/default.nix
+++ b/pkgs/development/tools/ofono-phonesim/default.nix
@@ -1,6 +1,6 @@
 { lib
 , mkDerivation
-, fetchgit
+, fetchzip
 , autoreconfHook
 , pkg-config
 , qtbase
@@ -10,9 +10,8 @@ mkDerivation {
   pname = "ofono-phonesim";
   version = "unstable-2019-11-18";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/network/ofono/phonesim.git";
-    rev = "adf231a84cd3708b825dc82c56e841dd7e3b4541";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/network/ofono/phonesim.git/snapshot/phonesim-adf231a84cd3708b825dc82c56e841dd7e3b4541.tar.gz";
     sha256 = "1840914sz46l8h2jwa0lymw6dvgj72wq9bhp3k4v4rk6masbf6hp";
   };
 
diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index a6aeb98546970..c2ea437148c65 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -7,15 +7,15 @@ let
   rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.66.1";
+  version = "0.69.1";
 
   src = fetchCrate {
     pname = "bindgen-cli";
     inherit version;
-    sha256 = "sha256-xVTVC3dNGIJeFm/v3swekzuJ2RQOe+wSh05vuWYTDRs=";
+    sha256 = "sha256-zqyIc07RLti2xb23bWzL7zFjreEZuUstnYSp+jUX8Lw=";
   };
 
-  cargoHash = "sha256-eIvl0RSKErNPip0r6iz7JVHm5YvuY3ke/6aMgkryRcI=";
+  cargoHash = "sha256-o1B8jq7Ze97pBLE9gvNsmCaD/tsW4f6DL0upzQkxbA4=";
 
   buildInputs = [ clang.cc.lib ];
 
diff --git a/pkgs/games/openmw/tes3mp.nix b/pkgs/games/openmw/tes3mp.nix
index 48454b42df299..5662f2356833f 100644
--- a/pkgs/games/openmw/tes3mp.nix
+++ b/pkgs/games/openmw/tes3mp.nix
@@ -7,13 +7,14 @@
 , luajit
 , makeWrapper
 , symlinkJoin
+, disable-warnings-if-gcc13
 }:
 
 # revisions are taken from https://github.com/GrimKriegor/TES3MP-deploy
 
 let
   # raknet could also be split into dev and lib outputs
-  raknet = stdenv.mkDerivation {
+  raknet = disable-warnings-if-gcc13 (stdenv.mkDerivation {
     pname = "raknet";
     version = "unstable-2020-01-19";
 
@@ -35,7 +36,7 @@ let
     installPhase = ''
       install -Dm555 lib/libRakNetLibStatic.a $out/lib/libRakNetLibStatic.a
     '';
-  };
+  });
 
   coreScripts = stdenv.mkDerivation {
     pname = "corescripts";
diff --git a/pkgs/games/portmod/default.nix b/pkgs/games/portmod/default.nix
index f9631c6d764f1..a0e7d38d178c3 100644
--- a/pkgs/games/portmod/default.nix
+++ b/pkgs/games/portmod/default.nix
@@ -51,8 +51,6 @@ python3Packages.buildPythonApplication rec {
   pname = "portmod";
   format = "pyproject";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # build the rust library independantly
   prePatch = ''
     substituteInPlace setup.py \
diff --git a/pkgs/games/super-tux-kart/default.nix b/pkgs/games/super-tux-kart/default.nix
index d92f01cad37ae..3077d5b9443c1 100644
--- a/pkgs/games/super-tux-kart/default.nix
+++ b/pkgs/games/super-tux-kart/default.nix
@@ -122,6 +122,13 @@ stdenv.mkDerivation rec {
     "-DOpenGL_GL_PREFERENCE=GLVND"
   ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'snprintf' was not declared in this scope
+    "-include cstdio"
+    # GCC 13: error: 'runtime_error' is not a member of 'std'
+    "-include stdexcept"
+  ];
+
   # Extract binary from built app bundle
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/bin
diff --git a/pkgs/misc/hdt/default.nix b/pkgs/misc/hdt/default.nix
index 9e1efd5f836d2..e7c46d78588dd 100644
--- a/pkgs/misc/hdt/default.nix
+++ b/pkgs/misc/hdt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, libtool, pkg-config, zlib, serd }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, libtool, pkg-config, zlib, serd }:
 
 stdenv.mkDerivation rec {
   pname = "hdt";
@@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "1vsq80jnix6cy78ayag7v8ajyw7h8dqyad1q6xkf2hzz3skvr34z";
   };
 
+  patches = [
+    # Pull fix for gcc-13 compatibility pending upstream inclusion:
+    #   https://github.com/rdfhdt/hdt-cpp/pull/276
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/rdfhdt/hdt-cpp/commit/1b775835c6661c67cb18f5d6f65638ba7d4ecf3c.patch";
+      hash = "sha256-2ppcA+Ztw5G/buW2cwCNbuGeUuvgvSruW3OarWNCIHI=";
+    })
+  ];
+
   buildInputs = [ zlib serd ];
 
   nativeBuildInputs = [ autoreconfHook libtool pkg-config ];
diff --git a/pkgs/misc/stabber/default.nix b/pkgs/misc/stabber/default.nix
index ff89241a24698..7ec9a8985e1de 100644
--- a/pkgs/misc/stabber/default.nix
+++ b/pkgs/misc/stabber/default.nix
@@ -15,6 +15,11 @@ stdenv.mkDerivation {
     sha256 = "0042nbgagl4gcxa5fj7bikjdi1gbk0jwyqnzc5lswpb0l5y0i1ql";
   };
 
+  postPatch = ''
+    # New toolchainsd like gcc-13 trigger warnings and fail the build.
+    substituteInPlace configure.ac --replace "-Werror" ""
+  '';
+
   preAutoreconf = ''
     mkdir m4
   '';
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index acdaa6796d65e..a0b91f6d778b7 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -20,7 +20,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.28.0";
+  version = "0.29.1";
 
   disabled = !stdenv.isLinux;
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     rev = "v${version}";
-    sha256 = "sha256-+ecSaVroDC2bWbio4JsuwEvHQdCMpxLt7hIkeREMJs8=";
+    hash = "sha256-+HYCweAI5axx0ZNFd/jLRXkUinRLDmKWMpLTk7FrEe0=";
   };
   format = "other";
 
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 00d46591c1361..66e3303890b03 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, protobuf, protobufc, asciidoc, iptables
+{ stdenv, lib, fetchFromGitHub, protobuf, protobufc, asciidoc, iptables
 , xmlto, docbook_xsl, libpaper, libnl, libcap, libnet, pkg-config, iproute2, gzip
 , which, python3, makeWrapper, docbook_xml_dtd_45, perl, nftables, libbsd, gnutar
 , buildPackages
@@ -6,33 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "criu";
-  version = "3.17.1";
+  version = "3.19";
 
   src = fetchFromGitHub {
     owner = "checkpoint-restore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0B0cdX5bemy4glF9iWjrQIXIqilyYcCcAN9x4Jjrwzk=";
+    hash = "sha256-S0nxBHfm7tWmW5PhSDhSAgy1uDa0RD5GTNpMDUHKqwY=";
   };
 
-  patches = [
-    # Fixes redefinition of rseq headers
-    (fetchpatch {
-      url = "https://github.com/checkpoint-restore/criu/commit/1e6e826ffb7ac05f33fa123051c2fc2ddf0f68ea.patch";
-      hash = "sha256-LJjk0jQ5v5wqeprvBMpxhjLXn7v+lSPldEGgazGUM44=";
-    })
-
-    # compat fixes for glibc-2.36
-    (fetchpatch {
-      url = "https://github.com/checkpoint-restore/criu/commit/8cd5fccd6cf3d03afb5abe463134d31f54d42258.patch";
-      sha256 = "sha256-b65DdLmyIuZik0dNRuWJKUPcDFA6CKq0bi4Vd26zgS4=";
-    })
-    (fetchpatch {
-      url = "https://github.com/checkpoint-restore/criu/commit/517c0947050e63aac72f63a3bf373d76264723b9.patch";
-      sha256 = "sha256-MPZ6oILVoZ7BQEZFjUlp3RuMC7iKTKXAtrUDFqbN4T8=";
-    })
-  ];
-
   enableParallelBuilding = true;
   depsBuildBuild = [ protobufc buildPackages.stdenv.cc ];
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/error-inject/default.nix b/pkgs/os-specific/linux/error-inject/default.nix
index f4a5441721762..69b90169bda02 100644
--- a/pkgs/os-specific/linux/error-inject/default.nix
+++ b/pkgs/os-specific/linux/error-inject/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit
+{ lib, stdenv, fetchzip
 , bison, flex, rasdaemon
 }:
 
@@ -9,9 +9,8 @@
     pname = "mce-inject";
     version = "4cbe46321b4a81365ff3aafafe63967264dbfec5";
 
-    src = fetchgit {
-      url = "https://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git";
-      rev = version;
+    src = fetchzip {
+      url = "https://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git/snapshot/mce-inject-${version}.tar.gz";
       sha256 = "0gjapg2hrlxp8ssrnhvc19i3r1xpcnql7xv0zjgbv09zyha08g6z";
     };
 
@@ -39,9 +38,8 @@
     pname = "aer-inject";
     version = "9bd5e2c7886fca72f139cd8402488a2235957d41";
 
-    src = fetchgit {
-      url = "https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git";
-      rev = version;
+    src = fetchzip {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git/snapshot/aer-inject-${version}.tar.gz";
       sha256 = "0bh6mzpk2mr4xidkammmkfk21b4dbq793qjg25ryyxd1qv0c6cg4";
     };
 
diff --git a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
index a4bbd6d2bb6bf..71a7cd9e947b5 100644
--- a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
+++ b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
@@ -4,26 +4,19 @@
 , autoPatchelfHook
 , expat
 , zlib
-
-# Pick one of
-# - ipu6 (Tiger Lake)
-# - ipu6ep (Alder Lake)
-, ipuVersion ? "ipu6"
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "${ipuVersion}-camera-bin";
-  version = "unstable-2023-02-08";
+  pname = "ipu6-camera-bins";
+  version = "unstable-2023-10-26";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipu6-camera-bins";
-    rev = "276859fc6de83918a32727d676985ec40f31af2b";
-    hash = "sha256-QnedM2UBbGyd2wIF762Mi+VkDZYtC6MifK4XGGxlUzw=";
+    rev = "af5ba0cb4a763569ac7514635013e9d870040bcf";
+    hash = "sha256-y0pT5M7AKACbquQWLZPYpTPXRC5hipLNL61nhs+cst4=";
   };
 
-  sourceRoot = "${finalAttrs.src.name}/${ipuVersion}";
-
   nativeBuildInputs = [
     autoPatchelfHook
     stdenv.cc.cc.lib
@@ -40,32 +33,20 @@ stdenv.mkDerivation (finalAttrs: {
       include \
       $out/
 
-    install -m 0644 -D ../LICENSE $out/share/doc/LICENSE
+    install -m 0644 -D LICENSE $out/share/doc/LICENSE
 
     runHook postInstall
   '';
 
   postFixup = ''
-    for pcfile in $out/lib/pkgconfig/*.pc; do
+    for pcfile in $out/lib/*/pkgconfig/*.pc; do
       substituteInPlace $pcfile \
-        --replace 'exec_prefix=/usr' 'exec_prefix=''${prefix}' \
-        --replace 'prefix=/usr' "prefix=$out" \
-        --replace 'libdir=/usr/lib' 'libdir=''${prefix}/lib' \
-        --replace 'includedir=/usr/include' 'includedir=''${prefix}/include'
+        --replace 'prefix=/usr' "prefix=$out"
     done
   '';
 
-  passthru = {
-    inherit ipuVersion;
-  };
-
-  meta = let
-    generation = {
-      ipu6 = "Tiger Lake";
-      ipu6ep = "Alder Lake";
-    }.${ipuVersion};
-  in with lib; {
-    description = "${generation} IPU firmware and proprietary image processing libraries";
+  meta = with lib; {
+    description = "IPU firmware and proprietary image processing libraries";
     homepage = "https://github.com/intel/ipu6-camera-bins";
     license = licenses.issl;
     sourceProvenance = with sourceTypes; [
diff --git a/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix b/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
index fb2f940ddce63..1a90380838a91 100644
--- a/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation {
   pname = "ivsc-firmware";
-  version = "unstable-2022-11-02";
+  version = "unstable-2023-08-11";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ivsc-firmware";
-    rev = "29c5eff4cdaf83e90ef2dcd2035a9cdff6343430";
-    hash = "sha256-GuD1oTnDEs0HslJjXx26DkVQIe0eS+js4UoaTDa77ME=";
+    rev = "10c214fea5560060d387fbd2fb8a1af329cb6232";
+    hash = "sha256-kEoA0yeGXuuB+jlMIhNm+SBljH+Ru7zt3PzGb+EPBPw=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/fsverity-utils/default.nix b/pkgs/os-specific/linux/fsverity-utils/default.nix
index c5bed075338f7..b0b6286c8cfa4 100644
--- a/pkgs/os-specific/linux/fsverity-utils/default.nix
+++ b/pkgs/os-specific/linux/fsverity-utils/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchgit
+, fetchzip
 , openssl
 , enableShared ? !stdenv.hostPlatform.isStatic
 , enableManpages ? false
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" "dev" ] ++ lib.optional enableManpages "man";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/fsverity-utils.git";
-    rev = "v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/snapshot/fsverity-utils-v${version}.tar.gz";
     sha256 = "sha256-ygBOkp2PBe8Z2ak6SXEJ6HHuT4NRKmIsbJDHcY+h8PQ=";
   };
 
@@ -42,7 +41,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.kernel.org/doc/html/latest/filesystems/fsverity.html#userspace-utility";
-    changelog = "https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/fsverity-utils.git/tree/NEWS.md";
+    changelog = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/tree/NEWS.md";
     description = "A set of userspace utilities for fs-verity";
     license = licenses.mit;
     maintainers = with maintainers; [ jk ];
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 3332699886c9a..83dd82e6ab260 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.376";
+  version = "0.377-2";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-M1uBamN09XepOembDAcHXO/UvnM9s/OiN+eNzChF5Tw=";
+    hash = "sha256-Nh+EIsJ/98NnflndQeSgiV2iOC0icTEfgwAySPbG6Lo=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/i2c-tools/default.nix b/pkgs/os-specific/linux/i2c-tools/default.nix
index 556bc2d89787c..e682bb398f91b 100644
--- a/pkgs/os-specific/linux/i2c-tools/default.nix
+++ b/pkgs/os-specific/linux/i2c-tools/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchgit
+, fetchzip
 , perl
 , read-edid
 }:
@@ -9,9 +9,8 @@ stdenv.mkDerivation rec {
   pname = "i2c-tools";
   version = "4.3";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git";
-    rev = "v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git/snapshot/i2c-tools-v${version}.tar.gz";
     sha256 = "sha256-HlmIocum+HZEKNiS5BUwEIswRfTMUhD1vCPibAuAK0Q=";
   };
 
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index a86af7e6db260..1fae93c532510 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.5.0";
+  version = "6.6.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-pwF5CF+huW08M7BAyAm3XitXVjrcUFpK0F4mCd83NGM=";
+    hash = "sha256-hzjIBK/Qnwv3VpN/DD3iMReDKpjYy79QOGz1AFzWE84=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/ipu6-drivers/default.nix b/pkgs/os-specific/linux/ipu6-drivers/default.nix
index bc85ffd9aa32c..fe9cb1da018c6 100644
--- a/pkgs/os-specific/linux/ipu6-drivers/default.nix
+++ b/pkgs/os-specific/linux/ipu6-drivers/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "ipu6-drivers";
-  version = "unstable-2023-08-28";
+  version = "unstable-2023-11-24";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipu6-drivers";
-    rev = "7c3d6ab1e9e234563a0af51286b0a8d60445f2a3";
-    hash = "sha256-D782v6hIqAl2EO1+zKeakURD3UGVP3c7p3ba/61yfW4=";
+    rev = "07f0612eabfdc31df36f5e316a9eae115807804f";
+    hash = "sha256-8JRZG6IKJT0qtoqJHm8641kSQMLc4Z+DRzK6FpL9Euk=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 8396fd5e3d33b..56ac85fa0b7a5 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iputils";
-  version = "20221126";
+  version = "20231222";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-XVoQhdjBmEK8TbCpaKLjebPw7ZT8iEvyLJDTCkzezeE=";
+    hash = "sha256-/blxT6k79fgbxX8qCQuJMf7zDPwMjJUt7FCscaMXx6U=";
   };
 
   outputs = [ "out" "apparmor" ];
diff --git a/pkgs/os-specific/linux/ivsc-driver/default.nix b/pkgs/os-specific/linux/ivsc-driver/default.nix
index 0491b1d548b46..72173de49baa5 100644
--- a/pkgs/os-specific/linux/ivsc-driver/default.nix
+++ b/pkgs/os-specific/linux/ivsc-driver/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation {
   pname = "ivsc-driver";
-  version = "unstable-2023-03-10";
+  version = "unstable-2023-11-09";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ivsc-driver";
-    rev = "c8db12b907e2e455d4d5586e5812d1ae0eebd571";
-    hash = "sha256-OM9PljvaMKrk72BFeSCqaABFeAws+tOdd3oC2jyNreE=";
+    rev = "73a044d9633212fac54ea96cdd882ff5ab40573e";
+    hash = "sha256-vE5pOtVqjiWovlUMSEoBKTk/qvs8K8T5oY2r7njh0wQ=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 51f6ea471a6a6..995bfba34a7fc 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-SDDdz2HKEfzHloLkb0sv5ldTo+1yJDVc9O7nj4Cjznk=";
+    sha256 = "sha256-wVCBLJK9nlS1N9/DrQtogoZmgWW4ECqInSeQTjUFhcY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index 5248c263b3b2e..68f4ee20df884 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -1,23 +1,48 @@
-{ stdenv, file, lib, fetchFromGitHub, autoreconfHook, bison, flex, pkg-config
-, pythonSupport ? false, swig ? null, python ? null}:
+{ stdenv
+, file
+, lib
+, fetchFromGitHub
+, autoreconfHook
+, bison
+, flex
+, pkg-config
+, doxygen
+, graphviz
+, mscgen
+, asciidoc
+, sourceHighlight
+, pythonSupport ? false
+, swig ? null
+, python ? null
+}:
 
 stdenv.mkDerivation rec {
   pname = "libnl";
-  version = "3.7.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     repo = "libnl";
     owner = "thom311";
     rev = "libnl${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-Ty9NdWKWB29MTRfG5OJlSE0mSTN3Wy+sR4KtuExXcB4=";
+    hash = "sha256-zVpoRlB5xDfo6wJkCJGGptuCXkNkriudtZF2Job9YD4=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ] ++ lib.optional pythonSupport "py";
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ autoreconfHook bison flex pkg-config file ]
-    ++ lib.optional pythonSupport swig;
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    pkg-config
+    file
+    doxygen
+    graphviz
+    mscgen
+    asciidoc
+    sourceHighlight
+  ] ++ lib.optional pythonSupport swig;
 
   postBuild = lib.optionalString (pythonSupport) ''
       cd python
diff --git a/pkgs/os-specific/linux/libtracefs/default.nix b/pkgs/os-specific/linux/libtracefs/default.nix
index 3e9c9115645da..2432a28e0c7bf 100644
--- a/pkgs/os-specific/linux/libtracefs/default.nix
+++ b/pkgs/os-specific/linux/libtracefs/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchgit
+, fetchzip
 , pkg-config
 , libtraceevent
 , asciidoc
@@ -21,10 +21,9 @@ stdenv.mkDerivation rec {
   pname = "libtracefs";
   version = "1.7.0";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git";
-    rev = "libtracefs-${version}";
-    sha256 = "sha256-64eXFFdnZHHf4C3vbADtPuIMsfJ85VZ6t8A1gIc1CW0=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/snapshot/libtracefs-libtracefs-${version}.tar.gz";
+    hash = "sha256-64eXFFdnZHHf4C3vbADtPuIMsfJ85VZ6t8A1gIc1CW0=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index 998b7d052b356..a65d4ed041b41 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -19,8 +19,6 @@ stdenv.mkDerivation rec {
     patchShebangs test
   '';
 
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
-
   # You probably shouldn't ever run these! They will reconfigure Linux
   # NUMA settings, which on my build machine makes the rest of package
   # building ~5% slower until reboot. Ugh!
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 56a92ffa44ef6..e4d245fdc7ce1 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Too red
-  configureFlags = [ "--disable-modern-top" ]
+  # Too red; 8bit support for fixing https://github.com/NixOS/nixpkgs/issues/275220
+  configureFlags = [ "--disable-modern-top" "--enable-watch8bit" ]
     ++ lib.optional withSystemd "--with-systemd"
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index f52342f5af366..d6319fd0dcf31 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , runtimeShell, nixosTests
 , autoreconfHook, bison, flex
 , docbook_xml_dtd_45, docbook_xsl
@@ -47,6 +47,13 @@ stdenv.mkDerivation rec {
     ./respect-xml-catalog-files-var.patch
     ./runtime-shell.patch
     ./fix-install-with-tcb.patch
+    # Fix build against `clang-16` and upcoming `gcc-14`:
+    #   https://github.com/shadow-maint/shadow/pull/857
+    (fetchpatch {
+      name = "fix-implicit-getdef_bool.patch";
+      url = "https://github.com/shadow-maint/shadow/commit/5abe0811b880208600f646356549b7e5cad89060.patch";
+      hash = "sha256-XqvVv8mYY58uXJBKRwncHQRSI45PUkp3dQNn44gzezU=";
+    })
   ];
 
   # The nix daemon often forbids even creating set[ug]id files.
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
new file mode 100644
index 0000000000000..68ae226448354
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -0,0 +1,46 @@
+From 7a27556920fe1feefd17096841c8f3ca1294a1b3 Mon Sep 17 00:00:00 2001
+From: Yuri Nesterov <yuriy.nesterov@unikie.com>
+Date: Wed, 21 Jun 2023 17:17:38 +0300
+Subject: [PATCH] timesyncd: disable NSCD when DNSSEC validation is disabled
+
+Systemd-timesyncd sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 in the unit file
+to disable DNSSEC validation but it doesn't work when NSCD is used in
+the system. This patch disabes NSCD in systemd-timesyncd when
+SYSTEMD_NSS_RESOLVE_VALIDATE is set to 0 so that it uses NSS libraries
+directly.
+---
+ src/timesync/timesyncd.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
+index 1d8ebecc91..2b0ae361ff 100644
+--- a/src/timesync/timesyncd.c
++++ b/src/timesync/timesyncd.c
+@@ -21,6 +21,11 @@
+ #include "timesyncd-conf.h"
+ #include "timesyncd-manager.h"
+ #include "user-util.h"
++#include "env-util.h"
++
++struct traced_file;
++extern void __nss_disable_nscd(void (*)(size_t, struct traced_file *));
++static void register_traced_file(size_t dbidx, struct traced_file *finfo) {}
+ 
+ static int advance_tstamp(int fd, const struct stat *st) {
+         assert_se(fd >= 0);
+@@ -198,6 +203,12 @@ static int run(int argc, char *argv[]) {
+         if (r < 0)
+                 return log_error_errno(r, "Failed to parse fallback server strings: %m");
+ 
++        r = getenv_bool_secure("SYSTEMD_NSS_RESOLVE_VALIDATE");
++        if (r == 0) {
++                log_info("Disabling NSCD because DNSSEC validation is turned off");
++                __nss_disable_nscd(register_traced_file);
++        }
++
+         log_debug("systemd-timesyncd running as pid " PID_FMT, getpid_cached());
+ 
+         notify_message = notify_start("READY=1\n"
+-- 
+2.34.1
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index f57e4039d203d..4a8053707f247 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -55,6 +55,7 @@
 , e2fsprogs
 , elfutils
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
+, gnutls
 , iptables
 , withSelinux ? false
 , libselinux
@@ -207,6 +208,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-core-don-t-taint-on-unmerged-usr.patch
     ./0018-tpm2_context_init-fix-driver-name-checking.patch
     ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -436,7 +438,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
-    ++ lib.optional withRemote libmicrohttpd
+    ++ lib.optionals withRemote [ libmicrohttpd gnutls ]
     ++ lib.optionals (withHomed || withCryptsetup) [ p11-kit ]
     ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
     ++ lib.optionals withLibBPF [ libbpf ]
@@ -773,7 +775,11 @@ stdenv.mkDerivation (finalAttrs: {
     inherit withCryptsetup withHostnamed withImportd withKmod withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
 
     tests = {
-      inherit (nixosTests) switchTest;
+      inherit (nixosTests)
+        switchTest
+        systemd-journal
+        systemd-journal-gateway
+        systemd-journal-upload;
       cross = pkgsCross.${if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform"}.systemd;
     };
   };
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index 371f66856de52..7bdadc2cea150 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -1,12 +1,11 @@
-{ lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libtraceevent, libtracefs, zstd, sourceHighlight }:
+{ lib, stdenv, fetchzip, pkg-config, asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libtraceevent, libtracefs, zstd, sourceHighlight }:
 stdenv.mkDerivation rec {
   pname = "trace-cmd";
   version = "3.2";
 
-  src = fetchgit {
-    url    = "https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
-    rev    = "trace-cmd-v${version}";
-    sha256 = "sha256-KlykIYF4uy1phgWRG5j76FJqgO7XhNnyrTDVTs8YOXY=";
+  src = fetchzip {
+    url    = "https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/snapshot/trace-cmd-v${version}.tar.gz";
+    hash   = "sha256-rTcaaEQ3Y4cneNnZSGiMZNp+Z7dyAa3oNTNMAEXr28g=";
   };
 
   # Don't build and install html documentation
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index 23ebbae8d1cb5..1eda219013da6 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchgit, qtbase, cmake, asciidoc
+{ lib, mkDerivation, fetchzip, qtbase, cmake, asciidoc
 , docbook_xsl, json_c, mesa_glu, freeglut, trace-cmd, pkg-config
 , libtraceevent, libtracefs, freefont_ttf
 }:
@@ -7,9 +7,8 @@ mkDerivation rec {
   pname = "kernelshark";
   version = "2.2.1";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/";
-    rev = "kernelshark-v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/snapshot/kernelshark-v${version}.tar.gz";
     hash = "sha256-V25IzPDOt6V03wgIa/AJ0T8mRaGmXYuMCcvbSOKleY0=";
   };
 
diff --git a/pkgs/os-specific/linux/tuna/default.nix b/pkgs/os-specific/linux/tuna/default.nix
index 0e621a24f0815..e3101cded09f1 100644
--- a/pkgs/os-specific/linux/tuna/default.nix
+++ b/pkgs/os-specific/linux/tuna/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonApplication
-, fetchgit
+, fetchzip
 , pygobject3
 , pytestCheckHook
 , gdk-pixbuf
@@ -16,13 +16,12 @@ buildPythonApplication rec {
   pname = "tuna";
   version = "0.15";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/utils/${pname}/${pname}.git";
-    rev = "v${version}";
-    sha256 = "sha256-lRHlbdCQ0NcjcWgLvCze67kN8NsK0f5RmKfPbkHhk78=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/tuna/tuna.git/snapshot/tuna-v${version}.tar.gz";
+    sha256 = "MwyLBwKz5ur1sBXHiCLq/Nq2u5aaiC+KzXqvGBmQii8=";
   };
 
-  patchPhase = ''
+  postPatch = ''
     mv tuna-cmd.py tuna/cmd.py
 
     substituteInPlace setup.py \
diff --git a/pkgs/os-specific/linux/usbguard-notifier/default.nix b/pkgs/os-specific/linux/usbguard-notifier/default.nix
index c5b296809da19..a9eaa6651f99b 100644
--- a/pkgs/os-specific/linux/usbguard-notifier/default.nix
+++ b/pkgs/os-specific/linux/usbguard-notifier/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   pkg-config,
   libqb,
@@ -23,6 +24,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-gWvCGSbOuey2ELAPD2WCG4q77IClL0S7rE2RaUJDc1I=";
   };
 
+  patches = [
+    # gcc-13 compatibility upstream fix:
+    #   https://github.com/Cropi/usbguard-notifier/pull/74
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/Cropi/usbguard-notifier/commit/f4586b732c8a7379aacbc9899173beeacfd54793.patch";
+      hash = "sha256-2q/qD6yEQUPxA/UutGIZKFJ3hHJ8ZlGMZI1wJyMRbmo=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config asciidoc ];
   buildInputs = [ libqb usbguard librsvg libnotify ];
 
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
index 46e9ee3d0a559..e43ee0b421dc5 100644
--- a/pkgs/os-specific/linux/usbguard/default.nix
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , installShellFiles
 , nixosTests
@@ -32,6 +33,16 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Pull upstream fix for gcc-13:
+    #   https://github.com/USBGuard/usbguard/pull/586
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/USBGuard/usbguard/commit/22b1e0897af977cc96af926c730ff948bd120bb5.patch";
+      hash = "sha256-yw0ZHcn6naHcsfsqdBB/aTgCwvEHecew/6HDmjyY2ZA=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     installShellFiles
diff --git a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
deleted file mode 100644
index 068744d4f32d0..0000000000000
--- a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
+++ /dev/null
@@ -1,277 +0,0 @@
-commit 68564ebb50f8afab5a9527c534417e247cca0b27
-Author: Filipe Manana <fdmanana@kernel.org>
-Date:   Thu Aug 17 10:20:13 2023 +0100
-
-    libmount: Fix regression when mounting with atime
-    
-    A regression was introduced in v2.39 that causes mounting with the atime
-    option to fail:
-    
-      $ mkfs.ext4 -F /dev/sdi
-      $ mount -o atime /dev/sdi /mnt/sdi
-      mount: /mnt/sdi: not mount point or bad option.
-             dmesg(1) may have more information after failed mount system call.
-    
-    The failure comes from the mount_setattr(2) call returning -EINVAL. This
-    is because we pass an invalid value for the attr_clr argument. From a
-    strace capture we have:
-    
-      mount_setattr(4, "", AT_EMPTY_PATH, {attr_set=0, attr_clr=MOUNT_ATTR_NOATIME, propagation=0 /* MS_??? */, userns_fd=0}, 32) = -1 EINVAL (Invalid argument)
-    
-    We can't pass MOUNT_ATTR_NOATIME to mount_setattr(2) through the attr_clr
-    argument because all atime options are exclusive, so in order to set atime
-    one has to pass MOUNT_ATTR__ATIME to attr_clr and leave attr_set as
-    MOUNT_ATTR_RELATIME (which is defined as a value of 0).
-    
-    This can be read from the man page for mount_setattr(2) and also from the
-    kernel source:
-    
-      $ cat fs/namespace.c
-      static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
-                                   struct mount_kattr *kattr, unsigned int flags)
-      {
-          (...)
-          /*
-           * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
-           * users wanting to transition to a different atime setting cannot
-           * simply specify the atime setting in @attr_set, but must also
-           * specify MOUNT_ATTR__ATIME in the @attr_clr field.
-           * So ensure that MOUNT_ATTR__ATIME can't be partially set in
-           * @attr_clr and that @attr_set can't have any atime bits set if
-           * MOUNT_ATTR__ATIME isn't set in @attr_clr.
-           */
-          if (attr->attr_clr & MOUNT_ATTR__ATIME) {
-              if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
-                  return -EINVAL;
-    
-                  /*
-                   * Clear all previous time settings as they are mutually
-                   * exclusive.
-                   */
-                  kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
-                  switch (attr->attr_set & MOUNT_ATTR__ATIME) {
-                  case MOUNT_ATTR_RELATIME:
-                      kattr->attr_set |= MNT_RELATIME;
-                      break;
-                  case MOUNT_ATTR_NOATIME:
-                      kattr->attr_set |= MNT_NOATIME;
-                      break;
-                  case MOUNT_ATTR_STRICTATIME:
-                      break;
-                  default:
-                      return -EINVAL;
-                  }
-        (...)
-    
-    So fix this by setting attr_clr MOUNT_ATTR__ATIME if we want to clear any
-    atime related option.
-    
-    Signed-off-by: Filipe Manana <fdmanana@kernel.org>
-
-diff --git a/libmount/src/optlist.c b/libmount/src/optlist.c
-index 1e962ec6d..0702adae7 100644
---- a/libmount/src/optlist.c
-+++ b/libmount/src/optlist.c
-@@ -875,7 +875,18 @@ int mnt_optlist_get_attrs(struct libmnt_optlist *ls, uint64_t *set, uint64_t *cl
- 
- 		if (opt->ent->mask & MNT_INVERT) {
- 			DBG(OPTLIST, ul_debugobj(ls, " clr: %s", opt->ent->name));
--			*clr |= x;
-+			/*
-+			 * All atime settings are mutually exclusive so *clr must
-+			 * have MOUNT_ATTR__ATIME set.
-+			 *
-+			 * See the function fs/namespace.c:build_mount_kattr()
-+			 * in the linux kernel source.
-+			 */
-+			if (x == MOUNT_ATTR_RELATIME || x == MOUNT_ATTR_NOATIME ||
-+			    x == MOUNT_ATTR_STRICTATIME)
-+				*clr |= MOUNT_ATTR__ATIME;
-+			else
-+				*clr |= x;
- 		} else {
- 			DBG(OPTLIST, ul_debugobj(ls, " set: %s", opt->ent->name));
- 			*set |= x;
-diff --git a/tests/expected/libmount/context-mount-flags b/tests/expected/libmount/context-mount-flags
-index 960641863..eb71323dd 100644
---- a/tests/expected/libmount/context-mount-flags
-+++ b/tests/expected/libmount/context-mount-flags
-@@ -3,3 +3,6 @@ ro,nosuid,noexec
- successfully mounted
- rw,nosuid,noexec
- successfully umounted
-+successfully mounted
-+rw,relatime
-+successfully umounted
-diff --git a/tests/ts/libmount/context b/tests/ts/libmount/context
-index f5b47185e..a5d2e81a3 100755
---- a/tests/ts/libmount/context
-+++ b/tests/ts/libmount/context
-@@ -116,8 +116,15 @@ $TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPU
- 
- ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
- is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
--ts_finalize_subtest
- 
-+# Test that the atime option works after the migration to use the new kernel mount APIs.
-+ts_run $TESTPROG --mount -o atime $DEVICE $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
-+$TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPUT 2>> $TS_ERRLOG
-+is_mounted $DEVICE || echo "$DEVICE not mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
-+ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
-+is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
-+
-+ts_finalize_subtest
- 
- ts_init_subtest "mount-loopdev"
- mkdir -p $MOUNTPOINT &> /dev/null
-
-commit 1ec71634aa4ef5ddca23d65c8a296f3614231e8a
-Author: Colin Gillespie <colin@cgillespie.xyz>
-Date:   Wed Aug 9 18:28:07 2023 +1000
-
-    libblkid: (bcachefs) fix not detecting large superblocks
-    
-    Probing does not detect bcachefs filesystems with a superblock larger
-    than 4KiB. Bcachefs superblocks grow in size and can become much larger
-    than this.
-    
-    Increase the superblock maximum size limit to 1MiB.
-    
-    Validate the superblock isn't larger than the maximum size defined in
-    the superblocks layout section.
-    
-    (cherry picked from commit 48d573797797650d96456979797c0155d58f61cb)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 40e702d75..236877042 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -102,6 +102,15 @@ union bcachefs_sb_csum {
- 	uint8_t raw[16];
- } __attribute__((packed));
- 
-+struct bcachefs_sb_layout {
-+	uint8_t		magic[16];
-+	uint8_t		layout_type;
-+	uint8_t		sb_max_size_bits;
-+	uint8_t		nr_superblocks;
-+	uint8_t		pad[5];
-+	uint64_t	sb_offset[61];
-+} __attribute__((packed));
-+
- struct bcachefs_super_block {
- 	union bcachefs_sb_csum	csum;
- 	uint16_t	version;
-@@ -123,7 +132,7 @@ struct bcachefs_super_block {
- 	uint64_t	flags[8];
- 	uint64_t	features[2];
- 	uint64_t	compat[2];
--	uint8_t		layout[512];
-+	struct bcachefs_sb_layout layout;
- 	struct bcachefs_sb_field _start[];
- }  __attribute__((packed));
- 
-@@ -143,7 +152,7 @@ struct bcachefs_super_block {
- /* granularity of offset and length fields within superblock */
- #define BCACHEFS_SECTOR_SIZE   512
- /* maximum superblock size */
--#define BCACHEFS_SB_MAX_SIZE   4096
-+#define BCACHEFS_SB_MAX_SIZE   0x100000
- /* fields offset within super block */
- #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
- /* tag value for members field */
-@@ -302,6 +311,9 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
-+	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
-+		return BLKID_PROBE_NONE;
-+
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
- 		return BLKID_PROBE_NONE;
- 
-
-commit acbf17ae8f8ee0f941fe98ed12f115f2b349bba8
-Author: Karel Zak <kzak@redhat.com>
-Date:   Wed Aug 23 11:53:45 2023 +0200
-
-    libblkid: (bcachefs) fix compiler warning [-Werror=sign-compare]
-    
-    Addresses: https://github.com/util-linux/util-linux/pull/2427
-    Signed-off-by: Karel Zak <kzak@redhat.com>
-    (cherry picked from commit 17873d38fc97913c0a31d4bd08cfbfe45c4de5be)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 236877042..6ab3fe9d4 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -311,7 +311,7 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
--	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
-+	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
- 		return BLKID_PROBE_NONE;
- 
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
-
-commit 6b9fda87c4e5d0c6f945d7565197f157b9fa3d5f
-Author: Thomas Weißschuh <thomas@t-8ch.de>
-Date:   Wed Aug 23 11:58:33 2023 +0200
-
-    libblkid: (bcachefs) fix size validation
-    
-    Avoid signed shift out-of-bounds.
-    
-    Also mark the constants explitly as unsigned instead of casting.
-    
-    Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
-    (cherry picked from commit befe455f59de8c7bc66b85ed52aae8cbc95325fa)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 6ab3fe9d4..28ac4b52b 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -142,17 +142,19 @@ struct bcachefs_super_block {
- /* magic string len */
- #define BCACHE_SB_MAGIC_LEN (sizeof(BCACHE_SB_MAGIC) - 1)
- /* super block offset */
--#define BCACHE_SB_OFF       0x1000
-+#define BCACHE_SB_OFF       0x1000U
- /* supper block offset in kB */
- #define BCACHE_SB_KBOFF     (BCACHE_SB_OFF >> 10)
- /* magic string offset within super block */
- #define BCACHE_SB_MAGIC_OFF offsetof(struct bcache_super_block, magic)
- /* start of checksummed data within superblock */
--#define BCACHE_SB_CSUMMED_START 8
-+#define BCACHE_SB_CSUMMED_START 8U
- /* granularity of offset and length fields within superblock */
--#define BCACHEFS_SECTOR_SIZE   512
-+#define BCACHEFS_SECTOR_SIZE   512U
-+/* maximum superblock size shift */
-+#define BCACHEFS_SB_MAX_SIZE_SHIFT   0x10U
- /* maximum superblock size */
--#define BCACHEFS_SB_MAX_SIZE   0x100000
-+#define BCACHEFS_SB_MAX_SIZE   (1U << BCACHEFS_SB_MAX_SIZE_SHIFT)
- /* fields offset within super block */
- #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
- /* tag value for members field */
-@@ -311,12 +313,16 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
--	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
--		return BLKID_PROBE_NONE;
- 
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
- 		return BLKID_PROBE_NONE;
- 
-+	if (bcs->layout.sb_max_size_bits > BCACHEFS_SB_MAX_SIZE_SHIFT)
-+		return BLKID_PROBE_NONE;
-+
-+	if (sb_size > (BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
-+		return BLKID_PROBE_NONE;
-+
- 	sb = blkid_probe_get_sb_buffer(pr, mag, sb_size);
- 	if (!sb)
- 		return BLKID_PROBE_NONE;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index d710fabb7ace0..ba989b41a6cac 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -20,16 +20,15 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
-  version = "2.39.2";
+  version = "2.39.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
-    hash = "sha256-h6vfqo5JD4vm3el298gLm1/58wHhtn44meHwWlmhUx8=";
+    hash = "sha256-e2YF5I0aSfQ8xLTPxZ8xPQ3VQC+kC5aBC9Vy4Wff7Q8=";
   };
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
-    ./bcachefs-patch-set.patch
   ];
 
   # We separate some of the utilities into their own outputs. This
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index e17fda67218e1..3d16748f05a2e 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -1,21 +1,16 @@
 { lib, stdenv, fetchFromGitHub, kernel, kmod }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "v4l2loopback";
-  version = "unstable-2023-02-19-${kernel.version}";
+  version = "unstable-2023-11-23-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "umlaeute";
     repo = "v4l2loopback";
-    rev = "fb410fc7af40e972058809a191fae9517b9313af";
-    hash = "sha256-gLFtR7s+3LUQ0BZxHbmaArHbufuphbtAX99nxJU3c84=";
+    rev = "850a2e36849f6ad3c9bf74f2ae3f603452bd8a71";
+    hash = "sha256-LqP5R3oKbjUQUfDZUWpkrmyopWhOt4wlgSgGywTPJXM=";
   };
 
-  patches = [
-    # fix bug https://github.com/umlaeute/v4l2loopback/issues/535
-    ./revert-pr518.patch
-  ];
-
   hardeningDisable = [ "format" "pic" ];
 
   preBuild = ''
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 3cbda3a7ebdd9..950547c4f001a 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -142,6 +142,20 @@ rec {
 
   };
 
+  # As defined by systemd.syntax(7)
+  #
+  # null does not set any value, which allows for RFC42 modules to specify
+  # optional config options.
+  systemd = let
+    mkValueString = lib.generators.mkValueStringDefault {};
+    mkKeyValue = k: v:
+      if v == null then "# ${k} is unset"
+      else "${k} = ${mkValueString v}";
+  in ini {
+    listsAsDuplicateKeys = true;
+    inherit mkKeyValue;
+  };
+
   keyValue = {
     # Represents lists as duplicate keys
     listsAsDuplicateKeys ? false,
diff --git a/pkgs/servers/ebusd/default.nix b/pkgs/servers/ebusd/default.nix
index 3e0b24c42c86d..bc20b930aef06 100644
--- a/pkgs/servers/ebusd/default.nix
+++ b/pkgs/servers/ebusd/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, pkgs, fetchFromGitHub, argparse, mosquitto, cmake, autoconf, automake, libtool, pkg-config, openssl }:
+{ lib, stdenv, pkgs, fetchFromGitHub, fetchpatch, argparse, mosquitto, cmake, autoconf, automake, libtool, pkg-config, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "ebusd";
@@ -27,6 +27,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./patches/ebusd-cmake.patch
+    # Upstream patch for gcc-13 copmpatibility:
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/john30/ebusd/commit/3384f3780087bd6b94d46bf18cdad18201ad516c.patch";
+      hash = "sha256-+wZDHjGaIhBCqhy2zmIE8Ko3uAiw8kfKx64etCqRQjM=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 62abc5de309ae..72f9fd11c7966 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -3,6 +3,7 @@
 , callPackage
 , fetchFromGitHub
 , fetchPypi
+, fetchpatch
 , python311
 , substituteAll
 , ffmpeg-headless
@@ -30,16 +31,46 @@ let
     # Override the version of some packages pinned in Home Assistant's setup.py and requirements_all.txt
 
     (self: super: {
-      # https://github.com/home-assistant/core/pull/101913
-      aiohttp = super.aiohttp.overridePythonAttrs (old: rec {
-        version = "3.9.1";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-j8Sah6wmnUUp2kWHHi/7aHTod3nD0OLM2BPAiZIhI50=";
+      aiogithubapi = super.aiogithubapi.overridePythonAttrs (oldAttrs: rec {
+        version = "22.10.1";
+        src = fetchFromGitHub {
+          owner = "ludeeus";
+          repo = "aiogithubapi";
+          rev = "refs/tags/${version}";
+          hash = "sha256-ceBuqaMqqL6qwN52765MG4sLt+08hx2G9rUVNC7x6ik=";
+        };
+        propagatedBuildInputs = with self; [
+          aiohttp
+          async-timeout
+          backoff
+        ];
+      });
+
+      aionotion = super.aionotion.overridePythonAttrs (oldAttrs: rec {
+        version = "2023.05.5";
+        src = fetchFromGitHub {
+          owner = "bachya";
+          repo = "aionotion";
+          rev = "refs/tags/${version}";
+          hash = "sha256-/2sF8m5R8YXkP89bi5zR3h13r5LrFOl1OsixAcX0D4o=";
+        };
+        patches = [
+          (fetchpatch {
+            # clean up build dependencies; https://github.com/bachya/aionotion/commit/53c7285110d12810f9b43284295f71d052a81b83
+            url = "https://github.com/bachya/aionotion/commit/53c7285110d12810f9b43284295f71d052a81b83.patch";
+            hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+          })
+        ];
+      });
+
+      aiopvapi = super.aiopvapi.overridePythonAttrs (oldAttrs: rec {
+        version = "2.0.4";
+        src = fetchFromGitHub {
+          owner = "sander76";
+          repo = "aio-powerview-api";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-cghfNi5T343/7GxNLDrE0iAewMlRMycQTP7SvDVpU2M=";
         };
-        patches = [];
-        doCheck = false;
       });
 
       aioskybell = super.aioskybell.overridePythonAttrs (oldAttrs: rec {
@@ -60,14 +91,19 @@ let
           rev = "refs/tags/${version}";
           hash = "sha256-tWnxGLJT+CRFvkhxFamHxnLXBvoR8tfOvzH1o1i5JJg=";
         };
+        postPatch = ''
+          substituteInPlace pyproject.toml --replace \
+            '"setuptools >= 35.0.2", "wheel >= 0.29.0", "poetry>=0.12"' \
+            '"poetry-core"'
+        '';
       });
 
-      aioresponses = super.aioresponses.overridePythonAttrs (oldAttrs: rec {
-        pname = "aioresponses";
-        version = "0.7.6";
+      amberelectric = super.amberelectric.overridePythonAttrs (oldAttrs: rec {
+        version = "1.0.4";
         src = fetchPypi {
-          inherit pname version;
-          hash = "sha256-95XZ29otYXdIQOfjL1Nm9FdS0a3Bt0yTYq/QFylsfuE=";
+          inherit (oldAttrs) pname;
+          inherit version;
+          hash = "sha256-5SWJnTxRm6mzP0RxrgA+jnV+Gp23WjqQA57wbT2V9Dk=";
         };
       });
 
@@ -123,6 +159,7 @@ let
           aenum
           aiohttp
           pydantic
+          requests
         ];
         doCheck = false; # requires asynctest, which does not work on python 3.11
       });
@@ -146,6 +183,16 @@ let
         };
       });
 
+      mcstatus = super.mcstatus.overridePythonAttrs (oldAttrs: rec {
+        version = "11.0.0";
+        src = fetchFromGitHub {
+          owner = "py-mine";
+          repo = "mcstatus";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-1jPIsFEJ17kjtCBiX4IvSf2FxYw9DkH3MrrJ85N71tc=";
+        };
+      });
+
       notifications-android-tv = super.notifications-android-tv.overridePythonAttrs (oldAttrs: rec {
         version = "0.1.5";
         format = "setuptools";
@@ -219,6 +266,18 @@ let
         };
       });
 
+      pyaussiebb = super.pyaussiebb.overridePythonAttrs (oldAttrs: rec {
+        version = "0.0.18";
+        src = fetchFromGitHub {
+          owner = "yaleman";
+          repo = "aussiebb";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-tEdddVsLFCHRvyLCctDakioiop2xWaJlfGE16P1ukHc=";
+        };
+      });
+
+      pydantic = super.pydantic_1;
+
       pydexcom = super.pydexcom.overridePythonAttrs (oldAttrs: rec {
         version = "0.2.3";
         src = fetchFromGitHub {
@@ -287,6 +346,35 @@ let
         };
       });
 
+      tesla-powerwall = super.tesla-powerwall.overridePythonAttrs (oldAttrs: rec {
+        version = "0.3.19";
+        src = fetchFromGitHub {
+          owner = "jrester";
+          repo = "tesla_powerwall";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-ClrMgPAMBtDMfD6hCJIN1u4mp75QW+c3re28v3FreQg=";
+        };
+      });
+
+      versioningit = super.versioningit.overridePythonAttrs (oldAttrs: rec {
+        version = "2.2.0";
+        src = fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          hash = "sha256-6xjnunJoqIC/HM/pLlNOlqs04Dl/KNy8s/wNpPaltr0=";
+        };
+      });
+
+      voluptuous = super.voluptuous.overridePythonAttrs (oldAttrs: rec {
+        version = "0.13.1";
+        src = fetchFromGitHub {
+          owner = "alecthomas";
+          repo = "voluptuous";
+          rev = "refs/tags/${version}";
+          hash = "sha256-cz3Bd+/yPh+VOHxzi/W+gbDh/H5Nl/n4jvxDOirmAVk=";
+        };
+      });
+
       # Pinned due to API changes ~1.0
       vultr = super.vultr.overridePythonAttrs (oldAttrs: rec {
         version = "0.1.2";
@@ -298,6 +386,29 @@ let
         };
       });
 
+      xbox-webapi = super.xbox-webapi.overridePythonAttrs (oldAttrs: rec {
+        version = "2.0.11";
+        src = fetchFromGitHub {
+          owner = "OpenXbox";
+          repo = "xbox-webapi-python";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-fzMB+I8+ZTJUiZovcuj+d5GdHY9BJyJd6j92EhJeIFI=";
+        };
+        postPatch = ''
+          sed -i '/pytest-runner/d' setup.py
+        '';
+        propagatedBuildInputs = with self; [
+          aiohttp
+          appdirs
+          ms-cv
+          pydantic
+          ecdsa
+        ];
+        nativeCheckInputs = with self; [
+          aresponses
+        ];
+      });
+
       # internal python packages only consumed by home-assistant itself
       home-assistant-frontend = self.callPackage ./frontend.nix { };
       home-assistant-intents = self.callPackage ./intents.nix { };
@@ -352,27 +463,19 @@ in python.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python.pkgs; [
     pythonRelaxDepsHook
     setuptools
-    wheel
   ];
 
   pythonRelaxDeps = [
-    "aiohttp"
-    "attrs"
     "awesomeversion"
-    "bcrypt"
     "ciso8601"
     "cryptography"
-    "home-assistant-bluetooth"
     "httpx"
-    "ifaddr"
+    "lru-dict"
     "orjson"
-    "pip"
-    "PyJWT"
-    "pyOpenSSL"
-    "PyYAML"
-    "requests"
+    "pyopenssl"
     "typing-extensions"
-    "voluptuous-serialize"
+    "urllib3"
+    "voluptuous"
     "yarl"
   ];
 
@@ -403,6 +506,9 @@ in python.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python.pkgs; [
     # Only packages required in pyproject.toml
     aiohttp
+    aiohttp-cors
+    aiohttp-fast-url-dispatcher
+    aiohttp-zlib-ng
     astral
     async-timeout
     atomicwrites-homeassistant
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index c6e7ad1f56616..27cfd755bcdd2 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -42,6 +42,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/apache/httpd/commit/918620a183d843fb393ed939423a25d42c1044ec.patch";
       hash = "sha256-YZi3t++hjM0skisax2xuh9DifZVZjCjVn6XQr6QKGEs=";
     })
+  ] ++ lib.optionals libxml2Support [
+    (fetchpatch {
+      name = "compat-with-libxml2-2.12.patch";
+      url = "https://github.com/apache/httpd/commit/27a68e54b7c6d2ae80dca396fd2727852897dab1.patch";
+      hash = "sha256-k2EqCaDkckrXLsHnjP4h+b1brTnde4pUyrbOiPFB6qk=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/ldap/lldap/default.nix b/pkgs/servers/ldap/lldap/default.nix
index ac55ac025d135..892fa3a10c365 100644
--- a/pkgs/servers/ldap/lldap/default.nix
+++ b/pkgs/servers/ldap/lldap/default.nix
@@ -7,7 +7,6 @@
 , nixosTests
 , rustPlatform
 , rustc
-, rustc-wasm32
 , stdenv
 , wasm-bindgen-cli
 , wasm-pack
@@ -48,7 +47,7 @@ let
     pname = commonDerivationAttrs.pname + "-frontend";
 
     nativeBuildInputs = [
-      wasm-pack wasm-bindgen-84 binaryen which rustc-wasm32 rustc-wasm32.llvmPackages.lld
+      wasm-pack wasm-bindgen-84 binaryen which rustc rustc.llvmPackages.lld
     ];
 
     buildPhase = ''
diff --git a/pkgs/servers/pinnwand/default.nix b/pkgs/servers/pinnwand/default.nix
index 86e05cfed45ac..fac861d56b02a 100644
--- a/pkgs/servers/pinnwand/default.nix
+++ b/pkgs/servers/pinnwand/default.nix
@@ -18,12 +18,13 @@ with python3.pkgs; buildPythonApplication rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'sqlalchemy = "^1.4"' 'sqlalchemy = "*"'
-  '';
+  pythonRelaxDeps = [
+    "docutils"
+    "sqlalchemy"
+  ];
 
   propagatedBuildInputs = [
     click
diff --git a/pkgs/servers/search/khoj/default.nix b/pkgs/servers/search/khoj/default.nix
index 058fe91ab7653..b09864492d7fc 100644
--- a/pkgs/servers/search/khoj/default.nix
+++ b/pkgs/servers/search/khoj/default.nix
@@ -2,74 +2,83 @@
 , stdenv
 , fetchFromGitHub
 , python3
-, qt6
+, postgresql
+, postgresqlTestHook
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "khoj";
-  version = "0.3.0";
-  format = "pyproject";
+  version = "1.0.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "debanjum";
     repo = "khoj";
     rev = "refs/tags/${version}";
-    hash = "sha256-9kKK0DXpLfPB2LMnYcC6BKgZaoRsNHBZVe4thI7b9tk=";
+    hash = "sha256-lvOeYTrvW5MfhuJ3lj9n9TRlvpRwVP2vFeaEeJdqIec=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "dateparser == 1.1.1" "dateparser" \
-      --replace "defusedxml == 0.7.1" ""defusedxml"" \
-      --replace "fastapi == 0.77.1" "fastapi" \
-      --replace "jinja2 == 3.1.2" "jinja2" \
-      --replace "openai == 0.20.0" "openai" \
-      --replace "pillow == 9.3.0" "pillow" \
-      --replace "pydantic == 1.9.1" "pydantic" \
-      --replace "pyyaml == 6.0" "pyyaml" \
-      --replace "pyqt6 == 6.3.1" "pyqt6" \
-      --replace "rich >= 13.3.1" "rich" \
-      --replace "schedule == 1.1.0" "schedule" \
-      --replace "sentence-transformers == 2.2.2" "sentence-transformers" \
-      --replace "torch == 1.13.1" "torch" \
-      --replace "uvicorn == 0.17.6" "uvicorn"
-  '';
+  env = {
+    DJANGO_SETTINGS_MODULE = "khoj.app.settings";
+    postgresqlEnableTCP = 1;
+  };
 
   nativeBuildInputs = with python3.pkgs; [
     hatch-vcs
     hatchling
-  ] ++ (with qt6; [
-    wrapQtAppsHook
-  ]);
-
-  buildInputs = lib.optionals stdenv.isLinux [
-    qt6.qtwayland
-  ] ++ lib.optionals stdenv.isDarwin [
-    qt6.qtbase
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
+    aiohttp
+    anyio
+    authlib
+    beautifulsoup4
     dateparser
     defusedxml
+    django
     fastapi
+    google-auth
+    # gpt4all
+    gunicorn
+    httpx
+    itsdangerous
     jinja2
-    numpy
+    langchain
+    lxml
     openai
+    openai-whisper
+    pgvector
     pillow
+    psycopg2
     pydantic
-    pyqt6
+    pymupdf
+    python-multipart
     pyyaml
+    # rapidocr-onnxruntime
+    requests
     rich
     schedule
     sentence-transformers
+    stripe
+    tenacity
+    tiktoken
     torch
+    transformers
+    tzdata
     uvicorn
   ];
 
   nativeCheckInputs = with python3.pkgs; [
+    freezegun
+    factory-boy
+    pytest-xdist
+    trio
+    psutil
+    pytest-django
     pytestCheckHook
+  ] ++ [
+    (postgresql.withPackages (p: with p; [ pgvector ]))
+    postgresqlTestHook
   ];
 
   preCheck = ''
@@ -82,32 +91,51 @@ python3.pkgs.buildPythonApplication rec {
 
   disabledTests = [
     # Tests require network access
-    "test_search_with_valid_content_type"
-    "test_update_with_valid_content_type"
-    "test_regenerate_with_valid_content_type"
-    "test_image_search"
-    "test_notes_search"
-    "test_notes_search_with_only_filters"
-    "test_notes_search_with_include_filter"
-    "test_notes_search_with_exclude_filter"
+    "test_different_user_data_not_accessed"
+    "test_get_api_config_types"
+    "test_get_configured_types_via_api"
     "test_image_metadata"
     "test_image_search"
-    "test_image_search_query_truncated"
     "test_image_search_by_filepath"
-    "test_asymmetric_setup_with_missing_file_raises_error"
-    "test_asymmetric_setup_with_empty_file_raises_error"
-    "test_asymmetric_reload"
-    "test_asymmetric_setup"
-    "test_asymmetric_search"
-    "test_entry_chunking_by_max_tokens"
-    "test_incremental_update"
+    "test_image_search_query_truncated"
+    "test_index_update"
+    "test_index_update_with_no_auth_key"
+    "test_notes_search"
+    "test_notes_search_with_exclude_filter"
+    "test_notes_search_with_include_filter"
+    "test_parse_html_plaintext_file"
+    "test_regenerate_index_with_new_entry"
+    "test_regenerate_with_github_fails_without_pat"
+    "test_regenerate_with_invalid_content_type"
+    "test_regenerate_with_valid_content_type"
+    "test_search_for_user2_returns_empty"
+    "test_search_with_invalid_auth_key"
+    "test_search_with_invalid_content_type"
+    "test_search_with_no_auth_key"
+    "test_search_with_valid_content_type"
+    "test_text_index_same_if_content_unchanged"
+    "test_text_indexer_deletes_embedding_before_regenerate"
+    "test_text_search"
+    "test_text_search_setup_batch_processes"
+    "test_update_with_invalid_content_type"
+    "test_user_no_data_returns_empty"
+
+    # Tests require rapidocr-onnxruntime
+    "test_multi_page_pdf_to_jsonl"
+    "test_single_page_pdf_to_jsonl"
+    "test_ocr_page_pdf_to_jsonl"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/test_conversation_utils.py"
   ];
 
   meta = with lib; {
     description = "Natural Language Search Assistant for your Org-Mode and Markdown notes, Beancount transactions and Photos";
     homepage = "https://github.com/debanjum/khoj";
     changelog = "https://github.com/debanjum/khoj/releases/tag/${version}";
-    license = licenses.gpl3Only;
+    license = licenses.agpl3Plus;
     maintainers = with maintainers; [ dit7ya ];
     # src/tcmalloc.cc:333] Attempt to free invalid pointer
     broken = stdenv.isDarwin;
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_1.nix b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
index f5de11c7cc110..a51fc1d104b1e 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_1.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
@@ -2,5 +2,5 @@
 
 callPackage ./. (args // {
   version = "3.1.21";
-  hash = "sha256-PovyQvomT8+vGWS39/QjLauiGkSiuqKQpTrSXdyVyow=";
+  hash = "sha256-guN3Rcsb/EV4rxPE3yhJRSsT1+z44zUetg7ZBA4WjIc=";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_2.nix b/pkgs/servers/sql/mariadb/connector-c/3_2.nix
index d9ef5d8966fec..6619e261650c7 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_2.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_2.nix
@@ -2,5 +2,5 @@
 
 callPackage ./. (args // {
   version = "3.2.7";
-  hash = "sha256-nXGWJI5ml8Ccc+Fz/psoIEX1XsnXrnQ8HrrQi56lbdo=";
+  hash = "sha256-F7s9fcbJiz6lsWrvlTpY+ZET8MPwlyWPKJZOvHEwBvo=";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_3.nix b/pkgs/servers/sql/mariadb/connector-c/3_3.nix
index ec70d9998283f..9f750fe8108be 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_3.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_3.nix
@@ -2,5 +2,5 @@
 
 callPackage ./. (args // {
   version = "3.3.5";
-  hash = "sha256-ynLrJvbbK++nfkj/lm9xvNPLRLM72Lu4ELZebQEcHlw=";
+  hash = "sha256-RLHx8PyfbfIDr6X6ky5/w0XsGMFd+v5PgmQHvYOaf+k=";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/default.nix b/pkgs/servers/sql/mariadb/connector-c/default.nix
index 7a175620c7cbf..be4af113c1d9f 100644
--- a/pkgs/servers/sql/mariadb/connector-c/default.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake
+{ lib, stdenv, fetchFromGitHub, cmake
 , curl, openssl, zlib, zstd
 , libiconv
 , version, hash, ...
@@ -13,8 +13,10 @@ in stdenv.mkDerivation {
   pname = "mariadb-connector-c";
   inherit version;
 
-  src = fetchurl {
-    url = "https://downloads.mariadb.com/Connectors/c/connector-c-${version}/mariadb-connector-c-${version}-src.tar.gz";
+  src = fetchFromGitHub {
+    owner = "mariadb-corporation";
+    repo = "mariadb-connector-c";
+    rev = "v${version}";
     inherit hash;
   };
 
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 6cd3e2c7a0147..3ff31ba1d3abe 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -58,6 +58,10 @@ let
 
       patches = [
         ./patch/cmake-includedir.patch
+
+        # Fix build with libxml 2.12 and Clang 16.
+        # https://github.com/MariaDB/server/pull/2983
+        ./patch/0001-Fix-build-with-libxml2-2.12.patch
       ]
         # Fixes a build issue as documented on
         # https://jira.mariadb.org/browse/MDEV-26769?focusedCommentId=206073&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-206073
@@ -234,7 +238,6 @@ let
       '';
 
       CXXFLAGS = lib.optionalString stdenv.hostPlatform.isi686 "-fpermissive";
-      NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
     });
   in
     server // {
diff --git a/pkgs/servers/sql/mariadb/patch/0001-Fix-build-with-libxml2-2.12.patch b/pkgs/servers/sql/mariadb/patch/0001-Fix-build-with-libxml2-2.12.patch
new file mode 100644
index 0000000000000..a12dfb73d09de
--- /dev/null
+++ b/pkgs/servers/sql/mariadb/patch/0001-Fix-build-with-libxml2-2.12.patch
@@ -0,0 +1,167 @@
+From 1f1ee5d3776af7ef56ffa3f4dcd22532c2c86c74 Mon Sep 17 00:00:00 2001
+From: Jan Tojnar <jtojnar@gmail.com>
+Date: Sun, 7 Jan 2024 10:19:54 +0100
+Subject: [PATCH] Fix build with libxml2 2.12
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+libxml2 2.12.0 made `xmlGetLastError()` return `const` pointer:
+
+https://gitlab.gnome.org/GNOME/libxml2/-/commit/61034116d0a3c8b295c6137956adc3ae55720711
+
+Clang 16 does not like this:
+
+    error: assigning to 'xmlErrorPtr' (aka '_xmlError *') from 'const xmlError *' (aka 'const _xmlError *') discards qualifiers
+    error: cannot initialize a variable of type 'xmlErrorPtr' (aka '_xmlError *') with an rvalue of type 'const xmlError *' (aka 'const _xmlError *')
+
+Let’s update the variables to `const`.
+For older versions, it will be automatically converted.
+
+But then `xmlResetError(xmlError*)` will not like the `const` pointer:
+
+    error: no matching function for call to 'xmlResetError'
+    note: candidate function not viable: 1st argument ('const xmlError *' (aka 'const _xmlError *')) would lose const qualifier
+
+Let’s replace it with `xmlResetLastError()`.
+
+ALso remove `LIBXMLDOC::Xerr` protected member property.
+It was introduced in 65b0e5455b547a3d574fa77b34cce23ae3bea0a0
+along with the `xmlResetError` calls.
+It does not appear to be used for anything.
+---
+ storage/connect/libdoc.cpp | 39 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/storage/connect/libdoc.cpp b/storage/connect/libdoc.cpp
+index e414aa88355..10edcbc3ffa 100644
+--- a/storage/connect/libdoc.cpp
++++ b/storage/connect/libdoc.cpp
+@@ -93,7 +93,6 @@ class LIBXMLDOC : public XMLDOCUMENT {
+   xmlXPathContextPtr Ctxp;
+   xmlXPathObjectPtr  Xop;
+   xmlXPathObjectPtr  NlXop;
+-  xmlErrorPtr        Xerr;
+   char              *Buf;                  // Temporary
+   bool               Nofreelist;
+ }; // end of class LIBXMLDOC
+@@ -327,7 +326,6 @@ LIBXMLDOC::LIBXMLDOC(char *nsl, char *nsdf, char *enc, PFBLOCK fp)
+   Ctxp = NULL;
+   Xop = NULL;
+   NlXop = NULL;
+-  Xerr = NULL;
+   Buf = NULL;
+   Nofreelist = false;
+   } // end of LIBXMLDOC constructor
+@@ -365,8 +363,8 @@ bool LIBXMLDOC::ParseFile(PGLOBAL g, char *fn)
+       Encoding = (char*)Docp->encoding;
+ 
+     return false;
+-  } else if ((Xerr = xmlGetLastError()))
+-    xmlResetError(Xerr);
++  } else if (xmlGetLastError())
++    xmlResetLastError();
+ 
+   return true;
+   } // end of ParseFile
+@@ -505,9 +503,9 @@ int LIBXMLDOC::DumpDoc(PGLOBAL g, char *ofn)
+ #if 1
+   // This function does not crash (
+   if (xmlSaveFormatFileEnc((const char *)ofn, Docp, Encoding, 0) < 0) {
+-    xmlErrorPtr err = xmlGetLastError();
++    const xmlError *err = xmlGetLastError();
+     strcpy(g->Message, (err) ? err->message : "Error saving XML doc");
+-    xmlResetError(Xerr);
++    xmlResetLastError();
+     rc = -1;
+     } // endif Save
+ //  rc = xmlDocDump(of, Docp);
+@@ -546,8 +544,8 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+     if (Nlist) {
+       xmlXPathFreeNodeSet(Nlist);
+ 
+-      if ((Xerr = xmlGetLastError()))
+-        xmlResetError(Xerr);
++      if (xmlGetLastError())
++        xmlResetLastError();
+ 
+       Nlist = NULL;
+       } // endif Nlist
+@@ -555,8 +553,8 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+     if (Xop) {
+       xmlXPathFreeObject(Xop);
+ 
+-      if ((Xerr = xmlGetLastError()))
+-        xmlResetError(Xerr);
++      if (xmlGetLastError())
++        xmlResetLastError();
+ 
+       Xop = NULL;
+       } // endif Xop
+@@ -564,8 +562,8 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+     if (NlXop) {
+       xmlXPathFreeObject(NlXop);
+ 
+-      if ((Xerr = xmlGetLastError()))
+-        xmlResetError(Xerr);
++      if (xmlGetLastError())
++        xmlResetLastError();
+ 
+       NlXop = NULL;
+       } // endif NlXop
+@@ -573,8 +571,8 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+     if (Ctxp) {
+       xmlXPathFreeContext(Ctxp);
+ 
+-      if ((Xerr = xmlGetLastError()))
+-        xmlResetError(Xerr);
++      if (xmlGetLastError())
++        xmlResetLastError();
+ 
+       Ctxp = NULL;
+       } // endif Ctxp
+@@ -590,6 +588,7 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+ /******************************************************************/
+ xmlNodeSetPtr LIBXMLDOC::GetNodeList(PGLOBAL g, xmlNodePtr np, char *xp)
+   {
++  const xmlError *xerr;
+   xmlNodeSetPtr nl;
+ 
+   if (trace(1))
+@@ -649,11 +648,11 @@ xmlNodeSetPtr LIBXMLDOC::GetNodeList(PGLOBAL g, xmlNodePtr np, char *xp)
+     } else
+       xmlXPathFreeObject(Xop);            // Caused node not found
+ 
+-    if ((Xerr = xmlGetLastError())) {
+-      strcpy(g->Message, Xerr->message);
+-      xmlResetError(Xerr);
++    if ((xerr = xmlGetLastError())) {
++      strcpy(g->Message, xerr->message);
++      xmlResetLastError();
+       return NULL;
+-      } // endif Xerr
++      } // endif xerr
+ 
+     } // endif Xop
+ 
+@@ -1079,7 +1078,7 @@ void XML2NODE::AddText(PGLOBAL g, PCSZ txtp)
+ /******************************************************************/
+ void XML2NODE::DeleteChild(PGLOBAL g, PXNODE dnp)
+   {
+-  xmlErrorPtr xerr;
++  const xmlError *xerr;
+ 
+   if (trace(1))
+     htrc("DeleteChild: node=%p\n", dnp);
+@@ -1122,7 +1121,7 @@ void XML2NODE::DeleteChild(PGLOBAL g, PXNODE dnp)
+   if (trace(1))
+     htrc("DeleteChild: errmsg=%-.256s\n", xerr->message);
+ 
+-  xmlResetError(xerr);
++  xmlResetLastError();
+   } // end of DeleteChild
+ 
+ /* -------------------- class XML2NODELIST ---------------------- */
+-- 
+2.42.0
+
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index ec2f95f5bd55b..69acb0cd1a85d 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -5,6 +5,7 @@ let
       { stdenv, lib, fetchurl, makeWrapper, fetchpatch
       , glibc, zlib, readline, openssl, icu, lz4, zstd, systemd, libossp_uuid
       , pkg-config, libxml2, tzdata, libkrb5, substituteAll, darwin
+      , linux-pam
 
       # This is important to obtain a version of `libpq` that does not depend on systemd.
       , enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd && !stdenv.hostPlatform.isStatic
@@ -63,6 +64,7 @@ let
       ++ lib.optionals zstdEnabled [ zstd ]
       ++ lib.optionals enableSystemd [ systemd ]
       ++ lib.optionals gssSupport [ libkrb5 ]
+      ++ lib.optionals stdenv'.isLinux [ linux-pam ]
       ++ lib.optionals (!stdenv'.isDarwin) [ libossp_uuid ];
 
     nativeBuildInputs = [
@@ -96,7 +98,8 @@ let
       ++ lib.optionals zstdEnabled [ "--with-zstd" ]
       ++ lib.optionals gssSupport [ "--with-gssapi" ]
       ++ lib.optionals stdenv'.hostPlatform.isRiscV [ "--disable-spinlocks" ]
-      ++ lib.optionals jitSupport [ "--with-llvm" ];
+      ++ lib.optionals jitSupport [ "--with-llvm" ]
+      ++ lib.optionals stdenv'.isLinux [ "--with-pam" ];
 
     patches = [
       (if atLeast "16" then ./patches/disable-normalize_exec_path.patch
@@ -106,6 +109,17 @@ let
       ./patches/specify_pkglibdir_at_runtime.patch
       ./patches/findstring.patch
 
+      # Fix build with libxml2 2.12.0 and -Wincompatible-function-pointer-types
+      (if atLeast "16" then
+        # https://www.postgresql.org/message-id/CACpMh%2BDMZVHM%2BiDSyqdcpK8sr7jd_HxxLJRNvGTzcLBE0W07QA%40mail.gmail.com
+        fetchurl {
+          url = "https://www.postgresql.org/message-id/attachment/152769/v1-0001-Make-PostgreSQL-work-with-newer-version-of-libxml.patch";
+          hash = "sha256-1j5mtG++hFmYwfS98PdN1SmNI4T86q4FXvKLz2VeJyg=";
+        }
+      else
+        ./patches/libxml2.12-15.patch
+      )
+
       (substituteAll {
         src = ./locale-binary-path.patch;
         locale = "${if stdenv.isDarwin then darwin.adv_cmds else lib.getBin stdenv.cc.libc}/bin/locale";
diff --git a/pkgs/servers/sql/postgresql/patches/libxml2.12-15.patch b/pkgs/servers/sql/postgresql/patches/libxml2.12-15.patch
new file mode 100644
index 0000000000000..13438c7d4bb75
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/patches/libxml2.12-15.patch
@@ -0,0 +1,22 @@
+diff --git a/src/backend/utils/adt/xml.c b/src/backend/utils/adt/xml.c
+index 6411f56b998..0eb39fcfc26 100644
+--- a/src/backend/utils/adt/xml.c
++++ b/src/backend/utils/adt/xml.c
+@@ -119,7 +119,7 @@ struct PgXmlErrorContext
+ 
+ static xmlParserInputPtr xmlPgEntityLoader(const char *URL, const char *ID,
+ 										   xmlParserCtxtPtr ctxt);
+-static void xml_errorHandler(void *data, xmlErrorPtr error);
++static void xml_errorHandler(void *data, const xmlError *error);
+ static void xml_ereport_by_code(int level, int sqlcode,
+ 								const char *msg, int errcode);
+ static void chopStringInfoNewlines(StringInfo str);
+@@ -1749,7 +1749,7 @@ xml_ereport(PgXmlErrorContext *errcxt, int level, int sqlcode, const char *msg)
+  * Error handler for libxml errors and warnings
+  */
+ static void
+-xml_errorHandler(void *data, xmlErrorPtr error)
++xml_errorHandler(void *data, const xmlError *error)
+ {
+ 	PgXmlErrorContext *xmlerrcxt = (PgXmlErrorContext *) data;
+ 	xmlParserCtxtPtr ctxt = (xmlParserCtxtPtr) error->ctxt;
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index cde718df1abac..463fd7e4847dd 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -420,4 +420,18 @@ rec {
         "propagatedBuildInputs"
       ]);
     });
+
+  withDefaultHardeningFlags = defaultHardeningFlags: stdenv: let
+    bintools = let
+      bintools' = stdenv.cc.bintools;
+    in if bintools' ? override then (bintools'.override {
+      inherit defaultHardeningFlags;
+    }) else bintools';
+  in
+    stdenv.override (old: {
+      cc = if stdenv.cc == null then null else stdenv.cc.override {
+        inherit bintools;
+      };
+      allowedRequisites = lib.mapNullable (rs: rs ++ [ bintools ]) (stdenv.allowedRequisites or null);
+    });
 }
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index faa83507893f1..78e3f87daabe0 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -239,23 +239,26 @@ let
     # disabling fortify implies fortify3 should also be disabled
     then unique (hardeningDisable ++ [ "fortify3" ])
     else hardeningDisable;
-  supportedHardeningFlags = [ "fortify" "fortify3" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
-  # Musl-based platforms will keep "pie", other platforms will not.
-  # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
-  # in the nixpkgs manual to inform users about the defaults.
-  defaultHardeningFlags = if stdenv.hostPlatform.isMusl &&
-      # Except when:
-      #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
-      #    - static armv7l, where compilation fails.
-      !(stdenv.hostPlatform.isAarch && stdenv.hostPlatform.isStatic)
-    then supportedHardeningFlags
-    else remove "pie" supportedHardeningFlags;
+  knownHardeningFlags = [
+    "bindnow"
+    "format"
+    "fortify"
+    "fortify3"
+    "pic"
+    "pie"
+    "relro"
+    "stackprotector"
+    "strictoverflow"
+  ];
+  defaultHardeningFlags = stdenv.cc.defaultHardeningFlags or
+    # fallback safe-ish set of flags
+    (remove "pie" knownHardeningFlags);
   enabledHardeningOptions =
     if builtins.elem "all" hardeningDisable'
     then []
     else subtractLists hardeningDisable' (defaultHardeningFlags ++ hardeningEnable);
   # hardeningDisable additionally supports "all".
-  erroneousHardeningFlags = subtractLists supportedHardeningFlags (hardeningEnable ++ remove "all" hardeningDisable);
+  erroneousHardeningFlags = subtractLists knownHardeningFlags (hardeningEnable ++ remove "all" hardeningDisable);
 
   checkDependencyList = checkDependencyList' [];
   checkDependencyList' = positions: name: deps: flip imap1 deps (index: dep:
@@ -264,7 +267,7 @@ let
     else throw "Dependency is not of a valid type: ${concatMapStrings (ix: "element ${toString ix} of ") ([index] ++ positions)}${name} for ${attrs.name or attrs.pname}");
 in if builtins.length erroneousHardeningFlags != 0
 then abort ("mkDerivation was called with unsupported hardening flags: " + lib.generators.toPretty {} {
-  inherit erroneousHardeningFlags hardeningDisable hardeningEnable supportedHardeningFlags;
+  inherit erroneousHardeningFlags hardeningDisable hardeningEnable knownHardeningFlags;
 })
 else let
   doCheck = doCheck';
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 081024781eeff..ec8df76f2c79a 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1044,7 +1044,11 @@ _defaultUnpack() {
         case "$fn" in
             *.tar.xz | *.tar.lzma | *.txz)
                 # Don't rely on tar knowing about .xz.
-                xz -d < "$fn" | tar xf - --warning=no-timestamp
+                # Additionally, we have multiple different xz binaries with different feature sets in different
+                # stages. The XZ_OPT env var is only used by the full "XZ utils" implementation, which supports
+                # the --threads (-T) flag. This allows us to enable multithreaded decompression exclusively on
+                # that implementation, without the use of complex bash conditionals and checks.
+                XZ_OPT="--threads=$NIX_BUILD_CORES" xz -d < "$fn" | tar xf - --warning=no-timestamp
                 ;;
             *.tar | *.tar.* | *.tgz | *.tbz2 | *.tbz)
                 # GNU tar can automatically select the decompression method
diff --git a/pkgs/test/auto-patchelf-hook/default.nix b/pkgs/test/auto-patchelf-hook/default.nix
new file mode 100644
index 0000000000000..6e05e729fba84
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook/default.nix
@@ -0,0 +1,6 @@
+{ lib, callPackage }:
+
+lib.recurseIntoAttrs {
+  withStructuredAttrs = callPackage ./package.nix { __structuredAttrs = true; };
+  withoutStructuredAttrs = callPackage ./package.nix { __structuredAttrs = false; };
+}
diff --git a/pkgs/test/auto-patchelf-hook/package.nix b/pkgs/test/auto-patchelf-hook/package.nix
new file mode 100644
index 0000000000000..be03ee68c0391
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook/package.nix
@@ -0,0 +1,96 @@
+# This is a test for autoPatchelfHook. To test it, we just need a simple binary
+# which uses the hook. We took the derivation from tonelib-jam, which sounds
+# like a good candidate with a small closure, and trimmed it down.
+
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, freetype
+, curl
+# This test checks that the behavior of autoPatchelfHook is correct whether
+# __structuredAttrs
+# (https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-structuredAttrs)
+# is set or not. Hence __structuredAttrs is provided as a parameter.
+, __structuredAttrs
+}:
+
+let runtimeDependencies = [
+  (lib.getLib curl)
+  "/some/dep"
+  "/some/other/dep"
+]
+# A dependency with space only works with __structuredAttrs set to true.
+++ lib.lists.optional __structuredAttrs "/some/dep with space";
+in
+
+stdenv.mkDerivation {
+  name = "auto-patchelf-test";
+
+  src = fetchurl {
+    url = "https://tonelib.net/download/221222/ToneLib-Jam-amd64.deb";
+    sha256 = "sha256-c6At2lRPngQPpE7O+VY/Hsfw+QfIb3COIuHfbqqIEuM=";
+  };
+
+  unpackCmd = ''
+    dpkg -x $curSrc source
+  '';
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
+
+  installPhase = ''
+    mv usr $out
+  '';
+
+  buildInputs = [
+    freetype
+  ];
+
+  autoPatchelfIgnoreMissingDeps = [
+    "libGL.so.1"
+    "libasound.so.2"
+  ];
+
+  inherit runtimeDependencies;
+
+  # Additional phase performing the actual test.
+  installCheckPhase =
+    let allDeps = runtimeDependencies ++ [ (lib.getLib freetype) ];
+    in
+    ''
+      local binary="$out/bin/ToneLib-Jam"
+      local interpreter=$(patchelf --print-interpreter $binary)
+      local runpath=$(patchelf --print-rpath $binary)
+      local glibcStorePath="${stdenv.cc.libc}"
+
+      # Check that the glibc path is a prefix of the interpreter. If
+      # autoPatchelfHook ran correctly, the binary should have set the interpreter
+      # to point to the store.
+      echo "[auto-patchelf-hook-test]: Check that the interpreter is in the store"
+      test "''${interpreter#$glibcStorePath}" != "$interpreter"
+
+      readarray -td':' runpathArray < <(echo -n "$runpath")
+
+      echo "[auto-patchelf-hook-test]: Check that the runpath has the right number of entries"
+      test "''${#runpathArray[@]}" -eq ${builtins.toString (builtins.length allDeps)}
+
+      echo "[auto-patchelf-hook-test]: Check that the runpath contains the expected runtime deps"
+    ''
+    + lib.strings.concatStringsSep "\n"
+      (lib.lists.imap0
+        (i: path:
+          let iAsStr = builtins.toString i; in
+          ''
+            echo "[auto-patchelf-hook-test]: Check that entry ${iAsStr} is ${path}"
+            test "''${paths[${iAsStr}]}" = "$path"
+          '')
+        allDeps
+      );
+
+  doInstallCheck = true;
+  inherit __structuredAttrs;
+}
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 65305bf165d30..363b0a2e1519c 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -168,4 +168,6 @@ with pkgs;
   pkgs-lib = recurseIntoAttrs (import ../pkgs-lib/tests { inherit pkgs; });
 
   nixpkgs-check-by-name = callPackage ./nixpkgs-check-by-name { };
+
+  auto-patchelf-hook = callPackage ./auto-patchelf-hook { };
 }
diff --git a/pkgs/tools/admin/ansible/lint.nix b/pkgs/tools/admin/ansible/lint.nix
index fbac95d019ba5..e1c168f8bf537 100644
--- a/pkgs/tools/admin/ansible/lint.nix
+++ b/pkgs/tools/admin/ansible/lint.nix
@@ -23,6 +23,11 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     setuptools
     setuptools-scm
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "ruamel.yaml"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 7bbc1e14efbe2..73c86278df703 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -10,14 +10,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "awscli";
-  version = "1.30.2"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.31.6"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XbYsPbYUIJPCS+nhcE3A5K7yxHcGUkulT5vHPT5T9kM=";
+    hash = "sha256-PINiNkP2vopPgc9bH0x7mifeUt7gdXi3/i2Ye96RANg=";
   };
 
-
   propagatedBuildInputs = with python3.pkgs; [
     botocore
     bcdoc
diff --git a/pkgs/tools/archivers/cpio/default.nix b/pkgs/tools/archivers/cpio/default.nix
index 1b766fed14924..4116a0b3e4ca8 100644
--- a/pkgs/tools/archivers/cpio/default.nix
+++ b/pkgs/tools/archivers/cpio/default.nix
@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
+, autoreconfHook
 
 # for passthru.tests
 , git
@@ -18,6 +20,17 @@ stdenv.mkDerivation rec {
     sha256 = "/NwV1g9yZ6b8fvzWudt7bIlmxPL7u5ZMJNQTNv0/LBI=";
   };
 
+  patches = [
+    # Pull upstream fix for clang-16 and gcc-14.
+    (fetchpatch {
+      name = "major-decl.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=8179be21e664cedb2e9d238cc2f6d04965e97275";
+      hash = "sha256-k5Xiv3xuPU8kPT6D9B6p+V8SK55ybFgrIIPDgHuorpM=";
+    })
+  ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+
   separateDebugInfo = true;
 
   preConfigure = lib.optionalString stdenv.isCygwin ''
diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index c504ed8f16e1f..002854e045d22 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -58,6 +58,9 @@ stdenv.mkDerivation rec {
       substituteInPlace intl/Makefile.in --replace "AR = ar" ""
     '';
 
+  # Workaround to fix the static build on macOS.
+  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/tools/audio/wyoming/piper.nix b/pkgs/tools/audio/wyoming/piper.nix
index f53f684f6facd..32d21bfa4eafc 100644
--- a/pkgs/tools/audio/wyoming/piper.nix
+++ b/pkgs/tools/audio/wyoming/piper.nix
@@ -27,6 +27,11 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "wyoming"
   ];
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/backup/borgbackup/default.nix b/pkgs/tools/backup/borgbackup/default.nix
index 33c5aa5272188..d7853d0506f64 100644
--- a/pkgs/tools/backup/borgbackup/default.nix
+++ b/pkgs/tools/backup/borgbackup/default.nix
@@ -14,7 +14,22 @@
 , fetchPypi
 }:
 
-python3Packages.buildPythonApplication rec {
+let
+  python = python3Packages.python.override {
+    packageOverrides = self: super: {
+      msgpack = super.msgpack.overrideAttrs (oldAttrs: rec {
+        version ="1.0.4";
+
+        src = fetchPypi {
+          pname = "msgpack";
+          inherit version;
+          hash = "sha256-9dhpwY8DAgLrQS8Iso0q/upVPWYTruieIA16yn7wH18=";
+        };
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
   version = "1.2.7";
   format = "pyproject";
@@ -30,7 +45,7 @@ python3Packages.buildPythonApplication rec {
       --replace "0o4755" "0o0755"
   '';
 
-  nativeBuildInputs = with python3Packages; [
+  nativeBuildInputs = with python.pkgs; [
     cython
     setuptools-scm
     pkgconfig
@@ -55,7 +70,7 @@ python3Packages.buildPythonApplication rec {
     acl
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python.pkgs; [
     msgpack
     packaging
     (if stdenv.isLinux then pyfuse3 else llfuse)
@@ -72,7 +87,7 @@ python3Packages.buildPythonApplication rec {
       --zsh scripts/shell_completions/zsh/_borg
   '';
 
-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = with python.pkgs; [
     e2fsprogs
     py
     python-dateutil
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 15b8a33de6755..452fab128e146 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -36,8 +36,6 @@ python3.pkgs.buildPythonApplication rec {
     ./linux-disable-timezone-test.patch
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   preConfigure = ''
     # fix version displayed by duplicity --version
     # see SourceCopy in setup.py
diff --git a/pkgs/tools/backup/gphotos-sync/default.nix b/pkgs/tools/backup/gphotos-sync/default.nix
index 53db44bb2e11f..74c442c09583e 100644
--- a/pkgs/tools/backup/gphotos-sync/default.nix
+++ b/pkgs/tools/backup/gphotos-sync/default.nix
@@ -8,8 +8,6 @@ python3.pkgs.buildPythonApplication rec {
   version = "3.1.2";
   format = "pyproject";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   src = fetchFromGitHub {
     owner = "gilesknap";
     repo = "gphotos-sync";
diff --git a/pkgs/tools/compression/efficient-compression-tool/default.nix b/pkgs/tools/compression/efficient-compression-tool/default.nix
index 17c1bfcbcf2b8..a4f4b9fd40daf 100644
--- a/pkgs/tools/compression/efficient-compression-tool/default.nix
+++ b/pkgs/tools/compression/efficient-compression-tool/default.nix
@@ -29,6 +29,11 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DECT_FOLDER_SUPPORT=ON" ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'uint32_t' does not name a type
+    "-include cstdint"
+  ];
+
   meta = with lib; {
     description = "Fast and effective C++ file optimizer";
     homepage = "https://github.com/fhanau/Efficient-Compression-Tool";
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 75b306b368aa3..4ba37c1502f65 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -50,8 +50,6 @@ stdenv.mkDerivation rec {
       tests/playTests.sh
   '';
 
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
-
   cmakeFlags = lib.attrsets.mapAttrsToList
     (name: value: "-DZSTD_${name}:BOOL=${if value then "ON" else "OFF"}") {
       BUILD_SHARED = !static;
diff --git a/pkgs/tools/filesystems/f2fs-tools/default.nix b/pkgs/tools/filesystems/f2fs-tools/default.nix
index c2af098577281..811adfadb55bc 100644
--- a/pkgs/tools/filesystems/f2fs-tools/default.nix
+++ b/pkgs/tools/filesystems/f2fs-tools/default.nix
@@ -1,12 +1,11 @@
-{ lib, stdenv, fetchgit, autoreconfHook, libselinux, libuuid, pkg-config }:
+{ lib, stdenv, fetchzip, autoreconfHook, libselinux, libuuid, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "f2fs-tools";
   version = "1.16.0";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git";
-    rev = "refs/tags/v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git/snapshot/f2fs-tools-v${version}.tar.gz";
     sha256 = "sha256-zNG1F//+BTBzlEc6qNVixyuCB6PMZD5Kf8pVK0ePYiA=";
   };
 
diff --git a/pkgs/tools/filesystems/rdfind/default.nix b/pkgs/tools/filesystems/rdfind/default.nix
index 59724c0c7c523..0e7c8fd42d63d 100644
--- a/pkgs/tools/filesystems/rdfind/default.nix
+++ b/pkgs/tools/filesystems/rdfind/default.nix
@@ -1,22 +1,14 @@
-{ lib, stdenv, fetchpatch, fetchurl, nettle }:
+{ lib, stdenv, fetchurl, nettle }:
 
 stdenv.mkDerivation rec {
   pname = "rdfind";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://rdfind.pauldreik.se/${pname}-${version}.tar.gz";
-    sha256 = "103hfqzgr6izmj57fcy4jsa2nmb1ax43q4b5ij92pcgpaq9fsl21";
+    sha256 = "sha256-ekBujvGIalhpZVYEYY3Zj2cvEsamvkkm0FO+ZQcPMnk=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "include-limits.patch";
-      url = "https://github.com/pauldreik/rdfind/commit/61877de88d782b63b17458a61fcc078391499b29.patch";
-      sha256 = "0igzm4833cn905pj84lgr88nd5gx35dnjl8kl8vrwk7bpyii6a8l";
-    })
-  ];
-
   buildInputs = [ nettle ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/cc2538-bsl/default.nix b/pkgs/tools/misc/cc2538-bsl/default.nix
index 602327ab79b17..a4b3c992544a9 100644
--- a/pkgs/tools/misc/cc2538-bsl/default.nix
+++ b/pkgs/tools/misc/cc2538-bsl/default.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "cc2538-bsl";
-  version = "unstable-2023-08-14";
+  version = "2.1-unstable-2023-10-03";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "JelmerT";
     repo = "cc2538-bsl";
-    rev = "641305fb5cae98415a28cbfab6e63436c1753abf";
-    hash = "sha256-fPY12kValxbJORi9xNyxzwkGpD9F9u3M1+aa9IlSiaE=";
+    rev = "4d64ac633dbaf29d098842c5937ed6eea2fd7c45";
+    hash = "sha256-NX2jPYAz15bSucj/YR5E/0eJy/cbszSrNxyJHRsbXxo=";
   };
 
   patches = [
diff --git a/pkgs/tools/misc/crudini/default.nix b/pkgs/tools/misc/crudini/default.nix
index fa4e7cc34a484..ea77f4db163ec 100644
--- a/pkgs/tools/misc/crudini/default.nix
+++ b/pkgs/tools/misc/crudini/default.nix
@@ -22,8 +22,6 @@ python3Packages.buildPythonApplication rec {
     patchShebangs crudini.py crudini-help tests/test.sh
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     help2man
     installShellFiles
diff --git a/pkgs/tools/misc/instaloader/default.nix b/pkgs/tools/misc/instaloader/default.nix
index 634693f6144be..57601ae975501 100644
--- a/pkgs/tools/misc/instaloader/default.nix
+++ b/pkgs/tools/misc/instaloader/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , sphinx
 , requests
 }:
@@ -20,6 +21,10 @@ buildPythonPackage rec {
     sha256 = "sha256-ZxvJPDj+r7KSyXpYNQIgnda5OS77GOFM901ZHgR6c4k=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
     sphinx
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index cb81ef9a9983f..8e29307ad24a0 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -1,37 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, fetchFromGitea, libjodycode }:
 
 stdenv.mkDerivation rec {
   pname = "jdupes";
-  version = "1.21.0";
+  version = "1.27.3";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
     owner = "jbruchon";
     repo  = "jdupes";
     rev   = "v${version}";
-    sha256 = "sha256-nDyRaV49bLVHlyqKJ7hf6OBWOLCfmHrTeHryK091c3w=";
+    hash = "sha256-hR5nl8G7TYVm4ol/jgo7iOb4dLr2MovgjKSXCD2UwMg=";
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The testdir
     # directories have such files and will be removed.
     postFetch = "rm -r $out/testdir";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "darwin-stack-size.patch";
-      url = "https://github.com/jbruchon/jdupes/commit/8f5b06109b44a9e4316f9445da3044590a6c63e2.patch";
-      sha256 = "0saq92v0mm5g979chr062psvwp3i3z23mgqrcliq4m07lvwc7i3s";
-    })
-    (fetchpatch {
-      name = "linux-header-ioctl.patch";
-      url = "https://github.com/jbruchon/jdupes/commit/0d4d98f51c99999d2c6dbbb89d554af551b5b69b.patch";
-      sha256 = "sha256-lyuZeRp0Laa8I9nDl1HGdlKa59OvGRQJnRg2fTWv7mQ=";
-    })
-    (fetchpatch {
-      name = "darwin-apfs-comp.patch";
-      url = "https://github.com/jbruchon/jdupes/commit/517b7035945eacd82323392b13bc17b044bcc89d.patch";
-      sha256 = "sha256-lvOab6tyEyKUtik3JBdIs5SHpVjcQEDfN7n2bfUszBw=";
-    })
-  ];
+  buildInputs = [ libjodycode ];
 
   dontConfigure = true;
 
@@ -49,7 +34,7 @@ stdenv.mkDerivation rec {
   doCheck = false; # broken Makefile, the above also removes tests
 
   postInstall = ''
-    install -Dm444 -t $out/share/doc/jdupes CHANGES LICENSE README.md
+    install -Dm444 -t $out/share/doc/jdupes CHANGES.txt LICENSE.txt README.md
   '';
 
   meta = with lib; {
@@ -61,7 +46,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/jbruchon/jdupes";
     license = licenses.mit;
-    maintainers = with maintainers; [ romildo ];
+    maintainers = with maintainers; [ ];
     mainProgram = "jdupes";
   };
 }
diff --git a/pkgs/tools/misc/lektor/default.nix b/pkgs/tools/misc/lektor/default.nix
index 638ce2ee3ce7c..1b20b4355d8e4 100644
--- a/pkgs/tools/misc/lektor/default.nix
+++ b/pkgs/tools/misc/lektor/default.nix
@@ -46,8 +46,6 @@ in python.pkgs.buildPythonApplication rec {
     npmHooks.npmConfigHook
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = with python.pkgs; [
     babel
     click
diff --git a/pkgs/tools/misc/mpremote/default.nix b/pkgs/tools/misc/mpremote/default.nix
index 04b7abb353a2f..c260b1e528931 100644
--- a/pkgs/tools/misc/mpremote/default.nix
+++ b/pkgs/tools/misc/mpremote/default.nix
@@ -19,7 +19,6 @@ buildPythonApplication rec {
   };
   sourceRoot = "source/tools/mpremote";
   format = "pyproject";
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     hatchling
diff --git a/pkgs/tools/misc/nbqa/default.nix b/pkgs/tools/misc/nbqa/default.nix
index dec7eb1aa1136..0c55c78f7b496 100644
--- a/pkgs/tools/misc/nbqa/default.nix
+++ b/pkgs/tools/misc/nbqa/default.nix
@@ -7,15 +7,20 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "nbqa";
-  version = "1.7.0";
+  version = "1.7.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nbQA-dev";
     repo = "nbQA";
-    rev = version;
-    hash = "sha256-CTF5HisBS44Ta18cVT04UrMIF30WmEBwZBGW7fkKXwk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-a/FuhJyf8BmZekUibzEiGgkHL51A+75R4a6S+h5i28s=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   passthru.optional-dependencies = {
     black = [ black ];
     blacken-docs = [ blacken-docs ];
@@ -76,9 +81,6 @@ python3.pkgs.buildPythonApplication rec {
     "test_running_in_different_dir_works"
     "test_unable_to_reconstruct_message_pythonpath"
     "test_with_subcommand"
-    # Broken since ruff was updated to 0.1.2
-    # A PR was opened upstream: https://github.com/nbQA-dev/nbQA/issues/834
-    "test_ruff_works"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/tools/misc/ntfy-sh/default.nix b/pkgs/tools/misc/ntfy-sh/default.nix
index 2ee18cb3da1c0..1bfde93c39e50 100644
--- a/pkgs/tools/misc/ntfy-sh/default.nix
+++ b/pkgs/tools/misc/ntfy-sh/default.nix
@@ -42,7 +42,7 @@ buildGoModule rec {
     mkdocs
     python3
     python3Packages.mkdocs-material
-    python3Packages.mkdocs-minify
+    python3Packages.mkdocs-minify-plugin
     python3Packages.mkdocs-simple-hooks
   ];
 
diff --git a/pkgs/tools/misc/osinfo-db-tools/default.nix b/pkgs/tools/misc/osinfo-db-tools/default.nix
index be78d6c026004..774ccd946aa72 100644
--- a/pkgs/tools/misc/osinfo-db-tools/default.nix
+++ b/pkgs/tools/misc/osinfo-db-tools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , meson
 , ninja
@@ -26,6 +27,18 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-i6bTG7XvBwVuOIeeBwZxr7z+wOtBqH+ZUEULu4MbCh0=";
   };
 
+  patches = [
+    # Fix build with libxml 2.12
+    (fetchpatch {
+      url = "https://gitlab.com/libosinfo/osinfo-db-tools/-/commit/019487cbc79925e49988789bf533c78dab7e1842.patch";
+      hash = "sha256-skuspjHDRilwym+hFInrSvIZ+rrzBOoI7WeFj2SrGkc=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/libosinfo/osinfo-db-tools/-/commit/34378a4ac257f2f5fcf364786d1634a8c36b304f.patch";
+      hash = "sha256-I9vRRbnotqRi8+7q1eZLJwQLaT9J4G3h+3rKxlaCME4=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/tools/misc/remote-exec/default.nix b/pkgs/tools/misc/remote-exec/default.nix
index afedab81cbd6e..557bde26c4650 100644
--- a/pkgs/tools/misc/remote-exec/default.nix
+++ b/pkgs/tools/misc/remote-exec/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , buildPythonApplication
 , click
-, pydantic
+, pydantic_1
 , toml
 , watchdog
 , pytestCheckHook
@@ -29,7 +29,7 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     click
-    pydantic
+    pydantic_1
     toml
     watchdog
   ];
diff --git a/pkgs/tools/misc/xfstests/default.nix b/pkgs/tools/misc/xfstests/default.nix
index c894f3b9f32e0..5080c85924920 100644
--- a/pkgs/tools/misc/xfstests/default.nix
+++ b/pkgs/tools/misc/xfstests/default.nix
@@ -1,5 +1,5 @@
 { stdenv, acl, attr, autoconf, automake, bash, bc, coreutils, e2fsprogs
-, fetchgit, fio, gawk, keyutils, killall, lib, libaio, libcap, libtool
+, fetchzip, fio, gawk, keyutils, killall, lib, libaio, libcap, libtool
 , libuuid, libxfs, lvm2, openssl, perl, procps, quota
 , time, util-linux, which, writeScript, xfsprogs, runtimeShell }:
 
@@ -7,10 +7,9 @@ stdenv.mkDerivation rec {
   pname = "xfstests";
   version = "2023.05.14";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git";
-    rev = "v${version}";
-    sha256 = "sha256-yyjY9Q3eUH+q+o15zFUjOcNz1HpXPCwdcxWXoycOx98=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git/snapshot/xfstests-dev-v${version}.tar.gz";
+    hash = "sha256-yyjY9Q3eUH+q+o15zFUjOcNz1HpXPCwdcxWXoycOx98=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff b/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff
new file mode 100644
index 0000000000000..9797d2c16d11c
--- /dev/null
+++ b/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff
@@ -0,0 +1,46 @@
+diff --git a/configure b/configure
+index 04d1de1..5de1b41 100755
+--- a/configure
++++ b/configure
+@@ -24949,15 +24949,12 @@ else $as_nop
+ # include <netinet/in6.h>
+ #endif
+ #endif
+-#include <stdlib.h> /* for exit() */
+-main()
++
++int main(void)
+ {
+  struct sockaddr_in6 s;
+  (void)s;
+- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+-   exit(1);
+- else
+-   exit(0);
++ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
+ }
+ 
+ 
+diff --git a/configure.ac b/configure.ac
+index 2d71c83..bd38dd9 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1679,15 +1679,12 @@ AS_HELP_STRING([--disable-ipv6],[Disable IPv6 support]),
+ # include <netinet/in6.h>
+ #endif
+ #endif
+-#include <stdlib.h> /* for exit() */
+-main()
++
++int main(void)
+ {
+  struct sockaddr_in6 s;
+  (void)s;
+- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+-   exit(1);
+- else
+-   exit(0);
++ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
+ }
+ ]])
+ ],
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 48bf59e252661..01208f0a121ca 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -57,6 +57,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
   };
 
+  patches = [
+    # fix ipv6 autodetect compile error in configure script
+    # remove once https://github.com/curl/curl/pull/12607 released (8.6.0)
+    ./configure-ipv6-autodetect.diff
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 2d7a646299ad6..0350a4989262a 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , pkg-config
 , udev
 , runtimeShellPackage
@@ -12,24 +11,15 @@
 
 stdenv.mkDerivation rec {
   pname = "dhcpcd";
-  version = "9.4.1";
+  version = "10.0.3";
 
   src = fetchFromGitHub {
     owner = "NetworkConfiguration";
     repo = "dhcpcd";
     rev = "v${version}";
-    sha256 = "sha256-qyxON+TsAKMwAI19b5P+dT/sgxpW6m1giGcf/boFpHc=";
+    sha256 = "sha256-NXLOfSPGHiRDSagaT+37TAn9XtdcG4+wP9AvyGJi4Dc=";
   };
 
-  patches = [
-    # dhcpcd with privsep SIGSYS's on dhcpcd -U
-    # https://github.com/NetworkConfiguration/dhcpcd/issues/147
-    (fetchpatch {
-      url = "https://github.com/NetworkConfiguration/dhcpcd/commit/38befd4e867583002b96ec39df733585d74c4ff5.patch";
-      hash = "sha256-nS2zmLuQBYhLfoPp0DOwxF803Hh32EE4OUKGBTTukE0=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     udev
diff --git a/pkgs/tools/networking/linkchecker/default.nix b/pkgs/tools/networking/linkchecker/default.nix
index c78c12c8fa776..018da51f77018 100644
--- a/pkgs/tools/networking/linkchecker/default.nix
+++ b/pkgs/tools/networking/linkchecker/default.nix
@@ -17,8 +17,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-z7Qp74cai8GfsxB4n9dSCWQepp0/4PimFiRJQBaVSoo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     gettext
   ];
diff --git a/pkgs/tools/networking/mmsd/default.nix b/pkgs/tools/networking/mmsd/default.nix
index 43891d612bb1a..f7ea7be22c08f 100644
--- a/pkgs/tools/networking/mmsd/default.nix
+++ b/pkgs/tools/networking/mmsd/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchgit
+, fetchzip
 , autoreconfHook
 , pkg-config
 , glib
@@ -10,9 +10,8 @@ stdenv.mkDerivation rec {
   pname = "mmsd";
   version = "unstable-2019-07-15";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/network/ofono/mmsd.git";
-    rev = "f4b8b32477a411180be1823fdc460b4f7e1e3c9c";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/network/ofono/mmsd.git/snapshot/mmsd-f4b8b32477a411180be1823fdc460b4f7e1e3c9c.tar.gz";
     sha256 = "0hcnpyhsi7b5m825dhnwbp65yi0961wi8mipzdvaw5nc693xv15b";
   };
 
diff --git a/pkgs/tools/networking/netifd/default.nix b/pkgs/tools/networking/netifd/default.nix
index 25aada6e3c446..59b2e47329801 100644
--- a/pkgs/tools/networking/netifd/default.nix
+++ b/pkgs/tools/networking/netifd/default.nix
@@ -1,17 +1,52 @@
-{ lib, stdenv, cmake, fetchgit, libnl, libubox, uci, ubus, json_c, pkg-config }:
+{ lib
+, stdenv
+, cmake
+, fetchgit
+, libnl
+, libubox
+, uci
+, ubus
+, json_c
+, pkg-config
+, udebug
+}:
 
 stdenv.mkDerivation {
   pname = "netifd";
-  version = "unstable-2021-04-03";
+  version = "unstable-2023-11-27";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/netifd.git";
-    rev = "327da9895327bc56b23413ee91a6e6b6e0e4329d";
-    sha256 = "0jvk2hx8kbkc6d72gh9rwap8ds6qgnmny6306vvzxy68v03xikwv";
+    rev = "02bc2e14d1d37500e888c0c53ac41398a56b5579";
+    hash = "sha256-aMs/Y50+1Yk/j5jGubjBCRcPGw03oIitvEygaxRlr90=";
   };
 
-  buildInputs = [ libnl libubox uci ubus json_c ];
-  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [
+    libnl.dev
+    libubox
+    uci
+    ubus
+    json_c
+    udebug
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  postPatch = ''
+    # by default this assumes the build directory is the source directory
+    # since we let cmake build in it's own build directory, we need to use
+    # $PWD (which at the time of this script being run is the directory with the source code)
+    # to adjust the paths
+    sed "s|./make_ethtool_modes_h.sh|$PWD/make_ethtool_modes_h.sh|g" -i CMakeLists.txt
+    sed "s|./ethtool-modes.h|$PWD/ethtool-modes.h|g" -i CMakeLists.txt
+  '';
+
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    "-Wno-error=maybe-uninitialized"
+  ]);
 
   meta = with lib; {
     description = "OpenWrt Network interface configuration daemon";
diff --git a/pkgs/tools/networking/ofono/default.nix b/pkgs/tools/networking/ofono/default.nix
index b52912d5e9a08..f4631f06dc793 100644
--- a/pkgs/tools/networking/ofono/default.nix
+++ b/pkgs/tools/networking/ofono/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchgit
+, fetchzip
 , autoreconfHook
 , pkg-config
 , glib
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/network/ofono/ofono.git";
-    rev = version;
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/network/ofono/ofono.git/snapshot/ofono-${version}.tar.gz";
     sha256 = "sha256-mnh0qzmgPDfimN/M33HntYj90Xcgc/uF8tKbzeQV1Yg=";
   };
 
diff --git a/pkgs/tools/networking/uqmi/default.nix b/pkgs/tools/networking/uqmi/default.nix
index 8050909487da0..bdbb85f30e890 100644
--- a/pkgs/tools/networking/uqmi/default.nix
+++ b/pkgs/tools/networking/uqmi/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "uqmi";
-  version = "unstable-2019-06-27";
+  version = "unstable-2023-10-30";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/uqmi.git";
-    rev = "1965c713937495a5cb029165c16acdb6572c3f87";
-    sha256 = "1gn8sdcl4lwfs3lwabmnjbvdhhk1l42bwbajwds7j4936fpbklx0";
+    rev = "eea292401c388a4eb59c0caf5d00aa046c6059f4";
+    hash = "sha256-Uz5GjGcSKatbii09CsvzsYMz8Vm+Am4RUeCZuFIK1Ag=";
   };
 
   postPatch = ''
@@ -21,6 +21,7 @@ stdenv.mkDerivation {
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
     "-Wno-error=dangling-pointer"
+    "-Wno-error=maybe-uninitialized"
   ]);
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/urlwatch/default.nix b/pkgs/tools/networking/urlwatch/default.nix
index 885304d9fdb10..a17b4b88da3d6 100644
--- a/pkgs/tools/networking/urlwatch/default.nix
+++ b/pkgs/tools/networking/urlwatch/default.nix
@@ -23,9 +23,9 @@ python3Packages.buildPythonApplication rec {
     markdown2
     matrix-client
     minidb
+    playwright
     pushbullet-py
     pycodestyle
-    pyppeteer
     pyyaml
     requests
   ];
diff --git a/pkgs/tools/nix/nixos-render-docs/default.nix b/pkgs/tools/nix/nixos-render-docs/default.nix
index d2b8f1a0614bd..b08abfe069f76 100644
--- a/pkgs/tools/nix/nixos-render-docs/default.nix
+++ b/pkgs/tools/nix/nixos-render-docs/default.nix
@@ -1,18 +1,11 @@
 { lib
 , stdenv
 , python3
-, python3Minimal
 , runCommand
 }:
 
 let
-  # python3Minimal can't be overridden with packages on Darwin, due to a missing framework.
-  # Instead of modifying stdenv, we take the easy way out, since most people on Darwin will
-  # just be hacking on the Nixpkgs manual (which also uses make-options-doc).
-  python = ((if stdenv.isDarwin then python3 else python3Minimal).override {
-    self = python;
-    includeSiteCustomize = true;
-  }).override {
+  python = python3.override {
     packageOverrides = final: prev: {
       markdown-it-py = prev.markdown-it-py.overridePythonAttrs (_: {
         doCheck = false;
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index 0ea47dd7e17cf..7aa7b1cc1a1da 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -213,6 +213,11 @@ self = stdenv.mkDerivation {
   preInstallCheck = lib.optionalString stdenv.isDarwin ''
     export TMPDIR=$NIX_BUILD_TOP
   ''
+  # Prevent crashes in libcurl due to invoking Objective-C `+initialize` methods after `fork`.
+  # See http://sealiesoftware.com/blog/archive/2017/6/5/Objective-C_and_fork_in_macOS_1013.html.
+  + lib.optionalString stdenv.isDarwin ''
+    export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=yes
+  ''
   # See https://github.com/NixOS/nix/issues/5687
   + lib.optionalString (atLeast25 && stdenv.isDarwin) ''
     echo "exit 99" > tests/gc-non-blocking.sh
diff --git a/pkgs/tools/package-management/packagekit/qt.nix b/pkgs/tools/package-management/packagekit/qt.nix
index 72045735cba3c..897f8d9e7b4a2 100644
--- a/pkgs/tools/package-management/packagekit/qt.nix
+++ b/pkgs/tools/package-management/packagekit/qt.nix
@@ -1,7 +1,9 @@
-{ stdenv, fetchFromGitHub, cmake, pkg-config
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config
 , qttools, packagekit }:
 
-stdenv.mkDerivation rec {
+let
+  isQt6 = lib.versions.major qttools.version == "6";
+in stdenv.mkDerivation rec {
   pname = "packagekit-qt";
   version = "1.1.1";
 
@@ -16,6 +18,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config qttools ];
 
+  cmakeFlags = [ (lib.cmakeBool "BUILD_WITH_QT6" isQt6) ];
+
   dontWrapQtApps = true;
 
   meta = packagekit.meta // {
diff --git a/pkgs/tools/package-management/protontricks/default.nix b/pkgs/tools/package-management/protontricks/default.nix
index 55392eaad8332..462a2546ff5da 100644
--- a/pkgs/tools/package-management/protontricks/default.nix
+++ b/pkgs/tools/package-management/protontricks/default.nix
@@ -36,8 +36,6 @@ buildPythonApplication rec {
     })
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/security/coercer/default.nix b/pkgs/tools/security/coercer/default.nix
index 3d1e6cb469637..f380d130bb07f 100644
--- a/pkgs/tools/security/coercer/default.nix
+++ b/pkgs/tools/security/coercer/default.nix
@@ -5,22 +5,28 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "coercer";
-  version = "1.6";
+  version = "2.4.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "p0dalirius";
     repo = "Coercer";
     rev = "refs/tags/${version}";
-    hash = "sha256-xftYnwu6uUTvJTZU9E7wvdgBxqa8xy83K5GOlgNSCvc=";
+    hash = "sha256-WeaKToKYIB+jjTNIQvAUQQNb25TsNWALYZwIZuBjkPE=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "impacket"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
     impacket
+    xlsxwriter
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/tools/security/efitools/default.nix b/pkgs/tools/security/efitools/default.nix
index 59cb794d718e1..70032504f475f 100644
--- a/pkgs/tools/security/efitools/default.nix
+++ b/pkgs/tools/security/efitools/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, gnu-efi, openssl, sbsigntool, perl, perlPackages,
-help2man, fetchgit }:
+help2man, fetchzip }:
 stdenv.mkDerivation rec {
   pname = "efitools";
   version = "1.9.2";
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
     help2man
   ];
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git";
-    rev = "v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git/snapshot/efitools-v${version}.tar.gz";
     sha256 = "0jabgl2pxvfl780yvghq131ylpf82k7banjz0ksjhlm66ik8gb1i";
   };
 
diff --git a/pkgs/tools/security/flare-floss/default.nix b/pkgs/tools/security/flare-floss/default.nix
index 212d0a74ebb1e..c9a9c8cd1380a 100644
--- a/pkgs/tools/security/flare-floss/default.nix
+++ b/pkgs/tools/security/flare-floss/default.nix
@@ -33,7 +33,7 @@ python3.pkgs.buildPythonPackage rec {
     halo
     networkx
     pefile
-    pydantic
+    pydantic_1
     rich
     tabulate
     tqdm
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
index de260e0682490..9a13c21030169 100644
--- a/pkgs/tools/security/ibm-sw-tpm2/default.nix
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -4,7 +4,12 @@
 , fetchpatch
 , openssl
 }:
-
+let
+  makefile =
+    if stdenv.isDarwin
+    then "makefile.mac"
+    else "makefile";
+in
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
   version = "1682";
@@ -30,12 +35,14 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "src";
 
+  inherit makefile;
+
   prePatch = ''
     # Fix hardcoded path to GCC.
-    substituteInPlace makefile --replace /usr/bin/gcc "${stdenv.cc}/bin/cc"
+    substituteInPlace ${makefile} --replace /usr/bin/gcc "${stdenv.cc}/bin/cc"
 
     # Remove problematic default CFLAGS.
-    substituteInPlace makefile \
+    substituteInPlace ${makefile} \
       --replace -Werror "" \
       --replace -O0 "" \
       --replace -ggdb ""
@@ -49,7 +56,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "IBM's Software TPM 2.0, an implementation of the TCG TPM 2.0 specification";
     homepage = "https://sourceforge.net/projects/ibmswtpm2/";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ delroth ];
     license = licenses.bsd3;
   };
diff --git a/pkgs/tools/security/kube-hunter/default.nix b/pkgs/tools/security/kube-hunter/default.nix
index f80f5c70c98c9..bc23c3845b896 100644
--- a/pkgs/tools/security/kube-hunter/default.nix
+++ b/pkgs/tools/security/kube-hunter/default.nix
@@ -14,8 +14,6 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-+M8P/VSF9SKPvq+yNPjokyhggY7hzQ9qLLhkiTNbJls=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
   ];
diff --git a/pkgs/tools/security/mitmproxy2swagger/default.nix b/pkgs/tools/security/mitmproxy2swagger/default.nix
index bbdc56e1d1998..56d47973b7e3a 100644
--- a/pkgs/tools/security/mitmproxy2swagger/default.nix
+++ b/pkgs/tools/security/mitmproxy2swagger/default.nix
@@ -17,6 +17,11 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "ruamel.yaml"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index a4ae25715c3fe..08a4b5b08d02a 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -1,8 +1,9 @@
 { stdenv
 , lib
-, fetchurl
+, fetchFromGitLab
 , autoreconfHook
 , autoconf-archive
+, flex
 , pkg-config
 , perl
 , python3
@@ -10,28 +11,26 @@
 , polkit
 , systemdLibs
 , IOKit
+, testers
+, nix-update-script
 , pname ? "pcsclite"
 , polkitSupport ? false
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "1.9.5";
+  version = "2.0.1";
 
   outputs = [ "bin" "out" "dev" "doc" "man" ];
 
-  src = fetchurl {
-    url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
-    hash = "sha256-nuP5szNTdWIXeJNVmtT3uNXCPr6Cju9TBWwC2xQEnQg=";
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "rousseau";
+    repo = "PCSC";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-7NGlU4byGxtGBticewg8K4FUiDSQZAiB7Q/y+LaqKPo=";
   };
 
-  patches = [ ./no-dropdir-literals.patch ];
-
-  postPatch = ''
-    sed -i configure.ac \
-      -e "s@polkit_policy_dir=.*@polkit_policy_dir=$bin/share/polkit-1/actions@"
-  '';
-
   configureFlags = [
     "--enable-confdir=/etc"
     # The OS should care on preparing the drivers into this location
@@ -43,11 +42,9 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=${placeholder "bin"}/lib/systemd/system"
   ];
 
-  postConfigure = ''
-    sed -i -re '/^#define *PCSCLITE_HP_DROPDIR */ {
-      s/(DROPDIR *)(.*)/\1(getenv("PCSCLITE_HP_DROPDIR") ? : \2)/
-    }' config.h
-  '';
+  makeFlags = [
+    "POLICY_DIR=$(out)/share/polkit-1/actions"
+  ];
 
   postInstall = ''
     # pcsc-spy is a debugging utility and it drags python into the closure
@@ -56,17 +53,34 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config perl ];
+  nativeBuildInputs = [
+    autoreconfHook
+    autoconf-archive
+    flex
+    pkg-config
+    perl
+  ];
 
   buildInputs = [ python3 ]
     ++ lib.optionals stdenv.isLinux [ systemdLibs ]
     ++ lib.optionals stdenv.isDarwin [ IOKit ]
     ++ lib.optionals polkitSupport [ dbus polkit ];
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "pcscd --version";
+    };
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "Middleware to access a smart card using SCard API (PC/SC)";
     homepage = "https://pcsclite.apdu.fr/";
+    changelog = "https://salsa.debian.org/rousseau/PCSC/-/blob/${finalAttrs.version}/ChangeLog";
     license = licenses.bsd3;
+    mainProgram = "pcscd";
+    maintainers = [ maintainers.anthonyroussel ];
     platforms = with platforms; unix;
   };
-}
+})
diff --git a/pkgs/tools/security/pcsclite/no-dropdir-literals.patch b/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
deleted file mode 100644
index 4c6d5554d77a1..0000000000000
--- a/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-diff --git a/src/hotplug_libudev.c b/src/hotplug_libudev.c
-index 51bd95f..84f959b 100644
---- a/src/hotplug_libudev.c
-+++ b/src/hotplug_libudev.c
-@@ -120,7 +120,8 @@ static LONG HPReadBundleValues(void)
- 
- 	if (NULL == hpDir)
- 	{
--		Log1(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: " PCSCLITE_HP_DROPDIR);
-+		Log2(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: %s",
-+			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_ERROR, "Disabling USB support for pcscd.");
- 		return -1;
- 	}
-@@ -741,7 +742,7 @@ ULONG HPRegisterForHotplugEvents(void)
- 
- 	if (driverSize <= 0)
- 	{
--		Log1(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: "
-+		Log2(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: %s",
- 			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
- 		return 0;
-diff --git a/src/hotplug_libusb.c b/src/hotplug_libusb.c
-index 0ada9f5..d49a407 100644
---- a/src/hotplug_libusb.c
-+++ b/src/hotplug_libusb.c
-@@ -142,7 +142,8 @@ static LONG HPReadBundleValues(void)
- 
- 	if (hpDir == NULL)
- 	{
--		Log1(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: " PCSCLITE_HP_DROPDIR);
-+		Log2(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: %s",
-+			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_ERROR, "Disabling USB support for pcscd.");
- 		return -1;
- 	}
-@@ -282,7 +283,8 @@ static LONG HPReadBundleValues(void)
- 
- 	if (driverSize == 0)
- 	{
--		Log1(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: " PCSCLITE_HP_DROPDIR);
-+		Log2(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: %s",
-+			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
- 	}
- #ifdef DEBUG_HOTPLUG
diff --git a/pkgs/tools/security/sedutil/default.nix b/pkgs/tools/security/sedutil/default.nix
index cb0e367fa2ccf..0e83472da0e70 100644
--- a/pkgs/tools/security/sedutil/default.nix
+++ b/pkgs/tools/security/sedutil/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 }:
 
@@ -15,6 +16,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NG/7aqe48ShHWW5hW8axYWV4+zX0dBE7Wy9q58l0S3E=";
   };
 
+  patches = [
+    # Fix for gcc-13 pending upstream inclusion:
+    #   https://github.com/Drive-Trust-Alliance/sedutil/pull/425
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/Drive-Trust-Alliance/sedutil/commit/927cd88cad7bea94c2eebecc18f7881f0defaccb.patch";
+      hash = "sha256-/Lvn3CQd7pzNhLa7sQY8VwbyJK/jEM5FzLijTQnzXx8=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs .
   '';
diff --git a/pkgs/tools/security/stacs/default.nix b/pkgs/tools/security/stacs/default.nix
index 672cd082849cf..205d85f0622e9 100644
--- a/pkgs/tools/security/stacs/default.nix
+++ b/pkgs/tools/security/stacs/default.nix
@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     click
-    pydantic
+    pydantic_1
     typing-extensions
     yara-python
   ];
diff --git a/pkgs/tools/text/l2md/default.nix b/pkgs/tools/text/l2md/default.nix
index 758130e9f0aa2..08ec219690f6a 100644
--- a/pkgs/tools/text/l2md/default.nix
+++ b/pkgs/tools/text/l2md/default.nix
@@ -1,12 +1,11 @@
-{ lib, stdenv, fetchgit, libgit2 }:
+{ lib, stdenv, fetchzip, libgit2 }:
 
 stdenv.mkDerivation rec {
   pname = "l2md";
   version = "unstable-2021-10-27";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/dborkman/l2md.git";
-    rev = "9db252bc1716ebaf0abd3a47a59ea78e4e6253d6";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/dborkman/l2md.git/snapshot/l2md-9db252bc1716ebaf0abd3a47a59ea78e4e6253d6.tar.gz";
     sha256 = "sha256-H/leDUwQM55akyXsmTnI2YsnG4i1KQtf4bBt1fizy8E=";
   };
 
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 95483b8465ed1..aacdf243f997e 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook";
-  version = "0.4.35";
+  version = "0.4.36";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "mdBook";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-oplR34M2PbcIwrfIkA4Ttk2zt3ve883TfXGIDnfJt/4=";
+    sha256 = "sha256-QQSGnOWRx5KK9eJP759E1V9zFVzvRol5bdJfD9mDr5g=";
   };
 
-  cargoHash = "sha256-D0XhrweO0A1+81Je4JZ0lmnbIHstNvefpmogCyB4FEE=";
+  cargoHash = "sha256-IlD4YI7jsWZw0Dn1PoljmhuIOqejva8HMhU4ULy32yE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/text/xml/xmlstarlet/default.nix b/pkgs/tools/text/xml/xmlstarlet/default.nix
index 111e95c9508d8..b5eb08199fc61 100644
--- a/pkgs/tools/text/xml/xmlstarlet/default.nix
+++ b/pkgs/tools/text/xml/xmlstarlet/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , libxml2
@@ -20,8 +21,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libxml2 libxslt ];
 
   patches = [
-    # Fixes an incompatible function pointer error with clang 16.
-    ./fix-incompatible-function-pointer.patch
+    (fetchpatch {
+      name = "0001-Fix-build-with-libxml2-2.12.patch";
+      url = "https://sourceforge.net/p/xmlstar/patches/_discuss/thread/890e29655a/66ca/attachment/0001-Fix-build-with-libxml2-2.12.patch";
+      hash = "sha256-XEk7aFOdrzdec1j2ffERJQbLH0AUNJA52QwA9jf4XWA=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/tools/text/xml/xmlstarlet/fix-incompatible-function-pointer.patch b/pkgs/tools/text/xml/xmlstarlet/fix-incompatible-function-pointer.patch
deleted file mode 100644
index a0818731c217c..0000000000000
--- a/pkgs/tools/text/xml/xmlstarlet/fix-incompatible-function-pointer.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/xml_elem.c	2012-08-12 09:18:59.000000000 -0600
-+++ b/src/xml_elem.c	2023-07-11 13:17:14.220809280 -0600
-@@ -186,7 +186,7 @@
-  * put @name into @data->array[@data->offset]
-  */
- static void
--hash_key_put(void *payload, void *data, xmlChar *name)
-+hash_key_put(void *payload, void *data, const xmlChar *name)
- {
-     ArrayDest *dest = data;
-     dest->array[dest->offset++] = name;
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 2d7f859c809cd..f1816efb0cf95 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -323,6 +323,15 @@ dvisvgm = stdenv.mkDerivation {
       extraPrefix = "texk/dvisvgm/dvisvgm-src/";
       hash = "sha256-CBCbc/woaFeLw7aBG/kSVYc3a5Q56zbAB64kK6mRy4g=";
     })
+
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/mgieseki/dvisvgm/commit/d5df85b403602c927fe56a1f692af91182a1facd.patch";
+      stripLen = 1;
+      extraPrefix = "texk/dvisvgm/dvisvgm-src/";
+      hash = "sha256-U5m9jPmfAXOQKaU+aO/h6hEAzHRPqKcdj5k8f5gU9JQ=";
+      excludes = [ "texk/dvisvgm/dvisvgm-src/src/ttf/TTFTable.hpp" ];
+    })
   ];
 
   preConfigure = "cd texk/dvisvgm";
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 1a497c6affaa9..a9d6e717318fc 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -2,7 +2,10 @@
   - source: ../../../../../doc/languages-frameworks/texlive.xml
   - current html: https://nixos.org/nixpkgs/manual/#sec-language-texlive
 */
-{ stdenv, lib, fetchurl, runCommand, writeShellScript, writeText, buildEnv
+{ lib
+#, stdenv
+, gcc12Stdenv
+, fetchurl, runCommand, writeShellScript, writeText, buildEnv
 , callPackage, ghostscript_headless, harfbuzz
 , makeWrapper, installShellFiles
 , python3, ruby, perl, tk, jdk, bash, snobol4
@@ -11,6 +14,7 @@
 , useFixedHashes ? true
 , recurseIntoAttrs
 }:
+let stdenv = gcc12Stdenv; in
 let
   # various binaries (compiled)
   bin = callPackage ./bin.nix {
diff --git a/pkgs/tools/video/svt-av1/default.nix b/pkgs/tools/video/svt-av1/default.nix
index 40869c0f8f4e4..d40047510f405 100644
--- a/pkgs/tools/video/svt-av1/default.nix
+++ b/pkgs/tools/video/svt-av1/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "svt-av1";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitLab {
     owner = "AOMediaCodec";
     repo = "SVT-AV1";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-WKc0DNwpA9smMS3e/GDkk77FUkohwaPMgcXgji14CIw=";
+    hash = "sha256-JV65VuEPJBrADsGviBnE6EgZmbqJ4Z4qli6cAfUMmkw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1a92aeb660496..1dab4e0de15a9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -290,6 +290,7 @@ mapAliases ({
   framework-system-tools = framework-tool; # added 2023-12-09
   fritzprofiles = throw "fritzprofiles was removed from nixpkgs, because it was removed as dependency of home-assistant for which it was pacakged."; # added 2024-01-05
   fuse2fs = if stdenv.isLinux then e2fsprogs.fuse2fs else null; # Added 2022-03-27 preserve, reason: convenience, arch has a package named fuse2fs too.
+  futuresql = libsForQt5.futuresql; # added 2023-11-11
   fx_cast_bridge = fx-cast-bridge; # added 2023-07-26
 
   fcitx = throw "fcitx is deprecated, please use fcitx5 instead."; # Added 2023-03-13
@@ -500,6 +501,7 @@ mapAliases ({
   liblastfm = libsForQt5.liblastfm; # Added 2020-06-14
   libmongo-client = throw "'libmongo-client' has been removed, upstream gone"; # Added 2023-06-22
   libpulseaudio-vanilla = libpulseaudio; # Added 2022-04-20
+  libquotient = libsForQt5.libquotient; # Added 2023-11-11
   libraw_unstable = throw "'libraw_unstable' has been removed, please use libraw"; # Added 2023-01-30
   librdf = lrdf; # Added 2020-03-22
   libressl_3_5 = throw "'libressl_3_5' has reached end-of-life "; # Added 2023-05-07
@@ -905,6 +907,7 @@ mapAliases ({
   rtsp-simple-server = throw "rtsp-simple-server is rebranded as mediamtx, including default config path update"; # Added 2023-04-11
   runCommandNoCC = runCommand;
   runCommandNoCCLocal = runCommandLocal;
+  rustc-wasm32 = rustc; # Added 2023-12-01
   rxvt_unicode = rxvt-unicode-unwrapped; # Added 2020-02-02
   rxvt_unicode-with-plugins = rxvt-unicode; # Added 2020-02-02
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8bf67e22749c5..a2b04cea49c5a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2798,7 +2798,7 @@ with pkgs;
 
   pcem = callPackage ../applications/emulators/pcem { };
 
-  pcsx2 = qt6Packages.callPackage ../applications/emulators/pcsx2 { };
+  pcsx2 = disable-warnings-if-gcc13 (qt6Packages.callPackage ../applications/emulators/pcsx2 { });
 
   pcsxr = callPackage ../applications/emulators/pcsxr { };
 
@@ -4410,8 +4410,6 @@ with pkgs;
     charles4
   ;
 
-  libquotient = libsForQt5.callPackage ../development/libraries/libquotient { };
-
   quaternion = libsForQt5.callPackage ../applications/networking/instant-messengers/quaternion { };
 
   tensor = libsForQt5.callPackage ../applications/networking/instant-messengers/tensor { };
@@ -4856,7 +4854,9 @@ with pkgs;
 
   wl-mirror = callPackage ../tools/wayland/wl-mirror { };
 
-  wl-screenrec = callPackage ../tools/wayland/wl-screenrec { };
+  wl-screenrec = callPackage ../tools/wayland/wl-screenrec {
+    ffmpeg = ffmpeg_5;
+  };
 
   wleave = callPackage ../tools/wayland/wleave { };
 
@@ -7364,8 +7364,11 @@ with pkgs;
 
   curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
 
-  curl-impersonate = darwin.apple_sdk_11_0.callPackage ../tools/networking/curl-impersonate { };
-  inherit (curl-impersonate) curl-impersonate-ff curl-impersonate-chrome;
+  curl-impersonate =
+    builtins.mapAttrs (_: pin-to-gcc12-if-gcc13)
+      (darwin.apple_sdk_11_0.callPackage ../tools/networking/curl-impersonate { });
+  curl-impersonate-ff = pin-to-gcc12-if-gcc13 curl-impersonate.curl-impersonate-ff;
+  curl-impersonate-chrom = pin-to-gcc12-if-gcc13 curl-impersonate.curl-impersonate-chrome;
 
   curlie = callPackage ../tools/networking/curlie { };
 
@@ -7948,7 +7951,7 @@ with pkgs;
 
   efibootmgr = callPackage ../tools/system/efibootmgr { };
 
-  efivar = callPackage ../tools/system/efivar { };
+  efivar = disable-warnings-if-gcc13 (callPackage ../tools/system/efivar { });
 
   eget = callPackage ../tools/misc/eget { };
 
@@ -8565,7 +8568,9 @@ with pkgs;
 
   gifsicle = callPackage ../tools/graphics/gifsicle { };
 
-  gifski = callPackage ../tools/graphics/gifski { };
+  gifski = callPackage ../tools/graphics/gifski {
+    ffmpeg = ffmpeg_5;
+  };
 
   github-backup = callPackage ../tools/misc/github-backup { };
 
@@ -8793,7 +8798,7 @@ with pkgs;
 
   google-guest-oslogin = callPackage ../tools/virtualization/google-guest-oslogin { };
 
-  google-cloud-cpp = callPackage ../development/libraries/google-cloud-cpp { };
+  google-cloud-cpp = disable-warnings-if-gcc13 (callPackage ../development/libraries/google-cloud-cpp { });
 
   google-java-format = callPackage ../development/tools/google-java-format { };
 
@@ -9441,7 +9446,7 @@ with pkgs;
 
   inql = callPackage ../tools/security/inql { };
 
-  intel-media-sdk = callPackage ../development/libraries/intel-media-sdk { };
+  intel-media-sdk = disable-warnings-if-gcc13 (callPackage ../development/libraries/intel-media-sdk { });
 
   intermodal = callPackage ../tools/misc/intermodal { };
 
@@ -12505,9 +12510,9 @@ with pkgs;
 
   qdigidoc = libsForQt5.callPackage ../tools/security/qdigidoc { } ;
 
-  qgrep = callPackage ../tools/text/qgrep {
+  qgrep = pin-to-gcc12-if-gcc13 (callPackage ../tools/text/qgrep {
     inherit (darwin.apple_sdk.frameworks) CoreServices CoreFoundation;
-  };
+  });
 
   qhull = callPackage ../development/libraries/qhull { };
 
@@ -15824,11 +15829,30 @@ with pkgs;
 
   default-gcc-version =
     if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
-    else 12;
+    else if stdenv.buildPlatform.isDarwin  then 12  # unable to test
+    else if stdenv.buildPlatform.isAarch64 then 12  # unable to test
+    else 13;
   gcc = pkgs.${"gcc${toString default-gcc-version}"};
   gccFun = callPackage ../development/compilers/gcc;
   gcc-unwrapped = gcc.cc;
 
+  disable-warnings-if-gcc13 = pkg:
+    if (pkg.stdenv.cc.cc.isGNU or false && lib.versionAtLeast pkg.stdenv.cc.cc.version "13.0")
+    then pkg.overrideAttrs(previousAttrs: previousAttrs // {
+      env = previousAttrs.env or {} // {
+        NIX_CFLAGS_COMPILE = (previousAttrs.env.NIX_CFLAGS_COMPILE or "") + " -Wno-error";
+      };
+    })
+    else pkg;
+
+  pin-to-gcc12-if-gcc13 = pkg:
+    if !(lib.isDerivation pkg) || !(pkg?override) then pkg else
+    pkg.override (previousArgs:
+      lib.optionalAttrs (previousArgs.stdenv.cc.cc.isGNU or false &&
+                         lib.versionAtLeast previousArgs.stdenv.cc.cc.version "13.0") {
+                           stdenv = gcc12Stdenv;
+                         });
+
   wrapNonDeterministicGcc = stdenv: ccWrapper:
     if ccWrapper.isGNU then ccWrapper.overrideAttrs(old: {
       env = old.env // {
@@ -16395,7 +16419,7 @@ with pkgs;
   hugs = callPackage ../development/interpreters/hugs { };
 
   inherit (javaPackages) openjfx11 openjfx15 openjfx17 openjfx19 openjfx20 openjfx21;
-  openjfx = openjfx17;
+  openjfx = pin-to-gcc12-if-gcc13 (openjfx17.override { });
 
   openjdk8-bootstrap = javaPackages.compiler.openjdk8-bootstrap;
   openjdk8 = javaPackages.compiler.openjdk8;
@@ -16629,6 +16653,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_8.tools;
     targetLlvm = targetPackages.llvmPackages_8.llvm or llvmPackages_8.llvm;
     targetLlvmLibraries = targetPackages.llvmPackages_8.libraries or llvmPackages_8.libraries;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   });
 
   llvmPackages_9 = recurseIntoAttrs (callPackage ../development/compilers/llvm/9 {
@@ -16636,6 +16661,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_9.tools;
     targetLlvm = targetPackages.llvmPackages_9.llvm or llvmPackages_9.llvm;
     targetLlvmLibraries = targetPackages.llvmPackages_9.libraries or llvmPackages_9.libraries;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   });
 
   llvmPackages_10 = recurseIntoAttrs (callPackage ../development/compilers/llvm/10 {
@@ -16643,6 +16669,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_10.tools;
     targetLlvm = targetPackages.llvmPackages_10.llvm or llvmPackages_10.llvm;
     targetLlvmLibraries = targetPackages.llvmPackages_10.libraries or llvmPackages_10.libraries;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   });
 
   llvmPackages_11 = recurseIntoAttrs (callPackage ../development/compilers/llvm/11 ({
@@ -16664,6 +16691,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_13.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_13.libraries or llvmPackages_13.libraries;
     targetLlvm = targetPackages.llvmPackages_13.llvm or llvmPackages_13.llvm;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   }));
 
   llvmPackages_14 = recurseIntoAttrs (callPackage ../development/compilers/llvm/14 ({
@@ -16671,6 +16699,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_14.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_14.libraries or llvmPackages_14.libraries;
     targetLlvm = targetPackages.llvmPackages_14.llvm or llvmPackages_14.llvm;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   }));
 
   llvmPackages_15 = recurseIntoAttrs (callPackage ../development/compilers/llvm/15 ({
@@ -16883,11 +16912,11 @@ with pkgs;
   wrapRustcWith = { rustc-unwrapped, ... } @ args: callPackage ../build-support/rust/rustc-wrapper args;
   wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
 
-  rust_1_74 = callPackage ../development/compilers/rust/1_74.nix {
+  rust_1_75 = callPackage ../development/compilers/rust/1_75.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
-    llvm_16 = llvmPackages_16.libllvm;
+    llvm_17 = llvmPackages_17.libllvm;
   };
-  rust = rust_1_74;
+  rust = rust_1_75;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16895,24 +16924,11 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_74 = rust_1_74.packages.stable;
-  rustPackages = rustPackages_1_74;
+  rustPackages_1_75 = rust_1_75.packages.stable;
+  rustPackages = rustPackages_1_75;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
-  # https://github.com/NixOS/nixpkgs/issues/89426
-  rustc-wasm32 = wrapRustc ((rustc.unwrapped.override {
-    stdenv = stdenv.override {
-      targetPlatform = lib.systems.elaborate {
-        # lib.systems.elaborate won't recognize "unknown" as the last component.
-        config = "wasm32-unknown-wasi";
-        rust.rustcTarget = "wasm32-unknown-unknown";
-      };
-    };
-  }).overrideAttrs (old: {
-    configureFlags = old.configureFlags ++ ["--set=build.docs=false"];
-  }));
-
   makeRustPlatform = callPackage ../development/compilers/rust/make-rust-platform.nix { };
 
   buildRustCrate = callPackage ../build-support/rust/build-rust-crate { };
@@ -17871,9 +17887,9 @@ with pkgs;
   python27Packages = python27.pkgs // { __attrsFailEvaluation = true; };
   python38Packages = python38.pkgs // { __attrsFailEvaluation = true; };
   python39Packages = python39.pkgs // { __attrsFailEvaluation = true; };
-  python310Packages = recurseIntoAttrs python310.pkgs // { pythonPackages = python310.pkgs // { __attrsFailEvaluation = true; }; };
+  python310Packages = python310.pkgs // { __attrsFailEvaluation = true; };
   python311Packages = recurseIntoAttrs python311.pkgs // { pythonPackages = python311.pkgs // { __attrsFailEvaluation = true; }; };
-  python312Packages = python312.pkgs // { __attrsFailEvaluation = true; };
+  python312Packages = recurseIntoAttrs python312.pkgs // { pythonPackages = python312.pkgs // { __attrsFailEvaluation = true; }; };
   python313Packages = python313.pkgs // { __attrsFailEvaluation = true; };
   pypyPackages = pypy.pkgs // { __attrsFailEvaluation = true; };
   pypy2Packages = pypy2.pkgs // { __attrsFailEvaluation = true; };
@@ -18506,16 +18522,16 @@ with pkgs;
     bazel_self = bazel_4;
   };
 
-  bazel_5 = callPackage ../development/tools/build-managers/bazel/bazel_5 {
+  bazel_5 = pin-to-gcc12-if-gcc13 (callPackage ../development/tools/build-managers/bazel/bazel_5 {
     inherit (darwin) cctools sigtool;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Foundation;
     buildJdk = jdk11_headless;
     runJdk = jdk11_headless;
     stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     bazel_self = bazel_5;
-  };
+  });
 
-  bazel_6 = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_6 {
+  bazel_6 = pin-to-gcc12-if-gcc13 (darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_6 {
     inherit (darwin) cctools;
     inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation CoreServices Foundation;
     buildJdk = jdk11_headless;
@@ -18524,7 +18540,7 @@ with pkgs;
       darwin.apple_sdk_11_0.stdenv else
       if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     bazel_self = bazel_6;
-  };
+  });
 
   bazel_7 = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_7 {
     inherit (darwin) cctools sigtool;
@@ -19178,8 +19194,6 @@ with pkgs;
 
   funzzy = callPackage ../development/tools/misc/funzzy { };
 
-  futuresql = libsForQt5.callPackage ../development/libraries/futuresql { };
-
   fzf-make = callPackage ../development/tools/misc/fzf-make { };
 
   gede = libsForQt5.callPackage ../development/tools/misc/gede { };
@@ -20642,7 +20656,7 @@ with pkgs;
     else callPackage ../os-specific/linux/bionic-prebuilt { };
 
 
-  bobcat = callPackage ../development/libraries/bobcat { };
+  bobcat = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/bobcat { });
 
   boehmgc = callPackage ../development/libraries/boehm-gc { };
 
@@ -20926,7 +20940,7 @@ with pkgs;
 
   crocoddyl = callPackage ../development/libraries/crocoddyl { };
 
-  crossguid = callPackage ../development/libraries/crossguid { };
+  crossguid = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/crossguid { });
 
   cryptopp = callPackage ../development/libraries/crypto++ { };
 
@@ -22252,6 +22266,11 @@ with pkgs;
 
   libjson = callPackage ../development/libraries/libjson { };
 
+  libjodycode = callPackage ../development/libraries/libjodycode {
+    # missing aligned_alloc()
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  };
+
   libb64 = callPackage ../development/libraries/libb64 { };
 
   judy = callPackage ../development/libraries/judy { };
@@ -22670,7 +22689,7 @@ with pkgs;
   dwarfdump = libdwarf.bin;
   libdwarf_20210528 = callPackage ../development/libraries/libdwarf/20210528.nix { };
 
-  libe57format = callPackage ../development/libraries/libe57format { };
+  libe57format = disable-warnings-if-gcc13 (callPackage ../development/libraries/libe57format { });
 
   libeatmydata = callPackage ../development/libraries/libeatmydata { };
 
@@ -22698,9 +22717,11 @@ with pkgs;
 
   libfido2 = callPackage ../development/libraries/libfido2 {};
 
-  libfilezilla = darwin.apple_sdk_11_0.callPackage ../development/libraries/libfilezilla {
-    inherit (darwin.apple_sdk_11_0.frameworks) ApplicationServices;
-  };
+  libfilezilla =
+    pin-to-gcc12-if-gcc13
+      (darwin.apple_sdk_11_0.callPackage ../development/libraries/libfilezilla {
+        inherit (darwin.apple_sdk_11_0.frameworks) ApplicationServices;
+      });
 
   libfishsound = callPackage ../development/libraries/libfishsound { };
 
@@ -23873,7 +23894,7 @@ with pkgs;
 
   mediastreamer-openh264 = callPackage ../development/libraries/mediastreamer/msopenh264.nix { };
 
-  memorymapping = callPackage ../development/libraries/memorymapping { };
+  memorymapping = disable-warnings-if-gcc13 (callPackage ../development/libraries/memorymapping { });
   memorymappingHook = makeSetupHook {
     name = "memorymapping-hook";
     propagatedBuildInputs = [ memorymapping ];
@@ -24260,7 +24281,7 @@ with pkgs;
 
   opencl-clhpp = callPackage ../development/libraries/opencl-clhpp { };
 
-  opencollada = callPackage ../development/libraries/opencollada { };
+  opencollada = disable-warnings-if-gcc13 (callPackage ../development/libraries/opencollada { });
 
   opencore-amr = callPackage ../development/libraries/opencore-amr { };
 
@@ -24356,7 +24377,7 @@ with pkgs;
 
   libressl = libressl_3_8;
 
-  boringssl = callPackage ../development/libraries/boringssl { };
+  boringssl = disable-warnings-if-gcc13 (callPackage ../development/libraries/boringssl { });
 
   wolfssl = darwin.apple_sdk_11_0.callPackage ../development/libraries/wolfssl {
     inherit (darwin.apple_sdk_11_0.frameworks) Security;
@@ -24514,9 +24535,9 @@ with pkgs;
 
   primesieve = callPackage ../applications/science/math/primesieve { };
 
-  proj = callPackage ../development/libraries/proj {
+  proj = disable-warnings-if-gcc13 (callPackage ../development/libraries/proj {
     stdenv = if stdenv.cc.isClang then overrideLibcxx llvmPackages_13.stdenv else stdenv;
-  };
+  });
 
   proj_7 = callPackage ../development/libraries/proj/7.nix { };
 
@@ -24568,10 +24589,16 @@ with pkgs;
 
   pylode = callPackage ../misc/pylode { };
 
-  python-qt = callPackage ../development/libraries/python-qt {
+  python-qt = (callPackage ../development/libraries/python-qt {
     python = python3;
-    inherit (qt5) qmake qttools qtwebengine qtxmlpatterns;
-  };
+    inherit (builtins.mapAttrs (_: pkg: pkg.override (previousArgs: lib.optionalAttrs (previousArgs ? stdenv) { stdenv = gcc12Stdenv; })) qt5)
+      qmake qttools qtwebengine qtxmlpatterns;
+    stdenv = gcc12Stdenv;
+  })
+  .overrideAttrs(previousAttrs: {
+    NIX_CFLAGS_COMPILE = "-w";
+    meta = previousAttrs.meta // { broken = true; };
+  });
 
   pyotherside = libsForQt5.callPackage ../development/libraries/pyotherside { };
 
@@ -24756,7 +24783,7 @@ with pkgs;
 
   rlottie = callPackage ../development/libraries/rlottie { };
 
-  rocksdb = callPackage ../development/libraries/rocksdb { };
+  rocksdb = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/rocksdb { });
 
   rocksdb_7_10 = rocksdb.overrideAttrs rec {
     pname = "rocksdb";
@@ -24896,9 +24923,9 @@ with pkgs;
 
   sdrplay = callPackage ../applications/radio/sdrplay { };
 
-  sdrpp = callPackage ../applications/radio/sdrpp {
+  sdrpp = pin-to-gcc12-if-gcc13 (callPackage ../applications/radio/sdrpp {
     inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  });
 
   sigdigger = libsForQt5.callPackage ../applications/radio/sigdigger { };
 
@@ -25397,7 +25424,7 @@ with pkgs;
 
   ucommon = callPackage ../development/libraries/ucommon { };
 
-  v8 = callPackage ../development/libraries/v8 (
+  v8 = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/v8 (
     let
       stdenv' = if stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc.cc) "16"
         then overrideLibcxx llvmPackages_15.stdenv
@@ -25406,7 +25433,7 @@ with pkgs;
     {
       stdenv = if stdenv'.isDarwin then overrideSDK stdenv' "11.0" else stdenv';
     }
-  );
+  ));
 
   intel-vaapi-driver = callPackage ../development/libraries/intel-vaapi-driver { };
 
@@ -25523,9 +25550,9 @@ with pkgs;
 
   wayland-protocols = callPackage ../development/libraries/wayland/protocols.nix { };
 
-  waylandpp = callPackage ../development/libraries/waylandpp {
+  waylandpp = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/waylandpp {
     graphviz = graphviz-nox;
-  };
+  });
 
   wcslib = callPackage ../development/libraries/science/astronomy/wcslib { };
 
@@ -25585,6 +25612,7 @@ with pkgs;
 
   wxSVG = callPackage ../development/libraries/wxSVG {
     wxGTK = wxGTK32;
+    stdenv = gcc12Stdenv;
   };
 
   wtk = callPackage ../development/libraries/wtk { };
@@ -26305,11 +26333,11 @@ with pkgs;
 
   engelsystem = callPackage ../servers/web-apps/engelsystem { php = php81; };
 
-  envoy = callPackage ../servers/http/envoy {
+  envoy = pin-to-gcc12-if-gcc13 (callPackage ../servers/http/envoy {
     go = go_1_20;
     jdk = openjdk11_headless;
     gn = gn1924;
-  };
+  });
 
   ergochat = callPackage ../servers/irc/ergochat { };
 
@@ -26765,7 +26793,7 @@ with pkgs;
 
   openxr-loader = callPackage ../development/libraries/openxr-loader { };
 
-  osrm-backend = callPackage ../servers/osrm-backend { };
+  osrm-backend = disable-warnings-if-gcc13 (callPackage ../servers/osrm-backend { });
 
   oven-media-engine = callPackage ../servers/misc/oven-media-engine { };
 
@@ -27222,9 +27250,9 @@ with pkgs;
     protobuf = protobuf_21;
   };
 
-  rippled = callPackage ../servers/rippled {
+  rippled = disable-warnings-if-gcc13 (callPackage ../servers/rippled {
     boost = boost177;
-  };
+  });
 
   rippled-validator-keys-tool = callPackage ../servers/rippled/validator-keys-tool.nix { };
 
@@ -27862,9 +27890,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) AppKit;
   };
 
-  btop = darwin.apple_sdk_11_0.callPackage ../tools/system/btop {
-    stdenv = gcc12Stdenv;
-  };
+  btop = disable-warnings-if-gcc13 (darwin.apple_sdk_11_0.callPackage ../tools/system/btop { });
 
   nmon = callPackage ../os-specific/linux/nmon { };
 
@@ -27895,16 +27921,16 @@ with pkgs;
 
   iproute2 = callPackage ../os-specific/linux/iproute { };
 
-  ipu6-camera-bin = callPackage ../os-specific/linux/firmware/ipu6-camera-bins {};
+  ipu6-camera-bins = callPackage ../os-specific/linux/firmware/ipu6-camera-bins {};
 
   ipu6-camera-hal = callPackage ../development/libraries/ipu6-camera-hal {};
 
-  ipu6ep-camera-bin = callPackage ../os-specific/linux/firmware/ipu6-camera-bins {
+  ipu6ep-camera-hal = callPackage ../development/libraries/ipu6-camera-hal {
     ipuVersion = "ipu6ep";
   };
 
-  ipu6ep-camera-hal = callPackage ../development/libraries/ipu6-camera-hal {
-    ipu6-camera-bin = ipu6ep-camera-bin;
+  ipu6epmtl-camera-hal = callPackage ../development/libraries/ipu6-camera-hal {
+    ipuVersion = "ipu6epmtl";
   };
 
   ivsc-firmware = callPackage ../os-specific/linux/firmware/ivsc-firmware { };
@@ -30828,7 +30854,7 @@ with pkgs;
 
   clapper = callPackage ../applications/video/clapper { };
 
-  claws-mail = callPackage ../applications/networking/mailreaders/claws-mail { };
+  claws-mail = disable-warnings-if-gcc13 (callPackage ../applications/networking/mailreaders/claws-mail { });
 
   cligh = python3Packages.callPackage ../development/tools/github/cligh { };
 
@@ -31644,12 +31670,12 @@ with pkgs;
       };
     };
   };
-  gnuradio3_8 = callPackage ../applications/radio/gnuradio/wrapper.nix {
+  gnuradio3_8 = disable-warnings-if-gcc13 (callPackage ../applications/radio/gnuradio/wrapper.nix {
     unwrapped = callPackage ../applications/radio/gnuradio/3.8.nix {
       inherit (darwin.apple_sdk.frameworks) CoreAudio;
       python = python3;
     };
-  };
+  });
   gnuradio3_8Packages = lib.recurseIntoAttrs gnuradio3_8.pkgs;
   # A build without gui components and other utilites not needed if gnuradio is
   # used as a c++ library.
@@ -34158,7 +34184,7 @@ with pkgs;
 
   rep-gtk = callPackage ../development/libraries/rep-gtk { };
 
-  reproc = callPackage ../development/libraries/reproc { };
+  reproc = disable-warnings-if-gcc13 (callPackage ../development/libraries/reproc { });
 
   sawfish = callPackage ../applications/window-managers/sawfish { };
 
@@ -34309,7 +34335,7 @@ with pkgs;
   obs-cli = callPackage ../applications/misc/obs-cli { };
 
   obs-studio = qt6Packages.callPackage ../applications/video/obs-studio {
-    ffmpeg_4 = ffmpeg-full;
+    ffmpeg = ffmpeg-full;
   };
 
   obs-studio-plugins = recurseIntoAttrs (callPackage ../applications/video/obs-studio/plugins {});
@@ -35206,7 +35232,7 @@ with pkgs;
 
   spice-vdagent = callPackage ../applications/virtualization/spice-vdagent { };
 
-  spike = callPackage ../applications/virtualization/spike { };
+  spike = pin-to-gcc12-if-gcc13 (callPackage ../applications/virtualization/spike { });
 
   tensorman = callPackage ../tools/misc/tensorman { };
 
@@ -35318,12 +35344,12 @@ with pkgs;
 
   slic3r = callPackage ../applications/misc/slic3r { };
 
-  curaengine_stable = callPackage ../applications/misc/curaengine/stable.nix { };
+  curaengine_stable = disable-warnings-if-gcc13 (callPackage ../applications/misc/curaengine/stable.nix { });
 
-  curaengine = callPackage ../applications/misc/curaengine {
+  curaengine = disable-warnings-if-gcc13 (callPackage ../applications/misc/curaengine {
     inherit (python3.pkgs) libarcus;
     protobuf = protobuf_21;
-  };
+  });
 
   cura = libsForQt5.callPackage ../applications/misc/cura { };
 
@@ -36123,10 +36149,10 @@ with pkgs;
 
   virtual-ans = callPackage ../applications/audio/virtual-ans { };
 
-  virtualbox = libsForQt5.callPackage ../applications/virtualization/virtualbox {
+  virtualbox = disable-warnings-if-gcc13 (libsForQt5.callPackage ../applications/virtualization/virtualbox {
     stdenv = stdenv_32bit;
     inherit (gnome2) libIDL;
-  };
+  });
 
   virtualboxHardened = lowPrio (virtualbox.override {
     enableHardening = true;
@@ -36819,7 +36845,7 @@ with pkgs;
 
   zerobin = callPackage ../applications/networking/zerobin { };
 
-  zeroc-ice = callPackage ../development/libraries/zeroc-ice { };
+  zeroc-ice = disable-warnings-if-gcc13 (callPackage ../development/libraries/zeroc-ice { });
 
   zeroc-ice-cpp11 = zeroc-ice.override { cpp11 = true; };
 
@@ -37026,11 +37052,11 @@ with pkgs;
 
   lightning-pool = callPackage ../applications/blockchains/lightning-pool { };
 
-  litecoin  = libsForQt5.callPackage ../applications/blockchains/litecoin {
+  litecoin  = disable-warnings-if-gcc13 (libsForQt5.callPackage ../applications/blockchains/litecoin {
     inherit (darwin.apple_sdk.frameworks) AppKit;
     boost = pkgs.boost177;
-  };
-  litecoind = litecoin.override { withGui = false; };
+  });
+  litecoind = disable-warnings-if-gcc13 (litecoin.override { withGui = false; });
 
   livedl = callPackage ../tools/misc/livedl { };
 
@@ -37106,15 +37132,15 @@ with pkgs;
   vertcoin  = libsForQt5.callPackage ../applications/blockchains/vertcoin {
     withGui = true;
   };
-  vertcoind = callPackage ../applications/blockchains/vertcoin {
+  vertcoind = disable-warnings-if-gcc13 (callPackage ../applications/blockchains/vertcoin {
     withGui = false;
-  };
+  });
 
   wasabiwallet = callPackage ../applications/blockchains/wasabiwallet { };
 
   wasabibackend = callPackage ../applications/blockchains/wasabibackend { };
 
-  wownero = callPackage ../applications/blockchains/wownero { };
+  wownero = disable-warnings-if-gcc13 (callPackage ../applications/blockchains/wownero { });
 
   zcash = callPackage ../applications/blockchains/zcash {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -39259,7 +39285,7 @@ with pkgs;
 
   ipopt = callPackage ../development/libraries/science/math/ipopt { };
 
-  gmsh = callPackage ../applications/science/math/gmsh { };
+  gmsh = disable-warnings-if-gcc13 (callPackage ../applications/science/math/gmsh { });
 
   wcpg = callPackage ../development/libraries/science/math/wcpg { };
 
@@ -39602,7 +39628,7 @@ with pkgs;
 
   avy = callPackage ../applications/science/logic/avy { };
 
-  btor2tools = callPackage ../applications/science/logic/btor2tools { };
+  btor2tools = pin-to-gcc12-if-gcc13 (callPackage ../applications/science/logic/btor2tools { });
 
   boolector = callPackage ../applications/science/logic/boolector {
     stdenv = if stdenv.cc.isClang then overrideLibcxx llvmPackages_14.stdenv else stdenv;
@@ -40037,7 +40063,7 @@ with pkgs;
 
   beep = callPackage ../misc/beep { };
 
-  bees = callPackage ../tools/filesystems/bees { };
+  bees = pin-to-gcc12-if-gcc13 (callPackage ../tools/filesystems/bees { });
 
   blahaj = callPackage ../tools/misc/blahaj { };
 
@@ -40475,11 +40501,12 @@ with pkgs;
 
   networkd-dispatcher = callPackage ../tools/networking/networkd-dispatcher { };
 
-  nixVersions = recurseIntoAttrs (callPackage ../tools/package-management/nix {
-    storeDir = config.nix.storeDir or "/nix/store";
-    stateDir = config.nix.stateDir or "/nix/var";
-    inherit (darwin.apple_sdk.frameworks) Security;
-  });
+  nixVersions = builtins.mapAttrs (_: disable-warnings-if-gcc13)
+    (recurseIntoAttrs (callPackage ../tools/package-management/nix {
+      storeDir = config.nix.storeDir or "/nix/store";
+      stateDir = config.nix.stateDir or "/nix/var";
+      inherit (darwin.apple_sdk.frameworks) Security;
+    }));
 
   nix = nixVersions.stable;
 
diff --git a/pkgs/top-level/kodi-packages.nix b/pkgs/top-level/kodi-packages.nix
index 80c080eff7ba4..d0a4947865618 100644
--- a/pkgs/top-level/kodi-packages.nix
+++ b/pkgs/top-level/kodi-packages.nix
@@ -1,4 +1,5 @@
-{ config, lib, newScope, kodi, libretro }:
+{ config, lib, newScope, kodi, libretro
+, disable-warnings-if-gcc13 }:
 
 with lib;
 
@@ -156,7 +157,7 @@ let self = rec {
 
   inputstream-adaptive = callPackage ../applications/video/kodi/addons/inputstream-adaptive { };
 
-  inputstream-ffmpegdirect = callPackage ../applications/video/kodi/addons/inputstream-ffmpegdirect { };
+  inputstream-ffmpegdirect = disable-warnings-if-gcc13 (callPackage ../applications/video/kodi/addons/inputstream-ffmpegdirect { });
 
   inputstream-rtmp = callPackage ../applications/video/kodi/addons/inputstream-rtmp { };
 
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index c424226f76b91..751a13b34ce7b 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -370,6 +370,17 @@ lib.makeScope pkgs.newScope (self: with self; {
           configureFlags = [
             "--enable-dom"
           ];
+          patches = lib.optionals (lib.versionOlder php.version "8.2.14") [
+            # Fix tests with libxml 2.12
+            # Part of 8.3.1RC1+, 8.2.14RC1+
+            (fetchpatch {
+              url = "https://github.com/php/php-src/commit/061058a9b1bbd90d27d97d79aebcf2b5029767b0.patch";
+              hash = "sha256-0hOlAG+pOYp/gUU0MUMZvzWpgr0ncJi5GB8IeNxxyEU=";
+              excludes = [
+                "NEWS"
+              ];
+            })
+          ];
         }
         {
           name = "enchant";
@@ -610,7 +621,9 @@ lib.makeScope pkgs.newScope (self: with self; {
           # The `sqlite3_bind_bug68849.phpt` test is currently broken for i686 Linux systems since sqlite 3.43, cf.:
           # - https://github.com/php/php-src/issues/12076
           # - https://www.sqlite.org/forum/forumpost/abbb95376ec6cd5f
-          patches = lib.optional (stdenv.isi686 && stdenv.isLinux) ../development/interpreters/php/skip-sqlite3_bind_bug68849.phpt.patch;
+          patches = lib.optionals (stdenv.isi686 && stdenv.isLinux) [
+            ../development/interpreters/php/skip-sqlite3_bind_bug68849.phpt.patch
+          ];
         }
         { name = "sysvmsg"; }
         { name = "sysvsem"; }
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index d4d59161faad6..ce36f16a9024f 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -270,6 +270,7 @@ mapAliases ({
   mir_eval = mir-eval; # added 2024-01-07
   mistune_0_8 = throw "mistune_0_8 was removed because it was outdated and insecure"; # added 2022-08-12
   mistune_2_0 = mistune; # added 2022-08-12
+  mkdocs-minify = mkdocs-minify-plugin; # added 2023-11-28
   mox = throw "mox was removed because it is unmaintained"; # added 2023-02-21
   mrkd = throw "mrkd has been promoted to a top-level attribute"; # added 2023-08-01
   multi_key_dict = multi-key-dict; # added 2023-11-05
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8a81dca98f2c8..582aa81f11ed2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16,6 +16,9 @@ self: super: with self; {
     build = toPythonModule (callPackage ../development/python-modules/bootstrap/build {
       inherit (bootstrap) flit-core installer;
     });
+    packaging = toPythonModule (callPackage ../development/python-modules/bootstrap/packaging {
+      inherit (bootstrap) flit-core installer;
+    });
   };
 
   setuptools = callPackage ../development/python-modules/setuptools { };
@@ -802,6 +805,8 @@ self: super: with self; {
 
   astropy-helpers = callPackage ../development/python-modules/astropy-helpers { };
 
+  astropy-iers-data = callPackage ../development/python-modules/astropy-iers-data { };
+
   astropy-extension-helpers = callPackage ../development/python-modules/astropy-extension-helpers { };
 
   astroquery = callPackage ../development/python-modules/astroquery { };
@@ -2546,13 +2551,13 @@ self: super: with self; {
 
   cysignals = callPackage ../development/python-modules/cysignals { };
 
-  cython = callPackage ../development/python-modules/Cython { };
+  cython = callPackage ../development/python-modules/cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.3";
+    version = "3.0.6";
     src = old.src.override {
       inherit version;
-      hash = "sha256-MnMJMBsB9ynxc6lFEcsigMh7oDyJ7UKOiPkT93gkUDA=";
+      hash = "sha256-OZ0YVnLGZ7Juq73KQgyYVkWDeYrzvEdnCooJ6fGd1mA=";
     };
     patches = [ ];
   });
@@ -2701,7 +2706,7 @@ self: super: with self; {
 
   dbus-next = callPackage ../development/python-modules/dbus-next { };
 
-  dbus-python = callPackage ../development/python-modules/dbus {
+  dbus-python = callPackage ../development/python-modules/dbus-python {
     inherit (pkgs) dbus;
   };
 
@@ -3530,7 +3535,7 @@ self: super: with self; {
 
   ecoaliface = callPackage ../development/python-modules/ecoaliface { };
 
-  ecos = callPackage ../development/python-modules/ecos { };
+  ecos = pkgs.disable-warnings-if-gcc13 (callPackage ../development/python-modules/ecos { });
 
   ecpy = callPackage ../development/python-modules/ecpy { };
 
@@ -3950,7 +3955,7 @@ self: super: with self; {
 
   fastrlock = callPackage ../development/python-modules/fastrlock { };
 
-  fasttext = callPackage ../development/python-modules/fasttext { };
+  fasttext = pkgs.disable-warnings-if-gcc13 (callPackage ../development/python-modules/fasttext { });
 
   fasttext-predict = callPackage ../development/python-modules/fasttext-predict { };
 
@@ -4639,9 +4644,9 @@ self: super: with self; {
 
   gmpy = callPackage ../development/python-modules/gmpy { };
 
-  gmsh = toPythonModule (callPackage ../applications/science/math/gmsh {
+  gmsh = pkgs.disable-warnings-if-gcc13 (toPythonModule (callPackage ../applications/science/math/gmsh {
     enablePython = true;
-  });
+  }));
 
   gntp = callPackage ../development/python-modules/gntp { };
 
@@ -4856,6 +4861,8 @@ self: super: with self; {
 
   gradio-client = callPackage ../development/python-modules/gradio/client.nix { };
 
+  gradio-pdf = callPackage ../development/python-modules/gradio-pdf { };
+
   grafanalib = callPackage ../development/python-modules/grafanalib/default.nix { };
 
   grammalecte = callPackage ../development/python-modules/grammalecte { };
@@ -5908,6 +5915,8 @@ self: super: with self; {
 
   jsonschema = callPackage ../development/python-modules/jsonschema { };
 
+  jsonschema-path = callPackage ../development/python-modules/jsonschema-path { };
+
   jsonschema-spec = callPackage ../development/python-modules/jsonschema-spec { };
 
   jsonschema-specifications = callPackage ../development/python-modules/jsonschema-specifications { };
@@ -6720,6 +6729,8 @@ self: super: with self; {
 
   rtmixer = callPackage ../development/python-modules/rtmixer { };
 
+  regress = callPackage ../development/python-modules/regress { };
+
   mail-parser = callPackage ../development/python-modules/mail-parser { };
 
   makefun = callPackage ../development/python-modules/makefun { };
@@ -7088,7 +7099,7 @@ self: super: with self; {
   mkdocs-macros = callPackage ../development/python-modules/mkdocs-macros { };
   mkdocs-material = callPackage ../development/python-modules/mkdocs-material { };
   mkdocs-material-extensions = callPackage ../development/python-modules/mkdocs-material/mkdocs-material-extensions.nix { };
-  mkdocs-minify = callPackage ../development/python-modules/mkdocs-minify { };
+  mkdocs-minify-plugin = callPackage ../development/python-modules/mkdocs-minify-plugin { };
   mkdocs-redirects = callPackage ../development/python-modules/mkdocs-redirects { };
   mkdocs-simple-hooks = callPackage ../development/python-modules/mkdocs-simple-hooks { };
   mkdocs-swagger-ui-tag = callPackage ../development/python-modules/mkdocs-swagger-ui-tag { };
@@ -8888,6 +8899,8 @@ self: super: with self; {
 
   pagelabels = callPackage ../development/python-modules/pagelabels { };
 
+  paginate = callPackage ../development/python-modules/paginate { };
+
   paho-mqtt = callPackage ../development/python-modules/paho-mqtt { };
 
   palace = callPackage ../development/python-modules/palace { };
@@ -9100,7 +9113,12 @@ self: super: with self; {
 
   pem = callPackage ../development/python-modules/pem { };
 
-  pendulum = callPackage ../development/python-modules/pendulum { };
+  pendulum = if pythonAtLeast "3.12" then
+    pendulum_3
+  else
+    callPackage ../development/python-modules/pendulum { };
+
+  pendulum_3 = callPackage ../development/python-modules/pendulum/3.nix { };
 
   pep440 = callPackage ../development/python-modules/pep440 { };
 
@@ -10060,7 +10078,7 @@ self: super: with self; {
 
   pybigwig = callPackage ../development/python-modules/pybigwig { };
 
-  pybind11 = callPackage ../development/python-modules/pybind11 { };
+  pybind11 = pkgs.disable-warnings-if-gcc13 (callPackage ../development/python-modules/pybind11 { });
 
   pybindgen = callPackage ../development/python-modules/pybindgen { };
 
@@ -10176,7 +10194,7 @@ self: super: with self; {
 
   pycron = callPackage ../development/python-modules/pycron { };
 
-  pycrypto = callPackage ../development/python-modules/pycrypto { };
+  pycrypto = pkgs.disable-warnings-if-gcc13 (callPackage ../development/python-modules/pycrypto { });
 
   pycryptodome = callPackage ../development/python-modules/pycryptodome { };
 
@@ -10218,6 +10236,8 @@ self: super: with self; {
 
   pydantic = callPackage ../development/python-modules/pydantic { };
 
+  pydantic_1 = callPackage ../development/python-modules/pydantic/1.nix { };
+
   pydantic-compat = callPackage ../development/python-modules/pydantic-compat { };
 
   pydantic-core = callPackage ../development/python-modules/pydantic-core { };
@@ -13142,6 +13162,8 @@ self: super: with self; {
 
   sigrok = callPackage ../development/python-modules/sigrok { };
 
+  sigstore = callPackage ../development/python-modules/sigstore { };
+
   sigstore-protobuf-specs = callPackage ../development/python-modules/sigstore-protobuf-specs { };
 
   sigstore-rekor-types = callPackage ../development/python-modules/sigstore-rekor-types { };
@@ -15445,6 +15467,8 @@ self: super: with self; {
 
   types-psutil = callPackage ../development/python-modules/types-psutil { };
 
+  types-psycopg2 = callPackage ../development/python-modules/types-psycopg2 { };
+
   types-pyopenssl = callPackage ../development/python-modules/types-pyopenssl { };
 
   types-python-dateutil = callPackage ../development/python-modules/types-python-dateutil { };
@@ -16125,6 +16149,7 @@ self: super: with self; {
     wxGTK = pkgs.wxGTK32.override {
       withWebKit = true;
     };
+    inherit (pkgs) mesa;
   };
 
   wyoming = callPackage ../development/python-modules/wyoming { };
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index 365f89dc990ff..decb953834388 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -100,6 +100,8 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   fcitx5-qt = callPackage ../tools/inputmethods/fcitx5/fcitx5-qt.nix { };
 
+  futuresql = callPackage ../development/libraries/futuresql { };
+
   qgpgme = callPackage ../development/libraries/gpgme { };
 
   grantlee = callPackage ../development/libraries/grantlee/5 { };
@@ -162,6 +164,8 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   libqtav = callPackage ../development/libraries/libqtav { };
 
+  libquotient = callPackage ../development/libraries/libquotient { };
+
   libqaccessibilityclient = callPackage ../development/libraries/libqaccessibilityclient { };
 
   mapbox-gl-native = libsForQt5.callPackage ../development/libraries/mapbox-gl-native { };
@@ -173,7 +177,7 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
   maui-core = libsForQt5.callPackage ../development/libraries/maui-core { };
 
   mlt = pkgs.mlt.override {
-    enableQt = true;
+    qt = qt5;
   };
 
   phonon = callPackage ../development/libraries/phonon { };
@@ -194,10 +198,11 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   pulseaudio-qt = callPackage ../development/libraries/pulseaudio-qt { };
 
-  qca-qt5 = callPackage ../development/libraries/qca-qt5 {
+  qca = callPackage ../development/libraries/qca {
     stdenv = if pkgs.stdenv.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
     inherit (libsForQt5) qtbase;
   };
+  qca-qt5 = self.qca;
 
   qcoro = callPackage ../development/libraries/qcoro { };
 
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index b9f3fdd35eeff..940a5e1545624 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -29,11 +29,31 @@ makeScopeWithSplicing' {
   inherit stdenv;
 
   # LIBRARIES
+  appstream-qt = callPackage ../development/libraries/appstream/qt.nix { };
+
+  kdsoap = callPackage ../development/libraries/kdsoap { };
+
+  futuresql = callPackage ../development/libraries/futuresql { };
+  kquickimageedit = callPackage ../development/libraries/kquickimageedit { };
+  libqaccessibilityclient = callPackage ../development/libraries/libqaccessibilityclient { };
+  libquotient = callPackage ../development/libraries/libquotient { };
+  mlt = pkgs.mlt.override {
+    qt = qt6;
+  };
+
+  qca = pkgs.darwin.apple_sdk_11_0.callPackage ../development/libraries/qca {
+    inherit (qt6) qtbase qt5compat;
+  };
+  qcoro = callPackage ../development/libraries/qcoro { };
+  qgpgme = callPackage ../development/libraries/gpgme { };
+  packagekit-qt = callPackage ../tools/package-management/packagekit/qt.nix { };
 
   qt6ct = callPackage ../tools/misc/qt6ct { };
 
   qt6gtk2 = callPackage ../tools/misc/qt6gtk2 { };
 
+  qtforkawesome = callPackage ../development/libraries/qtforkawesome { };
+
   qtkeychain = callPackage ../development/libraries/qtkeychain {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
@@ -44,6 +64,8 @@ makeScopeWithSplicing' {
     qt5Kvantum = pkgs.libsForQt5.qtstyleplugin-kvantum;
   };
 
+  qtutilities = callPackage ../development/libraries/qtutilities { };
+
   quazip = callPackage ../development/libraries/quazip { };
 
   qscintilla = callPackage ../development/libraries/qscintilla { };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 7d4d220e23a8b..7fdea87f3d60a 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -2520,10 +2520,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "004ip9x9281fxhpipwi8di1sb1dnabscq9dy1p3cxgdwbniqqi12";
+      sha256 = "NBOIGE6XXQkebjjOPzsziL+35Kw9eQ79jjkSSEQEC9E=";
       type = "gem";
     };
-    version = "1.15.5";
+    version = "1.16.0";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];