Merge master into staging-next

83 files changed, 772 insertions, 297 deletions

diff --git a/pkgs/applications/blockchains/lnd/default.nix b/pkgs/applications/blockchains/lnd/default.nix
index d4eef345eb777..a4271b9367951 100644
--- a/pkgs/applications/blockchains/lnd/default.nix
+++ b/pkgs/applications/blockchains/lnd/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.17.5-beta";
+  version = "0.18.0-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    hash = "sha256-q/mzF6LPW/ThgqfGgjtax8GvoC3JEpg0IetfSTo1XYk=";
+    hash = "sha256-LkVlsmL/NjWtKUnerqTiT/jNfxazYw0B0GhBDCTGmao=";
   };
 
-  vendorHash = "sha256-unT0zJrOEmKHpoUsrBHKfn5IziGlaqEtMfkeo/74Rfc=";
+  vendorHash = "sha256-T7jPuhAEeQ0U43J9gTQ+0/BdLAn4BOupAkmmmofhHtY=";
 
   subPackages = [ "cmd/lncli" "cmd/lnd" ];
 
diff --git a/pkgs/applications/blockchains/trezor-suite/default.nix b/pkgs/applications/blockchains/trezor-suite/default.nix
index a718d06c714ac..59fdaf825a6f5 100644
--- a/pkgs/applications/blockchains/trezor-suite/default.nix
+++ b/pkgs/applications/blockchains/trezor-suite/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "trezor-suite";
-  version = "24.5.2";
+  version = "24.5.3";
   name = "${pname}-${version}";
 
   suffix = {
@@ -20,7 +20,7 @@ let
     url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-${suffix}.AppImage";
     hash = { # curl -Lfs https://github.com/trezor/trezor-suite/releases/latest/download/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
       aarch64-linux = "sha512-U3Az5MtsHup+aNO6lVHeAXRAnNLUbQkL5qMTpYZTaLgiZEFQCUigBJXNPaiUiHA1rJAsFh6wpv20iRMcqRr9gA==";
-      x86_64-linux  = "sha512-9Gz0T9/GpTEzZDNk8tV7dg4QvQIB4IoEcOLIjrig6kmlaUoPwwoWFuJP0BH5WW2AhOZ+CEWBP6zFD7uw6VVDnA==";
+      x86_64-linux  = "sha512-JgcnCiq/ozrYDMH7zIns5c6x7TwtpJ6VVg6PUkcoDDgmr9ngIJmAdb+/v9mJUv98WNAPKmhCt0/H9DY2qWJ2Bg==";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/default.nix
index 608777208bb6b..9cfa97c4346d0 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/default.nix
@@ -2,22 +2,22 @@
 , melpaBuild
 , fetchFromGitHub
 , writeText
-, unstableGitUpdater
+, writeScript
 , gzip
 }:
 
 let
-  rev = "de68851724072c6695e675f090b33a8abec040c9";
+  rev = "13c9fa22155066acfb5a2e444fe76245738e7fb7";
 in
 melpaBuild {
   pname = "edraw";
-  version = "1.1.0";
+  version = "20240529.1009";
 
   src = fetchFromGitHub {
     owner = "misohena";
     repo = "el-easydraw";
     inherit rev;
-    hash = "sha256-l9i+HCRKnKiDqID+bfAOPE7LpVBZp1AOPkceX8KbDXM=";
+    hash = "sha256-h2auwVIWjrOBPHPCuLdJv5y3FpoV4V+MEOPf4xprfYg=";
   };
 
   commit = rev;
@@ -33,7 +33,19 @@ melpaBuild {
        "msg"))
   '';
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p common-updater-scripts coreutils git gnused
+    set -eu -o pipefail
+    tmpdir="$(mktemp -d)"
+    git clone --depth=1 https://github.com/misohena/el-easydraw.git "$tmpdir"
+    pushd "$tmpdir"
+    commit=$(git show -s --pretty='format:%H')
+    # Based on: https://github.com/melpa/melpa/blob/2d8716906a0c9e18d6c979d8450bf1d15dd785eb/package-build/package-build.el#L523-L533
+    version=$(TZ=UTC git show -s --pretty='format:%cd' --date='format-local:%Y%m%d.%H%M' | sed 's|\.0*|.|')
+    popd
+    update-source-version emacsPackages.el-easydraw $version --rev="$commit"
+  '';
 
   meta = {
     homepage = "https://github.com/misohena/el-easydraw";
diff --git a/pkgs/applications/emulators/86box/default.nix b/pkgs/applications/emulators/86box/default.nix
index 1e9b887d2d6a5..bcf47838aeeb2 100644
--- a/pkgs/applications/emulators/86box/default.nix
+++ b/pkgs/applications/emulators/86box/default.nix
@@ -88,6 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
       rev = "v${finalAttrs.version}";
       hash = "sha256-58nNTOLund/KeDlNwzwwihjFVigs/P0K8SN07zExE2c=";
     };
+    updateScript = ./update.sh;
   };
 
   # Some libraries are loaded dynamically, but QLibrary doesn't seem to search
diff --git a/pkgs/applications/emulators/86box/update.sh b/pkgs/applications/emulators/86box/update.sh
new file mode 100755
index 0000000000000..8af12478529f3
--- /dev/null
+++ b/pkgs/applications/emulators/86box/update.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq nix-prefetch-github common-updater-scripts
+
+set -euo pipefail
+
+latest_release=$(curl --silent https://api.github.com/repos/86Box/86Box/releases/latest)
+version=$(jq -r '.tag_name' <<<"$latest_release" | cut -c2-)
+main_hash=$(nix-prefetch-github --json --rev "v$version" 86Box 86Box | jq -r '.hash')
+roms_hash=$(nix-prefetch-github --json --rev "v$version" 86Box roms | jq -r '.hash')
+
+update-source-version _86Box "_$version" "$main_hash"
+update-source-version _86Box "$version" "$roms_hash" --source-key=roms
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index abede892b5ecf..bd6b5e4d080d0 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "9.9";
+    version = "9.10";
     url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
-    hash = "sha256-TWengSxKvUo96SMjjmD1qGsWrH+yD2KU4Nxu+ei+yjY=";
+    hash = "sha256-r8NLSRv6FMYsP99ifdK13Kxefp8/FFrbFDMleK+M8cA=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitLab rec {
     # https://gitlab.winehq.org/wine/wine-staging
     inherit (unstable) version;
-    hash = "sha256-JJrt2zTCjI8Zectoa5B0eZm2BLQm9u5cHbqVEHygwd0=";
+    hash = "sha256-ZqajfgPSKTcNBiDWEc9UgZWWmvkJvTA0S+j98Qz/y08=";
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "wine-staging";
diff --git a/pkgs/applications/misc/houdini/default.nix b/pkgs/applications/misc/houdini/default.nix
index 3810136cbf5f2..64536177aaff5 100644
--- a/pkgs/applications/misc/houdini/default.nix
+++ b/pkgs/applications/misc/houdini/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, writeScript, callPackage, buildFHSEnv, unwrapped ? callPackage ./runtime.nix {} }:
+{ lib, stdenv, writeScript, ncurses5, callPackage, buildFHSEnv, unwrapped ? callPackage ./runtime.nix {} }:
 
 buildFHSEnv rec {
   name = "houdini-${unwrapped.version}";
@@ -30,7 +30,6 @@ buildFHSEnv rec {
     bintools  # needed for ld and other tools, so ctypes can find/load sos from python
     ocl-icd  # needed for opencl
     numactl  # needed by hfs ocl backend
-    ncurses5  # needed by hfs ocl backend
     zstd  # needed from 20.0
   ] ++ (with xorg; [
     libICE
@@ -83,7 +82,7 @@ buildFHSEnv rec {
       mkdir -p $out/$(dirname $executable)
 
       echo "#!${stdenv.shell}" >> $out/$executable
-      echo "$WRAPPER ${unwrapped}/$executable \"\$@\"" >> $out/$executable
+      echo "exec $WRAPPER ${unwrapped}/$executable \"\$@\"" >> $out/$executable
     done
 
     cd $out
@@ -96,6 +95,9 @@ buildFHSEnv rec {
   ];
 
   runScript = writeScript "${name}-wrapper" ''
+    # ncurses5 is needed by hfs ocl backend
+    # workaround for this issue: https://github.com/NixOS/nixpkgs/issues/89769
+    export LD_LIBRARY_PATH=${lib.makeLibraryPath [ncurses5]}:$LD_LIBRARY_PATH
     exec "$@"
   '';
 }
diff --git a/pkgs/applications/misc/houdini/runtime.nix b/pkgs/applications/misc/houdini/runtime.nix
index d0d03d9787174..ef96a689b291a 100644
--- a/pkgs/applications/misc/houdini/runtime.nix
+++ b/pkgs/applications/misc/houdini/runtime.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, requireFile, callPackage}:
 
 callPackage ./runtime-build.nix rec {
-  version = "20.0.506";
+  version = "20.0.688";
   eulaDate = "2021-10-13";
   src = requireFile rec {
     name = "houdini-${version}-linux_x86_64_gcc11.2.tar.gz";
-    sha256 = "10dcb695bf9bb6407ccfd91c67858d69864208ee97e1e9afe216abf99db549f5";
+    sha256 = "99f9088824c328de9d351f037f26ff1cba960fbd9b4e2ed1d52601680d3512a6";
     url = "https://www.sidefx.com/download/daily-builds/?production=true";
   };
 }
diff --git a/pkgs/applications/networking/cluster/tanka/default.nix b/pkgs/applications/networking/cluster/tanka/default.nix
index 61f56f4252160..03b30a7209009 100644
--- a/pkgs/applications/networking/cluster/tanka/default.nix
+++ b/pkgs/applications/networking/cluster/tanka/default.nix
@@ -23,7 +23,30 @@ buildGoModule rec {
 
   postInstall = ''
     echo "complete -C $out/bin/tk tk" > tk.bash
-    installShellCompletion tk.bash
+
+    cat >tk.fish <<EOF
+
+    function __complete_tk
+        set -lx COMP_LINE (commandline -cp)
+        test -z (commandline -ct)
+        and set COMP_LINE "\$COMP_LINE "
+        $out/bin/tk
+    end
+    complete -f -c tk -a "(__complete_tk)"
+
+    EOF
+
+    cat >tk.zsh <<EOF
+    #compdef tk
+    autoload -U +X bashcompinit && bashcompinit
+    complete -o nospace -C $out/bin/tk tk
+    EOF
+
+    installShellCompletion \
+      --cmd tk \
+      --bash tk.bash \
+      --fish tk.fish \
+      --zsh tk.zsh
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index d2a33c129310b..a217c9e3763db 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -56,7 +56,6 @@ let
         license = licenses.bsl11;
         maintainers = with maintainers; [
           Chili-Man
-          babariviere
           kalbasit
           timstott
           zimbatm
diff --git a/pkgs/applications/science/biology/kent/default.nix b/pkgs/applications/science/biology/kent/default.nix
index b6e4661ccfd61..400e073f69057 100644
--- a/pkgs/applications/science/biology/kent/default.nix
+++ b/pkgs/applications/science/biology/kent/default.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "kent";
-  version = "446";
+  version = "465";
 
   src = fetchFromGitHub {
     owner = "ucscGenomeBrowser";
     repo = pname;
     rev = "v${version}_base";
-    hash = "sha256-d8gcoyMwINdHoD6xaNKt4rCKrKir99+i4KIzJ2YnxRw=";
+    hash = "sha256-QeHqXSbad5LCmQ8DfLxl2pyXJvKV4G7uLXBtRd7LME0=";
   };
 
   buildInputs = [ libpng libuuid zlib bzip2 xz openssl curl libmysqlclient ];
diff --git a/pkgs/applications/science/logic/prooftree/default.nix b/pkgs/applications/science/logic/prooftree/default.nix
index d0d95818ff93b..ce8badf8f6536 100644
--- a/pkgs/applications/science/logic/prooftree/default.nix
+++ b/pkgs/applications/science/logic/prooftree/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "prooftree";
-  version = "0.13";
+  version = "0.14";
 
   src = fetchurl {
     url = "https://askra.de/software/prooftree/releases/prooftree-${version}.tar.gz";
-    sha256 = "0z1z4wqbqwgppkh2bm89fgy07a0y2m6g4lvcyzs09sm1ysklk2dh";
+    sha256 = "sha256-nekV2UnjibOk4h0jZ1jV7W5pE/hXWb3fUoLTJb3Jzc0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index 708ffd8ecbbe9..ea09667c06485 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -31,20 +31,20 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.35.0";
+  version = "0.35.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "refs/tags/v${version}";
-    hash = "sha256-d/pPoa+bY7FAjFcd+32aXKDevJRoCGA209uLZ/4WRpQ=";
+    hash = "sha256-Hp8phZIVvg1oH6ajSmpcQ0uDXRzMQjVBIRYqpgro/24=";
   };
 
   goModules = (buildGo122Module {
     pname = "kitty-go-modules";
     inherit src version;
-    vendorHash = "sha256-rEG3mmghvEih2swm+2gp/G9EC2YdyjaOnvq+tALC3jo=";
+    vendorHash = "sha256-mpyotGzv8UU9pg/3UNZBx0Rkm5kzMzIlDSHuhtNALfw=";
   }).goModules;
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/git/update.sh b/pkgs/applications/version-management/git/update.sh
index 54574722b02b7..1f70dcff42940 100755
--- a/pkgs/applications/version-management/git/update.sh
+++ b/pkgs/applications/version-management/git/update.sh
@@ -10,7 +10,7 @@ targetVersion="${1:-$latestTag}"
 if [ ! "${oldVersion}" = "${targetVersion}" ]; then
   update-source-version git "${targetVersion}"
   nixpkgs="$(git rev-parse --show-toplevel)"
-  default_nix="$nixpkgs/pkgs/applications/version-management/git-and-tools/git/default.nix"
+  default_nix="$nixpkgs/pkgs/applications/version-management/git/default.nix"
   nix-build -A git
   git add "${default_nix}"
   git commit -m "git: ${oldVersion} -> ${targetVersion}"
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 99ce94c4976db..a5919f709971c 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -35,6 +35,6 @@ buildGoModule rec {
     mainProgram = "docker-compose";
     homepage = "https://github.com/docker/compose";
     license = licenses.asl20;
-    maintainers = with maintainers; [ babariviere ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/virtualization/podman-tui/default.nix b/pkgs/applications/virtualization/podman-tui/default.nix
index b1ff999cd89c2..0d7947a3f2511 100644
--- a/pkgs/applications/virtualization/podman-tui/default.nix
+++ b/pkgs/applications/virtualization/podman-tui/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-t1vrUXv0ZP+vmOcUIue/yvB34DP+gduopuN0U9oixBQ=";
+    hash = "sha256-my/y2cgF7F0wk5VJKfmqotBrV3HPmRQGPjlSdMe7wXk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix
index da7c8accf873a..f27f58fda4876 100644
--- a/pkgs/applications/virtualization/singularity/generic.nix
+++ b/pkgs/applications/virtualization/singularity/generic.nix
@@ -44,6 +44,7 @@ in
   gpgme,
   libseccomp,
   libuuid,
+  mount,
   # This is for nvidia-container-cli
   nvidia-docker,
   openssl,
@@ -79,6 +80,20 @@ in
   externalLocalStateDir ? null,
   # Remove the symlinks to `singularity*` when projectName != "singularity"
   removeCompat ? false,
+  # The defaultPath values to substitute in each source files.
+  #
+  # `defaultPath` are PATH variables hard-coded inside Apptainer/Singularity
+  # binaries to search for third-party utilities, as a hardening for
+  # `$out/bin/starter-suid`.
+  #
+  # The upstream provided values are suitable for FHS-conformant environment.
+  # We substitute them and insert Nixpkgs-specific values.
+  #
+  # Example:
+  # {
+  #   "path/to/source/file1" = [ "<originalDefaultPath11>" "<originalDefaultPath12>" ... ];
+  # }
+  sourceFilesWithDefaultPaths ? { },
   # Workaround #86349
   # should be removed when the issue is resolved
   vendorHash ? _defaultGoVendorArgs.vendorHash,
@@ -87,7 +102,6 @@ in
 }:
 
 let
-  defaultPathOriginal = "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin";
   privileged-un-utils =
     if ((newuidmapPath == null) && (newgidmapPath == null)) then
       null
@@ -97,6 +111,12 @@ let
         ln -s ${lib.escapeShellArg newuidmapPath} "$out/bin/newuidmap"
         ln -s ${lib.escapeShellArg newgidmapPath} "$out/bin/newgidmap"
       '');
+
+  concatMapStringAttrsSep =
+    sep: f: attrs:
+    lib.concatMapStringsSep sep (name: f name attrs.${name}) (lib.attrNames attrs);
+
+  addShellDoubleQuotes = s: lib.escapeShellArg ''"'' + s + lib.escapeShellArg ''"'';
 in
 (buildGoModule {
   inherit pname version src;
@@ -185,6 +205,7 @@ in
     fakeroot
     fuse2fs # Mount ext3 filesystems
     go
+    mount # mount
     privileged-un-utils
     squashfsTools # mksquashfs unsquashfs # Make / unpack squashfs image
     squashfuse # squashfuse_ll squashfuse # Mount (without unpacking) a squashfs image without privileges
@@ -199,8 +220,19 @@ in
     patchShebangs --build "$configureScript" makeit e2e scripts mlocal/scripts
 
     # Patching the hard-coded defaultPath by prefixing the packages in defaultPathInputs
-    substituteInPlace cmd/internal/cli/actions.go \
-      --replace "defaultPath = \"${defaultPathOriginal}\"" "defaultPath = \"''${defaultPathInputs// /\/bin:}''${defaultPathInputs:+/bin:}${defaultPathOriginal}\""
+    ${concatMapStringAttrsSep "\n" (fileName: originalDefaultPaths: ''
+      substituteInPlace ${lib.escapeShellArg fileName} \
+        ${
+          lib.concatMapStringsSep " \\\n  " (
+            originalDefaultPath:
+            lib.concatStringsSep " " [
+              "--replace-fail"
+              (addShellDoubleQuotes (lib.escapeShellArg originalDefaultPath))
+              (addShellDoubleQuotes ''$inputsDefaultPath''${inputsDefaultPath:+:}${lib.escapeShellArg originalDefaultPath}'')
+            ]
+          ) originalDefaultPaths
+        }
+    '') sourceFilesWithDefaultPaths}
 
     substituteInPlace internal/pkg/util/gpu/nvidia.go \
       --replace \
@@ -236,7 +268,7 @@ in
     substituteInPlace "$out/bin/run-singularity" \
       --replace "/usr/bin/env ${projectName}" "$out/bin/${projectName}"
     wrapProgram "$out/bin/${projectName}" \
-      --prefix PATH : "''${defaultPathInputs// /\/bin:}''${defaultPathInputs:+/bin:}"
+      --prefix PATH : "$inputsDefaultPath"
     # Make changes in the config file
     ${lib.optionalString forceNvcCli ''
       substituteInPlace "$out/etc/${projectName}/${projectName}.conf" \
@@ -294,7 +326,9 @@ in
 }).overrideAttrs
   (
     finalAttrs: prevAttrs: {
+      inputsDefaultPath = lib.makeBinPath finalAttrs.defaultPathInputs;
       passthru = prevAttrs.passthru or { } // {
+        inherit sourceFilesWithDefaultPaths;
         tests = {
           image-hello-cowsay = singularity-tools.buildImage {
             name = "hello-cowsay";
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index eca8c914e6aae..f03bdf9631c56 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -35,6 +35,12 @@ let
         # when building on a system with disabled unprivileged namespace.
         # See https://github.com/NixOS/nixpkgs/pull/215690#issuecomment-1426954601
         defaultToSuid = null;
+
+        sourceFilesWithDefaultPaths = {
+          "cmd/internal/cli/actions.go" = [ "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin" ];
+          "e2e/env/env.go" = [ "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ];
+          "internal/pkg/util/env/env.go" = [ "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ];
+        };
       };
 
   singularity =
@@ -71,6 +77,14 @@ let
         # on UNIX-like platforms,
         # and only have --without-suid but not --with-suid.
         defaultToSuid = true;
+
+        sourceFilesWithDefaultPaths = {
+          "cmd/internal/cli/actions.go" = [ "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin" ];
+          "e2e/env/env.go" = [ "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ];
+          "internal/pkg/util/env/clean.go" = [
+            "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+          ];
+        };
       };
 
   genOverridenNixos =
diff --git a/pkgs/build-support/singularity-tools/default.nix b/pkgs/build-support/singularity-tools/default.nix
index c9e53a4cb706f..cd10a9960421b 100644
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@@ -45,7 +45,7 @@ rec {
     , diskSize ? 1024
     , runScript ? "#!${stdenv.shell}\nexec /bin/sh"
     , runAsRoot ? null
-    , memSize ? 512
+    , memSize ? 1024
     , singularity ? defaultSingularity
     }:
     let
diff --git a/pkgs/by-name/ev/everforest-gtk-theme/package.nix b/pkgs/by-name/ev/everforest-gtk-theme/package.nix
new file mode 100644
index 0000000000000..943c743f894d8
--- /dev/null
+++ b/pkgs/by-name/ev/everforest-gtk-theme/package.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gnome-themes-extra
+, gtk-engine-murrine
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "everforest-gtk-theme";
+  version = "0-unstable-2023-03-20";
+
+  src = fetchFromGitHub {
+    owner = "Fausto-Korpsvart";
+    repo = "Everforest-GTK-Theme";
+    rev = "8481714cf9ed5148694f1916ceba8fe21e14937b";
+    sha256 = "sha256-NO12ku8wnW/qMHKxi5TL/dqBxH0+cZbe+fU0iicb9JU=";
+  };
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  buildInputs = [
+    gnome-themes-extra
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/share/"{themes,icons}
+    cp -a icons/* "$out/share/icons/"
+    cp -a themes/* "$out/share/themes/"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Everforest colour palette for GTK";
+    homepage = "https://github.com/Fausto-Korpsvart/Everforest-GTK-Theme";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ jn-sena ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/fc/fcitx5-catppuccin/package.nix b/pkgs/by-name/fc/fcitx5-catppuccin/package.nix
new file mode 100644
index 0000000000000..954471d716625
--- /dev/null
+++ b/pkgs/by-name/fc/fcitx5-catppuccin/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  unstableGitUpdater,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "fcitx5-catppuccin";
+  version = "0-unstable-2022-10-05";
+
+  src = fetchFromGitHub {
+    owner = "catppuccin";
+    repo = "fcitx5";
+    rev = "ce244cfdf43a648d984719fdfd1d60aab09f5c97";
+    hash = "sha256-uFaCbyrEjv4oiKUzLVFzw+UY54/h7wh2cntqeyYwGps=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fcitx5/themes
+    cp -r src/catppuccin-* $out/share/fcitx5/themes
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Soothing pastel theme for Fcitx5";
+    homepage = "https://github.com/catppuccin/fcitx5";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Guanran928 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/fc/fcitx5-tokyonight/package.nix b/pkgs/by-name/fc/fcitx5-tokyonight/package.nix
new file mode 100644
index 0000000000000..6771c664fdbea
--- /dev/null
+++ b/pkgs/by-name/fc/fcitx5-tokyonight/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  unstableGitUpdater,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "fcitx5-tokyonight";
+  version = "0-unstable-2024-01-28";
+
+  src = fetchFromGitHub {
+    owner = "ch3n9w";
+    repo = "fcitx5-Tokyonight";
+    rev = "f7454ab387d6b071ee12ff7ee819f0c7030fdf2c";
+    hash = "sha256-swOy0kDZUdqtC2sPSZEBLnHSs8dpQ/QfFMObI6BARfo=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 Tokyonight-Day/{arrow.png,panel.png,radio.png} -t $out/share/fcitx5-tokyonight/
+    for _variant in Tokyonight-Day Tokyonight-Storm; do
+      mkdir -p $out/share/fcitx5/themes/$_variant/
+      ln -s $out/share/fcitx5-tokyonight/arrow.png $out/share/fcitx5/themes/$_variant/arrow.png
+      ln -s $out/share/fcitx5-tokyonight/radio.png $out/share/fcitx5/themes/$_variant/radio.png
+      install -Dm644 $_variant/theme.conf $out/share/fcitx5/themes/$_variant/theme.conf
+    done
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Fcitx5 theme based on Tokyo Night color";
+    homepage = "https://github.com/ch3n9w/fcitx5-Tokyonight";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ Guanran928 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/ha/hare/003-use-mailcap-for-mimetypes.patch b/pkgs/by-name/ha/hare/003-use-mailcap-for-mimetypes.patch
new file mode 100644
index 0000000000000..fad17d12cb9e3
--- /dev/null
+++ b/pkgs/by-name/ha/hare/003-use-mailcap-for-mimetypes.patch
@@ -0,0 +1,13 @@
+diff --git a/mime/system.ha b/mime/system.ha
+index 73ff3496..42e7b640 100644
+--- a/mime/system.ha
++++ b/mime/system.ha
+@@ -11,7 +11,7 @@ use strings;
+ use types;
+ 
+ // Path to the system MIME database.
+-export def SYSTEM_DB: str = "/etc/mime.types";
++export def SYSTEM_DB: str = "@mailcap@/etc/mime.types";
+ 
+ @init fn init() void = {
+ 	// Done in a separate function so we can discard errors here
diff --git a/pkgs/by-name/ha/hare/mime-module-test.nix b/pkgs/by-name/ha/hare/mime-module-test.nix
new file mode 100644
index 0000000000000..073ae09e35570
--- /dev/null
+++ b/pkgs/by-name/ha/hare/mime-module-test.nix
@@ -0,0 +1,28 @@
+{
+  hare,
+  runCommandNoCC,
+  writeText,
+}:
+let
+  mainDotHare = writeText "main.ha" ''
+    use fmt;
+    use mime;
+    export fn main() void = {
+        const ext = "json";
+        match(mime::lookup_ext(ext)) {
+        case let mime: const *mime::mimetype =>
+          fmt::printfln("Found mimetype for extension `{}`: {}", ext, mime.mime)!;
+        case null =>
+          fmt::fatalf("Could not find mimetype for `{}`", ext);
+        };
+      };
+  '';
+in
+runCommandNoCC "mime-module-test" { nativeBuildInputs = [ hare ]; } ''
+  HARECACHE="$(mktemp -d)"
+  export HARECACHE
+  readonly binout="test-bin"
+  hare build -qRo "$binout" ${mainDotHare}
+  ./$binout
+  : 1>$out
+''
diff --git a/pkgs/by-name/ha/hare/package.nix b/pkgs/by-name/ha/hare/package.nix
index 3cf37e33109b1..5c8a80520937e 100644
--- a/pkgs/by-name/ha/hare/package.nix
+++ b/pkgs/by-name/ha/hare/package.nix
@@ -7,6 +7,7 @@
   gitUpdater,
   scdoc,
   tzdata,
+  mailcap,
   substituteAll,
   fetchpatch,
   callPackage,
@@ -116,6 +117,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.sr.ht/~sircmpwn/hare/commit/e35f2284774436f422e06f0e8d290b173ced1677.patch";
       hash = "sha256-A59bGO/9tOghV8/MomTxd8xRExkHVdoMom2d+HTfQGg=";
     })
+    # Use mailcap `/etc/mime.types` for Hare's mime module
+    (substituteAll {
+      src = ./003-use-mailcap-for-mimetypes.patch;
+      inherit mailcap;
+    })
   ];
 
   nativeBuildInputs = [
@@ -169,9 +175,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = gitUpdater { };
-    tests = lib.optionalAttrs enableCrossCompilation {
-      crossCompilation = callPackage ./cross-compilation-tests.nix { hare = finalAttrs.finalPackage; };
-    };
+    tests =
+      lib.optionalAttrs enableCrossCompilation {
+        crossCompilation = callPackage ./cross-compilation-tests.nix { hare = finalAttrs.finalPackage; };
+      }
+      // lib.optionalAttrs (stdenv.buildPlatform.canExecute stdenv.hostPlatform) {
+        mimeModule = callPackage ./mime-module-test.nix { hare = finalAttrs.finalPackage; };
+      };
   };
 
   meta = {
diff --git a/pkgs/by-name/ke/keepass/package.nix b/pkgs/by-name/ke/keepass/package.nix
index 9b17ca09af8fa..06c83d2ebfa5c 100644
--- a/pkgs/by-name/ke/keepass/package.nix
+++ b/pkgs/by-name/ke/keepass/package.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "keepass";
-  version = "2.56";
+  version = "2.57";
 
   src = fetchurl {
     url = "mirror://sourceforge/keepass/KeePass-${finalAttrs.version}-Source.zip";
-    hash = "sha256-e6+z3M36LiS0/UonJOvD3q6+Ic31uMixL8DoML0UhEQ=";
+    hash = "sha256-emJ4QhhIaUowG4SAUzRK6hUendc/H6JH09Js2Ji9PQ0=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/li/libmediainfo/package.nix b/pkgs/by-name/li/libmediainfo/package.nix
index d1a6986274832..931c24ad28d4f 100644
--- a/pkgs/by-name/li/libmediainfo/package.nix
+++ b/pkgs/by-name/li/libmediainfo/package.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmediainfo";
-  version = "24.04";
+  version = "24.05";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    hash = "sha256-dqb/BgiHdz8ll3tYiuUISEuxLRHLeivjMi2qnG5T8bI=";
+    hash = "sha256-sU95EEsdDXjen7QoBfKdVP3wHD5Ckcw2OOBNCdFFuNY=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/by-name/oi/oil/package.nix b/pkgs/by-name/oi/oil/package.nix
index c6ba73d1ef8ee..f195b19cfeddc 100644
--- a/pkgs/by-name/oi/oil/package.nix
+++ b/pkgs/by-name/oi/oil/package.nix
@@ -7,11 +7,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "oil";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchurl {
     url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
-    hash = "sha256-eoImAByJFtAEaPYn02XerR/0+dXO8IdhnTEDCMKmlJI=";
+    hash = "sha256-RS5/1Ci2hqp1LP65viuU+fz3upqyLgrlcKh83PeCJC4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pu/puppet-bolt/package.nix b/pkgs/by-name/pu/puppet-bolt/package.nix
index 7340ed9eb751e..a937752698559 100644
--- a/pkgs/by-name/pu/puppet-bolt/package.nix
+++ b/pkgs/by-name/pu/puppet-bolt/package.nix
@@ -1,5 +1,6 @@
 {
   bundlerApp,
+  defaultGemConfig,
   bundlerUpdateScript,
   lib,
   makeWrapper,
@@ -14,10 +15,12 @@
   exes = [ "bolt" ];
   nativeBuildInputs = [ makeWrapper ];
 
-  gemConfig.bolt = attrs: {
-    # scripts in libexec will be executed by remote host,
-    # so shebangs should remain unchanged
-    dontPatchShebangs = true;
+  gemConfig = defaultGemConfig // {
+    bolt = attrs: {
+      # scripts in libexec will be executed by remote host,
+      # so shebangs should remain unchanged
+      dontPatchShebangs = true;
+    };
   };
 
   postBuild = ''
diff --git a/pkgs/by-name/se/setup-envtest/package.nix b/pkgs/by-name/se/setup-envtest/package.nix
new file mode 100644
index 0000000000000..2fe80013d8efb
--- /dev/null
+++ b/pkgs/by-name/se/setup-envtest/package.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "setup-envtest";
+  version = "0.18.2";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes-sigs";
+    repo = "controller-runtime";
+    rev = "v${version}";
+    hash = "sha256-fQgWwndxzBIi3zsNMYvFDXjetnaQF0NNK+qW8j4Wn/M=";
+  } + "/tools/setup-envtest";
+
+  vendorHash = "sha256-Xr5b/CRz/DMmoc4bvrEyAZcNufLIZOY5OGQ6yw4/W9k=";
+
+  ldflags = [ "-s" "-w" ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = with lib; {
+    description = "Tool that manages binaries for envtest, allowing the download of new binaries, listing installed and available ones, and cleaning up versions";
+    homepage = "https://github.com/kubernetes-sigs/controller-runtime/tree/v${version}/tools/setup-envtest";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ arikgrahl ];
+    mainProgram = "setup-envtest";
+  };
+}
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index 2f749251cd142..eae7ef925d5ce 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -137,7 +137,6 @@ buildNpmPackage rec {
     platforms = platforms.all;
     maintainers = with maintainers; [
       ttuegel
-      babariviere
       rileyinman
       AluisioASG
       lunik1
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index aa73a62fab149..3eabf71a8912e 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -142,7 +142,7 @@ let
         license = licenses.bsd3;
         platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
         maintainers = teams.flutter.members ++ (with maintainers; [
-          babariviere ericdallo
+          ericdallo
         ]);
       };
     };
diff --git a/pkgs/development/cuda-modules/aliases.nix b/pkgs/development/cuda-modules/aliases.nix
index 36dd07d773bd9..7f28f2c76d471 100644
--- a/pkgs/development/cuda-modules/aliases.nix
+++ b/pkgs/development/cuda-modules/aliases.nix
@@ -13,6 +13,6 @@ in
     mkRenamed "autoAddDriverRunpath" "pkgs.autoAddDriverRunpath"
       final.pkgs.autoAddDriverRunpath; # Added 2024-03-30
   autoAddOpenGLRunpathHook =
-    mkRenamed "autoAddOpenGLRunpathHook" "pkgs.autoAddDriverRunpath"
+    mkRenamed "autoAddOpenGLRunpathHook" "pkgs.autoAddDriverRunpathHook"
       final.pkgs.autoAddDriverRunpath; # Added 2024-03-30
 }
diff --git a/pkgs/development/cuda-modules/cuda/extension.nix b/pkgs/development/cuda-modules/cuda/extension.nix
index 5b87a3df0959a..f39171e888741 100644
--- a/pkgs/development/cuda-modules/cuda/extension.nix
+++ b/pkgs/development/cuda-modules/cuda/extension.nix
@@ -53,6 +53,10 @@ let
       redistribRelease = redistribManifest.${pname};
       featureRelease = featureManifest.${pname};
       drv =
+        let
+          # get `autoAddDriverRunpath` from pkgs instead of cudaPackages' alias to avoid warning
+          inherit (callPackage ({ pkgs }: pkgs) { }) autoAddDriverRunpath;
+        in
         (callPackage ../generic-builders/manifest.nix {
           # We pass the whole release to the builder because it has logic to handle
           # the case we're trying to build on an unsupported platform.
@@ -61,6 +65,7 @@ let
             redistName
             redistribRelease
             featureRelease
+            autoAddDriverRunpath
             ;
         }).overrideAttrs
           (prevAttrs: {
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index 4ee5baa38bed0..cedc8edce3952 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "12.8.3";
+  version = "12.8.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-KSJYn2OHeWUEs0Daa7lUvvPYdXTCmFFYkyie3S2JAVE=";
+    hash = "sha256-VY/lJrmQoWY2eO/zr27JP3nuEoyBpMiu8nrTKPrmETg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/boost-process/default.nix b/pkgs/development/libraries/boost-process/default.nix
deleted file mode 100644
index 551c1247949ea..0000000000000
--- a/pkgs/development/libraries/boost-process/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ lib, stdenv, fetchurl, unzip }:
-
-stdenv.mkDerivation rec {
-  pname = "boost-process";
-  version = "0.5";
-
-  src = fetchurl {
-    url = "http://www.highscore.de/boost/process${version}/process.zip";
-    sha256 = "1v9y9pffb2b7p642kp9ic4z6kg42ziizmyvbgrqd1ci0i4gn0831";
-  };
-
-  nativeBuildInputs = [ unzip ];
-
-  unpackPhase = ''
-    mkdir boost-process-$version
-    cd boost-process-$version
-    unzip $src
-  '';
-
-  installPhase = ''
-    mkdir -p $out/include
-    cp -r boost $out/include
-  '';
-
-  meta = with lib; {
-    homepage = "http://www.highscore.de/boost/process0.5/";
-    description = "Library to manage system processes";
-    license = licenses.boost;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ abbradar ];
-  };
-}
diff --git a/pkgs/development/libraries/libnbd/default.nix b/pkgs/development/libraries/libnbd/default.nix
index 7a2e358d572be..c7e9e2b087e34 100644
--- a/pkgs/development/libraries/libnbd/default.nix
+++ b/pkgs/development/libraries/libnbd/default.nix
@@ -4,6 +4,7 @@
 , bash-completion
 , pkg-config
 , perl
+, buildPythonBindings ? false, python3
 , libxml2
 , fuse
 , fuse3
@@ -23,7 +24,8 @@ stdenv.mkDerivation rec {
     bash-completion
     pkg-config
     perl
-  ];
+  ]
+    ++ lib.optionals buildPythonBindings [ python3 ];
 
   buildInputs = [
     fuse
@@ -32,8 +34,16 @@ stdenv.mkDerivation rec {
     libxml2
   ];
 
+  configureFlags = lib.optionals buildPythonBindings [ "--with-python-installdir=${placeholder "out"}/${python3.sitePackages}" ];
+
   installFlags = [ "bashcompdir=$(out)/share/bash-completion/completions" ];
 
+  postInstall = lib.optionalString buildPythonBindings ''
+    LIBNBD_PYTHON_METADATA='${placeholder "out"}/${python3.sitePackages}/nbd-${version}.dist-info/METADATA'
+    install -Dm644 -T ${./libnbd-metadata} $LIBNBD_PYTHON_METADATA
+    substituteAllInPlace $LIBNBD_PYTHON_METADATA
+  '';
+
   meta = with lib; {
     homepage = "https://gitlab.com/nbdkit/libnbd";
     description = "Network Block Device client library in userspace";
@@ -59,5 +69,4 @@ stdenv.mkDerivation rec {
 }
 # TODO: package the 1.6-stable version too
 # TODO: git version needs ocaml
-# TODO: bindings for go, ocaml and python
-
+# TODO: bindings for go and ocaml
diff --git a/pkgs/development/libraries/libnbd/libnbd-metadata b/pkgs/development/libraries/libnbd/libnbd-metadata
new file mode 100644
index 0000000000000..7d91ab88d2015
--- /dev/null
+++ b/pkgs/development/libraries/libnbd/libnbd-metadata
@@ -0,0 +1,3 @@
+Metadata-Version: 2.1
+Name: nbd
+Version: @version@
diff --git a/pkgs/development/libraries/science/astronomy/indilib/default.nix b/pkgs/development/libraries/science/astronomy/indilib/default.nix
index 50ba7e8273fa8..0fd659b0e1b74 100644
--- a/pkgs/development/libraries/science/astronomy/indilib/default.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "indilib";
-  version = "2.0.7";
+  version = "2.0.8";
 
   src = fetchFromGitHub {
     owner = "indilib";
     repo = "indi";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sbs20BbAnvHTtJEuTWMCJrjzyvH7NSXS1+Ah5BdJZHA=";
+    hash = "sha256-qdPQMC8HCMdcbHyO8B0OFiefO+jM1ytA2dYNymE0Xuc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/cmdliner/1_1.nix b/pkgs/development/ocaml-modules/cmdliner/1_1.nix
index 735496aa459ce..4388886d4da0c 100644
--- a/pkgs/development/ocaml-modules/cmdliner/1_1.nix
+++ b/pkgs/development/ocaml-modules/cmdliner/1_1.nix
@@ -5,11 +5,11 @@ lib.throwIfNot (lib.versionAtLeast ocaml.version "4.08")
 
 stdenv.mkDerivation rec {
   pname = "cmdliner";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "https://erratique.ch/software/${pname}/releases/${pname}-${version}.tbz";
-    sha256 = "sha256-r+0QWJAoOU/W9k6XscYX4r5w3m017kfgQjXaMandAHg=";
+    sha256 = "sha256-joGA9XO0QPanqMII2rLK5KgjhP7HMtInhNG7bmQWjLs=";
   };
 
   nativeBuildInputs = [ ocaml ];
diff --git a/pkgs/development/python-modules/certomancer/default.nix b/pkgs/development/python-modules/certomancer/default.nix
index 70735255db773..eb21bdeeee04e 100644
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -1,57 +1,57 @@
 {
   lib,
-  asn1crypto,
   buildPythonPackage,
+  pythonOlder,
+  pythonAtLeast,
+  fetchFromGitHub,
+  # build-system
+  setuptools,
+  wheel,
+  # dependencies
+  asn1crypto,
   click,
   cryptography,
-  fetchFromGitHub,
-  freezegun,
+  python-dateutil,
+  pyyaml,
+  tzlocal,
+  # optional-dependencies
+  requests-mock,
   jinja2,
-  oscrypto,
+  werkzeug,
+  python-pkcs11,
+  # nativeCheckInputs
+  freezegun,
   pyhanko-certvalidator,
   pytest-aiohttp,
   pytestCheckHook,
-  python-dateutil,
-  python-pkcs11,
-  pythonOlder,
   pytz,
-  pyyaml,
   requests,
-  requests-mock,
-  setuptools,
-  tzlocal,
-  werkzeug,
-  wheel,
 }:
 
 buildPythonPackage rec {
   pname = "certomancer";
-  version = "0.11.0";
-  format = "pyproject";
+  version = "0.12.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  # https://github.com/MatthiasValvekens/certomancer/issues/12
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "certomancer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UQV0Tk4C5b5iBZ34Je59gK2dLTaJusnpxdyNicIh2Q8=";
+    hash = "sha256-c2Fq4YTHQvhxuZrpKQYZvqHIMfubbkeKV4rctELLeJU=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace ' "pytest-runner",' "" \
-  '';
-
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     wheel
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     asn1crypto
     click
-    oscrypto
+    cryptography
     python-dateutil
     pyyaml
     tzlocal
@@ -63,7 +63,6 @@ buildPythonPackage rec {
       jinja2
       werkzeug
     ];
-    pkcs12 = [ cryptography ];
     pkcs11 = [ python-pkcs11 ];
   };
 
@@ -83,11 +82,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "certomancer" ];
 
-  meta = with lib; {
+  meta = {
     description = "Quickly construct, mock & deploy PKI test configurations using simple declarative configuration";
     mainProgram = "certomancer";
     homepage = "https://github.com/MatthiasValvekens/certomancer";
-    license = licenses.mit;
-    maintainers = with maintainers; [ wolfangaukang ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ wolfangaukang ];
   };
 }
diff --git a/pkgs/development/python-modules/django-celery-results/default.nix b/pkgs/development/python-modules/django-celery-results/default.nix
index b1c69ae1080c1..92d2bf2355603 100644
--- a/pkgs/development/python-modules/django-celery-results/default.nix
+++ b/pkgs/development/python-modules/django-celery-results/default.nix
@@ -38,6 +38,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/celery/django-celery-results";
     changelog = "https://github.com/celery/django-celery-results/blob/v{version}/Changelog";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ babariviere ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index 89e0fdbe39232..4882b45aa4c90 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -1,55 +1,64 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pytest,
-  pytest-cov,
-  pytest-xdist,
-  six,
-  numpy,
-  scipy,
-  pyyaml,
+  pythonOlder,
+  fetchFromGitHub,
+  setuptools,
+  absl-py,
+  dm-tree,
   h5py,
+  markdown-it-py,
+  ml-dtypes,
+  namex,
+  numpy,
   optree,
-  keras-applications,
-  keras-preprocessing,
+  rich,
+  tensorflow,
 }:
 
 buildPythonPackage rec {
   pname = "keras";
-  version = "3.2.1";
-  format = "wheel";
-
-  src = fetchPypi {
-    inherit format pname version;
-    hash = "sha256-C+HomwQeaXvlYthCLsuVjuVIGs/AiZEyAJJsVh0ligM=";
-    python = "py3";
-    dist = "py3";
+  version = "3.3.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "keras-team";
+    repo = "keras";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-hhY28Ocv4zacZiwFflJtufKpeKfH1MD1PZJ+NTJfpH0=";
   };
 
-  nativeCheckInputs = [
-    pytest
-    pytest-cov
-    pytest-xdist
+  build-system = [
+    setuptools
   ];
 
-  propagatedBuildInputs = [
-    six
-    pyyaml
-    numpy
-    scipy
+  dependencies = [
+    absl-py
+    dm-tree
     h5py
-    keras-applications
-    keras-preprocessing
+    markdown-it-py
+    ml-dtypes
+    namex
+    numpy
+    optree
+    rich
+    tensorflow
+  ];
+
+  pythonImportsCheck = [
+    "keras"
+    "keras._tf_keras"
   ];
 
   # Couldn't get tests working
   doCheck = false;
 
-  meta = with lib; {
-    description = "Deep Learning library for Theano and TensorFlow";
+  meta = {
+    description = "Multi-backend implementation of the Keras API, with support for TensorFlow, JAX, and PyTorch";
     homepage = "https://keras.io";
-    license = licenses.mit;
-    maintainers = with maintainers; [ NikolaMandic ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ NikolaMandic ];
   };
 }
diff --git a/pkgs/development/python-modules/mhcflurry/default.nix b/pkgs/development/python-modules/mhcflurry/default.nix
index efc431db552e2..68b4624125a40 100644
--- a/pkgs/development/python-modules/mhcflurry/default.nix
+++ b/pkgs/development/python-modules/mhcflurry/default.nix
@@ -16,18 +16,18 @@
 
 buildPythonPackage rec {
   pname = "mhcflurry";
-  version = "2.1.0";
-  format = "setuptools";
+  version = "2.1.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openvax";
-    repo = pname;
+    repo = "mhcflurry";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VyPHcNlZYgNJZb2UBFX55x+nE0GnHixkcsiTNjDCju0=";
+    hash = "sha256-absIKvcFo6I1Uu0t+l8OLOU/AQ4kD295P4+KVwMAWMc=";
   };
 
   # keras and tensorflow are not in the official setup.py requirements but are required for the CLI utilities to run.
-  propagatedBuildInputs = [
+  dependencies = [
     appdirs
     keras
     mhcgnomes
@@ -82,10 +82,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "mhcflurry" ];
 
-  meta = with lib; {
+  meta = {
     description = "Peptide-MHC I binding affinity prediction";
     homepage = "https://github.com/openvax/mhcflurry";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ samuela ];
+    changelog = "https://github.com/openvax/mhcflurry/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ samuela ];
+    # ModuleNotFoundError: No module named 'keras.api._v2' as tensorflow is too outdated
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/namex/default.nix b/pkgs/development/python-modules/namex/default.nix
new file mode 100644
index 0000000000000..a2dfaf8904321
--- /dev/null
+++ b/pkgs/development/python-modules/namex/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  wheel,
+}:
+
+buildPythonPackage rec {
+  pname = "namex";
+  version = "0.0.8";
+  pyproject = true;
+
+  # Not using fetchFromGitHub because the repo does not have any tag/release.
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-MqUPbFZcC7EKp2KYyVlQer3A6FDv4IXcOPNED8s6qQs=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  pythonImportsCheck = [ "namex" ];
+
+  # This packages has no tests.
+  doCheck = false;
+
+  meta = {
+    description = "A simple utility to separate the implementation of your Python package and its public API surface";
+    homepage = "https://github.com/fchollet/namex";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/qmk-dotty-dict/default.nix b/pkgs/development/python-modules/qmk-dotty-dict/default.nix
index abceedd5a8f52..3e19b7bce5f12 100644
--- a/pkgs/development/python-modules/qmk-dotty-dict/default.nix
+++ b/pkgs/development/python-modules/qmk-dotty-dict/default.nix
@@ -30,6 +30,6 @@ buildPythonPackage rec {
       some non-UTF8 locale settings.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ babariviere ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/trfl/default.nix b/pkgs/development/python-modules/trfl/default.nix
index a0041be98eabb..1e8120bdec681 100644
--- a/pkgs/development/python-modules/trfl/default.nix
+++ b/pkgs/development/python-modules/trfl/default.nix
@@ -72,5 +72,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/deepmind/trfl";
     license = licenses.asl20;
     maintainers = with maintainers; [ onny ];
+    # ModuleNotFoundError: No module named 'keras.api._v2' as tensorflow is too outdated
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index bef6acb62ef52..1ac6b47a31bfb 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -297,6 +297,13 @@ buildPythonPackage rec {
     [
       # Timing sensitive
       "test_login_timeout"
+
+      # Tensorflow 2.13 is too old for the current version of keras
+      # ModuleNotFoundError: No module named 'keras.api._v2'
+      "test_saved_model_keras"
+      "test_sklearn_saved_model"
+      "test_pytorch_saved_model"
+      "test_tensorflow_keras_saved_model"
     ]
     ++ lib.optionals stdenv.isDarwin [
       # Disable test that fails on darwin due to issue with python3Packages.psutil:
diff --git a/pkgs/development/python-modules/ytmusicapi/default.nix b/pkgs/development/python-modules/ytmusicapi/default.nix
index a34b2e7f7e614..b2a805bbf2402 100644
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "1.7.2";
+  version = "1.7.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "sigma67";
     repo = "ytmusicapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-mFjNtZdLpS1jfqF/KZ1p8H0pWUGsIdFDxhc4dZnv6HM=";
+    hash = "sha256-a2EZ0uUwdP0QNQh9h4TG1lmPXkvrlDziKiUQwYENXwk=";
   };
 
   build-system = [
diff --git a/pkgs/development/tools/build-managers/bear/default.nix b/pkgs/development/tools/build-managers/bear/default.nix
index 2e0c1d54122b9..13f16c9171b6e 100644
--- a/pkgs/development/tools/build-managers/bear/default.nix
+++ b/pkgs/development/tools/build-managers/bear/default.nix
@@ -88,6 +88,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/rizsotto/Bear";
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ babariviere DieracDelta ];
+    maintainers = with maintainers; [ DieracDelta ];
   };
 }
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index e1956f7ea8bf3..73f8e6dcd4310 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -76,6 +76,6 @@ buildGraalvmNativeImage rec {
     homepage = "https://github.com/clojure-lsp/clojure-lsp";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
-    maintainers = with maintainers; [ ericdallo babariviere ];
+    maintainers = with maintainers; [ ericdallo ];
   };
 }
diff --git a/pkgs/development/tools/renderdoc/default.nix b/pkgs/development/tools/renderdoc/default.nix
index a5bc15ef3165f..5f17991091c45 100644
--- a/pkgs/development/tools/renderdoc/default.nix
+++ b/pkgs/development/tools/renderdoc/default.nix
@@ -32,13 +32,13 @@ let
 in
 mkDerivation rec {
   pname = "renderdoc";
-  version = "1.32";
+  version = "1.33";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "sha256-8Q2QMANieY/Bvb50NtlZEN/Nmd6xurU6AJU0Uo8qDTs=";
+    sha256 = "sha256-BQR7ENgdblzamO5GgtLJriNiJFICsj0/iWVn1usxBjU=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/web/bootstrap-studio/default.nix b/pkgs/development/web/bootstrap-studio/default.nix
index 14675efdac179..3839da048fa45 100644
--- a/pkgs/development/web/bootstrap-studio/default.nix
+++ b/pkgs/development/web/bootstrap-studio/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "bootstrap-studio";
-  version = "6.6.1";
+  version = "6.7.0";
   src = fetchurl {
     url = "https://releases.bootstrapstudio.io/${version}/Bootstrap%20Studio.AppImage";
-    sha256 = "sha256-mMhjdAJfiDoK4b8TfawzxZHyQG2MUJHpG45MhuaCPqs=";
+    sha256 = "sha256-bhtzz6eyvEXrGrp7upvk6hYuOeiOjI+sxXQy+9gyBto=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/development/web/insomnia/default.nix b/pkgs/development/web/insomnia/default.nix
index d46a098e89f9d..0ebe273949d89 100644
--- a/pkgs/development/web/insomnia/default.nix
+++ b/pkgs/development/web/insomnia/default.nix
@@ -26,7 +26,7 @@ let
     changelog = "https://github.com/Kong/insomnia/releases/tag/core@${version}";
     license = licenses.asl20;
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    maintainers = with maintainers; [ markus1189 babariviere kashw2 DataHearth ];
+    maintainers = with maintainers; [ markus1189 kashw2 DataHearth ];
   };
 in
 if stdenv.isDarwin then stdenv.mkDerivation {
diff --git a/pkgs/games/scid-vs-pc/default.nix b/pkgs/games/scid-vs-pc/default.nix
index dc76a6149c9d4..0a071237bee7c 100644
--- a/pkgs/games/scid-vs-pc/default.nix
+++ b/pkgs/games/scid-vs-pc/default.nix
@@ -2,11 +2,11 @@
 
 tcl.mkTclDerivation rec {
   pname = "scid-vs-pc";
-  version = "4.24";
+  version = "4.25";
 
   src = fetchurl {
     url = "mirror://sourceforge/scidvspc/scid_vs_pc-${version}.tgz";
-    hash = "sha256-x4Ljn1vaXrue16kUofWAH2sDNYC8h3NvzFjffRo0EhA=";
+    hash = "sha256-YZsBwIp5ouGk75wsAywuYyNSeNjCAx0iWgiA7YmUmnk=";
   };
 
   postPatch = ''
diff --git a/pkgs/games/vcmi/default.nix b/pkgs/games/vcmi/default.nix
index b4f1df8eed0b8..52fd00b90f169 100644
--- a/pkgs/games/vcmi/default.nix
+++ b/pkgs/games/vcmi/default.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vcmi";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-w4SYgc8T57PyezY6UspNCwBcoM6ytnNu6QsxwB4QYDw=";
+    hash = "sha256-Hn3qNTWFU3SMBTJxA2owsAQqIl9wZy33B2Mp4UdlLn4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/darwin/apparency/default.nix b/pkgs/os-specific/darwin/apparency/default.nix
index 0bae99c14b37e..bbe3f51aa12e1 100644
--- a/pkgs/os-specific/darwin/apparency/default.nix
+++ b/pkgs/os-specific/darwin/apparency/default.nix
@@ -4,13 +4,18 @@
 , undmg
 }:
 
+let
+  snapshot = "20240601172844";
+in
 stdenv.mkDerivation {
   pname = "apparency";
-  version = "1.5.1";
+  version = "2.0";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20230815073821/https://www.mothersruin.com/software/downloads/Apparency.dmg";
-    hash = "sha256-JpaBdlt8kTNFzK/yZVZ+ZFJ3DnPQbogJC7QBmtSVkoQ=";
+   # Use externally archived download URL because
+   # upstream does not provide stable URLs for versioned releases
+    url = "https://web.archive.org/web/${snapshot}/https://www.mothersruin.com/software/downloads/Apparency.dmg";
+    hash = "sha256-XKxWxqfxy9AQneILLrN9XqLt4/k2N8yumZ5mrSvczFk=";
   };
 
   nativeBuildInputs = [ undmg ];
diff --git a/pkgs/os-specific/darwin/dockutil/default.nix b/pkgs/os-specific/darwin/dockutil/default.nix
index 5e4187f07280f..64a8a98443886 100644
--- a/pkgs/os-specific/darwin/dockutil/default.nix
+++ b/pkgs/os-specific/darwin/dockutil/default.nix
@@ -1,37 +1,99 @@
-{ lib, stdenv, fetchurl, libarchive, p7zip }:
-stdenv.mkDerivation rec {
-  pname = "dockutil";
-  version = "3.0.2";
-
-  src = fetchurl {
-    url =
-      "https://github.com/kcrawford/dockutil/releases/download/${version}/dockutil-${version}.pkg";
-    sha256 = "175137ea747e83ed221d60b18b712b256ed31531534cde84f679487d337668fd";
-  };
-
-  dontBuild = true;
-
-  nativeBuildInputs = [ libarchive p7zip ];
+{ lib
+, stdenv
+, stdenvNoCC
+, fetchFromGitHub
+, fetchurl
+, swift
+, swiftpm
+, swiftpm2nix
+, swiftPackages
+, darwin
+, libarchive
+, p7zip
+# Building from source on x86_64 fails (among other things) due to:
+# error: cannot load underlying module for 'Darwin'
+, fromSource ? (stdenv.system != "x86_64-darwin")
+}:
 
-  unpackPhase = ''
-    7z x $src
-    bsdtar -xf Payload~
-  '';
+let
+  generated = swiftpm2nix.helpers ./generated;
 
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    mkdir -p $out/usr/local/bin
-    install -Dm755 usr/local/bin/dockutil -t $out/usr/local/bin
-    ln -rs $out/usr/local/bin/dockutil $out/bin/dockutil
-    runHook postInstall
-  '';
+  pname = "dockutil";
+  version = "3.1.3";
 
   meta = with lib; {
     description = "Tool for managing dock items";
     homepage = "https://github.com/kcrawford/dockutil";
     license = licenses.asl20;
     maintainers = with maintainers; [ tboerger ];
+    mainProgram = "dockutil";
     platforms = platforms.darwin;
   };
-}
+
+  buildFromSource = swiftPackages.stdenv.mkDerivation (finalAttrs: {
+    inherit pname version meta;
+
+    src = fetchFromGitHub {
+      owner = "kcrawford";
+      repo = "dockutil";
+      rev = finalAttrs.version;
+      hash = "sha256-mmk4vVZhq4kt05nI/dDM1676FDWyf4wTSwY2YzqKsLU=";
+    };
+
+    postPatch = ''
+      # Patch sources so that they build with Swift CoreFoundation
+      # which differs ever so slightly from Apple's implementation.
+      substituteInPlace Sources/DockUtil/DockUtil.swift \
+        --replace-fail "URL(filePath:" \
+                       "URL(fileURLWithPath:" \
+        --replace-fail "path(percentEncoded: false)" \
+                       "path"
+    '';
+
+    nativeBuildInputs = [ swift swiftpm ];
+
+    buildInputs = with darwin.apple_sdk.frameworks; [ Cocoa ];
+
+    configurePhase = generated.configure;
+
+    installPhase = ''
+      runHook preInstall
+      install -Dm755 .build/${stdenv.hostPlatform.darwinArch}-apple-macosx/release/dockutil -t $out/bin
+      runHook postInstall
+    '';
+  });
+
+  installBinary = stdenvNoCC.mkDerivation (finalAttrs: {
+    inherit pname version;
+
+    src = fetchurl {
+      url = "https://github.com/kcrawford/dockutil/releases/download/${finalAttrs.version}/dockutil-${finalAttrs.version}.pkg";
+      hash = "sha256-9g24Jz/oDXxIJFiL7bU4pTh2dcORftsAENq59S0/JYI=";
+    };
+
+    dontPatch = true;
+    dontConfigure = true;
+    dontBuild = true;
+
+    nativeBuildInputs = [ libarchive p7zip ];
+
+    unpackPhase = ''
+      7z x $src
+      bsdtar -xf Payload~
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin
+      install -Dm755 usr/local/bin/dockutil -t $out/bin
+      runHook postInstall
+    '';
+
+    meta = meta // {
+      sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    };
+  });
+in
+if fromSource
+  then buildFromSource
+  else installBinary
diff --git a/pkgs/os-specific/darwin/dockutil/generated/default.nix b/pkgs/os-specific/darwin/dockutil/generated/default.nix
new file mode 100644
index 0000000000000..32ffc68e4d2c9
--- /dev/null
+++ b/pkgs/os-specific/darwin/dockutil/generated/default.nix
@@ -0,0 +1,7 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "1fpdgivmwdszggvx0ligs3vidv9kpp9777v649hs8w7vpcifc2ji";
+  };
+}
diff --git a/pkgs/os-specific/darwin/dockutil/generated/workspace-state.json b/pkgs/os-specific/darwin/dockutil/generated/workspace-state.json
new file mode 100644
index 0000000000000..e24a74517af07
--- /dev/null
+++ b/pkgs/os-specific/darwin/dockutil/generated/workspace-state.json
@@ -0,0 +1,25 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser.git",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "82905286cc3f0fa8adc4674bf49437cab65a8373",
+            "version": "1.1.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      }
+    ]
+  },
+  "version": 6
+}
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 9ddb211ba0d57..ec1bb7bbf35a6 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "51.0";
+  version = "52.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-G5Z2BbmF5fzOg/32BBgGpC6yroDFOnZWtA/+5QatQ1M=";
+    hash = "sha256-M4nmnfeEIxsaFO1DJV9jKD/NnkaLHVNXtfTPf2pTDs4=";
   };
 
   strictDeps = true;
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
index e0a989105687a..b592ad5b5411f 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "mushroom";
-  version = "3.5.5";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "piitaya";
     repo = "lovelace-mushroom";
     rev = "v${version}";
-    hash = "sha256-ddxDgzD/dXA9H67Ttv1czDJMufk/IY8bWnVTnN8tdvc=";
+    hash = "sha256-lF6CBKQc1gu4ajD973xn75ZAs0vP7YGI3Dlc9YLvINo=";
   };
 
-  npmDepsHash = "sha256-mxot6pz0ChUgPTeutNSULcktq19ccUo3nZTgzPZtlXM=";
+  npmDepsHash = "sha256-hexrJUrSJBv1hsLKnWOkm8E4KtD4W3YQZf/8/6BAaVw=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 3cb9023694e5a..aa09ec90f78e7 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -43,8 +43,8 @@ let
   };
 in {
   nextcloud27 = generic {
-    version = "27.1.9";
-    hash = "sha256-+P4QzLWFNJ+EUQ25tLAgjbfziV2vPXpejxfSNuzEEfU=";
+    version = "27.1.10";
+    hash = "sha256-lD4ScNdxp8gNqisy5ylM6MO3e56u9yrYs4SH1YyFB1Y=";
     packages = nextcloud27Packages;
   };
 
diff --git a/pkgs/servers/nextcloud/notify_push.nix b/pkgs/servers/nextcloud/notify_push.nix
index e0f81b04b4d88..d8fc873802e5b 100644
--- a/pkgs/servers/nextcloud/notify_push.nix
+++ b/pkgs/servers/nextcloud/notify_push.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "notify_push";
-  version = "0.6.11";
+  version = "0.6.12";
 
   src = fetchFromGitHub {
     owner = "nextcloud";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-241p+9gLyEe2Mkc0GQ/Z0BjbxV5OZfbDC6kqfq7ATaE=";
+    hash = "sha256-Wbrkr9DWOQpOKAp9X/PzU8alDDrDapX/1hE+ObbD/nc=";
   };
 
-  cargoHash = "sha256-fGbRmrOEbs9nGZhcu1w7qOIwYMaTohaUFb7dilPuTHc=";
+  cargoHash = "sha256-4bgbhtqdb1IVsf0yIcZOXZCVdRHjdvhZe/VCab0kuMk=";
 
   passthru = rec {
     test_client = rustPlatform.buildRustPackage {
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
       buildAndTestSubdir = "test_client";
 
-      cargoHash = "sha256-RJnNwSDwIA0M+BufBKT9a/pyHwpcpJFR//j0fE4U3gE=";
+      cargoHash = "sha256-Z7AX/PXfiUHEV/M+i/2qne70tcZnnPj/iNT+DNMECS8=";
 
       meta = meta // {
         mainProgram = "test_client";
diff --git a/pkgs/servers/nextcloud/packages/27.json b/pkgs/servers/nextcloud/packages/27.json
index d33fd4331e7d1..1ce37d20fddb0 100644
--- a/pkgs/servers/nextcloud/packages/27.json
+++ b/pkgs/servers/nextcloud/packages/27.json
@@ -200,9 +200,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "1w0nb74q5ishwsd9xhgjlp5ik159xjfp5i2cczi0fmwlb185n1ik",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.11/notify_push-v0.6.11.tar.gz",
-    "version": "0.6.11",
+    "sha256": "14s8g3dqwrxjz1zww64n1lhwdb8374wr1b5v76xhawypmfz2a68h",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.12/notify_push-v0.6.12.tar.gz",
+    "version": "0.6.12",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -210,9 +210,9 @@
     ]
   },
   "onlyoffice": {
-    "sha256": "1h4jjphpqzxmnx300fkj0gf831sb61r8vxd3w9vnj4v38mxdmcc0",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.2.0/onlyoffice.tar.gz",
-    "version": "9.2.0",
+    "sha256": "1vflj70q8d0hrfck9c5l1k4qa38gpdh3zjgx4aqamnlbvkfssk7h",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.2.2/onlyoffice.tar.gz",
+    "version": "9.2.2",
     "description": "ONLYOFFICE connector allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
@@ -230,9 +230,9 @@
     ]
   },
   "polls": {
-    "sha256": "1s3rlfdk3g3c45ch8kb66ydzxfx20vcaff1926m5h8m50cmapq6x",
-    "url": "https://github.com/nextcloud/polls/releases/download/v6.3.0/polls.tar.gz",
-    "version": "6.3.0",
+    "sha256": "0zsklab2sjz5b37b1dn0fpc21yvxrp7fvacppv1v6x5yppnmm6kh",
+    "url": "https://github.com/nextcloud/polls/releases/download/v6.4.0/polls.tar.gz",
+    "version": "6.4.0",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/28.json b/pkgs/servers/nextcloud/packages/28.json
index ec4a34f3c10fb..7b8d3615bab7f 100644
--- a/pkgs/servers/nextcloud/packages/28.json
+++ b/pkgs/servers/nextcloud/packages/28.json
@@ -1,8 +1,8 @@
 {
   "bookmarks": {
-    "sha256": "0i070c5a66yxs8h7w6r9wi0n1bf41q4vrhvwr4vybi1siwr3psv6",
-    "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.0.2/bookmarks-14.0.2.tar.gz",
-    "version": "14.0.2",
+    "sha256": "1i003cp6x4hw3zkaf49a0srkgr257fbv3p612whd1nsbm2mfd2mf",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.1.1/bookmarks-14.1.1.tar.gz",
+    "version": "14.1.1",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- 🔍 Full-text search\n- 📲 Synchronize with all your browsers and devices\n- 👪 Share bookmarks with other users and publicly\n- ☠ Find broken links\n- ⚛ Generate RSS feeds of your collections\n- 📔 Read archived versions of your links in case they are depublished\n- 💬 Create new bookmarks directly from within Nextcloud Talk\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
     "homepage": "https://github.com/nextcloud/bookmarks",
     "licenses": [
@@ -70,9 +70,9 @@
     ]
   },
   "forms": {
-    "sha256": "0ca627nyrs61k5990j3m1l7vxavsh8x8rrhfvk01pdl9f1556jmf",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.2.3/forms-v4.2.3.tar.gz",
-    "version": "4.2.3",
+    "sha256": "1hwc7ra12nsr79xp8lkv3ip46bxxbjpaglb0a4k06ikfnzjaddny",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.2.4/forms-v4.2.4.tar.gz",
+    "version": "4.2.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -170,9 +170,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "1w0nb74q5ishwsd9xhgjlp5ik159xjfp5i2cczi0fmwlb185n1ik",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.11/notify_push-v0.6.11.tar.gz",
-    "version": "0.6.11",
+    "sha256": "14s8g3dqwrxjz1zww64n1lhwdb8374wr1b5v76xhawypmfz2a68h",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.12/notify_push-v0.6.12.tar.gz",
+    "version": "0.6.12",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -180,9 +180,9 @@
     ]
   },
   "onlyoffice": {
-    "sha256": "1h4jjphpqzxmnx300fkj0gf831sb61r8vxd3w9vnj4v38mxdmcc0",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.2.0/onlyoffice.tar.gz",
-    "version": "9.2.0",
+    "sha256": "1vflj70q8d0hrfck9c5l1k4qa38gpdh3zjgx4aqamnlbvkfssk7h",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.2.2/onlyoffice.tar.gz",
+    "version": "9.2.2",
     "description": "ONLYOFFICE connector allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/29.json b/pkgs/servers/nextcloud/packages/29.json
index 03563eeea2b1c..c49903cd39948 100644
--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
@@ -1,8 +1,8 @@
 {
   "bookmarks": {
-    "sha256": "0i070c5a66yxs8h7w6r9wi0n1bf41q4vrhvwr4vybi1siwr3psv6",
-    "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.0.2/bookmarks-14.0.2.tar.gz",
-    "version": "14.0.2",
+    "sha256": "1i003cp6x4hw3zkaf49a0srkgr257fbv3p612whd1nsbm2mfd2mf",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.1.1/bookmarks-14.1.1.tar.gz",
+    "version": "14.1.1",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- 🔍 Full-text search\n- 📲 Synchronize with all your browsers and devices\n- 👪 Share bookmarks with other users and publicly\n- ☠ Find broken links\n- ⚛ Generate RSS feeds of your collections\n- 📔 Read archived versions of your links in case they are depublished\n- 💬 Create new bookmarks directly from within Nextcloud Talk\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
     "homepage": "https://github.com/nextcloud/bookmarks",
     "licenses": [
@@ -70,9 +70,9 @@
     ]
   },
   "forms": {
-    "sha256": "0ca627nyrs61k5990j3m1l7vxavsh8x8rrhfvk01pdl9f1556jmf",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.2.3/forms-v4.2.3.tar.gz",
-    "version": "4.2.3",
+    "sha256": "1hwc7ra12nsr79xp8lkv3ip46bxxbjpaglb0a4k06ikfnzjaddny",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.2.4/forms-v4.2.4.tar.gz",
+    "version": "4.2.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -170,9 +170,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "1w0nb74q5ishwsd9xhgjlp5ik159xjfp5i2cczi0fmwlb185n1ik",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.11/notify_push-v0.6.11.tar.gz",
-    "version": "0.6.11",
+    "sha256": "14s8g3dqwrxjz1zww64n1lhwdb8374wr1b5v76xhawypmfz2a68h",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.12/notify_push-v0.6.12.tar.gz",
+    "version": "0.6.12",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -180,9 +180,9 @@
     ]
   },
   "onlyoffice": {
-    "sha256": "1h4jjphpqzxmnx300fkj0gf831sb61r8vxd3w9vnj4v38mxdmcc0",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.2.0/onlyoffice.tar.gz",
-    "version": "9.2.0",
+    "sha256": "1vflj70q8d0hrfck9c5l1k4qa38gpdh3zjgx4aqamnlbvkfssk7h",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.2.2/onlyoffice.tar.gz",
+    "version": "9.2.2",
     "description": "ONLYOFFICE connector allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
diff --git a/pkgs/servers/portunus/default.nix b/pkgs/servers/portunus/default.nix
index 6bd70ae5519f5..971a6a0967f5f 100644
--- a/pkgs/servers/portunus/default.nix
+++ b/pkgs/servers/portunus/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, libxcrypt-legacy # TODO: switch to libxcrypt for NixOS 24.11 (cf. same note on nixos/modules/services/misc/portunus.nix)
+, libxcrypt
 }:
 
 buildGoModule rec {
@@ -15,7 +15,7 @@ buildGoModule rec {
     sha256 = "sha256-+pMMIutj+OWKZmOYH5NuA4a7aS5CD+33vAEC9bJmyfM=";
   };
 
-  buildInputs = [ libxcrypt-legacy ];
+  buildInputs = [ libxcrypt ];
 
   vendorHash = null;
 
diff --git a/pkgs/servers/uwsgi/default.nix b/pkgs/servers/uwsgi/default.nix
index d5ffb81196ff9..add90b701abfc 100644
--- a/pkgs/servers/uwsgi/default.nix
+++ b/pkgs/servers/uwsgi/default.nix
@@ -71,13 +71,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsgi";
-  version = "2.0.25.1";
+  version = "2.0.26";
 
   src = fetchFromGitHub {
     owner = "unbit";
     repo = "uwsgi";
     rev = finalAttrs.version;
-    hash = "sha256-hAjwn5sZynMNBPw2dAtuf0xIbnDSraIWas6OEGdJlfc=";
+    hash = "sha256-3nmmVNNDvQ1RzaD5BQFrScHHnmUtMwjo3wodEGIJCvI=";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index e1952025220ad..6753657518af7 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -15,14 +15,14 @@
 
 let
   pname = "pgadmin";
-  version = "8.6";
-  yarnHash = "sha256-SDAU6goe5iu1SAcAsAEam2i+skZkG/hE9y3bGsKiFZ8=";
+  version = "8.7";
+  yarnHash = "sha256-dBgbgZrjF1rNyN1Hp1nKiT6C6FVbYdbEZQgYbRKVsYI=";
 
   src = fetchFromGitHub {
     owner = "pgadmin-org";
     repo = "pgadmin4";
     rev = "REL-${lib.versions.major version}_${lib.versions.minor version}";
-    hash = "sha256-a370dh5IHInhcPA1LeveUIjalrymTsdyoXjBNNKwSTs=";
+    hash = "sha256-KTu6cbB3AVxEOjDbTB4Uf7K4Sf6kHlNm4qecgdmR/LY=";
   };
 
   # keep the scope, as it is used throughout the derivation and tests
diff --git a/pkgs/tools/admin/pgadmin/yarn.lock b/pkgs/tools/admin/pgadmin/yarn.lock
index 026590933d2ab..2d0d2d44a23b3 100644
--- a/pkgs/tools/admin/pgadmin/yarn.lock
+++ b/pkgs/tools/admin/pgadmin/yarn.lock
@@ -2232,6 +2232,30 @@
     prop-types "^15.7.2"
     react-transition-state "^1.1.3"
 
+"@tanstack/react-table@^8.16.0":
+  version "8.16.0"
+  resolved "https://registry.npmjs.org/@tanstack/react-table/-/react-table-8.16.0.tgz#92151210ff99d6925353d7a2205735d9c31af48c"
+  integrity sha512-rKRjnt8ostqN2fercRVOIH/dq7MAmOENCMvVlKx6P9Iokhh6woBGnIZEkqsY/vEJf1jN3TqLOb34xQGLVRuhAg==
+  dependencies:
+    "@tanstack/table-core" "8.16.0"
+
+"@tanstack/react-virtual@^3.4.0":
+  version "3.4.0"
+  resolved "https://registry.npmjs.org/@tanstack/react-virtual/-/react-virtual-3.4.0.tgz#5dcc0ac7c9e35d5db12c3bbe4cbc075bad684d93"
+  integrity sha512-GZN4xn/Tg5w7gvYeVcMVCeL4pEyUhvg+Cp6KX2Z01C4FRNxIWMgIQ9ibgMarNQfo+gt0PVLcEER4A9sNv/jlow==
+  dependencies:
+    "@tanstack/virtual-core" "3.4.0"
+
+"@tanstack/table-core@8.16.0":
+  version "8.16.0"
+  resolved "https://registry.npmjs.org/@tanstack/table-core/-/table-core-8.16.0.tgz#7b58018dd3cec8e0015fe22d6bb24d18d33c891f"
+  integrity sha512-dCG8vQGk4js5v88/k83tTedWOwjGnIyONrKpHpfmSJB8jwFHl8GSu1sBBxbtACVAPtAQgwNxl0rw1d3RqRM1Tg==
+
+"@tanstack/virtual-core@3.4.0":
+  version "3.4.0"
+  resolved "https://registry.npmjs.org/@tanstack/virtual-core/-/virtual-core-3.4.0.tgz#afd72bc5a839b71c2cda87a738eb4eb18451b80a"
+  integrity sha512-75jXqXxqq5M5Veb9KP1STi8kA5u408uOOAefk2ftHDGCpUk3RP6zX++QqfbmHJTBiU72NQ+ghgCZVts/Wocz8Q==
+
 "@testing-library/dom@^8.0.0":
   version "8.20.1"
   resolved "https://registry.npmjs.org/@testing-library/dom/-/dom-8.20.1.tgz#2e52a32e46fc88369eef7eef634ac2a192decd9f"
@@ -10138,11 +10162,6 @@ react-select@^5.7.2:
     react-transition-group "^4.3.0"
     use-isomorphic-layout-effect "^1.1.2"
 
-react-table@^7.6.3:
-  version "7.8.0"
-  resolved "https://registry.npmjs.org/react-table/-/react-table-7.8.0.tgz#07858c01c1718c09f7f1aed7034fcfd7bda907d2"
-  integrity sha512-hNaz4ygkZO4bESeFfnfOft73iBUj8K5oKi1EcSHPAibEydfsX2MyU6Z8KCr3mv3C9Kqqh71U+DhZkFvibbnPbA==
-
 react-timer-hook@^3.0.5:
   version "3.0.7"
   resolved "https://registry.npmjs.org/react-timer-hook/-/react-timer-hook-3.0.7.tgz#ac42c43d0034b873cbf97b44eb34ccb2b11fe5e0"
@@ -10168,7 +10187,7 @@ react-virtualized-auto-sizer@^1.0.6:
   resolved "https://registry.npmjs.org/react-virtualized-auto-sizer/-/react-virtualized-auto-sizer-1.0.24.tgz#3ebdc92f4b05ad65693b3cc8e7d8dd54924c0227"
   integrity sha512-3kCn7N9NEb3FlvJrSHWGQ4iVl+ydQObq2fHMn12i5wbtm74zHOPhz/i64OL3c1S1vi9i2GXtZqNqUJTQ+BnNfg==
 
-"react-window@^1.3.1", "react-window@^1.8.10", "react-window@^1.8.5":
+"react-window@^1.3.1", "react-window@^1.8.10":
   version "1.8.10"
   resolved "https://registry.npmjs.org/react-window/-/react-window-1.8.10.tgz#9e6b08548316814b443f7002b1cf8fd3a1bdde03"
   integrity sha512-Y0Cx+dnU6NLa5/EvoHukUD0BklJ8qITCtVEPY1C/nL8wwoZ0b5aEw8Ff1dOVHw7fCzMt55XfJDd8S8W8LCaUCg==
diff --git a/pkgs/tools/inputmethods/fcitx5/with-addons.nix b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
index 614074595f51a..58175eedade8b 100644
--- a/pkgs/tools/inputmethods/fcitx5/with-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
@@ -36,13 +36,13 @@ symlinkJoin {
       wrapProgram $out/bin/fcitx5-config-qt --prefix FCITX_ADDON_DIRS : "$out/lib/fcitx5"
     ''}
 
-    desktop=share/applications/org.fcitx.Fcitx5.desktop
-    autostart=etc/xdg/autostart/org.fcitx.Fcitx5.desktop
-    rm $out/$desktop
-    rm $out/$autostart
-    cp ${fcitx5}/$desktop $out/$desktop
-    sed -i $out/$desktop -e "s|^Exec=.*|Exec=$out/bin/fcitx5|g"
-    ln -s $out/$desktop $out/$autostart
+    pushd $out
+    grep -Rl --include=\*.{desktop,service} share/applications etc/xdg/autostart share/dbus-1/services -e ${fcitx5} | while read -r file; do
+      rm $file
+      cp ${fcitx5}/$file $file
+      substituteInPlace $file --replace-fail ${fcitx5} $out
+    done
+    popd
   '';
 
   inherit (fcitx5) meta;
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 7bf5b4586e0d5..89af942966a6b 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -96,11 +96,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "267";
+  version = "269";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-eU5n39kwITCGKXFu7ESAs9bZM6SPxey0tmDLd86zRvE=";
+    hash = "sha256-L2UygmcTXgcc9l8ALpOS52+2dhsO42733nlc1Hzl8L8=";
   };
 
   outputs = [
@@ -108,6 +108,9 @@ python.pkgs.buildPythonApplication rec {
     "man"
   ];
 
+  # https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/378
+  sourceRoot = "./-269";
+
   patches = [
     ./ignore_links.patch
     ./openssh-no-dsa.patch # https://salsa.debian.org/reproducible-builds/diffoscope/-/merge_requests/139
diff --git a/pkgs/tools/misc/qmk/default.nix b/pkgs/tools/misc/qmk/default.nix
index 5493463e3c32e..433134ddb55f8 100644
--- a/pkgs/tools/misc/qmk/default.nix
+++ b/pkgs/tools/misc/qmk/default.nix
@@ -70,7 +70,7 @@ python3.pkgs.buildPythonApplication rec {
       - ... and many more!
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ bhipple babariviere ekleog ];
+    maintainers = with maintainers; [ bhipple ekleog ];
     mainProgram = "qmk";
   };
 }
diff --git a/pkgs/tools/networking/sitespeed-io/default.nix b/pkgs/tools/networking/sitespeed-io/default.nix
index ed7bf5363e9bc..fdb3a8d0f3cd3 100644
--- a/pkgs/tools/networking/sitespeed-io/default.nix
+++ b/pkgs/tools/networking/sitespeed-io/default.nix
@@ -24,13 +24,13 @@
 assert (!withFirefox && !withChromium) -> throw "Either `withFirefox` or `withChromium` must be enabled.";
 buildNpmPackage rec {
   pname = "sitespeed-io";
-  version = "33.6.0";
+  version = "34.0.1";
 
   src = fetchFromGitHub {
     owner = "sitespeedio";
     repo = "sitespeed.io";
     rev = "v${version}";
-    hash = "sha256-ln4P0mVKv/QppkKJwBQsV1OSvH3OFUsDN/WsOyRDGus=";
+    hash = "sha256-yC/TlAJa71hbPYYuqPV+k3syGuo/VhnNjXmmxh47ySQ=";
   };
 
   nodejs = nodejs_18;
@@ -46,7 +46,7 @@ buildNpmPackage rec {
 
   dontNpmBuild = true;
   npmInstallFlags = [ "--omit=dev" ];
-  npmDepsHash = "sha256-XdWpoXeDY7eV5F9UezUZBsr3RelajleVNzThTEjzw74=";
+  npmDepsHash = "sha256-Q0cWxV5OOaG8Z3aM2j0HtD1e9yPFVDSRcMKBf/yscv4=";
 
   postInstall = ''
     mv $out/bin/sitespeed{.,-}io
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index e583a22e6a06a..19d38a8d3538c 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.10"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.11"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 4ea9806710a45..81b036b5fd22c 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 19234871c7edcc534f2bd34505ec08a1f33319b0
-  ref: refs/tags/6.4.10
+  revision: 5dfb48d9f70d811d52e0633998108f22b4959b1a
+  ref: refs/tags/6.4.11
   specs:
-    metasploit-framework (6.4.10)
+    metasploit-framework (6.4.11)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
@@ -47,7 +47,7 @@ GIT
       net-ssh
       network_interface
       nexpose
-      nokogiri (~> 1.14.0)
+      nokogiri
       octokit (~> 4.0)
       openssl-ccm
       openvas-omp
@@ -87,7 +87,7 @@ GIT
       rubyntlm
       rubyzip
       sinatra
-      sqlite3 (= 1.6.6)
+      sqlite3 (= 1.7.3)
       sshkey
       swagger-blocks
       thin
@@ -415,7 +415,7 @@ GEM
       rack (~> 2.2, >= 2.2.4)
       rack-protection (= 3.2.0)
       tilt (~> 2.0)
-    sqlite3 (1.6.6)
+    sqlite3 (1.7.3)
       mini_portile2 (~> 2.8.0)
     sshkey (3.0.0)
     strptime (0.2.5)
@@ -466,4 +466,4 @@ DEPENDENCIES
   metasploit-framework!
 
 BUNDLED WITH
-   2.4.13
+   2.5.9
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 76be725c63625..867b4de7ecfc2 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.10";
+  version = "6.4.11";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-RocCo0InffP2Dn0kZB4vEgct95dJbdDSxBND8UyuUGU=";
+    hash = "sha256-//z4UmgREH5vQh1rzv5YpAfmjcWR+9NbitdJwjN+9jo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index a60daf4c5e823..b8d408cbda480 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -674,12 +674,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "19234871c7edcc534f2bd34505ec08a1f33319b0";
-      sha256 = "0rahmr6g2hqkqk9d0va9jzvjs1qj5wg6893x1vvg6z978aih51s6";
+      rev = "5dfb48d9f70d811d52e0633998108f22b4959b1a";
+      sha256 = "0fpngqrw4jfpi9dx7ywiqn6yc1x4b3zcwsqx89ppw40id19giz7z";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.10";
+    version = "6.4.11";
   };
   metasploit-model = {
     groups = ["default"];
@@ -1447,10 +1447,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15415lmz69jbzl6nch4q5l2jxv054676nk6y0vgy0g3iklmjrxvc";
+      sha256 = "073hd24qwx9j26cqbk0jma0kiajjv9fb8swv9rnz8j4mf0ygcxzs";
       type = "gem";
     };
-    version = "1.6.6";
+    version = "1.7.3";
   };
   sshkey = {
     groups = ["default"];
diff --git a/pkgs/tools/system/logrotate/default.nix b/pkgs/tools/system/logrotate/default.nix
index e92f34188f4ff..017cb0b1cb6cf 100644
--- a/pkgs/tools/system/logrotate/default.nix
+++ b/pkgs/tools/system/logrotate/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "logrotate";
-  version = "3.21.0";
+  version = "3.22.0";
 
   src = fetchFromGitHub {
     owner = "logrotate";
     repo = "logrotate";
     rev = version;
-    sha256 = "sha256-w86y6bz/nvH/0mIbn2XrSs5KdOM/xadnlZMQZp4LdGQ=";
+    sha256 = "sha256-D7E2mpC7v2kbsb1EyhR6hLvGbnIvGB2MK1n1gptYyKI=";
   };
 
   # Logrotate wants to access the 'mail' program; to be done.
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8e597fadca9b4..f345f9021d9e2 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -132,6 +132,7 @@ mapAliases ({
   boost174 = throw "boost174 has been deprecated in favor of the latest version"; # Added 2023-06-08
   boost17x = throw "boost17x has been deprecated in favor of the latest version"; # Added 2023-07-13
   boost18x = throw "boost18x has been deprecated in favor of the latest version"; # Added 2023-07-13
+  boost_process = throw "boost_process has been removed as it is included in regular boost"; # Added 2024-05-01
   bpb = throw "bpb has been removed as it is unmaintained and not compatible with recent Rust versions"; # Added 2024-04-30
   bpftool = bpftools; # Added 2021-05-03
   bpytop = throw "bpytop has been deprecated by btop"; # Added 2023-02-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d01bb7ad7174a..cb5005bc22ec3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20150,8 +20150,6 @@ with pkgs;
 
   boost = boost181;
 
-  boost_process = callPackage ../development/libraries/boost-process { };
-
   bosh-cli = callPackage ../applications/networking/cluster/bosh-cli { };
 
   botan2 = callPackage ../development/libraries/botan/2.0.nix {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 16d439e4c4d8e..56d1ba56398a8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6692,6 +6692,11 @@ self: super: with self; {
     inherit (pkgs) libsodium;
   };
 
+  libnbd = toPythonModule (pkgs.libnbd.override {
+    buildPythonBindings = true;
+    python3 = python;
+  });
+
   libpcap = callPackage ../development/python-modules/libpcap {
     pkgsLibpcap = pkgs.libpcap; # Needs the C library
   };
@@ -8603,6 +8608,8 @@ self: super: with self; {
 
   names = callPackage ../development/python-modules/names { };
 
+  namex = callPackage ../development/python-modules/namex { };
+
   name-that-hash = callPackage ../development/python-modules/name-that-hash { };
 
   nameko = callPackage ../development/python-modules/nameko { };