about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/android.section.md122
-rw-r--r--nixos/doc/manual/release-notes/rl-2411.section.md10
-rw-r--r--nixos/modules/programs/ydotool.nix25
-rw-r--r--nixos/modules/services/security/vaultwarden/default.nix47
-rw-r--r--nixos/tests/vaultwarden.nix15
-rw-r--r--nixos/tests/ydotool.nix257
-rw-r--r--pkgs/applications/audio/famistudio/default.nix9
-rw-r--r--pkgs/applications/blockchains/ton/default.nix4
-rw-r--r--pkgs/applications/editors/android-studio/common.nix61
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/video/kodi/addons/formula1/default.nix29
-rw-r--r--pkgs/applications/video/kodi/addons/infotagger/default.nix4
-rw-r--r--pkgs/applications/video/kodi/addons/plugin-cache/default.nix26
-rw-r--r--pkgs/applications/video/kodi/addons/simplecache/default.nix26
-rw-r--r--pkgs/applications/video/kodi/addons/upnext/default.nix26
-rw-r--r--pkgs/by-name/ay/ayatana-indicator-session/package.nix4
-rw-r--r--pkgs/by-name/di/dissent/package.nix29
-rw-r--r--pkgs/by-name/dt/dtools/package.nix4
-rw-r--r--pkgs/by-name/me/meletrix-udev-rules/meletrix.rules26
-rw-r--r--pkgs/by-name/me/meletrix-udev-rules/package.nix24
-rw-r--r--pkgs/by-name/tr/tracy/0001-remove-unifiedtypeidentifiers-framework (renamed from pkgs/development/tools/tracy/0001-remove-unifiedtypeidentifiers-framework)0
-rw-r--r--pkgs/by-name/tr/tracy/package.nix (renamed from pkgs/development/tools/tracy/default.nix)10
-rw-r--r--pkgs/by-name/wx/wxc/package.nix43
-rw-r--r--pkgs/common-updater/unstable-updater.nix2
-rw-r--r--pkgs/desktops/lomiri/data/lomiri-session/1001-Unset-QT_QPA_PLATFORMTHEME.patch33
-rw-r--r--pkgs/desktops/lomiri/data/lomiri-session/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/12/default.nix38
-rw-r--r--pkgs/development/compilers/llvm/13/default.nix41
-rw-r--r--pkgs/development/compilers/llvm/14/default.nix30
-rw-r--r--pkgs/development/compilers/llvm/15/default.nix30
-rw-r--r--pkgs/development/compilers/llvm/16/default.nix40
-rw-r--r--pkgs/development/compilers/llvm/17/default.nix39
-rw-r--r--pkgs/development/compilers/llvm/18/default.nix39
-rw-r--r--pkgs/development/compilers/llvm/git/default.nix39
-rw-r--r--pkgs/development/libraries/libbsd/default.nix3
-rw-r--r--pkgs/development/libraries/libdvdnav/4.2.1.nix21
-rw-r--r--pkgs/development/mobile/androidenv/compose-android-packages.nix4
-rw-r--r--pkgs/development/mobile/androidenv/default.nix8
-rw-r--r--pkgs/development/python-modules/aiolifx-themes/default.nix4
-rw-r--r--pkgs/development/python-modules/aiolifx/default.nix4
-rw-r--r--pkgs/development/python-modules/blebox-uniapi/default.nix6
-rw-r--r--pkgs/development/python-modules/daphne/default.nix30
-rw-r--r--pkgs/development/python-modules/exchangelib/default.nix4
-rw-r--r--pkgs/development/python-modules/huggingface-hub/default.nix4
-rw-r--r--pkgs/development/python-modules/langchain-community/default.nix11
-rw-r--r--pkgs/development/python-modules/langchain-core/default.nix4
-rw-r--r--pkgs/development/python-modules/langchain/default.nix4
-rw-r--r--pkgs/development/python-modules/langsmith/default.nix13
-rw-r--r--pkgs/development/python-modules/llama-index-core/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-readers-file/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix4
-rw-r--r--pkgs/development/python-modules/pyhaversion/default.nix21
-rw-r--r--pkgs/development/tools/misc/swig/2.x.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix16
-rw-r--r--pkgs/tools/graphics/snapdragon-profiler/default.nix2
-rw-r--r--pkgs/tools/networking/gnirehtet/default.nix2
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix7
-rw-r--r--pkgs/top-level/kodi-packages.nix8
61 files changed, 878 insertions, 459 deletions
diff --git a/doc/languages-frameworks/android.section.md b/doc/languages-frameworks/android.section.md
index 1c5687f8ebf1b..d6ed1f35cb0a8 100644
--- a/doc/languages-frameworks/android.section.md
+++ b/doc/languages-frameworks/android.section.md
@@ -3,10 +3,36 @@
 The Android build environment provides three major features and a number of
 supporting features.
 
+## Using androidenv with Android Studio {#using-androidenv-with-android-studio}
+
+Use the `android-studio-full` attribute for a very complete Android SDK, including system images:
+
+```nix
+buildInputs = [ android-studio-full ];
+```
+
+This is identical to:
+
+```nix
+buildInputs = [ androidStudioPackages.stable.full ];
+```
+
+Alternatively, you can pass composeAndroidPackages to the `withSdk` passthru:
+
+```nix
+buildInputs = [
+  (android-studio.withSdk (androidenv.composeAndroidPackages {
+    includeNDK = true;
+  }).androidsdk)
+];
+```
+
+These will export ANDROID_SDK_ROOT and ANDROID_NDK_ROOT to the SDK and NDK directories
+in the specified Android build environment.
+
 ## Deploying an Android SDK installation with plugins {#deploying-an-android-sdk-installation-with-plugins}
 
-The first use case is deploying the SDK with a desired set of plugins or subsets
-of an SDK.
+Alternatively, you can deploy the SDK separately with a desired set of plugins, or subsets of an SDK.
 
 ```nix
 with import <nixpkgs> {};
@@ -145,16 +171,14 @@ androidComposition.platform-tools
 ## Using predefined Android package compositions {#using-predefined-android-package-compositions}
 
 In addition to composing an Android package set manually, it is also possible
-to use a predefined composition that contains all basic packages for a specific
-Android version, such as version 9.0 (API-level 28).
+to use a predefined composition that contains a fairly complete set of Android packages:
 
-The following Nix expression can be used to deploy the entire SDK with all basic
-plugins:
+The following Nix expression can be used to deploy the entire SDK:
 
 ```nix
 with import <nixpkgs> {};
 
-androidenv.androidPkgs_9_0.androidsdk
+androidenv.androidPkgs.androidsdk
 ```
 
 It is also possible to use one plugin only:
@@ -162,50 +186,9 @@ It is also possible to use one plugin only:
 ```nix
 with import <nixpkgs> {};
 
-androidenv.androidPkgs_9_0.platform-tools
-```
-
-## Building an Android application {#building-an-android-application}
-
-In addition to the SDK, it is also possible to build an Ant-based Android
-project and automatically deploy all the Android plugins that a project
-requires.
-
-
-```nix
-with import <nixpkgs> {};
-
-androidenv.buildApp {
-  name = "MyAndroidApp";
-  src = ./myappsources;
-  release = true;
-
-  # If release is set to true, you need to specify the following parameters
-  keyStore = ./keystore;
-  keyAlias = "myfirstapp";
-  keyStorePassword = "mykeystore";
-  keyAliasPassword = "myfirstapp";
-
-  # Any Android SDK parameters that install all the relevant plugins that a
-  # build requires
-  platformVersions = [ "24" ];
-
-  # When we include the NDK, then ndk-build is invoked before Ant gets invoked
-  includeNDK = true;
-}
+androidenv.androidPkgs.platform-tools
 ```
 
-Aside from the app-specific build parameters (`name`, `src`, `release` and
-keystore parameters), the `buildApp {}` function supports all the function
-parameters that the SDK composition function (the function shown in the
-previous section) supports.
-
-This build function is particularly useful when it is desired to use
-[Hydra](https://nixos.org/hydra): the Nix-based continuous integration solution
-to build Android apps. An Android APK gets exposed as a build product and can be
-installed on any Android device with a web browser by navigating to the build
-result page.
-
 ## Spawning emulator instances {#spawning-emulator-instances}
 
 For testing purposes, it can also be quite convenient to automatically generate
@@ -349,3 +332,44 @@ To update the expressions run the `generate.sh` script that is stored in the
 ```bash
 ./generate.sh
 ```
+
+## Building an Android application with Ant {#building-an-android-application-with-ant}
+
+In addition to the SDK, it is also possible to build an Ant-based Android
+project and automatically deploy all the Android plugins that a project
+requires. Most newer Android projects use Gradle, and this is included for historical
+purposes.
+
+```nix
+with import <nixpkgs> {};
+
+androidenv.buildApp {
+  name = "MyAndroidApp";
+  src = ./myappsources;
+  release = true;
+
+  # If release is set to true, you need to specify the following parameters
+  keyStore = ./keystore;
+  keyAlias = "myfirstapp";
+  keyStorePassword = "mykeystore";
+  keyAliasPassword = "myfirstapp";
+
+  # Any Android SDK parameters that install all the relevant plugins that a
+  # build requires
+  platformVersions = [ "24" ];
+
+  # When we include the NDK, then ndk-build is invoked before Ant gets invoked
+  includeNDK = true;
+}
+```
+
+Aside from the app-specific build parameters (`name`, `src`, `release` and
+keystore parameters), the `buildApp {}` function supports all the function
+parameters that the SDK composition function (the function shown in the
+previous section) supports.
+
+This build function is particularly useful when it is desired to use
+[Hydra](https://nixos.org/hydra): the Nix-based continuous integration solution
+to build Android apps. An Android APK gets exposed as a build product and can be
+installed on any Android device with a web browser by navigating to the build
+result page.
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 7777df071b182..889d399749323 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -19,6 +19,8 @@
 
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
+- `androidenv.androidPkgs_9_0` has been removed, and replaced with `androidenv.androidPkgs` for a more complete Android SDK including support for Android 9 and later.
+
 - `nginx` package no longer includes `gd` and `geoip` dependencies. For enabling it, override `nginx` package with the optionals `withImageFilter` and `withGeoIP`.
 
 - `openssh` and `openssh_hpn` are now compiled without Kerberos 5 / GSSAPI support in an effort to reduce the attack surface of the components for the majority of users. Users needing this support can
@@ -35,6 +37,10 @@
 
 - `services.ddclient.use` has been deprecated: `ddclient` now supports separate IPv4 and IPv6 configuration. Use `services.ddclient.usev4` and `services.ddclient.usev6` instead.
 
+- `vaultwarden` lost the capability to bind to privileged ports. If you rely on
+   this behavior, override the systemd unit to allow `CAP_NET_BIND_SERVICE` in
+   your local configuration.
+
 - The Invoiceplane module now only accepts the structured `settings` option.
   `extraConfig` is now removed.
 
@@ -67,6 +73,10 @@
   services.portunus.ldap.package = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };
   ```
 
+- The `tracy` package no longer works on X11, since it's moved to Wayland
+  support, which is the intended default behavior by Tracy maintainers.
+  X11 users have to switch to the new package `tracy-x11`.
+
 ## Other Notable Changes {#sec-release-24.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/programs/ydotool.nix b/nixos/modules/programs/ydotool.nix
index f639e9283de42..643a5d369f3fc 100644
--- a/nixos/modules/programs/ydotool.nix
+++ b/nixos/modules/programs/ydotool.nix
@@ -14,23 +14,32 @@ in
 
   options.programs.ydotool = {
     enable = lib.mkEnableOption ''
-      ydotoold system service and install ydotool.
-      Add yourself to the 'ydotool' group to be able to use it.
+      ydotoold system service and {command}`ydotool` for members of
+      {option}`programs.ydotool.group`.
     '';
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "ydotool";
+      description = ''
+        Group which users must be in to use {command}`ydotool`.
+      '';
+    };
   };
 
-  config = lib.mkIf cfg.enable {
-    users.groups.ydotool = { };
+  config = let
+    runtimeDirectory = "ydotoold";
+  in lib.mkIf cfg.enable {
+    users.groups."${config.programs.ydotool.group}" = { };
 
     systemd.services.ydotoold = {
       description = "ydotoold - backend for ydotool";
       wantedBy = [ "multi-user.target" ];
       partOf = [ "multi-user.target" ];
       serviceConfig = {
-        Group = "ydotool";
-        RuntimeDirectory = "ydotoold";
+        Group = config.programs.ydotool.group;
+        RuntimeDirectory = runtimeDirectory;
         RuntimeDirectoryMode = "0750";
-        ExecStart = "${lib.getExe' pkgs.ydotool "ydotoold"} --socket-path=/run/ydotoold/socket --socket-perm=0660";
+        ExecStart = "${lib.getExe' pkgs.ydotool "ydotoold"} --socket-path=${config.environment.variables.YDOTOOL_SOCKET} --socket-perm=0660";
 
         # hardening
 
@@ -76,7 +85,7 @@ in
     };
 
     environment.variables = {
-      YDOTOOL_SOCKET = "/run/ydotoold/socket";
+      YDOTOOL_SOCKET = "/run/${runtimeDirectory}/socket";
     };
     environment.systemPackages = with pkgs; [ ydotool ];
   };
diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index 33957be437b30..41f7de5d80fab 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -5,6 +5,8 @@ let
   user = config.users.users.vaultwarden.name;
   group = config.users.groups.vaultwarden.name;
 
+  StateDirectory = if lib.versionOlder config.system.stateVersion "24.11" then "bitwarden_rs" else "vaultwarden";
+
   # Convert name from camel case (e.g. disable2FARemember) to upper case snake case (e.g. DISABLE_2FA_REMEMBER).
   nameToEnvVar = name:
     let
@@ -23,7 +25,7 @@ let
       configEnv = lib.concatMapAttrs (name: value: lib.optionalAttrs (value != null) {
         ${nameToEnvVar name} = if lib.isBool value then lib.boolToString value else toString value;
       }) cfg.config;
-    in { DATA_FOLDER = "/var/lib/bitwarden_rs"; } // lib.optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {
+    in { DATA_FOLDER = "/var/lib/${StateDirectory}"; } // lib.optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {
       WEB_VAULT_FOLDER = "${cfg.webVaultPackage}/share/vaultwarden/vault";
     } // configEnv;
 
@@ -176,16 +178,45 @@ in {
         User = user;
         Group = group;
         EnvironmentFile = [ configFile ] ++ lib.optional (cfg.environmentFile != null) cfg.environmentFile;
-        ExecStart = "${vaultwarden}/bin/vaultwarden";
+        ExecStart = lib.getExe vaultwarden;
         LimitNOFILE = "1048576";
-        PrivateTmp = "true";
-        PrivateDevices = "true";
-        ProtectHome = "true";
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "noaccess";
         ProtectSystem = "strict";
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
-        StateDirectory = "bitwarden_rs";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        inherit StateDirectory;
         StateDirectoryMode = "0700";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
         Restart = "always";
+        UMask = "0077";
       };
       wantedBy = [ "multi-user.target" ];
     };
@@ -193,7 +224,7 @@ in {
     systemd.services.backup-vaultwarden = lib.mkIf (cfg.backupDir != null) {
       description = "Backup vaultwarden";
       environment = {
-        DATA_FOLDER = "/var/lib/bitwarden_rs";
+        DATA_FOLDER = "/var/lib/${StateDirectory}";
         BACKUP_FOLDER = cfg.backupDir;
       };
       path = with pkgs; [ sqlite ];
diff --git a/nixos/tests/vaultwarden.nix b/nixos/tests/vaultwarden.nix
index 3aba3f6845fa7..baefa67dbf535 100644
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@@ -34,7 +34,7 @@ let
       driver = Firefox(options=options)
 
       driver.implicitly_wait(20)
-      driver.get('http://localhost/#/register')
+      driver.get('http://localhost:8080/#/register')
 
       wait = WebDriverWait(driver, 10)
 
@@ -134,11 +134,11 @@ let
             dbBackend = backend;
             config = {
               rocketAddress = "0.0.0.0";
-              rocketPort = 80;
+              rocketPort = 8080;
             };
           };
 
-          networking.firewall.allowedTCPPorts = [ 80 ];
+          networking.firewall.allowedTCPPorts = [ 8080 ];
 
           environment.systemPackages = [ pkgs.firefox-unwrapped pkgs.geckodriver testRunner ];
         }
@@ -152,10 +152,10 @@ let
     testScript = if testScript != null then testScript else ''
       start_all()
       server.wait_for_unit("vaultwarden.service")
-      server.wait_for_open_port(80)
+      server.wait_for_open_port(8080)
 
       with subtest("configure the cli"):
-          client.succeed("bw --nointeraction config server http://server")
+          client.succeed("bw --nointeraction config server http://server:8080")
 
       with subtest("can't login to nonexistent account"):
           client.fail(
@@ -179,6 +179,9 @@ let
               timeout=60
           )
           assert password.strip() == "${storedPassword}"
+
+      with subtest("Check systemd unit hardening"):
+          server.log(server.succeed("systemd-analyze security vaultwarden.service | grep -v ✓"))
     '';
   });
 in
@@ -193,7 +196,7 @@ builtins.mapAttrs (k: v: makeVaultwardenTest k v) {
     testScript = ''
       start_all()
       server.wait_for_unit("vaultwarden.service")
-      server.wait_for_open_port(80)
+      server.wait_for_open_port(8080)
 
       with subtest("Set up vaultwarden"):
           server.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")
diff --git a/nixos/tests/ydotool.nix b/nixos/tests/ydotool.nix
index 818ac6f2d50de..45e3d27adeb49 100644
--- a/nixos/tests/ydotool.nix
+++ b/nixos/tests/ydotool.nix
@@ -1,115 +1,184 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    textInput = "This works.";
-    inputBoxText = "Enter input";
-    inputBox = pkgs.writeShellScript "zenity-input" ''
-      ${lib.getExe pkgs.gnome.zenity} --entry --text '${inputBoxText}:' > /tmp/output &
-    '';
-  in
-  {
-    name = "ydotool";
-
-    meta = {
-      maintainers = with lib.maintainers; [
-        OPNA2608
-        quantenzitrone
-      ];
-    };
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../.. { inherit system config; },
+  lib ? pkgs.lib,
+}:
+let
+  makeTest = import ./make-test-python.nix;
+  textInput = "This works.";
+  inputBoxText = "Enter input";
+  inputBox = pkgs.writeShellScript "zenity-input" ''
+    ${lib.getExe pkgs.gnome.zenity} --entry --text '${inputBoxText}:' > /tmp/output &
+  '';
+  asUser = ''
+    def as_user(cmd: str):
+        """
+        Return a shell command for running a shell command as a specific user.
+        """
+        return f"sudo -u alice -i {cmd}"
+  '';
+in
+{
+  headless = makeTest {
+    name = "headless";
 
-    nodes = {
-      headless =
-        { config, ... }:
-        {
-          imports = [ ./common/user-account.nix ];
+    enableOCR = true;
 
-          users.users.alice.extraGroups = [ "ydotool" ];
+    nodes.machine = {
+      imports = [ ./common/user-account.nix ];
 
-          programs.ydotool.enable = true;
+      users.users.alice.extraGroups = [ "ydotool" ];
 
-          services.getty.autologinUser = "alice";
-        };
+      programs.ydotool.enable = true;
 
-      x11 =
-        { config, ... }:
-        {
-          imports = [
-            ./common/user-account.nix
-            ./common/auto.nix
-            ./common/x11.nix
-          ];
+      services.getty.autologinUser = "alice";
+    };
 
-          users.users.alice.extraGroups = [ "ydotool" ];
+    testScript =
+      asUser
+      + ''
+        start_all()
 
-          programs.ydotool.enable = true;
+        machine.wait_for_unit("multi-user.target")
+        machine.wait_for_text("alice")
+        machine.succeed(as_user("ydotool type 'echo ${textInput} > /tmp/output'")) # text input
+        machine.succeed(as_user("ydotool key 28:1 28:0")) # text input
+        machine.screenshot("headless_input")
+        machine.wait_for_file("/tmp/output")
+        machine.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+      '';
 
-          test-support.displayManager.auto = {
-            enable = true;
-            user = "alice";
-          };
+    meta.maintainers = with lib.maintainers; [
+      OPNA2608
+      quantenzitrone
+    ];
+  };
 
-          services.xserver.windowManager.dwm.enable = true;
-          services.displayManager.defaultSession = lib.mkForce "none+dwm";
-        };
+  x11 = makeTest {
+    name = "x11";
 
-      wayland =
-        { config, ... }:
-        {
-          imports = [ ./common/user-account.nix ];
+    enableOCR = true;
 
-          services.cage = {
-            enable = true;
-            user = "alice";
-          };
+    nodes.machine = {
+      imports = [
+        ./common/user-account.nix
+        ./common/auto.nix
+        ./common/x11.nix
+      ];
 
-          programs.ydotool.enable = true;
+      users.users.alice.extraGroups = [ "ydotool" ];
 
-          services.cage.program = inputBox;
-        };
+      programs.ydotool.enable = true;
+
+      test-support.displayManager.auto = {
+        enable = true;
+        user = "alice";
+      };
+
+      services.xserver.windowManager.dwm.enable = true;
+      services.displayManager.defaultSession = lib.mkForce "none+dwm";
     };
 
+    testScript =
+      asUser
+      + ''
+        start_all()
+
+        machine.wait_for_x()
+        machine.execute(as_user("${inputBox}"))
+        machine.wait_for_text("${inputBoxText}")
+        machine.succeed(as_user("ydotool type '${textInput}'")) # text input
+        machine.screenshot("x11_input")
+        machine.succeed(as_user("ydotool mousemove -a 400 110")) # mouse input
+        machine.succeed(as_user("ydotool click 0xC0")) # mouse input
+        machine.wait_for_file("/tmp/output")
+        machine.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+      '';
+
+    meta.maintainers = with lib.maintainers; [
+      OPNA2608
+      quantenzitrone
+    ];
+  };
+
+  wayland = makeTest {
+    name = "wayland";
+
     enableOCR = true;
 
-    testScript =
-      { nodes, ... }:
-      ''
-        def as_user(cmd: str):
-          """
-          Return a shell command for running a shell command as a specific user.
-          """
-          return f"sudo -u alice -i {cmd}"
+    nodes.machine = {
+      imports = [ ./common/user-account.nix ];
+
+      services.cage = {
+        enable = true;
+        user = "alice";
+      };
+
+      programs.ydotool.enable = true;
+
+      services.cage.program = inputBox;
+    };
+
+    testScript = ''
+      start_all()
+
+      machine.wait_for_unit("graphical.target")
+      machine.wait_for_text("${inputBoxText}")
+      machine.succeed("ydotool type '${textInput}'") # text input
+      machine.screenshot("wayland_input")
+      machine.succeed("ydotool mousemove -a 100 100") # mouse input
+      machine.succeed("ydotool click 0xC0") # mouse input
+      machine.wait_for_file("/tmp/output")
+      machine.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+    '';
+
+    meta.maintainers = with lib.maintainers; [
+      OPNA2608
+      quantenzitrone
+    ];
+  };
+
+  customGroup =
+    let
+      name = "customGroup";
+      nodeName = "${name}Node";
+      insideGroupUsername = "ydotool-user";
+      outsideGroupUsername = "other-user";
+      groupName = "custom-group";
+    in
+    makeTest {
+      inherit name;
+
+      nodes."${nodeName}" = {
+        programs.ydotool = {
+          enable = true;
+          group = groupName;
+        };
+
+        users.users = {
+          "${insideGroupUsername}" = {
+            isNormalUser = true;
+            extraGroups = [ groupName ];
+          };
+          "${outsideGroupUsername}".isNormalUser = true;
+        };
+      };
 
+      testScript = ''
         start_all()
 
-        # Headless
-        headless.wait_for_unit("multi-user.target")
-        headless.wait_for_text("alice")
-        headless.succeed(as_user("ydotool type 'echo ${textInput} > /tmp/output'")) # text input
-        headless.succeed(as_user("ydotool key 28:1 28:0")) # text input
-        headless.screenshot("headless_input")
-        headless.wait_for_file("/tmp/output")
-        headless.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
-
-        # X11
-        x11.wait_for_x()
-        x11.execute(as_user("${inputBox}"))
-        x11.wait_for_text("${inputBoxText}")
-        x11.succeed(as_user("ydotool type '${textInput}'")) # text input
-        x11.screenshot("x11_input")
-        x11.succeed(as_user("ydotool mousemove -a 400 110")) # mouse input
-        x11.succeed(as_user("ydotool click 0xC0")) # mouse input
-        x11.wait_for_file("/tmp/output")
-        x11.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
-
-        # Wayland
-        wayland.wait_for_unit("graphical.target")
-        wayland.wait_for_text("${inputBoxText}")
-        wayland.succeed("ydotool type '${textInput}'") # text input
-        wayland.screenshot("wayland_input")
-        wayland.succeed("ydotool mousemove -a 100 100") # mouse input
-        wayland.succeed("ydotool click 0xC0") # mouse input
-        wayland.wait_for_file("/tmp/output")
-        wayland.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+        # Wait for service to start
+        ${nodeName}.wait_for_unit("multi-user.target")
+        ${nodeName}.wait_for_unit("ydotoold.service")
+
+        # Verify that user with the configured group can use the service
+        ${nodeName}.succeed("sudo --login --user=${insideGroupUsername} ydotool type 'Hello, World!'")
+
+        # Verify that user without the configured group can't use the service
+        ${nodeName}.fail("sudo --login --user=${outsideGroupUsername} ydotool type 'Hello, World!'")
       '';
-  }
-)
+
+      meta.maintainers = with lib.maintainers; [ l0b0 ];
+    };
+}
diff --git a/pkgs/applications/audio/famistudio/default.nix b/pkgs/applications/audio/famistudio/default.nix
index 3d7b0563ac222..b858edf29bca5 100644
--- a/pkgs/applications/audio/famistudio/default.nix
+++ b/pkgs/applications/audio/famistudio/default.nix
@@ -6,6 +6,7 @@
 , fetchFromGitHub
 , ffmpeg
 , glfw
+, libglvnd
 , libogg
 , libvorbis
 , makeWrapper
@@ -23,13 +24,13 @@ let
 in
 buildDotnetModule rec {
   pname = "famistudio";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "BleuBleu";
     repo = "FamiStudio";
     rev = "refs/tags/${version}";
-    hash = "sha256-ydEWLL05B86672j3MVo/90tgDHg8FJ2EZaesqrBZy4A=";
+    hash = "sha256-WYy/6cWQg3Ayok/eAdnvlWAvdcuhy/sdlWOVvaYcPkc=";
   };
 
   postPatch = let
@@ -89,6 +90,10 @@ buildDotnetModule rec {
   dotnet-sdk = dotnetCorePackages.sdk_7_0;
   dotnet-runtime = dotnetCorePackages.runtime_7_0;
 
+  runtimeDeps = lib.optionals stdenv.hostPlatform.isLinux [
+    libglvnd
+  ];
+
   executables = [ "FamiStudio" ];
 
   postInstall = ''
diff --git a/pkgs/applications/blockchains/ton/default.nix b/pkgs/applications/blockchains/ton/default.nix
index 5c16de8597d2f..07be7664acba2 100644
--- a/pkgs/applications/blockchains/ton/default.nix
+++ b/pkgs/applications/blockchains/ton/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ton";
-  version = "2024.04";
+  version = "2024.06";
 
   src = fetchFromGitHub {
     owner = "ton-blockchain";
     repo = "ton";
     rev = "v${version}";
-    hash = "sha256-hh8D4IZX6RS/RXdhVONhgetqp89kpTC2IwDQ2KHdKsE=";
+    hash = "sha256-5fuRdVayvmM+yK1WsdtWlCZpxz7KKBs+ZRfnueP0Ny0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/editors/android-studio/common.nix b/pkgs/applications/editors/android-studio/common.nix
index f0863b771eba7..87b7a99833dec 100644
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@@ -1,7 +1,7 @@
 { channel, pname, version, sha256Hash }:
 
 { alsa-lib
-, bash
+, runtimeShell
 , buildFHSEnv
 , cacert
 , coreutils
@@ -65,6 +65,7 @@
 , zlib
 , makeDesktopItem
 , tiling_wm # if we are using a tiling wm, need to set _JAVA_AWT_WM_NONREPARENTING in wrapper
+, androidenv
 }:
 
 let
@@ -214,17 +215,52 @@ let
         '')
     ];
   };
-in runCommand
-  drvName
-  {
-    startScript = ''
-      #!${bash}/bin/bash
-      ${fhsEnv}/bin/${drvName}-fhs-env ${androidStudio}/bin/studio.sh "$@"
+  mkAndroidStudioWrapper = {androidStudio, androidSdk ? null}: runCommand drvName {
+    startScript = let
+      hasAndroidSdk = androidSdk != null;
+      androidSdkRoot = lib.optionalString hasAndroidSdk "${androidSdk}/libexec/android-sdk";
+    in ''
+      #!${runtimeShell}
+      ${lib.optionalString hasAndroidSdk ''
+        echo "=== nixpkgs Android Studio wrapper" >&2
+
+        # Default ANDROID_SDK_ROOT to the packaged one, if not provided.
+        ANDROID_SDK_ROOT="''${ANDROID_SDK_ROOT-${androidSdkRoot}}"
+
+        if [ -d "$ANDROID_SDK_ROOT" ]; then
+          export ANDROID_SDK_ROOT
+          # Legacy compatibility.
+          export ANDROID_HOME="$ANDROID_SDK_ROOT"
+          echo "  - ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT" >&2
+
+          # See if we can export ANDROID_NDK_ROOT too.
+          ANDROID_NDK_ROOT="$ANDROID_SDK_ROOT/ndk-bundle"
+          if [ ! -d "$ANDROID_NDK_ROOT" ]; then
+            ANDROID_NDK_ROOT="$(ls "$ANDROID_SDK_ROOT/ndk/"* 2>/dev/null | head -n1)"
+          fi
+
+          if [ -d "$ANDROID_NDK_ROOT" ]; then
+            export ANDROID_NDK_ROOT
+            echo "  - ANDROID_NDK_ROOT=$ANDROID_NDK_ROOT" >&2
+          else
+            unset ANDROID_NDK_ROOT
+          fi
+        else
+          unset ANDROID_SDK_ROOT
+          unset ANDROID_HOME
+        fi
+      ''}
+      exec ${fhsEnv}/bin/${drvName}-fhs-env ${androidStudio}/bin/studio.sh "$@"
     '';
     preferLocalBuild = true;
     allowSubstitutes = false;
-    passthru = {
+    passthru = let
+      withSdk = androidSdk: mkAndroidStudioWrapper { inherit androidStudio androidSdk; };
+    in {
       unwrapped = androidStudio;
+      full = withSdk androidenv.androidPkgs.androidsdk;
+      inherit withSdk;
+      sdk = androidSdk;
     };
     meta = with lib; {
       description = "Official IDE for Android (${channel} channel)";
@@ -245,9 +281,9 @@ in runCommand
       # source-code itself).
       platforms = [ "x86_64-linux" ];
       maintainers = with maintainers; rec {
-        stable = [ alapshin ];
-        beta = [ alapshin ];
-        canary = [ alapshin ];
+        stable = [ alapshin numinit ];
+        beta = [ alapshin numinit ];
+        canary = [ alapshin numinit ];
         dev = canary;
       }."${channel}";
       mainProgram = pname;
@@ -261,4 +297,5 @@ in runCommand
 
     ln -s ${androidStudio}/bin/studio.png $out/share/pixmaps/${pname}.png
     ln -s ${desktopItem}/share/applications $out/share/applications
-  ''
+  '';
+in mkAndroidStudioWrapper { inherit androidStudio; }
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 4e28f0750e49d..1c2402f6495b3 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -5,7 +5,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.11.36";
+  version = "3.11.37";
   pyproject = true;
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6WZALdKORsa0wahPKgkpzjlktJQxnbiiJLXGv3E9MXM=";
+    hash = "sha256-bZd/iLEGF5+Zt4kKAvUmjHiPKA1v1FWf5/BEcsLy9MU=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/video/kodi/addons/formula1/default.nix b/pkgs/applications/video/kodi/addons/formula1/default.nix
new file mode 100644
index 0000000000000..0d374dc65be1b
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/formula1/default.nix
@@ -0,0 +1,29 @@
+{ lib, rel, buildKodiAddon, fetchzip, addonUpdateScript, requests }:
+
+buildKodiAddon rec {
+  pname = "formula1";
+  namespace = "plugin.video.formula1";
+  version = "2.0.2";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
+    sha256 = "sha256-aClAgkJKvixeKzrwgEsfDhPXiFv9+ULLmb8c9QTaUgM=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  passthru = {
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.formula1";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/jaylinski/kodi-addon-formula1";
+    description = "Videos from the Formula 1 website";
+    license = licenses.mit;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/applications/video/kodi/addons/infotagger/default.nix b/pkgs/applications/video/kodi/addons/infotagger/default.nix
index da4528ed0afc5..7ac5e48071073 100644
--- a/pkgs/applications/video/kodi/addons/infotagger/default.nix
+++ b/pkgs/applications/video/kodi/addons/infotagger/default.nix
@@ -2,13 +2,13 @@
 buildKodiAddon rec {
   pname = "infotagger";
   namespace = "script.module.infotagger";
-  version = "0.0.7";
+  version = "0.0.8";
 
   src = fetchFromGitHub {
     owner = "jurialmunkey";
     repo = namespace;
     rev = "v${version}";
-    hash = "sha256-Us7ud0QORGn+ALB4uyISekp0kUYY8nN8uFNg8MlxEB0=";
+    hash = "sha256-Ns1OjrYLKz4znXRxqUErDLcmC0HBjBFVYI9GFqDVurY=";
   };
 
   passthru = {
diff --git a/pkgs/applications/video/kodi/addons/plugin-cache/default.nix b/pkgs/applications/video/kodi/addons/plugin-cache/default.nix
new file mode 100644
index 0000000000000..c21f5e136e41e
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/plugin-cache/default.nix
@@ -0,0 +1,26 @@
+{ lib, rel, buildKodiAddon, fetchzip, addonUpdateScript }:
+
+buildKodiAddon rec {
+  pname = "plugin-cache";
+  namespace = "script.common.plugin.cache";
+  version = "3.0.0";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
+    sha256 = "sha256-5QcMNmWOEw2C26OXlvAvxqDxTpjIMBhwmaIFwVgHuIU=";
+  };
+
+  passthru = {
+    pythonPath = "resources/lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.plugin-cache";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/anxdpanic/script.common.plugin.cache";
+    description = "Common plugin cache";
+    license = licenses.gpl3Only;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/applications/video/kodi/addons/simplecache/default.nix b/pkgs/applications/video/kodi/addons/simplecache/default.nix
new file mode 100644
index 0000000000000..35c2cc5a1a336
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/simplecache/default.nix
@@ -0,0 +1,26 @@
+{ lib, rel, buildKodiAddon, fetchzip, addonUpdateScript }:
+
+buildKodiAddon rec {
+  pname = "simplecache";
+  namespace = "script.module.simplecache";
+  version = "2.0.2";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
+    sha256 = "sha256-xdOBIi99nspcDIKkjxcW1r/BqL8O9NxdDViTuvMtUmo=";
+  };
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.simplecache";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/kodi-community-addons/script.module.simplecache";
+    description = "A simple object cache for Kodi addons";
+    license = licenses.asl20;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/applications/video/kodi/addons/upnext/default.nix b/pkgs/applications/video/kodi/addons/upnext/default.nix
new file mode 100644
index 0000000000000..dccfce4c3f0f6
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/upnext/default.nix
@@ -0,0 +1,26 @@
+{ lib, rel, buildKodiAddon, fetchzip, addonUpdateScript }:
+
+buildKodiAddon rec {
+  pname = "upnext";
+  namespace = "service.upnext";
+  version = "1.1.9+matrix.1";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
+    sha256 = "sha256-oNUk80MEzK6Qssn1KjT6psPTazISRoUif1IMo+BKJxo=";
+  };
+
+  passthru = {
+    pythonPath = "resources/lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.upnext";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/im85288/service.upnext";
+    description = "Up Next - Proposes to play the next episode automatically";
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/by-name/ay/ayatana-indicator-session/package.nix b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
index d2a5860098b4c..7a625b94eb499 100644
--- a/pkgs/by-name/ay/ayatana-indicator-session/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ayatana-indicator-session";
-  version = "24.2.0";
+  version = "24.5.0";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = "ayatana-indicator-session";
     rev = finalAttrs.version;
-    hash = "sha256-XHJhzL7B+4FnUHbsJVywELoY7xxG19RRryaPYZVao1I=";
+    hash = "sha256-p4nu7ZgnEjnnxNqyZIg//YcssnQcCY7GFDbpGIu1dz0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/di/dissent/package.nix b/pkgs/by-name/di/dissent/package.nix
index fdcc4ad37ce41..f3c0f81133888 100644
--- a/pkgs/by-name/di/dissent/package.nix
+++ b/pkgs/by-name/di/dissent/package.nix
@@ -1,16 +1,10 @@
 { buildGoModule
-, cairo
 , fetchFromGitHub
-, gdk-pixbuf
-, glib
 , gobject-introspection
-, graphene
 , gst_all_1
-, gtk4
 , lib
 , libadwaita
 , libcanberra-gtk3
-, pango
 , pkg-config
 , sound-theme-freedesktop
 , wrapGAppsHook4
@@ -18,13 +12,13 @@
 
 buildGoModule rec {
   pname = "dissent";
-  version = "0.0.24";
+  version = "0.0.25";
 
   src = fetchFromGitHub {
     owner = "diamondburned";
     repo = "dissent";
     rev = "v${version}";
-    hash = "sha256-XoppHkKQhWZbqVIViGIV0e0W/NhZW0v6ufmXlVtmzvI=";
+    hash = "sha256-ysI7zgducK52XbSzsaCnffSC9BRd/aaybMif/GkkhcI=";
   };
 
   nativeBuildInputs = [
@@ -34,34 +28,31 @@ buildGoModule rec {
   ];
 
   buildInputs = [
-    cairo
-    gdk-pixbuf
-    glib
-    graphene
-    gtk4
-    pango
     # Optional according to upstream but required for sound and video
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-ugly
     gst_all_1.gstreamer
+    libadwaita
     libcanberra-gtk3
     sound-theme-freedesktop
-    libadwaita
   ];
 
   postInstall = ''
     install -D -m 444 -t $out/share/applications nix/so.libdb.dissent.desktop
-    install -D -m 444 internal/icons/hicolor/scalable/apps/so.libdb.dissent.svg $out/share/icons/hicolor/scalable/apps/so.libdb.dissent.svg
+    install -D -m 444 -t $out/share/icons/hicolor/scalable/apps internal/icons/hicolor/scalable/apps/so.libdb.dissent.svg
+    install -D -m 444 -t $out/share/icons/hicolor/symbolic/apps internal/icons/symbolic/apps/so.libdb.dissent-symbolic.svg
+    install -D -m 444 -t $out/share/metainfo so.libdb.dissent.metainfo.xml
+    install -D -m 444 -t $out/share/dbus-1/services nix/so.libdb.dissent.service
   '';
 
-  vendorHash = "sha256-8/k9auM7+rceV26f3pNjEK1trzzAM530CX008pLZ1OA=";
+  vendorHash = "sha256-qBgj3h+WKWxVahRXyO/w2zGY4UCVkjP7XKFk/9GOFqs=";
 
   meta = with lib; {
-    description = "GTK4 Discord client in Go, attempt #4 (formerly gtkcord4)";
+    description = "A third-party Discord client designed for a smooth, native experience (formerly gtkcord4)";
     homepage = "https://github.com/diamondburned/dissent";
-    license = licenses.gpl3Only;
+    license = with licenses; [ gpl3Plus cc0 ];
     mainProgram = "dissent";
     maintainers = with maintainers; [ hmenke urandom aleksana ];
   };
diff --git a/pkgs/by-name/dt/dtools/package.nix b/pkgs/by-name/dt/dtools/package.nix
index feb4dc740b80a..8db3a14cf6173 100644
--- a/pkgs/by-name/dt/dtools/package.nix
+++ b/pkgs/by-name/dt/dtools/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dtools";
-  version = "2.108.0";
+  version = "2.109.0";
 
   src = fetchFromGitHub {
     owner = "dlang";
     repo = "tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YEBUgJPG/+WN4MnQUNAVftZM0ULxZZzpHoOozXua46U=";
+    hash = "sha256-C4hSs4zsFC8hWkhmDmNzVfK7Ctfnd1IQUphibUPiVzE=";
     name = "dtools";
   };
 
diff --git a/pkgs/by-name/me/meletrix-udev-rules/meletrix.rules b/pkgs/by-name/me/meletrix-udev-rules/meletrix.rules
new file mode 100644
index 0000000000000..fc7cafd1e563f
--- /dev/null
+++ b/pkgs/by-name/me/meletrix-udev-rules/meletrix.rules
@@ -0,0 +1,26 @@
+# Download VIA jsons from https://drive.google.com/drive/folders/1ky4kmGxZo1i0WyRZiY9V6FQlGzjegcPk for USB vendor and product ids
+
+# Zoom 65 Olivia Wired
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="806c", ATTRS{idProduct}=="0005", MODE:="0660", GROUP="input"
+
+# Zoom 65 EE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1ea7", ATTRS{idProduct}=="7777", MODE:="0660", GROUP="input"
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1ea7", ATTRS{idProduct}=="cc65", MODE:="0660", GROUP="input"
+
+# Zoom 65 V2
+# also 1ea7:7777
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1ea7", ATTRS{idProduct}=="ccbb", MODE:="0660", GROUP="input"
+
+# Zoom 65 V2.5
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1ea7", ATTRS{idProduct}=="ccc3", MODE:="0660", GROUP="input"
+
+# Zoom 75 (production unit)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1ea7", ATTRS{idProduct}=="ced3", MODE:="0660", GROUP="input"
+
+# Zoom 75 (prototype)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1ea7", ATTRS{idProduct}=="ce81", MODE:="0660", GROUP="input"
+
+# ZoomTKL
+# also 1ea7:7777
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1ea7", ATTRS{idProduct}=="cd87", MODE:="0660", GROUP="input"
+
diff --git a/pkgs/by-name/me/meletrix-udev-rules/package.nix b/pkgs/by-name/me/meletrix-udev-rules/package.nix
new file mode 100644
index 0000000000000..43fd2b94cdd5b
--- /dev/null
+++ b/pkgs/by-name/me/meletrix-udev-rules/package.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  stdenvNoCC,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "meletrix-udev-rules";
+  version = "0-unstable-2023-10-20";
+
+  src = [./meletrix.rules];
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    install -Dpm644 $src $out/lib/udev/rules.d/70-meletrix.rules
+  '';
+
+  meta = with lib; {
+    description = "udev rules to configure Meletrix keyboards";
+    license = licenses.cc0;
+    maintainers = with maintainers; [Scrumplex];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/tools/tracy/0001-remove-unifiedtypeidentifiers-framework b/pkgs/by-name/tr/tracy/0001-remove-unifiedtypeidentifiers-framework
index 0dc5a7eb68f16..0dc5a7eb68f16 100644
--- a/pkgs/development/tools/tracy/0001-remove-unifiedtypeidentifiers-framework
+++ b/pkgs/by-name/tr/tracy/0001-remove-unifiedtypeidentifiers-framework
diff --git a/pkgs/development/tools/tracy/default.nix b/pkgs/by-name/tr/tracy/package.nix
index 63df201f16193..82d4b9c285b82 100644
--- a/pkgs/development/tools/tracy/default.nix
+++ b/pkgs/by-name/tr/tracy/package.nix
@@ -10,6 +10,10 @@
 , hicolor-icon-theme
 , pkg-config
 , tbb
+
+, withWayland ? stdenv.isLinux
+, libxkbcommon
+, wayland
 }:
 
 stdenv.mkDerivation rec {
@@ -33,6 +37,9 @@ stdenv.mkDerivation rec {
     capstone
     freetype
     glfw
+  ] ++ lib.optionals (stdenv.isLinux && withWayland) [
+    libxkbcommon
+    wayland
   ] ++ lib.optionals stdenv.isLinux [
     dbus
     hicolor-icon-theme
@@ -60,7 +67,8 @@ stdenv.mkDerivation rec {
     make -j $NIX_BUILD_CORES -C csvexport/build/unix release
     make -j $NIX_BUILD_CORES -C import-chrome/build/unix release
     make -j $NIX_BUILD_CORES -C library/unix release
-    make -j $NIX_BUILD_CORES -C profiler/build/unix release LEGACY=1
+    make -j $NIX_BUILD_CORES -C profiler/build/unix release \
+      ${lib.optionalString (stdenv.isLinux && !withWayland) "LEGACY=1"}
     make -j $NIX_BUILD_CORES -C update/build/unix release
 
     runHook postBuild
diff --git a/pkgs/by-name/wx/wxc/package.nix b/pkgs/by-name/wx/wxc/package.nix
new file mode 100644
index 0000000000000..42de45ecfcf17
--- /dev/null
+++ b/pkgs/by-name/wx/wxc/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitea
+, cmake
+, libGL
+, wxGTK32
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wxc";
+  version = "1.0.0.2";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "wxHaskell";
+    repo = "wxHaskell";
+    rev = "wxc-${finalAttrs.version}";
+    hash = "sha256-wjby7F+Xi+H4avLGZxKJ7/LY2CJAGMIwBM7mfVzI1Bg=";
+  };
+
+  sourceRoot = finalAttrs.src.name + "/wxc";
+
+  nativeBuildInputs = [
+    cmake
+    wxGTK32 # in nativeBuildInputs because of wx-config
+  ];
+
+  buildInputs = [
+    libGL
+  ];
+
+  preConfigure = ''
+    bash generate-version-header.sh
+  '';
+
+  meta = {
+    description = "C language binding for wxWidgets";
+    homepage = "https://wiki.haskell.org/WxHaskell";
+    license = lib.licenses.wxWindows;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = wxGTK32.meta.platforms;
+  };
+})
diff --git a/pkgs/common-updater/unstable-updater.nix b/pkgs/common-updater/unstable-updater.nix
index d7a9c73fbc2d6..e6981f633534b 100644
--- a/pkgs/common-updater/unstable-updater.nix
+++ b/pkgs/common-updater/unstable-updater.nix
@@ -14,7 +14,7 @@
 
 { url ? null # The git url, if empty it will be set to src.gitRepoUrl
 , branch ? null
-, hardcodeZeroVersion ? false # Use a made-up version "0" instead of latest tag. Use when there is no previous release, or the project's tagging system is incompatible with what we expect from versions
+, hardcodeZeroVersion ? false # Use a made-up version "0" instead of latest tag. Use when the project's tagging system is incompatible with what we expect from versions
 , tagFormat ? "*" # A `git describe --tags --match '<format>'` pattern that tags must match to be considered
 , tagPrefix ? null # strip this prefix from a tag name
 , tagConverter ? null # A command to convert more complex tag formats. It receives the git tag via stdin and should convert it into x.y.z format to stdout
diff --git a/pkgs/desktops/lomiri/data/lomiri-session/1001-Unset-QT_QPA_PLATFORMTHEME.patch b/pkgs/desktops/lomiri/data/lomiri-session/1001-Unset-QT_QPA_PLATFORMTHEME.patch
new file mode 100644
index 0000000000000..8edf093d4ed34
--- /dev/null
+++ b/pkgs/desktops/lomiri/data/lomiri-session/1001-Unset-QT_QPA_PLATFORMTHEME.patch
@@ -0,0 +1,33 @@
+From 30b5391c3f20180fe7427fe179ba26f846200d96 Mon Sep 17 00:00:00 2001
+From: OPNA2608 <opna2608@protonmail.com>
+Date: Mon, 3 Jun 2024 20:50:03 +0200
+Subject: [PATCH] Unset QT_QPA_PLATFORMTHEME
+
+gtk3 value breaks Lomiri startup
+---
+ lomiri-session | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lomiri-session b/lomiri-session
+index 9d68249..b103840 100755
+--- a/lomiri-session
++++ b/lomiri-session
+@@ -47,6 +47,7 @@ fi
+ 
+ # Set some envs
+ export QT_QPA_PLATFORM=wayland
++export QT_QPA_PLATFORMTHEME=
+ export QT_IM_MODULE=maliit
+ export MALIIT_FORCE_DBUS_CONNECTION=1
+ export UITK_ICON_THEME=suru
+@@ -55,6 +56,7 @@ dbus-update-activation-environment --systemd MALIIT_FORCE_DBUS_CONNECTION=1
+ dbus-update-activation-environment --systemd QT_IM_MODULE=maliit
+ dbus-update-activation-environment --systemd GTK_IM_MODULE=maliit
+ dbus-update-activation-environment --systemd QT_QPA_PLATFORM=wayland
++dbus-update-activation-environment --systemd QT_QPA_PLATFORMTHEME=
+ dbus-update-activation-environment --systemd SDL_VIDEODRIVER=wayland
+ dbus-update-activation-environment --systemd QT_WAYLAND_DISABLE_WINDOWDECORATION=1
+ dbus-update-activation-environment --systemd QT_ACCESSIBILITY=1
+-- 
+2.44.1
+
diff --git a/pkgs/desktops/lomiri/data/lomiri-session/default.nix b/pkgs/desktops/lomiri/data/lomiri-session/default.nix
index c62e4ab572bd8..351aed9de8241 100644
--- a/pkgs/desktops/lomiri/data/lomiri-session/default.nix
+++ b/pkgs/desktops/lomiri/data/lomiri-session/default.nix
@@ -135,6 +135,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       excludes = [ "systemd/lomiri.service" ];
       hash = "sha256-BICb6ZwU/sUBzmM4udsOndIgw1A03I/UEG000YvMZ9Y=";
     })
+
+    ./1001-Unset-QT_QPA_PLATFORMTHEME.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 82a9d63ab3300..d3b823215c52f 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -17,29 +17,32 @@
     then null
     else pkgs.bintools
 , darwin
-}:
+}@args:
 
 let
-  release_version = "12.0.1";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
-  version = "${release_version}${dash-candidate}"; # differentiating these (variables) is important for RCs
 
-  fetch = name: sha256: fetchurl {
-    url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${version}/${name}-${release_version}${candidate}.src.tar.xz";
-    inherit sha256;
+  metadata = rec {
+    release_version = "12.0.1";
+    version = "${release_version}${dash-candidate}"; # differentiating these (variables) is important for RCs
+    inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
+    fetch = name: sha256: fetchurl {
+      url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${metadata.version}/${name}-${metadata.release_version}${candidate}.src.tar.xz";
+      inherit sha256;
+    };
+    clang-tools-extra_src = fetch "clang-tools-extra" "1r9a4fdz9ci58b5z2inwvm4z4cdp6scrivnaw05dggkxz7yrwrb5";
   };
 
-  clang-tools-extra_src = fetch "clang-tools-extra" "1r9a4fdz9ci58b5z2inwvm4z4cdp6scrivnaw05dggkxz7yrwrb5";
+  inherit (metadata) fetch;
 
-  inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
+    callPackage = newScope (tools // args // metadata);
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
+      ln -s "${cc.lib}/lib/clang/${metadata.release_version}/include" "$rsrc"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
     '';
     mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
@@ -104,7 +107,6 @@ let
       pollyPatches = [
         ./llvm/gnu-install-dirs-polly.patch
       ];
-      inherit llvm_meta;
     };
 
     # `llvm` historically had the binaries.  When choosing an output explicitly,
@@ -122,7 +124,6 @@ let
           libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
-      inherit clang-tools-extra_src llvm_meta;
     };
 
     clang-unwrapped = tools.libclang;
@@ -175,7 +176,6 @@ let
       patches = [
         ./lld/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
       inherit (libraries) libunwind;
     };
 
@@ -196,7 +196,6 @@ let
           resourceDirPatch
           ./lldb/gnu-install-dirs.patch
         ];
-      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -287,7 +286,7 @@ let
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
   in {
 
     compiler-rt-libc = callPackage ../common/compiler-rt {
@@ -306,7 +305,6 @@ let
         ../common/compiler-rt/armv6-sync-ops-no-thumb.patch
         ../common/compiler-rt/armv6-no-ldrexd-strexd.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
@@ -328,7 +326,6 @@ let
         ../common/compiler-rt/armv6-sync-ops-no-thumb.patch
         ../common/compiler-rt/armv6-no-ldrexd-strexd.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
@@ -347,7 +344,7 @@ let
       src = fetchFromGitHub {
         owner = "llvm";
         repo = "llvm-project";
-        rev = "refs/tags/llvmorg-${version}";
+        rev = "refs/tags/llvmorg-${metadata.version}";
         sparseCheckout = [
           "libcxx"
           "libcxxabi"
@@ -372,7 +369,6 @@ let
           ];
         })
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -381,7 +377,6 @@ let
       patches = [
         ./libunwind/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -394,9 +389,8 @@ let
           hash = "sha256-UxIlAifXnexF/MaraPW0Ut6q+sf3e7y1fMdEv1q103A=";
         })
       ];
-      inherit llvm_meta targetLlvm;
     };
   });
   noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 
-in { inherit tools libraries release_version; } // (noExtend libraries) // (noExtend tools)
+in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index 9348e19e6de39..0b231a91512b8 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -41,7 +41,7 @@
 # specified.
 , monorepoSrc ? null
 
-}:
+}@args:
 
 assert
   lib.assertMsg
@@ -53,19 +53,23 @@ assert
 let
   monorepoSrc' = monorepoSrc;
 in let
-  # Import releaseInfo separately to avoid infinite recursion
-  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-  inherit (releaseInfo) release_version version;
-  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
-
-  src = monorepoSrc;
+  metadata = rec {
+    # Import releaseInfo separately to avoid infinite recursion
+    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+    inherit (releaseInfo) release_version version;
+    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+    src = monorepoSrc;
+  };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version src buildLlvmTools; });
+    callPackage = newScope (tools // args // metadata
+      # Previously monorepoSrc was erroneously not being passed through.
+      // { monorepoSrc = null; } # Preserve a bug during #307211, TODO: remove; causes llvm 13 rebuild.
+    );
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
+      ln -s "${cc.lib}/lib/clang/${metadata.release_version}/include" "$rsrc"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
     '';
     mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
@@ -125,7 +129,6 @@ in let
       pollyPatches = [
         ./llvm/gnu-install-dirs-polly.patch
       ];
-      inherit llvm_meta;
     };
 
     # `llvm` historically had the binaries.  When choosing an output explicitly,
@@ -148,7 +151,6 @@ in let
           libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
-      inherit llvm_meta;
     };
 
     clang-unwrapped = tools.libclang;
@@ -199,7 +201,6 @@ in let
       patches = [
         ./lld/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
     };
 
     lldb = callPackage ../common/lldb.nix {
@@ -232,7 +233,6 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -323,7 +323,10 @@ in let
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version src; });
+    callPackage = newScope (libraries // buildLlvmTools // args // metadata
+      # Previously monorepoSrc was erroneously not being passed through.
+      // { monorepoSrc = null; } # Preserve a bug during #307211, TODO: remove; causes llvm 13 rebuild.
+    );
   in {
 
     compiler-rt-libc = callPackage ../common/compiler-rt {
@@ -344,7 +347,6 @@ in let
         ../common/compiler-rt/armv6-scudo-no-yield.patch
         ../common/compiler-rt/armv6-scudo-libatomic.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
@@ -368,7 +370,6 @@ in let
         ../common/compiler-rt/armv6-scudo-no-yield.patch
         ../common/compiler-rt/armv6-scudo-libatomic.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
@@ -399,16 +400,15 @@ in let
           ];
         })
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-      monorepoSrc = src;
+      # TODO: remove this, causes LLVM 13 packages rebuild.
+      inherit (metadata) monorepoSrc; # Preserve bug during #307211 refactor.
     };
 
     libunwind = callPackage ../common/libunwind {
       patches = [
         ./libunwind/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -420,9 +420,8 @@ in let
           hash = "sha256-UxIlAifXnexF/MaraPW0Ut6q+sf3e7y1fMdEv1q103A=";
         })
       ];
-      inherit llvm_meta targetLlvm;
     };
   });
   noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 
-in { inherit tools libraries release_version; } // (noExtend libraries) // (noExtend tools)
+in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index f7368050d6149..a80b3aa4ffff7 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -39,7 +39,7 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
-}:
+}@args:
 
 assert
   lib.assertMsg
@@ -51,17 +51,20 @@ assert
 let
   monorepoSrc' = monorepoSrc;
 in let
-  # Import releaseInfo separately to avoid infinite recursion
-  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-  inherit (releaseInfo) release_version version;
-  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+
+  metadata = rec {
+    # Import releaseInfo separately to avoid infinite recursion
+    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+    inherit (releaseInfo) release_version version;
+    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
+    callPackage = newScope (tools // args // metadata);
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
+      ln -s "${cc.lib}/lib/clang/${metadata.release_version}/include" "$rsrc"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
     '';
     mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
@@ -100,7 +103,6 @@ in let
       pollyPatches = [
         ./llvm/gnu-install-dirs-polly.patch
       ];
-      inherit llvm_meta;
     };
 
     # `llvm` historically had the binaries.  When choosing an output explicitly,
@@ -118,7 +120,6 @@ in let
           libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
-      inherit llvm_meta;
     };
 
     clang-unwrapped = tools.libclang;
@@ -170,7 +171,6 @@ in let
         ./lld/gnu-install-dirs.patch
         ./lld/fix-root-src-dir.patch
       ];
-      inherit llvm_meta;
     };
 
     lldb = callPackage ../common/lldb.nix {
@@ -203,7 +203,6 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -296,7 +295,7 @@ in let
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
   in {
 
     compiler-rt-libc = callPackage ../common/compiler-rt {
@@ -318,7 +317,6 @@ in let
         ../common/compiler-rt/armv6-scudo-no-yield.patch
         ../common/compiler-rt/armv6-scudo-libatomic.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
@@ -343,7 +341,6 @@ in let
         ../common/compiler-rt/armv6-scudo-no-yield.patch
         ../common/compiler-rt/armv6-scudo-libatomic.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
@@ -374,7 +371,6 @@ in let
           ];
         })
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -382,7 +378,6 @@ in let
       patches = [
         ./libunwind/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -391,9 +386,8 @@ in let
         ./openmp/gnu-install-dirs.patch
         ./openmp/run-lit-directly.patch
       ];
-      inherit llvm_meta targetLlvm;
     };
   });
   noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 
-in { inherit tools libraries release_version; } // (noExtend libraries) // (noExtend tools)
+in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index 5003ef32d1ee0..e30e9f9a59db7 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -39,7 +39,7 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
-}:
+}@args:
 
 assert
   lib.assertMsg
@@ -51,10 +51,13 @@ assert
 let
   monorepoSrc' = monorepoSrc;
 in let
-  # Import releaseInfo separately to avoid infinite recursion
-  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-  inherit (releaseInfo) release_version version;
-  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+
+  metadata = rec {
+    # Import releaseInfo separately to avoid infinite recursion
+    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+    inherit (releaseInfo) release_version version;
+    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  };
 
   lldbPlugins = lib.makeExtensible (lldbPlugins: let
     callPackage = newScope (lldbPlugins // { inherit stdenv; inherit (tools) lldb; });
@@ -63,11 +66,11 @@ in let
   });
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
+    callPackage = newScope (tools // args // metadata);
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
+      ln -s "${cc.lib}/lib/clang/${metadata.release_version}/include" "$rsrc"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
     '';
     mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
@@ -144,7 +147,6 @@ in let
         # Just like the `llvm-lit-cfg` patch, but for `polly`.
         ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
       ];
-      inherit llvm_meta;
     };
 
     # `llvm` historically had the binaries.  When choosing an output explicitly,
@@ -162,7 +164,6 @@ in let
           libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
-      inherit llvm_meta;
     };
 
     clang-unwrapped = tools.libclang;
@@ -212,7 +213,6 @@ in let
       patches = [
         ./lld/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
     };
 
     lldb = callPackage ../common/lldb.nix {
@@ -245,7 +245,6 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -348,7 +347,7 @@ in let
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
   in {
 
     compiler-rt-libc = callPackage ../common/compiler-rt {
@@ -365,7 +364,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
@@ -385,7 +383,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
@@ -427,7 +424,6 @@ in let
           ];
         })
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -435,7 +431,6 @@ in let
       patches = [
         ./libunwind/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -445,9 +440,8 @@ in let
         ./openmp/gnu-install-dirs.patch
         ./openmp/run-lit-directly.patch
       ];
-      inherit llvm_meta targetLlvm;
     };
   });
   noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 
-in { inherit tools libraries release_version lldbPlugins; } // (noExtend libraries) // (noExtend tools)
+in { inherit tools libraries lldbPlugins; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 79d5f8589044c..426bcb4c46d88 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -39,7 +39,7 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
-}:
+}@args:
 
 assert
   lib.assertMsg
@@ -51,10 +51,13 @@ assert
 let
   monorepoSrc' = monorepoSrc;
 in let
-  # Import releaseInfo separately to avoid infinite recursion
-  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-  inherit (releaseInfo) release_version version;
-  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+
+  metadata = rec {
+    # Import releaseInfo separately to avoid infinite recursion
+    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+    inherit (releaseInfo) release_version version;
+    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  };
 
   lldbPlugins = lib.makeExtensible (lldbPlugins: let
     callPackage = newScope (lldbPlugins // { inherit stdenv; inherit (tools) lldb; });
@@ -63,8 +66,8 @@ in let
   });
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
-    major = lib.versions.major release_version;
+    callPackage = newScope (tools // args // metadata);
+    major = lib.versions.major metadata.release_version;
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -138,7 +141,6 @@ in let
         # Just like the `llvm-lit-cfg` patch, but for `polly`.
         ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
       ];
-      inherit llvm_meta;
     };
 
     # `llvm` historically had the binaries.  When choosing an output explicitly,
@@ -156,7 +158,6 @@ in let
           libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
-      inherit llvm_meta;
     };
 
     clang-unwrapped = tools.libclang;
@@ -206,15 +207,12 @@ in let
         ./lld/gnu-install-dirs.patch
         ./lld/add-table-base.patch
       ];
-      inherit llvm_meta;
     };
 
-    mlir = callPackage ../common/mlir {
-      inherit llvm_meta;
-    };
+    mlir = callPackage ../common/mlir {};
 
     lldb = callPackage ../common/lldb.nix {
-      src = callPackage ({ runCommand }: runCommand "lldb-src-${version}" {} ''
+      src = callPackage ({ runCommand }: runCommand "lldb-src-${metadata.version}" {} ''
         mkdir -p "$out"
         cp -r ${monorepoSrc}/cmake "$out"
         cp -r ${monorepoSrc}/lldb "$out"
@@ -248,7 +246,6 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -351,13 +348,11 @@ in let
     # Has to be in tools despite mostly being a library,
     # because we use a native helper executable from a
     # non-cross build in cross builds.
-    libclc = callPackage ../common/libclc.nix {
-      inherit buildLlvmTools;
-    };
+    libclc = callPackage ../common/libclc.nix {};
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
   in {
 
     compiler-rt-libc = callPackage ../common/compiler-rt {
@@ -374,7 +369,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         # ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
@@ -394,7 +388,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         # ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
@@ -413,7 +406,6 @@ in let
     # so: we use the clang from this LLVM package set instead of the regular
     # stdenv's compiler.
     libcxx = callPackage ../common/libcxx {
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -421,7 +413,6 @@ in let
       patches = [
         ./libunwind/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -431,9 +422,8 @@ in let
         ./openmp/gnu-install-dirs.patch
         ./openmp/run-lit-directly.patch
       ];
-      inherit llvm_meta targetLlvm;
     };
   });
   noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 
-in { inherit tools libraries release_version lldbPlugins; } // (noExtend libraries) // (noExtend tools)
+in { inherit tools libraries lldbPlugins; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/17/default.nix b/pkgs/development/compilers/llvm/17/default.nix
index b4039540badf4..a6d7f48eb800c 100644
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@@ -39,7 +39,7 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
-}:
+}@args:
 
 assert
   lib.assertMsg
@@ -51,15 +51,17 @@ assert
 let
   monorepoSrc' = monorepoSrc;
 in let
-  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
 
-  inherit (releaseInfo) release_version version;
-
-  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  metadata = rec {
+    # Import releaseInfo separately to avoid infinite recursion
+    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+    inherit (releaseInfo) release_version version;
+    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub gitRelease release_version officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
-    major = lib.versions.major release_version;
+    callPackage = newScope (tools // args // metadata);
+    major = lib.versions.major metadata.release_version;
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -133,7 +135,6 @@ in let
         # Just like the `llvm-lit-cfg` patch, but for `polly`.
         ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
       ];
-      inherit llvm_meta;
     };
 
     # `llvm` historically had the binaries.  When choosing an output explicitly,
@@ -151,7 +152,6 @@ in let
           libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
-      inherit llvm_meta;
     };
 
     clang-unwrapped = tools.libclang;
@@ -201,15 +201,12 @@ in let
         ./lld/gnu-install-dirs.patch
         ./lld/add-table-base.patch
       ];
-      inherit llvm_meta;
     };
 
-    mlir = callPackage ../common/mlir {
-      inherit llvm_meta;
-    };
+    mlir = callPackage ../common/mlir {};
 
     lldb = callPackage ../common/lldb.nix {
-      src = callPackage ({ runCommand }: runCommand "lldb-src-${version}" {} ''
+      src = callPackage ({ runCommand }: runCommand "lldb-src-${metadata.version}" {} ''
         mkdir -p "$out"
         cp -r ${monorepoSrc}/cmake "$out"
         cp -r ${monorepoSrc}/lldb "$out"
@@ -233,7 +230,6 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -336,13 +332,11 @@ in let
     # Has to be in tools despite mostly being a library,
     # because we use a native helper executable from a
     # non-cross build in cross builds.
-    libclc = callPackage ../common/libclc.nix {
-      inherit buildLlvmTools;
-    };
+    libclc = callPackage ../common/libclc.nix {};
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
   in {
 
     compiler-rt-libc = callPackage ../common/compiler-rt {
@@ -359,7 +353,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         # ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
@@ -379,7 +372,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         # ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
@@ -406,12 +398,10 @@ in let
           hash = "sha256-jo+DYA6zuSv9OH3A0bYwY5TlkWprup4OKQ7rfK1WHBI=";
         })
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
     libunwind = callPackage ../common/libunwind {
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -421,9 +411,8 @@ in let
         ./openmp/gnu-install-dirs.patch
         ./openmp/run-lit-directly.patch
       ];
-      inherit llvm_meta targetLlvm;
     };
   });
   noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 
-in { inherit tools libraries release_version; } // (noExtend libraries) // (noExtend tools)
+in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/18/default.nix b/pkgs/development/compilers/llvm/18/default.nix
index f74a92f61cdc1..d62ae9c820b21 100644
--- a/pkgs/development/compilers/llvm/18/default.nix
+++ b/pkgs/development/compilers/llvm/18/default.nix
@@ -39,7 +39,7 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
-}:
+}@args:
 
 assert
   lib.assertMsg
@@ -51,15 +51,17 @@ assert
 let
   monorepoSrc' = monorepoSrc;
 in let
-  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
 
-  inherit (releaseInfo) release_version version;
-
-  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  metadata = rec {
+    # Import releaseInfo separately to avoid infinite recursion
+    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+    inherit (releaseInfo) release_version version;
+    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub gitRelease release_version officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
-    major = lib.versions.major release_version;
+    callPackage = newScope (tools // args // metadata);
+    major = lib.versions.major metadata.release_version;
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -133,7 +135,6 @@ in let
         # Just like the `llvm-lit-cfg` patch, but for `polly`.
         ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
       ];
-      inherit llvm_meta;
     };
 
     # `llvm` historically had the binaries.  When choosing an output explicitly,
@@ -151,7 +152,6 @@ in let
           libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
-      inherit llvm_meta;
     };
 
     clang-unwrapped = tools.libclang;
@@ -200,15 +200,12 @@ in let
       patches = [
         ./lld/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
     };
 
-    mlir = callPackage ../common/mlir {
-      inherit llvm_meta;
-    };
+    mlir = callPackage ../common/mlir {};
 
     lldb = callPackage ../common/lldb.nix {
-      src = callPackage ({ runCommand }: runCommand "lldb-src-${version}" {} ''
+      src = callPackage ({ runCommand }: runCommand "lldb-src-${metadata.version}" {} ''
         mkdir -p "$out"
         cp -r ${monorepoSrc}/cmake "$out"
         cp -r ${monorepoSrc}/lldb "$out"
@@ -232,7 +229,6 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -335,13 +331,11 @@ in let
     # Has to be in tools despite mostly being a library,
     # because we use a native helper executable from a
     # non-cross build in cross builds.
-    libclc = callPackage ../common/libclc.nix {
-      inherit buildLlvmTools;
-    };
+    libclc = callPackage ../common/libclc.nix {};
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
   in {
 
     compiler-rt-libc = callPackage ../common/compiler-rt {
@@ -355,7 +349,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         # ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
@@ -372,7 +365,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         # ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
@@ -395,12 +387,10 @@ in let
         # https://github.com/llvm/llvm-project/issues/64226
         ./libcxx/0001-darwin-10.12-mbstate_t-fix.patch
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
     libunwind = callPackage ../common/libunwind {
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -409,9 +399,8 @@ in let
         ./openmp/fix-find-tool.patch
         ./openmp/run-lit-directly.patch
       ];
-      inherit llvm_meta targetLlvm;
     };
   });
   noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 
-in { inherit tools libraries release_version; } // (noExtend libraries) // (noExtend tools)
+in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index be8b1a54f2114..464c405dc0606 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -44,7 +44,7 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
-}:
+}@args:
 
 assert
   lib.assertMsg
@@ -56,15 +56,17 @@ assert
 let
   monorepoSrc' = monorepoSrc;
 in let
-  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
 
-  inherit (releaseInfo) release_version version;
-
-  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  metadata = rec {
+    # Import releaseInfo separately to avoid infinite recursion
+    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+    inherit (releaseInfo) release_version version;
+    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub gitRelease release_version officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+  };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
-    major = lib.versions.major release_version;
+    callPackage = newScope (tools // args // metadata);
+    major = lib.versions.major metadata.release_version;
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -138,7 +140,6 @@ in let
         # Just like the `llvm-lit-cfg` patch, but for `polly`.
         ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
       ];
-      inherit llvm_meta;
     };
 
     # `llvm` historically had the binaries.  When choosing an output explicitly,
@@ -156,7 +157,6 @@ in let
           libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
-      inherit llvm_meta;
     };
 
     clang-unwrapped = tools.libclang;
@@ -205,15 +205,12 @@ in let
       patches = [
         ./lld/gnu-install-dirs.patch
       ];
-      inherit llvm_meta;
     };
 
-    mlir = callPackage ../common/mlir {
-      inherit llvm_meta;
-    };
+    mlir = callPackage ../common/mlir {};
 
     lldb = callPackage ../common/lldb.nix {
-      src = callPackage ({ runCommand }: runCommand "lldb-src-${version}" {} ''
+      src = callPackage ({ runCommand }: runCommand "lldb-src-${metadata.version}" {} ''
         mkdir -p "$out"
         cp -r ${monorepoSrc}/cmake "$out"
         cp -r ${monorepoSrc}/lldb "$out"
@@ -237,7 +234,6 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -340,13 +336,11 @@ in let
     # Has to be in tools despite mostly being a library,
     # because we use a native helper executable from a
     # non-cross build in cross builds.
-    libclc = callPackage ../common/libclc.nix {
-      inherit buildLlvmTools;
-    };
+    libclc = callPackage ../common/libclc.nix {};
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
   in {
 
     compiler-rt-libc = callPackage ../common/compiler-rt {
@@ -360,7 +354,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         # ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
@@ -377,7 +370,6 @@ in let
         # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
         # ../common/compiler-rt/armv7l-15.patch
       ];
-      inherit llvm_meta;
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
@@ -400,12 +392,10 @@ in let
         # https://github.com/llvm/llvm-project/issues/64226
         ./libcxx/0001-darwin-10.12-mbstate_t-fix.patch
       ];
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
     libunwind = callPackage ../common/libunwind {
-      inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
@@ -414,9 +404,8 @@ in let
         ./openmp/fix-find-tool.patch
         ./openmp/run-lit-directly.patch
       ];
-      inherit llvm_meta targetLlvm;
     };
   });
   noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 
-in { inherit tools libraries release_version; } // (noExtend libraries) // (noExtend tools)
+in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/libraries/libbsd/default.nix b/pkgs/development/libraries/libbsd/default.nix
index 9e80d17b8a033..fa8b6b65950bc 100644
--- a/pkgs/development/libraries/libbsd/default.nix
+++ b/pkgs/development/libraries/libbsd/default.nix
@@ -35,6 +35,9 @@ stdenv.mkDerivation rec {
     url = "https://gitlab.freedesktop.org/libbsd/libbsd.git";
   };
 
+  # Fix undefined reference errors with version script under LLVM.
+  configureFlags = lib.optionals (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17") [ "LDFLAGS=-Wl,--undefined-version" ];
+
   meta = with lib; {
     description = "Common functions found on BSD systems";
     homepage = "https://libbsd.freedesktop.org/";
diff --git a/pkgs/development/libraries/libdvdnav/4.2.1.nix b/pkgs/development/libraries/libdvdnav/4.2.1.nix
index 5ee1d423fd3ff..852ab2ea73099 100644
--- a/pkgs/development/libraries/libdvdnav/4.2.1.nix
+++ b/pkgs/development/libraries/libdvdnav/4.2.1.nix
@@ -12,12 +12,31 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [libdvdread];
 
-  configureScript = "./configure2"; # wtf?
+  # The upstream supports two configuration workflow:
+  # one is to generate ./configure via `autoconf`,
+  # the other is to run ./configure2.
+  # ./configure2 is a configureation script included in the upstream source
+  # that supports common "--<name>" flags and generates config.mak and config.h.
+  # See INSTALL inside the upstream source for detail.
+  configureScript = "./configure2";
+
+  configureFlags = [
+    "--cc=${stdenv.cc.targetPrefix}cc"
+    # Let's strip the binaries ourselves,
+    # as unprefixed `strip` command is not available during cross compilation.
+    "--disable-strip"
+  ];
 
   preConfigure = ''
     mkdir -p $out
   '';
 
+  makeFlags = [
+    "AR=${stdenv.cc.targetPrefix}ar"
+    "LD=${stdenv.cc.targetPrefix}ld"
+    "RANLIB=${stdenv.cc.targetPrefix}ranlib"
+  ];
+
   meta = {
     homepage = "http://dvdnav.mplayerhq.hu/";
     description = "Library that implements DVD navigation features such as DVD menus";
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 985ef9a8e23de..72dc64a7e0c22 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -11,8 +11,8 @@
 , platformVersions ? []
 , includeSources ? false
 , includeSystemImages ? false
-, systemImageTypes ? [ "google_apis_playstore" ]
-, abiVersions ? [ "armeabi-v7a" "arm64-v8a" ]
+, systemImageTypes ? [ "google_apis" "google_apis_playstore" ]
+, abiVersions ? [ "x86" "x86_64" "armeabi-v7a" "arm64-v8a" ]
 , cmakeVersions ? [ ]
 , includeNDK ? false
 , ndkVersion ? "26.3.11579264"
diff --git a/pkgs/development/mobile/androidenv/default.nix b/pkgs/development/mobile/androidenv/default.nix
index 3de6bf6e478cd..6c6f974be706b 100644
--- a/pkgs/development/mobile/androidenv/default.nix
+++ b/pkgs/development/mobile/androidenv/default.nix
@@ -15,9 +15,11 @@ rec {
     inherit composeAndroidPackages;
   };
 
-  androidPkgs_9_0 = composeAndroidPackages {
-    platformVersions = [ "28" ];
-    abiVersions = [ "x86" "x86_64"];
+  androidPkgs = composeAndroidPackages {
+    platformVersions = [ "28" "29" "30" "31" "32" "33" "34" ];
+    includeEmulator = true;
+    includeSystemImages = true;
+    includeNDK = true;
   };
 
   test-suite = pkgs.callPackage ./test-suite.nix {};
diff --git a/pkgs/development/python-modules/aiolifx-themes/default.nix b/pkgs/development/python-modules/aiolifx-themes/default.nix
index 284866dc921a6..8f30f735364b5 100644
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-themes";
-  version = "0.4.17";
+  version = "0.4.18";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nKzvdDzwizF1Db8qFQuOH7gLnYHmdCYdQZPN+gNg8mU=";
+    hash = "sha256-6oV6pyVwSS6sYrTokcJ/1KBkuv7EHNr+2bJ5ujengTY=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
index 8f3a773b713e1..62853267d54b0 100644
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "aiolifx";
-  version = "1.0.2";
+  version = "1.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-E3UxNTqss3urpMTwhLhIoAnBekGOIyFy0+sOj3mGlss=";
+    hash = "sha256-Lzdd4UPyu3/avxKO0XPCFI8zhTjDF7zwSKf6RL1/k9M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/blebox-uniapi/default.nix b/pkgs/development/python-modules/blebox-uniapi/default.nix
index 978d80cd9a84a..bf1b15ffcd639 100644
--- a/pkgs/development/python-modules/blebox-uniapi/default.nix
+++ b/pkgs/development/python-modules/blebox-uniapi/default.nix
@@ -6,6 +6,7 @@
   aiohttp,
   semver,
   deepmerge,
+  jmespath,
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
@@ -13,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "blebox-uniapi";
-  version = "2.3.0";
+  version = "2.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +23,7 @@ buildPythonPackage rec {
     owner = "blebox";
     repo = "blebox_uniapi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nqxbwHzx2cnojw/XX9XQoVvOCCd88tulY0m9xEHU3m4=";
+    hash = "sha256-/NXAyEv4RR12/aoSodKiexKlC83GB1YQVAii8vf6U8c=";
   };
 
   postPatch = ''
@@ -34,6 +35,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
+    jmespath
     semver
   ];
 
diff --git a/pkgs/development/python-modules/daphne/default.nix b/pkgs/development/python-modules/daphne/default.nix
index a5699289f24bd..0965dacd42326 100644
--- a/pkgs/development/python-modules/daphne/default.nix
+++ b/pkgs/development/python-modules/daphne/default.nix
@@ -10,24 +10,32 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
+  setuptools,
   twisted,
 }:
 
 buildPythonPackage rec {
   pname = "daphne";
-  version = "4.0.0";
-  format = "setuptools";
+  version = "4.1.2";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "django";
-    repo = pname;
-    rev = version;
-    hash = "sha256-vPMrmC2B0Pcvk8Y1FsJ4PXnzIMtPod7lL2u0IYNVUxc=";
+    repo = "daphne";
+    rev = "refs/tags/${version}";
+    hash = "sha256-RAK2CaKKVmVIv1MBK+9xyADOrHq664MQOry4KaGTNCw=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace-fail "pytest-runner" ""
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     asgiref
     autobahn
     twisted
@@ -40,11 +48,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pytest-runner" ""
-  '';
-
   # Most tests fail on darwin
   doCheck = !stdenv.isDarwin;
 
@@ -52,9 +55,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Django ASGI (HTTP/WebSocket) server";
-    mainProgram = "daphne";
     homepage = "https://github.com/django/daphne";
+    changelog = "https://github.com/django/daphne/blob/${version}/CHANGELOG.txt";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
+    mainProgram = "daphne";
   };
 }
diff --git a/pkgs/development/python-modules/exchangelib/default.nix b/pkgs/development/python-modules/exchangelib/default.nix
index 1e560b59895bd..1ee6dcfb3215e 100644
--- a/pkgs/development/python-modules/exchangelib/default.nix
+++ b/pkgs/development/python-modules/exchangelib/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "exchangelib";
-  version = "5.4.0";
+  version = "5.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "ecederstrand";
     repo = "exchangelib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GBfSdX9gFLx+CCV8DWHWtVpWi6zI3fg/3g/MiIvRoVM=";
+    hash = "sha256-FPn2l+PkTXFqzjqF4kQ8KE49BXZUzDDIcFI3UqoxqQM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index 18d2efa4bd062..0f09ffe98a4e3 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.23.3";
+  version = "0.23.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-878ijhVxvVvytYZTpCBbmo3GsU1bvOl2HXlPu0E/xtQ=";
+    hash = "sha256-6UAuNKeltaclhnQ7J2X0EziGitROMKmOlIWGw87y66E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/langchain-community/default.nix b/pkgs/development/python-modules/langchain-community/default.nix
index 7346d6fbbf326..063ee482ddb5c 100644
--- a/pkgs/development/python-modules/langchain-community/default.nix
+++ b/pkgs/development/python-modules/langchain-community/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-community";
-  version = "0.2.4";
+  version = "0.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -37,8 +37,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    rev = "langchain-community==${version}";
-    hash = "sha256-rqlYaSfDZIQHCndsnydeR1oeVZNIOH6NAgXeOSdBF5A=";
+    rev = "refs/tags/${pname}==${version}";
+    hash = "sha256-SVqhNfRAQoVyUsPw55ByPtVzU/h1II/ox8I79QJsci8=";
   };
 
   sourceRoot = "${src.name}/libs/community";
@@ -85,6 +85,11 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
+  disabledTests = [
+    # Test require network access
+    "test_ovhcloud_embed_documents"
+  ];
+
   meta = {
     description = "Community contributed LangChain integrations";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/community";
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index c8566dd441f39..954ddd477f4ae 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-core";
-  version = "0.2.5";
+  version = "0.2.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langchain";
     rev = "langchain-core==${version}";
-    hash = "sha256-EBs6BHxBPBR1TfSyesM2gJJtxgClM6lLXko1qisrz7A=";
+    hash = "sha256-MmWgnpOO+OWUyRUBqIKuIHG2/p8NfSlVJVbUXfF4spg=";
   };
 
   sourceRoot = "${src.name}/libs/core";
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index 91b7a54b1d0fe..b6d34154583d2 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "langchain";
-  version = "0.2.3";
+  version = "0.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langchain";
     rev = "refs/tags/langchain==${version}";
-    hash = "sha256-9WrWQuZxtl/eBEDdgKCUqT7fYBl6gSsW9rB8tTBqMso=";
+    hash = "sha256-WaJRXvA/SImTSgAkk06vmOtTbsYYs8nTChFLzmsFz7Q=";
   };
 
   sourceRoot = "${src.name}/libs/langchain";
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index c81ff1cc538c3..d86c96eb87ade 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -4,6 +4,7 @@
   anthropic,
   attr,
   buildPythonPackage,
+  dataclasses-json,
   fastapi,
   fetchFromGitHub,
   freezegun,
@@ -22,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.64";
+  version = "0.1.77";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -31,17 +32,16 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oAAbki0Mo4qmjIFpD4girpRuSKr9eLPU6Da6muG0NNk=";
+    hash = "sha256-Tkqo0BbBqFMsEDtEo0sVgSQOoa/J+ECw/7T7yALnL84=";
   };
 
   sourceRoot = "${src.name}/python";
 
   pythonRelaxDeps = [ "orjson" ];
 
-  build-system = [
-    poetry-core
-    pythonRelaxDepsHook
-  ];
+  build-system = [ poetry-core ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     orjson
@@ -51,6 +51,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     anthropic
+    dataclasses-json
     fastapi
     freezegun
     httpx
diff --git a/pkgs/development/python-modules/llama-index-core/default.nix b/pkgs/development/python-modules/llama-index-core/default.nix
index 8a669dac6bb89..3d0d9921c6881 100644
--- a/pkgs/development/python-modules/llama-index-core/default.nix
+++ b/pkgs/development/python-modules/llama-index-core/default.nix
@@ -46,7 +46,7 @@ in
 
 buildPythonPackage rec {
   pname = "llama-index-core";
-  version = "0.10.43";
+  version = "0.10.45";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = "run-llama";
     repo = "llama_index";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eqT3PR1yOrMU/lWGOr70OcekTeHveDfM9C8VOJEx1ps=";
+    hash = "sha256-mI2Cx3ZMW8cLiA7wIo/QwxZrlBVR9W/TMAD5l0TjBQo=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
index bea5dec85e19f..3bd7ddbef4601 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-embeddings-gemini";
-  version = "0.1.7";
+  version = "0.1.8";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_embeddings_gemini";
     inherit version;
-    hash = "sha256-0ob6t9pFaIsbDyt9+QOKFQctS6s99tEvdstn39iyVpA=";
+    hash = "sha256-rQKyPqZnyVYH2h5TTVV53kYYldGURWARWjYBrBb4d5M=";
   };
 
   pythonRelaxDeps = [ "google-generativeai" ];
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index cf76dd2e810ee..95045b4d31546 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-file";
-  version = "0.1.23";
+  version = "0.1.25";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_readers_file";
     inherit version;
-    hash = "sha256-/ejstYjnA4SeUdwPB19W0fXbO8FHndAMIbQuk7gbYmc=";
+    hash = "sha256-I43dmKo3fWpEMiAT64SAVgN8gK2EVx6lv0UaZA//TVw=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
index 4c95a9bfcefb7..63e8b5d9992d0 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-postgres";
-  version = "0.1.10";
+  version = "0.1.11";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_vector_stores_postgres";
     inherit version;
-    hash = "sha256-mtEAl4e3NAx5rILQu7BAv/4+kxth5IybHeKUAwFZQbs=";
+    hash = "sha256-ziP/lUnFJpvcy6Y4h1uSH6qkpYHO+3U+mfg2XIJIeg4=";
   };
 
   pythonRemoveDeps = [ "psycopg2-binary" ];
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
index 6cd34d2fd0b67..47fbc28659176 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-qdrant";
-  version = "0.2.9";
+  version = "0.2.10";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_vector_stores_qdrant";
     inherit version;
-    hash = "sha256-Iju/6Mh/dooQb8u3MHFc8XgNel2FBOI0VAGh6/dNZT4=";
+    hash = "sha256-kFUZiE7rtVQQzaTstKOaM2XkKZQ7ydqVR/2xyPdVtt8=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pyhaversion/default.nix b/pkgs/development/python-modules/pyhaversion/default.nix
index 26aff0187e29e..c4c5417ae47bc 100644
--- a/pkgs/development/python-modules/pyhaversion/default.nix
+++ b/pkgs/development/python-modules/pyhaversion/default.nix
@@ -5,32 +5,35 @@
   awesomeversion,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
+  poetry-core,
   pytest-asyncio,
   pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "pyhaversion";
-  version = "23.1.0";
-  format = "setuptools";
+  version = "24.6.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "ludeeus";
-    repo = pname;
+    repo = "pyhaversion";
     rev = "refs/tags/${version}";
-    hash = "sha256-HMJqZn0yzN2dP5WTRCbem1Xw8nyH2Hy7oVP4kEKHHAo=";
+    hash = "sha256-UZ9236mERoz3WG9MfeN1ALKc8OjqpcbbIhiEsRYzn4I=";
   };
 
   postPatch = ''
     # Upstream doesn't set a version for the tagged releases
-    substituteInPlace setup.py \
-      --replace "main" ${version}
+    substituteInPlace pyproject.toml \
+      --replace-fail 'version = "0"' 'version = "${version}"'
   '';
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
     aiohttp
     awesomeversion
   ];
diff --git a/pkgs/development/tools/misc/swig/2.x.nix b/pkgs/development/tools/misc/swig/2.x.nix
index ac03372d97610..fd8e2a368417f 100644
--- a/pkgs/development/tools/misc/swig/2.x.nix
+++ b/pkgs/development/tools/misc/swig/2.x.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0khm9gh5pczfcihr0pbicaicc4v9kjm5ip2alvkhmbb3ga6njkcm";
   };
 
+  # pcre-config isn't on PATH when cross-building
+  PCRE_CONFIG = "${pcre.dev}/bin/pcre-config";
   nativeBuildInputs = [ autoconf automake libtool bison ];
   buildInputs = [ pcre ];
 
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 15c344efbed3d..b2c4d0a6a6695 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.32";
-    hash = "sha256-DdBkfDq+bed1WdaAtxX16xjZO10jjqJ74ccY9Wq6ryM=";
+    version = "6.6.33";
+    hash = "sha256-3qGxIYNVm2f69rym0Ya1X497G7yRNj3lLCtVgyEZ9yw=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.8.11";
-    hash = "sha256-nEAUw7qFXab7J6x8coSsoB2meeOX4TQver2WztkFJJI=";
+    version = "6.9.4";
+    hash = "sha256-gY0t77aPWOuRZFESNp0OLIsjLAv+rf0NHbab9WF2VtA=";
     variant = "main";
   };
 
@@ -46,6 +46,14 @@ let
       HZ = freeform "250";
       HZ_250 = yes;
       HZ_1000 = no;
+
+      # RCU_BOOST and RCU_EXP_KTHREAD
+      RCU_EXPERT = yes;
+      RCU_FANOUT = freeform "64";
+      RCU_FANOUT_LEAF = freeform "16";
+      RCU_BOOST = yes;
+      RCU_BOOST_DELAY = freeform "0";
+      RCU_EXP_KTHREAD = yes;
     };
 
     extraMeta = {
diff --git a/pkgs/tools/graphics/snapdragon-profiler/default.nix b/pkgs/tools/graphics/snapdragon-profiler/default.nix
index aa8477d5717df..a4ece4ae1ab21 100644
--- a/pkgs/tools/graphics/snapdragon-profiler/default.nix
+++ b/pkgs/tools/graphics/snapdragon-profiler/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     cp -r * $out/lib/snapdragon-profiler
     makeWrapper "${mono}/bin/mono" $out/bin/snapdragon-profiler \
       --add-flags "$out/lib/snapdragon-profiler/SnapdragonProfiler.exe" \
-      --suffix PATH : ${lib.makeBinPath [ jre androidenv.androidPkgs_9_0.platform-tools coreutils ]} \
+      --suffix PATH : ${lib.makeBinPath [ jre androidenv.androidPkgs.platform-tools coreutils ]} \
       --prefix MONO_GAC_PREFIX : ${gtk-sharp-2_0} \
       --suffix LD_LIBRARY_PATH : $(echo $NIX_LDFLAGS | sed 's/ -L/:/g;s/ -rpath /:/g;s/-rpath //') \
       --chdir "$out/lib/snapdragon-profiler" # Fixes themes not loading correctly
diff --git a/pkgs/tools/networking/gnirehtet/default.nix b/pkgs/tools/networking/gnirehtet/default.nix
index 2281822d2e778..95ef1c7402d91 100644
--- a/pkgs/tools/networking/gnirehtet/default.nix
+++ b/pkgs/tools/networking/gnirehtet/default.nix
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage rec {
   postInstall = ''
     wrapProgram $out/bin/gnirehtet \
     --set GNIREHTET_APK ${apk}/gnirehtet.apk \
-    --set ADB ${androidenv.androidPkgs_9_0.platform-tools}/bin/adb
+    --set ADB ${androidenv.androidPkgs.platform-tools}/bin/adb
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d7cf6ef306928..fbd7bdaaad002 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -222,6 +222,7 @@ mapAliases ({
   clang15Stdenv = lowPrio llvmPackages_15.stdenv;
   clang16Stdenv = lowPrio llvmPackages_16.stdenv;
   clang17Stdenv = lowPrio llvmPackages_17.stdenv;
+  clang18Stdenv = lowPrio llvmPackages_18.stdenv;
 
   clang-tools_6 = throw "clang-tools_6 has been removed from nixpkgs"; # Added 2024-01-08
   clang-tools_7 = throw "clang-tools_7 has been removed from nixpkgs"; # Added 2023-11-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d12ff3f330bae..e846c3409166b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4068,7 +4068,7 @@ with pkgs;
   adbfs-rootless = callPackage ../development/mobile/adbfs-rootless { };
 
   adb-sync = callPackage ../development/mobile/adb-sync {
-    inherit (androidenv.androidPkgs_9_0) platform-tools;
+    inherit (androidenv.androidPkgs) platform-tools;
   };
 
   amoco = callPackage ../tools/security/amoco { };
@@ -4084,7 +4084,7 @@ with pkgs;
   androidndkPkgs_23b = (callPackage ../development/androidndk-pkgs {})."23b";
   androidndkPkgs_24 = (callPackage ../development/androidndk-pkgs {})."24";
 
-  androidsdk_9_0 = androidenv.androidPkgs_9_0.androidsdk;
+  androidsdk = androidenv.androidPkgs.androidsdk;
 
   webos = recurseIntoAttrs {
     cmake-modules = callPackage ../development/mobile/webos/cmake-modules.nix { };
@@ -7575,7 +7575,7 @@ with pkgs;
 
   tracker = callPackage ../development/libraries/tracker { };
 
-  tracy = callPackage ../development/tools/tracy { };
+  tracy-x11 = callPackage ../by-name/tr/tracy/package.nix { withWayland = false; };
 
   trivy = callPackage ../tools/admin/trivy { };
 
@@ -29515,6 +29515,7 @@ with pkgs;
   androidStudioPackages = recurseIntoAttrs
     (callPackage ../applications/editors/android-studio { });
   android-studio = androidStudioPackages.stable;
+  android-studio-full = android-studio.full;
 
   antfs-cli = callPackage ../applications/misc/antfs-cli { };
 
diff --git a/pkgs/top-level/kodi-packages.nix b/pkgs/top-level/kodi-packages.nix
index c9c8fe3b6a671..abc6c234e56bd 100644
--- a/pkgs/top-level/kodi-packages.nix
+++ b/pkgs/top-level/kodi-packages.nix
@@ -61,6 +61,8 @@ let
 
     controller-topology-project = callPackage ../applications/video/kodi/addons/controller-topology-project { };
 
+    formula1 = callPackage ../applications/video/kodi/addons/formula1 { };
+
     iagl = callPackage ../applications/video/kodi/addons/iagl { };
 
     invidious = callPackage ../applications/video/kodi/addons/invidious { };
@@ -119,6 +121,8 @@ let
 
     osmc-skin = callPackage ../applications/video/kodi/addons/osmc-skin { };
 
+    upnext = callPackage ../applications/video/kodi/addons/upnext { };
+
     vfs-libarchive = callPackage ../applications/video/kodi/addons/vfs-libarchive { };
 
     vfs-rar = callPackage ../applications/video/kodi/addons/vfs-rar { };
@@ -175,6 +179,8 @@ let
 
     myconnpy = callPackage ../applications/video/kodi/addons/myconnpy { };
 
+    plugin-cache = callPackage ../applications/video/kodi/addons/plugin-cache { };
+
     requests = callPackage ../applications/video/kodi/addons/requests { };
 
     requests-cache = callPackage ../applications/video/kodi/addons/requests-cache { };
@@ -185,6 +191,8 @@ let
 
     signals = callPackage ../applications/video/kodi/addons/signals { };
 
+    simplecache = callPackage ../applications/video/kodi/addons/simplecache { };
+
     simplejson = callPackage ../applications/video/kodi/addons/simplejson { };
 
     six = callPackage ../applications/video/kodi/addons/six { };