about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix6
-rw-r--r--pkgs/applications/emulators/cemu/default.nix4
-rw-r--r--pkgs/applications/misc/cotp/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/google-chrome/default.nix48
-rw-r--r--pkgs/applications/networking/cluster/atmos/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubeone/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubeshark/default.nix4
-rw-r--r--pkgs/applications/networking/trayscale/default.nix6
-rw-r--r--pkgs/applications/office/clockify/default.nix2
-rw-r--r--pkgs/applications/science/math/R/default.nix8
-rw-r--r--pkgs/applications/version-management/gitlab/gitlab-container-registry/Disable-inmemory-storage-driver-test.patch38
-rw-r--r--pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix7
-rw-r--r--pkgs/by-name/as/ast-grep/package.nix6
-rw-r--r--pkgs/by-name/de/dep-scan/package.nix4
-rw-r--r--pkgs/by-name/in/inshellisense/package.nix6
-rw-r--r--pkgs/by-name/nh/nh/package.nix6
-rw-r--r--pkgs/development/python-modules/dataclasses-json/default.nix14
-rw-r--r--pkgs/development/python-modules/django-model-utils/default.nix4
-rw-r--r--pkgs/development/python-modules/fastai/default.nix4
-rw-r--r--pkgs/development/python-modules/publicsuffixlist/default.nix4
-rw-r--r--pkgs/development/tools/bazel-watcher/default.nix8
-rw-r--r--pkgs/development/tools/continuous-integration/codeberg-pages/default.nix5
-rw-r--r--pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch58
-rw-r--r--pkgs/development/tools/rust/cargo-binstall/default.nix6
-rw-r--r--pkgs/servers/computing/storm/default.nix38
-rw-r--r--pkgs/servers/monitoring/mtail/default.nix4
-rw-r--r--pkgs/servers/roadrunner/default.nix13
-rw-r--r--pkgs/tools/admin/kics/default.nix6
-rw-r--r--pkgs/tools/admin/pgadmin/default.nix3
-rw-r--r--pkgs/tools/misc/phrase-cli/default.nix6
-rw-r--r--pkgs/tools/networking/bgpq4/default.nix4
-rw-r--r--pkgs/tools/networking/dnsproxy/default.nix4
-rw-r--r--pkgs/tools/security/aws-iam-authenticator/default.nix6
-rw-r--r--pkgs/tools/security/kubescape/default.nix7
-rw-r--r--pkgs/tools/security/quark-engine/default.nix34
-rw-r--r--pkgs/tools/security/tpm2-tools/default.nix12
-rw-r--r--pkgs/tools/security/vals/default.nix6
-rw-r--r--pkgs/tools/text/vale/styles.nix8
38 files changed, 152 insertions, 265 deletions
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
index d7cab2f707a24..30d0d83f97327 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
@@ -16,7 +16,7 @@
 }:
 
 let
-  rev = "977d344e2e930f3680990014f84ca94877d6eebf";
+  rev = "75b1431c1e0f6c221dbfdb0ecd0f62f183b02254";
   python = python3.withPackages (ps: with ps; [
     epc
     orjson
@@ -28,13 +28,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "20240424.1125";
+  version = "20240502.2306";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
     inherit rev;
-    hash = "sha256-moG0BaHHN3ySON4aMza43Ub4GKuGV9mGSzC48xoiPl8=";
+    hash = "sha256-8MqGwHVBE+87IQfsUA6b3ffrVWjypiH3shwELBCUBDQ=";
   };
 
   commit = rev;
diff --git a/pkgs/applications/emulators/cemu/default.nix b/pkgs/applications/emulators/cemu/default.nix
index a51982a19cd4c..987b615eadc4a 100644
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@@ -46,13 +46,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "cemu";
-  version = "2.0-79";
+  version = "2.0-80";
 
   src = fetchFromGitHub {
     owner = "cemu-project";
     repo = "Cemu";
     rev = "v${version}";
-    hash = "sha256-vSZLiRzOOJJMgycjI5xpgJcUAj5WCz241mAABgNuECw=";
+    hash = "sha256-uNGRiotitt+fWpJFCno04XiCSD1p38QEqw042Bq/IGc=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/cotp/default.nix b/pkgs/applications/misc/cotp/default.nix
index 10ec807247397..38308f4daa409 100644
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cotp";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-Zs/RUpyu8GG4koprC+8aSzpPUSLc19p/XinY5fR5Z4A=";
+    hash = "sha256-X3o3KgTHnhekdiSFdrCwLOrd0HKvCd8Z5jR2WpY1D6Q=";
   };
 
-  cargoHash = "sha256-jYKu1sAzPUfv8gQj3V4zxarRj3XUhyD/5n1WqMuLF/g=";
+  cargoHash = "sha256-zaVNfgWXqHQaogGTaR1eE5u3gYU9SQ0nk0VO7NL5mvg=";
 
   buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ AppKit ];
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index 17b7e288f0a63..8abb0f8f3ae82 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, patchelf, makeWrapper
+{ lib, stdenv, patchelf, makeWrapper, fetchurl
 
 # Linked dynamic libraries.
 , glib, fontconfig, freetype, pango, cairo, libX11, libXi, atk, nss, nspr
@@ -28,15 +28,9 @@
 ## Gentoo
 , bzip2, libcap
 
-# Which distribution channel to use.
-, channel ? "stable"
-
 # Necessary for USB audio devices.
 , pulseSupport ? true, libpulseaudio
 
-# Only needed for getting information about upstream binaries
-, chromium
-
 , gsettings-desktop-schemas
 , gnome
 
@@ -52,8 +46,6 @@ let
     withCustomModes = true;
   };
 
-  version = chromium.upstream-info.version;
-
   deps = [
     glib fontconfig freetype pango cairo libX11 libXi atk nss nspr
     libXcursor libXext libXfixes libXrender libXScrnSaver libXcomposite libxcb
@@ -70,18 +62,14 @@ let
     ++ lib.optional libvaSupport libva
     ++ [ gtk3 gtk4 ];
 
-  suffix = lib.optionalString (channel != "stable") "-${channel}";
-
-  crashpadHandlerBinary = if lib.versionAtLeast version "94"
-    then "chrome_crashpad_handler"
-    else "crashpad_handler";
+in stdenv.mkDerivation (finalAttrs: {
+  pname = "google-chrome";
+  version = "124.0.6367.118";
 
-in stdenv.mkDerivation {
-  inherit version;
-
-  name = "google-chrome${suffix}-${version}";
-
-  src = chromium.chromeSrc;
+  src = fetchurl {
+    url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
+    hash = "sha256-H3bv6WiVBl4j38ROZ80+SD9UO9ok+xxcKFxDd9yjWNY=";
+  };
 
   nativeBuildInputs = [ patchelf makeWrapper ];
   buildInputs = [
@@ -103,11 +91,8 @@ in stdenv.mkDerivation {
   installPhase = ''
     runHook preInstall
 
-    case ${channel} in
-      beta) appname=chrome-beta      dist=beta     ;;
-      dev)  appname=chrome-unstable  dist=unstable ;;
-      *)    appname=chrome           dist=stable   ;;
-    esac
+    appname=chrome
+    dist=stable
 
     exe=$out/bin/google-chrome-$dist
 
@@ -149,7 +134,7 @@ in stdenv.mkDerivation {
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
-    for elf in $out/share/google/$appname/{chrome,chrome-sandbox,${crashpadHandlerBinary}}; do
+    for elf in $out/share/google/$appname/{chrome,chrome-sandbox,chrome_crashpad_handler}; do
       patchelf --set-rpath $rpath $elf
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
     done
@@ -162,13 +147,8 @@ in stdenv.mkDerivation {
     homepage = "https://www.google.com/chrome/browser/";
     license = licenses.unfree;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ primeos ];
-    # Note from primeos: By updating Chromium I also update Google Chrome and
-    # will try to merge PRs and respond to issues but I'm not actually using
-    # Google Chrome.
+    maintainers = with maintainers; [ jnsgruk ];
     platforms = [ "x86_64-linux" ];
-    mainProgram =
-      if (channel == "dev") then "google-chrome-unstable"
-      else "google-chrome-${channel}";
+    mainProgram = "google-chrome-stable";
   };
-}
+})
diff --git a/pkgs/applications/networking/cluster/atmos/default.nix b/pkgs/applications/networking/cluster/atmos/default.nix
index 9e4d04befbc85..d5cd9a0851421 100644
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atmos";
-  version = "1.70.0";
+  version = "1.71.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NmgInrjCcMoSjSCotGU38URP7FNMaFs3N2g49Y/fXSw=";
+    sha256 = "sha256-RnBMVVbZQrJ85uPVLniNjpcledYnOyu5zxIYsvV63qk=";
   };
 
-  vendorHash = "sha256-dJJPq2HcGZ+MqtJ848gsrvzD1rMVrwJQKwq+UpZsFB0=";
+  vendorHash = "sha256-dcQWD6UrsSPJZzasovBSXUKaXvL9mZF6cLp458Ia8O4=";
 
   ldflags = [ "-s" "-w" "-X github.com/cloudposse/atmos/cmd.Version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/kubeone/default.nix b/pkgs/applications/networking/cluster/kubeone/default.nix
index 84ff7632cf2b9..abff9a029921e 100644
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "kubeone";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${version}";
-    hash = "sha256-m2RxSKXiKmx1p5g+C8I/l+OtV7wy2KtrFRIK+h9L5lo=";
+    hash = "sha256-GK5SEQjQb553MypcRpTfmewVhucP1fRldpXhfLERkMo=";
   };
 
-  vendorHash = "sha256-vUy60CBrdhB9OFMZ4+q05WtrtN4/5ssozYGBV7r4BsM=";
+  vendorHash = "sha256-pt3EWohdXOBgE3SfEEODUi1uX/X+jJ2JrBbLFIXDbwY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/kubeshark/default.nix b/pkgs/applications/networking/cluster/kubeshark/default.nix
index 32714e7d0ba40..a5fd286984c13 100644
--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubeshark";
-  version = "52.2.39";
+  version = "52.3.0";
 
   src = fetchFromGitHub {
     owner = "kubeshark";
     repo = "kubeshark";
     rev = "v${version}";
-    hash = "sha256-ji/WOCqZOIaUc+mS2zaMNjWxSgv68DGjtWxgtJCH2C4=";
+    hash = "sha256-7tTXhILWnYRFyKBw1Im9Q9/oqlKJAP478qiBEoTUGMc=";
   };
 
   vendorHash = "sha256-SmvO9DYOXxnmN2dmHPPOguVwEbWSH/xNLBB+idpzopo=";
diff --git a/pkgs/applications/networking/trayscale/default.nix b/pkgs/applications/networking/trayscale/default.nix
index e5ab2e2a1a85d..26e767ef90695 100644
--- a/pkgs/applications/networking/trayscale/default.nix
+++ b/pkgs/applications/networking/trayscale/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "trayscale";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "DeedleFake";
     repo = "trayscale";
     rev = "v${version}";
-    hash = "sha256-Og/ilxWNB5TNqnViZ5TeE0P+RxG1JOP2q9jo91SBNZQ=";
+    hash = "sha256-GAK95XlRVGpoVcEmeFO3SddHpdn0qO7qs2IOj7qzRXQ=";
   };
 
-  vendorHash = "sha256-eIakjEYfVp2wfXu0oqBmd5hJZTp0xgYKNNbtpRBnT2w=";
+  vendorHash = "sha256-Iedd8WsJPAVQexRqDSLAmv7MAWc4IFQXHk6XpnStMps=";
 
   subPackages = [ "cmd/trayscale" ];
 
diff --git a/pkgs/applications/office/clockify/default.nix b/pkgs/applications/office/clockify/default.nix
index 7b2faa6b7d203..6acb243acec76 100644
--- a/pkgs/applications/office/clockify/default.nix
+++ b/pkgs/applications/office/clockify/default.nix
@@ -14,8 +14,6 @@ appimageTools.wrapType2 rec {
   extraInstallCommands =
     let appimageContents = appimageTools.extract { inherit pname version src; };
     in ''
-      mv $out/bin/${pname}-${version} $out/bin/${pname}
-
       install -Dm 444 ${appimageContents}/clockify.desktop -t $out/share/applications
       install -Dm 444 ${appimageContents}/clockify.png -t $out/share/pixmaps
 
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index acfc38686ea42..5ceb413a24211 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
+{ lib, stdenv, fetchurl, fetchpatch, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
 , libtiff, ncurses, pango, pcre2, perl, readline, tcl, texlive, texliveSmall, tk, xz, zlib
 , less, texinfo, graphviz, icu, pkg-config, bison, imake, which, jdk, blas, lapack
 , curl, Cocoa, Foundation, libobjc, libcxx, tzdata
@@ -37,6 +37,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./no-usr-local-search-paths.patch
+    (fetchpatch {
+      # https://hiddenlayer.com/research/r-bitrary-code-execution/
+      name = "CVE-2024-27322.patch";
+      url = "https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7.patch";
+      hash = "sha256-CH2mMmie9E96JeGSC7UGm7/roUNhK5xv6HO53N2ixEI=";
+    })
   ];
 
   # Test of the examples for package 'tcltk' fails in Darwin sandbox. See:
diff --git a/pkgs/applications/version-management/gitlab/gitlab-container-registry/Disable-inmemory-storage-driver-test.patch b/pkgs/applications/version-management/gitlab/gitlab-container-registry/Disable-inmemory-storage-driver-test.patch
deleted file mode 100644
index 16f47fb3ae18d..0000000000000
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/Disable-inmemory-storage-driver-test.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From bc359e8f51a17ba759121339e87e90eed16e98fe Mon Sep 17 00:00:00 2001
-From: Yaya <mak@nyantec.com>
-Date: Tue, 20 Jun 2023 10:01:23 +0000
-Subject: [PATCH] Disable inmemory storage driver test
-
----
- .../storage/driver/inmemory/driver_test.go    | 19 -------------------
- 1 file changed, 19 deletions(-)
- delete mode 100644 registry/storage/driver/inmemory/driver_test.go
-
-diff --git a/registry/storage/driver/inmemory/driver_test.go b/registry/storage/driver/inmemory/driver_test.go
-deleted file mode 100644
-index dbc1916f..00000000
---- a/registry/storage/driver/inmemory/driver_test.go
-+++ /dev/null
-@@ -1,19 +0,0 @@
--package inmemory
--
--import (
--	"testing"
--
--	storagedriver "github.com/docker/distribution/registry/storage/driver"
--	"github.com/docker/distribution/registry/storage/driver/testsuites"
--	"gopkg.in/check.v1"
--)
--
--// Hook up gocheck into the "go test" runner.
--func Test(t *testing.T) { check.TestingT(t) }
--
--func init() {
--	inmemoryDriverConstructor := func() (storagedriver.StorageDriver, error) {
--		return New(), nil
--	}
--	testsuites.RegisterSuite(inmemoryDriverConstructor, testsuites.NeverSkip)
--}
--- 
-2.40.1
-
diff --git a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
index c92cc3e0ddeb0..2fd7ab95ed685 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@@ -15,11 +15,10 @@ buildGoModule rec {
 
   vendorHash = "sha256-KZWdM8Q8ipsgm7OoLyOuHo+4Vg2Nve+yZtTSUDgjOW4=";
 
-  patches = [
-    ./Disable-inmemory-storage-driver-test.patch
-  ];
-
   postPatch = ''
+    # Disable flaky inmemory storage driver test
+    rm registry/storage/driver/inmemory/driver_test.go
+
     substituteInPlace health/checks/checks_test.go \
       --replace \
         'func TestHTTPChecker(t *testing.T) {' \
diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index 153c144629630..e517689e4232d 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ast-grep";
-  version = "0.21.1";
+  version = "0.21.3";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     rev = version;
-    hash = "sha256-hR6DPkApHDlg91O040s+3FL2mEM3FH61pnyCBwwE6tw=";
+    hash = "sha256-vI40H+hLR1OR1Nark9NL4YWbx/ZElYTk651+COJQF9o=";
   };
 
-  cargoHash = "sha256-Iqq7F8PCrNhFGvrfbYQn3mdOwiokCmTKCaXjOHvD8V0=";
+  cargoHash = "sha256-bjBi8gcTT0tjnq+WSET3ywAvugJCdRXWYL8G6rJcxe4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/de/dep-scan/package.nix b/pkgs/by-name/de/dep-scan/package.nix
index a9dc4b718c80c..d666f4f0304e8 100644
--- a/pkgs/by-name/de/dep-scan/package.nix
+++ b/pkgs/by-name/de/dep-scan/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dep-scan";
-  version = "5.3.3";
+  version = "5.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "owasp-dep-scan";
     repo = "dep-scan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ehQsRTMoHr6LDXCka3/4YcyEKLN7DQW4mUp4nyid/aE=";
+    hash = "sha256-5iMhl3Wcxwgq4Wr0TUcAuRnb2+y8DHBugnnkpcZfSAM=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/in/inshellisense/package.nix b/pkgs/by-name/in/inshellisense/package.nix
index 0b685022ffa84..5e9610d0c2f9b 100644
--- a/pkgs/by-name/in/inshellisense/package.nix
+++ b/pkgs/by-name/in/inshellisense/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "inshellisense";
-  version = "0.0.1-rc.14";
+  version = "0.0.1-rc.15";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ZsEAE9EDJLREpKjHLbvqAUNM/y9eCH44g3D8NHYHiT4=";
+    hash = "sha256-/6pU8ubasONPMe1qnE+Db0nzdHRQTo9fhMr7Xxjgsos=";
   };
 
-  npmDepsHash = "sha256-p0/GnAdWNM/wjB/w+rXbOrh3Hr/smIW0IVQga7uCKYY=";
+  npmDepsHash = "sha256-rOyvFA5X3o1TCgY54XxNSg0+QotA8IUauLngTtJuRj4=";
 
   # Needed for dependency `@homebridge/node-pty-prebuilt-multiarch`
   # On Darwin systems the build fails with,
diff --git a/pkgs/by-name/nh/nh/package.nix b/pkgs/by-name/nh/nh/package.nix
index 3d1480da73d2b..23838fb804b53 100644
--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@@ -10,7 +10,7 @@
 , nix-output-monitor
 }:
 let
-  version = "3.5.13";
+  version = "3.5.14";
   runtimeDeps = [ nvd nix-output-monitor ];
 in
 rustPlatform.buildRustPackage {
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
     owner = "viperML";
     repo = "nh";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lTy5gmB3dJZJKag2uuuxXvZCAt/RhLnI0jbIicBJfCo=";
+    hash = "sha256-4vXLHDj6TnEXjJIzEcToHQ+6Rp4EnMpOFHQ3Ypymh0s=";
   };
 
   strictDeps = true;
@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage {
       --prefix PATH : ${lib.makeBinPath runtimeDeps}
   '';
 
-  cargoHash = "sha256-X8+GmPFxvgeNxMuOacoCUCgdZ/+N4mwQFMUtvO1E998=";
+  cargoHash = "sha256-A2AFlm6Qs7IuR6LedapWx4RL0Ae5E7eSBJSMXjrONHE=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/development/python-modules/dataclasses-json/default.nix b/pkgs/development/python-modules/dataclasses-json/default.nix
index 2718a88379c92..202b4ebb6dedb 100644
--- a/pkgs/development/python-modules/dataclasses-json/default.nix
+++ b/pkgs/development/python-modules/dataclasses-json/default.nix
@@ -12,29 +12,29 @@
 
 buildPythonPackage rec {
   pname = "dataclasses-json";
-  version = "0.6.4";
-  format = "pyproject";
+  version = "0.6.5";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "lidatong";
-    repo = pname;
+    repo = "dataclasses-json";
     rev = "refs/tags/v${version}";
-    hash = "sha256-izNDvljUWw60joi5WfCfoqL5SDM8Jz5Pz+lI/RP35n8=";
+    hash = "sha256-YkGxUQgnUB7WfpsZz74b3j/TIqJi2ihsk9Ib05S7uPM=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'version = "0.0.0"' 'version = "${version}"'
+      --replace-fail 'version = "0.0.0"' 'version = "${version}"'
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
     poetry-dynamic-versioning
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     typing-inspect
     marshmallow-enum
   ];
diff --git a/pkgs/development/python-modules/django-model-utils/default.nix b/pkgs/development/python-modules/django-model-utils/default.nix
index 0e39d901aae8d..38d03dca20105 100644
--- a/pkgs/development/python-modules/django-model-utils/default.nix
+++ b/pkgs/development/python-modules/django-model-utils/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "django-model-utils";
-  version = "4.5.0";
+  version = "4.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "django-model-utils";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZEnDk4kCXyhLvq3CZTK/zP3IK6BsNRqbkfqKAuU6Mfk=";
+    hash = "sha256-GaBTCrEwEkJyVeY5YVptPioYcmivyQtBKjs+TgC9IqA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fastai/default.nix b/pkgs/development/python-modules/fastai/default.nix
index ff8ac701cf274..cd4bcc9f4b671 100644
--- a/pkgs/development/python-modules/fastai/default.nix
+++ b/pkgs/development/python-modules/fastai/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "fastai";
-  version = "2.7.14";
+  version = "2.7.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QiVyYojI/xs7wYl3umhky0j+xzptNS7Fv+fLMRy/4jc=";
+    hash = "sha256-8swg/RjN9exzjMVtKdVN51iH1IrRX501z1DDjTqFaSM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index a8cd6193d74be..c7793a14a8960 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20240420";
+  version = "0.10.0.20240502";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s8xPkes/xFlejqfOlMZOPLmNK92e2TLK18UZmv3/a6I=";
+    hash = "sha256-Hy0DmawyjUXn35tTV39Mpp+Xe16hDTbkyQoBdKS/d0o=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/bazel-watcher/default.nix b/pkgs/development/tools/bazel-watcher/default.nix
index 23d2c904022d5..ae152a3782ab1 100644
--- a/pkgs/development/tools/bazel-watcher/default.nix
+++ b/pkgs/development/tools/bazel-watcher/default.nix
@@ -2,7 +2,7 @@
 , bazel_5
 , fetchFromGitHub
 , git
-, go
+, go_1_21
 , python3
 , lib, stdenv
 }:
@@ -29,16 +29,16 @@ let
 in
 buildBazelPackage rec {
   pname = "bazel-watcher";
-  version = "0.24.0";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazel-watcher";
     rev = "v${version}";
-    hash = "sha256-ebNHAYKyE3226KiCc2/VSz1OSITuPwuYlAIS3JrWzj0=";
+    hash = "sha256-lreGKA0DZiOd1bJq8NNQ+80cyDwiughoXCkKu1RaZmc=";
   };
 
-  nativeBuildInputs = [ go git python3 ];
+  nativeBuildInputs = [ go_1_21 git python3 ];
   removeRulesCC = false;
 
   bazel = bazel_5;
diff --git a/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix b/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
index c9ec0cc84ad4d..63324531f8e2f 100644
--- a/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
+++ b/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
@@ -14,7 +14,10 @@ buildGoModule rec {
 
   vendorHash = "sha256-vTYB3ka34VooN2Wh/Rcj+2S1qAsA2a/VtXlILn1W7oU=";
 
-  patches = [ ./disable_httptest.patch ];
+  postPatch = ''
+    # disable httptest
+    rm server/handler/handler_test.go
+  '';
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch b/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch
deleted file mode 100644
index 90c815712d388..0000000000000
--- a/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-diff --git a/server/handler/handler_test.go b/server/handler/handler_test.go
-deleted file mode 100644
-index 6521633..0000000
---- a/server/handler/handler_test.go
-+++ /dev/null
-@@ -1,52 +0,0 @@
--package handler
--
--import (
--	"net/http"
--	"net/http/httptest"
--	"testing"
--	"time"
--
--	"codeberg.org/codeberg/pages/server/cache"
--	"codeberg.org/codeberg/pages/server/gitea"
--	"github.com/rs/zerolog/log"
--)
--
--func TestHandlerPerformance(t *testing.T) {
--	giteaClient, _ := gitea.NewClient("https://codeberg.org", "", cache.NewKeyValueCache(), false, false)
--	testHandler := Handler(
--		"codeberg.page", "raw.codeberg.org",
--		giteaClient,
--		"https://docs.codeberg.org/pages/raw-content/",
--		[]string{"/.well-known/acme-challenge/"},
--		[]string{"raw.codeberg.org", "fonts.codeberg.org", "design.codeberg.org"},
--		[]string{"pages"},
--		cache.NewKeyValueCache(),
--		cache.NewKeyValueCache(),
--		cache.NewKeyValueCache(),
--	)
--
--	testCase := func(uri string, status int) {
--		t.Run(uri, func(t *testing.T) {
--			req := httptest.NewRequest("GET", uri, http.NoBody)
--			w := httptest.NewRecorder()
--
--			log.Printf("Start: %v\n", time.Now())
--			start := time.Now()
--			testHandler(w, req)
--			end := time.Now()
--			log.Printf("Done: %v\n", time.Now())
--
--			resp := w.Result()
--
--			if resp.StatusCode != status {
--				t.Errorf("request failed with status code %d", resp.StatusCode)
--			} else {
--				t.Logf("request took %d milliseconds", end.Sub(start).Milliseconds())
--			}
--		})
--	}
--
--	testCase("https://mondstern.codeberg.page/", 404) // TODO: expect 200
--	testCase("https://codeberg.page/", 404)           // TODO: expect 200
--	testCase("https://example.momar.xyz/", 424)
--}
diff --git a/pkgs/development/tools/rust/cargo-binstall/default.nix b/pkgs/development/tools/rust/cargo-binstall/default.nix
index 8f0ae1b22dd00..b537a8056cf31 100644
--- a/pkgs/development/tools/rust/cargo-binstall/default.nix
+++ b/pkgs/development/tools/rust/cargo-binstall/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-xG2eLKqGv+wqpSGBUMoYGSQ22lrMHDpQzrSyxyHMHoc=";
+    hash = "sha256-DD9tecF6oZOg501DUMm5KEPC2BOxMa78YGIXLvhsRys=";
   };
 
-  cargoHash = "sha256-xNTSvJZWX19kmaFoLLHNKIrcsTFYWwN+7Ubym0hCwTA=";
+  cargoHash = "sha256-veVE4THR58DAOo0CqMCnN3EqCOEge8K0PvLM0KgHDnI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/servers/computing/storm/default.nix b/pkgs/servers/computing/storm/default.nix
index d4669488901a8..a3503ccc8cbf1 100644
--- a/pkgs/servers/computing/storm/default.nix
+++ b/pkgs/servers/computing/storm/default.nix
@@ -1,26 +1,27 @@
 { stdenv, lib, fetchurl, zip, unzip
-, jdk, python2
+, jdk, python3
 , confFile ? ""
 , extraLibraryPaths ? []
 , extraJars ? []
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "apache-storm";
-  version = "2.4.0";
-  name = "${pname}-${version}";
+  version = "2.6.2";
+  name = "${finalAttrs.pname}-${finalAttrs.version}";
 
   src = fetchurl {
-    url = "mirror://apache/storm/${name}/${name}.tar.gz";
-    sha256 = "sha256-VFNcaISPBRMGR5l/P6/pGnK7lHClDW2AmXJ00gzxwMY=";
+    url = "mirror://apache/storm/${finalAttrs.name}/${finalAttrs.name}.tar.gz";
+    hash = "sha256-ZAwsVKWTzc/++UQTNnOHdK5hiDDT5j6453DCLWi+7TA=";
   };
 
   nativeBuildInputs = [ zip unzip ];
 
   installPhase = ''
-    mkdir -p $out/share/${name}
+    mkdir -p $out/share/${finalAttrs.name}
     mv public $out/docs
-    mv examples $out/share/${name}/.
+    mv examples $out/share/${finalAttrs.name}/.
 
     mv external extlib* lib $out/.
     mv conf bin $out/.
@@ -28,23 +29,23 @@ stdenv.mkDerivation rec {
   '';
 
   fixupPhase = ''
+    patchShebangs $out
     # Fix python reference
     sed -i \
-      -e '19iPYTHON=${python2}/bin/python' \
-      -e 's|#!/usr/bin/.*python|#!${python2}/bin/python|' \
+      -e '19iPYTHON=${python3}/bin/python' \
+      -e 's|#!/usr/bin/.*python|#!${python3}/bin/python|' \
       $out/bin/storm
     sed -i \
-      -e 's|#!/usr/bin/.*python|#!${python2}/bin/python|' \
+      -e 's|#!/usr/bin/.*python|#!${python3}/bin/python|' \
       -e "s|STORM_CONF_DIR = .*|STORM_CONF_DIR = os.getenv('STORM_CONF_DIR','$out/conf')|" \
       -e 's|STORM_LOG4J2_CONF_DIR =.*|STORM_LOG4J2_CONF_DIR = os.path.join(STORM_CONF_DIR, "log4j2")|' \
         $out/bin/storm.py
 
     # Default jdk location
-    sed -i -e 's|#.*export JAVA_HOME=.*|export JAVA_HOME="${jdk.home}"|' \
+    sed -i -e 's|export JAVA_HOME=.*|export JAVA_HOME="${jdk.home}"|' \
            $out/conf/storm-env.sh
-    ls -lh $out/lib
-    unzip  $out/lib/storm-client-${version}.jar defaults.yaml;
-    zip -d $out/lib/storm-client-${version}.jar defaults.yaml;
+    unzip  $out/lib/storm-client-${finalAttrs.version}.jar defaults.yaml;
+    zip -d $out/lib/storm-client-${finalAttrs.version}.jar defaults.yaml;
     sed -i \
        -e 's|java.library.path: .*|java.library.path: "${lib.concatStringsSep ":" extraLibraryPaths}"|' \
        -e 's|storm.log4j2.conf.dir: .*|storm.log4j2.conf.dir: "conf/log4j2"|' \
@@ -59,6 +60,11 @@ stdenv.mkDerivation rec {
 
   dontStrip = true;
 
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "storm version";
+  };
+
   meta = with lib; {
     homepage = "https://storm.apache.org/";
     description = "Distributed realtime computation system";
@@ -67,4 +73,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ edwtjo vizanto ];
     platforms = with platforms; unix;
   };
-}
+})
diff --git a/pkgs/servers/monitoring/mtail/default.nix b/pkgs/servers/monitoring/mtail/default.nix
index d932994c6e82c..32af6e92b2a81 100644
--- a/pkgs/servers/monitoring/mtail/default.nix
+++ b/pkgs/servers/monitoring/mtail/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "mtail";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mtail";
     rev = "v${version}";
-    hash = "sha256-1AUV3NyALJbR2CPpDJaK+Cq/w87jGFtp/iUkBFqanSE=";
+    hash = "sha256-HXnudY9GUCjFL4JvdNYGZ1fPeaPZjt63jrZfUfOWjEc=";
   };
 
   vendorHash = "sha256-XKELlrsyumv3EbNdepLRgX7kPWxzo2ZdKrOwiM0myf8=";
diff --git a/pkgs/servers/roadrunner/default.nix b/pkgs/servers/roadrunner/default.nix
index 0141a90093967..caf98f12a7ab5 100644
--- a/pkgs/servers/roadrunner/default.nix
+++ b/pkgs/servers/roadrunner/default.nix
@@ -6,12 +6,13 @@
 
 buildGoModule rec {
   pname = "roadrunner";
-  version = "2024.1.0";
+  version = "2024.1.1";
+
   src = fetchFromGitHub {
     repo = "roadrunner";
     owner = "roadrunner-server";
-    rev = "v${version}";
-    hash = "sha256-K5ZN5HHz2PEBOQ5ke7FUCjMihORfxxjLUtBJgd/1jAA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uSc4dVDw4aXuo0mKPhsXLYfifpu4c+L7AQXaDgTkvTc=";
   };
 
   nativeBuildInputs = [
@@ -22,8 +23,8 @@ buildGoModule rec {
   # https://github.com/roadrunner-server/roadrunner/blob/fe572d0eceae8fd05225fbd99ba50a9eb10c4393/.github/workflows/release.yml#L89
   ldflags = [
     "-s"
-    "-X github.com/roadrunner-server/roadrunner/v2023/internal/meta.version=${version}"
-    "-X github.com/roadrunner-server/roadrunner/v2023/internal/meta.buildTime=1970-01-01T00:00:00Z"
+    "-X=github.com/roadrunner-server/roadrunner/v2023/internal/meta.version=${version}"
+    "-X=github.com/roadrunner-server/roadrunner/v2023/internal/meta.buildTime=1970-01-01T00:00:00Z"
   ];
 
   postInstall = ''
@@ -44,7 +45,7 @@ buildGoModule rec {
       --replace "127.0.0.1:0" "127.0.0.1:55554"
   '';
 
-  vendorHash = "sha256-fAFErw5+oR4MEme5v3iMyLqwwsR4O6OxeVcVDVlKpdI=";
+  vendorHash = "sha256-8cNUCTwrhkgHu+XyneYLdPqsITnTCxQ6KGFoPrz7PwI=";
 
   meta = {
     changelog = "https://github.com/roadrunner-server/roadrunner/blob/v${version}/CHANGELOG.md";
diff --git a/pkgs/tools/admin/kics/default.nix b/pkgs/tools/admin/kics/default.nix
index ba8818c7f415b..6db54ce509494 100644
--- a/pkgs/tools/admin/kics/default.nix
+++ b/pkgs/tools/admin/kics/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "kics";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "Checkmarx";
     repo = "kics";
     rev = "v${version}";
-    hash = "sha256-OdX3ipfPj+rope5oT5ND9MEaefW36X6XDV5F7PaQOuw=";
+    hash = "sha256-4WYrKWkcf7AJjogWQcNsIZiCfxf4CmhLW/GJFUWfQzw=";
   };
 
-  vendorHash = "sha256-vYAMzXBQIt8F9DTGLkWNXx6e08MPo12W2ogiTZ8gcjw=";
+  vendorHash = "sha256-N3MJhuzMJW40aMrAyuBsNciwZaNq0K4IUd+0re17AOI=";
 
   subPackages = [ "cmd/console" ];
 
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index 95b8963afb7c6..3c8c362a41428 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -222,6 +222,9 @@ pythonPackages.buildPythonApplication rec {
     pythonPackages.selenium
   ];
 
+  # sandboxing issues on aarch64-darwin, see https://github.com/NixOS/nixpkgs/issues/198495
+  doCheck = postgresql.doCheck;
+
   checkPhase = ''
     runHook preCheck
 
diff --git a/pkgs/tools/misc/phrase-cli/default.nix b/pkgs/tools/misc/phrase-cli/default.nix
index 70b08aa96a928..fc00c5936b06b 100644
--- a/pkgs/tools/misc/phrase-cli/default.nix
+++ b/pkgs/tools/misc/phrase-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "phrase-cli";
-  version = "2.25.0";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = version;
-    sha256 = "sha256-JVelz5I6HWgoqqkfNzb0DlAA4DsydBzdcxEIdKs24i4=";
+    sha256 = "sha256-PStbkJbSGCN92eAk4TZaIzbkG1C25PKI6R6LJgaQuxQ=";
   };
 
-  vendorHash = "sha256-8lqiseOJ8eDvY4J/MimKVvh5euHfOgQLjhKf7sPS6AE=";
+  vendorHash = "sha256-5EgttRimT+TTL9QhT36AO9rx2DdZBmnQrllBfRpdhg0=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];
 
diff --git a/pkgs/tools/networking/bgpq4/default.nix b/pkgs/tools/networking/bgpq4/default.nix
index 22e17a205c207..006bfbf595dde 100644
--- a/pkgs/tools/networking/bgpq4/default.nix
+++ b/pkgs/tools/networking/bgpq4/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bgpq4";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchFromGitHub {
     owner = "bgp";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Irv91M5g21id0QfsnpDA7n5IhP8Qe9QHMh/KizD74qw=";
+    sha256 = "sha256-Kw1Y9g2ItclDYYoZC2FTdBTec7zoM/N3Vk4zM8EVBR0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index aca0907785449..6036d6658d021 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.71.0";
+  version = "0.71.1";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "dnsproxy";
     rev = "v${version}";
-    hash = "sha256-2Qn5lYam4bMA7JS/rovHTUGXovCUOhikpv8pcWzyO24=";
+    hash = "sha256-g+QjGU+9//Ms7s61IzkxLTffmu1XIhzUX841e86JqE4=";
   };
 
   vendorHash = "sha256-8t1/XIjDXRHumHkRNxQBeexL2qN94AHModk8ioLpMNY=";
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index 5af095ae15560..801d364c60269 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.19";
+  version = "0.6.20";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-wgMMa1PFKNArI4pk7gA2o8HHgF84Q+rga4j+UC1/Js8=";
+    hash = "sha256-72l+EgqWy8+7wdTKwXnebZ+wm5VCgYODw4D6lkL4NBA=";
   };
 
-  vendorHash = "sha256-wJqtIuLiidO3XFkvhSXRZcFR/31rR4U9BXjFilsr5a0=";
+  vendorHash = "sha256-7FYR8c1Q9SS3prt8yrTzbOqgqG1tGuvzjH42MkY0tAo=";
 
   ldflags = let PKG = "sigs.k8s.io/aws-iam-authenticator"; in [
     "-s"
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index 2c74013c3ad19..501c6dc1435b1 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -10,17 +10,17 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "3.0.8";
+  version = "3.0.9";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = "kubescape";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZGDE9go8BmaXE1YFT/z5Nob90MhsKZ6oKrodDMu2npY=";
+    hash = "sha256-pAe289XwKq/PO39/Wt60uipt4Z0ZD5f73pDaOTXXwi0=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-qFJVoWzU9rqpYbb8gzdK33rq///zizxVkWhsNV8OXOM=";
+  vendorHash = "sha256-UWmsS79N8ooFr4qpKqOVC14cgf5ckAQwzROHGl1smD8=";
 
   subPackages = [
     "."
@@ -49,7 +49,6 @@ buildGoModule rec {
     rm core/cautils/getter/downloadreleasedpolicy_test.go
     rm core/core/initutils_test.go
     rm core/core/list_test.go
-    rm core/pkg/resourcehandler/remotegitutils_test.go
 
     # Remove tests that use networking
     substituteInPlace core/pkg/resourcehandler/repositoryscanner_test.go \
diff --git a/pkgs/tools/security/quark-engine/default.nix b/pkgs/tools/security/quark-engine/default.nix
index 43e9413d125cd..58236cc8b30ab 100644
--- a/pkgs/tools/security/quark-engine/default.nix
+++ b/pkgs/tools/security/quark-engine/default.nix
@@ -1,27 +1,27 @@
-{ lib
-, fetchFromGitHub
-, gitMinimal
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  gitMinimal,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quark-engine";
-  version = "24.4.1";
+  version = "24.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "quark-engine";
+    repo = "quark-engine";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-cWO/avMz9nT9yo10b1ugC0C8NsEp2jAlcR0/+86gFKc=";
+    hash = "sha256-W1UeTiyyYZzxu3XQ/6VkTvEyqPWl1Du6QutuoPhaSfs=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-    pythonRelaxDepsHook
-  ];
+  build-system = with python3.pkgs; [ setuptools ];
+
+  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     androguard
     click
     colorama
@@ -37,16 +37,12 @@ python3.pkgs.buildPythonApplication rec {
     tqdm
   ];
 
-  pythonRelaxDeps = [
-    "r2pipe"
-  ];
+  pythonRelaxDeps = [ "r2pipe" ];
 
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "quark"
-  ];
+  pythonImportsCheck = [ "quark" ];
 
   meta = with lib; {
     description = "Android malware (analysis and scoring) system";
diff --git a/pkgs/tools/security/tpm2-tools/default.nix b/pkgs/tools/security/tpm2-tools/default.nix
index b664eb6f01a3e..1cf4d40091389 100644
--- a/pkgs/tools/security/tpm2-tools/default.nix
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@@ -4,21 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tools";
-  version = "5.6";
+  version = "5.7";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Usi8uq3KCCq/5et+5JZ9LWMthLFndnXy8HG20uwizsM=";
+    sha256 = "sha256-OBDTa1B5JW9PL3zlUuIiE9Q7EDHBMVON+KLbw8VwmDo=";
   };
 
-  patches = [
-    # https://github.com/tpm2-software/tpm2-tools/pull/3271
-    (fetchpatch {
-      url = "https://github.com/tpm2-software/tpm2-tools/commit/b98be08f6f88b0cca9e0667760c4e1e5eb417fbd.patch";
-      sha256 = "sha256-2sEam9i4gwscJhLwraX2EAjVM8Dh1vmNnG3zYsOF0fc=";
-    })
-  ];
-
   nativeBuildInputs = [ pandoc pkg-config makeWrapper ];
   buildInputs = [
     curl openssl tpm2-tss libuuid
diff --git a/pkgs/tools/security/vals/default.nix b/pkgs/tools/security/vals/default.nix
index e734893d527ff..b7b1012ad2772 100644
--- a/pkgs/tools/security/vals/default.nix
+++ b/pkgs/tools/security/vals/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vals";
-  version = "0.37.0";
+  version = "0.37.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "helmfile";
     repo = pname;
-    sha256 = "sha256-R/nTlB8VM41Yah+3sH/J3Y3m9KUFsIZQNQ9kFddo+Mo=";
+    sha256 = "sha256-POFxoGUbcasEvFdovZ1RER+yxLzg9owyKjWcr1zI+nc=";
   };
 
-  vendorHash = "sha256-VKJIbsVIIEEGqo+LXfYzhIJLtcj0jbbq/UXVpykgcz8=";
+  vendorHash = "sha256-Yzab4Y6ETOZM5zL/5fQSzqNFi51YOgDjsL53efW1vvk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/vale/styles.nix b/pkgs/tools/text/vale/styles.nix
index f2513289a5488..54764f77ff471 100644
--- a/pkgs/tools/text/vale/styles.nix
+++ b/pkgs/tools/text/vale/styles.nix
@@ -48,12 +48,12 @@ in
 
   google = buildStyle rec {
     name = "Google";
-    version = "0.6.0";
+    version = "0.6.1";
     src = fetchFromGitHub {
       owner = "errata-ai";
       repo = "Google";
       rev = "v${version}";
-      hash = "sha256-TQS/hgS6tEWPSuZpEbX65MdYSE/+HJVcnzIuQbhIG2M=";
+      hash = "sha256-jSmfUgzlIbDVh2zLtnTNpM/z6dHMp358F9adLZ5+qcw=";
     };
     meta = {
       description = "A Vale-compatible implementation of the Google Developer Documentation Style Guide";
@@ -80,12 +80,12 @@ in
 
   microsoft = buildStyle rec {
     name = "Microsoft";
-    version = "0.14.0";
+    version = "0.14.1";
     src = fetchFromGitHub {
       owner = "errata-ai";
       repo = "Microsoft";
       rev = "v${version}";
-      hash = "sha256-22rGNLZOsWYQ+H3CcM2b1zOXV3kNPcgYqDpaCg1iv9o=";
+      hash = "sha256-4j05bIGAVEy6untUqtrUxdLKlhyOcJsbcsow8OxRp1A=";
     };
     meta = {
       description = "A Vale-compatible implementation of the Microsoft Writing Style Guide";