about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/stdenv/meta.chapter.md4
-rw-r--r--maintainers/maintainer-list.nix12
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md2
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md8
-rw-r--r--nixos/modules/module-list.nix10
-rw-r--r--nixos/modules/rename.nix1
-rw-r--r--nixos/modules/services/admin/docuum.nix45
-rw-r--r--nixos/modules/services/home-automation/homeassistant-satellite.nix225
-rw-r--r--nixos/modules/services/home-automation/wyoming/faster-whisper.nix (renamed from nixos/modules/services/audio/wyoming/faster-whisper.nix)0
-rw-r--r--nixos/modules/services/home-automation/wyoming/openwakeword.nix (renamed from nixos/modules/services/audio/wyoming/openwakeword.nix)0
-rw-r--r--nixos/modules/services/home-automation/wyoming/piper.nix (renamed from nixos/modules/services/audio/wyoming/piper.nix)0
-rw-r--r--nixos/modules/services/home-automation/wyoming/satellite.nix244
-rw-r--r--nixos/modules/services/misc/invidious-router.nix121
-rw-r--r--nixos/modules/services/networking/mycelium.nix13
-rw-r--r--nixos/modules/services/networking/networkmanager.nix2
-rw-r--r--nixos/modules/services/web-apps/jitsi-meet.nix11
-rw-r--r--nixos/modules/services/x11/desktop-managers/pantheon.nix30
-rw-r--r--nixos/modules/services/x11/display-managers/default.nix2
-rw-r--r--nixos/modules/services/x11/xserver.nix10
-rw-r--r--nixos/modules/system/boot/initrd-ssh.nix30
-rw-r--r--nixos/modules/virtualisation/incus.nix18
-rw-r--r--nixos/tests/lvm2/default.nix7
-rw-r--r--nixos/tests/lvm2/systemd-stage-1.nix6
-rw-r--r--nixos/tests/lvm2/thinpool.nix5
-rw-r--r--nixos/tests/lvm2/vdo.nix4
-rw-r--r--nixos/tests/pantheon.nix6
-rw-r--r--pkgs/applications/audio/jacktrip/default.nix4
-rw-r--r--pkgs/applications/audio/schismtracker/default.nix4
-rw-r--r--pkgs/applications/audio/spotify-player/default.nix6
-rw-r--r--pkgs/applications/audio/squeezelite/default.nix6
-rw-r--r--pkgs/applications/blockchains/erigon/default.nix14
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix48
-rw-r--r--pkgs/applications/graphics/oculante/default.nix6
-rw-r--r--pkgs/applications/graphics/pureref/default.nix14
-rw-r--r--pkgs/applications/misc/gramps/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix4
-rw-r--r--pkgs/applications/networking/sync/storj-uplink/default.nix4
-rw-r--r--pkgs/applications/office/planify/default.nix4
-rw-r--r--pkgs/applications/science/logic/dafny/default.nix4
-rw-r--r--pkgs/applications/version-management/lucky-commit/default.nix6
-rw-r--r--pkgs/by-name/ad/advcpmv/package.nix62
-rw-r--r--pkgs/by-name/bu/bunbun/package.nix40
-rw-r--r--pkgs/by-name/bu/buttermanager/package.nix51
-rw-r--r--pkgs/by-name/cl/clash-verge-rev/package.nix4
-rw-r--r--pkgs/by-name/do/docuum/package.nix38
-rw-r--r--pkgs/by-name/do/doge/package.nix4
-rw-r--r--pkgs/by-name/dy/dynamodb-local/package.nix1
-rw-r--r--pkgs/by-name/ha/hacompanion/package.nix4
-rw-r--r--pkgs/by-name/ht/httpy-cli/package.nix53
-rw-r--r--pkgs/by-name/km/kmeet/package.nix43
-rw-r--r--pkgs/by-name/ll/llama-cpp/package.nix11
-rw-r--r--pkgs/by-name/lu/lubelogger/package.nix4
-rw-r--r--pkgs/by-name/my/mycelium/Cargo.lock89
-rw-r--r--pkgs/by-name/my/mycelium/package.nix4
-rw-r--r--pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch21
-rw-r--r--pkgs/by-name/pd/pdf4qt/package.nix67
-rw-r--r--pkgs/by-name/pg/pgmoneta/package.nix4
-rw-r--r--pkgs/by-name/po/pot/Cargo.lock (renamed from pkgs/applications/misc/pot/Cargo.lock)22
-rw-r--r--pkgs/by-name/po/pot/package.nix (renamed from pkgs/applications/misc/pot/default.nix)6
-rw-r--r--pkgs/by-name/ra/railway-travel/package.nix76
-rw-r--r--pkgs/by-name/se/sesh/package.nix4
-rw-r--r--pkgs/by-name/ti/tinymist/package.nix2
-rw-r--r--pkgs/by-name/tl/tlrc/package.nix6
-rw-r--r--pkgs/by-name/tr/treedome/package.nix4
-rw-r--r--pkgs/by-name/ty/typstyle/package.nix46
-rw-r--r--pkgs/by-name/wy/wyoming-satellite/package.nix60
-rw-r--r--pkgs/by-name/zi/zircolite/package.nix8
-rw-r--r--pkgs/data/fonts/google-fonts/default.nix13
-rw-r--r--pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix2
-rw-r--r--pkgs/desktops/pantheon/desktop/gala/default.nix3
-rw-r--r--pkgs/development/compilers/dotnet/common.nix114
-rw-r--r--pkgs/development/compilers/idris2/build-idris.nix46
-rw-r--r--pkgs/development/compilers/vala/default.nix21
-rw-r--r--pkgs/development/compilers/vala/disable-graphviz-0.46.1.patch280
-rw-r--r--pkgs/development/coq-modules/metacoq/default.nix8
-rw-r--r--pkgs/development/coq-modules/serapi/default.nix3
-rw-r--r--pkgs/development/libraries/libkrun/default.nix6
-rw-r--r--pkgs/development/misc/brev-cli/default.nix4
-rw-r--r--pkgs/development/php-packages/phpstan/default.nix6
-rw-r--r--pkgs/development/python-modules/aadict/default.nix29
-rw-r--r--pkgs/development/python-modules/actdiag/default.nix26
-rw-r--r--pkgs/development/python-modules/ailment/default.nix10
-rw-r--r--pkgs/development/python-modules/aioraven/default.nix8
-rw-r--r--pkgs/development/python-modules/angr/default.nix21
-rw-r--r--pkgs/development/python-modules/angrcli/default.nix17
-rw-r--r--pkgs/development/python-modules/angrop/default.nix8
-rw-r--r--pkgs/development/python-modules/approvaltests/default.nix18
-rw-r--r--pkgs/development/python-modules/archinfo/default.nix10
-rw-r--r--pkgs/development/python-modules/argilla/default.nix4
-rw-r--r--pkgs/development/python-modules/asciimatics/default.nix28
-rw-r--r--pkgs/development/python-modules/b2sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/bc-python-hcl2/default.nix12
-rw-r--r--pkgs/development/python-modules/blockdiag/default.nix27
-rw-r--r--pkgs/development/python-modules/boto3-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/claripy/default.nix23
-rw-r--r--pkgs/development/python-modules/cle/default.nix16
-rw-r--r--pkgs/development/python-modules/django-webpush/default.nix12
-rw-r--r--pkgs/development/python-modules/findpython/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-error-reporting/default.nix8
-rw-r--r--pkgs/development/python-modules/google-nest-sdm/default.nix15
-rw-r--r--pkgs/development/python-modules/huggingface-hub/default.nix4
-rw-r--r--pkgs/development/python-modules/langsmith/default.nix4
-rw-r--r--pkgs/development/python-modules/librosa/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-readers-s3/default.nix4
-rw-r--r--pkgs/development/python-modules/mizani/default.nix4
-rw-r--r--pkgs/development/python-modules/mypy-boto3/default.nix14
-rw-r--r--pkgs/development/python-modules/nampa/default.nix38
-rw-r--r--pkgs/development/python-modules/nwdiag/default.nix26
-rw-r--r--pkgs/development/python-modules/pex/default.nix6
-rw-r--r--pkgs/development/python-modules/pubnub/default.nix8
-rw-r--r--pkgs/development/python-modules/pyformlang/default.nix13
-rw-r--r--pkgs/development/python-modules/pylacus/default.nix4
-rw-r--r--pkgs/development/python-modules/pynvim-pp/default.nix6
-rw-r--r--pkgs/development/python-modules/pyring-buffer/default.nix36
-rw-r--r--pkgs/development/python-modules/pysilero-vad/default.nix61
-rw-r--r--pkgs/development/python-modules/python-whois/default.nix34
-rw-r--r--pkgs/development/python-modules/pyvex/default.nix14
-rw-r--r--pkgs/development/python-modules/pywebpush/default.nix35
-rw-r--r--pkgs/development/python-modules/reptor/default.nix4
-rw-r--r--pkgs/development/python-modules/requirements-parser/default.nix4
-rw-r--r--pkgs/development/python-modules/robotframework-pythonlibcore/default.nix27
-rw-r--r--pkgs/development/python-modules/scalene/default.nix87
-rw-r--r--pkgs/development/python-modules/seqdiag/default.nix27
-rw-r--r--pkgs/development/python-modules/tencentcloud-sdk-python/default.nix4
-rw-r--r--pkgs/development/python-modules/tesla-fleet-api/default.nix4
-rw-r--r--pkgs/development/python-modules/tesserocr/default.nix4
-rw-r--r--pkgs/development/python-modules/unique-log-filter/default.nix2
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/backblaze-b2/default.nix57
-rw-r--r--pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix9
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix6
-rw-r--r--pkgs/development/tools/misc/netcoredbg/default.nix1
-rw-r--r--pkgs/development/tools/misc/rsonpath/default.nix6
-rw-r--r--pkgs/development/tools/open-policy-agent/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix10
-rw-r--r--pkgs/servers/misc/oven-media-engine/default.nix8
-rw-r--r--pkgs/servers/web-apps/mediawiki/default.nix4
-rw-r--r--pkgs/shells/fzf-git-sh/default.nix2
-rw-r--r--pkgs/stdenv/generic/check-meta.nix28
-rw-r--r--pkgs/tools/admin/aliyun-cli/default.nix4
-rw-r--r--pkgs/tools/admin/granted/default.nix6
-rw-r--r--pkgs/tools/filesystems/xfsprogs/default.nix4
-rw-r--r--pkgs/tools/misc/latex2html/default.nix4
-rw-r--r--pkgs/tools/misc/panoply/default.nix4
-rw-r--r--pkgs/tools/misc/remind/default.nix4
-rw-r--r--pkgs/tools/misc/vial/default.nix2
-rw-r--r--pkgs/tools/package-management/libdnf/default.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix4
-rw-r--r--pkgs/tools/security/aws-iam-authenticator/default.nix6
-rw-r--r--pkgs/tools/security/cnspec/default.nix6
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock6
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix6
-rw-r--r--pkgs/tools/security/pass/extensions/audit/default.nix8
-rw-r--r--pkgs/tools/security/step-cli/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix6
-rw-r--r--pkgs/top-level/python-packages.nix6
163 files changed, 2059 insertions, 1155 deletions
diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 7f57eda791ea0..cfcc5549e8d19 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -47,6 +47,10 @@ Release branch. Used to specify that a package is not going to receive updates t
 
 The package’s homepage. Example: `https://www.gnu.org/software/hello/manual/`
 
+### `repository` {#var-meta-repository}
+
+A webpage where the package's source code can be viewed.  `https` links are preferred if available.  Automatically set to a default value if the package uses a `fetchFrom*` fetcher for its `src`. Example: `https://github.com/forthy42/gforth`
+
 ### `downloadPage` {#var-meta-downloadPage}
 
 The page where a link to the current version can be found. Example: `https://ftp.gnu.org/gnu/hello/`
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b328568e5b6ae..f5dbcb02b57d9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11231,6 +11231,12 @@
       fingerprint = "92D8 A09D 03DD B774 AABD 53B9 E136 2F07 D750 DB5C";
     }];
   };
+  lilacious = {
+    email = "yuchenhe126@gmail.com";
+    github = "Lilacious";
+    githubId = 101508537;
+    name = "Yuchen He";
+  };
   lillycham = {
     email = "lillycat332@gmail.com";
     github = "lillycat332";
@@ -17420,6 +17426,12 @@
     githubId = 92817635;
     name = "Sanskar Gurdasani";
   };
+  sarahec = {
+    email = "sarahec@nextquestion.net";
+    github = "sarahec";
+    githubId = 11277967;
+    name = "Sarah Clark";
+  };
   sarcasticadmin = {
     email = "rob@sarcasticadmin.com";
     github = "sarcasticadmin";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 5313f04cb7895..d837e0ff68b7c 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -1001,7 +1001,7 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
   Satellite](https://github.com/synesthesiam/homeassistant-satellite), a
   streaming audio satellite for Home Assistant voice pipelines, where you can
   reuse existing mic and speaker hardware. Available as
-  [services.homeassistant-satellite](#opt-services.homeassistant-satellite.enable).
+  `services.homeassistant-satellite`.
 
 - [Apache Guacamole](https://guacamole.apache.org/), a cross-platform,
   clientless remote desktop gateway. Available as
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 01ba9038fa75a..9a2c446a9eb11 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -126,6 +126,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [armagetronad](https://wiki.armagetronad.org), a mid-2000s 3D lightcycle game widely played at iD Tech Camps. You can define multiple servers using `services.armagetronad.<server>.enable`.
 
+- [wyoming-satellite](https://github.com/rhasspy/wyoming-satellite), a voice assistant satellite for Home Assistant using the Wyoming protocol. Available as [services.wyoming.satellite]($opt-services.wyoming.satellite.enable).
+
 - [TuxClocker](https://github.com/Lurkki14/tuxclocker), a hardware control and monitoring program. Available as [programs.tuxclocker](#opt-programs.tuxclocker.enable).
 
 - [ALVR](https://github.com/alvr-org/alvr), a VR desktop streamer. Available as [programs.alvr](#opt-programs.alvr.enable)
@@ -284,6 +286,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `services.archisteamfarm` no longer uses the abbreviation `asf` for its state directory (`/var/lib/asf`), user and group (both `asf`). Instead the long name `archisteamfarm` is used.
   Configurations with `system.stateVersion` 23.11 or earlier, default to the old stateDirectory until the 24.11 release and must either set the option explicitly or move the data to the new directory.
 
+- `xfsprogs` was updated to version 6.6.0, which enables reverse mapping (rmapbt) and large extent counts (nrext64) by default.
+   Support for these features was added in kernel 4.9 and 5.19 and nrext64 was deemed stable in kernel 6.5.
+   Format your filesystems with `mkfs.xfs -i nrext64=0`, if they need to be readable by GRUB2 before 2.12 or kernels older than 5.19.
+
 - `networking.iproute2.enable` now does not set `environment.etc."iproute2/rt_tables".text`.
 
   Setting `environment.etc."iproute2/{CONFIG_FILE_NAME}".text` will override the whole configuration file instead of appending it to the upstream configuration file.
@@ -373,6 +379,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - The Matrix homeserver [Synapse](https://element-hq.github.io/synapse/) module now supports configuring UNIX domain socket [listeners](#opt-services.matrix-synapse.settings.listeners) through the `path` option.
   The default replication worker on the main instance has been migrated away from TCP sockets to UNIX domain sockets.
 
+- The initrd ssh daemon module got a new option to add authorized keys via a list of files using `boot.initrd.network.ssh.authorizedKeyFiles`.
+
 - Programs written in [Nim](https://nim-lang.org/) are built with libraries selected by lockfiles.
   The `nimPackages` and `nim2Packages` sets have been removed.
   See https://nixos.org/manual/nixpkgs/unstable#nim for more information.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 90b37e8783125..aec16e791f4d0 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -331,6 +331,7 @@
   ./security/systemd-confinement.nix
   ./security/tpm2.nix
   ./security/wrappers/default.nix
+  ./services/admin/docuum.nix
   ./services/admin/meshcentral.nix
   ./services/admin/oxidized.nix
   ./services/admin/pgadmin.nix
@@ -362,9 +363,6 @@
   ./services/audio/spotifyd.nix
   ./services/audio/squeezelite.nix
   ./services/audio/tts.nix
-  ./services/audio/wyoming/faster-whisper.nix
-  ./services/audio/wyoming/openwakeword.nix
-  ./services/audio/wyoming/piper.nix
   ./services/audio/ympd.nix
   ./services/backup/automysqlbackup.nix
   ./services/backup/bacula.nix
@@ -587,8 +585,11 @@
   ./services/home-automation/evcc.nix
   ./services/home-automation/govee2mqtt.nix
   ./services/home-automation/home-assistant.nix
-  ./services/home-automation/homeassistant-satellite.nix
   ./services/home-automation/matter-server.nix
+  ./services/home-automation/wyoming/faster-whisper.nix
+  ./services/home-automation/wyoming/openwakeword.nix
+  ./services/home-automation/wyoming/piper.nix
+  ./services/home-automation/wyoming/satellite.nix
   ./services/home-automation/zigbee2mqtt.nix
   ./services/home-automation/zwave-js.nix
   ./services/logging/SystemdJournal2Gelf.nix
@@ -712,6 +713,7 @@
   ./services/misc/homepage-dashboard.nix
   ./services/misc/ihaskell.nix
   ./services/misc/input-remapper.nix
+  ./services/misc/invidious-router.nix
   ./services/misc/irkerd.nix
   ./services/misc/jackett.nix
   ./services/misc/jellyfin.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 0a975fcd98c8c..8e30e401c792e 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -62,6 +62,7 @@ in
     (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
     (mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
+    (mkRemovedOptionModule [ "services" "homeassistant-satellite"] "The `services.homeassistant-satellite` module has been replaced by `services.wyoming-satellite`.")
     (mkRemovedOptionModule [ "services" "ihatemoney" ] "The ihatemoney module has been removed for lack of downstream maintainer")
     (mkRemovedOptionModule [ "services" "kippo" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "mailpile" ] "The corresponding package was removed from nixpkgs.")
diff --git a/nixos/modules/services/admin/docuum.nix b/nixos/modules/services/admin/docuum.nix
new file mode 100644
index 0000000000000..6f6cd4e027337
--- /dev/null
+++ b/nixos/modules/services/admin/docuum.nix
@@ -0,0 +1,45 @@
+{ config, pkgs, lib, utils, ... }:
+
+let
+  cfg = config.services.docuum;
+  inherit (lib) mkIf mkEnableOption mkOption getExe types;
+in
+{
+  options.services.docuum = {
+    enable = mkEnableOption "docuum daemon";
+
+    threshold = mkOption {
+      description = "Threshold for deletion in bytes, like `10 GB`, `10 GiB`, `10GB` or percentage-based thresholds like `50%`";
+      type = types.str;
+      default = "10 GB";
+      example = "50%";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.virtualisation.docker.enable;
+        message = "docuum requires docker on the host";
+      }
+    ];
+
+    systemd.services.docuum = {
+      after = [ "docker.socket" ];
+      requires = [ "docker.socket" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ config.virtualisation.docker.package ];
+      environment.HOME = "/var/lib/docuum";
+
+      serviceConfig = {
+        DynamicUser = true;
+        StateDirectory = "docuum";
+        SupplementaryGroups = [ "docker" ];
+        ExecStart = utils.escapeSystemdExecArgs [
+          (getExe pkgs.docuum)
+          "--threshold" cfg.threshold
+        ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/home-automation/homeassistant-satellite.nix b/nixos/modules/services/home-automation/homeassistant-satellite.nix
deleted file mode 100644
index 6ca428f2af818..0000000000000
--- a/nixos/modules/services/home-automation/homeassistant-satellite.nix
+++ /dev/null
@@ -1,225 +0,0 @@
-{ config
-, lib
-, pkgs
-, ...
-}:
-
-let
-  cfg = config.services.homeassistant-satellite;
-
-  inherit (lib)
-    escapeShellArg
-    escapeShellArgs
-    mkOption
-    mdDoc
-    mkEnableOption
-    mkIf
-    mkPackageOption
-    types
-    ;
-
-  inherit (builtins)
-    toString
-    ;
-
-  # override the package with the relevant vad dependencies
-  package = cfg.package.overridePythonAttrs (oldAttrs: {
-    propagatedBuildInputs = oldAttrs.propagatedBuildInputs
-      ++ lib.optional (cfg.vad == "webrtcvad") cfg.package.optional-dependencies.webrtc
-      ++ lib.optional (cfg.vad == "silero") cfg.package.optional-dependencies.silerovad
-      ++ lib.optional (cfg.pulseaudio.enable) cfg.package.optional-dependencies.pulseaudio;
-  });
-
-in
-
-{
-  meta.buildDocsInSandbox = false;
-
-  options.services.homeassistant-satellite = with types; {
-    enable = mkEnableOption (mdDoc "Home Assistant Satellite");
-
-    package = mkPackageOption pkgs "homeassistant-satellite" { };
-
-    user = mkOption {
-      type = str;
-      example = "alice";
-      description = mdDoc ''
-        User to run homeassistant-satellite under.
-      '';
-    };
-
-    group = mkOption {
-      type = str;
-      default = "users";
-      description = mdDoc ''
-        Group to run homeassistant-satellite under.
-      '';
-    };
-
-    host = mkOption {
-      type = str;
-      example = "home-assistant.local";
-      description = mdDoc ''
-        Hostname on which your Home Assistant instance can be reached.
-      '';
-    };
-
-    port = mkOption {
-      type = port;
-      example = 8123;
-      description = mdDoc ''
-        Port on which your Home Assistance can be reached.
-      '';
-      apply = toString;
-    };
-
-    protocol = mkOption {
-      type = enum [ "http" "https" ];
-      default = "http";
-      example = "https";
-      description = mdDoc ''
-        The transport protocol used to connect to Home Assistant.
-      '';
-    };
-
-    tokenFile = mkOption {
-      type = path;
-      example = "/run/keys/hass-token";
-      description = mdDoc ''
-        Path to a file containing a long-lived access token for your Home Assistant instance.
-      '';
-      apply = escapeShellArg;
-    };
-
-    sounds = {
-      awake = mkOption {
-        type = nullOr str;
-        default = null;
-        description = mdDoc ''
-          Audio file to play when the wake word is detected.
-        '';
-      };
-
-      done = mkOption {
-        type = nullOr str;
-        default = null;
-        description = mdDoc ''
-          Audio file to play when the voice command is done.
-        '';
-      };
-    };
-
-    vad = mkOption {
-      type = enum [ "disabled" "webrtcvad" "silero" ];
-      default = "disabled";
-      example = "silero";
-      description = mdDoc ''
-        Voice activity detection model. With `disabled` sound will be transmitted continously.
-      '';
-    };
-
-    pulseaudio = {
-      enable = mkEnableOption "recording/playback via PulseAudio or PipeWire";
-
-      socket = mkOption {
-        type = nullOr str;
-        default = null;
-        example = "/run/user/1000/pulse/native";
-        description = mdDoc ''
-          Path or hostname to connect with the PulseAudio server.
-        '';
-      };
-
-      duckingVolume = mkOption {
-        type = nullOr float;
-        default = null;
-        example = 0.4;
-        description = mdDoc ''
-          Reduce output volume (between 0 and 1) to this percentage value while recording.
-        '';
-      };
-
-      echoCancellation = mkEnableOption "acoustic echo cancellation";
-    };
-
-    extraArgs = mkOption {
-      type = listOf str;
-      default = [ ];
-      description = mdDoc ''
-        Extra arguments to pass to the commandline.
-      '';
-      apply = escapeShellArgs;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services."homeassistant-satellite" = {
-      description = "Home Assistant Satellite";
-      after = [
-        "network-online.target"
-      ];
-      wants = [
-        "network-online.target"
-      ];
-      wantedBy = [
-        "multi-user.target"
-      ];
-      path = with pkgs; [
-        ffmpeg-headless
-      ] ++ lib.optionals (!cfg.pulseaudio.enable) [
-        alsa-utils
-      ];
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        # https://github.com/rhasspy/hassio-addons/blob/master/assist_microphone/rootfs/etc/s6-overlay/s6-rc.d/assist_microphone/run
-        ExecStart = ''
-          ${package}/bin/homeassistant-satellite \
-            --host ${cfg.host} \
-            --port ${cfg.port} \
-            --protocol ${cfg.protocol} \
-            --token-file ${cfg.tokenFile} \
-            --vad ${cfg.vad} \
-            ${lib.optionalString cfg.pulseaudio.enable "--pulseaudio"}${lib.optionalString (cfg.pulseaudio.socket != null) "=${cfg.pulseaudio.socket}"} \
-            ${lib.optionalString (cfg.pulseaudio.enable && cfg.pulseaudio.duckingVolume != null) "--ducking-volume=${toString cfg.pulseaudio.duckingVolume}"} \
-            ${lib.optionalString (cfg.pulseaudio.enable && cfg.pulseaudio.echoCancellation) "--echo-cancel"} \
-            ${lib.optionalString (cfg.sounds.awake != null) "--awake-sound=${toString cfg.sounds.awake}"} \
-            ${lib.optionalString (cfg.sounds.done != null) "--done-sound=${toString cfg.sounds.done}"} \
-            ${cfg.extraArgs}
-        '';
-        CapabilityBoundingSet = "";
-        DeviceAllow = "";
-        DevicePolicy = "closed";
-        LockPersonality = true;
-        MemoryDenyWriteExecute = false; # onnxruntime/capi/onnxruntime_pybind11_state.so: cannot enable executable stack as shared object requires: Operation not permitted
-        PrivateDevices = true;
-        PrivateUsers = true;
-        ProtectHome = false; # Would deny access to local pulse/pipewire server
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectControlGroups = true;
-        ProtectProc = "invisible";
-        ProcSubset = "all"; # Error in cpuinfo: failed to parse processor information from /proc/cpuinfo
-        Restart = "always";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        SupplementaryGroups = [
-          "audio"
-        ];
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
-        UMask = "0077";
-      };
-    };
-  };
-}
diff --git a/nixos/modules/services/audio/wyoming/faster-whisper.nix b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
index 0c36e8c9ab059..0c36e8c9ab059 100644
--- a/nixos/modules/services/audio/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
diff --git a/nixos/modules/services/audio/wyoming/openwakeword.nix b/nixos/modules/services/home-automation/wyoming/openwakeword.nix
index 252f70be2baa4..252f70be2baa4 100644
--- a/nixos/modules/services/audio/wyoming/openwakeword.nix
+++ b/nixos/modules/services/home-automation/wyoming/openwakeword.nix
diff --git a/nixos/modules/services/audio/wyoming/piper.nix b/nixos/modules/services/home-automation/wyoming/piper.nix
index 2828fdf078921..2828fdf078921 100644
--- a/nixos/modules/services/audio/wyoming/piper.nix
+++ b/nixos/modules/services/home-automation/wyoming/piper.nix
diff --git a/nixos/modules/services/home-automation/wyoming/satellite.nix b/nixos/modules/services/home-automation/wyoming/satellite.nix
new file mode 100644
index 0000000000000..531d375e703a3
--- /dev/null
+++ b/nixos/modules/services/home-automation/wyoming/satellite.nix
@@ -0,0 +1,244 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.wyoming.satellite;
+
+  inherit (lib)
+    elem
+    escapeShellArgs
+    getExe
+    literalExpression
+    mkOption
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    optional
+    optionals
+    types
+  ;
+
+  finalPackage = cfg.package.overridePythonAttrs (oldAttrs: {
+    propagatedBuildInputs = oldAttrs.propagatedBuildInputs
+      # for audio enhancements like auto-gain, noise suppression
+      ++ cfg.package.optional-dependencies.webrtc
+      # vad is currently optional, because it is broken on aarch64-linux
+      ++ optionals cfg.vad.enable cfg.package.optional-dependencies.silerovad;
+    });
+in
+
+{
+  meta.buildDocsInSandbox = false;
+
+  options.services.wyoming.satellite = with types; {
+    enable = mkEnableOption "Wyoming Satellite";
+
+    package = mkPackageOption pkgs "wyoming-satellite" { };
+
+    user = mkOption {
+      type = str;
+      example = "alice";
+      description = ''
+        User to run wyoming-satellite under.
+      '';
+    };
+
+    group = mkOption {
+      type = str;
+      default = "users";
+      description = ''
+        Group to run wyoming-satellite under.
+      '';
+    };
+
+    uri = mkOption {
+      type = str;
+      default = "tcp://0.0.0.0:10700";
+      description = ''
+        URI where wyoming-satellite will bind its socket.
+      '';
+    };
+
+    name = mkOption {
+      type = str;
+      default = config.networking.hostName;
+      defaultText = literalExpression ''
+        config.networking.hostName
+      '';
+      description = ''
+        Name of the satellite.
+      '';
+    };
+
+    area = mkOption {
+      type = nullOr str;
+      default = null;
+      example = "Kitchen";
+      description = ''
+        Area to the satellite.
+      '';
+    };
+
+    microphone = {
+      command = mkOption {
+        type = str;
+        default = "arecord -r 16000 -c 1 -f S16_LE -t raw";
+        description = ''
+          Program to run for audio input.
+        '';
+      };
+
+      autoGain = mkOption {
+        type = ints.between 0 31;
+        default = 5;
+        example = 15;
+        description = ''
+          Automatic gain control in dbFS, with 31 being the loudest value. Set to 0 to disable.
+        '';
+      };
+
+      noiseSuppression = mkOption {
+        type = ints.between 0 4;
+        default = 2;
+        example = 3;
+        description = ''
+          Noise suppression level with 4 being the maximum suppression,
+          which may cause audio distortion. Set to 0 to disable.
+        '';
+      };
+    };
+
+    sound = {
+      command = mkOption {
+        type = nullOr str;
+        default = "aplay -r 22050 -c 1 -f S16_LE -t raw";
+        description = ''
+          Program to run for sound output.
+        '';
+      };
+    };
+
+    sounds = {
+      awake = mkOption {
+        type = nullOr path;
+        default = null;
+        description = ''
+          Path to audio file in WAV format to play when wake word is detected.
+        '';
+      };
+
+      done = mkOption {
+        type = nullOr path;
+        default = null;
+        description = ''
+          Path to audio file in WAV format to play when voice command recording has ended.
+        '';
+      };
+    };
+
+    vad = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = ''
+          Whether to enable voice activity detection.
+
+          Enabling will result in only streaming audio, when speech gets
+          detected.
+        '';
+      };
+    };
+
+    extraArgs = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Extra arguments to pass to the executable.
+
+        Check `wyoming-satellite --help` for possible options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services."wyoming-satellite" = {
+      description = "Wyoming Satellite";
+      after = [
+        "network-online.target"
+        "sound.target"
+      ];
+      wants = [
+        "network-online.target"
+        "sound.target"
+      ];
+      wantedBy = [
+        "multi-user.target"
+      ];
+      path = with pkgs; [
+        alsa-utils
+      ];
+      script = let
+        optionalParam = param: argument: optionals (!elem argument [ null 0 false ]) [
+          param argument
+        ];
+      in ''
+        export XDG_RUNTIME_DIR=/run/user/$UID
+        ${escapeShellArgs ([
+          (getExe finalPackage)
+          "--uri" cfg.uri
+          "--name" cfg.name
+          "--mic-command" cfg.microphone.command
+        ]
+        ++ optionalParam "--mic-auto-gain" cfg.microphone.autoGain
+        ++ optionalParam "--mic-noise-suppression" cfg.microphone.noiseSuppression
+        ++ optionalParam "--area" cfg.area
+        ++ optionalParam "--snd-command" cfg.sound.command
+        ++ optionalParam "--awake-wav" cfg.sounds.awake
+        ++ optionalParam "--done-wav" cfg.sounds.done
+        ++ optional cfg.vad.enable "--vad"
+        ++ cfg.extraArgs)}
+      '';
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        # https://github.com/rhasspy/hassio-addons/blob/master/assist_microphone/rootfs/etc/s6-overlay/s6-rc.d/assist_microphone/run
+        CapabilityBoundingSet = "";
+        DeviceAllow = "";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = false; # onnxruntime/capi/onnxruntime_pybind11_state.so: cannot enable executable stack as shared object requires: Operation not permitted
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHome = false; # Would deny access to local pulse/pipewire server
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectProc = "invisible";
+        ProcSubset = "all"; # Error in cpuinfo: failed to parse processor information from /proc/cpuinfo
+        Restart = "always";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SupplementaryGroups = [
+          "audio"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/misc/invidious-router.nix b/nixos/modules/services/misc/invidious-router.nix
new file mode 100644
index 0000000000000..01ef18dad5356
--- /dev/null
+++ b/nixos/modules/services/misc/invidious-router.nix
@@ -0,0 +1,121 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.invidious-router;
+  settingsFormat = pkgs.formats.yaml {};
+  configFile = settingsFormat.generate "config.yaml" cfg.settings;
+in {
+  meta.maintainers = [lib.maintainers.s1ls];
+
+  options.services.invidious-router = {
+    enable = lib.mkEnableOption "Enables the invidious-router service";
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8050;
+      description = lib.mdDoc ''
+        Port to bind to.
+      '';
+    };
+    address = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = lib.mdDoc ''
+        Address on which invidious-router should listen on.
+      '';
+    };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+      };
+      default = {
+        app = {
+          listen = "127.0.0.1:8050";
+          enable_youtube_fallback = false;
+          reload_instance_list_interval = "60s";
+        };
+        api = {
+          enabled = true;
+          url = "https://api.invidious.io/instances.json";
+          filter_regions = true;
+          allowed_regions = [
+            "AT"
+            "DE"
+            "CH"
+          ];
+        };
+        healthcheck = {
+          path = "/";
+          allowed_status_codes = [
+            200
+          ];
+          timeout = "1s";
+          interval = "10s";
+          filter_by_response_time = {
+            enabled = true;
+            qty_of_top_results = 3;
+          };
+          minimum_ratio = 0.2;
+          remove_no_ratio = true;
+          text_not_present = "YouTube is currently trying to block Invidious instances";
+        };
+      };
+      description = lib.mdDoc ''
+        Configuration for invidious-router.
+        Check https://gitlab.com/gaincoder/invidious-router#configuration
+        for configuration options.
+      '';
+    };
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.invidious-router;
+      defaultText = lib.literalExpression "pkgs.invidious-router";
+      description = lib.mdDoc ''
+        The invidious-router package to use.
+      '';
+    };
+    nginx = {
+      enable = lib.mkEnableOption (lib.mdDoc ''
+        Automatic nginx proxy configuration
+      '');
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "invidious-router.example.com";
+        description = lib.mdDoc ''
+          The domain on which invidious-router should be served.
+        '';
+      };
+      extraDomains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [];
+        description = lib.mdDoc ''
+          Additional domains to serve invidious-router on.
+        '';
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    systemd.services.invidious-router = {
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        Restart = "on-failure";
+        ExecStart = "${lib.getExe cfg.package} --configfile ${configFile}";
+        DynamicUser = "yes";
+      };
+    };
+
+    services.nginx.virtualHosts = lib.mkIf cfg.nginx.enable {
+      ${cfg.nginx.domain} = {
+        locations."/" = {
+          recommendedProxySettings = true;
+          proxyPass = "http://${cfg.address}:${toString cfg.port}";
+        };
+        enableACME = true;
+        forceSSL = true;
+        serverAliases = cfg.nginx.extraDomains;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/mycelium.nix b/nixos/modules/services/networking/mycelium.nix
index 9c4bca7c68618..9487a5daafee0 100644
--- a/nixos/modules/services/networking/mycelium.nix
+++ b/nixos/modules/services/networking/mycelium.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, utils, ... }:
 
 let
   cfg = config.services.mycelium;
@@ -46,6 +46,15 @@ in
         Adds the hosted peers from https://github.com/threefoldtech/mycelium#hosted-public-nodes.
       '';
     };
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Extra command-line arguments to pass to mycelium.
+
+        See `mycelium --help` for all available options.
+      '';
+    };
   };
   config = lib.mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ 9651 ];
@@ -87,6 +96,7 @@ in
           )
           "--tun-name"
           "mycelium"
+          "${utils.escapeSystemdExecArgs cfg.extraArgs}"
         ] ++
         (lib.optional (cfg.addHostedPublicNodes || cfg.peers != [ ]) "--peers")
         ++ cfg.peers ++ (lib.optionals cfg.addHostedPublicNodes [
@@ -130,4 +140,3 @@ in
     maintainers = with lib.maintainers; [ flokli lassulus ];
   };
 }
-
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 573a02cbda9e1..1eaf065972d21 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -390,7 +390,7 @@ in
           };
         });
         default = [ ];
-        example = literalExpression ''[{ name = "03f0:4e1d"; script = "''${pkgs.modemmanager}/share/ModemManager/fcc-unlock.available.d/03f0:4e1d"; }]'';
+        example = literalExpression ''[{ id = "03f0:4e1d"; path = "''${pkgs.modemmanager}/share/ModemManager/fcc-unlock.available.d/03f0:4e1d"; }]'';
         description = lib.mdDoc ''
           List of FCC unlock scripts to enable on the system, behaving as described in
           https://modemmanager.org/docs/modemmanager/fcc-unlock/#integration-with-third-party-fcc-unlock-tools.
diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index c4505534d635e..f907aa68f55e1 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -188,7 +188,14 @@ in
       description = lib.mdDoc ''The port which the Excalidraw backend for Jitsi should listen to.'';
     };
 
-    secureDomain.enable = mkEnableOption (lib.mdDoc "Authenticated room creation");
+    secureDomain = {
+      enable = mkEnableOption (lib.mdDoc "Authenticated room creation");
+      authentication = mkOption {
+        type = types.str;
+        default = "internal_hashed";
+        description = lib.mdDoc ''The authentication type to be used by jitsi'';
+      };
+    };
   };
 
   config = mkIf cfg.enable {
@@ -309,7 +316,7 @@ in
         enabled = true;
         domain = cfg.hostName;
         extraConfig = ''
-          authentication = ${if cfg.secureDomain.enable then "\"internal_hashed\"" else "\"jitsi-anonymous\""}
+          authentication = ${if cfg.secureDomain.enable then "\"${cfg.secureDomain.authentication}\"" else "\"jitsi-anonymous\""}
           c2s_require_encryption = false
           admins = { "focus@auth.${cfg.hostName}" }
           smacks_max_unacked_stanzas = 5
diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.nix b/nixos/modules/services/x11/desktop-managers/pantheon.nix
index 59bc142eeb7f9..2cfdc69b86e06 100644
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@@ -174,12 +174,38 @@ in
         # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1443
         pkgs.pantheon.mutter
       ];
-      systemd.packages = [
-        pkgs.pantheon.gnome-settings-daemon
+      systemd.packages = with pkgs; [
+        gnome.gnome-session
+        pantheon.gala
+        pantheon.gnome-settings-daemon
+        pantheon.elementary-session-settings
       ];
       programs.dconf.enable = true;
       networking.networkmanager.enable = mkDefault true;
 
+      systemd.user.targets."gnome-session-x11-services".wants = [
+        "org.gnome.SettingsDaemon.XSettings.service"
+      ];
+      systemd.user.targets."gnome-session-x11-services-ready".wants = [
+        "org.gnome.SettingsDaemon.XSettings.service"
+      ];
+
+      # https://github.com/elementary/gala/issues/1826#issuecomment-1890461298
+      systemd.user.services."io.elementary.gala.daemon@" = {
+        unitConfig = {
+          Description = "Gala Daemon";
+          BindsTo = "io.elementary.gala@.service";
+          After = "io.elementary.gala@.service";
+        };
+
+        serviceConfig = {
+          Type = "dbus";
+          BusName = "org.pantheon.gala.daemon";
+          ExecStart = "${pkgs.pantheon.gala}/bin/gala-daemon";
+          Slice = "session.slice";
+        };
+      };
+
       # Global environment
       environment.systemPackages = (with pkgs.pantheon; [
         elementary-session-settings
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index 3e2d5780a5cb1..c22048c6692e9 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -40,7 +40,7 @@ let
         IFS=:
         for i in $XDG_CURRENT_DESKTOP; do
           case $i in
-            KDE|GNOME|X-NIXOS-SYSTEMD-AWARE) echo "1"; exit; ;;
+            KDE|GNOME|Pantheon|X-NIXOS-SYSTEMD-AWARE) echo "1"; exit; ;;
             *) ;;
           esac
         done
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 453f414e2a862..c5b168e608a4d 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -111,7 +111,7 @@ let
     }
       ''
         echo 'Section "Files"' >> $out
-        echo $fontpath >> $out
+        echo "$fontpath" >> $out
 
         for i in ${toString fontsForXServer}; do
           if test "''${i:0:''${#NIX_STORE}}" == "$NIX_STORE"; then
@@ -121,11 +121,9 @@ let
           fi
         done
 
-        for i in $(find ${toString cfg.modules} -type d | sort); do
-          if test $(echo $i/*.so* | wc -w) -ne 0; then
-            echo "  ModulePath \"$i\"" >> $out
-          fi
-        done
+        ${concatMapStrings (m: ''
+        echo "  ModulePath \"${m}/lib/xorg/modules\"" >> "$out"
+        '') cfg.modules}
 
         echo '${cfg.filesSection}' >> $out
         echo 'EndSection' >> $out
diff --git a/nixos/modules/system/boot/initrd-ssh.nix b/nixos/modules/system/boot/initrd-ssh.nix
index 61e61f32bc5ee..43da2496d16c7 100644
--- a/nixos/modules/system/boot/initrd-ssh.nix
+++ b/nixos/modules/system/boot/initrd-ssh.nix
@@ -93,6 +93,21 @@ in
       defaultText = literalExpression "config.users.users.root.openssh.authorizedKeys.keys";
       description = lib.mdDoc ''
         Authorized keys for the root user on initrd.
+        You can combine the `authorizedKeys` and `authorizedKeyFiles` options.
+      '';
+      example = [
+        "ssh-rsa AAAAB3NzaC1yc2etc/etc/etcjwrsh8e596z6J0l7 example@host"
+        "ssh-ed25519 AAAAC3NzaCetcetera/etceteraJZMfk3QPfQ foo@bar"
+      ];
+    };
+
+    authorizedKeyFiles = mkOption {
+      type = types.listOf types.path;
+      default = config.users.users.root.openssh.authorizedKeys.keyFiles;
+      defaultText = literalExpression "config.users.users.root.openssh.authorizedKeys.keyFiles";
+      description = lib.mdDoc ''
+        Authorized keys taken from files for the root user on initrd.
+        You can combine the `authorizedKeyFiles` and `authorizedKeys` options.
       '';
     };
 
@@ -152,7 +167,7 @@ in
   in mkIf enabled {
     assertions = [
       {
-        assertion = cfg.authorizedKeys != [];
+        assertion = cfg.authorizedKeys != [] || cfg.authorizedKeyFiles != [];
         message = "You should specify at least one authorized key for initrd SSH";
       }
 
@@ -206,6 +221,9 @@ in
       ${concatStrings (map (key: ''
         echo ${escapeShellArg key} >> /root/.ssh/authorized_keys
       '') cfg.authorizedKeys)}
+      ${concatStrings (map (keyFile: ''
+        cat ${keyFile} >> /root/.ssh/authorized_keys
+      '') cfg.authorizedKeyFiles)}
 
       ${flip concatMapStrings cfg.hostKeys (path: ''
         # keys from Nix store are world-readable, which sshd doesn't like
@@ -236,9 +254,13 @@ in
 
       users.root.shell = mkIf (config.boot.initrd.network.ssh.shell != null) config.boot.initrd.network.ssh.shell;
 
-      contents."/etc/ssh/authorized_keys.d/root".text =
-        concatStringsSep "\n" config.boot.initrd.network.ssh.authorizedKeys;
-      contents."/etc/ssh/sshd_config".text = sshdConfig;
+      contents = {
+        "/etc/ssh/sshd_config".text = sshdConfig;
+        "/etc/ssh/authorized_keys.d/root".text =
+          concatStringsSep "\n" (
+            config.boot.initrd.network.ssh.authorizedKeys ++
+            (map (file: lib.fileContents file) config.boot.initrd.network.ssh.authorizedKeyFiles));
+      };
       storePaths = ["${package}/bin/sshd"];
 
       services.sshd = {
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 1ceaa40cca9dc..7e75d78f667f1 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -60,8 +60,26 @@ let
   }'';
 
   # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
+  OVMF2MB = pkgs.OVMF.override {
+    secureBoot = true;
+    fdSize2MB = true;
+  };
   ovmf-prefix = if pkgs.stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
   ovmf = pkgs.linkFarm "incus-ovmf" [
+    # 2MB must remain the default or existing VMs will fail to boot. New VMs will prefer 4MB
+    {
+      name = "OVMF_CODE.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_VARS.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.ms.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+
     {
       name = "OVMF_CODE.4MB.fd";
       path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_CODE.fd";
diff --git a/nixos/tests/lvm2/default.nix b/nixos/tests/lvm2/default.nix
index e0358ec2806fa..84f24cbc38593 100644
--- a/nixos/tests/lvm2/default.nix
+++ b/nixos/tests/lvm2/default.nix
@@ -36,9 +36,14 @@ lib.listToAttrs (
     lib.flip lib.concatMap kernelVersionsToTest (version:
       let
         v' = lib.replaceStrings [ "." ] [ "_" ] version;
+        mkXfsFlags = lib.optionalString (lib.versionOlder version "5.10") " -m bigtime=0 -m inobtcount=0 "
+                     + lib.optionalString (lib.versionOlder version "5.19") " -i nrext64=0 ";
       in
       lib.flip lib.mapAttrsToList tests (name: t:
-        lib.nameValuePair "lvm-${name}-linux-${v'}" (lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (t.test ({ kernelPackages = pkgs."linuxPackages_${v'}"; } // builtins.removeAttrs t [ "test" "kernelFilter" ])))
+        lib.nameValuePair "lvm-${name}-linux-${v'}" (lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (t.test ({
+          kernelPackages = pkgs."linuxPackages_${v'}";
+          inherit mkXfsFlags;
+        } // builtins.removeAttrs t [ "test" "kernelFilter" ])))
       )
     )
   )
diff --git a/nixos/tests/lvm2/systemd-stage-1.nix b/nixos/tests/lvm2/systemd-stage-1.nix
index 1c95aadfcb3f1..7f106e1b0dd64 100644
--- a/nixos/tests/lvm2/systemd-stage-1.nix
+++ b/nixos/tests/lvm2/systemd-stage-1.nix
@@ -1,4 +1,4 @@
-{ kernelPackages ? null, flavour }: let
+{ kernelPackages ? null, flavour, mkXfsFlags ? "" }: let
   preparationCode = {
     raid = ''
       machine.succeed("vgcreate test_vg /dev/vdb /dev/vdc")
@@ -71,7 +71,7 @@ in import ../make-test-python.nix ({ pkgs, lib, ... }: {
     boot.loader.systemd-boot.enable = true;
     boot.loader.efi.canTouchEfiVariables = true;
 
-    environment.systemPackages = with pkgs; [ e2fsprogs ]; # for mkfs.ext4
+    environment.systemPackages = with pkgs; [ xfsprogs ];
     boot = {
       initrd.systemd = {
         enable = true;
@@ -88,7 +88,7 @@ in import ../make-test-python.nix ({ pkgs, lib, ... }: {
     machine.wait_for_unit("multi-user.target")
     # Create a VG for the root
     ${preparationCode}
-    machine.succeed("mkfs.ext4 /dev/test_vg/test_lv")
+    machine.succeed("mkfs.xfs ${mkXfsFlags} /dev/test_vg/test_lv")
     machine.succeed("mkdir -p /mnt && mount /dev/test_vg/test_lv /mnt && echo hello > /mnt/test && umount /mnt")
 
     # Boot from LVM
diff --git a/nixos/tests/lvm2/thinpool.nix b/nixos/tests/lvm2/thinpool.nix
index f49c8980613ce..325bb87460b71 100644
--- a/nixos/tests/lvm2/thinpool.nix
+++ b/nixos/tests/lvm2/thinpool.nix
@@ -1,4 +1,4 @@
-{ kernelPackages ? null }:
+{ kernelPackages ? null, mkXfsFlags ? "" }:
 import ../make-test-python.nix ({ pkgs, lib, ... }: {
   name = "lvm2-thinpool";
   meta.maintainers = lib.teams.helsinki-systems.members;
@@ -18,7 +18,8 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: {
   };
 
   testScript = let
-    mkXfsFlags = lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.10") "-m bigtime=0 -m inobtcount=0";
+    mkXfsFlags = lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.10") " -m bigtime=0 -m inobtcount=0 "
+               + lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.19") " -i nrext64=0 ";
   in ''
     machine.succeed("vgcreate test_vg /dev/vdb")
     machine.succeed("lvcreate -L 512M -T test_vg/test_thin_pool")
diff --git a/nixos/tests/lvm2/vdo.nix b/nixos/tests/lvm2/vdo.nix
index 75c1fc094e97f..18d25b7b366d0 100644
--- a/nixos/tests/lvm2/vdo.nix
+++ b/nixos/tests/lvm2/vdo.nix
@@ -1,4 +1,4 @@
-{ kernelPackages ? null }:
+{ kernelPackages ? null, mkXfsFlags ? "" }:
 import ../make-test-python.nix ({ pkgs, lib, ... }: {
   name = "lvm2-vdo";
   meta.maintainers = lib.teams.helsinki-systems.members;
@@ -17,7 +17,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: {
   testScript = ''
     machine.succeed("vgcreate test_vg /dev/vdb")
     machine.succeed("lvcreate --type vdo -n vdo_lv -L 6G -V 12G test_vg/vdo_pool_lv")
-    machine.succeed("mkfs.xfs -K /dev/test_vg/vdo_lv")
+    machine.succeed("mkfs.xfs ${mkXfsFlags} -K /dev/test_vg/vdo_lv")
     machine.succeed("mkdir /mnt; mount /dev/test_vg/vdo_lv /mnt")
     assert "/dev/mapper/test_vg-vdo_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
     machine.succeed("umount /mnt")
diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix
index 69a28c397bedc..14f92fa3af4a2 100644
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@@ -50,11 +50,11 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
             machine.wait_until_succeeds(f"pgrep -f {i}")
         for i in ["gala", "io.elementary.wingpanel", "plank"]:
             machine.wait_for_window(i)
-        machine.wait_for_unit("bamfdaemon.service", "${user.name}")
-        machine.wait_for_unit("io.elementary.files.xdg-desktop-portal.service", "${user.name}")
+        for i in ["io.elementary.gala.daemon@x11.service", "bamfdaemon.service", "io.elementary.files.xdg-desktop-portal.service"]:
+            machine.wait_for_unit(i, "${user.name}")
 
     with subtest("Check if various environment variables are set"):
-        cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/gala)/environ"
+        cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf ${pkgs.pantheon.gala}/bin/gala)/environ"
         machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Pantheon'")
         # Hopefully from the sessionPath option.
         machine.succeed(f"{cmd} | grep 'XDG_DATA_DIRS' | grep 'gsettings-schemas/pantheon-agent-geoclue2'")
diff --git a/pkgs/applications/audio/jacktrip/default.nix b/pkgs/applications/audio/jacktrip/default.nix
index 150f05c5f53ed..f8fb4cedbc9ff 100644
--- a/pkgs/applications/audio/jacktrip/default.nix
+++ b/pkgs/applications/audio/jacktrip/default.nix
@@ -11,7 +11,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.2.4";
+  version = "2.2.5";
   pname = "jacktrip";
 
   src = fetchFromGitHub {
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     repo = "jacktrip";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-H1zjBNEFPvZRDEaFOiL1ZAlHQsNxeT4WbXEOqg0+eFg=";
+    sha256 = "sha256-rZ8oaud+ovJ7t+SGnWe7QbqjQns1EkbbwpdE+rLr6nc=";
   };
 
   preConfigure = ''
diff --git a/pkgs/applications/audio/schismtracker/default.nix b/pkgs/applications/audio/schismtracker/default.nix
index 94b082fd84a4f..bc6a406ba2f5c 100644
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "schismtracker";
-  version = "20240308";
+  version = "20240328";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-6MzMmeD4HCS/7VTFTAcOhyKjz5NvzvDEzcSpHGUwFvM=";
+    sha256 = "sha256-hoP/14lbqsuQ37oJDErPoQWWk04UshImmApCFrf5wno=";
   };
 
   configureFlags = [ "--enable-dependency-tracking" ]
diff --git a/pkgs/applications/audio/spotify-player/default.nix b/pkgs/applications/audio/spotify-player/default.nix
index f3c6755645120..e4e02f03891b9 100644
--- a/pkgs/applications/audio/spotify-player/default.nix
+++ b/pkgs/applications/audio/spotify-player/default.nix
@@ -33,16 +33,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaud
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-1aq+J1dP+hGJHq3boxZLUFfLLSFDY2uN6BwYXqHjCtk=";
+    hash = "sha256-TwMQtyg8ygFTI5DgT5rBVkZE31U4puaANIo5S8W0TXU=";
   };
 
-  cargoHash = "sha256-nULTz1H52L1kiTtViYfvxL+jrJ0uDk68oe8t5Hd7aCU=";
+  cargoHash = "sha256-RTvMywRWdZiBgNMjlUGa4jlD0HYOL3ESkVppGlsl4So=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/audio/squeezelite/default.nix b/pkgs/applications/audio/squeezelite/default.nix
index 694dd04d12a94..5c1ed3905539f 100644
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@@ -45,13 +45,13 @@ stdenv.mkDerivation {
   pname = binName;
   # versions are specified in `squeezelite.h`
   # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1473";
+  version = "2.0.0.1476";
 
   src = fetchFromGitHub {
     owner = "ralph-irving";
     repo = "squeezelite";
-    rev = "66c9b6a21834019a0230c39fcee74b6bf2891f7d";
-    hash = "sha256-MCH7vltF3jLGfxcRspXg9eQMx+e+lHSoxIanf91NrE0=";
+    rev = "7bba683e26f84b7dccc6ef5f40762a67b4f63606";
+    hash = "sha256-iRrZRnSIp8NbZ/Pi8WoQjyeBgxoU0mchNEf00W1Gsvo=";
   };
 
   buildInputs = [ flac libmad libvorbis mpg123 ]
diff --git a/pkgs/applications/blockchains/erigon/default.nix b/pkgs/applications/blockchains/erigon/default.nix
index ae77b64c7b04a..d76f090efa86f 100644
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "erigon";
-  version = "2.55.1";
+  version = "2.59.2";
 in
 buildGoModule {
   inherit pname version;
@@ -11,11 +11,11 @@ buildGoModule {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ttBJIx2QR3H5JFyquoGwZpWwT10r7X7GnGE4uEzuRZA=";
+    hash = "sha256-gSoaPoyPyryC1yzYaafnPXKpMNzI9fw9Yd0nKzziAKw=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-QLuWxec1gwMnVo0Zw8z4Ef8vzxc4xFpLL/TT986Sljo=";
+  vendorHash = "sha256-B3xbCI0szSAo9ULHDiqoTTR8tvgZUry7spDGuldu0lU=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:
@@ -34,6 +34,14 @@ buildGoModule {
     "cmd/rlpdump"
   ];
 
+  # Matches the tags to upstream's release build configuration
+  # https://github.com/ledgerwatch/erigon/blob/0c0dbe5f3a81cf8f16da8e4838312ab80ebe5302/.goreleaser.yml
+  #
+  # Enabling silkworm also breaks the build as it requires dynamically linked libraries.
+  # If we need it in the future, we should consider packaging silkworm and silkworm-go
+  # as depenedencies explicitly.
+  tags = "-tags=nosqlite,noboltdb,nosilkworm";
+
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 6f61a18d83580..9bc494a445112 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -20,6 +20,7 @@
 , millet
 , craftos-pc
 , shfmt
+, tinymist
 , typst-lsp
 , typst-preview
 , autoPatchelfHook
@@ -2345,6 +2346,22 @@ let
         };
       };
 
+      jbockle.jbockle-format-files = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "jbockle-format-files";
+          publisher = "jbockle";
+          version = "3.4.0";
+          sha256 = "sha256-BHw+T2EPdQq/wOD5kzvSln5SBFTYUXip8QDjnAGBfFY=";
+        };
+        meta = {
+          description = "A VSCode extension to formats all files in the current workspace";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jbockle.jbockle-format-files";
+          homepage = "https://github.com/jbockle/format-files";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.wackbyte ];
+        };
+      };
+
       jdinhlife.gruvbox = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "gruvbox";
@@ -3169,6 +3186,37 @@ let
         };
       };
 
+      myriad-dreamin.tinymist = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "tinymist";
+          publisher = "myriad-dreamin";
+          # Please update the corresponding binary (tinymist) when updating
+          # this extension.
+          version = "0.11.1";
+          sha256 = "sha256-jyZBnT8UW94TVnZKZna1cJa/UIj+DwYwlAbU4pnaf04=";
+        };
+
+        nativeBuildInputs = [ jq moreutils ];
+
+        buildInputs = [
+          tinymist
+        ];
+
+        postInstall = ''
+          cd "$out/$installPrefix"
+          jq '.contributes.configuration.properties."tinymist.serverPath".default = "${lib.getExe tinymist}"' package.json | sponge package.json
+        '';
+
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/myriad-dreamin.tinymist/changelog";
+          description = "A VSCode extension for providing an integration solution for Typst";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=myriad-dreamin.tinymist";
+          homepage = "https://github.com/myriad-dreamin/tinymist";
+          license = lib.licenses.asl20;
+          maintainers = [ lib.maintainers.drupol ];
+        };
+      };
+
       naumovs.color-highlight = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "color-highlight";
diff --git a/pkgs/applications/graphics/oculante/default.nix b/pkgs/applications/graphics/oculante/default.nix
index f83184a488aa6..fbbe037257bb8 100644
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oculante";
-  version = "0.8.16";
+  version = "0.8.17";
 
   src = fetchFromGitHub {
     owner = "woelper";
     repo = "oculante";
     rev = version;
-    hash = "sha256-C8USTDW5C+mjj/fr242is/42RpmUvcK3lUeaq0/BSGA=";
+    hash = "sha256-kSCmBdTh4Z6b49fItv68w+hdIFH98g8lCfIVqj08wgg=";
   };
 
-  cargoHash = "sha256-w8k0QG509PRHHB1e4WThYnM6R0PwWMbSBxs2B0zQ0ww=";
+  cargoHash = "sha256-vZwzIV0l9iHEf2Iz/n1jY9Ai+YU5UkeSJPSqDkKy+nI=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/graphics/pureref/default.nix b/pkgs/applications/graphics/pureref/default.nix
index 5a0774a09f430..825ea4c51e190 100644
--- a/pkgs/applications/graphics/pureref/default.nix
+++ b/pkgs/applications/graphics/pureref/default.nix
@@ -1,14 +1,16 @@
-{ lib, appimageTools, requireFile }:
+{ lib, appimageTools, runCommand, curl, gnugrep, cacert }:
 
 appimageTools.wrapType1 rec {
   pname = "pureref";
   version = "1.11.1";
 
-  src = requireFile {
-    name = "PureRef-${version}_x64.Appimage";
-    sha256 = "05naywdgykqrsgc3xybskr418cyvbx7vqs994yv9w8zf98gxvbvm";
-    url = "https://www.pureref.com/download.php";
-  };
+  src = runCommand "PureRef-${version}_x64.Appimage" {
+    nativeBuildInputs = [ curl gnugrep cacert ];
+    outputHash = "sha256-da/dH0ruI562JylpvE9f2zMUSJ56+T7Y0xlP/xr3yhY=";
+  } ''
+    key="$(curl "https://www.pureref.com/download.php" --silent | grep '%3D%3D' | cut -d '"' -f2)"
+    curl "https://www.pureref.com/files/build.php?build=LINUX64.Appimage&version=${version}&downloadKey=$key" --output $out
+  '';
 
   extraInstallCommands = ''
     mv $out/bin/${pname}-${version} $out/bin/${pname}
diff --git a/pkgs/applications/misc/gramps/default.nix b/pkgs/applications/misc/gramps/default.nix
index a24cff0942e1e..e4bf463ac4a30 100644
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@@ -23,7 +23,7 @@ let
   inherit (pythonPackages) buildPythonApplication pythonOlder;
 in
 buildPythonApplication rec {
-  version = "5.2.0";
+  version = "5.2.1";
   pname = "gramps";
   pyproject = true;
 
@@ -33,7 +33,7 @@ buildPythonApplication rec {
     owner = "gramps-project";
     repo = "gramps";
     rev = "v${version}";
-    hash = "sha256-8iQcaWLiBegVjcV16TfZbp8/4N/9f5pEl7mdV78CeEY=";
+    hash = "sha256-KgUc6AFLVFf3SYpjY/le0g4jNhGe4gpYcnkDEIZ/gxQ=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 2c2c0813a88f0..dbee3360d20c5 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -94,11 +94,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.64.109";
+  version = "1.64.113";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-36igba0U3p8i7t91RxeG6PqlKYyHDDlj295ICcYmCNc=";
+    hash = "sha256-T0uVq1yxDXNi6x9ot5bs3NRaOQ+RwBThvULS6EZ+Bdg=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
index 46c049b9d2f22..dffcdc6172f28 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "6.46.0";
+  version = "7.3.0";
   url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
-  hash = "sha256-rHmG2brzlQtYd3l5EFhjndPF5T7nQWzUhEe7LsEFVpc=";
+  hash = "sha256-RIOMIAXdBMr1Bi1TDFr4VD0w8JfBKzwEjpYS/DfV5kc=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
index 86f08b1067a11..2e13a66377358 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "7.4.0-beta.1";
+  version = "7.4.0-beta.2";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-Pjz55iVBww7d7WIAonTeX+cdEobitltoAyOU79RY40c=";
+  hash = "sha256-oBkZ9BaKbmosTkC/OZFjt6PmU/9XqclyzbllwYPj3Q4=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index 10ea168355b30..3cb0d35725153 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.2.1";
+  version = "7.3.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-IJ808xvPqGivccqH/mOMSHu/mU/JLFJ798UztwXWtm0=";
+  hash = "sha256-J99mSSzl+TxWb6whzJ4oZs8a7NnKFVL3iNvWmvlQIaw=";
 }
diff --git a/pkgs/applications/networking/sync/storj-uplink/default.nix b/pkgs/applications/networking/sync/storj-uplink/default.nix
index 8f625a1fe1b09..e65ead7bd5c74 100644
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.100.3";
+  version = "1.100.4";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-/aR6M/zL7xL+ujmGgu9J8Toiy7/0ou76nYJ0vwd5RVM=";
+    hash = "sha256-LPckEiuw+3WlEnW07jql+TFggB6mEzrvC7NI+pVBCLY=";
   };
 
   subPackages = [ "cmd/uplink" ];
diff --git a/pkgs/applications/office/planify/default.nix b/pkgs/applications/office/planify/default.nix
index 6bf0f20313f62..d01e0c45c9486 100644
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.5.8";
+  version = "4.5.11";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-VTBnVVxv3hCyDKJlY/hE8oEDMNuMMWtm+NKzfD3tVzk=";
+    hash = "sha256-LMN+1ORp44uWVqzw1sjiZzx81s9l2msPFM3+sJ7qw8U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/logic/dafny/default.nix b/pkgs/applications/science/logic/dafny/default.nix
index 83d472c1abb18..acf4f05000bf1 100644
--- a/pkgs/applications/science/logic/dafny/default.nix
+++ b/pkgs/applications/science/logic/dafny/default.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "Dafny";
-  version = "4.5.0";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "dafny-lang";
     repo = "dafny";
     rev = "v${version}";
-    hash = "sha256-NsQhJY++IaLyFc5jqo7TyZBcz0P8VUizGLxdIe9KEO4=";
+    hash = "sha256-3t0drxM7PZzrLbxBKYa6Gja2u6GK6Pc+ejoswag3P3k=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/version-management/lucky-commit/default.nix b/pkgs/applications/version-management/lucky-commit/default.nix
index 4e8db1fef606f..dcaca33f09522 100644
--- a/pkgs/applications/version-management/lucky-commit/default.nix
+++ b/pkgs/applications/version-management/lucky-commit/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lucky-commit";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "not-an-aardvark";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DrgZBzcJmqSP7iCHZyy623iRZYfTE/z/zzx7I+BAOBo=";
+    sha256 = "sha256-jxcsTtQcSuL+2vwdxIVxqTpKh8Bfvna+hkGt+Rx21FE=";
   };
 
-  cargoHash = "sha256-5P0CiLCf86Jul4EaIDqHGkp4XNifLKnWJZXtrLkpLMY=";
+  cargoHash = "sha256-8JkodGtMdYP/IIBqRcJFD5syiZi+VakDyX7VcvR0HLo=";
 
   buildInputs = lib.optional withOpenCL (if stdenv.isDarwin then OpenCL else ocl-icd);
 
diff --git a/pkgs/by-name/ad/advcpmv/package.nix b/pkgs/by-name/ad/advcpmv/package.nix
deleted file mode 100644
index ba4caea99cd3b..0000000000000
--- a/pkgs/by-name/ad/advcpmv/package.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ coreutils
-, fetchFromGitHub
-}:
-
-let
-  advcpmv-data = {
-    pname = "advcpmv";
-    patch-version = "0.9";
-    coreutils-version = "9.4";
-    version = "${advcpmv-data.patch-version}-${advcpmv-data.coreutils-version}";
-    src = fetchFromGitHub {
-      owner = "jarun";
-      repo = "advcpmv";
-      rev = "a1f8b505e691737db2f7f2b96275802c45f65c59";
-      hash = "sha256-IHfMu6PyGRPc87J/hbxMUdosmLq13K0oWa5fPLWKOvo=";
-    };
-    patch-file = advcpmv-data.src + "/advcpmv-${advcpmv-data.version}.patch";
-  };
-  coreutilsNoSingleBinary = coreutils.override { singleBinary = false; };
-in
-assert (advcpmv-data.coreutils-version == coreutils.version);
-coreutilsNoSingleBinary.overrideAttrs (old: {
-  inherit (advcpmv-data) pname version;
-
-  patches = (old.patches or [ ]) ++ [
-    advcpmv-data.patch-file
-  ];
-
-  outputs = [ "out" ]; # Since we don't need info files
-
-  configureFlags = (old.configureFlags or [ ]) ++ [
-    # To not conflict with regular coreutils
-    "--program-prefix=adv"
-  ];
-
-  # Only cpg and mvg are desired, the others are not touched and therefore can
-  # be removed. Equally, the info directory is removed.
-  postFixup = (old.postFixup or "") + ''
-    rm -rf $out/share/info
-    pushd $out/bin
-    mv advcp cpg
-    mv advmv mvg
-    rm adv*
-    mv cpg advcp
-    mv mvg advmv
-    ln -s advcp cpg
-    ln -s advcp acp
-    ln -s advmv mvg
-    ln -s advmv amv
-    popd
-  '';
-
-  meta = old.meta // {
-    homepage = "https://github.com/jarun/advcpmv";
-    description = "Patched cp and mv from Coreutils that provides progress bars";
-    longDescription = ''
-      Advanced Copy is a mod for the GNU cp and GNU mv tools which adds a
-      progress bar and provides some info on what's going on. It was written by
-      Florian Zwicke and released under the GPL.
-    '';
-  };
-})
diff --git a/pkgs/by-name/bu/bunbun/package.nix b/pkgs/by-name/bu/bunbun/package.nix
new file mode 100644
index 0000000000000..79d158fb6ae70
--- /dev/null
+++ b/pkgs/by-name/bu/bunbun/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bunbun";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "devraza";
+    repo = "bunbun";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-jqokKvJYu/xHJHJVuNlTns3cYPLx1osbRUrCpVTCJZ0=";
+  };
+
+  cargoHash = "sha256-dWZ5aNaHyTkEmkn88Dx5nCnGyiBmpJ6p5iYC7xj/mBw=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.IOKit
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  # Cargo.lock is outdated
+  preConfigure = ''
+    cargo update --offline
+  '';
+
+  meta = with lib; {
+    description = "A simple and adorable sysinfo utility written in Rust";
+    homepage = "https://github.com/devraza/bunbun";
+    changelog = "https://github.com/devraza/bunbun/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "bunbun";
+  };
+}
diff --git a/pkgs/by-name/bu/buttermanager/package.nix b/pkgs/by-name/bu/buttermanager/package.nix
new file mode 100644
index 0000000000000..fe738b3712195
--- /dev/null
+++ b/pkgs/by-name/bu/buttermanager/package.nix
@@ -0,0 +1,51 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, wrapGAppsHook
+, qt5
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "buttermanager";
+  version = "2.5.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "egara";
+    repo = "buttermanager";
+    rev = version;
+    hash = "sha256-MLYJt7OMYlTFk8FCAlZJ1RGlFFXKfeAthWGp4JN+PfY=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    pyqt5
+    pyyaml
+    sip
+    tkinter
+  ];
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    qt5.wrapQtAppsHook
+  ];
+
+  dontWrapQtApps = true;
+  dontWrapGApps = true;
+  makeWrapperArgs = [ "\${qtWrapperArgs[@]}" "\${gappsWrapperArgs[@]}"];
+
+  postInstall = ''
+    substituteInPlace packaging/buttermanager.desktop \
+      --replace-fail /opt/buttermanager/gui/buttermanager.svg buttermanager
+
+    install -Dm444 packaging/buttermanager.desktop -t $out/share/applications
+    install -Dm444 packaging/buttermanager.svg -t $out/share/icons/hicolor/scalable/apps
+  '';
+
+  meta = with lib; {
+    description = "Btrfs tool for managing snapshots, balancing filesystems and upgrading the system safetly";
+    homepage = "https://github.com/egara/buttermanager";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ t4ccer ];
+    mainProgram = "buttermanager";
+  };
+}
diff --git a/pkgs/by-name/cl/clash-verge-rev/package.nix b/pkgs/by-name/cl/clash-verge-rev/package.nix
index 576a994c1e739..95415d03cfec7 100644
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@@ -5,11 +5,11 @@
 
 clash-verge.overrideAttrs (old: rec {
   pname = "clash-verge-rev";
-  version = "1.5.10";
+  version = "1.5.11";
 
   src = fetchurl {
     url = "https://github.com/clash-verge-rev/clash-verge-rev/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-xv6xKAjpHL4eyFEcgiuHZQi3EDhYkzGHAKbcKm4rIGk=";
+    hash = "sha256-FoNWCH4SE7DnKoDMwdUiTnWoFwHSUCAIDQhvgZdgyeU=";
   };
 
   meta = old.meta // (with lib; {
diff --git a/pkgs/by-name/do/docuum/package.nix b/pkgs/by-name/do/docuum/package.nix
new file mode 100644
index 0000000000000..65c455038e67a
--- /dev/null
+++ b/pkgs/by-name/do/docuum/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "docuum";
+  version = "0.23.1";
+
+  src = fetchFromGitHub {
+    owner = "stepchowfun";
+    repo = "docuum";
+    rev = "v${version}";
+    hash = "sha256-jZJkI4rk/8O6MsHjuDqmIiRc1LJpTajk/rSUVYnHiOs=";
+  };
+
+  cargoHash = "sha256-qBigfW0W3t0a43y99H22gmKBnhsu08Yd1CTTatsRfRs=";
+
+  checkFlags = [
+    # fails, no idea why
+    "--skip=format::tests::code_str_display"
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.IOKit
+  ];
+
+  meta = with lib; {
+    description = "Least recently used (LRU) eviction of Docker images";
+    homepage = "https://github.com/stepchowfun/docuum";
+    changelog = "https://github.com/stepchowfun/docuum/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mkg20001 ];
+    mainProgram = "docuum";
+  };
+}
diff --git a/pkgs/by-name/do/doge/package.nix b/pkgs/by-name/do/doge/package.nix
index d35d6708bdf25..4b64f8a7dfff2 100644
--- a/pkgs/by-name/do/doge/package.nix
+++ b/pkgs/by-name/do/doge/package.nix
@@ -5,13 +5,13 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "doge";
-  version = "3.7.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "Olivia5k";
     repo = "doge";
     rev = version;
-    hash = "sha256-LmEbDQUZe/3lg/Ze+WUNyYfC8zMr88/rn10sL0jgbGA=";
+    hash = "sha256-CZw9Pz9YPVmDMOfDp5yIp/yStOvXEzAgb/HvKpxhQ8I=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/dy/dynamodb-local/package.nix b/pkgs/by-name/dy/dynamodb-local/package.nix
index b22a5c2fd8c79..846f8cac68b4c 100644
--- a/pkgs/by-name/dy/dynamodb-local/package.nix
+++ b/pkgs/by-name/dy/dynamodb-local/package.nix
@@ -19,6 +19,7 @@ let
       "java.xml"
       "java.desktop"
       "java.management"
+      "java.naming"
     ];
     jdk = jdk_headless;
   };
diff --git a/pkgs/by-name/ha/hacompanion/package.nix b/pkgs/by-name/ha/hacompanion/package.nix
index dbf8be29cb463..eeb1cd7fe8a2c 100644
--- a/pkgs/by-name/ha/hacompanion/package.nix
+++ b/pkgs/by-name/ha/hacompanion/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "hacompanion";
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "tobias-kuendig";
     repo = "hacompanion";
     rev = "v${version}";
-    hash = "sha256-gTsA5XBjLlm/cITwQwYNudPK9SbSEaiAIjjdvRS3+8Q=";
+    hash = "sha256-3uPn139e8TyP0rE9hfRKw192YyexG+f3KmlHMmgCN7A=";
   };
 
   vendorHash = "sha256-ZZ8nxN+zUeFhSXyoHLMgzeFllnIkKdoVnbVK5KjrLEQ=";
diff --git a/pkgs/by-name/ht/httpy-cli/package.nix b/pkgs/by-name/ht/httpy-cli/package.nix
new file mode 100644
index 0000000000000..2b59b54ef2136
--- /dev/null
+++ b/pkgs/by-name/ht/httpy-cli/package.nix
@@ -0,0 +1,53 @@
+{ lib
+, python3Packages
+, fetchPypi
+, curl
+ }:
+
+python3Packages.buildPythonPackage rec {
+  pname = "httpy-cli";
+  version = "1.1.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "httpy-cli";
+    hash = "sha256-uhF/jF4buHMDiXOuuqjskynioz4qVBevQhdcUbH+91Q=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    colorama
+    pygments
+    requests
+    urllib3
+  ];
+
+  build-system = with python3Packages; [
+      setuptools
+  ];
+
+  pythonImportsCheck = [
+    "httpy"
+  ];
+
+  nativeCheckInputs = [
+      python3Packages.pytest
+      curl
+    ];
+
+  checkPhase = ''
+    runHook preCheck
+    echo "line1\nline2\nline3" > tests/test_file.txt
+    # ignore the test_args according to pytest.ini in the repo
+    pytest tests/ --ignore=tests/test_args.py
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Modern, user-friendly, programmable command-line HTTP client for the API";
+    homepage = "https://github.com/knid/httpy";
+    license = licenses.mit;
+    mainProgram = "httpy";
+    maintainers = with maintainers; [ eymeric ];
+  };
+}
diff --git a/pkgs/by-name/km/kmeet/package.nix b/pkgs/by-name/km/kmeet/package.nix
new file mode 100644
index 0000000000000..8c928e434123b
--- /dev/null
+++ b/pkgs/by-name/km/kmeet/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, fetchurl
+, appimageTools
+}:
+
+appimageTools.wrapType2 rec {
+  pname = "kmeet";
+  version = "2.0.1";
+
+  src = fetchurl {
+    url = "https://download.storage5.infomaniak.com/meet/kmeet-desktop-${version}-linux-x86_64.AppImage";
+    name = "kmeet-${version}.AppImage";
+    hash = "sha256-0lygBbIwaEydvFEfvADiL2k5GWzVpM1jX4orweriBYw=";
+  };
+
+  extraInstallCommands =
+    let
+      contents = appimageTools.extractType2 { inherit pname version src; };
+    in
+    ''
+      mkdir -p "$out/share/applications"
+      mkdir -p "$out/share/lib/kmeet"
+      cp -r ${contents}/{locales,resources} "$out/share/lib/kmeet"
+      cp -r ${contents}/usr/* "$out"
+      cp "${contents}/kMeet.desktop" "$out/share/applications/"
+      mv "$out/bin/kmeet-${version}" "$out/bin/${meta.mainProgram}"
+      substituteInPlace $out/share/applications/kMeet.desktop --replace 'Exec=AppRun' 'Exec=${meta.mainProgram}'
+    '';
+
+  meta = with lib; {
+    description = "Organise secure online meetings via your web browser, your mobile, your tablet or your computer.";
+    homepage = "https://www.infomaniak.com/en/apps/download-kmeet";
+    license = licenses.unfree;
+    maintainers = [ maintainers.vinetos ];
+    mainProgram = "kmeet";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    longDescription = ''
+      kMeet allows you to organise secure online meetings via your web browser, your mobile, your tablet or your
+      computer.
+    '';
+  };
+}
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index ca2f4d5149d63..74be7dc68541c 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -71,13 +71,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "2481";
+  version = "2568";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "llama.cpp";
     rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-40GSZZEnjM9L9KVVKdSKtBoSRy996l98ORM4NeltsSM=";
+    hash = "sha256-yBlLChtzfAi2TAGUO1zdnpHCvi5YDCzjdflQgTWh98Y=";
   };
 
   postPatch = ''
@@ -107,7 +107,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     (cmakeBool "BUILD_SHARED_LIBS" true)
     (cmakeBool "LLAMA_BLAS" blasSupport)
     (cmakeBool "LLAMA_CLBLAST" openclSupport)
-    (cmakeBool "LLAMA_CUBLAS" cudaSupport)
+    (cmakeBool "LLAMA_CUDA" cudaSupport)
     (cmakeBool "LLAMA_HIPBLAS" rocmSupport)
     (cmakeBool "LLAMA_METAL" metalSupport)
     (cmakeBool "LLAMA_MPI" mpiSupport)
@@ -131,7 +131,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
         # Should likely use `rocmPackages.clr.gpuTargets`.
         "-DAMDGPU_TARGETS=gfx803;gfx900;gfx906:xnack-;gfx908:xnack-;gfx90a:xnack+;gfx90a:xnack-;gfx940;gfx941;gfx942;gfx1010;gfx1012;gfx1030;gfx1100;gfx1101;gfx1102"
       ]
-      ++ optionals metalSupport [ (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1") ];
+      ++ optionals metalSupport [
+        (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1")
+        (cmakeBool "LLAMA_METAL_EMBED_LIBRARY" true)
+      ];
 
   # upstream plans on adding targets at the cmakelevel, remove those
   # additional steps after that
diff --git a/pkgs/by-name/lu/lubelogger/package.nix b/pkgs/by-name/lu/lubelogger/package.nix
index 1b8501fc11298..72bef4a340af8 100644
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "lubelogger";
-  version = "1.2.8";
+  version = "1.2.9";
 
   src = fetchFromGitHub {
     owner = "hargata";
     repo = "lubelog";
     rev = "v${version}";
-    hash = "sha256-22I4OJZLeFLstGZF1fY/s8Y5tPgGJpJR/sPZpkHvUmY=";
+    hash = "sha256-bzCPoWgI7JA5dEYKl2m1ZzNPXxNRAzZz1lFa7fVCkNw=";
   };
 
   projectFile = "CarCareTracker.sln";
diff --git a/pkgs/by-name/my/mycelium/Cargo.lock b/pkgs/by-name/my/mycelium/Cargo.lock
index 311901f8a2425..a16f24fc94777 100644
--- a/pkgs/by-name/my/mycelium/Cargo.lock
+++ b/pkgs/by-name/my/mycelium/Cargo.lock
@@ -219,6 +219,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+
+[[package]]
 name = "bitflags"
 version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -241,9 +247,9 @@ dependencies = [
 
 [[package]]
 name = "blake3"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0231f06152bf547e9c2b5194f247cd97aacf6dcd8b15d8e5ec0663f64580da87"
+checksum = "30cca6d3674597c30ddf2c587bf8d9d65c9a84d2326d941cc79c9842dfe0ef52"
 dependencies = [
  "arrayref",
  "arrayvec",
@@ -275,9 +281,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "c2rust-bitfields"
@@ -332,9 +338,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.18"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e578d6ec4194633722ccf9544794b71b1385c3c027efe0c55db226fc880865c"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -342,9 +348,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.18"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4df4df40ec50c46000231c914968278b1eb05098cf8f1b3a518a95030e71d1c7"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
@@ -354,9 +360,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.4.7"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -366,9 +372,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "colorchoice"
@@ -523,9 +529,9 @@ dependencies = [
 
 [[package]]
 name = "faster-hex"
-version = "0.8.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "239f7bfb930f820ab16a9cd95afc26f88264cf6905c960b340a615384aa3338a"
+checksum = "a2a2b11eda1d40935b26cf18f6833c526845ae8c41e58d09af6adeb6f0269183"
 dependencies = [
  "serde",
 ]
@@ -736,9 +742,9 @@ checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
 
 [[package]]
 name = "heck"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
@@ -1068,11 +1074,11 @@ dependencies = [
 
 [[package]]
 name = "mycelium"
-version = "0.4.3"
+version = "0.4.5"
 dependencies = [
  "aes-gcm",
  "axum",
- "base64",
+ "base64 0.22.0",
  "blake2",
  "blake3",
  "bytes",
@@ -1120,14 +1126,14 @@ dependencies = [
 
 [[package]]
 name = "netlink-packet-route"
-version = "0.17.1"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053998cea5a306971f88580d0829e90f270f940befd7cf928da179d4187a5a66"
+checksum = "74c171cd77b4ee8c7708da746ce392440cb7bcf618d122ec9ecc607b12938bf4"
 dependencies = [
  "anyhow",
- "bitflags 1.3.2",
  "byteorder",
  "libc",
+ "log",
  "netlink-packet-core",
  "netlink-packet-utils",
 ]
@@ -1174,9 +1180,9 @@ dependencies = [
 
 [[package]]
 name = "network-interface"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d68759ef97fe9c9e46f79ea8736c19f1d28992e24c8dc8ce86752918bfeaae7"
+checksum = "8ee524f98ddbe7772762a7477cfb22356df075cac4069bf81ac5082a46db742c"
 dependencies = [
  "cc",
  "libc",
@@ -1186,17 +1192,6 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
-dependencies = [
- "bitflags 1.3.2",
- "cfg-if",
- "libc",
-]
-
-[[package]]
-name = "nix"
 version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
@@ -1278,7 +1273,7 @@ version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b8fcc794035347fb64beda2d3b462595dd2753e3f268d89c5aae77e8cf2c310"
 dependencies = [
- "base64",
+ "base64 0.21.7",
  "serde",
 ]
 
@@ -1517,7 +1512,7 @@ version = "0.11.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
 dependencies = [
- "base64",
+ "base64 0.21.7",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -1577,9 +1572,9 @@ dependencies = [
 
 [[package]]
 name = "rtnetlink"
-version = "0.13.1"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a552eb82d19f38c3beed3f786bd23aa434ceb9ac43ab44419ca6d67a7e186c0"
+checksum = "b684475344d8df1859ddb2d395dd3dac4f8f3422a1aa0725993cb375fc5caba5"
 dependencies = [
  "futures",
  "log",
@@ -1588,7 +1583,7 @@ dependencies = [
  "netlink-packet-utils",
  "netlink-proto",
  "netlink-sys",
- "nix 0.26.4",
+ "nix 0.27.1",
  "thiserror",
  "tokio",
 ]
@@ -1801,9 +1796,9 @@ checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
 [[package]]
 name = "strsim"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
 
 [[package]]
 name = "subtle"
@@ -1963,9 +1958,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.14"
+version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
+checksum = "267ac89e0bec6e691e5813911606935d77c476ff49024f98abcea3e7b15e37af"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -2001,9 +1996,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.10"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a9aad4a3066010876e8dcf5a8a06e70a558751117a145c6ce2b82c2e2054290"
+checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -2022,9 +2017,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.22.6"
+version = "0.22.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c1b5fd4128cc8d3e0cb74d4ed9a9cc7c7284becd4df68f5f940e1ad123606f6"
+checksum = "c12219811e0c1ba077867254e5ad62ee2c9c190b0d957110750ac0cda1ae96cd"
 dependencies = [
  "indexmap",
  "serde",
diff --git a/pkgs/by-name/my/mycelium/package.nix b/pkgs/by-name/my/mycelium/package.nix
index b3aee2f9ff3ed..ce67e2704637c 100644
--- a/pkgs/by-name/my/mycelium/package.nix
+++ b/pkgs/by-name/my/mycelium/package.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mycelium";
-  version = "0.4.3";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "threefoldtech";
     repo = "mycelium";
     rev = "v${version}";
-    hash = "sha256-bA3ci+vqXBCPBaxMvfUdFcqdaZbAw/+r5UbH/as/fnc=";
+    hash = "sha256-AJA1yd7P9zHOIdSOR2bAHgL5NyoyqzgNIEs8ObgD4Mo=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch b/pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch
new file mode 100644
index 0000000000000..eb38b07feb45b
--- /dev/null
+++ b/pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch
@@ -0,0 +1,21 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 98752ec..aa029b3 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -55,7 +55,15 @@ endif()
+ qt_standard_project_setup()
+ 
+ find_package(OpenSSL REQUIRED)
+-find_package(lcms REQUIRED)
++SET(LCMS2_NAMES ${LCMS2_NAMES} lcms2 liblcms2 liblcms2_static)
++FIND_LIBRARY(LCMS2_LIBRARY NAMES ${LCMS2_NAMES} )
++FIND_PATH(LCMS2_INCLUDE_DIR lcms2.h)
++add_library(lcms2::lcms2 UNKNOWN IMPORTED)
++set_target_properties(lcms2::lcms2 PROPERTIES
++    IMPORTED_LOCATION ${LCMS2_LIBRARY}
++    INTERFACE_INCLUDE_DIRECTORIES ${LCMS2_INCLUDE_DIR}
++    INTERFACE_COMPILE_DEFINITIONS "HAVE_LCMS2=1;CMS_NO_REGISTER_KEYWORD=1")
++set_property(GLOBAL APPEND PROPERTY INTERNAL_DEPS_PROP lcms2::lcms2)
+ find_package(ZLIB REQUIRED)
+ find_package(Freetype REQUIRED)
+ find_package(OpenJPEG CONFIG REQUIRED)
diff --git a/pkgs/by-name/pd/pdf4qt/package.nix b/pkgs/by-name/pd/pdf4qt/package.nix
new file mode 100644
index 0000000000000..95152518f7994
--- /dev/null
+++ b/pkgs/by-name/pd/pdf4qt/package.nix
@@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, lcms
+, cmake
+, pkg-config
+, qt6
+, openjpeg
+, tbb_2021_8
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pdf4qt";
+  version = "1.3.7";
+
+  src = fetchFromGitHub {
+    owner = "JakubMelka";
+    repo = "PDF4QT";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-wZJDMLEaHGBPSToQ+ObSfB5tw/fTIX1i5tmNPmIa7Ck=";
+  };
+
+  patches = [
+    # lcms2 cmake module only appears when built with vcpkg.
+    # We directly search for the corresponding libraries and
+    # header files instead.
+    ./find_lcms2_path.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt6.qttools
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtwayland
+    qt6.qtsvg
+    qt6.qtspeech
+    lcms
+    openjpeg
+    tbb_2021_8
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "PDF4QT_INSTALL_TO_USR" false)
+  ];
+
+  meta = {
+    description = "Open source PDF editor";
+    longDescription = ''
+      This software is consisting of PDF rendering library,
+      and several applications, such as advanced document
+      viewer, command line tool, and document page
+      manipulator application. Software is implementing PDF
+      functionality based on PDF Reference 2.0.
+    '';
+    homepage = "https://jakubmelka.github.io";
+    license = lib.licenses.lgpl3Only;
+    mainProgram = "Pdf4QtViewerLite";
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pg/pgmoneta/package.nix b/pkgs/by-name/pg/pgmoneta/package.nix
index ee9ac2bbeefa9..c56243fe89207 100644
--- a/pkgs/by-name/pg/pgmoneta/package.nix
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmoneta";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "pgmoneta";
     repo = "pgmoneta";
     rev = version;
-    hash = "sha256-KVweAsmAQGUkBAxR7gPJe6mygfG7xApvJFRiCbSFq9E=";
+    hash = "sha256-wNBomyyr078Twzg7fuu3et1NUxpb+vqIbsnpmF73t18=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/pot/Cargo.lock b/pkgs/by-name/po/pot/Cargo.lock
index a8dcf7612e3ab..88e10a2d1d888 100644
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/by-name/po/pot/Cargo.lock
@@ -2791,9 +2791,9 @@ dependencies = [
 
 [[package]]
 name = "lingua"
-version = "1.6.1"
+version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73989d32b4cd00a69e78d979203fa3b87e43fae0236a29544331c2ccfa180fdd"
+checksum = "d109aef84956f04b8b5866db17e59f964152411915ad27b6e291b262d63a442c"
 dependencies = [
  "ahash",
  "brotli",
@@ -2821,6 +2821,7 @@ dependencies = [
  "lingua-spanish-language-model",
  "lingua-thai-language-model",
  "lingua-turkish-language-model",
+ "lingua-ukrainian-language-model",
  "lingua-vietnamese-language-model",
  "maplit",
  "once_cell",
@@ -3015,6 +3016,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "lingua-ukrainian-language-model"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14ed035dd4b7ec5f76fe3b07e5f499d76c4cdb2a6d275459e4cdd3a3d21f131a"
+dependencies = [
+ "include_dir",
+]
+
+[[package]]
 name = "lingua-vietnamese-language-model"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3582,9 +3592,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "open"
@@ -4650,9 +4660,9 @@ dependencies = [
 
 [[package]]
 name = "serde-wasm-bindgen"
-version = "0.6.1"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17ba92964781421b6cef36bf0d7da26d201e96d84e1b10e7ae6ed416e516906d"
+checksum = "4c1432112bce8b966497ac46519535189a3250a3812cd27a999678a69756f79f"
 dependencies = [
  "js-sys",
  "serde",
diff --git a/pkgs/applications/misc/pot/default.nix b/pkgs/by-name/po/pot/package.nix
index fdc0a6b6c4149..aac04e5a0bcce 100644
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/by-name/po/pot/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pot";
-  version = "2.7.4";
+  version = "2.7.9";
 
   src = fetchFromGitHub {
     owner = "pot-app";
     repo = "pot-desktop";
     rev = version;
-    hash = "sha256-c7FHkp/utvrr7qasY+XKaTnPaiZWb8M5EGiFne52osQ=";
+    hash = "sha256-Y2gFLvRNBjOGxdpIeoY1CXEip0Ht73aymWIP5wuc9kU=";
   };
 
   sourceRoot = "${src.name}/src-tauri";
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
 
     dontFixup = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-BQ5M+pKEXGJzWmxMchNgxpvLpgFCRIg33GQCvO4TLz4=";
+    outputHash = "sha256-LuY5vh642DgSa91eUcA/AT+ovDcP9tZFE2dKyicCOeQ=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/by-name/ra/railway-travel/package.nix b/pkgs/by-name/ra/railway-travel/package.nix
new file mode 100644
index 0000000000000..be09a63e6dd0c
--- /dev/null
+++ b/pkgs/by-name/ra/railway-travel/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  cargo,
+  desktop-file-utils,
+  meson,
+  ninja,
+  pkg-config,
+  rustPlatform,
+  rustc,
+  wrapGAppsHook4,
+  cairo,
+  gdk-pixbuf,
+  glib,
+  gtk4,
+  libadwaita,
+  pango,
+  darwin,
+}:
+stdenv.mkDerivation rec {
+  pname = "railway-travel";
+  version = "2.4.0";
+
+  src = fetchFromGitLab {
+    owner = "schmiddi-on-mobile";
+    repo = "railway";
+    rev = version;
+    hash = "sha256-2iLxErEP0OG+BcG7fvJBzNjh95EkNoC3NC7rKxPLhYk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-yalFC7Pw9rq1ylLwoxLi4joTyjQsZJ/ZC61GhTNc49w=";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    cargo
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+  ];
+
+  buildInputs =
+    [
+      cairo
+      gdk-pixbuf
+      glib
+      gtk4
+      libadwaita
+      pango
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Foundation
+      darwin.apple_sdk.frameworks.Security
+    ];
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isClang [ "-Wno-error=incompatible-function-pointer-types" ]
+  );
+
+  meta = with lib; {
+    description = "Find all your travel information";
+    homepage = "https://gitlab.com/schmiddi-on-mobile/railway";
+    changelog = "https://gitlab.com/schmiddi-on-mobile/railway/-/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lilacious ];
+    mainProgram = "diebahn";
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/se/sesh/package.nix b/pkgs/by-name/se/sesh/package.nix
index ccfc53274e2cf..919bc5e6a047e 100644
--- a/pkgs/by-name/se/sesh/package.nix
+++ b/pkgs/by-name/se/sesh/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "sesh";
-  version = "0.15.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "joshmedeski";
     repo = "sesh";
     rev = "v${version}";
-    hash = "sha256-vV1b0YhDBt/dJJCrxvVV/FIuOIleTg4mI496n4/Y/Hk=";
+    hash = "sha256-eFqqiGIbS9HW7czAtSIPmvbynvg2gsu4luKsL25vxn4=";
   };
 
   vendorHash = "sha256-zt1/gE4bVj+3yr9n0kT2FMYMEmiooy3k1lQ77rN6sTk=";
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index 19473454839ac..9cd26ccf8fcc8 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -11,6 +11,8 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tinymist";
+  # Please update the corresponding vscode extension when updating
+  # this derivation.
   version = "0.11.1";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/tl/tlrc/package.nix b/pkgs/by-name/tl/tlrc/package.nix
index dd59312600a7f..5ac8fe12fb971 100644
--- a/pkgs/by-name/tl/tlrc/package.nix
+++ b/pkgs/by-name/tl/tlrc/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tlrc";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "tldr-pages";
     repo = "tlrc";
     rev = "v${version}";
-    hash = "sha256-SoWGZXBAqWWg5kwwpWuiA7iGqq9RNok/LqsjPAy6O+k=";
+    hash = "sha256-RzGw4rvak055V48bkeuzKAH6F/wlFMLya8Ny3mgU+H4=";
   };
 
-  cargoHash = "sha256-+HxRu8t6nofeE9WrDxQhebWIgeMYeMSXnHtHR1OHGzw=";
+  cargoHash = "sha256-BbBt6oCO9y++EWx9/CXISGfB/FEcEPKYeXNXcejevrg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/tr/treedome/package.nix b/pkgs/by-name/tr/treedome/package.nix
index a7752abf0fd6e..86a554b2f8aeb 100644
--- a/pkgs/by-name/tr/treedome/package.nix
+++ b/pkgs/by-name/tr/treedome/package.nix
@@ -19,12 +19,12 @@
 
 let
   pname = "treedome";
-  version = "0.4.3";
+  version = "0.4.5";
 
   src = fetchgit {
     url = "https://codeberg.org/solver-orgz/treedome";
     rev = version;
-    hash = "sha256-FBzRsBoV3wnt2nu5WMnaTnBNC51jG120E0Orm55KhBg=";
+    hash = "sha256-YkyjG/ee5WeO5OD4FZnWaqcOJO3YC0uQkbwGkCNBxC8=";
     fetchLFS = true;
   };
 
diff --git a/pkgs/by-name/ty/typstyle/package.nix b/pkgs/by-name/ty/typstyle/package.nix
new file mode 100644
index 0000000000000..1ef0f9b47f359
--- /dev/null
+++ b/pkgs/by-name/ty/typstyle/package.nix
@@ -0,0 +1,46 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, libgit2
+, zlib
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "typstyle";
+  version = "0.11.5";
+
+  src = fetchFromGitHub {
+    owner = "Enter-tainer";
+    repo = "typstyle";
+    rev = "v${version}";
+    hash = "sha256-jAsKktTgvmZ4NKr1QpJPYjI2HRSw8CPBfJTETVyiRhg=";
+  };
+
+  cargoHash = "sha256-oLJWgF5byM3sY3Bs/wpSrBqjNg4sHDF3RIsWZBiguGI=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+    zlib
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  meta = {
+    changelog = "https://github.com/Enter-tainer/typstyle/blob/${src.rev}/CHANGELOG.md";
+    description = "Format your typst source code";
+    homepage = "https://github.com/Enter-tainer/typstyle";
+    license = lib.licenses.asl20;
+    mainProgram = "typstyle";
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/pkgs/by-name/wy/wyoming-satellite/package.nix b/pkgs/by-name/wy/wyoming-satellite/package.nix
new file mode 100644
index 0000000000000..45c0ff03eeb1f
--- /dev/null
+++ b/pkgs/by-name/wy/wyoming-satellite/package.nix
@@ -0,0 +1,60 @@
+{ lib
+, python3Packages
+, fetchFromGitHub
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "wyoming-satellite";
+  version = "1.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rhasspy";
+    repo = "wyoming-satellite";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-KIWhWE9Qaxs72fJ1LRTkvk6QtpBJOFlmZv2od69O15g=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "zeroconf"
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pyring-buffer
+    wyoming
+    zeroconf
+  ];
+
+  passthru.optional-dependencies = {
+    silerovad = with python3Packages; [
+      pysilero-vad
+    ];
+    webrtc = with python3Packages; [
+      webrtc-noise-gain
+    ];
+  };
+
+  pythonImportsCheck = [
+    "wyoming_satellite"
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+
+  meta = with lib; {
+    description = "Remote voice satellite using Wyoming protocol";
+    homepage = "https://github.com/rhasspy/wyoming-satellite";
+    changelog = "https://github.com/rhasspy/wyoming-satellite/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+    mainProgram = "wyoming-satellite";
+  };
+}
diff --git a/pkgs/by-name/zi/zircolite/package.nix b/pkgs/by-name/zi/zircolite/package.nix
index 13583df1b912c..c6b73bb716035 100644
--- a/pkgs/by-name/zi/zircolite/package.nix
+++ b/pkgs/by-name/zi/zircolite/package.nix
@@ -6,23 +6,23 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "zircolite";
-  version = "2.10.0";
+  version = "2.20.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "wagga40";
     repo = "Zircolite";
     rev = "refs/tags/${version}";
-    hash = "sha256-r5MIoP+6CnAGsOtK4YLshLBVSZN2NVrwnkuHHDdLZrQ=";
+    hash = "sha256-a7xwF0amsh2SycOjtZpk3dylcBGG9uYd7vmbnz/f9Ug=";
   };
 
   __darwinAllowLocalNetworking = true;
 
-  nativeBuildInputs = [
+  build-system = [
     makeWrapper
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     aiohttp
     colorama
     elastic-transport
diff --git a/pkgs/data/fonts/google-fonts/default.nix b/pkgs/data/fonts/google-fonts/default.nix
index d0f055166805e..bb3fc3ab0c1db 100644
--- a/pkgs/data/fonts/google-fonts/default.nix
+++ b/pkgs/data/fonts/google-fonts/default.nix
@@ -40,12 +40,10 @@ stdenvNoCC.mkDerivation {
 
   dontBuild = true;
 
-  # The font files are in the fonts directory and use two naming schemes:
-  # FamilyName-StyleName.ttf and FamilyName[param1,param2,...].ttf
-  # This installs all fonts if fonts is empty and otherwise only
-  # the specified fonts by FamilyName. To do this, it invokes
-  # `find` 2 times for every font, anyone is free to do this
-  # in a more efficient way.
+  # The font files are in the fonts directory and use three naming schemes:
+  # FamilyName-StyleName.ttf, FamilyName[param1,param2,...].ttf, and
+  # FamilyName.ttf. This installs all fonts if fonts is empty and otherwise
+  # only the specified fonts by FamilyName.
   fonts = map (font: builtins.replaceStrings [" "] [""] font) fonts;
   installPhase = ''
     adobeBlankDest=$adobeBlank/share/fonts/truetype
@@ -56,8 +54,7 @@ stdenvNoCC.mkDerivation {
     find . -name '*.ttf' -exec install -m 444 -Dt $dest '{}' +
   '' else ''
     for font in $fonts; do
-      find . -name "$font-*.ttf" -exec install -m 444 -Dt $dest '{}' +
-      find . -name "$font[*.ttf" -exec install -m 444 -Dt $dest '{}' +
+      find . \( -name "$font-*.ttf" -o -name "$font[*.ttf" -o -name "$font.ttf" \) -exec install -m 444 -Dt $dest '{}' +
     done
   '');
 
diff --git a/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix b/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
index dff4189a1a2de..2588a133ba7bb 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
@@ -72,7 +72,7 @@ let
     export XDG_DATA_DIRS=@out@/share:$XDG_DATA_DIRS
 
     # Start pantheon session. Keep in sync with upstream
-    exec ${gnome-session}/bin/gnome-session --builtin --session=pantheon "$@"
+    exec ${gnome-session}/bin/gnome-session --session=pantheon "$@"
   '';
 
   # Absolute path patched version of the upstream xsession
diff --git a/pkgs/desktops/pantheon/desktop/gala/default.nix b/pkgs/desktops/pantheon/desktop/gala/default.nix
index 61d9c120b2461..123870c356de0 100644
--- a/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gala/default.nix
@@ -70,6 +70,9 @@ stdenv.mkDerivation rec {
   postPatch = ''
     chmod +x build-aux/meson/post_install.py
     patchShebangs build-aux/meson/post_install.py
+
+    # https://github.com/elementary/gala/issues/1826#issuecomment-1890461298
+    sed '2i Wants=io.elementary.gala.daemon@.service' -i 'data/gala@x11.service.in'
   '';
 
   passthru = {
diff --git a/pkgs/development/compilers/dotnet/common.nix b/pkgs/development/compilers/dotnet/common.nix
index 0d8890e61da2b..63b3a7de374ef 100644
--- a/pkgs/development/compilers/dotnet/common.nix
+++ b/pkgs/development/compilers/dotnet/common.nix
@@ -4,6 +4,8 @@
 , writeText
 , testers
 , runCommand
+, expect
+, curl
 }: type: args: stdenv.mkDerivation (finalAttrs: args // {
   doInstallCheck = true;
 
@@ -27,37 +29,97 @@
 
 } // lib.optionalAttrs (type == "sdk") {
   passthru = {
-    tests = {
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-      };
+    tests = let
+      mkDotnetTest =
+        {
+          name,
+          template,
+          usePackageSource ? false,
+          build,
+          # TODO: use correct runtimes instead of sdk
+          runtime ? finalAttrs.finalPackage,
+          runInputs ? [],
+          run ? null,
+        }:
+        let
+          built = runCommand "dotnet-test-${name}" { buildInputs = [ finalAttrs.finalPackage ]; } (''
+            HOME=$PWD/.home
+            dotnet new nugetconfig
+            dotnet nuget disable source nuget
+          '' + lib.optionalString usePackageSource ''
+            dotnet nuget add source ${finalAttrs.finalPackage.packages}
+          '' + ''
+            dotnet new ${template} -n test -o .
+          '' + build);
+        in
+          if run == null
+            then build
+          else
+            runCommand "${built.name}-run" { src = built; nativeBuildInputs = runInputs; } (
+              lib.optionalString (runtime != null) ''
+                # TODO: use runtime here
+                export DOTNET_ROOT=${runtime}
+              '' + run);
 
-      console = runCommand "dotnet-test-console" {
-        nativeBuildInputs = [ finalAttrs.finalPackage ];
-      } ''
-        HOME=$(pwd)/fake-home
-        dotnet new nugetconfig
-        dotnet nuget disable source nuget
-        dotnet new console -n test -o .
-        output="$(dotnet run)"
+      checkConsoleOutput = command: ''
+        output="$(${command})"
         # yes, older SDKs omit the comma
         [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
       '';
 
-      single-file = let build = runCommand "dotnet-test-build-single-file" {
-        nativeBuildInputs = [ finalAttrs.finalPackage ];
-      } ''
-        HOME=$(pwd)/fake-home
-        dotnet new nugetconfig
-        dotnet nuget disable source nuget
-        dotnet nuget add source ${finalAttrs.finalPackage.packages}
-        dotnet new console -n test -o .
-        dotnet publish --use-current-runtime -p:PublishSingleFile=true -o $out
-      ''; in runCommand "dotnet-test-run-single-file" {} ''
-        output="$(${build}/test)"
-        # yes, older SDKs omit the comma
-        [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
-      '';
+    in {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+
+      console = mkDotnetTest {
+        name = "console";
+        template = "console";
+        build = checkConsoleOutput "dotnet run";
+      };
+
+      publish = mkDotnetTest {
+        name = "publish";
+        template = "console";
+        build = "dotnet publish -o $out";
+        run = checkConsoleOutput "$src/test";
+      };
+
+      single-file = mkDotnetTest {
+        name = "single-file";
+        template = "console";
+        usePackageSource = true;
+        build = "dotnet publish --use-current-runtime -p:PublishSingleFile=true -o $out";
+        runtime = null;
+        run = checkConsoleOutput "$src/test";
+      };
+
+      web = mkDotnetTest {
+        name = "publish";
+        template = "web";
+        build = "dotnet publish -o $out";
+        runInputs = [ expect curl ];
+        run = ''
+          expect <<"EOF"
+            set status 1
+            spawn $env(src)/test
+            expect_before default abort
+            expect -re {Now listening on: ([^\r]+)\r} {
+              set url $expect_out(1,string)
+            }
+            expect "Application started. Press Ctrl+C to shut down."
+            set output [exec curl -sSf $url]
+            if {$output != "Hello World!"} {
+              send_error "Unexpected output: $output\n"
+              exit 1
+            }
+            send \x03
+            catch wait result
+            exit [lindex $result 3]
+          EOF
+          touch $out
+        '';
+      };
     } // args.passthru.tests or {};
   } // args.passthru or {};
 })
diff --git a/pkgs/development/compilers/idris2/build-idris.nix b/pkgs/development/compilers/idris2/build-idris.nix
index e66306c4344b1..1df763e4c4fd4 100644
--- a/pkgs/development/compilers/idris2/build-idris.nix
+++ b/pkgs/development/compilers/idris2/build-idris.nix
@@ -32,28 +32,34 @@ let
     "idrisLibraries"
   ];
 
-  sharedAttrs = drvAttrs // {
-    pname = ipkgName;
-    inherit version;
-    src = src;
-    nativeBuildInputs = [ idris2 makeWrapper ] ++ attrs.nativeBuildInputs or [];
-    buildInputs = propagatedIdrisLibraries ++ attrs.buildInputs or [];
+  derivation = stdenv.mkDerivation (finalAttrs:
+    drvAttrs // {
+      pname = ipkgName;
+      inherit version;
+      src = src;
+      nativeBuildInputs = [ idris2 makeWrapper ] ++ attrs.nativeBuildInputs or [];
+      buildInputs = propagatedIdrisLibraries ++ attrs.buildInputs or [];
 
-    IDRIS2_PACKAGE_PATH = libDirs;
+      IDRIS2_PACKAGE_PATH = libDirs;
 
-    buildPhase = ''
-      runHook preBuild
-      idris2 --build ${ipkgFileName}
-      runHook postBuild
-    '';
+      buildPhase = ''
+        runHook preBuild
+        idris2 --build ${ipkgFileName}
+        runHook postBuild
+      '';
 
-    passthru = {
-      inherit propagatedIdrisLibraries;
-    };
-  };
+      passthru = {
+        inherit propagatedIdrisLibraries;
+      };
+
+      shellHook = ''
+        export IDRIS2_PACKAGE_PATH="${finalAttrs.IDRIS2_PACKAGE_PATH}"
+      '';
+    }
+  );
 
 in {
-  executable = stdenv.mkDerivation (sharedAttrs // {
+  executable = derivation.overrideAttrs {
     installPhase = ''
       runHook preInstall
       mkdir -p $out/bin
@@ -76,11 +82,11 @@ in {
       fi
       runHook postInstall
     '';
-  });
+  };
 
   library = { withSource ? false }:
     let installCmd = if withSource then "--install-with-src" else "--install";
-    in stdenv.mkDerivation (sharedAttrs // {
+    in derivation.overrideAttrs {
       installPhase = ''
         runHook preInstall
         mkdir -p $out/${libSuffix}
@@ -88,5 +94,5 @@ in {
         idris2 ${installCmd} ${ipkgFileName}
         runHook postInstall
       '';
-    });
+    };
 }
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 5abe309624bb4..d29fb743c7dc9 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -14,15 +14,10 @@ let
     # https://github.com/openembedded/openembedded-core/blob/a5440d4288e09d3e/meta/recipes-devtools/vala/vala/disable-graphviz.patch
     graphvizPatch =
       {
-        "0.48" = ./disable-graphviz-0.46.1.patch;
-
-        "0.54" = ./disable-graphviz-0.46.1.patch;
-
         "0.56" = ./disable-graphviz-0.56.8.patch;
-
       }.${lib.versions.majorMinor version} or (throw "no graphviz patch for this version of vala");
 
-    disableGraphviz = lib.versionAtLeast version "0.38" && !withGraphviz;
+    disableGraphviz = !withGraphviz;
 
   in stdenv.mkDerivation rec {
     pname = "vala";
@@ -55,14 +50,14 @@ let
 
     nativeBuildInputs = [
       pkg-config flex bison libxslt
-    ] ++ lib.optional (stdenv.isDarwin && (lib.versionAtLeast version "0.38")) expat
+    ] ++ lib.optional (stdenv.isDarwin) expat
       ++ lib.optional disableGraphviz autoreconfHook # if we changed our ./configure script, need to reconfigure
       ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ vala ]
       ++ extraNativeBuildInputs;
 
     buildInputs = [
       glib libiconv libintl
-    ] ++ lib.optional (lib.versionAtLeast version "0.38" && withGraphviz) graphviz
+    ] ++ lib.optional (withGraphviz) graphviz
       ++ extraBuildInputs;
 
     enableParallelBuilding = true;
@@ -90,16 +85,6 @@ let
   });
 
 in rec {
-  vala_0_48 = generic {
-    version = "0.48.25";
-    sha256 = "UMs8Xszdx/1DaL+pZBSlVgReedKxWmiRjHJ7jIOxiiQ=";
-  };
-
-  vala_0_54 = generic {
-    version = "0.54.9";
-    sha256 = "hXLA6Nd9eMFZfVFgCPBUDH50leA10ou0wlzJk+U85LQ=";
-  };
-
   vala_0_56 = generic {
     version = "0.56.14";
     sha256 = "k4LCaMqb3AKq7cgVKpgYvzk1JzBB9inFbeQQ42Cj9Vc=";
diff --git a/pkgs/development/compilers/vala/disable-graphviz-0.46.1.patch b/pkgs/development/compilers/vala/disable-graphviz-0.46.1.patch
deleted file mode 100644
index 7c2ded4c8eda3..0000000000000
--- a/pkgs/development/compilers/vala/disable-graphviz-0.46.1.patch
+++ /dev/null
@@ -1,280 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index f70234759..b3d6c3833 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -13,19 +13,9 @@ SUBDIRS = \
- 	doc \
- 	gobject-introspection \
- 	vapigen \
--	$(NULL)
--
--if ENABLE_VALADOC
--SUBDIRS += \
- 	libvaladoc \
- 	valadoc \
- 	$(NULL)
--endif
--
--DISTCHECK_CONFIGURE_FLAGS = \
--	--enable-valadoc \
--	--enable-unversioned \
--	$(NULL)
- 
- if ENABLE_UNVERSIONED
- aclocaldir = $(datadir)/aclocal
-diff --git a/configure.ac b/configure.ac
-index 6de326bbb..91f159b16 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -160,10 +160,11 @@ AC_SUBST(GMODULE_CFLAGS)
- AC_SUBST(GMODULE_LIBS)
- 
- AC_ARG_WITH(cgraph, AS_HELP_STRING([--with-cgraph], [Required flag for cross-compilation to define capability of graphviz]), [], with_cgraph=check)
--AC_ARG_ENABLE(valadoc, AS_HELP_STRING([--disable-valadoc], [Disable valadoc]), enable_valadoc=$enableval, enable_valadoc=yes)
--if test x$enable_valadoc = xyes; then
-+AC_ARG_ENABLE(graphviz, AS_HELP_STRING([--disable-graphviz], [Disable graphviz usage for valadoc]), enable_graphviz=$enableval, enable_graphviz=yes)
-+if test x$enable_graphviz = xyes; then
- 	PKG_CHECK_MODULES(LIBGVC, libgvc >= $LIBGVC_REQUIRED)
- 	AC_MSG_CHECKING([for CGRAPH])
-+	VALAFLAGS="$VALAFLAGS -D HAVE_GRAPHVIZ"
- 	cgraph_tmp_LIBADD="$LIBADD"
- 	cgraph_tmp_CFLAGS="$CFLAGS"
- 	LIBADD="$LIBADD $LIBGVC_LIBS"
-@@ -201,8 +202,8 @@ if test x$enable_valadoc = xyes; then
- 	LIBADD="$cgraph_tmp_LIBADD"
- 	CFLAGS="$cgraph_tmp_CFLAGS"
- fi
-+AM_CONDITIONAL(ENABLE_GRAPHVIZ, test x$enable_graphviz = xyes)
- AM_CONDITIONAL(HAVE_CGRAPH, test "$have_cgraph" = "yes")
--AM_CONDITIONAL(ENABLE_VALADOC, test x$enable_valadoc = xyes)
- 
- AC_PATH_PROG([XSLTPROC], [xsltproc], :)
- AM_CONDITIONAL(HAVE_XSLTPROC, test "$XSLTPROC" != :)
-diff --git a/doc/Makefile.am b/doc/Makefile.am
-index d2684a0e0..b343c7c10 100644
---- a/doc/Makefile.am
-+++ b/doc/Makefile.am
-@@ -6,16 +6,11 @@ SUBDIRS = \
- 
- dist_man_MANS = \
- 	valac.1 \
-+	valadoc.1 \
- 	vala-gen-introspect.1 \
- 	vapigen.1 \
- 	$(NULL)
- 
--if ENABLE_VALADOC
--dist_man_MANS += \
--	valadoc.1 \
--	$(NULL)
--endif
--
- EXTRA_DIST = \
- 	valac.h2m \
- 	valadoc.h2m \
-@@ -24,11 +19,7 @@ EXTRA_DIST = \
- 	$(NULL)
- 
- if HAVE_HELP2MAN
--if ENABLE_VALADOC
- manpages: valac.1 valadoc.1 vala-gen-introspect.1 vapigen.1
--else
--manpages: valac.1 vala-gen-introspect.1 vapigen.1
--endif
- 	@rm $^
- 	$(MAKE) $(AM_MAKEFLAGS) $^
- 
-@@ -37,13 +28,11 @@ valac.1:
- 		--include $(srcdir)/valac.h2m \
- 		--libtool --no-info \
- 		--output=$@
--if ENABLE_VALADOC
- valadoc.1:
- 	$(HELP2MAN) $(top_builddir)/valadoc/valadoc \
- 		--include $(srcdir)/valadoc.h2m \
- 		--libtool --no-info \
- 		--output=$@
--endif
- vala-gen-introspect.1:
- 	$(HELP2MAN) $(top_builddir)/gobject-introspection/gen-introspect \
- 		--include $(srcdir)/vala-gen-introspect.h2m \
-@@ -60,15 +49,12 @@ endif
- if ENABLE_UNVERSIONED
- install-data-hook:
- 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f valac@PACKAGE_SUFFIX@.1 valac.1
--if ENABLE_VALADOC
- 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f valadoc@PACKAGE_SUFFIX@.1 valadoc.1
--endif
- 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f vala-gen-introspect@PACKAGE_SUFFIX@.1 vala-gen-introspect.1
- 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f vapigen@PACKAGE_SUFFIX@.1 vapigen.1
- endif
- 
- 
--if ENABLE_VALADOC
- COMMON_VALADOCFLAGS = \
- 	--force \
- 	--verbose \
-@@ -150,7 +136,6 @@ internal-apis/valadoc: $(valadoc_VALASOURCES) internal-apis/codegen
- 	@touch $@
- 
- internal-api-docs: internal-apis/gee internal-apis/vala internal-apis/ccode internal-apis/codegen internal-apis/valadoc
--endif
- 
- clean-local:
- 	rm -rf $(builddir)/internal-apis
-diff --git a/libvaladoc/Makefile.am b/libvaladoc/Makefile.am
-index 8a3924b54..81fde9ac8 100644
---- a/libvaladoc/Makefile.am
-+++ b/libvaladoc/Makefile.am
-@@ -119,10 +119,6 @@ libvaladoc_la_VALASOURCES = \
- 	content/tablerow.vala \
- 	content/taglet.vala \
- 	content/text.vala \
--	charts/chart.vala \
--	charts/chartfactory.vala \
--	charts/hierarchychart.vala \
--	charts/simplechartfactory.vala \
- 	parser/manyrule.vala \
- 	parser/oneofrule.vala \
- 	parser/optionalrule.vala \
-@@ -149,13 +145,24 @@ libvaladoc_la_VALASOURCES = \
- 	highlighter/codetoken.vala \
- 	highlighter/highlighter.vala \
- 	html/basicdoclet.vala \
--	html/htmlchartfactory.vala \
- 	html/linkhelper.vala \
- 	html/cssclassresolver.vala \
- 	html/htmlmarkupwriter.vala \
- 	html/htmlrenderer.vala \
- 	$(NULL)
- 
-+if ENABLE_GRAPHVIZ
-+libvaladoc_la_VALASOURCES += \
-+	charts/chart.vala \
-+	charts/chartfactory.vala \
-+	charts/hierarchychart.vala \
-+	charts/simplechartfactory.vala \
-+	html/htmlchartfactory.vala \
-+	$(NULL)
-+
-+LIBGVC_PKG = --vapidir $(top_srcdir)/vapi --pkg libgvc
-+endif
-+
- libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
- 	libvaladoc.vala.stamp \
- 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
-@@ -175,11 +182,11 @@ libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
- 		--library valadoc \
- 		--vapi valadoc@PACKAGE_SUFFIX@.vapi \
- 		--vapidir $(top_srcdir)/vapi --pkg gmodule-2.0 \
--		--vapidir $(top_srcdir)/vapi --pkg libgvc \
- 		--vapidir $(top_srcdir)/gee --pkg gee \
- 		--vapidir $(top_srcdir)/vala --pkg vala \
- 		--vapidir $(top_srcdir)/ccode --pkg ccode \
- 		--vapidir $(top_srcdir)/codegen --pkg codegen \
-+		$(LIBGVC_PKG) \
- 		--pkg config \
- 		$(filter %.vala %.c,$^)
- 	touch $@
-@@ -207,6 +214,9 @@ nodist_pkgconfig_DATA = valadoc@PACKAGE_SUFFIX@.pc
- 
- valadoc@PACKAGE_SUFFIX@.pc: valadoc.pc
- 	cp $< $@
-+if !ENABLE_GRAPHVIZ
-+	sed -i "s/libgvc //g" $@
-+endif
- 
- vapidir = $(datadir)/vala/vapi
- dist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.vapi
-@@ -214,6 +224,9 @@ nodist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.deps
- 
- valadoc@PACKAGE_SUFFIX@.deps: valadoc.deps
- 	cp $< $@
-+if !ENABLE_GRAPHVIZ
-+	sed -i "s/libgvc//g" $@
-+endif
- 
- EXTRA_DIST = \
- 	$(libvaladoc_la_VALASOURCES) \
-diff --git a/libvaladoc/html/basicdoclet.vala b/libvaladoc/html/basicdoclet.vala
-index 46578c28f..f6ce7097c 100644
---- a/libvaladoc/html/basicdoclet.vala
-+++ b/libvaladoc/html/basicdoclet.vala
-@@ -46,7 +46,11 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 	protected HtmlRenderer _renderer;
- 	protected Html.MarkupWriter writer;
- 	protected Html.CssClassResolver cssresolver;
-+#if HAVE_GRAPHVIZ
- 	protected Charts.Factory image_factory;
-+#else
-+	protected void* image_factory;
-+#endif
- 	protected ErrorReporter reporter;
- 	protected string package_list_link = "../index.html";
- 
-@@ -120,7 +124,9 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 		this.linker = new LinkHelper ();
- 
- 		_renderer = new HtmlRenderer (settings, this.linker, this.cssresolver);
-+#if HAVE_GRAPHVIZ
- 		this.image_factory = new SimpleChartFactory (settings, linker);
-+#endif
- 	}
- 
- 
-@@ -1025,6 +1031,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 	}
- 
- 	protected void write_image_block (Api.Node element) {
-+#if HAVE_GRAPHVIZ
- 		if (element is Class || element is Interface || element is Struct) {
- 			unowned string format = (settings.use_svg_images ? "svg" : "png");
- 			var chart = new Charts.Hierarchy (image_factory, element);
-@@ -1044,6 +1051,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 									   this.get_img_path_html (element, format)});
- 			writer.add_usemap (chart);
- 		}
-+#endif
- 	}
- 
- 	public void write_namespace_content (Namespace node, Api.Node? parent) {
-diff --git a/libvaladoc/html/htmlmarkupwriter.vala b/libvaladoc/html/htmlmarkupwriter.vala
-index 5aa4afdea..e79b0b8f5 100644
---- a/libvaladoc/html/htmlmarkupwriter.vala
-+++ b/libvaladoc/html/htmlmarkupwriter.vala
-@@ -51,12 +51,16 @@ public class Valadoc.Html.MarkupWriter : Valadoc.MarkupWriter {
- 		}
- 	}
- 
-+#if HAVE_GRAPHVIZ
- 	public unowned MarkupWriter add_usemap (Charts.Chart chart) {
- 		string? buf = (string?) chart.write_buffer ("cmapx");
- 		if (buf != null) {
- 			raw_text ("\n");
- 			raw_text ((!) buf);
- 		}
-+#else
-+	public unowned MarkupWriter add_usemap (void* chart) {
-+#endif
- 
- 		return this;
- 	}
-diff --git i/libvaladoc/Makefile.am w/libvaladoc/Makefile.am
-index 8dc398cf1..a5d8a45b4 100644
---- i/libvaladoc/Makefile.am
-+++ w/libvaladoc/Makefile.am
-@@ -176,9 +176,13 @@ endif
- libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
- 	libvaladoc.vala.stamp \
- 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
--	gvc-compat.c \
- 	$(NULL)
- 
-+if ENABLE_GRAPHVIZ
-+libvaladoc@PACKAGE_SUFFIX@_la_SOURCES += \
-+	gvc-compat.c
-+endif
-+
- valadoc@PACKAGE_SUFFIX@.vapi valadoc.h: libvaladoc.vala.stamp
- libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
- 	$(VALA_V)$(VALAC) \
diff --git a/pkgs/development/coq-modules/metacoq/default.nix b/pkgs/development/coq-modules/metacoq/default.nix
index 5695bcf2ee998..174f44b7702ae 100644
--- a/pkgs/development/coq-modules/metacoq/default.nix
+++ b/pkgs/development/coq-modules/metacoq/default.nix
@@ -13,8 +13,9 @@ let
       { case = "8.14"; out = "1.1-8.14"; }
       { case = "8.15"; out = "1.1-8.15"; }
       { case = "8.16"; out = "1.1-8.16"; }
-      { case = "8.17"; out = "1.2.1-8.17"; }
-      { case = "8.18"; out = "1.2.1-8.18"; }
+      { case = "8.17"; out = "1.3.1-8.17"; }
+      { case = "8.18"; out = "1.3.1-8.18"; }
+      { case = "8.19"; out = "1.3.1-8.19"; }
     ] null;
   release = {
     "1.0-beta2-8.11".sha256 = "sha256-I9YNk5Di6Udvq5/xpLSNflfjRyRH8fMnRzbo3uhpXNs=";
@@ -28,6 +29,9 @@ let
     "1.1-8.16".sha256 = "sha256-cTK4ptxpPPlqxAhasZFX3RpSlsoTZwhTqs2A3BZy9sA=";
     "1.2.1-8.17".sha256 = "sha256-FP4upuRsG8B5Q5FIr76t+ecRirrOUX0D1QiLq0/zMyE=";
     "1.2.1-8.18".sha256 = "sha256-49g5db2Bv8HpltptJdxA7zrmgNFGC6arx5h2mKHhrko=";
+    "1.3.1-8.17".sha256 = "sha256-l0/QLC7V3zSk/FsaE2eL6tXy2BzbcI5MAk/c+FESwnc=";
+    "1.3.1-8.18".sha256 = "sha256-L6Ym4Auwqaxv5tRmJLSVC812dxCqdUU5aN8+t5HVYzY=";
+    "1.3.1-8.19".sha256 = "sha256-fZED/Uel1jt5XF83dR6HfyhSkfBdLkET8C/ArDgsm64=";
   };
   releaseRev = v: "v${v}";
 
diff --git a/pkgs/development/coq-modules/serapi/default.nix b/pkgs/development/coq-modules/serapi/default.nix
index f48cce55d4dc2..d993bbdf1020f 100644
--- a/pkgs/development/coq-modules/serapi/default.nix
+++ b/pkgs/development/coq-modules/serapi/default.nix
@@ -71,7 +71,8 @@ in
           if version == "8.11.0+0.11.1" then version
           else builtins.replaceStrings [ "+" ] [ "." ] version
         }.tbz";
-    sha256 = release."${version}".sha256;
+    # abort/syntax error will fail package set eval, but throw is "fine"
+    sha256 = release."${version}".sha256 or (throw "Unknown version '${version}'");
   };
 
   patches =
diff --git a/pkgs/development/libraries/libkrun/default.nix b/pkgs/development/libraries/libkrun/default.nix
index dbee4c9a35820..6a66320299279 100644
--- a/pkgs/development/libraries/libkrun/default.nix
+++ b/pkgs/development/libraries/libkrun/default.nix
@@ -13,18 +13,18 @@
 
 stdenv.mkDerivation rec {
   pname = "libkrun";
-  version = "1.7.2";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libkrun";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cP+Pxl/9QIsoGysXTBZJ86q57cIMA7TJenMWtcOI+Y4=";
+    hash = "sha256-rrNiqwx4aEOB3fTyv8xcZEDsNJX4NNPhp13W0qnl1O0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit pname version src;
-    hash = "sha256-qVyHC015QJEt6LZ8br3H0nucYKhYGBMtyB2IBaixTqk=";
+    hash = "sha256-6Zfy0LtxUDZzwlhul2fZpsI1c7GWntAMfsT6j+QefVs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index 39824b634b11b..146d41321c6a6 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.277";
+  version = "0.6.279";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-s80veDxN0GfHKOwDhxx1ArZXqk8OPSl+d/Ruxj0oLJA=";
+    sha256 = "sha256-jQkaMFTArXPSCm6aBQb/vb4JEkgHtmzJl/Iz/f/pBSY=";
   };
 
   vendorHash = "sha256-IR/tgqh8rS4uN5jSOcopCutbHCKHSU9icUfRhOgu4t8=";
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index d2e28b0a1b2ca..c206a881eb156 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -2,16 +2,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "phpstan";
-  version = "1.10.65";
+  version = "1.10.66";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan-src";
     rev = finalAttrs.version;
-    hash = "sha256-mKNix5TEnr0aUHxn9cYvFafU7yLhTe8AVkHZcu0/a1M=";
+    hash = "sha256-ZEQ6oP6zyi0cL69J9ck8gAht5taPkzH+iW5ALC4saAQ=";
   };
 
-  vendorHash = "sha256-NezEoraSomeeMbY7qz2pH2EwLr/VXO1tmWJ5/2fS/qU=";
+  vendorHash = "sha256-Qp/eMhcKK32N1EMgeIspBDs28Oofwn6n2bEFKqvSx9E=";
   composerStrictValidation = false;
 
   meta = {
diff --git a/pkgs/development/python-modules/aadict/default.nix b/pkgs/development/python-modules/aadict/default.nix
index d6b5bdf9c6f02..4ddf06bbb700a 100644
--- a/pkgs/development/python-modules/aadict/default.nix
+++ b/pkgs/development/python-modules/aadict/default.nix
@@ -2,27 +2,40 @@
 , buildPythonPackage
 , fetchPypi
 , six
-, nose
-, coverage
+, pynose
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "aadict";
   version = "0.2.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "013pn9ii6mkql6khgdvsd1gi7zmya418fhclm5fp7dfvann2hwx7";
+    hash = "sha256-p3MorFXbtXNdqZRBhwJRvv4TX2h6twenoXhWE2OydwQ=";
   };
 
-  propagatedBuildInputs = [ six ];
-  nativeCheckInputs = [ nose coverage ];
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    six
+  ];
+
+  nativeCheckInputs = [
+    pynose
+  ];
+
+  pythonImportsCheck = [
+    "aadict"
+  ];
 
   meta = with lib; {
+    description = "An auto-attribute dict (and a couple of other useful dict functions)";
     homepage = "https://github.com/metagriffin/aadict";
-    description = "An auto-attribute dict (and a couple of other useful dict functions).";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ glittershark ];
-    license = licenses.gpl3;
   };
 }
diff --git a/pkgs/development/python-modules/actdiag/default.nix b/pkgs/development/python-modules/actdiag/default.nix
index 6d04df9d96715..070bcd72ed4ab 100644
--- a/pkgs/development/python-modules/actdiag/default.nix
+++ b/pkgs/development/python-modules/actdiag/default.nix
@@ -2,7 +2,7 @@
 , blockdiag
 , buildPythonPackage
 , fetchFromGitHub
-, nose
+, pynose
 , pytestCheckHook
 , pythonOlder
 , setuptools
@@ -11,24 +11,27 @@
 buildPythonPackage rec {
   pname = "actdiag";
   version = "3.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "blockdiag";
-    repo = pname;
-    rev = version;
+    repo = "actdiag";
+    rev = "refs/tags/${version}";
     hash = "sha256-WmprkHOgvlsOIg8H77P7fzEqxGnj6xaL7Df7urRkg3o=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     blockdiag
-    setuptools
   ];
 
   nativeCheckInputs = [
-    nose
+    pynose
     pytestCheckHook
   ];
 
@@ -36,16 +39,23 @@ buildPythonPackage rec {
     "src/actdiag/tests/"
   ];
 
+  disabledTests = [
+    # AttributeError: 'TestRstDirectives' object has no attribute 'assertRegexpMatches'
+    "svg"
+    "noviewbox"
+  ];
+
   pythonImportsCheck = [
     "actdiag"
   ];
 
   meta = with lib; {
     description = "Generate activity-diagram image from spec-text file (similar to Graphviz)";
-    mainProgram = "actdiag";
     homepage = "http://blockdiag.com/";
+    changelog = "https://github.com/blockdiag/actdiag/blob/${version}/CHANGES.rst";
     license = licenses.asl20;
-    platforms = platforms.unix;
     maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "actdiag";
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 1131a4b9c93f4..348d4e8e62376 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,23 +8,23 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.84";
+  version = "9.2.96";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "angr";
-    repo = pname;
+    repo = "ailment";
     rev = "refs/tags/v${version}";
-    hash = "sha256-I4lZrp4coJOBB8gREmeQsCiNhMC0MqhYxd5BmYXq9BA=";
+    hash = "sha256-xc9/J360ftynKT5HYNcjR/0WX04DUDmszaAHb8h3Iao=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     pyvex
   ];
 
diff --git a/pkgs/development/python-modules/aioraven/default.nix b/pkgs/development/python-modules/aioraven/default.nix
index 227e0b62becf7..ca64f111e35e3 100644
--- a/pkgs/development/python-modules/aioraven/default.nix
+++ b/pkgs/development/python-modules/aioraven/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioraven";
-  version = "0.5.2";
+  version = "0.5.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,14 +21,14 @@ buildPythonPackage rec {
     owner = "cottsay";
     repo = "aioraven";
     rev = "refs/tags/${version}";
-    hash = "sha256-ysmIxWy+gufX5oUfQ7Zw5xv0t/yxihFB+eAdYAWAmXs=";
+    hash = "sha256-kGCFwpMaLWxLUp8k5H5AnL21KrwohbUYLswLcLqmc3M=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     iso4217
     pyserial
     pyserial-asyncio
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 3fee462c620b5..06a884aaa0b33 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -20,19 +20,23 @@
 , protobuf
 , psutil
 , pycparser
+, pyformlang
 , pythonOlder
+, pythonRelaxDepsHook
 , pyvex
 , rich
 , rpyc
+, setuptools
 , sortedcontainers
 , sqlalchemy
 , sympy
 , unicorn
+, unique-log-filter
 }:
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.84";
+  version = "9.2.96";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -41,10 +45,19 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qav9SUvQtcEad9lvgyrMhOcFhPAhzU/9s7ekTfohqRc=";
+    hash = "sha256-eyXjmU/K8zv5nxrt+oKkyxS00tHOYrkbTc2X9esTSSA=";
   };
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "capstone"
+  ];
+
+  build-system = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  dependencies = [
     ailment
     archinfo
     cachetools
@@ -63,6 +76,7 @@ buildPythonPackage rec {
     protobuf
     psutil
     pycparser
+    pyformlang
     pyvex
     rich
     rpyc
@@ -70,6 +84,7 @@ buildPythonPackage rec {
     sqlalchemy
     sympy
     unicorn
+    unique-log-filter
   ];
 
   setupPyBuildFlags = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/python-modules/angrcli/default.nix b/pkgs/development/python-modules/angrcli/default.nix
index 368ea4c9a27eb..cd2bf2f5508f2 100644
--- a/pkgs/development/python-modules/angrcli/default.nix
+++ b/pkgs/development/python-modules/angrcli/default.nix
@@ -1,5 +1,4 @@
-{ stdenv
-, lib
+{ lib
 , angr
 , buildPythonPackage
 , cmd2
@@ -8,28 +7,34 @@
 , pygments
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, stdenv
 }:
 
 buildPythonPackage rec {
   pname = "angrcli";
   version = "1.2.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "fmagin";
     repo = "angr-cli";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-a5ajUBQwt3xUNkeSOeGOAFf47wd4UVk+LcuAHGqbq4s=";
   };
 
   postPatch = ''
     substituteInPlace tests/test_derefs.py \
-      --replace "/bin/ls" "${coreutils}/bin/ls"
+      --replace-fail "/bin/ls" "${coreutils}/bin/ls"
   '';
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     angr
     cmd2
     pygments
diff --git a/pkgs/development/python-modules/angrop/default.nix b/pkgs/development/python-modules/angrop/default.nix
index 69b06e58784d4..1d26565b1b962 100644
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@@ -11,22 +11,22 @@
 buildPythonPackage rec {
   pname = "angrop";
   version = "9.2.8";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
-    repo = pname;
+    repo = "angrop";
     rev = "refs/tags/v${version}";
     hash = "sha256-zmWdGbFzwLDP7MUqEprZcIgA7lAdCrafWYohAehJyh0=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     angr
     progressbar
     tqdm
diff --git a/pkgs/development/python-modules/approvaltests/default.nix b/pkgs/development/python-modules/approvaltests/default.nix
index 16b7c1d29dcbc..b396c69a61e5a 100644
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@@ -5,6 +5,7 @@
 , buildPythonPackage
 , empty-files
 , fetchFromGitHub
+, fetchpatch2
 , mock
 , mrjob
 , numpy
@@ -20,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "approvaltests";
-  version = "11.1.2";
+  version = "11.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,14 +30,21 @@ buildPythonPackage rec {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VM4TP98bS9NmhxZz+YHMJrHKr5g6E6aYidxjKQyXp7k=";
+    hash = "sha256-VqE2Oj3b+ZfKT+fhJ9DxBClfa8Wz8w/puAnAotN3eG4=";
   };
 
-  nativeBuildInputs = [
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/approvals/ApprovalTests.Python/commit/dac7c8a8aa62f31dca7a687d4dbf08158351d5e1.patch";
+      hash = "sha256-TMyfXNtzpGci6tdFRhxiKJRjCWRD5LkaffPY8EVj53E=";
+    })
+  ];
+
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     allpairspy
     approval-utilities
     beautifulsoup4
@@ -56,7 +64,7 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # Tests expects paths below ApprovalTests.Python directory
+    # Tests expect paths below ApprovalTests.Python directory
     "test_received_filename"
     "test_pytest_namer"
   ];
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 35fc62a91b76b..3bee9cd94282e 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -9,23 +9,23 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.84";
+  version = "9.2.96";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "angr";
-    repo = pname;
+    repo = "archinfo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-drZuQRQ2XukCimH/SG6CRCL4avyMEcKxuj+Rinp7lJQ=";
+    hash = "sha256-g/fxj/6dMVLoW4hFtVDEjHjdJiB3KE2XB3c0ihclqeM=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.11") [
+  dependencies = lib.optionals (pythonOlder "3.11") [
     backports-strenum
   ];
 
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index f4886e311f850..bd05a3d076f56 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -65,7 +65,7 @@
 }:
 let
   pname = "argilla";
-  version = "1.26.0";
+  version = "1.26.1";
   optional-dependencies = {
     server = [
       fastapi
@@ -126,7 +126,7 @@ buildPythonPackage {
     owner = "argilla-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+8oN3afbpBQU2tRb2Oq12IlmoCg4O1LUHtt4hl2FOEI=";
+    hash = "sha256-7d8zvP06GrHrSEJn2NNv2BUNea1wamf21e+qa1dZU18=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/asciimatics/default.nix b/pkgs/development/python-modules/asciimatics/default.nix
index 68607924c1de2..0a9736bebe508 100644
--- a/pkgs/development/python-modules/asciimatics/default.nix
+++ b/pkgs/development/python-modules/asciimatics/default.nix
@@ -1,45 +1,40 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, setuptools-scm
-, pyfiglet
 , pillow
+, pyfiglet
+, pytestCheckHook
+, pythonOlder
+, setuptools-scm
 , wcwidth
-, future
-, mock
-, nose
 }:
 
 buildPythonPackage rec {
   pname = "asciimatics";
   version = "1.15.0";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-z905gEJydRnYtz5iuO+CwL7P7U60IImcO5bJjQuWgho=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     pyfiglet
     pillow
     wcwidth
-    future
   ];
 
   nativeCheckInputs = [
-    mock
-    nose
+    pytestCheckHook
   ];
 
-  # tests require a pty emulator
-  # which is too complicated to setup here
-  doCheck = false;
-
   pythonImportsCheck =  [
     "asciimatics.effects"
     "asciimatics.renderers"
@@ -48,8 +43,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Helps to create full-screen text UIs (from interactive forms to ASCII animations) on any platform";
+    description = "Module to create full-screen text UIs (from interactive forms to ASCII animations)";
     homepage = "https://github.com/peterbrittain/asciimatics";
+    changelog = "https://github.com/peterbrittain/asciimatics/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ cmcdragonkai ];
   };
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index a6a805fd33ad2..a878a17b0f2a4 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "b2sdk";
-  version = "1.32.0";
+  version = "1.33.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "Backblaze";
     repo = "b2-sdk-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xBLMvH51zbrSuBOtMxLeQJt7Wv31OcxBbD72EuLHzuU=";
+    hash = "sha256-eMFgsjEb0DMTLqG+8IZru1dEAuKZW4dEszrznZxR+mc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bc-python-hcl2/default.nix b/pkgs/development/python-modules/bc-python-hcl2/default.nix
index 7f3832eeeb052..dc74d16127609 100644
--- a/pkgs/development/python-modules/bc-python-hcl2/default.nix
+++ b/pkgs/development/python-modules/bc-python-hcl2/default.nix
@@ -2,14 +2,15 @@
 , buildPythonPackage
 , fetchPypi
 , lark
-, nose
+, pynose
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "bc-python-hcl2";
   version = "0.4.2";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -20,10 +21,11 @@ buildPythonPackage rec {
 
   # Nose is required during build process, so can not use `nativeCheckInputs`.
   buildInputs = [
-    nose
+    pynose
+    setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     lark
   ];
 
@@ -36,7 +38,6 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Parser for HCL2 written in Python using Lark";
-    mainProgram = "hcl2tojson";
     longDescription = ''
       This parser only supports HCL2 and isn't backwards compatible with HCL v1.
       It can be used to parse any HCL2 config file such as Terraform.
@@ -46,5 +47,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/amplify-education/python-hcl2";
     license = licenses.mit;
     maintainers = with maintainers; [ anhdle14 ];
+    mainProgram = "hcl2tojson";
   };
 }
diff --git a/pkgs/development/python-modules/blockdiag/default.nix b/pkgs/development/python-modules/blockdiag/default.nix
index 4444e34759465..47b598b306cb8 100644
--- a/pkgs/development/python-modules/blockdiag/default.nix
+++ b/pkgs/development/python-modules/blockdiag/default.nix
@@ -1,31 +1,30 @@
 { lib
 , buildPythonPackage
 , docutils
+, ephem
 , fetchFromGitHub
 , fetchpatch
 , funcparserlib
-, nose
 , pillow
-, ephem
-, pythonOlder
+, pynose
 , pytestCheckHook
+, pythonOlder
 , reportlab
 , setuptools
 , webcolors
-, python
 }:
 
 buildPythonPackage rec {
   pname = "blockdiag";
   version = "3.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "blockdiag";
     repo = "blockdiag";
-    rev = version;
+    rev = "refs/tags/${version}";
     hash = "sha256-j8FoNUIJJOaahaol1MRPyY2jcPCEIlaAD4bmM2QKFFI=";
   };
 
@@ -38,18 +37,21 @@ buildPythonPackage rec {
     })
   ];
 
-  propagatedBuildInputs = [
+  build-system = [
     setuptools
+  ];
+
+  dependencies = [
+    docutils
     funcparserlib
     pillow
-    webcolors
     reportlab
-    docutils
+    webcolors
   ];
 
   nativeCheckInputs = [
     ephem
-    nose
+    pynose
     pytestCheckHook
   ];
 
@@ -68,10 +70,11 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Generate block-diagram image from spec-text file (similar to Graphviz)";
-    mainProgram = "blockdiag";
     homepage = "http://blockdiag.com/";
+    changelog = "https://github.com/blockdiag/blockdiag/blob/${version}/CHANGES.rst";
     license = licenses.asl20;
-    platforms = platforms.unix;
     maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "blockdiag";
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index a5e202469480f..a796c7d5017ef 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -365,14 +365,14 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.72";
+  version = "1.34.73";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eQPciiA763TWI3smauBk/1qbJ2B0r3UAt9tIVEZJWWo=";
+    hash = "sha256-ok9aPF2xGPxYxkh/GozIpKggYmB5Fr+pcxKXygspBpc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index b5c0dcd061508..b9526b9faa7ce 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -1,19 +1,19 @@
 { lib
 , buildPythonPackage
-, setuptools
 , cachetools
 , decorator
 , fetchFromGitHub
-, future
 , pysmt
-, pythonOlder
 , pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, setuptools
 , z3-solver
 }:
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.84";
+  version = "9.2.96";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,20 +22,25 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wgCWMngda0gB+AEDFpRxQ2ots5YXE4bkBSxMtYJqLEo=";
+    hash = "sha256-rXJzJCyhsScFW1L/mVARciGDlOOBCFT69VBivjV6oig=";
   };
 
-  nativeBuildInputs = [
+  # z3 does not provide a dist-info, so python-runtime-deps-check will fail
+  pythonRemoveDeps = [
+    "z3-solver"
+  ];
+
+  build-system = [
+    pythonRelaxDepsHook
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cachetools
     decorator
-    future
     pysmt
     z3-solver
-  ];
+  ] ++ z3-solver.requiredPythonModules;
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 20ac0c60435d0..c1e0c3b5ad17e 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -1,11 +1,12 @@
 { lib
+, archinfo
 , buildPythonPackage
 , cffi
 , fetchFromGitHub
 , minidump
-, nose
 , pefile
 , pyelftools
+, pynose
 , pytestCheckHook
 , pythonOlder
 , pyvex
@@ -16,14 +17,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.84";
+  version = "9.2.96";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sU9Rv2kTLYMpaalrkcOv6HlHt1u4oG482M+d7OSjJ3Y=";
+    hash = "sha256-eC9qQCrms4pSXYTrKJlfdejhl/kzUmmyfYhjlEPpgzA=";
   };
 
 in
@@ -38,14 +39,15 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-N0z5wgaeWkoPuhIUj7bj1kDKgZ7pWChm1uEU4MjXjqI=";
+    hash = "sha256-osClaoAzjf3mOng38disxxSFncbc/V7Uuc1HCTdX4SQ=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
+    archinfo
     cffi
     minidump
     pefile
@@ -56,7 +58,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    nose
+    pynose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/django-webpush/default.nix b/pkgs/development/python-modules/django-webpush/default.nix
index 44d670dfeedee..5f04dccb1ca64 100644
--- a/pkgs/development/python-modules/django-webpush/default.nix
+++ b/pkgs/development/python-modules/django-webpush/default.nix
@@ -22,17 +22,21 @@ buildPythonPackage rec {
     hash = "sha256-Mwp53apdPpBcn7VfDbyDlvLAVAG65UUBhT0w9OKjKbU=";
   };
 
-  nativeBuildInputs = [
+  pythonRelaxDeps = [
+    "pywebpush"
+  ];
+
+  build-system = [
     pythonRelaxDepsHook
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     django
     pywebpush
   ];
 
-  # nothing to test
+  # Module has no tests
   doCheck = false;
 
   pythonImportsCheck = [
@@ -40,7 +44,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "A Package made for integrating and sending Web Push Notification in Django Application";
+    description = "Module for integrating and sending Web Push Notification in Django Application";
     homepage = "https://github.com/safwanrahman/django-webpush/";
     changelog = "https://github.com/safwanrahman/django-webpush/releases/tag/${src.rev}";
     license = licenses.gpl3Plus;
diff --git a/pkgs/development/python-modules/findpython/default.nix b/pkgs/development/python-modules/findpython/default.nix
index 78875b6db2c8f..aa0905fed01fe 100644
--- a/pkgs/development/python-modules/findpython/default.nix
+++ b/pkgs/development/python-modules/findpython/default.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "findpython";
-  version = "0.5.1";
+  version = "0.6.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -25,7 +25,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UGSjA5PFLvyMajV5DDdbiwAF1vdPFykDW0tCZHNH4T0=";
+    hash = "sha256-A2p4QbiOLzckM6WJsfCSGVGXN9KYnrX1Nw1wr7z4R2U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
index a284b961291d0..7705598e80971 100644
--- a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
+++ b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
@@ -15,21 +15,21 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-error-reporting";
-  version = "1.10.0";
+  version = "1.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OyfMbjxwtrYLrXrjCVS+DFjGdGGsMsfHBrGzg66crkU=";
+    hash = "sha256-+oeVT/ag00BEObbqzkC/EazEwnrWvRURnz3gnCBbn4k=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     google-api-core
     google-cloud-logging
     proto-plus
diff --git a/pkgs/development/python-modules/google-nest-sdm/default.nix b/pkgs/development/python-modules/google-nest-sdm/default.nix
index 44cd15ba33cd0..2fb82e23543f4 100644
--- a/pkgs/development/python-modules/google-nest-sdm/default.nix
+++ b/pkgs/development/python-modules/google-nest-sdm/default.nix
@@ -12,12 +12,13 @@
 , pytestCheckHook
 , pythonOlder
 , requests-oauthlib
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-nest-sdm";
-  version = "3.0.3";
-  format = "setuptools";
+  version = "3.0.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.10";
 
@@ -25,10 +26,14 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "python-google-nest-sdm";
     rev = "refs/tags/${version}";
-    hash = "sha256-VO/TY/QBzVFxqIumVJjw+Ic0hrqkRBS+7wQKBhcN9Jw=";
+    hash = "sha256-zYHrS9y15dcyDhOoky7sB2BYkpTL3PoyNbNewKKl19E=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     aiohttp
     google-auth
     google-auth-oauthlib
@@ -57,10 +62,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Module for Google Nest Device Access using the Smart Device Management API";
-    mainProgram = "google_nest";
     homepage = "https://github.com/allenporter/python-google-nest-sdm";
     changelog = "https://github.com/allenporter/python-google-nest-sdm/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "google_nest";
   };
 }
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index 1593e7c9d84b7..7717982dd4e07 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.22.0";
+  version = "0.22.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jq7oCQlLXwr859mhHYolKp/N63Z0SIksMTwNL0JjfNQ=";
+    hash = "sha256-Y/oUF+d6Oo45x9cufZxjaJCQpoY0acPhetbyAt8M3pQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index 79fbbb1ed8933..3c2cee34008ce 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.36";
+  version = "0.1.38";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YHYzC4c7VOPBiBgtJcN/hPccZMJBL5E8VsIAwErhWjg=";
+    hash = "sha256-hK9zPEmO0LaRnbLTbc9ABE9a7UAZU9yZZUswu955CJU=";
   };
 
   sourceRoot = "${src.name}/python";
diff --git a/pkgs/development/python-modules/librosa/default.nix b/pkgs/development/python-modules/librosa/default.nix
index 48eae549523fc..62d712aa7b1f3 100644
--- a/pkgs/development/python-modules/librosa/default.nix
+++ b/pkgs/development/python-modules/librosa/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
@@ -108,6 +109,9 @@ buildPythonPackage rec {
     "test_load_resample"
     # does not converge
     "test_nnls_vector"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # https://github.com/librosa/librosa/pull/1808
+    "test_pyin_multi_center"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/llama-index-readers-s3/default.nix b/pkgs/development/python-modules/llama-index-readers-s3/default.nix
index 0cc7c10661e2e..947a81bb76c47 100644
--- a/pkgs/development/python-modules/llama-index-readers-s3/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-s3/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-s3";
-  version = "0.1.4";
+  version = "0.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_readers_s3";
     inherit version;
-    hash = "sha256-FjRIo0sJGJikX4T4Esew3pBxEp7E3kK7Ds2uXDJqMzQ=";
+    hash = "sha256-x3XaPKxnvYYzrJYDmXIKC9YOAOr1HOU1XnaaHIuQnhk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mizani/default.nix b/pkgs/development/python-modules/mizani/default.nix
index f54c018212405..1ab85c88c3126 100644
--- a/pkgs/development/python-modules/mizani/default.nix
+++ b/pkgs/development/python-modules/mizani/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "mizani";
-  version = "0.11.0";
+  version = "0.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "has2k1";
     repo = "mizani";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4xk8FCUiNOp5n512asYKcjAS7fsyExyMQiWg14XWwHY=";
+    hash = "sha256-rlzMvIQej8d7LCklNNZeIgtrGaB5A6lDd/1iQG+j+X8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 8a8d53bc1c496..c0909c69a4f4c 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -163,7 +163,7 @@ rec {
 
   mypy-boto3-codebuild = buildMypyBoto3Package "codebuild" "1.34.70" "sha256-lv69lhMKJHRnooVrmGinfDEi7eVEe7O12GNNo5uZQQc=";
 
-  mypy-boto3-codecatalyst = buildMypyBoto3Package "codecatalyst" "1.34.0" "sha256-TsXVy8bx6kaj84PJiNNU+075Tx3WW0mrtZFOyLx9yT4=";
+  mypy-boto3-codecatalyst = buildMypyBoto3Package "codecatalyst" "1.34.73" "sha256-jQ/DIoWXQWo1oVWi4Gn88cxr78QCs45EVtgfc6fZkFk=";
 
   mypy-boto3-codecommit = buildMypyBoto3Package "codecommit" "1.34.6" "sha256-wCw6e7yvMjM+A6jXfB2D4Z+i9s3e/F9Ih/VxD6iiwws=";
 
@@ -193,7 +193,7 @@ rec {
 
   mypy-boto3-comprehendmedical = buildMypyBoto3Package "comprehendmedical" "1.34.0" "sha256-4KzL56xU474te8tW5xVZo6D5Pwe3GLRQbQfX8CXTz9g=";
 
-  mypy-boto3-compute-optimizer = buildMypyBoto3Package "compute-optimizer" "1.34.0" "sha256-k/4Ixaf9n4J8Y5ELjuMZ2dn7DgKftmwQZfdHhYDMc6w=";
+  mypy-boto3-compute-optimizer = buildMypyBoto3Package "compute-optimizer" "1.34.73" "sha256-WOPbzONtQ+hnVYwWCWC2Q/E1mqWNww0K2tbJhZxjAHo=";
 
   mypy-boto3-config = buildMypyBoto3Package "config" "1.34.45" "sha256-LN1CcIOj9cgzSNCvnUVwLRNPXlitHAlt+5jj6wu6i8E=";
 
@@ -251,7 +251,7 @@ rec {
 
   mypy-boto3-ebs = buildMypyBoto3Package "ebs" "1.34.0" "sha256-xIrrXOayZed+Jcn4CFXXNgKz/G+RdiuwA04wq+Ry/fs=";
 
-  mypy-boto3-ec2 = buildMypyBoto3Package "ec2" "1.34.71" "sha256-hjEJNB8/m1yE9f0yxoKZeVySRfCun1NGmL8UeqP8AXs=";
+  mypy-boto3-ec2 = buildMypyBoto3Package "ec2" "1.34.73" "sha256-/vEtJCIUBHeOX0ttyOID2/Ds2VCm6/eGEqRXE/ynrr4=";
 
   mypy-boto3-ec2-instance-connect = buildMypyBoto3Package "ec2-instance-connect" "1.34.63" "sha256-kExmGXEJ5jrvOewmWx7AjVb3boD5GU0cEUp/2PQhzlw=";
 
@@ -263,7 +263,7 @@ rec {
 
   mypy-boto3-efs = buildMypyBoto3Package "efs" "1.34.0" "sha256-VAK7mfnPBPDC8Azm6Bxl86E8CkeArTmfgqYkIcSblYA=";
 
-  mypy-boto3-eks = buildMypyBoto3Package "eks" "1.34.53" "sha256-bmd/gv3krZZSeQDCYca/AFHkSBL4PTvx3ZEjItQ43QQ=";
+  mypy-boto3-eks = buildMypyBoto3Package "eks" "1.34.73" "sha256-sSVfQvBmH9wYnqInvF8ixsyb0pbvHPx0zQwfPxa5caE=";
 
   mypy-boto3-elastic-inference = buildMypyBoto3Package "elastic-inference" "1.34.0" "sha256-gbWKw0zDQf3qBlp1KeO7MX1j/GqRUpFAxLG0BKFrHBk=";
 
@@ -327,7 +327,7 @@ rec {
 
   mypy-boto3-groundstation = buildMypyBoto3Package "groundstation" "1.34.0" "sha256-CR3w42iyXmyGMzjCM7M1LKqsIROMjXxxGM8coSTtJ3o=";
 
-  mypy-boto3-guardduty = buildMypyBoto3Package "guardduty" "1.34.59" "sha256-Q5itLyYcSK7tzlYjT4Dgdcm4bE2Dr+bl5kfHqV4D9Pg=";
+  mypy-boto3-guardduty = buildMypyBoto3Package "guardduty" "1.34.73" "sha256-DasHgBMa4/hnh/otzh0Zz4nalmESIS2/HkaY4vTltRs=";
 
   mypy-boto3-health = buildMypyBoto3Package "health" "1.34.0" "sha256-st3ygy9yZbAbh1ZWnT8XDZTBz1qWhRWXCEfr5ILQHpo=";
 
@@ -519,7 +519,7 @@ rec {
 
   mypy-boto3-nimble = buildMypyBoto3Package "nimble" "1.34.0" "sha256-i0E9kLunDRl+XzU3Ti3vxqHNa2oGHQQ9xDjCtNKi1Lw=";
 
-  mypy-boto3-oam = buildMypyBoto3Package "oam" "1.34.0" "sha256-/0ou6QtLQerkqJ+alocpYxUfe9jRHoOgQy9R6sxZAFo=";
+  mypy-boto3-oam = buildMypyBoto3Package "oam" "1.34.73" "sha256-MAnS/E6BKcaubeOdblitGzS7y7YUZr35M4679iJL6lE=";
 
   mypy-boto3-omics = buildMypyBoto3Package "omics" "1.34.7" "sha256-Mtb11Oe2j28u+MFaycvMMNiqi7ZdVDcKQV/X/7npze4=";
 
@@ -575,7 +575,7 @@ rec {
 
   mypy-boto3-qldb-session = buildMypyBoto3Package "qldb-session" "1.34.0" "sha256-JHePiaFCfIJPxZzvC1U38xrBGkDvB9+yKwPecaZl7BY=";
 
-  mypy-boto3-quicksight = buildMypyBoto3Package "quicksight" "1.34.53" "sha256-aN1W1Hu/gyV181x68VNkbBp2Ua4jpJB3H/vmQ0HO1Nw=";
+  mypy-boto3-quicksight = buildMypyBoto3Package "quicksight" "1.34.73" "sha256-tbO9V8EiPR1OyCYImQHYmMsZtvclNK7Mnoqt3s0YRFM=";
 
   mypy-boto3-ram = buildMypyBoto3Package "ram" "1.34.0" "sha256-9sOspEfirpVQ8cT9ILUSWypxBswpAD75A0hHRV7glNg=";
 
diff --git a/pkgs/development/python-modules/nampa/default.nix b/pkgs/development/python-modules/nampa/default.nix
index d5d411728315e..abeedb716ad56 100644
--- a/pkgs/development/python-modules/nampa/default.nix
+++ b/pkgs/development/python-modules/nampa/default.nix
@@ -2,41 +2,49 @@
 , buildPythonPackage
 , fetchFromGitHub
 , future
-, pytestCheckHook
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "nampa";
   version = "1.0";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "thebabush";
-    repo = pname;
-    rev = version;
-    sha256 = "14b6xjm497wrfw4kv24zhsvz2l6zknvx36w8i754hfwz3s3fsl6a";
+    repo = "nampa";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ylDthh6fO0jKiYib0bed31Dxt4afiD0Jd5mfRKrsZpE=";
   };
 
-  propagatedBuildInputs = [
-    future
-  ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
   postPatch = ''
     # https://github.com/thebabush/nampa/pull/13
     substituteInPlace setup.py \
       --replace "0.1.1" "${version}"
   '';
 
-  pythonImportsCheck = [ "nampa" ];
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    future
+  ];
+
+  # Not used for binaryninja as plugin
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "nampa"
+  ];
 
   meta = with lib; {
     description = "Python implementation of the FLIRT technology";
-    mainProgram = "dumpsig.py";
     homepage = "https://github.com/thebabush/nampa";
+    changelog = "https://github.com/thebabush/nampa/releases/tag/${version}";
     license = licenses.lgpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/nwdiag/default.nix b/pkgs/development/python-modules/nwdiag/default.nix
index a35d6159731a0..54bd6a1f9fea4 100644
--- a/pkgs/development/python-modules/nwdiag/default.nix
+++ b/pkgs/development/python-modules/nwdiag/default.nix
@@ -2,7 +2,7 @@
 , blockdiag
 , fetchFromGitHub
 , buildPythonPackage
-, nose
+, pynose
 , pytestCheckHook
 , setuptools
 , pythonOlder
@@ -11,24 +11,27 @@
 buildPythonPackage rec {
   pname = "nwdiag";
   version = "3.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "blockdiag";
-    repo = pname;
-    rev = version;
+    repo = "nwdiag";
+    rev = "refs/tags/${version}";
     hash = "sha256-uKrdkXpL5YBr953sRsHknYg+2/WwrZmyDf8BMA2+0tU=";
   };
 
-  propagatedBuildInputs = [
-    blockdiag
+  build-system = [
     setuptools
   ];
 
+  dependencies = [
+    blockdiag
+  ];
+
   nativeCheckInputs = [
-    nose
+    pynose
     pytestCheckHook
   ];
 
@@ -37,8 +40,9 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # UnicodeEncodeError: 'latin-1' codec can't encode...
-    "test_setup_inline_svg_is_true_with_multibytes"
+    # AttributeError: 'TestRstDirectives' object has no attribute 'assertRegexpMatches'
+    "svg"
+    "noviewbox"
   ];
 
   pythonImportsCheck = [
@@ -48,8 +52,10 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Generate network-diagram image from spec-text file (similar to Graphviz)";
     homepage = "http://blockdiag.com/";
+    changelog = "https://github.com/blockdiag/nwdiag/blob/${version}/CHANGES.rst";
     license = licenses.asl20;
-    platforms = platforms.unix;
     maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "rackdiag";
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/pex/default.nix b/pkgs/development/python-modules/pex/default.nix
index 6260a921ffa83..7b962064a8321 100644
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@@ -7,17 +7,17 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.2.2";
+  version = "2.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-g5D9v1CZ70viP0C/9lWwJvterJ2KH3oUCKRsxEr9Neg=";
+    hash = "sha256-fQ/IYjYZL7wUpxslCB6cSMVD19vB57Jw1i7/iK/SJFw=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     hatchling
   ];
 
diff --git a/pkgs/development/python-modules/pubnub/default.nix b/pkgs/development/python-modules/pubnub/default.nix
index 174139f5aaf48..b6437f880ddb1 100644
--- a/pkgs/development/python-modules/pubnub/default.nix
+++ b/pkgs/development/python-modules/pubnub/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pubnub";
-  version = "7.4.2";
+  version = "7.4.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,14 +24,14 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fmRFxSVzKN2ynuXJlpZcuIt4XIe7XHU4HSzSN1kCi2g=";
+    hash = "sha256-t3lNotfT3C2hv5AGPWZpL3wN68m8HRcjsccUz8QcY5I=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     cbor2
     pycryptodomex
diff --git a/pkgs/development/python-modules/pyformlang/default.nix b/pkgs/development/python-modules/pyformlang/default.nix
index ce3923e0f8a68..f5cc07c29e749 100644
--- a/pkgs/development/python-modules/pyformlang/default.nix
+++ b/pkgs/development/python-modules/pyformlang/default.nix
@@ -1,12 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, setuptools
-, wheel
 , networkx
 , numpy
 , pydot
 , pytestCheckHook
+, pythonOlder
+, setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -14,17 +15,19 @@ buildPythonPackage rec {
   version = "1.0.9";
   pyproject = true;
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-oCwYM4yQ1KYZpC7vVpeHSIDH2Q930JAuTDq9mds9zoc=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     wheel
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     networkx
     numpy
     pydot
@@ -39,7 +42,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "A python framework for formal grammars";
+    description = "Framework for formal grammars";
     homepage = "https://github.com/Aunsiels/pyformlang";
     license = licenses.mit;
     maintainers = with maintainers; [ natsukium ];
diff --git a/pkgs/development/python-modules/pylacus/default.nix b/pkgs/development/python-modules/pylacus/default.nix
index 1f2790ad20311..09941db80a0ed 100644
--- a/pkgs/development/python-modules/pylacus/default.nix
+++ b/pkgs/development/python-modules/pylacus/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pylacus";
-  version = "1.8.2";
+  version = "1.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "ail-project";
     repo = "PyLacus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wXdQe/4Xw/D0MRFqNfSKimJ99aCE7M7k1neT/+t7ixY=";
+    hash = "sha256-ytO9wtCkiC6CLWLkmSV/R+Rnx/W4Jv2dsgykZ2GB13U=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pynvim-pp/default.nix b/pkgs/development/python-modules/pynvim-pp/default.nix
index 0f69b51e65dea..a1dee20139b4e 100644
--- a/pkgs/development/python-modules/pynvim-pp/default.nix
+++ b/pkgs/development/python-modules/pynvim-pp/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage {
   pname = "pynvim-pp";
-  version = "unstable-2023-08-03";
+  version = "unstable-2024-03-11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ms-jpq";
     repo = "pynvim_pp";
-    rev = "40d0f6053ddbba61f53505eebb0290cfb661661b";
-    hash = "sha256-4jeYE9HL+PQZuJq5nyf9CgL4UrRWm3ifLL/vfygLOwc=";
+    rev = "34e3a027c595981886d7efd1c91071f3eaa4715d";
+    hash = "sha256-2+jDRJXlg9q4MN9vOhmeq4cWVJ0wp5r5xAh3G8lqgOg=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyring-buffer/default.nix b/pkgs/development/python-modules/pyring-buffer/default.nix
new file mode 100644
index 0000000000000..6a5c709f617ea
--- /dev/null
+++ b/pkgs/development/python-modules/pyring-buffer/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# build-system
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "pyring-buffer";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rhasspy";
+    repo = "pyring-buffer";
+    rev = "382290312fa2ad5d75bd42c040a43e25dad9c8a7";
+    hash = "sha256-bHhcBU4tjFAyZ3/GjaP/hDXz2N73mCChTNYHsZyBCSM=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pyring_buffer"
+  ];
+
+  meta = with lib; {
+    description = "A pure Python ring buffer for bytes";
+    homepage = "https://github.com/rhasspy/pyring-buffer";
+    changelog = "https://github.com/rhasspy/pyring-buffer/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysilero-vad/default.nix b/pkgs/development/python-modules/pysilero-vad/default.nix
new file mode 100644
index 0000000000000..332d7260e519f
--- /dev/null
+++ b/pkgs/development/python-modules/pysilero-vad/default.nix
@@ -0,0 +1,61 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, stdenv
+, pythonRelaxDepsHook
+
+# build-system
+, setuptools
+
+# dependencies
+, numpy
+, onnxruntime
+
+# tests
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pysilero-vad";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rhasspy";
+    repo = "pysilero-vad";
+    rev = "fc1e3f74e6282249c1fd67ab0f65832ad1ce9cc5";
+    hash = "sha256-5jS2xZEtvzXO/ffZzseTTUHfE528W9FvKB0AKG6T62k=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "numpy"
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    onnxruntime
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pysilero_vad"
+  ];
+
+  meta = with lib; {
+    # what():  /build/source/include/onnxruntime/core/common/logging/logging.h:294 static const onnxruntime::logging::Logger& onnxruntime::logging::LoggingManager::DefaultLogger() Attempt to use DefaultLogger but none has been registered.
+    broken = stdenv.isAarch64 && stdenv.isLinux;
+    description = "Pre-packaged voice activity detector using silero-vad";
+    homepage = "https://github.com/rhasspy/pysilero-vad";
+    changelog = "https://github.com/rhasspy/pysilero-vad/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-whois/default.nix b/pkgs/development/python-modules/python-whois/default.nix
index 6cdfb81628a3a..a9bb5cdd8e383 100644
--- a/pkgs/development/python-modules/python-whois/default.nix
+++ b/pkgs/development/python-modules/python-whois/default.nix
@@ -1,37 +1,53 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, future
-, nose
+, pynose
 , pytestCheckHook
+, python-dateutil
+, pythonOlder
+, setuptools
 , simplejson
 }:
 
 buildPythonPackage rec {
   pname = "python-whois";
-  version = "0.8.0";
-  format = "setuptools";
+  version = "0.9.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3TNtNRfqzip2iUBtt7uWraPF50MnQjFRru4+ZCJfYiA=";
+    hash = "sha256-jdoscMD4nw+PxIpCNweJMyv/9nm1+kYgSIhBUdJso84=";
   };
 
-  propagatedBuildInputs = [ future ];
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    python-dateutil
+  ];
 
   nativeCheckInputs = [
-    nose
+    pynose
     pytestCheckHook
     simplejson
   ];
 
-  # Exclude tests that require network access
   disabledTests = [
+    # Exclude tests that require network access
     "test_dk_parse"
     "test_ipv4"
     "test_ipv6"
+    "test_choose_server"
+    "test_simple_ascii_domain"
+    "test_simple_unicode_domain"
+  ];
+
+  pythonImportsCheck = [
+    "whois"
   ];
-  pythonImportsCheck = [ "whois" ];
 
   meta = with lib; {
     description = "Python module to produce parsed WHOIS data";
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 3259d3133d87d..9a3f6d00dc6ee 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -1,11 +1,9 @@
 { lib
 , stdenv
-, archinfo
 , bitstring
 , buildPythonPackage
 , cffi
 , fetchPypi
-, future
 , pycparser
 , pythonOlder
 , setuptools
@@ -13,31 +11,29 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.93";
+  version = "9.2.96";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-44F1EE8TRsmYRnMNQakxIaFdAuZKpHIDsq+M1cK/pQk=";
+    hash = "sha256-60aOAm7eUlYHTCqIILz4l0oF1jvttDZUs4jSrF5+IJI=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
-    archinfo
+  dependencies = [
     bitstring
     cffi
-    future
     pycparser
   ];
 
   postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace vex/Makefile-gcc \
-      --replace '/usr/bin/ar' 'ar'
+      --replace-fail '/usr/bin/ar' 'ar'
   '';
 
   setupPyBuildFlags = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/python-modules/pywebpush/default.nix b/pkgs/development/python-modules/pywebpush/default.nix
index 903ad646b8b53..ebb3313b20c52 100644
--- a/pkgs/development/python-modules/pywebpush/default.nix
+++ b/pkgs/development/python-modules/pywebpush/default.nix
@@ -1,28 +1,36 @@
 { lib
-, fetchPypi
+, aiohttp
 , buildPythonPackage
 , cryptography
+, fetchPypi
 , http-ece
+, mock
 , py-vapid
+, pytestCheckHook
+, pythonOlder
 , requests
+, setuptools
 , six
-, coverage
-, flake8
-, mock
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pywebpush";
-  version = "1.14.1";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+I1+K/XofGFt+wS4yVwRkjjFEWWbAvc17nfMFoQoVe4=";
+    hash = "sha256-A8zD6XW2A3S3Y0xJVZVha+Ujvyx9oNl26E/amsjGMwE=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    aiohttp
     cryptography
     http-ece
     py-vapid
@@ -31,19 +39,20 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    coverage
-    flake8
     mock
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pywebpush" ];
+  pythonImportsCheck = [
+    "pywebpush"
+  ];
 
   meta = with lib; {
     description = "Webpush Data encryption library for Python";
-    mainProgram = "pywebpush";
     homepage = "https://github.com/web-push-libs/pywebpush";
+    changelog = "https://github.com/web-push-libs/pywebpush/releases/tag/${version}";
     license = licenses.mpl20;
     maintainers = with maintainers; [ peterhoeg ];
+    mainProgram = "pywebpush";
   };
 }
diff --git a/pkgs/development/python-modules/reptor/default.nix b/pkgs/development/python-modules/reptor/default.nix
index 013008581a531..1843505af86d4 100644
--- a/pkgs/development/python-modules/reptor/default.nix
+++ b/pkgs/development/python-modules/reptor/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "reptor";
-  version = "0.14";
+  version = "0.16";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "Syslifters";
     repo = "reptor";
     rev = "refs/tags/${version}";
-    hash = "sha256-XZiFVIUyLVVr3ZraOAuXs+shl4vk3S8OJHNHV4p10YY=";
+    hash = "sha256-xyk83XPITD1sAtuFcndTQg0otDMO89LK+B+9SD89kvo=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/requirements-parser/default.nix b/pkgs/development/python-modules/requirements-parser/default.nix
index b2b7697a464af..1f35ce49b25c5 100644
--- a/pkgs/development/python-modules/requirements-parser/default.nix
+++ b/pkgs/development/python-modules/requirements-parser/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "requirements-parser";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "madpah";
     repo = "requirements-parser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fUx6NBD6qxAyArGgCiB2J1Ak7pudx/LI0+rCHjLnc1M=";
+    hash = "sha256-P1uMpg9uoPp18KwdBHkvpMGV8eKhTEsDCKwz2JsTOug=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/robotframework-pythonlibcore/default.nix b/pkgs/development/python-modules/robotframework-pythonlibcore/default.nix
index 797bda0d3ea40..39feab338d240 100644
--- a/pkgs/development/python-modules/robotframework-pythonlibcore/default.nix
+++ b/pkgs/development/python-modules/robotframework-pythonlibcore/default.nix
@@ -2,16 +2,18 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, fetchpatch2
 , setuptools
+, robotframework
+, approvaltests
 , pytest-mockito
 , pytestCheckHook
-, robotframework
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "robotframework-pythonlibcore";
-  version = "4.3.0";
+  version = "4.4.0";
 
   disabled = pythonOlder "3.8";
 
@@ -21,24 +23,31 @@ buildPythonPackage rec {
     owner = "robotframework";
     repo = "PythonLibCore";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5ayOQyOhCg4nLpAyH/eQ6NYEApix0wsL2nhJzEXKJRo=";
+    hash = "sha256-282A4EW88z6ODSIEIIeBbN8YO491rwI4M7njI7kL3XQ=";
   };
 
-  nativeBuildInputs = [
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/robotframework/PythonLibCore/commit/8b756a4bd119d660109437023789bfada21bdc78.patch";
+      hash = "sha256-4NtgkGbIj9gH9Det6VNh1MpGSGroESxQ8X2ZTeoX/zU=";
+    })
+  ];
+
+  build-system = [
     setuptools
   ];
 
+  dependencies = [
+    robotframework
+  ];
+
   nativeCheckInputs = [
+    approvaltests
     pytest-mockito
     pytestCheckHook
-    robotframework
     typing-extensions
   ];
 
-  preCheck = ''
-    export PYTHONPATH="atest:utest/helpers:$PYTHONPATH"
-  '';
-
   pythonImportsCheck = [ "robotlibcore" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/scalene/default.nix b/pkgs/development/python-modules/scalene/default.nix
new file mode 100644
index 0000000000000..29a51e38b631b
--- /dev/null
+++ b/pkgs/development/python-modules/scalene/default.nix
@@ -0,0 +1,87 @@
+{ lib
+, buildPythonPackage
+, hypothesis
+, fetchpatch
+, fetchPypi
+, setuptools
+, setuptools-scm
+, cloudpickle
+, cython
+, jinja2
+, numpy
+, psutil
+, pynvml
+, pytestCheckHook
+, pythonOlder
+, rich
+}:
+
+buildPythonPackage rec {
+  pname = "scalene";
+  version = "1.5.38";
+  pyproject = true;
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-LR1evkn2m6FNBmJnUUJubesxIPeHG6RDgLFBHDuxe38=";
+  };
+
+  patches = [
+    # fix scalene_config import. remove on next update
+    (fetchpatch {
+      name = "scalene_config-import-fix.patch";
+      url = "https://github.com/plasma-umass/scalene/commit/cd437be11f600ac0925ce77efa516e6d83934200.patch";
+      hash = "sha256-YjFh+mu5jyIJYUQFhmGqLXhec6lgQAdj4tWxij3NkwU=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cython
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    cloudpickle
+    jinja2
+    psutil
+    pynvml
+    rich
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    hypothesis
+    numpy
+  ];
+
+  disabledTestPaths = [
+    # remove on next update
+    # Failing Darwin-specific tests that were subsequently removed from the source repo.
+    "tests/test_coverup_35.py"
+    "tests/test_coverup_42.py"
+    "tests/test_coverup_43.py"
+  ];
+
+  # remove scalene directory to prevent pytest import confusion
+  preCheck = ''
+    rm -rf scalene
+  '';
+
+  pythonImportsCheck = [ "scalene" ];
+
+  meta = with lib; {
+    description = "High-resolution, low-overhead CPU, GPU, and memory profiler for Python with AI-powered optimization suggestions";
+    homepage = "https://github.com/plasma-umass/scalene";
+    changelog = "https://github.com/plasma-umass/scalene/releases/tag/v${version}";
+    mainProgram = "scalene";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ sarahec ];
+  };
+}
diff --git a/pkgs/development/python-modules/seqdiag/default.nix b/pkgs/development/python-modules/seqdiag/default.nix
index bbf7cca1293a4..8b8a89bd49db3 100644
--- a/pkgs/development/python-modules/seqdiag/default.nix
+++ b/pkgs/development/python-modules/seqdiag/default.nix
@@ -2,7 +2,7 @@
 , blockdiag
 , buildPythonPackage
 , fetchFromGitHub
-, nose
+, pynose
 , pytestCheckHook
 , pythonOlder
 , setuptools
@@ -11,24 +11,27 @@
 buildPythonPackage rec {
   pname = "seqdiag";
   version = "3.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "blockdiag";
-    repo = pname;
-    rev = version;
+    repo = "seqdiag";
+    rev = "refs/tags/${version}";
     hash = "sha256-Dh9JMx50Nexi0q39rYr9MpkKmQRAfT7lzsNOXoTuphg=";
   };
 
-  propagatedBuildInputs = [
-    blockdiag
+  build-system = [
     setuptools
   ];
 
+  dependencies = [
+    blockdiag
+  ];
+
   nativeCheckInputs = [
-    nose
+    pynose
     pytestCheckHook
   ];
 
@@ -36,21 +39,17 @@ buildPythonPackage rec {
     "src/seqdiag/tests/"
   ];
 
-  disabledTests = [
-    # UnicodeEncodeError: 'latin-1' codec can't encode...
-    "test_setup_inline_svg_is_true_with_multibytes"
-  ];
-
   pythonImportsCheck = [
     "seqdiag"
   ];
 
   meta = with lib; {
     description = "Generate sequence-diagram image from spec-text file (similar to Graphviz)";
-    mainProgram = "seqdiag";
     homepage = "http://blockdiag.com/";
+    changelog = "https://github.com/blockdiag/seqdiag/blob/${version}/CHANGES.rst";
     license = licenses.asl20;
-    platforms = platforms.unix;
     maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "seqdiag";
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index e12d4e6b8abb5..c46aeb33788be 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1116";
+  version = "3.0.1119";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-TeS5ymvVbebzGdCbQL7HEtB4J4VgnzfEsB31zwjs6aE=";
+    hash = "sha256-F/aghPj/4xh06z+PTHSd/J7ImwouDd59/Cry2Zq13Jg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index 0377b13b244b9..7515a4b837131 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "tesla-fleet-api";
-  version = "0.5.1";
+  version = "0.5.3";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PbtOokzpJ58SpQOfpSyoDnUb8qcRvy0XPDR5cGMMbKU=";
+    hash = "sha256-rVxrMgp1V8wlDE+PGGiyZbpe4OuU2LT/LFYQ6m6k98o=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index 7959d38d2d3c5..95b5ced2a7d35 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "tesserocr";
-  version = "2.6.2";
+  version = "2.6.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-RVJfocGjVvnRVanekbN1nKRECEr9hTVE9aKaqFizA5A=";
+    sha256 = "sha256-RMHE73vcKGz6FEzhoJfoHDMp9KQ1CbyElKGrhSM4xuE=";
   };
 
   # https://github.com/sirfz/tesserocr/issues/314
diff --git a/pkgs/development/python-modules/unique-log-filter/default.nix b/pkgs/development/python-modules/unique-log-filter/default.nix
index 07b2a9a305e07..2b91ab437adfb 100644
--- a/pkgs/development/python-modules/unique-log-filter/default.nix
+++ b/pkgs/development/python-modules/unique-log-filter/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     hash = "sha256-av1pVPDsO2dto5fhBK74jKfVsVY2ChyUE5NNja2B1Qw=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     flit-core
   ];
 
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 555c7ddf4307e..266b28f6e4ca7 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.48";
+  version = "3.2.49";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-B0wvUd94J+Q+ZuWitYMKYgOTSNGC4njPrUAhs1QPCuQ=";
+    hash = "sha256-lO1NMK+tIj/riNt5JVjqgQDAfDlApENi0waj5pfjubc=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/backblaze-b2/default.nix b/pkgs/development/tools/backblaze-b2/default.nix
index 3ed49c05bec98..1fd6333a3d506 100644
--- a/pkgs/development/tools/backblaze-b2/default.nix
+++ b/pkgs/development/tools/backblaze-b2/default.nix
@@ -1,32 +1,30 @@
-{ lib, python3Packages, fetchPypi, installShellFiles, testers, backblaze-b2
+{ lib
+, python3Packages
+, fetchFromGitHub
+, installShellFiles
+, testers
+, backblaze-b2
 # executable is renamed to backblaze-b2 by default, to avoid collision with boost's 'b2'
 , execName ? "backblaze-b2"
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "backblaze-b2";
-  version = "3.15.0";
-  format = "setuptools";
+  version = "3.17.0";
+  format = "pyproject";
 
-  src = fetchPypi {
-    inherit version;
-    pname = "b2";
-    hash = "sha256-10c2zddALy7+CGxhjUC6tMLQcZ3WmLeRY1bNKWunAys=";
+  src = fetchFromGitHub {
+    owner = "Backblaze";
+    repo = "B2_Command_Line_Tool";
+    rev = "v${version}";
+    hash = "sha256-Xj7RNe6XM2atijhVasILWRdTzu6xuKBzMllM1z1mFLY=";
   };
 
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace 'phx-class-registry==4.0.5' 'phx-class-registry'
-    substituteInPlace requirements.txt \
-      --replace 'tabulate==0.8.10' 'tabulate'
-    substituteInPlace setup.py \
-      --replace 'setuptools_scm<6.0' 'setuptools_scm'
-  '';
-
   nativeBuildInputs = [
     installShellFiles
-    python3Packages.setuptools-scm
-  ];
+  ] ++ (with python3Packages; [
+    pdm-backend
+  ]);
 
   propagatedBuildInputs = with python3Packages; [
     argcomplete
@@ -46,31 +44,24 @@ python3Packages.buildPythonApplication rec {
     backoff
     more-itertools
     pexpect
-
-    # backblaze-b2 requires pytest 7 to complete tests.
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytestCheckHook
+    pytest-xdist
   ];
 
   preCheck = ''
     export HOME=$(mktemp -d)
   '';
 
-  disabledTests = [
-    # require network
-    "test_files_headers"
-    "test_integration"
-
-    # fixed by https://github.com/Backblaze/B2_Command_Line_Tool/pull/915
-    "TestRmConsoleTool"
-  ];
-
   disabledTestPaths = [
     # requires network
     "test/integration/test_b2_command_line.py"
+    "test/integration/test_tqdm_closer.py"
 
     # it's hard to make it work on nix
     "test/integration/test_autocomplete.py"
-    "test/unit/console_tool"
+    "test/unit/test_console_tool.py"
+    # this one causes successive tests to fail
+    "test/unit/_cli/test_autocomplete_cache.py"
   ];
 
   postInstall = lib.optionalString (execName != "b2") ''
@@ -88,7 +79,9 @@ python3Packages.buildPythonApplication rec {
   }).overrideAttrs (old: {
     # workaround the error: Permission denied: '/homeless-shelter'
     # backblaze-b2 fails to create a 'b2' directory under the XDG config path
-    HOME = "$(mktemp -d)";
+    preHook = ''
+      export HOME=$(mktemp -d)
+    '';
   });
 
   meta = with lib; {
diff --git a/pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix b/pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix
index bae57ea74d79e..709cd3e87fc70 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix
@@ -3,24 +3,27 @@
 , rustPlatform
 , stdenv
 , Security
+, nix-update-script
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "buildkite-test-collector-rust";
-  version = "0.1.0";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "test-collector-rust";
     rev = "v${version}";
-    sha256 = "sha256-rY/+AwxO0+xcnRj0A8TRhCUJQ0ecosybI6It1mDOdQM=";
+    sha256 = "sha256-PF2TFfzWmHXLgTopzJ04dfnzd3Sc/A6Hduffz2guxmU=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
   ];
 
-  cargoSha256 = "sha256-qfJ0ROi0S0mmPl6kKrW3dp3VLjYqK+sBVj+iKDNTjyM=";
+  cargoSha256 = "sha256-4eaU6dOb97/vV3NSCCpdzK2oQUIHl4kdAtgWbGsY5LU=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Rust adapter for Buildkite Test Analytics";
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index e7d5be602cdcd..922f3c081d5d2 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.13.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4Ur9LGYcC9C2EUWLLppcVSf+PLgfPITbKGp2qLRnxVY=";
+    hash = "sha256-jShFLwoxZdUEHA+gd87n3R+faOdC6TboXuPvcZp89+Y=";
   };
 
-  vendorHash = "sha256-le2AWHqTElo95GQJ8jEk3jjNrxu63YyWVtq+CI6+SbY=";
+  vendorHash = "sha256-kBk2KhPDVYBGIUQpXq4ANA7WX+JUOxz7/Ad+4h2CD1c=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/netcoredbg/default.nix b/pkgs/development/tools/misc/netcoredbg/default.nix
index 180692e9932ff..b16c4718914e3 100644
--- a/pkgs/development/tools/misc/netcoredbg/default.nix
+++ b/pkgs/development/tools/misc/netcoredbg/default.nix
@@ -86,6 +86,7 @@ stdenv.mkDerivation {
     homepage = "https://github.com/Samsung/netcoredbg";
     license = licenses.mit;
     platforms = platforms.unix;
+    mainProgram = "netcoredbg";
     maintainers = with maintainers; [ leo60228 konradmalik ];
   };
 }
diff --git a/pkgs/development/tools/misc/rsonpath/default.nix b/pkgs/development/tools/misc/rsonpath/default.nix
index 1d673ae35ded7..90c5d066aef81 100644
--- a/pkgs/development/tools/misc/rsonpath/default.nix
+++ b/pkgs/development/tools/misc/rsonpath/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rsonpath";
-  version = "0.8.7";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "v0ldek";
     repo = "rsonpath";
     rev = "v${version}";
-    hash = "sha256-AMnUErmufHc05MxHru/b4mFHH+HF9jfhoNi8yIejc64=";
+    hash = "sha256-g6dBPW3iIRslzQUwcmx9Ube/Q3llp6Sstdihq9ExANU=";
   };
 
-  cargoHash = "sha256-flMzNxA1NWGy4ea7/dmPiEKspBmVuy82VPe5r8jaEGg=";
+  cargoHash = "sha256-byeMX4wKFQbOH9f89cWkrpKAbhThLlR12Xok7vn/hOw=";
 
   cargoBuildFlags = [ "-p=rsonpath" ];
   cargoTestFlags = cargoBuildFlags;
diff --git a/pkgs/development/tools/open-policy-agent/default.nix b/pkgs/development/tools/open-policy-agent/default.nix
index 7346b9bea1d9d..c175d788b355f 100644
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@@ -11,13 +11,13 @@ assert enableWasmEval && stdenv.isDarwin -> builtins.throw "building with wasm o
 
 buildGoModule rec {
   pname = "open-policy-agent";
-  version = "0.62.1";
+  version = "0.63.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    hash = "sha256-iR3/6tqB6jwjy87D6xkKu/N61oenWzU3tEPTYTeEv7c=";
+    hash = "sha256-yXYyRl0ZDgS6eB2pB0Iqi3DiBGcIO3Vdet9RLSOczkU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index d8261beb17641..25043ac7ff0a3 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.8"; #zen
-    suffix = "zen1"; #zen
-    sha256 = "19rsi8747xw5lsq4pwizq2va6inmwrywgy8b5f2ppcd6ny0whn1i"; #zen
+    version = "6.8.2"; #zen
+    suffix = "zen2"; #zen
+    sha256 = "0v8y7d7mn0y5g8bbw2nm89a7jsvdwfjg6d3zqyga9mpr16xpsssa"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.7.9"; #lqx
+    version = "6.7.11"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "0hhkn2098h69l8slz5f0krkckf3qm7hmh5z233j341jpc0qv8p6b"; #lqx
+    sha256 = "180a39qrpldq4y2gn12pynhk62w46bzqi7zgciawznxyp8rr673x"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index 35db446c70a25..c5e2d181c1cba 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oven-media-engine";
-  version = "0.15.14";
+  version = "0.16.5";
 
   src = fetchFromGitHub {
     owner = "AirenSoft";
     repo = "OvenMediaEngine";
     rev = "v${version}";
-    sha256 = "sha256-pLLnk0FXJ6gb0WSdWGEzJSEbKdOpjdWECIRzrHvi8HQ=";
+    sha256 = "sha256-hkLIJ3vGpnywcOw+bfEsQESGFe1FUcCVJlMlVgGsrNs=";
   };
 
   sourceRoot = "${src.name}/src";
@@ -40,10 +40,6 @@ stdenv.mkDerivation rec {
     patchShebangs core/colorgcc
     patchShebangs projects/main/update_git_info.sh
 
-    sed -i -e 's/const AVOutputFormat /AVOutputFormat /g' \
-      projects/modules/mpegts/mpegts_writer.cpp \
-      projects/modules/file/file_writer.cpp \
-      projects/modules/rtmp/rtmp_writer.cpp
     sed -i -e '/^CC =/d' -e '/^CXX =/d' -e '/^AR =/d' projects/third_party/pugixml-1.9/scripts/pugixml.make
   '';
 
diff --git a/pkgs/servers/web-apps/mediawiki/default.nix b/pkgs/servers/web-apps/mediawiki/default.nix
index 23f0e6c2153c7..bab57f2576833 100644
--- a/pkgs/servers/web-apps/mediawiki/default.nix
+++ b/pkgs/servers/web-apps/mediawiki/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mediawiki";
-  version = "1.41.0";
+  version = "1.41.1";
 
   src = fetchurl {
     url = "https://releases.wikimedia.org/mediawiki/${lib.versions.majorMinor version}/mediawiki-${version}.tar.gz";
-    hash = "sha256-84Qrcqp6JYiPHsYyMj3YkEF3OaEg2VHEhfhQ4MzLQhs=";
+    hash = "sha256-TguqlTuF6U0xBAyyUSCrxgb6hpsuMxJr37t/xhPoxLI=";
   };
 
   postPatch = ''
diff --git a/pkgs/shells/fzf-git-sh/default.nix b/pkgs/shells/fzf-git-sh/default.nix
index 8d7ce5d1e0f70..e9cda521fb1db 100644
--- a/pkgs/shells/fzf-git-sh/default.nix
+++ b/pkgs/shells/fzf-git-sh/default.nix
@@ -39,12 +39,12 @@ stdenv.mkDerivation rec {
       -e "s,\buniq\b,${coreutils}/bin/uniq," \
       -e "s,\bcolumn\b,${util-linux}/bin/column," \
       -e "s,\bfzf-tmux\b,${fzf}/bin/fzf-tmux," \
-      -e "/display-message/!s,\bgit\b,${git}/bin/git,g" \
       -e "s,\bgrep\b,${gnugrep}/bin/grep," \
       -e "s,\bsed\b,${gnused}/bin/sed," \
       -e "/fzf-tmux/!s,\btmux\b,${tmux}/bin/tmux," \
       -e "s,\bxargs\b,${findutils}/bin/xargs," \
       -e "s,\bxdg-open\b,${xdg-utils}/bin/xdg-open," \
+      -e "/display-message\|fzf-git-\$o-widget\|\burl=\|\$remote_url =~ /!s,\bgit\b,${git}/bin/git,g" \
       -e "s,__fzf_git=.*BASH_SOURCE.*,__fzf_git=$out/share/${pname}/fzf-git.sh," \
       -e "/__fzf_git=.*readlink.*/d" \
       fzf-git.sh
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 63c853e3dc317..eb4482be78945 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -296,6 +296,10 @@ let
       str
     ];
     downloadPage = str;
+    repository = union [
+      (listOf str)
+      str
+    ];
     changelog = union [
       (listOf str)
       str
@@ -444,7 +448,29 @@ let
     let
       outputs = attrs.outputs or [ "out" ];
     in
-    {
+    optionalAttrs (attrs ? src.meta.homepage || attrs ? srcs && isList attrs.srcs && any (src: src ? meta.homepage) attrs.srcs) {
+      # should point to an http-browsable source tree, if available.
+      # fetchers like fetchFromGitHub set it automatically.
+      # this could be handled a lot easier if we nulled it instead
+      # of having it be undefined, but that wouldn't match the
+      # other attributes.
+      repository = let
+        getSrcs = attrs:
+          if attrs ? src
+          then
+            [ attrs.src ]
+          else
+            lib.filter (src: src ? meta.homepage) attrs.srcs;
+        getHomePages = srcs: map (src: src.meta.homepage) srcs;
+        unlist = list:
+          if lib.length list == 1
+          then
+            lib.elemAt list 0
+          else
+            list;
+      in
+        unlist (getHomePages (getSrcs attrs));
+    } // {
       # `name` derivation attribute includes cross-compilation cruft,
       # is under assert, and is sanitized.
       # Let's have a clean always accessible version here.
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index 78a7c62e9f776..e4ca2a611c3fc 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.200";
+  version = "3.0.201";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-xUP7zEWq5zTNzDaazmsL2h4QznsE5K3Rzo08qctCA3M=";
+    sha256 = "sha256-gI+D65wBnuexSJF89KjWJ5p4RJXs64Zg23V9RGwUTws=";
   };
 
   vendorHash = "sha256-t9ukiREUEmW6KK7m5Uv5Ce6n/1GsBLom9H35eEyOBys=";
diff --git a/pkgs/tools/admin/granted/default.nix b/pkgs/tools/admin/granted/default.nix
index 4761d49e8becd..5b428505f82bc 100644
--- a/pkgs/tools/admin/granted/default.nix
+++ b/pkgs/tools/admin/granted/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "granted";
-  version = "0.21.1";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "common-fate";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aHqMsEqlD/a/qQEjRKQU/+9Ov5BTnptExuO0eEXvf9k=";
+    sha256 = "sha256-cN7c5oJAP6ZHjq8o6PZHv40fdjCJtkGbPS2Vh+EWDHw=";
   };
 
-  vendorHash = "sha256-I4sds5r61oGop+EtOpDgTYwLbSVBBSBmNbRU56sCYjo=";
+  vendorHash = "sha256-lVP32y+XCPaVp8FtnN/13wBXTPQDHupaVw0T/nWtmYo=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/filesystems/xfsprogs/default.nix b/pkgs/tools/filesystems/xfsprogs/default.nix
index 5a7022ee6a13a..327d1e74f7c5b 100644
--- a/pkgs/tools/filesystems/xfsprogs/default.nix
+++ b/pkgs/tools/filesystems/xfsprogs/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xfsprogs";
-  version = "6.4.0";
+  version = "6.6.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
-    hash = "sha256-wxhoQYv79Jo6nEf8cM3/3p2W9P8AUb0EoIgeZlRkgQQ=";
+    hash = "sha256-UMovRnbfj6tMtMPvPdUS1VUeaETUCmWjHVuOA1k9It8=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];
diff --git a/pkgs/tools/misc/latex2html/default.nix b/pkgs/tools/misc/latex2html/default.nix
index 79b80eb3e55eb..f3cca8872b238 100644
--- a/pkgs/tools/misc/latex2html/default.nix
+++ b/pkgs/tools/misc/latex2html/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "latex2html";
-  version = "2023.2";
+  version = "2024";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fn9Td4IVqlON93p3xPpQuurFQR8Rjp/sHoQG33O5GkI=";
+    sha256 = "sha256-MF+S6x+k+lkutJQ60HCxFpdR96K3AFZcP/4guK9RvsA=";
   };
 
   buildInputs = [ ghostscript netpbm perl ];
diff --git a/pkgs/tools/misc/panoply/default.nix b/pkgs/tools/misc/panoply/default.nix
index 2238cafe69839..b79d6b7d8e35d 100644
--- a/pkgs/tools/misc/panoply/default.nix
+++ b/pkgs/tools/misc/panoply/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "panoply";
-  version = "5.3.3";
+  version = "5.3.4";
 
   src = fetchurl {
     url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";
-    sha256 = "sha256-h2MJqbouPSciOdChLNIskYm3YLpJYK9gjTDB8StmBqg=";
+    sha256 = "sha256-v7ieTtm2W8Sc/zhQ7QPh8rkMUgaqgfGYYXc6Ly+9iMg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/remind/default.nix b/pkgs/tools/misc/remind/default.nix
index d3ac44b713649..00daec1e49132 100644
--- a/pkgs/tools/misc/remind/default.nix
+++ b/pkgs/tools/misc/remind/default.nix
@@ -15,11 +15,11 @@ let
 in
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "04.03.03";
+  version = "04.03.04";
 
   src = fetchurl {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    sha256 = "sha256-+/vX6Nu0F84mZcEnd9jFlaVKbJIQQOJiPsxspKF+klQ=";
+    sha256 = "sha256-XkF/silBwDlQt9T2wmUMPh7MiE9yB+vXrSQmEnBEpC8=";
   };
 
   propagatedBuildInputs = tclLibraries;
diff --git a/pkgs/tools/misc/vial/default.nix b/pkgs/tools/misc/vial/default.nix
index 613abcdf7dbf3..e4c2b2989394c 100644
--- a/pkgs/tools/misc/vial/default.nix
+++ b/pkgs/tools/misc/vial/default.nix
@@ -27,7 +27,7 @@ appimageTools.wrapType2 {
     description = "An Open-source GUI and QMK fork for configuring your keyboard in real time";
     homepage = "https://get.vial.today";
     license = lib.licenses.gpl2Plus;
-    mainProgram = "vial";
+    mainProgram = "Vial";
     maintainers = with lib.maintainers; [ kranzes ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/tools/package-management/libdnf/default.nix b/pkgs/tools/package-management/libdnf/default.nix
index 9bce8a919db44..79fc38eaef33d 100644
--- a/pkgs/tools/package-management/libdnf/default.nix
+++ b/pkgs/tools/package-management/libdnf/default.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libdnf";
-  version = "0.73.0";
+  version = "0.73.1";
 
   outputs = [ "out" "dev" "py" ];
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "rpm-software-management";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-zduxlroqo7aeQYhiTWmEK47YG/ll8hLH/d3xtXdcYhk=";
+    hash = "sha256-mZCrJ1fXqKE1sMYKWHLLQEPkdLwPwqJz+8n+DlNmxvM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 96e91b000b402..75d1442bd38fc 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -261,8 +261,8 @@ in lib.makeExtensible (self: ({
   };
 
   nix_2_21 = common {
-    version = "2.21.0";
-    hash = "sha256-9b9qJ+7rGjLKbIswMf0/2pgUWH/xOlYLk7P4WYNcGDs=";
+    version = "2.21.1";
+    hash = "sha256-iRtvOcJbohyhav+deEajI/Ln/LU/6WqSfLyXDQaNEro=";
   };
 
   # The minimum Nix version supported by Nixpkgs
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index 3019a2593640e..5af095ae15560 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.18";
+  version = "0.6.19";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-QhtDfi6USazpPq+7VnJX9YqTxsm7y1CZpIXiZyHaGG4=";
+    hash = "sha256-wgMMa1PFKNArI4pk7gA2o8HHgF84Q+rga4j+UC1/Js8=";
   };
 
-  vendorHash = "sha256-TDsY05jnutNIKx0z6/8vGvsgYCIKBkTxh9mXqk4IR38=";
+  vendorHash = "sha256-wJqtIuLiidO3XFkvhSXRZcFR/31rR4U9BXjFilsr5a0=";
 
   ldflags = let PKG = "sigs.k8s.io/aws-iam-authenticator"; in [
     "-s"
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index 57d33623f0a2e..91fb3a554fd7e 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "10.9.1";
+  version = "10.9.2";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9NHzSgcUWRVhq4hqkq8xJ0FgTk9BBz2Zc0yuj72WL+c=";
+    hash = "sha256-2Vy2IFsq9vbNECnf873FYcWiitnzsbxP8v2IwjE5j1I=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-bhpVAvoIriqA7QnYysqUfuAYbR9PoaPHgWCHlJLdgYY=";
+  vendorHash = "sha256-zGtvA1m6U55+0Toy5zvQeU0jkumQzPqle6rCfyg3aN0=";
 
   subPackages = [
     "apps/cnspec"
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 3db2051c8de08..333668fbfc9d5 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-03-26";
+  version = "2024-03-29";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-oZfo9p23uvDw2f7O5AnycVpE14Rul8ZIeQPojVGQCXI=";
+    hash = "sha256-SNgC7gMedVpy07PQTt5MfyxZdb5bN3tTDx72l/rusvw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 21f6f0ecbd2ad..cad0fef74f582 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.0"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.1"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index b58232b1e8ef1..9ec271d8b7e01 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: c82de1374a222da3ca6db840432a971cfd4e865e
-  ref: refs/tags/6.4.0
+  revision: 73d98ad0ca24cdd33bbb9dfb110f3b781c613b55
+  ref: refs/tags/6.4.1
   specs:
-    metasploit-framework (6.4.0)
+    metasploit-framework (6.4.1)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index cacaf4ec0b0ed..0db72c46ae48f 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.0";
+  version = "6.4.1";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-1OWgQgnmsKxGHzX2ly/7xIJH4BcWUV6SjScxB5bMhu0=";
+    hash = "sha256-swKIiUgxsT6EnJV21sXOYU+s9fNTURLtJd1kjINyMd0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index a35e66a422228..fdaf84e0bb0e4 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -674,12 +674,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "c82de1374a222da3ca6db840432a971cfd4e865e";
-      sha256 = "1vc6rjb0fc97in95wl8n2zh4g0n4zcprgxim3x3arc76151a1rfl";
+      rev = "73d98ad0ca24cdd33bbb9dfb110f3b781c613b55";
+      sha256 = "1p9ifa1qqr6x4pni4lakygssqkv1rv2xcxlmkj23xc9i924qh0mk";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.0";
+    version = "6.4.1";
   };
   metasploit-model = {
     groups = ["default"];
diff --git a/pkgs/tools/security/pass/extensions/audit/default.nix b/pkgs/tools/security/pass/extensions/audit/default.nix
index 365f81759cce1..055af774a6245 100644
--- a/pkgs/tools/security/pass/extensions/audit/default.nix
+++ b/pkgs/tools/security/pass/extensions/audit/default.nix
@@ -11,7 +11,7 @@ in stdenv.mkDerivation rec {
     owner = "roddhjav";
     repo = "pass-audit";
     rev = "v${version}";
-    sha256 = "sha256-xigP8LxRXITLF3X21zhWx6ooFNSTKGv46yFSt1dd4vs=";
+    hash = "sha256-xigP8LxRXITLF3X21zhWx6ooFNSTKGv46yFSt1dd4vs=";
   };
 
   patches = [
@@ -21,9 +21,9 @@ in stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace audit.bash \
-      --replace 'python3' "${pythonEnv}/bin/python3"
+      --replace-fail 'python3' "${pythonEnv.interpreter}"
     substituteInPlace Makefile \
-      --replace "install --root" "install --prefix ''' --root"
+      --replace-fail "install --root" "install --prefix ''' --root"
   '';
 
   outputs = [ "out" "man" ];
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
   doCheck = !stdenv.isDarwin;
   nativeCheckInputs = [ pythonPackages.green pass gnupg ];
   checkPhase = ''
-    ${pythonEnv}/bin/python3 setup.py green -q
+    ${pythonEnv.interpreter} -m green -q
   '';
 
   installFlags = [ "DESTDIR=${placeholder "out"}" "PREFIX=" ];
diff --git a/pkgs/tools/security/step-cli/default.nix b/pkgs/tools/security/step-cli/default.nix
index 4ba73b2ac2e54..32446eeaa75be 100644
--- a/pkgs/tools/security/step-cli/default.nix
+++ b/pkgs/tools/security/step-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "step-cli";
-  version = "0.25.2";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-umo0f4cXxnxg3xH1aHeJE2brUT9w+Gp+0Qzq4zIQ8oI=";
+    hash = "sha256-B0LGedExlk9XllWilZ0QAwQHNyISAI2WJ48P2STbxSY=";
   };
 
   ldflags = [
@@ -25,7 +25,7 @@ buildGoModule rec {
     rm command/certificate/remote_test.go
   '';
 
-  vendorHash = "sha256-R9UJHXs35/yvwlqu1iR3lJN/w8DWMqw48Kc+7JKfD7I=";
+  vendorHash = "sha256-A38pmKRulvmxXbIaUsTiMWgq1MhUKkvuGp07H1rxCJg=";
 
   meta = with lib; {
     description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8f271535dbd9f..2b05d40d9de23 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -59,6 +59,7 @@ mapAliases ({
   AusweisApp2 = ausweisapp; # Added 2023-11-08
   a4term = a4; # Added 2023-10-06
   adtool = throw "'adtool' has been removed, as it was broken and unmaintained";
+  advcpmv = throw "'advcpmv' has been removed, as it is not being actively maintained and break recent coreutils."; # Added 2024-03-29
   aether = throw "aether has been removed from nixpkgs; upstream unmaintained, security issues"; # Added 2023-10-03
   airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
   alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream"; # Added 2023-07-28
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index af033ee87f4b2..7a97e5aa81384 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17176,8 +17176,6 @@ with pkgs;
   vcard = python3Packages.toPythonApplication python3Packages.vcard;
 
   inherit (callPackage ../development/compilers/vala { })
-    vala_0_48
-    vala_0_54
     vala_0_56
     vala;
 
@@ -26858,6 +26856,8 @@ with pkgs;
 
   sampler = callPackage ../applications/misc/sampler { };
 
+  scalene = with python3Packages; toPythonApplication scalene;
+
   scalr-cli = callPackage ../tools/admin/scalr-cli { };
 
   scaphandre = callPackage ../servers/scaphandre { };
@@ -34167,8 +34167,6 @@ with pkgs;
 
   pop-launcher = callPackage ../applications/misc/pop-launcher { };
 
-  pot = callPackage ../applications/misc/pot { };
-
   pothos = libsForQt5.callPackage ../applications/radio/pothos { };
 
   potrace = callPackage ../applications/graphics/potrace { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b030a14a79b49..810868a51b696 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9856,6 +9856,8 @@ self: super: with self; {
 
   pysiaalarm = callPackage ../development/python-modules/pysiaalarm { };
 
+  pysilero-vad = callPackage ../development/python-modules/pysilero-vad { };
+
   pysimplesoap = callPackage ../development/python-modules/pysimplesoap { };
 
   pyskyqhub = callPackage ../development/python-modules/pyskyqhub { };
@@ -11512,6 +11514,8 @@ self: super: with self; {
 
   pyric = callPackage ../development/python-modules/pyric { };
 
+  pyring-buffer = callPackage ../development/python-modules/pyring-buffer { };
+
   pyrisco = callPackage ../development/python-modules/pyrisco { };
 
   pyrituals = callPackage ../development/python-modules/pyrituals { };
@@ -13332,6 +13336,8 @@ self: super: with self; {
 
   sasmodels = callPackage ../development/python-modules/sasmodels { };
 
+  scalene = callPackage ../development/python-modules/scalene { };
+
   scales = callPackage ../development/python-modules/scales { };
 
   scancode-toolkit = callPackage ../development/python-modules/scancode-toolkit { };