about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS16
-rw-r--r--.github/workflows/basic-eval.yml2
-rw-r--r--doc/README.md12
-rw-r--r--doc/languages-frameworks/python.section.md76
-rw-r--r--doc/using/configuration.chapter.md29
-rw-r--r--lib/attrsets.nix48
-rw-r--r--lib/default.nix4
-rw-r--r--lib/fileset/default.nix2
-rw-r--r--lib/lists.nix22
-rw-r--r--lib/tests/misc.nix50
-rw-r--r--maintainers/maintainer-list.nix64
-rw-r--r--maintainers/team-list.nix3
-rw-r--r--nixos/doc/manual/configuration/customizing-packages.section.md30
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md12
-rw-r--r--nixos/modules/misc/documentation.nix1
-rw-r--r--nixos/modules/module-list.nix5
-rw-r--r--nixos/modules/programs/fcast-receiver.nix4
-rw-r--r--nixos/modules/programs/fzf.nix5
-rw-r--r--nixos/modules/security/duosec.nix6
-rw-r--r--nixos/modules/services/misc/greenclip.nix5
-rw-r--r--nixos/modules/services/misc/ollama.nix38
-rw-r--r--nixos/modules/services/misc/paperless.nix5
-rw-r--r--nixos/modules/services/misc/podgrab.nix41
-rw-r--r--nixos/modules/services/networking/deconz.nix2
-rw-r--r--nixos/modules/services/networking/firewall-nftables.nix18
-rw-r--r--nixos/modules/services/networking/inadyn.nix250
-rw-r--r--nixos/modules/services/networking/knot.nix2
-rw-r--r--nixos/modules/services/networking/netbird/coturn.nix160
-rw-r--r--nixos/modules/services/networking/netbird/dashboard.nix186
-rw-r--r--nixos/modules/services/networking/netbird/management.nix460
-rw-r--r--nixos/modules/services/networking/netbird/server.md42
-rw-r--r--nixos/modules/services/networking/netbird/server.nix67
-rw-r--r--nixos/modules/services/networking/netbird/signal.nix123
-rw-r--r--nixos/modules/services/networking/sunshine.nix156
-rw-r--r--nixos/modules/services/networking/wpa_supplicant.nix13
-rw-r--r--nixos/modules/services/search/manticore.nix131
-rw-r--r--nixos/modules/services/security/oauth2_proxy.nix10
-rw-r--r--nixos/modules/services/system/earlyoom.nix39
-rw-r--r--nixos/modules/services/web-apps/firefly-iii.nix367
-rw-r--r--nixos/modules/services/web-apps/limesurvey.nix16
-rw-r--r--nixos/modules/services/web-apps/pretalx.nix8
-rw-r--r--nixos/modules/services/x11/desktop-managers/lxqt.nix2
-rw-r--r--nixos/modules/services/x11/display-managers/default.nix4
-rw-r--r--nixos/modules/virtualisation/digital-ocean-config.nix2
-rw-r--r--nixos/release-combined.nix5
-rw-r--r--nixos/release-small.nix2
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/earlyoom.nix2
-rw-r--r--nixos/tests/firefly-iii.nix26
-rw-r--r--nixos/tests/gnome-extensions.nix2
-rw-r--r--nixos/tests/paperless.nix1
-rw-r--r--nixos/tests/phosh.nix11
-rw-r--r--nixos/tests/predictable-interface-names.nix2
-rw-r--r--nixos/tests/sunshine.nix70
-rw-r--r--nixos/tests/wpa_supplicant.nix29
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix4
-rw-r--r--pkgs/applications/audio/miniplayer/default.nix8
-rw-r--r--pkgs/applications/audio/mpg123/default.nix19
-rw-r--r--pkgs/applications/audio/ncspot/default.nix6
-rw-r--r--pkgs/applications/blockchains/btcpayserver/default.nix4
-rw-r--r--pkgs/applications/blockchains/btcpayserver/deps.nix11
-rw-r--r--pkgs/applications/blockchains/nbxplorer/default.nix4
-rw-r--r--pkgs/applications/blockchains/nbxplorer/deps.nix2
-rw-r--r--pkgs/applications/blockchains/terra-station/default.nix4
-rw-r--r--pkgs/applications/editors/android-studio/default.nix4
-rw-r--r--pkgs/applications/editors/jetbrains/bin/ides.json11
-rwxr-xr-xpkgs/applications/editors/jetbrains/bin/update_bin.py6
-rw-r--r--pkgs/applications/editors/jetbrains/bin/versions.json32
-rw-r--r--pkgs/applications/editors/jetbrains/default.nix2
-rw-r--r--pkgs/applications/editors/neovim/default.nix8
-rw-r--r--pkgs/applications/editors/neovim/neovide/default.nix2
-rw-r--r--pkgs/applications/editors/standardnotes/default.nix14
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/editors/vim/plugins/deprecated.json2
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix1092
-rw-r--r--pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix508
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix12
-rw-r--r--pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch10
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-gen-doc-hook.sh2
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names2
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix249
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix4
-rw-r--r--pkgs/applications/emulators/cemu/default.nix4
-rw-r--r--pkgs/applications/emulators/mednafen/server.nix22
-rw-r--r--pkgs/applications/emulators/mednaffe/default.nix42
-rw-r--r--pkgs/applications/gis/qgis/unwrapped-ltr.nix4
-rw-r--r--pkgs/applications/gis/qgis/unwrapped.nix4
-rw-r--r--pkgs/applications/graphics/flaca/Cargo.lock729
-rw-r--r--pkgs/applications/graphics/flaca/default.nix40
-rw-r--r--pkgs/applications/graphics/gscan2pdf/default.nix9
-rw-r--r--pkgs/applications/graphics/meshlab/default.nix58
-rw-r--r--pkgs/applications/graphics/pymeshlab/default.nix107
-rw-r--r--pkgs/applications/graphics/sane/backends/brscan5/default.nix13
-rw-r--r--pkgs/applications/misc/1password-gui/default.nix18
-rw-r--r--pkgs/applications/misc/1password/default.nix10
-rw-r--r--pkgs/applications/misc/albert/default.nix3
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--pkgs/applications/misc/electron-cash/default.nix5
-rw-r--r--pkgs/applications/misc/faircamp/Cargo.lock487
-rw-r--r--pkgs/applications/misc/faircamp/default.nix6
-rw-r--r--pkgs/applications/misc/gallery-dl/default.nix10
-rw-r--r--pkgs/applications/misc/inochi2d/creator-dub-lock.json148
-rw-r--r--pkgs/applications/misc/inochi2d/default.nix81
-rw-r--r--pkgs/applications/misc/inochi2d/generic.nix139
-rw-r--r--pkgs/applications/misc/inochi2d/session-dub-lock.json140
-rw-r--r--pkgs/applications/misc/inochi2d/support-url.patch13
-rw-r--r--pkgs/applications/misc/inochi2d/translations.patch22
-rw-r--r--pkgs/applications/misc/logseq/default.nix3
-rw-r--r--pkgs/applications/misc/opencpn/default.nix3
-rw-r--r--pkgs/applications/misc/orca/default.nix2
-rw-r--r--pkgs/applications/misc/rtfm/default.nix27
-rw-r--r--pkgs/applications/misc/rtfm/enable-write-permissions.patch (renamed from pkgs/applications/misc/rtfm/patches/enable-write-permissions.patch)4
-rw-r--r--pkgs/applications/misc/rtfm/make.patch39
-rw-r--r--pkgs/applications/misc/rtfm/patches/friendly-docs-path.patch11
-rw-r--r--pkgs/applications/misc/rtfm/patches/make.patch21
-rw-r--r--pkgs/applications/misc/rtfm/shards.nix20
-rw-r--r--pkgs/applications/misc/shell-genie/default.nix9
-rw-r--r--pkgs/applications/misc/systembus-notify/default.nix4
-rw-r--r--pkgs/applications/misc/trenchbroom/default.nix8
-rw-r--r--pkgs/applications/misc/ttyper/default.nix6
-rw-r--r--pkgs/applications/misc/writefreely/default.nix10
-rw-r--r--pkgs/applications/misc/writefreely/fix-go-version-error.patch36
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix16
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.nix12
-rw-r--r--pkgs/applications/networking/cluster/k3s/README.md6
-rw-r--r--pkgs/applications/networking/cluster/kubefirst/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubelogin/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubevpn/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/linkerd/edge.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/element/element-desktop.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/webcord/default.nix9
-rw-r--r--pkgs/applications/networking/instant-messengers/wire-desktop/default.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/zoom-us/default.nix2
-rw-r--r--pkgs/applications/networking/iroh/default.nix6
-rw-r--r--pkgs/applications/networking/maestral-qt/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/packages.nix4
-rw-r--r--pkgs/applications/networking/protonvpn-gui/default.nix4
-rw-r--r--pkgs/applications/networking/sync/rsync/default.nix4
-rw-r--r--pkgs/applications/networking/synology-drive-client/default.nix8
-rw-r--r--pkgs/applications/networking/twingate/default.nix4
-rw-r--r--pkgs/applications/office/super-productivity/default.nix7
-rw-r--r--pkgs/applications/radio/gqrx/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/stellarium/default.nix4
-rw-r--r--pkgs/applications/science/biology/iqtree/default.nix4
-rw-r--r--pkgs/applications/science/biology/macs2/default.nix2
-rw-r--r--pkgs/applications/science/biology/nest/default.nix2
-rw-r--r--pkgs/applications/science/electronics/nvc/default.nix2
-rw-r--r--pkgs/applications/science/math/sage/python-modules/sage-setup.nix4
-rw-r--r--pkgs/applications/science/math/sage/sagelib.nix4
-rw-r--r--pkgs/applications/terminal-emulators/kitty/default.nix6
-rw-r--r--pkgs/applications/version-management/commitizen/default.nix2
-rw-r--r--pkgs/applications/version-management/forgejo/default.nix6
-rw-r--r--pkgs/applications/version-management/git-interactive-rebase-tool/default.nix7
-rw-r--r--pkgs/applications/version-management/git-up/default.nix2
-rw-r--r--pkgs/applications/video/anilibria-winmaclinux/default.nix4
-rw-r--r--pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix4
-rw-r--r--pkgs/applications/video/subtitleedit/default.nix4
-rw-r--r--pkgs/applications/virtualization/OVMF/default.nix51
-rw-r--r--pkgs/applications/virtualization/podman-compose/default.nix15
-rw-r--r--pkgs/applications/virtualization/podman/default.nix6
-rw-r--r--pkgs/applications/virtualization/virt-manager/default.nix2
-rw-r--r--pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix6
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix13
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix15
-rw-r--r--pkgs/build-support/expand-response-params/default.nix16
-rw-r--r--pkgs/build-support/fetchurl/mirrors.nix1
-rw-r--r--pkgs/by-name/_6/_64gram/package.nix4
-rw-r--r--pkgs/by-name/ab/ab-av1/package.nix33
-rw-r--r--pkgs/by-name/ad/adminerevo/index.php35
-rw-r--r--pkgs/by-name/ad/adminerevo/package.nix73
-rw-r--r--pkgs/by-name/ap/api-linter/package.nix6
-rw-r--r--pkgs/by-name/be/betula/package.nix6
-rw-r--r--pkgs/by-name/bi/biglybt/package.nix66
-rw-r--r--pkgs/by-name/cl/clatd/package.nix63
-rw-r--r--pkgs/by-name/cm/cmake/package.nix4
-rw-r--r--pkgs/by-name/co/codeium/package.nix10
-rw-r--r--pkgs/by-name/co/corto/package.nix27
-rw-r--r--pkgs/by-name/cy/cyclonedx-cli/deps.nix195
-rw-r--r--pkgs/by-name/cy/cyclonedx-cli/package.nix33
-rw-r--r--pkgs/by-name/do/dogedns/package.nix48
-rw-r--r--pkgs/by-name/do/dogedns/remove-date-info.patch11
-rw-r--r--pkgs/by-name/do/doublecmd/package.nix4
-rw-r--r--pkgs/by-name/du/dublin-traceroute/package.nix7
-rw-r--r--pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch (renamed from pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch)0
-rw-r--r--pkgs/by-name/ea/earlyoom/package.nix64
-rw-r--r--pkgs/by-name/ei/eigenlayer/package.nix6
-rw-r--r--pkgs/by-name/et/etlegacy-unwrapped/package.nix4
-rw-r--r--pkgs/by-name/et/etlegacy/package.nix2
-rw-r--r--pkgs/by-name/ez/eza/package.nix8
-rw-r--r--pkgs/by-name/fe/feather/package.nix2
-rw-r--r--pkgs/by-name/fi/find-billy/package.nix70
-rw-r--r--pkgs/by-name/fi/fira-mono/package.nix (renamed from pkgs/data/fonts/fira-mono/default.nix)0
-rw-r--r--pkgs/by-name/fi/fira-sans/package.nix (renamed from pkgs/data/fonts/fira/default.nix)20
-rw-r--r--pkgs/by-name/fi/fira/package.nix23
-rw-r--r--pkgs/by-name/fi/firefly-iii/package.nix60
-rw-r--r--pkgs/by-name/fi/firefoxpwa/package.nix72
-rw-r--r--pkgs/by-name/fo/fork-cleaner/package.nix41
-rw-r--r--pkgs/by-name/ga/gamescope/package.nix4
-rw-r--r--pkgs/by-name/ga/gatus/package.nix6
-rw-r--r--pkgs/by-name/gi/gitu/package.nix6
-rw-r--r--pkgs/by-name/gl/glider/package.nix37
-rw-r--r--pkgs/by-name/go/go-camo/package.nix6
-rw-r--r--pkgs/by-name/gt/gtfocli/package.nix33
-rw-r--r--pkgs/by-name/gv/gvisor/package.nix2
-rw-r--r--pkgs/by-name/ho/home-manager/package.nix6
-rw-r--r--pkgs/by-name/hy/hypridle/package.nix4
-rw-r--r--pkgs/by-name/ig/igir/package.nix6
-rw-r--r--pkgs/by-name/ja/jan/package.nix6
-rw-r--r--pkgs/by-name/ja/jasper/package.nix4
-rw-r--r--pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix65
-rw-r--r--pkgs/by-name/kc/kcl-cli/package.nix6
-rw-r--r--pkgs/by-name/kt/ktfmt/package.nix7
-rw-r--r--pkgs/by-name/kt/ktfmt/pin-default-maven-plugin-versions.patch60
-rw-r--r--pkgs/by-name/lb/lbd/package.nix48
-rw-r--r--pkgs/by-name/li/libigl/package.nix31
-rw-r--r--pkgs/by-name/li/limine/package.nix5
-rw-r--r--pkgs/by-name/li/livekit/package.nix6
-rw-r--r--pkgs/by-name/lu/luneta/dub-lock.json24
-rw-r--r--pkgs/by-name/lu/luneta/package.nix44
-rw-r--r--pkgs/by-name/ma/maa-assistant-arknights/pin.json8
-rw-r--r--pkgs/by-name/ma/mautrix-meta/package.nix23
-rw-r--r--pkgs/by-name/mc/mcap-cli/package.nix6
-rw-r--r--pkgs/by-name/me/mednafen-server/package.nix30
-rw-r--r--pkgs/by-name/me/mednafen/package.nix (renamed from pkgs/applications/emulators/mednafen/default.nix)69
-rw-r--r--pkgs/by-name/me/mednaffe/package.nix52
-rw-r--r--pkgs/by-name/me/meson/0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch92
-rw-r--r--pkgs/by-name/me/meson/package.nix12
-rw-r--r--pkgs/by-name/mo/moproxy/package.nix40
-rw-r--r--pkgs/by-name/mq/mqttui/Cargo.lock402
-rw-r--r--pkgs/by-name/mq/mqttui/package.nix20
-rw-r--r--pkgs/by-name/my/mycelium/Cargo.lock638
-rw-r--r--pkgs/by-name/my/mycelium/package.nix11
-rw-r--r--pkgs/by-name/my/mystmd/package.nix6
-rw-r--r--pkgs/by-name/ne/netbird-dashboard/package.nix35
-rw-r--r--pkgs/by-name/ne/nezha-agent/package.nix8
-rw-r--r--pkgs/by-name/nh/nh/package.nix6
-rw-r--r--pkgs/by-name/ni/niri/Cargo.lock13
-rw-r--r--pkgs/by-name/ni/niri/package.nix6
-rw-r--r--pkgs/by-name/no/nom/package.nix4
-rw-r--r--pkgs/by-name/no/nomore403/package.nix35
-rw-r--r--pkgs/by-name/no/novops/package.nix6
-rw-r--r--pkgs/by-name/nr/nrr/package.nix11
-rw-r--r--pkgs/by-name/nw/nwg-hello/package.nix4
-rw-r--r--pkgs/by-name/of/offat/package.nix4
-rw-r--r--pkgs/by-name/om/omnictl/package.nix40
-rw-r--r--pkgs/by-name/op/open-scq30/package.nix6
-rw-r--r--pkgs/by-name/op/openctm/package.nix59
-rw-r--r--pkgs/by-name/ot/oterm/package.nix4
-rw-r--r--pkgs/by-name/ov/OVMF-cloud-hypervisor/package.nix7
-rw-r--r--pkgs/by-name/pi/pingtunnel/package.nix32
-rw-r--r--pkgs/by-name/po/poppins/package.nix35
-rw-r--r--pkgs/by-name/pr/pretix/package.nix1
-rw-r--r--pkgs/by-name/pr/primecount/package.nix4
-rw-r--r--pkgs/by-name/pr/proto/package.nix6
-rw-r--r--pkgs/by-name/pr/proton-ge-bin/package.nix4
-rw-r--r--pkgs/by-name/py/pyright/package-lock.json193
-rw-r--r--pkgs/by-name/py/pyright/package.nix75
-rwxr-xr-xpkgs/by-name/py/pyright/update.sh44
-rw-r--r--pkgs/by-name/qu/quarkus/package.nix4
-rw-r--r--pkgs/by-name/re/renode-unstable/package.nix4
-rw-r--r--pkgs/by-name/re/restls/package.nix26
-rw-r--r--pkgs/by-name/ri/rippkgs/package.nix36
-rw-r--r--pkgs/by-name/rm/rmenu/Cargo.lock96
-rw-r--r--pkgs/by-name/rm/rmenu/package.nix11
-rw-r--r--pkgs/by-name/sa/sandbar/package.nix47
-rw-r--r--pkgs/by-name/sb/sbom-utility/package.nix32
-rw-r--r--pkgs/by-name/sh/shadow-tls/package.nix32
-rw-r--r--pkgs/by-name/sn/snapcraft/lxd-socket-path.patch13
-rw-r--r--pkgs/by-name/sn/snapcraft/os-platform.patch21
-rw-r--r--pkgs/by-name/sn/snapcraft/package.nix188
-rw-r--r--pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch30
-rw-r--r--pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch26
-rw-r--r--pkgs/by-name/so/solana-cli/Cargo.lock225
-rw-r--r--pkgs/by-name/so/solana-cli/package.nix4
-rw-r--r--pkgs/by-name/so/solo5/package.nix15
-rw-r--r--pkgs/by-name/so/sopwith/package.nix4
-rw-r--r--pkgs/by-name/ss/ssh-tpm-agent/package.nix2
-rw-r--r--pkgs/by-name/ss/ssimulacra2/package.nix49
-rw-r--r--pkgs/by-name/sw/swayosd/package.nix19
-rw-r--r--pkgs/by-name/sy/symfony-cli/package.nix6
-rw-r--r--pkgs/by-name/sy/syncall/package.nix73
-rw-r--r--pkgs/by-name/sy/systemctl-tui/package.nix6
-rw-r--r--pkgs/by-name/ta/taskchampion-sync-server/package.nix29
-rw-r--r--pkgs/by-name/ta/taskwarrior3/package.nix83
-rw-r--r--pkgs/by-name/te/ternimal/package.nix44
-rw-r--r--pkgs/by-name/te/tetrio-desktop/package.json22
-rw-r--r--pkgs/by-name/te/tetrio-desktop/package.nix98
-rw-r--r--pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix160
-rw-r--r--pkgs/by-name/te/tetrio-desktop/yarn.lock348
-rw-r--r--pkgs/by-name/tk/tkey-ssh-agent/package.nix27
-rw-r--r--pkgs/by-name/to/tootik/package.nix4
-rw-r--r--pkgs/by-name/tr/tridactyl-native/lock.json24
-rw-r--r--pkgs/by-name/tr/tridactyl-native/package.nix9
-rw-r--r--pkgs/by-name/ug/ugrep-indexer/package.nix4
-rw-r--r--pkgs/by-name/uv/uv/Cargo.lock1042
-rw-r--r--pkgs/by-name/uv/uv/package.nix8
-rw-r--r--pkgs/by-name/ux/uxn/package.nix6
-rw-r--r--pkgs/by-name/va/vaults/package.nix85
-rw-r--r--pkgs/by-name/ve/vencord/package-lock.json40
-rw-r--r--pkgs/by-name/ve/vencord/package.nix8
-rwxr-xr-xpkgs/by-name/ve/vencord/update.sh4
-rw-r--r--pkgs/by-name/ve/vesktop/package.nix14
-rw-r--r--pkgs/by-name/vl/vlc-bittorrent/package.nix2
-rw-r--r--pkgs/by-name/wa/warp-terminal/versions.json8
-rw-r--r--pkgs/by-name/wa/waycheck/package.nix15
-rw-r--r--pkgs/by-name/we/wechat-uos/package.nix10
-rw-r--r--pkgs/by-name/wi/wiremock/package.nix4
-rw-r--r--pkgs/by-name/wi/wireproxy/package.nix (renamed from pkgs/tools/networking/wireproxy/default.nix)8
-rw-r--r--pkgs/by-name/xo/xonsh/unwrapped.nix2
-rw-r--r--pkgs/by-name/ze/zed-editor/Cargo.lock213
-rw-r--r--pkgs/by-name/ze/zed-editor/package.nix7
-rw-r--r--pkgs/data/fonts/iosevka/default.nix6
-rw-r--r--pkgs/data/fonts/junicode/tests.nix7
-rw-r--r--pkgs/data/fonts/nasin-nanpa/default.nix23
-rw-r--r--pkgs/data/icons/catppuccin-cursors/default.nix3
-rw-r--r--pkgs/data/icons/comixcursors/default.nix3
-rw-r--r--pkgs/data/icons/gruppled-cursors/default.nix30
-rw-r--r--pkgs/data/icons/gruppled-lite-cursors/default.nix30
-rw-r--r--pkgs/data/icons/numix-icon-theme-circle/default.nix4
-rw-r--r--pkgs/data/misc/iana-etc/default.nix4
-rw-r--r--pkgs/data/themes/orchis-theme/default.nix4
-rw-r--r--pkgs/desktops/budgie/budgie-desktop-view/default.nix2
-rw-r--r--pkgs/desktops/deepin/apps/deepin-terminal/default.nix2
-rw-r--r--pkgs/desktops/deepin/library/qt5integration/default.nix2
-rw-r--r--pkgs/desktops/gnome/core/eog/default.nix5
-rw-r--r--pkgs/desktops/gnome/core/gnome-control-center/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-shell/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/nautilus/default.nix2
-rw-r--r--pkgs/desktops/gnome/extensions/buildGnomeExtension.nix2
-rw-r--r--pkgs/desktops/lxqt/compton-conf/default.nix21
-rw-r--r--pkgs/desktops/lxqt/default.nix57
-rw-r--r--pkgs/desktops/lxqt/libdbusmenu-lxqt/default.nix40
-rw-r--r--pkgs/desktops/lxqt/libfm-qt/default.nix42
-rw-r--r--pkgs/desktops/lxqt/liblxqt/default.nix32
-rw-r--r--pkgs/desktops/lxqt/libqtxdg/default.nix14
-rw-r--r--pkgs/desktops/lxqt/libsysstat/default.nix9
-rw-r--r--pkgs/desktops/lxqt/lximage-qt/default.nix41
-rw-r--r--pkgs/desktops/lxqt/lxqt-about/default.nix22
-rw-r--r--pkgs/desktops/lxqt/lxqt-admin/default.nix28
-rw-r--r--pkgs/desktops/lxqt/lxqt-archiver/default.nix14
-rw-r--r--pkgs/desktops/lxqt/lxqt-build-tools/default.nix24
-rw-r--r--pkgs/desktops/lxqt/lxqt-config/default.nix55
-rw-r--r--pkgs/desktops/lxqt/lxqt-globalkeys/default.nix12
-rw-r--r--pkgs/desktops/lxqt/lxqt-menu-data/default.nix10
-rw-r--r--pkgs/desktops/lxqt/lxqt-notificationd/default.nix28
-rw-r--r--pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix26
-rw-r--r--pkgs/desktops/lxqt/lxqt-panel/default.nix30
-rw-r--r--pkgs/desktops/lxqt/lxqt-policykit/default.nix36
-rw-r--r--pkgs/desktops/lxqt/lxqt-powermanagement/default.nix34
-rw-r--r--pkgs/desktops/lxqt/lxqt-qtplugin/default.nix23
-rw-r--r--pkgs/desktops/lxqt/lxqt-runner/default.nix30
-rw-r--r--pkgs/desktops/lxqt/lxqt-session/default.nix41
-rw-r--r--pkgs/desktops/lxqt/lxqt-sudo/default.nix26
-rw-r--r--pkgs/desktops/lxqt/lxqt-themes/default.nix8
-rw-r--r--pkgs/desktops/lxqt/obconf-qt/default.nix37
-rw-r--r--pkgs/desktops/lxqt/pavucontrol-qt/default.nix18
-rw-r--r--pkgs/desktops/lxqt/pcmanfm-qt/default.nix30
-rw-r--r--pkgs/desktops/lxqt/qlipper/default.nix6
-rw-r--r--pkgs/desktops/lxqt/qps/default.nix18
-rw-r--r--pkgs/desktops/lxqt/qterminal/default.nix10
-rw-r--r--pkgs/desktops/lxqt/qtermwidget/default.nix5
-rw-r--r--pkgs/desktops/lxqt/qtxdg-tools/default.nix16
-rw-r--r--pkgs/desktops/lxqt/screengrab/default.nix35
-rw-r--r--pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix14
-rw-r--r--pkgs/development/compilers/cakelisp/default.nix6
-rw-r--r--pkgs/development/compilers/circt/default.nix4
-rw-r--r--pkgs/development/compilers/crystal/build-package.nix6
-rw-r--r--pkgs/development/compilers/gcc/common/meta.nix11
-rw-r--r--pkgs/development/compilers/gcc/default.nix159
-rw-r--r--pkgs/development/compilers/gnat-bootstrap/default.nix3
-rw-r--r--pkgs/development/compilers/go/1.22.nix4
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix18
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix18
-rw-r--r--pkgs/development/compilers/ligo/default.nix9
-rw-r--r--pkgs/development/compilers/llvm/17/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/18/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/common/libcxx/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/nasm/default.nix21
-rw-r--r--pkgs/development/compilers/orc/default.nix4
-rw-r--r--pkgs/development/compilers/rust/1_77.nix (renamed from pkgs/development/compilers/rust/1_76.nix)30
-rw-r--r--pkgs/development/compilers/rust/cargo-auditable.nix10
-rw-r--r--pkgs/development/compilers/rust/rustc.nix2
-rw-r--r--pkgs/development/compilers/zig/0.12.nix37
-rw-r--r--pkgs/development/compilers/zig/generic.nix5
-rw-r--r--pkgs/development/coq-modules/CoLoR/default.nix3
-rw-r--r--pkgs/development/cuda-modules/backend-stdenv.nix4
-rw-r--r--pkgs/development/cuda-modules/cuda-library-samples/extension.nix4
-rw-r--r--pkgs/development/cuda-modules/cuda-library-samples/generic.nix2
-rw-r--r--pkgs/development/cuda-modules/cuda-samples/extension.nix4
-rw-r--r--pkgs/development/cuda-modules/cuda-samples/generic.nix3
-rw-r--r--pkgs/development/cuda-modules/cuda/overrides.nix454
-rw-r--r--pkgs/development/cuda-modules/cutensor/extension.nix4
-rw-r--r--pkgs/development/cuda-modules/flags.nix13
-rw-r--r--pkgs/development/cuda-modules/generic-builders/manifest.nix95
-rw-r--r--pkgs/development/cuda-modules/generic-builders/multiplex.nix4
-rw-r--r--pkgs/development/cuda-modules/nccl/default.nix30
-rw-r--r--pkgs/development/cuda-modules/saxpy/default.nix22
-rw-r--r--pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh21
-rw-r--r--pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh17
-rw-r--r--pkgs/development/cuda-modules/tensorrt/fixup.nix3
-rw-r--r--pkgs/development/embedded/avrdude/default.nix52
-rw-r--r--pkgs/development/embedded/avrdude/libelf.nix36
-rw-r--r--pkgs/development/interpreters/babashka/clojure-tools.nix4
-rw-r--r--pkgs/development/interpreters/babashka/default.nix4
-rw-r--r--pkgs/development/interpreters/lua-5/hooks/setup-hook.sh3
-rw-r--r--pkgs/development/interpreters/lua-5/tests/default.nix15
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix3
-rw-r--r--pkgs/development/interpreters/python/default.nix8
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix6
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh35
-rw-r--r--pkgs/development/interpreters/python/pypy/default.nix3
-rw-r--r--pkgs/development/interpreters/python/pypy/prebuilt.nix3
-rw-r--r--pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix3
-rw-r--r--pkgs/development/interpreters/python/sitecustomize.py39
-rw-r--r--pkgs/development/interpreters/python/tests.nix93
-rw-r--r--pkgs/development/interpreters/python/tests/test_environments/test_python.py2
-rw-r--r--pkgs/development/interpreters/python/wrapper.nix10
-rw-r--r--pkgs/development/interpreters/ruby/default.nix10
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix4
-rw-r--r--pkgs/development/libraries/LAStools/default.nix4
-rw-r--r--pkgs/development/libraries/SDL2/default.nix4
-rw-r--r--pkgs/development/libraries/abseil-cpp/202401.nix4
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix4
-rw-r--r--pkgs/development/libraries/avahi/CVE-2023-38469.patch102
-rw-r--r--pkgs/development/libraries/avahi/CVE-2023-38471-2.patch47
-rw-r--r--pkgs/development/libraries/avahi/default.nix41
-rw-r--r--pkgs/development/libraries/aws-c-auth/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-common/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-event-stream/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-http/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-io/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-mqtt/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-s3/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-sdkutils/default.nix4
-rw-r--r--pkgs/development/libraries/aws-crt-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/embree/default.nix18
-rw-r--r--pkgs/development/libraries/enchant/2.x.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/default.nix9
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix71
-rw-r--r--pkgs/development/libraries/flatpak/default.nix4
-rw-r--r--pkgs/development/libraries/glfw/3.x.nix31
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix1
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/ldb/default.nix12
-rw-r--r--pkgs/development/libraries/libaom/default.nix4
-rw-r--r--pkgs/development/libraries/libarchive/default.nix9
-rw-r--r--pkgs/development/libraries/libdeflate/default.nix4
-rw-r--r--pkgs/development/libraries/libical/default.nix4
-rw-r--r--pkgs/development/libraries/libiconv/default.nix12
-rw-r--r--pkgs/development/libraries/libimobiledevice-glue/default.nix4
-rw-r--r--pkgs/development/libraries/libjxl/default.nix28
-rw-r--r--pkgs/development/libraries/liblc3/default.nix4
-rw-r--r--pkgs/development/libraries/libplist/default.nix4
-rw-r--r--pkgs/development/libraries/libproxy/default.nix146
-rw-r--r--pkgs/development/libraries/libproxy/hardcode-gsettings.patch140
-rw-r--r--pkgs/development/libraries/libproxy/skip-gsettings-detection.patch29
-rw-r--r--pkgs/development/libraries/librsvg/default.nix6
-rw-r--r--pkgs/development/libraries/libsamplerate/default.nix13
-rw-r--r--pkgs/development/libraries/libtiff/4.5.nix86
-rw-r--r--pkgs/development/libraries/libtiff/default.nix5
-rw-r--r--pkgs/development/libraries/libtiff/headers-4.5.patch16
-rw-r--r--pkgs/development/libraries/libtiff/libtiff_t.nix73
-rw-r--r--pkgs/development/libraries/libtiff/rename-version-4.5.patch21
-rw-r--r--pkgs/development/libraries/libucl/default.nix4
-rw-r--r--pkgs/development/libraries/libzim/default.nix29
-rw-r--r--pkgs/development/libraries/mesa/backport-radeon-crash-fix.patch13
-rw-r--r--pkgs/development/libraries/mesa/default.nix12
-rw-r--r--pkgs/development/libraries/mtdev/default.nix16
-rw-r--r--pkgs/development/libraries/nghttp2/default.nix4
-rw-r--r--pkgs/development/libraries/npth/default.nix6
-rw-r--r--pkgs/development/libraries/openexr/3.nix4
-rw-r--r--pkgs/development/libraries/pcre2/default.nix10
-rw-r--r--pkgs/development/libraries/pipewire/default.nix4
-rw-r--r--pkgs/development/libraries/pixman/default.nix6
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtdeclarative.nix14
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtmultimedia.nix20
-rw-r--r--pkgs/development/libraries/qt-6/patches/qtmultimedia-windows-no-uppercase-libs.patch13
-rw-r--r--pkgs/development/libraries/qt-6/patches/qtmultimedia-windows-resolve-function-name.patch30
-rw-r--r--pkgs/development/libraries/rustls-ffi/default.nix3
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/soundtouch/default.nix4
-rw-r--r--pkgs/development/libraries/structuresynth/default.nix61
-rw-r--r--pkgs/development/libraries/umockdev/default.nix4
-rw-r--r--pkgs/development/libraries/v8/default.nix8
-rw-r--r--pkgs/development/libraries/x264/default.nix29
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix4
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal/default.nix4
-rw-r--r--pkgs/development/libraries/zziplib/default.nix25
-rw-r--r--pkgs/development/lua-modules/overrides.nix19
-rw-r--r--pkgs/development/misc/resholve/0014-clang_incompatible_function_pointer_conversions.patch42
-rw-r--r--pkgs/development/misc/resholve/README.md5
-rw-r--r--pkgs/development/misc/resholve/default.nix2
-rw-r--r--pkgs/development/misc/resholve/oildev.nix60
-rw-r--r--pkgs/development/misc/resholve/resholve.nix21
-rw-r--r--pkgs/development/misc/resholve/source.nix4
-rw-r--r--pkgs/development/node-packages/main-programs.nix1
-rw-r--r--pkgs/development/node-packages/node-packages.json1
-rw-r--r--pkgs/development/ocaml-modules/clap/default.nix24
-rw-r--r--pkgs/development/ocaml-modules/data-encoding/default.nix18
-rw-r--r--pkgs/development/ocaml-modules/index/default.nix5
-rw-r--r--pkgs/development/ocaml-modules/irmin/chunk.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/containers.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/fs.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/git.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/http.nix25
-rw-r--r--pkgs/development/ocaml-modules/irmin/mirage-git.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/mirage-graphql.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/mirage.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/pack.nix2
-rw-r--r--pkgs/development/ocaml-modules/irmin/ppx.nix4
-rw-r--r--pkgs/development/ocaml-modules/irmin/test.nix7
-rw-r--r--pkgs/development/ocaml-modules/irmin/tezos.nix2
-rw-r--r--pkgs/development/ocaml-modules/json-data-encoding/bson.nix2
-rw-r--r--pkgs/development/ocaml-modules/json-data-encoding/default.nix19
-rw-r--r--pkgs/development/ocaml-modules/mirage-kv/default.nix9
-rw-r--r--pkgs/development/ocaml-modules/ocaml-freestanding/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/progress/default.nix1
-rw-r--r--pkgs/development/ocaml-modules/terminal/default.nix7
-rw-r--r--pkgs/development/ocaml-modules/tezt/default.nix34
-rw-r--r--pkgs/development/php-packages/composer/default.nix8
-rw-r--r--pkgs/development/php-packages/opentelemetry/default.nix2
-rw-r--r--pkgs/development/python-modules/accelerate/default.nix5
-rw-r--r--pkgs/development/python-modules/accuweather/default.nix42
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix5
-rw-r--r--pkgs/development/python-modules/aiojobs/default.nix8
-rw-r--r--pkgs/development/python-modules/aiomisc/default.nix4
-rw-r--r--pkgs/development/python-modules/aiounifi/default.nix43
-rw-r--r--pkgs/development/python-modules/aiozeroconf/default.nix31
-rw-r--r--pkgs/development/python-modules/alembic/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-pylibssh/default.nix4
-rw-r--r--pkgs/development/python-modules/anytree/default.nix13
-rw-r--r--pkgs/development/python-modules/anywidget/default.nix4
-rw-r--r--pkgs/development/python-modules/apkinspector/default.nix38
-rw-r--r--pkgs/development/python-modules/apsw/default.nix3
-rw-r--r--pkgs/development/python-modules/aranet4/default.nix4
-rw-r--r--pkgs/development/python-modules/argcomplete/default.nix4
-rw-r--r--pkgs/development/python-modules/argilla/default.nix4
-rw-r--r--pkgs/development/python-modules/aspy-yaml/default.nix (renamed from pkgs/development/python-modules/aspy.yaml/default.nix)5
-rw-r--r--pkgs/development/python-modules/astropy/default.nix4
-rw-r--r--pkgs/development/python-modules/aws-encryption-sdk/default.nix9
-rw-r--r--pkgs/development/python-modules/awswrangler/default.nix6
-rw-r--r--pkgs/development/python-modules/backports-shutil-get-terminal-size/default.nix (renamed from pkgs/development/python-modules/backports_shutil_get_terminal_size/default.nix)2
-rw-r--r--pkgs/development/python-modules/barectf/default.nix8
-rw-r--r--pkgs/development/python-modules/bellows/default.nix8
-rw-r--r--pkgs/development/python-modules/betterproto/default.nix4
-rw-r--r--pkgs/development/python-modules/blis/default.nix4
-rw-r--r--pkgs/development/python-modules/blosc2/default.nix4
-rw-r--r--pkgs/development/python-modules/bluetooth-data-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/boto3-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/botocore-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/bubop/default.nix52
-rw-r--r--pkgs/development/python-modules/cached-ipaddress/default.nix4
-rw-r--r--pkgs/development/python-modules/camel-converter/default.nix37
-rw-r--r--pkgs/development/python-modules/cassandra-driver/default.nix4
-rw-r--r--pkgs/development/python-modules/catkin-pkg/default.nix45
-rw-r--r--pkgs/development/python-modules/certifi/default.nix4
-rw-r--r--pkgs/development/python-modules/certifi/env.patch25
-rw-r--r--pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix4
-rw-r--r--pkgs/development/python-modules/chalice/default.nix8
-rw-r--r--pkgs/development/python-modules/chart-studio/default.nix2
-rw-r--r--pkgs/development/python-modules/clarifai/default.nix4
-rw-r--r--pkgs/development/python-modules/clickhouse-cityhash/default.nix4
-rw-r--r--pkgs/development/python-modules/clickhouse-connect/default.nix4
-rw-r--r--pkgs/development/python-modules/clickhouse-driver/default.nix4
-rw-r--r--pkgs/development/python-modules/cloudpathlib/default.nix5
-rw-r--r--pkgs/development/python-modules/cloudsmith-api/default.nix4
-rw-r--r--pkgs/development/python-modules/colorcet/default.nix16
-rw-r--r--pkgs/development/python-modules/consonance/default.nix10
-rw-r--r--pkgs/development/python-modules/cpyparsing/default.nix4
-rw-r--r--pkgs/development/python-modules/craft-application/default.nix114
-rw-r--r--pkgs/development/python-modules/craft-providers/default.nix5
-rw-r--r--pkgs/development/python-modules/craft-providers/inject-snaps.patch2
-rw-r--r--pkgs/development/python-modules/cypari2/default.nix4
-rw-r--r--pkgs/development/python-modules/cysignals/default.nix4
-rw-r--r--pkgs/development/python-modules/cython/0.nix91
-rw-r--r--pkgs/development/python-modules/cython/default.nix28
-rw-r--r--pkgs/development/python-modules/cytoolz/default.nix14
-rw-r--r--pkgs/development/python-modules/daqp/default.nix5
-rw-r--r--pkgs/development/python-modules/dask-mpi/default.nix10
-rw-r--r--pkgs/development/python-modules/dask/default.nix20
-rw-r--r--pkgs/development/python-modules/dbus-fast/default.nix4
-rw-r--r--pkgs/development/python-modules/deal/default.nix4
-rw-r--r--pkgs/development/python-modules/demes/default.nix9
-rw-r--r--pkgs/development/python-modules/detect-secrets/default.nix9
-rw-r--r--pkgs/development/python-modules/devtools/default.nix5
-rw-r--r--pkgs/development/python-modules/dirigera/default.nix4
-rw-r--r--pkgs/development/python-modules/django/4.nix8
-rw-r--r--pkgs/development/python-modules/django/5.nix8
-rw-r--r--pkgs/development/python-modules/djangorestframework/default.nix9
-rw-r--r--pkgs/development/python-modules/dtlssocket/default.nix4
-rw-r--r--pkgs/development/python-modules/editdistance/default.nix4
-rw-r--r--pkgs/development/python-modules/editdistpy/default.nix10
-rw-r--r--pkgs/development/python-modules/exceptiongroup/default.nix6
-rw-r--r--pkgs/development/python-modules/falcon/default.nix9
-rw-r--r--pkgs/development/python-modules/fastapi-sso/default.nix4
-rw-r--r--pkgs/development/python-modules/fastjsonschema/default.nix17
-rw-r--r--pkgs/development/python-modules/favicon/default.nix8
-rw-r--r--pkgs/development/python-modules/fiona/default.nix4
-rw-r--r--pkgs/development/python-modules/flaky/default.nix12
-rw-r--r--pkgs/development/python-modules/flexmock/default.nix15
-rw-r--r--pkgs/development/python-modules/flow-record/default.nix5
-rw-r--r--pkgs/development/python-modules/fonttools/default.nix5
-rw-r--r--pkgs/development/python-modules/fpylll/default.nix4
-rw-r--r--pkgs/development/python-modules/frozenlist/default.nix4
-rw-r--r--pkgs/development/python-modules/fugashi/default.nix4
-rw-r--r--pkgs/development/python-modules/gbinder-python/default.nix4
-rw-r--r--pkgs/development/python-modules/gevent/default.nix10
-rw-r--r--pkgs/development/python-modules/gios/default.nix19
-rw-r--r--pkgs/development/python-modules/githubkit/default.nix57
-rw-r--r--pkgs/development/python-modules/google-cloud-bigquery/default.nix74
-rw-r--r--pkgs/development/python-modules/google-generativeai/default.nix4
-rw-r--r--pkgs/development/python-modules/graphene-django/default.nix22
-rw-r--r--pkgs/development/python-modules/graphene/default.nix5
-rw-r--r--pkgs/development/python-modules/green/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-health-checking/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-reflection/default.nix4
-rw-r--r--pkgs/development/python-modules/h5py/default.nix4
-rw-r--r--pkgs/development/python-modules/hatchling/default.nix4
-rw-r--r--pkgs/development/python-modules/hid-parser/default.nix8
-rw-r--r--pkgs/development/python-modules/hidapi/default.nix8
-rw-r--r--pkgs/development/python-modules/homematicip/default.nix5
-rw-r--r--pkgs/development/python-modules/hypothesis/default.nix4
-rw-r--r--pkgs/development/python-modules/in-n-out/default.nix4
-rw-r--r--pkgs/development/python-modules/influxdb3-python/default.nix33
-rw-r--r--pkgs/development/python-modules/ipyniivue/default.nix21
-rw-r--r--pkgs/development/python-modules/ipython/default.nix38
-rw-r--r--pkgs/development/python-modules/ipyvue/default.nix4
-rw-r--r--pkgs/development/python-modules/ipywidgets/default.nix9
-rw-r--r--pkgs/development/python-modules/isort/default.nix4
-rw-r--r--pkgs/development/python-modules/item-synchronizer/default.nix43
-rw-r--r--pkgs/development/python-modules/itemdb/default.nix4
-rw-r--r--pkgs/development/python-modules/itemloaders/default.nix23
-rw-r--r--pkgs/development/python-modules/jaraco-test/default.nix5
-rw-r--r--pkgs/development/python-modules/jedi-language-server/default.nix6
-rw-r--r--pkgs/development/python-modules/json-tricks/default.nix8
-rw-r--r--pkgs/development/python-modules/jupyter-collaboration/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter-lsp/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter-server-fileid/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter-server/default.nix4
-rw-r--r--pkgs/development/python-modules/kivy/default.nix4
-rw-r--r--pkgs/development/python-modules/kombu/default.nix9
-rw-r--r--pkgs/development/python-modules/lacuscore/default.nix4
-rw-r--r--pkgs/development/python-modules/levenshtein/default.nix4
-rw-r--r--pkgs/development/python-modules/libgpuarray/default.nix4
-rw-r--r--pkgs/development/python-modules/librouteros/default.nix9
-rw-r--r--pkgs/development/python-modules/lightning-utilities/default.nix5
-rw-r--r--pkgs/development/python-modules/line-profiler/default.nix4
-rw-r--r--pkgs/development/python-modules/litellm/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-embeddings-openai/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-llms-openai/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix4
-rw-r--r--pkgs/development/python-modules/llfuse/default.nix4
-rw-r--r--pkgs/development/python-modules/lupa/default.nix4
-rw-r--r--pkgs/development/python-modules/lxml/default.nix4
-rw-r--r--pkgs/development/python-modules/lz4/default.nix14
-rw-r--r--pkgs/development/python-modules/maestral/default.nix17
-rw-r--r--pkgs/development/python-modules/mailchecker/default.nix23
-rw-r--r--pkgs/development/python-modules/marshmallow-enum/default.nix25
-rw-r--r--pkgs/development/python-modules/matchpy/default.nix10
-rw-r--r--pkgs/development/python-modules/mdformat-admon/default.nix4
-rw-r--r--pkgs/development/python-modules/mdtraj/default.nix4
-rw-r--r--pkgs/development/python-modules/mechanize/default.nix9
-rw-r--r--pkgs/development/python-modules/memory-allocator/default.nix4
-rw-r--r--pkgs/development/python-modules/mido/default.nix34
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix6
-rw-r--r--pkgs/development/python-modules/moto/default.nix10
-rw-r--r--pkgs/development/python-modules/ndindex/default.nix9
-rw-r--r--pkgs/development/python-modules/nettigo-air-monitor/default.nix43
-rw-r--r--pkgs/development/python-modules/nextdns/default.nix40
-rw-r--r--pkgs/development/python-modules/nibabel/default.nix9
-rw-r--r--pkgs/development/python-modules/nipy/default.nix4
-rw-r--r--pkgs/development/python-modules/nocasedict/default.nix8
-rw-r--r--pkgs/development/python-modules/nocaselist/default.nix8
-rw-r--r--pkgs/development/python-modules/notebook/default.nix4
-rw-r--r--pkgs/development/python-modules/numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/nvchecker/default.nix12
-rw-r--r--pkgs/development/python-modules/oelint-parser/default.nix4
-rw-r--r--pkgs/development/python-modules/ondilo/default.nix29
-rw-r--r--pkgs/development/python-modules/openai-triton/default.nix3
-rw-r--r--pkgs/development/python-modules/openapi-core/default.nix5
-rw-r--r--pkgs/development/python-modules/openpyxl/default.nix4
-rw-r--r--pkgs/development/python-modules/openstacksdk/default.nix4
-rw-r--r--pkgs/development/python-modules/openstep-plist/default.nix28
-rw-r--r--pkgs/development/python-modules/openusd/default.nix9
-rw-r--r--pkgs/development/python-modules/oracledb/default.nix4
-rw-r--r--pkgs/development/python-modules/palace/default.nix27
-rw-r--r--pkgs/development/python-modules/pandas/default.nix4
-rw-r--r--pkgs/development/python-modules/papermill/default.nix9
-rw-r--r--pkgs/development/python-modules/paramiko/default.nix9
-rw-r--r--pkgs/development/python-modules/periodiq/default.nix1
-rw-r--r--pkgs/development/python-modules/pint/default.nix6
-rw-r--r--pkgs/development/python-modules/playwrightcapture/default.nix4
-rw-r--r--pkgs/development/python-modules/plexapi/default.nix4
-rw-r--r--pkgs/development/python-modules/plugwise/default.nix47
-rw-r--r--pkgs/development/python-modules/pmdarima/default.nix8
-rw-r--r--pkgs/development/python-modules/pook/default.nix5
-rw-r--r--pkgs/development/python-modules/pplpy/default.nix4
-rw-r--r--pkgs/development/python-modules/prefixed/default.nix4
-rw-r--r--pkgs/development/python-modules/primecountpy/default.nix4
-rw-r--r--pkgs/development/python-modules/protobuf/3.nix3
-rw-r--r--pkgs/development/python-modules/protobuf/default.nix5
-rw-r--r--pkgs/development/python-modules/proton-core/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-keyring-linux/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-vpn-api-core/default.nix6
-rw-r--r--pkgs/development/python-modules/proton-vpn-connection/default.nix4
-rw-r--r--pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-vpn-killswitch/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-vpn-network-manager/default.nix4
-rw-r--r--pkgs/development/python-modules/proton-vpn-session/default.nix4
-rw-r--r--pkgs/development/python-modules/proxy-py/default.nix90
-rw-r--r--pkgs/development/python-modules/psd-tools/default.nix8
-rw-r--r--pkgs/development/python-modules/psycopg/default.nix4
-rw-r--r--pkgs/development/python-modules/publicsuffixlist/default.nix4
-rw-r--r--pkgs/development/python-modules/pulsectl-asyncio/default.nix33
-rw-r--r--pkgs/development/python-modules/py-libzfs/default.nix4
-rw-r--r--pkgs/development/python-modules/py-partiql-parser/default.nix10
-rw-r--r--pkgs/development/python-modules/pyarrow/default.nix4
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix22
-rw-r--r--pkgs/development/python-modules/pydantic/1.nix9
-rw-r--r--pkgs/development/python-modules/pydash/default.nix5
-rw-r--r--pkgs/development/python-modules/pyenphase/default.nix45
-rw-r--r--pkgs/development/python-modules/pyfftw/default.nix4
-rw-r--r--pkgs/development/python-modules/pyfuse3/default.nix4
-rw-r--r--pkgs/development/python-modules/pygame-sdl2/default.nix4
-rw-r--r--pkgs/development/python-modules/pygame/default.nix4
-rw-r--r--pkgs/development/python-modules/pygeos/default.nix4
-rw-r--r--pkgs/development/python-modules/pykdtree/default.nix4
-rw-r--r--pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix4
-rw-r--r--pkgs/development/python-modules/pyliblo/default.nix6
-rw-r--r--pkgs/development/python-modules/pylint/default.nix4
-rw-r--r--pkgs/development/python-modules/pylitterbot/default.nix4
-rw-r--r--pkgs/development/python-modules/pymeeus/default.nix18
-rw-r--r--pkgs/development/python-modules/pympler/default.nix7
-rw-r--r--pkgs/development/python-modules/pyopengl-accelerate/default.nix4
-rw-r--r--pkgs/development/python-modules/pyowm/default.nix52
-rw-r--r--pkgs/development/python-modules/pyqtdarktheme/add-missing-argument-to-the-proxy-style-initializer.patch25
-rw-r--r--pkgs/development/python-modules/pyqtdarktheme/default.nix70
-rw-r--r--pkgs/development/python-modules/pyreadstat/default.nix4
-rw-r--r--pkgs/development/python-modules/pyrevolve/default.nix4
-rw-r--r--pkgs/development/python-modules/pysam/default.nix4
-rw-r--r--pkgs/development/python-modules/pysiaalarm/default.nix5
-rw-r--r--pkgs/development/python-modules/pysolcast/default.nix46
-rw-r--r--pkgs/development/python-modules/pystemmer/default.nix37
-rw-r--r--pkgs/development/python-modules/pytest-asyncio/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-doctestplus/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-factoryboy/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-snapshot/default.nix5
-rw-r--r--pkgs/development/python-modules/pytest-unordered/default.nix5
-rw-r--r--pkgs/development/python-modules/pytest/default.nix4
-rw-r--r--pkgs/development/python-modules/python-apt/default.nix38
-rw-r--r--pkgs/development/python-modules/python-box/default.nix4
-rw-r--r--pkgs/development/python-modules/python-i18n/default.nix10
-rw-r--r--pkgs/development/python-modules/python-openems/default.nix5
-rw-r--r--pkgs/development/python-modules/python-rtmidi/default.nix4
-rw-r--r--pkgs/development/python-modules/python-zbar/0001-python-enum-fix-build-for-Python-3.11.patch61
-rw-r--r--pkgs/development/python-modules/python-zbar/default.nix27
-rw-r--r--pkgs/development/python-modules/pyyaml/default.nix4
-rw-r--r--pkgs/development/python-modules/pyzmq/default.nix4
-rw-r--r--pkgs/development/python-modules/qtile-extras/default.nix62
-rw-r--r--pkgs/development/python-modules/qtile/default.nix6
-rw-r--r--pkgs/development/python-modules/quart/default.nix4
-rw-r--r--pkgs/development/python-modules/qutip/default.nix4
-rw-r--r--pkgs/development/python-modules/rangehttpserver/default.nix4
-rw-r--r--pkgs/development/python-modules/rapidfuzz/default.nix4
-rw-r--r--pkgs/development/python-modules/rasterio/default.nix4
-rw-r--r--pkgs/development/python-modules/razdel/default.nix4
-rw-r--r--pkgs/development/python-modules/rdflib/default.nix5
-rw-r--r--pkgs/development/python-modules/reproject/default.nix4
-rw-r--r--pkgs/development/python-modules/result/default.nix17
-rw-r--r--pkgs/development/python-modules/rpyc/default.nix4
-rw-r--r--pkgs/development/python-modules/rtmidi-python/default.nix4
-rw-r--r--pkgs/development/python-modules/rustworkx/default.nix6
-rw-r--r--pkgs/development/python-modules/scikit-fuzzy/default.nix27
-rw-r--r--pkgs/development/python-modules/scikit-hep-testdata/default.nix4
-rw-r--r--pkgs/development/python-modules/scikit-learn/default.nix13
-rw-r--r--pkgs/development/python-modules/scipy/default.nix36
-rw-r--r--pkgs/development/python-modules/scipy/pocketfft-aligned_alloc.patch30
-rw-r--r--pkgs/development/python-modules/seabreeze/default.nix4
-rw-r--r--pkgs/development/python-modules/setuptools/default.nix4
-rw-r--r--pkgs/development/python-modules/sfepy/default.nix7
-rw-r--r--pkgs/development/python-modules/shapely/1.8.nix4
-rw-r--r--pkgs/development/python-modules/shapely/default.nix4
-rw-r--r--pkgs/development/python-modules/shlib/default.nix18
-rw-r--r--pkgs/development/python-modules/smart-open/default.nix5
-rw-r--r--pkgs/development/python-modules/smpp-pdu/default.nix (renamed from pkgs/development/python-modules/smpp.pdu/default.nix)2
-rw-r--r--pkgs/development/python-modules/snorkel/default.nix4
-rw-r--r--pkgs/development/python-modules/soxr/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy/annotation-test/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy/default.nix2
-rw-r--r--pkgs/development/python-modules/sparse/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix10
-rw-r--r--pkgs/development/python-modules/sqlmodel/default.nix4
-rw-r--r--pkgs/development/python-modules/srpenergy/default.nix23
-rw-r--r--pkgs/development/python-modules/srsly/default.nix4
-rw-r--r--pkgs/development/python-modules/starlette/default.nix19
-rw-r--r--pkgs/development/python-modules/std-uritemplate/default.nix4
-rw-r--r--pkgs/development/python-modules/taskw-ng/default.nix56
-rw-r--r--pkgs/development/python-modules/taskw/default.nix32
-rw-r--r--pkgs/development/python-modules/tencentcloud-sdk-python/default.nix4
-rw-r--r--pkgs/development/python-modules/textnets/default.nix4
-rw-r--r--pkgs/development/python-modules/thinc/default.nix4
-rw-r--r--pkgs/development/python-modules/timetagger/default.nix4
-rw-r--r--pkgs/development/python-modules/tokenizers/Cargo.lock556
-rw-r--r--pkgs/development/python-modules/tokenizers/default.nix20
-rw-r--r--pkgs/development/python-modules/toolz/default.nix5
-rw-r--r--pkgs/development/python-modules/torchsde/default.nix8
-rw-r--r--pkgs/development/python-modules/traitlets/default.nix5
-rw-r--r--pkgs/development/python-modules/transformers/default.nix11
-rw-r--r--pkgs/development/python-modules/trimesh/default.nix4
-rw-r--r--pkgs/development/python-modules/twilio/default.nix4
-rw-r--r--pkgs/development/python-modules/txtai/default.nix4
-rw-r--r--pkgs/development/python-modules/types-psycopg2/default.nix4
-rw-r--r--pkgs/development/python-modules/uamqp/default.nix4
-rw-r--r--pkgs/development/python-modules/uarray/default.nix42
-rw-r--r--pkgs/development/python-modules/uharfbuzz/default.nix4
-rw-r--r--pkgs/development/python-modules/unearth/default.nix4
-rw-r--r--pkgs/development/python-modules/unidata-blocks/default.nix4
-rw-r--r--pkgs/development/python-modules/uuid/default.nix17
-rw-r--r--pkgs/development/python-modules/uvloop/default.nix4
-rw-r--r--pkgs/development/python-modules/vine/default.nix6
-rw-r--r--pkgs/development/python-modules/vispy/default.nix4
-rw-r--r--pkgs/development/python-modules/vt-py/default.nix44
-rw-r--r--pkgs/development/python-modules/wikipedia2vec/default.nix6
-rw-r--r--pkgs/development/python-modules/xmlschema/default.nix4
-rw-r--r--pkgs/development/python-modules/yarl/default.nix4
-rw-r--r--pkgs/development/python-modules/yowsup/default.nix5
-rw-r--r--pkgs/development/python-modules/zeroconf/default.nix4
-rw-r--r--pkgs/development/r-modules/bioc-packages.nix2
-rw-r--r--pkgs/development/r-modules/default.nix39
-rw-r--r--pkgs/development/r-modules/patches/rgoslin.patch12
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/analysis/binlore/default.nix11
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/analysis/cppcheck/default.nix4
-rw-r--r--pkgs/development/tools/castxml/default.nix4
-rw-r--r--pkgs/development/tools/coder/default.nix32
-rwxr-xr-xpkgs/development/tools/coder/update.sh49
-rw-r--r--pkgs/development/tools/continuous-integration/cirrus-cli/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/codeberg-pages/default.nix8
-rw-r--r--pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch9
-rw-r--r--pkgs/development/tools/continuous-integration/jenkins/default.nix8
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix6
-rw-r--r--pkgs/development/tools/database/sqlfluff/default.nix4
-rw-r--r--pkgs/development/tools/electron/binary/default.nix28
-rw-r--r--pkgs/development/tools/electron/common.nix24
-rw-r--r--pkgs/development/tools/electron/info.json12
-rw-r--r--pkgs/development/tools/go-minimock/default.nix6
-rw-r--r--pkgs/development/tools/infisical/default.nix2
-rw-r--r--pkgs/development/tools/infisical/hashes.json8
-rw-r--r--pkgs/development/tools/kubeswitch/default.nix4
-rw-r--r--pkgs/development/tools/language-servers/ccls/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/dune/3.nix4
-rw-r--r--pkgs/development/tools/parsing/re-flex/default.nix4
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/Cargo.lock1935
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/default.nix32
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/fix-paths.patch13
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bash.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json6
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/update.nix10
-rw-r--r--pkgs/development/tools/renderdoc/default.nix4
-rw-r--r--pkgs/development/tools/ruff/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-dist/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-modules/default.nix31
-rw-r--r--pkgs/development/tools/rust/cargo-show-asm/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-spellcheck/default.nix5
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/tools/rust/svd2rust/default.nix6
-rw-r--r--pkgs/development/tools/rust/typeshare/default.nix6
-rw-r--r--pkgs/development/tools/sqldef/default.nix6
-rw-r--r--pkgs/development/tools/steamos-devkit/default.nix2
-rw-r--r--pkgs/development/tools/supabase-cli/default.nix6
-rw-r--r--pkgs/development/tools/twilio-cli/default.nix4
-rw-r--r--pkgs/development/tools/typos/default.nix6
-rw-r--r--pkgs/development/tools/vsce/default.nix6
-rw-r--r--pkgs/development/web/flyctl/default.nix6
-rw-r--r--pkgs/development/web/function-runner/default.nix6
-rw-r--r--pkgs/development/web/nodejs/v20.nix4
-rw-r--r--pkgs/games/gogui/default.nix45
-rw-r--r--pkgs/games/shattered-pixel-dungeon/rkpd2.nix4
-rw-r--r--pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh2
-rw-r--r--pkgs/kde/frameworks/ki18n/default.nix3
-rw-r--r--pkgs/misc/screensavers/slock/default.nix11
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix6
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/sdkRoot.nix68
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix23
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix2
-rw-r--r--pkgs/os-specific/darwin/binutils/default.nix85
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix4
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix4
-rw-r--r--pkgs/os-specific/linux/dbus-broker/default.nix4
-rw-r--r--pkgs/os-specific/linux/dbus-broker/disable-test.patch23
-rw-r--r--pkgs/os-specific/linux/earlyoom/default.nix38
-rw-r--r--pkgs/os-specific/linux/ell/default.nix4
-rw-r--r--pkgs/os-specific/linux/fw-ectool/default.nix33
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix14
-rw-r--r--pkgs/os-specific/linux/kernel/rust-1.77.patch792
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix8
-rw-r--r--pkgs/os-specific/linux/kexec-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix3
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh8
-rw-r--r--pkgs/os-specific/linux/pam/default.nix9
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix7
-rw-r--r--pkgs/os-specific/linux/upower/default.nix9
-rw-r--r--pkgs/pkgs-lib/formats/hocon/default.nix2
-rw-r--r--pkgs/servers/deconz/default.nix11
-rw-r--r--pkgs/servers/dns/knot-resolver/default.nix9
-rw-r--r--pkgs/servers/dns/trust-dns/default.nix4
-rw-r--r--pkgs/servers/elasticmq-server-bin/default.nix4
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix2
-rw-r--r--pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix4
-rw-r--r--pkgs/servers/home-assistant/custom-components/default.nix6
-rw-r--r--pkgs/servers/home-assistant/custom-components/miele/default.nix4
-rw-r--r--pkgs/servers/home-assistant/custom-components/smartir/default.nix38
-rw-r--r--pkgs/servers/home-assistant/custom-components/xiaomi_gateway3/default.nix32
-rw-r--r--pkgs/servers/home-assistant/custom-components/xiaomi_miot/default.nix38
-rw-r--r--pkgs/servers/home-assistant/default.nix10
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rwxr-xr-xpkgs/servers/home-assistant/parse-requirements.py2
-rw-r--r--pkgs/servers/home-assistant/stubs.nix4
-rwxr-xr-xpkgs/servers/home-assistant/update.py2
-rw-r--r--pkgs/servers/hylafaxplus/default.nix4
-rw-r--r--pkgs/servers/hylafaxplus/libtiff-4.patch4
-rw-r--r--pkgs/servers/klipper/default.nix6
-rw-r--r--pkgs/servers/memcached/default.nix4
-rw-r--r--pkgs/servers/minio/default.nix6
-rw-r--r--pkgs/servers/misc/irrd/default.nix3
-rw-r--r--pkgs/servers/monitoring/unpoller/default.nix6
-rw-r--r--pkgs/servers/pocketbase/default.nix6
-rw-r--r--pkgs/servers/radarr/default.nix10
-rw-r--r--pkgs/servers/radicale/3.x.nix7
-rw-r--r--pkgs/servers/redpanda/default.nix6
-rw-r--r--pkgs/servers/samba/4.x.nix33
-rw-r--r--pkgs/servers/sql/postgresql/ext/citus.nix2
-rw-r--r--pkgs/servers/sql/postgresql/ext/pg_bigm.nix2
-rw-r--r--pkgs/servers/sunshine/default.nix6
-rw-r--r--pkgs/servers/web-apps/changedetection-io/default.nix6
-rw-r--r--pkgs/servers/web-apps/kavita/change-webroot.diff22
-rw-r--r--pkgs/servers/web-apps/kavita/default.nix6
-rw-r--r--pkgs/servers/web-apps/kavita/nuget-deps.nix142
-rw-r--r--pkgs/servers/x11/xorg/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list2
-rw-r--r--pkgs/shells/bash/bash-completion/default.nix4
-rw-r--r--pkgs/shells/hishtory/default.nix4
-rw-r--r--pkgs/shells/nushell/plugins/formats.nix7
-rw-r--r--pkgs/shells/nushell/plugins/gstat.nix7
-rw-r--r--pkgs/shells/nushell/plugins/query.nix5
-rw-r--r--pkgs/stdenv/adapters.nix130
-rw-r--r--pkgs/stdenv/darwin/bootstrap-files/aarch64-apple-darwin.nix30
-rw-r--r--pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix30
-rw-r--r--pkgs/stdenv/darwin/default.nix127
-rw-r--r--pkgs/stdenv/darwin/make-bootstrap-tools.nix4
-rw-r--r--pkgs/stdenv/darwin/override-sdk.nix437
-rw-r--r--pkgs/stdenv/darwin/unpack-bootstrap-tools-aarch64.sh57
-rw-r--r--pkgs/stdenv/darwin/unpack-bootstrap-tools.sh54
-rw-r--r--pkgs/stdenv/generic/setup.sh7
-rw-r--r--pkgs/stdenv/linux/default.nix36
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix5
-rw-r--r--pkgs/tools/admin/copilot-cli/default.nix6
-rw-r--r--pkgs/tools/admin/credhub-cli/default.nix4
-rw-r--r--pkgs/tools/admin/mycli/default.nix7
-rw-r--r--pkgs/tools/admin/pulumi-packages/base.nix8
-rw-r--r--pkgs/tools/admin/pulumi-packages/default.nix1
-rw-r--r--pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix27
-rw-r--r--pkgs/tools/audio/beets/builtin-plugins.nix3
-rw-r--r--pkgs/tools/audio/beets/default.nix6
-rw-r--r--pkgs/tools/audio/headsetcontrol/default.nix17
-rw-r--r--pkgs/tools/audio/yabridge/default.nix10
-rw-r--r--pkgs/tools/audio/yabridge/hardcode-dependencies.patch15
-rw-r--r--pkgs/tools/backup/borgbackup/default.nix42
-rw-r--r--pkgs/tools/backup/zfs-replicate/default.nix4
-rw-r--r--pkgs/tools/bootloaders/refind/default.nix2
-rw-r--r--pkgs/tools/compression/zstd/default.nix4
-rw-r--r--pkgs/tools/filesystems/ceph/default.nix6
-rw-r--r--pkgs/tools/filesystems/mount-zip/default.nix4
-rw-r--r--pkgs/tools/inputmethods/keymapper/default.nix4
-rw-r--r--pkgs/tools/misc/coreutils/default.nix15
-rw-r--r--pkgs/tools/misc/coreutils/fix-test-failure-musl.patch23
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/fastfetch/default.nix4
-rw-r--r--pkgs/tools/misc/leanify/default.nix11
-rw-r--r--pkgs/tools/misc/man-db/default.nix4
-rw-r--r--pkgs/tools/misc/markdown-anki-decks/default.nix17
-rw-r--r--pkgs/tools/misc/phrase-cli/default.nix6
-rw-r--r--pkgs/tools/misc/plocate/default.nix3
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/misc/thefuck/default.nix4
-rw-r--r--pkgs/tools/networking/curl/default.nix7
-rw-r--r--pkgs/tools/networking/dnsproxy/default.nix6
-rw-r--r--pkgs/tools/networking/frp/default.nix6
-rw-r--r--pkgs/tools/networking/juicity/default.nix4
-rw-r--r--pkgs/tools/networking/knock/package.nix13
-rw-r--r--pkgs/tools/networking/libreswan/default.nix13
-rw-r--r--pkgs/tools/networking/minio-client/default.nix6
-rw-r--r--pkgs/tools/networking/ockam/default.nix27
-rw-r--r--pkgs/tools/networking/openapi-generator-cli/default.nix4
-rw-r--r--pkgs/tools/networking/unbound/default.nix29
-rw-r--r--pkgs/tools/nix/nixci/default.nix20
-rw-r--r--pkgs/tools/package-management/nix/common.nix2
-rw-r--r--pkgs/tools/package-management/rpm/default.nix2
-rw-r--r--pkgs/tools/security/afl/README.md19
-rw-r--r--pkgs/tools/security/afl/default.nix82
-rw-r--r--pkgs/tools/security/afl/libdislocator.nix35
-rw-r--r--pkgs/tools/security/afl/qemu-patches/no-etc-install.patch13
-rw-r--r--pkgs/tools/security/afl/qemu-patches/syscall-glibc2_30.diff51
-rw-r--r--pkgs/tools/security/afl/qemu.nix77
-rw-r--r--pkgs/tools/security/cnspec/default.nix6
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/gnupg/24.nix2
-rw-r--r--pkgs/tools/security/keepwn/default.nix25
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock73
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix130
-rw-r--r--pkgs/tools/security/onlykey-cli/default.nix5
-rw-r--r--pkgs/tools/security/osv-scanner/default.nix17
-rw-r--r--pkgs/tools/security/pomerium-cli/default.nix6
-rw-r--r--pkgs/tools/security/pwdsafety/default.nix25
-rw-r--r--pkgs/tools/security/semgrep/common.nix16
-rw-r--r--pkgs/tools/security/step-kms-plugin/default.nix6
-rw-r--r--pkgs/tools/system/acpica-tools/default.nix15
-rw-r--r--pkgs/tools/system/pciutils/default.nix4
-rw-r--r--pkgs/tools/text/d2/default.nix4
-rw-r--r--pkgs/tools/text/goawk/default.nix4
-rw-r--r--pkgs/tools/text/mdbook-admonish/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-cmdrun/default.nix28
-rw-r--r--pkgs/tools/text/mdbook-d2/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-emojicodes/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-epub/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-footnote/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-graphviz/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-i18n-helpers/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-katex/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-kroki-preprocessor/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-linkcheck/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-mermaid/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-pagetoc/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-pdf/default.nix2
-rw-r--r--pkgs/tools/text/mdbook-plantuml/default.nix2
-rw-r--r--pkgs/tools/text/ov/default.nix6
-rw-r--r--pkgs/tools/text/vale/default.nix32
-rw-r--r--pkgs/tools/text/vale/styles.nix144
-rw-r--r--pkgs/tools/typesetting/tex/texpresso/default.nix6
-rw-r--r--pkgs/tools/virtualization/cloud-init/default.nix2
-rw-r--r--pkgs/tools/virtualization/govc/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix128
-rw-r--r--pkgs/top-level/config.nix2
-rw-r--r--pkgs/top-level/cuda-packages.nix2
-rw-r--r--pkgs/top-level/linux-kernels.nix2
-rw-r--r--pkgs/top-level/make-tarball.nix3
-rw-r--r--pkgs/top-level/nixpkgs-basic-release-checks.nix4
-rw-r--r--pkgs/top-level/ocaml-packages.nix36
-rw-r--r--pkgs/top-level/python-aliases.nix3
-rw-r--r--pkgs/top-level/python-packages.nix39
-rw-r--r--pkgs/top-level/release.nix4
1133 files changed, 18559 insertions, 10932 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index aff7aee0f797f..7ddc221d21c10 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -185,17 +185,17 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /lib/licenses.nix @alyssais
 
 # Qt
-/pkgs/development/libraries/qt-5 @NixOS/qt-kde
-/pkgs/development/libraries/qt-6 @NixOS/qt-kde
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE / Plasma 5
-/pkgs/applications/kde @NixOS/qt-kde
-/pkgs/desktops/plasma-5 @NixOS/qt-kde
-/pkgs/development/libraries/kde-frameworks @NixOS/qt-kde
+/pkgs/applications/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/desktops/plasma-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE / Plasma 6
-/pkgs/kde @NixOS/qt-kde
-/maintainers/scripts/kde @NixOS/qt-kde
+/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # PostgreSQL and related stuff
 /pkgs/servers/sql/postgresql @thoughtpolice @marsam
@@ -298,7 +298,7 @@ nixos/modules/services/networking/networkmanager.nix @Janik-Haag
 
 # GNOME
 /pkgs/desktops/gnome                              @jtojnar
-/pkgs/desktops/gnome/extensions       @piegamesde @jtojnar
+/pkgs/desktops/gnome/extensions                   @jtojnar
 /pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
 
 # Cinnamon
diff --git a/.github/workflows/basic-eval.yml b/.github/workflows/basic-eval.yml
index 9008ca208e174..04e74f774c2ec 100644
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@@ -26,4 +26,4 @@ jobs:
         name: nixpkgs-ci
         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
     # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
-    - run: nix-build pkgs/top-level/release.nix -A tarball.nixpkgs-basic-release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'
+    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'
diff --git a/doc/README.md b/doc/README.md
index 1e9305d040ba4..41afc090b3740 100644
--- a/doc/README.md
+++ b/doc/README.md
@@ -106,12 +106,12 @@ This is a warning
 
 The following are supported:
 
-- [`caution`](https://tdg.docbook.org/tdg/5.0/caution.html)
-- [`important`](https://tdg.docbook.org/tdg/5.0/important.html)
-- [`note`](https://tdg.docbook.org/tdg/5.0/note.html)
-- [`tip`](https://tdg.docbook.org/tdg/5.0/tip.html)
-- [`warning`](https://tdg.docbook.org/tdg/5.0/warning.html)
-- [`example`](https://tdg.docbook.org/tdg/5.0/example.html)
+- `caution`
+- `important`
+- `note`
+- `tip`
+- `warning`
+- `example`
 
 Example admonitions require a title to work.
 If you don't provide one, the manual won't be built.
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index f325af0641f68..3b737333308da 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -497,40 +497,6 @@ are used in [`buildPythonPackage`](#buildpythonpackage-function).
   with the `pipInstallHook`.
 - `unittestCheckHook` will run tests with `python -m unittest discover`. See [example usage](#using-unittestcheckhook).
 
-### Development mode {#development-mode}
-
-Development or editable mode is supported. To develop Python packages
-[`buildPythonPackage`](#buildpythonpackage-function) has additional logic inside `shellPhase` to run `pip
-install -e . --prefix $TMPDIR/`for the package.
-
-Warning: `shellPhase` is executed only if `setup.py` exists.
-
-Given a `default.nix`:
-
-```nix
-with import <nixpkgs> {};
-
-python3Packages.buildPythonPackage {
-  name = "myproject";
-  buildInputs = with python3Packages; [ pyramid ];
-
-  src = ./.;
-}
-```
-
-Running `nix-shell` with no arguments should give you the environment in which
-the package would be built with `nix-build`.
-
-Shortcut to setup environments with C headers/libraries and Python packages:
-
-```shell
-nix-shell -p python3Packages.pyramid zlib libjpeg git
-```
-
-::: {.note}
-There is a boolean value `lib.inNixShell` set to `true` if nix-shell is invoked.
-:::
-
 ## User Guide {#user-guide}
 
 ### Using Python {#using-python}
@@ -867,8 +833,7 @@ Above, we were mostly just focused on use cases and what to do to get started
 creating working Python environments in nix.
 
 Now that you know the basics to be up and running, it is time to take a step
-back and take a deeper look at how Python packages are packaged on Nix. Then,
-we will look at how you can use development mode with your code.
+back and take a deeper look at how Python packages are packaged on Nix.
 
 #### Python library packages in Nixpkgs {#python-library-packages-in-nixpkgs}
 
@@ -1481,45 +1446,6 @@ documentation source root.
 The hook is also available to packages outside the python ecosystem by
 referencing it using `sphinxHook` from top-level.
 
-### Develop local package {#develop-local-package}
-
-As a Python developer you're likely aware of [development mode](http://setuptools.readthedocs.io/en/latest/setuptools.html#development-mode)
-(`python setup.py develop`); instead of installing the package this command
-creates a special link to the project code. That way, you can run updated code
-without having to reinstall after each and every change you make. Development
-mode is also available. Let's see how you can use it.
-
-In the previous Nix expression the source was fetched from a url. We can also
-refer to a local source instead using `src = ./path/to/source/tree;`
-
-If we create a `shell.nix` file which calls [`buildPythonPackage`](#buildpythonpackage-function), and if `src`
-is a local source, and if the local source has a `setup.py`, then development
-mode is activated.
-
-In the following example, we create a simple environment that has a Python 3.11
-version of our package in it, as well as its dependencies and other packages we
-like to have in the environment, all specified with `dependencies`.
-
-```nix
-with import <nixpkgs> {};
-with python311Packages;
-
-buildPythonPackage rec {
-  name = "mypackage";
-  src = ./path/to/package/source;
-  dependencies = [
-    pytest
-    numpy
-  ];
-  propagatedBuildInputs = [
-    pkgs.libsndfile
-  ];
-}
-```
-
-It is important to note that due to how development mode is implemented on Nix
-it is not possible to have multiple packages simultaneously in development mode.
-
 ### Organising your packages {#organising-your-packages}
 
 So far we discussed how you can use Python on Nix, and how you can develop with
diff --git a/doc/using/configuration.chapter.md b/doc/using/configuration.chapter.md
index 252d255de829d..05a8fa5517cc3 100644
--- a/doc/using/configuration.chapter.md
+++ b/doc/using/configuration.chapter.md
@@ -1,6 +1,7 @@
 # Global configuration {#chap-packageconfig}
 
-Nix comes with certain defaults about what packages can and cannot be installed, based on a package's metadata. By default, Nix will prevent installation if any of the following criteria are true:
+Nix comes with certain defaults about which packages can and cannot be installed, based on a package's metadata.
+By default, Nix will prevent installation if any of the following criteria are true:
 
 -   The package is thought to be broken, and has had its `meta.broken` set to `true`.
 
@@ -10,23 +11,14 @@ Nix comes with certain defaults about what packages can and cannot be installed,
 
 -   The package has known security vulnerabilities but has not or can not be updated for some reason, and a list of issues has been entered in to the package's `meta.knownVulnerabilities`.
 
-Note that all this is checked during evaluation already, and the check includes any package that is evaluated. In particular, all build-time dependencies are checked. `nix-env -qa` will (attempt to) hide any packages that would be refused.
+Each of these criteria can be altered in the Nixpkgs configuration.
 
-Each of these criteria can be altered in the nixpkgs configuration.
+:::{.note}
+All this is checked during evaluation already, and the check includes any package that is evaluated.
+In particular, all build-time dependencies are checked.
+:::
 
-The nixpkgs configuration for a NixOS system is set in the `configuration.nix`, as in the following example:
-
-```nix
-{
-  nixpkgs.config = {
-    allowUnfree = true;
-  };
-}
-```
-
-However, this does not allow unfree software for individual users. Their configurations are managed separately.
-
-A user's nixpkgs configuration is stored in a user-specific configuration file located at `~/.config/nixpkgs/config.nix`. For example:
+A user's Nixpkgs configuration is stored in a user-specific configuration file located at `~/.config/nixpkgs/config.nix`. For example:
 
 ```nix
 {
@@ -34,7 +26,10 @@ A user's nixpkgs configuration is stored in a user-specific configuration file l
 }
 ```
 
-Note that we are not able to test or build unfree software on Hydra due to policy. Most unfree licenses prohibit us from either executing or distributing the software.
+:::{.caution}
+Unfree software is not tested or built in Nixpkgs continuous integration, and therefore not cached.
+Most unfree licenses prohibit either executing or distributing the software.
+:::
 
 ## Installing broken packages {#sec-allow-broken}
 
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 49d311ed37b39..83f8d0f34186e 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -5,7 +5,7 @@
 
 let
   inherit (builtins) head length;
-  inherit (lib.trivial) mergeAttrs warn;
+  inherit (lib.trivial) isInOldestRelease mergeAttrs warn warnIf;
   inherit (lib.strings) concatStringsSep concatMapStringsSep escapeNixIdentifier sanitizeDerivationName;
   inherit (lib.lists) foldr foldl' concatMap elemAt all partition groupBy take foldl;
 in
@@ -885,15 +885,15 @@ rec {
     # Type
 
     ```
-    cartesianProductOfSets :: AttrSet -> [AttrSet]
+    cartesianProduct :: AttrSet -> [AttrSet]
     ```
 
     # Examples
     :::{.example}
-    ## `lib.attrsets.cartesianProductOfSets` usage example
+    ## `lib.attrsets.cartesianProduct` usage example
 
     ```nix
-    cartesianProductOfSets { a = [ 1 2 ]; b = [ 10 20 ]; }
+    cartesianProduct { a = [ 1 2 ]; b = [ 10 20 ]; }
     => [
          { a = 1; b = 10; }
          { a = 1; b = 20; }
@@ -904,7 +904,7 @@ rec {
 
     :::
   */
-  cartesianProductOfSets =
+  cartesianProduct =
     attrsOfLists:
     foldl' (listOfAttrs: attrName:
       concatMap (attrs:
@@ -914,6 +914,40 @@ rec {
 
 
   /**
+    Return the result of function f applied to the cartesian product of attribute set value combinations.
+    Equivalent to using cartesianProduct followed by map.
+
+    # Inputs
+
+    `f`
+
+    : A function, given an attribute set, it returns a new value.
+
+    `attrsOfLists`
+
+    : Attribute set with attributes that are lists of values
+
+    # Type
+
+    ```
+    mapCartesianProduct :: (AttrSet -> a) -> AttrSet -> [a]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.attrsets.mapCartesianProduct` usage example
+
+    ```nix
+    mapCartesianProduct ({a, b}: "${a}-${b}") { a = [ "1" "2" ]; b = [ "3" "4" ]; }
+    => [ "1-3" "1-4" "2-3" "2-4" ]
+    ```
+
+    :::
+
+  */
+  mapCartesianProduct = f: attrsOfLists: map f (cartesianProduct attrsOfLists);
+
+  /**
     Utility function that creates a `{name, value}` pair as expected by `builtins.listToAttrs`.
 
 
@@ -1999,4 +2033,8 @@ rec {
   # DEPRECATED
   zip = warn
     "lib.zip is a deprecated alias of lib.zipAttrsWith." zipAttrsWith;
+
+  # DEPRECATED
+  cartesianProductOfSets = warnIf (isInOldestRelease 2405)
+    "lib.cartesianProductOfSets is a deprecated alias of lib.cartesianProduct." cartesianProduct;
 }
diff --git a/lib/default.nix b/lib/default.nix
index 21e4bab2b942b..486d412fbb6fd 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -86,8 +86,8 @@ let
       zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
       recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput
       getBin getLib getDev getMan chooseDevOutputs zipWithNames zip
-      recurseIntoAttrs dontRecurseIntoAttrs cartesianProductOfSets
-      updateManyAttrsByPath;
+      recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
+      mapCartesianProduct updateManyAttrsByPath;
     inherit (self.lists) singleton forEach foldr fold foldl foldl' imap0 imap1
       concatMap flatten remove findSingle findFirst any all count
       optional optionals toList range replicate partition zipListsWith zipLists
diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index ce9afc796a3f9..e29f30251c690 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -1,5 +1,5 @@
 /*
-  <!-- This anchor is here for backwards compatibity -->
+  <!-- This anchor is here for backwards compatibility -->
   []{#sec-fileset}
 
   The [`lib.fileset`](#sec-functions-library-fileset) library allows you to work with _file sets_.
diff --git a/lib/lists.nix b/lib/lists.nix
index c162f921280d2..28fa277b22b1f 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -1688,16 +1688,32 @@ rec {
     ## `lib.lists.crossLists` usage example
 
     ```nix
-    crossLists (x:y: "${toString x}${toString y}") [[1 2] [3 4]]
+    crossLists (x: y: "${toString x}${toString y}") [[1 2] [3 4]]
     => [ "13" "14" "23" "24" ]
     ```
 
+    The following function call is equivalent to the one deprecated above:
+
+    ```nix
+    mapCartesianProduct (x: "${toString x.a}${toString x.b}") { a = [1 2]; b = [3 4]; }
+    => [ "13" "14" "23" "24" ]
+    ```
     :::
   */
   crossLists = warn
-    "lib.crossLists is deprecated, use lib.cartesianProductOfSets instead."
-    (f: foldl (fs: args: concatMap (f: map f args) fs) [f]);
+    ''lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
 
+    For example, the following function call:
+
+    nix-repl> lib.crossLists (x: y: x+y) [[1 2] [3 4]]
+    [ 4 5 5 6 ]
+
+    Can now be replaced by the following one:
+
+    nix-repl> lib.mapCartesianProduct ({x,y}: x+y) { x = [1 2]; y = [3 4]; }
+    [ 4 5 5 6 ]
+    ''
+    (f: foldl (fs: args: concatMap (f: map f args) fs) [f]);
 
   /**
     Remove duplicate elements from the `list`. O(n^2) complexity.
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index accceb4ddf9c1..cf4a185c14689 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -33,7 +33,7 @@ let
     boolToString
     callPackagesWith
     callPackageWith
-    cartesianProductOfSets
+    cartesianProduct
     cli
     composeExtensions
     composeManyExtensions
@@ -71,10 +71,10 @@ let
     makeIncludePath
     makeOverridable
     mapAttrs
+    mapCartesianProduct
     matchAttrs
     mergeAttrs
     meta
-    mkOption
     mod
     nameValuePair
     optionalDrvAttr
@@ -117,7 +117,6 @@ let
     expr = (builtins.tryEval expr).success;
     expected = true;
   };
-  testingDeepThrow = expr: testingThrow (builtins.deepSeq expr expr);
 
   testSanitizeDerivationName = { name, expected }:
   let
@@ -1415,7 +1414,7 @@ runTests {
     };
 
   testToPrettyMultiline = {
-    expr = mapAttrs (const (generators.toPretty { })) rec {
+    expr = mapAttrs (const (generators.toPretty { })) {
       list = [ 3 4 [ false ] ];
       attrs = { foo = null; bar.foo = "baz"; };
       newlinestring = "\n";
@@ -1429,7 +1428,7 @@ runTests {
         there
         test'';
     };
-    expected = rec {
+    expected = {
       list = ''
         [
           3
@@ -1467,13 +1466,10 @@ runTests {
     expected  = "«foo»";
   };
 
-  testToPlist =
-    let
-      deriv = derivation { name = "test"; builder = "/bin/sh"; system = "aarch64-linux"; };
-    in {
+  testToPlist = {
     expr = mapAttrs (const (generators.toPlist { })) {
       value = {
-        nested.values = rec {
+        nested.values = {
           int = 42;
           float = 0.1337;
           bool = true;
@@ -1686,17 +1682,17 @@ runTests {
   };
 
   testCartesianProductOfEmptySet = {
-    expr = cartesianProductOfSets {};
+    expr = cartesianProduct {};
     expected = [ {} ];
   };
 
   testCartesianProductOfOneSet = {
-    expr = cartesianProductOfSets { a = [ 1 2 3 ]; };
+    expr = cartesianProduct { a = [ 1 2 3 ]; };
     expected = [ { a = 1; } { a = 2; } { a = 3; } ];
   };
 
   testCartesianProductOfTwoSets = {
-    expr = cartesianProductOfSets { a = [ 1 ]; b = [ 10 20 ]; };
+    expr = cartesianProduct { a = [ 1 ]; b = [ 10 20 ]; };
     expected = [
       { a = 1; b = 10; }
       { a = 1; b = 20; }
@@ -1704,12 +1700,12 @@ runTests {
   };
 
   testCartesianProductOfTwoSetsWithOneEmpty = {
-    expr = cartesianProductOfSets { a = [ ]; b = [ 10 20 ]; };
+    expr = cartesianProduct { a = [ ]; b = [ 10 20 ]; };
     expected = [ ];
   };
 
   testCartesianProductOfThreeSets = {
-    expr = cartesianProductOfSets {
+    expr = cartesianProduct {
       a = [   1   2   3 ];
       b = [  10  20  30 ];
       c = [ 100 200 300 ];
@@ -1753,6 +1749,30 @@ runTests {
     ];
   };
 
+  testMapCartesianProductOfOneSet = {
+    expr = mapCartesianProduct ({a}: a * 2) { a = [ 1 2 3 ]; };
+    expected = [ 2 4 6 ];
+  };
+
+  testMapCartesianProductOfTwoSets = {
+    expr = mapCartesianProduct ({a,b}: a + b) { a = [ 1 ]; b = [ 10 20 ]; };
+    expected = [ 11 21 ];
+  };
+
+  testMapCartesianProcutOfTwoSetsWithOneEmpty = {
+    expr = mapCartesianProduct (x: x.a + x.b) { a = [ ]; b = [ 10 20 ]; };
+    expected = [ ];
+  };
+
+  testMapCartesianProductOfThreeSets = {
+    expr = mapCartesianProduct ({a,b,c}: a + b + c) {
+      a = [ 1 2 3 ];
+      b = [ 10 20 30 ];
+      c = [ 100 200 300 ];
+    };
+    expected = [ 111 211 311 121 221 321 131 231 331 112 212 312 122 222 322 132 232 332 113 213 313 123 223 323 133 233 333 ];
+  };
+
   # The example from the showAttrPath documentation
   testShowAttrPathExample = {
     expr = showAttrPath [ "foo" "10" "bar" ];
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 36ddea9f5e0d8..018666e7f0105 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -800,6 +800,12 @@
     githubId = 20405311;
     name = "Aksh Gupta";
   };
+  aktaboot = {
+    email = "akhtaboo@protonmail.com";
+    github = "aktaboot";
+    githubId = 120214979;
+    name = "aktaboot";
+  };
   al3xtjames = {
     email = "nix@alextjam.es";
     github = "al3xtjames";
@@ -6456,6 +6462,12 @@
     githubId = 4246921;
     name = "Florian Beeres";
   };
+  fccapria = {
+    email = "francesco@capria.eu";
+    github = "fccapria";
+    githubId = 62179193;
+    name = "Francesco Carmelo Capria";
+  };
   fd = {
     email = "simon.menke@gmail.com";
     github = "fd";
@@ -10523,6 +10535,12 @@
     githubId = 845652;
     name = "Kier Davis";
   };
+  kiike = {
+    email = "me@enric.me";
+    github = "kiike";
+    githubId = 464625;
+    name = "Enric Morales";
+  };
   kilianar = {
     email = "mail@kilianar.de";
     github = "kilianar";
@@ -13394,6 +13412,12 @@
       fingerprint = "64BE BF11 96C3 DD7A 443E  8314 1DC0 82FA DE5B A863";
     }];
   };
+  mlaradji = {
+    name = "Mohamed Laradji";
+    email = "mlaradji@pm.me";
+    github = "mlaradji";
+    githubId = 33703663;
+  };
   mlatus = {
     email = "wqseleven@gmail.com";
     github = "Ninlives";
@@ -14798,6 +14822,12 @@
     githubId = 127548;
     name = "Judson Lester";
   };
+  nyawox = {
+    name = "nyawox";
+    email = "nyawox.git@gmail.com";
+    github = "nyawox";
+    githubId = 93813719;
+  };
   nzbr = {
     email = "nixos@nzbr.de";
     github = "nzbr";
@@ -16683,6 +16713,12 @@
     githubId = 145816;
     name = "David McKay";
   };
+  raylas = {
+    email = "r@raymond.sh";
+    github = "raylas";
+    githubId = 8099415;
+    name = "Raymond Douglas";
+  };
   rayslash = {
     email = "stevemathewjoy@tutanota.com";
     github = "rayslash";
@@ -16925,6 +16961,13 @@
     githubId = 12279531;
     name = "Ricardo Guevara";
   };
+  rhelmot = {
+    name = "Audrey Dutcher";
+    github = "rhelmot";
+    githubId = 2498805;
+    email = "audrey@rhelmot.io";
+    matrix = "@rhelmot:matrix.org";
+  };
   rhendric = {
     name = "Ryan Hendrickson";
     github = "rhendric";
@@ -18120,6 +18163,11 @@
     githubId = 863807;
     name = "Serge Guelton";
   };
+  sergioribera = {
+    github = "SergioRibera";
+    githubId = 56278796;
+    name = "Sergio Ribera";
+  };
   sersorrel = {
     email = "ash@sorrel.sh";
     github = "sersorrel";
@@ -21538,6 +21586,16 @@
       fingerprint = "DA03 D6C6 3F58 E796 AD26  E99B 366A 2940 479A 06FC";
     }];
   };
+  willbush = {
+    email = "git@willbush.dev";
+    matrix = "@willbush:matrix.org";
+    github = "willbush";
+    githubId = 2023546;
+    name = "Will Bush";
+    keys = [{
+      fingerprint = "4441 422E 61E4 C8F3 EBFE  5E33 3823 864B 54B1 3BDA";
+    }];
+  };
   willcohen = {
     github = "willcohen";
     githubId = 5185341;
@@ -22428,6 +22486,12 @@
     githubId = 1108325;
     name = "Théo Zimmermann";
   };
+  zlepper = {
+    name = "Rasmus Hansen";
+    github = "zlepper";
+    githubId = 1499810;
+    email = "hansen13579@gmail.com";
+  };
   zmitchell = {
     name = "Zach Mitchell";
     email = "zmitchell@fastmail.com";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 9389514fcba53..412cafb627d6c 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -575,6 +575,9 @@ with lib.maintainers; {
       rrbutani
       sternenseemann
     ];
+    githubTeams = [
+      "llvm"
+    ];
     scope = "Maintain LLVM package sets and related packages";
     shortName = "LLVM";
     enableFeatureFreezePing = true;
diff --git a/nixos/doc/manual/configuration/customizing-packages.section.md b/nixos/doc/manual/configuration/customizing-packages.section.md
index a524ef266eaff..074932b3f1105 100644
--- a/nixos/doc/manual/configuration/customizing-packages.section.md
+++ b/nixos/doc/manual/configuration/customizing-packages.section.md
@@ -1,11 +1,33 @@
 # Customising Packages {#sec-customising-packages}
 
-Some packages in Nixpkgs have options to enable or disable optional
-functionality or change other aspects of the package.
+The Nixpkgs configuration for a NixOS system is set by the {option}`nixpkgs.config` option.
+
+::::{.example}
+# Globally allow unfree packages
+
+```nix
+{
+  nixpkgs.config = {
+    allowUnfree = true;
+  };
+}
+```
+
+:::{.note}
+This only allows unfree software in the given NixOS configuration.
+For users invoking Nix commands such as [`nix-build`](https://nixos.org/manual/nix/stable/command-ref/nix-build), Nixpkgs is configured independently.
+See the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig) for details.
+:::
+::::
+
+<!-- TODO(@fricklerhandwerk)
+all of the following should go to the Nixpkgs manual, it has nothing to do with NixOS
+-->
+
+Some packages in Nixpkgs have options to enable or disable optional functionality, or change other aspects of the package.
 
 ::: {.warning}
-Unfortunately, Nixpkgs currently lacks a way to query available
-configuration options.
+Unfortunately, Nixpkgs currently lacks a way to query available package configuration options.
 :::
 
 ::: {.note}
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 32d9508e89b17..b8dde9db52da0 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -108,6 +108,8 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - [dnsproxy](https://github.com/AdguardTeam/dnsproxy), a simple DNS proxy with DoH, DoT, DoQ and DNSCrypt support. Available as [services.dnsproxy](#opt-services.dnsproxy.enable).
 
+- [manticoresearch](https://manticoresearch.com), easy to use open source fast database for search. Available as [services.manticore](#opt-services.manticore.enable).
+
 - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.
 
 - [ollama](https://ollama.ai), server for running large language models locally.
@@ -137,6 +139,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [Suwayomi Server](https://github.com/Suwayomi/Suwayomi-Server), a free and open source manga reader server that runs extensions built for [Tachiyomi](https://tachiyomi.org). Available as [services.suwayomi-server](#opt-services.suwayomi-server.enable).
 
+- A self-hosted management server for the [Netbird](https://netbird.io). Available as [services.netbird.server](#opt-services.netbird.server.enable).
+
 - [ping_exporter](https://github.com/czerwonk/ping_exporter), a Prometheus exporter for ICMP echo requests. Available as [services.prometheus.exporters.ping](#opt-services.prometheus.exporters.ping.enable).
 
 - [Prometheus DNSSEC Exporter](https://github.com/chrj/prometheus-dnssec-exporter), check for validity and expiration in DNSSEC signatures and expose metrics for Prometheus. Available as [services.prometheus.exporters.dnssec](#opt-services.prometheus.exporters.dnssec.enable).
@@ -151,6 +155,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [microsocks](https://github.com/rofl0r/microsocks), a tiny, portable SOCKS5 server with very moderate resource usage. Available as [services.microsocks]($opt-services-microsocks.enable).
 
+- [inadyn](https://github.com/troglobit/inadyn), a Dynamic DNS client with built-in support for multiple providers. Available as [services.inadyn](#opt-services.inadyn.enable).
+
 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).
 
 - [fritz-exporter](https://github.com/pdreker/fritz_exporter), a Prometheus exporter for extracting metrics from [FRITZ!](https://avm.de/produkte/) devices. Available as [services.prometheus.exporters.fritz](#opt-services.prometheus.exporters.fritz.enable).
@@ -173,12 +179,16 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [davis](https://github.com/tchapi/davis), a simple CardDav and CalDav server inspired by Baïkal. Available as [services.davis]($opt-services-davis.enable).
 
+- [Firefly-iii](https://www.firefly-iii.org), a free and open source personal finance manager. Available as [services.firefly-iii](#opt-services.firefly-iii.enable)
+
 - [systemd-lock-handler](https://git.sr.ht/~whynothugo/systemd-lock-handler/), a bridge between logind D-Bus events and systemd targets. Available as [services.systemd-lock-handler.enable](#opt-services.systemd-lock-handler.enable).
 
 - [wastebin](https://github.com/matze/wastebin), a pastebin server written in rust. Available as [services.wastebin](#opt-services.wastebin.enable).
 
 - [Mealie](https://nightly.mealie.io/), a self-hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in NuxtJS for a pleasant user experience for the whole family. Available as [services.mealie](#opt-services.mealie.enable)
 
+- [Sunshine](https://app.lizardbyte.dev/Sunshine), a self-hosted game stream host for Moonlight. Available as [services.sunshine](#opt-services.sunshine.enable).
+
 - [Uni-Sync](https://github.com/EightB1ts/uni-sync), a synchronization tool for Lian Li Uni Controllers. Available as [hardware.uni-sync](#opt-hardware.uni-sync.enable)
 
 - [prometheus-nats-exporter](https://github.com/nats-io/prometheus-nats-exporter), a Prometheus exporter for NATS. Available as [services.prometheus.exporters.nats](#opt-services.prometheus.exporters.nats.enable).
@@ -573,6 +583,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   and `services.kavita.settings.IpAddresses`. The file at `services.kavita.tokenKeyFile` now needs to contain a secret with
   512+ bits instead of 128+ bits.
 
+- `kavita` has been updated to 0.8.0, requiring a manual forced library scan on all libraries for migration. Refer to upstream's [release notes](https://github.com/Kareadita/Kavita/releases/tag/v0.8.0) for details.
+
 - The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`.
 
 - `services.soju` now has a wrapper for the `sojuctl` command, pointed at the service config file. It also has the new option `adminSocket.enable`, which creates a unix admin socket at `/run/soju/admin`.
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index 2a25f8e564684..26323e14b9017 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -101,6 +101,7 @@ let
           libPath = filter (pkgs.path + "/lib");
           pkgsLibPath = filter (pkgs.path + "/pkgs/pkgs-lib");
           nixosPath = filter (pkgs.path + "/nixos");
+          NIX_ABORT_ON_WARN = warningsAreErrors;
           modules =
             "[ "
             + concatMapStringsSep " " (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2a25561047316..511d991e919cd 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1012,6 +1012,7 @@
   ./services/networking/icecream/daemon.nix
   ./services/networking/icecream/scheduler.nix
   ./services/networking/imaginary.nix
+  ./services/networking/inadyn.nix
   ./services/networking/inspircd.nix
   ./services/networking/iodine.nix
   ./services/networking/iperf3.nix
@@ -1070,6 +1071,7 @@
   ./services/networking/ndppd.nix
   ./services/networking/nebula.nix
   ./services/networking/netbird.nix
+  ./services/networking/netbird/server.nix
   ./services/networking/netclient.nix
   ./services/networking/networkd-dispatcher.nix
   ./services/networking/networkmanager.nix
@@ -1160,6 +1162,7 @@
   ./services/networking/strongswan.nix
   ./services/networking/stubby.nix
   ./services/networking/stunnel.nix
+  ./services/networking/sunshine.nix
   ./services/networking/supplicant.nix
   ./services/networking/supybot.nix
   ./services/networking/syncplay.nix
@@ -1223,6 +1226,7 @@
   ./services/search/elasticsearch-curator.nix
   ./services/search/elasticsearch.nix
   ./services/search/hound.nix
+  ./services/search/manticore.nix
   ./services/search/meilisearch.nix
   ./services/search/opensearch.nix
   ./services/search/qdrant.nix
@@ -1334,6 +1338,7 @@
   ./services/web-apps/dolibarr.nix
   ./services/web-apps/engelsystem.nix
   ./services/web-apps/ethercalc.nix
+  ./services/web-apps/firefly-iii.nix
   ./services/web-apps/fluidd.nix
   ./services/web-apps/freshrss.nix
   ./services/web-apps/galene.nix
diff --git a/nixos/modules/programs/fcast-receiver.nix b/nixos/modules/programs/fcast-receiver.nix
index 8da07a66e2223..2e4e6bf8b242a 100644
--- a/nixos/modules/programs/fcast-receiver.nix
+++ b/nixos/modules/programs/fcast-receiver.nix
@@ -11,11 +11,11 @@ in
   };
 
   options.programs.fcast-receiver = {
-    enable = mkEnableOption (lib.mdDoc "FCast Receiver");
+    enable = mkEnableOption "FCast Receiver";
     openFirewall = mkOption {
       type = types.bool;
       default = false;
-      description = lib.mdDoc ''
+      description = ''
         Open ports needed for the functionality of the program.
       '';
     };
diff --git a/nixos/modules/programs/fzf.nix b/nixos/modules/programs/fzf.nix
index 0e7e519f0436d..66ad7d418de68 100644
--- a/nixos/modules/programs/fzf.nix
+++ b/nixos/modules/programs/fzf.nix
@@ -15,11 +15,12 @@ in
     environment.systemPackages = lib.mkIf (cfg.keybindings || cfg.fuzzyCompletion) [ pkgs.fzf ];
 
     programs = {
-      bash.interactiveShellInit = lib.optionalString cfg.fuzzyCompletion ''
+      # load after programs.bash.enableCompletion
+      bash.promptPluginInit = lib.mkAfter (lib.optionalString cfg.fuzzyCompletion ''
         source ${pkgs.fzf}/share/fzf/completion.bash
       '' + lib.optionalString cfg.keybindings ''
         source ${pkgs.fzf}/share/fzf/key-bindings.bash
-      '';
+      '');
 
       zsh = {
         interactiveShellInit = lib.optionalString (!config.programs.zsh.ohMyZsh.enable)
diff --git a/nixos/modules/security/duosec.nix b/nixos/modules/security/duosec.nix
index 7fb75f42db1f8..e755b5f0ee534 100644
--- a/nixos/modules/security/duosec.nix
+++ b/nixos/modules/security/duosec.nix
@@ -200,7 +200,8 @@ in
       unitConfig.DefaultDependencies = false;
       script = ''
         if test -f "${cfg.secretKeyFile}"; then
-          mkdir -m 0755 -p /etc/duo
+          mkdir -p /etc/duo
+          chmod 0755 /etc/duo
 
           umask 0077
           conf="$(mktemp)"
@@ -222,7 +223,8 @@ in
       unitConfig.DefaultDependencies = false;
       script = ''
         if test -f "${cfg.secretKeyFile}"; then
-          mkdir -m 0755 -p /etc/duo
+          mkdir -p /etc/duo
+          chmod 0755 /etc/duo
 
           umask 0077
           conf="$(mktemp)"
diff --git a/nixos/modules/services/misc/greenclip.nix b/nixos/modules/services/misc/greenclip.nix
index 9d1483a5a047a..d92cd1854877f 100644
--- a/nixos/modules/services/misc/greenclip.nix
+++ b/nixos/modules/services/misc/greenclip.nix
@@ -18,7 +18,10 @@ in {
       description = "greenclip daemon";
       wantedBy = [ "graphical-session.target" ];
       after    = [ "graphical-session.target" ];
-      serviceConfig.ExecStart = "${cfg.package}/bin/greenclip daemon";
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/greenclip daemon";
+        Restart = "always";
+      };
     };
 
     environment.systemPackages = [ cfg.package ];
diff --git a/nixos/modules/services/misc/ollama.nix b/nixos/modules/services/misc/ollama.nix
index 948c8f17f9894..c0341984aa351 100644
--- a/nixos/modules/services/misc/ollama.nix
+++ b/nixos/modules/services/misc/ollama.nix
@@ -21,6 +21,8 @@ in
         example = "/home/foo";
         description = ''
           The home directory that the ollama service is started in.
+
+          See also `services.ollama.writablePaths` and `services.ollama.sandbox`.
         '';
       };
       models = lib.mkOption {
@@ -29,6 +31,37 @@ in
         example = "/path/to/ollama/models";
         description = ''
           The directory that the ollama service will read models from and download new models to.
+
+          See also `services.ollama.writablePaths` and `services.ollama.sandbox`
+          if downloading models or other mutation of the filesystem is required.
+        '';
+      };
+      sandbox = lib.mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to enable systemd's sandboxing capabilities.
+
+          This sets [`DynamicUser`](
+          https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+          ), which runs the server as a unique user with read-only access to most of the filesystem.
+
+          See also `services.ollama.writablePaths`.
+        '';
+      };
+      writablePaths = lib.mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [ "/home/foo" "/mnt/foo" ];
+        description = ''
+          Paths that the server should have write access to.
+
+          This sets [`ReadWritePaths`](
+          https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ReadWritePaths=
+          ), which allows specified paths to be written to through the default sandboxing.
+
+          See also `services.ollama.sandbox`.
         '';
       };
       listenAddress = lib.mkOption {
@@ -59,8 +92,8 @@ in
         type = types.attrsOf types.str;
         default = { };
         example = {
-          HOME = "/tmp";
           OLLAMA_LLM_LIBRARY = "cpu";
+          HIP_VISIBLE_DEVICES = "0,1";
         };
         description = ''
           Set arbitrary environment variables for the ollama service.
@@ -87,7 +120,8 @@ in
         ExecStart = "${lib.getExe ollamaPackage} serve";
         WorkingDirectory = cfg.home;
         StateDirectory = [ "ollama" ];
-        DynamicUser = true;
+        DynamicUser = cfg.sandbox;
+        ReadWritePaths = cfg.writablePaths;
       };
     };
 
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 3456098073b34..e564fe3b8317b 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -203,9 +203,12 @@ in
       apply = pkg: pkg.override {
         tesseract5 = pkg.tesseract5.override {
           # always enable detection modules
+          # tesseract fails to build when eng is not present
           enableLanguages = if cfg.settings ? PAPERLESS_OCR_LANGUAGE then
-            [ "equ" "osd" ]
+            lists.unique (
+              [ "equ" "osd" "eng" ]
               ++ lib.splitString "+" cfg.settings.PAPERLESS_OCR_LANGUAGE
+            )
           else null;
         };
       };
diff --git a/nixos/modules/services/misc/podgrab.nix b/nixos/modules/services/misc/podgrab.nix
index f95d2dc928cd5..50dc70e2bd767 100644
--- a/nixos/modules/services/misc/podgrab.nix
+++ b/nixos/modules/services/misc/podgrab.nix
@@ -1,6 +1,8 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.services.podgrab;
+
+  stateDir = "/var/lib/podgrab";
 in
 {
   options.services.podgrab = with lib; {
@@ -22,28 +24,59 @@ in
       example = 4242;
       description = "The port on which Podgrab will listen for incoming HTTP traffic.";
     };
+
+    dataDirectory = mkOption {
+      type = types.path;
+      default = "${stateDir}/data";
+      example = "/mnt/podcasts";
+      description = "Directory to store downloads.";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "podgrab";
+      description = "User under which Podgrab runs, and which owns the download directory.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "podgrab";
+      description = "Group under which Podgrab runs, and which owns the download directory.";
+    };
   };
 
   config = lib.mkIf cfg.enable {
+    systemd.tmpfiles.settings."10-pyload" = {
+      ${cfg.dataDirectory}.d = { inherit (cfg) user group; };
+    };
+
     systemd.services.podgrab = {
       description = "Podgrab podcast manager";
       wantedBy = [ "multi-user.target" ];
       environment = {
-        CONFIG = "/var/lib/podgrab/config";
-        DATA = "/var/lib/podgrab/data";
+        CONFIG = "${stateDir}/config";
+        DATA = cfg.dataDirectory;
         GIN_MODE = "release";
         PORT = toString cfg.port;
       };
       serviceConfig = {
-        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
         EnvironmentFile = lib.optionals (cfg.passwordFile != null) [
           cfg.passwordFile
         ];
         ExecStart = "${pkgs.podgrab}/bin/podgrab";
         WorkingDirectory = "${pkgs.podgrab}/share";
-        StateDirectory = [ "podgrab/config" "podgrab/data" ];
+        StateDirectory = [ "podgrab/config" ];
       };
     };
+
+    users.users.podgrab = lib.mkIf (cfg.user == "podgrab") {
+      isSystemUser = true;
+      group = cfg.group;
+    };
+
+    users.groups.podgrab = lib.mkIf (cfg.group == "podgrab") { };
   };
 
   meta.maintainers = with lib.maintainers; [ ambroisie ];
diff --git a/nixos/modules/services/networking/deconz.nix b/nixos/modules/services/networking/deconz.nix
index eaa7759d0407c..88b0ee612d871 100644
--- a/nixos/modules/services/networking/deconz.nix
+++ b/nixos/modules/services/networking/deconz.nix
@@ -95,7 +95,7 @@ in
       '';
       postStart = ''
         # Delay signalling service readiness until it's actually up.
-        while ! "${lib.getExe pkgs.curl}" -sSfl -o /dev/null "http://${cfg.listenAddress}:${toString cfg.httpPort}"; do
+        while ! "${lib.getExe pkgs.curl}" -sSfL -o /dev/null "http://${cfg.listenAddress}:${toString cfg.httpPort}"; do
             echo "Waiting for TCP port ${toString cfg.httpPort} to be open..."
             sleep 1
         done
diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix
index de336113843ef..a05beaf42e4f5 100644
--- a/nixos/modules/services/networking/firewall-nftables.nix
+++ b/nixos/modules/services/networking/firewall-nftables.nix
@@ -45,6 +45,18 @@ in
           This option only works with the nftables based firewall.
         '';
       };
+
+      extraReversePathFilterRules = mkOption {
+        type = types.lines;
+        default = "";
+        example = "fib daddr . mark . iif type local accept";
+        description = lib.mdDoc ''
+          Additional nftables rules to be appended to the rpfilter-allow
+          chain.
+
+          This option only works with the nftables based firewall.
+        '';
+      };
     };
 
   };
@@ -79,6 +91,8 @@ in
             meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
             fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
 
+            jump rpfilter-allow
+
             ${optionalString cfg.logReversePathDrops ''
               log level info prefix "rpfilter drop: "
             ''}
@@ -86,6 +100,10 @@ in
           }
         ''}
 
+        chain rpfilter-allow {
+          ${cfg.extraReversePathFilterRules}
+        }
+
         chain input {
           type filter hook input priority filter; policy drop;
 
diff --git a/nixos/modules/services/networking/inadyn.nix b/nixos/modules/services/networking/inadyn.nix
new file mode 100644
index 0000000000000..5af1ec9c91efe
--- /dev/null
+++ b/nixos/modules/services/networking/inadyn.nix
@@ -0,0 +1,250 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.inadyn;
+
+  # check if a value of an attrset is not null or an empty collection
+  nonEmptyValue = _: v: v != null && v != [ ] && v != { };
+
+  renderOption = k: v:
+    if builtins.elem k [ "provider" "custom" ] then
+      lib.concatStringsSep "\n"
+        (mapAttrsToList
+          (name: config: ''
+            ${k} ${name} {
+                ${lib.concatStringsSep "\n    " (mapAttrsToList renderOption (filterAttrs nonEmptyValue config))}
+            }'')
+          v)
+    else if k == "include" then
+      "${k}(\"${v}\")"
+    else if k == "hostname" && builtins.isList v then
+      "${k} = { ${builtins.concatStringsSep ", " (map (s: "\"${s}\"") v)} }"
+    else if builtins.isBool v then
+      "${k} = ${boolToString v}"
+    else if builtins.isString v then
+      "${k} = \"${v}\""
+    else
+      "${k} = ${toString v}";
+
+  configFile' = pkgs.writeText "inadyn.conf"
+    ''
+      # This file was generated by nix
+      # do not edit
+
+      ${(lib.concatStringsSep "\n" (mapAttrsToList renderOption (filterAttrs nonEmptyValue cfg.settings)))}
+    '';
+
+  configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
+in
+{
+  options.services.inadyn = with types;
+    let
+      providerOptions =
+        {
+          include = mkOption {
+            default = null;
+            description = mdDoc "File to include additional settings for this provider from.";
+            type = nullOr path;
+          };
+          ssl = mkOption {
+            default = true;
+            description = mdDoc "Whether to use HTTPS for this DDNS provider.";
+            type = bool;
+          };
+          username = mkOption {
+            default = null;
+            description = mdDoc "Username for this DDNS provider.";
+            type = nullOr str;
+          };
+          password = mkOption {
+            default = null;
+            description = mdDoc ''
+              Password for this DDNS provider.
+
+              WARNING: This will be world-readable in the nix store.
+              To store credentials securely, use the `include` or `configFile` options.
+            '';
+            type = nullOr str;
+          };
+          hostname = mkOption {
+            default = "*";
+            example = "your.cool-domain.com";
+            description = mdDoc "Hostname alias(es).";
+            type = either str (listOf str);
+          };
+        };
+    in
+    {
+      enable = mkEnableOption (mdDoc ''
+        synchronise your machine's IP address with a dynamic DNS provider using inadyn
+      '');
+      user = mkOption {
+        default = "inadyn";
+        type = types.str;
+        description = lib.mdDoc ''
+          User account under which inadyn runs.
+
+          ::: {.note}
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the inadyn service starts.
+          :::
+        '';
+      };
+      group = mkOption {
+        default = "inadyn";
+        type = types.str;
+        description = lib.mdDoc ''
+          Group account under which inadyn runs.
+
+          ::: {.note}
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the inadyn service starts.
+          :::
+        '';
+      };
+      interval = mkOption {
+        default = "*-*-* *:*:00";
+        description = mdDoc ''
+          How often to check the current IP.
+          Uses the format described in {manpage}`systemd.time(7)`";
+        '';
+        type = str;
+      };
+      logLevel = lib.mkOption {
+        type = lib.types.enum [ "none" "err" "warning" "info" "notice" "debug" ];
+        default = "notice";
+        description = lib.mdDoc "Set inadyn's log level.";
+      };
+      settings = mkOption {
+        default = { };
+        description = "See `inadyn.conf (5)`";
+        type = submodule {
+          freeformType = attrs;
+          options = {
+            allow-ipv6 = mkOption {
+              default = config.networking.enableIPv6;
+              defaultText = "`config.networking.enableIPv6`";
+              description = mdDoc "Whether to get IPv6 addresses from interfaces.";
+              type = bool;
+            };
+            forced-update = mkOption {
+              default = 2592000;
+              description = mdDoc "Duration (in seconds) after which an update is forced.";
+              type = ints.positive;
+            };
+            provider = mkOption {
+              default = { };
+              description = mdDoc ''
+                Settings for DDNS providers built-in to inadyn.
+
+                For a list of built-in providers, see `inadyn.conf (5)`.
+              '';
+              type = attrsOf (submodule {
+                freeformType = attrs;
+                options = providerOptions;
+              });
+            };
+            custom = mkOption {
+              default = { };
+              description = mdDoc ''
+                Settings for custom DNS providers.
+              '';
+              type = attrsOf (submodule {
+                freeformType = attrs;
+                options = providerOptions // {
+                  ddns-server = mkOption {
+                    description = mdDoc "DDNS server name.";
+                    type = str;
+                  };
+                  ddns-path = mkOption {
+                    description = mdDoc ''
+                      DDNS server path.
+
+                      See `inadnyn.conf (5)` for a list for format specifiers that can be used.
+                    '';
+                    example = "/update?user=%u&password=%p&domain=%h&myip=%i";
+                    type = str;
+                  };
+                };
+              });
+            };
+          };
+        };
+      };
+      configFile = mkOption {
+        default = null;
+        description = mdDoc ''
+          Configuration file for inadyn.
+
+          Setting this will override all other configuration options.
+
+          Passed to the inadyn service using LoadCredential.
+        '';
+        type = nullOr path;
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    systemd = {
+      services.inadyn = {
+        description = "Update nameservers using inadyn";
+        documentation = [
+          "man:inadyn"
+          "man:inadyn.conf"
+          "file:${pkgs.inadyn}/share/doc/inadyn/README.md"
+        ];
+        requires = [ "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];
+        startAt = cfg.interval;
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = ''${lib.getExe pkgs.inadyn} -f ${configFile} --cache-dir ''${CACHE_DIRECTORY}/inadyn -1 --foreground -l ${cfg.logLevel}'';
+          LoadCredential = "config:${configFile}";
+          CacheDirectory = "inadyn";
+
+          User = cfg.user;
+          Group = cfg.group;
+          UMask = "0177";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectSystem = "strict";
+          ProtectProc = "invisible";
+          ProtectHome = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = "@system-service";
+          CapabilityBoundingSet = "";
+        };
+      };
+
+      timers.inadyn.timerConfig.Persistent = true;
+    };
+
+    users.users.inadyn = mkIf (cfg.user == "inadyn") {
+      group = cfg.group;
+      isSystemUser = true;
+    };
+
+    users.groups = mkIf (cfg.group == "inadyn") {
+      inadyn = { };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index 6488a159b3b73..89d3ea5e9626a 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -226,7 +226,7 @@ in {
       };
 
       settings = mkOption {
-        type = types.attrs;
+        type = types.submodule { freeformType = types.attrs; };
         default = {};
         description = ''
           Extra configuration as nix values.
diff --git a/nixos/modules/services/networking/netbird/coturn.nix b/nixos/modules/services/networking/netbird/coturn.nix
new file mode 100644
index 0000000000000..dd032abb2d75e
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/coturn.nix
@@ -0,0 +1,160 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe
+    literalExpression
+    mkAfter
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    optionalAttrs
+    optionalString
+    ;
+
+  inherit (lib.types)
+    bool
+    listOf
+    nullOr
+    path
+    port
+    str
+    ;
+
+  cfg = config.services.netbird.server.coturn;
+in
+
+{
+  options.services.netbird.server.coturn = {
+    enable = mkEnableOption "a Coturn server for Netbird, will also open the firewall on the configured range";
+
+    useAcmeCertificates = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to use ACME certificates corresponding to the given domain for the server.
+      '';
+    };
+
+    domain = mkOption {
+      type = str;
+      description = "The domain under which the coturn server runs.";
+    };
+
+    user = mkOption {
+      type = str;
+      default = "netbird";
+      description = ''
+        The username used by netbird to connect to the coturn server.
+      '';
+    };
+
+    password = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        The password of the user used by netbird to connect to the coturn server.
+      '';
+    };
+
+    passwordFile = mkOption {
+      type = nullOr path;
+      default = null;
+      description = ''
+        The path to a file containing the password of the user used by netbird to connect to the coturn server.
+      '';
+    };
+
+    openPorts = mkOption {
+      type = listOf port;
+      default = with config.services.coturn; [
+        listening-port
+        alt-listening-port
+        tls-listening-port
+        alt-tls-listening-port
+      ];
+      defaultText = literalExpression ''
+        with config.services.coturn; [
+          listening-port
+          alt-listening-port
+          tls-listening-port
+          alt-tls-listening-port
+        ];
+      '';
+
+      description = ''
+        The list of ports used by coturn for listening to open in the firewall.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = (cfg.password == null) != (cfg.passwordFile == null);
+          message = "Exactly one of `password` or `passwordFile` must be given for the coturn setup.";
+        }
+      ];
+
+      services.coturn =
+        {
+          enable = true;
+
+          realm = cfg.domain;
+          lt-cred-mech = true;
+          no-cli = true;
+
+          extraConfig = ''
+            fingerprint
+            user=${cfg.user}:${if cfg.password != null then cfg.password else "@password@"}
+            no-software-attribute
+          '';
+        }
+        // (optionalAttrs cfg.useAcmeCertificates {
+          cert = "@cert@";
+          pkey = "@pkey@";
+        });
+
+      systemd.services.coturn =
+        let
+          dir = config.security.acme.certs.${cfg.domain}.directory;
+          preStart' =
+            (optionalString (cfg.passwordFile != null) ''
+              ${getExe pkgs.replace-secret} @password@ ${cfg.passwordFile} /run/coturn/turnserver.cfg
+            '')
+            + (optionalString cfg.useAcmeCertificates ''
+              ${getExe pkgs.replace-secret} @cert@ "$CREDENTIALS_DIRECTORY/cert.pem" /run/coturn/turnserver.cfg
+              ${getExe pkgs.replace-secret} @pkey@ "$CREDENTIALS_DIRECTORY/pkey.pem" /run/coturn/turnserver.cfg
+            '');
+        in
+        (optionalAttrs (preStart' != "") { preStart = mkAfter preStart'; })
+        // (optionalAttrs cfg.useAcmeCertificates {
+          serviceConfig.LoadCredential = [
+            "cert.pem:${dir}/fullchain.pem"
+            "pkey.pem:${dir}/key.pem"
+          ];
+        });
+
+      security.acme.certs.${cfg.domain}.postRun = optionalString cfg.useAcmeCertificates "systemctl restart coturn.service";
+
+      networking.firewall = {
+        allowedUDPPorts = cfg.openPorts;
+        allowedTCPPorts = cfg.openPorts;
+
+        allowedUDPPortRanges = [
+          {
+            from = cfg.minPort;
+            to = cfg.maxPort;
+          }
+        ];
+      };
+    }
+  ]);
+}
diff --git a/nixos/modules/services/networking/netbird/dashboard.nix b/nixos/modules/services/networking/netbird/dashboard.nix
new file mode 100644
index 0000000000000..6fc3086155900
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/dashboard.nix
@@ -0,0 +1,186 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    boolToString
+    concatStringsSep
+    hasAttr
+    isBool
+    mapAttrs
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+
+  inherit (lib.types)
+    attrsOf
+    bool
+    either
+    package
+    str
+    submodule
+    ;
+
+  toStringEnv = value: if isBool value then boolToString value else toString value;
+
+  cfg = config.services.netbird.server.dashboard;
+in
+
+{
+  options.services.netbird.server.dashboard = {
+    enable = mkEnableOption "the static netbird dashboard frontend";
+
+    package = mkPackageOption pkgs "netbird-dashboard" { };
+
+    enableNginx = mkEnableOption "Nginx reverse-proxy to serve the dashboard.";
+
+    domain = mkOption {
+      type = str;
+      default = "localhost";
+      description = "The domain under which the dashboard runs.";
+    };
+
+    managementServer = mkOption {
+      type = str;
+      description = "The address of the management server, used for the API endpoints.";
+    };
+
+    settings = mkOption {
+      type = submodule { freeformType = attrsOf (either str bool); };
+
+      defaultText = ''
+        {
+          AUTH_AUDIENCE = "netbird";
+          AUTH_CLIENT_ID = "netbird";
+          AUTH_SUPPORTED_SCOPES = "openid profile email";
+          NETBIRD_TOKEN_SOURCE = "idToken";
+          USE_AUTH0 = false;
+        }
+      '';
+
+      description = ''
+        An attribute set that will be used to substitute variables when building the dashboard.
+        Any values set here will be templated into the frontend and be public for anyone that can reach your website.
+        The exact values sadly aren't documented anywhere.
+        A starting point when searching for valid values is this [script](https://github.com/netbirdio/dashboard/blob/main/docker/init_react_envs.sh)
+        The only mandatory value is 'AUTH_AUTHORITY' as we cannot set a default value here.
+      '';
+    };
+
+    finalDrv = mkOption {
+      readOnly = true;
+      type = package;
+      description = ''
+        The derivation containing the final templated dashboard.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = hasAttr "AUTH_AUTHORITY" cfg.settings;
+        message = "The setting AUTH_AUTHORITY is required for the dasboard to function.";
+      }
+    ];
+
+    services.netbird.server.dashboard = {
+      settings =
+        {
+          # Due to how the backend and frontend work this secret will be templated into the backend
+          # and then served statically from your website
+          # This enables you to login without the normally needed indirection through the backend
+          # but this also means anyone that can reach your website can
+          # fetch this secret, which is why there is no real need to put it into
+          # special options as its public anyway
+          # As far as I know leaking this secret is just
+          # an information leak as one can fetch some basic app
+          # informations from the IDP
+          # To actually do something one still needs to have login
+          # data and this secret so this being public will not
+          # suffice for anything just decreasing security
+          AUTH_CLIENT_SECRET = "";
+
+          NETBIRD_MGMT_API_ENDPOINT = cfg.managementServer;
+          NETBIRD_MGMT_GRPC_API_ENDPOINT = cfg.managementServer;
+        }
+        // (mapAttrs (_: mkDefault) {
+          # Those values have to be easily overridable
+          AUTH_AUDIENCE = "netbird"; # must be set for your devices to be able to log in
+          AUTH_CLIENT_ID = "netbird";
+          AUTH_SUPPORTED_SCOPES = "openid profile email";
+          NETBIRD_TOKEN_SOURCE = "idToken";
+          USE_AUTH0 = false;
+        });
+
+      # The derivation containing the templated dashboard
+      finalDrv =
+        pkgs.runCommand "netbird-dashboard"
+          {
+            nativeBuildInputs = [ pkgs.gettext ];
+            env = {
+              ENV_STR = concatStringsSep " " [
+                "$AUTH_AUDIENCE"
+                "$AUTH_AUTHORITY"
+                "$AUTH_CLIENT_ID"
+                "$AUTH_CLIENT_SECRET"
+                "$AUTH_REDIRECT_URI"
+                "$AUTH_SILENT_REDIRECT_URI"
+                "$AUTH_SUPPORTED_SCOPES"
+                "$NETBIRD_DRAG_QUERY_PARAMS"
+                "$NETBIRD_GOOGLE_ANALYTICS_ID"
+                "$NETBIRD_HOTJAR_TRACK_ID"
+                "$NETBIRD_MGMT_API_ENDPOINT"
+                "$NETBIRD_MGMT_GRPC_API_ENDPOINT"
+                "$NETBIRD_TOKEN_SOURCE"
+                "$USE_AUTH0"
+              ];
+            } // (mapAttrs (_: toStringEnv) cfg.settings);
+          }
+          ''
+            cp -R ${cfg.package} build
+
+            find build -type d -exec chmod 755 {} \;
+            OIDC_TRUSTED_DOMAINS="build/OidcTrustedDomains.js"
+
+            envsubst "$ENV_STR" < "$OIDC_TRUSTED_DOMAINS.tmpl" > "$OIDC_TRUSTED_DOMAINS"
+
+            for f in $(grep -R -l AUTH_SUPPORTED_SCOPES build/); do
+              mv "$f" "$f.copy"
+              envsubst "$ENV_STR" < "$f.copy" > "$f"
+              rm "$f.copy"
+            done
+
+            cp -R build $out
+          '';
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        locations = {
+          "/" = {
+            root = cfg.finalDrv;
+            tryFiles = "$uri $uri.html $uri/ =404";
+          };
+
+          "/404.html".extraConfig = ''
+            internal;
+          '';
+        };
+
+        extraConfig = ''
+          error_page 404 /404.html;
+        '';
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/netbird/management.nix b/nixos/modules/services/networking/netbird/management.nix
new file mode 100644
index 0000000000000..52f033959143c
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/management.nix
@@ -0,0 +1,460 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  inherit (lib)
+    any
+    concatMap
+    getExe'
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optional
+    recursiveUpdate
+    ;
+
+  inherit (lib.types)
+    bool
+    enum
+    listOf
+    port
+    str
+    ;
+
+  inherit (utils) escapeSystemdExecArgs genJqSecretsReplacementSnippet;
+
+  stateDir = "/var/lib/netbird-mgmt";
+
+  settingsFormat = pkgs.formats.json { };
+
+  defaultSettings = {
+    Stuns = [
+      {
+        Proto = "udp";
+        URI = "stun:${cfg.turnDomain}:3478";
+        Username = "";
+        Password = null;
+      }
+    ];
+
+    TURNConfig = {
+      Turns = [
+        {
+          Proto = "udp";
+          URI = "turn:${cfg.turnDomain}:${builtins.toString cfg.turnPort}";
+          Username = "netbird";
+          Password = "netbird";
+        }
+      ];
+
+      CredentialsTTL = "12h";
+      Secret = "not-secure-secret";
+      TimeBasedCredentials = false;
+    };
+
+    Signal = {
+      Proto = "https";
+      URI = "${cfg.domain}:443";
+      Username = "";
+      Password = null;
+    };
+
+    ReverseProxy = {
+      TrustedHTTPProxies = [ ];
+      TrustedHTTPProxiesCount = 0;
+      TrustedPeers = [ "0.0.0.0/0" ];
+    };
+
+    Datadir = "${stateDir}/data";
+    DataStoreEncryptionKey = "very-insecure-key";
+    StoreConfig = {
+      Engine = "sqlite";
+    };
+
+    HttpConfig = {
+      Address = "127.0.0.1:${builtins.toString cfg.port}";
+      IdpSignKeyRefreshEnabled = true;
+      OIDCConfigEndpoint = cfg.oidcConfigEndpoint;
+    };
+
+    IdpManagerConfig = {
+      ManagerType = "none";
+      ClientConfig = {
+        Issuer = "";
+        TokenEndpoint = "";
+        ClientID = "netbird";
+        ClientSecret = "";
+        GrantType = "client_credentials";
+      };
+
+      ExtraConfig = { };
+      Auth0ClientCredentials = null;
+      AzureClientCredentials = null;
+      KeycloakClientCredentials = null;
+      ZitadelClientCredentials = null;
+    };
+
+    DeviceAuthorizationFlow = {
+      Provider = "none";
+      ProviderConfig = {
+        Audience = "netbird";
+        Domain = null;
+        ClientID = "netbird";
+        TokenEndpoint = null;
+        DeviceAuthEndpoint = "";
+        Scope = "openid profile email";
+        UseIDToken = false;
+      };
+    };
+
+    PKCEAuthorizationFlow = {
+      ProviderConfig = {
+        Audience = "netbird";
+        ClientID = "netbird";
+        ClientSecret = "";
+        AuthorizationEndpoint = "";
+        TokenEndpoint = "";
+        Scope = "openid profile email";
+        RedirectURLs = [ "http://localhost:53000" ];
+        UseIDToken = false;
+      };
+    };
+  };
+
+  managementConfig = recursiveUpdate defaultSettings cfg.settings;
+
+  managementFile = settingsFormat.generate "config.json" managementConfig;
+
+  cfg = config.services.netbird.server.management;
+in
+
+{
+  options.services.netbird.server.management = {
+    enable = mkEnableOption "Netbird Management Service.";
+
+    package = mkPackageOption pkgs "netbird" { };
+
+    domain = mkOption {
+      type = str;
+      description = "The domain under which the management API runs.";
+    };
+
+    turnDomain = mkOption {
+      type = str;
+      description = "The domain of the TURN server to use.";
+    };
+
+    turnPort = mkOption {
+      type = port;
+      default = 3478;
+      description = ''
+        The port of the TURN server to use.
+      '';
+    };
+
+    dnsDomain = mkOption {
+      type = str;
+      default = "netbird.selfhosted";
+      description = "Domain used for peer resolution.";
+    };
+
+    singleAccountModeDomain = mkOption {
+      type = str;
+      default = "netbird.selfhosted";
+      description = ''
+        Enables single account mode.
+        This means that all the users will be under the same account grouped by the specified domain.
+        If the installation has more than one account, the property is ineffective.
+      '';
+    };
+
+    disableAnonymousMetrics = mkOption {
+      type = bool;
+      default = true;
+      description = "Disables push of anonymous usage metrics to NetBird.";
+    };
+
+    disableSingleAccountMode = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        If set to true, disables single account mode.
+        The `singleAccountModeDomain` property will be ignored and every new user will have a separate NetBird account.
+      '';
+    };
+
+    port = mkOption {
+      type = port;
+      default = 8011;
+      description = "Internal port of the management server.";
+    };
+
+    extraOptions = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Additional options given to netbird-mgmt as commandline arguments.
+      '';
+    };
+
+    oidcConfigEndpoint = mkOption {
+      type = str;
+      description = "The oidc discovery endpoint.";
+      example = "https://example.eu.auth0.com/.well-known/openid-configuration";
+    };
+
+    settings = mkOption {
+      inherit (settingsFormat) type;
+
+      defaultText = literalExpression ''
+        defaultSettings = {
+          Stuns = [
+            {
+              Proto = "udp";
+              URI = "stun:''${cfg.turnDomain}:3478";
+              Username = "";
+              Password = null;
+            }
+          ];
+
+          TURNConfig = {
+            Turns = [
+              {
+                Proto = "udp";
+                URI = "turn:''${cfg.turnDomain}:3478";
+                Username = "netbird";
+                Password = "netbird";
+              }
+            ];
+
+            CredentialsTTL = "12h";
+            Secret = "not-secure-secret";
+            TimeBasedCredentials = false;
+          };
+
+          Signal = {
+            Proto = "https";
+            URI = "''${cfg.domain}:443";
+            Username = "";
+            Password = null;
+          };
+
+          ReverseProxy = {
+            TrustedHTTPProxies = [ ];
+            TrustedHTTPProxiesCount = 0;
+            TrustedPeers = [ "0.0.0.0/0" ];
+          };
+
+          Datadir = "''${stateDir}/data";
+          DataStoreEncryptionKey = "genEVP6j/Yp2EeVujm0zgqXrRos29dQkpvX0hHdEUlQ=";
+          StoreConfig = { Engine = "sqlite"; };
+
+          HttpConfig = {
+            Address = "127.0.0.1:''${builtins.toString cfg.port}";
+            IdpSignKeyRefreshEnabled = true;
+            OIDCConfigEndpoint = cfg.oidcConfigEndpoint;
+          };
+
+          IdpManagerConfig = {
+            ManagerType = "none";
+            ClientConfig = {
+              Issuer = "";
+              TokenEndpoint = "";
+              ClientID = "netbird";
+              ClientSecret = "";
+              GrantType = "client_credentials";
+            };
+
+            ExtraConfig = { };
+            Auth0ClientCredentials = null;
+            AzureClientCredentials = null;
+            KeycloakClientCredentials = null;
+            ZitadelClientCredentials = null;
+          };
+
+          DeviceAuthorizationFlow = {
+            Provider = "none";
+            ProviderConfig = {
+              Audience = "netbird";
+              Domain = null;
+              ClientID = "netbird";
+              TokenEndpoint = null;
+              DeviceAuthEndpoint = "";
+              Scope = "openid profile email offline_access api";
+              UseIDToken = false;
+            };
+          };
+
+          PKCEAuthorizationFlow = {
+            ProviderConfig = {
+              Audience = "netbird";
+              ClientID = "netbird";
+              ClientSecret = "";
+              AuthorizationEndpoint = "";
+              TokenEndpoint = "";
+              Scope = "openid profile email offline_access api";
+              RedirectURLs = "http://localhost:53000";
+              UseIDToken = false;
+            };
+          };
+        };
+      '';
+
+      default = { };
+
+      description = ''
+        Configuration of the netbird management server.
+        Options containing secret data should be set to an attribute set containing the attribute _secret
+        - a string pointing to a file containing the value the option should be set to.
+        See the example to get a better picture of this: in the resulting management.json file,
+        the `DataStoreEncryptionKey` key will be set to the contents of the /run/agenix/netbird_mgmt-data_store_encryption_key file.
+      '';
+
+      example = {
+        DataStoreEncryptionKey = {
+          _secret = "/run/agenix/netbird_mgmt-data_store_encryption_key";
+        };
+      };
+    };
+
+    logLevel = mkOption {
+      type = enum [
+        "ERROR"
+        "WARN"
+        "INFO"
+        "DEBUG"
+      ];
+      default = "INFO";
+      description = "Log level of the netbird services.";
+    };
+
+    enableNginx = mkEnableOption "Nginx reverse-proxy for the netbird management service.";
+  };
+
+  config = mkIf cfg.enable {
+    warnings =
+      concatMap
+        (
+          { check, name }:
+          optional check "${name} is world-readable in the Nix Store, you should provide it as a _secret."
+        )
+        [
+          {
+            check = builtins.isString managementConfig.TURNConfig.Secret;
+            name = "The TURNConfig.secret";
+          }
+          {
+            check = builtins.isString managementConfig.DataStoreEncryptionKey;
+            name = "The DataStoreEncryptionKey";
+          }
+          {
+            check = any (T: (T ? Password) && builtins.isString T.Password) managementConfig.TURNConfig.Turns;
+            name = "A Turn configuration's password";
+          }
+        ];
+
+    systemd.services.netbird-management = {
+      description = "The management server for Netbird, a wireguard VPN";
+      documentation = [ "https://netbird.io/docs/" ];
+
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ managementFile ];
+
+      preStart = genJqSecretsReplacementSnippet managementConfig "${stateDir}/management.json";
+
+      serviceConfig = {
+        ExecStart = escapeSystemdExecArgs (
+          [
+            (getExe' cfg.package "netbird-mgmt")
+            "management"
+            # Config file
+            "--config"
+            "${stateDir}/management.json"
+            # Data directory
+            "--datadir"
+            "${stateDir}/data"
+            # DNS domain
+            "--dns-domain"
+            cfg.dnsDomain
+            # Port to listen on
+            "--port"
+            cfg.port
+            # Log to stdout
+            "--log-file"
+            "console"
+            # Log level
+            "--log-level"
+            cfg.logLevel
+            #
+            "--idp-sign-key-refresh-enabled"
+            # Domain for internal resolution
+            "--single-account-mode-domain"
+            cfg.singleAccountModeDomain
+          ]
+          ++ (optional cfg.disableAnonymousMetrics "--disable-anonymous-metrics")
+          ++ (optional cfg.disableSingleAccountMode "--disable-single-account-mode")
+          ++ cfg.extraOptions
+        );
+        Restart = "always";
+        RuntimeDirectory = "netbird-mgmt";
+        StateDirectory = [
+          "netbird-mgmt"
+          "netbird-mgmt/data"
+        ];
+        WorkingDirectory = stateDir;
+
+        # hardening
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+
+      stopIfChanged = false;
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        locations = {
+          "/api".proxyPass = "http://localhost:${builtins.toString cfg.port}";
+
+          "/management.ManagementService/".extraConfig = ''
+            # This is necessary so that grpc connections do not get closed early
+            # see https://stackoverflow.com/a/67805465
+            client_body_timeout 1d;
+
+            grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+            grpc_pass grpc://localhost:${builtins.toString cfg.port};
+            grpc_read_timeout 1d;
+            grpc_send_timeout 1d;
+            grpc_socket_keepalive on;
+          '';
+        };
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/netbird/server.md b/nixos/modules/services/networking/netbird/server.md
new file mode 100644
index 0000000000000..3649e97b379e5
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/server.md
@@ -0,0 +1,42 @@
+# Netbird server {#module-services-netbird-server}
+
+NetBird is a VPN built on top of WireGuard® making it easy to create secure private networks for your organization or home.
+
+## Quickstart {#module-services-netbird-server-quickstart}
+
+To fully setup Netbird as a self-hosted server, we need both a Coturn server and an identity provider, the list of supported SSOs and their setup are available [on Netbird's documentation](https://docs.netbird.io/selfhosted/selfhosted-guide#step-3-configure-identity-provider-idp).
+
+There are quite a few settings that need to be passed to Netbird for it to function, and a minimal config looks like :
+
+```nix
+services.netbird.server = {
+  enable = true;
+
+  domain = "netbird.example.selfhosted";
+
+  enableNginx = true;
+
+  coturn = {
+    enable = true;
+
+    passwordFile = "/path/to/a/secret/password";
+  };
+
+  management = {
+    oidcConfigEndpoint = "https://sso.example.selfhosted/oauth2/openid/netbird/.well-known/openid-configuration";
+
+    settings = {
+      TURNConfig = {
+        Turns = [
+          {
+            Proto = "udp";
+            URI = "turn:netbird.example.selfhosted:3478";
+            Username = "netbird";
+            Password._secret = "/path/to/a/secret/password";
+          }
+        ];
+      };
+    };
+  };
+};
+```
diff --git a/nixos/modules/services/networking/netbird/server.nix b/nixos/modules/services/networking/netbird/server.nix
new file mode 100644
index 0000000000000..a4de0fda6a134
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/server.nix
@@ -0,0 +1,67 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    optionalAttrs
+    ;
+
+  inherit (lib.types) str;
+
+  cfg = config.services.netbird.server;
+in
+
+{
+  meta = {
+    maintainers = with lib.maintainers; [ thubrecht ];
+    doc = ./server.md;
+  };
+
+  # Import the separate components
+  imports = [
+    ./coturn.nix
+    ./dashboard.nix
+    ./management.nix
+    ./signal.nix
+  ];
+
+  options.services.netbird.server = {
+    enable = mkEnableOption "Netbird Server stack, comprising the dashboard, management API and signal service";
+
+    enableNginx = mkEnableOption "Nginx reverse-proxy for the netbird server services.";
+
+    domain = mkOption {
+      type = str;
+      description = "The domain under which the netbird server runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.netbird.server = {
+      dashboard = {
+        inherit (cfg) enable domain enableNginx;
+
+        managementServer = "https://${cfg.domain}";
+      };
+
+      management =
+        {
+          inherit (cfg) enable domain enableNginx;
+        }
+        // (optionalAttrs cfg.coturn.enable {
+          turnDomain = cfg.domain;
+          turnPort = config.services.coturn.tls-listening-port;
+        });
+
+      signal = {
+        inherit (cfg) enable domain enableNginx;
+      };
+
+      coturn = {
+        inherit (cfg) domain;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/netbird/signal.nix b/nixos/modules/services/networking/netbird/signal.nix
new file mode 100644
index 0000000000000..8408d20e874b5
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/signal.nix
@@ -0,0 +1,123 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe'
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    mkOption
+    ;
+
+  inherit (lib.types) enum port str;
+
+  inherit (utils) escapeSystemdExecArgs;
+
+  cfg = config.services.netbird.server.signal;
+in
+
+{
+  options.services.netbird.server.signal = {
+    enable = mkEnableOption "Netbird's Signal Service";
+
+    package = mkPackageOption pkgs "netbird" { };
+
+    enableNginx = mkEnableOption "Nginx reverse-proxy for the netbird signal service.";
+
+    domain = mkOption {
+      type = str;
+      description = "The domain name for the signal service.";
+    };
+
+    port = mkOption {
+      type = port;
+      default = 8012;
+      description = "Internal port of the signal server.";
+    };
+
+    logLevel = mkOption {
+      type = enum [
+        "ERROR"
+        "WARN"
+        "INFO"
+        "DEBUG"
+      ];
+      default = "INFO";
+      description = "Log level of the netbird signal service.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.netbird-signal = {
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = escapeSystemdExecArgs [
+          (getExe' cfg.package "netbird-signal")
+          "run"
+          # Port to listen on
+          "--port"
+          cfg.port
+          # Log to stdout
+          "--log-file"
+          "console"
+          # Log level
+          "--log-level"
+          cfg.logLevel
+        ];
+
+        Restart = "always";
+        RuntimeDirectory = "netbird-mgmt";
+        StateDirectory = "netbird-mgmt";
+        WorkingDirectory = "/var/lib/netbird-mgmt";
+
+        # hardening
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+
+      stopIfChanged = false;
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        locations."/signalexchange.SignalExchange/".extraConfig = ''
+          # This is necessary so that grpc connections do not get closed early
+          # see https://stackoverflow.com/a/67805465
+          client_body_timeout 1d;
+
+          grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          grpc_pass grpc://localhost:${builtins.toString cfg.port};
+          grpc_read_timeout 1d;
+          grpc_send_timeout 1d;
+          grpc_socket_keepalive on;
+        '';
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/sunshine.nix b/nixos/modules/services/networking/sunshine.nix
new file mode 100644
index 0000000000000..c115b9cd5cf99
--- /dev/null
+++ b/nixos/modules/services/networking/sunshine.nix
@@ -0,0 +1,156 @@
+{ config, lib, pkgs, utils, ... }:
+let
+  inherit (lib) mkEnableOption mkPackageOption mkOption mkIf mkDefault types optionals getExe;
+  inherit (utils) escapeSystemdExecArgs;
+  cfg = config.services.sunshine;
+
+  # ports used are offset from a single base port, see https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#port
+  generatePorts = port: offsets: map (offset: port + offset) offsets;
+  defaultPort = 47989;
+
+  appsFormat = pkgs.formats.json { };
+  settingsFormat = pkgs.formats.keyValue { };
+
+  appsFile = appsFormat.generate "apps.json" cfg.applications;
+  configFile = settingsFormat.generate "sunshine.conf" cfg.settings;
+in
+{
+  options.services.sunshine = with types; {
+    enable = mkEnableOption "Sunshine, a self-hosted game stream host for Moonlight";
+    package = mkPackageOption pkgs "sunshine" { };
+    openFirewall = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to automatically open ports in the firewall.
+      '';
+    };
+    capSysAdmin = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to give the Sunshine binary CAP_SYS_ADMIN, required for DRM/KMS screen capture.
+      '';
+    };
+    settings = mkOption {
+      default = { };
+      description = ''
+        Settings to be rendered into the configuration file. If this is set, no configuration is possible from the web UI.
+
+        See https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#configuration for syntax.
+      '';
+      example = ''
+        {
+          sunshine_name = "nixos";
+        }
+      '';
+      type = submodule (settings: {
+        freeformType = settingsFormat.type;
+        options.port = mkOption {
+          type = port;
+          default = defaultPort;
+          description = ''
+            Base port -- others used are offset from this one, see https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#port for details.
+          '';
+        };
+      });
+    };
+    applications = mkOption {
+      default = { };
+      description = ''
+        Configuration for applications to be exposed to Moonlight. If this is set, no configuration is possible from the web UI, and must be by the `settings` option.
+      '';
+      example = ''
+        {
+          env = {
+            PATH = "$(PATH):$(HOME)/.local/bin";
+          };
+          apps = [
+            {
+              name = "1440p Desktop";
+              prep-cmd = [
+                {
+                  do = "''${pkgs.kdePackages.libkscreen}/bin/kscreen-doctor output.DP-4.mode.2560x1440@144";
+                  undo = "''${pkgs.kdePackages.libkscreen}/bin/kscreen-doctor output.DP-4.mode.3440x1440@144";
+                }
+              ];
+              exclude-global-prep-cmd = "false";
+              auto-detach = "true";
+            }
+          ];
+        }
+      '';
+      type = submodule {
+        options = {
+          env = mkOption {
+            default = { };
+            description = ''
+              Environment variables to be set for the applications.
+            '';
+            type = attrsOf str;
+          };
+          apps = mkOption {
+            default = [ ];
+            description = ''
+              Applications to be exposed to Moonlight.
+            '';
+            type = listOf attrs;
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.sunshine.settings.file_apps = mkIf (cfg.applications.apps != [ ]) "${appsFile}";
+
+    environment.systemPackages = [
+      cfg.package
+    ];
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = generatePorts cfg.settings.port [ (-5) 0 1 21 ];
+      allowedUDPPorts = generatePorts cfg.settings.port [ 9 10 11 13 21 ];
+    };
+
+    boot.kernelModules = [ "uinput" ];
+
+    services.udev.packages = [ cfg.package ];
+
+    services.avahi = {
+      enable = mkDefault true;
+      publish = {
+        enable = mkDefault true;
+        userServices = mkDefault true;
+      };
+    };
+
+    security.wrappers.sunshine = mkIf cfg.capSysAdmin {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_sys_admin+p";
+      source = getExe cfg.package;
+    };
+
+    systemd.user.services.sunshine = {
+      description = "Self-hosted game stream host for Moonlight";
+
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      wants = [ "graphical-session.target" ];
+      after = [ "graphical-session.target" ];
+
+      startLimitIntervalSec = 500;
+      startLimitBurst = 5;
+
+      serviceConfig = {
+        # only add configFile if an application or a setting other than the default port is set to allow configuration from web UI
+        ExecStart = escapeSystemdExecArgs ([
+          (if cfg.capSysAdmin then "${config.security.wrapperDir}/sunshine" else "${getExe cfg.package}")
+        ] ++ optionals (cfg.applications.apps != [ ] || (builtins.length (builtins.attrNames cfg.settings) > 1 || cfg.settings.port != defaultPort)) [ "${configFile}" ]);
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index c9dd1d1b0f01f..435cd530c18d4 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -124,11 +124,20 @@ let
           fi
         ''}
 
+        # ensure wpa_supplicant.conf exists, or the daemon will fail to start
+        ${optionalString cfg.allowAuxiliaryImperativeNetworks ''
+          touch /etc/wpa_supplicant.conf
+        ''}
+
         # substitute environment variables
         if [ -f "${configFile}" ]; then
           ${pkgs.gawk}/bin/awk '{
-            for(varname in ENVIRON)
-              gsub("@"varname"@", ENVIRON[varname])
+            for(varname in ENVIRON) {
+              find = "@"varname"@"
+              repl = ENVIRON[varname]
+              if (i = index($0, find))
+                $0 = substr($0, 1, i-1) repl substr($0, i+length(find))
+            }
             print
           }' "${configFile}" > "${finalConfig}"
         else
diff --git a/nixos/modules/services/search/manticore.nix b/nixos/modules/services/search/manticore.nix
new file mode 100644
index 0000000000000..a8fcd9d0b3820
--- /dev/null
+++ b/nixos/modules/services/search/manticore.nix
@@ -0,0 +1,131 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.manticore;
+  format = pkgs.formats.json { };
+
+  toSphinx = {
+    mkKeyValue    ? mkKeyValueDefault {} "=",
+    listsAsDuplicateKeys ? true
+  }: attrsOfAttrs:
+    let
+        # map function to string for each key val
+        mapAttrsToStringsSep = sep: mapFn: attrs:
+          concatStringsSep sep
+            (mapAttrsToList mapFn attrs);
+        mkSection = sectName: sectValues: ''
+          ${sectName} {
+        '' + lib.generators.toKeyValue { inherit mkKeyValue listsAsDuplicateKeys; } sectValues + ''}'';
+    in
+      # map input to ini sections
+      mapAttrsToStringsSep "\n" mkSection attrsOfAttrs;
+
+  configFile = pkgs.writeText "manticore.conf" (
+    toSphinx {
+        mkKeyValue = k: v: "  ${k} = ${v}";
+    } cfg.settings
+  );
+
+in {
+
+  options = {
+    services.manticore = {
+
+      enable = mkEnableOption "Manticoresearch";
+
+      settings = mkOption {
+        default = {
+          searchd = {
+            listen = [
+              "127.0.0.1:9312"
+              "127.0.0.1:9306:mysql"
+              "127.0.0.1:9308:http"
+            ];
+            log = "/var/log/manticore/searchd.log";
+            query_log = "/var/log/manticore/query.log";
+            pid_file = "/run/manticore/searchd.pid";
+            data_dir = "/var/lib/manticore";
+          };
+        };
+        description = ''
+          Configuration for Manticoresearch. See
+          <https://manual.manticoresearch.com/Server%20settings>
+          for more information.
+        '';
+        type = types.submodule {
+          freeformType = format.type;
+        };
+        example = literalExpression ''
+          {
+            searchd = {
+                listen = [
+                  "127.0.0.1:9312"
+                  "127.0.0.1:9306:mysql"
+                  "127.0.0.1:9308:http"
+                ];
+                log = "/var/log/manticore/searchd.log";
+                query_log = "/var/log/manticore/query.log";
+                pid_file = "/run/manticore/searchd.pid";
+                data_dir = "/var/lib/manticore";
+            };
+          }
+        '';
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd = {
+      packages = [ pkgs.manticoresearch ];
+      services.manticore = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          ExecStart = [
+            ""
+            "${pkgs.manticoresearch}/bin/searchd --config ${configFile}"
+          ];
+          ExecStop = [
+            ""
+            "${pkgs.manticoresearch}/bin/searchd --config ${configFile} --stopwait"
+          ];
+          ExecStartPre = [ "" ];
+          DynamicUser = true;
+          LogsDirectory = "manticore";
+          RuntimeDirectory = "manticore";
+          StateDirectory = "manticore";
+          ReadWritePaths = "";
+          CapabilityBoundingSet = "";
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "@system-service" "~@privileged" ];
+          RestrictRealtime = true;
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          UMask = "0066";
+          ProtectHostname = true;
+        } // lib.optionalAttrs (cfg.settings.searchd.pid_file != null) {
+          PIDFile = cfg.settings.searchd.pid_file;
+        };
+      };
+    };
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+}
diff --git a/nixos/modules/services/security/oauth2_proxy.nix b/nixos/modules/services/security/oauth2_proxy.nix
index abf1ce9ba0200..d2992a196bf87 100644
--- a/nixos/modules/services/security/oauth2_proxy.nix
+++ b/nixos/modules/services/security/oauth2_proxy.nix
@@ -47,6 +47,7 @@ let
     reverse-proxy = reverseProxy;
     proxy-prefix = proxyPrefix;
     profile-url = profileURL;
+    oidc-issuer-url = oidcIssuerUrl;
     redeem-url = redeemURL;
     redirect-url = redirectURL;
     request-logging = requestLogging;
@@ -131,6 +132,15 @@ in
       example = "123456.apps.googleusercontent.com";
     };
 
+    oidcIssuerUrl = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The OAuth issuer URL.
+      '';
+      example = "https://login.microsoftonline.com/{TENANT_ID}/v2.0";
+    };
+
     clientSecret = mkOption {
       type = types.nullOr types.str;
       description = ''
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index bcdf7d6512d5a..7e012dee02cbf 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -4,15 +4,29 @@ let
   cfg = config.services.earlyoom;
 
   inherit (lib)
-    mkDefault mkEnableOption mkIf mkOption types
-    mkRemovedOptionModule literalExpression
-    escapeShellArg concatStringsSep optional optionalString;
-
+    concatStringsSep
+    escapeShellArg
+    literalExpression
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    mkRemovedOptionModule
+    optionalString
+    optionals
+    types;
 in
 {
+  meta = {
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+  };
+
   options.services.earlyoom = {
     enable = mkEnableOption "early out of memory killing";
 
+    package = mkPackageOption pkgs "earlyoom" { };
+
     freeMemThreshold = mkOption {
       type = types.ints.between 1 100;
       default = 10;
@@ -138,22 +152,21 @@ in
     systemd.services.earlyoom = {
       description = "Early OOM Daemon for Linux";
       wantedBy = [ "multi-user.target" ];
-      path = optional cfg.enableNotifications pkgs.dbus;
+      path = optionals cfg.enableNotifications [ pkgs.dbus ];
       serviceConfig = {
         StandardError = "journal";
         ExecStart = concatStringsSep " " ([
-          "${pkgs.earlyoom}/bin/earlyoom"
+          "${lib.getExe cfg.package}"
           ("-m ${toString cfg.freeMemThreshold}"
-            + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}")
+           + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}")
           ("-s ${toString cfg.freeSwapThreshold}"
-            + optionalString (cfg.freeSwapKillThreshold != null) ",${toString cfg.freeSwapKillThreshold}")
+           + optionalString (cfg.freeSwapKillThreshold != null) ",${toString cfg.freeSwapKillThreshold}")
           "-r ${toString cfg.reportInterval}"
         ]
-        ++ optional cfg.enableDebugInfo "-d"
-        ++ optional cfg.enableNotifications "-n"
-        ++ optional (cfg.killHook != null) "-N ${escapeShellArg cfg.killHook}"
-        ++ cfg.extraArgs
-        );
+        ++ optionals cfg.enableDebugInfo [ "-d" ]
+        ++ optionals cfg.enableNotifications [ "-n" ]
+        ++ optionals (cfg.killHook != null) [ "-N ${escapeShellArg cfg.killHook}" ]
+        ++ cfg.extraArgs);
       };
     };
   };
diff --git a/nixos/modules/services/web-apps/firefly-iii.nix b/nixos/modules/services/web-apps/firefly-iii.nix
new file mode 100644
index 0000000000000..b0024ce09c38e
--- /dev/null
+++ b/nixos/modules/services/web-apps/firefly-iii.nix
@@ -0,0 +1,367 @@
+{ pkgs, config, lib, ... }:
+
+let
+  inherit (lib) optionalString mkDefault mkIf mkOption mkEnableOption literalExpression;
+  inherit (lib.types) nullOr attrsOf oneOf str int bool path package enum submodule;
+  inherit (lib.strings) concatMapStringsSep removePrefix toShellVars removeSuffix hasSuffix;
+  inherit (lib.attrsets) attrValues genAttrs filterAttrs mapAttrs' nameValuePair;
+  inherit (builtins) isInt isString toString typeOf;
+
+  cfg = config.services.firefly-iii;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  defaultUser = "firefly-iii";
+  defaultGroup = "firefly-iii";
+
+  artisan = "${cfg.package}/artisan";
+
+  env-file-values = mapAttrs' (n: v: nameValuePair (removeSuffix "_FILE" n) v)
+    (filterAttrs (n: v: hasSuffix "_FILE" n) cfg.settings);
+  env-nonfile-values = filterAttrs (n: v: ! hasSuffix "_FILE" n) cfg.settings;
+
+  envfile = pkgs.writeText "firefly-iii-env" ''
+    ${toShellVars env-file-values}
+    ${toShellVars env-nonfile-values}
+  '';
+
+  fileenv-func = ''
+    cp --no-preserve=mode ${envfile} /tmp/firefly-iii-env
+    ${concatMapStringsSep "\n"
+      (n: "${pkgs.replace-secret}/bin/replace-secret ${n} ${n} /tmp/firefly-iii-env")
+      (attrValues env-file-values)}
+    set -a
+    . /tmp/firefly-iii-env
+    set +a
+  '';
+
+  firefly-iii-maintenance = pkgs.writeShellScript "firefly-iii-maintenance.sh" ''
+    ${fileenv-func}
+
+    ${optionalString (cfg.settings.DB_CONNECTION == "sqlite")
+      "touch ${cfg.dataDir}/storage/database/database.sqlite"}
+    ${artisan} migrate --seed --no-interaction --force
+    ${artisan} firefly-iii:decrypt-all
+    ${artisan} firefly-iii:upgrade-database
+    ${artisan} firefly-iii:correct-database
+    ${artisan} firefly-iii:report-integrity
+    ${artisan} firefly-iii:laravel-passport-keys
+    ${artisan} cache:clear
+
+    mv /tmp/firefly-iii-env /run/phpfpm/firefly-iii-env
+  '';
+
+  commonServiceConfig = {
+    Type = "oneshot";
+    User = user;
+    Group = group;
+    StateDirectory = "${removePrefix "/var/lib/" cfg.dataDir}";
+    WorkingDirectory = cfg.package;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    CapabilityBoundingSet = "";
+    AmbientCapabilities = "";
+    ProtectSystem = "strict";
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectControlGroups = true;
+    ProtectClock = true;
+    ProtectHostname = true;
+    ProtectHome = "tmpfs";
+    ProtectKernelLogs = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    PrivateNetwork = false;
+    RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service @resources"
+      "~@obsolete @privileged"
+    ];
+    RestrictSUIDSGID = true;
+    RemoveIPC = true;
+    NoNewPrivileges = true;
+    RestrictRealtime = true;
+    RestrictNamespaces = true;
+    LockPersonality = true;
+    PrivateUsers = true;
+  };
+
+in {
+
+  options.services.firefly-iii = {
+
+    enable = mkEnableOption "Firefly III: A free and open source personal finance manager";
+
+    user = mkOption {
+      type = str;
+      default = defaultUser;
+      description = "User account under which firefly-iii runs.";
+    };
+
+    group = mkOption {
+      type = str;
+      default = if cfg.enableNginx then "nginx" else defaultGroup;
+      defaultText = "If `services.firefly-iii.enableNginx` is true then `nginx` else ${defaultGroup}";
+      description = ''
+        Group under which firefly-iii runs. It is best to set this to the group
+        of whatever webserver is being used as the frontend.
+      '';
+    };
+
+    dataDir = mkOption {
+      type = path;
+      default = "/var/lib/firefly-iii";
+      description = ''
+        The place where firefly-iii stores its state.
+      '';
+    };
+
+    package = mkOption {
+      type = package;
+      default = pkgs.firefly-iii;
+      defaultText = literalExpression "pkgs.firefly-iii";
+      description = ''
+        The firefly-iii package served by php-fpm and the webserver of choice.
+        This option can be used to point the webserver to the correct root. It
+        may also be used to set the package to a different version, say a
+        development version.
+      '';
+      apply = firefly-iii : firefly-iii.override (prev: {
+        dataDir = cfg.dataDir;
+      });
+    };
+
+    enableNginx = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to enable nginx or not. If enabled, an nginx virtual host will
+        be created for access to firefly-iii. If not enabled, then you may use
+        `''${config.services.firefly-iii.package}` as your document root in
+        whichever webserver you wish to setup.
+      '';
+    };
+
+    virtualHost = mkOption {
+      type = str;
+      description = ''
+        The hostname at which you wish firefly-iii to be served. If you have
+        enabled nginx using `services.firefly-iii.enableNginx` then this will
+        be used.
+      '';
+    };
+
+    poolConfig = mkOption {
+      type = attrsOf (oneOf [ str int bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = ''
+        Options for the Firefly III PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+        for details on configuration directives.
+      '';
+    };
+
+    settings = mkOption {
+      description = ''
+        Options for firefly-iii configuration. Refer to
+        <https://github.com/firefly-iii/firefly-iii/blob/main/.env.example> for
+        details on supported values. All <option>_FILE values supported by
+        upstream are supported here.
+
+        APP_URL will be set by `services.firefly-iii.virtualHost`, do not
+        redefine it here.
+      '';
+      example = literalExpression ''
+        {
+          APP_ENV = "production";
+          APP_KEY_FILE = "/var/secrets/firefly-iii-app-key.txt";
+          SITE_OWNER = "mail@example.com";
+          DB_CONNECTION = "mysql";
+          DB_HOST = "db";
+          DB_PORT = 3306;
+          DB_DATABASE = "firefly";
+          DB_USERNAME = "firefly";
+          DB_PASSWORD_FILE = "/var/secrets/firefly-iii-mysql-password.txt;
+        }
+      '';
+      default = {};
+      type = submodule {
+        freeformType = attrsOf (oneOf [str int bool]);
+        options = {
+          DB_CONNECTION = mkOption {
+            type = enum [ "sqlite" "pgsql" "mysql" ];
+            default = "sqlite";
+            example = "pgsql";
+            description = ''
+              The type of database you wish to use. Can be one of "sqlite",
+              "mysql" or "pgsql".
+            '';
+          };
+          APP_ENV = mkOption {
+            type = enum [ "local" "production" "testing" ];
+            default = "local";
+            example = "production";
+            description = ''
+              The app environment. It is recommended to keep this at "local".
+              Possible values are "local", "production" and "testing"
+            '';
+          };
+          DB_PORT = mkOption {
+            type = nullOr int;
+            default = if cfg.settings.DB_CONNECTION == "sqlite" then null
+                      else if cfg.settings.DB_CONNECTION == "mysql" then 3306
+                      else 5432;
+            defaultText = ''
+              `null` if DB_CONNECTION is "sqlite", `3306` if "mysql", `5432` if "pgsql"
+            '';
+            description = ''
+              The port your database is listening at. sqlite does not require
+              this value to be filled.
+            '';
+          };
+          APP_KEY_FILE = mkOption {
+            type = path;
+            description = ''
+              The path to your appkey. The file should contain a 32 character
+              random app key. This may be set using `echo "base64:$(head -c 32
+              /dev/urandom | base64)" > /path/to/key-file`.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    services.firefly-iii = {
+      settings = {
+        APP_URL = cfg.virtualHost;
+      };
+    };
+
+    services.phpfpm.pools.firefly-iii = {
+      inherit user group;
+      phpPackage = cfg.package.phpPackage;
+      phpOptions = ''
+        log_errors = on
+      '';
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = user;
+        "listen.group" = group;
+        "clear_env" = "no";
+      } // cfg.poolConfig;
+    };
+
+    systemd.services.phpfpm-firefly-iii.serviceConfig = {
+      EnvironmentFile = "/run/phpfpm/firefly-iii-env";
+      ExecStartPost = "${pkgs.coreutils}/bin/rm /run/phpfpm/firefly-iii-env";
+    };
+
+    systemd.services.firefly-iii-setup = {
+      requiredBy = [ "phpfpm-firefly-iii.service" ];
+      before = [ "phpfpm-firefly-iii.service" ];
+      serviceConfig = {
+        ExecStart = firefly-iii-maintenance;
+        RuntimeDirectory = "phpfpm";
+        RuntimeDirectoryPreserve = true;
+      } // commonServiceConfig;
+      unitConfig.JoinsNamespaceOf = "phpfpm-firefly-iii.service";
+    };
+
+    systemd.services.firefly-iii-cron = {
+      description = "Daily Firefly III cron job";
+      script = ''
+        ${fileenv-func}
+        ${artisan} firefly-iii:cron
+      '';
+      serviceConfig = commonServiceConfig;
+    };
+
+    systemd.timers.firefly-iii-cron = {
+      description = "Trigger Firefly Cron";
+      timerConfig = {
+        OnCalendar = "Daily";
+        RandomizedDelaySec = "1800s";
+        Persistent = true;
+      };
+      wantedBy = [ "timers.target" ];
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+      recommendedTlsSettings = mkDefault true;
+      recommendedOptimisation = mkDefault true;
+      recommendedGzipSettings = mkDefault true;
+      virtualHosts.${cfg.virtualHost} = {
+        root = "${cfg.package}/public";
+        locations = {
+          "/" = {
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+            index = "index.php";
+            extraConfig = ''
+              sendfile off;
+            '';
+          };
+          "~ \.php$" = {
+            extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi_params ;
+              fastcgi_param SCRIPT_FILENAME $request_filename;
+              fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
+              fastcgi_pass unix:${config.services.phpfpm.pools.firefly-iii.socket};
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.tmpfiles.settings."10-firefly-iii" = genAttrs [
+      "${cfg.dataDir}/storage"
+      "${cfg.dataDir}/storage/app"
+      "${cfg.dataDir}/storage/database"
+      "${cfg.dataDir}/storage/export"
+      "${cfg.dataDir}/storage/framework"
+      "${cfg.dataDir}/storage/framework/cache"
+      "${cfg.dataDir}/storage/framework/sessions"
+      "${cfg.dataDir}/storage/framework/views"
+      "${cfg.dataDir}/storage/logs"
+      "${cfg.dataDir}/storage/upload"
+      "${cfg.dataDir}/cache"
+    ] (n: {
+      d = {
+        group = group;
+        mode = "0700";
+        user = user;
+      };
+    }) // {
+      "${cfg.dataDir}".d = {
+        group = group;
+        mode = "0710";
+        user = user;
+      };
+    };
+
+    users = {
+      users = mkIf (user == defaultUser) {
+        ${defaultUser} = {
+          description = "Firefly-iii service user";
+          inherit group;
+          isSystemUser = true;
+          home = cfg.dataDir;
+        };
+      };
+      groups = mkIf (group == defaultGroup) {
+        ${defaultGroup} = {};
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index 0d0361584c3a0..cdd60f572b990 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -2,7 +2,7 @@
 
 let
 
-  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption;
+  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption mkPackageOption;
   inherit (lib) literalExpression mapAttrs optional optionalString types;
 
   cfg = config.services.limesurvey;
@@ -12,8 +12,6 @@ let
   group = config.services.httpd.group;
   stateDir = "/var/lib/limesurvey";
 
-  pkg = pkgs.limesurvey;
-
   configType = with types; oneOf [ (attrsOf configType) str int bool ] // {
     description = "limesurvey config type (str, int, bool or attribute set thereof)";
   };
@@ -34,6 +32,8 @@ in
   options.services.limesurvey = {
     enable = mkEnableOption "Limesurvey web application";
 
+    package = mkPackageOption pkgs "limesurvey" { };
+
     encryptionKey = mkOption {
       type = types.str;
       default = "E17687FC77CEE247F0E22BB3ECF27FDE8BEC310A892347EC13013ABA11AA7EB5";
@@ -240,7 +240,7 @@ in
       adminAddr = mkDefault cfg.virtualHost.adminAddr;
       extraModules = [ "proxy_fcgi" ];
       virtualHosts.${cfg.virtualHost.hostName} = mkMerge [ cfg.virtualHost {
-        documentRoot = mkForce "${pkg}/share/limesurvey";
+        documentRoot = mkForce "${cfg.package}/share/limesurvey";
         extraConfig = ''
           Alias "/tmp" "${stateDir}/tmp"
           <Directory "${stateDir}">
@@ -256,7 +256,7 @@ in
             Options -Indexes
           </Directory>
 
-          <Directory "${pkg}/share/limesurvey">
+          <Directory "${cfg.package}/share/limesurvey">
             <FilesMatch "\.php$">
               <If "-f %{REQUEST_FILENAME}">
                 SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
@@ -277,7 +277,7 @@ in
       "d ${stateDir}/tmp/assets 0750 ${user} ${group} - -"
       "d ${stateDir}/tmp/runtime 0750 ${user} ${group} - -"
       "d ${stateDir}/tmp/upload 0750 ${user} ${group} - -"
-      "C ${stateDir}/upload 0750 ${user} ${group} - ${pkg}/share/limesurvey/upload"
+      "C ${stateDir}/upload 0750 ${user} ${group} - ${cfg.package}/share/limesurvey/upload"
     ];
 
     systemd.services.limesurvey-init = {
@@ -288,8 +288,8 @@ in
       environment.LIMESURVEY_CONFIG = limesurveyConfig;
       script = ''
         # update or install the database as required
-        ${pkgs.php81}/bin/php ${pkg}/share/limesurvey/application/commands/console.php updatedb || \
-        ${pkgs.php81}/bin/php ${pkg}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
+        ${pkgs.php81}/bin/php ${cfg.package}/share/limesurvey/application/commands/console.php updatedb || \
+        ${pkgs.php81}/bin/php ${cfg.package}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
       '';
       serviceConfig = {
         User = user;
diff --git a/nixos/modules/services/web-apps/pretalx.nix b/nixos/modules/services/web-apps/pretalx.nix
index e80eedf9f8590..b062a8b7eeeac 100644
--- a/nixos/modules/services/web-apps/pretalx.nix
+++ b/nixos/modules/services/web-apps/pretalx.nix
@@ -286,16 +286,16 @@ in
         virtualHosts.${cfg.nginx.domain} = {
           # https://docs.pretalx.org/administrator/installation.html#step-7-ssl
           extraConfig = ''
-            more_set_headers Referrer-Policy same-origin;
-            more_set_headers X-Content-Type-Options nosniff;
+            more_set_headers "Referrer-Policy: same-origin";
+            more_set_headers "X-Content-Type-Options: nosniff";
           '';
           locations = {
             "/".proxyPass = "http://pretalx";
             "/media/" = {
-              alias = "${cfg.settings.filesystem.data}/data/media/";
+              alias = "${cfg.settings.filesystem.data}/media/";
               extraConfig = ''
                 access_log off;
-                more_set_headers Content-Disposition 'attachment; filename="$1"';
+                more_set_headers 'Content-Disposition: attachment; filename="$1"';
                 expires 7d;
               '';
             };
diff --git a/nixos/modules/services/x11/desktop-managers/lxqt.nix b/nixos/modules/services/x11/desktop-managers/lxqt.nix
index 3fce3283e71ff..1937bdcbd3e73 100644
--- a/nixos/modules/services/x11/desktop-managers/lxqt.nix
+++ b/nixos/modules/services/x11/desktop-managers/lxqt.nix
@@ -71,7 +71,7 @@ in
 
     services.xserver.libinput.enable = mkDefault true;
 
-    xdg.portal.lxqt.enable = true;
+    xdg.portal.lxqt.enable = mkDefault true;
 
     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050804
     xdg.portal.config.lxqt.default = mkDefault [ "lxqt" "gtk" ];
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index 4c62e964c34c4..0f9b712c6df53 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -284,7 +284,7 @@ in
       in
         # We will generate every possible pair of WM and DM.
         concatLists (
-            builtins.map
+            lib.mapCartesianProduct
             ({dm, wm}: let
               sessionName = "${dm.name}${optionalString (wm.name != "none") ("+" + wm.name)}";
               script = xsession dm wm;
@@ -312,7 +312,7 @@ in
                   providedSessions = [ sessionName ];
                 })
             )
-            (cartesianProductOfSets { dm = dms; wm = wms; })
+            { dm = dms; wm = wms; }
           );
   };
 
diff --git a/nixos/modules/virtualisation/digital-ocean-config.nix b/nixos/modules/virtualisation/digital-ocean-config.nix
index 2d5bc0661d48d..4ef2b85551c66 100644
--- a/nixos/modules/virtualisation/digital-ocean-config.nix
+++ b/nixos/modules/virtualisation/digital-ocean-config.nix
@@ -41,7 +41,7 @@ with lib;
         kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
         initrd.kernelModules = [ "virtio_scsi" ];
         kernelModules = [ "virtio_pci" "virtio_net" ];
-        loader.grub.devices = lib.mkDefault ["/dev/vda"];
+        loader.grub.devices = ["/dev/vda"];
       };
       services.openssh = {
         enable = mkDefault true;
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 96b24feeb0631..39cbe85579ae9 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -168,7 +168,10 @@ in rec {
         (onFullSupported "nixpkgs.emacs")
         (onFullSupported "nixpkgs.jdk")
         (onSystems ["x86_64-linux"] "nixpkgs.mesa_i686") # i686 sanity check + useful
-        ["nixpkgs.tarball"]
+        [
+          "nixpkgs.tarball"
+          "nixpkgs.release-checks"
+        ]
       ];
     };
 }
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index cac20b63925f0..091c2b1f305be 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -81,6 +81,7 @@ in rec {
       php
       postgresql
       python
+      release-checks
       rsyslog
       stdenv
       subversion
@@ -103,6 +104,7 @@ in rec {
       [
         "nixos.channel"
         "nixpkgs.tarball"
+        "nixpkgs.release-checks"
       ]
       (map (onSystems [ "x86_64-linux" ]) [
         "nixos.tests.boot.biosCdrom"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 23c5a94ed12ca..232f10d7c24dd 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -308,6 +308,7 @@ in {
   ferm = handleTest ./ferm.nix {};
   ferretdb = handleTest ./ferretdb.nix {};
   filesystems-overlayfs = runTest ./filesystems-overlayfs.nix;
+  firefly-iii = handleTest ./firefly-iii.nix {};
   firefox = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox; };
   firefox-beta = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-beta; };
   firefox-devedition = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-devedition; };
@@ -857,6 +858,7 @@ in {
   stunnel = handleTest ./stunnel.nix {};
   sudo = handleTest ./sudo.nix {};
   sudo-rs = handleTest ./sudo-rs.nix {};
+  sunshine = handleTest ./sunshine.nix {};
   suwayomi-server = handleTest ./suwayomi-server.nix {};
   swap-file-btrfs = handleTest ./swap-file-btrfs.nix {};
   swap-partition = handleTest ./swap-partition.nix {};
diff --git a/nixos/tests/earlyoom.nix b/nixos/tests/earlyoom.nix
index 75bdf56899b30..b7850ddeaaab3 100644
--- a/nixos/tests/earlyoom.nix
+++ b/nixos/tests/earlyoom.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ lib, ... }: {
   name = "earlyoom";
   meta = {
-    maintainers = with lib.maintainers; [ ncfavier ];
+    maintainers = with lib.maintainers; [ ncfavier AndersonTorres ];
   };
 
   machine = {
diff --git a/nixos/tests/firefly-iii.nix b/nixos/tests/firefly-iii.nix
new file mode 100644
index 0000000000000..c93d799320a48
--- /dev/null
+++ b/nixos/tests/firefly-iii.nix
@@ -0,0 +1,26 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "firefly-iii";
+  meta.maintainers = [ lib.maintainers.savyajha ];
+
+  nodes.machine = { config, ... }: {
+    environment.etc = {
+      "firefly-iii-appkey".text = "TestTestTestTestTestTestTestTest";
+    };
+    services.firefly-iii = {
+      enable = true;
+      virtualHost = "http://localhost";
+      enableNginx = true;
+      settings = {
+        APP_KEY_FILE = "/etc/firefly-iii-appkey";
+        LOG_CHANNEL = "stdout";
+        SITE_OWNER = "mail@example.com";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("phpfpm-firefly-iii.service")
+    machine.wait_for_unit("nginx.service")
+    machine.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
+  '';
+})
diff --git a/nixos/tests/gnome-extensions.nix b/nixos/tests/gnome-extensions.nix
index a9bb5e3766b7b..51ccabd7e6a65 100644
--- a/nixos/tests/gnome-extensions.nix
+++ b/nixos/tests/gnome-extensions.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix (
 { pkgs, lib, ...}:
 {
   name = "gnome-extensions";
-  meta.maintainers = [ lib.maintainers.piegames ];
+  meta.maintainers = [ ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/nixos/tests/paperless.nix b/nixos/tests/paperless.nix
index 3d834b29958de..3ef291ba7e06f 100644
--- a/nixos/tests/paperless.nix
+++ b/nixos/tests/paperless.nix
@@ -23,6 +23,7 @@ import ./make-test-python.nix ({ lib, ... }: {
       };
       services.paperless.settings = {
         PAPERLESS_DBHOST = "/run/postgresql";
+        PAPERLESS_OCR_LANGUAGE = "deu";
       };
     };
   }; in self;
diff --git a/nixos/tests/phosh.nix b/nixos/tests/phosh.nix
index 78d6da31beee1..d505f0ffc5245 100644
--- a/nixos/tests/phosh.nix
+++ b/nixos/tests/phosh.nix
@@ -25,6 +25,10 @@ in {
         };
       };
 
+      environment.systemPackages = [
+        pkgs.phosh-mobile-settings
+      ];
+
       systemd.services.phosh = {
         environment = {
           # Accelerated graphics fail on phoc 0.20 (wlroots 0.15)
@@ -63,8 +67,13 @@ in {
         phone.screenshot("03launcher")
 
     with subtest("Check the on-screen keyboard shows"):
-        phone.send_chars("setting", delay=0.2)
+        phone.send_chars("mobile setting", delay=0.2)
         phone.wait_for_text("123") # A button on the OSK
         phone.screenshot("04osk")
+
+    with subtest("Check mobile-phosh-settings starts"):
+       phone.send_chars("\n")
+       phone.wait_for_text("Tweak advanced mobile settings");
+       phone.screenshot("05settings")
   '';
 })
diff --git a/nixos/tests/predictable-interface-names.nix b/nixos/tests/predictable-interface-names.nix
index 51d5e8ae59b92..9ac4f8211e6b1 100644
--- a/nixos/tests/predictable-interface-names.nix
+++ b/nixos/tests/predictable-interface-names.nix
@@ -5,7 +5,7 @@
 
 let
   inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
-  testCombinations = pkgs.lib.cartesianProductOfSets {
+  testCombinations = pkgs.lib.cartesianProduct {
     predictable = [true false];
     withNetworkd = [true false];
     systemdStage1 = [true false];
diff --git a/nixos/tests/sunshine.nix b/nixos/tests/sunshine.nix
new file mode 100644
index 0000000000000..7c7e86de203a0
--- /dev/null
+++ b/nixos/tests/sunshine.nix
@@ -0,0 +1,70 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "sunshine";
+  meta = {
+    # test is flaky on aarch64
+    broken = pkgs.stdenv.isAarch64;
+    maintainers = [ lib.maintainers.devusb ];
+  };
+
+  nodes.sunshine = { config, pkgs, ... }: {
+    imports = [
+      ./common/x11.nix
+    ];
+
+    services.sunshine = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        capture = "x11";
+        encoder = "software";
+        output_name = 0;
+      };
+    };
+
+    environment.systemPackages = with pkgs; [
+      gxmessage
+    ];
+
+  };
+
+  nodes.moonlight = { config, pkgs, ... }: {
+    imports = [
+      ./common/x11.nix
+    ];
+
+    environment.systemPackages = with pkgs; [
+      moonlight-qt
+    ];
+
+  };
+
+  enableOCR = true;
+
+  testScript = ''
+    # start the tests, wait for sunshine to be up
+    start_all()
+    sunshine.wait_for_open_port(48010,"localhost")
+
+    # set the admin username/password, restart sunshine
+    sunshine.execute("sunshine --creds sunshine sunshine")
+    sunshine.systemctl("restart sunshine","root")
+    sunshine.wait_for_open_port(48010,"localhost")
+
+    # initiate pairing from moonlight
+    moonlight.execute("moonlight pair sunshine --pin 1234 >&2 & disown")
+    moonlight.wait_for_console_text("Executing request")
+
+    # respond to pairing request from sunshine
+    sunshine.succeed("curl --insecure -u sunshine:sunshine -d '{\"pin\": \"1234\"}' https://localhost:47990/api/pin")
+
+    # close moonlight once pairing complete
+    moonlight.send_key("kp_enter")
+
+    # put words on the sunshine screen for moonlight to see
+    sunshine.execute("gxmessage 'hello world' -center -font 'sans 75' >&2 & disown")
+
+    # connect to sunshine from moonlight and look for the words
+    moonlight.execute("moonlight --video-decoder software stream sunshine 'Desktop' >&2 & disown")
+    moonlight.wait_for_text("hello world")
+  '';
+})
diff --git a/nixos/tests/wpa_supplicant.nix b/nixos/tests/wpa_supplicant.nix
index 8c701ca7d5f71..5e3b39f27ecf3 100644
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@@ -102,17 +102,34 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
           test2.psk = "@PSK_SPECIAL@";            # should be replaced
           test3.psk = "@PSK_MISSING@";            # should not be replaced
           test4.psk = "P@ssowrdWithSome@tSymbol"; # should not be replaced
+          test5.psk = "@PSK_AWK_REGEX@";          # should be replaced
         };
 
         # secrets
         environmentFile = pkgs.writeText "wpa-secrets" ''
           PSK_VALID="S0m3BadP4ssw0rd";
           # taken from https://github.com/minimaxir/big-list-of-naughty-strings
-          PSK_SPECIAL=",./;'[]\-= <>?:\"{}|_+ !@#$%^\&*()`~";
+          PSK_SPECIAL=",./;'[]\/\-= <>?:\"{}|_+ !@#$%^&*()`~";
+          PSK_AWK_REGEX="PassowrdWith&symbol";
         '';
       };
     };
 
+    imperative = { ... }: {
+      imports = [ ../modules/profiles/minimal.nix ];
+
+      # add a virtual wlan interface
+      boot.kernelModules = [ "mac80211_hwsim" ];
+
+      # wireless client
+      networking.wireless = {
+        enable = lib.mkOverride 0 true;
+        userControlled.enable = true;
+        allowAuxiliaryImperativeNetworks = true;
+        interfaces = [ "wlan1" ];
+      };
+    };
+
     # Test connecting to the SAE-only hotspot using SAE
     machineSae = machineWithHostapd {
       networking.wireless = {
@@ -171,6 +188,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
           basic.fail(f"grep -q @PSK_SPECIAL@ {config_file}")
           basic.succeed(f"grep -q @PSK_MISSING@ {config_file}")
           basic.succeed(f"grep -q P@ssowrdWithSome@tSymbol {config_file}")
+          basic.succeed(f"grep -q 'PassowrdWith&symbol' {config_file}")
 
       with subtest("WPA2 fallbacks have been generated"):
           assert int(basic.succeed(f"grep -c sae-only {config_file}")) == 1
@@ -185,6 +203,15 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
           assert "Failed to connect" not in status, \
                  "Failed to connect to the daemon"
 
+      with subtest("Daemon can be configured imperatively"):
+          imperative.wait_for_unit("wpa_supplicant-wlan1.service")
+          imperative.wait_until_succeeds("wpa_cli -i wlan1 status")
+          imperative.succeed("wpa_cli -i wlan1 add_network")
+          imperative.succeed("wpa_cli -i wlan1 set_network 0 ssid '\"nixos-test\"'")
+          imperative.succeed("wpa_cli -i wlan1 set_network 0 psk '\"reproducibility\"'")
+          imperative.succeed("wpa_cli -i wlan1 save_config")
+          imperative.succeed("grep -q nixos-test /etc/wpa_supplicant.conf")
+
       machineSae.wait_for_unit("hostapd.service")
       machineSae.copy_from_vm("/run/hostapd/wlan0.hostapd.conf")
       with subtest("Daemon can connect to the SAE access point using SAE"):
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index 56f76f6513c77..9197a21a28e10 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    hash = "sha256-3qLmo9Ibl44v6Jj5Ix17ixwqfPt3ITTXUqBETF5pzE4=";
+    hash = "sha256-CzKfvQzhF4Mz2WZaJM/Nt6XjF6ThlX4jyQSaXfZukG8=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/applications/audio/miniplayer/default.nix b/pkgs/applications/audio/miniplayer/default.nix
index 018fd6c8b78f3..e3837baeca048 100644
--- a/pkgs/applications/audio/miniplayer/default.nix
+++ b/pkgs/applications/audio/miniplayer/default.nix
@@ -15,7 +15,11 @@ buildPythonApplication rec {
     hash = "sha256-iUUsVIDLQAiaMomfA2LvvJZ2ePhgADtC6GCwIpRC1MA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     colorthief
     ffmpeg-python
     mpd2
@@ -25,6 +29,8 @@ buildPythonApplication rec {
     ueberzug
   ];
 
+  doCheck = false; # no tests
+
   # pythonImportsCheck is disabled because this package doesn't expose any modules.
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 7a666da0d23f3..f7480557eb5e6 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -15,17 +15,18 @@
 , jack
 , withConplay ? !stdenv.hostPlatform.isWindows
 , perl
+, writeScript
 }:
 
 assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.5";
+  version = "1.32.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-r5CM32zbZUS5e8cGp5n3mJTmlGivWIG/RUoOu5Fx7WM=";
+    hash = "sha256-zN0dCrwx1z2LQ1/GWMeQSdCpBbMGabakKgOtFp3GCeY=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
@@ -69,6 +70,20 @@ stdenv.mkDerivation rec {
       --prefix PATH : $out/bin
   '';
 
+  passthru = {
+    updateScript = writeScript "update-mpg123" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl pcre common-updater-scripts
+
+      set -eu -o pipefail
+
+      # Expect the text in format of '<a href="download/mpg123-1.32.6.tar.bz2">'
+      new_version="$(curl -s https://mpg123.org/download.shtml |
+          pcregrep -o1 '<a href="download/mpg123-([0-9.]+).tar.bz2">')"
+      update-source-version ${pname} "$new_version"
+    '';
+  };
+
   meta = with lib; {
     description = "Fast console MPEG Audio Player and decoder library";
     homepage = "https://mpg123.org";
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index e70a2eb26f174..597f87337caeb 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -6,12 +6,13 @@
 , ncurses
 , openssl
 , Cocoa
-, withALSA ? true, alsa-lib
+, withALSA ? false, alsa-lib
 , withClipboard ? true, libxcb, python3
 , withCover ? false, ueberzug
-, withPulseAudio ? false, libpulseaudio
+, withPulseAudio ? true, libpulseaudio
 , withPortAudio ? false, portaudio
 , withMPRIS ? true, withNotify ? true, dbus
+, withCrossterm ? true
 , nix-update-script
 , testers
 , ncspot
@@ -54,6 +55,7 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optional withPulseAudio "pulseaudio_backend"
     ++ lib.optional withPortAudio "portaudio_backend"
     ++ lib.optional withMPRIS "mpris"
+    ++ lib.optional withCrossterm "crossterm_backend"
     ++ lib.optional withNotify "notify";
 
   postInstall = ''
diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index a42d94e1f89c5..15d0335736017 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.12.5";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qlqwIVk8NzfFZlzShfm3nTZWovObWLIKiNGAOCN8i7Y=";
+    sha256 = "sha256-p0GNwwbhsgChlSlPVD/RHhzWF/1URdYp/iYQmJxORU8=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";
diff --git a/pkgs/applications/blockchains/btcpayserver/deps.nix b/pkgs/applications/blockchains/btcpayserver/deps.nix
index 0e5986de9739b..2ae9af5a08878 100644
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
@@ -8,18 +8,18 @@
   (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38"; })
   (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; sha256 = "12pm2s35c0qzc06099q2z1pxwq94rq85n74yz8fs8gwvm2ksgp4p"; })
   (fetchNuGet { pname = "BTCPayServer.Hwi"; version = "2.0.2"; sha256 = "0lh3n1qncqs4kbrmx65xs271f0d9c7irrs9qnsa9q51cbbqbljh9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.5.3"; sha256 = "0nn6z1gjkkfy46w32pc5dvp4z5gjnwa9bn7xjkxgh7575m467jpp"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.6.0"; sha256 = "0xcqf7jz5rsi6nawcjfdbbdjlnqbx8xfzw8sn3a9ks8xjqv37krn"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.5.1"; sha256 = "1sb6qhm15d6qqyx9v5g7csvp8phhs6k2py5wmfmbpnjydaydf76g"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.5.1"; sha256 = "13slknvqslxn8sp4dcwgbrnigrd9di84h9hribpls79kzw76gfpy"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.6.0"; sha256 = "1bsmic9i1p2ya5hv1mscv46fxh6ibczfj1srylzwcpgs0mypy5y3"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.21"; sha256 = "042xwfsxd30zgwiz0w14ynb755w5sldkplxgw1fkw68lrz66x5s4"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.5.1"; sha256 = "1jy5k0nd2b10p3gyv8qm3nb31chkpcssrb9sjw2dqbac757nv154"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.5.2"; sha256 = "1wmj66my2cg9dbz4bf8vrkxpkpl4wfqaxxzqxgs830vdk8h7pp50"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.5.2"; sha256 = "0g2jv712lb3arlpf6j8p0ccq62gz1bjipb9ndzhdk7mwhaznkrwl"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.5.2"; sha256 = "1yfs2ghh7xw4c98hfm3k8sdkij8qxwnfnb8fjw896jvj2jd3p3sr"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.5.4"; sha256 = "0jqxy60msq9rl04lmqyiz9f02mjywypfh3apr9vcbyv2q47maxnd"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.5.2"; sha256 = "09i663w6i93675bxrq5x6l26kr60mafwfr6ny92xrppj8rmd2lzx"; })
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins"; version = "1.4.4"; sha256 = "0rk0prmb0539ji5fd33cqy3yvw51i5i8m5hb43admr5z8960dd6l"; })
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; sha256 = "1kmmj5m7s41wc1akpqw1b1j7pp4c0vn6sqxb487980ibpj6hyisl"; })
-  (fetchNuGet { pname = "BTCPayServer.NTag424"; version = "1.0.20"; sha256 = "19nzikcg7vygpad83lcaw5jvkrp4pgvggnziwkmi95l8k38gkj5q"; })
+  (fetchNuGet { pname = "BTCPayServer.NTag424"; version = "1.0.22"; sha256 = "1gy81kqd745p2sak7yj5phn25k8blwwjzi39s5ikpwyqg3b0arsw"; })
   (fetchNuGet { pname = "CsvHelper"; version = "15.0.5"; sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma"; })
   (fetchNuGet { pname = "Dapper"; version = "2.1.28"; sha256 = "15vpa9k11rr1mh5vb6hdchy8hqa03lqs83w19s3kxzh1089yl9m8"; })
   (fetchNuGet { pname = "DigitalRuby.ExchangeSharp"; version = "1.0.4"; sha256 = "1hkdls4wjrxq6df1zq9saa6hn5hynalq3gxb486w59j7i9f3g7d8"; })
@@ -36,7 +36,7 @@
   (fetchNuGet { pname = "Google.Apis.Core"; version = "1.38.0"; sha256 = "012gslhnx65vqfyzjnqx4bqk9kb8bwbx966q2f9fdgrfcn26gj9j"; })
   (fetchNuGet { pname = "Google.Apis.Storage.v1"; version = "1.38.0.1470"; sha256 = "0mfrz7fmpfbjvp4zfpjasmnfbgxgxrrjkf8xgp9p6h9g8qh2f2h2"; })
   (fetchNuGet { pname = "Google.Cloud.Storage.V1"; version = "2.3.0"; sha256 = "01jhrd6m6md8m28chzg2dkdfd4yris79j1xi7r1ydm1cfjhmlj64"; })
-  (fetchNuGet { pname = "HtmlSanitizer"; version = "8.0.723"; sha256 = "1x621v4ypgd1zrmq7zd7j9wcrc30f6rm9qh0i1sm4yfqd983yf4g"; })
+  (fetchNuGet { pname = "HtmlSanitizer"; version = "8.0.838"; sha256 = "1k05ld36872lzbhlby9m1vf9y7chlijbflbk2pzcni57b9rp2qrg"; })
   (fetchNuGet { pname = "Humanizer.Core"; version = "2.14.1"; sha256 = "1ai7hgr0qwd7xlqfd92immddyi41j3ag91h3594yzfsgsy6yhyqi"; })
   (fetchNuGet { pname = "libsodium"; version = "1.0.18"; sha256 = "15qzl5k31yaaapqlijr336lh4lzz1qqxlimgxy8fdyig8jdmgszn"; })
   (fetchNuGet { pname = "LNURL"; version = "0.0.34"; sha256 = "1sbkqsln7wq5fsbw63wdha8kqwxgd95j0iblv4kxa1shyg3c5d9x"; })
@@ -251,6 +251,7 @@
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "6.0.0"; sha256 = "1js98kmjn47ivcvkjqdmyipzknb9xbndssczm8gq224pbaj1p88c"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; sha256 = "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "8.0.0"; sha256 = "0z53a42zjd59zdkszcm7pvij4ri5xbb8jly9hzaad9khlf69bcqp"; })
   (fetchNuGet { pname = "System.Composition"; version = "6.0.0"; sha256 = "1p7hysns39cc24af6dwd4m48bqjsrr3clvi4aws152mh2fgyg50z"; })
   (fetchNuGet { pname = "System.Composition.AttributedModel"; version = "6.0.0"; sha256 = "1mqrblb0l65hw39d0hnspqcv85didpn4wbiwhfgj4784wzqx2w6k"; })
   (fetchNuGet { pname = "System.Composition.Convention"; version = "6.0.0"; sha256 = "02km3yb94p1c4s7liyhkmda0g71zm1rc8ijsfmy4bnlkq15xjw3b"; })
diff --git a/pkgs/applications/blockchains/nbxplorer/default.nix b/pkgs/applications/blockchains/nbxplorer/default.nix
index 6a4b164e5f1c4..5f8c0110402e3 100644
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "nbxplorer";
-  version = "2.5.0";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "sha256-yhOPv8J1unDx61xPc8ktQbIfkp00PPXRlOgdGo2QkB4=";
+    sha256 = "sha256-zfL+VoDfICUtw02KeRghaq3XPOa/YnSh8orhqmo3Auo=";
   };
 
   projectFile = "NBXplorer/NBXplorer.csproj";
diff --git a/pkgs/applications/blockchains/nbxplorer/deps.nix b/pkgs/applications/blockchains/nbxplorer/deps.nix
index 97879b0c4e394..cdf73d5de09ad 100644
--- a/pkgs/applications/blockchains/nbxplorer/deps.nix
+++ b/pkgs/applications/blockchains/nbxplorer/deps.nix
@@ -46,7 +46,7 @@
   (fetchNuGet { pname = "NicolasDorier.CommandLine"; version = "2.0.0"; sha256 = "0gywvl0gqs3crlzwgwzcqf0qsrbhk3dxjycpimxqvs1ihg4dhb1f"; })
   (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "2.0.0"; sha256 = "1cng096r3kb85lf5wjill4yhxx8nv9v0d6ksbn1i1vvdawwl6fkw"; })
   (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "2.0.0"; sha256 = "0058dx34ja2idw468bmw7l3w21wr2am6yx57sqp7llhjl5ayy0wv"; })
-  (fetchNuGet { pname = "Npgsql"; version = "8.0.1"; sha256 = "01dqlqpwr450vfs7r113k1glrnpnr2fgc04x5ni6bj0k6aahhl7v"; })
+  (fetchNuGet { pname = "Npgsql"; version = "8.0.2"; sha256 = "0w1hm3bjh1vfnkzflp1x8bd4d723mpr4y6gb6ga79v5kkf09cmm2"; })
   (fetchNuGet { pname = "RabbitMQ.Client"; version = "5.1.2"; sha256 = "195nxmnva1z2p0ahvn0kswv4d39f5bdy2sl3cxcvfziamc21xrmd"; })
   (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
   (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "1wl76vk12zhdh66vmagni66h5xbhgqq7zkdpgw21jhxhvlbcl8pk"; })
diff --git a/pkgs/applications/blockchains/terra-station/default.nix b/pkgs/applications/blockchains/terra-station/default.nix
index cf684e062c5cb..5c4a7cc8b3549 100644
--- a/pkgs/applications/blockchains/terra-station/default.nix
+++ b/pkgs/applications/blockchains/terra-station/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchurl
-, gcc-unwrapped
 , dpkg
 , util-linux
 , bash
@@ -57,8 +56,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ gcc-unwrapped.lib ]}"
+      --add-flags $out/share/${pname}/resources/app.aasar
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 5f7b3d259dec5..d3940efaccc11 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -18,8 +18,8 @@ let
     sha256Hash = "sha256-zROBKzQiP4V2P67HgOIkHgn8q/M0zy5MkZozVSiQsWU=";
   };
   latestVersion = {
-    version = "2024.1.1.3"; # "Android Studio Koala | 2024.1.1 Canary 5"
-    sha256Hash = "sha256-JL2cloR0RhSnr8e62fHhxIzF286fT9sahTuv2OoQVRY=";
+    version = "2024.1.1.4"; # "Android Studio Koala | 2024.1.1 Canary 6"
+    sha256Hash = "sha256-lfig7lFyF7XZowTQKpo6zGeR23VHq/f7vvUDWCs7jeo=";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/editors/jetbrains/bin/ides.json b/pkgs/applications/editors/jetbrains/bin/ides.json
index b503a7c6759c9..b44aa560e5432 100644
--- a/pkgs/applications/editors/jetbrains/bin/ides.json
+++ b/pkgs/applications/editors/jetbrains/bin/ides.json
@@ -168,5 +168,16 @@
       "longDescription": "WebStorm provides an editor for HTML, JavaScript (incl. Node.js), and CSS with on-the-fly code analysis, error prevention and automated refactorings for JavaScript code.",
       "homepage": "https://www.jetbrains.com/webstorm/"
     }
+  },
+  "writerside": {
+    "product": "Writerside",
+    "wmClass": "jetbrains-writerside",
+    "meta": {
+      "isOpenSource": false,
+      "description": "Documentation IDE from JetBrains",
+      "maintainers": [ "zlepper"],
+      "longDescription": "The most powerful development environment – now adapted for writing documentation.",
+      "homepage": "https://www.jetbrains.com/writerside/"
+    }
   }
 }
diff --git a/pkgs/applications/editors/jetbrains/bin/update_bin.py b/pkgs/applications/editors/jetbrains/bin/update_bin.py
index 31271d1dffed9..604499203363a 100755
--- a/pkgs/applications/editors/jetbrains/bin/update_bin.py
+++ b/pkgs/applications/editors/jetbrains/bin/update_bin.py
@@ -68,7 +68,11 @@ def update_product(name, product):
         try:
             build = latest_build(channel)
             new_version = build["@version"]
-            new_build_number = build["@fullNumber"]
+            new_build_number = ""
+            if "@fullNumber" not in build:
+                new_build_number = build["@number"]
+            else:
+                new_build_number = build["@fullNumber"]
             if "EAP" not in channel["@name"]:
                 version_or_build_number = new_version
             else:
diff --git a/pkgs/applications/editors/jetbrains/bin/versions.json b/pkgs/applications/editors/jetbrains/bin/versions.json
index af8d8453ad7c9..c7f7009465cdc 100644
--- a/pkgs/applications/editors/jetbrains/bin/versions.json
+++ b/pkgs/applications/editors/jetbrains/bin/versions.json
@@ -120,6 +120,14 @@
       "sha256": "d4c7cb7f1462c2b2bd9042b4714ab9de66c455ab9752c87698dc3902f0d49a2a",
       "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.1.tar.gz",
       "build_number": "241.14494.235"
+    },
+    "writerside": {
+      "update-channel": "Writerside EAP",
+      "url-template": "https://download.jetbrains.com/writerside/writerside-{version}.tar.gz",
+      "version": "2023.3 EAP",
+      "sha256": "8eae1c965c1b5dae17c580cd3ed9b2a6182a3b54a54f8e6152472815118ae2c2",
+      "url": "https://download.jetbrains.com/writerside/writerside-233.14938.tar.gz",
+      "build_number": "233.14938"
     }
   },
   "aarch64-linux": {
@@ -243,6 +251,14 @@
       "sha256": "6691e4855fd4ecf3da9b63b78a11afc3441fb2139cdc7e7aaa5d78aa92a88c12",
       "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.1-aarch64.tar.gz",
       "build_number": "241.14494.235"
+    },
+    "writerside": {
+      "update-channel": "Writerside EAP",
+      "url-template": "https://download.jetbrains.com/writerside/writerside-{version}-aarch64.tar.gz",
+      "version": "2023.3 EAP",
+      "sha256": "b09dac04217d5d523501bdb1e9026fd17fb6370dff2610502472bbf6a48323d8",
+      "url": "https://download.jetbrains.com/writerside/writerside-233.14938-aarch64.tar.gz",
+      "build_number": "233.14938"
     }
   },
   "x86_64-darwin": {
@@ -366,6 +382,14 @@
       "sha256": "b3b41e5e8559e36e0bd4121dee61d39a8ba5b5ce8193e7b026c5bc261e973df5",
       "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.1.dmg",
       "build_number": "241.14494.235"
+    },
+    "writerside": {
+      "update-channel": "Writerside EAP",
+      "url-template": "https://download.jetbrains.com/writerside/writerside-{version}.dmg",
+      "version": "2023.3 EAP",
+      "sha256": "53c7ad5a8808776b60eb82b3155c6f3a2a0dfad43ba8d9238a0db1752d503b09",
+      "url": "https://download.jetbrains.com/writerside/writerside-233.14938.dmg",
+      "build_number": "233.14938"
     }
   },
   "aarch64-darwin": {
@@ -489,6 +513,14 @@
       "sha256": "95dd3a397fe063583c5e3ba4fefafdfcad740c18447c1a70c0f03cb004436496",
       "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.1-aarch64.dmg",
       "build_number": "241.14494.235"
+    },
+    "writerside": {
+      "update-channel": "Writerside EAP",
+      "url-template": "https://download.jetbrains.com/writerside/writerside-{version}-aarch64.dmg",
+      "version": "2023.3 EAP",
+      "sha256": "2a78fbcabcdd5b7c906d933dd91ac927bde22ae3bba988dad7450184fd90457a",
+      "url": "https://download.jetbrains.com/writerside/writerside-233.14938-aarch64.dmg",
+      "build_number": "233.14938"
     }
   }
 }
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 4c53a5bbe59e3..a88785e708178 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -257,6 +257,8 @@ rec {
 
   webstorm = mkJetBrainsProduct { pname = "webstorm"; extraBuildInputs = [ stdenv.cc.cc musl ]; };
 
+  writerside = mkJetBrainsProduct { pname = "writerside"; extraBuildInputs = [ stdenv.cc.cc musl ]; };
+
   plugins = callPackage ./plugins { } // { __attrsFailEvaluation = true; };
 
 }
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index aa5b007c4d1b3..b29e020cbf612 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, gettext, msgpack-c, libtermkey, libiconv
+{ lib, stdenv, fetchFromGitHub, removeReferencesTo, cmake, gettext, msgpack-c, libtermkey, libiconv
 , libuv, lua, ncurses, pkg-config
 , unibilium, gperf
 , libvterm-neovim
@@ -121,6 +121,7 @@ in {
       cmake
       gettext
       pkg-config
+      removeReferencesTo
     ];
 
     # extra programs test via `make functionaltest`
@@ -141,8 +142,11 @@ in {
       sed -i src/nvim/po/CMakeLists.txt \
         -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
     '';
+    postInstall = ''
+      find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+    '';
     # check that the above patching actually works
-    disallowedReferences = [ stdenv.cc ] ++ lib.optional (lua != codegenLua) codegenLua;
+    disallowedRequisites = [ stdenv.cc ] ++ lib.optional (lua != codegenLua) codegenLua;
 
     cmakeFlags = [
       # Don't use downloaded dependencies. At the end of the configurePhase one
diff --git a/pkgs/applications/editors/neovim/neovide/default.nix b/pkgs/applications/editors/neovim/neovide/default.nix
index b103c9f20be5f..ce9b091add820 100644
--- a/pkgs/applications/editors/neovim/neovide/default.nix
+++ b/pkgs/applications/editors/neovim/neovide/default.nix
@@ -113,7 +113,7 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
     homepage = "https://github.com/neovide/neovide";
     changelog = "https://github.com/neovide/neovide/releases/tag/${version}";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ ck3d multisn8 ];
+    maintainers = with maintainers; [ ck3d ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/editors/standardnotes/default.nix b/pkgs/applications/editors/standardnotes/default.nix
index 8d535f6f5534d..e61f57c76448c 100644
--- a/pkgs/applications/editors/standardnotes/default.nix
+++ b/pkgs/applications/editors/standardnotes/default.nix
@@ -1,5 +1,12 @@
-{ lib, stdenv, fetchurl, dpkg, makeWrapper, electron, libsecret
-, desktop-file-utils , callPackage }:
+{ lib
+, stdenv
+, fetchurl
+, dpkg
+, makeWrapper
+, electron
+, desktop-file-utils
+, callPackage
+}:
 
 let
 
@@ -33,8 +40,7 @@ stdenv.mkDerivation rec {
     cp -R opt/Standard\ Notes/resources/app.asar $out/share/standardnotes/
 
     makeWrapper ${electron}/bin/electron $out/bin/standardnotes \
-      --add-flags $out/share/standardnotes/app.asar \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libsecret stdenv.cc.cc.lib ]}
+      --add-flags $out/share/standardnotes/app.asar
 
     ${desktop-file-utils}/bin/desktop-file-install --dir $out/share/applications \
       --set-key Exec --set-value standardnotes usr/share/applications/standard-notes.desktop
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index a32285f19e7aa..d33891c37d26f 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0148";
+  version = "9.1.0200";
 
   outputs = [ "out" "xxd" ];
 
@@ -8,7 +8,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-lBs9PwNE3GoxtMka9oftYx3gegjCv6D3sEyAWK6RZzM=";
+    hash = "sha256-MAMd+k4GpFUwEZzQTWtzSpYY6AEez+FMiqexozYK3Y4=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/vim/plugins/deprecated.json b/pkgs/applications/editors/vim/plugins/deprecated.json
index d855a3d2cd4bd..e73899e66fea8 100644
--- a/pkgs/applications/editors/vim/plugins/deprecated.json
+++ b/pkgs/applications/editors/vim/plugins/deprecated.json
@@ -48,7 +48,7 @@
         "new": "sqlite-lua"
     },
     "vim-fsharp": {
-        "date": "2024-04-03",
+        "date": "2024-04-21",
         "new": "zarchive-vim-fsharp"
     },
     "vim-jade": {
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index d8e8dfe1e554e..c51621873ea30 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -65,12 +65,12 @@ final: prev:
 
   Coqtail = buildVimPlugin {
     pname = "Coqtail";
-    version = "2024-03-30";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "whonore";
       repo = "Coqtail";
-      rev = "c881047dd32cbd9524b0c733821c113ebcc03b07";
-      sha256 = "1my43cd1shgjg0f111qq14n217l3msdxgx2ks2hdil9vbrvn530s";
+      rev = "c74271e68dfc9e125e6ae197879eb50c7b34512d";
+      sha256 = "1x2yhdmmm5sbfpqbkrivwa05hx8vk5xa3468db3554clawkp2mnj";
     };
     meta.homepage = "https://github.com/whonore/Coqtail/";
   };
@@ -173,24 +173,24 @@ final: prev:
 
   LazyVim = buildVimPlugin {
     pname = "LazyVim";
-    version = "2024-03-29";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "LazyVim";
       repo = "LazyVim";
-      rev = "97480dc5d2dbb717b45a351e0b04835f138a9094";
-      sha256 = "0p5qrqk958rp85vskh5di05s0v9a02phmpdk6gy61z632ycvym6w";
+      rev = "bb36f71b77d8e15788a5b62c82a1c9ec7b209e49";
+      sha256 = "1vjckraf062d7dybf1iphp7i7lwphzgc1bns0jzfardbd1q9gw3f";
     };
     meta.homepage = "https://github.com/LazyVim/LazyVim/";
   };
 
   LeaderF = buildVimPlugin {
     pname = "LeaderF";
-    version = "2024-03-29";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "Yggdroot";
       repo = "LeaderF";
-      rev = "735a2f36d3a25e320182bf3f385f5530d674600e";
-      sha256 = "058m5ry3lc4wz7978vd0a2a2wqv7q1z3adzasfzsddhah07dkxa3";
+      rev = "d4eded0ab36ba60aa7e13893a2064a74d2cdb6bd";
+      sha256 = "0xzdm4ggh5bggnxjgcaxkzdiwfxs11yblgmpwvzqjhpzv8qnzkx1";
     };
     meta.homepage = "https://github.com/Yggdroot/LeaderF/";
   };
@@ -305,12 +305,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "2024-04-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "32e3a9654693f513a2cbb76ba99cbc9947b1352d";
-      sha256 = "1sazs3a8zzbjy6g83fm1kqah8cc3x3pihbzqplmllrw2nbc29qxk";
+      rev = "f7cae6f1b38cb296f48ce1a9c5ed1a419d912a42";
+      sha256 = "0mdriqqna37a9fjbilaq2qkkn4ik4jn2dz1x6ra51pgh42r86qhl";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -522,12 +522,12 @@ final: prev:
 
   aerial-nvim = buildVimPlugin {
     pname = "aerial.nvim";
-    version = "2024-03-28";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "aerial.nvim";
-      rev = "24ebacab5821107c50f628e8e7774f105c08fe9b";
-      sha256 = "148d8v57g7sxh1xy3df2bzq8jvgp70k52rw9ihr88f0dd3x7zsfj";
+      rev = "7045e7cb0017d222122a1f6e5795e69754d8b9db";
+      sha256 = "04mclw1drrkr4x4gnb26p6szg6glbkkff7cbrxy4g7fyx6lhl9fy";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/aerial.nvim/";
@@ -583,12 +583,12 @@ final: prev:
 
   ale = buildVimPlugin {
     pname = "ale";
-    version = "2024-03-20";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "6c10a519f1460179cf8f8e329d8eb3186247be2b";
-      sha256 = "122hsm461cqs3k48fqzsizqnknm7pg4v8pnpady3zzjwijzgq9h7";
+      rev = "adee52fba040428264aee956d99033572fc405a3";
+      sha256 = "125hcnl146bh8bpsp3v62dbdqpzwma5n69f8y6gpk5anh4yc1sai";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
   };
@@ -691,12 +691,12 @@ final: prev:
 
   astrotheme = buildVimPlugin {
     pname = "astrotheme";
-    version = "2024-04-01";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "AstroNvim";
       repo = "astrotheme";
-      rev = "e056b8216214f7140eda3e0adcfc27efba705231";
-      sha256 = "1l17d68y3p1gyhp8w2ll3v9mcvnbc4gyck2qlc595w79d0hgzfhr";
+      rev = "8b316aa3ecd8c4206430379c0b1da0b4e7969ab9";
+      sha256 = "120fz8z6bmsp7dqjhg8dygbgv1q4bzwk0k8ji55xa2w6bc8ji3ii";
     };
     meta.homepage = "https://github.com/AstroNvim/astrotheme/";
   };
@@ -895,12 +895,12 @@ final: prev:
 
   auto-session = buildVimPlugin {
     pname = "auto-session";
-    version = "2024-04-01";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "rmagatti";
       repo = "auto-session";
-      rev = "64dc86e43c85f0062baafb0b607a6162efc99c91";
-      sha256 = "051l736qzpmnljindha84zbbl5i6ckzn2ys1gpmcj93l80nf2jc7";
+      rev = "9e0a169b6fce8791278abbd110717b921afe634d";
+      sha256 = "0d1rbdsrlprr8dsw948i352c8564hglh56vwg80qxqib2ssfxvy2";
     };
     meta.homepage = "https://github.com/rmagatti/auto-session/";
   };
@@ -1015,24 +1015,24 @@ final: prev:
 
   bamboo-nvim = buildVimPlugin {
     pname = "bamboo.nvim";
-    version = "2024-03-16";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "ribru17";
       repo = "bamboo.nvim";
-      rev = "5c826c8ad27010ac2fcaf7deb4c36b16d00ef5a1";
-      sha256 = "1651b4lyll7902817bi4ndx115k7pxsvbx8mdddmmkw863zl60db";
+      rev = "aaeda8100e3a7ebcc65b5897c9027eca2bd9cbf2";
+      sha256 = "1734skv1z9qd8p6dspda1hhq79rd4y4bkyggf0iphz8qw7g0qm8m";
     };
     meta.homepage = "https://github.com/ribru17/bamboo.nvim/";
   };
 
   barbar-nvim = buildVimPlugin {
     pname = "barbar.nvim";
-    version = "2024-04-01";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "romgrk";
       repo = "barbar.nvim";
-      rev = "e7521487be265773f81200a2628b141c836c089b";
-      sha256 = "11hx8vbspf5ai547x5r3cc217qn40mxrxcasblhcwmjgg9ybnvdd";
+      rev = "88fe247ba6453b6ac422f26eb047acaac1a6000a";
+      sha256 = "0amim3cminq310rzqyylkf7afkyjpmxcvp1y42ml00vdl7av2484";
     };
     meta.homepage = "https://github.com/romgrk/barbar.nvim/";
   };
@@ -1051,12 +1051,12 @@ final: prev:
 
   base16-nvim = buildVimPlugin {
     pname = "base16-nvim";
-    version = "2024-02-17";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "base16-nvim";
-      rev = "b3e9ec6a82c05b562cd71f40fe8964438a9ba64a";
-      sha256 = "1qb8g6q8vwq99030nqw719xgrizbqcnmj4n25fqakjq8pbclwh4p";
+      rev = "eec6882101dd189117f79c5d18d389d20cfc0415";
+      sha256 = "060cm7071gr3vpizd7iinpgk50igsqrgcrffa0ali2r6mdhxcwd7";
     };
     meta.homepage = "https://github.com/RRethy/base16-nvim/";
   };
@@ -1279,12 +1279,12 @@ final: prev:
 
   bufferline-nvim = buildVimPlugin {
     pname = "bufferline.nvim";
-    version = "2024-03-07";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "bufferline.nvim";
-      rev = "64e2c5def50dfd6b6f14d96a45fa3d815a4a1eef";
-      sha256 = "1r9bb6jmcj2048ny86v7ha8scjv1qispmxhj98l11jb2xb1f1fvn";
+      rev = "f6f00d9ac1a51483ac78418f9e63126119a70709";
+      sha256 = "1681xqpvxb7zhfig69d0qf287qzxfwcwb6vipnhykiisd8vn9inv";
     };
     meta.homepage = "https://github.com/akinsho/bufferline.nvim/";
   };
@@ -1303,12 +1303,12 @@ final: prev:
 
   bullets-vim = buildVimPlugin {
     pname = "bullets.vim";
-    version = "2024-03-08";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "bullets-vim";
       repo = "bullets.vim";
-      rev = "0cc28d53e9da628e006c89bb2d3b03b94a0dee33";
-      sha256 = "0gxa73q89w7mkhhmy3f2zdcsys4p9m4z61ff1c9lmbvd1r8dh898";
+      rev = "4ed0785a5a812d9dc96164f2ceab10f5dce68270";
+      sha256 = "0dpbh9l4a3009k0qi016zm03wjc12jbf31lhj78mmqnpazfn7gfh";
     };
     meta.homepage = "https://github.com/bullets-vim/bullets.vim/";
   };
@@ -1351,24 +1351,24 @@ final: prev:
 
   ccc-nvim = buildVimPlugin {
     pname = "ccc.nvim";
-    version = "2024-04-01";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "uga-rosa";
       repo = "ccc.nvim";
-      rev = "46b8a38a3bc287f27789800d3d26480d093d65b5";
-      sha256 = "0cgmvjkyvrn9c77hl1i5qbak8v8ypl8m0pqkpz886x2f95xa68xd";
+      rev = "1283eef5494c092a047baa34ed3e667f3cb2715e";
+      sha256 = "1wipfpypa2zjdc2n4cjkiaxcfh0mraiwiripg3vmd4mf37wbxphv";
     };
     meta.homepage = "https://github.com/uga-rosa/ccc.nvim/";
   };
 
   chadtree = buildVimPlugin {
     pname = "chadtree";
-    version = "2024-04-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "f085e2363ed170b3d90a95e614954395a0a541c0";
-      sha256 = "01cfzcm2f6vr67w2l4f80iqmp74l827mmzcfjgcxjc68a70y2y8f";
+      rev = "a8271021ec4f5cae4b9a276ab8662e9a7d6074f9";
+      sha256 = "0cpzpz17smp3dc4lwid3gkkjwangndy1d6fbijrl1l2jpa8dzrgq";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -1423,12 +1423,12 @@ final: prev:
 
   citruszest-nvim = buildVimPlugin {
     pname = "citruszest.nvim";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "zootedb0t";
       repo = "citruszest.nvim";
-      rev = "b30d441088d579d22e773f4cb28550fb9a65a604";
-      sha256 = "03j3n1rjmvylllhhpp6qz5v6n3h1hb12bsp186jvamb3wqky48la";
+      rev = "ea9cb04feadc1f7fbd2902fc65f0308354583f5d";
+      sha256 = "0mqnh1155pg0dw07hzn7jd5x42gwvffkpn7w1pk4jnmaas3yxpkh";
     };
     meta.homepage = "https://github.com/zootedb0t/citruszest.nvim/";
   };
@@ -1519,12 +1519,12 @@ final: prev:
 
   cmake-tools-nvim = buildVimPlugin {
     pname = "cmake-tools.nvim";
-    version = "2024-03-19";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "Civitasv";
       repo = "cmake-tools.nvim";
-      rev = "a4cd0b3a2c8a166a54b36bc00579954426748959";
-      sha256 = "1bi79pv0wd97rvjx1dx60y87c7shw8xrg02mf08rl3l6827zq3p8";
+      rev = "8506c426d5b361dbaa7c61c0490a2589a9c555ce";
+      sha256 = "1kmrfbxwzi60mf88qfcwjcwn0js9wci0yz89d99zgrm0vxl5jpkh";
     };
     meta.homepage = "https://github.com/Civitasv/cmake-tools.nvim/";
   };
@@ -1747,12 +1747,12 @@ final: prev:
 
   cmp-git = buildVimPlugin {
     pname = "cmp-git";
-    version = "2023-12-29";
+    version = "2024-04-15";
     src = fetchFromGitHub {
       owner = "petertriho";
       repo = "cmp-git";
-      rev = "8d8993680d627c8f13bd85094eba84604107dbdd";
-      sha256 = "1p7jq14rcljkg2d216498gr0gj76p493vy0h4jzgsz8ncmfxk6qw";
+      rev = "b9603f18496bc3ca07e6bd474607081af709e750";
+      sha256 = "0r27gf1j77fmqi2m8n5q3s326wp3ns81p7vcfhn6j74y979v11jg";
     };
     meta.homepage = "https://github.com/petertriho/cmp-git/";
   };
@@ -1867,12 +1867,12 @@ final: prev:
 
   cmp-nvim-tags = buildVimPlugin {
     pname = "cmp-nvim-tags";
-    version = "2023-05-10";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "quangnguyen30192";
       repo = "cmp-nvim-tags";
-      rev = "30bdc2eec86eb66730af541bb06d24d4a67e3eeb";
-      sha256 = "0dlpw2z9amb4klsr0mjviin73bj7zqfh3lz0g2lwb2n5g6jnakfn";
+      rev = "3580b6c97c35831afc25a23f1e7f4aa8ad070481";
+      sha256 = "074y4h2p5dx72s7y6spi1iqqpmva3f2mr33pra155ahzqpzqi3v7";
     };
     meta.homepage = "https://github.com/quangnguyen30192/cmp-nvim-tags/";
   };
@@ -2203,12 +2203,12 @@ final: prev:
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "2024-03-28";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "196d8f0314bc6199f8243f00411ca7d87adc3c30";
-      sha256 = "1gq1kqinyqj5d2w7420kvyvs9wkbr29zhhibbrac287smpqvgkw0";
+      rev = "a8823eed914f89cdd3940ed9f5f62786e6d585c1";
+      sha256 = "1s3hcbhx5kn3b6m1793m02kl94g8hb53jc5lhjhgkg4qhx27hsq9";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -2227,12 +2227,12 @@ final: prev:
 
   codeium-nvim = buildVimPlugin {
     pname = "codeium.nvim";
-    version = "2024-03-21";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "Exafunction";
       repo = "codeium.nvim";
-      rev = "a070f57c0f54bd940436b94c8b679bcad5a48811";
-      sha256 = "1r2sshdl7afgy5c5v5jc1lffvw4wbb4fv9fhn1fgxvn61r0xm005";
+      rev = "dfcac077fa023b7194c6403ac9a8f931b9c24f28";
+      sha256 = "03lykrm0d5xm8i5f002xfy7l8wmzji5bqy4ygl3vals12ni5ymph";
     };
     meta.homepage = "https://github.com/Exafunction/codeium.nvim/";
   };
@@ -2491,12 +2491,12 @@ final: prev:
 
   conform-nvim = buildVimPlugin {
     pname = "conform.nvim";
-    version = "2024-03-28";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "conform.nvim";
-      rev = "9d5ba06d6ee7418c674f498634617416d15b6239";
-      sha256 = "0xpgpjaq40qf686qg0m5hhqpqahjz5wgxviyxny2i7zk4r832bqm";
+      rev = "a6965ac128eba75537ec2bc5ddd5d5e357062bdc";
+      sha256 = "00knvdl5msvn178skxqxb0ip722cnqrpp8xr1id4z6j5vbysmhiy";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/conform.nvim/";
@@ -2564,12 +2564,12 @@ final: prev:
 
   copilot-vim = buildVimPlugin {
     pname = "copilot.vim";
-    version = "2024-03-14";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "github";
       repo = "copilot.vim";
-      rev = "9484e35cf222e9360e05450622a884f95c662c4c";
-      sha256 = "1c7dabbyk5124xw5k5b29h9nmv04ix6p3j3p7qns7ssqinvfphmm";
+      rev = "1e135c5303bc60598f6314a2276f31dc91aa34dd";
+      sha256 = "06b5c0xgs3xiajdw7ag3qbv4i0qwn4s084r4pj5v8d9iyc834kiz";
     };
     meta.homepage = "https://github.com/github/copilot.vim/";
   };
@@ -2588,12 +2588,12 @@ final: prev:
 
   coq-thirdparty = buildVimPlugin {
     pname = "coq.thirdparty";
-    version = "2024-02-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.thirdparty";
-      rev = "d9c1492ee60d627b171c7a9bcd0c3bb35af3e0fd";
-      sha256 = "0q8fv58v2sy9kq737ddmrrf0vvqpz8wrybnrks3vazq017jc5y7v";
+      rev = "5f45777bcb0c14266a7e07ed474cb70c4e8b6397";
+      sha256 = "0h2rq7aqxrf58cgwh6iwm2gs2fghkipyz20gdwqcy5hqmy2l0mi1";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
   };
@@ -2612,12 +2612,12 @@ final: prev:
 
   coq_nvim = buildVimPlugin {
     pname = "coq_nvim";
-    version = "2024-04-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "c7fc9a764f91d7152c6a435de730eb436aeeed49";
-      sha256 = "0ljpylgxir8sbcxh9qmvwm1vpabs2l4s3im81yfcyj1164hwsk84";
+      rev = "98e389717df1a29f557f7a5d8f1d8a7e5c0560dd";
+      sha256 = "16ngidw3lg1virbd731pp9z1s20j8mva6569blkj7cnk08kprh7l";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
   };
@@ -2648,12 +2648,12 @@ final: prev:
 
   crates-nvim = buildVimPlugin {
     pname = "crates.nvim";
-    version = "2024-03-13";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "saecki";
       repo = "crates.nvim";
-      rev = "b4f4987ccdb1cc3899ee541ef4375c73c48c4570";
-      sha256 = "0r9l018sfymmbg7lc31bp4q2aqdljaqini5s14mg3r7lwcg15z61";
+      rev = "786d12a70c9b91fa2d0d102bb07df02be0db31a1";
+      sha256 = "1krd7srvzjrikpirfypw09cv2flcy22jv8amrbxfxykrgg2vn6dd";
     };
     meta.homepage = "https://github.com/saecki/crates.nvim/";
   };
@@ -2744,12 +2744,12 @@ final: prev:
 
   cyberdream-nvim = buildVimPlugin {
     pname = "cyberdream.nvim";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "scottmckendry";
       repo = "cyberdream.nvim";
-      rev = "10bae2c37bc76e812af769687acb88b11283d38b";
-      sha256 = "1w7k5x8da0a3ifw0hgs5wcph5kixx52jd0zqqdf7v76ci3158g95";
+      rev = "9a7f07ad318a96f19845683014d27be00495ea98";
+      sha256 = "1w8ic8ngfk1x99yl7bx7kfqmwi0py6xj198yczvxwzmgfxby5sjc";
     };
     meta.homepage = "https://github.com/scottmckendry/cyberdream.nvim/";
   };
@@ -2780,24 +2780,24 @@ final: prev:
 
   dashboard-nvim = buildVimPlugin {
     pname = "dashboard-nvim";
-    version = "2024-04-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "nvimdev";
       repo = "dashboard-nvim";
-      rev = "7c0c09d55118a2afeb8874e885f87ae80d8ff452";
-      sha256 = "0ipn3cbivi04hn1qixxp8cd4kxfsjnkd3a8hz5j3bpn4x74c6qxk";
+      rev = "6d06924b562de6f0bb136edf1bf549afbf6b7d00";
+      sha256 = "1c5xhwsj84rs00zds9279wfvxc2xjmdfix36mvxdklrq6f083ifd";
     };
     meta.homepage = "https://github.com/nvimdev/dashboard-nvim/";
   };
 
   debugprint-nvim = buildVimPlugin {
     pname = "debugprint.nvim";
-    version = "2024-04-03";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "andrewferrier";
       repo = "debugprint.nvim";
-      rev = "ff44034c8f52feb252bd88311f91b8c9b9abe0f0";
-      sha256 = "1gxfimxg422bgz631nrdxwmmvx1l40vy3qjwawnp0jgi0b32nlfv";
+      rev = "4ac809ff035eb246392ce4593c49705e894dbbea";
+      sha256 = "1zjycn3qj6mpa7c5aknka2dfq8d05ac8rc6sfh81sal2hwdnq1d1";
     };
     meta.homepage = "https://github.com/andrewferrier/debugprint.nvim/";
   };
@@ -2900,24 +2900,24 @@ final: prev:
 
   denops-vim = buildVimPlugin {
     pname = "denops.vim";
-    version = "2024-03-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "vim-denops";
       repo = "denops.vim";
-      rev = "c057cdff217e3f7de9f19c8da270b23523bb19a4";
-      sha256 = "1sjsc04ssjblcyxlpp944qhhpf6qizw6d595cgj2i8pap0vpx4bf";
+      rev = "c727a3f05a804d1f04b11735f8241518465de9a7";
+      sha256 = "1h08jrxa07b59ipxqlk2ni78bn1h2w4qdg0m46bwgn7pb24479f6";
     };
     meta.homepage = "https://github.com/vim-denops/denops.vim/";
   };
 
   deol-nvim = buildVimPlugin {
     pname = "deol.nvim";
-    version = "2024-03-21";
+    version = "2024-04-15";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "deol.nvim";
-      rev = "f61f59979c073b663977dbb659f1c9c5a91d88e1";
-      sha256 = "0a0dgnh3rk8b6739pb3nacg8pbqw1yj2aib0sgspsvd0zirqwisw";
+      rev = "c77537a563a58221eb996ea64304dbe22ebc6f64";
+      sha256 = "0gnrx5ll1hmpxsn5jw229w8sa2kkswyw6bdd1ffgx7bvfk7z2k4m";
     };
     meta.homepage = "https://github.com/Shougo/deol.nvim/";
   };
@@ -3298,12 +3298,12 @@ final: prev:
 
   dropbar-nvim = buildVimPlugin {
     pname = "dropbar.nvim";
-    version = "2024-04-01";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "Bekaboo";
       repo = "dropbar.nvim";
-      rev = "26173fd5347bddc28fdc645d7020abd860754a73";
-      sha256 = "1lwzl4c9bkw06k875hg9b3yhavqbd1p5xr8zlfcspc05ip57y9l4";
+      rev = "e3c7de9f733587373959b220d5a1970c476a3d9f";
+      sha256 = "02ipdrrian2s0ddbjaga681sgflcw6nqcq707g7v1f094fc2rvj5";
     };
     meta.homepage = "https://github.com/Bekaboo/dropbar.nvim/";
   };
@@ -3358,12 +3358,12 @@ final: prev:
 
   editorconfig-vim = buildVimPlugin {
     pname = "editorconfig-vim";
-    version = "2024-01-15";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "editorconfig";
       repo = "editorconfig-vim";
-      rev = "0956bc257ca4eaa3e087e0ba2253a3e980805820";
-      sha256 = "1w64bpv4hanyxml0hbqqsbm96fckx1imcvksr2raq9al0qlfk4gn";
+      rev = "8b7da79e9daee7a3f3a8d4fe29886b9756305aff";
+      sha256 = "1ix80rgylpjimv3x13f8nf3gs33lf99wzydswyzyd5mpvz5p8i55";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/editorconfig/editorconfig-vim/";
@@ -3383,24 +3383,24 @@ final: prev:
 
   efmls-configs-nvim = buildVimPlugin {
     pname = "efmls-configs-nvim";
-    version = "2024-04-02";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "creativenull";
       repo = "efmls-configs-nvim";
-      rev = "479505abe49a554c0d31104a2fee730188240944";
-      sha256 = "1qgwxxwdqk6nqdaka11p5cpyms1d2h5yqcgq3wfcy8f2j94hpbxg";
+      rev = "2bd059ef683c232f9d6fa898bfe93173f0d4253e";
+      sha256 = "1phyrapplsn5iivl1vfnvg4nfilxdp8digcfy6d9khsbpggjhcmq";
     };
     meta.homepage = "https://github.com/creativenull/efmls-configs-nvim/";
   };
 
   elixir-tools-nvim = buildVimPlugin {
     pname = "elixir-tools.nvim";
-    version = "2024-03-11";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "elixir-tools";
       repo = "elixir-tools.nvim";
-      rev = "4d003f4b41ab9b4f8b569104fa7818f048ed4e25";
-      sha256 = "08qz9azq1m4rfw8s2sd6hhrds5zx0vv2azyjnwyk05q2v95xwl55";
+      rev = "3c4f8344a341818417b3d75c04eb96d894cb4640";
+      sha256 = "1jwqflzdr9qk27gqsd0h4nfi2scq274l2rgbmyccybj5kmdjv654";
     };
     meta.homepage = "https://github.com/elixir-tools/elixir-tools.nvim/";
   };
@@ -3564,12 +3564,12 @@ final: prev:
 
   feline-nvim = buildVimPlugin {
     pname = "feline.nvim";
-    version = "2024-01-05";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "freddiehaddad";
       repo = "feline.nvim";
-      rev = "6cfbe0608d2552a7d947c6f521670b10379fbe42";
-      sha256 = "1hkypnpaws9ijw4k3gqc03y5hmwnjp9jax8k9dxgqiasixk0wqs9";
+      rev = "2aa8b757313cc01f7779865bef7c7cc391753bd8";
+      sha256 = "1xbaa553l7hc2jfgdj9q44xxgv8bkia51w54297p548w90by3kfl";
     };
     meta.homepage = "https://github.com/freddiehaddad/feline.nvim/";
   };
@@ -3612,12 +3612,12 @@ final: prev:
 
   fidget-nvim = buildNeovimPlugin {
     pname = "fidget.nvim";
-    version = "2024-03-20";
+    version = "2024-04-04";
     src = fetchFromGitHub {
       owner = "j-hui";
       repo = "fidget.nvim";
-      rev = "933db4596e4bab1b09b6d48a10e21819e4cc458f";
-      sha256 = "15dngi9zink0sq5nvc2qdag8nr9j9i8qqq8l6hrrb8rdwkr6147j";
+      rev = "1ba38e4cbb24683973e00c2e36f53ae64da38ef5";
+      sha256 = "0g0z1g1nmrjmg9298vg2ski6m41f1yhpas8kr9mi8pa6ibk4m63x";
     };
     meta.homepage = "https://github.com/j-hui/fidget.nvim/";
   };
@@ -3709,12 +3709,12 @@ final: prev:
 
   flit-nvim = buildVimPlugin {
     pname = "flit.nvim";
-    version = "2024-03-20";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "flit.nvim";
-      rev = "04f744bbb2b91fb2ad2c702b5eb8e23d17924fa6";
-      sha256 = "1jg7acb4qmq7yb679w1r3jxvf7acgzm9kkpj8i8wnilfy3b6n8xc";
+      rev = "56490317983218b09698f8c960c3669958b12b32";
+      sha256 = "1m1l9dh7gwphf7ry7wzvx1hrha3i9b5alp6kpazpjidnjr1mjzb9";
     };
     meta.homepage = "https://github.com/ggandor/flit.nvim/";
   };
@@ -3769,12 +3769,12 @@ final: prev:
 
   flutter-tools-nvim = buildVimPlugin {
     pname = "flutter-tools.nvim";
-    version = "2024-03-28";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "flutter-tools.nvim";
-      rev = "4f18033c3b78aa5450e538d81dfbbb3e67aeadec";
-      sha256 = "0xppabjh206gppm7ip0h3i6654k951am80v5ckrsksp0q7c7612d";
+      rev = "f04131d6b2c82c2a7624a8843642d6269b50b437";
+      sha256 = "0i8nincmm9jnq36hhgmygq2101993mabya61mmjgpcf96dl1mdwj";
     };
     meta.homepage = "https://github.com/akinsho/flutter-tools.nvim/";
   };
@@ -4021,12 +4021,12 @@ final: prev:
 
   git-blame-nvim = buildVimPlugin {
     pname = "git-blame.nvim";
-    version = "2024-02-29";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "f-person";
       repo = "git-blame.nvim";
-      rev = "a0282d05adbee80aaf4e2ff35b81b52940b67bed";
-      sha256 = "0r678sln1ixgwby2kl6z344iq3dq2xpkyilrq2zpdrq4gfjhmanx";
+      rev = "ad1d1365c9189d89797fe8d559677d5f55dc2830";
+      sha256 = "1saw496nx8pimq1sn0ws2k10cvwg4r5q5dizfclm1rpxfp13485j";
     };
     meta.homepage = "https://github.com/f-person/git-blame.nvim/";
   };
@@ -4067,6 +4067,18 @@ final: prev:
     meta.homepage = "https://github.com/ThePrimeagen/git-worktree.nvim/";
   };
 
+  gitignore-nvim = buildVimPlugin {
+    pname = "gitignore.nvim";
+    version = "2024-03-25";
+    src = fetchFromGitHub {
+      owner = "wintermute-cell";
+      repo = "gitignore.nvim";
+      rev = "2455191ec94da8ed222806a4fe3aa358eac1e558";
+      sha256 = "sha256-p6k0NP3Vne6Kl98YodzSruVmJwxyrXziJj8N7u79o1w=";
+    };
+    meta.homepage = "https://github.com/wintermute-cell/gitignore.nvim/";
+  };
+
   gitignore-vim = buildVimPlugin {
     pname = "gitignore.vim";
     version = "2014-03-16";
@@ -4093,12 +4105,12 @@ final: prev:
 
   gitsigns-nvim = buildNeovimPlugin {
     pname = "gitsigns.nvim";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "gitsigns.nvim";
-      rev = "b45ff86f5618d1421a88c12d4feb286b80a1e2d3";
-      sha256 = "0wdz87n5k1wh0c9kzvrqf163nr33iwyvys2j355ql082qwlywhdq";
+      rev = "035da036e68e509ed158414416c827d022d914bd";
+      sha256 = "1k5qd4k7izirgvc8yvg1hjgfx00f9fml7k0ayzk45lnhzb5c7bah";
     };
     meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
   };
@@ -4129,12 +4141,12 @@ final: prev:
 
   gleam-vim = buildVimPlugin {
     pname = "gleam.vim";
-    version = "2024-03-19";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "gleam-lang";
       repo = "gleam.vim";
-      rev = "6739d8b656adb5d2807675b7652afb6e257b2b1c";
-      sha256 = "15pz1pzcajz6j146my418xr332dnd5rdr1pxssk7nx2bd2brxj3s";
+      rev = "f9e82b70425dc0726ee173ecddf176ffa364e30d";
+      sha256 = "1z4vvrxddhncfnr14a7kqc2k6gwknx8ydvs6n4my0nkz9jxh3v6s";
     };
     meta.homepage = "https://github.com/gleam-lang/gleam.vim/";
   };
@@ -4153,12 +4165,12 @@ final: prev:
 
   go-nvim = buildVimPlugin {
     pname = "go.nvim";
-    version = "2024-03-27";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "go.nvim";
-      rev = "abd282564a31c5dec14e2038ebf04fdac9ea3278";
-      sha256 = "03slm6dwfm62y2fmcfbyja86d51hks6lfcqrd697g5w7qpny5y96";
+      rev = "cbc6aca611cdc664f9bfc3c0a9aa9f9912fa9720";
+      sha256 = "1a1a7ddg70l74ngwwrygg5r39h1yzwws0myzy5jk837lmr909sb1";
     };
     meta.homepage = "https://github.com/ray-x/go.nvim/";
   };
@@ -4201,12 +4213,12 @@ final: prev:
 
   goto-preview = buildVimPlugin {
     pname = "goto-preview";
-    version = "2024-02-17";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "rmagatti";
       repo = "goto-preview";
-      rev = "527fd81a827234e26ca47891abe90497215db2a6";
-      sha256 = "123gbz6313b0qz2ydzv1gi4nlv9a1p0lg2ywp0p365lx3684nqfg";
+      rev = "3552fad4a0244ffd9ac86508e29ccc5166f19eb8";
+      sha256 = "1a7dbzr3sgabcidwls7mnjbdbhjqayh1xfxwhl96ml3cqhari2k7";
     };
     meta.homepage = "https://github.com/rmagatti/goto-preview/";
   };
@@ -4319,6 +4331,18 @@ final: prev:
     meta.homepage = "https://github.com/sainnhe/gruvbox-material/";
   };
 
+  gruvbox-material-nvim = buildVimPlugin {
+    pname = "gruvbox-material.nvim";
+    version = "2024-04-19";
+    src = fetchFromGitHub {
+      owner = "f4z3r";
+      repo = "gruvbox-material.nvim";
+      rev = "9143e172617e708d6588f424772ef20340877dd9";
+      sha256 = "0ad1s2l7vd9h2ycva5wwxisadsiqlr55pfjas23cra8gw5ngn9cj";
+    };
+    meta.homepage = "https://github.com/f4z3r/gruvbox-material.nvim/";
+  };
+
   gruvbox-nvim = buildVimPlugin {
     pname = "gruvbox.nvim";
     version = "2024-01-29";
@@ -4393,35 +4417,35 @@ final: prev:
 
   hardhat-nvim = buildVimPlugin {
     pname = "hardhat.nvim";
-    version = "2024-04-01";
+    version = "2024-04-03";
     src = fetchFromGitHub {
       owner = "TheSnakeWitcher";
       repo = "hardhat.nvim";
-      rev = "9d9f03c27319198ca6f692ce4b12b50bc8ca9d9f";
-      sha256 = "156cpcnjgsdynk0d8h8rmcczsi4ipbcdflc12kcnb9a5c87lgk4h";
+      rev = "ad39b73b07aab7d1f48a624ba6f3ae35ad0a2e56";
+      sha256 = "0fpn0sif0y7xrp8f01fkz0qq0c29l6r5shc6q9bvl32dzp7n2ryp";
     };
     meta.homepage = "https://github.com/TheSnakeWitcher/hardhat.nvim/";
   };
 
   hardtime-nvim = buildVimPlugin {
     pname = "hardtime.nvim";
-    version = "2024-03-17";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "hardtime.nvim";
-      rev = "21b0f9146198bb43fbc9f5ec66c8af3234f278ed";
-      sha256 = "0i95llvcgdwizhxr7ml8hvb1r9mwm0j19z143i7acbfy0dv4sdcd";
+      rev = "eaf4bc31b86419c26ad7b3a142dd36ca545ca2e4";
+      sha256 = "0z2ppcfqd9zkhmr8xkckq7a7a8pjgma0f6jyyzg83yb3f4443yhw";
     };
     meta.homepage = "https://github.com/m4xshen/hardtime.nvim/";
   };
 
   hare-vim = buildVimPlugin {
     pname = "hare.vim";
-    version = "2024-04-01";
+    version = "2024-04-21";
     src = fetchgit {
       url = "https://git.sr.ht/~sircmpwn/hare.vim";
-      rev = "d88953356be21eccd3a61671ba50bdd527d0f537";
-      sha256 = "0hab1j7hycz44k3k0bymyp865gmj8mms4rhq51ri3rl5dilm7f5d";
+      rev = "960c7a342609f373414c1e7fe4be0dcc369716ff";
+      sha256 = "1dzpp050gl1a39vdmn57941qzxmyws0x1fqykq82babppn23hzpb";
     };
     meta.homepage = "https://git.sr.ht/~sircmpwn/hare.vim";
   };
@@ -4464,12 +4488,12 @@ final: prev:
 
   haskell-tools-nvim = buildNeovimPlugin {
     pname = "haskell-tools.nvim";
-    version = "2024-03-25";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "b53d4f2faef93c4b85c1510adef280747b37ec67";
-      sha256 = "0lai1w94256x458rhpkmkjy276m6rwql89calqbdvb4ci3hwzv7b";
+      rev = "4fdb49333093c0a8aae35cfac68e71cf595666ef";
+      sha256 = "0qgrkxmqzlp1z5zxkdzy37lwfc7y3bpqgiy17hxszdrjy6n44vih";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -4631,24 +4655,24 @@ final: prev:
 
   hop-nvim = buildVimPlugin {
     pname = "hop.nvim";
-    version = "2024-01-01";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "smoka7";
       repo = "hop.nvim";
-      rev = "6d853addd6e11df8338b26e869a29b36f2c3e893";
-      sha256 = "0h7dcrqyb5d67pxg4pmky4cw3qhl1z8z217nxnkvrwxfdl0khwn8";
+      rev = "059e88e9dcaad3280ea1fd5c757f6904f274aed5";
+      sha256 = "1m5li7gy18d4z2fzzm6ipghn67m2i9a5fq7v1l6qy3vxgh9vzrq7";
     };
     meta.homepage = "https://github.com/smoka7/hop.nvim/";
   };
 
   hotpot-nvim = buildVimPlugin {
     pname = "hotpot.nvim";
-    version = "2024-03-28";
+    version = "2024-04-04";
     src = fetchFromGitHub {
       owner = "rktjmp";
       repo = "hotpot.nvim";
-      rev = "0b5d34f00836400ca80f68dfcd56b2a110c323d6";
-      sha256 = "0z0h4b574s2dvvxzw5rpmajjxhkhh4v25d3mrr33y14lczn9fjaa";
+      rev = "5c96b423a6663c91c47d6184f810acf1dacf4615";
+      sha256 = "136jawqxirrs130ka15hnbwlgplrkisahcv91v4avcbr46rx09d6";
     };
     meta.homepage = "https://github.com/rktjmp/hotpot.nvim/";
   };
@@ -4751,12 +4775,12 @@ final: prev:
 
   image-nvim = buildNeovimPlugin {
     pname = "image.nvim";
-    version = "2024-03-30";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "3rd";
       repo = "image.nvim";
-      rev = "a0b756d589c1623ebbfe344666e6d7c49bdc9d71";
-      sha256 = "15c6pz8hhb3mnahzppx46mx0xwq4gc85j7xc5rpjf5jf6ra346z3";
+      rev = "301de7919b2c0378cb7a782663f67abbcb198b17";
+      sha256 = "0cxqffdync3hfg7xfahwnsd5rwz1gd2mqcgsgm615qbx364as8d9";
     };
     meta.homepage = "https://github.com/3rd/image.nvim/";
   };
@@ -5064,12 +5088,12 @@ final: prev:
 
   jsonfly-nvim = buildVimPlugin {
     pname = "jsonfly.nvim";
-    version = "2024-04-12";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "Myzel394";
       repo = "jsonfly.nvim";
-      rev = "539a0b79a5ea75d201e1e90cebfe9367154d04fc";
-      sha256 = "1v1i4x2px0zs65rxkf2yhnxn6clx33vdr54r9gaqq713qj5ddlfm";
+      rev = "e47fd7713b083120af6cdb1548de8af513a0ec6f";
+      sha256 = "0wnjzqx68kqwza2pnaazmp1l986pys86ncj8hrdfcp4nvmz2i3xv";
     };
     meta.homepage = "https://github.com/Myzel394/jsonfly.nvim/";
   };
@@ -5088,12 +5112,12 @@ final: prev:
 
   jupytext-nvim = buildVimPlugin {
     pname = "jupytext.nvim";
-    version = "2024-03-25";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "GCBallesteros";
       repo = "jupytext.nvim";
-      rev = "6e439dc048986bcc00f8ba8695cb452de932127b";
-      sha256 = "1y0mi94q97lykvk4pzx3x6ifgns09pvj08xyv5274j2ykp4hmm9d";
+      rev = "c8baf3ad344c59b3abd461ecc17fc16ec44d0f7b";
+      sha256 = "1lz8ajcy9gm02bwgq5rr5ppx4g1irzvgx074mqmbv7xawij5241c";
     };
     meta.homepage = "https://github.com/GCBallesteros/jupytext.nvim/";
   };
@@ -5208,12 +5232,12 @@ final: prev:
 
   lazy-lsp-nvim = buildVimPlugin {
     pname = "lazy-lsp.nvim";
-    version = "2024-03-26";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "dundalek";
       repo = "lazy-lsp.nvim";
-      rev = "d341dd528ad6c2199ab20911ed6b56db43af6e3a";
-      sha256 = "1bjgpbf9v91pw9x6r23dl6d5cchvl8s4d8fvrbd09jjacbswc1v8";
+      rev = "19d2a4de3a57deed4aab304704c1f5e77454f4f3";
+      sha256 = "089drz8djyhsksi19ixcpfnci7ag121gsj17cq2a91l8m430j0y4";
     };
     meta.homepage = "https://github.com/dundalek/lazy-lsp.nvim/";
   };
@@ -5244,12 +5268,12 @@ final: prev:
 
   lean-nvim = buildVimPlugin {
     pname = "lean.nvim";
-    version = "2024-03-29";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "023cde8c59ecd02b7478587737450a88041d5856";
-      sha256 = "0ivdflbk1qqshnmf5pyn9xn7dn3jbygnyvyqn532d3ic85vqiafi";
+      rev = "2828898ad6f6ac6c1c9f404d72bd3d56546b0c72";
+      sha256 = "16wxih5nhdybzrm04z18cjwhjvdxq3yjdsq02v7q4kxwkbz5sy1a";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
@@ -5280,24 +5304,24 @@ final: prev:
 
   leap-nvim = buildVimPlugin {
     pname = "leap.nvim";
-    version = "2024-04-01";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "leap.nvim";
-      rev = "7a9407d17fab3a1c3cfe201965d680a408776152";
-      sha256 = "1nfkcn6xbrzklmx2v1rjzim9wp26w82hay3vhfhvkylzmil8vjqx";
+      rev = "626be4c4ec040aeaf6466c9aae17ee0ab09f1a5b";
+      sha256 = "1glf2xf4frr1in0yyar3aybmhrymrn5lzc261jdflpi749yfhadi";
     };
     meta.homepage = "https://github.com/ggandor/leap.nvim/";
   };
 
   legendary-nvim = buildVimPlugin {
     pname = "legendary.nvim";
-    version = "2024-03-29";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "legendary.nvim";
-      rev = "3a47364508503f0f44e26433cd0c0e4876f2136e";
-      sha256 = "183s62zjkamsxf0g78vl2isgrd1373r90lp1jn6p7j9lkwv49v73";
+      rev = "02a7799750a56865c58e3ea58e13b19ae1d2dc31";
+      sha256 = "1y7v6xa9n620vlzcvvcf7xc1pfbzidz7ybr7yf1k30gyv3sxpp4j";
     };
     meta.homepage = "https://github.com/mrjones2014/legendary.nvim/";
   };
@@ -5592,12 +5616,12 @@ final: prev:
 
   lsp-overloads-nvim = buildVimPlugin {
     pname = "lsp-overloads.nvim";
-    version = "2024-02-03";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "Issafalcon";
       repo = "lsp-overloads.nvim";
-      rev = "6b023414d7a6264ce1880148f1a61cf10294546e";
-      sha256 = "1svxn4kvhr666hcjfm3qii03wl2djxch52ffn7a2fggv7116vjnn";
+      rev = "be3486a501fdda84ea91a0949178b75e8476030d";
+      sha256 = "097vn7y6gal2fimpvvqm70jz6im3pnb370dxvc7zmw1yrr3zjhc4";
     };
     meta.homepage = "https://github.com/Issafalcon/lsp-overloads.nvim/";
   };
@@ -5628,12 +5652,12 @@ final: prev:
 
   lsp-zero-nvim = buildVimPlugin {
     pname = "lsp-zero.nvim";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "VonHeikemen";
       repo = "lsp-zero.nvim";
-      rev = "74441a6309cf12232da52520e210387dc95412f8";
-      sha256 = "0q96939hfqn29svgqrj1cskmxiax5h05yz8lxqmhn9cvpkzm5s4k";
+      rev = "b93f040edd57888cd6a1e7d9dee47dddc4463f8f";
+      sha256 = "02nhnm7lfdrx6yfwm754khndkq4732qnv99j91d46q68xi305p0n";
     };
     meta.homepage = "https://github.com/VonHeikemen/lsp-zero.nvim/";
   };
@@ -5711,12 +5735,12 @@ final: prev:
 
   ltex_extra-nvim = buildVimPlugin {
     pname = "ltex_extra.nvim";
-    version = "2024-02-03";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "barreiroleo";
       repo = "ltex_extra.nvim";
-      rev = "42dd3572cb09b52a137e91e515f2dff5eb631b1e";
-      sha256 = "1hirgy2w7lqn22qb20xkcxd7p1212wvra1xbyy43ky3an0bn6ivs";
+      rev = "4296c2c7aefbca721d02a011366a1de30598046c";
+      sha256 = "07ql6j5m3sdkwdn273xmqryksrz4ggw3plgxr4f6n7s07jq05qrs";
     };
     meta.homepage = "https://github.com/barreiroleo/ltex_extra.nvim/";
   };
@@ -5735,24 +5759,24 @@ final: prev:
 
   lualine-nvim = buildVimPlugin {
     pname = "lualine.nvim";
-    version = "2024-03-21";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "nvim-lualine";
       repo = "lualine.nvim";
-      rev = "b5e8bb642138f787a2c1c5aedc2a78cb2cebbd67";
-      sha256 = "0c2ncxj66p90r3wmc0y96ywqbmvll9gr5zpfs3gfv558q7ky4rzv";
+      rev = "0a5a66803c7407767b799067986b4dc3036e1983";
+      sha256 = "1llhfs5wgv87k5hv8mdyv4qjpw37zq27488lq0j063jicxszdhar";
     };
     meta.homepage = "https://github.com/nvim-lualine/lualine.nvim/";
   };
 
   luasnip = buildNeovimPlugin {
     pname = "luasnip";
-    version = "2024-04-02";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "825a61bad1d60d917a7962d73cf3c683f4e0407e";
-      sha256 = "002ksxnplfmvwclm1713x2m25zd8dkjm6bhfxv56r24i174h3dfb";
+      rev = "03c8e67eb7293c404845b3982db895d59c0d1538";
+      sha256 = "1abfssd3352kp7r54rnbl85cjz1cbxl4w48vr437k1dr6b3zcgcq";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
@@ -5772,12 +5796,12 @@ final: prev:
 
   lush-nvim = buildNeovimPlugin {
     pname = "lush.nvim";
-    version = "2024-03-17";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "rktjmp";
       repo = "lush.nvim";
-      rev = "bc12f010b34cfeefac35720656eb777753b165d9";
-      sha256 = "06am05fcipfxz8nfr6yg8yhkcdir53asl9h3k40hl0sscx4a03s9";
+      rev = "7c0e27f50901481fe83b974493c4ea67a4296aeb";
+      sha256 = "0cacfxrvm1fx73q5mch72gglrg6hvi39w78wgfb7dfkby1j8hl8r";
     };
     meta.homepage = "https://github.com/rktjmp/lush.nvim/";
   };
@@ -5856,24 +5880,24 @@ final: prev:
 
   mason-lspconfig-nvim = buildVimPlugin {
     pname = "mason-lspconfig.nvim";
-    version = "2024-03-22";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "williamboman";
       repo = "mason-lspconfig.nvim";
-      rev = "9dfcf2036c223920826140f0151d929a43f9eceb";
-      sha256 = "18fhp9qgadxh8csp1l91m61kxycb302dlcy7d1yvqmvvrhwmsl1j";
+      rev = "44509689b9bf3984d729cc264aacb31cb7f41668";
+      sha256 = "1z65m3hfx1avi4wfzsf8ypin5d37j3mcipay9rnriwhc8q8vwbb1";
     };
     meta.homepage = "https://github.com/williamboman/mason-lspconfig.nvim/";
   };
 
   mason-tool-installer-nvim = buildVimPlugin {
     pname = "mason-tool-installer.nvim";
-    version = "2024-02-13";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "WhoIsSethDaniel";
       repo = "mason-tool-installer.nvim";
-      rev = "1212fb6082b7177dde17ea65e429e027835aeb40";
-      sha256 = "0zrdpdqklmk1f9gsim209x28h4qisf1hljmwq2imc4lzpwca39kc";
+      rev = "b129892f783740e6cf741f2ea09fa5dd512aa584";
+      sha256 = "08152z7smaxv82v7ivp92n58lvr3ys7976795k0pxi8a99qj9kw7";
     };
     meta.homepage = "https://github.com/WhoIsSethDaniel/mason-tool-installer.nvim/";
   };
@@ -5904,12 +5928,12 @@ final: prev:
 
   material-nvim = buildVimPlugin {
     pname = "material.nvim";
-    version = "2024-03-27";
+    version = "2024-04-04";
     src = fetchFromGitHub {
       owner = "marko-cerovac";
       repo = "material.nvim";
-      rev = "ba56aeea3db29c8c9ffd55158aed7b2e6a749a46";
-      sha256 = "1j19q1lczx57s6qci76rxhi0wxp6k5f7ivcsg1pq5g439wj2vab8";
+      rev = "772e41a7f33743224f30799a3a887dc7dd853f8d";
+      sha256 = "0knb5d6z1hjzn3ib0nznv54rpyyk0ms6g2na59apmcwdqh1wyz6a";
     };
     meta.homepage = "https://github.com/marko-cerovac/material.nvim/";
   };
@@ -6000,12 +6024,12 @@ final: prev:
 
   mini-nvim = buildVimPlugin {
     pname = "mini.nvim";
-    version = "2024-04-02";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "5d841fcca666bc27ca777807a63381ce2cf6e2f9";
-      sha256 = "0sg82lbzf1s7qkmvc4sdpw25nms61xgdym2pqk8szmm400jk74n1";
+      rev = "e623d29561746637b49d30d6434338f88f44e856";
+      sha256 = "1if6r4w7qpi3d0z1zdwfwz211n5rfiizxvjjsywdb4659ap5b0mw";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
@@ -6036,12 +6060,12 @@ final: prev:
 
   mkdnflow-nvim = buildVimPlugin {
     pname = "mkdnflow.nvim";
-    version = "2024-03-04";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "jakewvincent";
       repo = "mkdnflow.nvim";
-      rev = "0a42aa3c7c2c982a1503e63ce8f0f065e0eb63df";
-      sha256 = "1p5vwzl48bgfzxk4nwxlyf98ymjyglm44942lpm8al908ysnpwc2";
+      rev = "3486f98dfed4cfbfa83922f73c7189cc88e9e2f2";
+      sha256 = "055kcpcjbr011rmccns63k21sg8x24yn9f2r45n30pl92irpvmqa";
     };
     meta.homepage = "https://github.com/jakewvincent/mkdnflow.nvim/";
   };
@@ -6072,12 +6096,12 @@ final: prev:
 
   modus-themes-nvim = buildVimPlugin {
     pname = "modus-themes.nvim";
-    version = "2024-03-24";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "miikanissi";
       repo = "modus-themes.nvim";
-      rev = "7cef53b10b6964a0be483fa27a3d66069cefaa6c";
-      sha256 = "0lvr83jirmcn5k8704wmz3kgcc3fhxfmi5yjk7acwih7ib7x821q";
+      rev = "08b7268c59f6d4b4030107d9b9fa934f4063d9e7";
+      sha256 = "10f9m8jji4yq7pxbrk46wi2s4awvshm8hi6wq50ckwsabfn1wjb5";
     };
     meta.homepage = "https://github.com/miikanissi/modus-themes.nvim/";
   };
@@ -6096,24 +6120,24 @@ final: prev:
 
   molten-nvim = buildVimPlugin {
     pname = "molten-nvim";
-    version = "2024-03-31";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "benlubas";
       repo = "molten-nvim";
-      rev = "66b11de7c3132dcc4521d50039ce2b5f81e64ca2";
-      sha256 = "0wijwv3mw3qvr3zmjq1f5mr89l66rrj8pgiyy8a6h4sxrna8wv9x";
+      rev = "f3a40c744d177862682f0787eef7e5ab0f4e0118";
+      sha256 = "1p9x9zqb3lsi6gzp9n0yh62w69im265yg2xp1dfhvzg3nn2s7pkw";
     };
     meta.homepage = "https://github.com/benlubas/molten-nvim/";
   };
 
   monokai-pro-nvim = buildVimPlugin {
     pname = "monokai-pro.nvim";
-    version = "2024-04-01";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "loctvl842";
       repo = "monokai-pro.nvim";
-      rev = "8940b2f87343db96ee2c62404a4e4ff9257ed514";
-      sha256 = "1vnzyikp9mf4wgs5rh666vjpmk3y7ccz4kwaq8ib47l8kcrywxy7";
+      rev = "aafde73a622435891d36b411d8623e705ead6293";
+      sha256 = "14cdrkglg0swn5nfs23z0j7jpf5gjdm1cgz1arhi1afi8dx8cr6g";
     };
     meta.homepage = "https://github.com/loctvl842/monokai-pro.nvim/";
   };
@@ -6144,12 +6168,12 @@ final: prev:
 
   multicursors-nvim = buildVimPlugin {
     pname = "multicursors.nvim";
-    version = "2024-02-21";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "smoka7";
       repo = "multicursors.nvim";
-      rev = "8b3e14682eed06a532b155c7eae33e174846b3fd";
-      sha256 = "02ar7m9g92lg7rhz7l1vm2sn8c353wk1rvl32wdbqsbi70ac8pi7";
+      rev = "b959ad0f38881e81e757208c6adfc9e6dc24dfc7";
+      sha256 = "0x4v0bpahwqcrwqv5nc0hnfc0qyc21sgd996h5nksnxykrxvf462";
     };
     meta.homepage = "https://github.com/smoka7/multicursors.nvim/";
   };
@@ -6408,12 +6432,12 @@ final: prev:
 
   neo-tree-nvim = buildVimPlugin {
     pname = "neo-tree.nvim";
-    version = "2024-03-21";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "nvim-neo-tree";
       repo = "neo-tree.nvim";
-      rev = "16d1b194376bf1fc2acd89ccb3c29ba8315bfcea";
-      sha256 = "0imgbzf9k98az077zqscf82iilf5rlkawxci2c1p3djb3nf8h43m";
+      rev = "25bfdbe802eb913276bb83874b043be57bd70347";
+      sha256 = "12z784x1ij1j3dnh71dcx2a0vcz5pnlls00j01gadybxbz4r6y39";
     };
     meta.homepage = "https://github.com/nvim-neo-tree/neo-tree.nvim/";
   };
@@ -6432,24 +6456,24 @@ final: prev:
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "2024-04-02";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "f41d28e3f9c873de17ecab12e767fc8cfd94c7a2";
-      sha256 = "10ycpk5ipvb8rafx1bpakm6r3c07vqskbjv87cxqy3bk4nc3smq8";
+      rev = "19cd99ec623de29a9d0e649b606a13d1775058af";
+      sha256 = "16dj2b3vw9zv7p01qiyf6wnnn3lwrh271kx3b4gismg1zbbrhzwi";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
   };
 
   neocord = buildVimPlugin {
     pname = "neocord";
-    version = "2024-03-28";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "IogaMaster";
       repo = "neocord";
-      rev = "6269823e78a2d2d8c3954068da196879cf2f0fe6";
-      sha256 = "1hsjp04gfdrpb1z5ij2psnyap66ism19pxg6d8n05sgzv6v7p4b5";
+      rev = "014e78cff9f1fc7b3b46ec67fdca68a91a9b7c65";
+      sha256 = "1dyw315fhh6fll1gxq764yqlrd7xb153y4g7dvc7rih9rnqi3h4m";
     };
     meta.homepage = "https://github.com/IogaMaster/neocord/";
   };
@@ -6480,12 +6504,12 @@ final: prev:
 
   neoformat = buildVimPlugin {
     pname = "neoformat";
-    version = "2024-03-30";
+    version = "2024-04-07";
     src = fetchFromGitHub {
       owner = "sbdchd";
       repo = "neoformat";
-      rev = "29e8d9c1e1da985e363d8f87c417adfdd50a5a75";
-      sha256 = "13xggjfk8fqxbghyyw7138jvl1i14bam2xacn1v9a2bd7a0iyxza";
+      rev = "4372abb846f43ec121df40e620682c985ebc8286";
+      sha256 = "1wk6vzigd6kbjfqfbayv5jbrr9lvmkxqc9b4fj5r90qqcqmfp399";
     };
     meta.homepage = "https://github.com/sbdchd/neoformat/";
   };
@@ -6504,12 +6528,12 @@ final: prev:
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "2024-03-31";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "c0b1d4dfc8ba6371857868ca7c4d33954cf002fd";
-      sha256 = "1sqgwp835wjz0cb1j5gfdxvfml1wz9zrgj81973b4dqdqzfcqkm9";
+      rev = "0cae7abc30cb91d661f28257c331fcb5b5198e31";
+      sha256 = "0alyscd5qhh30p6bsd3qr2h7qsc57yb4g8c0g7abc5z0jsw58cg9";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
   };
@@ -6576,36 +6600,36 @@ final: prev:
 
   neorg = buildVimPlugin {
     pname = "neorg";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "89f9a79179e179e9e0d96d6adce14473bed896bc";
-      sha256 = "1mfq1d6s8npnm35hflz80zxiln7wx1d4m90zpbb4vhv7nap975za";
+      rev = "e03e82bdf6a2c3173f6e417a63087c7255533b81";
+      sha256 = "1n83wjzxd7y8cmbxgmszxlh3anb32cbrzk9zrlfdpawyn2dyby48";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
 
   neorg-telescope = buildVimPlugin {
     pname = "neorg-telescope";
-    version = "2024-02-10";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg-telescope";
-      rev = "418f8fd4bd7360d954613a2322b4eb2888ac3ad9";
-      sha256 = "0r09xwvzb2ma25ngfiilwd9i6ci2llkv98scdzjkq5z96m1h6vnx";
+      rev = "92c1c6064429c74505de8e5d84a6dc8488a6f8e3";
+      sha256 = "0varnp4wm1sp9mr8yglj2kb5wl8cdf4q9ymxf3szvbv2xw1bbnb2";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg-telescope/";
   };
 
   neoscroll-nvim = buildVimPlugin {
     pname = "neoscroll.nvim";
-    version = "2024-03-10";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "karb94";
       repo = "neoscroll.nvim";
-      rev = "21d52973bde32db998fc8b6590f87eb3c3c6d8e4";
-      sha256 = "1hxf9218asn22lpa28zb6kmj64a8ak4njxj0whl60a1p0349s4qb";
+      rev = "c513218d864d4ccfdaaea991c6de67bdb84bc116";
+      sha256 = "0i6xy9xqplv9aii148g1nnwv3shnjqiq9m0gab6gav9l6144mzz9";
     };
     meta.homepage = "https://github.com/karb94/neoscroll.nvim/";
   };
@@ -6648,24 +6672,24 @@ final: prev:
 
   neotest = buildNeovimPlugin {
     pname = "neotest";
-    version = "2024-03-20";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "e07fe8241112274aae9947b98d255763738a1d52";
-      sha256 = "0wcsngcpz8ih6s5amnm1c7c09xr4xsi2bil5iiw8vlr8gbrj8rl2";
+      rev = "f03a78cef74db5638e4312e18b767294a90de8da";
+      sha256 = "1lvwmgicnqm5r7wg0325ijjfkyl5wyawx7hbzmlmr87g3z1cp62j";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
 
   neotest-bash = buildVimPlugin {
     pname = "neotest-bash";
-    version = "2023-11-18";
+    version = "2024-04-15";
     src = fetchFromGitHub {
       owner = "rcasia";
       repo = "neotest-bash";
-      rev = "2eaad2ae4577fadf4af1eec32ec169d0fb2698bb";
-      sha256 = "0w1x9ya843pa8514974frdd8qmzycnvj418igni4y3wy3s0dc65v";
+      rev = "a3480f53300842922ecb79693e64bf51d4f22337";
+      sha256 = "1dbjv5zyw5nqqwgqagq0q2255byzgc9ckrzsbm2dc7svqp04hki9";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/rcasia/neotest-bash/";
@@ -6697,12 +6721,12 @@ final: prev:
 
   neotest-dotnet = buildVimPlugin {
     pname = "neotest-dotnet";
-    version = "2024-03-13";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "Issafalcon";
       repo = "neotest-dotnet";
-      rev = "15943dd05e2d4d9393531b647ad661e60820c608";
-      sha256 = "0vcx6avfbsjxv3nwbmy6101yb33msx6s3l1mzmnb7rprgcy53zm5";
+      rev = "3844d16706d7655f4c84387bdb68eb8fb0155ef2";
+      sha256 = "0dh66m1yyzzsrcxrhaydqm7ymqspggnd345c8mfjprp7312x3yc5";
     };
     meta.homepage = "https://github.com/Issafalcon/neotest-dotnet/";
   };
@@ -6771,24 +6795,24 @@ final: prev:
 
   neotest-haskell = buildVimPlugin {
     pname = "neotest-haskell";
-    version = "2024-03-25";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "neotest-haskell";
-      rev = "a4e73415548d2de91912d9f015cced49e82af4c0";
-      sha256 = "171qrv5nmdywz8zakc73hi1rkrdy6j63p582igbsf83zp06hnswk";
+      rev = "0367f44e49aa64d8b66fc9f736a61e9a60ce9526";
+      sha256 = "1yb9l9gac08sqx6maxhfhb1dj796l48gflx1l59l4fxm9sw7djkj";
     };
     meta.homepage = "https://github.com/MrcJkb/neotest-haskell/";
   };
 
   neotest-java = buildVimPlugin {
     pname = "neotest-java";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "rcasia";
       repo = "neotest-java";
-      rev = "9af20dbc445f568b5f6b6f3241f07259ee95cfe8";
-      sha256 = "1v87jb7fm3xgnhzfxbp6wn5dk4m8r0asff4d0ap3zcc4sr771cl5";
+      rev = "68dd64e296c6da73aacd7ad795ac789e15087ee6";
+      sha256 = "03iap2dsawqj1c8jac6lm1knc16ikiwzgp7hnpv2k43vny52l492";
     };
     meta.homepage = "https://github.com/rcasia/neotest-java/";
   };
@@ -6807,12 +6831,12 @@ final: prev:
 
   neotest-minitest = buildVimPlugin {
     pname = "neotest-minitest";
-    version = "2024-04-01";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "zidhuss";
       repo = "neotest-minitest";
-      rev = "45718d7995d590aae1371e3758f1f0f582ec0f6f";
-      sha256 = "1wk1qyqzi1v6c9b84fg06mkjwyl2x5jgcbfmji4a94r4pnrhpx8b";
+      rev = "f56e5a84fc89aafb6e0be368a58ad1a6f8723444";
+      sha256 = "18xi436a164ly3d1wb0a8pzsa1fb8rshqm4r9rp0da85ms2nl14c";
     };
     meta.homepage = "https://github.com/zidhuss/neotest-minitest/";
   };
@@ -6879,24 +6903,24 @@ final: prev:
 
   neotest-rspec = buildVimPlugin {
     pname = "neotest-rspec";
-    version = "2024-04-01";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "neotest-rspec";
-      rev = "b27bb629d201a2fd24d453d68b44d73bf801c665";
-      sha256 = "0lcf4pwhwimjq77gymyg4z5x0rva4rb6l9v6kibh9sl8cm9zfnn7";
+      rev = "c1c3f36e1b1a23698534e6326e90876f87b773a4";
+      sha256 = "0yfd23mkvpzddgxxsfnzcix0qr4l1cjfk0i8crw8kzb01n6dh5v3";
     };
     meta.homepage = "https://github.com/olimorris/neotest-rspec/";
   };
 
   neotest-rust = buildVimPlugin {
     pname = "neotest-rust";
-    version = "2024-02-28";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "rouge8";
       repo = "neotest-rust";
-      rev = "9e9df68064bd6fa3b5e40b32fcb7c52af130cdbf";
-      sha256 = "0h8fhylg1rhgjxjhg2d3y77fhril6ng3cj49yz2g8hh1p5xassfr";
+      rev = "0418811e1e3499b2501593f2e131d02f5e6823d4";
+      sha256 = "1ffa0in8zvw6fc9lwga67s9gjqmvn1a69i3wpajrslf2d0ngmw3y";
     };
     meta.homepage = "https://github.com/rouge8/neotest-rust/";
   };
@@ -6927,12 +6951,12 @@ final: prev:
 
   neotest-vitest = buildVimPlugin {
     pname = "neotest-vitest";
-    version = "2024-03-12";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "marilari88";
       repo = "neotest-vitest";
-      rev = "102e7494bbe0f205d28c31a3fd75a9dfbcc78c73";
-      sha256 = "03j5vfqryi419d5x0ssxpasx93jkpraj2vhwfclbhwfjf1d20jkl";
+      rev = "6965a714793d9d156dadbe734c99b3a307f65c61";
+      sha256 = "0dxcnkvhdlxlxa6vrjfgn5pfi3a2g78c3xz13sxggw559wmzp9lr";
     };
     meta.homepage = "https://github.com/marilari88/neotest-vitest/";
   };
@@ -6951,12 +6975,12 @@ final: prev:
 
   neovim-ayu = buildVimPlugin {
     pname = "neovim-ayu";
-    version = "2024-02-05";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "Shatur";
       repo = "neovim-ayu";
-      rev = "0a9804db5c08dba63be9774a57e4214fd0473ce1";
-      sha256 = "17324y4ywxmijappa9sb194xc2mwa8ijfxvb3s4302bnd6ggdw7h";
+      rev = "e03beacbc51f1a985d7a4b69828fd7612a4151e0";
+      sha256 = "1yf3j0lqcsng1ksq5wb1l8pcw6r9f6apzn6y2w5j431sm2by5jw4";
     };
     meta.homepage = "https://github.com/Shatur/neovim-ayu/";
   };
@@ -7095,24 +7119,24 @@ final: prev:
 
   night-owl-nvim = buildVimPlugin {
     pname = "night-owl.nvim";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "oxfist";
       repo = "night-owl.nvim";
-      rev = "1afa7f158feb79987ca0d017f65558492e6c8a8e";
-      sha256 = "1gypvdfbg7s3l3j9hlf6n2d22pjq4q54xv48gsg2zvczzg3c77ww";
+      rev = "94aead739b6223feb19650077c9694e6c1c63fbf";
+      sha256 = "0baw75s3r09pf747rm3mni07pszkba5ykk1vky2lqq2ga7xplalf";
     };
     meta.homepage = "https://github.com/oxfist/night-owl.nvim/";
   };
 
   nightfox-nvim = buildVimPlugin {
     pname = "nightfox.nvim";
-    version = "2024-03-18";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "EdenEast";
       repo = "nightfox.nvim";
-      rev = "e352a32e0f54feb2550ebdab815ae8f7f26ed63b";
-      sha256 = "11r0hlabysrxqxsh09c42mqfy2zzi6gkafkwqi430ngxc09yzln0";
+      rev = "ce0cdf8538c8c0b9c8fb2884d3d1090c8faf515d";
+      sha256 = "09hij99myk1ry8sik71sd2cdicaqrhidpkay6yzs0j67wr0705yv";
     };
     meta.homepage = "https://github.com/EdenEast/nightfox.nvim/";
   };
@@ -7155,12 +7179,12 @@ final: prev:
 
   nlsp-settings-nvim = buildVimPlugin {
     pname = "nlsp-settings.nvim";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "tamago324";
       repo = "nlsp-settings.nvim";
-      rev = "5c4e0796937a3d732f8d489188d55312d802050a";
-      sha256 = "12pvrvcd339y8f0pzx398fn7c4shjmdy68xq7rfq6bg245mnd04j";
+      rev = "78064fe0dbb67d2f449854bd2fe7fc2b1af0a8c0";
+      sha256 = "0yh9xalsj4y2yh7avabvnw2jj7b1nl1amsxmcxm9jiz0xw50nkbf";
     };
     meta.homepage = "https://github.com/tamago324/nlsp-settings.nvim/";
   };
@@ -7227,12 +7251,12 @@ final: prev:
 
   none-ls-nvim = buildVimPlugin {
     pname = "none-ls.nvim";
-    version = "2024-04-02";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls.nvim";
-      rev = "fff481b65d88415933b9574dc0e1947724bcf64a";
-      sha256 = "0qpnsj7pd7lg9qli3pgwxk8m50k65866mxk1id42n85v558hd9nx";
+      rev = "88821b67e6007041f43b802f58e3d9fa9bfce684";
+      sha256 = "09mv5ndk0xnij3nv2p1qcm6k59xh0j2nl949960d24aln4h354dl";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls.nvim/";
   };
@@ -7323,12 +7347,12 @@ final: prev:
 
   nvchad = buildVimPlugin {
     pname = "nvchad";
-    version = "2024-03-26";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "nvchad";
-      rev = "6833c60694a626615911e379d201dd723511546d";
-      sha256 = "0wdl610n3060ipsplsb8rrlpxa1xh72vpczpmwswdvwp3y67lmy4";
+      rev = "f8e6c59985f1d5f820f051395e88064a8d16ef2a";
+      sha256 = "1ss67kpn8lkgcdj90yjg69dfdy3w2v32znqc2nbl6hblgmxfakd4";
     };
     meta.homepage = "https://github.com/nvchad/nvchad/";
   };
@@ -7347,12 +7371,12 @@ final: prev:
 
   nvim-FeMaco-lua = buildVimPlugin {
     pname = "nvim-FeMaco.lua";
-    version = "2023-10-21";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "AckslD";
       repo = "nvim-FeMaco.lua";
-      rev = "6af458f0196215f397db31a6e1fb2df795811693";
-      sha256 = "0pvdbk48pyqvi75pzpsz9wsvhfrp5rya2dbccg2gfx3h5yvks6fn";
+      rev = "96bbf843595dbe865838b3f2484b73557f34700c";
+      sha256 = "0lqqjzzysl5n152z2j93fk536w2vdi67hss76ai881jr9l4xscvq";
     };
     meta.homepage = "https://github.com/AckslD/nvim-FeMaco.lua/";
   };
@@ -7371,36 +7395,36 @@ final: prev:
 
   nvim-autopairs = buildVimPlugin {
     pname = "nvim-autopairs";
-    version = "2024-03-20";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "dbfc1c34bed415906395db8303c71039b3a3ffb4";
-      sha256 = "1xbyx5fy9mp8x2yshah810zxdkm8f94ng64al2kpx8rjf7iqk28z";
+      rev = "4f41e5940bc0443fdbe5f995e2a596847215cd2a";
+      sha256 = "0cfi0wmqy8vrrf17s71jyg6c5s8ghb7xjapzhj9l9l6g1s7v9bxm";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
 
   nvim-bacon = buildVimPlugin {
     pname = "nvim-bacon";
-    version = "2024-02-12";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "Canop";
       repo = "nvim-bacon";
-      rev = "3f8e7a80a0e715952a3066fefe7447f1347207ca";
-      sha256 = "sha256-jIoRzMjOZlTHR7q4piyY7MjEUgZIR5pjobfOdY/IpeM=";
+      rev = "94f684baacf22c65e5ef889cfa943cfc90ee1cf4";
+      sha256 = "0b4xpmk6cv6k9h2vqk9773hszwy90d7y3fpjz1yqg9nxfvbdjp2b";
     };
     meta.homepage = "https://github.com/Canop/nvim-bacon/";
   };
 
   nvim-biscuits = buildVimPlugin {
     pname = "nvim-biscuits";
-    version = "2023-03-28";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "code-biscuits";
       repo = "nvim-biscuits";
-      rev = "0224be36b60588e88b21b8244a0bcd069699720e";
-      sha256 = "1pw7ad9x4jn1ciam72bdc2087mrmxwr4przivfpkhjj6vjgfpn1v";
+      rev = "ff1d12c8b47cd28723da593b2cfa2e98391d439a";
+      sha256 = "18dvvg32nxrdp1ydbvxrzkdg7q214naq2bphs7y1s9zmjhyj25pm";
     };
     meta.homepage = "https://github.com/code-biscuits/nvim-biscuits/";
   };
@@ -7563,12 +7587,12 @@ final: prev:
 
   nvim-dap = buildVimPlugin {
     pname = "nvim-dap";
-    version = "2024-03-25";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "405df1dcc2e395ab5173a9c3d00e03942c023074";
-      sha256 = "00mmxasay25ha4l63jrn3b440xp7k39xr2al6d3kmw9mw1hyg0hy";
+      rev = "6ae8a14828b0f3bff1721a35a1dfd604b6a933bb";
+      sha256 = "0a75lxhzbwm66c1fa5b7zpsz3i7raljsbq4d3n5h8cfdv8hgcjch";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -7587,12 +7611,12 @@ final: prev:
 
   nvim-dap-python = buildVimPlugin {
     pname = "nvim-dap-python";
-    version = "2024-02-19";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap-python";
-      rev = "66560f0ebddf96604f7037e1efad3ba6942761e6";
-      sha256 = "0yc96r53iy0iim2nkl3rz5fza148fs6wk9y9k19k90ilzhh2ay3k";
+      rev = "3dffa58541d1f52c121fe58ced046268c838d802";
+      sha256 = "0kjcv8wvh7hwr9wy2najyrxz88fa4s7djz2lnmz2gfrmqhihibjl";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap-python/";
   };
@@ -7611,12 +7635,12 @@ final: prev:
 
   nvim-dap-virtual-text = buildVimPlugin {
     pname = "nvim-dap-virtual-text";
-    version = "2024-03-10";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "nvim-dap-virtual-text";
-      rev = "baa5b0dc6663284cce32e0d00ac1f2511b13496f";
-      sha256 = "136qm88phwbyn5zdbr6xnw0hvsa7zcycxyg5anhfdc1vxdsh8lfm";
+      rev = "3e8e207513e6ef520894950acd76b79902714103";
+      sha256 = "1jsb5l4vda1qgsf8qpnz18gniw1fliia5hgap0l7xl40syvcczzm";
     };
     meta.homepage = "https://github.com/theHamsta/nvim-dap-virtual-text/";
   };
@@ -7695,36 +7719,36 @@ final: prev:
 
   nvim-highlight-colors = buildVimPlugin {
     pname = "nvim-highlight-colors";
-    version = "2024-04-01";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "brenoprata10";
       repo = "nvim-highlight-colors";
-      rev = "ca3731eab0cff414722a5c9c43a3ba06577cb250";
-      sha256 = "1z0y0xh9kyk3p2dyr5qfy7y67dawqc6d58g37ii1nxf81bi2lf3h";
+      rev = "432dc7a817a4973041f02b418169667c491f60fd";
+      sha256 = "1x2791sbifpwk3rzakggja7gr7s4icainaqyhg2x587vw26739cc";
     };
     meta.homepage = "https://github.com/brenoprata10/nvim-highlight-colors/";
   };
 
   nvim-highlite = buildVimPlugin {
     pname = "nvim-highlite";
-    version = "2024-03-21";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "Iron-E";
       repo = "nvim-highlite";
-      rev = "0962a3a5f206676d7111cd56185b28d5498a0f88";
-      sha256 = "1w75kp9dq34294k01a73pialzah875mm4xgfg9h3wdh6zdhjl1jk";
+      rev = "e1f68ff238802fdee67c3f8ac547c1832ae2b8ee";
+      sha256 = "1n1iqhn67q3fzff4kvqz2ikp5scjbb2wls267aamdqg8apq5dpq1";
     };
     meta.homepage = "https://github.com/Iron-E/nvim-highlite/";
   };
 
   nvim-hlslens = buildVimPlugin {
     pname = "nvim-hlslens";
-    version = "2024-03-22";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-hlslens";
-      rev = "c42b4526e6d83b904eb5f3d50e68d7c2fc4be4b5";
-      sha256 = "13lwshdjrqn9f827xfbnd8pdqk8ild3j2p4xbmwi2lskm17i0vhi";
+      rev = "3e8fceb2b030100857ee72741a8f48c9a1d8595e";
+      sha256 = "0j6i7rv78xxkmqgmi4w7yqhj4rng7p2skbgs8gq8jcb3k6ghcs3q";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
   };
@@ -7826,12 +7850,12 @@ final: prev:
 
   nvim-lint = buildVimPlugin {
     pname = "nvim-lint";
-    version = "2024-04-01";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "6670b3ac73fa4caf720f017b91c619e9424d955e";
-      sha256 = "0pwx4l64glhx8cxrka3ms6xl9i9rf1lwsx6brzm0hdragb1lnaqr";
+      rev = "f098232d70cebe90e27404928c9bc19ca7a5a7b5";
+      sha256 = "1xnirwlnby8fr99qkcicwd1npmkx7i557jzvgxfv4m8f4b2vw923";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -7862,12 +7886,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPlugin {
     pname = "nvim-lspconfig";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "96e5711040df23583591391ce49e556b8cd248d8";
-      sha256 = "0jlqjhi6x3g8w80mqbnmybh5lmf8cw0lnyywhhdkc5plpzh43j0c";
+      rev = "ed8b8a15acc441aec669f97d75f2c1f2ac8c8aa5";
+      sha256 = "0rqjcksb0dcvvxnc0r4n499xlkviwp2sbn29r8b1bnf68d7qnapx";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -7982,12 +8006,12 @@ final: prev:
 
   nvim-nio = buildNeovimPlugin {
     pname = "nvim-nio";
-    version = "2024-04-02";
+    version = "2024-04-04";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "nvim-nio";
-      rev = "173f285eebb410199273fa178aa517fd2d7edd80";
-      sha256 = "0favgnfpsak44lzyzyhfavazr2i64l7ysk370xm4wbrb51kjsdkf";
+      rev = "5800f585def265d52f1d8848133217c800bcb25d";
+      sha256 = "0y3afl42z41ymksk29al5knasmm9wmqzby860x8zj0i0mfb1q5k5";
     };
     meta.homepage = "https://github.com/nvim-neotest/nvim-nio/";
   };
@@ -8150,12 +8174,12 @@ final: prev:
 
   nvim-spectre = buildVimPlugin {
     pname = "nvim-spectre";
-    version = "2024-03-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "nvim-pack";
       repo = "nvim-spectre";
-      rev = "2b012554a2536465243c0dff3605b5927c49ed23";
-      sha256 = "09v8pw7a4p0k7aib7yhzadifg9pm8amzqvql3rwx9b95d793710x";
+      rev = "9653847cf2f225648967f6e9363643e327387579";
+      sha256 = "15866wdyck6snm0iz9iqd036wqkbfwnliwd5f220r9g5v3cwg5lg";
     };
     meta.homepage = "https://github.com/nvim-pack/nvim-spectre/";
   };
@@ -8174,12 +8198,12 @@ final: prev:
 
   nvim-surround = buildVimPlugin {
     pname = "nvim-surround";
-    version = "2024-02-27";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "kylechui";
       repo = "nvim-surround";
-      rev = "84a26afce16cffa7e3322cfa80a42cddf60616eb";
-      sha256 = "04sapqxwj4siwv5b0zxhv5vxmc653109bkk7yn6g5bckmwkdg2dq";
+      rev = "a4e30d33add8a9743b4f518b3a788b3c8e5def71";
+      sha256 = "09m95jd84y3b2wrair263f0csqqdx8h45fjq9jrr4f3108494xc1";
     };
     meta.homepage = "https://github.com/kylechui/nvim-surround/";
   };
@@ -8222,36 +8246,36 @@ final: prev:
 
   nvim-tree-lua = buildVimPlugin {
     pname = "nvim-tree.lua";
-    version = "2024-03-31";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-tree.lua";
-      rev = "d8d3a1590a05b2d8b5eb26e2ed1c6052b1b47a77";
-      sha256 = "1b2h5hxngzplf3gi72r07s2zrlgyk4213yqs208xrqry2svd9ih0";
+      rev = "ae8e46e8fabb32fa3ae5319383ea2c8763f14caa";
+      sha256 = "0cb4p6bndid12h2bjdj5ybksqjmwv1876jx5a2wlj6h0q50wfjs0";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "cc0e29727a9651e27869b7444e835c44fb1e7b4c";
-      sha256 = "1lnpmbj0nz33dv5b2kf6p39bxknjfcwqc7qsj5rzsxf4ycf73jig";
+      rev = "ea4f6d5175812a3f48302d638a766bc18fcbb04a";
+      sha256 = "0smghl0nv4w1rpn7gqsq6lbarh5nzbhvi8pfysh5f7am0p42y86m";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
 
   nvim-treesitter-context = buildVimPlugin {
     pname = "nvim-treesitter-context";
-    version = "2024-03-22";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-context";
-      rev = "f19766163c18515fb4d3c12d572bf9cba6cdb990";
-      sha256 = "1ivaaj3fq33dynrmw67l3m2hfdklyb2f269a2brra613qm84ac48";
+      rev = "ba4289ad345ececd335a9cdd7b9616fd0bb6be92";
+      sha256 = "0cfklfz2anc8021qi0q8dbrdmnndnd073azgsiwaagbh75s3sgh1";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-context/";
   };
@@ -8294,12 +8318,12 @@ final: prev:
 
   nvim-treesitter-textobjects = buildVimPlugin {
     pname = "nvim-treesitter-textobjects";
-    version = "2024-04-03";
+    version = "2024-04-15";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-textobjects";
-      rev = "acffd3476eb340faef0ec07e48060b817386b973";
-      sha256 = "1mw5dn52dx1lmh98254hj44c4nlwxaf4j5i9fla9fg1g71rc521k";
+      rev = "23b820146956b3b681c19e10d3a8bc0cbd9a1d4c";
+      sha256 = "1jvx9nbz5sh09jnlcqm5qfyjvryibc3fpnfxim7adk5gb4160xws";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-textobjects/";
   };
@@ -8330,12 +8354,12 @@ final: prev:
 
   nvim-ts-context-commentstring = buildVimPlugin {
     pname = "nvim-ts-context-commentstring";
-    version = "2024-03-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "joosepalviste";
       repo = "nvim-ts-context-commentstring";
-      rev = "734ebad31c81c6198dfe102aa23280937c937c42";
-      sha256 = "114w2xkb1warjbs6r3z75pzb8k6087j3xlpi5z4nnxcjk1sj03v0";
+      rev = "a6382f744f584bbf71d0a563af789af7190aabda";
+      sha256 = "12b12ndva3ck5y18mkmhzkbmaz65kjkqsjxvq5gfniz1br7n2y9j";
     };
     meta.homepage = "https://github.com/joosepalviste/nvim-ts-context-commentstring/";
   };
@@ -8366,12 +8390,12 @@ final: prev:
 
   nvim-web-devicons = buildVimPlugin {
     pname = "nvim-web-devicons";
-    version = "2024-03-26";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-web-devicons";
-      rev = "3ee60deaa539360518eaab93a6c701fe9f4d82ef";
-      sha256 = "1a0z8canxpr5vlnmkqpys35yar8l296gdznqlvvvf1200wai3i8v";
+      rev = "beb6367ab8496c9e43f22e0252735fdadae1872d";
+      sha256 = "1qqwfzfk5w2sfaavfa2nn01caj753j272hpnhmvgwknfgvl9cv81";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-web-devicons/";
   };
@@ -8414,12 +8438,12 @@ final: prev:
 
   nvim_context_vt = buildVimPlugin {
     pname = "nvim_context_vt";
-    version = "2024-01-15";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "andersevenrud";
       repo = "nvim_context_vt";
-      rev = "8f7b6b46292e0819290b0d368abc3366b8a163fc";
-      sha256 = "06njpi7zr0m7kwcrw2pwnhhmaij49p810bsdkav0ynkcszf60402";
+      rev = "4b89241c19909f18d2f6b58777c413c027600fcc";
+      sha256 = "116j5k4nznsldiv752rhxlsjzr2cha1zclxrffiqlnbldiyr5i8i";
     };
     meta.homepage = "https://github.com/andersevenrud/nvim_context_vt/";
   };
@@ -8450,12 +8474,12 @@ final: prev:
 
   obsidian-nvim = buildVimPlugin {
     pname = "obsidian.nvim";
-    version = "2024-04-01";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "epwalsh";
       repo = "obsidian.nvim";
-      rev = "d70f3289399c25153b7f503b838afbf981124a37";
-      sha256 = "1528p9rhh5gkl726m5r367zdi4wd1yln0l0crg19n0gnif2l8gj4";
+      rev = "ec0f44e1921d2701bd99a542031d280f1e3930b5";
+      sha256 = "1b9b72yrp1xfkag41hxjk903payfrcnjdi7lr5880183mm0im04w";
     };
     meta.homepage = "https://github.com/epwalsh/obsidian.nvim/";
   };
@@ -8486,24 +8510,24 @@ final: prev:
 
   octo-nvim = buildVimPlugin {
     pname = "octo.nvim";
-    version = "2024-04-03";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "pwntester";
       repo = "octo.nvim";
-      rev = "a511b52fbf040f928a24deb72e17ec465613b442";
-      sha256 = "0jrcqxjbv24qa9k701l1bxyz20s0wj9jkr8vxx68j3z51idjygqn";
+      rev = "5646539320cd62af6ff28f48ec92aeb724c68e18";
+      sha256 = "1qknswy3hs9lkwbs4pqqbsngyvk7ibl6lhdl0df46ymzpmpkkb8h";
     };
     meta.homepage = "https://github.com/pwntester/octo.nvim/";
   };
 
   oil-nvim = buildVimPlugin {
     pname = "oil.nvim";
-    version = "2024-03-18";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "oil.nvim";
-      rev = "e462a3446505185adf063566f5007771b69027a1";
-      sha256 = "1pg1sakc1lka2j9nbdy4hqfhg4gc9csbrmpbhsyxwb8p2n4zyiiq";
+      rev = "1f05774e1c2dbc1940104b5c950d5c7b65ec6e0b";
+      sha256 = "0l6y9xnz8l7flq0jlh9xxnsp9inny9mbbqg2j2sg0rivq630bbnh";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/oil.nvim/";
@@ -8667,48 +8691,48 @@ final: prev:
 
   openscad-nvim = buildVimPlugin {
     pname = "openscad.nvim";
-    version = "2024-03-12";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "salkin-mada";
       repo = "openscad.nvim";
-      rev = "5c35ce921a63d59f2a0bb20d872c15a0d4c8aa72";
-      sha256 = "1l3xhv670apfjns12xzhf7sn3mf3gdd3xiyirydrnp7bxy7dyv1h";
+      rev = "bf99a48bff318ceb28646d27f29f925ba0b10af0";
+      sha256 = "1b90bfwwnz9iwwr89whpqn939m5bvw8cpiysc8yaq3yy46gzvkw7";
     };
     meta.homepage = "https://github.com/salkin-mada/openscad.nvim/";
   };
 
   orgmode = buildVimPlugin {
     pname = "orgmode";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvim-orgmode";
       repo = "orgmode";
-      rev = "207d12c8683090195d290c46b00f684ec941f20e";
-      sha256 = "1ff4sxq671iwk3c4qbsj9disdb5iaa0ynhq88slmq045ndbjz2bh";
+      rev = "389e91f6f935aa845bc0cd13dd80f75431c34751";
+      sha256 = "1fzckfi00bb4mi5l9wadhgv98z7fmlgryx24zipcr7k98pdaw36h";
     };
     meta.homepage = "https://github.com/nvim-orgmode/orgmode/";
   };
 
   other-nvim = buildVimPlugin {
     pname = "other.nvim";
-    version = "2024-02-05";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "rgroli";
       repo = "other.nvim";
-      rev = "d36a66af270b63459c080d4589126a06cf56578c";
-      sha256 = "015is3pyjn0jrmz03vsvyiiy8fgwrpd1syfq3zmspyyki7blclcl";
+      rev = "2a82971d3763474df29d5d32d0699b5bb13c551f";
+      sha256 = "1jxiyabkg3y8fcnms9rms844038hjmynbg9wykfmn7n38sxig300";
     };
     meta.homepage = "https://github.com/rgroli/other.nvim/";
   };
 
   otter-nvim = buildVimPlugin {
     pname = "otter.nvim";
-    version = "2024-03-25";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "jmbuhr";
       repo = "otter.nvim";
-      rev = "145a7b0c3c40f4e62fc6c0bc9721e2cfe8f95471";
-      sha256 = "0a2rpxnvx35xafp19n163hba3p3247sqnwkgdhaka54yx4gx091q";
+      rev = "e67aa5082c65eeffd8a57b672e1353e8cf2ca7a9";
+      sha256 = "0223cmm4hg9c9ywifr0c7zk091ny5sndarkq7sa9vk5vmar5sz15";
     };
     meta.homepage = "https://github.com/jmbuhr/otter.nvim/";
   };
@@ -8727,12 +8751,12 @@ final: prev:
 
   overseer-nvim = buildVimPlugin {
     pname = "overseer.nvim";
-    version = "2024-03-24";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "overseer.nvim";
-      rev = "b04b0b105c07b4f02b3073ea3a98d6eca90bf152";
-      sha256 = "1j9ch2n1hxrc0vs48v753jg56jxcv79j96rvbag8f7z7gbl5agpy";
+      rev = "dd701ed0639ef1e10d0ca8dec039719e916c4a7b";
+      sha256 = "1xr0xzf5h1r8ax6djvq1vq936yqmvwa4l0hbjqq090mgnj60arh5";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/overseer.nvim/";
@@ -9162,12 +9186,12 @@ final: prev:
 
   qmk-nvim = buildVimPlugin {
     pname = "qmk.nvim";
-    version = "2024-02-15";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "codethread";
       repo = "qmk.nvim";
-      rev = "67c1a94b10f7266ac01b0a2431dade70693edba9";
-      sha256 = "sha256-YKp9/unDL52guKRHI50DSPV8nXyPqAHY9mEHUMHFhmc=";
+      rev = "cfa6cecae362d23778cd97317d33ab12671e157c";
+      sha256 = "0p44i25iyryrvy1sf3bp10as39mgd6da1gai332rv2ky3zgc3lbh";
     };
     meta.homepage = "https://github.com/codethread/qmk.nvim/";
   };
@@ -9246,11 +9270,11 @@ final: prev:
 
   rainbow-delimiters-nvim = buildVimPlugin {
     pname = "rainbow-delimiters.nvim";
-    version = "2024-03-23";
+    version = "2024-04-18";
     src = fetchgit {
       url = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
-      rev = "580bc045c7ab3ab3ebd267774038c0d8cc19c789";
-      sha256 = "1jqxlikp8y2qs9sd48dvwvpim4276kw3a32k85n6nfkvlwjspkqp";
+      rev = "7ef0766b5cd2f5cdf4fcb08886f0a2ebf65981fa";
+      sha256 = "0pw3dk0rnaa2llvgkqar1j5wqrh3lah2ygvxaqiy7760pyanh38c";
     };
     meta.homepage = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
   };
@@ -9389,12 +9413,12 @@ final: prev:
 
   rest-nvim = buildNeovimPlugin {
     pname = "rest.nvim";
-    version = "2024-03-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "rest-nvim";
       repo = "rest.nvim";
-      rev = "a1221086cfdeb58de393f4bbae11063c6c8c075c";
-      sha256 = "0agjc2jz6jh3k2hm942rdslpypsdxj2i8r1mm0dlqswbl853c9lj";
+      rev = "20c5b5259afa7f4867474cc463211d64c93ba371";
+      sha256 = "0ysmzf2lfry8abaajjanp3b3358nbgd2d2zs9qfjyrbk0fmqw0gc";
     };
     meta.homepage = "https://github.com/rest-nvim/rest.nvim/";
   };
@@ -9509,12 +9533,12 @@ final: prev:
 
   rustaceanvim = buildNeovimPlugin {
     pname = "rustaceanvim";
-    version = "2024-04-01";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "mrcjkb";
       repo = "rustaceanvim";
-      rev = "e2dbf91daed26d4dd7263affbecbf9a36e0096e5";
-      sha256 = "1mk8v1mdkxib9kaypy7kb76yga7zj5zyqka8zhnhn9h4v4kqdj8z";
+      rev = "dd4d5d8d1313f0bb343af90e2432ad2f2a9fedaf";
+      sha256 = "1zph7b9vdd96xai19g6di48r5p5px0pz8kkq5hfkriq2apygpb99";
     };
     meta.homepage = "https://github.com/mrcjkb/rustaceanvim/";
   };
@@ -9557,12 +9581,12 @@ final: prev:
 
   scnvim = buildVimPlugin {
     pname = "scnvim";
-    version = "2024-01-11";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "davidgranstrom";
       repo = "scnvim";
-      rev = "8929739543e5a4dc51d1af1d122bdbbb54e634b9";
-      sha256 = "1mm3lp5q6fvrlmq84637y7gjf04917xz8v1y0jkp2g4hi6v119nc";
+      rev = "94e49fa6c596813247549cd594f5ab6246c79973";
+      sha256 = "1axbrakr3xpmvbdslh803xam72fg6ar428bgz04h0j2ygg75bqmy";
     };
     meta.homepage = "https://github.com/davidgranstrom/scnvim/";
   };
@@ -9750,12 +9774,12 @@ final: prev:
 
   smart-splits-nvim = buildVimPlugin {
     pname = "smart-splits.nvim";
-    version = "2024-03-29";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "smart-splits.nvim";
-      rev = "50f52146e4504a3fc0f0d5830c8560a16a95dd08";
-      sha256 = "07ca4mn1rlxy11ayfw89i2vvcndd0p4lpfqyzdzd99vnm0cxg2ml";
+      rev = "95d11bfc83263236431ead7dc017f5ab0ff992ca";
+      sha256 = "0x9s5801si869gh7jazlfd9asiwk5fkr1gv67qf7bs55pc0z9rbf";
     };
     meta.homepage = "https://github.com/mrjones2014/smart-splits.nvim/";
   };
@@ -9979,12 +10003,12 @@ final: prev:
 
   sqlite-lua = buildVimPlugin {
     pname = "sqlite.lua";
-    version = "2024-02-19";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "kkharji";
       repo = "sqlite.lua";
-      rev = "40701b6151f8883980c1548647116de39b763540";
-      sha256 = "106j1zzsr97jr0pk6ri2jxdpvqc2ci7g8rlsbb5s30lsqr4ix0ah";
+      rev = "d0ffd703b56d090d213b497ed4eb840495f14a11";
+      sha256 = "1nj0yqrr8dzjva14irp10g0c6xbnv3wm1igkl2cc7c8f3bddrfwx";
     };
     meta.homepage = "https://github.com/kkharji/sqlite.lua/";
   };
@@ -10099,12 +10123,12 @@ final: prev:
 
   statuscol-nvim = buildVimPlugin {
     pname = "statuscol.nvim";
-    version = "2024-02-23";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "luukvbaal";
       repo = "statuscol.nvim";
-      rev = "d954893262a57a92e46edd87de67e2b3fe72305e";
-      sha256 = "1i8nvhbrcsinydd1ppnrw6lr3izh1dwp860hr7axyfjgqxgx39f8";
+      rev = "483b9a596dfd63d541db1aa51ee6ee9a1441c4cc";
+      sha256 = "0dvpfbyvsalim5ml37vprh5ay9brdjfpcn08rgg77xp6pcjrk2qb";
     };
     meta.homepage = "https://github.com/luukvbaal/statuscol.nvim/";
   };
@@ -10159,12 +10183,12 @@ final: prev:
 
   suda-vim = buildVimPlugin {
     pname = "suda.vim";
-    version = "2024-03-12";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "lambdalisue";
       repo = "suda.vim";
-      rev = "66727b416837836712975e748bc8a19fb6cf4ec3";
-      sha256 = "09lbnx6mrqsrn6fvcp3mb6mkwbrkdrvr5rgzp43idj0ipm5j809h";
+      rev = "04469d855e36fffcda6be036eb7ff005f64fa0d6";
+      sha256 = "18igbn0ldh3mwf8qlnfbbidk88l1wfjx1v95dmdwd1xif642bppn";
     };
     meta.homepage = "https://github.com/lambdalisue/suda.vim/";
   };
@@ -10329,12 +10353,12 @@ final: prev:
 
   tabout-nvim = buildVimPlugin {
     pname = "tabout.nvim";
-    version = "2024-02-18";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "abecodes";
       repo = "tabout.nvim";
-      rev = "6a8f4e67a9bfc9bfc9989cc45253180598cc4339";
-      sha256 = "0j4n6f8k2054v77pm458q0qf36ipyk31lplm2m4fszxq0sq0kmwp";
+      rev = "c442ae7788c30dbd41d259c51df4046cb8269a96";
+      sha256 = "0rd451fz9i6wbyzjrdkjz4phwlq8fz1lcgmbdjrjxvax3hkpbbqx";
     };
     meta.homepage = "https://github.com/abecodes/tabout.nvim/";
   };
@@ -10449,12 +10473,12 @@ final: prev:
 
   telekasten-nvim = buildVimPlugin {
     pname = "telekasten.nvim";
-    version = "2024-02-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "renerocksai";
       repo = "telekasten.nvim";
-      rev = "a684d6ebe7026944b0a5323219d5f5364511e5b2";
-      sha256 = "03hsj2rfhllpxy0x8nr5sjp2krfg51ib0771bqmwycnlfg3cp1bw";
+      rev = "24fd8c1e7eb989dba9efa5d174e42870f08da8fb";
+      sha256 = "1ky0035jar8i06k8w4mkizbcyiib393zk3cwr14fnsvq94jp23bs";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/renerocksai/telekasten.nvim/";
@@ -10486,12 +10510,12 @@ final: prev:
 
   telescope-coc-nvim = buildVimPlugin {
     pname = "telescope-coc.nvim";
-    version = "2024-03-02";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "fannheyward";
       repo = "telescope-coc.nvim";
-      rev = "421f50c56d66bc8f39c5deec05532deb071b597d";
-      sha256 = "1cf6990fkrzbagwphzkyh10i30hrv8vbqgmf4znva3ms1ad7ilhf";
+      rev = "55ca0d6960eb1c32f9f7967fa71926f7bad484a8";
+      sha256 = "0yzw9k406q1ixascqw8maw9raqny6cc0cp1idmdsrp8dnvl954v8";
     };
     meta.homepage = "https://github.com/fannheyward/telescope-coc.nvim/";
   };
@@ -10522,12 +10546,12 @@ final: prev:
 
   telescope-frecency-nvim = buildVimPlugin {
     pname = "telescope-frecency.nvim";
-    version = "2024-03-25";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-frecency.nvim";
-      rev = "2a22815b0928087a5989e2a8e836b13b46015505";
-      sha256 = "0jar21cac5q0blpfc25hyfi1kxxx18maw0mvjnpi5awygggxxwx7";
+      rev = "94a532cb9c4713db83acf5432f5aadfd096e2af9";
+      sha256 = "17243ls89kdalb0vlx84blwxan9g8xdin9fvzyk5xkb8b1wbpz5p";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-frecency.nvim/";
   };
@@ -10607,12 +10631,12 @@ final: prev:
 
   telescope-manix = buildNeovimPlugin {
     pname = "telescope-manix";
-    version = "2024-03-31";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "telescope-manix";
-      rev = "b61eaf260d02da734228e0d54c3999b9b8340d5e";
-      sha256 = "1asih4ycx4219zhidsyvlw95rv83vpvx8bdb7ivzsqjnv92s70f4";
+      rev = "bd6b110a08cc5b7c098020325ff55218a5b249da";
+      sha256 = "1dj6bdx98596l2lnjcdd2c5zm5j00cid0kdb0zd6vhv1jfw8zqsx";
     };
     meta.homepage = "https://github.com/MrcJkb/telescope-manix/";
   };
@@ -10752,12 +10776,12 @@ final: prev:
 
   telescope-nvim = buildNeovimPlugin {
     pname = "telescope.nvim";
-    version = "2024-04-02";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope.nvim";
-      rev = "4626aaa2bcfdacf55fd6d44b430e2df81b2403ff";
-      sha256 = "0rzdasr1lavdrxk7kszi0ari3di48zfki70himrc1m2qs89pa6ph";
+      rev = "7d1698f3d88b448e0639974248cc17f49b7b8acf";
+      sha256 = "1k3fhgpakr1b8x9fk7sq699h3479k8x9yc3jbq7xq2jk7p0n4m62";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope.nvim/";
   };
@@ -10860,12 +10884,12 @@ final: prev:
 
   texpresso-vim = buildVimPlugin {
     pname = "texpresso.vim";
-    version = "2024-03-08";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "let-def";
       repo = "texpresso.vim";
-      rev = "04816dcdddc27e6c50fc2a4faff0ef1675a7ee8e";
-      sha256 = "08lzl0g1b287agscd345yg9cmxsj2vlbg83s1mgsa13qn81y6jga";
+      rev = "30f9b8277b18326e0aa6882fb96d51bc1b40a222";
+      sha256 = "1iagc7kld327mkkravk30dz2a0dq4i8718w0k1jrlj0z54981gbn";
     };
     meta.homepage = "https://github.com/let-def/texpresso.vim/";
   };
@@ -11005,12 +11029,12 @@ final: prev:
 
   toggleterm-nvim = buildVimPlugin {
     pname = "toggleterm.nvim";
-    version = "2024-02-12";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "toggleterm.nvim";
-      rev = "193786e0371e3286d3bc9aa0079da1cd41beaa62";
-      sha256 = "0cz6i3xa61mh8s5b9b2z008ay85ggaw02ak9w58wzgmn172q770l";
+      rev = "dca1c80fb8ec41c97e7c3ef308719d8143fbbb05";
+      sha256 = "11rmk7hpmf75n0lgchj7hvsw9915m493hlgqsmjkkyhs9w0bwb4n";
     };
     meta.homepage = "https://github.com/akinsho/toggleterm.nvim/";
   };
@@ -11209,12 +11233,12 @@ final: prev:
 
   typst-vim = buildVimPlugin {
     pname = "typst.vim";
-    version = "2024-03-25";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "kaarmu";
       repo = "typst.vim";
-      rev = "86e4fa8dcddd032f9fdbf04602417a8baac8fed3";
-      sha256 = "1rhiz5lbkq3d6pd0g07hj9gwk359vyk2vqsj0h4dmkvz6vlnnjv2";
+      rev = "d9a7650e76c85f8ba437e056d08dd43b01b8bfd6";
+      sha256 = "1l4mq2m8s7kav6hpq6nay4xyy2jvq6jbblyy100yfb9nrzkpggpc";
     };
     meta.homepage = "https://github.com/kaarmu/typst.vim/";
   };
@@ -11245,12 +11269,12 @@ final: prev:
 
   undotree = buildVimPlugin {
     pname = "undotree";
-    version = "2024-03-08";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "mbbill";
       repo = "undotree";
-      rev = "aa93a7e5890dbbebbc064cd22260721a6db1a196";
-      sha256 = "110w9nr24rph717w1vs3vhfq1ggsjgq91zvyp431qxpa7wzd5pyk";
+      rev = "56c684a805fe948936cda0d1b19505b84ad7e065";
+      sha256 = "1yy7y344b906z04rrnvy2hkrgsrxjm6ij399qmfw8b20rxdyi2jh";
     };
     meta.homepage = "https://github.com/mbbill/undotree/";
   };
@@ -11269,12 +11293,12 @@ final: prev:
 
   unison = buildVimPlugin {
     pname = "unison";
-    version = "2024-04-01";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "unisonweb";
       repo = "unison";
-      rev = "80fc452dd8cd325436fb8da1dcd54510348c89de";
-      sha256 = "0ndmfsxy4scwahv3917ylxjn59lih9q1rha636h2xq4bcmgbcifb";
+      rev = "ac4d817f5e18a0b462b23dcd124f849633d650fe";
+      sha256 = "00dsvdqp02bf8zvnk8ljn0f38wb38h8iabsrarycl2a3v6jr8lgr";
     };
     meta.homepage = "https://github.com/unisonweb/unison/";
   };
@@ -11341,12 +11365,12 @@ final: prev:
 
   venn-nvim = buildVimPlugin {
     pname = "venn.nvim";
-    version = "2023-11-05";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "jbyuki";
       repo = "venn.nvim";
-      rev = "e4d68341a73dd56c64955058821a58295fb337b1";
-      sha256 = "181sr7p8qn67br64ahg5vhb9b7m9mldwlg27nsgs0hc33vagvr1h";
+      rev = "a5430d75875acbe93e9685cdeb78c6eb2a329ed5";
+      sha256 = "1dwl75chqbp888yp2ykyqszz0glli2vx2cbw3lsgnrzlhql53alm";
     };
     meta.homepage = "https://github.com/jbyuki/venn.nvim/";
   };
@@ -11377,12 +11401,12 @@ final: prev:
 
   vim-CtrlXA = buildVimPlugin {
     pname = "vim-CtrlXA";
-    version = "2024-03-27";
+    version = "2024-04-07";
     src = fetchFromGitHub {
       owner = "Konfekt";
       repo = "vim-CtrlXA";
-      rev = "56a7041a393f08594dc34865ddddc724bffa7684";
-      sha256 = "1gw2793hdw7m1k5837ynnzvbb1ikgyhzi6lv817cdfgxa5kkqsh0";
+      rev = "cb520cd3f9248b9ede236ff3da8ca3e0b68b6459";
+      sha256 = "1csbmjrdrlqsagz5b6hryrcglfdplwc7d26q4r20w37zx3f9qzw3";
     };
     meta.homepage = "https://github.com/Konfekt/vim-CtrlXA/";
   };
@@ -12205,12 +12229,12 @@ final: prev:
 
   vim-code-dark = buildVimPlugin {
     pname = "vim-code-dark";
-    version = "2023-11-11";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "tomasiser";
       repo = "vim-code-dark";
-      rev = "8def3d890b2087ee4c42af03117d7edc7d693706";
-      sha256 = "129mrz3jxw4kgbg5lz9gc7rznsjp2fbjvi60zyrpkmv8xa6yhmpw";
+      rev = "05d7843412c4fb7d1bdafefd04462ac4db841f0f";
+      sha256 = "1ycb94cdady4x1bv957zcndrsk16ia54q5kg1k8r8x0ir0gclmac";
     };
     meta.homepage = "https://github.com/tomasiser/vim-code-dark/";
   };
@@ -12289,12 +12313,12 @@ final: prev:
 
   vim-commentary = buildVimPlugin {
     pname = "vim-commentary";
-    version = "2024-01-12";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-commentary";
-      rev = "f67e3e67ea516755005e6cccb178bc8439c6d402";
-      sha256 = "0r5jlxkxfy5gvpkmzsfkxzlgydn477qiywqlng4xbaw3pijcf04i";
+      rev = "c4b8f52cbb7142ec239494e5a2c4a512f92c4d07";
+      sha256 = "1v16mnjm8gr540w6smvwbpn1zmjimzwi74a8d165a1yacnmdm6pf";
     };
     meta.homepage = "https://github.com/tpope/vim-commentary/";
   };
@@ -12601,12 +12625,12 @@ final: prev:
 
   vim-easy-align = buildVimPlugin {
     pname = "vim-easy-align";
-    version = "2019-04-29";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "vim-easy-align";
-      rev = "12dd6316974f71ce333e360c0260b4e1f81169c3";
-      sha256 = "0gpfdla8shaf5ykgakrsf0h0w6ygvwcv3lfpnki24l790xhdi606";
+      rev = "9815a55dbcd817784458df7a18acacc6f82b1241";
+      sha256 = "028gcsvmihw3nmc4pp9zyh8na29i6h0fhihk060ka2y3rn5xc9zl";
     };
     meta.homepage = "https://github.com/junegunn/vim-easy-align/";
   };
@@ -12913,12 +12937,12 @@ final: prev:
 
   vim-floaterm = buildVimPlugin {
     pname = "vim-floaterm";
-    version = "2024-04-02";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "voldikss";
       repo = "vim-floaterm";
-      rev = "fe61226f8990bb4d36fa274fdc5f6079535cedeb";
-      sha256 = "0yy16na6ffjj4kk14ar1gy9zvd9nlz15hnn18s3g92494gipq4q2";
+      rev = "4e28c8dd0271e10a5f55142fb6fe9b1599ee6160";
+      sha256 = "0nkbp4hcpfqj2s85g03rkb3786pa4cdf80mvmbzc89kiqw2ir260";
     };
     meta.homepage = "https://github.com/voldikss/vim-floaterm/";
   };
@@ -12985,12 +13009,12 @@ final: prev:
 
   vim-fugitive = buildVimPlugin {
     pname = "vim-fugitive";
-    version = "2024-03-31";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "c0b03f1cac242d96837326d300f42a660306fc1a";
-      sha256 = "0czzasq0r4130yxjhsakk65p5yv7wcwlbzrv14dbjjsvgjs0zdlx";
+      rev = "dac8e5c2d85926df92672bf2afb4fc48656d96c7";
+      sha256 = "1m33vpkfw1dx3kxxgw8r278a5rch4sd3ngc9mbnap97f0q8karm6";
     };
     meta.homepage = "https://github.com/tpope/vim-fugitive/";
   };
@@ -13141,12 +13165,12 @@ final: prev:
 
   vim-go = buildVimPlugin {
     pname = "vim-go";
-    version = "2024-03-25";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "14eedf6135cf4253b0ed48a0b53d6834a40da1c4";
-      sha256 = "06ihf1mrynk28yv4a23khfbz16621pj3lindwd19p2sn3wbz47d1";
+      rev = "feef9b31507f8e942bcd21f9e1f22d587c83c72d";
+      sha256 = "10baiz4hklzwr53vrvivmx86c84d66k0yzbajd3p8mi19h3a96gy";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
   };
@@ -13478,12 +13502,12 @@ final: prev:
 
   vim-illuminate = buildVimPlugin {
     pname = "vim-illuminate";
-    version = "2024-02-04";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "vim-illuminate";
-      rev = "305bf07b919ac526deb5193280379e2f8b599926";
-      sha256 = "1pmzh7pz23dl6jmcify9494jwgyi2jfjkg0l95cxfrbjqghjxli8";
+      rev = "e522e0dd742a83506db0a72e1ced68c9c130f185";
+      sha256 = "0l9306c3867r6dqn4272kkzql63pwfaibhdwisjlc7pcv9wzah53";
     };
     meta.homepage = "https://github.com/RRethy/vim-illuminate/";
   };
@@ -13743,12 +13767,12 @@ final: prev:
 
   vim-just = buildVimPlugin {
     pname = "vim-just";
-    version = "2024-04-03";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "NoahTheDuke";
       repo = "vim-just";
-      rev = "4f6eea3d5ad64236549411bb2e2fd8f1c7926abc";
-      sha256 = "07g61mvln8sdqfacypap5fdx235bmrlbx713s4n8jpxdp6fwnydr";
+      rev = "a2777b4b113dafc639f541ad4f0f7da0adc640f4";
+      sha256 = "07dwja75dlwjmn687jbk56yz3srijjagppqn7xyl4bzd0svi4s97";
     };
     meta.homepage = "https://github.com/NoahTheDuke/vim-just/";
   };
@@ -13803,12 +13827,12 @@ final: prev:
 
   vim-lawrencium = buildVimPlugin {
     pname = "vim-lawrencium";
-    version = "2024-04-03";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "ludovicchabant";
       repo = "vim-lawrencium";
-      rev = "756d7544c380a92b6f12e501a0d979cb6f53a90a";
-      sha256 = "16wzibxqz6jqh4bp43h1hh9kwlnns6zcqd6hdi25zzlfpx5m14q3";
+      rev = "a790513b278eba1279e1f053aab760cbddbc3872";
+      sha256 = "0awx42g0wak2akxmdm5whp2hcgjyqf28v3vzmb06l1fm7qs76c0v";
     };
     meta.homepage = "https://github.com/ludovicchabant/vim-lawrencium/";
   };
@@ -14007,12 +14031,12 @@ final: prev:
 
   vim-lsp-settings = buildVimPlugin {
     pname = "vim-lsp-settings";
-    version = "2024-03-19";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "mattn";
       repo = "vim-lsp-settings";
-      rev = "d0766475906b8cda4d542a2284efd170da31eff7";
-      sha256 = "0abnh5rrir62glayf8kdlq9h16ixa934z0hpw4kc7k4nsx66y91m";
+      rev = "4b3732c31b408953a1bb0fca6f003400abb5bfaa";
+      sha256 = "1p02j2k68csvcp5wshhzk29byavsc76gpj7a935smirj9d8nhcmr";
     };
     meta.homepage = "https://github.com/mattn/vim-lsp-settings/";
   };
@@ -14116,12 +14140,12 @@ final: prev:
 
   vim-markdown-toc = buildVimPlugin {
     pname = "vim-markdown-toc";
-    version = "2024-03-20";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "mzlogin";
       repo = "vim-markdown-toc";
-      rev = "483c8fbc7d63c9d381b367a9f845674456081534";
-      sha256 = "08mvz4qz2mvcyvlii4p7v5w9pc81vwh108p643dm8rzkw0g8kn50";
+      rev = "05d6538ccef1d33f2d26f2515c0eacaa93d2e061";
+      sha256 = "0x9vq6qi7m532la56i9pnp9l4q1s7iy1g7w36451w4c03lsw39is";
     };
     meta.homepage = "https://github.com/mzlogin/vim-markdown-toc/";
   };
@@ -14668,12 +14692,12 @@ final: prev:
 
   vim-paper = buildVimPlugin {
     pname = "vim-paper";
-    version = "2023-08-02";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "yorickpeterse";
       repo = "vim-paper";
-      rev = "c4995be5a73a5b24d69a9ebd932a4e9be58fdb90";
-      sha256 = "11psmnapyz8qg2h6rm2wkaq8xkw8kv12nwq5m16baqvf04fp847c";
+      rev = "790c31c56ce510cc0c0f777090be4140fe130d1d";
+      sha256 = "1w958a6ga1a6518f5cr1nag6vkkxh92hqcv5k6f7410xm7fqdya6";
     };
     meta.homepage = "https://github.com/yorickpeterse/vim-paper/";
   };
@@ -15040,12 +15064,12 @@ final: prev:
 
   vim-rails = buildVimPlugin {
     pname = "vim-rails";
-    version = "2024-02-11";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-rails";
-      rev = "3a155462d1c346e291595400ca238037d02a357f";
-      sha256 = "0zz510l1ncv3abax76s99cfpc6r6vvb81hnhxzyx4nzgwqzm0qag";
+      rev = "8972461e64c7c4bf049f2f86ea1bc571e8077b55";
+      sha256 = "08lzlk2lhfcyp45sk90h3j6diwz78c8hx0dm1wb9fykmiiipsr0c";
     };
     meta.homepage = "https://github.com/tpope/vim-rails/";
   };
@@ -15280,12 +15304,12 @@ final: prev:
 
   vim-signify = buildVimPlugin {
     pname = "vim-signify";
-    version = "2023-05-10";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "mhinz";
       repo = "vim-signify";
-      rev = "7d538b77a5a8806e344b057f8846f6d0c035efa9";
-      sha256 = "00ybb3l0g9bprdlj33f0n3nlf96gm40gsmnlazh9mzb3nzr2knzr";
+      rev = "8670143f9e12ed1cd3c9b2c54f345cdd9a4baac3";
+      sha256 = "0wpa5d401slgg41mknm6kiaki7frg7wkzs7ymjyn4l5jxq03x42h";
     };
     meta.homepage = "https://github.com/mhinz/vim-signify/";
   };
@@ -15725,12 +15749,12 @@ final: prev:
 
   vim-test = buildVimPlugin {
     pname = "vim-test";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "vim-test";
       repo = "vim-test";
-      rev = "8746ef06631293d7d47a6daccd95b0ed3e135494";
-      sha256 = "04wp13zpfzvcx7lisjq489m8vh6maynv6lhz7didqr3lawicnvr2";
+      rev = "eb5bd18d58a859e7d55d732d37e4e2b94fa50275";
+      sha256 = "0v4yi5h8w06vkcl13zhl8hmb79d1g1rc4wrbwj86rxcq7yj490vk";
     };
     meta.homepage = "https://github.com/vim-test/vim-test/";
   };
@@ -15821,12 +15845,12 @@ final: prev:
 
   vim-themis = buildVimPlugin {
     pname = "vim-themis";
-    version = "2024-03-02";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "thinca";
       repo = "vim-themis";
-      rev = "5c8df1b5fa495ece990df5596d8e7fa1be2c2355";
-      sha256 = "14v75zl5dgxi9pyv8vm79gd578mnq0mw4c947v8f2zhlc4xbda04";
+      rev = "c1f4d465ce7dd23735513551b5c4c918d9c1bab1";
+      sha256 = "1vzwjpn3jr3ayal2pjr2qb36mal2pa8szbf83nqzb2awa1lv1ds1";
     };
     meta.homepage = "https://github.com/thinca/vim-themis/";
   };
@@ -15869,12 +15893,12 @@ final: prev:
 
   vim-tmux-navigator = buildVimPlugin {
     pname = "vim-tmux-navigator";
-    version = "2023-12-23";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "christoomey";
       repo = "vim-tmux-navigator";
-      rev = "38b1d0402c4600543281dc85b3f51884205674b6";
-      sha256 = "0wj7627bvzw2rjb97b3ddkqx966f4xjlw80lmna6kxi0vvx5hsp1";
+      rev = "a26954a585b02a2ac02f87145e204f8798a7cbc2";
+      sha256 = "01nqxcsn2w24w33d0c4k2w5xyxb0xxvwn7a3pxlzv4i1k36nyaz9";
     };
     meta.homepage = "https://github.com/christoomey/vim-tmux-navigator/";
   };
@@ -15905,12 +15929,12 @@ final: prev:
 
   vim-tpipeline = buildVimPlugin {
     pname = "vim-tpipeline";
-    version = "2024-02-18";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "vimpostor";
       repo = "vim-tpipeline";
-      rev = "649f079a0bee19565978b82b672d831c6641d952";
-      sha256 = "16lyavpy8qh06l03jqs7klyja3nqs3ynjfy7y8xjmlqa4mgfcffn";
+      rev = "5dd3832bd6e239feccb11cadca583cdcf9d5bda1";
+      sha256 = "14f4fjjjjml3rbh99385xzkkcfqa7awa9bjc191qvvvycqipp0hw";
     };
     meta.homepage = "https://github.com/vimpostor/vim-tpipeline/";
   };
@@ -16145,12 +16169,12 @@ final: prev:
 
   vim-wakatime = buildVimPlugin {
     pname = "vim-wakatime";
-    version = "2024-03-15";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "wakatime";
       repo = "vim-wakatime";
-      rev = "56b4d073adaf18c04c7bb5728d41c03b2f25754d";
-      sha256 = "1qcx81hgamz4v7nxhbx0kbwsx2qm0b7rsgpja16imhycvlaf28n1";
+      rev = "5d11a253dd1ecabd4612a885175216032d814300";
+      sha256 = "1kx5xid8sybwc7fmmcn6j36r8n0m3g0529q5p0mywfn337m8q3np";
     };
     meta.homepage = "https://github.com/wakatime/vim-wakatime/";
   };
@@ -16470,12 +16494,12 @@ final: prev:
 
   vimtex = buildVimPlugin {
     pname = "vimtex";
-    version = "2024-03-31";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "ac0a41b297a70c101df89bc9c8d43341ba00fd4f";
-      sha256 = "1lnakgdi5gp46v0bqivlvmjqqcagvz78h5327p4k9fxccz3gcf58";
+      rev = "268dd8d311adebb121fa0a4b31cdabcb98072403";
+      sha256 = "1nd6yafqvdx0h7mad3pwfp3fxs8kssjyd758q3f99612fhl63c61";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -16554,24 +16578,24 @@ final: prev:
 
   vista-vim = buildVimPlugin {
     pname = "vista.vim";
-    version = "2024-02-21";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vista.vim";
-      rev = "f76cecc430003968e6174cae899c2cb2953219b7";
-      sha256 = "0hq41f91f97885vx1rcl981vhwariiwbz2hs0dzryka2ycy5lvy4";
+      rev = "04fa99afe865b16324af94fd8a8391121117d8f7";
+      sha256 = "0gjma1ba0ds0dznhqdajmhib1i49b08iv7hf0c4vjz833kcjagqj";
     };
     meta.homepage = "https://github.com/liuchengxu/vista.vim/";
   };
 
   vscode-nvim = buildVimPlugin {
     pname = "vscode.nvim";
-    version = "2024-03-24";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "Mofiqul";
       repo = "vscode.nvim";
-      rev = "4fe3e696a90f183d4dbbb432ddb79155c6d4c99b";
-      sha256 = "1dxabfrdwm5c8dnpjzgxmb9bnajnk3d4jhg5m1mvkw9vlyjvq8xg";
+      rev = "d47aab1fbe423bf14275745684205dca08366277";
+      sha256 = "0g4dh47rasd5973mjv8cpsd1c6bf5c1bv7pc05sbjkb8vck2lsl5";
     };
     meta.homepage = "https://github.com/Mofiqul/vscode.nvim/";
   };
@@ -16650,12 +16674,12 @@ final: prev:
 
   wiki-vim = buildVimPlugin {
     pname = "wiki.vim";
-    version = "2024-04-02";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "wiki.vim";
-      rev = "34c82a61963988bdf9db3ff426ff313d419f2061";
-      sha256 = "0qazdn1y0j3pb9qm3f9ydasgkcvishz2km0aw19n1fqyylal0fps";
+      rev = "0035cd000cb2a5c60ea67c176ce795852ea04448";
+      sha256 = "0xzxscvaflappikhi7l0v6i92cls6jp1y8fq2pfai9rnsyizvh7p";
     };
     meta.homepage = "https://github.com/lervag/wiki.vim/";
   };
@@ -16758,12 +16782,12 @@ final: prev:
 
   wrapping-nvim = buildVimPlugin {
     pname = "wrapping.nvim";
-    version = "2024-02-25";
+    version = "2024-04-07";
     src = fetchFromGitHub {
       owner = "andrewferrier";
       repo = "wrapping.nvim";
-      rev = "2b74a9fa326ad42e2a509f9e49543471d2d7c1ea";
-      sha256 = "1v66hgmv05w5yz9bg4h5s00j1iz41pc09prm45xdbds6kx02rg2d";
+      rev = "d1ac69c0db82ff0c7540088a0f91d74ad7378c3d";
+      sha256 = "0cmvgmynr3jkp9ikygrn773f3j8n6580ajvv29p8lzg6h5pvafdc";
     };
     meta.homepage = "https://github.com/andrewferrier/wrapping.nvim/";
   };
@@ -16951,12 +16975,12 @@ final: prev:
 
   zk-nvim = buildVimPlugin {
     pname = "zk-nvim";
-    version = "2024-01-05";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "zk-org";
       repo = "zk-nvim";
-      rev = "fb0962b75a680561f94cae0588b8da92ea8d2fae";
-      sha256 = "0xbxkm6inxi09fb0zj4zrbfi8iyhcjn6lfrwqvmym8fnvi5pmz4c";
+      rev = "e2b6d62b18a88249016bf917d4e5bb0e417ac974";
+      sha256 = "16mmrl34f1bsr1dfl1drg62wwycc23n9w0qczmqz7ylpgb6k8i02";
     };
     meta.homepage = "https://github.com/zk-org/zk-nvim/";
   };
@@ -16987,12 +17011,12 @@ final: prev:
 
   catppuccin-nvim = buildVimPlugin {
     pname = "catppuccin-nvim";
-    version = "2024-03-29";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "aebe43db9cb26e1c70fc5b2fd4158169c405e720";
-      sha256 = "0921cvaa0hkm47vcih1vjsqabzgnpqj1qvg2hnlrv3shr49z220r";
+      rev = "a1439ad7c584efb3d0ce14ccb835967f030450fe";
+      sha256 = "1ngjll0khnx1nighazw64kvfdl139z8xhv0hh2r4bb40ynxnhdf9";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
@@ -17011,12 +17035,12 @@ final: prev:
 
   dracula-vim = buildVimPlugin {
     pname = "dracula-vim";
-    version = "2024-02-23";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "vim";
-      rev = "9fa89296884e47bbadc49ad959e37b9d1c24cafb";
-      sha256 = "0911akib9ys9vyxnalbmyip7m1ahpnsn89km2hrgj0fc9s5m75ky";
+      rev = "28874a1e9d583eb0b1dfebb9191445b822812ea3";
+      sha256 = "1answqiln7pg1f0cpgknjrnnzk4cslhn19vnv2hvji9xm45lvvbv";
     };
     meta.homepage = "https://github.com/dracula/vim/";
   };
@@ -17059,12 +17083,12 @@ final: prev:
 
   harpoon2 = buildVimPlugin {
     pname = "harpoon2";
-    version = "2024-04-02";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "ThePrimeagen";
       repo = "harpoon";
-      rev = "4ad05be8fe98092f0dec3bc3b47abebb59c3814a";
-      sha256 = "0ssnlid3bd6qnar1xlg2kkmlgfdabrnkwqhvvw02nr9ms901d9sh";
+      rev = "0378a6c428a0bed6a2781d459d7943843f374bce";
+      sha256 = "129d51cp89dir809yakiw0b7kkjqww7s5h437j8ppn1lq7ghg50m";
     };
     meta.homepage = "https://github.com/ThePrimeagen/harpoon/";
   };
@@ -17083,12 +17107,12 @@ final: prev:
 
   nightfly = buildVimPlugin {
     pname = "nightfly";
-    version = "2024-03-28";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "bluz71";
       repo = "vim-nightfly-colors";
-      rev = "06cd078edc8d92ded2d37270649bd8ed23dec43d";
-      sha256 = "1axw4m4xw6nqbiabs7cbd8davgpgbxvyxjn73n21zh9bvjdmm90x";
+      rev = "a54ba6131c4e5feb47176efb78b1f93501df1572";
+      sha256 = "1ajnyr7lwhmpjzdwni0hzgd46x64kgdgb3x0qjmvw2q456vs1fap";
     };
     meta.homepage = "https://github.com/bluz71/vim-nightfly-colors/";
   };
@@ -17107,12 +17131,12 @@ final: prev:
 
   nvchad-ui = buildVimPlugin {
     pname = "nvchad-ui";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "ui";
-      rev = "e1af69426b3c4b55c88bd1c81790c1c73b30bfa8";
-      sha256 = "1rmfjmwm5zckvdyk2pdpi2zgzql9rvy0b2rpsm8z56g98skh3nma";
+      rev = "6512f7d1faa4fd86c53e9c5c8492b4bdda692613";
+      sha256 = "165yndfj0m3wib17wa15fswsfwixm1bxalprpbdwvyzd2f9p1fd0";
     };
     meta.homepage = "https://github.com/nvchad/ui/";
   };
@@ -17155,12 +17179,12 @@ final: prev:
 
   rose-pine = buildVimPlugin {
     pname = "rose-pine";
-    version = "2024-03-30";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "rose-pine";
       repo = "neovim";
-      rev = "19055dfe90bfa46a1e5b0a706d13980bdffa2dee";
-      sha256 = "0h3l8dnzqvbq43zhbgm2p741ivk3zks5qi6azyg0qmjx469h4mhr";
+      rev = "17b466e79479758b332a3cac12544a3ad2be6241";
+      sha256 = "1fwwp7szzz2yp4z5hngqn8ll8765xv0nlhgcb75yj257kz7x5lq1";
     };
     meta.homepage = "https://github.com/rose-pine/neovim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 8c1224cbe4c96..42c846ee5ebc1 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -27,12 +27,12 @@
   };
   angular = buildGrammar {
     language = "angular";
-    version = "0.0.0+rev=62179d7";
+    version = "0.0.0+rev=b7a7167";
     src = fetchFromGitHub {
       owner = "dlvandenberg";
       repo = "tree-sitter-angular";
-      rev = "62179d7bbfb5fd8a8f7298495ac654d252a1bd52";
-      hash = "sha256-qRsBeJ01kGTKJqFubG1u9SFa1nsDH7ZHKQ0cGwfqi84=";
+      rev = "b7a7167762e3863b3d6247c708b7f9bca1ca7bea";
+      hash = "sha256-GXjjRcB0ml9MMYuJUWAlORWrOUsRxrwZ6kmg0fp3kNQ=";
     };
     meta.homepage = "https://github.com/dlvandenberg/tree-sitter-angular";
   };
@@ -50,34 +50,34 @@
   };
   arduino = buildGrammar {
     language = "arduino";
-    version = "0.0.0+rev=e3d0dea";
+    version = "0.0.0+rev=4ddf79e";
     src = fetchFromGitHub {
       owner = "ObserverOfTime";
       repo = "tree-sitter-arduino";
-      rev = "e3d0dea39dbb8032e754bafe5aec3ed5a234d986";
-      hash = "sha256-cBuFIHUZQGkj1C3S6W+yPPuICxL1cCZVoSVvMOqjDAY=";
+      rev = "4ddf79edaa87170ec12bd6a8d03a8ac528fe0ae7";
+      hash = "sha256-DbxzbbmKq0GxbKIKtoygEhbdYeEwp23Nkk15WI2AQW4=";
     };
     meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-arduino";
   };
   asm = buildGrammar {
     language = "asm";
-    version = "0.0.0+rev=62e4932";
+    version = "0.0.0+rev=afdc3d5";
     src = fetchFromGitHub {
       owner = "RubixDev";
       repo = "tree-sitter-asm";
-      rev = "62e49328113ff318128c640bf0cf6dd3d3d51553";
-      hash = "sha256-FwbHDaUqIVKYIAOCF9kv30aV2JX/tEmGUsWXFKQ6Uro=";
+      rev = "afdc3d5da18d42cbb471c0f40527dbed9cace7ad";
+      hash = "sha256-YYzJMGmizeqZxBF2YXYPLjAo54Y60z7RFhLcmOJbeGY=";
     };
     meta.homepage = "https://github.com/RubixDev/tree-sitter-asm";
   };
   astro = buildGrammar {
     language = "astro";
-    version = "0.0.0+rev=dfa0893";
+    version = "0.0.0+rev=b422ccd";
     src = fetchFromGitHub {
       owner = "virchau13";
       repo = "tree-sitter-astro";
-      rev = "dfa0893bdc4bdfada102043404758c66e3580568";
-      hash = "sha256-gToRdyLvvDaeE1b9fYRVPFt1mtdR9kSYzqFBDUYpv3k=";
+      rev = "b422ccd41f0b433260a3d28df7e39fa2ff63ef9c";
+      hash = "sha256-FrXd4dR28GP1CAP+SaGSRO8TImok9MjVw2vWyZgUijQ=";
     };
     meta.homepage = "https://github.com/virchau13/tree-sitter-astro";
   };
@@ -105,12 +105,12 @@
   };
   bash = buildGrammar {
     language = "bash";
-    version = "0.0.0+rev=f3f26f4";
+    version = "0.0.0+rev=f8fb327";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-bash";
-      rev = "f3f26f47a126797c011c311cec9d449d855c3eab";
-      hash = "sha256-6Rfxh8Y6dg2wyQ9jYnbOaXm1SVfQDQ1B1tNqgpz6sY4=";
+      rev = "f8fb3274f72a30896075585b32b0c54cad65c086";
+      hash = "sha256-sj1qYb42k0hXXcNCKg1hINYD11wDcVpnoPhZNtlYT6k=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
   };
@@ -149,12 +149,12 @@
   };
   bicep = buildGrammar {
     language = "bicep";
-    version = "0.0.0+rev=c3451d1";
+    version = "0.0.0+rev=0092c7d";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-bicep";
-      rev = "c3451d1049c80074b18078ba50007b7c00e063f8";
-      hash = "sha256-81Pt/Yyc/r8RDBCaGcXx9giIJ9+smi9Xus43NGOePgM=";
+      rev = "0092c7d1bd6bb22ce0a6f78497d50ea2b87f19c0";
+      hash = "sha256-jj1ccJQOX8oBx1XVKzI53B1sveq5kNADc2DB8bJhsf4=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-bicep";
   };
@@ -182,23 +182,23 @@
   };
   c = buildGrammar {
     language = "c";
-    version = "0.0.0+rev=72084f4";
+    version = "0.0.0+rev=1aafaff";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c";
-      rev = "72084f447c2051e01a7cd6c6e0477ec71a9297ed";
-      hash = "sha256-M0OWcUS+7G/S8S6iqlHXXcWfwqQLjshZpWniFzf3hvo=";
+      rev = "1aafaff4d26dac5a36dd3495be33e1c20161d761";
+      hash = "sha256-eix/BqsZzrJc+h1sHiG/IDtdyZvIsEdox71sPMNXs58=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
   };
   c_sharp = buildGrammar {
     language = "c_sharp";
-    version = "0.0.0+rev=92c0a94";
+    version = "0.0.0+rev=9de5652";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c-sharp";
-      rev = "92c0a9431400cd8b6b6ee7503f81da3ae83fc830";
-      hash = "sha256-8ffTbsAOjGZi1Bcf2mOGjTLbzwVI8K1RAYrUbhj/j94=";
+      rev = "9de565257ada70ac441c640e3b5d6850e2df5ab8";
+      hash = "sha256-QNI2V1CG1DdkMIzR+NUcM/IjtQHnJcYn9Nk3sUmkINE=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
   };
@@ -215,12 +215,12 @@
   };
   capnp = buildGrammar {
     language = "capnp";
-    version = "0.0.0+rev=dc28c9f";
+    version = "0.0.0+rev=7b0883c";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-capnp";
-      rev = "dc28c9f4212809eab74d10996086297853eb34e5";
-      hash = "sha256-4GcOBC5JJsfbdsIrQd33tSW2sz6ytjYGqWgFVFLH6sc=";
+      rev = "7b0883c03e5edd34ef7bcf703194204299d7099f";
+      hash = "sha256-WKrZuOMxmdGlvUI9y8JgwCNMdJ8MULucMhkmW8JCiXM=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-capnp";
   };
@@ -270,12 +270,12 @@
   };
   commonlisp = buildGrammar {
     language = "commonlisp";
-    version = "0.0.0+rev=a2a6749";
+    version = "0.0.0+rev=83ae738";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-commonlisp";
-      rev = "a2a67494c223ccf8aa419ac419d9cdf483dbb8ca";
-      hash = "sha256-6rzHgzXWZW5psOsBxW9ygRIPHc/I3wX40EDDM/nc3Qk=";
+      rev = "83ae738bed7e914cee9090c3fe4c80a32ab45905";
+      hash = "sha256-0qWcrn65vtOYz54NVi/sj+GqnGMztEpZJsl9sjbF5sw=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-commonlisp";
   };
@@ -303,23 +303,23 @@
   };
   cpon = buildGrammar {
     language = "cpon";
-    version = "0.0.0+rev=f4b3cbc";
+    version = "0.0.0+rev=594289e";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-cpon";
-      rev = "f4b3cbc8b0bd4e13035d39940fef09f1392e8739";
-      hash = "sha256-Enxc0sdQS9vSZVvIQkkHxk/1bzT2denRk0+AZdDNnJ8=";
+      rev = "594289eadfec719198e560f9d7fd243c4db678d5";
+      hash = "sha256-Nr+98yrDkOS5Yh/EFmBWV9Yhv2tPfHGb4pPlLUwc+k8=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-cpon";
   };
   cpp = buildGrammar {
     language = "cpp";
-    version = "0.0.0+rev=e0c1678";
+    version = "0.0.0+rev=72fd001";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-cpp";
-      rev = "e0c1678a78731e78655b7d953efb4daecf58be46";
-      hash = "sha256-CdNCVDMAmeJrHgPb2JLxFHj/tHnUYC8flmxj+UaVXTo=";
+      rev = "72fd00128f1c38319670cbf4bcedbba0dc849d96";
+      hash = "sha256-COlDbMi3kKb1YAjJthBO5TmLOWs1dH4VAGNYgh8iSmE=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
   };
@@ -348,12 +348,12 @@
   };
   cuda = buildGrammar {
     language = "cuda";
-    version = "0.0.0+rev=4ec5afd";
+    version = "0.0.0+rev=50a28f4";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-cuda";
-      rev = "4ec5afdf98041d137c25b555958a1f825c7c1272";
-      hash = "sha256-EA37LJeRHBFBra17UwiUASQYTRBuGKE9HNyUrn8HBNk=";
+      rev = "50a28f4600c559e3d19a1825e854dfe6dcac1d49";
+      hash = "sha256-xVf9sD5CbXDn1Kw9vkgKd+hWmerQgHf7ntUtynRXpBo=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
   };
@@ -381,12 +381,12 @@
   };
   dart = buildGrammar {
     language = "dart";
-    version = "0.0.0+rev=7861a48";
+    version = "0.0.0+rev=6da4647";
     src = fetchFromGitHub {
       owner = "UserNobody14";
       repo = "tree-sitter-dart";
-      rev = "7861a4889e7682af453afa4811ae85b1d7a6e415";
-      hash = "sha256-zJngHDZVmQtliHpgqYpLpLvSHQYwOXDDIw/U0/CBxF0=";
+      rev = "6da46473ab8accb13da48113f4634e729a71d335";
+      hash = "sha256-AT7DuOq4mZZxizB2a5UsPGSIP11Jn88O7bJeJIEmv8s=";
     };
     meta.homepage = "https://github.com/UserNobody14/tree-sitter-dart";
   };
@@ -414,12 +414,12 @@
   };
   diff = buildGrammar {
     language = "diff";
-    version = "0.0.0+rev=c165725";
+    version = "0.0.0+rev=710e881";
     src = fetchFromGitHub {
       owner = "the-mikedavis";
       repo = "tree-sitter-diff";
-      rev = "c165725c28e69b36c5799ff0e458713a844f1aaf";
-      hash = "sha256-qou5ow/Am/qyO0I1j74ojgnBonwmJriLCCeSNpTk7t8=";
+      rev = "710e881127512bda8157096e26c1f3e91702823a";
+      hash = "sha256-BdRWI/7LiUS8z5LehaQgPVcdOPcEOJSmNHowtukHAQw=";
     };
     meta.homepage = "https://github.com/the-mikedavis/tree-sitter-diff";
   };
@@ -447,12 +447,12 @@
   };
   dockerfile = buildGrammar {
     language = "dockerfile";
-    version = "0.0.0+rev=33e22c3";
+    version = "0.0.0+rev=439c3e7";
     src = fetchFromGitHub {
       owner = "camdencheek";
       repo = "tree-sitter-dockerfile";
-      rev = "33e22c33bcdbfc33d42806ee84cfd0b1248cc392";
-      hash = "sha256-uCKzTTbJL9Ans3lCQbt2zApF+ERLbbu5D1WcyWJ6Gf4=";
+      rev = "439c3e7b8a9bfdbf1f7d7c2beaae4173dc484cbf";
+      hash = "sha256-sW3fCCAXNak4JszEPgspZFfOHtUlqnW3eRxzHNfzInk=";
     };
     meta.homepage = "https://github.com/camdencheek/tree-sitter-dockerfile";
   };
@@ -480,16 +480,27 @@
   };
   dtd = buildGrammar {
     language = "dtd";
-    version = "0.0.0+rev=2282ad5";
+    version = "0.0.0+rev=96beba9";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-xml";
-      rev = "2282ad5cb8e815523e70d5c82404620bd9a1494c";
-      hash = "sha256-CZAVJdT01wXyaDnPxXz6ZhiiDxuvwKCWPGjaWe6FpWk=";
+      rev = "96beba9f3e4156aaae64bb86997503b1ceb1283d";
+      hash = "sha256-XmSU9Om1bj/PtBxr22Sf81Mx68QINtK8Gls1fRldt6Q=";
     };
     location = "dtd";
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-xml";
   };
+  earthfile = buildGrammar {
+    language = "earthfile";
+    version = "0.0.0+rev=7d5cc9e";
+    src = fetchFromGitHub {
+      owner = "glehmann";
+      repo = "tree-sitter-earthfile";
+      rev = "7d5cc9e27e3e340c8b521d11c8da84047494fe30";
+      hash = "sha256-0rjD8SJGot/KAsLVW98e7X2tbNPntScRk/oEsS1wmAg=";
+    };
+    meta.homepage = "https://github.com/glehmann/tree-sitter-earthfile";
+  };
   ebnf = buildGrammar {
     language = "ebnf";
     version = "0.0.0+rev=8e635b0";
@@ -526,12 +537,12 @@
   };
   elixir = buildGrammar {
     language = "elixir";
-    version = "0.0.0+rev=868620e";
+    version = "0.0.0+rev=de690fa";
     src = fetchFromGitHub {
       owner = "elixir-lang";
       repo = "tree-sitter-elixir";
-      rev = "868620e19f070a5e6b0b685dc6069a611a86259a";
-      hash = "sha256-r+G0321T1+RwaqcJ+E/gfzm1iSLCIVGPdus7XZFK9So=";
+      rev = "de690fa8a028f122af46d9d2685679fe5f2d7d60";
+      hash = "sha256-bvbOWF+Fy3IhOPhkW6pB/3LcLXnPzqVQb8GOCCQWzw0=";
     };
     meta.homepage = "https://github.com/elixir-lang/tree-sitter-elixir";
   };
@@ -636,12 +647,12 @@
   };
   firrtl = buildGrammar {
     language = "firrtl";
-    version = "0.0.0+rev=2b5adae";
+    version = "0.0.0+rev=8503d3a";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-firrtl";
-      rev = "2b5adae629c8cba528c7b1e4aa67a8ae28934ea5";
-      hash = "sha256-If34GymYMJpSNtzSGpcq4dMxj8djKZ3B5uMHGx9uCnM=";
+      rev = "8503d3a0fe0f9e427863cb0055699ff2d29ae5f5";
+      hash = "sha256-I2EMcm6bTMRODmxOOOiv+U0fhm6yoNhjCyuINfTUtlY=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-firrtl";
   };
@@ -779,12 +790,12 @@
   };
   gitcommit = buildGrammar {
     language = "gitcommit";
-    version = "0.0.0+rev=a427a79";
+    version = "0.0.0+rev=edd817e";
     src = fetchFromGitHub {
       owner = "gbprod";
       repo = "tree-sitter-gitcommit";
-      rev = "a427a79653b6829aa5b663b5b9a6b39e954858b7";
-      hash = "sha256-vnuSzMQeBow5A37VOmpAWUgHehVpetjJwos44mdEmP8=";
+      rev = "edd817e0532f179b7f7f371dc180629070945f0c";
+      hash = "sha256-iipzgO8vJJpxhf/ZJh6tsfRa54C6g9rAN9TVdycKiqc=";
     };
     meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
   };
@@ -823,12 +834,12 @@
   };
   glsl = buildGrammar {
     language = "glsl";
-    version = "0.0.0+rev=f704096";
+    version = "0.0.0+rev=e7817c9";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-glsl";
-      rev = "f7040966a97c6c5a644a230df7fe74623f963d2f";
-      hash = "sha256-HwaN4T3dpcMpR2Nch3gMh9QGhBThd4RxdW7o5KTzRtI=";
+      rev = "e7817c982e0e921c5ee89a1e0283121bb5cc5e01";
+      hash = "sha256-pkbvD+VQUtR6GiY4RP6J6tB2Cl2UyqjB7t/HE0dLr78=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-glsl";
   };
@@ -856,12 +867,12 @@
   };
   go = buildGrammar {
     language = "go";
-    version = "0.0.0+rev=fd577c4";
+    version = "0.0.0+rev=eb68645";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-go";
-      rev = "fd577c4358c28cbcb6748bbf65354cc85f1cf7a4";
-      hash = "sha256-Fz9xSyjJLbNXAXbYMoVDsRqyRrLTWHAxnQBV9EF6n78=";
+      rev = "eb68645662a3f7bf7fdd4bcb9531585f54c8570e";
+      hash = "sha256-RZx8M3QGX/+kfjbEB0+f2jeDZhGF+XGXwtb5oltxHrI=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-go";
   };
@@ -944,23 +955,23 @@
   };
   groovy = buildGrammar {
     language = "groovy";
-    version = "0.0.0+rev=b398a5a";
+    version = "0.0.0+rev=6c5c881";
     src = fetchFromGitHub {
       owner = "murtaza64";
       repo = "tree-sitter-groovy";
-      rev = "b398a5a243c67f0b4d54728c983fa586bd5cd52e";
-      hash = "sha256-5PA3of/pD8YDXyV+taKha/zKphpH4EDHRj40YA7aL9c=";
+      rev = "6c5c8813233fe326e24c5ef032858d13f8006a8d";
+      hash = "sha256-NursRJ7DBmlbA7EOzC+WwoxDkjMUZYANcdX48DyjEIY=";
     };
     meta.homepage = "https://github.com/murtaza64/tree-sitter-groovy";
   };
   gstlaunch = buildGrammar {
     language = "gstlaunch";
-    version = "0.0.0+rev=2c0d9c9";
+    version = "0.0.0+rev=549aef2";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-gstlaunch";
-      rev = "2c0d9c94d35e37aa63fa5002163c8480985b3e5b";
-      hash = "sha256-H5H1v4xJSPHW0oaTY/JczhfVmYExbrdfdugYkMJktPY=";
+      rev = "549aef253fd38a53995cda1bf55c501174372bf7";
+      hash = "sha256-zNUx/9dxEqyqTXCxEiNnYPzplnR7l9b2L4frYpPOA9M=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-gstlaunch";
   };
@@ -977,12 +988,12 @@
   };
   hare = buildGrammar {
     language = "hare";
-    version = "0.0.0+rev=3d4af17";
+    version = "0.0.0+rev=0705249";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-hare";
-      rev = "3d4af179414525a35dd069ba0208c9b71093d8b3";
-      hash = "sha256-RRi2uAE9rf0bjQrk8Asf6z+6ZDZYhEoKaX0m8hZnI9o=";
+      rev = "070524937539eb8bb4f10debd9c83b66c434f3a2";
+      hash = "sha256-NUvbkMYA1nZmS84vLNguto/Fo7wdrDmRCBnveR88ry0=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-hare";
   };
@@ -1055,23 +1066,23 @@
   };
   hlsl = buildGrammar {
     language = "hlsl";
-    version = "0.0.0+rev=ef428a3";
+    version = "0.0.0+rev=d200375";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-hlsl";
-      rev = "ef428a36b2faa20450ee979a618f802228b38318";
-      hash = "sha256-/G5c7Fr7Z23FR7n5oh90QHObicDjx8Ppslp8T6sr1wg=";
+      rev = "d200375a29b24764b78d7051df0024ed7c2f1ab0";
+      hash = "sha256-HCbH8Lyi2ziaUTxhgVPQ4hyOZhRxNFW66gAkoFT/Ubg=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
   };
   hlsplaylist = buildGrammar {
     language = "hlsplaylist";
-    version = "0.0.0+rev=5305c06";
+    version = "0.0.0+rev=3e65f65";
     src = fetchFromGitHub {
       owner = "Freed-Wu";
       repo = "tree-sitter-hlsplaylist";
-      rev = "5305c061efce2841942dbbac6f9a5b21e3e4eb35";
-      hash = "sha256-XNqkyFLqZTo5mPqbtLM8gq178fkB1YhQkjfp6bcKpcM=";
+      rev = "3e65f652b9dea8d38f9a44b5b0898a51c9247eb8";
+      hash = "sha256-IGfKnEG1b9TSPBjxb+NjgweyKp7HUyZCe2gR/xnV5CY=";
     };
     meta.homepage = "https://github.com/Freed-Wu/tree-sitter-hlsplaylist";
   };
@@ -1121,12 +1132,12 @@
   };
   http = buildGrammar {
     language = "http";
-    version = "0.0.0+rev=86ad05a";
+    version = "0.0.0+rev=8d22f33";
     src = fetchFromGitHub {
       owner = "rest-nvim";
       repo = "tree-sitter-http";
-      rev = "86ad05ac2de3c63c69f65e58f0182a76c1658d1e";
-      hash = "sha256-7iUNDri5SB9RygMcAGUo78Cbtm11fM8Wvn+KwjKC0M4=";
+      rev = "8d22f33faa5aa95c6526606fb656ada342e59e40";
+      hash = "sha256-L+9cDLTmisZmdBXocK8u7fkJIlaZId9qeQxVWwFkdJg=";
     };
     meta.homepage = "https://github.com/rest-nvim/tree-sitter-http";
   };
@@ -1187,23 +1198,23 @@
   };
   java = buildGrammar {
     language = "java";
-    version = "0.0.0+rev=2aae502";
+    version = "0.0.0+rev=953abfc";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-java";
-      rev = "2aae502017d3aed587ba85e3c7e0cbc138f3e07a";
-      hash = "sha256-UzMpDQtvbu05iu0kL/qkPaxnAOQKLJlzqWYeUurGSqo=";
+      rev = "953abfc8bb3eb2f578e1f461edba4a9885f974b8";
+      hash = "sha256-COrEPsdTI6MJeb5iIZtyNHHe6nMsD/EnHDRVDTSKFTg=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-java";
   };
   javascript = buildGrammar {
     language = "javascript";
-    version = "0.0.0+rev=de1e682";
+    version = "0.0.0+rev=fff4560";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-javascript";
-      rev = "de1e682289a417354df5b4437a3e4f92e0722a0f";
-      hash = "sha256-HhqYqU1CwPxXMHp21unRekFDzpGVedlgh/4bsplhe9c=";
+      rev = "fff4560044bdc51d9f6995f1edc797b7cd72b9dc";
+      hash = "sha256-erxZ5nYvUwrzdRnkni8WEsxB04ghI7H3DLASfCoHXYs=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-javascript";
   };
@@ -1231,12 +1242,12 @@
   };
   json = buildGrammar {
     language = "json";
-    version = "0.0.0+rev=3b12920";
+    version = "0.0.0+rev=80e623c";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-json";
-      rev = "3b129203f4b72d532f58e72c5310c0a7db3b8e6d";
-      hash = "sha256-dVErHgsUDEN42wc/Gd68vQfVc8+/r/8No9KZk2GFzmY=";
+      rev = "80e623c2165887f9829357acfa9c0a0bab34a3cd";
+      hash = "sha256-waejAbS7MjrE7w03MPqvBRpEpqTcKc6RgKCVSYaDV1Y=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-json";
   };
@@ -1275,12 +1286,12 @@
   };
   julia = buildGrammar {
     language = "julia";
-    version = "0.0.0+rev=e84f10d";
+    version = "0.0.0+rev=acd5ca1";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-julia";
-      rev = "e84f10db8eeb8b9807786bfc658808edaa1b4fa2";
-      hash = "sha256-jrQjVPLb6SfePxEJV1GgFgLslGxgdmdb8bJy6VHOEbs=";
+      rev = "acd5ca12cc278df7960629c2429a096c7ac4bbea";
+      hash = "sha256-1dOUMS4nlPaG5WxpCONXclVgq4F/Ti4JQK81KOnxvIk=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-julia";
   };
@@ -1352,12 +1363,12 @@
   };
   latex = buildGrammar {
     language = "latex";
-    version = "0.0.0+rev=eb552c7";
+    version = "0.0.0+rev=ae2134a";
     src = fetchFromGitHub {
       owner = "latex-lsp";
       repo = "tree-sitter-latex";
-      rev = "eb552c7022cbd1379138bdc1b2fe464a99d25640";
-      hash = "sha256-y+FFT9UmtVDp37hWLwHi+qlCwezHYn0blH1tt/uyKb8=";
+      rev = "ae2134af67f6c5e45587ace9ec748dd6e7b356a2";
+      hash = "sha256-hQaQBQYK0o5qRH5Mjv3pIAUHJe6BWHGzg2I4KCVG2KE=";
     };
     generate = true;
     meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
@@ -1463,12 +1474,12 @@
   };
   luau = buildGrammar {
     language = "luau";
-    version = "0.0.0+rev=e5f7a02";
+    version = "0.0.0+rev=5b088fa";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-luau";
-      rev = "e5f7a020967407f73959592decdb147bb5fc30bb";
-      hash = "sha256-5Tnqt4PA3xX2Gk0CvlzVpWXI3OcqzsIJov4Kn0EWN+w=";
+      rev = "5b088fac748f2666a315cafd1638a214388eb23e";
+      hash = "sha256-m0xHQu9nxjyrCMza9Aw/kRK8Rlhtc2DRbtyyFtMZkJU=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-luau";
   };
@@ -1542,12 +1553,12 @@
   };
   mermaid = buildGrammar {
     language = "mermaid";
-    version = "0.0.0+rev=e8dac87";
+    version = "0.0.0+rev=49442bd";
     src = fetchFromGitHub {
       owner = "monaqa";
       repo = "tree-sitter-mermaid";
-      rev = "e8dac87a9f789b23a2c7ab8e55b485a2f5927b98";
-      hash = "sha256-1FCc8goKhFtgxSPeAzFkQhpbpruhZ+GD8VaLRJpnyS4=";
+      rev = "49442bd087901c60f019b4e34dcb6ecdc8849067";
+      hash = "sha256-KoAoEuADv6Xj/bpZV5XGW7nXugSCfk6St2xzx7x2oPA=";
     };
     meta.homepage = "https://github.com/monaqa/tree-sitter-mermaid";
   };
@@ -1564,24 +1575,24 @@
   };
   mlir = buildGrammar {
     language = "mlir";
-    version = "0.0.0+rev=a89a5f2";
+    version = "0.0.0+rev=c2845c1";
     src = fetchFromGitHub {
       owner = "artagnon";
       repo = "tree-sitter-mlir";
-      rev = "a89a5f2bbcf7e82e46b106138977c99d6a644db2";
-      hash = "sha256-FIwyHvyIJziliEd+7CBMqUjJuT9G60CZGe73Ees0CRU=";
+      rev = "c2845c1c0b23e2faf6febfa72a042e5346374ebf";
+      hash = "sha256-SQR/1lAWdvNDwa40wNI3uGSF9OBgtyjxVM5lsP4CgIU=";
     };
     generate = true;
     meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
   };
   muttrc = buildGrammar {
     language = "muttrc";
-    version = "0.0.0+rev=2f918f9";
+    version = "0.0.0+rev=1a3d3c9";
     src = fetchFromGitHub {
       owner = "neomutt";
       repo = "tree-sitter-muttrc";
-      rev = "2f918f9c887109fdf1419f98158a0cfff644af75";
-      hash = "sha256-tB0qY7p099aNulvuZVah4yuyFdp/Dh6Knw4Qi+/QC6w=";
+      rev = "1a3d3c98de86689f2bb1e59c8db8067c6784aaed";
+      hash = "sha256-9RFz8qaAapJSNxy8YH/6FZG2j1tcrhNWRhxx+fNo7z8=";
     };
     meta.homepage = "https://github.com/neomutt/tree-sitter-muttrc";
   };
@@ -1609,12 +1620,12 @@
   };
   nim = buildGrammar {
     language = "nim";
-    version = "0.0.0+rev=f5cec6a";
+    version = "0.0.0+rev=961c279";
     src = fetchFromGitHub {
       owner = "alaviss";
       repo = "tree-sitter-nim";
-      rev = "f5cec6a841b585e4e7388a120ded07e60ae19c43";
-      hash = "sha256-CL041Tjw7CH9EnpjAVl4f66zyOADfG9qwkFxeUjXH0w=";
+      rev = "961c2798cec9250c44f7d7225ddb33d47d25856a";
+      hash = "sha256-zFT316pJwJvPRLJcBk4kvPmwNgdkYG5/10VktNBQwL8=";
     };
     meta.homepage = "https://github.com/alaviss/tree-sitter-nim";
   };
@@ -1642,23 +1653,23 @@
   };
   nix = buildGrammar {
     language = "nix";
-    version = "0.0.0+rev=763168f";
+    version = "0.0.0+rev=b3cda61";
     src = fetchFromGitHub {
       owner = "cstrahan";
       repo = "tree-sitter-nix";
-      rev = "763168fa916a333a459434f1424b5d30645f015d";
-      hash = "sha256-MarXhVPVmL505c57HkbUk0kHN7jez83mcGtyM5GMw1o=";
+      rev = "b3cda619248e7dd0f216088bd152f59ce0bbe488";
+      hash = "sha256-Ib83CECi3hvm2GfeAJXIkapeN8rrpFQxCWWFFsIvB/Y=";
     };
     meta.homepage = "https://github.com/cstrahan/tree-sitter-nix";
   };
   norg = buildGrammar {
     language = "norg";
-    version = "0.0.0+rev=9766442";
+    version = "0.0.0+rev=aa1a1a7";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "tree-sitter-norg";
-      rev = "9766442985fd546e2d33f8d1c7e7619ed07860cf";
-      hash = "sha256-YMS4UDVulE9PjOTchCSkeRRVbBbDFYgY/dCla32CkwQ=";
+      rev = "aa1a1a7ded81a094cc3d5cb14bea6f34b86d8688";
+      hash = "sha256-baJdvWfwUx1U2RX0G6ECaGPGZBFbWsVUhh3kYPaYeiE=";
     };
     meta.homepage = "https://github.com/nvim-neorg/tree-sitter-norg";
   };
@@ -1733,12 +1744,12 @@
   };
   odin = buildGrammar {
     language = "odin";
-    version = "0.0.0+rev=f94c590";
+    version = "0.0.0+rev=b5f668e";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-odin";
-      rev = "f94c590ed5263e11f1e492d1b53356f8c8459b66";
-      hash = "sha256-MLSy1OU8PE2wTfV8JoJdtjoc12MD993TViaZjp3Ujgc=";
+      rev = "b5f668ef8918aab13812ce73acd89fe191fb8c5e";
+      hash = "sha256-D/+ls8a5efAy3sBaH1eGEifEwBRmz+6bYIMGNji949Q=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-odin";
   };
@@ -1755,12 +1766,12 @@
   };
   pascal = buildGrammar {
     language = "pascal";
-    version = "0.0.0+rev=9e99540";
+    version = "0.0.0+rev=a9ee969";
     src = fetchFromGitHub {
       owner = "Isopod";
       repo = "tree-sitter-pascal";
-      rev = "9e995404ddff8319631d72d4b46552e737206912";
-      hash = "sha256-y8xPnVZ15+eAnjrLSGjS5wIbLgSKbz9bipgL0o8acmA=";
+      rev = "a9ee969dec5b2e3b2ccccc5954fec04100c7619e";
+      hash = "sha256-U45RkRpE1EdX2ijGyjTKVNRcSu6E6Dh9Z7G9bp24T80=";
     };
     meta.homepage = "https://github.com/Isopod/tree-sitter-pascal.git";
   };
@@ -1845,12 +1856,12 @@
   };
   po = buildGrammar {
     language = "po";
-    version = "0.0.0+rev=d6aed22";
+    version = "0.0.0+rev=bd860a0";
     src = fetchFromGitHub {
       owner = "erasin";
       repo = "tree-sitter-po";
-      rev = "d6aed225290bc71a15ab6f06305cb11419360c56";
-      hash = "sha256-fz4DGPA+KtOvLBmVMXqwnEMeXhupFecQC1xfhMbWCJg=";
+      rev = "bd860a0f57f697162bf28e576674be9c1500db5e";
+      hash = "sha256-/St0VxDTAF872ZlBph1TukRoO0PBIOMT0D11DZ6nSLQ=";
     };
     meta.homepage = "https://github.com/erasin/tree-sitter-po";
   };
@@ -1878,12 +1889,12 @@
   };
   pony = buildGrammar {
     language = "pony";
-    version = "0.0.0+rev=16f930b";
+    version = "0.0.0+rev=73ff874";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-pony";
-      rev = "16f930b250433cfcd4fb4144df92bb98ad344c20";
-      hash = "sha256-UamgLmI1aI5e/JlGVZzFCPgDol8MnFomncrFKhQYLsk=";
+      rev = "73ff874ae4c9e9b45462673cbc0a1e350e2522a7";
+      hash = "sha256-/9bTbep2AXLoiijeft9amMeFQ6fHXzItjH+bD/w6pDo=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-pony";
   };
@@ -1978,12 +1989,12 @@
   };
   puppet = buildGrammar {
     language = "puppet";
-    version = "0.0.0+rev=5849f96";
+    version = "0.0.0+rev=584522f";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-puppet";
-      rev = "5849f9694197a6e822872945b415429c285fdd54";
-      hash = "sha256-Lwfiby7amjTIOz8QRoC4RdZyFPfFikmQ2sqta4akyH8=";
+      rev = "584522f32495d648b18a53ccb52d988e60de127d";
+      hash = "sha256-+zMgzyuGerJ8l+i5ZtWnmGr3i4fFiSLD5FssyKESsmI=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-puppet";
   };
@@ -2011,12 +2022,12 @@
   };
   python = buildGrammar {
     language = "python";
-    version = "0.0.0+rev=b8a4c64";
+    version = "0.0.0+rev=a227610";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-python";
-      rev = "b8a4c64121ba66b460cb878e934e3157ecbfb124";
-      hash = "sha256-ZTqWyr4+pOyXY4X/WnYdn9Sgp7T8FEEUy/TQPuFqb4k=";
+      rev = "a22761025cdac6c314b7e3aa48fb44fa9e594d6a";
+      hash = "sha256-L6iEej6bPqfaZdH5GNoJyNxZWdnIyn7+Cut+zYnMI88=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
   };
@@ -2077,12 +2088,12 @@
   };
   racket = buildGrammar {
     language = "racket";
-    version = "0.0.0+rev=d9858a0";
+    version = "0.0.0+rev=171f52a";
     src = fetchFromGitHub {
       owner = "6cdh";
       repo = "tree-sitter-racket";
-      rev = "d9858a0f607578814f2d34662ad4bc21aa37a455";
-      hash = "sha256-UaF9/leXBlyF+3j8lTyi9tn2pVwVHlYM7zLdTpVCmgI=";
+      rev = "171f52a8c0ed635b85cd42d1e36d82f1066a03b4";
+      hash = "sha256-iuigtcakpqm5vPuxsSV5PR32pwzyPMmldYXaJmzO3d0=";
     };
     meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
   };
@@ -2187,34 +2198,34 @@
   };
   roc = buildGrammar {
     language = "roc";
-    version = "0.0.0+rev=649c3b6";
+    version = "0.0.0+rev=7df2c08";
     src = fetchFromGitHub {
       owner = "nat-418";
       repo = "tree-sitter-roc";
-      rev = "649c3b68eb863f350f0aafeb68f4a8ca4f13081a";
-      hash = "sha256-oY6mQV4bJ0XCGcx/8AnlYMAIKAs54wbgZ4iNzD4rkVE=";
+      rev = "7df2c0892e62efb81a7504d9799d4e0d0443d241";
+      hash = "sha256-8HJH63NcSuqmPviVWO+UE27ydoU7vRXEIXSTjKLSYvk=";
     };
     meta.homepage = "https://github.com/nat-418/tree-sitter-roc";
   };
   ron = buildGrammar {
     language = "ron";
-    version = "0.0.0+rev=ce6086b";
+    version = "0.0.0+rev=f0ddc95";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-ron";
-      rev = "ce6086b2c9e8e71065b8129d6c2289c5f66d1879";
-      hash = "sha256-4ZKhJ3qvKWwINQIWJLqgPwfnDvQBWzeZb2dZY7imYfc=";
+      rev = "f0ddc95a4b7bb21a7308642255a80f5496e69c5b";
+      hash = "sha256-Wi81LYFfQXjZzj2OuxB64sNDEim/eZKViMeQ0h/w88k=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-ron";
   };
   rst = buildGrammar {
     language = "rst";
-    version = "0.0.0+rev=c6f7444";
+    version = "0.0.0+rev=5120f6e";
     src = fetchFromGitHub {
       owner = "stsewd";
       repo = "tree-sitter-rst";
-      rev = "c6f7444fd77271862730af49e757c60405fba991";
-      hash = "sha256-Z6kW2InTqQ+5p0WDcRjXN1dvKLoruIKdTe04SrspVzg=";
+      rev = "5120f6e59284cb8b85b450bd2db0bd352635ba9f";
+      hash = "sha256-PI1C0W8fiuIQ2fgHXDelkCa0ng1a32x/9hrA33KoefM=";
     };
     meta.homepage = "https://github.com/stsewd/tree-sitter-rst";
   };
@@ -2231,23 +2242,23 @@
   };
   rust = buildGrammar {
     language = "rust";
-    version = "0.0.0+rev=3a56481";
+    version = "0.0.0+rev=b77c0d8";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-rust";
-      rev = "3a56481f8d13b6874a28752502a58520b9139dc7";
-      hash = "sha256-6ROXeKuPehtIOtaI1OJuTtyPfQmZyLzCxv3ZS04yAIk=";
+      rev = "b77c0d8ac28a7c143224e6ed9b4f9e4bd044ff5b";
+      hash = "sha256-7SQ/gOKVIE5bmj3vscY363LTwkYX+VHn7JflSU+zKsQ=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-rust";
   };
   scala = buildGrammar {
     language = "scala";
-    version = "0.0.0+rev=70b4fe6";
+    version = "0.0.0+rev=b76db43";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-scala";
-      rev = "70b4fe63c4973b04cc7bd40c6b7646d9c2430db8";
-      hash = "sha256-ZwrsEhlZGVJMP+GRIlaxGqS1b7HtiQelg3QBwJT9Igk=";
+      rev = "b76db435a7f876cf1ede837d66054c534783c72f";
+      hash = "sha256-AZ1YIsnw3x84T2ubwWoekfy98L2GdgQP0R3tM8DEXLM=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
   };
@@ -2265,12 +2276,12 @@
   };
   scheme = buildGrammar {
     language = "scheme";
-    version = "0.0.0+rev=184e759";
+    version = "0.0.0+rev=8f9dff3";
     src = fetchFromGitHub {
       owner = "6cdh";
       repo = "tree-sitter-scheme";
-      rev = "184e7596ee0cbaef79230cae1b4ee5bb4fbad314";
-      hash = "sha256-wx/uov0kWoxwTyo9MwJR50efnRoboQUlii2MrwpnDGs=";
+      rev = "8f9dff3d038f09934db5ea113cebc59c74447743";
+      hash = "sha256-QECZQVhWntN+3wnIA+U3JesuoLZiSU7pOrsKRdVPLtk=";
     };
     meta.homepage = "https://github.com/6cdh/tree-sitter-scheme";
   };
@@ -2287,34 +2298,34 @@
   };
   slang = buildGrammar {
     language = "slang";
-    version = "0.0.0+rev=13fdd89";
+    version = "0.0.0+rev=b950ddf";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-slang";
-      rev = "13fdd899bfa62527cc39887abd74ec24cd626dec";
-      hash = "sha256-YImk9t0zrOSBornem2rTzqhl/FUWqh955bjjOWkcfHY=";
+      rev = "b950ddf54c564fec0efead602268b6e0d3e5f26e";
+      hash = "sha256-AYZ7MlAh9AEvyHsGw6stiJFSEb4/FDLfuqFPhpAorAA=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-slang";
   };
   slint = buildGrammar {
     language = "slint";
-    version = "0.0.0+rev=acc77c9";
+    version = "0.0.0+rev=d5fbeaf";
     src = fetchFromGitHub {
       owner = "slint-ui";
       repo = "tree-sitter-slint";
-      rev = "acc77c93ef4b73ba8c3a581b8c99d95b55f7178b";
-      hash = "sha256-/fvCR8h3C7aL2We8Ijzx4nQ9AN05PFKObPMCwu7Ps6o=";
+      rev = "d5fbeaf0c26683f1417d00b6a5ab1cca445031f2";
+      hash = "sha256-ECzYJue7tKx9Eg043fl5x18ySvPlkWPU21Ga2Zqunv0=";
     };
     meta.homepage = "https://github.com/slint-ui/tree-sitter-slint";
   };
   smali = buildGrammar {
     language = "smali";
-    version = "0.0.0+rev=5ae51e1";
+    version = "0.0.0+rev=3f65178";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-smali";
-      rev = "5ae51e15c4d1ac93cba6127caf3d1f0a072c140c";
-      hash = "sha256-hcqai2QKx6ZG+Sl1HOPu3wlyjKt3MJ60jNfjfcjKKiM=";
+      rev = "3f6517855898ef23023e5d64a8b175d4ee8d646e";
+      hash = "sha256-K1cRK4D0BE9FNq1tpa0L3Crc+8woXIwhRPg86+73snk=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-smali";
   };
@@ -2342,12 +2353,12 @@
   };
   solidity = buildGrammar {
     language = "solidity";
-    version = "0.0.0+rev=a8ed2f5";
+    version = "0.0.0+rev=1653da0";
     src = fetchFromGitHub {
       owner = "JoranHonig";
       repo = "tree-sitter-solidity";
-      rev = "a8ed2f5d600fed77f8ed3084d1479998c649bca1";
-      hash = "sha256-aSQnJR/r4H086Um4TV4mjnCSg+2Y7KFn2Rwo/lP2nfg=";
+      rev = "1653da09ccd183f4312fba819056a13af22a65f6";
+      hash = "sha256-1IW04F6CxTIdGHxRocM1QmfgXHHf5Jn/eaZ6M8o2EU8=";
     };
     meta.homepage = "https://github.com/JoranHonig/tree-sitter-solidity";
   };
@@ -2399,34 +2410,34 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "0.0.0+rev=cdb7cde";
+    version = "0.0.0+rev=25f94f9";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "cdb7cde9bf70b194ab8beb5069fbbc3c9640284e";
-      hash = "sha256-yxr+AbKp4pkVpjMQXL3P5VEzSo2Ii6yE7ceEBYiDHJA=";
+      rev = "25f94f998de79bae9df28add9782f9ea6ea0e2b8";
+      hash = "sha256-UmGvjtN0Pi7uH8+Sb6JbvdV60gow7KQCbDRcKo3nMYw=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
   squirrel = buildGrammar {
     language = "squirrel";
-    version = "0.0.0+rev=e8b5835";
+    version = "0.0.0+rev=f93fd28";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-squirrel";
-      rev = "e8b5835296f931bcaa1477d3c5a68a0c5c2ba034";
-      hash = "sha256-wKefWCqcQcg7zLT6abaDC9lWoJiJp7EbbsBOWRRsWFQ=";
+      rev = "f93fd2864dd05cc39b0490145fd86a1a93bfa3a3";
+      hash = "sha256-06cmaCyBkdwSmIHSEE0xr9V4M6pp+ApIZNopbnW3pok=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-squirrel";
   };
   ssh_config = buildGrammar {
     language = "ssh_config";
-    version = "0.0.0+rev=514695d";
+    version = "0.0.0+rev=77450e8";
     src = fetchFromGitHub {
       owner = "ObserverOfTime";
       repo = "tree-sitter-ssh-config";
-      rev = "514695df4985f56455b8f139a319453a2325cdcf";
-      hash = "sha256-LDqRP8FA5m1tnbGNTxItQlp6B6U+M6gOBlbi4zX0FHI=";
+      rev = "77450e8bce8853921512348f83c73c168c71fdfb";
+      hash = "sha256-V7JI1o30+mzGA4X1oh+pyu3rSWOfHFKfCUbYaFPLOmM=";
     };
     meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-ssh-config";
   };
@@ -2454,12 +2465,12 @@
   };
   styled = buildGrammar {
     language = "styled";
-    version = "0.0.0+rev=5e52758";
+    version = "0.0.0+rev=c68a457";
     src = fetchFromGitHub {
       owner = "mskelton";
       repo = "tree-sitter-styled";
-      rev = "5e52758b32e02adca16bb93f95b3f9c050c72b56";
-      hash = "sha256-3x/ZKVYyWuLGkgdm9HutI16m8xpJKSMOZHY48WqH9b0=";
+      rev = "c68a4572e2d6403b6e99066c9a113b43f4a07a27";
+      hash = "sha256-ZOMHyhtlKVOty+0lyUX7aJiwyP9yNN+r0eXVhpu22WQ=";
     };
     meta.homepage = "https://github.com/mskelton/tree-sitter-styled";
   };
@@ -2487,23 +2498,23 @@
   };
   svelte = buildGrammar {
     language = "svelte";
-    version = "0.0.0+rev=6909efa";
+    version = "0.0.0+rev=2c97326";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-svelte";
-      rev = "6909efa7179cd655f9b48123357d65ce8fc661fd";
-      hash = "sha256-s/aO6f91vW+XITaDkB3kyNSReLU1V125wgPcTATvgcY=";
+      rev = "2c97326cd96b7c3016c3d249e8dc244c89b4abeb";
+      hash = "sha256-rlfLelXjNLtQ2/UACwxB3QO5l+QYFLsfGnBaxTAtgTE=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-svelte";
   };
   swift = buildGrammar {
     language = "swift";
-    version = "0.0.0+rev=67ea4e9";
+    version = "0.0.0+rev=e2f0b7c";
     src = fetchFromGitHub {
       owner = "alex-pinkus";
       repo = "tree-sitter-swift";
-      rev = "67ea4e9ea7302b731d392cd8b1aad7b8e79a5547";
-      hash = "sha256-+ms6YcgcwpEuF+KWoC75KA/cQuOeqqDlfOJkWPApor4=";
+      rev = "e2f0b7cf8136b801e4743790b7a956ab29a4d6b0";
+      hash = "sha256-DFoNyZmpzSDI37Gto2DxeoRZuDgLtx9NJxyYGIG6lrY=";
     };
     generate = true;
     meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -2532,34 +2543,34 @@
   };
   t32 = buildGrammar {
     language = "t32";
-    version = "0.0.0+rev=95caba8";
+    version = "0.0.0+rev=6182836";
     src = fetchFromGitLab {
       owner = "xasc";
       repo = "tree-sitter-t32";
-      rev = "95caba87f00c51177b254e95be55b2dc46d2ac78";
-      hash = "sha256-Z02LcEzzAHVKw0lyeuo4bdeFclLUtyXU8XGevBbJJPc=";
+      rev = "6182836f4128725f1e74ce986840d7317021a015";
+      hash = "sha256-w9X/CL5X6Lwr4/GGVQcMZ1O2HfJmdNiVjRQKGZHrRqg=";
     };
     meta.homepage = "https://gitlab.com/xasc/tree-sitter-t32.git";
   };
   tablegen = buildGrammar {
     language = "tablegen";
-    version = "0.0.0+rev=300f6a4";
+    version = "0.0.0+rev=6b7eb09";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-tablegen";
-      rev = "300f6a490e71f895e644ed2deec6920860a2e107";
-      hash = "sha256-V4fEmiGPBAnZO+NAyA7FdlyjLSA0ByUfrCTbsdDOxc8=";
+      rev = "6b7eb096621443627cc5e29c8c34ff1fde482cf3";
+      hash = "sha256-kdOqHAyKAI4IgI2/GbEx13DWLB8JklURd3ndaicxUno=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-tablegen";
   };
   tcl = buildGrammar {
     language = "tcl";
-    version = "0.0.0+rev=56ad1fa";
+    version = "0.0.0+rev=8784024";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-tcl";
-      rev = "56ad1fa6a34ba800e5495d1025a9b0fda338d5b8";
-      hash = "sha256-GhK92+nbJ+M5/1ZnPbIJ3EuNub332YK+hyWiwyBqUmk=";
+      rev = "8784024358c233efd0f3a6fd9e7a3c5852e628bc";
+      hash = "sha256-/uw+Nb5A+DklN+BxMpufSCMb/VOE/zqJNnLZVFwjWtc=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-tcl";
   };
@@ -2577,12 +2588,12 @@
   };
   templ = buildGrammar {
     language = "templ";
-    version = "0.0.0+rev=db66241";
+    version = "0.0.0+rev=e2218a2";
     src = fetchFromGitHub {
       owner = "vrischmann";
       repo = "tree-sitter-templ";
-      rev = "db662414ccd6f7c78b1e834e7abe11c224b04759";
-      hash = "sha256-DPVVdzAU3xGa1TpndlwPZr11zi1ToYkvqWDJeddfDYs=";
+      rev = "e2218a2376e3ff18c9963b21aa567770baab0462";
+      hash = "sha256-lyxXb71FVfpWw4IbU5P6uDVETNSDO+r7+YgZDvaIEbc=";
     };
     meta.homepage = "https://github.com/vrischmann/tree-sitter-templ";
   };
@@ -2611,12 +2622,12 @@
   };
   thrift = buildGrammar {
     language = "thrift";
-    version = "0.0.0+rev=d4deb1b";
+    version = "0.0.0+rev=68fd0d8";
     src = fetchFromGitHub {
       owner = "duskmoon314";
       repo = "tree-sitter-thrift";
-      rev = "d4deb1bd9e848f2dbe81103a151d99e8546de480";
-      hash = "sha256-MCa7319E8bo3r2kDClBmjOvvs+yZDlE1E+52WqJqvMI=";
+      rev = "68fd0d80943a828d9e6f49c58a74be1e9ca142cf";
+      hash = "sha256-owZbs8ttjKrqTA8fQ/NmBGyIUUItSUvvW4hRv0NPV8Y=";
     };
     meta.homepage = "https://github.com/duskmoon314/tree-sitter-thrift";
   };
@@ -2633,23 +2644,23 @@
   };
   tlaplus = buildGrammar {
     language = "tlaplus";
-    version = "0.0.0+rev=439dad0";
+    version = "0.0.0+rev=410122a";
     src = fetchFromGitHub {
       owner = "tlaplus-community";
       repo = "tree-sitter-tlaplus";
-      rev = "439dad01355e4db335fe9cd12eb177b4f2563dd6";
-      hash = "sha256-d2CPUjqMOu9xc+wjw2uGk2UmkR9OzoYFchbK+IMH7YA=";
+      rev = "410122a012abb06fbacc8c0b8f288b684f8113e1";
+      hash = "sha256-vWxMaka5h8L+tJctiflEWT1/nofPYHIgpf1/3jfsgVU=";
     };
     meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
   };
   tmux = buildGrammar {
     language = "tmux";
-    version = "0.0.0+rev=7499587";
+    version = "0.0.0+rev=1415bd8";
     src = fetchFromGitHub {
       owner = "Freed-Wu";
       repo = "tree-sitter-tmux";
-      rev = "7499587642a46ee156e1bb58851904ac750dcc7c";
-      hash = "sha256-0zeAaQtHZrOwfoSyzj37GZH4tpm+BSuJvLyilVHUW4E=";
+      rev = "1415bd8b5bb69c230947663deceb62c2a0ae4155";
+      hash = "sha256-3kF6H3tP20FUfNoIRxQCnVzvyd4MFLd9oN6rhB/ePvo=";
     };
     meta.homepage = "https://github.com/Freed-Wu/tree-sitter-tmux";
   };
@@ -2746,12 +2757,12 @@
   };
   typst = buildGrammar {
     language = "typst";
-    version = "0.0.0+rev=f457c77";
+    version = "0.0.0+rev=13863dd";
     src = fetchFromGitHub {
       owner = "uben0";
       repo = "tree-sitter-typst";
-      rev = "f457c77edffd4b93190794355ff5acf7acfb99c6";
-      hash = "sha256-f/vIpDZkQOK0GWlwvGEGucYkv4FHGpmhQDchnE6ddz8=";
+      rev = "13863ddcbaa7b68ee6221cea2e3143415e64aea4";
+      hash = "sha256-n6RTRMJS3h+g+Wawjb7I9NJbz+w/SGi+DQVj1jiyGaU=";
     };
     meta.homepage = "https://github.com/uben0/tree-sitter-typst";
   };
@@ -2779,12 +2790,12 @@
   };
   unison = buildGrammar {
     language = "unison";
-    version = "0.0.0+rev=fb49b81";
+    version = "0.0.0+rev=a1eba0f";
     src = fetchFromGitHub {
       owner = "kylegoetz";
       repo = "tree-sitter-unison";
-      rev = "fb49b8125509c079e08f345758c03a427129010e";
-      hash = "sha256-Y4Pnte9ZxXq7tzjc+cliXO8U57cnHlQxOMuX8u39ptE=";
+      rev = "a1eba0fef887800de97126e2c9ae4109c1c6a2ea";
+      hash = "sha256-p0LArEOspQvpgNponLpMakEHrwHM+UzA9SU5PdwQCTU=";
     };
     generate = true;
     meta.homepage = "https://github.com/kylegoetz/tree-sitter-unison";
@@ -2813,12 +2824,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=95869fa";
+    version = "0.0.0+rev=7e11a6f";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "v-analyzer";
-      rev = "95869fa2058fbc9098f640b87399971c6d7552c0";
-      hash = "sha256-Y3htLfDQ6gjYReQ1z5vlCA+A5n0qFSlu7GHog/b+7/E=";
+      rev = "7e11a6f8f369df935664fadd2f0c99d90fe3226f";
+      hash = "sha256-zCXfYW8NCsdqKKEMkZUudpCEQM4bLePyCGFS0w86DY0=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/vlang/v-analyzer";
@@ -2880,12 +2891,12 @@
   };
   vimdoc = buildGrammar {
     language = "vimdoc";
-    version = "0.0.0+rev=a75a932";
+    version = "0.0.0+rev=0b36856";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "tree-sitter-vimdoc";
-      rev = "a75a932449675bbd260213a95f4cd8b3193286f0";
-      hash = "sha256-spj8h1ZDY+6sWi+FCALapBsG+ig9H1u3bjkI2+UP0ds=";
+      rev = "0b36856db88680f662cc67545c82af4ce83bf158";
+      hash = "sha256-8kq1Y+WXL6qu8CyS5zmE7pe/a0K5rmiGgZMxj5O/VHY=";
     };
     meta.homepage = "https://github.com/neovim/tree-sitter-vimdoc";
   };
@@ -2913,27 +2924,36 @@
   };
   wgsl_bevy = buildGrammar {
     language = "wgsl_bevy";
-    version = "0.0.0+rev=4d7b469";
+    version = "0.0.0+rev=f5980f5";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-wgsl-bevy";
-      rev = "4d7b4697dd2598c60a6ccbc51db8b768cd8700b8";
-      hash = "sha256-n4RkD6Q0QPYY34MlJSlzlzsUix5xnZnMEU/UCdbxGYI=";
+      rev = "f5980f534ee64256b1e64b0a42e2864d91154a5d";
+      hash = "sha256-LbysBXujWWDVtgyHte9RLOPu/LMk1TN/9DC0t0WWdcQ=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-wgsl-bevy";
   };
   wing = buildGrammar {
     language = "wing";
-    version = "0.0.0+rev=0cdff2b";
+    version = "0.0.0+rev=bd1d35c";
     src = fetchFromGitHub {
       owner = "winglang";
-      repo = "wing";
-      rev = "0cdff2bc50e3664049905e952746cadf4ac62f15";
-      hash = "sha256-ocHNpn7EKDdoBsanBf8XPhqZYM0wna9a+tDxy4gIO3o=";
+      repo = "tree-sitter-wing";
+      rev = "bd1d35cf3e013dc7e189b46a593bdc2b281b0dd7";
+      hash = "sha256-jygMTswZ8r4tUJQ0lUH8GHz56dyGd6rV1wL5i75Ni88=";
     };
-    location = "libs/tree-sitter-wing";
-    generate = true;
-    meta.homepage = "https://github.com/winglang/wing";
+    meta.homepage = "https://github.com/winglang/tree-sitter-wing";
+  };
+  wit = buildGrammar {
+    language = "wit";
+    version = "0.0.0+rev=6f511f9";
+    src = fetchFromGitHub {
+      owner = "liamwh";
+      repo = "tree-sitter-wit";
+      rev = "6f511f9c6676e597c2f0930e4d2629595319882d";
+      hash = "sha256-xvMIcbeYdr/KIz0fqnARAwEKWmm4dlWhFAS/NZFU16s=";
+    };
+    meta.homepage = "https://github.com/liamwh/tree-sitter-wit";
   };
   xcompose = buildGrammar {
     language = "xcompose";
@@ -2948,24 +2968,24 @@
   };
   xml = buildGrammar {
     language = "xml";
-    version = "0.0.0+rev=2282ad5";
+    version = "0.0.0+rev=96beba9";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-xml";
-      rev = "2282ad5cb8e815523e70d5c82404620bd9a1494c";
-      hash = "sha256-CZAVJdT01wXyaDnPxXz6ZhiiDxuvwKCWPGjaWe6FpWk=";
+      rev = "96beba9f3e4156aaae64bb86997503b1ceb1283d";
+      hash = "sha256-XmSU9Om1bj/PtBxr22Sf81Mx68QINtK8Gls1fRldt6Q=";
     };
     location = "xml";
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-xml";
   };
   yaml = buildGrammar {
     language = "yaml";
-    version = "0.0.0+rev=c9ee63b";
+    version = "0.0.0+rev=ee09311";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-yaml";
-      rev = "c9ee63b15c92656a89f7007f38a98f21c3eca81d";
-      hash = "sha256-2MWTBUoaf+F/TJU+CWJ22JAoyq63XKxy1wJPxcZFePc=";
+      rev = "ee093118211be521742b9866a8ed8ce6d87c7a94";
+      hash = "sha256-tE39KP86JYYmj8WW1l3HAIiBZr/E4IyOgdsUm6d6pQ8=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-yaml";
   };
@@ -2982,23 +3002,23 @@
   };
   yuck = buildGrammar {
     language = "yuck";
-    version = "0.0.0+rev=c348825";
+    version = "0.0.0+rev=a513732";
     src = fetchFromGitHub {
       owner = "Philipp-M";
       repo = "tree-sitter-yuck";
-      rev = "c348825d3f86dec71dee0e1223c6bd73114e3579";
-      hash = "sha256-H4tsLDo9Egp1mpZGcA5Z9C9wPFNxPEBDTugUYKeYW9I=";
+      rev = "a513732feb813426b51d1ead8397a9c285c411be";
+      hash = "sha256-XfenP9bXkskCfiq2sE8qLog0NmSecP50Ur+8HDtU4pQ=";
     };
     meta.homepage = "https://github.com/Philipp-M/tree-sitter-yuck";
   };
   zathurarc = buildGrammar {
     language = "zathurarc";
-    version = "0.0.0+rev=aad4302";
+    version = "0.0.0+rev=09b837d";
     src = fetchFromGitHub {
       owner = "Freed-Wu";
       repo = "tree-sitter-zathurarc";
-      rev = "aad4302fb5a5176004b688fcab4ae7dcf36bf49a";
-      hash = "sha256-mo/gYg6cDp38hx3HTqI4CqPHTGLQ/Je9fs1rYn10Aws=";
+      rev = "09b837dc8f7445fd86e1245c23b1a7804229edd4";
+      hash = "sha256-t7eBWDfn0nq1nGqSyCZmoSGVGgeTcGFfPrZl62OkD1I=";
     };
     meta.homepage = "https://github.com/Freed-Wu/tree-sitter-zathurarc";
   };
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 381c9e4a80d82..58524a92d1a7a 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -321,12 +321,12 @@
 
   codeium-nvim = let
     # Update according to https://github.com/Exafunction/codeium.nvim/blob/main/lua/codeium/versions.json
-    codeiumVersion = "1.6.7";
+    codeiumVersion = "1.8.25";
     codeiumHashes = {
-      x86_64-linux = "sha256-z1cZ6xmP25iPezeLpz4xRh7czgx1JLwsYwGAEUA6//I=";
-      aarch64-linux = "sha256-8cSdCiIVbqv91lUMOLV1Xld8KuIzJA5HCIDbhyyc404=";
-      x86_64-darwin = "sha256-pjW7tNyO0cIFdIm69H6I3HDBpFwnJIRmIN7WRi1OfLw=";
-      aarch64-darwin = "sha256-DgE4EVNCM9+YdTVJeVYnrDGAXOJV1VrepiVeX3ziwfg=";
+      x86_64-linux = "sha256-6sIYDI6+1/p54Af+E/GmRAFlfDYJVwxhn0qF47ZH+Zg=";
+      aarch64-linux = "sha256-1ImcjAqCZm5KZZYHWhG1eO7ipAdrP4Qjj2eBxTst++s=";
+      x86_64-darwin = "sha256-yHthItxZYFejJlwJJ7BrM2csnLsZXjy/IbzF1iaCCyI=";
+      aarch64-darwin = "sha256-GIx0yABISj/rH/yVkkx6NBs5qF0P8nhpMyvnzXJ92mA=";
     };
 
     codeium' = codeium.overrideAttrs rec {
@@ -1038,7 +1038,7 @@
         inherit (old) version src;
         sourceRoot = "${old.src.name}/spectre_oxi";
 
-        cargoHash = "sha256-tWJyVBYYQWr3ofYnbvfQZdzPQ9o//7XEbdjN5b2frPo=";
+        cargoHash = "sha256-UxOAIyVlJWlp5RUFVU3Ib539D5pm6Z+3edjHLerkIRU=";
 
 
         preCheck = ''
diff --git a/pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch b/pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch
index 82d73809ff793..c3b1368577f3f 100644
--- a/pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch
+++ b/pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch
@@ -21,7 +21,7 @@ index d6d4b4c..9853877 100644
  	else
  		call v:lua.vim.health.ok("htop is installed")
 diff --git a/lua/openscad.lua b/lua/openscad.lua
-index 7475f29..832c895 100644
+index 0a26d08..1264989 100644
 --- a/lua/openscad.lua
 +++ b/lua/openscad.lua
 @@ -101,7 +101,7 @@ end
@@ -33,12 +33,12 @@ index 7475f29..832c895 100644
  end
  
  function M.help()
-@@ -125,7 +125,7 @@ function M.exec_openscad()
- 		jobCommand = '/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD ' .. vim.fn.expand('%:p')
+@@ -126,7 +126,7 @@ function M.exec_openscad()
+ 		jobCommand = '/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD ' .. filename
  	else
  		-- TODO: What about Windows?
--		jobCommand = 'openscad ' .. vim.fn.expand('%:p')
-+		jobCommand = '@openscad@ ' .. vim.fn.expand('%:p')
+-		jobCommand = 'openscad ' .. filename
++		jobCommand = '@openscad@ ' .. filename
  	end
  
  	vim.fn.jobstart(jobCommand)
diff --git a/pkgs/applications/editors/vim/plugins/vim-gen-doc-hook.sh b/pkgs/applications/editors/vim/plugins/vim-gen-doc-hook.sh
index d5f0a00ebcc28..a14d3f0dd08b3 100644
--- a/pkgs/applications/editors/vim/plugins/vim-gen-doc-hook.sh
+++ b/pkgs/applications/editors/vim/plugins/vim-gen-doc-hook.sh
@@ -23,7 +23,7 @@ vimPluginGenTags() {
         echo "$addonInfo" > $target/addon-info.json
     fi
 
-    echo "Finished executing vimPluginInstallPhase"
+    echo "Finished executing vimPluginGenTags"
 }
 
 preFixupHooks+=(vimPluginGenTags)
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 66e0351298cd7..07fff8a3a62b5 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -338,6 +338,7 @@ https://github.com/f-person/git-blame.nvim/,,
 https://github.com/akinsho/git-conflict.nvim/,HEAD,
 https://github.com/rhysd/git-messenger.vim/,,
 https://github.com/ThePrimeagen/git-worktree.nvim/,,
+https://github.com/wintermute-cell/gitignore.nvim/,HEAD,
 https://github.com/vim-scripts/gitignore.vim/,,
 https://github.com/ruifm/gitlinker.nvim/,,
 https://github.com/lewis6991/gitsigns.nvim/,,
@@ -360,6 +361,7 @@ https://github.com/morhetz/gruvbox/,,
 https://github.com/luisiacc/gruvbox-baby/,HEAD,
 https://github.com/eddyekofo94/gruvbox-flat.nvim/,,
 https://github.com/sainnhe/gruvbox-material/,,
+https://github.com/f4z3r/gruvbox-material.nvim/,HEAD,
 https://github.com/ellisonleao/gruvbox.nvim/,,
 https://github.com/nvimdev/guard-collection/,HEAD,
 https://github.com/nvimdev/guard.nvim/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 5cf2b7b53d066..24d0a32ef9cbf 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1,27 +1,29 @@
 # Before adding a new extension, read ./README.md
 
-{ config
-, lib
-, fetchurl
-, callPackage
-, vscode-utils
-, python3Packages
-, jdk
-, llvmPackages
-, llvmPackages_14
-, protobuf
-, jq
-, moreutils
-, autoPatchelfHook
-, zlib
-, stdenv
+{
+  autoPatchelfHook,
+  callPackage,
+  config,
+  fetchurl,
+  jdk,
+  jq,
+  lib,
+  llvmPackages,
+  llvmPackages_14,
+  moreutils,
+  protobuf,
+  python3Packages,
+  stdenv,
+  vscode-utils,
+  zlib,
 }:
 
 let
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
 
-  baseExtensions = self: lib.mapAttrs (_n: lib.recurseIntoAttrs)
-    {
+  baseExtensions =
+    self:
+    lib.mapAttrs (_n: lib.recurseIntoAttrs) {
       "13xforever".language-x86-64-assembly = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "language-x86-64-assembly";
@@ -142,6 +144,23 @@ let
         };
       };
 
+      adzero.vscode-sievehighlight = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-sievehighlight";
+          publisher = "adzero";
+          version = "1.0.6";
+          hash = "sha256-8Ompv792eI2kIH+5+KPL9jAf88xsMGQewHEQwi8BhoQ=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/adzero.vscode-sievehighlight/changelog";
+          description = "A Visual Studio Code extension to enable syntax highlight support for Sieve mail filtering language";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=adzero.vscode-sievehighlight";
+          homepage = "https://github.com/adzero/vscode-sievehighlight";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.sebtm ];
+        };
+      };
+
       alanz.vscode-hie-server = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-hie-server";
@@ -316,8 +335,7 @@ let
         };
         meta = {
           description = "An arctic, north-bluish clean and elegant Visual Studio Code theme.";
-          downloadPage =
-            "https://marketplace.visualstudio.com/items?itemName=arcticicestudio.nord-visual-studio-code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=arcticicestudio.nord-visual-studio-code";
           homepage = "https://github.com/arcticicestudio/nord-visual-studio-code";
           license = lib.licenses.mit;
           maintainers = [ lib.maintainers.imgabe ];
@@ -363,7 +381,7 @@ let
           homepage = "https://github.com/asdine/vscode-cue";
           changelog = "https://marketplace.visualstudio.com/items/asdine.cue/changelog";
           license = lib.licenses.mit;
-          maintainers = [lib.maintainers.matthewpi];
+          maintainers = [ lib.maintainers.matthewpi ];
         };
       };
 
@@ -735,30 +753,33 @@ let
       };
 
       charliermarsh.ruff = buildVscodeMarketplaceExtension {
-        mktplcRef = let
-          sources = {
-            "x86_64-linux" = {
-              arch = "linux-x64";
-              hash = "sha256-2c0tH/MlDOqeyffcV8ZCy4woogBTcf1GCuPPO8JXaWc=";
-            };
-            "x86_64-darwin" = {
-              arch = "darwin-x64";
-              hash = "sha256-euvGIlO7931N56R5BWKu3F9nSEoDgf+DXk7Hgl1qSUw=";
-            };
-            "aarch64-linux" = {
-              arch = "linux-arm64";
-              hash = "sha256-dGpIHChnfrQbxRZDuoAi4imgStyyPdxdvTQ3lknMYu0=";
-            };
-            "aarch64-darwin" = {
-              arch = "darwin-arm64";
-              hash = "sha256-tElX4C0I5AmpxSHMtqOsxSAUImD1tqArB5fnvhw4LFc=";
+        mktplcRef =
+          let
+            sources = {
+              "x86_64-linux" = {
+                arch = "linux-x64";
+                hash = "sha256-2c0tH/MlDOqeyffcV8ZCy4woogBTcf1GCuPPO8JXaWc=";
+              };
+              "x86_64-darwin" = {
+                arch = "darwin-x64";
+                hash = "sha256-euvGIlO7931N56R5BWKu3F9nSEoDgf+DXk7Hgl1qSUw=";
+              };
+              "aarch64-linux" = {
+                arch = "linux-arm64";
+                hash = "sha256-dGpIHChnfrQbxRZDuoAi4imgStyyPdxdvTQ3lknMYu0=";
+              };
+              "aarch64-darwin" = {
+                arch = "darwin-arm64";
+                hash = "sha256-tElX4C0I5AmpxSHMtqOsxSAUImD1tqArB5fnvhw4LFc=";
+              };
             };
-          };
-        in {
-          name = "ruff";
-          publisher = "charliermarsh";
-          version = "2024.4.0";
-        } // sources.${stdenv.system} or (throw "Unsupported system ${stdenv.system}");
+          in
+          {
+            name = "ruff";
+            publisher = "charliermarsh";
+            version = "2024.4.0";
+          }
+          // sources.${stdenv.system} or (throw "Unsupported system ${stdenv.system}");
         meta = {
           license = lib.licenses.mit;
           changelog = "https://marketplace.visualstudio.com/items/charliermarsh.ruff/changelog";
@@ -917,7 +938,9 @@ let
         };
       };
 
-      contextmapper.context-mapper-vscode-extension = callPackage ./contextmapper.context-mapper-vscode-extension { };
+      contextmapper.context-mapper-vscode-extension =
+        callPackage ./contextmapper.context-mapper-vscode-extension
+          { };
 
       continue.continue = buildVscodeMarketplaceExtension {
         mktplcRef =
@@ -945,13 +968,10 @@ let
             name = "continue";
             publisher = "Continue";
             version = "0.8.22";
-          } // sources.${stdenv.system};
-        nativeBuildInputs = [
-          autoPatchelfHook
-        ];
-        buildInputs = [
-          stdenv.cc.cc.lib
-        ];
+          }
+          // sources.${stdenv.system};
+        nativeBuildInputs = [ autoPatchelfHook ];
+        buildInputs = [ stdenv.cc.cc.lib ];
         postInstall = ''
           cd "$out/$installPrefix"
           substituteInPlace "out/extension.js" \
@@ -963,7 +983,12 @@ let
           homepage = "https://github.com/continuedev/continue";
           license = lib.licenses.asl20;
           maintainers = [ lib.maintainers.raroh73 ];
-          platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ];
+          platforms = [
+            "x86_64-linux"
+            "x86_64-darwin"
+            "aarch64-darwin"
+            "aarch64-linux"
+          ];
         };
       };
 
@@ -1130,34 +1155,35 @@ let
       };
 
       devsense.phptools-vscode = buildVscodeMarketplaceExtension {
-        mktplcRef = let
-          sources = {
-            "x86_64-linux" = {
-              arch = "linux-x64";
-              hash = "sha256-8i5nRlzd+LnpEh9trWECxfiC1W4S0ekBab5vo18OlsA=";
-            };
-            "x86_64-darwin" = {
-              arch = "darwin-x64";
-              sha256 = "14crw56277rdwhigabb3nsndkfcs3yzzf7gw85jvryxviq32chgy";
-            };
-            "aarch64-linux" = {
-              arch = "linux-arm64";
-              sha256 = "1j1xlvbg3nrfmdd9zm6kywwicdwdkrq0si86lcndaii8m7sj5pfp";
-            };
-            "aarch64-darwin" = {
-              arch = "darwin-arm64";
-              sha256 = "0nlks6iqxkx1xlicsa8lrb1319rgznlxkv2gg7wkwgzph97ik8bi";
+        mktplcRef =
+          let
+            sources = {
+              "x86_64-linux" = {
+                arch = "linux-x64";
+                hash = "sha256-8i5nRlzd+LnpEh9trWECxfiC1W4S0ekBab5vo18OlsA=";
+              };
+              "x86_64-darwin" = {
+                arch = "darwin-x64";
+                sha256 = "14crw56277rdwhigabb3nsndkfcs3yzzf7gw85jvryxviq32chgy";
+              };
+              "aarch64-linux" = {
+                arch = "linux-arm64";
+                sha256 = "1j1xlvbg3nrfmdd9zm6kywwicdwdkrq0si86lcndaii8m7sj5pfp";
+              };
+              "aarch64-darwin" = {
+                arch = "darwin-arm64";
+                sha256 = "0nlks6iqxkx1xlicsa8lrb1319rgznlxkv2gg7wkwgzph97ik8bi";
+              };
             };
-          };
-        in {
-          name = "phptools-vscode";
-          publisher = "devsense";
-          version = "1.41.14332";
-        } // sources.${stdenv.system};
+          in
+          {
+            name = "phptools-vscode";
+            publisher = "devsense";
+            version = "1.41.14332";
+          }
+          // sources.${stdenv.system};
 
-        nativeBuildInputs = [
-          autoPatchelfHook
-        ];
+        nativeBuildInputs = [ autoPatchelfHook ];
 
         buildInputs = [
           zlib
@@ -1175,7 +1201,12 @@ let
           homepage = "https://github.com/DEVSENSE/phptools-docs";
           license = lib.licenses.unfree;
           maintainers = [ lib.maintainers.drupol ];
-          platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ];
+          platforms = [
+            "x86_64-linux"
+            "x86_64-darwin"
+            "aarch64-darwin"
+            "aarch64-linux"
+          ];
         };
       };
 
@@ -1203,7 +1234,9 @@ let
           version = "0.0.4";
           sha256 = "0sa04srhqmngmw71slnrapi2xay0arj42j4gkan8i11n7bfi1xpf";
         };
-        meta = { license = lib.licenses.mit; };
+        meta = {
+          license = lib.licenses.mit;
+        };
       };
 
       dhall.vscode-dhall-lsp-server = buildVscodeMarketplaceExtension {
@@ -1213,7 +1246,9 @@ let
           version = "0.0.4";
           sha256 = "1zin7s827bpf9yvzpxpr5n6mv0b5rhh3civsqzmj52mdq365d2js";
         };
-        meta = { license = lib.licenses.mit; };
+        meta = {
+          license = lib.licenses.mit;
+        };
       };
 
       dhedgecock.radical-vscode = buildVscodeMarketplaceExtension {
@@ -1240,7 +1275,9 @@ let
           version = "0.0.8";
           hash = "sha256-BQPiSxiPPjdNPtIJI8L+558DVKxngPAI9sscpcJSJUI=";
         };
-        meta = { license = lib.licenses.asl20; };
+        meta = {
+          license = lib.licenses.asl20;
+        };
       };
 
       divyanshuagrawal.competitive-programming-helper = buildVscodeMarketplaceExtension {
@@ -1794,8 +1831,7 @@ let
         };
         meta = {
           description = "GitHub theme for VS Code";
-          downloadPage =
-            "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
           homepage = "https://github.com/primer/github-vscode-theme";
           license = lib.licenses.mit;
           maintainers = [ lib.maintainers.hugolgst ];
@@ -1830,7 +1866,9 @@ let
           version = "0.78.1";
           hash = "sha256-T9oW6o4ItZfR8E1qrcH3nhMvVB6ihi4kpiDz7YGHOcI=";
         };
-        meta = { license = lib.licenses.mit; };
+        meta = {
+          license = lib.licenses.mit;
+        };
       };
 
       gitlab.gitlab-workflow = buildVscodeMarketplaceExtension {
@@ -2439,9 +2477,15 @@ let
             hash = "sha256-IueXiN+077tiecAsVCzgYksWYTs00mZv6XJVMtRJ/PQ=";
           };
 
-          nativeBuildInputs = [ jq moreutils ];
+          nativeBuildInputs = [
+            jq
+            moreutils
+          ];
 
-          buildInputs = [ cfn-lint pydot ];
+          buildInputs = [
+            cfn-lint
+            pydot
+          ];
 
           postInstall = ''
             cd "$out/$installPrefix"
@@ -3321,13 +3365,18 @@ let
         mktplcRef = {
           name = "java";
           publisher = "redhat";
-          version = "1.17.2023032504";
-          hash = "sha256-ni1jzCPjwtcdJTEORn0vYzLRbQ/wseTZmrETJ8QPW58=";
+          version = "1.30.2024041908";
+          hash = "sha256-2VaB7duzDmoQYxLHIuC9yghJvmVnWJIBfH75xq5ljPg=";
         };
         buildInputs = [ jdk ];
         meta = {
+          description = "Java language support for VS Code via the Eclipse JDT Language Server";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=redhat.java";
+          homepage = "https://github.com/redhat-developer/vscode-java";
+          changelog = "https://marketplace.visualstudio.com/items/redhat.java/changelog";
           license = lib.licenses.epl20;
-          broken = lib.versionOlder jdk.version "11";
+          maintainers = [ lib.maintainers.wackbyte ];
+          broken = lib.versionOlder jdk.version "17";
         };
       };
 
@@ -4019,8 +4068,8 @@ let
         mktplcRef = {
           name = "vscode-nushell-lang";
           publisher = "thenuprojectcontributors";
-          version = "1.1.0";
-          hash = "sha256-7v4q0OEqv7q2ejHp4lph2Dsqg0GWE65pxyz9goQEm8g=";
+          version = "1.9.0";
+          hash = "sha256-E9CK/GChd/yZT+P3ttROjL2jHtKPJ0KZzc32/nbuE4w=";
         };
         meta.license = lib.licenses.mit;
       };
@@ -4179,7 +4228,11 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=uiua-lang.uiua-vscode";
           homepage = "https://github.com/uiua-lang/uiua-vscode";
           license = lib.licenses.mit;
-          maintainers = with lib.maintainers; [ tomasajt wackbyte defelo ];
+          maintainers = with lib.maintainers; [
+            tomasajt
+            wackbyte
+            defelo
+          ];
         };
       };
 
@@ -4249,7 +4302,10 @@ let
           sha256 = "1nlrijjwc35n1xgb5lgnr4yvlgfcxd0vdj93ip8lv2xi8x1ni5f6";
         };
 
-        nativeBuildInputs = [ jq moreutils ];
+        nativeBuildInputs = [
+          jq
+          moreutils
+        ];
 
         buildInputs = [ jdk ];
 
@@ -4693,7 +4749,10 @@ let
           version = "0.5.4";
           sha256 = "08dfl5h1k6s542qw5qx2czm1wb37ck9w2vpjz44kp2az352nmksb";
         };
-        nativeBuildInputs = [ jq moreutils ];
+        nativeBuildInputs = [
+          jq
+          moreutils
+        ];
         postInstall = ''
           cd "$out/$installPrefix"
           jq '.contributes.configuration.properties.protoc.properties.path.default = "${protobuf}/bin/protoc"' package.json | sponge package.json
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
index b06922a90c5bb..c5ae57e0f63b0 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  nodePackages,
+  pyright,
   vscode-utils,
 }:
 
@@ -12,7 +12,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
   };
 
-  buildInputs = [ nodePackages.pyright ];
+  buildInputs = [ pyright ];
 
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/ms-python.vscode-pylance/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index 5e7c3f59f1982..9dbf71b8b1016 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
     publisher = "myriad-dreamin";
     # Please update the corresponding binary (tinymist) when updating
     # this extension.
-    version = "0.11.4";
-    hash = "sha256-VR+vl6mctwq9oSIgnfutvPFwfGUdEco8fCOjzMvPtII=";
+    version = "0.11.5";
+    hash = "sha256-p97RREGKhTeXO5s4jP8qUsLtYxOj91ddQhsk6Q+50jc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/emulators/cemu/default.nix b/pkgs/applications/emulators/cemu/default.nix
index 2b3f5e28a8cf8..26230f8d72a70 100644
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@@ -46,13 +46,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "cemu";
-  version = "2.0-74";
+  version = "2.0-78";
 
   src = fetchFromGitHub {
     owner = "cemu-project";
     repo = "Cemu";
     rev = "v${version}";
-    hash = "sha256-taV2HEKRUQ7k5BpgA3nwVzX8qkTN02O9kqswjdCHod0=";
+    hash = "sha256-ivdqO44+8sDgOshUDFc+4eTgzcEDSiPPIawyktYpob4=";
   };
 
   patches = [
diff --git a/pkgs/applications/emulators/mednafen/server.nix b/pkgs/applications/emulators/mednafen/server.nix
deleted file mode 100644
index 3e11ff41d48d5..0000000000000
--- a/pkgs/applications/emulators/mednafen/server.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  pname = "mednafen-server";
-  version = "0.5.2";
-
-  src = fetchurl {
-    url = "https://mednafen.github.io/releases/files/mednafen-server-${version}.tar.xz";
-    sha256 = "0xm7dj5nwnrsv69r72rcnlw03jm0l8rmrg3s05gjfvxyqmlb36dq";
-  };
-
-  postInstall = "install -m 644 -Dt $out/share/mednafen-server standard.conf";
-
-  meta = with lib; {
-    description = "Netplay server for Mednafen";
-    mainProgram = "mednafen-server";
-    homepage = "https://mednafen.github.io/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/applications/emulators/mednaffe/default.nix b/pkgs/applications/emulators/mednaffe/default.nix
deleted file mode 100644
index 75a25a4bec3b0..0000000000000
--- a/pkgs/applications/emulators/mednaffe/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, autoreconfHook
-, pkg-config
-, mednafen
-, gtk3
-, wrapGAppsHook
-}:
-
-stdenv.mkDerivation rec {
-  pname = "mednaffe";
-  version = "0.9.2";
-
-  src = fetchFromGitHub {
-    owner = "AmatCoder";
-    repo = "mednaffe";
-    rev = version;
-    sha256 = "sha256-zvSAt6CMcgdoPpTTA5sPlQaWUw9LUMsR2Xg9jM2UaWY=";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
-
-  buildInputs = [ gtk3 mednafen ];
-
-  enableParallelBuilding = true;
-
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix PATH ':' "${mednafen}/bin"
-    )
-   '';
-
-  meta = with lib; {
-    description = "GTK-based frontend for mednafen emulator";
-    mainProgram = "mednaffe";
-    homepage = "https://github.com/AmatCoder/mednaffe";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ sheenobu yana AndersonTorres ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index 4a5e06c2e5e64..3476816b1c230 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -77,14 +77,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.34.5";
+  version = "3.34.6";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-TRSS1YclGUfBjNz+Lo8U8YlN4kdJ9JLcwd7qpgwRbG0=";
+    hash = "sha256-eWd8oIINWVN5Dt6s4bc1RtQbytFd0foPgIcd/N2hsMw=";
   };
 
   passthru = {
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 61e08ef561632..d112ed50a0d52 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -78,14 +78,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.36.1";
+  version = "3.36.2";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-/0wVPcQoliJFgY8Kn506gUHfY+kDTdLgzbp/0KLSAkI=";
+    hash = "sha256-/8mpzl/6UpjrMVjae2nqpS2DBRCq86rE+B3INzoRz8g=";
   };
 
   passthru = {
diff --git a/pkgs/applications/graphics/flaca/Cargo.lock b/pkgs/applications/graphics/flaca/Cargo.lock
deleted file mode 100644
index fe91f0890a47e..0000000000000
--- a/pkgs/applications/graphics/flaca/Cargo.lock
+++ /dev/null
@@ -1,729 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "adler"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
-
-[[package]]
-name = "ahash"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
-]
-
-[[package]]
-name = "argyle"
-version = "0.6.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a7b00c835644c00c2f160668103439b2e4374e9340fda8a9730e2efa8925145"
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
-
-[[package]]
-name = "bitvec"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
-dependencies = [
- "funty",
- "radium",
- "tap",
- "wyz",
-]
-
-[[package]]
-name = "bytecount"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c676a478f63e9fa2dd5368a42f28bba0d6c560b775f38583c8bbaa7fcd67c9c"
-
-[[package]]
-name = "bytemuck"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
-
-[[package]]
-name = "byteorder"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
-
-[[package]]
-name = "cc"
-version = "1.0.83"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "jobserver",
- "libc",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "color_quant"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
-
-[[package]]
-name = "crc32fast"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
-dependencies = [
- "cfg-if",
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
-dependencies = [
- "autocfg",
- "cfg-if",
- "crossbeam-utils",
- "memoffset",
- "scopeguard",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "ctrlc"
-version = "3.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82e95fbd621905b854affdc67943b043a0fbb6ed7385fd5a25650d19a8a6cfdf"
-dependencies = [
- "nix",
- "windows-sys",
-]
-
-[[package]]
-name = "dactyl"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f762271c6826d426c3fd2e37aa827fa039596bc7050e9289cb713265be3d7f"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "dowser"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea8b43a90f6c54a58a97ad6a82001227bafeeb4550ee05732fb656133494918"
-dependencies = [
- "ahash",
- "dactyl",
-]
-
-[[package]]
-name = "dunce"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56ce8c6da7551ec6c462cbaf3bfbc75131ebbfa1c944aeaa9dab51ca1c5f0c3b"
-
-[[package]]
-name = "either"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
-
-[[package]]
-name = "errno"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6999dc1837253364c2ebb0704ba97994bd874e8f195d665c50b7548f6ea92764"
-
-[[package]]
-name = "fdeflate"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d329bdeac514ee06249dabc27877490f17f5d371ec693360768b838e19f3ae10"
-dependencies = [
- "simd-adler32",
-]
-
-[[package]]
-name = "flaca"
-version = "2.3.0"
-dependencies = [
- "argyle",
- "cc",
- "ctrlc",
- "dactyl",
- "dowser",
- "fyi_msg",
- "libc",
- "mozjpeg-sys",
- "oxipng",
- "rayon",
- "write_atomic",
-]
-
-[[package]]
-name = "flate2"
-version = "1.0.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
-[[package]]
-name = "funty"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
-
-[[package]]
-name = "fyi_msg"
-version = "0.11.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04bb9530916893c31bca029d18088c77f02ea93e270cffab771f9b985cdeb4bb"
-dependencies = [
- "ahash",
- "bytecount",
- "dactyl",
- "term_size",
- "unicode-width",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
-
-[[package]]
-name = "image"
-version = "0.24.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f3dfdbdd72063086ff443e297b61695500514b1e41095b6fb9a5ab48a70a711"
-dependencies = [
- "bytemuck",
- "byteorder",
- "color_quant",
- "num-rational",
- "num-traits",
- "png",
-]
-
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown",
-]
-
-[[package]]
-name = "itertools"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "jobserver"
-version = "0.1.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "936cfd212a0155903bcbc060e316fb6cc7cbf2e1907329391ebadc1fe0ce77c2"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.148"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
-
-[[package]]
-name = "libdeflate-sys"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb6784b6b84b67d71b4307963d456a9c7c29f9b47c658f533e598de369e34277"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "libdeflater"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8e285aa6a046fd338b2592c16bee148b2b00789138ed6b7bb56bb13d585050d"
-dependencies = [
- "libdeflate-sys",
-]
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a9bad9f94746442c783ca431b22403b519cd7fbeed0533fdd6328b2f2212128"
-
-[[package]]
-name = "log"
-version = "0.4.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
-
-[[package]]
-name = "memoffset"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
-dependencies = [
- "adler",
- "simd-adler32",
-]
-
-[[package]]
-name = "mozjpeg-sys"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "808feab72499ffd6c267a6fd06bd07e37bef14650c328a5c64636fecfa113eff"
-dependencies = [
- "cc",
- "dunce",
- "libc",
- "nasm-rs",
-]
-
-[[package]]
-name = "nasm-rs"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe4d98d0065f4b1daf164b3eafb11974c94662e5e2396cf03f32d0bb5c17da51"
-dependencies = [
- "rayon",
-]
-
-[[package]]
-name = "nix"
-version = "0.27.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
-dependencies = [
- "bitflags 2.4.0",
- "cfg-if",
- "libc",
-]
-
-[[package]]
-name = "num-integer"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
-dependencies = [
- "autocfg",
- "num-traits",
-]
-
-[[package]]
-name = "num-rational"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
-dependencies = [
- "autocfg",
- "num-integer",
- "num-traits",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
-
-[[package]]
-name = "oxipng"
-version = "8.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630638e107fb436644c300e781d3f17e1b04656138ba0d40564be4be3b06db32"
-dependencies = [
- "bitvec",
- "crossbeam-channel",
- "image",
- "indexmap",
- "itertools",
- "libdeflater",
- "log",
- "rgb",
- "rustc-hash",
- "rustc_version",
-]
-
-[[package]]
-name = "png"
-version = "0.17.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd75bf2d8dd3702b9707cdbc56a5b9ef42cec752eb8b3bafc01234558442aa64"
-dependencies = [
- "bitflags 1.3.2",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide",
-]
-
-[[package]]
-name = "radium"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
-
-[[package]]
-name = "rayon"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
-dependencies = [
- "crossbeam-channel",
- "crossbeam-deque",
- "crossbeam-utils",
- "num_cpus",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "rgb"
-version = "0.8.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20ec2d3e3fc7a92ced357df9cebd5a10b6fb2aa1ee797bf7e9ce2f17dffc8f59"
-dependencies = [
- "bytemuck",
-]
-
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "rustc_version"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
-dependencies = [
- "semver",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7db8590df6dfcd144d22afd1b83b36c21a18d7cbc1dc4bb5295a8712e9eb662"
-dependencies = [
- "bitflags 2.4.0",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "semver"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0293b4b29daaf487284529cc2f5675b8e57c61f70167ba415a463651fd6a918"
-
-[[package]]
-name = "simd-adler32"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
-
-[[package]]
-name = "tap"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
-
-[[package]]
-name = "tempfile"
-version = "3.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
-dependencies = [
- "cfg-if",
- "fastrand",
- "redox_syscall",
- "rustix",
- "windows-sys",
-]
-
-[[package]]
-name = "term_size"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e4129646ca0ed8f45d09b929036bafad5377103edd06e50bf574b353d2b08d9"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "unicode-width"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
-[[package]]
-name = "write_atomic"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cc5bd3df909eefc4f13328da8ac3b9e6016e0899477c0354c6880c67362cfc"
-dependencies = [
- "rustix",
- "tempfile",
-]
-
-[[package]]
-name = "wyz"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
-dependencies = [
- "tap",
-]
diff --git a/pkgs/applications/graphics/flaca/default.nix b/pkgs/applications/graphics/flaca/default.nix
index 912887e0e93a9..90fec04b36e5f 100644
--- a/pkgs/applications/graphics/flaca/default.nix
+++ b/pkgs/applications/graphics/flaca/default.nix
@@ -1,21 +1,35 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, fetchurl
+, runCommand
+, lndir
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "flaca";
-  version = "2.3.0";
+  version = "2.4.6";
 
-  src = fetchFromGitHub {
-    owner = "Blobfolio";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-gK9nKvhrqGQ3yDAfnqDF2K1g6JK3CYz0kSpTLqfGTzc=";
-  };
+  src =
+    let
+      source = fetchFromGitHub {
+        owner = "Blobfolio";
+        repo = pname;
+        rev = "v${version}";
+        hash = "sha256-uybEo098+Y92b2P9CniKFmaV8hQZFuOSthgQRGZ/ncc=";
+      };
+      lockFile = fetchurl {
+        url = "https://github.com/Blobfolio/flaca/releases/download/v${version}/Cargo.lock";
+        hash = "sha256-xAjpw71HgS6fILg5zNuc43s0fIqYcoUMMbCH65xrlww=";
+      };
+    in
+    runCommand "source-with-lock" { nativeBuildInputs = [ lndir ]; } ''
+      mkdir -p $out
+      ln -s ${lockFile} $out/Cargo.lock
+      lndir -silent ${source} $out
+    '';
 
-  # upstream does not provide a Cargo.lock
-  cargoLock.lockFile = ./Cargo.lock;
-  postPatch = ''
-    ln -s ${./Cargo.lock} Cargo.lock
-  '';
+  cargoHash = "sha256-w+PeuH6VFIu3iH5EXF6gEwyYoGeqXX0yd5jJs2NqisQ=";
 
   meta = with lib; {
     description = "A CLI tool to losslessly compress JPEG and PNG images";
diff --git a/pkgs/applications/graphics/gscan2pdf/default.nix b/pkgs/applications/graphics/gscan2pdf/default.nix
index bbf52e105a284..d7ebb0a747ea3 100644
--- a/pkgs/applications/graphics/gscan2pdf/default.nix
+++ b/pkgs/applications/graphics/gscan2pdf/default.nix
@@ -2,7 +2,7 @@
   # libs
   librsvg, sane-backends, sane-frontends,
   # runtime dependencies
-  imagemagick, libtiff_4_5, djvulibre, poppler_utils, ghostscript, unpaper, pdftk,
+  imagemagick, libtiff, djvulibre, poppler_utils, ghostscript, unpaper, pdftk,
   # test dependencies
   xvfb-run, liberation_ttf, file, tesseract }:
 
@@ -82,7 +82,7 @@ perlPackages.buildPerlPackage rec {
     wrapProgram "$out/bin/gscan2pdf" \
       --prefix PATH : "${sane-backends}/bin" \
       --prefix PATH : "${imagemagick}/bin" \
-      --prefix PATH : "${libtiff_4_5}/bin" \
+      --prefix PATH : "${libtiff}/bin" \
       --prefix PATH : "${djvulibre}/bin" \
       --prefix PATH : "${poppler_utils}/bin" \
       --prefix PATH : "${ghostscript}/bin" \
@@ -98,10 +98,7 @@ perlPackages.buildPerlPackage rec {
 
   nativeCheckInputs = [
     imagemagick
-    # Needs older libtiff version, because it stopped packageing tools like
-    # tiff2pdf and others in version 4.6. These tools are necessary for gscan2pdf.
-    # See commit f57a4b0ac1b954eec0c8def2a99e2a464ac6ff7a for in-depth explanation.
-    libtiff_4_5
+    libtiff
     djvulibre
     poppler_utils
     ghostscript
diff --git a/pkgs/applications/graphics/meshlab/default.nix b/pkgs/applications/graphics/meshlab/default.nix
index 32d5288315395..a77a39445c045 100644
--- a/pkgs/applications/graphics/meshlab/default.nix
+++ b/pkgs/applications/graphics/meshlab/default.nix
@@ -15,21 +15,27 @@
 , qhull
 , cmake
 , cgal
-, boost179
+, boost
 , mpfr
 , xercesc
+, tbb
+, embree
+, vcg
+, libigl
+, corto
+, openctm
+, structuresynth
 }:
 
 mkDerivation rec {
   pname = "meshlab";
-  version = "2022.02";
+  version = "2023.12";
 
   src = fetchFromGitHub {
     owner = "cnr-isti-vclab";
     repo = "meshlab";
     rev = "MeshLab-${version}";
-    sha256 = "sha256-jcc3PfsiIeYyipteZgzd0NwZgFFgR/mMBiaInzhOcDY=";
-    fetchSubmodules = true; # for vcglib
+    sha256 = "sha256-AdUAWS741RQclYaSE3Tz1/I0YSinNAnfSaqef+Tib8Y=";
   };
 
   buildInputs = [
@@ -46,38 +52,38 @@ mkDerivation rec {
     levmar
     qhull
     cgal
-    boost179
+    boost
     mpfr
     xercesc
+    tbb
+    embree
+    vcg
+    libigl
+    corto
+    openctm
+    structuresynth
   ];
 
   nativeBuildInputs = [ cmake ];
 
   preConfigure = ''
-    substituteAll ${./meshlab.desktop} scripts/Linux/resources/meshlab.desktop
-    cmakeDir=$PWD/src
-    mkdir ../build
-    cd ../build
+    substituteAll ${./meshlab.desktop} resources/linux/meshlab.desktop
+    substituteInPlace src/external/libigl.cmake \
+      --replace-fail '$'{MESHLAB_EXTERNAL_DOWNLOAD_DIR}/libigl-2.4.0 ${libigl}
+    substituteInPlace src/external/nexus.cmake \
+      --replace-fail '$'{NEXUS_DIR}/src/corto ${corto.src}
+    substituteInPlace src/external/levmar.cmake \
+      --replace-fail '$'{LEVMAR_LINK} ${levmar.src} \
+      --replace-warn "MD5 ''${LEVMAR_MD5}" ""
+    substituteInPlace src/external/ssynth.cmake \
+      --replace-fail '$'{SSYNTH_LINK} ${structuresynth.src} \
+      --replace-warn "MD5 ''${SSYNTH_MD5}" ""
+    substituteInPlace src/common_gui/CMakeLists.txt \
+      --replace-warn "MESHLAB_LIB_INSTALL_DIR" "CMAKE_INSTALL_LIBDIR"
   '';
 
   cmakeFlags = [
-    "-DALLOW_BUNDLED_EIGEN=OFF"
-    "-DALLOW_BUNDLED_GLEW=OFF"
-    "-DALLOW_BUNDLED_LIB3DS=OFF"
-    "-DALLOW_BUNDLED_MUPARSER=OFF"
-    "-DALLOW_BUNDLED_QHULL=OFF"
-    # disable when available in nixpkgs
-    "-DALLOW_BUNDLED_OPENCTM=ON"
-    "-DALLOW_BUNDLED_SSYNTH=ON"
-    "-DALLOW_BUNDLED_BOOST=OFF"
-    # some plugins are disabled unless these are on
-    "-DALLOW_BUNDLED_NEWUOA=ON"
-    "-DALLOW_BUNDLED_LEVMAR=ON"
-  ];
-
-  CXXFLAGS = [
-    # GCC 13: error: 'int16_t' has not been declared in 'std'
-    "-include cstdint"
+    "-DVCGDIR=${vcg.src}"
   ];
 
   postFixup = ''
diff --git a/pkgs/applications/graphics/pymeshlab/default.nix b/pkgs/applications/graphics/pymeshlab/default.nix
new file mode 100644
index 0000000000000..5bf8339797b42
--- /dev/null
+++ b/pkgs/applications/graphics/pymeshlab/default.nix
@@ -0,0 +1,107 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, libGLU
+, qtbase
+, qtscript
+, qtxmlpatterns
+, lib3ds
+, bzip2
+, muparser
+, eigen
+, glew
+, gmp
+, levmar
+, qhull
+, cmake
+, cgal
+, boost
+, mpfr
+, xercesc
+, tbb
+, embree
+, vcg
+, libigl
+, corto
+, openctm
+, structuresynth
+, wrapQtAppsHook
+, python3Packages
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pymeshlab";
+  version = "2023.12";
+
+  src = fetchFromGitHub {
+    owner = "cnr-isti-vclab";
+    repo = "pymeshlab";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-IOlRdXoUPOJt67g3HqsLchV5aL+JUEks2y1Sy+wpwsg=";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [
+    libGLU
+    qtbase
+    qtscript
+    qtxmlpatterns
+    lib3ds
+    bzip2
+    muparser
+    eigen
+    glew
+    gmp
+    levmar
+    qhull
+    cgal
+    boost
+    mpfr
+    xercesc
+    tbb
+    embree
+    vcg
+    libigl
+    corto
+    structuresynth
+    openctm
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+    python3Packages.pybind11
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.numpy
+  ];
+
+  preConfigure = ''
+    substituteInPlace src/meshlab/src/external/libigl.cmake \
+      --replace-fail '$'{MESHLAB_EXTERNAL_DOWNLOAD_DIR}/libigl-2.4.0 ${libigl}
+    substituteInPlace src/meshlab/src/external/nexus.cmake \
+      --replace-fail '$'{NEXUS_DIR}/src/corto ${corto.src}
+    substituteInPlace src/meshlab/src/external/levmar.cmake \
+      --replace-fail '$'{LEVMAR_LINK} ${levmar.src} \
+      --replace-warn "MD5 ''${LEVMAR_MD5}" ""
+    substituteInPlace src/meshlab/src/external/ssynth.cmake \
+      --replace-fail '$'{SSYNTH_LINK} ${structuresynth.src} \
+      --replace-warn "MD5 ''${SSYNTH_MD5}" ""
+    export cmakeFlags="cmakeFlags
+      -DCMAKE_INSTALL_PREFIX=$out/${python3Packages.python.sitePackages}/pymeshlab
+    "
+  '';
+
+  cmakeFlags = [
+    "-DVCGDIR=${vcg.src}"
+  ];
+
+  meta = {
+    description = "The open source mesh processing python library";
+    homepage = "https://github.com/cnr-isti-vclab/PyMeshLab";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ nim65s ];
+    platforms = with lib.platforms; linux;
+  };
+})
diff --git a/pkgs/applications/graphics/sane/backends/brscan5/default.nix b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
index 7bce5301f938a..c15599ec66bbb 100644
--- a/pkgs/applications/graphics/sane/backends/brscan5/default.nix
+++ b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
@@ -10,15 +10,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "brscan5";
-  version = "1.3.0-0";
+  version = "1.3.1-0";
   src = {
     "i686-linux" = fetchurl {
       url = "https://download.brother.com/welcome/dlf104034/${pname}-${version}.i386.deb";
-      sha256 = "sha256-LpbPUo8iD5CcwUoIOa1UYHQXMrZZJ7PjZpcuyXhXjzk=";
+      hash = "sha256-BgS64vwsKESJBDz9H2MDwcGiresROSNFP1b+7+zlE5c=";
     };
     "x86_64-linux" = fetchurl {
       url = "https://download.brother.com/welcome/dlf104033/${pname}-${version}.amd64.deb";
-      sha256 = "sha256-ntVe/e6/cdz3+LSpGilMFZecxfv74pd7ksh85SzEdKc=";
+      hash = "sha256-0UMbXMBlyiZI90WG5FWEP2mIZEBsxXd11dtgtyuSDnY=";
     };
   }."${system}" or (throw "Unsupported system: ${system}");
 
@@ -33,9 +33,12 @@ stdenv.mkDerivation rec {
 
   postPatch =
     let
+      # Download .deb for both amd64 and i386, then unpack like unpackPhase
+      # to get the offset, run:
+      # strings -n 10 --radix=d opt/brother/scanner/brscan5/libsane-brother5.so.1.0.7 | grep "/opt/brother/scanner/brscan5/models"
       patchOffsetBytes =
-        if system == "x86_64-linux" then 86528
-        else if system == "i686-linux" then 79140
+        if system == "x86_64-linux" then 86592
+        else if system == "i686-linux" then 79236
         else throw "Unsupported system: ${system}";
     in
     ''
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 5f8b7c9068acf..e977dffc444b6 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -9,43 +9,43 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.10.28" else "8.10.30-11.BETA";
+  version = if channel == "stable" then "8.10.30" else "8.10.30-20.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-1EfP8z+vH0yRklkcxCOPYExu13iFcs6jOdvWBzl64BA=";
+        hash = "sha256-q1PKFpBgjada7jmeXZYmH8dvy2A4lwfrQ0jQSoHVNcg=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-E4MfpHVIn5Vu/TcDgwkoHdSnKthaAMFJZArnmSH5cxA=";
+        hash = "sha256-Zv/mnykPi9PCDX44JtGi0GPrOujSmjx1BBJuEB81CwE=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-+cXirJyDnxfE5FN8HEIrEyyoGvVrJ+0ykBHON9oHAek=";
+        hash = "sha256-unC1cz5ooSdu4Csf7/daCyPdMy3/Lp3a76B7TBa/VXk=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-zKAgAKYIgy5gZbe2IpskV8DG8AKtamYqq8cF/mTpRss=";
+        hash = "sha256-DS6oCdr6srF+diL68a2gOskS4x+uj1i8DtL3uaaxv/I=";
       };
     };
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-6zyDZRsk9FZXJuGqqt1kCATcL99PjYP/wQzqE/4e4kg=";
+        hash = "sha256-6I/3o+33sIkfyef8xGUWczaWykHPcvvAGv0xy/jCkKI=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-JwHk6Byqd5LxVWBT/blRVnYhgSeYfaVY3Ax4GkLcFxM=";
+        hash = "sha256-ph6DBBUzdUHtYCAQiA1me3bevtVPEgIxtwbgbdgQcGY=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-h7vJguOEQBEvX9Z9MjdLj0hPnn8hJpeWRoduVowznLg=";
+        hash = "sha256-XzZOj1pfoCTGMTsqZlI8hKTDRJ4w7debAPYHIIwsyyY=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-g6lorMdQ56B6gd4YN4WQSkztwHqIgO7QshM1zocpqTE=";
+        hash = "sha256-s+hnKhI2s6E1ZyJQxs3Wggy60LxCEr+u3tRtjTgjmZk=";
       };
     };
   };
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index ea8440b5d82ba..a213c7ef89b8c 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.26.1";
+  version = "2.27.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-dV3VDPjiA9xKbL4tmDJ6T4B8NmPHBB2aKj3HWNGifr4=" "zip";
-    i686-linux = fetch "linux_386" "sha256-61zjjg2+UU3cMP+kcn1zXopTdRR2v/Wom3Vtz0/KnUQ=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-2Cq0tbdFpvFYSGRmdPclCw4jqfIKPoixv/gZKkBqgH0=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-NOCRGKF32tAh5HwwYgm+f3el3l1djqvIHNdpR5NsoM8=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-yutS8xSTRABt12+mEyU99R4eCHvuAwWdO40SZlUrtdc=" "zip";
+    i686-linux = fetch "linux_386" "sha256-juP//g9quhd7GRq5TNm3qAq+rOegGJ9u9F+fmGbfmbw=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-cFQ3lsHBV9fDoNK5ujTummIXA4591meP43KbiyWcbQk=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-fUwiEJxn4JdsViBQU2Odrw+Focp0ngH/RmfmW2Uu0Bo=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/applications/misc/albert/default.nix b/pkgs/applications/misc/albert/default.nix
index f9533663daa4b..8fe269ddab230 100644
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@@ -75,7 +75,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://albertlauncher.github.io";
     changelog = "https://github.com/albertlauncher/albert/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    license = licenses.gpl3Plus;
+    # See: https://github.com/NixOS/nixpkgs/issues/279226
+    license = licenses.unfree;
     maintainers = with maintainers; [ ericsagnes synthetica ];
     mainProgram = "albert";
     platforms = platforms.linux;
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 8266f4bfd067f..8cc7d4dd01f61 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -99,11 +99,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "blender";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3AAtguPDQMk4VcZoRzDQGAG2aaKbHMa3XuuZC6aecj8=";
+    hash = "sha256-T7s69k0/hN9ccQN0hFQibBiFwawu1Tc9DOoegOgsCEg=";
   };
 
   patches = [ ./draco.patch ] ++ lib.optional stdenv.isDarwin ./darwin.patch;
diff --git a/pkgs/applications/misc/electron-cash/default.nix b/pkgs/applications/misc/electron-cash/default.nix
index f28d1bf7e0434..f8914a7bb8f45 100644
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@@ -12,6 +12,10 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-xOyj5XerOwgfvI0qj7+7oshDvd18h5IeZvcJTis8nWo=";
   };
 
+  build-system = with python3Packages; [
+    cython
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     # requirements
     pyaes
@@ -36,7 +40,6 @@ python3Packages.buildPythonApplication rec {
     cryptography
 
     # requirements-hw
-    cython
     trezor
     keepkey
     btchip-python
diff --git a/pkgs/applications/misc/faircamp/Cargo.lock b/pkgs/applications/misc/faircamp/Cargo.lock
index 3c9a2765b2a26..deeaca6b86be1 100644
--- a/pkgs/applications/misc/faircamp/Cargo.lock
+++ b/pkgs/applications/misc/faircamp/Cargo.lock
@@ -53,7 +53,7 @@ dependencies = [
  "actix-service",
  "actix-utils",
  "ahash",
- "base64",
+ "base64 0.21.7",
  "bitflags 2.4.1",
  "brotli",
  "bytes",
@@ -262,6 +262,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "aligned-vec"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aa90d7ce82d4be67b64039a3d588d38dbcc6736577de4a847025ce5b0c468d1"
+
+[[package]]
 name = "alloc-no-stdlib"
 version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -346,12 +352,35 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
 
 [[package]]
+name = "arbitrary"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
+
+[[package]]
 name = "arbitrary-int"
 version = "1.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe8e2a586ecd6eb29477a0c25b19742acca4fa5e39c92e127656616810c20579"
 
 [[package]]
+name = "arg_enum_proc_macro"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ae92a5119aa49cdbcf6b9f893fe4e1d98b04ccbf82ee0584ad948a44a734dea"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
 name = "atomic-polyfill"
 version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -378,6 +407,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
+name = "av1-grain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6678909d8c5d46a42abcf571271e15fdbc0a225e3646cf23762cd415046c78bf"
+dependencies = [
+ "anyhow",
+ "arrayvec",
+ "log",
+ "nom",
+ "num-rational",
+ "v_frame",
+]
+
+[[package]]
+name = "avif-serialize"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "876c75a42f6364451a033496a14c44bffe41f5f4a8236f697391f11024e596d2"
+dependencies = [
+ "arrayvec",
+]
+
+[[package]]
 name = "az"
 version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -405,6 +457,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+
+[[package]]
 name = "base64ct"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -447,6 +505,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "bitstream-io"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06c9989a51171e2e81038ab168b6ae22886fe9ded214430dbb4f41c28cf176da"
+
+[[package]]
 name = "block-buffer"
 version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -477,6 +541,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "built"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38d17f4d6e4dc36d1a02fbedc2753a096848e7c1b0772f7654eab8e2c927dd53"
+
+[[package]]
 name = "bumpalo"
 version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -547,6 +617,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
 [[package]]
+name = "cfg-expr"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa50868b64a9a6fda9d593ce778849ea8715cd2a3d2cc17ffdb4a2f2f2f1961d"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
 name = "cfg-if"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -554,9 +634,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.33"
+version = "0.4.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f13690e35a5e4ace198e7beea2895d29f3a9cc55015fcebe6336bd2010af9eb"
+checksum = "8a0d04d43504c61aa6c7531f1871dd0d418d91130162063b789da00fd7057a5e"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -579,9 +659,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.18"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e578d6ec4194633722ccf9544794b71b1385c3c027efe0c55db226fc880865c"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -589,9 +669,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.18"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4df4df40ec50c46000231c914968278b1eb05098cf8f1b3a518a95030e71d1c7"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
@@ -601,9 +681,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.4.7"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -613,9 +693,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "claxon"
@@ -822,8 +902,8 @@ dependencies = [
 
 [[package]]
 name = "enolib"
-version = "0.4.1"
-source = "git+https://codeberg.org/simonrepp/enolib-rs?tag=0.4.1#1ca85dc8af9f74f65b199b2ab6c5c94f5b119b93"
+version = "0.4.2"
+source = "git+https://codeberg.org/simonrepp/enolib-rs?tag=0.4.2#b97102e1890d91f184469f9c778d07df7d117adc"
 
 [[package]]
 name = "equivalent"
@@ -849,12 +929,12 @@ dependencies = [
 
 [[package]]
 name = "faircamp"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "actix-files",
  "actix-web",
  "alac",
- "base64",
+ "base64 0.22.0",
  "bincode",
  "chrono",
  "clap",
@@ -1010,9 +1090,9 @@ dependencies = [
 
 [[package]]
 name = "gif"
-version = "0.12.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80792593675e051cf94a4b111980da2ba60d4a83e43e0048c5693baab3977045"
+checksum = "3fb2d69b19215e18bb912fa30f7ce15846e301408695e44e0ef719f1da9e19f2"
 dependencies = [
  "color_quant",
  "weezl",
@@ -1092,9 +1172,9 @@ dependencies = [
 
 [[package]]
 name = "heck"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
@@ -1186,9 +1266,9 @@ dependencies = [
 
 [[package]]
 name = "id3"
-version = "1.12.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ba0a11a3cf6f08d58a5629531bdb4e7c3b8b595e9812a31a7058b1176c4631e"
+checksum = "79f41f7e5ad125c63d55b112a98afb753742fa7f97692bfbbc52544b89e1ff1f"
 dependencies = [
  "bitflags 2.4.1",
  "byteorder",
@@ -1207,23 +1287,44 @@ dependencies = [
 
 [[package]]
 name = "image"
-version = "0.24.8"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "034bbe799d1909622a74d1193aa50147769440040ff36cb2baa947609b0a4e23"
+checksum = "fd54d660e773627692c524beaad361aca785a4f9f5730ce91f42aabe5bce3d11"
 dependencies = [
  "bytemuck",
  "byteorder",
  "color_quant",
  "exr",
  "gif",
- "jpeg-decoder",
+ "image-webp",
  "num-traits",
  "png",
  "qoi",
+ "ravif",
+ "rayon",
+ "rgb",
  "tiff",
+ "zune-core",
+ "zune-jpeg",
 ]
 
 [[package]]
+name = "image-webp"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a84a25dcae3ac487bc24ef280f9e20c79c9b1a3e5e32cbed3041d1c514aa87c"
+dependencies = [
+ "byteorder",
+ "thiserror",
+]
+
+[[package]]
+name = "imgref"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44feda355f4159a7c757171a77de25daf6411e217b4cabd03bd6650690468126"
+
+[[package]]
 name = "indexmap"
 version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1235,9 +1336,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.4"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "inout"
@@ -1249,6 +1350,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "interpolate_name"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c34819042dc3d3971c46c2190835914dfbe0c3c13f61449b2997f4e9722dfa60"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
 name = "iso_country"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1267,6 +1379,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+dependencies = [
+ "either",
+]
+
+[[package]]
 name = "itoa"
 version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1308,9 +1429,6 @@ name = "jpeg-decoder"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
-dependencies = [
- "rayon",
-]
 
 [[package]]
 name = "js-sys"
@@ -1357,12 +1475,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
 
 [[package]]
+name = "libfuzzer-sys"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a96cfd5557eb82f2b83fed4955246c988d331975a002961b07c81584d107e7f7"
+dependencies = [
+ "arbitrary",
+ "cc",
+ "once_cell",
+]
+
+[[package]]
 name = "libvips"
 version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bfedc1cd1634c8bc74e91653646f4be7ec7630fcd828ae35a35272a0bbfd9e8d"
 dependencies = [
- "num-derive",
+ "num-derive 0.3.3",
  "num-traits",
 ]
 
@@ -1400,6 +1529,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
+name = "loop9"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fae87c125b03c1d2c0150c90365d7d6bcc53fb73a9acaef207d2d065860f062"
+dependencies = [
+ "imgref",
+]
+
+[[package]]
 name = "malloc_buf"
 version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1409,6 +1547,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "maybe-rayon"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea1f30cedd69f0a2954655f7188c6a834246d2bcf1e315e2ac40c4b24dc9519"
+dependencies = [
+ "cfg-if",
+ "rayon",
+]
+
+[[package]]
 name = "memchr"
 version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1529,6 +1677,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
 
 [[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
 name = "nom"
 version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1539,6 +1693,23 @@ dependencies = [
 ]
 
 [[package]]
+name = "noop_proc_macro"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0676bb32a98c1a483ce53e500a81ad9c3d5b3f7c920c28c24e9cb0980d0b5bc8"
+
+[[package]]
+name = "num-bigint"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
 name = "num-derive"
 version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1550,6 +1721,38 @@ dependencies = [
 ]
 
 [[package]]
+name = "num-derive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+dependencies = [
+ "autocfg",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
 name = "num-traits"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1606,9 +1809,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "opus"
@@ -1770,6 +1973,25 @@ dependencies = [
 ]
 
 [[package]]
+name = "profiling"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d84d1d7a6ac92673717f9f6d1518374ef257669c24ebc5ac25d5033828be58"
+dependencies = [
+ "profiling-procmacros",
+]
+
+[[package]]
+name = "profiling-procmacros"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8021cf59c8ec9c432cfc2526ac6b8aa508ecaf29cd415f271b8406c1b851c3fd"
+dependencies = [
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
 name = "pulldown-cmark"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1797,6 +2019,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "quick-error"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+
+[[package]]
 name = "quote"
 version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1836,6 +2064,56 @@ dependencies = [
 ]
 
 [[package]]
+name = "rav1e"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd87ce80a7665b1cce111f8a16c1f3929f6547ce91ade6addf4ec86a8dda5ce9"
+dependencies = [
+ "arbitrary",
+ "arg_enum_proc_macro",
+ "arrayvec",
+ "av1-grain",
+ "bitstream-io",
+ "built",
+ "cfg-if",
+ "interpolate_name",
+ "itertools",
+ "libc",
+ "libfuzzer-sys",
+ "log",
+ "maybe-rayon",
+ "new_debug_unreachable",
+ "noop_proc_macro",
+ "num-derive 0.4.2",
+ "num-traits",
+ "once_cell",
+ "paste",
+ "profiling",
+ "rand",
+ "rand_chacha",
+ "simd_helpers",
+ "system-deps",
+ "thiserror",
+ "v_frame",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "ravif"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc13288f5ab39e6d7c9d501759712e6969fcc9734220846fc9ed26cae2cc4234"
+dependencies = [
+ "avif-serialize",
+ "imgref",
+ "loop9",
+ "quick-error",
+ "rav1e",
+ "rayon",
+ "rgb",
+]
+
+[[package]]
 name = "raw-window-handle"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1900,6 +2178,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
+name = "rgb"
+version = "0.8.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05aaa8004b64fd573fc9d002f4e632d51ad4f026c2b5ba95fcb6c2f32c2c47d8"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
 name = "rmp3"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1963,18 +2250,18 @@ checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090"
 
 [[package]]
 name = "serde"
-version = "1.0.196"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "870026e60fa08c69f064aa766c10f10b1d62db9ccd4d0abb206472bee0ce3b32"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.196"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33c85360c95e7d137454dc81d9a4ed2b8efd8fbe19cee57357b32b9771fccb67"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1993,6 +2280,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "serde_spanned"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2042,6 +2338,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
 
 [[package]]
+name = "simd_helpers"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95890f873bec569a0362c235787f3aca6e1e887302ba4840839bcc6459c42da6"
+dependencies = [
+ "quote",
+]
+
+[[package]]
 name = "slab"
 version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2099,9 +2404,9 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "strsim"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
 
 [[package]]
 name = "subtle"
@@ -2132,6 +2437,25 @@ dependencies = [
 ]
 
 [[package]]
+name = "system-deps"
+version = "6.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
+dependencies = [
+ "cfg-expr",
+ "heck",
+ "pkg-config",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
+
+[[package]]
 name = "thiserror"
 version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2208,9 +2532,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.36.0"
+version = "1.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2251,6 +2575,40 @@ dependencies = [
 ]
 
 [[package]]
+name = "toml"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e40bb779c5187258fd7aad0eb68cb8706a0a81fa712fbea808ab43c4b8374c4"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
+]
+
+[[package]]
 name = "tracing"
 version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2330,12 +2688,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
+name = "v_frame"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f32aaa24bacd11e488aa9ba66369c7cd514885742c9fe08cfe85884db3e92b"
+dependencies = [
+ "aligned-vec",
+ "num-traits",
+ "wasm-bindgen",
+]
+
+[[package]]
 name = "v_htmlescape"
 version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4e8257fbc510f0a46eb602c10215901938b5c2a7d5e70fc11483b1d3c9b5b18c"
 
 [[package]]
+name = "version-compare"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852e951cb7832cb45cb1169900d19760cfa39b82bc0ea9c0e5a14ae88411c98b"
+
+[[package]]
 name = "version_check"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2423,9 +2798,9 @@ dependencies = [
 
 [[package]]
 name = "webbrowser"
-version = "0.8.12"
+version = "0.8.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b2391658b02c27719fc5a0a73d6e696285138e8b12fba9d4baa70451023c71"
+checksum = "d1b04c569c83a9bb971dd47ec6fd48753315f4bf989b9b04a2e7ca4d7f0dc950"
 dependencies = [
  "core-foundation",
  "home",
@@ -2440,9 +2815,9 @@ dependencies = [
 
 [[package]]
 name = "weezl"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"
+checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"
 
 [[package]]
 name = "winapi"
@@ -2674,6 +3049,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
 
 [[package]]
+name = "winnow"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dffa400e67ed5a4dd237983829e66475f0a4a26938c4b04c21baede6262215b8"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
 name = "zerocopy"
 version = "0.7.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2761,6 +3145,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "zune-core"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f423a2c17029964870cfaabb1f13dfab7d092a62a29a89264f4d36990ca414a"
+
+[[package]]
 name = "zune-inflate"
 version = "0.2.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2768,3 +3158,12 @@ checksum = "73ab332fe2f6680068f3582b16a24f90ad7096d5d39b974d1c0aff0125116f02"
 dependencies = [
  "simd-adler32",
 ]
+
+[[package]]
+name = "zune-jpeg"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec866b44a2a1fd6133d363f073ca1b179f438f99e7e5bfb1e33f7181facfe448"
+dependencies = [
+ "zune-core",
+]
diff --git a/pkgs/applications/misc/faircamp/default.nix b/pkgs/applications/misc/faircamp/default.nix
index 9aa92101a1cce..3b1cdf51321b8 100644
--- a/pkgs/applications/misc/faircamp/default.nix
+++ b/pkgs/applications/misc/faircamp/default.nix
@@ -16,20 +16,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "faircamp";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "simonrepp";
     repo = "faircamp";
     rev = version;
-    hash = "sha256-Q0jsqOWeXEfekegxYvq3oIIuVMGyeKL1no2Jh4JByD0=";
+    hash = "sha256-gHlm5ZQ5u+gOSBERlg6iYJxGTfs/+L4y2TY+ZOsVYh8=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "enolib-0.4.1" = "sha256-Uz9AXksD3YO6PjSr29RZCQjdoPiFBTXecbE0fluA0LU=";
+      "enolib-0.4.2" = "sha256-FJuWKcwjoi/wKfTzxghobNWblhnKRdUvHOejhpCF7kY=";
     };
   };
 
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 7fb177d482892..c4dd51951bd2b 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchPypi, requests, yt-dlp, pytestCheckHook }:
+{ lib, buildPythonApplication, fetchPypi, fetchpatch, requests, yt-dlp, pytestCheckHook }:
 
 buildPythonApplication rec {
   pname = "gallery-dl";
@@ -11,6 +11,14 @@ buildPythonApplication rec {
     sha256 = "sha256-PgbfppyJCpgFupBQng8MUPihbDmit4C+xWnSzCJyu5k=";
   };
 
+  patches = [
+    # catch general Exceptions. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/mikf/gallery-dl/commit/5227bb6b1d62ecef5b281592b0d001e7f9c101e3.patch";
+      hash = "sha256-rVsd764siP/07XBPVDnpxMm/4kLiH3fp9+NtpHHH23U=";
+    })
+  ];
+
   propagatedBuildInputs = [
     requests
     yt-dlp
diff --git a/pkgs/applications/misc/inochi2d/creator-dub-lock.json b/pkgs/applications/misc/inochi2d/creator-dub-lock.json
new file mode 100644
index 0000000000000..97570d2d6678b
--- /dev/null
+++ b/pkgs/applications/misc/inochi2d/creator-dub-lock.json
@@ -0,0 +1,148 @@
+{
+  "dependencies": {
+    "bcaa": {
+      "version": "0.0.8",
+      "sha256": "1v8qy98hjdgfsdx6zg9n09sfpfqsh57nbsn8phw82rssi0gysgsr"
+    },
+    "bindbc-loader": {
+      "version": "1.0.3",
+      "sha256": "0d688cwb2hjhfxc7l00cfh22prybsndk6j1hvlrf9nlzb46i4i1j"
+    },
+    "bindbc-sdl": {
+      "version": "1.1.3",
+      "sha256": "0yi472nv7pg1q1kk749w3mv1l2l6ch20k8kcc4l9jy3m2vwlpd88"
+    },
+    "dcv": {
+      "version": "0.3.0",
+      "sha256": "02fd7wig6i618r7l7alw0hfljbwjvq13fkyhwcpsdd7r5x2f7hyk"
+    },
+    "ddbus": {
+      "version": "3.0.0-beta.2",
+      "sha256": "01dgvlvwbhwz7822gp6z5xn6w3k51q09i6qzns2i4ixmjh45wscs"
+    },
+    "diet-ng": {
+      "version": "1.8.1",
+      "sha256": "0kh8haw712xkd3f07s5x5g12nmmkv0y1lk2cqh66298fc5mgj4sv"
+    },
+    "dportals": {
+      "version": "0.1.0",
+      "sha256": "11wxlp2y7s2mc98bxya7fmg0gc4yqlyg0bjsd1yxzr8fmsvf2zzh"
+    },
+    "dunit": {
+      "version": "1.0.16",
+      "sha256": "0p9g4h5qanbg6281x1068mdl5p7zvqig4zmmi72a2cay6dxnbvxb"
+    },
+    "dxml": {
+      "version": "0.4.4",
+      "sha256": "0p5vmkw29ksh5wdxz1ijms1wblq288pv15vnbl93z7q2vgnq995w"
+    },
+    "eventcore": {
+      "version": "0.9.29",
+      "sha256": "1993mibxqb4v7lbsq3kbfwxfpi0d1gzzmzvx6y01907aqz933isa"
+    },
+    "facetrack-d": {
+      "version": "0.7.8",
+      "sha256": "1414wvh0kn1rps5r16ir92sqfj8a7na1gd71ds81jkq8arkm17j0"
+    },
+    "fghj": {
+      "version": "1.0.2",
+      "sha256": "0c102pfbcb3kpr8hpq3qzlxfw460v202vg6hrfdzw5a8pygy4cxj"
+    },
+    "i18n-d": {
+      "version": "1.0.2",
+      "sha256": "1p33w5wh09ha132fsk0b37rjgzw6z3l0v64dixmkvnhhm1xy3b1g"
+    },
+    "i2d-imgui": {
+      "version": "0.8.0",
+      "sha256": "1xikjz5b9r4gml0j7z5k8x1n8h9qcixzsg8gpjlzr3dwis7m0cfw"
+    },
+    "i2d-opengl": {
+      "version": "1.0.0",
+      "sha256": "0137ifda4z6h7sa7ls9n3rpcd6344qsfpbcc0dl7wzyk0xa73912"
+    },
+    "imagefmt": {
+      "version": "2.1.2",
+      "sha256": "0dl7n4myxp1s3b32v2s975k76gs90wr2nw6ac5jq9hsgzhp1ix0h"
+    },
+    "inmath": {
+      "version": "1.0.6",
+      "sha256": "0kzk55ilbnl6qypjk60zwd5ibys5n47128hbbr0mbc7bpj9ppfg4"
+    },
+    "inochi2d": {
+      "version": "0.8.3",
+      "sha256": "1m9dalm6sb518yi9mbphq1fdax90fc5rmskah19l7slnplbhli4l"
+    },
+    "kra-d": {
+      "version": "0.5.5",
+      "sha256": "0dffmf084ykz19y084v936r3f74613d0jifj0wb3xibfcq9mwxqz"
+    },
+    "libasync": {
+      "version": "0.8.6",
+      "sha256": "0hhk5asfdccby8ky77a25qn7dfmfdmwyzkrg3zk064bicmgdwlnj"
+    },
+    "memutils": {
+      "version": "1.0.10",
+      "sha256": "0hm31birbw59sw1bi9syjhbcdgwwwyyx6r9jg7ar9i6a74cjr52c"
+    },
+    "mir-algorithm": {
+      "version": "3.22.0",
+      "sha256": "0pl1vwyyhr2hrxlj060khzhg33dkgyrzi3f5qqxz6xj3hcp7axxq"
+    },
+    "mir-core": {
+      "version": "1.7.0",
+      "sha256": "14k7y2r06pwzf29shymyjrk7l582bh181rc07bnwgjn3f84ayn62"
+    },
+    "mir-linux-kernel": {
+      "version": "1.0.1",
+      "sha256": "0adyjpcgd65z44iydnrrrpjwbvmrm08a3pkcriqi7npqylfysqn6"
+    },
+    "mir-random": {
+      "version": "2.2.19",
+      "sha256": "0ad9ahvyrv5h38aqwn3zvlrva3ikfq28dfhpg2lwwgm31ymzvqpb"
+    },
+    "openssl": {
+      "version": "3.3.3",
+      "sha256": "1fwhd5fkvgbqf3y8gwmrnd42kzi4k3mibpxijw5j82jxgfp1rzsf"
+    },
+    "openssl-static": {
+      "version": "1.0.3+3.0.8",
+      "sha256": "1z977ghlnczxky2q2gislfi68jnbp2zf4pifv8rzrcs0nx3va2jr"
+    },
+    "psd-d": {
+      "version": "0.6.3",
+      "sha256": "0qbwkvzgrvd6m67p14ari4iiajmhfi2x1id4da971qxiprfm1993"
+    },
+    "silly": {
+      "version": "1.1.1",
+      "sha256": "1l0mpnbz8h3ihjxvk5qwn6p6lwb75g259k7fjqasw0zp0c27bkjb"
+    },
+    "stdx-allocator": {
+      "version": "2.77.5",
+      "sha256": "1g8382wr49sjyar0jay8j7y2if7h1i87dhapkgxphnizp24d7kaj"
+    },
+    "taggedalgebraic": {
+      "version": "0.11.22",
+      "sha256": "1kc39sdnk2ybhrwxiwyw1mqcw0qzjr0vr54yvyp3gkkaad373k4r"
+    },
+    "tinyfiledialogs": {
+      "version": "0.10.1",
+      "sha256": "1k3gq9y7912x5b30h60nvlfdr61as1f187b8rsilkxliizcmbhfi"
+    },
+    "vibe-container": {
+      "version": "1.3.0",
+      "sha256": "02gdw7ma93fdvgx3fngmfjd074jh2rzm9qsxakr3zn81p6qnzair"
+    },
+    "vibe-core": {
+      "version": "2.8.2",
+      "sha256": "1g9l8hmjx4dzzwh7pqasc9s16zzbdfvciswbv0gnrvmjsb0pi9xr"
+    },
+    "vibe-d": {
+      "version": "0.9.8",
+      "sha256": "1gficgfzwswaxj9qlnca28c65gl7xq6q8y47qlf4m1gvkxj4ij2k"
+    },
+    "vmc-d": {
+      "version": "1.1.3",
+      "sha256": "0kkqihhzxdq0n46jk55g4yhhwrnw6b9d931yb5pblxcc342gckvm"
+    }
+  }
+}
diff --git a/pkgs/applications/misc/inochi2d/default.nix b/pkgs/applications/misc/inochi2d/default.nix
new file mode 100644
index 0000000000000..9b1c4f67fc7f9
--- /dev/null
+++ b/pkgs/applications/misc/inochi2d/default.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  substituteAll,
+  callPackage,
+}:
+
+# Note for maintainers:
+#
+# These packages are only allowed to be packaged under the the condition that we
+# - patch source/creator/config.d to not point to upstream's bug tracker
+# - use the "barebones" configuration to remove the mascot and logo from the build
+#
+# We have received permission by the owner to go ahead with the packaging, as we have met all the criteria
+# https://github.com/NixOS/nixpkgs/pull/288841#issuecomment-1950247467
+
+let
+  mkGeneric = builderArgs: callPackage ./generic.nix { inherit builderArgs; };
+in
+{
+  inochi-creator = mkGeneric rec {
+    pname = "inochi-creator";
+    appname = "Inochi Creator";
+    version = "0.8.4";
+
+    src = fetchFromGitHub {
+      owner = "Inochi2D";
+      repo = "inochi-creator";
+      rev = "v${version}";
+      hash = "sha256-wsB9KIZyot2Y+6QpQlIXRzv3cPCdwp2Q/ZfDizAKJc4=";
+    };
+
+    dubLock = ./creator-dub-lock.json;
+
+    patches = [
+      # Upstream asks that we change the bug tracker URL to not point to the upsteam bug tracker
+      (substituteAll {
+        src = ./support-url.patch;
+        assignees = "TomaSajt"; # should be a comma separated list of the github usernames of the maintainers
+      })
+      # Change how duplicate locales differentiate themselves (the store paths were too long)
+      ./translations.patch
+    ];
+
+    meta = {
+      # darwin has slightly different build steps
+      broken = stdenv.isDarwin;
+      changelog = "https://github.com/Inochi2D/inochi-creator/releases/tag/${src.rev}";
+      description = "An open source editor for the Inochi2D puppet format";
+    };
+  };
+
+  inochi-session = mkGeneric rec {
+    pname = "inochi-session";
+    appname = "Inochi Session";
+    version = "0.8.3";
+
+    src = fetchFromGitHub {
+      owner = "Inochi2D";
+      repo = "inochi-session";
+      rev = "v${version}";
+      hash = "sha256-yq/uMWEeydZun07/7hgUaAw3IruRqrDuGgbe5NzNYxw=";
+    };
+
+    dubLock = ./session-dub-lock.json;
+
+    preFixup = ''
+      patchelf $out/share/inochi-session/inochi-session --add-needed cimgui.so
+    '';
+
+    dontStrip = true; # symbol lookup error: undefined symbol: , version
+
+    meta = {
+      # darwin has slightly different build steps, aarch fails to build because of some lua related error
+      broken = stdenv.isDarwin || stdenv.isAarch64;
+      changelog = "https://github.com/Inochi2D/inochi-session/releases/tag/${src.rev}";
+      description = "An application that allows streaming with Inochi2D puppets";
+    };
+  };
+}
diff --git a/pkgs/applications/misc/inochi2d/generic.nix b/pkgs/applications/misc/inochi2d/generic.nix
new file mode 100644
index 0000000000000..6666a63ca1ed9
--- /dev/null
+++ b/pkgs/applications/misc/inochi2d/generic.nix
@@ -0,0 +1,139 @@
+{
+  lib,
+  buildDubPackage,
+  fetchFromGitHub,
+  writeShellScriptBin,
+
+  cmake,
+  gettext,
+  copyDesktopItems,
+  makeDesktopItem,
+  makeWrapper,
+
+  dbus,
+  freetype,
+  SDL2,
+  gnome,
+
+  builderArgs,
+}:
+
+let
+  cimgui-src = fetchFromGitHub {
+    owner = "Inochi2D";
+    repo = "cimgui";
+    rev = "49bb5ce65f7d5eeab7861d8ffd5aa2a58ca8f08c";
+    hash = "sha256-XcnZbIjwq7vmYBnMAs+cEpJL8HB8wrL098FXGxC+diA=";
+    fetchSubmodules = true;
+  };
+
+  inherit (builderArgs)
+    pname
+    appname
+    version
+    dubLock
+    meta
+    ;
+in
+buildDubPackage (
+  builderArgs
+  // {
+    nativeBuildInputs = [
+      cmake # used for building `i2d-imgui`
+      gettext # used when generating translations
+      copyDesktopItems
+      makeWrapper
+
+      # A fake git implementation to be used by the `gitver` package
+      # It is a dependency of the main packages and the `inochi2d` dub dependency
+      # A side effect of this script is that `inochi2d` will have the same version listed as the main package
+      (writeShellScriptBin "git" "echo v${version}")
+    ];
+
+    buildInputs = [
+      dbus
+      freetype
+      SDL2
+    ];
+
+    dontUseCmakeConfigure = true;
+
+    # these deps are not listed inside `dub.sdl`, so they didn't get auto-generated
+    # these are used for generating version info when building
+    dubLock = lib.recursiveUpdate (lib.importJSON dubLock) {
+      dependencies = {
+        gitver = {
+          version = "1.6.1";
+          sha256 = "sha256-NCyFik4FbD7yMLd5zwf/w4cHwhzLhIRSVw1bWo/CZB4=";
+        };
+        semver = {
+          version = "0.3.2";
+          sha256 = "sha256-l6c9hniUd5xNsJepq8x30e0JTjmXs4pYUmv4ws+Nrn4=";
+        };
+      };
+    };
+
+    postConfigure = ''
+      cimgui_dir=("$DUB_HOME"/packages/i2d-imgui/*/i2d-imgui)
+
+      # `i2d-imgui` isn't able to find SDL2 by default due to it being written in lower case
+      # this is only an issue when compiling statically (session)
+      substituteInPlace "$cimgui_dir/dub.json" \
+          --replace-fail '"sdl2"' '"SDL2"'
+
+      # The `i2d-cimgui` dub dependency fetched inside the auto-generated `*-deps.nix` file
+      # which doesn't know that it's actually a git repo, so it doesn't fetch its submodules.
+      # Upstream uses a cmake script to fetch the `cimgui` submodule anyway, which we can't do
+      # We get around this by manually pre-fetching the submodule and copying it into the right place
+      cp -r --no-preserve=all ${cimgui-src}/* "$cimgui_dir/deps/cimgui"
+
+      # Disable the original cmake fetcher script
+      substituteInPlace "$cimgui_dir/deps/CMakeLists.txt" \
+          --replace-fail "PullSubmodules(" "# PullSubmodules(" \
+          --replace-fail  "\''${cimgui_SUBMOD_DIR}" "cimgui"
+    '';
+
+    preBuild = ''
+      # Generate translations (if possible)
+      . gentl.sh
+
+      # Use the fake git to generate version info
+      dub build --skip-registry=all --compiler=ldc2 --build=release --config=meta
+    '';
+
+    # Use the "barebones" configuration so that we don't include the mascot and icon files in out build
+    dubFlags = [ "--config=barebones" ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share/${pname}
+      cp -r out/* $out/share/${pname}
+
+      runHook postInstall
+    '';
+
+    desktopItems = [
+      (makeDesktopItem {
+        name = pname;
+        desktopName = appname;
+        exec = pname;
+        comment = meta.description;
+        categories = [ "Utility" ];
+      })
+    ];
+
+    postFixup = ''
+      # Add support for `open file` dialog
+      makeWrapper $out/share/${pname}/${pname} $out/bin/${pname} \
+          --prefix PATH : ${lib.makeBinPath [ gnome.zenity ]}
+    '';
+
+    meta = {
+      homepage = "https://inochi2d.com/";
+      license = lib.licenses.bsd2;
+      mainProgram = pname;
+      maintainers = with lib.maintainers; [ tomasajt ];
+    } // meta;
+  }
+)
diff --git a/pkgs/applications/misc/inochi2d/session-dub-lock.json b/pkgs/applications/misc/inochi2d/session-dub-lock.json
new file mode 100644
index 0000000000000..30a486e549c5c
--- /dev/null
+++ b/pkgs/applications/misc/inochi2d/session-dub-lock.json
@@ -0,0 +1,140 @@
+{
+  "dependencies": {
+    "bindbc-loader": {
+      "version": "1.0.3",
+      "sha256": "0d688cwb2hjhfxc7l00cfh22prybsndk6j1hvlrf9nlzb46i4i1j"
+    },
+    "bindbc-lua": {
+      "version": "0.5.1",
+      "sha256": "116lcplxxl39x6m2sr9zkszdbrm1pa285sjqijnqxqy99jajnhc7"
+    },
+    "bindbc-sdl": {
+      "version": "1.1.3",
+      "sha256": "0yi472nv7pg1q1kk749w3mv1l2l6ch20k8kcc4l9jy3m2vwlpd88"
+    },
+    "bindbc-spout2": {
+      "version": "0.1.1",
+      "sha256": "03r4xsjpwys4nlfhas4hjqygzs764dzsr789b091iczp56pp9w9z"
+    },
+    "ddbus": {
+      "version": "3.0.0-beta.2",
+      "sha256": "01dgvlvwbhwz7822gp6z5xn6w3k51q09i6qzns2i4ixmjh45wscs"
+    },
+    "diet-ng": {
+      "version": "1.8.1",
+      "sha256": "0kh8haw712xkd3f07s5x5g12nmmkv0y1lk2cqh66298fc5mgj4sv"
+    },
+    "dportals": {
+      "version": "0.1.0",
+      "sha256": "11wxlp2y7s2mc98bxya7fmg0gc4yqlyg0bjsd1yxzr8fmsvf2zzh"
+    },
+    "dunit": {
+      "version": "1.0.16",
+      "sha256": "0p9g4h5qanbg6281x1068mdl5p7zvqig4zmmi72a2cay6dxnbvxb"
+    },
+    "eventcore": {
+      "version": "0.9.29",
+      "sha256": "1993mibxqb4v7lbsq3kbfwxfpi0d1gzzmzvx6y01907aqz933isa"
+    },
+    "facetrack-d": {
+      "version": "0.7.8",
+      "sha256": "1414wvh0kn1rps5r16ir92sqfj8a7na1gd71ds81jkq8arkm17j0"
+    },
+    "fghj": {
+      "version": "1.0.2",
+      "sha256": "0c102pfbcb3kpr8hpq3qzlxfw460v202vg6hrfdzw5a8pygy4cxj"
+    },
+    "i18n-d": {
+      "version": "1.0.2",
+      "sha256": "1p33w5wh09ha132fsk0b37rjgzw6z3l0v64dixmkvnhhm1xy3b1g"
+    },
+    "i2d-imgui": {
+      "version": "0.8.0",
+      "sha256": "1xikjz5b9r4gml0j7z5k8x1n8h9qcixzsg8gpjlzr3dwis7m0cfw"
+    },
+    "i2d-opengl": {
+      "version": "1.0.0",
+      "sha256": "0137ifda4z6h7sa7ls9n3rpcd6344qsfpbcc0dl7wzyk0xa73912"
+    },
+    "imagefmt": {
+      "version": "2.1.2",
+      "sha256": "0dl7n4myxp1s3b32v2s975k76gs90wr2nw6ac5jq9hsgzhp1ix0h"
+    },
+    "inmath": {
+      "version": "1.0.6",
+      "sha256": "0kzk55ilbnl6qypjk60zwd5ibys5n47128hbbr0mbc7bpj9ppfg4"
+    },
+    "inochi2d": {
+      "version": "0.8.3",
+      "sha256": "1m9dalm6sb518yi9mbphq1fdax90fc5rmskah19l7slnplbhli4l"
+    },
+    "inui": {
+      "version": "1.2.1",
+      "sha256": "0pygf8jxnbvib5f23qxf6k24wz8mh6fc0zhrkp83gq33k02ab5cx"
+    },
+    "libasync": {
+      "version": "0.8.6",
+      "sha256": "0hhk5asfdccby8ky77a25qn7dfmfdmwyzkrg3zk064bicmgdwlnj"
+    },
+    "lumars": {
+      "version": "1.6.1",
+      "sha256": "1vzdghqwv2gb41rp75456g43yfsndbl0dy6bnn4x6azwwny22br9"
+    },
+    "memutils": {
+      "version": "1.0.10",
+      "sha256": "0hm31birbw59sw1bi9syjhbcdgwwwyyx6r9jg7ar9i6a74cjr52c"
+    },
+    "mir-algorithm": {
+      "version": "3.22.0",
+      "sha256": "0pl1vwyyhr2hrxlj060khzhg33dkgyrzi3f5qqxz6xj3hcp7axxq"
+    },
+    "mir-core": {
+      "version": "1.7.0",
+      "sha256": "14k7y2r06pwzf29shymyjrk7l582bh181rc07bnwgjn3f84ayn62"
+    },
+    "mir-linux-kernel": {
+      "version": "1.0.1",
+      "sha256": "0adyjpcgd65z44iydnrrrpjwbvmrm08a3pkcriqi7npqylfysqn6"
+    },
+    "openssl": {
+      "version": "3.3.3",
+      "sha256": "1fwhd5fkvgbqf3y8gwmrnd42kzi4k3mibpxijw5j82jxgfp1rzsf"
+    },
+    "openssl-static": {
+      "version": "1.0.3+3.0.8",
+      "sha256": "1z977ghlnczxky2q2gislfi68jnbp2zf4pifv8rzrcs0nx3va2jr"
+    },
+    "silly": {
+      "version": "1.1.1",
+      "sha256": "1l0mpnbz8h3ihjxvk5qwn6p6lwb75g259k7fjqasw0zp0c27bkjb"
+    },
+    "stdx-allocator": {
+      "version": "2.77.5",
+      "sha256": "1g8382wr49sjyar0jay8j7y2if7h1i87dhapkgxphnizp24d7kaj"
+    },
+    "taggedalgebraic": {
+      "version": "0.11.22",
+      "sha256": "1kc39sdnk2ybhrwxiwyw1mqcw0qzjr0vr54yvyp3gkkaad373k4r"
+    },
+    "tinyfiledialogs": {
+      "version": "0.10.1",
+      "sha256": "1k3gq9y7912x5b30h60nvlfdr61as1f187b8rsilkxliizcmbhfi"
+    },
+    "vibe-container": {
+      "version": "1.3.0",
+      "sha256": "02gdw7ma93fdvgx3fngmfjd074jh2rzm9qsxakr3zn81p6qnzair"
+    },
+    "vibe-core": {
+      "version": "2.8.2",
+      "sha256": "1g9l8hmjx4dzzwh7pqasc9s16zzbdfvciswbv0gnrvmjsb0pi9xr"
+    },
+    "vibe-d": {
+      "version": "0.9.8",
+      "sha256": "1gficgfzwswaxj9qlnca28c65gl7xq6q8y47qlf4m1gvkxj4ij2k"
+    },
+    "vmc-d": {
+      "version": "1.1.3",
+      "sha256": "0kkqihhzxdq0n46jk55g4yhhwrnw6b9d931yb5pblxcc342gckvm"
+    }
+  }
+}
diff --git a/pkgs/applications/misc/inochi2d/support-url.patch b/pkgs/applications/misc/inochi2d/support-url.patch
new file mode 100644
index 0000000000000..b52377487df8b
--- /dev/null
+++ b/pkgs/applications/misc/inochi2d/support-url.patch
@@ -0,0 +1,13 @@
+diff --git a/source/creator/config.d b/source/creator/config.d
+index 4289703..d8dea4e 100644
+--- a/source/creator/config.d
++++ b/source/creator/config.d
+@@ -30,7 +30,7 @@ enum INC_BANNER_ARTIST_PAGE = "https://mastodon.art/@nighteden";
+ /**
+     URI for bug reports, for unofficial builds this SHOULD be changed.
+ */
+-enum INC_BUG_REPORT_URI = "https://github.com/Inochi2D/inochi-creator/issues/new?assignees=&labels=bug&template=bug-report.yml&title=%5BBUG%5D";
++enum INC_BUG_REPORT_URI = "https://github.com/NixOS/nixpkgs/issues/new?assignees=@assignees@&labels=0.kind%3A+bug&projects=&template=bug_report.md&title=inochi-creator:";
+ 
+ /**
+     URI for feature requests, for the most part this doesn't need to be changed
diff --git a/pkgs/applications/misc/inochi2d/translations.patch b/pkgs/applications/misc/inochi2d/translations.patch
new file mode 100644
index 0000000000000..ee21c8b332833
--- /dev/null
+++ b/pkgs/applications/misc/inochi2d/translations.patch
@@ -0,0 +1,22 @@
+diff --git a/source/creator/core/i18n.d b/source/creator/core/i18n.d
+index 38761dd..f276ca1 100644
+--- a/source/creator/core/i18n.d
++++ b/source/creator/core/i18n.d
+@@ -132,7 +132,7 @@ void markDups(TLEntry[] entries) {
+         // If prevEntry has same humanName as entry before prevEntry, or as this entry,
+         // disambiguate with the source folder
+         if (prevIsDup || entryIsDup) {
+-            prevEntry.humanName ~= " (" ~ prevEntry.path ~ ")";
++            prevEntry.humanName ~= " (" ~ prevEntry.code ~ ")";
+             prevEntry.humanNameC = prevEntry.humanName.toStringz;
+         }
+         prevIsDup = entryIsDup;
+@@ -140,7 +140,7 @@ void markDups(TLEntry[] entries) {
+     }
+ 
+     if (prevIsDup) {
+-        prevEntry.humanName ~= " (" ~ prevEntry.path ~ ")";
++        prevEntry.humanName ~= " (" ~ prevEntry.code ~ ")";
+         prevEntry.humanNameC = prevEntry.humanName.toStringz;
+     }
+ }
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index 882481ace1e07..eacd64b06b557 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -60,8 +60,7 @@ in {
     makeWrapper ${electron_27}/bin/electron $out/bin/${pname} \
       --set "LOCAL_GIT_DIRECTORY" ${git} \
       --add-flags $out/share/${pname}/resources/app \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/applications/misc/opencpn/default.nix b/pkgs/applications/misc/opencpn/default.nix
index 89d656798008e..52cf30b1ffba2 100644
--- a/pkgs/applications/misc/opencpn/default.nix
+++ b/pkgs/applications/misc/opencpn/default.nix
@@ -108,12 +108,13 @@ stdenv.mkDerivation (finalAttrs: {
     wxGTK32
   ] ++ lib.optionals stdenv.isLinux [
     alsa-utils
-    elfutils
     libselinux
     libsepol
     util-linux
     xorg.libXdmcp
     xorg.libXtst
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
+    elfutils
   ] ++ lib.optionals stdenv.isDarwin [
     lame
   ];
diff --git a/pkgs/applications/misc/orca/default.nix b/pkgs/applications/misc/orca/default.nix
index 283970a6e75ef..dcb578dd56789 100644
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@@ -96,7 +96,7 @@ buildPythonApplication rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Projects/Orca";
+    homepage = "https://orca.gnome.org/";
     description = "Screen reader";
     mainProgram = "orca";
     longDescription = ''
diff --git a/pkgs/applications/misc/rtfm/default.nix b/pkgs/applications/misc/rtfm/default.nix
index 9eb97113c37b5..256ed98f9a8cd 100644
--- a/pkgs/applications/misc/rtfm/default.nix
+++ b/pkgs/applications/misc/rtfm/default.nix
@@ -7,10 +7,10 @@
 , desktopToDarwinBundle
 , webkitgtk_6_0
 , sqlite
-, gi-crystal
 , libadwaita
 , gtk4
 , pango
+, substituteAll
 }:
 let
   gtk4' = gtk4.override { x11Support = true; };
@@ -18,42 +18,40 @@ let
 in
 crystal.buildCrystalPackage rec {
   pname = "rtfm";
-  version = "0.2.4";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "hugopl";
     repo = "rtfm";
     rev = "v${version}";
     name = "rtfm";
-    hash = "sha256-IfI7jYM1bsrCq2NiANv/SWkCjPyT/HYUofJMUYy0Sbk=";
+    hash = "sha256-cloaGlHjtwrjuPGzAG55B58w307R+TO+MixAWTw2ags=";
   };
 
   patches = [
     # 1) fixed gi-crystal binding generator command
-    # 2) removed `-v` arg to `cp` command to prevent build failure due to stdout buffer overflow
+    # 2) fixed docset generator command
     # 3) added commands to build gschemas and update icon-cache
-    ./patches/make.patch
-
-    # fixed docset path and gi libs directory names
-    ./patches/friendly-docs-path.patch
-
+    (substituteAll {
+      src = ./make.patch;
+      inherit crystal;
+    })
     # added chmod +w for copied docs to prevent error:
     # `Error opening file with mode 'wb': '.../style.css': Permission denied`
-    ./patches/enable-write-permissions.patch
+    ./enable-write-permissions.patch
   ];
 
   postPatch = ''
-    substituteInPlace Makefile \
-      --replace "crystal run src/create_crystal_docset.cr" "crystal src/create_crystal_docset.cr ${crystal}/share/doc/crystal/api/" \
-      --replace "crystal run src/create_gtk_docset.cr" "crystal src/create_gtk_docset.cr gtk-doc/"
+    substituteInPlace src/doc2dash/create_gtk_docset.cr \
+      --replace-fail 'basedir = Path.new("/usr/share/doc")' 'basedir = Path.new(ARGV[0]? || "gtk-docs")'
   '';
 
   shardsFile = ./shards.nix;
+  copyShardDeps = true;
 
   nativeBuildInputs = [
     wrapGAppsHook4
     gobject-introspection
-    gi-crystal
   ] ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
 
   buildInputs = [
@@ -86,6 +84,7 @@ crystal.buildCrystalPackage rec {
     description = "Dash/docset reader with built in documentation for Crystal and GTK APIs";
     homepage = "https://github.com/hugopl/rtfm/";
     license = licenses.mit;
+    mainProgram = "rtfm";
     maintainers = with maintainers; [ sund3RRR ];
   };
 }
diff --git a/pkgs/applications/misc/rtfm/patches/enable-write-permissions.patch b/pkgs/applications/misc/rtfm/enable-write-permissions.patch
index efdabce083519..8023d647f782a 100644
--- a/pkgs/applications/misc/rtfm/patches/enable-write-permissions.patch
+++ b/pkgs/applications/misc/rtfm/enable-write-permissions.patch
@@ -1,5 +1,5 @@
---- a/src/doc2dash/doc_set_builder.cr	2023-07-19 14:00:06.864770147 +0300
-+++ b/src/doc2dash/doc_set_builder.cr	2023-07-19 13:59:35.440707740 +0300
+--- a/src/doc2dash/docset_builder.cr	2024-04-20 10:45:32.000673168 +0300
++++ b/src/doc2dash/docset_builder.cr	2024-04-20 10:45:56.072895349 +0300
 @@ -44,6 +44,7 @@
        real_dest = @html_dest.join(dest || source)
        Dir.mkdir_p(Path.new(real_dest).dirname)
diff --git a/pkgs/applications/misc/rtfm/make.patch b/pkgs/applications/misc/rtfm/make.patch
new file mode 100644
index 0000000000000..40f327193debf
--- /dev/null
+++ b/pkgs/applications/misc/rtfm/make.patch
@@ -0,0 +1,39 @@
+--- a/Makefile	2024-04-20 10:28:36.697545022 +0300
++++ b/Makefile	2024-04-20 10:37:55.591657540 +0300
+@@ -7,8 +7,10 @@
+ 	shards build --debug -Dpreview_mt
+ 
+ configure:
+-	shards install
+-	./bin/gi-crystal
++	mkdir bin/
++	cd lib/gi-crystal && shards build -Dpreview_mt --release --no-debug
++	cd ../..
++	cp lib/gi-crystal/bin/gi-crystal bin/ && ./bin/gi-crystal
+ 
+ rtfm:
+ 	shards build --release -Dpreview_mt rtfm
+@@ -16,10 +18,10 @@
+ docsets: crystal-docset gtk-docset
+ 
+ crystal-docset:
+-	crystal run src/doc2dash/create_crystal_docset.cr
++	crystal src/doc2dash/create_crystal_docset.cr "@crystal@/share/doc/crystal/api"
+ 
+ gtk-docset:
+-	crystal run src/doc2dash/create_gtk_docset.cr
++	crystal src/doc2dash/create_gtk_docset.cr "gtk-doc/"
+ 
+ test: crystal-docset gtk-docset
+ 	crystal spec
+@@ -28,8 +30,10 @@
+ 	install -D -m 0755 bin/rtfm $(DESTDIR)$(PREFIX)/bin/rtfm
+ 	install -D -m 0644 data/io.github.hugopl.rtfm.desktop $(DESTDIR)$(PREFIX)/share/applications/io.github.hugopl.rtfm.desktop
+ 	install -D -m 0644 data/icons/hicolor/scalable/apps/io.github.hugopl.rtfm.svg $(DESTDIR)$(PREFIX)/share/icons/hicolor/scalable/apps/io.github.hugopl.rtfm.svg
++	gtk4-update-icon-cache --ignore-theme-index $(PREFIX)/share/icons/hicolor
+ 	# Settings schema
+ 	install -D -m644 data/io.github.hugopl.rtfm.gschema.xml $(DESTDIR)$(PREFIX)/share/glib-2.0/schemas/io.github.hugopl.rtfm.gschema.xml
++	glib-compile-schemas $(DESTDIR)$(PREFIX)/share/glib-2.0/schemas
+ 	# docsets
+ 	mkdir -p $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
+ 	cp -r data/Crystal.docset $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
diff --git a/pkgs/applications/misc/rtfm/patches/friendly-docs-path.patch b/pkgs/applications/misc/rtfm/patches/friendly-docs-path.patch
deleted file mode 100644
index cecbeb750b300..0000000000000
--- a/pkgs/applications/misc/rtfm/patches/friendly-docs-path.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/create_gtk_docset.cr	2023-07-17 14:28:04.882620660 +0300
-+++ b/src/create_gtk_docset.cr	2023-07-17 14:27:09.660643747 +0300
-@@ -136,7 +136,7 @@
- end
- 
- def find_modules : Array(Path)
--  basedir = Path.new("/usr/share/doc")
-+  basedir = Path.new(ARGV[0]? || "gtk-docs")
-   MODULES.compact_map do |mod|
-     print "#{mod.ljust(20, '.')}"
-     mod_dir = basedir.join(mod)
diff --git a/pkgs/applications/misc/rtfm/patches/make.patch b/pkgs/applications/misc/rtfm/patches/make.patch
deleted file mode 100644
index 51b95575cd0d6..0000000000000
--- a/pkgs/applications/misc/rtfm/patches/make.patch
+++ /dev/null
@@ -1,21 +0,0 @@
---- a/Makefile	2023-12-07 23:37:38.984501858 +0300
-+++ b/Makefile	2023-12-07 23:47:52.884456064 +0300
-@@ -4,8 +4,7 @@
- all: configure .WAIT rtfm docsets
- 
- configure:
--	shards install
--	./bin/gi-crystal
-+	gi-crystal
- 
- rtfm:
- 	shards build --release -s rtfm
-@@ -36,6 +35,8 @@
- 	# Changelog
- 	install -D -m0644 CHANGELOG.md $(DESTDIR)$(PREFIX)/share/doc/rtfm/CHANGELOG.md
- 	gzip -9fn $(DESTDIR)$(PREFIX)/share/doc/rtfm/CHANGELOG.md
-+	gtk4-update-icon-cache --ignore-theme-index $(PREFIX)/share/icons/hicolor
-+	glib-compile-schemas $(DESTDIR)$(PREFIX)/share/glib-2.0/schemas
- 
- uninstall:
- 	rm -f $(DESTDIR)$(PREFIX)/bin/rtfm
diff --git a/pkgs/applications/misc/rtfm/shards.nix b/pkgs/applications/misc/rtfm/shards.nix
index 0a7ce34cda62e..79a2eeb2f0db3 100644
--- a/pkgs/applications/misc/rtfm/shards.nix
+++ b/pkgs/applications/misc/rtfm/shards.nix
@@ -6,18 +6,18 @@
   };
   fzy = {
     url = "https://github.com/hugopl/fzy.git";
-    rev = "v0.5.5";
-    sha256 = "1zk95m43ymx9ilwr6iw9l44nkmp4sas28ib0dkr07hkhgrkw68sv";
+    rev = "6c2395bcdea1889969d0d08c16163c276fe4e473";
+    sha256 = "0vpradafkwckfsq7wqrgkpsli7bfmgc27d38q06l1jzq0z0j92rw";
   };
-  gio = {
-    url = "https://github.com/hugopl/gio.cr.git";
-    rev = "v0.2.1";
-    sha256 = "0vl5lpvhhdi9pvyl12smag0i3dwj1jjz1zzilc8ai0wjrnbnwlxs";
+  gi-crystal = {
+    url = "https://github.com/hugopl/gi-crystal.git";
+    rev = "v0.22.2";
+    sha256 = "0bpa1f8iaf97z2kbgjc7nc8km7nd7bppiwna319lm2hvm8m5pw15";
   };
   gtk4 = {
     url = "https://github.com/hugopl/gtk4.cr.git";
-    rev = "v0.16.0";
-    sha256 = "1bnnfy07246vwbjfwhziv2yw1g52pzhhrr25660fp3qcnw8q513w";
+    rev = "v0.16.1";
+    sha256 = "1cqkbh072y70l8g0p040vf50k920p32ry1larnwn9mqabd74jwaj";
   };
   harfbuzz = {
     url = "https://github.com/hugopl/harfbuzz.cr.git";
@@ -31,8 +31,8 @@
   };
   pango = {
     url = "https://github.com/hugopl/pango.cr.git";
-    rev = "v0.3.0";
-    sha256 = "1dg5bcbq11zww4xh68dq4ivnsz89yqsnxz81ggp4j9c9d6dhx0m4";
+    rev = "v0.3.1";
+    sha256 = "0xlf127flimnll875mcq92q7xsi975rrgdpcpmnrwllhdhfx9qmv";
   };
   sqlite3 = {
     url = "https://github.com/crystal-lang/crystal-sqlite3.git";
diff --git a/pkgs/applications/misc/shell-genie/default.nix b/pkgs/applications/misc/shell-genie/default.nix
index 63294e4048210..728a4aabed381 100644
--- a/pkgs/applications/misc/shell-genie/default.nix
+++ b/pkgs/applications/misc/shell-genie/default.nix
@@ -21,12 +21,15 @@ buildPythonPackage rec {
     "typer"
   ];
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
+  ];
+
+  nativeBuildInputs = [
     pythonRelaxDepsHook
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     colorama
     openai
     pyperclip
@@ -44,9 +47,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Describe your shell commands in natural language";
-    mainProgram = "shell-genie";
     homepage = "https://github.com/dylanjcastillo/shell-genie";
     license = licenses.mit;
     maintainers = with maintainers; [ onny ];
+    mainProgram = "shell-genie";
   };
 }
diff --git a/pkgs/applications/misc/systembus-notify/default.nix b/pkgs/applications/misc/systembus-notify/default.nix
index f05c8a0aa0746..c059c566fecd3 100644
--- a/pkgs/applications/misc/systembus-notify/default.nix
+++ b/pkgs/applications/misc/systembus-notify/default.nix
@@ -17,7 +17,9 @@ let
       Type = "exec";
       ExecStart = "@out@/bin/systembus-notify";
       PrivateTmp = true;
-      ProtectHome = true;
+      # NB. We cannot `ProtectHome`, or it would block session dbus access.
+      InaccessiblePaths = "/home";
+      ReadOnlyPaths = "/run/user";
       ProtectSystem = "strict";
       Restart = "on-failure";
       Slice = "background.slice";
diff --git a/pkgs/applications/misc/trenchbroom/default.nix b/pkgs/applications/misc/trenchbroom/default.nix
index 83db22260d83d..df7cb0a083923 100644
--- a/pkgs/applications/misc/trenchbroom/default.nix
+++ b/pkgs/applications/misc/trenchbroom/default.nix
@@ -2,19 +2,19 @@
 , cmake, ninja, curl, git, pandoc, pkg-config, unzip, zip
 , libGL, libGLU, freeimage, freetype, assimp
 , catch2, fmt, glew, miniz, tinyxml-2, xorg
-, qtbase, wrapQtAppsHook
+, qtbase, qtwayland, wrapQtAppsHook
 , copyDesktopItems, makeDesktopItem
 }:
 
 stdenv.mkDerivation rec {
   pname = "TrenchBroom";
-  version = "2023.1";
+  version = "2024.1";
 
   src = fetchFromGitHub {
     owner = "TrenchBroom";
     repo = "TrenchBroom";
     rev = "v${version}";
-    sha256 = "sha256-62xcFKSqxPS+J54+kLo/hewM+Wu/rVBGD8oiECDCJpA=";
+    hash = "sha256-HNK/gLbew7MKN6GVStxDb2tyMgyw2l1+dhPr6fSaZ4A=";
     fetchSubmodules = true;
   };
   # Manually simulate a vcpkg installation so that it can link the libraries
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ninja curl git pandoc wrapQtAppsHook copyDesktopItems pkg-config unzip zip ];
   buildInputs = [
     libGL libGLU xorg.libXxf86vm xorg.libSM
-    freeimage freetype qtbase catch2 fmt
+    freeimage freetype qtbase qtwayland catch2 fmt
     glew miniz tinyxml-2 assimp
   ];
   QT_PLUGIN_PATH = "${qtbase}/${qtbase.qtPluginPrefix}";
diff --git a/pkgs/applications/misc/ttyper/default.nix b/pkgs/applications/misc/ttyper/default.nix
index de72638d19ffe..180b09771ce3e 100644
--- a/pkgs/applications/misc/ttyper/default.nix
+++ b/pkgs/applications/misc/ttyper/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttyper";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "max-niederman";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IvAx65b2rGsMdDUhRxTx8cyqnG7oxC+MseCFIJil1e0=";
+    hash = "sha256-L6xdJ659ZWKNg9CGQs+5TQIKoIAZ5KHdFSk7NCp9a2Q=";
   };
 
-  cargoHash = "sha256-o3J2bEAV5NnWKFadJdSGTqUS8K2qpBKPQz6xAbfLtg4=";
+  cargoHash = "sha256-iOeyn4oXk6y/NqZeBwkStBjt3hVVw4s2L5Lm58tq1BY=";
 
   meta = with lib; {
     description = "Terminal-based typing test";
diff --git a/pkgs/applications/misc/writefreely/default.nix b/pkgs/applications/misc/writefreely/default.nix
index fe1d221bd274c..d505ae2e380a0 100644
--- a/pkgs/applications/misc/writefreely/default.nix
+++ b/pkgs/applications/misc/writefreely/default.nix
@@ -2,16 +2,20 @@
 
 buildGoModule rec {
   pname = "writefreely";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "writefreely";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vOoTAr33FMQaHIwpwIX0g/KJWQvDn3oVJg14kEY6FIQ=";
+    sha256 = "sha256-7KTNimthtfmQCgyXevAEj+CZ2MS+uOby73OO1fGNXfs=";
   };
 
-  vendorHash = "sha256-xTo/zbz9pSjvNntr5dnytiJ7oRAdtEuyiu4mJZgwHTc=";
+  vendorHash = "sha256-6RTshhxX+w/gdK53wCHVMpm6EkkRtEJ2/Fe7MfZ0WvY=";
+
+  patches = [
+    ./fix-go-version-error.patch
+  ];
 
   ldflags = [ "-s" "-w" "-X github.com/writefreely/writefreely.softwareVer=${version}" ];
 
diff --git a/pkgs/applications/misc/writefreely/fix-go-version-error.patch b/pkgs/applications/misc/writefreely/fix-go-version-error.patch
new file mode 100644
index 0000000000000..bfe7ba2dd5dc4
--- /dev/null
+++ b/pkgs/applications/misc/writefreely/fix-go-version-error.patch
@@ -0,0 +1,36 @@
+diff --git a/go.mod b/go.mod
+index c49d701..601443d 100644
+--- a/go.mod
++++ b/go.mod
+@@ -89,4 +89,6 @@ require (
+ 	gopkg.in/yaml.v3 v3.0.1 // indirect
+ )
+ 
+-go 1.19
++go 1.21
++
++toolchain go1.21.6
+diff --git a/go.sum b/go.sum
+index a9256ea..28ad24f 100644
+--- a/go.sum
++++ b/go.sum
+@@ -72,6 +72,7 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
+ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
++github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+ github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
+ github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+ github.com/gorilla/csrf v1.7.2 h1:oTUjx0vyf2T+wkrx09Trsev1TE+/EbDAeHtSTbtC2eI=
+@@ -106,9 +107,11 @@ github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVY
+ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+ github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
++github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
++github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+ github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec h1:ZXWuspqypleMuJy4bzYEqlMhJnGAYpLrWe5p7W3CdvI=
+ github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec/go.mod h1:voECJzdraJmolzPBgL9Z7ANwXf4oMXaTCsIkdiPpR/g=
+ github.com/mailgun/mailgun-go v2.0.0+incompatible h1:0FoRHWwMUctnd8KIR3vtZbqdfjpIMxOZgcSa51s8F8o=
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 54697febefe32..df33a2bbe7571 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -102,7 +102,14 @@ let
     "flac"
     "libjpeg"
     "libpng"
+  ] ++ lib.optionals (!chromiumVersionAtLeast "124") [
+    # Use the vendored libwebp for M124+ until we figure out how to solve:
+    # Running phase: configurePhase
+    # ERROR Unresolved dependencies.
+    # //third_party/libavif:libavif_enc(//build/toolchain/linux/unbundle:default)
+    #   needs //third_party/libwebp:libwebp_sharpyuv(//build/toolchain/linux/unbundle:default)
     "libwebp"
+  ] ++ [
     "libxslt"
     # "opus"
   ];
@@ -241,6 +248,15 @@ let
       # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
       # allowing us to use our rustc and our clang.
       ./patches/chromium-121-rust.patch
+    ] ++ lib.optionals (chromiumVersionAtLeast "124" && !chromiumVersionAtLeast "125") [
+      # M124 shipped with broken --ozone-platform-hint flag handling, which we rely on
+      # for our NIXOS_OZONE_WL (wayland) environment variable.
+      # See <https://issues.chromium.org/issues/329678163>.
+      # This is the commit for the fix that landed in M125, which applies clean on M124.
+      (githubPatch {
+        commit = "c7f4c58f896a651eba80ad805ebdb49d19ebdbd4";
+        hash = "sha256-6nYWT2zN+j73xAIXLdGYT2eC71vGnGfiLCB0OwT0CAI=";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 2597d293ac63a..d75b5df530328 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -9,15 +9,15 @@
     };
     deps = {
       gn = {
-        hash = "sha256-JvilCnnb4laqwq69fay+IdAujYC1EHD7uWpkF/C8tBw=";
-        rev = "d4f94f9a6c25497b2ce0356bb99a8d202c8c1d32";
+        hash = "sha256-aEL1kIhgPAFqdb174dG093HoLhCJ07O1Kpqfu7r14wQ=";
+        rev = "22581fb46c0c0c9530caa67149ee4dd8811063cf";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-02-19";
+        version = "2024-03-14";
       };
     };
-    hash = "sha256-7H7h621AHPyhFYbaVFO892TtS+SP3Qu7cYUVk3ICL14=";
-    hash_deb_amd64 = "sha256-tNkO1mPZg1xltBfoWeNhLekITtZV/WNgu//i2DJb17c=";
-    version = "123.0.6312.122";
+    hash = "sha256-apEniFKhIxPo4nhp9gCU+WpiV/EB40qif4RfE7Uniog=";
+    hash_deb_amd64 = "sha256-rSbigG5/xbL32d1ntOn6gnZyxSpgrg1h7lb/RD4YROI=";
+    version = "124.0.6367.60";
   };
   ungoogled-chromium = {
     deps = {
diff --git a/pkgs/applications/networking/cluster/k3s/README.md b/pkgs/applications/networking/cluster/k3s/README.md
index 9e3c32623ac3f..c01a9ceab817f 100644
--- a/pkgs/applications/networking/cluster/k3s/README.md
+++ b/pkgs/applications/networking/cluster/k3s/README.md
@@ -75,11 +75,11 @@ This would allow someone to upgrade between those NixOS releases in a supported
 
 ## K3s upkeep for nixpkgs maintainers
 
-* A `nixos-stable` release triggers the need of re-setting K3s versions in `nixos-unstable` branch to a single K3s version. After every `nixos-stable` release, K3s maintainers should remove all K3s versions in `nixos-unstable` branch but the latest. While `nixos-stable` keeps the multiple K3s versions necessary for a smooth upgrade to `nixos-unstable`.
+* After every nixos release, K3s maintainers should remove from `nixos-unstable` all K3s versions that exist in `nixos-stable` except the latest version (to allow decoupling system upgrade from k3s upgrade).
 
 * Whenever adding a new major/minor K3s version to nixpkgs:
   - update `k3s` alias to the latest version.
-  - add a NixOS release note scheduling the removal of all K3s packages but the latest
+  - add a NixOS release note scheduling the removal of deprecated K3s packages
   - include migration information from both Kubernetes and K3s projects
 
 * For version patch upgrades, use the K3s update script.
@@ -111,4 +111,4 @@ This would allow someone to upgrade between those NixOS releases in a supported
 
   - Read the nix build logs to check for anything unusual. (Obvious but underrated.)
 
-* Thank you for reading the documentation and your continued contribution.
+* Thanks for reading the documentation and your continued contribution.
diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index 01f05ba65ac94..e4d704d6ff27d 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.4.3";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = "kubefirst";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wxIXXCB7+s3RfDjSxwlp0BBTZMb/9GFZ7cYm7L471U8=";
+    hash = "sha256-CkssgMr/4VGNQHyvaPnXBOf6HdExnhB7MjpJ3yQ9kfI=";
   };
 
   vendorHash = "sha256-ZcZl4knlyKAwTsiyZvlkN5e2ox30B5aNzutI/2UEE9U=";
diff --git a/pkgs/applications/networking/cluster/kubelogin/default.nix b/pkgs/applications/networking/cluster/kubelogin/default.nix
index b2fa146b0bc30..b52a4887824cb 100644
--- a/pkgs/applications/networking/cluster/kubelogin/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JBP2lE1/46VB/oKgDlNTQ8RFpgIlQE0If5vND7dzo7A=";
+    sha256 = "sha256-mQSQrcLzEZqNpXNuZFCVk3FRcfkrtvN19VhwqyrmwIU=";
   };
 
-  vendorHash = "sha256-EwL/aiq2jyojM1r7wNZkA07TswHy6MLUUPQJFnaDG4A=";
+  vendorHash = "sha256-Xh4htBknBW59xdJVYw7A7BT2GB5WW8SnV05is7dWAS8=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/applications/networking/cluster/kubevpn/default.nix b/pkgs/applications/networking/cluster/kubevpn/default.nix
index 13b45f748ab73..14df6fa5c47d0 100644
--- a/pkgs/applications/networking/cluster/kubevpn/default.nix
+++ b/pkgs/applications/networking/cluster/kubevpn/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubevpn";
-  version = "2.2.5";
+  version = "2.2.6";
 
   src = fetchFromGitHub {
     owner  = "KubeNetworks";
     repo   = "kubevpn";
     rev    = "v${version}";
-    hash = "sha256-I4szQNRBW3M+QNwsfkJZlrZL3jJXcXmD2KnFF/E+jaE=";
+    hash = "sha256-Z+IXSmN1V0xRnhE/PpWv9dQIwfTztJRYaftY9KCIucc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/linkerd/edge.nix b/pkgs/applications/networking/cluster/linkerd/edge.nix
index e268dadd262dd..f40dc62474764 100644
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "24.4.2";
-  sha256 = "0apwhbcnghy7b9kwalbhcgvgcrwv6s55gzlgax55qaa5lxm6r6yz";
+  version = "24.4.4";
+  sha256 = "07p4cgl4myv7kv9pxvxrvsqnl3vkd9ay5hngx5g6xds2sc8va306";
   vendorHash = "sha256-bLTummNoDfGMYvtfSLxICgCFZEymPJcRWkQyWOSzKR8=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 3fcbfcbf4649c..db8a8be7a8718 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -16,7 +16,6 @@
 , AppKit
 , CoreServices
 , desktopToDarwinBundle
-, libnotify
 , useKeytar ? true
 }:
 
@@ -79,11 +78,6 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
   '';
 
   installPhase =
-    let
-      libPath = lib.makeLibraryPath [
-        libnotify
-      ];
-    in
   ''
     runHook preInstall
 
@@ -111,7 +105,6 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
     # LD_PRELOAD workaround for sqlcipher not found: https://github.com/matrix-org/seshat/issues/102
     makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
       --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher.so \
-      --set LD_LIBRARY_PATH "${libPath}" \
       --add-flags "$out/share/element/electron" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
 
diff --git a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
index 318f7a11c54bf..83a3b78e1d4bd 100644
--- a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
@@ -10,7 +10,6 @@
 , libXtst
 , zlib
 , electron
-, pipewire
 }:
 
 buildNpmPackage rec {
@@ -72,7 +71,6 @@ buildNpmPackage rec {
 
     makeWrapper ${lib.getExe electron} $out/bin/jitsi-meet-electron \
         --add-flags $out/share/jitsi-meet-electron/resources/app.asar \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ pipewire ]} \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
         --inherit-argv0
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
index 2e13a66377358..62b6e1c9a4847 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "7.4.0-beta.2";
+  version = "7.6.0-beta.3";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-oBkZ9BaKbmosTkC/OZFjt6PmU/9XqclyzbllwYPj3Q4=";
+  hash = "sha256-BbXogNB2BxFQTpvHw0JVOaCV2PQHEQbafSavVcBd/Fg=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index 0d4d46be06b4a..130508f95e30b 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.4.0";
+  version = "7.5.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-9a8Y8ncatynKspC/q0YxUWJj+nENr1ArwCZA9Ng8Mxk=";
+  hash = "sha256-afKR+P2YPkv4OMIr8LzWeAMZWr0zaJ1R0BQD87gQuSk=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 6c976fdd0a433..f59b9c3774bc6 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -9,9 +9,6 @@
 , fetchYarnDeps
 , fixup-yarn-lock
 , electron
-, libnotify
-, libpulseaudio
-, pipewire
 , alsa-utils
 , which
 , testers
@@ -72,11 +69,10 @@ stdenv.mkDerivation (finalAttrs: {
     done
     popd
 
-    # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, 'libpipewire' for screen sharing and 'libnotify' for notifications
+    # Linux needs 'aplay' for notification sounds
     makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
       ${lib.optionalString stdenv.isLinux ''
         --prefix PATH : ${lib.makeBinPath [ alsa-utils which ]} \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire libnotify ]} \
       ''} \
       --add-flags "$out/share/teams-for-linux/app.asar" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
diff --git a/pkgs/applications/networking/instant-messengers/webcord/default.nix b/pkgs/applications/networking/instant-messengers/webcord/default.nix
index d2796142e8f7d..aebe2998bd277 100644
--- a/pkgs/applications/networking/instant-messengers/webcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/default.nix
@@ -3,9 +3,6 @@
 , fetchFromGitHub
 , copyDesktopItems
 , python3
-, pipewire
-, libpulseaudio
-, libnotify
 , xdg-utils
 , electron_29
 , makeDesktopItem
@@ -42,11 +39,6 @@ buildNpmPackage rec {
   # override installPhase so we can copy the only folders that matter
   installPhase =
     let
-      libPath = lib.makeLibraryPath [
-        libpulseaudio
-        pipewire
-        libnotify
-      ];
       binPath = lib.makeBinPath [ xdg-utils ];
     in
   ''
@@ -62,7 +54,6 @@ buildNpmPackage rec {
 
     # Add xdg-utils to path via suffix, per PR #181171
     makeWrapper '${lib.getExe electron_29}' $out/bin/webcord \
-      --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/webcord \
       --suffix PATH : "${binPath}" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
       --add-flags $out/lib/node_modules/webcord/
diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
index 9aaba98710e30..4109c5f04cf27 100644
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@@ -26,19 +26,19 @@ let
   pname = "wire-desktop";
 
   version = let
-    x86_64-darwin = "3.32.4589";
+    x86_64-darwin = "3.35.4861";
   in {
     inherit x86_64-darwin;
     aarch64-darwin = x86_64-darwin;
-    x86_64-linux = "3.32.3079";
+    x86_64-linux = "3.35.3348";
   }.${system} or throwSystem;
 
   hash = let
-    x86_64-darwin = "sha256-PDAZCnkgzlausdtwycK+PHfp+zmL33VnX6RzCsgBTZ4=";
+    x86_64-darwin = "sha256-QPxslMEz1jOH2LceFOdCyVDtpya1SfJ8GWMIAIhie4U=";
   in {
     inherit x86_64-darwin;
     aarch64-darwin = x86_64-darwin;
-    x86_64-linux = "sha256-+4aRis141ctI50BtBwipoVtPoMGRs82ENqZ+y2ZlL58=";
+    x86_64-linux = "sha256-KtDUuAzD53mFJ0+yywp0Q2/hx9MGsOhFjRLWsZAd+h0=";
   }.${system} or throwSystem;
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 5c96be3bb82e1..cdf8f4f886d60 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -179,7 +179,7 @@ stdenv.mkDerivation rec {
       --prefix PATH : ${lib.makeBinPath [ coreutils glib.dev pciutils procps util-linux ]} \
       --prefix LD_LIBRARY_PATH ":" ${libs}
 
-    # Backwards compatiblity: we used to call it zoom-us
+    # Backwards compatibility: we used to call it zoom-us
     ln -s $out/bin/{zoom,zoom-us}
   '';
 
diff --git a/pkgs/applications/networking/iroh/default.nix b/pkgs/applications/networking/iroh/default.nix
index a436204999963..52e2f0d47c773 100644
--- a/pkgs/applications/networking/iroh/default.nix
+++ b/pkgs/applications/networking/iroh/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "iroh";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-lyDwvVPkHCHZtb/p5PixD31Rl9kXozHw/SxIH1MJPwo=";
+    hash = "sha256-r4sE/1RI/Y6gDMApwlr4Gf6Jvl0zNCAahduXyRtFboE=";
   };
 
-  cargoHash = "sha256-yCI6g/ZTC5JLxwICRDmH4TzUYQtj3PJXdhBD7JSGO1s=";
+  cargoHash = "sha256-N9MsYz7QTm04k5eMdwqj4wTQ36SoaJBqvsty58Pg8tU=";
 
   buildInputs = lib.optionals stdenv.isDarwin (
     with darwin.apple_sdk.frameworks; [
diff --git a/pkgs/applications/networking/maestral-qt/default.nix b/pkgs/applications/networking/maestral-qt/default.nix
index 51fde794a1c8b..195fdc8556420 100644
--- a/pkgs/applications/networking/maestral-qt/default.nix
+++ b/pkgs/applications/networking/maestral-qt/default.nix
@@ -10,14 +10,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "maestral-qt";
-  version = "1.8.0";
+  version = "1.9.2";
   disabled = python3.pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral-qt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ys7XrvV4qzq4Q9llua2WgU013Ui0+x+uMwLNIv6xxCw=";
+    hash = "sha256-dgiVSwCTNDncbPJ+f0grjtq822TvtG0PhC9gDOKhwRI=";
   };
 
   format = "pyproject";
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 956842ca9bccd..5a55476d4b9e4 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -44,13 +44,13 @@ rec {
 
   thunderbird-115 = (buildMozillaMach rec {
     pname = "thunderbird";
-    version = "115.9.0";
+    version = "115.10.1";
     application = "comm/mail";
     applicationName = "Mozilla Thunderbird";
     binaryName = pname;
     src = fetchurl {
       url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      sha512 = "8ff0bed6e6d7f337ebae09011a10b59343ae7a8355ed1da2d72ec0d4218010adfae78e42565e5b784df26cef4702f313dc9616ac5ca5530fb772d77bdf7f2ea4";
+      sha512 = "0324811d3e7e6228bb45cbf01e8a4a08b8386e22d1b52eb79f9a9a3bda940eb9d534ec1230961e9a998a0162c299a1ad49d23c5fbfa8e287896bcc0fd1c398e0";
     };
     extraPatches = [
       # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
diff --git a/pkgs/applications/networking/protonvpn-gui/default.nix b/pkgs/applications/networking/protonvpn-gui/default.nix
index e273a3242739d..2930ef450ea25 100644
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonApplication rec {
   pname = "protonvpn-gui";
-  version = "4.1.10";
+  version = "4.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D06dMMjzFE7gIGFpIH/+0xmVCckqAWLkb3lc2ZmxNZs=";
+    hash = "sha256-H4m4u9zksab47W5aIsQZPQTPEYiXbmrVCnT67b+A5Tc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index 0d8b3d78ec05d..8fb607979100d 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -54,6 +54,10 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_64) [
     # fix `multiversioning needs 'ifunc' which is not supported on this target` error
     "--disable-roll-simd"
+  ] ++ lib.optionals (!enableZstd) [
+    "--disable-zstd"
+  ] ++ lib.optionals (!enableXXHash) [
+    "--disable-xxhash"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/networking/synology-drive-client/default.nix b/pkgs/applications/networking/synology-drive-client/default.nix
index 84ca42cec167a..172e5bfb669a4 100644
--- a/pkgs/applications/networking/synology-drive-client/default.nix
+++ b/pkgs/applications/networking/synology-drive-client/default.nix
@@ -2,7 +2,7 @@
 let
   pname = "synology-drive-client";
   baseUrl = "https://global.synologydownload.com/download/Utility/SynologyDriveClient";
-  version = "3.4.0-15724";
+  version = "3.5.0-16084";
   buildNumber = with lib; last (splitString "-" version);
   meta = with lib; {
     description = "Desktop application to synchronize files and folders between the computer and the Synology Drive server.";
@@ -10,7 +10,7 @@ let
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ jcouyang MoritzBoehme ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
     mainProgram = "synology-drive";
   };
   passthru.updateScript = writeScript "update-synology-drive-client" ''
@@ -30,7 +30,7 @@ let
 
     src = fetchurl {
       url = "${baseUrl}/${version}/Ubuntu/Installer/synology-drive-client-${buildNumber}.x86_64.deb";
-      sha256 = "sha256-Zf6JMghXy8ODbR4MhVSPmD4QDu003MTc7YNfbiRVRoY=";
+      sha256 = "sha256-Spl6DC+wf+JaXjwH2ecraySo1VtA+EiI3/TWw9UOSA8=";
     };
 
     nativeBuildInputs = [ autoPatchelfHook dpkg ];
@@ -60,7 +60,7 @@ let
 
     src = fetchurl {
       url = "${baseUrl}/${version}/Mac/Installer/synology-drive-client-${buildNumber}.dmg";
-      sha256 = "sha256-65mZeRYHGl+n9TeTx7bxRrGPjcZiV9UlyfcCZ3GwOhE=";
+      sha256 = "sha256-NDYxUhWtAVUtpCf1WemqShZCFHGgLGwrkX6HldxOlH0=";
     };
 
     nativeBuildInputs = [ cpio xar undmg ];
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
index c8e218a3fdffa..9537ab4c17846 100644
--- a/pkgs/applications/networking/twingate/default.nix
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "twingate";
-  version = "2024.63.115357";
+  version = "2024.98.119300";
 
   src = fetchurl {
     url = "https://binaries.twingate.com/client/linux/DEB/x86_64/${version}/twingate-amd64.deb";
-    hash = "sha256-VSm9gnHfo9LPwUvNwLeX7OjqMYgFUgGYSxx/qDndfwo=";
+    hash = "sha256-N0cabYHaF5H1EeriQRQL7bN5UM85oOGrm9pxGr1AlEk=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/office/super-productivity/default.nix b/pkgs/applications/office/super-productivity/default.nix
index eb97565cb760d..9b32967159275 100644
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "super-productivity";
-  version = "8.0.1";
+  version = "8.0.5";
 
   src = fetchurl {
     url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-BW/4jP4lh3leAcdy3JHET/PUybN+0Cy9wxMSi57dAcw=";
+    sha256 = "sha256-nH7dCrXBhkAYbvb9CPc4zhslFiYtA1ChuYPoHMdBBwQ=";
     name = "${pname}-${version}.AppImage";
   };
 
@@ -38,8 +38,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ]}"
+      --add-flags $out/share/${pname}/resources/app.asar
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/radio/gqrx/default.nix b/pkgs/applications/radio/gqrx/default.nix
index 1079b2c19641b..a574066045718 100644
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@@ -27,13 +27,13 @@ assert !(pulseaudioSupport && portaudioSupport);
 
 gnuradioMinimal.pkgs.mkDerivation rec {
   pname = "gqrx";
-  version = "2.17.4";
+  version = "2.17.5";
 
   src = fetchFromGitHub {
     owner = "gqrx-sdr";
     repo = "gqrx";
     rev = "v${version}";
-    hash = "sha256-7TjmtF0B+dxUcoXXzpF47dHwxhNMKKQ8Mpf/FFTuwl4=";
+    hash = "sha256-9VePsl/vaSTZ1TMyIeaGoZNrZv+O/7BxQ3ubD5S2EjY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index 59472c4b25ce8..35d6bd8aba925 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stellarium";
-  version = "23.4";
+  version = "24.1";
 
   src = fetchFromGitHub {
     owner = "Stellarium";
     repo = "stellarium";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-rDqDs6sFaZQbqJcCRhY5w8sFM2mYHHvw0Ud2Niimg4Y=";
+    hash = "sha256-t3eFmiG9X2cmnjc/PQwZ2bw1SCHaNRA83wiT1cPbKJc=";
   };
 
   patches = [
diff --git a/pkgs/applications/science/biology/iqtree/default.nix b/pkgs/applications/science/biology/iqtree/default.nix
index 1f00876b58484..d8e90789f4d5f 100644
--- a/pkgs/applications/science/biology/iqtree/default.nix
+++ b/pkgs/applications/science/biology/iqtree/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iqtree";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "iqtree";
     repo = "iqtree2";
     rev = "v${version}";
-    hash = "sha256-GaNumiTGa6mxvFifv730JFgKrRxG41gJN+ci3imDbzs=";
+    hash = "sha256-hAJs48PhIyZSKSRZjQJKQwoJlt6DPRQwaDsuZ00VZII=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/science/biology/macs2/default.nix b/pkgs/applications/science/biology/macs2/default.nix
index 73f12af6a6057..26ec138048f7e 100644
--- a/pkgs/applications/science/biology/macs2/default.nix
+++ b/pkgs/applications/science/biology/macs2/default.nix
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonPackage rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    cython
+    cython_0
     numpy
     setuptools
     wheel
diff --git a/pkgs/applications/science/biology/nest/default.nix b/pkgs/applications/science/biology/nest/default.nix
index 2e5eac7881392..807af7ce488ac 100644
--- a/pkgs/applications/science/biology/nest/default.nix
+++ b/pkgs/applications/science/biology/nest/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "nest";
     repo = "nest-simulator";
     rev = "v${version}";
-    hash = "sha256-KoeehD0HNG6Uafv6ICf8d4gjggJ7+/8RBJCpttf7AGk=";
+    hash = "sha256-EwhpsfRmBLJnPiH6hXQXgG9jSNoC2oqq5lZ6t038VpI=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/science/electronics/nvc/default.nix b/pkgs/applications/science/electronics/nvc/default.nix
index d14aa3b6fab39..9bab9991baf82 100644
--- a/pkgs/applications/science/electronics/nvc/default.nix
+++ b/pkgs/applications/science/electronics/nvc/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     llvm
     zlib
     zstd
-  ] ++ lib.optionals stdenv.isLinux [
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
     elfutils
   ];
 
diff --git a/pkgs/applications/science/math/sage/python-modules/sage-setup.nix b/pkgs/applications/science/math/sage/python-modules/sage-setup.nix
index a96f7ccd5d4c0..e1c497678d50b 100644
--- a/pkgs/applications/science/math/sage/python-modules/sage-setup.nix
+++ b/pkgs/applications/science/math/sage/python-modules/sage-setup.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , sage-src
-, cython_3
+, cython
 , jinja2
 , pkgconfig # the python module, not the pkg-config alias
 }:
@@ -11,7 +11,7 @@ buildPythonPackage rec {
   pname = "sage-setup";
   src = sage-src;
 
-  nativeBuildInputs = [ cython_3 ];
+  nativeBuildInputs = [ cython ];
   buildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ jinja2 ];
 
diff --git a/pkgs/applications/science/math/sage/sagelib.nix b/pkgs/applications/science/math/sage/sagelib.nix
index b67b74e3a0f23..0a2bd8011b0bd 100644
--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@@ -48,7 +48,7 @@
 , cvxopt
 , cypari2
 , cysignals
-, cython_3
+, cython
 , fpylll
 , gmpy2
 , importlib-metadata
@@ -153,7 +153,7 @@ buildPythonPackage rec {
     cvxopt
     cypari2
     cysignals
-    cython_3
+    cython
     fpylll
     gmpy2
     importlib-metadata
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index fa08dd15fe6d5..675e47e5f57ac 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -31,14 +31,14 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.34.0";
+  version = "0.34.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IP1CWMHiWnBSbt+78EQ6hfX2A9FDhlwt0KLthXtO4dA=";
+    hash = "sha256-r7KZcSqREILMp0F9ajeHS5sglq/o88h2t+4BgbABjOY=";
   };
 
   goModules = (buildGo122Module {
@@ -250,6 +250,6 @@ buildPythonApplication rec {
     ];
     platforms = platforms.darwin ++ platforms.linux;
     mainProgram = "kitty";
-    maintainers = with maintainers; [ tex rvolosatovs Luflosi adamcstephens kashw2 ];
+    maintainers = with maintainers; [ tex rvolosatovs Luflosi kashw2 ];
   };
 }
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index 454de78abc42a..7b573717c003d 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication rec {
     pytest-freezer
     pytest-mock
     pytest-regressions
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ];
 
   doCheck = true;
diff --git a/pkgs/applications/version-management/forgejo/default.nix b/pkgs/applications/version-management/forgejo/default.nix
index 3357309442e90..65c683ddbe763 100644
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "1.21.10-0";
+  version = "1.21.11-1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-uCRAT9RiU9S+tP9alNshSQwbUgLmU9wE5HIQ4FPmXVE=";
+    hash = "sha256-7oYsoZpZcNIUw3iXSi1Q5So2yYgKnT5U7GHQ4NVqVdc=";
     # Forgejo has multiple different version strings that need to be provided
     # via ldflags.  main.ForgejoVersion for example is a combination of a
     # hardcoded gitea compatibility version string (in the Makefile) and
@@ -65,7 +65,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-pgUSmM2CxYO8DralWoeR2groQxpxo9WtRcToYeaHXGk=";
+  vendorHash = "sha256-OuWNF+muWM6xqwkFxLIUsn/huqXj2VKg8BN9+JHVw58=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/version-management/git-interactive-rebase-tool/default.nix b/pkgs/applications/version-management/git-interactive-rebase-tool/default.nix
index 176e271475368..f450b17535dd8 100644
--- a/pkgs/applications/version-management/git-interactive-rebase-tool/default.nix
+++ b/pkgs/applications/version-management/git-interactive-rebase-tool/default.nix
@@ -12,10 +12,9 @@ rustPlatform.buildRustPackage rec {
   };
 
   postPatch = ''
-    # unknown lint: `ffi_unwind_calls`
-    # note: the `ffi_unwind_calls` lint is unstable
-    substituteInPlace src/main.rs src/{config,core,display,input,git,runtime,todo_file,testutils,view}/src/lib.rs \
-      --replace "ffi_unwind_calls," ""
+    # error: lint `unused_tuple_struct_fields` has been renamed to `dead_code`
+    substituteInPlace scripts/data/lints.rs src/main.rs src/{config,core,display,git,input,runtime,testutils,todo_file,view}/src/lib.rs \
+      --replace-fail "unused_tuple_struct_fields," ""
   '';
 
   cargoLock = {
diff --git a/pkgs/applications/version-management/git-up/default.nix b/pkgs/applications/version-management/git-up/default.nix
index 851cb8464c5b2..5f91aacf63d8a 100644
--- a/pkgs/applications/version-management/git-up/default.nix
+++ b/pkgs/applications/version-management/git-up/default.nix
@@ -30,7 +30,7 @@ pythonPackages.buildPythonApplication rec {
 
   nativeCheckInputs = [
     git
-    pythonPackages.pytestCheckHook
+    pythonPackages.pytest7CheckHook
   ];
 
   # 1. git fails to run as it cannot detect the email address, so we set it
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 522c37f3a625f..818e3a8e15053 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "1.2.16.1";
+  version = "1.2.16.2";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-QQliz/tLeYsWgh/ZAO7FfbApAEqWhWoaQe9030QZxA8=";
+    hash = "sha256-IgNYJSadGemjclh7rtY8dHz7uSfBHoWEyLlRoZ+st6k=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
index 96209f3f94062..ea379e6ffc51f 100644
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "advanced-scene-switcher";
-  version = "1.25.4";
+  version = "1.25.5";
 
   src = fetchFromGitHub {
     owner = "WarmUpTill";
     repo = "SceneSwitcher";
     rev = version;
-    hash = "sha256-d/utejwSazepkIMzd1tRrJSrKRFhFRZsQBGiOkt5pYk=";
+    hash = "sha256-ROR+R1Zak8XkhFk1+Pyi0lB+JZI4SVtKGin4vem7NEE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/subtitleedit/default.nix b/pkgs/applications/video/subtitleedit/default.nix
index d47889857ed08..924f0fc44e0eb 100644
--- a/pkgs/applications/video/subtitleedit/default.nix
+++ b/pkgs/applications/video/subtitleedit/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "subtitleedit";
-  version = "4.0.4";
+  version = "4.0.5";
 
   src = fetchzip {
     url = "https://github.com/SubtitleEdit/subtitleedit/releases/download/${version}/SE${lib.replaceStrings [ "." ] [ "" ] version}.zip";
-    hash = "sha256-9z9igHU/23KHOd1TM3Wd7y5kl19cg3D9AQ2MjH5av20=";
+    hash = "sha256-qYDLUqC5adzpmlQIq/EKmrkN8D8/EHZmP8QUGAaYf+s=";
     stripRoot = false;
   };
 
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 4798e324141d6..79df60253ff59 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -24,41 +24,39 @@
 # Usually, this option is broken, do not use it except if you know what you are
 # doing.
 , sourceDebug ? false
+, projectDscPath ? {
+    i686 = "OvmfPkg/OvmfPkgIa32.dsc";
+    x86_64 = "OvmfPkg/OvmfPkgX64.dsc";
+    aarch64 = "ArmVirtPkg/ArmVirtQemu.dsc";
+    riscv64 = "OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc";
+  }.${stdenv.hostPlatform.parsed.cpu.name}
+  or (throw "Unsupported OVMF `projectDscPath` on ${stdenv.hostPlatform.parsed.cpu.name}")
+, fwPrefix ? {
+    i686 = "OVMF";
+    x86_64 = "OVMF";
+    aarch64 = "AAVMF";
+    riscv64 = "RISCV_VIRT";
+  }.${stdenv.hostPlatform.parsed.cpu.name}
+  or (throw "Unsupported OVMF `fwPrefix` on ${stdenv.hostPlatform.parsed.cpu.name}")
+, metaPlatforms ? edk2.meta.platforms
 }:
 
 let
 
   platformSpecific = {
-    i686 = {
-      projectDscPath = "OvmfPkg/OvmfPkgIa32.dsc";
-      fwPrefix = "OVMF";
+    x86_64.msVarsArgs = {
+      flavor = "OVMF_4M";
+      archDir = "X64";
     };
-    x86_64 = {
-      projectDscPath = "OvmfPkg/OvmfPkgX64.dsc";
-      fwPrefix = "OVMF";
-      msVarsArgs = {
-        flavor = "OVMF_4M";
-        archDir = "X64";
-      };
-    };
-    aarch64 = {
-      projectDscPath = "ArmVirtPkg/ArmVirtQemu.dsc";
-      fwPrefix = "AAVMF";
-      msVarsArgs = {
-        flavor = "AAVMF";
-        archDir = "AARCH64";
-      };
-    };
-    riscv64 = {
-      projectDscPath = "OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc";
-      fwPrefix = "RISCV_VIRT";
+    aarch64.msVarsArgs = {
+      flavor = "AAVMF";
+      archDir = "AARCH64";
     };
   };
 
   cpuName = stdenv.hostPlatform.parsed.cpu.name;
 
-  inherit (platformSpecific.${cpuName})
-    projectDscPath fwPrefix msVarsArgs;
+  inherit (platformSpecific.${cpuName}) msVarsArgs;
 
   version = lib.getVersion edk2;
 
@@ -152,6 +150,9 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
   # release notes accordingly.
   postInstall = ''
     mkdir -vp $fd/FV
+  '' + lib.optionalString (builtins.elem fwPrefix [
+    "OVMF" "AAVMF" "RISCV_VIRT"
+  ]) ''
     mv -v $out/FV/${fwPrefix}_{CODE,VARS}.fd $fd/FV
   '' + lib.optionalString stdenv.hostPlatform.isx86 ''
     mv -v $out/FV/${fwPrefix}.fd $fd/FV
@@ -184,7 +185,7 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
     description = "Sample UEFI firmware for QEMU and KVM";
     homepage = "https://github.com/tianocore/tianocore.github.io/wiki/OVMF";
     license = lib.licenses.bsd2;
-    inherit (edk2.meta) platforms;
+    platforms = metaPlatforms;
     maintainers = with lib.maintainers; [ adamcstephens raitobezarius ];
     broken = stdenv.isDarwin;
   };
diff --git a/pkgs/applications/virtualization/podman-compose/default.nix b/pkgs/applications/virtualization/podman-compose/default.nix
index 8671617a40431..29bfbfa781898 100644
--- a/pkgs/applications/virtualization/podman-compose/default.nix
+++ b/pkgs/applications/virtualization/podman-compose/default.nix
@@ -1,17 +1,24 @@
-{ lib, buildPythonApplication, fetchFromGitHub, python-dotenv, pyyaml }:
+{ lib, buildPythonApplication, fetchFromGitHub, python-dotenv, pyyaml, setuptools, pipBuildHook, pypaBuildHook }:
 
 buildPythonApplication rec {
-  version = "1.0.6";
+  version = "1.1.0";
   pname = "podman-compose";
+  pyproject = true;
 
   src = fetchFromGitHub {
     repo = "podman-compose";
     owner = "containers";
     rev = "v${version}";
-    sha256 = "sha256-TsNM5xORqwWge+UCijKptwbAcIz1uZFN9BuIOl28vIU=";
+    sha256 = "sha256-uNgzdLrnDIABtt0L2pvsil14esRzl0XcWohgf7Oksr8=";
   };
 
-  propagatedBuildInputs = [ pyyaml python-dotenv ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [ python-dotenv pyyaml ];
+  propagatedBuildInputs = [ pypaBuildHook ];
 
   meta = {
     description = "An implementation of docker-compose with podman backend";
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index dca7b9bc4af0c..92935ed129d8a 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -74,13 +74,13 @@ buildGoModule rec {
   };
 
   patches = [
+    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
+    ./rm-podman-mac-helper-msg.patch
+  ] ++ lib.optionals stdenv.isLinux [
     (substituteAll {
       src = ./hardcode-paths.patch;
       inherit crun runc gvisor youki conmon;
     })
-
-    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
-    ./rm-podman-mac-helper-msg.patch
   ];
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 3e0c24877fdf3..813e77db435cf 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -76,7 +76,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
+    pytest7CheckHook
     cpio
     cdrtools
     xorriso
diff --git a/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix b/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix
index 64ccff89f6e33..0635d7a5e407e 100644
--- a/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix
+++ b/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, nixosTests
 , directoryListingUpdater
 , meson
 , ninja
@@ -59,7 +60,10 @@ stdenv.mkDerivation rec {
     ln -s '${phosh}/lib/phosh' "$out/lib/phosh"
   '';
 
-  passthru.updateScript = directoryListingUpdater { };
+  passthru = {
+    tests.phosh = nixosTests.phosh;
+    updateScript = directoryListingUpdater { };
+  };
 
   meta = with lib; {
     description = "A settings app for mobile specific things";
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 3c553f181f0dd..5ca5bc3f5eb3b 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -8,7 +8,8 @@
 { name ? ""
 , lib
 , stdenvNoCC
-, bintools ? null, libc ? null, coreutils ? null, shell ? stdenvNoCC.shell, gnugrep ? null
+, runtimeShell
+, bintools ? null, libc ? null, coreutils ? null, gnugrep ? null
 , netbsd ? null, netbsdCross ? null
 , sharedLibraryLoader ?
   if libc == null then
@@ -28,7 +29,7 @@
 , isGNU ? bintools.isGNU or false
 , isLLVM ? bintools.isLLVM or false
 , isCCTools ? bintools.isCCTools or false
-, buildPackages ? {}
+, expand-response-params
 , targetPackages ? {}
 , useMacosReexportHack ? false
 , wrapGas ? false
@@ -131,10 +132,6 @@ let
     else if hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
     else "";
 
-  expand-response-params =
-    optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
-    (import ../expand-response-params { inherit (buildPackages) stdenv; });
-
 in
 
 stdenvNoCC.mkDerivation {
@@ -418,8 +415,10 @@ stdenvNoCC.mkDerivation {
 
   env = {
     # for substitution in utils.bash
+    # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-    shell = getBin shell + shell.shellPath or "";
+    # TODO(@sternenseemann): rename env var via stdenv rebuild
+    shell = (getBin runtimeShell + runtimeShell.shellPath or "");
     gnugrep_bin = optionalString (!nativeTools) gnugrep;
     wrapperName = "BINTOOLS_WRAPPER";
     inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 11ae9868ce016..4adc1dcb1f8d8 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -8,14 +8,15 @@
 { name ? ""
 , lib
 , stdenvNoCC
-, cc ? null, libc ? null, bintools, coreutils ? null, shell ? stdenvNoCC.shell
+, runtimeShell
+, cc ? null, libc ? null, bintools, coreutils ? null
 , zlib ? null
 , nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
 , propagateDoc ? cc != null && cc ? man
 , extraTools ? [], extraPackages ? [], extraBuildCommands ? ""
 , nixSupport ? {}
 , isGNU ? false, isClang ? cc.isClang or false, isCcache ? cc.isCcache or false, gnugrep ? null
-, buildPackages ? {}
+, expand-response-params
 , libcxx ? null
 
 # Whether or not to add `-B` and `-L` to `nix-support/cc-{c,ld}flags`
@@ -112,9 +113,6 @@ let
   # unstable implementation detail, however.
   suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
 
-  expand-response-params =
-    optionalString ((buildPackages.stdenv.hasCC or false) && buildPackages.stdenv.cc != "/dev/null") (import ../expand-response-params { inherit (buildPackages) stdenv; });
-
   useGccForLibs = useCcForLibs
     && libcxx == null
     && !targetPlatform.isDarwin
@@ -297,6 +295,9 @@ stdenvNoCC.mkDerivation {
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
 
+    # Expose expand-response-params we are /actually/ using. In stdenv
+    # bootstrapping, expand-response-params usually comes from an earlier stage,
+    # so it is important to expose this for reference checking.
     inherit expand-response-params;
 
     inherit nixSupport;
@@ -738,8 +739,10 @@ stdenvNoCC.mkDerivation {
     inherit isClang;
 
     # for substitution in utils.bash
+    # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-    shell = getBin shell + shell.shellPath or "";
+    # TODO(@sternenseemann): rename env var via stdenv rebuild
+    shell = getBin runtimeShell + runtimeShell.shellPath or "";
     gnugrep_bin = optionalString (!nativeTools) gnugrep;
     # stdenv.cc.cc should not be null and we have nothing better for now.
     # if the native impure bootstrap is gotten rid of this can become `inherit cc;` again.
diff --git a/pkgs/build-support/expand-response-params/default.nix b/pkgs/build-support/expand-response-params/default.nix
index 7ce15e98c8d99..6868ab97d8964 100644
--- a/pkgs/build-support/expand-response-params/default.nix
+++ b/pkgs/build-support/expand-response-params/default.nix
@@ -1,4 +1,4 @@
-{ stdenv }:
+{ stdenv, lib }:
 
 # A "response file" is a sequence of arguments that is passed via a
 # file, rather than via argv[].
@@ -25,4 +25,18 @@ stdenv.mkDerivation {
     mkdir -p $prefix/bin
     mv expand-response-params $prefix/bin/
   '';
+
+  meta = {
+    description = "Internal tool used by the nixpkgs wrapper scripts for processing response files";
+    longDescription = ''
+      expand-response-params is a tool that allows for obtaining a full list of all
+      arguments passed in a given compiler command line including those passed via
+      so-called response files. The nixpkgs wrapper scripts for bintools and C
+      compilers use it for processing compiler flags. As it is developed in
+      conjunction with the nixpkgs wrapper scripts, it should be considered as
+      unstable and subject to change.
+    '';
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
 }
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index a7e697c552154..e192c650a4ddb 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -315,6 +315,7 @@
   # D DUB
   dub = [
     "https://code.dlang.org/packages/"
+    "https://codemirror.dlang.org/packages/"
   ];
 
   # Haskell Hackage
diff --git a/pkgs/by-name/_6/_64gram/package.nix b/pkgs/by-name/_6/_64gram/package.nix
index 959a2ad5d17e1..8db36cf9abf50 100644
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@@ -7,7 +7,7 @@
 
 telegram-desktop.overrideAttrs (old: rec {
   pname = "64gram";
-  version = "1.1.17";
+  version = "1.1.19";
 
   src = fetchFromGitHub {
     owner = "TDesktop-x64";
@@ -15,7 +15,7 @@ telegram-desktop.overrideAttrs (old: rec {
     rev = "v${version}";
 
     fetchSubmodules = true;
-    hash = "sha256-QWHC1NAAKpH9zU7cplCW2rNYckY87bpU7MEZ1ytSi58=";
+    hash = "sha256-9QCh7/eNPWqsOF+cjO61EnqqhAdy6+4UxZhWjfJc5gQ=";
   };
 
   passthru.updateScript = nix-update-script {};
diff --git a/pkgs/by-name/ab/ab-av1/package.nix b/pkgs/by-name/ab/ab-av1/package.nix
new file mode 100644
index 0000000000000..a92e021f67e3a
--- /dev/null
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@@ -0,0 +1,33 @@
+{ lib, rustPlatform, fetchFromGitHub, installShellFiles }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ab-av1";
+  version = "0.7.14";
+
+  src = fetchFromGitHub {
+    owner = "alexheretic";
+    repo = "ab-av1";
+    rev = "v${version}";
+    hash = "sha256-cDabGXNzusVnp4exINqUitEL1HnzSgpcRtYXU5pSRhY=";
+  };
+
+  cargoHash = "sha256-sW/673orvK+mIUqTijpNh4YGd9ZrgSveGT6F1O5OYfI=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd ab-av1 \
+      --bash <($out/bin/ab-av1 print-completions bash) \
+      --fish <($out/bin/ab-av1 print-completions fish) \
+      --zsh <($out/bin/ab-av1 print-completions zsh)
+  '';
+
+  meta = with lib; {
+    description = "AV1 re-encoding using ffmpeg, svt-av1 & vmaf";
+    homepage = "https://github.com/alexheretic/ab-av1";
+    changelog = "https://github.com/alexheretic/ab-av1/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+    mainProgram = "ab-av1";
+  };
+}
diff --git a/pkgs/by-name/ad/adminerevo/index.php b/pkgs/by-name/ad/adminerevo/index.php
new file mode 100644
index 0000000000000..838b5948ae4d3
--- /dev/null
+++ b/pkgs/by-name/ad/adminerevo/index.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace nixos {
+	function adminer_object() {
+		require_once(__DIR__ . '/plugins/plugin.php');
+
+		$plugins = [];
+		if (file_exists(__DIR__ . '/plugins.json')) {
+			$names = json_decode(file_get_contents(__DIR__ . '/plugins.json'), true);
+
+			foreach ($names as $name) {
+				$plugin = __DIR__ . '/plugins/' . $name . '.php';
+				if (is_readable($plugin)) {
+					require($plugin);
+
+					preg_match_all('/(\w+)/', $name, $matches);
+
+					$className = 'Adminer'. implode('', array_map('ucfirst', $matches[1]));
+
+					$plugins[] = new $className;
+				}
+			}
+		}
+
+		return new \AdminerPlugin($plugins);
+	}
+}
+
+namespace {
+	function adminer_object() {
+		return \nixos\adminer_object();
+	}
+
+	require(__DIR__ . '/adminer.php');
+}
diff --git a/pkgs/by-name/ad/adminerevo/package.nix b/pkgs/by-name/ad/adminerevo/package.nix
new file mode 100644
index 0000000000000..398d007671002
--- /dev/null
+++ b/pkgs/by-name/ad/adminerevo/package.nix
@@ -0,0 +1,73 @@
+{ lib
+, pkgs
+, stdenvNoCC
+, fetchFromGitHub
+, php
+, nix-update-script
+, theme ? null
+, plugins ? []
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  version = "4.8.4";
+  pname = "adminerevo";
+
+  src = fetchFromGitHub {
+    owner = "adminerevo";
+    repo = "adminerevo";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-cyKSwzoVbS/0Fiv02kFIF4MTOqzpKSEFwwUwS4yqL6Q=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    php
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    php compile.php
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp adminer-${finalAttrs.version}.php $out/adminer.php
+    cp ${./index.php} $out/index.php
+
+    ${lib.optionalString (theme != null) ''
+      cp designs/${theme}/adminer.css $out/adminer.css
+    ''}
+
+    # Copy base plugin
+    mkdir -p $out/plugins
+    cp plugins/plugin.php $out/plugins/plugin.php
+
+    ${lib.optionalString (plugins != []) ''
+      cp plugins/*.php $out/plugins/
+      cp ${pkgs.writeText "$out/plugins.json" ''
+        ${toString (builtins.toJSON plugins)}
+      ''} $out/plugins.json
+    ''}
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "Database management in a single PHP file";
+    homepage = "https://docs.adminerevo.org";
+    license = with licenses; [ asl20 gpl2Only ];
+    maintainers = with maintainers; [
+      shyim
+    ];
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ap/api-linter/package.nix b/pkgs/by-name/ap/api-linter/package.nix
index 554c470fe3e54..c3501889915d7 100644
--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.65.0";
+  version = "1.65.1";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     rev = "v${version}";
-    hash = "sha256-j5xvFg7C74sVjISZMWgURVHnJM6HBZtr90b0UXbGbdg=";
+    hash = "sha256-YGawN0mAJHfWkre+0tunPM/psd9aBWtSVsJoar0WVwY=";
   };
 
-  vendorHash = "sha256-Bz7+4iVR2X36vt6wx3nIgWmVL+i9ncwdzYP9tBEpplk=";
+  vendorHash = "sha256-CsOnHHq3UjNWjfMy1TjXy20B0Bni6Fr3ZMJGvU7QDFA=";
 
   subPackages = [ "cmd/api-linter" ];
 
diff --git a/pkgs/by-name/be/betula/package.nix b/pkgs/by-name/be/betula/package.nix
index 1e27400950235..c29e6e850e75c 100644
--- a/pkgs/by-name/be/betula/package.nix
+++ b/pkgs/by-name/be/betula/package.nix
@@ -3,15 +3,15 @@
 , buildGoModule
 }: buildGoModule rec {
   pname = "betula";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromSourcehut {
     owner = "~bouncepaw";
     repo = "betula";
     rev = "v${version}";
-    hash = "sha256-MH6YeWG94YVBgx5Es3oMJ9A/hAPPBXpAcIdCJV3HX78=";
+    hash = "sha256-oxwOGpf305VDlY3Mwl0dRJRRhe0yolaMMlpNspZdKQk=";
   };
-  vendorHash = "sha256-wiMIhoSO7nignNWY16OpDYZCguRbcEwwO/HggKSC5jM=";
+  vendorHash = "sha256-DjL2h6YKCJOWgmR/Gb0Eja38yJ4DymqW/SzmPG3+q9w=";
 
   CGO_ENABLED = 1;
   # These tests use internet, so are failing in Nix build.
diff --git a/pkgs/by-name/bi/biglybt/package.nix b/pkgs/by-name/bi/biglybt/package.nix
new file mode 100644
index 0000000000000..ad365c14377a3
--- /dev/null
+++ b/pkgs/by-name/bi/biglybt/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jre,
+  wrapGAppsHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "biglybt";
+  version = "3.5.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/BiglySoftware/BiglyBT/releases/download/v${version}/GitHub_BiglyBT_unix.tar.gz";
+    hash = "sha256-ToTCIjunj/ABi3wVSmeddLGBdQlv+CfK2jGRjixJd0w=";
+  };
+
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    sed -e 's/AUTOUPDATE_SCRIPT=1/AUTOUPDATE_SCRIPT=0/g' \
+      -i biglybt || die
+
+    runHook postConfigure
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d $out/{share/{biglybt,applications,icons/hicolor/scalable/apps},bin}
+
+    cp -r ./* $out/share/biglybt/
+
+    ln -s $out/share/biglybt/biglybt.desktop $out/share/applications/
+
+    ln -s $out/share/biglybt/biglybt.svg $out/share/icons/hicolor/scalable/apps/
+
+    wrapProgram $out/share/biglybt/biglybt \
+      --prefix PATH : ${lib.makeBinPath [ jre ]}
+
+    ln -s $out/share/biglybt/biglybt $out/bin/
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^(v[0-9.]+)$"
+    ];
+  };
+
+  meta = {
+    changelog = "https://github.com/BiglySoftware/BiglyBT/releases/tag/v${version}";
+    description = "A BitTorrent client based on the Azureus that supports I2P darknet for privacy";
+    downloadPage = "https://github.com/BiglySoftware/BiglyBT";
+    homepage = "https://www.biglybt.com/";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    mainProgram = "biglybt";
+    maintainers = with lib.maintainers; [ raspher ];
+  };
+}
diff --git a/pkgs/by-name/cl/clatd/package.nix b/pkgs/by-name/cl/clatd/package.nix
new file mode 100644
index 0000000000000..dff8ce4261a93
--- /dev/null
+++ b/pkgs/by-name/cl/clatd/package.nix
@@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, perl
+, perlPackages
+, tayga
+, iproute2
+, iptables
+}:
+
+stdenv.mkDerivation rec {
+  pname = "clatd";
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "toreanderson";
+    repo = "clatd";
+    rev = "v${version}";
+    hash = "sha256-ZUGWQTXXgATy539NQxkZSvQA7HIWkIPsw1NJrz0xKEg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    perl # for pod2man
+  ];
+
+  buildInputs = with perlPackages; [
+    perl
+    NetIP
+    NetDNS
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  preBuild = ''
+    mkdir -p $out/{sbin,share/man/man8}
+  '';
+
+  postFixup = ''
+    patchShebangs $out/bin/clatd
+    wrapProgram $out/bin/clatd \
+      --set PERL5LIB $PERL5LIB \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          tayga
+          iproute2
+          iptables
+        ]
+      }
+  '';
+
+  meta = with lib; {
+    description = "A 464XLAT CLAT implementation for Linux";
+    homepage = "https://github.com/toreanderson/clatd";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jmbaur ];
+    mainProgram = "clatd";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index a9b29a3245d5d..f47265ca09c9f 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -47,11 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.28.3";
+  version = "3.29.1";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-crdXDlyFk95qxKtDO3PqsYxfsyiIBGDIbOMmCBQa1cE=";
+    hash = "sha256-f7Auj1e2Kzmqa0z3HoIBSLoaI3JIiElHNQIeMqsO78w=";
   };
 
   patches = [
diff --git a/pkgs/by-name/co/codeium/package.nix b/pkgs/by-name/co/codeium/package.nix
index 437df8439ed3a..2c0dd84cbbcda 100644
--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@@ -13,10 +13,10 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-AHjR6lHszYqZ2yC/uY2DmB67xMUFZliqI29Ptes2SoY=";
-    aarch64-linux = "sha256-2NYlec6gpVMJwZctEqwn5rQiTrb5PmaxEz3lQxF1qmk=";
-    x86_64-darwin = "sha256-OeMbO2lDK6XUF3ht+09ZWOL7UsEEVTrKyXOfhny8DhM=";
-    aarch64-darwin = "sha256-4CQvJkd3kI7XJz46QsSUBtWLmxDu7AcAJwRS3amv0SM=";
+    x86_64-linux = "sha256-6sIYDI6+1/p54Af+E/GmRAFlfDYJVwxhn0qF47ZH+Zg=";
+    aarch64-linux = "sha256-1ImcjAqCZm5KZZYHWhG1eO7ipAdrP4Qjj2eBxTst++s=";
+    x86_64-darwin = "sha256-yHthItxZYFejJlwJJ7BrM2csnLsZXjy/IbzF1iaCCyI=";
+    aarch64-darwin = "sha256-GIx0yABISj/rH/yVkkx6NBs5qF0P8nhpMyvnzXJ92mA=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.8.22";
+  version = "1.8.25";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
diff --git a/pkgs/by-name/co/corto/package.nix b/pkgs/by-name/co/corto/package.nix
new file mode 100644
index 0000000000000..acf0517e0c10a
--- /dev/null
+++ b/pkgs/by-name/co/corto/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation {
+  pname = "corto";
+  version = "0-unstable-2024-04-05";
+
+  src = fetchFromGitHub {
+    owner = "cnr-isti-vclab";
+    repo = "corto";
+    rev = "d880519c490c88a39d12c31a914b6a687a7019c3";
+    hash = "sha256-0OUijrf+0ZNv3oYko2r8Kp9zgtg8b9RPL7DXHf15Ryc=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Mesh compression library, designed for rendering and speed";
+    homepage = "https://github.com/cnr-isti-vclab/corto";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nim65s ];
+  };
+}
diff --git a/pkgs/by-name/cy/cyclonedx-cli/deps.nix b/pkgs/by-name/cy/cyclonedx-cli/deps.nix
new file mode 100644
index 0000000000000..7e5ef08ed1f96
--- /dev/null
+++ b/pkgs/by-name/cy/cyclonedx-cli/deps.nix
@@ -0,0 +1,195 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
+{ fetchNuGet }: [
+  (fetchNuGet { pname = "CoderPatros.AntPathMatching"; version = "0.1.1"; sha256 = "1a9xhigw6bc4gl7qg3d8m9y53bk0mn9kmw07w4y27f32gr6m9b2k"; })
+  (fetchNuGet { pname = "coverlet.collector"; version = "3.1.2"; sha256 = "0gsk2q93qw7pqxwd4pdyq5364wz0lvldcqqnf4amz13jaq86idmz"; })
+  (fetchNuGet { pname = "CsvHelper"; version = "29.0.0"; sha256 = "0x5i3x5jqrxi82sgzfbgyrqqd6nsgb35z5p4rhqzb0fhq9qf6hlw"; })
+  (fetchNuGet { pname = "CycloneDX.Core"; version = "6.0.0"; sha256 = "0lvllq1bb4w2l9va2ayjyd0kkbqyglkgjbha3y2hq71qkviqryd2"; })
+  (fetchNuGet { pname = "CycloneDX.Spdx"; version = "6.0.0"; sha256 = "032q2rp2626hirfhr8q6xhi2hs35ma137fswivsd1lkcz69vvl4h"; })
+  (fetchNuGet { pname = "CycloneDX.Spdx.Interop"; version = "6.0.0"; sha256 = "1c660hpq3bl3zaxyn9dkcn64f97nb1ri1bcdnky39ap4z6fp96ll"; })
+  (fetchNuGet { pname = "CycloneDX.Utils"; version = "6.0.0"; sha256 = "1zf57hppl586x2sc9c3j4n9mqyinfsnj2fp66rxdljgcrlsb1vd1"; })
+  (fetchNuGet { pname = "JetBrains.Annotations"; version = "2021.2.0"; sha256 = "0krvmg2h5ibh6mzs9yn7c8cdxgvr5hm7l884i49hlhnc1aiy5m1n"; })
+  (fetchNuGet { pname = "Json.More.Net"; version = "1.7.0"; sha256 = "0fbmrq88wqbfpngs9vfx03xdbg71liz07nyx620za82f294pcdzk"; })
+  (fetchNuGet { pname = "JsonPointer.Net"; version = "2.2.1"; sha256 = "16fhp2v2cqb9yaxy0nzq5ngmx1b089iz1phqfi0nhdjln3b2win6"; })
+  (fetchNuGet { pname = "JsonSchema.Net"; version = "3.3.2"; sha256 = "0sfp8qvdnxnh93q1vs9f9pjybjkh9jifvhaxjgfksf6zbz8dhp4v"; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.3.2"; sha256 = "1f05l2vm8inlwhk36lfbyszjlcnvdd2qw2832npaah0dldn6dz00"; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.4.1"; sha256 = "0z6d1i6xcf0c00z6rs75rgw4ncs9q2m8amasf6mmbf40fm02ry7g"; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.3.2"; sha256 = "0pm06nxqi8aw04lciqy7iz8ln1qm5mx06cpwgqa2dfwvnjp7zxnm"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.3.2"; sha256 = "0bs38r5kdw1xpbjbi5l82xbhfnfbzr5xhg5520lk05pg914d1ln1"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.3.2"; sha256 = "089nmaxzvm5xcf20pm4iiavz2k6lwh69r51xlbqg0ry605mnl869"; })
+  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
+  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "12.0.3"; sha256 = "17dzl305d835mzign8r15vkmav2hq8l6g7942dfjpnzr17wwl89x"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "9.0.1"; sha256 = "0mcy0i7pnfpqm4pcaiyzzji4g0c8i3a5gjz28rrr28110np8304r"; })
+  (fetchNuGet { pname = "NuGet.Frameworks"; version = "5.11.0"; sha256 = "0wv26gq39hfqw9md32amr5771s73f5zn1z9vs4y77cgynxr73s4z"; })
+  (fetchNuGet { pname = "protobuf-net"; version = "3.2.26"; sha256 = "1mcg46xnhgqwjacy6j8kvp3rylpi26wjnmhwv8mh5cwjya9nynqb"; })
+  (fetchNuGet { pname = "protobuf-net.Core"; version = "3.2.26"; sha256 = "1wrr38ygdanf121bkl8b1d4kz1pawm064z69bqf3qbr46h4j575w"; })
+  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "1wl76vk12zhdh66vmagni66h5xbhgqq7zkdpgw21jhxhvlbcl8pk"; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "00j6nv2xgmd3bi347k00m7wr542wjlig53rmj28pmw7ddcn97jbn"; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1ghhhk5psqxcg6w88sxkqrc35bxcz27zbqm2y5p5298pv3v7g201"; })
+  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; sha256 = "0zyri97dfc5vyaz9ba65hjj1zbcrzaffhsdlpxc9bh09wy22fq33"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; sha256 = "0x1mm8c6iy8rlxm8w9vqw7gb7s1ljadrn049fmf70cyh42vdfhrf"; })
+  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "03kickal0iiby82wa5flar18kyv82s9s6d4xhk5h4bi5kfcyfjzl"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; sha256 = "1cqh1sv3h5j7ixyb7axxbdkqx6cxy00p4np4j91kpm492rf4s25b"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "0lqhgqi0i8194ryqq6v2gqx0fb86db2gqknbm0aq31wb378j7ip8"; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Timer"; version = "4.3.0"; sha256 = "0aw4phrhwqz9m61r79vyfl5la64bjxj8l34qnrcwb28v49fg2086"; })
+  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
+  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
+  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
+  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; sha256 = "1vvivbqsk6y4hzcid27pqpm5bsi6sc50hvqwbcx8aap5ifrxfs8d"; })
+  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
+  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
+  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1klrs545awhayryma6l7g2pvnp9xy4z0r1i40r80zb45q3i9nbyf"; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "10yc8jdrwgcl44b4g93f1ds76b176bajd3zqi2faf5rvh1vy9smi"; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0zcxjv5pckplvkg0r6mw3asggm7aqzbdjimhvsasb0cgm59x09l3"; })
+  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0vhynn79ih7hw7cwjazn87rm9z9fj0rvxgzlab36jybgcpcgphsn"; })
+  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
+  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0y61k9zbxhdi0glg154v30kkq7f8646nif8lnnxbvkjpakggd5id"; })
+  (fetchNuGet { pname = "runtime.unix.System.Console"; version = "4.3.0"; sha256 = "1pfpkvc6x2if8zbdzg9rnc5fx51yllprl8zkm5npni2k50lisy80"; })
+  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
+  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; sha256 = "14nbkhvs7sji5r1saj2x8daz82rnf9kx28d3v2qss34qbr32dzix"; })
+  (fetchNuGet { pname = "runtime.unix.System.Net.Primitives"; version = "4.3.0"; sha256 = "0bdnglg59pzx9394sy4ic66kmxhqp8q8bvmykdxcbs5mm0ipwwm4"; })
+  (fetchNuGet { pname = "runtime.unix.System.Net.Sockets"; version = "4.3.0"; sha256 = "03npdxzy8gfv035bv1b9rz7c7hv0rxl5904wjz51if491mw0xy12"; })
+  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
+  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
+  (fetchNuGet { pname = "Snapshooter"; version = "0.7.1"; sha256 = "04sn8pm1fgv8nasa6xi1wnm972xq9sq46lhc1p0945x44yvbrja9"; })
+  (fetchNuGet { pname = "Snapshooter.Xunit"; version = "0.7.1"; sha256 = "1z0v66nnaf7jj9b793x334z0da4llw6d4iddv4iy876q7a656rbx"; })
+  (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
+  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
+  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; sha256 = "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"; })
+  (fetchNuGet { pname = "System.CommandLine"; version = "2.0.0-beta1.21308.1"; sha256 = "09p3pr8sfx2znlwiig0m74qswziih0gn85y9i6bww5xprk4612np"; })
+  (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
+  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq"; })
+  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
+  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
+  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
+  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; sha256 = "1pla2dx8gkidf7xkciig6nifdsb494axjvzvann8g2lp3dbqasm9"; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "6.0.0"; sha256 = "1vvr7hs4qzjqb37r0w1mxq7xql2b17la63jwvmgv65s1hj00g8r9"; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
+  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
+  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
+  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
+  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
+  (fetchNuGet { pname = "System.IO.Abstractions"; version = "13.2.47"; sha256 = "0s7f3cx99k6ci9a32q7sfm3s878awqs2k75c989kl7qx7i0g7v54"; })
+  (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; sha256 = "084zc82yi6yllgda0zkgl2ys48sypiswbiwrv7irb3r0ai1fp4vz"; })
+  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; sha256 = "1yxy5pq4dnsm9hlkg9ysh5f6bf3fahqqb6p8668ndy5c0lk7w2ar"; })
+  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
+  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
+  (fetchNuGet { pname = "System.IO.FileSystem.AccessControl"; version = "5.0.0"; sha256 = "0ixl68plva0fsj3byv76bai7vkin86s6wyzr8vcav3szl862blvk"; })
+  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.0.1"; sha256 = "1s0mniajj3lvbyf7vfb5shp4ink5yibsx945k6lvxa96r8la1612"; })
+  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c"; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; sha256 = "1ppg83svb39hj4hpp5k7kcryzrf3sfnm08vxd5sm2drrijsla2k5"; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
+  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.1.0"; sha256 = "1gpdxl6ip06cnab7n3zlcg6mqp7kknf73s8wjinzi4p0apw82fpg"; })
+  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
+  (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; sha256 = "1i4gc757xqrzflbk7kc5ksn20kwwfjhw9w7pgdkn19y3cgnl302j"; })
+  (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
+  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
+  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; sha256 = "1ssa65k6chcgi6mfmzrznvqaxk8jp0gvl77xhf1hbzakjnpxspla"; })
+  (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; sha256 = "1sybkfi60a4588xn34nd9a58png36i0xr4y4v4kqpg8wlvy5krrj"; })
+  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
+  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; sha256 = "1js89429pfw79mxvbzp8p3q93il6rdff332hddhzi5wqglc4gml9"; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; sha256 = "0ydqcsvh6smi41gyaakglnv252625hf29f7kywy2c70nhii2ylqp"; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; sha256 = "1pcd2ig6bg144y10w7yxgc9d22r7c7ww7qn1frdfwgxr24j9wvv0"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; sha256 = "1s4b043zdbx9k39lfhvsk68msv1nxbidhkq6nbm27q7sf8xcsnxr"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; sha256 = "0ql7lcakycrvzgi9kxz1b3lljd990az1x6c4jsiwcacrvimpib5c"; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; sha256 = "0m7wqwq0zqq9gbpiqvgk3sr92cbrw7cp3xn53xvw7zj6rz6fdirn"; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; sha256 = "1bangaabhsl4k9fg8khn83wm6yial8ik1sza7401621jc6jrym28"; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.1.0"; sha256 = "1bjli8a7sc7jlxqgcagl9nh8axzfl11f4ld3rjqsyxc516iijij7"; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; sha256 = "0y2ssg08d817p0vdag98vn238gyrrynjdj4181hdg780sif3ykp1"; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; sha256 = "0b4i7mncaf8cnai85jv3wnw6hps140cxz8vylv2bik6wyzgvz7bi"; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; sha256 = "02hdkgk13rvsd6r9yafbwzss8kr55wnj8d5c7xjnp8gqrwc8sn0m"; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0rw4rm4vsm3h3szxp9iijc3ksyviwsv6f63dng3vhqyg4vjdkc2z"; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; sha256 = "1g0zrdi5508v49pfm3iii2hn6nm00bgvfpjq1zxknfjrxxa20r4g"; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; sha256 = "0q18r1sh4vn7bvqgd6dmqlw5v28flbpj349mkdish2vjyvmnb2ii"; })
+  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
+  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.1.1"; sha256 = "042rfjixknlr6r10vx2pgf56yming8lkjikamg3g4v29ikk78h7k"; })
+  (fetchNuGet { pname = "System.Security.AccessControl"; version = "5.0.0"; sha256 = "17n3lrrl6vahkqmhlpn3w20afgz09n7i6rv0r3qypngwi7wqdr5r"; })
+  (fetchNuGet { pname = "System.Security.AccessControl"; version = "6.0.0"; sha256 = "0a678bzj8yxxiffyzy60z2w1nczzpi8v97igr4ip3byd2q89dv58"; })
+  (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "6.0.1"; sha256 = "0wswhbvm3gh06azg9k1zfvmhicpzlh7v71qzd4x5zwizq4khv7iq"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Xml"; version = "6.0.1"; sha256 = "15d0np1njvy2ywf0qzdqyjk5sjs4zbfxg917jrvlbfwrqpqxb5dj"; })
+  (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "5.0.0"; sha256 = "1mpk7xj76lxgz97a5yg93wi8lj0l8p157a5d50mmjy3gbz1904q8"; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
+  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
+  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
+  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "7.0.0"; sha256 = "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl"; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.2"; sha256 = "1i6yinxvbwdk5g5z9y8l4a5hj2gw3h9ijlz2f1c1ngyprnwz2ivf"; })
+  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.1.0"; sha256 = "1mw7vfkkyd04yn2fbhm38msk7dz2xwvib14ygjsb8dq2lcvr18y7"; })
+  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; sha256 = "1bgq51k7fwld0njylfn7qc5fmwrk2137gdq7djqdsw347paa9c2l"; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; sha256 = "0nr1r41rak82qfa5m0lhk9mp0k93bvfd7bbd9sdzwx9mb36g28p5"; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.0.0"; sha256 = "1cb51z062mvc2i8blpzmpn9d9mm4y307xrwi65di8ri18cz5r1zr"; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
+  (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
+  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56"; })
+  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; sha256 = "0c6ky1jk5ada9m94wcadih98l6k1fvf6vi7vhn1msjixaha419l5"; })
+  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
+  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
+  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
+  (fetchNuGet { pname = "xunit"; version = "2.4.2"; sha256 = "0barl6x1qwx9srjxnanw9z0jik7lv1fp6cvmgqhk10aiv57dgqxm"; })
+  (fetchNuGet { pname = "xunit.abstractions"; version = "2.0.3"; sha256 = "00wl8qksgkxld76fgir3ycc5rjqv1sqds6x8yx40927q5py74gfh"; })
+  (fetchNuGet { pname = "xunit.analyzers"; version = "1.0.0"; sha256 = "0p4f24c462z49gvbh3k4z5ksa8ffa6p8abdgysqbbladl96im4c5"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.4.1"; sha256 = "1imynzh80wxq2rp9sc4gxs4x1nriil88f72ilhj5q0m44qqmqpc6"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.4.2"; sha256 = "0ifdry9qq3yaw2lfxdll30ljx1jkyhwwy3ydw6gd97y3kifr3k60"; })
+  (fetchNuGet { pname = "xunit.core"; version = "2.4.1"; sha256 = "1nnb3j4kzmycaw1g76ii4rfqkvg6l8gqh18falwp8g28h802019a"; })
+  (fetchNuGet { pname = "xunit.core"; version = "2.4.2"; sha256 = "1ir029igwm6b571lcm6585v5yxagy66rwrg26v4a1fnjq9dnh4cd"; })
+  (fetchNuGet { pname = "xunit.extensibility.core"; version = "2.4.1"; sha256 = "103qsijmnip2pnbhciqyk2jyhdm6snindg5z2s57kqf5pcx9a050"; })
+  (fetchNuGet { pname = "xunit.extensibility.core"; version = "2.4.2"; sha256 = "1h0a62xddsd82lljfjldn1nqy17imga905jb7j0ddr10wi8cqm62"; })
+  (fetchNuGet { pname = "xunit.extensibility.execution"; version = "2.4.1"; sha256 = "1pbilxh1gp2ywm5idfl0klhl4gb16j86ib4x83p8raql1dv88qia"; })
+  (fetchNuGet { pname = "xunit.extensibility.execution"; version = "2.4.2"; sha256 = "0r9gczqz4bc59cwl6d6wali6pvlw210i97chc1nlwn2qh383m54p"; })
+  (fetchNuGet { pname = "xunit.runner.visualstudio"; version = "2.4.5"; sha256 = "0y8w33ci80z8k580pp24mfnaw1r8ji0w3az543xxcz6aagax9zhs"; })
+]
diff --git a/pkgs/by-name/cy/cyclonedx-cli/package.nix b/pkgs/by-name/cy/cyclonedx-cli/package.nix
new file mode 100644
index 0000000000000..81f6554e9d5da
--- /dev/null
+++ b/pkgs/by-name/cy/cyclonedx-cli/package.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildDotnetModule
+, fetchFromGitHub
+}:
+
+buildDotnetModule rec {
+  pname = "cyclonedx-cli";
+  version = "0.25.0";
+
+  src = fetchFromGitHub {
+    owner = "CycloneDX";
+    repo = "cyclonedx-cli";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kAMSdUMr/NhsbMBViFJQlzgUNnxWgi/CLb3CW9OpWFo=";
+  };
+
+  nugetDeps = ./deps.nix;
+
+  preFixup = ''
+    cd $out/bin
+    find . ! -name 'cyclonedx' -type f -exec rm -f {} +
+  '';
+
+  meta = with lib; {
+    description = "CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions";
+    homepage = "https://github.com/CycloneDX/cyclonedx-cli";
+    changelog = "https://github.com/CycloneDX/cyclonedx-cli/releases/tag/v${version}";
+    maintainers = with maintainers; [ thillux ];
+    license = licenses.asl20;
+    platforms = with platforms; (linux ++ darwin);
+    mainProgram = "cyclonedx";
+  };
+}
diff --git a/pkgs/by-name/do/dogedns/package.nix b/pkgs/by-name/do/dogedns/package.nix
new file mode 100644
index 0000000000000..0c94a9506d2c0
--- /dev/null
+++ b/pkgs/by-name/do/dogedns/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, stdenv
+, pkg-config
+, openssl
+, pandoc
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dogedns";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "Dj-Codeman";
+    repo = "doge";
+    rev = "6dd0383f31c096bfe2b6918c36b6e2c48414e753";
+    hash = "sha256-cvqDSTHFf/le2jItGTSkAGURj64WRvOmMRI+vFH0/50=";
+  };
+
+  cargoHash = "sha256-v9AuX7FZfy18yu4P9ovHsL5AQIYhPa8NEsMziEeHCJ8=";
+
+  patches = [
+    # remove date info to make the build reproducible
+    # remove commit hash to avoid dependency on git and the need to keep `.git`
+    ./remove-date-info.patch
+  ];
+
+  nativeBuildInputs = [ installShellFiles pandoc ]
+    ++ lib.optionals stdenv.isLinux [ pkg-config ];
+  buildInputs = lib.optionals stdenv.isLinux [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+
+ postInstall = ''
+    installShellCompletion completions/doge.{bash,fish,zsh}
+    installManPage ./target/man/*.1
+  '';
+
+  meta = with lib; {
+    description = "Reviving A command-line DNS client";
+    homepage = "https://github.com/Dj-Codeman/doge";
+    license = licenses.eupl12;
+    mainProgram = "doge";
+    maintainers = with maintainers; [ aktaboot ];
+  };
+}
diff --git a/pkgs/by-name/do/dogedns/remove-date-info.patch b/pkgs/by-name/do/dogedns/remove-date-info.patch
new file mode 100644
index 0000000000000..0495ec4db4611
--- /dev/null
+++ b/pkgs/by-name/do/dogedns/remove-date-info.patch
@@ -0,0 +1,11 @@
+--- a/build.rs
++++ b/build.rs
+@@ -34,7 +34,7 @@ fn main() -> io::Result<()> {
+             format!("{}\nv{} \\1;31m(beta debug build!)\\0m\n\\1;4;34m{}\\0m", tagline, version_string(), url)
+         }
+         else if is_development_version() {
+-            format!("{}\nv{} [{}] built on {} \\1;31m(beta-release!)\\0m\n\\1;4;34m{}\\0m", tagline, version_string(), git_hash(), build_date(), url)
++            format!("{}\nv{} [nixpkgs] \\1;31m(beta-release!)\\0m\n\\1;4;34m{}\\0m", tagline, version_string(),  url)
+         }
+         else {
+             format!("{}\nv{}\n\\1;4;34m{}\\0m", tagline, version_string(), url)
diff --git a/pkgs/by-name/do/doublecmd/package.nix b/pkgs/by-name/do/doublecmd/package.nix
index 35746a409c77c..eb4de12dfd2f8 100644
--- a/pkgs/by-name/do/doublecmd/package.nix
+++ b/pkgs/by-name/do/doublecmd/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doublecmd";
-  version = "1.1.12";
+  version = "1.1.13";
 
   src = fetchFromGitHub {
     owner = "doublecmd";
     repo = "doublecmd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8wwYyZ9Uq65jEmgA1yO001YSZuDLnXLrFjK6WIsppwU=";
+    hash = "sha256-QJPLDqdXttUSeCm1QpQ7oFgvDmzStz9maW0c5xhOLtg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/du/dublin-traceroute/package.nix b/pkgs/by-name/du/dublin-traceroute/package.nix
index 5f559c4d97c49..5e797cf97b57f 100644
--- a/pkgs/by-name/du/dublin-traceroute/package.nix
+++ b/pkgs/by-name/du/dublin-traceroute/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "dublin-traceroute";
-  version = "0.4.2-unstable-2024-01-09";
+  version = "0.4.2-unstable-2024-04-11";
 
   src = fetchFromGitHub {
     owner = "insomniacslk";
     repo = "dublin-traceroute";
-    rev = "b136db81cfbb30d5fd324dfccc97fca49a5ecee1";
-    hash = "sha256-FsolpeQGaLDjDE5Yk58t2hFQJgM58zafIx6s5ejYKnY=";
+    rev = "a92118d93fd1fa7bdb827e741dd848b7f7083a1e";
+    hash = "sha256-UJeFPVi3423Jh72fVk8QbLX1tTNAQ504xYs9HwVCkZc=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -37,5 +37,6 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ baloo ];
     platforms = platforms.unix;
     mainProgram = "dublin-traceroute";
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch b/pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch
index e1c10cf82f96e..e1c10cf82f96e 100644
--- a/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch
+++ b/pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch
diff --git a/pkgs/by-name/ea/earlyoom/package.nix b/pkgs/by-name/ea/earlyoom/package.nix
new file mode 100644
index 0000000000000..ba69b72b3babf
--- /dev/null
+++ b/pkgs/by-name/ea/earlyoom/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  fetchFromGitHub,
+  installShellFiles,
+  pandoc,
+  stdenv,
+  nixosTests,
+  # Boolean flags
+  withManpage ? true,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "earlyoom";
+  version = "1.8";
+
+  src = fetchFromGitHub {
+    owner = "rfjakob";
+    repo = "earlyoom";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-jgNoYOGor2i3ngDuU3It238n5ky+AppzlRKdkwXb2AI=";
+  };
+
+  outputs = [ "out" ] ++ lib.optionals withManpage [ "man" ];
+
+  patches = [ ./0000-fix-dbus-path.patch ];
+
+  nativeBuildInputs = lib.optionals withManpage [
+    installShellFiles
+    pandoc
+  ];
+
+  makeFlags = [
+    "VERSION=${finalAttrs.version}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D earlyoom $out/bin/earlyoom
+  '' + lib.optionalString withManpage ''
+    installManPage earlyoom.1
+  '' + ''
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) earlyoom;
+  };
+
+  meta = {
+    homepage = "https://github.com/rfjakob/earlyoom";
+    description = "Early OOM Daemon for Linux";
+    longDescription = ''
+      earlyoom checks the amount of available memory and free swap up to 10
+      times a second (less often if there is a lot of free memory). By default
+      if both are below 10%, it will kill the largest process (highest
+      oom_score). The percentage value is configurable via command line
+      arguments.
+    '';
+    license = lib.licenses.mit;
+    mainProgram = "earlyoom";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ei/eigenlayer/package.nix b/pkgs/by-name/ei/eigenlayer/package.nix
index 6f24e3169e355..484d1007f25a4 100644
--- a/pkgs/by-name/ei/eigenlayer/package.nix
+++ b/pkgs/by-name/ei/eigenlayer/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "eigenlayer";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "Layr-Labs";
     repo = "eigenlayer-cli";
     rev = "v${version}";
-    hash = "sha256-vGXu6xQUeXLUkmLqJEXaVNXhxXZSmVlnQicBZAfj768=";
+    hash = "sha256-HsDuDe2ANxL+cTJ3mm1enLoKRewZ9Ey/YajpsLO66JA=";
   };
 
-  vendorHash = "sha256-9DbyfUKJjzqbZcX7j/df6fdtgZt3RY1kq2H2RK+5Vfk=";
+  vendorHash = "sha256-aclRbQtGg6yQMJtaO1WjtHLXU7cE1HX1ZDckRIEtw6o=";
 
   ldflags = ["-s" "-w"];
   subPackages = ["cmd/eigenlayer"];
diff --git a/pkgs/by-name/et/etlegacy-unwrapped/package.nix b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
index 84526ae11ada5..906ffa86c2183 100644
--- a/pkgs/by-name/et/etlegacy-unwrapped/package.nix
+++ b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
@@ -22,7 +22,7 @@
 , zlib
 }:
 let
-  version = "2.82.0";
+  version = "2.82.1";
   fakeGit = writeShellApplication {
     name = "git";
 
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
     owner = "etlegacy";
     repo = "etlegacy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yNVVEa+3+Swm3hgwm9cSLV0K88E37TgVVjh1uUl8O2o=";
+    hash = "sha256-DA5tudbehXIU+4hX3ggcxWZ7AAOa8LUkIvUHbgMgDY8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/et/etlegacy/package.nix b/pkgs/by-name/et/etlegacy/package.nix
index 446659c0148fb..245291d1e99fa 100644
--- a/pkgs/by-name/et/etlegacy/package.nix
+++ b/pkgs/by-name/et/etlegacy/package.nix
@@ -7,7 +7,7 @@
 
 symlinkJoin {
   name = "etlegacy";
-  version = "2.82.0";
+  version = "2.82.1";
   paths = [
     etlegacy-assets
     etlegacy-unwrapped
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 3e258bfca5b52..80aa328d289ec 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -10,23 +10,23 @@
 , darwin
 , libiconv
 , installShellFiles
-  # once eza upstream gets support for setting up a compatibilty symlink for exa, we should change
+  # once eza upstream gets support for setting up a compatibility symlink for exa, we should change
   # the handling here from postInstall to passing the required argument to the builder.
 , exaAlias ? true
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.18.10";
+  version = "0.18.11";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-qXyuibsgEF/wv2736r3EMpoXjyDFI3QFjVRsg9cI0u0=";
+    hash = "sha256-jh1YmY3G3oL8HfgojGtrJLvgLT+gyTX0fsv/11UDIJ0=";
   };
 
-  cargoHash = "sha256-9xtJJDP3f4aRPTgnpor0nSp5ehbX7Qt9U3LN9kkDWrI=";
+  cargoHash = "sha256-4ziEG7P7igCkN6UnVqaWXgqfW+XssUP4Rn867ELXYmU=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/fe/feather/package.nix b/pkgs/by-name/fe/feather/package.nix
index 99e7cf6e2166b..659f7ad1872f0 100644
--- a/pkgs/by-name/fe/feather/package.nix
+++ b/pkgs/by-name/fe/feather/package.nix
@@ -9,6 +9,7 @@
 , openssl
 , pkg-config
 , protobuf
+, python3
 , qrencode
 , qt6
 , readline
@@ -34,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
+    python3
     qt6.wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/fi/find-billy/package.nix b/pkgs/by-name/fi/find-billy/package.nix
new file mode 100644
index 0000000000000..89d89dd104f3a
--- /dev/null
+++ b/pkgs/by-name/fi/find-billy/package.nix
@@ -0,0 +1,70 @@
+{ stdenv
+, lib
+, fetchFromGitea
+, godot3-headless
+, godot3-export-templates
+, godot3
+, makeWrapper
+, just
+, inkscape
+, imagemagick
+}:
+
+stdenv.mkDerivation rec {
+  pname = "find-billy";
+  version = "0.37.3";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "annaaurora";
+    repo = "Find-Billy";
+    rev = "v${version}";
+    hash = "sha256-z1GR5W67LJb5z+u/qeFZreMK4B6PjB18coecLCYFHy8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ godot3-headless makeWrapper just inkscape imagemagick ];
+
+  postPatch = ''
+    substituteInPlace export_presets.cfg --replace 'res://build/icons/usr/share/icons/hicolor' $out/share/icons/hicolor
+    substituteInPlace project.godot --replace 'res://build/icons/usr/share/icons/hicolor' $out/share/icons/hicolor
+
+    substituteInPlace justfile --replace '{{build_icons_dir}}/usr' $out
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # Cannot create file `/homeless-shelter/.config/godot/projects/...`
+    export HOME=$TMPDIR
+    # Link the export-templates to the expected location. The `--export` option expects the templates in the home directory.
+    mkdir -p $HOME/.local/share/godot
+    ln -s ${godot3-export-templates}/share/godot/templates $HOME/.local/share/godot
+
+    mkdir -p $out/share/find-billy
+    godot3-headless --export-pack 'Linux/X11' $out/share/${pname}/${pname}.pck
+    makeWrapper ${godot3}/bin/godot3 $out/bin/${pname} \
+      --add-flags "--main-pack" \
+      --add-flags "$out/share/${pname}/${pname}.pck"
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    just build-icons
+    install -D ${pname}.desktop -t $out/share/applications
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A 2 dimensional Pixel Art Jump & Run";
+    homepage = "https://codeberg.org/annaaurora/Find-Billy";
+    license = licenses.gpl3Plus;
+    platforms = [ "x86_64-linux" ];
+    maintainers = [ maintainers.annaaurora ];
+  };
+}
diff --git a/pkgs/data/fonts/fira-mono/default.nix b/pkgs/by-name/fi/fira-mono/package.nix
index 5d059dbf88e08..5d059dbf88e08 100644
--- a/pkgs/data/fonts/fira-mono/default.nix
+++ b/pkgs/by-name/fi/fira-mono/package.nix
diff --git a/pkgs/data/fonts/fira/default.nix b/pkgs/by-name/fi/fira-sans/package.nix
index 4b79d14dd94e7..c07cc15c97cce 100644
--- a/pkgs/data/fonts/fira/default.nix
+++ b/pkgs/by-name/fi/fira-sans/package.nix
@@ -1,20 +1,16 @@
-{ lib, stdenvNoCC, fetchFromGitHub }:
+{ lib
+, stdenvNoCC
+, fira-mono
+}:
 
-stdenvNoCC.mkDerivation rec {
-  pname = "fira";
-  version = "4.202";
-
-  src = fetchFromGitHub {
-    owner = "mozilla";
-    repo = "Fira";
-    rev = version;
-    hash = "sha256-HLReqgL0PXF5vOpwLN0GiRwnzkjGkEVEyOEV2Z4R0oQ=";
-  };
+stdenvNoCC.mkDerivation {
+  pname = "fira-sans";
+  inherit (fira-mono) version src;
 
   installPhase = ''
     runHook preInstall
 
-    install --mode=-x -Dt $out/share/fonts/opentype otf/*.otf
+    install --mode=-x -Dt $out/share/fonts/opentype otf/FiraSans*.otf
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/fi/fira/package.nix b/pkgs/by-name/fi/fira/package.nix
new file mode 100644
index 0000000000000..405189ba2e99f
--- /dev/null
+++ b/pkgs/by-name/fi/fira/package.nix
@@ -0,0 +1,23 @@
+{ lib
+, symlinkJoin
+, fira-mono
+, fira-sans
+}:
+
+symlinkJoin rec {
+  pname = "fira";
+  inherit (fira-mono) version;
+  name = "${pname}-${version}";
+
+  paths = [
+    fira-mono
+    fira-sans
+  ];
+
+  meta = {
+    description = "Fira font family including Fira Sans and Fira Mono";
+    homepage = "https://mozilla.github.io/Fira/";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/fi/firefly-iii/package.nix b/pkgs/by-name/fi/firefly-iii/package.nix
new file mode 100644
index 0000000000000..850bb85755d65
--- /dev/null
+++ b/pkgs/by-name/fi/firefly-iii/package.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchFromGitHub
+, buildNpmPackage
+, php83
+, nixosTests
+, dataDir ? "/var/lib/firefly-iii"
+}:
+
+let
+  pname = "firefly-iii";
+  version = "6.1.13";
+  phpPackage = php83;
+
+  src = fetchFromGitHub {
+    owner = "firefly-iii";
+    repo = "firefly-iii";
+    rev = "v${version}";
+    hash = "sha256-85zI8uCyyoCflzxDkvba6FWa9B3kh179DJfQ2Um6MGM=";
+  };
+
+  assets = buildNpmPackage {
+    pname = "${pname}-assets";
+    inherit version src;
+    npmDepsHash = "sha256-wuPUE6XuzzgKjpxZVgwh2wGut15M61WSBFG+YIZwOFM=";
+    dontNpmBuild = true;
+    installPhase = ''
+      runHook preInstall
+      npm run build
+      cp -r ./public $out/
+      runHook postInstall
+    '';
+  };
+in
+
+phpPackage.buildComposerProject (finalAttrs: {
+  inherit pname src version;
+
+  vendorHash = "sha256-CVGKyyLp5hjjpEulDNEYfljU4OgPBaFcYQQAUf6GeGs=";
+
+  passthru = {
+    inherit phpPackage;
+    tests = nixosTests.firefly-iii;
+  };
+
+  postInstall = ''
+    mv $out/share/php/${pname}/* $out/
+    rm -R $out/share $out/storage $out/bootstrap/cache $out/public
+    cp -a ${assets} $out/public
+    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/cache $out/bootstrap/cache
+  '';
+
+  meta = {
+    changelog = "https://github.com/firefly-iii/firefly-iii/releases/tag/v${version}";
+    description = "Firefly III: a personal finances manager";
+    homepage = "https://github.com/firefly-iii/firefly-iii";
+    license = lib.licenses.agpl3Only;
+    maintainers = [ lib.maintainers.savyajha ];
+  };
+})
diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
index 971d5ac16fdea..b75d6694c19df 100644
--- a/pkgs/by-name/fi/firefoxpwa/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -1,22 +1,26 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, makeWrapper
-, pkg-config
-, installShellFiles
-, firefox-unwrapped
-, openssl
-, stdenv
-, udev
-, libva
-, mesa
-, libnotify
-, xorg
-, cups
-, pciutils
-, libcanberra-gtk3
-, extraLibs ? [ ]
-, nixosTests
+{
+  extraLibs ? [ ],
+
+  lib,
+  fetchFromGitHub,
+  installShellFiles,
+  makeWrapper,
+  rustPlatform,
+
+  cups,
+  firefox-unwrapped,
+  libcanberra-gtk3,
+  libglvnd,
+  libnotify,
+  libva,
+  mesa,
+  nixosTests,
+  openssl,
+  pciutils,
+  pkg-config,
+  stdenv,
+  udev,
+  xorg,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -47,7 +51,11 @@ rustPlatform.buildRustPackage rec {
     sed -i $'s;DISTRIBUTION_VERSION = \'0.0.0\';DISTRIBUTION_VERSION = \'${version}\';' userchrome/profile/chrome/pwa/chrome.jsm
   '';
 
-  nativeBuildInputs = [ makeWrapper pkg-config installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+    pkg-config
+  ];
   buildInputs = [ openssl ];
 
   FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
@@ -55,7 +63,23 @@ rustPlatform.buildRustPackage rec {
   completions = "target/${stdenv.targetPlatform.config}/release/completions";
 
   gtk_modules = map (x: x + x.gtkModule) [ libcanberra-gtk3 ];
-  libs = let libs = lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils ] ++ gtk_modules ++ extraLibs; in lib.makeLibraryPath libs + ":" + lib.makeSearchPathOutput "lib" "lib64" libs;
+  libs =
+    let
+      libs =
+        lib.optionals stdenv.isLinux [
+          cups
+          libglvnd
+          libnotify
+          libva
+          mesa
+          pciutils
+          udev
+          xorg.libXScrnSaver
+        ]
+        ++ gtk_modules
+        ++ extraLibs;
+    in
+    lib.makeLibraryPath libs + ":" + lib.makeSearchPathOutput "lib" "lib64" libs;
 
   postInstall = ''
     # Runtime
@@ -127,7 +151,11 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/filips123/PWAsForFirefox/releases/tag/v${version}";
     license = licenses.mpl20;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ camillemndn pasqui23 ];
+    maintainers = with maintainers; [
+      adamcstephens
+      camillemndn
+      pasqui23
+    ];
     mainProgram = "firefoxpwa";
   };
 }
diff --git a/pkgs/by-name/fo/fork-cleaner/package.nix b/pkgs/by-name/fo/fork-cleaner/package.nix
new file mode 100644
index 0000000000000..30a670ab189bc
--- /dev/null
+++ b/pkgs/by-name/fo/fork-cleaner/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+let
+  version = "2.3.1";
+in
+buildGoModule {
+  name = "fork-cleaner";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "caarlos0";
+    repo = "fork-cleaner";
+    rev = "v${version}";
+    sha256 = "sha256-JNmpcDwmxR+s4regOWz8FAJllBNRfOCmVwkDs7tlChA=";
+  };
+
+  vendorHash = "sha256-QuIaXXkch5PCpX8P755X8j7MeNnbewWo7NB+Vue1/Pk=";
+
+  # allowGoRefence adds the flag `-trimpath` which is also denoted by, fork-cleaner goreleaser config
+  #  <https://github.com/caarlos0/fork-cleaner/blob/645345bf97d751614270de4ade698ddbc53509c1/goreleaser.yml#L38>
+  allowGoReference = true;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+    "-X main.builtBy=nixpkgs"
+  ];
+
+  meta = {
+    description = "Quickly clean up unused forks on your GitHub account";
+    homepage = "https://github.com/caarlos0/fork-cleaner";
+    changelog = "https://github.com/caarlos0/fork-cleaner/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ isabelroses ];
+    mainProgram = "fork-cleaner";
+  };
+}
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 96102fe2258c1..dcd00d290599a 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -43,14 +43,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.14.3";
+  version = "3.14.4";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     rev = "refs/tags/${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-+6RyrdHRDk9aeM52wcgLo966jP70EAiXSMR3sffNeZM=";
+    hash = "sha256-kmi+3EH5h5kQeyTB3RnnndPn+akHFAF0N7Gt/aCOdcs=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ga/gatus/package.nix b/pkgs/by-name/ga/gatus/package.nix
index ef7df35bdaed5..1e10ce2db4759 100644
--- a/pkgs/by-name/ga/gatus/package.nix
+++ b/pkgs/by-name/ga/gatus/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gatus";
-  version = "5.9.0";
+  version = "5.10.0";
 
   src = fetchFromGitHub {
     owner = "TwiN";
     repo = "gatus";
     rev = "v${version}";
-    hash = "sha256-obrdEnNxLdWtbGL57D/nTClaOdzJlLDU3+K9VdR8XI4=";
+    hash = "sha256-gZSK3ebBBJGHRdylCl18AYifGknYbOz7+xaCJjU9ZlY=";
   };
 
-  vendorHash = "sha256-VICVo7XYeHs/43knHA4CMSgHloyYSjOFe1TUb4u+egE=";
+  vendorHash = "sha256-sZ6IPYitNnnw7+UQVAWFEe9/ObDhAiou1GzDDqnGXb8=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gi/gitu/package.nix b/pkgs/by-name/gi/gitu/package.nix
index 4fc148542604f..8754c3bb7ed78 100644
--- a/pkgs/by-name/gi/gitu/package.nix
+++ b/pkgs/by-name/gi/gitu/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitu";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "altsem";
     repo = "gitu";
     rev = "v${version}";
-    hash = "sha256-ePyMyKCI8fHKfoNCMYyYeCPkyYF5KyMYaPrB1NtovCs=";
+    hash = "sha256-9OY6zBW7UA4lTH+NI61xuil5p2ChQESXrG2zTxdJblE=";
   };
 
-  cargoHash = "sha256-1komuFSucXYdgeAFWeeuMmZYxb6Mzku7hdltDwKAa7A=";
+  cargoHash = "sha256-gVmoKneAtC5dJh5Z+3aXwxCixrPZTRcxQRpoSh4S1e4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/gl/glider/package.nix b/pkgs/by-name/gl/glider/package.nix
new file mode 100644
index 0000000000000..55304ada4c985
--- /dev/null
+++ b/pkgs/by-name/gl/glider/package.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "glider";
+  version = "0.16.3";
+
+  src = fetchFromGitHub {
+    owner = "nadoo";
+    repo = "glider";
+    rev = "v${version}";
+    hash = "sha256-nM6jKFqyaxZbn0wyEt0xy9uTu9JyLRfGTNsGPTQOXQw=";
+  };
+
+  vendorHash = "sha256-PGIBBop/waZDeQvW7iSi/AzLye/4t7nNXjX8zJsS2eo=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  postInstall = ''
+    substituteInPlace systemd/glider@.service \
+      --replace-fail "/usr/bin/glider" "$out/bin/glider"
+    install -Dm444 -t "$out/lib/systemd/system/" systemd/glider@.service
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/nadoo/glider";
+    description = "Forward proxy with multiple protocols support";
+    license = licenses.gpl3Only;
+    mainProgram = "glider";
+    maintainers = with maintainers; [ oluceps ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/go/go-camo/package.nix b/pkgs/by-name/go/go-camo/package.nix
index 42cc8b7ba5daa..e90fa676cbd4d 100644
--- a/pkgs/by-name/go/go-camo/package.nix
+++ b/pkgs/by-name/go/go-camo/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-camo";
-  version = "2.4.11";
+  version = "2.4.12";
 
   src = fetchFromGitHub {
     owner = "cactus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wgneDCBiHg9M1PtLHFxEXRhK9fBNKPWQwV0fwUFxEgQ=";
+    sha256 = "sha256-rlzAx6xjV4JR3RDL+Kr2ghN3qpfIRqVZ5z/SyDBBaIc=";
   };
 
-  vendorHash = "sha256-duTW42UL8EtnxUvPr2GXHKcaGQ3d0u2maMzSIOHIxxI=";
+  vendorHash = "sha256-iyZNOooPH1jvT+S9/ETRoXsTwXUIUi1UKmDzhB7NRuE=";
 
   ldflags = [ "-s" "-w" "-X=main.ServerVersion=${version}" ];
 
diff --git a/pkgs/by-name/gt/gtfocli/package.nix b/pkgs/by-name/gt/gtfocli/package.nix
new file mode 100644
index 0000000000000..3ce328daa0242
--- /dev/null
+++ b/pkgs/by-name/gt/gtfocli/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "gtfocli";
+  version = "0.0.4";
+
+  src = fetchFromGitHub {
+    owner = "cmd-tools";
+    repo = "gtfocli";
+    rev = "refs/tags/${version}";
+    hash = "sha256-fSk/OyeUffYZOkHXM1m/a9traDxdllYBieMEfsv910Q=";
+  };
+
+  vendorHash = "sha256-yhN2Ve4mBw1HoC3zXYz+M8+2CimLGduG9lGTXi+rPNw=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = with lib; {
+    description = "GTFO Command Line Interface for search binaries commands to bypass local security restrictions";
+    homepage = "https://github.com/cmd-tools/gtfocli";
+    changelog = "https://github.com/cmd-tools/gtfocli/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "gtfocli";
+  };
+}
diff --git a/pkgs/by-name/gv/gvisor/package.nix b/pkgs/by-name/gv/gvisor/package.nix
index ceb122a2c08db..0a83adc5953c3 100644
--- a/pkgs/by-name/gv/gvisor/package.nix
+++ b/pkgs/by-name/gv/gvisor/package.nix
@@ -47,6 +47,6 @@ buildGoModule {
     homepage = "https://github.com/google/gvisor";
     license = licenses.asl20;
     maintainers = with maintainers; [ andrew-d gpl ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index 391bc8b9680f2..6aea05d15a2c2 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -16,14 +16,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "unstable-2024-04-10";
+  version = "unstable-2024-04-16";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "31357486b0ef6f4e161e002b6893eeb4fafc3ca9";
-    hash = "sha256-2APpO3ZW4idlgtlb8hB04u/rmIcKA8O7pYqxF66xbNY=";
+    rev = "fa8c16e2452bf092ac76f09ee1fb1e9f7d0796e7";
+    hash = "sha256-LmaabaQZdx52MPGKPRt9Opoc9Gd9RbwvCdysUUYQoXI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hypridle/package.nix b/pkgs/by-name/hy/hypridle/package.nix
index 0526d741dd9d0..32f0982100c12 100644
--- a/pkgs/by-name/hy/hypridle/package.nix
+++ b/pkgs/by-name/hy/hypridle/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hypridle";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hypridle";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YayFU0PZkwnKn1RSV3+i2HlSha/IFkG5osXcT0b/EUw=";
+    hash = "sha256-7Ft5WZTMIjXOGgRCf31DZBwK6RK8xkeKlD5vFXz3gII=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ig/igir/package.nix b/pkgs/by-name/ig/igir/package.nix
index 488febb21a590..820d843dc0ed4 100644
--- a/pkgs/by-name/ig/igir/package.nix
+++ b/pkgs/by-name/ig/igir/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "igir";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "emmercm";
     repo = "igir";
     rev = "v${version}";
-    hash = "sha256-bJPUGB9fyeOb5W9EzQldh4rRJQBat58MgjjfS1qh66w=";
+    hash = "sha256-0WA+7qw5ZuELHc8P0yizV+kEwSmoUBmgReM8ZosGnqs=";
   };
 
-  npmDepsHash = "sha256-q8gpx5zwiO/7ZBB/YruhCUgukp71sfJju8nmF6SwTrc=";
+  npmDepsHash = "sha256-UfTq7/da1V9ubHh2wGvktP/SiWfyL8yF9iuCOq8Hxwg=";
 
   # I have no clue why I have to do this
   postPatch = ''
diff --git a/pkgs/by-name/ja/jan/package.nix b/pkgs/by-name/ja/jan/package.nix
index ea2bb38f1b5c4..49b6f245f76f2 100644
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@@ -5,10 +5,10 @@
 
 let
   pname = "jan";
-  version = "0.4.10";
+  version = "0.4.11";
   src = fetchurl {
     url = "https://github.com/janhq/jan/releases/download/v${version}/jan-linux-x86_64-${version}.AppImage";
-    hash = "sha256-IOqwz3pJ4veuxQwfkMs0Zf8dNQcQ0HwnR3SPBVvQXtU=";
+    hash = "sha256-EDQK8W0MxwXSNaHx2snByHs2Wr3RXtlNiXajzDMVJpc=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -20,7 +20,7 @@ appimageTools.wrapType2 {
     mv $out/bin/jan-${version} $out/bin/jan
     install -Dm444 ${appimageContents}/jan.desktop -t $out/share/applications
     substituteInPlace $out/share/applications/jan.desktop \
-      --replace 'Exec=AppRun --no-sandbox %U' 'Exec=jan'
+      --replace-fail 'Exec=AppRun --no-sandbox %U' 'Exec=jan'
     cp -r ${appimageContents}/usr/share/icons $out/share
   '';
 
diff --git a/pkgs/by-name/ja/jasper/package.nix b/pkgs/by-name/ja/jasper/package.nix
index e399268a202cb..34e517c81eaba 100644
--- a/pkgs/by-name/ja/jasper/package.nix
+++ b/pkgs/by-name/ja/jasper/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jasper";
-  version = "4.2.2";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "jasper-software";
     repo = "jasper";
     rev = "version-${finalAttrs.version}";
-    hash = "sha256-dcE9Cc+L/nLp/JCvYuGLRnkxL1i3dLIB9cSILWaZWn4=";
+    hash = "sha256-Hmmoe1lzUR1DBwgg30KGfsIDzSNe5shghaieEXX/am4=";
   };
 
   outputs = [ "out" "dev" "doc" "lib" "man" ];
diff --git a/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix b/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
new file mode 100644
index 0000000000000..34ec710a9b455
--- /dev/null
+++ b/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitea,
+  makeDesktopItem,
+  copyDesktopItems,
+  makeWrapper,
+  renpy,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "katawa-shoujo-re-engineered";
+  version = "1.4.4";
+
+  src = fetchFromGitea {
+    # GitHub mirror at fleetingheart/ksre
+    domain = "codeberg.org";
+    owner = "fhs";
+    repo = "katawa-shoujo-re-engineered";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-RYJM/wGVWqIRZzHLUtUZ5mKUrUftDVaOwS1f/EpW6Tk=";
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "katawa-shoujo-re-engineered";
+      desktopName = "Katawa Shoujo: Re-Engineered";
+      type = "Application";
+      icon = finalAttrs.meta.mainProgram;
+      categories = [ "Game" ];
+      exec = finalAttrs.meta.mainProgram;
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe' renpy "renpy"} $out/bin/${finalAttrs.meta.mainProgram} \
+      --add-flags ${finalAttrs.src} --add-flags run
+    install -D $src/web-icon.png $out/share/icons/hicolor/512x512/apps/${finalAttrs.meta.mainProgram}.png
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A fan-made modernization of the classic visual novel Katawa Shoujo";
+    homepage = "https://www.fhs.sh/projects";
+    license = with lib.licenses; [
+      # code
+      mpl20
+      # assets from the original game
+      cc-by-nc-nd-30
+    ];
+    mainProgram = "katawa-shoujo-re-engineered";
+    maintainers = with lib.maintainers; [ quantenzitrone ];
+    platforms = renpy.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/kc/kcl-cli/package.nix b/pkgs/by-name/kc/kcl-cli/package.nix
index 1065bde95de2e..5a8dfc9e4d02b 100644
--- a/pkgs/by-name/kc/kcl-cli/package.nix
+++ b/pkgs/by-name/kc/kcl-cli/package.nix
@@ -5,14 +5,14 @@
 
 buildGoModule rec {
   pname = "kcl-cli";
-  version = "0.8.5";
+  version = "0.8.6";
   src = fetchFromGitHub {
     owner = "kcl-lang";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-ZjEMgQukhBGY3LWqsGmLj3lKfLtNNaQugQs0cSLMb80=";
+    hash = "sha256-A98Y5ktXFwn1XrFTwL8l04VW5zPNcMLtZCUf+niXx6c=";
   };
-  vendorHash = "sha256-jmqKMB85HxAlwH7FVjHrLCZQYuAJrguRfzIz1yMypjw=";
+  vendorHash = "sha256-zFTcwyK5HT1cwfHJB3n5Eh2JE3xuXqAluU3McA+FurQ=";
   ldflags = [
     "-X=kcl-lang.io/cli/pkg/version.version=${version}"
   ];
diff --git a/pkgs/by-name/kt/ktfmt/package.nix b/pkgs/by-name/kt/ktfmt/package.nix
index 49546fd411018..99d5b03f9a53d 100644
--- a/pkgs/by-name/kt/ktfmt/package.nix
+++ b/pkgs/by-name/kt/ktfmt/package.nix
@@ -11,14 +11,17 @@ maven.buildMavenPackage rec {
     hash = "sha256-vdvKHTTD84OAQacv/VE/5BxYdW4n3bxPUHF2MdH+sQQ=";
   };
 
-  mvnHash = "sha256-Cl7P2i4VFJ/yk7700u62YPcacfKkhBztFvcDkYBfZEA=";
+  patches = [ ./pin-default-maven-plugin-versions.patch ];
+
+  mvnHash = "sha256-iw28HS0WMFC9BKQKr0v33D77rMQeIMKjXduqPcYU1XA=";
+
+  mvnParameters = "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z";
 
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
     install -Dm644 core/target/ktfmt-*-jar-with-dependencies.jar $out/share/ktfmt/ktfmt.jar
 
     makeWrapper ${jre_headless}/bin/java $out/bin/ktfmt \
diff --git a/pkgs/by-name/kt/ktfmt/pin-default-maven-plugin-versions.patch b/pkgs/by-name/kt/ktfmt/pin-default-maven-plugin-versions.patch
new file mode 100644
index 0000000000000..d3425669da0f9
--- /dev/null
+++ b/pkgs/by-name/kt/ktfmt/pin-default-maven-plugin-versions.patch
@@ -0,0 +1,60 @@
+diff --git a/core/pom.xml b/core/pom.xml
+index 267689e..6b6e04d 100644
+--- a/core/pom.xml
++++ b/core/pom.xml
+@@ -34,6 +34,55 @@
+         <sourceDirectory>${project.basedir}/src/main/java</sourceDirectory>
+         <testSourceDirectory>${project.basedir}/src/test/java</testSourceDirectory>
+         <plugins>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-enforcer-plugin</artifactId>
++                <version>3.4.1</version>
++                <executions>
++                    <execution>
++                        <id>require-all-plugin-versions-to-be-set</id>
++                        <phase>validate</phase>
++                        <goals>
++                            <goal>enforce</goal>
++                        </goals>
++                        <configuration>
++                            <rules>
++                                <requirePluginVersions />
++                            </rules>
++                        </configuration>
++                    </execution>
++                </executions>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-surefire-plugin</artifactId>
++                <version>3.2.5</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-clean-plugin</artifactId>
++                <version>3.3.2</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-install-plugin</artifactId>
++                <version>3.1.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-site-plugin</artifactId>
++                <version>4.0.0-M13</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-resources-plugin</artifactId>
++                <version>3.3.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-deploy-plugin</artifactId>
++                <version>3.1.1</version>
++            </plugin>
+             <plugin>
+                 <groupId>org.jetbrains.kotlin</groupId>
+                 <artifactId>kotlin-maven-plugin</artifactId>
diff --git a/pkgs/by-name/lb/lbd/package.nix b/pkgs/by-name/lb/lbd/package.nix
new file mode 100644
index 0000000000000..f84ed553ad25b
--- /dev/null
+++ b/pkgs/by-name/lb/lbd/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, makeWrapper
+, bash
+, coreutils
+, diffutils
+, gawk
+, gnugrep
+, gnused
+, host
+, netcat-openbsd
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "lbd";
+  version = "0-unstable-2024-02-17";
+
+  src = fetchFromGitHub {
+    owner = "D3vil0p3r";
+    repo = "lbd";
+    rev = "73baaaecddcd834d43d79f50f0808b779c9a97c3";
+    hash = "sha256-NHY3NoPigsmfRjOx9Lt3/fGsyeq1/bzKHIXMDBJiI6c=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,share/lbd}
+    cp lbd $out/share/lbd/
+    makeWrapper ${lib.getExe bash} $out/bin/lbd \
+      --prefix PATH : "${lib.makeBinPath [ coreutils diffutils gawk gnugrep gnused host netcat-openbsd ]}" \
+      --add-flags "$out/share/lbd/lbd"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Detect if a domain uses DNS and/or HTTP Load-Balancing";
+    mainProgram = "lbd";
+    homepage = "https://github.com/D3vil0p3r/lbd";
+    maintainers = with maintainers; [ d3vil0p3r ];
+    platforms = platforms.unix;
+    license = licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/by-name/li/libigl/package.nix b/pkgs/by-name/li/libigl/package.nix
new file mode 100644
index 0000000000000..085915ea352f3
--- /dev/null
+++ b/pkgs/by-name/li/libigl/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "libigl";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "libigl";
+    repo = "libigl";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-OpjkQGRiuc7kNlwgCeM4dcotTb5J+6LUn4IOe9bFbW4=";
+  };
+
+  # We could also properly use CMake, but we would have to heavily patch it
+  # to avoid configure-time downloads of many things.
+  installPhase = ''
+    mkdir -p $out/include
+    cp -r include/igl $out/include
+  '';
+
+  meta = with lib; {
+    description = "Simple C++ geometry processing library";
+    homepage = "https://github.com/libigl/libigl";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 52a6ba51c2f49..aa1c7afa3470c 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -12,7 +12,7 @@
 }:
 
 let
-  version = "7.3.1";
+  version = "7.4.0";
 in
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${version}/limine-${version}.tar.gz";
-    sha256 = "sha256-xlOBBb281W9QT5Fv2Hgw/eyh7K3oyaNY1yU6WktbFro=";
+    sha256 = "sha256-lPesgQENZkMbxl/4sh+wTR21QfPJg57CDmqTwcy4b2k=";
   };
 
   nativeBuildInputs = [
@@ -58,6 +58,7 @@ stdenv.mkDerivation {
     # The platforms on that the Liminine binary and helper tools can run, not
     # necessarily the platforms for that bootable images can be created.
     platforms = platforms.unix;
+    badPlatforms = platforms.darwin;
     maintainers = [
       maintainers._48cf
       maintainers.phip1611
diff --git a/pkgs/by-name/li/livekit/package.nix b/pkgs/by-name/li/livekit/package.nix
index 40706a679c2d9..b362366e51f65 100644
--- a/pkgs/by-name/li/livekit/package.nix
+++ b/pkgs/by-name/li/livekit/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "livekit";
-  version = "1.5.3";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit";
     rev = "v${version}";
-    hash = "sha256-2MooX+wy7KetxEBgQoVoL4GuVkm+SbTzYgfWyLL7KU8=";
+    hash = "sha256-tgoVHRv8hnDkjFYShZ/3lieknhIobHv27RVvQOCtEWU=";
   };
 
-  vendorHash = "sha256-8YR0Bl+sQsqpFtD+1GeYaydBdHeM0rRL2NbgAh9kCj0=";
+  vendorHash = "sha256-TZ435gu5naFi/JLz6B/1fpvGA3diJp4JIWL1zgNlb4Q=";
 
   subPackages = [ "cmd/server" ];
 
diff --git a/pkgs/by-name/lu/luneta/dub-lock.json b/pkgs/by-name/lu/luneta/dub-lock.json
new file mode 100644
index 0000000000000..b45bfa0fd6545
--- /dev/null
+++ b/pkgs/by-name/lu/luneta/dub-lock.json
@@ -0,0 +1,24 @@
+{
+  "dependencies": {
+    "arsd-official": {
+      "version": "7.2.0",
+      "sha256": "1m546r6l0pkk80y5f3ff8im08hp59nwzjb5ikjhfiswvdizpwjlh"
+    },
+    "fuzzyd": {
+      "version": "2.2.0-beta",
+      "sha256": "0wzih4yrlrrj12ls9hd27gnxrj4j4c0ha9xprdfc7azszlv16j6g"
+    },
+    "ncurses": {
+      "version": "1.0.0",
+      "sha256": "0ivl88vp2dy9rpv6x3f9jlyqa7aps2x1kkyx80w2d4vcs31pzmb2"
+    },
+    "riverd-loader": {
+      "version": "1.0.2",
+      "sha256": "0c94551bscnia7vpixaq4xd2anprkd7pkf0q0anyadv5kqa8xgip"
+    },
+    "riverd-ncurses": {
+      "version": "1.0.5",
+      "sha256": "1wgdschv6hpdjykf5bblxphnhnpy2kvw8hq8h5iaygi9zr7jf286"
+    }
+  }
+}
diff --git a/pkgs/by-name/lu/luneta/package.nix b/pkgs/by-name/lu/luneta/package.nix
new file mode 100644
index 0000000000000..02e9a0724da2b
--- /dev/null
+++ b/pkgs/by-name/lu/luneta/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildDubPackage,
+  fetchFromGitHub,
+  ncurses,
+}:
+
+buildDubPackage rec {
+  pname = "luneta";
+  version = "0.7.4";
+
+  src = fetchFromGitHub {
+    owner = "fbeline";
+    repo = "luneta";
+    rev = "v${version}";
+    hash = "sha256-pYE8hccXT87JIMh71PtXzVQBegTzU7bdpVEaV2VkaEk=";
+  };
+
+  # not sure why, but this alias does not resolve
+  postPatch = ''
+    substituteInPlace source/luneta/keyboard.d \
+        --replace-fail "wint_t" "dchar"
+  '';
+
+  # ncurses dub package version is locked to 1.0.0 instead of using ~master
+  dubLock = ./dub-lock.json;
+
+  buildInputs = [ ncurses ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 luneta -t $out/bin
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/fbeline/luneta/releases/tag/${src.rev}";
+    description = "An interactive filter and fuzzy finder for the command-line";
+    homepage = "https://github.com/fbeline/luneta";
+    license = lib.licenses.gpl2Only;
+    mainProgram = "luneta";
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+}
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index 36f8fcf420708..cb63a81700545 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.2.0",
-    "hash": "sha256-vxGJHm1StQNN+0IVlGMqKVKW56LH6KUC94utDn7FcNo="
+    "version": "5.2.1",
+    "hash": "sha256-pyvHhFfwgozaTP3AhqWPKOuXdC23stXiUW2PpdYRR7M="
   },
   "beta": {
-    "version": "5.2.0",
-    "hash": "sha256-vxGJHm1StQNN+0IVlGMqKVKW56LH6KUC94utDn7FcNo="
+    "version": "5.2.1",
+    "hash": "sha256-pyvHhFfwgozaTP3AhqWPKOuXdC23stXiUW2PpdYRR7M="
   }
 }
diff --git a/pkgs/by-name/ma/mautrix-meta/package.nix b/pkgs/by-name/ma/mautrix-meta/package.nix
index 198890a4b35ab..7de21ab0233cc 100644
--- a/pkgs/by-name/ma/mautrix-meta/package.nix
+++ b/pkgs/by-name/ma/mautrix-meta/package.nix
@@ -1,8 +1,14 @@
-{ lib, buildGoModule, fetchFromGitHub, olm, config }:
+{ buildGoModule
+, config
+, fetchFromGitHub
+, lib
+, nixosTests
+, olm
+}:
 
 buildGoModule rec {
   pname = "mautrix-meta";
-  version = "0.2.0";
+  version = "0.3.0";
 
   subPackages = [ "." ];
 
@@ -10,14 +16,21 @@ buildGoModule rec {
     owner = "mautrix";
     repo = "meta";
     rev = "v${version}";
-    hash = "sha256-n0FpEHgnMdg6W5wahIT5HaF9AP/QYlLuUWJS+VrElgg=";
+    hash = "sha256-QyVcy9rqj1n1Nn/+gBufd57LyEaXPyu0KQhAUTgNmBA=";
   };
 
   buildInputs = [ olm ];
 
-  vendorHash = "sha256-GkgIang3/1u0ybznHgK1l84bEiCj6u4qf8G+HgLGr90=";
+  vendorHash = "sha256-oQSjP1WY0LuxrMtIrvyKhize91wXJxTzWeH0Y3MsEL4=";
 
-  doCheck = false;
+  passthru = {
+    tests = {
+      inherit (nixosTests)
+        mautrix-meta-postgres
+        mautrix-meta-sqlite
+        ;
+    };
+  };
 
   meta = {
     homepage = "https://github.com/mautrix/meta";
diff --git a/pkgs/by-name/mc/mcap-cli/package.nix b/pkgs/by-name/mc/mcap-cli/package.nix
index 80ddcd574b027..8f4fd9d7406cd 100644
--- a/pkgs/by-name/mc/mcap-cli/package.nix
+++ b/pkgs/by-name/mc/mcap-cli/package.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub, nix-update-script
 }:
 let
-  version = "0.0.42";
+  version = "0.0.43";
 in
 buildGoModule {
 
@@ -13,10 +13,10 @@ buildGoModule {
     repo = "mcap";
     owner = "foxglove";
     rev = "releases/mcap-cli/v${version}";
-    hash = "sha256-9fjzMUMWn5j8AJJq+tK+Hq0o8d3HpacitJZ5CfLiaLw=";
+    hash = "sha256-AWmPqymnNZxKbhxiQOO9djQXbP56mNh9Ucmty2jd+4Q=";
   };
 
-  vendorHash = "sha256-Gl0zLBTWscKGtVOS6rPRL/r8KHYHpZwoUDbEyCL4Ijk=";
+  vendorHash = "sha256-YFbfrqu2H7yU6vANH56MnxipDxaJLT76qZkvqLCFTTg=";
 
   modRoot = "go/cli/mcap";
 
diff --git a/pkgs/by-name/me/mednafen-server/package.nix b/pkgs/by-name/me/mednafen-server/package.nix
new file mode 100644
index 0000000000000..59247cf46c592
--- /dev/null
+++ b/pkgs/by-name/me/mednafen-server/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mednafen-server";
+  version = "0.5.2";
+
+  src = fetchurl {
+    url = "https://mednafen.github.io/releases/files/mednafen-server-${finalAttrs.version}.tar.xz";
+    hash = "sha256-uJmxaMW+bydfAXq8XDOioMoBOLUsi5OT2Tpbbotsp3Y=";
+  };
+
+  strictDeps = true;
+
+  postInstall = ''
+    install -m 644 -Dt $out/share/mednafen-server standard.conf
+  '';
+
+  meta = {
+    description = "Netplay server for Mednafen";
+    mainProgram = "mednafen-server";
+    homepage = "https://mednafen.github.io/";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/applications/emulators/mednafen/default.nix b/pkgs/by-name/me/mednafen/package.nix
index 816b6c1bd4d7c..057f3ed4cf130 100644
--- a/pkgs/applications/emulators/mednafen/default.nix
+++ b/pkgs/by-name/me/mednafen/package.nix
@@ -1,33 +1,39 @@
-{ lib
-, stdenv
-, fetchurl
-, SDL2
-, SDL2_net
-, alsa-lib
-, flac
-, freeglut
-, libGL
-, libGLU
-, libX11
-, libcdio
-, libjack2
-, libsamplerate
-, libsndfile
-, pkg-config
-, zlib
-, libiconv
+{
+  lib,
+  SDL2,
+  SDL2_net,
+  alsa-lib,
+  fetchurl,
+  flac,
+  freeglut,
+  libGL,
+  libGLU,
+  libX11,
+  libcdio,
+  libiconv,
+  libjack2,
+  libsamplerate,
+  libsndfile,
+  pkg-config,
+  stdenv,
+  zlib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mednafen";
   version = "1.29.0";
 
   src = fetchurl {
-    url = "https://mednafen.github.io/releases/files/${pname}-${version}.tar.xz";
+    url = "https://mednafen.github.io/releases/files/mednafen-${finalAttrs.version}.tar.xz";
     hash = "sha256-2j+88Ch3+b4PAov6XRy1npU6QEm5D+fjk4ijOG2fNi4=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  outputs = [ "out" "doc" ];
+
+  nativeBuildInputs = [
+    SDL2
+    pkg-config
+  ];
 
   buildInputs = [
     SDL2
@@ -48,16 +54,21 @@ stdenv.mkDerivation rec {
     libiconv
   ];
 
-  hardeningDisable = [ "pic" "format" ];
+  hardeningDisable = [
+    "format"
+    "pic"
+  ];
 
   enableParallelBuilding = true;
 
+  strictDeps = true;
+
   postInstall = ''
-    mkdir -p $out/share/doc
-    mv Documentation $out/share/doc/mednafen
+    mkdir -p $doc/share/doc
+    mv Documentation $doc/share/doc/mednafen
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://mednafen.github.io/";
     description = "A portable, CLI-driven, SDL+OpenGL-based, multi-system emulator";
     longDescription = ''
@@ -91,9 +102,9 @@ stdenv.mkDerivation rec {
       - Sega Saturn (experimental, x86_64 only)
       - Sony PlayStation
     '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2Plus;
     mainProgram = "mednafen";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/me/mednaffe/package.nix b/pkgs/by-name/me/mednaffe/package.nix
new file mode 100644
index 0000000000000..5625c380eaa7a
--- /dev/null
+++ b/pkgs/by-name/me/mednaffe/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  autoreconfHook,
+  fetchFromGitHub,
+  gtk3,
+  mednafen,
+  pkg-config,
+  stdenv,
+  wrapGAppsHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mednaffe";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "AmatCoder";
+    repo = "mednaffe";
+    rev = finalAttrs.version;
+    hash = "sha256-ZizW0EeY/Cc68m87cnbLAkx3G/ULyFT5b6Ku2ObzFRU=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    mednafen
+  ];
+
+  enableParallelBuilding = true;
+
+  strictDeps = true;
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH ':' "${mednafen}/bin"
+    )
+   '';
+
+  meta = {
+    description = "GTK-based frontend for mednafen emulator";
+    mainProgram = "mednaffe";
+    homepage = "https://github.com/AmatCoder/mednaffe";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/me/meson/0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch b/pkgs/by-name/me/meson/0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch
new file mode 100644
index 0000000000000..ff9440905310b
--- /dev/null
+++ b/pkgs/by-name/me/meson/0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch
@@ -0,0 +1,92 @@
+From 8304b645c655832c47ee9ca706d182c26d29eaff Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Tue, 9 Apr 2024 06:35:39 +0000
+Subject: [PATCH] Revert "rust: recursively pull proc-macro dependencies as
+ well"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit aee941559c4b88a062e88186819a820c69c200ae.
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ mesonbuild/build.py                                   |  2 ++
+ test cases/rust/18 proc-macro/lib.rs                  |  8 --------
+ test cases/rust/18 proc-macro/meson.build             | 11 -----------
+ test cases/rust/18 proc-macro/subdir/meson.build      |  1 -
+ .../rust/18 proc-macro/transitive-proc-macro.rs       |  7 -------
+ 5 files changed, 2 insertions(+), 27 deletions(-)
+ delete mode 100644 test cases/rust/18 proc-macro/lib.rs
+ delete mode 100644 test cases/rust/18 proc-macro/subdir/meson.build
+ delete mode 100644 test cases/rust/18 proc-macro/transitive-proc-macro.rs
+
+diff --git a/mesonbuild/build.py b/mesonbuild/build.py
+index 6f0d6a2dd..7be9b497b 100644
+--- a/mesonbuild/build.py
++++ b/mesonbuild/build.py
+@@ -1295,6 +1295,8 @@ def get_dependencies_recurse(self, result: OrderedSet[BuildTargetTypes], include
+         for t in self.link_targets:
+             if t in result:
+                 continue
++            if t.rust_crate_type == 'proc-macro':
++                continue
+             if include_internals or not t.is_internal():
+                 result.add(t)
+             if isinstance(t, StaticLibrary):
+diff --git a/test cases/rust/18 proc-macro/lib.rs b/test cases/rust/18 proc-macro/lib.rs
+deleted file mode 100644
+index 5242886cc..000000000
+--- a/test cases/rust/18 proc-macro/lib.rs	
++++ /dev/null
+@@ -1,8 +0,0 @@
+-extern crate proc_macro_examples;
+-use proc_macro_examples::make_answer;
+-
+-make_answer!();
+-
+-pub fn func() -> u32 {
+-    answer()
+-}
+diff --git a/test cases/rust/18 proc-macro/meson.build b/test cases/rust/18 proc-macro/meson.build
+index e8b28eda1..c5f0dfc82 100644
+--- a/test cases/rust/18 proc-macro/meson.build	
++++ b/test cases/rust/18 proc-macro/meson.build	
+@@ -31,14 +31,3 @@ main = executable(
+ )
+ 
+ test('main_test2', main)
+-
+-subdir('subdir')
+-
+-staticlib = static_library('staticlib', 'lib.rs',
+-  link_with: pm_in_subdir,
+-  rust_dependency_map : {'proc_macro_examples3' : 'proc_macro_examples'}
+-)
+-
+-executable('transitive-proc-macro', 'transitive-proc-macro.rs',
+-  link_with: staticlib,
+-)
+diff --git a/test cases/rust/18 proc-macro/subdir/meson.build b/test cases/rust/18 proc-macro/subdir/meson.build
+deleted file mode 100644
+index 04842c431..000000000
+--- a/test cases/rust/18 proc-macro/subdir/meson.build	
++++ /dev/null
+@@ -1 +0,0 @@
+-pm_in_subdir = rust.proc_macro('proc_macro_examples3', '../proc.rs')
+diff --git a/test cases/rust/18 proc-macro/transitive-proc-macro.rs b/test cases/rust/18 proc-macro/transitive-proc-macro.rs
+deleted file mode 100644
+index 4c804b3b6..000000000
+--- a/test cases/rust/18 proc-macro/transitive-proc-macro.rs	
++++ /dev/null
+@@ -1,7 +0,0 @@
+-extern crate staticlib;
+-use staticlib::func;
+-
+-
+-fn main() {
+-    assert_eq!(42, func());
+-}
+-- 
+2.44.0
+
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 04064b4255c6e..b2c85c431e01d 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -14,17 +14,17 @@
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation LDAP OpenGL;
+  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation LDAP OpenAL OpenGL;
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-7M/El2snWsQi+gaZWPHnEr9gpJW3trqG1RbnT43M49s=";
+    hash = "sha256-hRTmKO2E6SIdvAhO7OJtV8dcsGm39c51H+2ZGEkdcFY=";
   };
 
   patches = [
@@ -65,6 +65,10 @@ python3.pkgs.buildPythonApplication rec {
 
     # Nixpkgs cctools does not have bitcode support.
     ./006-disable-bitcode.patch
+
+    # Fix cross-compilation of proc-macro (and mesa)
+    # https://github.com/mesonbuild/meson/issues/12973
+    ./0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch
   ];
 
   buildInputs = lib.optionals (python3.pythonOlder "3.9") [
@@ -86,6 +90,7 @@ python3.pkgs.buildPythonApplication rec {
     Cocoa
     Foundation
     LDAP
+    OpenAL
     OpenGL
     openldap
   ];
@@ -96,6 +101,7 @@ python3.pkgs.buildPythonApplication rec {
       patchShebangs 'test cases'
       substituteInPlace \
         'test cases/native/8 external program shebang parsing/script.int.in' \
+        'test cases/common/273 customtarget exe for test/generate.py' \
           --replace /usr/bin/env ${coreutils}/bin/env
     ''
   ]
diff --git a/pkgs/by-name/mo/moproxy/package.nix b/pkgs/by-name/mo/moproxy/package.nix
new file mode 100644
index 0000000000000..ca25da7d401b0
--- /dev/null
+++ b/pkgs/by-name/mo/moproxy/package.nix
@@ -0,0 +1,40 @@
+{ fetchFromGitHub
+, rustPlatform
+, fetchurl
+, lib
+}:
+
+rustPlatform.buildRustPackage rec{
+  pname = "moproxy";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "sorz";
+    repo = "moproxy";
+    rev = "v${version}";
+    hash = "sha256-Rqno+cg44IWBJbKWUP6BnxzwCjuNhFo9nBF6u2jlyA4=";
+  };
+
+  cargoHash = "sha256-EunlvI7I6d93wb3hxgxsyAXkzxRlDu0fq9qqjnbzzWg=";
+
+  preBuild =
+    let
+      webBundle = fetchurl {
+        url = "https://github.com/sorz/moproxy-web/releases/download/v0.1.8/build.zip";
+        hash = "sha256-bLC76LnTWR2/xnDcZtX/t0OUmP7vdI/o3TCRzG9eH/g=";
+      };
+    in
+    ''
+      # build script try to download from network
+      sed -i '15s/.*/let zip_path = PathBuf::from("${lib.escape ["/"]  (toString webBundle)}");/' build.rs
+    '';
+
+  meta = with lib; {
+    homepage = "https://github.com/sorz/moproxy";
+    description = "A transparent TCP to SOCKSv5/HTTP proxy on Linux written in Rust";
+    license = licenses.mit;
+    mainProgram = "moproxy";
+    maintainers = with maintainers; [ oluceps ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/mq/mqttui/Cargo.lock b/pkgs/by-name/mq/mqttui/Cargo.lock
index fd3db1ec87029..7726441244f5a 100644
--- a/pkgs/by-name/mq/mqttui/Cargo.lock
+++ b/pkgs/by-name/mq/mqttui/Cargo.lock
@@ -19,9 +19,9 @@ checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "ahash"
-version = "0.8.9"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d713b3834d76b85304d4d525563c1276e2e30dc97cc67bfb4585a4a29fc2c89f"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -31,9 +31,9 @@ dependencies = [
 
 [[package]]
 name = "allocator-api2"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
 
 [[package]]
 name = "android-tzdata"
@@ -52,9 +52,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.12"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b09b5178381e0874812a9b157f7fe84982617e48f71f4e3235482775e5b540"
+checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -100,21 +100,22 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.80"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ad32ce52e4161730f7098c077cd2ed6229b5804ccf99e5366be1ab72a98b4e1"
+checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
 
 [[package]]
 name = "async-tungstenite"
-version = "0.23.0"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e9efbe14612da0a19fb983059a0b621e9cf6225d7018ecab4f9988215540dc"
+checksum = "2cca750b12e02c389c1694d35c16539f88b8bbaa5945934fdc1b41a776688589"
 dependencies = [
  "futures-io",
  "futures-util",
  "log",
  "pin-project-lite",
  "rustls-native-certs",
+ "rustls-pki-types",
  "tokio",
  "tokio-rustls",
  "tungstenite",
@@ -134,15 +135,15 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
 
 [[package]]
 name = "backtrace"
-version = "0.3.69"
+version = "0.3.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
 dependencies = [
  "addr2line",
  "cc",
@@ -155,9 +156,9 @@ dependencies = [
 
 [[package]]
 name = "base64"
-version = "0.21.7"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
 
 [[package]]
 name = "bitflags"
@@ -167,9 +168,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.2"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "block-buffer"
@@ -182,9 +183,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.3"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea184aa71bb362a1157c896979544cc23974e08fd265f29ea96b59f0b4a555b"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "byteorder"
@@ -194,9 +195,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "cassowary"
@@ -215,9 +216,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.88"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02f341c093d19155a6e41631ce5971aac4e9a868262212153124c15fa22d1cdc"
+checksum = "17f6e324229dc011159fcc089755d1e2e216a90d43a7dea6853ca740b84f35e7"
 
 [[package]]
 name = "cfg-if"
@@ -227,21 +228,22 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.34"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "num-traits",
- "windows-targets 0.52.3",
+ "serde",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
 name = "clap"
-version = "4.5.1"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c918d541ef2913577a0f9566e9ce27cb35b6df072075769e0b26cb5a554520da"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -249,9 +251,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.1"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f3e7391dad68afb0c2ede1bf619f579a3dc9c2ec67f089baa397123a2f3d1eb"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
@@ -262,23 +264,23 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.1"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "885e4d7d5af40bfb99ae6f9433e292feac98d452dcb3ec3d25dfe7552b77da8c"
+checksum = "dd79504325bf38b10165b02e89b4347300f855f273c4cb30c4a3209e6583275e"
 dependencies = [
  "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.5.0"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "307bc0538d5f0f83b8248db3087aa92fe504e4691294d0c96c0eabc33f47ba47"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
- "heck",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -347,7 +349,7 @@ version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f476fe445d41c9e991fd07515a6f463074b782242ccf4a5b7b1d1012e70824df"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "crossterm_winapi",
  "libc",
  "mio",
@@ -400,9 +402,9 @@ checksum = "3a68a4904193147e0a8dec3314640e6db742afd5f6e634f428a6af230d9b3591"
 
 [[package]]
 name = "either"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "errno"
@@ -496,7 +498,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -541,9 +543,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -573,10 +575,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
 name = "http"
-version = "0.2.11"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
 dependencies = [
  "bytes",
  "fnv",
@@ -624,9 +632,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.4"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "itertools"
@@ -639,15 +647,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "js-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "406cda4b368d531c842222cf9d2600a9a4acce8d29423695379c6868a143a9ee"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -676,9 +684,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "lru"
@@ -691,9 +699,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "miniz_oxide"
@@ -706,9 +714,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "log",
@@ -718,7 +726,7 @@ dependencies = [
 
 [[package]]
 name = "mqttui"
-version = "0.20.0"
+version = "0.21.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -735,6 +743,8 @@ dependencies = [
  "rustls",
  "rustls-native-certs",
  "rustls-pemfile",
+ "rustls-pki-types",
+ "serde",
  "serde_json",
  "tui-tree-widget",
  "url",
@@ -817,9 +827,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pin-utils"
@@ -835,18 +845,18 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.78"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -883,11 +893,11 @@ dependencies = [
 
 [[package]]
 name = "ratatui"
-version = "0.26.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcb12f8fbf6c62614b0d56eb352af54f6a22410c3b079eb53ee93c7b97dd31d8"
+checksum = "a564a852040e82671dc50a37d88f3aa83bbc690dfc6844cfe7a2591620206a80"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "cassowary",
  "compact_str",
  "crossterm",
@@ -935,9 +945,9 @@ dependencies = [
 
 [[package]]
 name = "rmp"
-version = "0.8.12"
+version = "0.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f9860a6cc38ed1da53456442089b4dfa35e7cedaa326df63017af88385e6b20"
+checksum = "228ed7c16fa39782c3b3468e974aec2795e9089153cd08ee2e9aefb3613334c4"
 dependencies = [
  "byteorder",
  "num-traits",
@@ -946,12 +956,14 @@ dependencies = [
 
 [[package]]
 name = "rmpv"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e0e0214a4a2b444ecce41a4025792fc31f77c7bb89c46d253953ea8c65701ec"
+checksum = "e540282f11751956c82bc5529a7fb71b871b998fbf9cf06c2419b22e1b4350df"
 dependencies = [
  "num-traits",
  "rmp",
+ "serde",
+ "serde_bytes",
 ]
 
 [[package]]
@@ -962,9 +974,9 @@ checksum = "b833d8d034ea094b1ea68aa6d5c740e0d04bad9d16568d08ba6f76823a114316"
 
 [[package]]
 name = "rumqttc"
-version = "0.23.0"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d8941c6791801b667d52bfe9ff4fc7c968d4f3f9ae8ae7abdaaa1c966feafc8"
+checksum = "e1568e15fab2d546f940ed3a21f48bbbd1c494c90c99c4481339364a497f94a9"
 dependencies = [
  "async-tungstenite",
  "bytes",
@@ -998,11 +1010,11 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.31"
+version = "0.38.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -1011,52 +1023,63 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.21.10"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+checksum = "99008d7ad0bbbea527ec27bddbc0e432c5b87d8175178cee68d2eec9c4a1813c"
 dependencies = [
  "log",
  "ring",
+ "rustls-pki-types",
  "rustls-webpki",
- "sct",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.6.3"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+checksum = "8f1fb85efa936c42c6d5fc28d2629bb51e4b2f4b8a5211e297d599cc5a093792"
 dependencies = [
  "openssl-probe",
  "rustls-pemfile",
+ "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
 
 [[package]]
 name = "rustls-pemfile"
-version = "1.0.4"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
 dependencies = [
  "base64",
+ "rustls-pki-types",
 ]
 
 [[package]]
+name = "rustls-pki-types"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecd36cc4259e3e4514335c4a138c6b43171a8d61d8f5c9348f9fc7529416f247"
+
+[[package]]
 name = "rustls-webpki"
-version = "0.101.7"
+version = "0.102.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
 dependencies = [
  "ring",
+ "rustls-pki-types",
  "untrusted",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
+checksum = "80af6f9131f277a45a3fba6ce8e2258037bb0477a67e610d3c1fe046ab31de47"
 
 [[package]]
 name = "ryu"
@@ -1080,20 +1103,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
-
-[[package]]
 name = "security-framework"
-version = "2.9.2"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
+checksum = "770452e37cad93e0a50d5abc3990d2bc351c36d0328f86cefec2f2fb206eaef6"
 dependencies = [
  "bitflags 1.3.2",
  "core-foundation",
@@ -1104,9 +1117,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.9.1"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
+checksum = "41f3cc463c0ef97e11c3461a9d3787412d30e8e7eb907c79180c4a57bf7c04ef"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1120,29 +1133,38 @@ checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
 
 [[package]]
 name = "serde"
-version = "1.0.197"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
+name = "serde_bytes"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b8497c313fd43ab992087548117643f6fcd935cbf36f176ffda0aacf9591734"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "serde_derive"
-version = "1.0.197"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.114"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
  "itoa",
  "ryu",
@@ -1201,9 +1223,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "socket2"
@@ -1226,12 +1248,12 @@ dependencies = [
 
 [[package]]
 name = "stability"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebd1b177894da2a2d9120208c3386066af06a488255caabc5de8ddca22dbc3ce"
+checksum = "2ff9eaf853dec4c8802325d8b6d3dffa86cc707fd7a1a4cdbf416e13b061787a"
 dependencies = [
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -1242,48 +1264,43 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "strsim"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "strum"
-version = "0.26.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "723b93e8addf9aa965ebe2d11da6d7540fa2283fcea14b3371ff055f7ba13f5f"
+checksum = "5d8cec3501a5194c432b2b7976db6b7d10ec95c253208b45f83f7136aa985e29"
 dependencies = [
  "strum_macros",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.26.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a3417fc93d76740d974a01654a09777cb500428cc874ca9f45edfe0c4d4cd18"
+checksum = "c6cf59daf282c0a494ba14fd21610a0325f9f90ec9d1231dea26bcb1d696c946"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
-name = "syn"
-version = "1.0.109"
+name = "subtle"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "syn"
-version = "2.0.51"
+version = "2.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab617d94515e94ae53b8406c628598680aa0c9587474ecbe58188f7b345d66c"
+checksum = "4a6531ffc7b071655e4ce2e04bd464c4830bb585a61cabb96cf808f05172615a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1302,22 +1319,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.57"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e45bcbe8ed29775f228095caf2cd67af7a4ccf756ebff23a306bf3e8b47b24b"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.57"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a953cb265bef375dae3de6663da4d3804eee9682ea80d8e2542529b73c531c81"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -1337,9 +1354,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.36.0"
+version = "1.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
 dependencies = [
  "backtrace",
  "bytes",
@@ -1359,16 +1376,17 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.24.1"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
 dependencies = [
  "rustls",
+ "rustls-pki-types",
  "tokio",
 ]
 
@@ -1391,7 +1409,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -1415,9 +1433,9 @@ dependencies = [
 
 [[package]]
 name = "tungstenite"
-version = "0.20.1"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e3dac10fd62eaf6617d3a904ae222845979aec67c615d1c842b4002c7666fb9"
+checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
 dependencies = [
  "byteorder",
  "bytes",
@@ -1427,6 +1445,7 @@ dependencies = [
  "log",
  "rand",
  "rustls",
+ "rustls-pki-types",
  "sha1",
  "thiserror",
  "url",
@@ -1515,9 +1534,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -1525,24 +1544,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1550,22 +1569,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "winapi"
@@ -1595,7 +1614,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.3",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -1613,7 +1632,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.3",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -1633,17 +1652,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d380ba1dc7187569a8a9e91ed34b8ccfc33123bbacb8c0aed2d1ad7f3ef2dc5f"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.3",
- "windows_aarch64_msvc 0.52.3",
- "windows_i686_gnu 0.52.3",
- "windows_i686_msvc 0.52.3",
- "windows_x86_64_gnu 0.52.3",
- "windows_x86_64_gnullvm 0.52.3",
- "windows_x86_64_msvc 0.52.3",
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -1654,9 +1674,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68e5dcfb9413f53afd9c8f86e56a7b4d86d9a2fa26090ea2dc9e40fba56c6ec6"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -1666,9 +1686,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dab469ebbc45798319e69eebf92308e541ce46760b49b18c6b3fe5e8965b30f"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -1678,9 +1698,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4e9b6a7cac734a8b4138a4e1044eac3404d8326b6c0f939276560687a033fb"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -1690,9 +1716,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b0ec9c422ca95ff34a78755cfa6ad4a51371da2a5ace67500cf7ca5f232c58"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -1702,9 +1728,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "704131571ba93e89d7cd43482277d6632589b18ecf4468f591fbae0a8b101614"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -1714,9 +1740,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42079295511643151e98d61c38c0acc444e52dd42ab456f7ccfd5152e8ecf21c"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -1726,19 +1752,19 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0770833d60a970638e989b3fa9fd2bb1aaadcf88963d1659fd7d9990196ed2d6"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "ws_stream_tungstenite"
-version = "0.11.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e283cc794a890f5bdc01e358ad7c34535025f79ba83c1b5c7e01e5d6c60b336d"
+checksum = "a198f414f083fb19fcc1bffcb0fa0cf46d33ccfa229adf248cac12c180e91609"
 dependencies = [
  "async-tungstenite",
  "async_io_stream",
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "futures-core",
  "futures-io",
  "futures-sink",
@@ -1767,5 +1793,11 @@ checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
+
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/pkgs/by-name/mq/mqttui/package.nix b/pkgs/by-name/mq/mqttui/package.nix
index 6c7ca4cb46292..a1023cb6debae 100644
--- a/pkgs/by-name/mq/mqttui/package.nix
+++ b/pkgs/by-name/mq/mqttui/package.nix
@@ -1,19 +1,20 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, darwin
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mqttui";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "EdJoPaTo";
     repo = "mqttui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NfRPuZFZMZl1ulEGD5oQkS25oJdBVyLiN3QCQWrDej8=";
+    hash = "sha256-aIvT1js+xY1rauZYVCkl71JLfIDjIEGy3W8WdIaTyxY=";
   };
 
   cargoLock = {
@@ -34,7 +35,10 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/EdJoPaTo/mqttui";
     changelog = "https://github.com/EdJoPaTo/mqttui/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ fab sikmir ];
+    maintainers = with maintainers; [
+      fab
+      sikmir
+    ];
     mainProgram = "mqttui";
   };
 }
diff --git a/pkgs/by-name/my/mycelium/Cargo.lock b/pkgs/by-name/my/mycelium/Cargo.lock
index ecdc6cf89f71b..9151a00466595 100644
--- a/pkgs/by-name/my/mycelium/Cargo.lock
+++ b/pkgs/by-name/my/mycelium/Cargo.lock
@@ -154,10 +154,10 @@ dependencies = [
  "axum-core",
  "bytes",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.0",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.2.0",
+ "hyper",
  "hyper-util",
  "itoa",
  "matchit",
@@ -186,8 +186,8 @@ dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.0",
+ "http",
+ "http-body",
  "http-body-util",
  "mime",
  "pin-project-lite",
@@ -452,12 +452,14 @@ dependencies = [
 ]
 
 [[package]]
-name = "encoding_rs"
-version = "0.8.33"
+name = "dlopen2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "09b4f5f101177ff01b8ec4ecc81eead416a8aa42819a2869311b3420fa114ffa"
 dependencies = [
- "cfg-if",
+ "libc",
+ "once_cell",
+ "winapi",
 ]
 
 [[package]]
@@ -520,6 +522,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
 name = "form_urlencoded"
 version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -669,35 +686,16 @@ checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
 name = "h2"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.11",
- "indexmap",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
-name = "h2"
-version = "0.4.2"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31d030e59af851932b72ceebadf4a2b5986dba4c3b99dd2493f8273a0f151943"
+checksum = "816ec7294445779408f36fe57bc5b7fc1cf59664059096c65f905c1c61f58069"
 dependencies = [
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
  "futures-util",
- "http 1.1.0",
+ "http",
  "indexmap",
  "slab",
  "tokio",
@@ -724,15 +722,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d3d0e0f38255e7fa3cf31335b3a56f05febd18025f4db5ef7a0cfb4f8da651f"
 
 [[package]]
-name = "http"
-version = "0.2.11"
+name = "hex"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
@@ -747,23 +740,12 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
-dependencies = [
- "bytes",
- "http 0.2.11",
- "pin-project-lite",
-]
-
-[[package]]
-name = "http-body"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
 dependencies = [
  "bytes",
- "http 1.1.0",
+ "http",
 ]
 
 [[package]]
@@ -774,8 +756,8 @@ checksum = "41cb79eb393015dadd30fc252023adb0b2400a0caee0fa2a077e6e21a551e840"
 dependencies = [
  "bytes",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.0",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -799,30 +781,6 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2 0.3.24",
- "http 0.2.11",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
-[[package]]
-name = "hyper"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
@@ -830,15 +788,16 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "h2 0.4.2",
- "http 1.1.0",
- "http-body 1.0.0",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
  "smallvec",
  "tokio",
+ "want",
 ]
 
 [[package]]
@@ -848,13 +807,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
 dependencies = [
  "bytes",
+ "futures-channel",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.0",
- "hyper 1.2.0",
+ "http",
+ "http-body",
+ "hyper",
  "pin-project-lite",
  "socket2",
  "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -887,6 +850,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "io-lifetimes"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
 name = "ioctl-sys"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -911,7 +885,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bad00257d07be169d870ab665980b06cdb366d792ad690bf2e76876dc503455"
 dependencies = [
  "hermit-abi",
- "rustix",
+ "rustix 0.38.30",
  "windows-sys 0.52.0",
 ]
 
@@ -964,11 +938,27 @@ dependencies = [
 
 [[package]]
 name = "linux-raw-sys"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
+
+[[package]]
+name = "linux-raw-sys"
 version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
+name = "lock_api"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
 name = "log"
 version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1003,6 +993,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
 [[package]]
+name = "memalloc"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df39d232f5c40b0891c10216992c2f250c054105cb1e56f0fc9032db6203ecc1"
+
+[[package]]
 name = "memchr"
 version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1045,14 +1041,11 @@ dependencies = [
 
 [[package]]
 name = "mycelium"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
  "aes-gcm",
- "axum",
- "base64 0.22.0",
  "blake3",
  "bytes",
- "clap",
  "etherparse",
  "faster-hex",
  "futures",
@@ -1061,28 +1054,60 @@ dependencies = [
  "left-right",
  "libc",
  "log",
- "network-interface",
+ "netdev",
  "nix 0.28.0",
- "pretty_env_logger",
+ "openssl",
  "quinn",
  "rand",
  "rcgen",
- "reqwest",
  "rtnetlink",
  "rustls",
  "serde",
- "serde_json",
  "tokio",
+ "tokio-openssl",
  "tokio-stream",
  "tokio-tun",
  "tokio-util",
- "toml",
  "tun",
  "wintun 0.4.0",
  "x25519-dalek",
 ]
 
 [[package]]
+name = "myceliumd"
+version = "0.5.1"
+dependencies = [
+ "axum",
+ "base64 0.22.0",
+ "clap",
+ "log",
+ "mycelium",
+ "pretty_env_logger",
+ "prometheus",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "netdev"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb353f5a5a852d5cc779c1c80bec0bd14a696ef832f3a761cb10091802c37109"
+dependencies = [
+ "dlopen2",
+ "libc",
+ "memalloc",
+ "netlink-packet-core",
+ "netlink-packet-route 0.17.1",
+ "netlink-sys",
+ "once_cell",
+ "system-configuration",
+ "windows 0.54.0",
+]
+
+[[package]]
 name = "netlink-packet-core"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1095,6 +1120,20 @@ dependencies = [
 
 [[package]]
 name = "netlink-packet-route"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053998cea5a306971f88580d0829e90f270f940befd7cf928da179d4187a5a66"
+dependencies = [
+ "anyhow",
+ "bitflags 1.3.2",
+ "byteorder",
+ "libc",
+ "netlink-packet-core",
+ "netlink-packet-utils",
+]
+
+[[package]]
+name = "netlink-packet-route"
 version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74c171cd77b4ee8c7708da746ce392440cb7bcf618d122ec9ecc607b12938bf4"
@@ -1148,18 +1187,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "network-interface"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee524f98ddbe7772762a7477cfb22356df075cac4069bf81ac5082a46db742c"
-dependencies = [
- "cc",
- "libc",
- "thiserror",
- "winapi",
-]
-
-[[package]]
 name = "nix"
 version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1225,12 +1252,83 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
 
 [[package]]
+name = "openssl"
+version = "0.10.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
+dependencies = [
+ "bitflags 2.4.2",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
+name = "openssl-src"
+version = "300.2.3+3.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cff92b6f71555b61bb9315f7c64da3ca43d87531622120fea0195fc761b4843"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
+dependencies = [
+ "cc",
+ "libc",
+ "openssl-src",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
 name = "overload"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets 0.48.5",
+]
+
+[[package]]
 name = "paste"
 version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1285,6 +1383,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
+name = "pkg-config"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+
+[[package]]
 name = "platforms"
 version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1334,6 +1438,42 @@ dependencies = [
 ]
 
 [[package]]
+name = "procfs"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1de8dacb0873f77e6aefc6d71e044761fcc68060290f5b1089fcdf84626bb69"
+dependencies = [
+ "bitflags 1.3.2",
+ "byteorder",
+ "hex",
+ "lazy_static",
+ "rustix 0.36.17",
+]
+
+[[package]]
+name = "prometheus"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "449811d15fbdf5ceb5c1144416066429cf82316e2ec8ce0c1f6f8a02e7bbcf8c"
+dependencies = [
+ "cfg-if",
+ "fnv",
+ "lazy_static",
+ "libc",
+ "memchr",
+ "parking_lot",
+ "procfs",
+ "protobuf",
+ "thiserror",
+]
+
+[[package]]
+name = "protobuf"
+version = "2.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
+
+[[package]]
 name = "quinn"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1432,6 +1572,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "redox_syscall"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
 name = "regex"
 version = "1.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1477,19 +1626,19 @@ checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "reqwest"
-version = "0.11.23"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
+checksum = "3e6cc1e89e689536eb5aeede61520e874df5a4707df811cd5da4aa5fbb2aae19"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.0",
  "bytes",
- "encoding_rs",
  "futures-core",
  "futures-util",
- "h2 0.3.24",
- "http 0.2.11",
- "http-body 0.4.6",
- "hyper 0.14.28",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
  "ipnet",
  "js-sys",
  "log",
@@ -1500,7 +1649,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "system-configuration",
+ "sync_wrapper 0.1.2",
  "tokio",
  "tower-service",
  "url",
@@ -1548,7 +1697,7 @@ dependencies = [
  "futures",
  "log",
  "netlink-packet-core",
- "netlink-packet-route",
+ "netlink-packet-route 0.19.0",
  "netlink-packet-utils",
  "netlink-proto",
  "netlink-sys",
@@ -1580,6 +1729,20 @@ dependencies = [
 
 [[package]]
 name = "rustix"
+version = "0.36.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "305efbd14fde4139eb501df5f136994bb520b033fa9fbdce287507dc23b8c7ed"
+dependencies = [
+ "bitflags 1.3.2",
+ "errno",
+ "io-lifetimes",
+ "libc",
+ "linux-raw-sys 0.1.4",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "rustix"
 version = "0.38.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "322394588aaf33c24007e8bb3238ee3e4c5c09c084ab32bc73890b99ff326bca"
@@ -1587,7 +1750,7 @@ dependencies = [
  "bitflags 2.4.2",
  "errno",
  "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.4.13",
  "windows-sys 0.52.0",
 ]
 
@@ -1631,6 +1794,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
 
 [[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
 name = "sct"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1688,15 +1857,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde_spanned"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
-dependencies = [
- "serde",
-]
-
-[[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1811,20 +1971,20 @@ checksum = "384595c11a4e2969895cad5a8c4029115f5ab956a9e5ef4de79d11a426e5f20c"
 
 [[package]]
 name = "system-configuration"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+checksum = "658bc6ee10a9b4fcf576e9b0819d95ec16f4d2c02d39fd83ac1c8789785c4a42"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.4.2",
  "core-foundation",
  "system-configuration-sys",
 ]
 
 [[package]]
 name = "system-configuration-sys"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1932,6 +2092,18 @@ dependencies = [
 ]
 
 [[package]]
+name = "tokio-openssl"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ffab79df67727f6acf57f1ff743091873c24c579b1e2ce4d8f53e47ded4d63d"
+dependencies = [
+ "futures-util",
+ "openssl",
+ "openssl-sys",
+ "tokio",
+]
+
+[[package]]
 name = "tokio-stream"
 version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1945,12 +2117,12 @@ dependencies = [
 
 [[package]]
 name = "tokio-tun"
-version = "0.11.2"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf2efaf33e86779a3a68b1f1d6e9e13a346c1c75ee3cab7a4293235c463b2668"
+checksum = "65d79912ba514490b1f5a574b585e19082bd2a6b238970c87c57a66bd77206b5"
 dependencies = [
  "libc",
- "nix 0.27.1",
+ "nix 0.28.0",
  "thiserror",
  "tokio",
 ]
@@ -1970,40 +2142,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "toml"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
-dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime",
- "toml_edit",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.22.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c12219811e0c1ba077867254e5ad62ee2c9c190b0d957110750ac0cda1ae96cd"
-dependencies = [
- "indexmap",
- "serde",
- "serde_spanned",
- "toml_datetime",
- "winnow",
-]
-
-[[package]]
 name = "tower"
 version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2016,6 +2154,7 @@ dependencies = [
  "tokio",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -2036,6 +2175,7 @@ version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -2187,6 +2327,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
 
 [[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
 name = "version_check"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2340,7 +2486,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
 dependencies = [
  "windows-core 0.52.0",
- "windows-targets 0.52.0",
+ "windows-targets 0.52.4",
+]
+
+[[package]]
+name = "windows"
+version = "0.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9252e5725dbed82865af151df558e754e4a3c2c30818359eb17465f1346a1b49"
+dependencies = [
+ "windows-core 0.54.0",
+ "windows-targets 0.52.4",
 ]
 
 [[package]]
@@ -2358,7 +2514,35 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.0",
+ "windows-targets 0.52.4",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12661b9c89351d684a50a8a643ce5f608e20243b9fb84687800163429f161d65"
+dependencies = [
+ "windows-result",
+ "windows-targets 0.52.4",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd19df78e5168dfb0aedc343d1d1b8d422ab2db6756d2dc3fef75035402a3f64"
+dependencies = [
+ "windows-targets 0.52.4",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
 ]
 
 [[package]]
@@ -2376,7 +2560,22 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.0",
+ "windows-targets 0.52.4",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
 ]
 
 [[package]]
@@ -2396,30 +2595,42 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.0",
- "windows_aarch64_msvc 0.52.0",
- "windows_i686_gnu 0.52.0",
- "windows_i686_msvc 0.52.0",
- "windows_x86_64_gnu 0.52.0",
- "windows_x86_64_gnullvm 0.52.0",
- "windows_x86_64_msvc 0.52.0",
+ "windows_aarch64_gnullvm 0.52.4",
+ "windows_aarch64_msvc 0.52.4",
+ "windows_i686_gnu 0.52.4",
+ "windows_i686_msvc 0.52.4",
+ "windows_x86_64_gnu 0.52.4",
+ "windows_x86_64_gnullvm 0.52.4",
+ "windows_x86_64_msvc 0.52.4",
 ]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -2429,9 +2640,15 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -2441,9 +2658,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -2453,9 +2676,15 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.0"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -2465,9 +2694,15 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.0"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -2477,36 +2712,33 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.5"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
-name = "winnow"
-version = "0.6.5"
+name = "windows_x86_64_msvc"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dffa400e67ed5a4dd237983829e66475f0a4a26938c4b04c21baede6262215b8"
-dependencies = [
- "memchr",
-]
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
 
 [[package]]
 name = "winreg"
-version = "0.50.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
 dependencies = [
  "cfg-if",
  "windows-sys 0.48.0",
diff --git a/pkgs/by-name/my/mycelium/package.nix b/pkgs/by-name/my/mycelium/package.nix
index a3f93eb3c88ad..a180a77278773 100644
--- a/pkgs/by-name/my/mycelium/package.nix
+++ b/pkgs/by-name/my/mycelium/package.nix
@@ -2,18 +2,19 @@
 , rustPlatform
 , fetchFromGitHub
 , stdenv
+, openssl
 , darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mycelium";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "threefoldtech";
     repo = "mycelium";
     rev = "v${version}";
-    hash = "sha256-K82LHVXbSMIJQlQ/qUpdCBVlAEZWyMMG2eUt2FzNwRE=";
+    hash = "sha256-x3XqFKcOLwKhgF/DKo8Qp3QLyaE2hdCTjfLSE8K3ifQ=";
   };
 
   cargoLock = {
@@ -28,6 +29,12 @@ rustPlatform.buildRustPackage rec {
     darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
+  env = {
+    OPENSSL_NO_VENDOR = 1;
+    OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
+    OPENSSL_DIR = "${lib.getDev openssl}";
+  };
+
   meta = with lib; {
     description = "End-2-end encrypted IPv6 overlay network";
     homepage = "https://github.com/threefoldtech/mycelium";
diff --git a/pkgs/by-name/my/mystmd/package.nix b/pkgs/by-name/my/mystmd/package.nix
index 6c4277ee5823a..2be16bb1c83e6 100644
--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "mystmd";
-  version = "1.1.53";
+  version = "1.1.55";
 
   src = fetchFromGitHub {
     owner = "executablebooks";
     repo = "mystmd";
     rev = "mystmd@${version}";
-    hash = "sha256-neJKlUk0NHdAh7y92Iyv2kouASPzv1PIl79+D0mgckI=";
+    hash = "sha256-aIqIcNXlzpvW90WJs9tJajXvnEQB0IiNCu8B62cwElo=";
   };
 
-  npmDepsHash = "sha256-bXvOzx89MR7KL9wsqzB1uorjGGjh++mw17Ni65LLz28=";
+  npmDepsHash = "sha256-QIGqx1Peogmdo1KLHkzUKqvAuA6jCJRfxeQ1X7p6vTM=";
 
   dontNpmInstall = true;
 
diff --git a/pkgs/by-name/ne/netbird-dashboard/package.nix b/pkgs/by-name/ne/netbird-dashboard/package.nix
new file mode 100644
index 0000000000000..18353174e118a
--- /dev/null
+++ b/pkgs/by-name/ne/netbird-dashboard/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage rec {
+  pname = "netbird-dashboard";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "netbirdio";
+    repo = "dashboard";
+    rev = "v${version}";
+    hash = "sha256-4aZ7WGLhjpTHOggJ+sRdln0YOG3jf7TKT9/bH/n3LmQ=";
+  };
+
+  npmDepsHash = "sha256-ts3UuThIMf+wwSr3DpZ+k1i9RnHi/ltvhD/7lomVxQk=";
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  installPhase = ''
+    cp -R out $out
+  '';
+
+  env = {
+    CYPRESS_INSTALL_BINARY = 0;
+  };
+
+  meta = with lib; {
+    description = "NetBird Management Service Web UI Panel";
+    homepage = "https://github.com/netbirdio/dashboard";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ thubrecht ];
+  };
+}
diff --git a/pkgs/by-name/ne/nezha-agent/package.nix b/pkgs/by-name/ne/nezha-agent/package.nix
index c10feadd32a5f..2288100599215 100644
--- a/pkgs/by-name/ne/nezha-agent/package.nix
+++ b/pkgs/by-name/ne/nezha-agent/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "nezha-agent";
-  version = "0.16.4";
+  version = "0.16.5";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-xXv2FVPsl8BR51VMrFreaS3UQLEJwfObY4OeMMb8pms=";
+    hash = "sha256-WRHYI3/6qrVZRa4ANA6VBBJCaINP1N8Xjy0GWO4LqgA=";
   };
 
-  vendorHash = "sha256-ZlheRFgl3vsUXVx8PKZQ59kme2NC31OQAL6EaNhbf70=";
+  vendorHash = "sha256-AtcRfvYBgTZJz9dpsMgacnV8RNi2Ph7QgUrcE6zzTo8=";
 
   ldflags = [
     "-s"
@@ -40,6 +40,6 @@ buildGoModule rec {
     description = "Agent of Nezha Monitoring";
     homepage = "https://github.com/nezhahq/agent";
     license = licenses.asl20;
-    maintainers = with maintainers; [moraxyc];
+    maintainers = with maintainers; [ moraxyc ];
   };
 }
diff --git a/pkgs/by-name/nh/nh/package.nix b/pkgs/by-name/nh/nh/package.nix
index 780e3b2a0693e..3d1480da73d2b 100644
--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@@ -10,7 +10,7 @@
 , nix-output-monitor
 }:
 let
-  version = "3.5.10";
+  version = "3.5.13";
   runtimeDeps = [ nvd nix-output-monitor ];
 in
 rustPlatform.buildRustPackage {
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
     owner = "viperML";
     repo = "nh";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uEVd15WsX+Wti9PXW724puFcsFO72VTiJyBwW2WXT9M=";
+    hash = "sha256-lTy5gmB3dJZJKag2uuuxXvZCAt/RhLnI0jbIicBJfCo=";
   };
 
   strictDeps = true;
@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage {
       --prefix PATH : ${lib.makeBinPath runtimeDeps}
   '';
 
-  cargoHash = "sha256-/aqs/l+Qi2b8zxHXqxdHLBpSr5+vVsd6pY/QnHbkmb0=";
+  cargoHash = "sha256-X8+GmPFxvgeNxMuOacoCUCgdZ/+N4mwQFMUtvO1E998=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ni/niri/Cargo.lock b/pkgs/by-name/ni/niri/Cargo.lock
index 8292783edb7da..eed1cf8108d90 100644
--- a/pkgs/by-name/ni/niri/Cargo.lock
+++ b/pkgs/by-name/ni/niri/Cargo.lock
@@ -2138,7 +2138,7 @@ dependencies = [
 
 [[package]]
 name = "niri"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "arrayvec",
@@ -2183,7 +2183,7 @@ dependencies = [
 
 [[package]]
 name = "niri-config"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "bitflags 2.5.0",
  "csscolorparser",
@@ -2198,15 +2198,16 @@ dependencies = [
 
 [[package]]
 name = "niri-ipc"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "clap",
  "serde",
+ "serde_json",
 ]
 
 [[package]]
 name = "niri-visual-tests"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "gtk4",
@@ -3115,7 +3116,7 @@ checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 [[package]]
 name = "smithay"
 version = "0.3.0"
-source = "git+https://github.com/Smithay/smithay.git#e5f006818df7ebb92d206985f45e713ba1e9c1c9"
+source = "git+https://github.com/Smithay/smithay.git#c5e9a697e41f50dc56b918d9ef1e3d2e52c84ac0"
 dependencies = [
  "appendlist",
  "bitflags 2.5.0",
@@ -3187,7 +3188,7 @@ dependencies = [
 [[package]]
 name = "smithay-drm-extras"
 version = "0.1.0"
-source = "git+https://github.com/Smithay/smithay.git#e5f006818df7ebb92d206985f45e713ba1e9c1c9"
+source = "git+https://github.com/Smithay/smithay.git#c5e9a697e41f50dc56b918d9ef1e3d2e52c84ac0"
 dependencies = [
  "drm",
  "edid-rs",
diff --git a/pkgs/by-name/ni/niri/package.nix b/pkgs/by-name/ni/niri/package.nix
index a24619921e529..8413089ece203 100644
--- a/pkgs/by-name/ni/niri/package.nix
+++ b/pkgs/by-name/ni/niri/package.nix
@@ -20,19 +20,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "niri";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "YaLTeR";
     repo = "niri";
     rev = "v${version}";
-    hash = "sha256-lkGIQIMWfg71UOkT/TST8O6hD0IfslENj6oFPevUGl4=";
+    hash = "sha256-YuYowUw5ecPa78bhT72zY2b99wn68mO3vVkop8hnb8M=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "smithay-0.3.0" = "sha256-bWan2DCyMvEC8ZQPwM+XpuOGkOZ/RdDV+LmRCN8UAuc=";
+      "smithay-0.3.0" = "sha256-1ANERwRG7Uwe1gSm6zQnEMQlpRrGSFP8mp6JItzjz0k=";
     };
   };
 
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 8d78e22a0c420..2d1c40e09cdf2 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.1.6";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     rev = "v${version}";
-    hash = "sha256-NOPzznopH+PeSEMzO1vMHOSbmy9/v2yT4VC4kAsdbGw";
+    hash = "sha256-AAgkxBbGH45n140jm28+J3hqYxzUIL6IVLGWD9oBexo=";
   };
 
   vendorHash = "sha256-fP6yxfIQoVaBC9hYcrCyo3YP3ntEVDbDTwKMO9TdyDI=";
diff --git a/pkgs/by-name/no/nomore403/package.nix b/pkgs/by-name/no/nomore403/package.nix
new file mode 100644
index 0000000000000..074db314f10a5
--- /dev/null
+++ b/pkgs/by-name/no/nomore403/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "nomore403";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "devploit";
+    repo = "nomore403";
+    rev = "refs/tags/${version}";
+    hash = "sha256-qA1i8l2oBQQ5IF8ho3K2k+TAndUTFGwb2NfhyFqfKzU=";
+  };
+
+  vendorHash = "sha256-IGnTbuaQH8A6aKyahHMd2RyFRh4WxZ3Vx/A9V3uelRg=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.Version=${version}"
+    "-X=main.BuildDate=1970-01-01T00:00:00Z"
+  ];
+
+  meta = with lib; {
+    description = "Tool to bypass 403/40X response codes";
+    homepage = "https://github.com/devploit/nomore403";
+    changelog = "https://github.com/devploit/nomore403/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "nomore403";
+  };
+}
diff --git a/pkgs/by-name/no/novops/package.nix b/pkgs/by-name/no/novops/package.nix
index f5893bf661919..eed3077f5ef33 100644
--- a/pkgs/by-name/no/novops/package.nix
+++ b/pkgs/by-name/no/novops/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "novops";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "PierreBeucher";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-iQFw3m7dpAii/Nc1UQ/ZXTuHvj5vGsp3SOqd14uHUpc=";
+    hash = "sha256-LrEPdEVWgbZ6WyEqdfAhUjKXPuk8Xx7kmLA2ZsPFf1U=";
   };
 
-  cargoHash = "sha256-mQ7Vm80S4FALWiEsV+68pNrah36aYu7PediRlJUXLAk=";
+  cargoHash = "sha256-kI836Z0fgpmPPoX0HtWkZG731xaVWgWkXF0eCaQfM28=";
 
   buildInputs = [
     openssl # required for openssl-sys
diff --git a/pkgs/by-name/nr/nrr/package.nix b/pkgs/by-name/nr/nrr/package.nix
index 6b37d272f5f8a..0992152aed3e9 100644
--- a/pkgs/by-name/nr/nrr/package.nix
+++ b/pkgs/by-name/nr/nrr/package.nix
@@ -5,20 +5,21 @@
 , darwin
 , pkg-config
 , libiconv
+, nrxAlias ? true
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nrr";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ryanccn";
     repo = "nrr";
     rev = "v${version}";
-    hash = "sha256-4zQi7kQxcRXpYuSjolSZoDqX+CcGmq4dvChPlZZZVso=";
+    hash = "sha256-94BeBCYCxZBoOp6xo4I/uxd6ULjIfmF4nw/vUWoaEpo=";
   };
 
-  cargoHash = "sha256-XNnyEFEzKQ5N0xtskaUudcb2LtAiEsd6h3D/FdyIbHc=";
+  cargoHash = "sha256-DTQTIAk914XC+LecQTXk1TdBc/5sMFG8KiD9lO5HLiM=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreFoundation
@@ -31,8 +32,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
+  postInstall = lib.optionalString nrxAlias "ln -s $out/bin/nr{r,x}";
+
   meta = with lib; {
-    description = "Minimal, blazing fast Node.js script runner";
+    description = "Minimal, blazing fast npm scripts runner";
     maintainers = with maintainers; [ ryanccn ];
     license = licenses.gpl3Only;
     mainProgram = "nrr";
diff --git a/pkgs/by-name/nw/nwg-hello/package.nix b/pkgs/by-name/nw/nwg-hello/package.nix
index eb6126d1300ec..cae3fd2d25218 100644
--- a/pkgs/by-name/nw/nwg-hello/package.nix
+++ b/pkgs/by-name/nw/nwg-hello/package.nix
@@ -9,13 +9,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-hello";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-hello";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Z5Pwn/uJERWfHELXK+1SJ2vh//ZV9gqblD/GqnznJII=";
+    hash = "sha256-naYouinDYgdGwySVxdEOZpNTK0vwnIyUKTkPgYaneew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/of/offat/package.nix b/pkgs/by-name/of/offat/package.nix
index 145ab32a1bbfa..e5b1186af7a59 100644
--- a/pkgs/by-name/of/offat/package.nix
+++ b/pkgs/by-name/of/offat/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "offat";
-  version = "0.17.0";
+  version = "0.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "OFFAT";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tSLlMgvKIDlzHL71gH1OznKI5jEyUoJUy9d9Z8tNXjk=";
+    hash = "sha256-tyQoTc/cfzYxK+vLg9TvZdbKRX3B4tL1Do/wDMArJSA=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/by-name/om/omnictl/package.nix b/pkgs/by-name/om/omnictl/package.nix
new file mode 100644
index 0000000000000..4f803fe35626d
--- /dev/null
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -0,0 +1,40 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "omnictl";
+  version = "0.32.2";
+
+  src = fetchFromGitHub {
+    owner = "siderolabs";
+    repo = "omni";
+    rev = "v${version}";
+    hash = "sha256-db/bYwMPrOZvD/YPtFaRK80yaYdsE70YPh0xQe0uVi4=";
+  };
+
+  vendorHash = "sha256-uwzVUdA51eT9fi2Wr0ilNPMpXx430UIYYWXQa1hpzRM=";
+
+  ldflags = [ "-s" "-w" ];
+
+  GOWORK = "off";
+
+  subPackages = [ "cmd/omnictl" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd omnictl \
+      --bash <($out/bin/omnictl completion bash) \
+      --fish <($out/bin/omnictl completion fish) \
+      --zsh <($out/bin/omnictl completion zsh)
+  '';
+
+  doCheck = false; # no tests
+
+  meta = with lib; {
+    description = "A CLI for the Sidero Omni Kubernetes management platform";
+    mainProgram = "omnictl";
+    homepage = "https://omni.siderolabs.com/";
+    license = licenses.bsl11;
+    maintainers = with maintainers; [ raylas ];
+  };
+}
diff --git a/pkgs/by-name/op/open-scq30/package.nix b/pkgs/by-name/op/open-scq30/package.nix
index 12b709282f6c5..7ab3452bd2df8 100644
--- a/pkgs/by-name/op/open-scq30/package.nix
+++ b/pkgs/by-name/op/open-scq30/package.nix
@@ -18,13 +18,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "open-scq30";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "Oppzippy";
     repo = "OpenSCQ30";
     rev = "v${version}";
-    hash = "sha256-yls7F6ou0TsoY6CDi694fJrq30Y3B6d96T1VWl47K0w=";
+    hash = "sha256-DL2hYm1j27K0nnBvE3iGnguqm0m1k56bkuG+6+u4u4c=";
   };
 
   nativeBuildInputs = [
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
     darwin.apple_sdk.frameworks.Foundation
   ];
 
-  cargoHash = "sha256-VxweKzXNWOrBrzLzId8D6O0tZG8bI7HjhD+GJ3vRyhk=";
+  cargoHash = "sha256-YBJd43xOCumQbrvzfV/+F63McYzHg1bGI3icgGzGZrQ=";
 
   INSTALL_PREFIX = placeholder "out";
 
diff --git a/pkgs/by-name/op/openctm/package.nix b/pkgs/by-name/op/openctm/package.nix
new file mode 100644
index 0000000000000..e255e209111dd
--- /dev/null
+++ b/pkgs/by-name/op/openctm/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  freeglut,
+  gtk2,
+  libGLU,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openctm";
+  version = "1.0.3";
+
+  src = fetchurl {
+    url = "https://downloads.sourceforge.net/project/openctm/OpenCTM-${finalAttrs.version}/OpenCTM-${finalAttrs.version}-src.tar.bz2";
+    hash = "sha256-So0mCNlzZPfuxWt8Y3xWuTCK6YKGs+kNu3QTyQ6UPx0=";
+  };
+
+  outputs = [
+    "bin"
+    "dev"
+    "man"
+    "out"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    freeglut
+    gtk2
+    libGLU
+  ];
+
+  postPatch = ''
+    substituteInPlace tools/tinyxml/Makefile.linux \
+      --replace-warn "-Wno-format" "-Wno-format -Wno-format-security"
+    substituteInPlace tools/Makefile.linux \
+      --replace-warn "-lglut" "-lglut -lGL -lGLU"
+  '';
+
+  makeFlags = [
+    "BINDIR=$(bin)/bin/"
+    "INCDIR=$(dev)/include/"
+    "LIBDIR=$(out)/lib/"
+    "MAN1DIR=$(man)/share/man//man1"
+  ];
+
+  makefile = if stdenv.isDarwin then "Makefile.macosx" else "Makefile.linux";
+
+  preInstall = "mkdir -p $bin/bin $dev/include $out/lib $man/share/man/man1";
+
+  meta = with lib; {
+    description = "File format, software library and a tool set for compression of 3D triangle meshes";
+    homepage = "https://sourceforge.net/projects/openctm/";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/by-name/ot/oterm/package.nix b/pkgs/by-name/ot/oterm/package.nix
index 5dbc79b712bbd..00c9d594179c1 100644
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "oterm";
-  version = "0.2.5";
+  version = "0.2.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggozad";
     repo = "oterm";
     rev = "refs/tags/${version}";
-    hash = "sha256-s+TqDrgy7sR0sli8BGKlF546TW1+vzF0k3IkAQV6TpM=";
+    hash = "sha256-I/0U4lYqYZ6QCmWbDYhSOTCQ8o09W2cdd8kW7iN9iHU=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ov/OVMF-cloud-hypervisor/package.nix b/pkgs/by-name/ov/OVMF-cloud-hypervisor/package.nix
new file mode 100644
index 0000000000000..4369b083cedfa
--- /dev/null
+++ b/pkgs/by-name/ov/OVMF-cloud-hypervisor/package.nix
@@ -0,0 +1,7 @@
+{ lib, OVMF }:
+
+OVMF.override {
+  projectDscPath = "OvmfPkg/CloudHv/CloudHvX64.dsc";
+  fwPrefix = "CLOUDHV";
+  metaPlatforms = builtins.filter (lib.hasPrefix "x86_64-") OVMF.meta.platforms;
+}
diff --git a/pkgs/by-name/pi/pingtunnel/package.nix b/pkgs/by-name/pi/pingtunnel/package.nix
new file mode 100644
index 0000000000000..826a562699289
--- /dev/null
+++ b/pkgs/by-name/pi/pingtunnel/package.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "pingtunnel";
+  version = "2.8";
+
+  src = fetchFromGitHub {
+    owner = "esrrhs";
+    repo = "pingtunnel";
+    rev = version;
+    hash = "sha256-qkIeE6gNBUUd5/IhcKhDmXZbzeSTR0r6qCAK/Nz7Kew=";
+  };
+
+  vendorHash = "sha256-SkBHFvQn3Q6fl/d1npEspTYhq1YrnusXNWr/Ky4bv64=";
+
+  ldflags = [ "-s" "-w" ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/pingtunnel
+  '';
+
+  meta = with lib; {
+    description = "A tool that send TCP/UDP traffic over ICMP";
+    homepage = "https://github.com/esrrhs/pingtunnel";
+    license = licenses.mit;
+    maintainers = with maintainers; [ oluceps ];
+    mainProgram = "pingtunnel";
+  };
+}
diff --git a/pkgs/by-name/po/poppins/package.nix b/pkgs/by-name/po/poppins/package.nix
new file mode 100644
index 0000000000000..b56b2c3f2c8d6
--- /dev/null
+++ b/pkgs/by-name/po/poppins/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  unzip,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "poppins";
+  version = "4.003";
+
+  src = fetchFromGitHub {
+    owner = "itfoundry";
+    repo = "poppins";
+    rev = "v${version}";
+    hash = "sha256-7+RQHYxNFqOw2EeS2hgrbK/VbUAiPorUtkyRb5MFh5w=";
+  };
+
+  nativeBuildInputs = [unzip];
+
+  installPhase = ''
+    runHook preInstall
+    unzip products/Poppins-4.003-GoogleFonts-TTF.zip
+    unzip products/PoppinsLatin-5.001-Latin-TTF.zip
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A Devanagari + Latin family for Google Fonts";
+    homepage = "https://github.com/itfoundry/Poppins/";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [nyawox];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index c8f31b88a7d60..2456720db7050 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -97,7 +97,6 @@ python.pkgs.buildPythonApplication rec {
   build-system = with python.pkgs; [
     gettext
     nodejs
-    pythonRelaxDepsHook
     setuptools
     tomli
   ];
diff --git a/pkgs/by-name/pr/primecount/package.nix b/pkgs/by-name/pr/primecount/package.nix
index e595091dc4415..d2b117138e73f 100644
--- a/pkgs/by-name/pr/primecount/package.nix
+++ b/pkgs/by-name/pr/primecount/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "primecount";
-  version = "7.12";
+  version = "7.13";
 
   src = fetchFromGitHub {
     owner = "kimwalisch";
     repo = "primecount";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GjLLJLGMzFAN75zFAwIfFvaTm8sSC0J20HtH8tn52h8=";
+    hash = "sha256-VjsJjG2pSnDMVg3lY3cmpdnASeqClPjHUGY5wqupf2w=";
   };
 
   outputs = [ "out" "dev" "lib" "man" ];
diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix
index 20b5fa4b7e0a7..94753d08d47e5 100644
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "proto";
-  version = "0.34.3";
+  version = "0.34.4";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4stIazXr7+P6gF98NTWQoVW52ov9tQ1DQjPPuN7ssLU=";
+    hash = "sha256-sh4EeK9LGY1t7BDWV31pOjp6CYhOIRR/wCb6LAv68ok=";
   };
 
-  cargoHash = "sha256-lijDw55F7QBPqA17CPoee5unW/++LXo3Gbn24C7FLi8=";
+  cargoHash = "sha256-PU6r6Iwv00TLhAZSt9hERWvCgpC27Cuf3rrsjN1gO5k=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index efd92a5da7e5f..3537d60cbbfed 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton9-2";
+  version = "GE-Proton9-4";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-NqBzKonCYH+hNpVZzDhrVf+r2i6EwLG/IFBXjE2mC7s=";
+    hash = "sha256-OR4SUqm5Xsycv/KVBW2Ug/lz4Xr6IQBp8gXacorRe3U=";
   };
 
   outputs = [ "out" "steamcompattool" ];
diff --git a/pkgs/by-name/py/pyright/package-lock.json b/pkgs/by-name/py/pyright/package-lock.json
new file mode 100644
index 0000000000000..dee0ab51a5212
--- /dev/null
+++ b/pkgs/by-name/py/pyright/package-lock.json
@@ -0,0 +1,193 @@
+{
+  "name": "pyright-root",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pyright-root",
+      "hasInstallScript": true,
+      "dependencies": {
+        "glob": "^7.2.3",
+        "jsonc-parser": "^3.2.1"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  },
+  "dependencies": {
+    "balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  }
+}
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
new file mode 100644
index 0000000000000..3e264bc20e819
--- /dev/null
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -0,0 +1,75 @@
+{ lib, buildNpmPackage, fetchFromGitHub, runCommand, jq }:
+
+let
+  version = "1.1.359";
+
+  src = fetchFromGitHub {
+    owner = "Microsoft";
+    repo = "pyright";
+    rev = "${version}";
+    hash = "sha256-gqMAfmYjYO6D9sRu+uJv4yJ/+csioFAwsUPBDF29VDs=";
+  };
+
+  patchedPackageJSON = runCommand "package.json" { } ''
+    ${jq}/bin/jq '
+      .devDependencies |= with_entries(select(.key == "glob" or .key == "jsonc-parser"))
+      | .scripts =  {  }
+      ' ${src}/package.json > $out
+  '';
+
+  pyright-root = buildNpmPackage {
+    pname = "pyright-root";
+    inherit version src;
+    npmDepsHash = "sha256-63kUhKrxtJhwGCRBnxBfOFXs2ARCNn+OOGu6+fSJey4=";
+    dontNpmBuild = true;
+    postPatch = ''
+      cp ${patchedPackageJSON} ./package.json
+      cp ${./package-lock.json} ./package-lock.json
+    '';
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+
+  pyright-internal = buildNpmPackage {
+    pname = "pyright-internal";
+    inherit version src;
+    sourceRoot = "${src.name}/packages/pyright-internal";
+    npmDepsHash = "sha256-p2KamNFJ3sJHmJm0MEPhI8L/8zAVzfc9NYy24rAdFcQ=";
+    dontNpmBuild = true;
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+in
+buildNpmPackage rec {
+  pname = "pyright";
+  inherit version src;
+
+  sourceRoot = "${src.name}/packages/pyright";
+  npmDepsHash = "sha256-U7WdMIYg9U4fJ8YtDruMzloRS2BQAa2QWExle9uwPbU=";
+
+  postPatch = ''
+    chmod +w ../../
+    ln -s ${pyright-root}/node_modules ../../node_modules
+    chmod +w ../pyright-internal
+    ln -s ${pyright-internal}/node_modules ../pyright-internal/node_modules
+  '';
+
+  dontNpmBuild = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    changelog = "https://github.com/Microsoft/pyright/releases/tag/${version}";
+    description = "Type checker for the Python language";
+    homepage = "https://github.com/Microsoft/pyright";
+    license = lib.licenses.mit;
+    mainProgram = "pyright";
+    maintainers = with lib.maintainers; [ kalekseev ];
+  };
+}
diff --git a/pkgs/by-name/py/pyright/update.sh b/pkgs/by-name/py/pyright/update.sh
new file mode 100755
index 0000000000000..b0a2b2a111842
--- /dev/null
+++ b/pkgs/by-name/py/pyright/update.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused common-updater-scripts jq prefetch-npm-deps
+set -euo pipefail
+
+version=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s https://api.github.com/repos/microsoft/pyright/releases/latest | jq -r '.tag_name | sub("^v"; "")')
+
+update-source-version pyright "$version"
+
+root="$(dirname "$(readlink -f "$0")")"
+FILE_PATH="$root/package.nix"
+REPO_URL_PREFIX="https://github.com/microsoft/pyright/raw"
+TEMP_DIR=$(mktemp -d)
+
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+# Function to download `package-lock.json` for a given source path and update hash
+update_hash() {
+    local source_root_path="$1"
+    local existing_hash="$2"
+
+    # Formulate download URL
+    local download_url="${REPO_URL_PREFIX}/${version}${source_root_path}/package-lock.json"
+
+    # Download package-lock.json to temporary directory
+    curl -fsSL -o "${TEMP_DIR}/package-lock.json" "$download_url"
+
+    # Calculate the new hash
+    local new_hash
+    new_hash=$(prefetch-npm-deps "${TEMP_DIR}/package-lock.json")
+
+    # Update npmDepsHash in the original file
+    sed -i "s|$existing_hash|${new_hash}|" "$FILE_PATH"
+}
+
+while IFS= read -r source_root_line; do
+    [[ "$source_root_line" =~ sourceRoot ]] || continue
+    source_root_path=$(echo "$source_root_line" | sed -e 's/^.*"${src.name}\(.*\)";.*$/\1/')
+
+    # Extract the current npmDepsHash for this sourceRoot
+    existing_hash=$(grep -A1 "$source_root_line" "$FILE_PATH" | grep 'npmDepsHash' | sed -e 's/^.*npmDepsHash = "\(.*\)";$/\1/')
+
+    # Call the function to download and update the hash
+    update_hash "$source_root_path" "$existing_hash"
+done < "$FILE_PATH"
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index 8128b434ddb0f..5e6faa4316ba7 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.9.3";
+  version = "3.9.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-VTgBwpE5b/OgM7kkzZijmj9H4d8jy0HNMGl5tfmBe4E=";
+    hash = "sha256-ez4D+czYDhs/GNrjRF8Bx999JRW0EigMxc39fOH54V8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 65a2d2cad87a7..3eb909bc63466 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -5,11 +5,11 @@
 
 renode.overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.15.0+20240404gitbfa16ba07";
+  version = "1.15.0+20240418git228a25674";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-pXA6sGYBlLU2EnhFvUwRWkYirMi5BTgzyUbQ33sIMrg=";
+    hash = "sha256-v8fWQQM2NZkE+Wsg8pyww6esYLggJzehavqIhzI+EaQ=";
   };
 
   passthru.updateScript =
diff --git a/pkgs/by-name/re/restls/package.nix b/pkgs/by-name/re/restls/package.nix
new file mode 100644
index 0000000000000..c01e392190122
--- /dev/null
+++ b/pkgs/by-name/re/restls/package.nix
@@ -0,0 +1,26 @@
+{ fetchFromGitHub
+, rustPlatform
+, lib
+}:
+
+rustPlatform.buildRustPackage rec{
+  pname = "restls";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "3andne";
+    repo = "restls";
+    rev = "v${version}";
+    hash = "sha256-nlQdBwxHVbpOmb9Wq+ap2i4KI1zJYT3SEqvedDbVH8Q=";
+  };
+
+  cargoHash = "sha256-KtNLLtStZ7SNndcPxWfNPA2duoXFVePrbNQFPUz2xFg=";
+
+  meta = with lib; {
+    homepage = "https://github.com/3andne/restls";
+    description = "A Perfect Impersonation of TLS";
+    license = licenses.bsd3;
+    mainProgram = "restls";
+    maintainers = with maintainers; [ oluceps ];
+  };
+}
diff --git a/pkgs/by-name/ri/rippkgs/package.nix b/pkgs/by-name/ri/rippkgs/package.nix
new file mode 100644
index 0000000000000..9ee41a107efd5
--- /dev/null
+++ b/pkgs/by-name/ri/rippkgs/package.nix
@@ -0,0 +1,36 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, sqlite
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rippkgs";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "replit";
+    repo = "rippkgs";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qQZnD9meczfsQv1R68IiUfPq730I2IyesurrOhtA3es=";
+  };
+
+  cargoHash = "sha256-hGSHgJ2HVCNqTBsTQIZlSE89FKqdMifuJyAGl3utF2I=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    sqlite
+  ];
+
+  meta = {
+    description = "A CLI for indexing and searching packages in Nix expressions";
+    homepage = "https://github.com/replit/rippkgs";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eclairevoyant cdmistman ];
+    mainProgram = "rippkgs";
+  };
+}
diff --git a/pkgs/by-name/rm/rmenu/Cargo.lock b/pkgs/by-name/rm/rmenu/Cargo.lock
index adcadaa48a1aa..33210d3b2f2d8 100644
--- a/pkgs/by-name/rm/rmenu/Cargo.lock
+++ b/pkgs/by-name/rm/rmenu/Cargo.lock
@@ -110,7 +110,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f28243a43d821d11341ab73c80bed182dc015c514b951616cf79bd4af39af0c3"
 dependencies = [
  "concurrent-queue",
- "event-listener 5.2.0",
+ "event-listener 5.3.0",
  "event-listener-strategy 0.5.1",
  "futures-core",
  "pin-project-lite",
@@ -118,9 +118,9 @@ dependencies = [
 
 [[package]]
 name = "async-executor"
-version = "1.9.1"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10b3e585719c2358d2660232671ca8ca4ddb4be4ce8a1842d6c2dc8685303316"
+checksum = "5f98c37cf288e302c16ef6c8472aad1e034c6c84ce5ea7b8101c98eb4a802fee"
 dependencies = [
  "async-lock 3.3.0",
  "async-task",
@@ -244,7 +244,7 @@ checksum = "a507401cad91ec6a857ed5513a2073c82a9b9048762b885bb98655b306964681"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -373,9 +373,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.4"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "bytemuck"
@@ -489,9 +489,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.90"
+version = "1.0.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cd6604a82acf3039f1144f54b8eb34e91ffba622051189e71b781822d5ee1f5"
+checksum = "2678b2e3449475e95b0aa6f9b506a28e61b3dc8996592b983695e8ebb58a8b41"
 
 [[package]]
 name = "cesu8"
@@ -545,7 +545,7 @@ dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "strsim 0.11.0",
+ "strsim 0.11.1",
 ]
 
 [[package]]
@@ -557,7 +557,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -642,7 +642,7 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom 0.2.14",
  "once_cell",
  "tiny-keccak",
 ]
@@ -772,7 +772,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
 dependencies = [
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -843,7 +843,7 @@ dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -876,7 +876,7 @@ checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
  "darling_core 0.20.8",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -968,7 +968,7 @@ dependencies = [
  "prettyplease",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1079,7 +1079,7 @@ dependencies = [
  "dioxus-core",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1183,7 +1183,7 @@ dependencies = [
  "darling 0.20.8",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1244,9 +1244,9 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.2.0"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b5fb89194fa3cad959b833185b3063ba881dbfc7030680b314250779fb4cc91"
+checksum = "6d9944b8ca13534cdfb2800775f8dd4902ff3fc75a50101466decadfdf322a24"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -1269,7 +1269,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "332f51cb23d20b0de8458b86580878211da09bcd4503cb579c225b3d124cabb3"
 dependencies = [
- "event-listener 5.2.0",
+ "event-listener 5.3.0",
  "pin-project-lite",
 ]
 
@@ -1378,9 +1378,9 @@ dependencies = [
 
 [[package]]
 name = "freedesktop-desktop-entry"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "287f89b1a3d88dd04d2b65dfec39f3c381efbcded7b736456039c4ee49d54b17"
+checksum = "c201444ddafb5506fe85265b48421664ff4617e3b7090ef99e42a0070c1aead0"
 dependencies = [
  "dirs 3.0.2",
  "gettext-rs",
@@ -1495,7 +1495,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1645,9 +1645,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1822,7 +1822,7 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -2872,7 +2872,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d3928fb5db768cb86f891ff014f0144589297e3c6a1aba6ed7cecfdace270c7"
 dependencies = [
  "proc-macro2",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3002,7 +3002,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom 0.2.14",
 ]
 
 [[package]]
@@ -3050,7 +3050,7 @@ version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom 0.2.14",
  "libredox",
  "thiserror",
 ]
@@ -3137,7 +3137,7 @@ dependencies = [
 
 [[package]]
 name = "rmenu"
-version = "1.2.0"
+version = "1.2.1"
 dependencies = [
  "cached 0.44.0",
  "clap",
@@ -3168,7 +3168,7 @@ dependencies = [
 
 [[package]]
 name = "rmenu-plugin"
-version = "0.0.1"
+version = "0.0.2"
 dependencies = [
  "bincode",
  "clap",
@@ -3358,7 +3358,7 @@ checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3374,13 +3374,13 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b2e6b945e9d3df726b65d6ee24060aff8e3533d431f677a9695db04eff9dfdb"
+checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3594,9 +3594,9 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
 name = "strsim"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "strum"
@@ -3639,9 +3639,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.57"
+version = "2.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11a6ae1e52eb25aab8f3fb9fca13be982a373b8f1157ca14b897a825ba4a2d35"
+checksum = "44cfb93f38070beee36b3fef7d4f5a16f27751d94b187b666a5cc5e9b0d30687"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3789,7 +3789,7 @@ checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3870,7 +3870,7 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3946,7 +3946,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -4135,7 +4135,7 @@ version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom 0.2.14",
 ]
 
 [[package]]
@@ -4211,7 +4211,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
  "wasm-bindgen-shared",
 ]
 
@@ -4245,7 +4245,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -4268,9 +4268,9 @@ dependencies = [
 
 [[package]]
 name = "webbrowser"
-version = "0.8.13"
+version = "0.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1b04c569c83a9bb971dd47ec6fd48753315f4bf989b9b04a2e7ca4d7f0dc950"
+checksum = "dd595fb70f33583ac61644820ebc144a26c96028b625b96cafcd861f4743fbc8"
 dependencies = [
  "core-foundation",
  "home",
@@ -4416,7 +4416,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "window"
-version = "0.0.0"
+version = "0.0.1"
 dependencies = [
  "anyhow",
  "clap",
diff --git a/pkgs/by-name/rm/rmenu/package.nix b/pkgs/by-name/rm/rmenu/package.nix
index 70a31e82e57be..15de597438fa5 100644
--- a/pkgs/by-name/rm/rmenu/package.nix
+++ b/pkgs/by-name/rm/rmenu/package.nix
@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "rmenu";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "imgurbot12";
     repo = "rmenu";
-    hash = "sha256-mzY+M7GGJDxb8s7pusRDo/xfKE/S4uxPy4klRBjVGOA=";
+    hash = "sha256-JHJZfDxrDi0rJSloPdOVdvo/XkrFhvshd7yZWn/zELU=";
   };
 
   nativeBuildInputs = [
@@ -65,14 +65,17 @@ rustPlatform.buildRustPackage rec {
     # fix config and theme
     mkdir -p $out/share/rmenu
     cp -vf $src/rmenu/public/config.yaml $out/share/rmenu/config.yaml
-    sed -i "s@~\/\.config\/rmenu\/themes@$out\/themes@g" $out/share/rmenu/config.yaml
-    sed -i "s@~\/\.config\/rmenu@$out\/plugins@g" $out/share/rmenu/config.yaml
+    substituteInPlace $out/share/rmenu/config.yaml --replace "~/.config/rmenu" "$out"
     ln -sf  $out/themes/dark.css $out/share/rmenu/style.css
   '';
 
   preFixup = ''
+    # rmenu expects the config to be in XDG_CONFIG_DIRS
+    # shell script plugins called from rmenu binary expect the rmenu-build binary to be on the PATH,
+    # which needs wrapping in temporary environments like shells and flakes
     gappsWrapperArgs+=(
       --suffix XDG_CONFIG_DIRS : "$out/share"
+      --suffix PATH : "$out/bin"
     )
   '';
 
diff --git a/pkgs/by-name/sa/sandbar/package.nix b/pkgs/by-name/sa/sandbar/package.nix
new file mode 100644
index 0000000000000..8c754289aa001
--- /dev/null
+++ b/pkgs/by-name/sa/sandbar/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pixman,
+  fcft,
+  pkg-config,
+  wayland-protocols,
+  wayland-scanner,
+  wayland
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sandbar";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "kolunmi";
+    repo = "sandbar";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-uG+/e75s/OQtEotR+8aXTEjW6p3oJM8btuRNgUVmIiQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    wayland-scanner
+    wayland-protocols
+    wayland
+    pixman
+    fcft
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kolunmi/sandbar";
+    description = "DWM-like bar for the river wayland compositor";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fccapria ];
+    platforms = platforms.all;
+    badPlatforms = platforms.darwin;
+    mainProgram = "sandbar";
+  };
+})
diff --git a/pkgs/by-name/sb/sbom-utility/package.nix b/pkgs/by-name/sb/sbom-utility/package.nix
new file mode 100644
index 0000000000000..213dc94cff579
--- /dev/null
+++ b/pkgs/by-name/sb/sbom-utility/package.nix
@@ -0,0 +1,32 @@
+{
+  lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "sbom-utility";
+  version = "0.15.0";
+
+  src = fetchFromGitHub {
+    owner = "CycloneDX";
+    repo = "sbom-utility";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tNLMrtJj1eeJ4sVhDRR24/KVI1HzZSRquiImuDTNZFI=";
+  };
+
+  vendorHash = "sha256-EdzI5ypwZRksQVmcfGDUgEMa4CeAPcm237ZaKqmWQDY=";
+
+  preCheck = ''
+    cd test
+  '';
+
+  meta = with lib; {
+    description = "Utility that provides an API platform for validating, querying and managing BOM data";
+    homepage = "https://github.com/CycloneDX/sbom-utility";
+    changelog = "https://github.com/CycloneDX/sbom-utility/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ thillux ];
+    mainProgram = "sbom-utility";
+  };
+}
diff --git a/pkgs/by-name/sh/shadow-tls/package.nix b/pkgs/by-name/sh/shadow-tls/package.nix
new file mode 100644
index 0000000000000..91116caf47505
--- /dev/null
+++ b/pkgs/by-name/sh/shadow-tls/package.nix
@@ -0,0 +1,32 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec{
+  pname = "shadow-tls";
+  version = "0.2.25";
+
+  src = fetchFromGitHub {
+    owner = "ihciah";
+    repo = "shadow-tls";
+    rev = "v${version}";
+    hash = "sha256-T+GPIrcME6Wq5sdfIt4t426/3ew5sUQMykYeZ6zw1ko=";
+  };
+
+  cargoHash = "sha256-w+DQeiQAtVsTw1VJhntX1FXymgS0fxsXiUmd6OjVWLQ=";
+
+  RUSTC_BOOTSTRAP = 1;
+
+  # network required
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/ihciah/shadow-tls";
+    description = "A proxy to expose real tls handshake to the firewall";
+    license = licenses.mit;
+    mainProgram = "shadow-tls";
+    maintainers = with maintainers; [ oluceps ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch b/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch
new file mode 100644
index 0000000000000..4219fcbfa7d48
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch
@@ -0,0 +1,13 @@
+diff --git a/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py b/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
+index 5fa4f898..41264ebb 100644
+--- a/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
++++ b/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
+@@ -142,7 +142,7 @@ class LXD(Provider):
+             build_provider_flags=build_provider_flags,
+         )
+         # This endpoint is hardcoded everywhere lxc/lxd-pkg-snap#33
+-        lxd_socket_path = "/var/snap/lxd/common/lxd/unix.socket"
++        lxd_socket_path = "/var/lib/lxd/unix.socket"
+         endpoint = "http+unix://{}".format(urllib.parse.quote(lxd_socket_path, safe=""))
+         try:
+             self._lxd_client: pylxd.Client = pylxd.Client(endpoint=endpoint)
diff --git a/pkgs/by-name/sn/snapcraft/os-platform.patch b/pkgs/by-name/sn/snapcraft/os-platform.patch
new file mode 100644
index 0000000000000..0b441ec8d4bc8
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/os-platform.patch
@@ -0,0 +1,21 @@
+diff --git a/snapcraft/utils.py b/snapcraft/utils.py
+index 511effe2..4af5a029 100644
+--- a/snapcraft/utils.py
++++ b/snapcraft/utils.py
+@@ -15,6 +15,7 @@
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
+ """Utilities for snapcraft."""
++
+ import multiprocessing
+ import os
+ import pathlib
+@@ -91,7 +92,7 @@ def get_os_platform(
+     release = platform.release()
+     machine = platform.machine()
+ 
+-    if system == "Linux":
++    if system == "Linux" and "NixOS" not in platform.version():
+         try:
+             with filepath.open("rt", encoding="utf-8") as release_file:
+                 lines = release_file.readlines()
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
new file mode 100644
index 0000000000000..57e16a1a138c9
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -0,0 +1,188 @@
+{
+  fetchFromGitHub,
+  git,
+  glibc,
+  lib,
+  makeWrapper,
+  nix-update-script,
+  python3Packages,
+  squashfsTools,
+  stdenv,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "snapcraft";
+  version = "8.2.0";
+
+  pyproject = true;
+
+  # Somewhere deep in the dependency tree is 'versioningit', which depends
+  # on pydantic 2. Snapcraft will soon migrate to pydantic 2, and disabling
+  # this doesn't seem to affect the functionality of the application.
+  catchConflicts = false;
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "snapcraft";
+    rev = "refs/tags/${version}";
+    hash = "sha256-uRapRL+492FOju83o3OBsYK52hwOOG6b4EbdMVpAlBs=";
+  };
+
+  patches = [
+    # Snapcraft is only officially distributed as a snap, as is LXD. The socket
+    # path for LXD must be adjusted so that it's at the correct location for LXD
+    # on NixOS. This patch will likely never be accepted upstream.
+    ./lxd-socket-path.patch
+    # In certain places, Snapcraft expects an /etc/os-release file to determine
+    # host info which doesn't exist in our test environment. This is a
+    # relatively naive patch which helps the test suite pass - without it *many*
+    # of the tests fail. This patch will likely never be accepted upstream.
+    ./os-platform.patch
+    # Snapcraft will try to inject itself as a snap *from the host system* into
+    # the build system. This patch short-circuits that logic and ensures that
+    # Snapcraft is installed on the build system from the snap store - because
+    # there is no snapd on NixOS hosts that can be used for the injection. This
+    # patch will likely never be accepted upstream.
+    ./set-channel-for-nix.patch
+    # Certain paths (for extensions, schemas) are packaged in the snap by the
+    # upstream, so the paths are well-known, except here where Snapcraft is
+    # *not* in a snap, so this patch changes those paths to point to the correct
+    # place in the Nix store. This patch will likely never be accepted upstream.
+    ./snapcraft-data-dirs.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail 'version=determine_version()' 'version="${version}"' \
+      --replace-fail 'gnupg' 'python-gnupg'
+
+    substituteInPlace requirements.txt \
+      --replace-fail 'gnupg==2.3.1' 'python-gnupg'
+
+    substituteInPlace snapcraft/__init__.py \
+      --replace-fail '__version__ = _get_version()' '__version__ = "${version}"'
+
+    substituteInPlace snapcraft_legacy/__init__.py \
+      --replace-fail '__version__ = _get_version()' '__version__ = "${version}"'
+
+    substituteInPlace snapcraft/elf/elf_utils.py \
+      --replace-fail 'arch_linker_path = Path(arch_config.dynamic_linker)' \
+      'return str(Path("${glibc}/lib/ld-linux-x86-64.so.2"))'
+  '';
+
+  buildInputs = [ makeWrapper ];
+
+  propagatedBuildInputs = with python3Packages; [
+    attrs
+    catkin-pkg
+    click
+    craft-application
+    craft-archives
+    craft-cli
+    craft-grammar
+    craft-parts
+    craft-providers
+    craft-store
+    debian
+    docutils
+    jsonschema
+    launchpadlib
+    lazr-restfulclient
+    lxml
+    macaroonbakery
+    mypy-extensions
+    progressbar
+    pyelftools
+    pygit2
+    pylxd
+    python-apt
+    python-gnupg
+    raven
+    requests-toolbelt
+    simplejson
+    snap-helpers
+    tabulate
+    tinydb
+  ];
+
+  nativeBuildInputs = with python3Packages; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "docutils"
+    "jsonschema"
+    "pygit2"
+    "urllib3"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/snapcraft --prefix PATH : ${squashfsTools}/bin
+  '';
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-check
+    pytest-cov
+    pytest-mock
+    pytest-subprocess
+    pytestCheckHook
+    responses
+  ] ++ [
+    git
+    squashfsTools
+  ];
+
+  preCheck = ''
+    mkdir -p check-phase
+    export HOME="$(pwd)/check-phase"
+  '';
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  disabledTests = [
+    "test_bin_echo"
+    "test_classic_linter_filter"
+    "test_classic_linter"
+    "test_complex_snap_yaml"
+    "test_get_base_configuration_snap_channel"
+    "test_get_base_configuration_snap_instance_name_default"
+    "test_get_base_configuration_snap_instance_name_not_running_as_snap"
+    "test_get_extensions_data_dir"
+    "test_get_os_platform_alternative_formats"
+    "test_get_os_platform_linux"
+    "test_get_os_platform_windows"
+    "test_lifecycle_pack_components_with_output"
+    "test_lifecycle_pack_components"
+    "test_lifecycle_write_component_metadata"
+    "test_parse_info_integrated"
+    "test_patch_elf"
+    "test_remote_builder_init"
+    "test_setup_assets_remote_icon"
+    "test_snap_command_fallback"
+    "test_validate_architectures_supported"
+    "test_validate_architectures_unsupported"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    "test_load_project"
+  ];
+
+  disabledTestPaths = [
+    "tests/unit/commands/test_remote.py"
+    "tests/unit/elf"
+    "tests/unit/linters/test_classic_linter.py"
+    "tests/unit/linters/test_library_linter.py"
+    "tests/unit/parts/test_parts.py"
+    "tests/unit/services"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "snapcraft";
+    description = "Build and publish Snap packages";
+    homepage = "https://github.com/canonical/snapcraft";
+    changelog = "https://github.com/canonical/snapcraft/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch b/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch
new file mode 100644
index 0000000000000..b90f0b4e1df27
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch
@@ -0,0 +1,30 @@
+diff --git a/snapcraft/providers.py b/snapcraft/providers.py
+index a999537a..dcd290a7 100644
+--- a/snapcraft/providers.py
++++ b/snapcraft/providers.py
+@@ -21,6 +21,7 @@ import sys
+ from pathlib import Path
+ from textwrap import dedent
+ from typing import Dict, Optional
++import platform
+ 
+ from craft_cli import emit
+ from craft_providers import Provider, ProviderError, bases, executor
+@@ -178,14 +179,14 @@ def get_base_configuration(
+     # injecting a snap on a non-linux system is not supported, so default to
+     # install snapcraft from the store's stable channel
+     snap_channel = get_managed_environment_snap_channel()
+-    if sys.platform != "linux" and not snap_channel:
++    if snap_channel is None and (sys.platform != "linux" or "NixOS" in platform.version()):
+         emit.progress(
+-            "Using snapcraft from snap store channel 'latest/stable' in instance "
++            "Using snapcraft from snap store channel 'latest/beta' in instance "
+             "because snap injection is only supported on Linux hosts.",
+             permanent=True,
+         )
+         snap_name = "snapcraft"
+-        snap_channel = "stable"
++        snap_channel = "beta"
+     elif is_snapcraft_running_from_snap():
+         # Use SNAP_INSTANCE_NAME for snapcraft's snap name, as it may not be
+         # 'snapcraft' if the '--name' parameter was used to install snapcraft.
diff --git a/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch b/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch
new file mode 100644
index 0000000000000..1dc4ef6cdcdf3
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch
@@ -0,0 +1,26 @@
+diff --git a/snapcraft_legacy/internal/common.py b/snapcraft_legacy/internal/common.py
+index 6017b405..aacd99a5 100644
+--- a/snapcraft_legacy/internal/common.py
++++ b/snapcraft_legacy/internal/common.py
+@@ -34,14 +34,17 @@ from snaphelpers import SnapConfigOptions, SnapCtlError
+ 
+ from snapcraft_legacy.internal import errors
+ 
++# Get the path to the Nix store entry for Snapcraft at runtime
++drv = os.path.realpath(__file__).split("/")[3]
++
+ SNAPCRAFT_FILES = ["parts", "stage", "prime"]
+-_DEFAULT_PLUGINDIR = os.path.join(sys.prefix, "share", "snapcraft", "plugins")
++_DEFAULT_PLUGINDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "plugins")
+ _plugindir = _DEFAULT_PLUGINDIR
+-_DEFAULT_SCHEMADIR = os.path.join(sys.prefix, "share", "snapcraft", "schema")
++_DEFAULT_SCHEMADIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "schema")
+ _schemadir = _DEFAULT_SCHEMADIR
+-_DEFAULT_EXTENSIONSDIR = os.path.join(sys.prefix, "share", "snapcraft", "extensions")
++_DEFAULT_EXTENSIONSDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "extensions")
+ _extensionsdir = _DEFAULT_EXTENSIONSDIR
+-_DEFAULT_KEYRINGSDIR = os.path.join(sys.prefix, "share", "snapcraft", "keyrings")
++_DEFAULT_KEYRINGSDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "keyrings")
+ _keyringsdir = _DEFAULT_KEYRINGSDIR
+ 
+ _DOCKERENV_FILE = "/.dockerenv"
diff --git a/pkgs/by-name/so/solana-cli/Cargo.lock b/pkgs/by-name/so/solana-cli/Cargo.lock
index 984d2e3828bfb..d50e156b347f7 100644
--- a/pkgs/by-name/so/solana-cli/Cargo.lock
+++ b/pkgs/by-name/so/solana-cli/Cargo.lock
@@ -2137,7 +2137,7 @@ dependencies = [
 
 [[package]]
 name = "gen-headers"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "log",
  "regex",
@@ -2145,7 +2145,7 @@ dependencies = [
 
 [[package]]
 name = "gen-syscall-list"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "regex",
 ]
@@ -2263,9 +2263,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.24"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
 dependencies = [
  "bytes",
  "fnv",
@@ -4066,7 +4066,7 @@ dependencies = [
 
 [[package]]
 name = "proto"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "protobuf-src",
  "tonic-build",
@@ -4309,7 +4309,7 @@ dependencies = [
 
 [[package]]
 name = "rbpf-cli"
-version = "1.17.28"
+version = "1.17.31"
 
 [[package]]
 name = "rcgen"
@@ -5042,9 +5042,9 @@ checksum = "9def91fd1e018fe007022791f865d0ccc9b3a0d5001e01aabb8b40e46000afb5"
 
 [[package]]
 name = "smallvec"
-version = "1.11.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "smpl_jwt"
@@ -5099,7 +5099,7 @@ dependencies = [
 
 [[package]]
 name = "solana-account-decoder"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "Inflector",
  "assert_matches",
@@ -5124,7 +5124,7 @@ dependencies = [
 
 [[package]]
 name = "solana-accounts-bench"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 2.33.3",
  "log",
@@ -5138,7 +5138,7 @@ dependencies = [
 
 [[package]]
 name = "solana-accounts-cluster-bench"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 2.33.3",
  "log",
@@ -5168,7 +5168,7 @@ dependencies = [
 
 [[package]]
 name = "solana-accounts-db"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "arrayref",
  "assert_matches",
@@ -5232,7 +5232,7 @@ dependencies = [
 
 [[package]]
 name = "solana-address-lookup-table-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "bytemuck",
@@ -5251,7 +5251,7 @@ dependencies = [
 
 [[package]]
 name = "solana-address-lookup-table-program-tests"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -5262,7 +5262,7 @@ dependencies = [
 
 [[package]]
 name = "solana-banking-bench"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 3.2.23",
  "crossbeam-channel",
@@ -5286,7 +5286,7 @@ dependencies = [
 
 [[package]]
 name = "solana-banks-client"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "borsh 0.10.3",
  "futures 0.3.28",
@@ -5303,7 +5303,7 @@ dependencies = [
 
 [[package]]
 name = "solana-banks-interface"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "serde",
  "solana-sdk",
@@ -5312,7 +5312,7 @@ dependencies = [
 
 [[package]]
 name = "solana-banks-server"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "crossbeam-channel",
@@ -5330,7 +5330,7 @@ dependencies = [
 
 [[package]]
 name = "solana-bench-streamer"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 3.2.23",
  "crossbeam-channel",
@@ -5341,7 +5341,7 @@ dependencies = [
 
 [[package]]
 name = "solana-bench-tps"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 2.33.3",
  "crossbeam-channel",
@@ -5382,7 +5382,7 @@ dependencies = [
 
 [[package]]
 name = "solana-bloom"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bv",
  "fnv",
@@ -5399,7 +5399,7 @@ dependencies = [
 
 [[package]]
 name = "solana-bpf-loader-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -5420,7 +5420,7 @@ dependencies = [
 
 [[package]]
 name = "solana-bpf-loader-program-tests"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -5431,7 +5431,7 @@ dependencies = [
 
 [[package]]
 name = "solana-bucket-map"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bv",
  "bytemuck",
@@ -5450,7 +5450,7 @@ dependencies = [
 
 [[package]]
 name = "solana-cargo-build-bpf"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "log",
  "solana-logger",
@@ -5458,7 +5458,7 @@ dependencies = [
 
 [[package]]
 name = "solana-cargo-build-sbf"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_cmd",
  "bzip2",
@@ -5479,11 +5479,11 @@ dependencies = [
 
 [[package]]
 name = "solana-cargo-test-bpf"
-version = "1.17.28"
+version = "1.17.31"
 
 [[package]]
 name = "solana-cargo-test-sbf"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "cargo_metadata",
  "clap 3.2.23",
@@ -5494,7 +5494,7 @@ dependencies = [
 
 [[package]]
 name = "solana-clap-utils"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "chrono",
@@ -5511,7 +5511,7 @@ dependencies = [
 
 [[package]]
 name = "solana-clap-v3-utils"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "chrono",
@@ -5529,7 +5529,7 @@ dependencies = [
 
 [[package]]
 name = "solana-cli"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -5582,7 +5582,7 @@ dependencies = [
 
 [[package]]
 name = "solana-cli-config"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "anyhow",
  "dirs-next",
@@ -5597,7 +5597,7 @@ dependencies = [
 
 [[package]]
 name = "solana-cli-output"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "Inflector",
  "base64 0.21.4",
@@ -5623,7 +5623,7 @@ dependencies = [
 
 [[package]]
 name = "solana-client"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "async-trait",
  "bincode",
@@ -5655,7 +5655,7 @@ dependencies = [
 
 [[package]]
 name = "solana-client-test"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "futures-util",
  "rand 0.8.5",
@@ -5685,7 +5685,7 @@ dependencies = [
 
 [[package]]
 name = "solana-compute-budget-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "solana-program-runtime",
  "solana-sdk",
@@ -5693,7 +5693,7 @@ dependencies = [
 
 [[package]]
 name = "solana-config-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "chrono",
@@ -5706,7 +5706,7 @@ dependencies = [
 
 [[package]]
 name = "solana-connection-cache"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "async-trait",
  "bincode",
@@ -5730,7 +5730,7 @@ dependencies = [
 
 [[package]]
 name = "solana-core"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "base64 0.21.4",
@@ -5813,7 +5813,7 @@ dependencies = [
 
 [[package]]
 name = "solana-cost-model"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "lazy_static",
  "log",
@@ -5838,7 +5838,7 @@ dependencies = [
 
 [[package]]
 name = "solana-dos"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "clap 3.2.23",
@@ -5868,7 +5868,7 @@ dependencies = [
 
 [[package]]
 name = "solana-download-utils"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "console",
  "indicatif",
@@ -5880,7 +5880,7 @@ dependencies = [
 
 [[package]]
 name = "solana-ed25519-program-tests"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "ed25519-dalek",
@@ -5891,7 +5891,7 @@ dependencies = [
 
 [[package]]
 name = "solana-entry"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -5913,7 +5913,7 @@ dependencies = [
 
 [[package]]
 name = "solana-faucet"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "byteorder",
@@ -5935,7 +5935,7 @@ dependencies = [
 
 [[package]]
 name = "solana-frozen-abi"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "ahash 0.8.5",
  "bitflags 2.3.3",
@@ -5965,7 +5965,7 @@ dependencies = [
 
 [[package]]
 name = "solana-frozen-abi-macro"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5975,7 +5975,7 @@ dependencies = [
 
 [[package]]
 name = "solana-genesis"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "base64 0.21.4",
  "bincode",
@@ -6000,7 +6000,7 @@ dependencies = [
 
 [[package]]
 name = "solana-genesis-utils"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "log",
  "solana-accounts-db",
@@ -6011,7 +6011,7 @@ dependencies = [
 
 [[package]]
 name = "solana-geyser-plugin-interface"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "log",
  "solana-sdk",
@@ -6021,7 +6021,7 @@ dependencies = [
 
 [[package]]
 name = "solana-geyser-plugin-manager"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bs58",
  "crossbeam-channel",
@@ -6046,7 +6046,7 @@ dependencies = [
 
 [[package]]
 name = "solana-gossip"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -6097,7 +6097,7 @@ dependencies = [
 
 [[package]]
 name = "solana-install"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "atty",
  "bincode",
@@ -6132,7 +6132,7 @@ dependencies = [
 
 [[package]]
 name = "solana-keygen"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bs58",
  "clap 3.2.23",
@@ -6149,7 +6149,7 @@ dependencies = [
 
 [[package]]
 name = "solana-ledger"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -6217,7 +6217,7 @@ dependencies = [
 
 [[package]]
 name = "solana-ledger-tool"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_cmd",
  "bs58",
@@ -6266,7 +6266,7 @@ dependencies = [
 
 [[package]]
 name = "solana-loader-v4-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "log",
@@ -6278,7 +6278,7 @@ dependencies = [
 
 [[package]]
 name = "solana-local-cluster"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "crossbeam-channel",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "solana-log-analyzer"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "byte-unit",
  "clap 3.2.23",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "solana-logger"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "env_logger",
  "lazy_static",
@@ -6338,7 +6338,7 @@ dependencies = [
 
 [[package]]
 name = "solana-measure"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "log",
  "solana-sdk",
@@ -6346,11 +6346,11 @@ dependencies = [
 
 [[package]]
 name = "solana-memory-management"
-version = "1.17.28"
+version = "1.17.31"
 
 [[package]]
 name = "solana-merkle-root-bench"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 2.33.3",
  "log",
@@ -6363,7 +6363,7 @@ dependencies = [
 
 [[package]]
 name = "solana-merkle-tree"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "fast-math",
  "hex",
@@ -6372,7 +6372,7 @@ dependencies = [
 
 [[package]]
 name = "solana-metrics"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "crossbeam-channel",
  "env_logger",
@@ -6388,7 +6388,7 @@ dependencies = [
 
 [[package]]
 name = "solana-net-shaper"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 3.2.23",
  "rand 0.8.5",
@@ -6399,7 +6399,7 @@ dependencies = [
 
 [[package]]
 name = "solana-net-utils"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "clap 3.2.23",
@@ -6419,7 +6419,7 @@ dependencies = [
 
 [[package]]
 name = "solana-notifier"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "log",
  "reqwest",
@@ -6429,7 +6429,7 @@ dependencies = [
 
 [[package]]
 name = "solana-perf"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "ahash 0.8.5",
  "assert_matches",
@@ -6460,7 +6460,7 @@ dependencies = [
 
 [[package]]
 name = "solana-poh"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -6481,7 +6481,7 @@ dependencies = [
 
 [[package]]
 name = "solana-poh-bench"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 3.2.23",
  "log",
@@ -6496,7 +6496,7 @@ dependencies = [
 
 [[package]]
 name = "solana-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "anyhow",
  "ark-bn254",
@@ -6553,7 +6553,7 @@ dependencies = [
 
 [[package]]
 name = "solana-program-runtime"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "base64 0.21.4",
@@ -6582,7 +6582,7 @@ dependencies = [
 
 [[package]]
 name = "solana-program-test"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "async-trait",
@@ -6611,7 +6611,7 @@ dependencies = [
 
 [[package]]
 name = "solana-pubsub-client"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "anyhow",
  "crossbeam-channel",
@@ -6635,7 +6635,7 @@ dependencies = [
 
 [[package]]
 name = "solana-quic-client"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "async-mutex",
  "async-trait",
@@ -6663,7 +6663,7 @@ dependencies = [
 
 [[package]]
 name = "solana-rayon-threadlimit"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "lazy_static",
  "num_cpus",
@@ -6671,7 +6671,7 @@ dependencies = [
 
 [[package]]
 name = "solana-remote-wallet"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "console",
@@ -6690,7 +6690,7 @@ dependencies = [
 
 [[package]]
 name = "solana-rpc"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "base64 0.21.4",
  "bincode",
@@ -6749,7 +6749,7 @@ dependencies = [
 
 [[package]]
 name = "solana-rpc-client"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "async-trait",
@@ -6778,7 +6778,7 @@ dependencies = [
 
 [[package]]
 name = "solana-rpc-client-api"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "base64 0.21.4",
  "bs58",
@@ -6798,7 +6798,7 @@ dependencies = [
 
 [[package]]
 name = "solana-rpc-client-nonce-utils"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "anyhow",
  "clap 2.33.3",
@@ -6815,7 +6815,7 @@ dependencies = [
 
 [[package]]
 name = "solana-rpc-test"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "bs58",
@@ -6842,7 +6842,7 @@ dependencies = [
 
 [[package]]
 name = "solana-runtime"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "arrayref",
  "assert_matches",
@@ -6925,7 +6925,7 @@ dependencies = [
 
 [[package]]
 name = "solana-sdk"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "anyhow",
  "assert_matches",
@@ -6983,7 +6983,7 @@ dependencies = [
 
 [[package]]
 name = "solana-sdk-macro"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bs58",
  "proc-macro2",
@@ -7000,7 +7000,7 @@ checksum = "468aa43b7edb1f9b7b7b686d5c3aeb6630dc1708e86e31343499dd5c4d775183"
 
 [[package]]
 name = "solana-send-transaction-service"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "crossbeam-channel",
  "log",
@@ -7015,7 +7015,7 @@ dependencies = [
 
 [[package]]
 name = "solana-stake-accounts"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 2.33.3",
  "solana-clap-utils",
@@ -7031,7 +7031,7 @@ dependencies = [
 
 [[package]]
 name = "solana-stake-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -7048,7 +7048,7 @@ dependencies = [
 
 [[package]]
 name = "solana-storage-bigtable"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "backoff",
  "bincode",
@@ -7080,7 +7080,7 @@ dependencies = [
 
 [[package]]
 name = "solana-storage-proto"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "bs58",
@@ -7096,7 +7096,7 @@ dependencies = [
 
 [[package]]
 name = "solana-store-tool"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 2.33.3",
  "log",
@@ -7108,7 +7108,7 @@ dependencies = [
 
 [[package]]
 name = "solana-streamer"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "async-channel",
@@ -7129,6 +7129,7 @@ dependencies = [
  "rand 0.8.5",
  "rcgen",
  "rustls",
+ "smallvec",
  "solana-logger",
  "solana-metrics",
  "solana-perf",
@@ -7140,7 +7141,7 @@ dependencies = [
 
 [[package]]
 name = "solana-system-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -7154,7 +7155,7 @@ dependencies = [
 
 [[package]]
 name = "solana-test-validator"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "base64 0.21.4",
  "bincode",
@@ -7184,7 +7185,7 @@ dependencies = [
 
 [[package]]
 name = "solana-thin-client"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "log",
@@ -7198,7 +7199,7 @@ dependencies = [
 
 [[package]]
 name = "solana-tokens"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -7231,7 +7232,7 @@ dependencies = [
 
 [[package]]
 name = "solana-tpu-client"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "async-trait",
  "bincode",
@@ -7253,7 +7254,7 @@ dependencies = [
 
 [[package]]
 name = "solana-transaction-dos"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "clap 2.33.3",
@@ -7280,7 +7281,7 @@ dependencies = [
 
 [[package]]
 name = "solana-transaction-status"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "Inflector",
  "base64 0.21.4",
@@ -7303,7 +7304,7 @@ dependencies = [
 
 [[package]]
 name = "solana-turbine"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -7340,7 +7341,7 @@ dependencies = [
 
 [[package]]
 name = "solana-udp-client"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "async-trait",
  "solana-connection-cache",
@@ -7353,7 +7354,7 @@ dependencies = [
 
 [[package]]
 name = "solana-upload-perf"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "serde_json",
  "solana-metrics",
@@ -7361,7 +7362,7 @@ dependencies = [
 
 [[package]]
 name = "solana-validator"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "chrono",
  "clap 2.33.3",
@@ -7425,7 +7426,7 @@ dependencies = [
 
 [[package]]
 name = "solana-version"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "log",
  "rustc_version 0.4.0",
@@ -7439,7 +7440,7 @@ dependencies = [
 
 [[package]]
 name = "solana-vote"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bincode",
  "crossbeam-channel",
@@ -7458,7 +7459,7 @@ dependencies = [
 
 [[package]]
 name = "solana-vote-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "assert_matches",
  "bincode",
@@ -7481,7 +7482,7 @@ dependencies = [
 
 [[package]]
 name = "solana-watchtower"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "clap 2.33.3",
  "humantime",
@@ -7500,7 +7501,7 @@ dependencies = [
 
 [[package]]
 name = "solana-zk-keygen"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bs58",
  "clap 3.2.23",
@@ -7519,7 +7520,7 @@ dependencies = [
 
 [[package]]
 name = "solana-zk-token-proof-program"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bytemuck",
  "criterion",
@@ -7533,7 +7534,7 @@ dependencies = [
 
 [[package]]
 name = "solana-zk-token-proof-program-tests"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "bytemuck",
  "curve25519-dalek",
@@ -7545,7 +7546,7 @@ dependencies = [
 
 [[package]]
 name = "solana-zk-token-sdk"
-version = "1.17.28"
+version = "1.17.31"
 dependencies = [
  "aes-gcm-siv",
  "base64 0.21.4",
diff --git a/pkgs/by-name/so/solana-cli/package.nix b/pkgs/by-name/so/solana-cli/package.nix
index a681710565072..e1a0ae412c900 100644
--- a/pkgs/by-name/so/solana-cli/package.nix
+++ b/pkgs/by-name/so/solana-cli/package.nix
@@ -31,8 +31,8 @@
   ]
 }:
 let
-  version = "1.17.28";
-  sha256 = "y79zsUfYsX377ofsFSg9a2il99uJsA+qdCu3J+EU5nQ=";
+  version = "1.17.31";
+  sha256 = "sha256-5qPW199o+CVJlqGwiAegsquBRWEb5uDKITxjN5dQYAQ=";
 
   inherit (darwin.apple_sdk_11_0) Libsystem;
   inherit (darwin.apple_sdk_11_0.frameworks) System IOKit AppKit Security;
diff --git a/pkgs/by-name/so/solo5/package.nix b/pkgs/by-name/so/solo5/package.nix
index 240c69a40a0f8..57ccd1e24b2bf 100644
--- a/pkgs/by-name/so/solo5/package.nix
+++ b/pkgs/by-name/so/solo5/package.nix
@@ -63,16 +63,15 @@ in stdenv.mkDerivation {
     runHook postCheck
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Sandboxed execution environment";
     homepage = "https://github.com/solo5/solo5";
-    license = lib.licenses.isc;
-    maintainers = with lib.maintainers; [ ehmry ];
-    platforms = builtins.map ({arch, os}: "${arch}-${os}")
-      (lib.cartesianProductOfSets {
-        arch = [ "aarch64" "x86_64" ];
-        os = [ "freebsd" "genode" "linux" "openbsd" ];
-      });
+    license = licenses.isc;
+    maintainers = [ maintainers.ehmry ];
+    platforms = mapCartesianProduct ({ arch, os }: "${arch}-${os}") {
+      arch = [ "aarch64" "x86_64" ];
+      os = [ "freebsd" "genode" "linux" "openbsd" ];
+    };
   };
 
 }
diff --git a/pkgs/by-name/so/sopwith/package.nix b/pkgs/by-name/so/sopwith/package.nix
index b881454fff78e..8a4c1f9162010 100644
--- a/pkgs/by-name/so/sopwith/package.nix
+++ b/pkgs/by-name/so/sopwith/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sopwith";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "fragglet";
     repo = "sdl-sopwith";
     rev = "refs/tags/sdl-sopwith-${version}";
-    hash = "sha256-7/xTg41NYxzeGNyt/ClbM/uHMTAE87wn6vc9Ai6P+30=";
+    hash = "sha256-e7/Cv/v5NhYG5eb9B5oVxh/Dbmm2v4Y4KUKI4JI5SFw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ss/ssh-tpm-agent/package.nix b/pkgs/by-name/ss/ssh-tpm-agent/package.nix
index a7335db8daa0d..fc655fce32ad6 100644
--- a/pkgs/by-name/ss/ssh-tpm-agent/package.nix
+++ b/pkgs/by-name/ss/ssh-tpm-agent/package.nix
@@ -25,7 +25,7 @@ buildGo122Module rec {
 
   meta = with lib; {
     description = "SSH agent with support for TPM sealed keys for public key authentication";
-    homepage = "https://github.com/Foxboron/ssh-agent-tpm";
+    homepage = "https://github.com/Foxboron/ssh-tpm-agent";
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ sgo ];
diff --git a/pkgs/by-name/ss/ssimulacra2/package.nix b/pkgs/by-name/ss/ssimulacra2/package.nix
new file mode 100644
index 0000000000000..9e9992f6d9368
--- /dev/null
+++ b/pkgs/by-name/ss/ssimulacra2/package.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, ninja
+, cmake
+, libpng
+, libhwy
+, lcms2
+, giflib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ssimulacra2";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "cloudinary";
+    repo = "ssimulacra2";
+    hash = "sha256-gOo8WCWMdXOSmny0mQSzCvHgURQTCNBFD4G4sxfmXik=";
+    rev = "tags/v${finalAttrs.version}";
+  };
+
+  nativeBuildInputs = [
+    ninja
+    cmake
+  ];
+
+  buildInputs = [
+    libpng
+    libhwy
+    lcms2
+    giflib
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  installPhase = ''
+    runHook preInstall
+    install -m 755 -D ssimulacra2 -t $out/bin/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/cloudinary/ssimulacra2";
+    maintainers = [ maintainers.viraptor ];
+    license = licenses.bsd3;
+    description = "Perceptual image comparison tool";
+  };
+})
diff --git a/pkgs/by-name/sw/swayosd/package.nix b/pkgs/by-name/sw/swayosd/package.nix
index d3bd68ea1e4e9..d3238053c0196 100644
--- a/pkgs/by-name/sw/swayosd/package.nix
+++ b/pkgs/by-name/sw/swayosd/package.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pkg-config
 , wrapGAppsHook
+, brightnessctl
 , cargo
 , coreutils
 , gtk-layer-shell
@@ -12,25 +13,26 @@
 , meson
 , ninja
 , rustc
+, sassc
 , stdenv
 , udev
 }:
 
 stdenv.mkDerivation rec {
   pname = "swayosd";
-  version = "unstable-2023-09-26";
+  version = "0-unstable-2024-04-15";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
     repo = "SwayOSD";
-    rev = "1c7d2f5b3ee262f25bdd3c899eadf17efb656d26";
-    hash = "sha256-Y22O6Ktya/WIhidnoyxnZu5YvXWNmSS6vecDU8zDD34=";
+    rev = "11271760052c4a4a4057f2d287944d74e8fbdb58";
+    hash = "sha256-qOxnl2J+Ivx/TIqodv3a8nP0JQsYoKIrhqnbD9IxU8g=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-tqbMlygX+n14oR1t+0ngjiSG2mHUk/NbiWHk4yEAb2o=";
+    hash = "sha256-exbVanUvGp0ub4WE3VcsN8hkcK0Ipf0tNfd92UecICg=";
   };
 
   nativeBuildInputs = [
@@ -49,12 +51,19 @@ stdenv.mkDerivation rec {
     libinput
     libpulseaudio
     udev
+    sassc
   ];
 
   patches = [
     ./swayosd_systemd_paths.patch
   ];
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ brightnessctl ]}
+    )
+  '';
+
   postPatch = ''
     substituteInPlace data/udev/99-swayosd.rules \
       --replace /bin/chgrp ${coreutils}/bin/chgrp \
@@ -65,7 +74,7 @@ stdenv.mkDerivation rec {
     description = "A GTK based on screen display for keyboard shortcuts";
     homepage = "https://github.com/ErikReider/SwayOSD";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ aleksana barab-i ];
+    maintainers = with maintainers; [ aleksana barab-i sergioribera ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/sy/symfony-cli/package.nix b/pkgs/by-name/sy/symfony-cli/package.nix
index 470a6eaa6cd6f..9931e4f590892 100644
--- a/pkgs/by-name/sy/symfony-cli/package.nix
+++ b/pkgs/by-name/sy/symfony-cli/package.nix
@@ -10,14 +10,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.8.14";
-  vendorHash = "sha256-OBXurPjyB2/JCQBna+tk0p3+n8gPoNLXCppXkII3ZUc=";
+  version = "5.8.15";
+  vendorHash = "sha256-rkvQhZSoKZIl/gFgekLUelem2FGbRL9gp1LEzYN88Dc=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-rwcULDbdYHZ1yFrGEGsJOZQG7Z29m0MOd79yalFIdkQ=";
+    hash = "sha256-HbBg2oCsogY3X4jgjknqwNe2bszXjylvE+h5/iyg2pM=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/sy/syncall/package.nix b/pkgs/by-name/sy/syncall/package.nix
new file mode 100644
index 0000000000000..5ad793b672a28
--- /dev/null
+++ b/pkgs/by-name/sy/syncall/package.nix
@@ -0,0 +1,73 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "syncall";
+  version = "1.8.5";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "syncall";
+    rev = "v${version}";
+    hash = "sha256-f9WVZ1gpVG0wvIqoAkeaYBE4QsGXSqrYS4KyHy6S+0Q=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+    --replace-fail 'loguru = "^0.5.3"' 'loguru = "^0.7"' \
+    --replace-fail 'PyYAML = "~5.3.1"' 'PyYAML = "^6.0"' \
+    --replace-fail 'bidict = "^0.21.2"' 'bidict = "^0.23"' \
+    --replace-fail 'typing = "^3.7.4"' '''
+  '';
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+    python3.pkgs.poetry-dynamic-versioning
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    bidict
+    bubop
+    click
+    item-synchronizer
+    loguru
+    python-dateutil
+    pyyaml
+    rfc3339
+    typing
+
+    # asana optional-dep
+    asana
+    # caldav optional-dep
+    caldav
+    icalendar
+    # fs optional-dep
+    xattr
+    # gkeep optional-dep
+    # gkeepapi is unavailable in nixpkgs
+    # google optional-dep
+    google-api-python-client
+    google-auth-oauthlib
+    # notion optional-dep
+    # FIXME: notion-client -- broken, doesn't build.
+    # taskwarrior optional-dep
+    taskw-ng
+  ];
+
+  postInstall = ''
+    # We do not support gkeep
+    rm $out/bin/tw_gkeep_sync
+  '';
+
+  pythonImportsCheck = [ "syncall" ];
+
+  meta = with lib; {
+    description = "Bi-directional synchronization between services such as Taskwarrior, Google Calendar, Notion, Asana, and more";
+    homepage = "https://github.com/bergercookie/syncall";
+    license = licenses.mit;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/by-name/sy/systemctl-tui/package.nix b/pkgs/by-name/sy/systemctl-tui/package.nix
index 571c9b15091f7..23a831e9e9c57 100644
--- a/pkgs/by-name/sy/systemctl-tui/package.nix
+++ b/pkgs/by-name/sy/systemctl-tui/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systemctl-tui";
-  version = "0.2.4";
+  version = "0.3.3";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-SZmOCx9S5WWz9fSlicvT/glZKj5AsFDRnxmHbGxM9Ms=";
+    hash = "sha256-oFXLxWS2G+CkG0yuJLkA34SqoGGcXU/eZmFMRYw+Gzo=";
   };
 
-  cargoHash = "sha256-zUc6RchoGtJB+gnJNwNu93to775fdM5JDJ4qYwRdJn0=";
+  cargoHash = "sha256-MKxeRQupgAxA2ui8qSK8BvhxqqgjJarD8pY9wmk8MvA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.AppKit
diff --git a/pkgs/by-name/ta/taskchampion-sync-server/package.nix b/pkgs/by-name/ta/taskchampion-sync-server/package.nix
new file mode 100644
index 0000000000000..8ddefa8374c1f
--- /dev/null
+++ b/pkgs/by-name/ta/taskchampion-sync-server/package.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "taskchampion-sync-server";
+  version = "0.4.1-unstable-2024-04-08";
+  src = fetchFromGitHub {
+      owner = "GothenburgBitFactory";
+      repo = "taskchampion-sync-server";
+      rev = "31cb732f0697208ef9a8d325a79688612087185a";
+      fetchSubmodules = false;
+      sha256 = "sha256-CUgXJcrCOenbw9ZDFBody5FAvpT1dsZBojJk3wOv9U4=";
+    };
+
+  cargoHash = "sha256-TpShnVQ2eFNLXJzOTlWVaLqT56YkP4zCGCf3yVtNcvI=";
+
+  # cargo tests fail when checkType="release" (default)
+  checkType = "debug";
+
+  meta = {
+    description = "Sync server for Taskwarrior 3";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/GothenburgBitFactory/taskchampion-sync-server";
+    maintainers = with lib.maintainers; [mlaradji];
+    mainProgram = "taskchampion-sync-server";
+  };
+}
diff --git a/pkgs/by-name/ta/taskwarrior3/package.nix b/pkgs/by-name/ta/taskwarrior3/package.nix
new file mode 100644
index 0000000000000..5b9372189c72b
--- /dev/null
+++ b/pkgs/by-name/ta/taskwarrior3/package.nix
@@ -0,0 +1,83 @@
+{
+  rustPlatform,
+  rustc,
+  cargo,
+  corrosion,
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libuuid,
+  gnutls,
+  python3,
+  xdg-utils,
+  installShellFiles,
+}:
+stdenv.mkDerivation rec {
+    pname = "taskwarrior";
+    version = "3.0.0-unstable-2024-04-07";
+    src = fetchFromGitHub {
+      owner = "GothenburgBitFactory";
+      repo = "taskwarrior";
+      rev = "fd306712b85dda3ea89de4e617aebeb98b2ede80";
+      fetchSubmodules = true;
+      sha256 = "sha256-vzfHq/LHfnTx6CVGFCuO6W5aSqj1jVqldMdmyciSDDk=";
+    };
+
+  postPatch = ''
+    substituteInPlace src/commands/CmdNews.cpp \
+      --replace "xdg-open" "${lib.getBin xdg-utils}/bin/xdg-open"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    libuuid
+    python3
+    installShellFiles
+    corrosion
+    cargo
+    rustc
+    rustPlatform.cargoSetupHook
+  ];
+
+  doCheck = true;
+  preCheck = ''
+    patchShebangs --build test
+  '';
+  checkTarget = "test";
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    name = "${pname}-${version}-cargo-deps";
+    inherit src;
+    sourceRoot = src.name;
+    hash = "sha256-zQca/1tI/GUCekKhrg2iSL+h69SH6Ttsj3MqwDKj8HQ=";
+  };
+  cargoRoot = "./";
+  preConfigure = ''
+    export CMAKE_PREFIX_PATH="${corrosion}:$CMAKE_PREFIX_PATH"
+  '';
+
+  postInstall = ''
+    # ZSH is installed automatically from some reason, only bash and fish need
+    # manual installation
+    installShellCompletion --cmd task \
+      --bash $out/share/doc/task/scripts/bash/task.sh \
+      --fish $out/share/doc/task/scripts/fish/task.fish
+    rm -r $out/share/doc/task/scripts/bash
+    rm -r $out/share/doc/task/scripts/fish
+    # Install vim and neovim plugin
+    mkdir -p $out/share/vim-plugins
+    mv $out/share/doc/task/scripts/vim $out/share/vim-plugins/task
+    mkdir -p $out/share/nvim
+    ln -s $out/share/vim-plugins/task $out/share/nvim/site
+  '';
+
+  meta = with lib; {
+    description = "Highly flexible command-line tool to manage TODO lists";
+    homepage = "https://taskwarrior.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [marcweber oxalica mlaradji];
+    mainProgram = "task";
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/te/ternimal/package.nix b/pkgs/by-name/te/ternimal/package.nix
new file mode 100644
index 0000000000000..31f796f1ae600
--- /dev/null
+++ b/pkgs/by-name/te/ternimal/package.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustc
+}:
+stdenv.mkDerivation {
+  pname = "ternimal";
+  version = "0.1.0-unstable-2017-12-31";
+
+  src = fetchFromGitHub {
+    owner = "p-e-w";
+    repo = "ternimal";
+    rev = "e7953b4f80e514899e0920f0e36bb3141b685122";
+    hash = "sha256-uIxuwRvStvlC/YiolOvWZd45Qg3b86jsZQ000zZMo3M=";
+  };
+
+  nativeBuildInputs = [ rustc ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    rustc -O $src/ternimal.rs
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ternimal $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Simulate a lifeform in the terminal";
+    homepage = "https://github.com/p-e-w/ternimal";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ anomalocaris ];
+    platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "ternimal";
+  };
+}
diff --git a/pkgs/by-name/te/tetrio-desktop/package.json b/pkgs/by-name/te/tetrio-desktop/package.json
new file mode 100644
index 0000000000000..65bf8ea63f762
--- /dev/null
+++ b/pkgs/by-name/te/tetrio-desktop/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "tetrio-desktop",
+  "version": "9.0.0",
+  "author": {
+    "name": "osk",
+    "email": "me@osk.sh"
+  },
+  "license": "© osk 2019-2024. All Rights Reserved.",
+  "homepage": "https://tetr.io/",
+  "main": "main.js",
+  "description": "Puzzle together in this modern yet familiar online stacker!",
+  "dependencies": {
+    "discord-rich-presence": "0.0.8",
+    "electron-store": "^8.1.0",
+    "image-size": "^1.1.1",
+    "node-fetch": "2.6.1",
+    "openpgp": "^5.11.1",
+    "systeminformation": "^5.22.0",
+    "whatwg-url": "^14.0.0",
+    "xmldom": "^0.6.0"
+  }
+}
diff --git a/pkgs/by-name/te/tetrio-desktop/package.nix b/pkgs/by-name/te/tetrio-desktop/package.nix
index d7fed29e7dae7..c3749de57dadc 100644
--- a/pkgs/by-name/te/tetrio-desktop/package.nix
+++ b/pkgs/by-name/te/tetrio-desktop/package.nix
@@ -1,84 +1,65 @@
 { stdenv
 , lib
-, fetchurl
+, fetchzip
 , dpkg
-, autoPatchelfHook
-, wrapGAppsHook
-, alsa-lib
-, cups
-, libGL
-, libX11
-, libXScrnSaver
-, libXtst
-, mesa
-, nss
-, gtk3
-, libpulseaudio
-, systemd
-, withTetrioPlus ? false # For backwards compatibility. At the time of writing, the latest released tetrio plus version is not compatible with tetrio desktop.
-, tetrio-plus ? false # For backwards compatibility. At the time of writing, the latest released tetrio plus version is not compatible with tetrio desktop.
+, makeWrapper
+, callPackage
+, addOpenGLRunpath
+, electron
+, withTetrioPlus ? true
+, tetrio-plus ? null
 }:
 
-lib.warnIf (withTetrioPlus != false) "withTetrioPlus: Currently unsupported with tetrio-desktop 9.0.0. Please remove this attribute."
-lib.warnIf (tetrio-plus != false) "tetrio-plus: Currently unsupported with tetrio-desktop 9.0.0. Please remove this attribute."
-
-(let
-  libPath = lib.makeLibraryPath [
-    libGL
-    libpulseaudio
-    systemd
-  ];
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tetrio-desktop";
   version = "9.0.0";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://tetr.io/about/desktop/builds/${lib.versions.major finalAttrs.version}/TETR.IO%20Setup.deb";
-    hash = "sha256-UriLwMB8D+/T32H4rPbkJAy/F/FFhNpd++0AR1lwEfs=";
+    hash = "sha256-TgegFy+sHjv0ILaiLO1ghyUhKXoj8v43ACJOJhKyI0c=";
+    nativeBuildInputs = [ dpkg ];
   };
 
   nativeBuildInputs = [
-    dpkg
-    autoPatchelfHook
-    wrapGAppsHook
+    makeWrapper
   ];
 
-  dontWrapGApps = true;
-
-  buildInputs = [
-    alsa-lib
-    cups
-    libX11
-    libXScrnSaver
-    libXtst
-    mesa
-    nss
-    gtk3
-  ];
+  installPhase =
+    let
+      tetrio-plus' =
+        if tetrio-plus == null
+        then callPackage ./tetrio-plus.nix { tetrio-src = finalAttrs.src; }
+        else tetrio-plus;
 
-  unpackCmd = "dpkg -x $curSrc src";
+      asarPath =
+        if withTetrioPlus
+        then "${tetrio-plus'}/app.asar"
+        else "opt/TETR.IO/resources/app.asar";
+    in
+    ''
+      runHook preInstall
 
-  installPhase = ''
-    runHook preInstall
+      mkdir -p $out
+      cp -r usr/share/ $out
 
-    mkdir -p $out/bin
-    cp -r opt/ usr/share/ $out
-    ln -s $out/opt/TETR.IO/TETR.IO $out/bin/tetrio
+      mkdir -p $out/share/TETR.IO/
+      cp ${asarPath} $out/share/TETR.IO/app.asar
 
-    substituteInPlace $out/share/applications/TETR.IO.desktop \
-      --replace-fail "Exec=/opt/TETR.IO/TETR.IO" "Exec=$out/bin/tetrio"
+      substituteInPlace $out/share/applications/TETR.IO.desktop \
+        --replace-fail "Exec=/opt/TETR.IO/TETR.IO" "Exec=$out/bin/tetrio"
 
-    runHook postInstall
-  '';
+      runHook postInstall
+    '';
 
   postFixup = ''
-    wrapProgram $out/opt/TETR.IO/TETR.IO \
-      --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/TETR.IO \
-      ''${gappsWrapperArgs[@]}
+    makeShellWrapper '${lib.getExe electron}' $out/bin/tetrio \
+      --prefix LD_LIBRARY_PATH : ${addOpenGLRunpath.driverLink}/lib \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags $out/share/TETR.IO/app.asar
   '';
 
   meta = {
+    changelog = "https://tetr.io/about/desktop/history/";
     description = "TETR.IO desktop client";
     downloadPage = "https://tetr.io/about/desktop/";
     homepage = "https://tetr.io";
@@ -88,7 +69,8 @@ stdenv.mkDerivation (finalAttrs: {
       Play against friends and foes all over the world, or claim a spot on the leaderboards - the stacker future is yours!
     '';
     mainProgram = "tetrio";
-    maintainers = with lib.maintainers; [ wackbyte ];
+    maintainers = with lib.maintainers; [ wackbyte huantian ];
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
   };
-}))
+})
diff --git a/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
new file mode 100644
index 0000000000000..a0c67265e51ce
--- /dev/null
+++ b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
@@ -0,0 +1,160 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, rustPlatform
+, rustc
+, wasm-pack
+, wasm-bindgen-cli
+, binaryen
+
+, fetchYarnDeps
+, yarn
+, fixup_yarn_lock
+, nodejs
+, asar
+
+, tetrio-src
+}:
+
+let
+  version = "unstable-2024-03-31";
+
+  src = fetchFromGitLab {
+    owner = "UniQMG";
+    repo = "tetrio-plus";
+    rev = "b13d476a162a2aec4ca0def29eb7a4ada9ebf523";
+    hash = "sha256-bZwx0r2lu4Ed/pYRvNog6IIok/HMoK+UeDIQctggUEs=";
+    fetchSubmodules = true;
+
+    # tetrio-plus uses this info for displaying its version,
+    # so we need to deep clone to have all the revision history.
+    # After we're done, we emulate 'leaveDotGit = false' by removing
+    # all the .git folders.
+    leaveDotGit = true;
+    deepClone = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse --short HEAD~1 > resources/ci-commit-previous
+      git rev-parse --short HEAD > resources/ci-commit
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  wasm-bindgen-82 = wasm-bindgen-cli.override {
+    version = "0.2.82";
+    hash = "sha256-BQ8v3rCLUvyCCdxo5U+NHh30l9Jwvk9Sz8YQv6fa0SU=";
+    cargoHash = "sha256-mP85+qi2KA0GieaBzbrQOBqYxBZNRJipvd2brCRGyOM=";
+  };
+
+  tpsecore = rustPlatform.buildRustPackage {
+    pname = "tpsecore";
+    inherit version src;
+
+    sourceRoot = "${src.name}/tpsecore";
+
+    cargoHash = "sha256-14UjPSlfiuf696cqy8+fz3SmfmFoGQlEDg9obP0EKXg=";
+
+    nativeBuildInputs = [
+      wasm-pack
+      wasm-bindgen-82
+      binaryen
+      rustc.llvmPackages.lld
+    ];
+
+    buildPhase = ''
+      HOME=$(mktemp -d) RUSTFLAGS="-C linker=lld" wasm-pack build --target web --release
+    '';
+
+    installPhase = ''
+      cp -r pkg/ $out
+    '';
+
+    doCheck = false;
+
+    meta = {
+      description = "A self contained toolkit for creating, editing, and previewing TPSE files";
+      homepage = "https://gitlab.com/UniQMG/tpsecore";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [ huantian wackbyte ];
+      platforms = lib.platforms.linux;
+    };
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = ./yarn.lock;
+    hash = "sha256-VYUh9y6PRc1OTLELkqCxP89Xbesv3Nu+eUq6fkuoQHE=";
+  };
+
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tetrio-plus";
+  inherit version src;
+
+  nativeBuildInputs = [
+    yarn
+    fixup_yarn_lock
+    nodejs
+    asar
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    # 'out' is the directory that the tetrio-plus expects the vanilla asar to be
+    # and this is the directory that will contain the final result that we want
+    asar extract ${tetrio-src}/opt/TETR.IO/resources/app.asar out
+    cd out
+
+    # Install custom package.json/yarn.lock that describe the additional node
+    # dependencies that tetrio-plus needs to run, and install them in our output
+    install -m644 ${./package.json} package.json
+    install -m644 ${./yarn.lock} yarn.lock
+
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror ${offlineCache}
+    fixup_yarn_lock yarn.lock
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    patchShebangs node_modules/
+
+    cd ..
+
+    # The simple build script expects the vanilla asar located here
+    # This patches the vanilla code to load the tetrio-plus code
+    ln -s ${tetrio-src}/opt/TETR.IO/resources/app.asar app.asar
+    node ./scripts/build-electron.js
+
+    # Finally, we install the tetrio-plus code where the above patch script expects
+    cp -r $src out/tetrioplus
+    chmod -R u+w out/tetrioplus
+
+    # We don't need the tpsecore source code bundled
+    rm -rf out/tetrioplus/tpsecore/
+    # since we install the compiled version here
+    cp ${tpsecore}/{tpsecore_bg.wasm,tpsecore.js} out/tetrioplus/source/lib/
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preinstall
+
+    mkdir -p $out
+    asar pack out $out/app.asar
+
+    runHook postinstall
+  '';
+
+  meta = {
+    description = "TETR.IO customization tool suite";
+    downloadPage = "https://gitlab.com/UniQMG/tetrio-plus/-/releases";
+    homepage = "https://gitlab.com/UniQMG/tetrio-plus";
+    license = [
+      lib.licenses.mit
+      # while tetrio-plus is itself mit, the result of this derivation
+      # is a modified version of tetrio-desktop, which is unfree.
+      lib.licenses.unfree
+    ];
+    maintainers = with lib.maintainers; [ huantian wackbyte ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/te/tetrio-desktop/yarn.lock b/pkgs/by-name/te/tetrio-desktop/yarn.lock
new file mode 100644
index 0000000000000..9c6cd6519a9f2
--- /dev/null
+++ b/pkgs/by-name/te/tetrio-desktop/yarn.lock
@@ -0,0 +1,348 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+ajv-formats@^2.1.1:
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/ajv-formats/-/ajv-formats-2.1.1.tgz#6e669400659eb74973bbf2e33327180a0996b520"
+  integrity sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==
+  dependencies:
+    ajv "^8.0.0"
+
+ajv@^8.0.0, ajv@^8.6.3:
+  version "8.12.0"
+  resolved "https://registry.yarnpkg.com/ajv/-/ajv-8.12.0.tgz#d1a0527323e22f53562c567c00991577dfbe19d1"
+  integrity sha512-sRu1kpcO9yLtYxBKvqfTeh9KzZEwO3STyX1HT+4CaDzC6HpTGYhIhPIzj9XuKU7KYDwnaeh5hcOwjy1QuJzBPA==
+  dependencies:
+    fast-deep-equal "^3.1.1"
+    json-schema-traverse "^1.0.0"
+    require-from-string "^2.0.2"
+    uri-js "^4.2.2"
+
+asn1.js@^5.0.0:
+  version "5.4.1"
+  resolved "https://registry.yarnpkg.com/asn1.js/-/asn1.js-5.4.1.tgz#11a980b84ebb91781ce35b0fdc2ee294e3783f07"
+  integrity sha512-+I//4cYPccV8LdmBLiX8CYvf9Sp3vQsrqu2QNXRcrbiWvcx/UdlFiqUJJzxRQxgsZmvhXhn4cSKeSmoFjVdupA==
+  dependencies:
+    bn.js "^4.0.0"
+    inherits "^2.0.1"
+    minimalistic-assert "^1.0.0"
+    safer-buffer "^2.1.0"
+
+atomically@^1.7.0:
+  version "1.7.0"
+  resolved "https://registry.yarnpkg.com/atomically/-/atomically-1.7.0.tgz#c07a0458432ea6dbc9a3506fffa424b48bccaafe"
+  integrity sha512-Xcz9l0z7y9yQ9rdDaxlmaI4uJHf/T8g9hOEzJcsEqX2SjCj4J20uK7+ldkDHMbpJDK76wF7xEIgxc/vSlsfw5w==
+
+bindings@^1.3.0:
+  version "1.5.0"
+  resolved "https://registry.yarnpkg.com/bindings/-/bindings-1.5.0.tgz#10353c9e945334bc0511a6d90b38fbc7c9c504df"
+  integrity sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==
+  dependencies:
+    file-uri-to-path "1.0.0"
+
+bn.js@^4.0.0:
+  version "4.12.0"
+  resolved "https://registry.yarnpkg.com/bn.js/-/bn.js-4.12.0.tgz#775b3f278efbb9718eec7361f483fb36fbbfea88"
+  integrity sha512-c98Bf3tPniI+scsdk237ku1Dc3ujXQTSgyiPUDEOe7tRkhrqridvh8klBv0HCEso1OLOYcHuCv/cS6DNxKH+ZA==
+
+conf@^10.2.0:
+  version "10.2.0"
+  resolved "https://registry.yarnpkg.com/conf/-/conf-10.2.0.tgz#838e757be963f1a2386dfe048a98f8f69f7b55d6"
+  integrity sha512-8fLl9F04EJqjSqH+QjITQfJF8BrOVaYr1jewVgSRAEWePfxT0sku4w2hrGQ60BC/TNLGQ2pgxNlTbWQmMPFvXg==
+  dependencies:
+    ajv "^8.6.3"
+    ajv-formats "^2.1.1"
+    atomically "^1.7.0"
+    debounce-fn "^4.0.0"
+    dot-prop "^6.0.1"
+    env-paths "^2.2.1"
+    json-schema-typed "^7.0.3"
+    onetime "^5.1.2"
+    pkg-up "^3.1.0"
+    semver "^7.3.5"
+
+debounce-fn@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/debounce-fn/-/debounce-fn-4.0.0.tgz#ed76d206d8a50e60de0dd66d494d82835ffe61c7"
+  integrity sha512-8pYCQiL9Xdcg0UPSD3d+0KMlOjp+KGU5EPwYddgzQ7DATsg4fuUDjQtsYLmWjnk2obnNHgV3vE2Y4jejSOJVBQ==
+  dependencies:
+    mimic-fn "^3.0.0"
+
+discord-rich-presence@0.0.8:
+  version "0.0.8"
+  resolved "https://registry.yarnpkg.com/discord-rich-presence/-/discord-rich-presence-0.0.8.tgz#7a2b41ff87a278e8a2c8835cd91c9890d6b9fbdd"
+  integrity sha512-IpVMPjv15C9UvppxvrrGdv6bzQHOW1P1vLoMH15HvdJwGJ3dBd2bnrJ63Uy36YRUfrAMxGLiwUDHncvC8AuPaQ==
+  dependencies:
+    discord-rpc "github:discordjs/rpc"
+
+"discord-rpc@github:discordjs/rpc":
+  version "4.0.1"
+  resolved "https://codeload.github.com/discordjs/rpc/tar.gz/9e7de2a6d917591f10a66389e62e1dc053c04fec"
+  dependencies:
+    node-fetch "^2.6.1"
+    ws "^7.3.1"
+  optionalDependencies:
+    register-scheme "github:devsnek/node-register-scheme"
+
+dot-prop@^6.0.1:
+  version "6.0.1"
+  resolved "https://registry.yarnpkg.com/dot-prop/-/dot-prop-6.0.1.tgz#fc26b3cf142b9e59b74dbd39ed66ce620c681083"
+  integrity sha512-tE7ztYzXHIeyvc7N+hR3oi7FIbf/NIjVP9hmAt3yMXzrQ072/fpjGLx2GxNxGxUl5V73MEqYzioOMoVhGMJ5cA==
+  dependencies:
+    is-obj "^2.0.0"
+
+electron-store@^8.1.0:
+  version "8.2.0"
+  resolved "https://registry.yarnpkg.com/electron-store/-/electron-store-8.2.0.tgz#114e6e453e8bb746ab4ccb542424d8c881ad2ca1"
+  integrity sha512-ukLL5Bevdil6oieAOXz3CMy+OgaItMiVBg701MNlG6W5RaC0AHN7rvlqTCmeb6O7jP0Qa1KKYTE0xV0xbhF4Hw==
+  dependencies:
+    conf "^10.2.0"
+    type-fest "^2.17.0"
+
+env-paths@^2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/env-paths/-/env-paths-2.2.1.tgz#420399d416ce1fbe9bc0a07c62fa68d67fd0f8f2"
+  integrity sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==
+
+fast-deep-equal@^3.1.1:
+  version "3.1.3"
+  resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525"
+  integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==
+
+file-uri-to-path@1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz#553a7b8446ff6f684359c445f1e37a05dacc33dd"
+  integrity sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==
+
+find-up@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/find-up/-/find-up-3.0.0.tgz#49169f1d7993430646da61ecc5ae355c21c97b73"
+  integrity sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==
+  dependencies:
+    locate-path "^3.0.0"
+
+image-size@^1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/image-size/-/image-size-1.1.1.tgz#ddd67d4dc340e52ac29ce5f546a09f4e29e840ac"
+  integrity sha512-541xKlUw6jr/6gGuk92F+mYM5zaFAc5ahphvkqvNe2bQ6gVBkd6bfrmVJ2t4KDAfikAYZyIqTnktX3i6/aQDrQ==
+  dependencies:
+    queue "6.0.2"
+
+inherits@^2.0.1, inherits@~2.0.3:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c"
+  integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==
+
+is-obj@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/is-obj/-/is-obj-2.0.0.tgz#473fb05d973705e3fd9620545018ca8e22ef4982"
+  integrity sha512-drqDG3cbczxxEJRoOXcOjtdp1J/lyp1mNn0xaznRs8+muBhgQcrnbspox5X5fOw0HnMnbfDzvnEMEtqDEJEo8w==
+
+json-schema-traverse@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz#ae7bcb3656ab77a73ba5c49bf654f38e6b6860e2"
+  integrity sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==
+
+json-schema-typed@^7.0.3:
+  version "7.0.3"
+  resolved "https://registry.yarnpkg.com/json-schema-typed/-/json-schema-typed-7.0.3.tgz#23ff481b8b4eebcd2ca123b4fa0409e66469a2d9"
+  integrity sha512-7DE8mpG+/fVw+dTpjbxnx47TaMnDfOI1jwft9g1VybltZCduyRQPJPvc+zzKY9WPHxhPWczyFuYa6I8Mw4iU5A==
+
+locate-path@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/locate-path/-/locate-path-3.0.0.tgz#dbec3b3ab759758071b58fe59fc41871af21400e"
+  integrity sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==
+  dependencies:
+    p-locate "^3.0.0"
+    path-exists "^3.0.0"
+
+lru-cache@^6.0.0:
+  version "6.0.0"
+  resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-6.0.0.tgz#6d6fe6570ebd96aaf90fcad1dafa3b2566db3a94"
+  integrity sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==
+  dependencies:
+    yallist "^4.0.0"
+
+mimic-fn@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-2.1.0.tgz#7ed2c2ccccaf84d3ffcb7a69b57711fc2083401b"
+  integrity sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==
+
+mimic-fn@^3.0.0:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-3.1.0.tgz#65755145bbf3e36954b949c16450427451d5ca74"
+  integrity sha512-Ysbi9uYW9hFyfrThdDEQuykN4Ey6BuwPD2kpI5ES/nFTDn/98yxYNLZJcgUAKPT/mcrLLKaGzJR9YVxJrIdASQ==
+
+minimalistic-assert@^1.0.0:
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz#2e194de044626d4a10e7f7fbc00ce73e83e4d5c7"
+  integrity sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==
+
+node-addon-api@^1.3.0:
+  version "1.7.2"
+  resolved "https://registry.yarnpkg.com/node-addon-api/-/node-addon-api-1.7.2.tgz#3df30b95720b53c24e59948b49532b662444f54d"
+  integrity sha512-ibPK3iA+vaY1eEjESkQkM0BbCqFOaZMiXRTtdB0u7b4djtY6JnsjvPdUHVMg6xQt3B8fpTTWHI9A+ADjM9frzg==
+
+node-fetch@2.6.1:
+  version "2.6.1"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.1.tgz#045bd323631f76ed2e2b55573394416b639a0052"
+  integrity sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==
+
+node-fetch@^2.6.1:
+  version "2.7.0"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.7.0.tgz#d0f0fa6e3e2dc1d27efcd8ad99d550bda94d187d"
+  integrity sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==
+  dependencies:
+    whatwg-url "^5.0.0"
+
+onetime@^5.1.2:
+  version "5.1.2"
+  resolved "https://registry.yarnpkg.com/onetime/-/onetime-5.1.2.tgz#d0e96ebb56b07476df1dd9c4806e5237985ca45e"
+  integrity sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==
+  dependencies:
+    mimic-fn "^2.1.0"
+
+openpgp@^5.11.1:
+  version "5.11.1"
+  resolved "https://registry.yarnpkg.com/openpgp/-/openpgp-5.11.1.tgz#97f3a1dfb3d3573a0a73fe2efb29e6b1f8fefb1c"
+  integrity sha512-TynUBPuaSI7dN0gP+A38CjNRLxkOkkptefNanalDQ71BFAKKm+dLbksymSW5bUrB7RcAneMySL/Y+r/TbLpOnQ==
+  dependencies:
+    asn1.js "^5.0.0"
+
+p-limit@^2.0.0:
+  version "2.3.0"
+  resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-2.3.0.tgz#3dd33c647a214fdfffd835933eb086da0dc21db1"
+  integrity sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==
+  dependencies:
+    p-try "^2.0.0"
+
+p-locate@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/p-locate/-/p-locate-3.0.0.tgz#322d69a05c0264b25997d9f40cd8a891ab0064a4"
+  integrity sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==
+  dependencies:
+    p-limit "^2.0.0"
+
+p-try@^2.0.0:
+  version "2.2.0"
+  resolved "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz#cb2868540e313d61de58fafbe35ce9004d5540e6"
+  integrity sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==
+
+path-exists@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/path-exists/-/path-exists-3.0.0.tgz#ce0ebeaa5f78cb18925ea7d810d7b59b010fd515"
+  integrity sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==
+
+pkg-up@^3.1.0:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/pkg-up/-/pkg-up-3.1.0.tgz#100ec235cc150e4fd42519412596a28512a0def5"
+  integrity sha512-nDywThFk1i4BQK4twPQ6TA4RT8bDY96yeuCVBWL3ePARCiEKDRSrNGbFIgUJpLp+XeIR65v8ra7WuJOFUBtkMA==
+  dependencies:
+    find-up "^3.0.0"
+
+punycode@^2.1.0, punycode@^2.3.1:
+  version "2.3.1"
+  resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5"
+  integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==
+
+queue@6.0.2:
+  version "6.0.2"
+  resolved "https://registry.yarnpkg.com/queue/-/queue-6.0.2.tgz#b91525283e2315c7553d2efa18d83e76432fed65"
+  integrity sha512-iHZWu+q3IdFZFX36ro/lKBkSvfkztY5Y7HMiPlOUjhupPcG2JMfst2KKEpu5XndviX/3UhFbRngUPNKtgvtZiA==
+  dependencies:
+    inherits "~2.0.3"
+
+"register-scheme@github:devsnek/node-register-scheme":
+  version "0.0.2"
+  resolved "https://codeload.github.com/devsnek/node-register-scheme/tar.gz/e7cc9a63a1f512565da44cb57316d9fb10750e17"
+  dependencies:
+    bindings "^1.3.0"
+    node-addon-api "^1.3.0"
+
+require-from-string@^2.0.2:
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/require-from-string/-/require-from-string-2.0.2.tgz#89a7fdd938261267318eafe14f9c32e598c36909"
+  integrity sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==
+
+safer-buffer@^2.1.0:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
+  integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
+
+semver@^7.3.5:
+  version "7.6.0"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.6.0.tgz#1a46a4db4bffcccd97b743b5005c8325f23d4e2d"
+  integrity sha512-EnwXhrlwXMk9gKu5/flx5sv/an57AkRplG3hTK68W7FRDN+k+OWBj65M7719OkA82XLBxrcX0KSHj+X5COhOVg==
+  dependencies:
+    lru-cache "^6.0.0"
+
+systeminformation@^5.22.0:
+  version "5.22.7"
+  resolved "https://registry.yarnpkg.com/systeminformation/-/systeminformation-5.22.7.tgz#9a20810c7eacad4aebe7591cb7c78c0dd96dbd1a"
+  integrity sha512-AWxlP05KeHbpGdgvZkcudJpsmChc2Y5Eo/GvxG/iUA/Aws5LZKHAMSeAo+V+nD+nxWZaxrwpWcnx4SH3oxNL3A==
+
+tr46@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/tr46/-/tr46-5.0.0.tgz#3b46d583613ec7283020d79019f1335723801cec"
+  integrity sha512-tk2G5R2KRwBd+ZN0zaEXpmzdKyOYksXwywulIX95MBODjSzMIuQnQ3m8JxgbhnL1LeVo7lqQKsYa1O3Htl7K5g==
+  dependencies:
+    punycode "^2.3.1"
+
+tr46@~0.0.3:
+  version "0.0.3"
+  resolved "https://registry.yarnpkg.com/tr46/-/tr46-0.0.3.tgz#8184fd347dac9cdc185992f3a6622e14b9d9ab6a"
+  integrity sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==
+
+type-fest@^2.17.0:
+  version "2.19.0"
+  resolved "https://registry.yarnpkg.com/type-fest/-/type-fest-2.19.0.tgz#88068015bb33036a598b952e55e9311a60fd3a9b"
+  integrity sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA==
+
+uri-js@^4.2.2:
+  version "4.4.1"
+  resolved "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.1.tgz#9b1a52595225859e55f669d928f88c6c57f2a77e"
+  integrity sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==
+  dependencies:
+    punycode "^2.1.0"
+
+webidl-conversions@^3.0.0:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/webidl-conversions/-/webidl-conversions-3.0.1.tgz#24534275e2a7bc6be7bc86611cc16ae0a5654871"
+  integrity sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==
+
+webidl-conversions@^7.0.0:
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/webidl-conversions/-/webidl-conversions-7.0.0.tgz#256b4e1882be7debbf01d05f0aa2039778ea080a"
+  integrity sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==
+
+whatwg-url@^14.0.0:
+  version "14.0.0"
+  resolved "https://registry.yarnpkg.com/whatwg-url/-/whatwg-url-14.0.0.tgz#00baaa7fd198744910c4b1ef68378f2200e4ceb6"
+  integrity sha512-1lfMEm2IEr7RIV+f4lUNPOqfFL+pO+Xw3fJSqmjX9AbXcXcYOkCe1P6+9VBZB6n94af16NfZf+sSk0JCBZC9aw==
+  dependencies:
+    tr46 "^5.0.0"
+    webidl-conversions "^7.0.0"
+
+whatwg-url@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/whatwg-url/-/whatwg-url-5.0.0.tgz#966454e8765462e37644d3626f6742ce8b70965d"
+  integrity sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==
+  dependencies:
+    tr46 "~0.0.3"
+    webidl-conversions "^3.0.0"
+
+ws@^7.3.1:
+  version "7.5.9"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.9.tgz#54fa7db29f4c7cec68b1ddd3a89de099942bb591"
+  integrity sha512-F+P9Jil7UiSKSkppIiD94dN07AwvFixvLIj1Og1Rl9GGMuNipJnV9JzjD6XuqmAeiswGvUmNLjr5cFuXwNS77Q==
+
+xmldom@^0.6.0:
+  version "0.6.0"
+  resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.6.0.tgz#43a96ecb8beece991cef382c08397d82d4d0c46f"
+  integrity sha512-iAcin401y58LckRZ0TkI4k0VSM1Qg0KGSc3i8rU+xrxe19A/BN1zHyVSJY7uoutVlaTSzYyk/v5AmkewAP7jtg==
+
+yallist@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72"
+  integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==
diff --git a/pkgs/by-name/tk/tkey-ssh-agent/package.nix b/pkgs/by-name/tk/tkey-ssh-agent/package.nix
new file mode 100644
index 0000000000000..3a38389ae4a9d
--- /dev/null
+++ b/pkgs/by-name/tk/tkey-ssh-agent/package.nix
@@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "tkey-ssh-agent";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "tillitis";
+    repo = "tkey-ssh-agent";
+    rev = "v${version}";
+    sha256 = "sha256-Uf3VJJfZn4UYX1q79JdaOfrore+L/Mic3whzpP32JV0=";
+  };
+
+  vendorHash = "sha256-SFyp1UB6+m7/YllRyY56SwweJ3X175bChXQYiG2M7zM=";
+
+  subPackages = [
+    "cmd/tkey-ssh-agent"
+  ];
+
+  meta = with lib; {
+    description = "SSH Agent for TKey, the flexible open hardware/software USB security key";
+    homepage    = "https://tillitis.se/app/tkey-ssh-agent/";
+    license     = licenses.gpl2;
+    maintainers = with maintainers; [ bbigras ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/to/tootik/package.nix b/pkgs/by-name/to/tootik/package.nix
index 9e7a2c801cf55..51d890f5c731a 100644
--- a/pkgs/by-name/to/tootik/package.nix
+++ b/pkgs/by-name/to/tootik/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tootik";
-  version = "0.10.0";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "dimkr";
     repo = "tootik";
     rev = version;
-    hash = "sha256-5rv+hkIBRu5uIUYsy7drJvcAHwL9tY8qD/dTj1mbarQ=";
+    hash = "sha256-roB1mrhq9LQcdi7ynPzI9UmeawSw9fX7jl3bb6+ygfM=";
   };
 
   vendorHash = "sha256-Lsc8nK4I1gZEW7RbEapHr3IJ6wTATLElX3XfNX1LwvM=";
diff --git a/pkgs/by-name/tr/tridactyl-native/lock.json b/pkgs/by-name/tr/tridactyl-native/lock.json
index ca4a960bee714..cf0816314a366 100644
--- a/pkgs/by-name/tr/tridactyl-native/lock.json
+++ b/pkgs/by-name/tr/tridactyl-native/lock.json
@@ -3,6 +3,18 @@
     {
       "method": "fetchzip",
       "packages": [
+        "regex"
+      ],
+      "path": "/nix/store/y6w1gzbf6i691z35rbn6kzrmf1n5bmdc-source",
+      "ref": "v0.25.0",
+      "rev": "cb8b7bfdcdc2272aadf92153c668acd3c901bd6b",
+      "sha256": "1ggp5rvs217dv2n0p5ddm5h17pv2mc7724n8cd0b393kmsjiykhz",
+      "srcDir": "src",
+      "url": "https://github.com/nitely/nim-regex/archive/cb8b7bfdcdc2272aadf92153c668acd3c901bd6b.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
         "tempfile"
       ],
       "path": "/nix/store/d0x874ngf02b8fk1xralnvmij7xh0kjc-source",
@@ -11,6 +23,18 @@
       "sha256": "10d1g09q6p554pwr6a3b6ajnwqbphz3a4cwkfa05jbviflfyzjyk",
       "srcDir": "",
       "url": "https://github.com/OpenSystemsLab/tempfile.nim/archive/26e0239441755e5edcfd170e9aa566bb9c9eb6f3.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "unicodedb"
+      ],
+      "path": "/nix/store/wpilzdf8vdwp7w129yrl821p9qvl3ky3-source",
+      "ref": "0.12.0",
+      "rev": "b055310c08db8f879057b4fec15c8301ee93bb2a",
+      "sha256": "0w77h75vrgp6jiq4dd9i2m4za2cf8qhjkz2wlxiz27yn2isjrndy",
+      "srcDir": "src",
+      "url": "https://github.com/nitely/nim-unicodedb/archive/b055310c08db8f879057b4fec15c8301ee93bb2a.tar.gz"
     }
   ]
 }
diff --git a/pkgs/by-name/tr/tridactyl-native/package.nix b/pkgs/by-name/tr/tridactyl-native/package.nix
index e8f9394c896d3..3506f82c0b799 100644
--- a/pkgs/by-name/tr/tridactyl-native/package.nix
+++ b/pkgs/by-name/tr/tridactyl-native/package.nix
@@ -1,14 +1,13 @@
 { lib, buildNimPackage, fetchFromGitHub }:
-
 buildNimPackage {
   pname = "tridactyl-native";
-  version = "0.3.7";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "tridactyl";
     repo = "native_messenger";
-    rev = "62f19dba573b924703829847feb1bfee68885514";
-    sha256 = "sha256-YGDVcfFcI9cRCCZ4BrO5xTuI9mrGq1lfbEITB7o3vQQ=";
+    rev = "3059abd9fb3f14d598f6c299335c3ebac5bc689a";
+    sha256 = "sha256-gicdpWAoimZMNGLc8w0vtJiFFxeqxB8P4lgWDun7unM=";
   };
 
   lockFile = ./lock.json;
@@ -26,6 +25,6 @@ buildNimPackage {
     homepage = "https://github.com/tridactyl/native_messenger";
     license = licenses.bsd2;
     platforms = platforms.all;
-    maintainers = with maintainers; [ timokau dit7ya ];
+    maintainers = with maintainers; [ timokau dit7ya kiike ];
   };
 }
diff --git a/pkgs/by-name/ug/ugrep-indexer/package.nix b/pkgs/by-name/ug/ugrep-indexer/package.nix
index 07bd5edac2539..2dd2cde3a266e 100644
--- a/pkgs/by-name/ug/ugrep-indexer/package.nix
+++ b/pkgs/by-name/ug/ugrep-indexer/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ugrep-indexer";
-  version = "0.9.6";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = "ugrep-indexer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZXZF9ZSdfQ2gxi5JkDJCUzMbkTs9KLzZBsyYxR/v4tI=";
+    hash = "sha256-XKjCAYPBRQgId66LupTlODPh2ctzvk7rHWznkLd4C8c=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/uv/uv/Cargo.lock b/pkgs/by-name/uv/uv/Cargo.lock
index 35b14d51a7a14..2044212a42c25 100644
--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@@ -30,9 +30,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
@@ -123,15 +123,15 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.81"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
+checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
 
 [[package]]
 name = "arc-swap"
-version = "1.7.0"
+version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b3d0060af21e8d11a926981cc00c6c1541aa91dd64b9f881985c3da1094425f"
+checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
 
 [[package]]
 name = "arrayref"
@@ -187,9 +187,9 @@ dependencies = [
 
 [[package]]
 name = "async-channel"
-version = "2.2.0"
+version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f28243a43d821d11341ab73c80bed182dc015c514b951616cf79bd4af39af0c3"
+checksum = "136d4d23bcc79e27423727b36823d86233aad06dfea531837b038394d11e9928"
 dependencies = [
  "concurrent-queue",
  "event-listener",
@@ -200,46 +200,38 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.6"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a116f46a969224200a0a97f29cfd4c50e7534e4b4826bd23ea2c3c533039c82c"
+checksum = "07dbbf24db18d609b1462965249abdf49129ccad073ec257da372adc83259c60"
 dependencies = [
  "brotli",
+ "bzip2",
  "flate2",
  "futures-core",
  "futures-io",
  "memchr",
  "pin-project-lite",
  "tokio",
-]
-
-[[package]]
-name = "async-recursion"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fd55a5ba1179988837d24ab4c7cc8ed6efdeff578ede0416b4225a5fca35bd0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.52",
+ "zstd",
+ "zstd-safe",
 ]
 
 [[package]]
 name = "async-trait"
-version = "0.1.78"
+version = "0.1.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "461abc97219de0eaaf81fe3ef974a540158f3d079c2ab200f891f1a2ef201e85"
+checksum = "c6fa2087f2753a7da8cc1c0dbfcf89579dd57458e36769de5ac750b4671737ca"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
 name = "async_http_range_reader"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8eeab30c68da4dc2c51f3afc4327ab06fe0f3f028ca423f7ca398c7ed8c5e7"
+checksum = "8561e6613f8361df8bed11c0eef05b98384643bc81f6b753eec7c1d91f097509"
 dependencies = [
  "bisection",
  "futures",
@@ -257,8 +249,8 @@ dependencies = [
 
 [[package]]
 name = "async_zip"
-version = "0.0.16"
-source = "git+https://github.com/charliermarsh/rs-async-zip?rev=d76801da0943de985254fc6255c0e476b57c5836#d76801da0943de985254fc6255c0e476b57c5836"
+version = "0.0.17"
+source = "git+https://github.com/charliermarsh/rs-async-zip?rev=1dcb40cfe1bf5325a6fd4bfcf9894db40241f585#1dcb40cfe1bf5325a6fd4bfcf9894db40241f585"
 dependencies = [
  "async-compression",
  "crc32fast",
@@ -271,15 +263,15 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
 
 [[package]]
 name = "axoasset"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dce2f189800bafe8322ef3a4d361ee7373bfc2f8fe052afda404230166dc45f"
+checksum = "5e05853b0d9abfab8e7532cad0d07ec396dd95c1a81926b49ab3cfa121a9d8d6"
 dependencies = [
  "camino",
  "image",
@@ -304,13 +296,25 @@ dependencies = [
 ]
 
 [[package]]
+name = "axotag"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d888fac0b73e64cbdf36a743fc5a25af5ae955c357535cb420b389bf1e1a6c54"
+dependencies = [
+ "miette",
+ "semver",
+ "thiserror",
+]
+
+[[package]]
 name = "axoupdater"
-version = "0.3.3"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e18b628756d7e73bcd3b7330e5834a44f841b115e92bad8563c3dc616a64131"
+checksum = "04daf26062f90764242d0e144ad52d1952cb0d02ef7ce3ffbb9127b4f1340f36"
 dependencies = [
  "axoasset",
  "axoprocess",
+ "axotag",
  "camino",
  "homedir",
  "miette",
@@ -337,9 +341,9 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.69"
+version = "0.3.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
 dependencies = [
  "addr2line",
  "cc",
@@ -372,6 +376,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+
+[[package]]
 name = "bench"
 version = "0.0.0"
 dependencies = [
@@ -394,9 +404,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.2"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "bitvec"
@@ -421,9 +431,9 @@ dependencies = [
 
 [[package]]
 name = "brotli"
-version = "3.4.0"
+version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "516074a47ef4bce09577a3b379392300159ce5b1ba2e501ff1c819950066100f"
+checksum = "125740193d7fee5cc63ab9e16c2fdc4e07c74ba755cc53b327d6ea029e9fc569"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -432,9 +442,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "2.5.1"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f"
+checksum = "65622a320492e09b5e0ac436b14c54ff68199bac392d0e89a6832c4518eea525"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -453,9 +463,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.4"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "bytecheck"
@@ -481,9 +491,9 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.14.3"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2ef034f05691a48569bd920a96c81b9d91bbad1ab5ac7c4616c1f6ef36cb79f"
+checksum = "5d6d68c57235a3a081186990eca2867354726650f42f7516ca50c28d6281fd15"
 
 [[package]]
 name = "byteorder"
@@ -493,9 +503,30 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
+
+[[package]]
+name = "bzip2"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8"
+dependencies = [
+ "bzip2-sys",
+ "libc",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.11+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "736a955f3fa7875102d57c82b8cac37ec45224a07fd32d58f9f7a186b6cd4cdc"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
 
 [[package]]
 name = "cache-key"
@@ -526,9 +557,9 @@ dependencies = [
 
 [[package]]
 name = "cargo-util"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74862c3c6e53a1c1f8f0178f9d38ab41e49746cd3a7cafc239b3d0248fd4e342"
+checksum = "9f2d9a9a8d3e0b61b1110c49ab8f6ed7a76ce4f2b1d53ae48a83152d3d5e8f5b"
 dependencies = [
  "anyhow",
  "core-foundation",
@@ -555,9 +586,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.0.90"
+version = "1.0.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cd6604a82acf3039f1144f54b8eb34e91ffba622051189e71b781822d5ee1f5"
+checksum = "2678b2e3449475e95b0aa6f9b506a28e61b3dc8996592b983695e8ebb58a8b41"
 dependencies = [
  "jobserver",
  "libc",
@@ -587,9 +618,9 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.35"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eaf5903dcbc0a39312feb77df2ff4c76387d591b9fc7b04a238dcf8bb62639a"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -629,9 +660,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.3"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "949626d00e063efc93b6dca932419ceb5432f99769911c0b995f7e884c778813"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -647,13 +678,14 @@ dependencies = [
  "anstyle",
  "clap_lex",
  "strsim",
+ "terminal_size",
 ]
 
 [[package]]
 name = "clap_complete"
-version = "4.5.1"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "885e4d7d5af40bfb99ae6f9433e292feac98d452dcb3ec3d25dfe7552b77da8c"
+checksum = "dd79504325bf38b10165b02e89b4347300f855f273c4cb30c4a3209e6583275e"
 dependencies = [
  "clap",
 ]
@@ -692,14 +724,14 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.3"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90239a040c80f5e14809ca132ddc4176ab33d5e17e49691793296e3fcb34d72f"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -952,6 +984,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "diff"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
+
+[[package]]
 name = "difflib"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1019,6 +1057,7 @@ dependencies = [
  "pypi-types",
  "rkyv",
  "rustc-hash",
+ "schemars",
  "serde",
  "serde_json",
  "thiserror",
@@ -1043,10 +1082,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56ce8c6da7551ec6c462cbaf3bfbc75131ebbfa1c944aeaa9dab51ca1c5f0c3b"
 
 [[package]]
+name = "dyn-clone"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
+
+[[package]]
 name = "either"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "encode_unicode"
@@ -1056,9 +1101,9 @@ checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
 dependencies = [
  "cfg-if",
 ]
@@ -1090,9 +1135,9 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.2.0"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b5fb89194fa3cad959b833185b3063ba881dbfc7030680b314250779fb4cc91"
+checksum = "6d9944b8ca13534cdfb2800775f8dd4902ff3fc75a50101466decadfdf322a24"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -1101,9 +1146,9 @@ dependencies = [
 
 [[package]]
 name = "event-listener-strategy"
-version = "0.5.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "feedafcaa9b749175d5ac357452a9d41ea2911da598fde46ce1fe02c37751291"
+checksum = "332f51cb23d20b0de8458b86580878211da09bcd4503cb579c225b3d124cabb3"
 dependencies = [
  "event-listener",
  "pin-project-lite",
@@ -1111,9 +1156,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
 
 [[package]]
 name = "fdeflate"
@@ -1274,9 +1319,9 @@ checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
 
 [[package]]
 name = "futures-lite"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "445ba825b27408685aaecefd65178908c36c6e96aaf6d8599419d46e624192ba"
+checksum = "52527eb5074e35e9339c6b4e8d12600c7128b68fb25dcb9fa9dec18f7c25f3a5"
 dependencies = [
  "fastrand",
  "futures-core",
@@ -1293,7 +1338,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1338,9 +1383,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -1367,11 +1412,11 @@ checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
 name = "git2"
-version = "0.18.2"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b3ba52851e73b46a4c3df1d89343741112003f0f6f13beb0dfac9e457c3fdcd"
+checksum = "232e6a7bfe35766bf715e55a88b39a700596c0ccfd88cd3680b4cdb40d66ef70"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "libc",
  "libgit2-sys",
  "log",
@@ -1396,7 +1441,7 @@ dependencies = [
  "bstr",
  "log",
  "regex-automata 0.4.6",
- "regex-syntax 0.8.2",
+ "regex-syntax 0.8.3",
 ]
 
 [[package]]
@@ -1405,42 +1450,23 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf760ebf69878d9fd8f110c89703d90ce35095324d1f1edcb595c63945ee757"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "ignore",
  "walkdir",
 ]
 
 [[package]]
 name = "h2"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
-name = "h2"
-version = "0.4.2"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31d030e59af851932b72ceebadf4a2b5986dba4c3b99dd2493f8273a0f151943"
+checksum = "816ec7294445779408f36fe57bc5b7fc1cf59664059096c65f905c1c61f58069"
 dependencies = [
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
  "futures-util",
- "http 1.1.0",
+ "http",
  "indexmap",
  "slab",
  "tokio",
@@ -1450,9 +1476,9 @@ dependencies = [
 
 [[package]]
 name = "half"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5eceaaeec696539ddaf7b333340f1af35a5aa87ae3e4f3ead0532f72affab2e"
+checksum = "6dd08c532ae367adf81c312a4580bc67f1d0fe8bc9c460520283f4c0ff277888"
 dependencies = [
  "cfg-if",
  "crunchy",
@@ -1540,17 +1566,6 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
-[[package]]
-name = "http"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
@@ -1562,23 +1577,12 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
-dependencies = [
- "bytes",
- "http 0.2.12",
- "pin-project-lite",
-]
-
-[[package]]
-name = "http-body"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
 dependencies = [
  "bytes",
- "http 1.1.0",
+ "http",
 ]
 
 [[package]]
@@ -1589,8 +1593,8 @@ checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.1.0",
- "http-body 1.0.0",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -1614,40 +1618,16 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "0.14.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2 0.3.24",
- "http 0.2.12",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
-[[package]]
-name = "hyper"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
+checksum = "9f24ce812868d86d19daa79bf3bf9175bc44ea323391147a5e3abde2a283871b"
 dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "h2 0.4.2",
- "http 1.1.0",
- "http-body 1.0.0",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
  "httpdate",
  "itoa",
@@ -1659,16 +1639,19 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.24.2"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
- "http 0.2.12",
- "hyper 0.14.28",
+ "http",
+ "hyper",
+ "hyper-util",
  "rustls",
+ "rustls-pki-types",
  "tokio",
  "tokio-rustls",
+ "tower-service",
 ]
 
 [[package]]
@@ -1678,13 +1661,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
 dependencies = [
  "bytes",
+ "futures-channel",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.0",
- "hyper 1.2.0",
+ "http",
+ "http-body",
+ "hyper",
  "pin-project-lite",
  "socket2",
  "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -1756,9 +1743,9 @@ checksum = "b72ad49b554c1728b1e83254a1b1565aea4161e28dabbfa171fc15fe62299caf"
 
 [[package]]
 name = "indexmap"
-version = "2.2.5"
+version = "2.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b0b929d511467233429c45a44ac1dcaa21ba0f5ba11e4879e6ed28ddb4f9df4"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
  "hashbrown 0.14.3",
@@ -1781,23 +1768,24 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.4"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "insta"
-version = "1.36.1"
+version = "1.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a7c22c4d34ef4788c351e971c52bfdfe7ea2766f8c5466bc175dd46e52ac22e"
+checksum = "3eab73f58e59ca6526037208f0e98851159ec1633cf17b6cd2e1f2c3fd5d53cc"
 dependencies = [
  "console",
  "lazy_static",
  "linked-hash-map",
+ "pest",
+ "pest_derive",
  "regex",
  "serde",
  "similar",
- "yaml-rust",
 ]
 
 [[package]]
@@ -1821,6 +1809,7 @@ dependencies = [
  "reflink-copy",
  "regex",
  "rustc-hash",
+ "schemars",
  "serde",
  "serde_json",
  "sha2",
@@ -1888,9 +1877,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "jobserver"
@@ -1982,13 +1971,12 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.0.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
+checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "libc",
- "redox_syscall 0.4.1",
 ]
 
 [[package]]
@@ -2017,9 +2005,9 @@ dependencies = [
 
 [[package]]
 name = "libz-sys"
-version = "1.1.15"
+version = "1.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037731f5d3aaa87a5675e895b63ddff1a87624bc29f77004ea829809654e48f6"
+checksum = "5e143b5e666b2695d28f6bca6497720813f699c9602dd7f5cac91008b8ada7f9"
 dependencies = [
  "cc",
  "libc",
@@ -2076,10 +2064,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
 name = "memchr"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memmap2"
@@ -2110,9 +2108,9 @@ dependencies = [
 
 [[package]]
 name = "memoffset"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
 dependencies = [
  "autocfg",
 ]
@@ -2145,7 +2143,7 @@ checksum = "dcf09caffaac8068c346b6df2a7fc27a177fd20b39421a39ce0a211bde679a6c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -2164,16 +2162,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
-name = "mime_guess"
-version = "2.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4192263c238a5f0d0c6bfd21f336a313a4ce1c450542449ca191bb657b4642ef"
-dependencies = [
- "mime",
- "unicase",
-]
-
-[[package]]
 name = "miniz_oxide"
 version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2231,7 +2219,7 @@ version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -2333,9 +2321,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.101"
+version = "0.9.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda2b0f344e78efc2facf7d195d098df0dd72151b26ab98da807afc26c198dff"
+checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
 dependencies = [
  "cc",
  "libc",
@@ -2351,16 +2339,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
 [[package]]
-name = "os_info"
-version = "3.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "006e42d5b888366f1880eda20371fedde764ed2213dc8496f49622fa0c99cd5e"
-dependencies = [
- "log",
- "winapi",
-]
-
-[[package]]
 name = "overload"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2433,6 +2411,24 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
 
 [[package]]
+name = "path-absolutize"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4af381fe79fa195b4909485d99f73a80792331df0625188e707854f0b3383f5"
+dependencies = [
+ "path-dedot",
+]
+
+[[package]]
+name = "path-dedot"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07ba0ad7e047712414213ff67533e6dd477af0a4e1d14fb52343e53d30ea9397"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
 name = "pathdiff"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2444,7 +2440,6 @@ version = "0.5.0"
 dependencies = [
  "indoc",
  "once_cell",
- "pubgrub",
  "pyo3",
  "rkyv",
  "serde",
@@ -2483,6 +2478,51 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
+name = "pest"
+version = "2.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f8023d0fb78c8e03784ea1c7f3fa36e68a723138990b8d5a47d916b651e7a8"
+dependencies = [
+ "memchr",
+ "thiserror",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0d24f72393fd16ab6ac5738bc33cdb6a9aa73f8b902e8fe29cf4e67d7dd1026"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc17e2a6c7d0a492f0158d7a4bd66cc17280308bbaff78d5bef566dca35ab80"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.58",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "934cd7631c050f4674352a6e835d5f6711ffbfb9345c2fc0107155ac495ae293"
+dependencies = [
+ "once_cell",
+ "pest",
+ "sha2",
+]
+
+[[package]]
 name = "petgraph"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2515,14 +2555,14 @@ checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pin-utils"
@@ -2538,9 +2578,9 @@ checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
 [[package]]
 name = "platform-info"
-version = "2.0.2"
+version = "2.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6259c4860e53bf665016f1b2f46a8859cadfa717581dc9d597ae4069de6300f"
+checksum = "d5ff316b9c4642feda973c18f0decd6c8b0919d4722566f6e4337cce0dd88217"
 dependencies = [
  "libc",
  "winapi",
@@ -2621,6 +2661,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "pretty_assertions"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af7cee1a6c8a5b9208b3cb1061f10c0cb689087b3d8ce85fb9d2dd7a29b6ba66"
+dependencies = [
+ "diff",
+ "yansi",
+]
+
+[[package]]
 name = "priority-queue"
 version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2663,7 +2713,7 @@ dependencies = [
 [[package]]
 name = "pubgrub"
 version = "0.2.1"
-source = "git+https://github.com/astral-sh/pubgrub?rev=e981e4dfe315582e84e2fd724832fb0e0c50b7aa#e981e4dfe315582e84e2fd724832fb0e0c50b7aa"
+source = "git+https://github.com/astral-sh/pubgrub?rev=c26e485213e39582c6f2e4d45c0328422670e7a7#c26e485213e39582c6f2e4d45c0328422670e7a7"
 dependencies = [
  "indexmap",
  "log",
@@ -2681,8 +2731,8 @@ dependencies = [
  "cfg-if",
  "indoc",
  "libc",
- "memoffset 0.9.0",
- "parking_lot 0.12.1",
+ "memoffset 0.9.1",
+ "parking_lot 0.11.2",
  "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
@@ -2730,7 +2780,7 @@ dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -2743,7 +2793,7 @@ dependencies = [
  "proc-macro2",
  "pyo3-build-config",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -2751,6 +2801,7 @@ name = "pypi-types"
 version = "0.0.1"
 dependencies = [
  "chrono",
+ "indexmap",
  "mailparse",
  "once_cell",
  "pep440_rs",
@@ -2759,29 +2810,17 @@ dependencies = [
  "rkyv",
  "serde",
  "thiserror",
+ "toml",
  "tracing",
  "url",
  "uv-normalize",
 ]
 
 [[package]]
-name = "pyproject-toml"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b80f889b6d413c3f8963a2c7db03f95dd6e1d85e1074137cb2013ea2faa8898"
-dependencies = [
- "indexmap",
- "pep440_rs",
- "pep508_rs",
- "serde",
- "toml",
-]
-
-[[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -2830,9 +2869,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4963ed1bc86e4f3ee217022bd855b297cef07fb9eac5dfa1f788b220b49b3bd"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
  "either",
  "rayon-core",
@@ -2883,9 +2922,9 @@ dependencies = [
 
 [[package]]
 name = "redox_users"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
+checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
 dependencies = [
  "getrandom",
  "libredox",
@@ -2905,14 +2944,14 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.10.3"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata 0.4.6",
- "regex-syntax 0.8.2",
+ "regex-syntax 0.8.3",
 ]
 
 [[package]]
@@ -2932,7 +2971,7 @@ checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.2",
+ "regex-syntax 0.8.3",
 ]
 
 [[package]]
@@ -2943,9 +2982,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "rend"
@@ -2962,7 +3001,6 @@ version = "0.0.1"
 dependencies = [
  "anyhow",
  "assert_fs",
- "async-recursion",
  "fs-err",
  "indoc",
  "insta",
@@ -2979,6 +3017,7 @@ dependencies = [
  "unscanny",
  "url",
  "uv-client",
+ "uv-configuration",
  "uv-fs",
  "uv-normalize",
  "uv-warnings",
@@ -2986,37 +3025,37 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.11.26"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bf93c4af7a8bb7d879d51cebe797356ff10ae8516ace542b5182d9dcac10b2"
+checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
  "async-compression",
- "base64 0.21.7",
+ "base64 0.22.0",
  "bytes",
- "encoding_rs",
+ "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.3.24",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.28",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
  "hyper-rustls",
+ "hyper-util",
  "ipnet",
  "js-sys",
  "log",
  "mime",
- "mime_guess",
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
  "rustls",
  "rustls-native-certs",
  "rustls-pemfile",
+ "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper",
- "system-configuration",
  "tokio",
  "tokio-rustls",
  "tokio-util",
@@ -3032,37 +3071,36 @@ dependencies = [
 
 [[package]]
 name = "reqwest-middleware"
-version = "0.2.5"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a735987236a8e238bf0296c7e351b999c188ccc11477f311b82b55c93984216"
+checksum = "0209efb52486ad88136190094ee214759ef7507068b27992256ed6610eb71a01"
 dependencies = [
  "anyhow",
  "async-trait",
- "http 0.2.12",
+ "http",
  "reqwest",
  "serde",
- "task-local-extensions",
  "thiserror",
+ "tower-service",
 ]
 
 [[package]]
 name = "reqwest-retry"
-version = "0.3.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9af20b65c2ee9746cc575acb6bd28a05ffc0d15e25c992a8f4462d8686aacb4f"
+checksum = "40f342894422862af74c50e1e9601cf0931accc9c6981e5eb413c46603b616b5"
 dependencies = [
  "anyhow",
  "async-trait",
  "chrono",
  "futures",
  "getrandom",
- "http 0.2.12",
- "hyper 0.14.28",
+ "http",
+ "hyper",
  "parking_lot 0.11.2",
  "reqwest",
  "reqwest-middleware",
  "retry-policies",
- "task-local-extensions",
  "tokio",
  "tracing",
  "wasm-timer",
@@ -3089,9 +3127,9 @@ dependencies = [
 
 [[package]]
 name = "retry-policies"
-version = "0.2.1"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17dd00bff1d737c40dbcd47d4375281bf4c17933f9eef0a185fc7bacca23ecbd"
+checksum = "493b4243e32d6eedd29f9a398896e35c6943a123b55eec97dcaee98310d25810"
 dependencies = [
  "anyhow",
  "chrono",
@@ -3224,11 +3262,11 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.38.31"
+version = "0.38.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -3237,44 +3275,55 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.21.10"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+checksum = "99008d7ad0bbbea527ec27bddbc0e432c5b87d8175178cee68d2eec9c4a1813c"
 dependencies = [
  "log",
  "ring",
+ "rustls-pki-types",
  "rustls-webpki",
- "sct",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.6.3"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+checksum = "8f1fb85efa936c42c6d5fc28d2629bb51e4b2f4b8a5211e297d599cc5a093792"
 dependencies = [
  "openssl-probe",
  "rustls-pemfile",
+ "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
 
 [[package]]
 name = "rustls-pemfile"
-version = "1.0.4"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.0",
+ "rustls-pki-types",
 ]
 
 [[package]]
+name = "rustls-pki-types"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecd36cc4259e3e4514335c4a138c6b43171a8d61d8f5c9348f9fc7529416f247"
+
+[[package]]
 name = "rustls-webpki"
-version = "0.101.7"
+version = "0.102.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
 dependencies = [
  "ring",
+ "rustls-pki-types",
  "untrusted",
 ]
 
@@ -3319,22 +3368,36 @@ dependencies = [
 ]
 
 [[package]]
-name = "scopeguard"
-version = "1.2.0"
+name = "schemars"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+checksum = "45a28f4c49489add4ce10783f7911893516f15afe45d015608d41faca6bc4d29"
+dependencies = [
+ "dyn-clone",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
 
 [[package]]
-name = "sct"
-version = "0.7.1"
+name = "schemars_derive"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+checksum = "c767fd6fa65d9ccf9cf026122c1b555f2ef9a4f0cea69da4d7dbc3e258d30967"
 dependencies = [
- "ring",
- "untrusted",
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 1.0.109",
 ]
 
 [[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
 name = "seahash"
 version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3342,9 +3405,9 @@ checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
 [[package]]
 name = "security-framework"
-version = "2.9.2"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
+checksum = "770452e37cad93e0a50d5abc3990d2bc351c36d0328f86cefec2f2fb206eaef6"
 dependencies = [
  "bitflags 1.3.2",
  "core-foundation",
@@ -3355,15 +3418,21 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.9.1"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
+checksum = "41f3cc463c0ef97e11c3461a9d3787412d30e8e7eb907c79180c4a57bf7c04ef"
 dependencies = [
  "core-foundation-sys",
  "libc",
 ]
 
 [[package]]
+name = "semver"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
+
+[[package]]
 name = "serde"
 version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3380,14 +3449,25 @@ checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85bf8229e7920a9f636479437026331ce11aa132b4dde37d121944a44d6e5f3c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.114"
+version = "1.0.115"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
+checksum = "12dc5c46daa8e9fdf4f5e71b6cf9a53f2487da0e86e55808e2d35539666497dd"
 dependencies = [
  "itoa",
  "ryu",
@@ -3475,9 +3555,9 @@ checksum = "f27f6278552951f1f2b8cf9da965d10969b2efdea95a6ec47987ab46edfe263a"
 
 [[package]]
 name = "similar"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32fea41aca09ee824cc9724996433064c89f7777e60762749a4170a14abbfa21"
+checksum = "fa42c91313f1d05da9b26f267f931cf178d4aba455b4c4622dd7355eb80c6640"
 
 [[package]]
 name = "simplecss"
@@ -3505,9 +3585,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "smawk"
@@ -3542,9 +3622,9 @@ dependencies = [
 
 [[package]]
 name = "strsim"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "subtle"
@@ -3622,9 +3702,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.52"
+version = "2.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b699d15b36d1f02c3e7c69f8ffef53de37aefae075d8488d4ba1a7788d574a07"
+checksum = "44cfb93f38070beee36b3fef7d4f5a16f27751d94b187b666a5cc5e9b0d30687"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3648,27 +3728,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "system-configuration"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
 name = "tagu"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3687,19 +3746,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
 
 [[package]]
-name = "task-local-extensions"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba323866e5d033818e3240feeb9f7db2c4296674e4d9e16b97b7bf8f490434e8"
-dependencies = [
- "pin-utils",
-]
-
-[[package]]
 name = "temp-dir"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd16aa9ffe15fe021c6ee3766772132c6e98dfa395a167e16864f61a9cfb71d6"
+checksum = "1f227968ec00f0e5322f9b8173c7a0cbcff6181a0a5b28e9892491c286277231"
 
 [[package]]
 name = "tempfile"
@@ -3747,7 +3797,7 @@ dependencies = [
  "cfg-if",
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3758,11 +3808,32 @@ checksum = "5c89e72a01ed4c579669add59014b9a524d609c0c88c6a585ce37485879f6ffb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
  "test-case-core",
 ]
 
 [[package]]
+name = "test-log"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b319995299c65d522680decf80f2c108d85b861d81dfe340a10d16cee29d9e6"
+dependencies = [
+ "test-log-macros",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "test-log-macros"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8f546451eaa38373f549093fe9fd05e7d2bade739e2ddf834b9968621d60107"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.58",
+]
+
+[[package]]
 name = "testing_logger"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3799,7 +3870,7 @@ checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3890,9 +3961,9 @@ checksum = "b130bd8a58c163224b44e217b4239ca7b927d82bf6cc2fea1fc561d15056e3f7"
 
 [[package]]
 name = "tokio"
-version = "1.36.0"
+version = "1.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
 dependencies = [
  "backtrace",
  "bytes",
@@ -3915,24 +3986,25 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.24.1"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
 dependencies = [
  "rustls",
+ "rustls-pki-types",
  "tokio",
 ]
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.14"
+version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
+checksum = "267ac89e0bec6e691e5813911606935d77c476ff49024f98abcea3e7b15e37af"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -3993,9 +4065,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.22.8"
+version = "0.22.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c12219811e0c1ba077867254e5ad62ee2c9c190b0d957110750ac0cda1ae96cd"
+checksum = "8e40bb779c5187258fd7aad0eb68cb8706a0a81fa712fbea808ab43c4b8374c4"
 dependencies = [
  "indexmap",
  "serde",
@@ -4005,6 +4077,28 @@ dependencies = [
 ]
 
 [[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project",
+ "pin-project-lite",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+
+[[package]]
 name = "tower-service"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4030,7 +4124,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -4146,13 +4240,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
-name = "unicase"
-version = "2.7.0"
+name = "ucd-trie"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7d2d4dafb69621809a81864c9c1b864479e1235c0dd4e199924b9742439ed89"
-dependencies = [
- "version_check",
-]
+checksum = "ed646292ffc8188ef8ea4d1e0e0150fb15a5c2e12ad9b8fc191ae7a8a7f3c4b9"
 
 [[package]]
 name = "unicode-bidi"
@@ -4306,14 +4397,14 @@ checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
 
 [[package]]
 name = "uv"
-version = "0.1.24"
+version = "0.1.35"
 dependencies = [
  "anstream",
  "anyhow",
  "assert_cmd",
  "assert_fs",
  "axoupdater",
- "base64 0.21.7",
+ "base64 0.22.0",
  "byteorder",
  "chrono",
  "clap",
@@ -4337,6 +4428,7 @@ dependencies = [
  "regex",
  "requirements-txt",
  "reqwest",
+ "rustc-hash",
  "serde",
  "serde_json",
  "tempfile",
@@ -4353,6 +4445,7 @@ dependencies = [
  "uv-auth",
  "uv-cache",
  "uv-client",
+ "uv-configuration",
  "uv-dispatch",
  "uv-distribution",
  "uv-fs",
@@ -4361,9 +4454,11 @@ dependencies = [
  "uv-normalize",
  "uv-requirements",
  "uv-resolver",
- "uv-traits",
+ "uv-toolchain",
+ "uv-types",
  "uv-virtualenv",
  "uv-warnings",
+ "uv-workspace",
 ]
 
 [[package]]
@@ -4371,14 +4466,17 @@ name = "uv-auth"
 version = "0.0.1"
 dependencies = [
  "async-trait",
- "base64 0.21.7",
- "clap",
+ "base64 0.22.0",
+ "http",
+ "insta",
  "once_cell",
  "reqwest",
  "reqwest-middleware",
  "rust-netrc",
- "task-local-extensions",
+ "schemars",
+ "serde",
  "tempfile",
+ "test-log",
  "thiserror",
  "tokio",
  "tracing",
@@ -4409,9 +4507,10 @@ dependencies = [
  "tokio",
  "toml",
  "tracing",
+ "uv-configuration",
  "uv-fs",
  "uv-interpreter",
- "uv-traits",
+ "uv-types",
  "uv-virtualenv",
 ]
 
@@ -4453,11 +4552,12 @@ dependencies = [
  "fs-err",
  "futures",
  "html-escape",
- "http 0.2.12",
- "hyper 0.14.28",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
  "insta",
  "install-wheel-rs",
- "os_info",
  "pep440_rs",
  "pep508_rs",
  "platform-tags",
@@ -4467,13 +4567,9 @@ dependencies = [
  "reqwest-retry",
  "rkyv",
  "rmp-serde",
- "rustc-hash",
- "rustls",
- "rustls-native-certs",
  "serde",
  "serde_json",
  "sys-info",
- "task-local-extensions",
  "tempfile",
  "thiserror",
  "tl",
@@ -4484,11 +4580,29 @@ dependencies = [
  "urlencoding",
  "uv-auth",
  "uv-cache",
+ "uv-configuration",
  "uv-fs",
  "uv-normalize",
  "uv-version",
  "uv-warnings",
- "webpki-roots",
+]
+
+[[package]]
+name = "uv-configuration"
+version = "0.0.1"
+dependencies = [
+ "anyhow",
+ "clap",
+ "itertools 0.12.1",
+ "pep508_rs",
+ "platform-tags",
+ "rustc-hash",
+ "schemars",
+ "serde",
+ "serde_json",
+ "uv-auth",
+ "uv-cache",
+ "uv-normalize",
 ]
 
 [[package]]
@@ -4511,10 +4625,11 @@ dependencies = [
  "pep440_rs",
  "pep508_rs",
  "petgraph",
- "platform-tags",
  "poloto",
+ "pretty_assertions",
  "resvg",
  "rustc-hash",
+ "schemars",
  "serde",
  "serde_json",
  "tagu",
@@ -4527,13 +4642,16 @@ dependencies = [
  "uv-build",
  "uv-cache",
  "uv-client",
+ "uv-configuration",
  "uv-dispatch",
- "uv-distribution",
+ "uv-fs",
  "uv-installer",
  "uv-interpreter",
  "uv-normalize",
  "uv-resolver",
- "uv-traits",
+ "uv-toolchain",
+ "uv-types",
+ "uv-workspace",
  "walkdir",
 ]
 
@@ -4544,6 +4662,7 @@ dependencies = [
  "anyhow",
  "distribution-types",
  "futures",
+ "install-wheel-rs",
  "itertools 0.12.1",
  "pep508_rs",
  "rustc-hash",
@@ -4551,10 +4670,11 @@ dependencies = [
  "uv-build",
  "uv-cache",
  "uv-client",
+ "uv-configuration",
  "uv-installer",
  "uv-interpreter",
  "uv-resolver",
- "uv-traits",
+ "uv-types",
 ]
 
 [[package]]
@@ -4568,7 +4688,9 @@ dependencies = [
  "fs-err",
  "futures",
  "install-wheel-rs",
+ "md-5",
  "nanoid",
+ "once_cell",
  "pep440_rs",
  "pep508_rs",
  "platform-tags",
@@ -4578,6 +4700,7 @@ dependencies = [
  "rmp-serde",
  "rustc-hash",
  "serde",
+ "sha2",
  "tempfile",
  "thiserror",
  "tokio",
@@ -4586,11 +4709,12 @@ dependencies = [
  "url",
  "uv-cache",
  "uv-client",
+ "uv-configuration",
  "uv-extract",
  "uv-fs",
  "uv-git",
  "uv-normalize",
- "uv-traits",
+ "uv-types",
  "zip",
 ]
 
@@ -4602,8 +4726,11 @@ dependencies = [
  "async_zip",
  "fs-err",
  "futures",
+ "md-5",
+ "pypi-types",
  "rayon",
  "rustc-hash",
+ "sha2",
  "thiserror",
  "tokio",
  "tokio-tar",
@@ -4623,6 +4750,7 @@ dependencies = [
  "fs2",
  "junction",
  "once_cell",
+ "path-absolutize",
  "tempfile",
  "tokio",
  "tracing",
@@ -4635,7 +4763,7 @@ name = "uv-git"
 version = "0.0.1"
 dependencies = [
  "anyhow",
- "base64 0.21.7",
+ "base64 0.22.0",
  "cache-key",
  "cargo-util",
  "fs-err",
@@ -4666,9 +4794,9 @@ dependencies = [
  "pep508_rs",
  "platform-tags",
  "pypi-types",
- "pyproject-toml",
  "rayon",
  "requirements-txt",
+ "rmp-serde",
  "rustc-hash",
  "serde",
  "tempfile",
@@ -4679,12 +4807,13 @@ dependencies = [
  "url",
  "uv-cache",
  "uv-client",
+ "uv-configuration",
  "uv-distribution",
  "uv-extract",
  "uv-fs",
  "uv-interpreter",
  "uv-normalize",
- "uv-traits",
+ "uv-types",
  "uv-warnings",
  "walkdir",
 ]
@@ -4716,6 +4845,7 @@ dependencies = [
  "tracing",
  "uv-cache",
  "uv-fs",
+ "uv-toolchain",
  "which",
  "winapi",
 ]
@@ -4725,6 +4855,7 @@ name = "uv-normalize"
 version = "0.0.1"
 dependencies = [
  "rkyv",
+ "schemars",
  "serde",
 ]
 
@@ -4733,6 +4864,7 @@ name = "uv-requirements"
 version = "0.1.0"
 dependencies = [
  "anyhow",
+ "cache-key",
  "configparser",
  "console",
  "ctrlc",
@@ -4743,18 +4875,20 @@ dependencies = [
  "indexmap",
  "pep508_rs",
  "pypi-types",
- "pyproject-toml",
  "requirements-txt",
  "rustc-hash",
  "serde",
+ "thiserror",
  "toml",
  "tracing",
+ "url",
  "uv-client",
+ "uv-configuration",
  "uv-distribution",
  "uv-fs",
  "uv-normalize",
  "uv-resolver",
- "uv-traits",
+ "uv-types",
  "uv-warnings",
 ]
 
@@ -4775,6 +4909,7 @@ dependencies = [
  "futures",
  "indexmap",
  "insta",
+ "install-wheel-rs",
  "itertools 0.12.1",
  "once-map",
  "once_cell",
@@ -4788,6 +4923,9 @@ dependencies = [
  "requirements-txt",
  "rkyv",
  "rustc-hash",
+ "schemars",
+ "serde",
+ "textwrap",
  "thiserror",
  "tokio",
  "tokio-stream",
@@ -4795,31 +4933,65 @@ dependencies = [
  "url",
  "uv-cache",
  "uv-client",
+ "uv-configuration",
  "uv-distribution",
  "uv-interpreter",
  "uv-normalize",
- "uv-traits",
+ "uv-types",
  "uv-warnings",
 ]
 
 [[package]]
-name = "uv-traits"
+name = "uv-toolchain"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "fs-err",
+ "futures",
+ "once_cell",
+ "pep440_rs",
+ "pep508_rs",
+ "reqwest",
+ "reqwest-middleware",
+ "schemars",
+ "serde",
+ "tempfile",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "url",
+ "uv-client",
+ "uv-extract",
+ "uv-fs",
+]
+
+[[package]]
+name = "uv-types"
 version = "0.0.1"
 dependencies = [
  "anyhow",
+ "clap",
  "distribution-types",
+ "itertools 0.12.1",
  "once-map",
+ "pep440_rs",
  "pep508_rs",
+ "pypi-types",
+ "rustc-hash",
  "serde",
  "serde_json",
+ "thiserror",
+ "url",
  "uv-cache",
+ "uv-configuration",
  "uv-interpreter",
  "uv-normalize",
 ]
 
 [[package]]
 name = "uv-version"
-version = "0.1.24"
+version = "0.1.35"
 
 [[package]]
 name = "uv-virtualenv"
@@ -4852,6 +5024,29 @@ dependencies = [
 ]
 
 [[package]]
+name = "uv-workspace"
+version = "0.0.1"
+dependencies = [
+ "dirs-sys",
+ "distribution-types",
+ "fs-err",
+ "install-wheel-rs",
+ "pep508_rs",
+ "schemars",
+ "serde",
+ "thiserror",
+ "toml",
+ "tracing",
+ "uv-auth",
+ "uv-configuration",
+ "uv-fs",
+ "uv-normalize",
+ "uv-resolver",
+ "uv-toolchain",
+ "uv-warnings",
+]
+
+[[package]]
 name = "valuable"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4957,7 +5152,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
  "wasm-bindgen-shared",
 ]
 
@@ -4991,7 +5186,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -5042,9 +5237,12 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "0.25.4"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+checksum = "b3de34ae270483955a94f4b21bdaaeb83d508bb84a01435f393818edb0012009"
+dependencies = [
+ "rustls-pki-types",
+]
 
 [[package]]
 name = "weezl"
@@ -5054,22 +5252,21 @@ checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"
 
 [[package]]
 name = "which"
-version = "6.0.0"
+version = "6.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fa5e0c10bf77f44aac573e498d1a82d5fbd5e91f6fc0a99e7be4b38e85e101c"
+checksum = "8211e4f58a2b2805adfbefbc07bab82958fc91e3836339b1ab7ae32465dce0d7"
 dependencies = [
  "either",
  "home",
- "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "winsafe",
 ]
 
 [[package]]
 name = "widestring"
-version = "1.0.2"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
+checksum = "7219d36b6eac893fa81e84ebe06485e7dcbb616177469b142df14f1f4deb1311"
 
 [[package]]
 name = "winapi"
@@ -5151,7 +5348,7 @@ checksum = "12168c33176773b86799be25e2a2ba07c7aab9968b37541f1094dbd7a60c8946"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -5162,7 +5359,7 @@ checksum = "9d8dc32e0095a7eeccebd0e3f09e9509365ecb3fc6ac4d6f5f14a3f6392942d1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -5317,15 +5514,21 @@ dependencies = [
 
 [[package]]
 name = "winreg"
-version = "0.50.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
 dependencies = [
  "cfg-if",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
+name = "winsafe"
+version = "0.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
+
+[[package]]
 name = "wiremock"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5336,9 +5539,9 @@ dependencies = [
  "base64 0.21.7",
  "deadpool",
  "futures",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.2.0",
+ "hyper",
  "hyper-util",
  "log",
  "once_cell",
@@ -5390,13 +5593,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
 
 [[package]]
-name = "yaml-rust"
-version = "0.4.5"
+name = "yansi"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
-dependencies = [
- "linked-hash-map",
-]
+checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
+
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
 
 [[package]]
 name = "zip"
@@ -5409,3 +5615,31 @@ dependencies = [
  "crossbeam-utils",
  "flate2",
 ]
+
+[[package]]
+name = "zstd"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d789b1514203a1120ad2429eae43a7bd32b90976a7bb8a05f7ec02fa88cc23a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cd99b45c6bc03a018c8b8a86025678c87e55526064e38f9df301989dce7ec0a"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.10+zstd.1.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c253a4914af5bafc8fa8c86ee400827e83cf6ec01195ec1f1ed8441bf00d65aa"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 025f5851ec1b9..f4aab33401c08 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -12,20 +12,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uv";
-  version = "0.1.24";
+  version = "0.1.35";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     rev = version;
-    hash = "sha256-XsBTfe2+J5CGdjYZjhgxiP20OA7+VTCvD9JniLOjhKs=";
+    hash = "sha256-GcAvpX7oanJ8G1dgTyTa8jk9xhTroF2G+ir8j7Yua1M=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "async_zip-0.0.16" = "sha256-M94ceTCtyQc1AtPXYrVGplShQhItqZZa/x5qLiL+gs0=";
-      "pubgrub-0.2.1" = "sha256-SdgxoJ37cs+XwWRCFX4uKhJ9Juu9R/jENb6tzUMam4k=";
+      "async_zip-0.0.17" = "sha256-Q5fMDJrQtob54CTII3+SXHeozy5S5s3iLOzntevdGOs=";
+      "pubgrub-0.2.1" = "sha256-sqC7R2mtqymYFULDW0wSbM/MKCZc8rP7Yy/gaQpjYEI=";
     };
   };
 
diff --git a/pkgs/by-name/ux/uxn/package.nix b/pkgs/by-name/ux/uxn/package.nix
index b006de83b3974..9180f1b3d9331 100644
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "unstable-2024-04-05";
+  version = "unstable-2024-04-15";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "41567558bc1ec4721fee1cc316c3a3cdc627b102";
-    hash = "sha256-Qvq9/kNZAKRHH3NIxiX5+67ibeX5QzK97EhuoplTBDQ=";
+    rev = "b0bfb38dccff4ff7b0fa6d384651f7847a76fd1f";
+    hash = "sha256-OLrIIrcIfFI96+Q2fc0JSqJHBMcoN9+LL5E/YCN21Kc=";
   };
 
   outputs = [ "out" "projects" ];
diff --git a/pkgs/by-name/va/vaults/package.nix b/pkgs/by-name/va/vaults/package.nix
new file mode 100644
index 0000000000000..e44c3b73efecf
--- /dev/null
+++ b/pkgs/by-name/va/vaults/package.nix
@@ -0,0 +1,85 @@
+{ fetchFromGitHub
+, lib
+, stdenv
+, appstream-glib
+, desktop-file-utils
+, meson
+, ninja
+, pkg-config
+, python3
+, rustPlatform
+, rustc
+, cargo
+, wrapGAppsHook
+, glib
+, gtk4
+, libadwaita
+, wayland
+, gocryptfs
+, cryfs
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "vaults";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "mpobaschnig";
+    repo = "Vaults";
+    rev = version;
+    hash = "sha256-jA7OeyRqc5DxkS4sMx9cIbVlZwd++aCQi09uBQik1oA=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-l9Zer6d6kgjIUNiQ1VdQQ57caVNWfzCkdsMf79X8Ar4=";
+  };
+
+  postPatch = ''
+    patchShebangs build-aux
+  '';
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : "${lib.makeBinPath [ gocryptfs cryfs ]}"
+    )
+  '';
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+    cargo
+    rustc
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    appstream-glib
+    gtk4
+    python3
+    glib
+    libadwaita
+    wayland
+    gocryptfs
+    cryfs
+  ];
+
+  meta = {
+    description = "GTK frontend for encrypted vaults supporting gocryptfs and CryFS for encryption";
+    homepage = "https://mpobaschnig.github.io/vaults/";
+    changelog = "https://github.com/mpobaschnig/vaults/releases/tag/${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ benneti ];
+    mainProgram = "vaults";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ve/vencord/package-lock.json b/pkgs/by-name/ve/vencord/package-lock.json
index 6c301b195570d..6f6e7e3fae823 100644
--- a/pkgs/by-name/ve/vencord/package-lock.json
+++ b/pkgs/by-name/ve/vencord/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "vencord",
-    "version": "1.7.4",
+    "version": "1.7.8",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "vencord",
-            "version": "1.7.4",
+            "version": "1.7.8",
             "license": "GPL-3.0-or-later",
             "dependencies": {
                 "@sapphi-red/web-noise-suppressor": "0.3.3",
@@ -236,9 +236,9 @@
             }
         },
         "node_modules/@csstools/selector-specificity": {
-            "version": "3.0.2",
-            "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-3.0.2.tgz",
-            "integrity": "sha512-RpHaZ1h9LE7aALeQXmXrJkRG84ZxIsctEN2biEUmFyKpzFM3zZ35eUMcIzZFsw/2olQE6v69+esEqU2f1MKycg==",
+            "version": "3.0.3",
+            "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-3.0.3.tgz",
+            "integrity": "sha512-KEPNw4+WW5AVEIyzC80rTbWEUatTW2lXpN8+8ILC8PiPeWPjwUzrPZDIOZ2wwqDmeqOYTdSGyL3+vE5GC3FB3Q==",
             "dev": true,
             "funding": [
                 {
@@ -693,9 +693,9 @@
             }
         },
         "node_modules/@humanwhocodes/object-schema": {
-            "version": "2.0.2",
-            "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.2.tgz",
-            "integrity": "sha512-6EwiSjwWYP7pTckG6I5eyFANjPhmPjUX9JRLUSfNPC7FX7zK9gyZAfUEaECL6ALTpGX5AjnBq3C9XmVWPitNpw==",
+            "version": "2.0.3",
+            "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.3.tgz",
+            "integrity": "sha512-93zYdMES/c1D69yZiKDBj0V24vqNzB/koF26KPaagAfd3P/4gUlh3Dys5ogAK+Exi9QyzlD8x/08Zt7wIKcDcA==",
             "dev": true
         },
         "node_modules/@nodelib/fs.scandir": {
@@ -824,9 +824,9 @@
             "dev": true
         },
         "node_modules/@types/node": {
-            "version": "18.19.28",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.28.tgz",
-            "integrity": "sha512-J5cOGD9n4x3YGgVuaND6khm5x07MMdAKkRyXnjVR6KFhLMNh2yONGiP7Z+4+tBOt5mK+GvDTiacTOVGGpqiecw==",
+            "version": "18.19.31",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.31.tgz",
+            "integrity": "sha512-ArgCD39YpyyrtFKIqMDvjz79jto5fcI/SVUs2HwB+f0dAzq68yqOdyaSivLiLugSziTpNXLQrVb7RZFmdZzbhA==",
             "dev": true,
             "dependencies": {
                 "undici-types": "~5.26.4"
@@ -845,9 +845,9 @@
             "dev": true
         },
         "node_modules/@types/react": {
-            "version": "18.2.73",
-            "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.73.tgz",
-            "integrity": "sha512-XcGdod0Jjv84HOC7N5ziY3x+qL0AfmubvKOZ9hJjJ2yd5EE+KYjWhdOjt387e9HPheHkdggF9atTifMRtyAaRA==",
+            "version": "18.2.79",
+            "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.79.tgz",
+            "integrity": "sha512-RwGAGXPl9kSXwdNTafkOEuFrTBD5SA2B3iEB96xi8+xu5ddUa/cpvyVCSNn+asgLCTHkb5ZxN8gbuibYJi4s1w==",
             "dev": true,
             "dependencies": {
                 "@types/prop-types": "*",
@@ -855,9 +855,9 @@
             }
         },
         "node_modules/@types/react-dom": {
-            "version": "18.2.23",
-            "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.2.23.tgz",
-            "integrity": "sha512-ZQ71wgGOTmDYpnav2knkjr3qXdAFu0vsk8Ci5w3pGAIdj7/kKAyn+VsQDhXsmzzzepAiI9leWMmubXz690AI/A==",
+            "version": "18.2.25",
+            "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.2.25.tgz",
+            "integrity": "sha512-o/V48vf4MQh7juIKZU2QGDfli6p1+OOi5oXx36Hffpc9adsHeXjVp8rHuPkjd8VT8sOJ2Zp05HR7CdpGTIUFUA==",
             "dev": true,
             "dependencies": {
                 "@types/react": "*"
@@ -5248,9 +5248,9 @@
             }
         },
         "node_modules/typescript": {
-            "version": "5.4.3",
-            "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.3.tgz",
-            "integrity": "sha512-KrPd3PKaCLr78MalgiwJnA25Nm8HAmdwN3mYUYZgG/wizIo9EainNVQI9/yDavtVFRN2h3k8uf3GLHuhDMgEHg==",
+            "version": "5.4.5",
+            "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",
+            "integrity": "sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==",
             "dev": true,
             "bin": {
                 "tsc": "bin/tsc",
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 5a227196cee7f..b445b00b90ab2 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -5,8 +5,8 @@
 , buildWebExtension ? false
 }:
 let
-  version = "1.7.4";
-  gitHash = "bdef47e";
+  version = "1.7.8";
+  gitHash = "97ce410";
 in
 buildNpmPackage rec {
   pname = "vencord";
@@ -16,7 +16,7 @@ buildNpmPackage rec {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${version}";
-    hash = "sha256-Ub8VzeTkka0oq0CYN/UHjOIH2y3F7Oy9QZpTi6glehI=";
+    hash = "sha256-5kMBUdFupVxmlQ7NVJ7qzFoyQieDGHrFNkrzhlhEzJ0=";
   };
 
   ESBUILD_BINARY_PATH = lib.getExe (esbuild.overrideAttrs (final: _: {
@@ -34,7 +34,7 @@ buildNpmPackage rec {
   npmRebuildFlags = [ "|| true" ];
 
   makeCacheWritable = true;
-  npmDepsHash = "sha256-/iUNvTk51aoh0TmDXgFG425I37xFuIddkrceF0pNBcE=";
+  npmDepsHash = "sha256-LdLPNM2yCUXh0PxAbzI2YNF6QoX1iG2TixMh6XdVuX0=";
   npmFlags = [ "--legacy-peer-deps" ];
   npmBuildScript = if buildWebExtension then "buildWeb" else "build";
   npmBuildFlags = [ "--" "--standalone" "--disable-updater" ];
diff --git a/pkgs/by-name/ve/vencord/update.sh b/pkgs/by-name/ve/vencord/update.sh
index 8ba180bb6fd77..b9eb69660427b 100755
--- a/pkgs/by-name/ve/vencord/update.sh
+++ b/pkgs/by-name/ve/vencord/update.sh
@@ -19,6 +19,6 @@ popd
 
 update-source-version vencord "${latestTag#v}"
 
-sed -E 's#\bgitHash = ".*?"#gitHash = "'"${gitHash:0:7}"'"#' -i "$pkgDir/default.nix"
-sed -E 's#\bnpmDepsHash = ".*?"#npmDepsHash = "'"$npmDepsHash"'"#' -i "$pkgDir/default.nix"
+sed -E 's#\bgitHash = ".*?"#gitHash = "'"${gitHash:0:7}"'"#' -i "$pkgDir/package.nix"
+sed -E 's#\bnpmDepsHash = ".*?"#npmDepsHash = "'"$npmDepsHash"'"#' -i "$pkgDir/package.nix"
 cp "$tempDir/package-lock.json" "$pkgDir/package-lock.json"
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index 17fb994f2ba47..980258ed863a4 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -8,15 +8,11 @@
 , copyDesktopItems
 , vencord
 , electron
-, pipewire
-, libpulseaudio
 , libicns
-, libnotify
 , jq
 , moreutils
 , cacert
 , nodePackages
-, speechd
 , withTTS ? true
   # Enables the use of vencord from nixpkgs instead of
   # letting vesktop manage it's own version
@@ -116,15 +112,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   # this is consistent with other nixpkgs electron packages and upstream, as far as I am aware
   installPhase =
-    let
-      # this is mainly required for venmic
-      libPath = lib.makeLibraryPath ([
-        libpulseaudio
-        libnotify
-        pipewire
-        stdenv.cc.cc.lib
-      ] ++ lib.optional withTTS speechd);
-    in
     ''
       runHook preInstall
 
@@ -139,7 +126,6 @@ stdenv.mkDerivation (finalAttrs: {
       done
 
       makeWrapper ${electron}/bin/electron $out/bin/vesktop \
-        --prefix LD_LIBRARY_PATH : ${libPath} \
         --add-flags $out/opt/Vesktop/resources/app.asar \
         ${lib.optionalString withTTS "--add-flags \"--enable-speech-dispatcher\""} \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
diff --git a/pkgs/by-name/vl/vlc-bittorrent/package.nix b/pkgs/by-name/vl/vlc-bittorrent/package.nix
index d87e30579c5a4..d4107d59cd3ab 100644
--- a/pkgs/by-name/vl/vlc-bittorrent/package.nix
+++ b/pkgs/by-name/vl/vlc-bittorrent/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vlc-bittorrent";
-  version = "2.15.0";
+  version = "2.15";
 
   src = fetchFromGitHub {
     owner = "johang";
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index d5c6c8d064750..f0d9321a1f2f6 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,10 +1,10 @@
 {
   "darwin": {
-    "hash": "sha256-tNNT8FqMvrjGFuyhizbyd2gAimbd5SLyCMVt6bFcbyQ=",
-    "version": "0.2024.04.02.08.02.stable_01"
+    "hash": "sha256-t8Qobl20YXY71vZVAIq6uJ+vnEeT3wFTmAy2dfthvIY=",
+    "version": "0.2024.04.16.08.02.stable_00"
   },
   "linux": {
-    "hash": "sha256-xnXRg23AdfCk2TKBr+PZ3wDYqTN4+8wLSodWpmh3D/Y=",
-    "version": "0.2024.04.02.08.02.stable_01"
+    "hash": "sha256-V1bG4Sx0cWv1+5mPnktQ3pPQm6Qwj0Ec6qDXmxGqB+8=",
+    "version": "0.2024.04.16.08.02.stable_00"
   }
 }
diff --git a/pkgs/by-name/wa/waycheck/package.nix b/pkgs/by-name/wa/waycheck/package.nix
index ddbd67e882200..4ac98f6a640f0 100644
--- a/pkgs/by-name/wa/waycheck/package.nix
+++ b/pkgs/by-name/wa/waycheck/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waycheck";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "serebit";
     repo = "waycheck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kwkdTMA15oJHz9AXEkBGeuzYdEUpNuv/xnhzoKOHCE4=";
+    hash = "sha256-sDfIR+F2W59mh50jXoOrcNZ1nuckm3r7jN613BH4Eog=";
   };
 
   nativeBuildInputs = [
@@ -38,13 +38,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontWrapGApps = true;
 
-  preFixup = ''
-    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  postPatch = ''
+    substituteInPlace scripts/mesonPostInstall.sh \
+      --replace-fail "#!/usr/bin/env sh" "#!${stdenv.shell}" \
+      --replace-fail "update-desktop-database -q" "update-desktop-database $out/share/applications"
   '';
 
-  preInstall = ''
-    substituteInPlace ../scripts/mesonPostInstall.sh \
-      --replace "update-desktop-database -q" "update-desktop-database $out/share/applications"
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
   meta = {
diff --git a/pkgs/by-name/we/wechat-uos/package.nix b/pkgs/by-name/we/wechat-uos/package.nix
index d151c022ed66b..7a8f806426ce0 100644
--- a/pkgs/by-name/we/wechat-uos/package.nix
+++ b/pkgs/by-name/we/wechat-uos/package.nix
@@ -229,6 +229,16 @@ buildFHSEnv {
   runScript = writeShellScript "wechat-uos-launcher" ''
     export QT_QPA_PLATFORM=xcb
     export LD_LIBRARY_PATH=${lib.makeLibraryPath wechat-uos-runtime}
+
+    if [[ ''${XMODIFIERS} =~ fcitx ]]; then
+      export QT_IM_MODULE=fcitx
+      export GTK_IM_MODULE=fcitx
+    elif [[ ''${XMODIFIERS} =~ ibus ]]; then
+      export QT_IM_MODULE=ibus
+      export GTK_IM_MODULE=ibus
+      export IBUS_USE_PORTAL=1
+    fi
+
     ${wechat.outPath}/opt/apps/com.tencent.wechat/files/wechat
   '';
   extraInstallCommands = ''
diff --git a/pkgs/by-name/wi/wiremock/package.nix b/pkgs/by-name/wi/wiremock/package.nix
index 577c2582df977..eba4083201be4 100644
--- a/pkgs/by-name/wi/wiremock/package.nix
+++ b/pkgs/by-name/wi/wiremock/package.nix
@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "wiremock";
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "mirror://maven/org/wiremock/wiremock-standalone/${finalAttrs.version}/wiremock-standalone-${finalAttrs.version}.jar";
-    hash = "sha256-27DIcfP5R1Qiwl2fhvUQjFsE8pTHTv5MuFqHGa+whVY=";
+    hash = "sha256-HIWhuaW36/kdsj8iZD0ANHQ26olURnYL1q5fcQXHHjw=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/wireproxy/default.nix b/pkgs/by-name/wi/wireproxy/package.nix
index 1c5eda9f1cd49..b244364c8c9bf 100644
--- a/pkgs/tools/networking/wireproxy/default.nix
+++ b/pkgs/by-name/wi/wireproxy/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "wireproxy";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "pufferffish";
     repo = "wireproxy";
     rev = "v${version}";
-    hash = "sha256-2gio+kyjIvaNjb/+M8M5YvbAPbQX+B9A/Qly2kyFZXw=";
+    hash = "sha256-VPIEgvUg0h80Cd611zXQ5mhamfJTQpaDK9kiUMy2G0A=";
   };
 
   ldflags = [
@@ -22,7 +22,7 @@ buildGoModule rec {
     "-X main.version=v${version}"
   ];
 
-  vendorHash = "sha256-u5/ppH+8mcR3AdPnA6vDFL4GwVzbUj679I4zBw80HU0=";
+  vendorHash = "sha256-DNTPzZSxcjkcv7RygTpOIgdYEQ8wBPkuJqfzZGt8ExI=";
 
   passthru.tests.version = testers.testVersion {
     package = wireproxy;
@@ -32,7 +32,7 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Wireguard client that exposes itself as a socks5 proxy";
-    homepage = "https://github.com/octeep/wireproxy";
+    homepage = "https://github.com/pufferffish/wireproxy";
     license = licenses.isc;
     maintainers = with maintainers; [ _3JlOy-PYCCKUi ];
     mainProgram = "wireproxy";
diff --git a/pkgs/by-name/xo/xonsh/unwrapped.nix b/pkgs/by-name/xo/xonsh/unwrapped.nix
index e5b55efbf344b..b0115dc247c41 100644
--- a/pkgs/by-name/xo/xonsh/unwrapped.nix
+++ b/pkgs/by-name/xo/xonsh/unwrapped.nix
@@ -90,6 +90,8 @@ python3.pkgs.buildPythonApplication {
     export HOME=$TMPDIR
   '';
 
+  dontWrapPythonPrograms = true;
+
   passthru = {
     shellPath = "/bin/xonsh";
     python = python3; # To the wrapper
diff --git a/pkgs/by-name/ze/zed-editor/Cargo.lock b/pkgs/by-name/ze/zed-editor/Cargo.lock
index 5e6ebe7f1758e..04d3e032fb15e 100644
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -166,6 +166,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "anes"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
+
+[[package]]
 name = "anstream"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1433,8 +1439,8 @@ dependencies = [
 
 [[package]]
 name = "blade-graphics"
-version = "0.3.0"
-source = "git+https://github.com/kvark/blade?rev=61cbd6b2c224791d52b150fe535cee665cc91bb2#61cbd6b2c224791d52b150fe535cee665cc91bb2"
+version = "0.4.0"
+source = "git+https://github.com/kvark/blade?rev=810ec594358aafea29a4a3d8ab601d25292b2ce4#810ec594358aafea29a4a3d8ab601d25292b2ce4"
 dependencies = [
  "ash",
  "ash-window",
@@ -1464,7 +1470,7 @@ dependencies = [
 [[package]]
 name = "blade-macros"
 version = "0.2.1"
-source = "git+https://github.com/kvark/blade?rev=61cbd6b2c224791d52b150fe535cee665cc91bb2#61cbd6b2c224791d52b150fe535cee665cc91bb2"
+source = "git+https://github.com/kvark/blade?rev=810ec594358aafea29a4a3d8ab601d25292b2ce4#810ec594358aafea29a4a3d8ab601d25292b2ce4"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1807,6 +1813,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "cast"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
+
+[[package]]
 name = "castaway"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1915,6 +1927,33 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cca491388666e04d7248af3f60f0c40cfb0991c72205595d7c396e3510207d1a"
 
 [[package]]
+name = "ciborium"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
+dependencies = [
+ "ciborium-io",
+ "ciborium-ll",
+ "serde",
+]
+
+[[package]]
+name = "ciborium-io"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
+
+[[package]]
+name = "ciborium-ll"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
+dependencies = [
+ "ciborium-io",
+ "half",
+]
+
+[[package]]
 name = "cipher"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2784,6 +2823,42 @@ dependencies = [
 ]
 
 [[package]]
+name = "criterion"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c76e09c1aae2bc52b3d2f29e13c6572553b30c4aa1b8a49fd70de6412654cb"
+dependencies = [
+ "anes",
+ "atty",
+ "cast",
+ "ciborium",
+ "clap 3.2.25",
+ "criterion-plot",
+ "itertools 0.10.5",
+ "lazy_static",
+ "num-traits",
+ "oorandom",
+ "plotters",
+ "rayon",
+ "regex",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "tinytemplate",
+ "walkdir",
+]
+
+[[package]]
+name = "criterion-plot"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
+dependencies = [
+ "cast",
+ "itertools 0.10.5",
+]
+
+[[package]]
 name = "crossbeam-channel"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2837,6 +2912,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "crunchy"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
+
+[[package]]
 name = "crypto-bigint"
 version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4295,6 +4376,7 @@ dependencies = [
 name = "go_to_line"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "editor",
  "gpui",
  "indoc",
@@ -4302,7 +4384,10 @@ dependencies = [
  "menu",
  "project",
  "rope",
+ "schemars",
+ "serde",
  "serde_json",
+ "settings",
  "text",
  "theme",
  "tree-sitter-rust",
@@ -4480,6 +4565,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "half"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dd08c532ae367adf81c312a4580bc67f1d0fe8bc9c460520283f4c0ff277888"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+]
+
+[[package]]
 name = "hashbrown"
 version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5339,7 +5434,6 @@ dependencies = [
  "tree-sitter-c",
  "tree-sitter-cpp",
  "tree-sitter-css",
- "tree-sitter-dart",
  "tree-sitter-elixir",
  "tree-sitter-elm",
  "tree-sitter-embedded-template",
@@ -5349,7 +5443,6 @@ dependencies = [
  "tree-sitter-gowork",
  "tree-sitter-hcl",
  "tree-sitter-heex",
- "tree-sitter-html",
  "tree-sitter-jsdoc",
  "tree-sitter-json 0.20.0",
  "tree-sitter-lua",
@@ -5678,10 +5771,13 @@ dependencies = [
 name = "markdown_preview"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "async-recursion 1.0.5",
  "editor",
  "gpui",
  "language",
+ "linkify",
+ "log",
  "pretty_assertions",
  "pulldown-cmark",
  "theme",
@@ -6400,6 +6496,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "oorandom"
+version = "11.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"
+
+[[package]]
 name = "opaque-debug"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -6880,6 +6982,34 @@ dependencies = [
 ]
 
 [[package]]
+name = "plotters"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2c224ba00d7cadd4d5c660deaf2098e5e80e07846537c51f9cfa4be50c1fd45"
+dependencies = [
+ "num-traits",
+ "plotters-backend",
+ "plotters-svg",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "plotters-backend"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e76628b4d3a7581389a35d5b6e2139607ad7c75b17aed325f210aa91f4a9609"
+
+[[package]]
+name = "plotters-svg"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38f6d39893cca0701371e3c27294f09797214b86f1fb951b89ade8ec04e2abab"
+dependencies = [
+ "plotters-backend",
+]
+
+[[package]]
 name = "png"
 version = "0.16.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -7794,6 +7924,7 @@ version = "0.1.0"
 dependencies = [
  "arrayvec 0.7.4",
  "bromberg_sl2",
+ "criterion",
  "gpui",
  "log",
  "rand 0.8.5",
@@ -9498,16 +9629,19 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "editor",
+ "file_icons",
  "fuzzy",
  "gpui",
  "itertools 0.11.0",
  "language",
- "menu",
  "picker",
  "project",
+ "schemars",
  "serde",
  "serde_json",
+ "settings",
  "task",
+ "terminal",
  "tree-sitter-rust",
  "tree-sitter-typescript",
  "ui",
@@ -9829,6 +9963,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "tinytemplate"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
 name = "tinyvec"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -10220,15 +10364,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "tree-sitter-dart"
-version = "0.0.1"
-source = "git+https://github.com/agent3bood/tree-sitter-dart?rev=48934e3bf757a9b78f17bdfaa3e2b4284656fdc7#48934e3bf757a9b78f17bdfaa3e2b4284656fdc7"
-dependencies = [
- "cc",
- "tree-sitter",
-]
-
-[[package]]
 name = "tree-sitter-elixir"
 version = "0.1.0"
 source = "git+https://github.com/elixir-lang/tree-sitter-elixir?rev=a2861e88a730287a60c11ea9299c033c7d076e30#a2861e88a730287a60c11ea9299c033c7d076e30"
@@ -12380,7 +12515,7 @@ dependencies = [
 
 [[package]]
 name = "zed"
-version = "0.130.7"
+version = "0.131.6"
 dependencies = [
  "activity_indicator",
  "anyhow",
@@ -12493,6 +12628,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "zed_dart"
+version = "0.0.1"
+dependencies = [
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "zed_emmet"
+version = "0.0.1"
+dependencies = [
+ "zed_extension_api 0.0.4",
+]
+
+[[package]]
 name = "zed_erlang"
 version = "0.0.1"
 dependencies = [
@@ -12511,16 +12660,29 @@ dependencies = [
 [[package]]
 name = "zed_extension_api"
 version = "0.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5f4ae4e302a80591635ef9a236b35fde6fcc26cfd060e66fde4ba9f9fd394a1"
 dependencies = [
  "wit-bindgen",
 ]
 
 [[package]]
 name = "zed_extension_api"
-version = "0.0.5"
+version = "0.0.6"
+dependencies = [
+ "serde",
+ "serde_json",
+ "wit-bindgen",
+]
+
+[[package]]
+name = "zed_extension_api"
+version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5f4ae4e302a80591635ef9a236b35fde6fcc26cfd060e66fde4ba9f9fd394a1"
+checksum = "77ca8bcaea3feb2d2ce9dbeb061ee48365312a351faa7014c417b0365fe9e459"
 dependencies = [
+ "serde",
+ "serde_json",
  "wit-bindgen",
 ]
 
@@ -12528,13 +12690,20 @@ dependencies = [
 name = "zed_gleam"
 version = "0.0.2"
 dependencies = [
- "zed_extension_api 0.0.4",
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
 name = "zed_haskell"
 version = "0.0.1"
 dependencies = [
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "zed_html"
+version = "0.0.1"
+dependencies = [
  "zed_extension_api 0.0.4",
 ]
 
@@ -12563,14 +12732,14 @@ dependencies = [
 name = "zed_svelte"
 version = "0.0.1"
 dependencies = [
- "zed_extension_api 0.0.4",
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
 name = "zed_toml"
 version = "0.0.2"
 dependencies = [
- "zed_extension_api 0.0.5 (registry+https://github.com/rust-lang/crates.io-index)",
+ "zed_extension_api 0.0.5",
 ]
 
 [[package]]
@@ -12584,7 +12753,7 @@ dependencies = [
 name = "zed_zig"
 version = "0.0.1"
 dependencies = [
- "zed_extension_api 0.0.5 (registry+https://github.com/rust-lang/crates.io-index)",
+ "zed_extension_api 0.0.5",
 ]
 
 [[package]]
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 6de47e35491e9..d656f2a33e90f 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zed";
-  version = "0.130.7";
+  version = "0.131.6";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nGE4RjquH5tEz6vHR1f5F44TX4GtPwiPP3V3lWPpmxk=";
+    hash = "sha256-IhFOA+g2I5vb72CTSZ8WTa9K0ieYbPD/BMShGqaUb84=";
     fetchSubmodules = true;
   };
 
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "async-pipe-0.1.3" = "sha256-g120X88HGT8P6GNCrzpS5SutALx5H+45Sf4iSSxzctE=";
-      "blade-graphics-0.3.0" = "sha256-0TmunFnq9MBxm4TrAkI0PxB58qJEf7oWLWhHq5cVsQ8=";
+      "blade-graphics-0.4.0" = "sha256-S1PNdQ9YbJgLLsJU1mvDZ3feVDIrZGwU37JqIm+kfcE=";
       "bromberg_sl2-0.6.0" = "sha256-+bwdnk3EgYEAxQSP4KpEPicCfO+r2er1DRZjvfF4jSM=";
       "font-kit-0.11.0" = "sha256-+4zMzjFyMS60HfLMEXGfXqKn6P+pOngLA45udV09DM8=";
       "lsp-types-0.94.1" = "sha256-kplgPsafrgZFMI1D9pQCwmg+FKMn5HNWLbcgdXHUFVU=";
@@ -52,7 +52,6 @@ rustPlatform.buildRustPackage rec {
       "tree-sitter-bash-0.20.4" = "sha256-VP7rJfE/k8KV1XN1w5f0YKjCnDMYU1go/up0zj1mabM=";
       "tree-sitter-cpp-0.20.0" = "sha256-2QYEFkpwcRmh2kf4qEAL2a5lGSa316CetOhF73e7rEM=";
       "tree-sitter-css-0.19.0" = "sha256-5Qti/bFac2A1PJxqZEOuSLK3GGKYwPDKAp3OOassBxU=";
-      "tree-sitter-dart-0.0.1" = "sha256-FE6zXy0lAUWWayrM3urZFnQaEYBcnmaVANcUUnvw1q4=";
       "tree-sitter-elixir-0.1.0" = "sha256-hBHqQ3eBjknRPJjP+lQJU6NPFhUMtiv4FbKsTw28Bog=";
       "tree-sitter-elm-5.6.4" = "sha256-0LpuyebOB5ew9fULBcaw8aUbF7HM5sXQpv+Jroz4tXg=";
       "tree-sitter-glsl-0.1.4" = "sha256-TRuiT3ndCeDCsCFokAN8cosNKccB0NjWVRiBJuBJXZw=";
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index ad8f2c0a8e021..1350b01d96fe5 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "29.2.0";
+  version = "29.2.1";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-7g0eogqiBdfTwg8btkHExrY4fpqf0hUZbvlElFtKrB8=";
+    hash = "sha256-WWumGi6+jaQUGi1eArS9l3G8sOQL4ZetixVB5RWDPQ4=";
   };
 
-  npmDepsHash = "sha256-lSKh16qN4EAmC0wtBokkFyl6Vung85vPTyr8Icc4rU0=";
+  npmDepsHash = "sha256-Gm3R8lWmYbLOfyGW+f8CYXlodp11vMCMAhagILxLKFA=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/data/fonts/junicode/tests.nix b/pkgs/data/fonts/junicode/tests.nix
index fda7de31670e1..831e60796d12f 100644
--- a/pkgs/data/fonts/junicode/tests.nix
+++ b/pkgs/data/fonts/junicode/tests.nix
@@ -15,14 +15,13 @@ let
       '');
 in
 builtins.listToAttrs (
-  map
-    texTest
-    (lib.attrsets.cartesianProductOfSets {
+  lib.mapCartesianProduct texTest
+    {
       tex = [ "xelatex" "lualatex" ];
       fonttype = [ "ttf" "otf" ];
       package = [ "junicode" ];
       file = [ ./test.tex ];
-    })
+    }
   ++
   [
     (texTest {
diff --git a/pkgs/data/fonts/nasin-nanpa/default.nix b/pkgs/data/fonts/nasin-nanpa/default.nix
index cd05c667a2487..339c89dd9b0b4 100644
--- a/pkgs/data/fonts/nasin-nanpa/default.nix
+++ b/pkgs/data/fonts/nasin-nanpa/default.nix
@@ -2,29 +2,18 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nasin-nanpa";
-  version = "2.5.1";
+  version = "3.1.0";
 
-  srcs = [
-    (fetchurl {
-      name = "nasin-nanpa.otf";
-      url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}.otf";
-      hash = "sha256-++uOrqFzQ6CB/OPEmBivpjMfAtFk3PSsCNpFBjOtGEg=";
-    })
-    (fetchurl {
-      name = "nasin-nanpa-lasina-kin.otf";
-      url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}-lasina-kin.otf";
-      hash = "sha256-4WIX74y2O4NaKi/JQrgTbOxlKDQKJ/F9wkQuoOdWuTI=";
-    })
-  ];
+  src = fetchurl {
+    url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}.otf";
+    hash = "sha256-remTvvOt7kpvTdq9H8tFI2yU+BtqePXlDDLQv/jtETU=";
+  };
 
   dontUnpack = true;
 
   installPhase = ''
     mkdir -p $out/share/fonts/opentype
-    for src in $srcs; do
-        file=$(stripHash $src)
-        cp $src $out/share/fonts/opentype/$file
-    done
+    cp $src $out/share/fonts/opentype/nasin-nanpa.otf
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/icons/catppuccin-cursors/default.nix b/pkgs/data/icons/catppuccin-cursors/default.nix
index 20e4718515e61..eeb9dd3227f07 100644
--- a/pkgs/data/icons/catppuccin-cursors/default.nix
+++ b/pkgs/data/icons/catppuccin-cursors/default.nix
@@ -9,9 +9,8 @@ let
     palette = [ "Frappe" "Latte" "Macchiato" "Mocha" ];
     color = [ "Blue" "Dark" "Flamingo" "Green" "Lavender" "Light" "Maroon" "Mauve" "Peach" "Pink" "Red" "Rosewater" "Sapphire" "Sky" "Teal" "Yellow" ];
   };
-  product = lib.attrsets.cartesianProductOfSets dimensions;
   variantName = { palette, color }: (lib.strings.toLower palette) + color;
-  variants = map variantName product;
+  variants = lib.mapCartesianProduct variantName dimensions;
 in
 stdenvNoCC.mkDerivation rec {
   pname = "catppuccin-cursors";
diff --git a/pkgs/data/icons/comixcursors/default.nix b/pkgs/data/icons/comixcursors/default.nix
index 1c4fdc195180b..735ff686b49cf 100644
--- a/pkgs/data/icons/comixcursors/default.nix
+++ b/pkgs/data/icons/comixcursors/default.nix
@@ -7,14 +7,13 @@ let
     thickness = [ "" "Slim_" ];  # Thick or slim edges.
     handedness = [ "" "LH_" ];   # Right- or left-handed.
   };
-  product = lib.cartesianProductOfSets dimensions;
   variantName =
     { color, opacity, thickness, handedness }:
     "${handedness}${opacity}${thickness}${color}";
   variants =
     # (The order of this list is already good looking enough to show in the
     # meta.longDescription.)
-    map variantName product;
+    lib.mapCartesianProduct variantName dimensions;
 in
 stdenvNoCC.mkDerivation rec {
   pname = "comixcursors";
diff --git a/pkgs/data/icons/gruppled-cursors/default.nix b/pkgs/data/icons/gruppled-cursors/default.nix
new file mode 100644
index 0000000000000..f78becfd615f4
--- /dev/null
+++ b/pkgs/data/icons/gruppled-cursors/default.nix
@@ -0,0 +1,30 @@
+{
+  stdenvNoCC,
+  fetchFromGitHub,
+  theme,
+  lib,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "gruppled-cursors";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "nim65s";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ejlgdogjIYevZvB23si6bEeU6qY7rWXflaUyVk5MzqU=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/icons/${theme}
+    cp -r ${theme}/{cursors,index.theme} $out/share/icons/${theme}
+  '';
+
+  meta = with lib; {
+    description = "Gruppled Cursors theme";
+    homepage = "https://github.com/nim65s/gruppled-cursors";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/data/icons/gruppled-lite-cursors/default.nix b/pkgs/data/icons/gruppled-lite-cursors/default.nix
new file mode 100644
index 0000000000000..eba7daeb0d80e
--- /dev/null
+++ b/pkgs/data/icons/gruppled-lite-cursors/default.nix
@@ -0,0 +1,30 @@
+{
+  stdenvNoCC,
+  fetchFromGitHub,
+  theme,
+  lib,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "gruppled-lite-cursors";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "nim65s";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-adCXYu8v6mFKXubVQb/RCZXS87//YgixQp20kMt7KT8=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/icons/${theme}
+    cp -r ${theme}/{cursors,index.theme} $out/share/icons/${theme}
+  '';
+
+  meta = with lib; {
+    description = "Gruppled Lite Cursors theme";
+    homepage = "https://github.com/nim65s/gruppled-lite-cursors";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index 5422eaac80739..5fd04d5a1b1d8 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "24.03.12";
+  version = "24.04.16";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-WWgppmMIXa7AtMu8Tu3TOt4JvsAkpufZva1reE+UaWg=";
+    sha256 = "sha256-1SBIEqbgJwRcoCPWDL5YoapNHsrqWcpjFo0xp+GSXXs=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index ee83d1cca0bbf..2f60c1367f2ce 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20231227";
+  version = "20240318";
 
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-8Pa6LtAml8axjrUS32UbFIqTtM8v124U2Tt0J4sC0Is=";
+    sha256 = "sha256-t/VOTFDdAH+EdzofdMyUO9Yvl5qdMjdPl9ebYtBC388=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 100599b34c3c1..75bdf7b07aa9c 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2024-04-01";
+  version = "2024-04-18";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    hash = "sha256-gszyUZGWlgrBTQnaz6Ws7jzfTN5KAfX5SjVwmVrP9QE=";
+    hash = "sha256-Kvafbvw1q8F0+l47WshFHPfZEQhFXPPXuI0RjBJnP4s=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/desktops/budgie/budgie-desktop-view/default.nix b/pkgs/desktops/budgie/budgie-desktop-view/default.nix
index 99d90b8ab8882..a1869cfa918cc 100644
--- a/pkgs/desktops/budgie/budgie-desktop-view/default.nix
+++ b/pkgs/desktops/budgie/budgie-desktop-view/default.nix
@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
     gtk3
   ];
 
+  mesonFlags = [ (lib.mesonBool "werror" false) ];
+
   meta = {
     description = "The official Budgie desktop icons application/implementation";
     homepage = "https://github.com/BuddiesOfBudgie/budgie-desktop-view";
diff --git a/pkgs/desktops/deepin/apps/deepin-terminal/default.nix b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
index 5142b8d354ee5..b911f74f53e4d 100644
--- a/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     qttools
     pkg-config
     wrapQtAppsHook
-    lxqt.lxqt-build-tools
+    lxqt.lxqt-build-tools_0_13
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/deepin/library/qt5integration/default.nix b/pkgs/desktops/deepin/library/qt5integration/default.nix
index e8e3b4d8e146e..c7d219f8de69f 100644
--- a/pkgs/desktops/deepin/library/qt5integration/default.nix
+++ b/pkgs/desktops/deepin/library/qt5integration/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     qtsvg
     qtx11extras
     mtdev
-    lxqt.libqtxdg
+    lxqt.libqtxdg_3_12
     xorg.xcbutilrenderutil
     gtest
   ];
diff --git a/pkgs/desktops/gnome/core/eog/default.nix b/pkgs/desktops/gnome/core/eog/default.nix
index 6790c764a82d0..095845b8acc1b 100644
--- a/pkgs/desktops/gnome/core/eog/default.nix
+++ b/pkgs/desktops/gnome/core/eog/default.nix
@@ -21,6 +21,7 @@
 , exempi
 , shared-mime-info
 , wrapGAppsHook
+, libjxl
 , librsvg
 , webp-pixbuf-loader
 , libheif
@@ -81,10 +82,11 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    # Pull in WebP support for gnome-backgrounds.
+    # Pull in WebP and JXL support for gnome-backgrounds.
     # In postInstall to run before gappsWrapperArgsHook.
     export GDK_PIXBUF_MODULE_FILE="${gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
       extraLoaders = [
+        libjxl
         librsvg
         webp-pixbuf-loader
         libheif.out
@@ -96,6 +98,7 @@ stdenv.mkDerivation rec {
     gappsWrapperArgs+=(
       # Thumbnailers
       --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
+      --prefix XDG_DATA_DIRS : "${libjxl}/share"
       --prefix XDG_DATA_DIRS : "${librsvg}/share"
       --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
     )
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/default.nix b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
index 2042eede7c113..48566ba66945c 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@@ -31,6 +31,7 @@
 , libgudev
 , libadwaita
 , libkrb5
+, libjxl
 , libpulseaudio
 , libpwquality
 , librsvg
@@ -173,10 +174,11 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = ''
-    # Pull in WebP support for gnome-backgrounds.
+    # Pull in WebP and JXL support for gnome-backgrounds.
     # In postInstall to run before gappsWrapperArgsHook.
     export GDK_PIXBUF_MODULE_FILE="${gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
       extraLoaders = [
+        libjxl
         librsvg
         webp-pixbuf-loader
       ];
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index aa74bec266962..3a7da11739773 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -19,6 +19,7 @@
 , unzip
 , shared-mime-info
 , libgweather
+, libjxl
 , librsvg
 , webp-pixbuf-loader
 , geoclue2
@@ -188,10 +189,11 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = ''
-    # Pull in WebP support for gnome-backgrounds.
+    # Pull in WebP and JXL support for gnome-backgrounds.
     # In postInstall to run before gappsWrapperArgsHook.
     export GDK_PIXBUF_MODULE_FILE="${gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
       extraLoaders = [
+        libjxl
         librsvg
         webp-pixbuf-loader
       ];
diff --git a/pkgs/desktops/gnome/core/nautilus/default.nix b/pkgs/desktops/gnome/core/nautilus/default.nix
index 7e2d442493768..9279d967ccbff 100644
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -19,6 +19,7 @@
 , shared-mime-info
 , libnotify
 , libexif
+, libjxl
 , libseccomp
 , librsvg
 , webp-pixbuf-loader
@@ -106,6 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
     gappsWrapperArgs+=(
       # Thumbnailers
       --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
+      --prefix XDG_DATA_DIRS : "${libjxl}/share"
       --prefix XDG_DATA_DIRS : "${librsvg}/share"
       --prefix XDG_DATA_DIRS : "${webp-pixbuf-loader}/share"
       --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
diff --git a/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix b/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
index 16ccc43895d69..a36251e81ec86 100644
--- a/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
+++ b/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
@@ -55,7 +55,7 @@ let
       longDescription = description;
       homepage = link;
       license = lib.licenses.gpl2Plus; # https://wiki.gnome.org/Projects/GnomeShell/Extensions/Review#Licensing
-      maintainers = with lib.maintainers; [ piegames ];
+      maintainers = with lib.maintainers; [ ];
     };
     passthru = {
       extensionPortalSlug = pname;
diff --git a/pkgs/desktops/lxqt/compton-conf/default.nix b/pkgs/desktops/lxqt/compton-conf/default.nix
index f54fbd92bd35b..be6d593b41778 100644
--- a/pkgs/desktops/lxqt/compton-conf/default.nix
+++ b/pkgs/desktops/lxqt/compton-conf/default.nix
@@ -1,17 +1,18 @@
-{ stdenv
-, lib
-, mkDerivation
+{ lib
+, stdenv
 , fetchFromGitHub
 , cmake
+, libconfig
+, lxqt-build-tools
 , pkg-config
 , qtbase
 , qttools
-, lxqt
-, libconfig
+, qtx11extras
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "compton-conf";
   version = "0.16.0";
 
@@ -24,19 +25,21 @@ mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
+    lxqt-build-tools
     pkg-config
-    lxqt.lxqt-build-tools
     qttools
+    qtx11extras
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
     libconfig
+    qtbase
   ];
 
   preConfigure = ''
     substituteInPlace autostart/CMakeLists.txt \
-      --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg" \
+      --replace-fail "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg" \
   '';
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/default.nix b/pkgs/desktops/lxqt/default.nix
index dec4cabffe7e6..b4925f3c5d954 100644
--- a/pkgs/desktops/lxqt/default.nix
+++ b/pkgs/desktops/lxqt/default.nix
@@ -1,4 +1,5 @@
-{ pkgs, makeScope, libsForQt5, qt5 }:
+{ pkgs, makeScope, kdePackages }:
+
 let
   packages = self: with self; {
 
@@ -11,6 +12,7 @@ let
     libsysstat = callPackage ./libsysstat {};
     liblxqt = callPackage ./liblxqt {};
     qtxdg-tools = callPackage ./qtxdg-tools {};
+    libdbusmenu-lxqt = callPackage ./libdbusmenu-lxqt {};
 
     ### CORE 1
     libfm-qt = callPackage ./libfm-qt {};
@@ -28,7 +30,10 @@ let
     lxqt-sudo = callPackage ./lxqt-sudo {};
     lxqt-themes = callPackage ./lxqt-themes {};
     pavucontrol-qt = callPackage ./pavucontrol-qt {};
-    qtermwidget = callPackage ./qtermwidget {};
+    qtermwidget = callPackage ./qtermwidget {
+      lxqt-build-tools = lxqt-build-tools_0_13;
+      inherit (pkgs.libsForQt5) qtbase qttools;
+    };
 
     ### CORE 2
     lxqt-panel = callPackage ./lxqt-panel {};
@@ -36,24 +41,55 @@ let
     pcmanfm-qt = callPackage ./pcmanfm-qt {};
 
     ### OPTIONAL
-    qterminal = callPackage ./qterminal {};
-    compton-conf = callPackage ./compton-conf {};
+    qterminal = callPackage ./qterminal {
+      lxqt-build-tools = lxqt-build-tools_0_13;
+      inherit (pkgs.libsForQt5) qtbase qttools qtx11extras;
+    };
+    compton-conf = callPackage ./compton-conf {
+      lxqt-build-tools = lxqt-build-tools_0_13;
+      inherit (pkgs.libsForQt5) qtbase qttools qtx11extras;
+    };
     obconf-qt = callPackage ./obconf-qt {};
     lximage-qt = callPackage ./lximage-qt {};
     qps = callPackage ./qps {};
     screengrab = callPackage ./screengrab {};
-    qlipper = callPackage ./qlipper {};
+    qlipper = callPackage ./qlipper {
+      inherit (pkgs.libsForQt5) qtbase qttools;
+    };
     lxqt-archiver = callPackage ./lxqt-archiver {};
     xdg-desktop-portal-lxqt = callPackage ./xdg-desktop-portal-lxqt {};
 
+    ### COMPATIBILITY
+    lxqt-build-tools_0_13 = callPackage ./lxqt-build-tools {
+      version = "0.13.0";
+      inherit (pkgs.libsForQt5) qtbase;
+    };
+    libqtxdg_3_12 = callPackage ./libqtxdg {
+      version = "3.12.0";
+      lxqt-build-tools = lxqt-build-tools_0_13;
+      inherit (pkgs.libsForQt5) qtbase qtsvg;
+    };
+    libfm-qt_1_4 = callPackage ./libfm-qt {
+      version = "1.4.0";
+      lxqt-build-tools = lxqt-build-tools_0_13;
+      inherit (pkgs.libsForQt5) qttools qtx11extras;
+    };
+    lxqt-qtplugin_1_4 = callPackage ./lxqt-qtplugin {
+      version = "1.4.1";
+      lxqt-build-tools = lxqt-build-tools_0_13;
+      libqtxdg = libqtxdg_3_12;
+      libfm-qt = libfm-qt_1_4;
+      inherit (pkgs.libsForQt5) qtbase qtsvg qttools libdbusmenu;
+    };
+
     preRequisitePackages = [
-      libsForQt5.kwindowsystem # provides some QT5 plugins needed by lxqt-panel
-      libsForQt5.libkscreen # provides plugins for screen management software
+      kdePackages.kwindowsystem # provides some QT plugins needed by lxqt-panel
+      kdePackages.libkscreen # provides plugins for screen management software
       pkgs.libfm
       pkgs.libfm-extra
       pkgs.menu-cache
       pkgs.openbox # default window manager
-      qt5.qtsvg # provides QT5 plugins for svg icons
+      kdePackages.qtsvg # provides QT plugins for svg icons
     ];
 
     corePackages = [
@@ -62,6 +98,7 @@ let
       libsysstat
       liblxqt
       qtxdg-tools
+      libdbusmenu-lxqt
 
       ### CORE 1
       libfm-qt
@@ -98,7 +135,7 @@ let
       screengrab
 
       ### Default icon theme
-      libsForQt5.breeze-icons
+      kdePackages.breeze-icons
 
       ### Screen saver
       pkgs.xscreensaver
@@ -106,4 +143,4 @@ let
 
   };
 in
-makeScope libsForQt5.newScope packages
+makeScope kdePackages.newScope packages
diff --git a/pkgs/desktops/lxqt/libdbusmenu-lxqt/default.nix b/pkgs/desktops/lxqt/libdbusmenu-lxqt/default.nix
new file mode 100644
index 0000000000000..ca7910668ca27
--- /dev/null
+++ b/pkgs/desktops/lxqt/libdbusmenu-lxqt/default.nix
@@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, qtbase
+, wrapQtAppsHook
+, gitUpdater
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libdbusmenu-lxqt";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "lxqt";
+    repo = pname;
+    rev = version;
+    hash = "sha256-fwYvU62NCmJ6HNrOqHPWKDas7LE1XF3squ0CBEFkNkk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+  ];
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    broken = stdenv.isDarwin;
+    description = "A Qt implementation of the DBusMenu protocol";
+    homepage = "https://github.com/lxqt/libdbusmenu-lxqt";
+    license = licenses.lgpl21Plus;
+    platforms = with platforms; unix;
+    maintainers = teams.lxqt.members;
+  };
+}
diff --git a/pkgs/desktops/lxqt/libfm-qt/default.nix b/pkgs/desktops/lxqt/libfm-qt/default.nix
index c945107aaf3bc..0ef27be05d2b6 100644
--- a/pkgs/desktops/lxqt/libfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/libfm-qt/default.nix
@@ -1,29 +1,36 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
-, lxqt-build-tools
-, lxqt-menu-data
-, pcre
+, libXdmcp
 , libexif
-, xorg
 , libfm
+, libpthreadstubs
+, libxcb
+, lxqt-build-tools
+, lxqt-menu-data
 , menu-cache
-, qtx11extras
+, pcre
+, pkg-config
 , qttools
+, wrapQtAppsHook
 , gitUpdater
+, version ? "2.0.0"
+, qtx11extras ? null
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "libfm-qt";
-  version = "1.4.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "libfm-qt";
     rev = version;
-    hash = "sha256-QxPYSA7537K+/dRTxIYyg+Q/kj75rZOdzlUsmSdQcn4=";
+    hash = {
+      "1.4.0" = "sha256-QxPYSA7537K+/dRTxIYyg+Q/kj75rZOdzlUsmSdQcn4=";
+      "2.0.0" = "sha256-vWkuPdG5KaT6KMr1NJGt7JBUd1z3wROKY79otsrRsuI=";
+    }."${version}";
   };
 
   nativeBuildInputs = [
@@ -31,19 +38,20 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    lxqt-menu-data
-    pcre
+    libXdmcp
     libexif
-    xorg.libpthreadstubs
-    xorg.libxcb
-    xorg.libXdmcp
-    qtx11extras
     libfm
+    libpthreadstubs
+    libxcb
+    lxqt-menu-data
     menu-cache
-  ];
+    pcre
+  ] ++ (lib.optionals (lib.versionAtLeast "2.0.0" version) [qtx11extras])
+  ;
 
   passthru.updateScript = gitUpdater { };
 
diff --git a/pkgs/desktops/lxqt/liblxqt/default.nix b/pkgs/desktops/lxqt/liblxqt/default.nix
index 8a5316d73f53f..430c33c03605f 100644
--- a/pkgs/desktops/lxqt/liblxqt/default.nix
+++ b/pkgs/desktops/lxqt/liblxqt/default.nix
@@ -1,42 +1,42 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
+, gitUpdater
+, kwindowsystem
+, libXScrnSaver
+, libqtxdg
 , lxqt-build-tools
-, qtx11extras
-, qttools
+, polkit-qt-1
 , qtsvg
-, libqtxdg
-, polkit-qt
-, kwindowsystem
-, xorg
-, gitUpdater
+, qttools
+, wrapQtAppsHook
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "liblxqt";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-daD4okYc4J2nRrO6423W0IUK9173zcepCvvMtx7Vho4=";
+    hash = "sha256-ClAmREsPBb7i7T2aGgf0h3rk1ohUvWQvmSnrlprHzds=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtx11extras
-    qtsvg
-    polkit-qt
     kwindowsystem
+    libXScrnSaver
     libqtxdg
-    xorg.libXScrnSaver
+    polkit-qt-1
+    qtsvg
   ];
 
   # convert name of wrapped binary, e.g. .lxqt-whatever-wrapped to the original name, e.g. lxqt-whatever so binaries can find their resources
@@ -45,7 +45,7 @@ mkDerivation rec {
   postPatch = ''
     # https://github.com/NixOS/nixpkgs/issues/119766
     substituteInPlace lxqtbacklight/linux_backend/driver/libbacklight_backend.c \
-      --replace "pkexec lxqt-backlight_backend" "pkexec $out/bin/lxqt-backlight_backend"
+      --replace-fail "pkexec lxqt-backlight_backend" "pkexec $out/bin/lxqt-backlight_backend"
 
     sed -i "s|\''${POLKITQT-1_POLICY_FILES_INSTALL_DIR}|''${out}/share/polkit-1/actions|" CMakeLists.txt
   '';
diff --git a/pkgs/desktops/lxqt/libqtxdg/default.nix b/pkgs/desktops/lxqt/libqtxdg/default.nix
index f2c42ccca5924..155b9c58bd425 100644
--- a/pkgs/desktops/lxqt/libqtxdg/default.nix
+++ b/pkgs/desktops/lxqt/libqtxdg/default.nix
@@ -1,27 +1,33 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , qtbase
 , qtsvg
 , lxqt-build-tools
+, wrapQtAppsHook
 , gitUpdater
+, version ? "4.0.0"
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "libqtxdg";
-  version = "3.12.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-y+3noaHubZnwUUs8vbMVvZPk+6Fhv37QXUb//reedCU=";
+    hash = {
+      "3.12.0" = "sha256-y+3noaHubZnwUUs8vbMVvZPk+6Fhv37QXUb//reedCU=";
+      "4.0.0" = "sha256-TTFgkAI3LulYGuqdhorkjNYyo942y1oFy5SRAKl9ZxU=";
+    }."${version}";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/lxqt/libsysstat/default.nix b/pkgs/desktops/lxqt/libsysstat/default.nix
index 5e3514310c3d3..6f809629eaaa5 100644
--- a/pkgs/desktops/lxqt/libsysstat/default.nix
+++ b/pkgs/desktops/lxqt/libsysstat/default.nix
@@ -1,27 +1,28 @@
 { stdenv
 , lib
-, mkDerivation
 , fetchFromGitHub
 , cmake
 , qtbase
 , lxqt-build-tools
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "libsysstat";
-  version = "0.4.6";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-dk3I+bkU2ztqIe33rTYneSUd8VFzrElTqVrjHQhAWXw=";
+    hash = "sha256-2rdhw67TPvy/QmyzbtStgiIuIgZ7ZSt07xjCvOywKF4=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/lxqt/lximage-qt/default.nix b/pkgs/desktops/lxqt/lximage-qt/default.nix
index 2e49678f80f9c..3ff33af9d4c56 100644
--- a/pkgs/desktops/lxqt/lximage-qt/default.nix
+++ b/pkgs/desktops/lxqt/lximage-qt/default.nix
@@ -1,30 +1,32 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , pkg-config
-, qtbase
-, qttools
-, qtx11extras
-, qtsvg
-, qtimageformats
-, xorg
-, lxqt-build-tools
-, libfm-qt
+, libXdmcp
 , libexif
+, libfm-qt
+, libpthreadstubs
+, lxqt-build-tools
 , menu-cache
+, qtbase
+, qtimageformats
+, qtsvg
+, qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lximage-qt";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-Igfd8lhKDjdseQeARiirj+tEoJdcaeHuyd4mfQHOVg0=";
+    hash = "sha256-yjsdXVV/EOgpNI5kY12lNH9Wpru8A6eWxayslFdioiQ=";
   };
 
   nativeBuildInputs = [
@@ -32,18 +34,19 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtx11extras
-    qtsvg
-    qtimageformats # add-on module to support more image file formats
-    libfm-qt
-    xorg.libpthreadstubs
-    xorg.libXdmcp
+    libXdmcp
     libexif
+    libfm-qt
+    libpthreadstubs
     menu-cache
+    qtbase
+    qtimageformats # add-on module to support more image file formats
+    qtsvg
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-about/default.nix b/pkgs/desktops/lxqt/lxqt-about/default.nix
index e78f0ba4e233d..73b49561d886b 100644
--- a/pkgs/desktops/lxqt/lxqt-about/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-about/default.nix
@@ -1,40 +1,42 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, lxqt-build-tools
-, qtx11extras
-, qttools
-, qtsvg
 , kwindowsystem
 , liblxqt
 , libqtxdg
+, lxqt-build-tools
+, qtsvg
+, qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-about";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-FA9xvIi45qpD6iGxiiNKNlcLKzJtb0cWmvDBJRnJFwA=";
+    hash = "sha256-Y0OF4W0quQEet/QvntwGwFqaqJDDUchWYRh+OWZDS8w=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtx11extras
-    qtsvg
     kwindowsystem
     liblxqt
     libqtxdg
+    qtsvg
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-admin/default.nix b/pkgs/desktops/lxqt/lxqt-admin/default.nix
index fc911cf27ea50..e83b1788dc3a9 100644
--- a/pkgs/desktops/lxqt/lxqt-admin/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-admin/default.nix
@@ -1,47 +1,49 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, lxqt-build-tools
-, qtx11extras
-, qttools
-, qtsvg
 , kwindowsystem
 , liblxqt
 , libqtxdg
-, polkit-qt
+, lxqt-build-tools
+, polkit-qt-1
+, qtsvg
+, qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-admin";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-wPK3TMBC359GnisjpdY2zU+Jnvr7Hdzb6r+HuUQC3mo=";
+    hash = "sha256-Ps+XiCA6OmnsYj0D+pxpvRxfIZfRGFBbZ0t/IPZjlv8=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtx11extras
-    qtsvg
     kwindowsystem
     liblxqt
     libqtxdg
-    polkit-qt
+    polkit-qt-1
+    qtsvg
+    qtwayland
   ];
 
   postPatch = ''
     for f in lxqt-admin-{time,user}/CMakeLists.txt; do
-      substituteInPlace $f --replace \
+      substituteInPlace $f --replace-fail \
         "\''${POLKITQT-1_POLICY_FILES_INSTALL_DIR}" \
         "$out/share/polkit-1/actions"
     done
diff --git a/pkgs/desktops/lxqt/lxqt-archiver/default.nix b/pkgs/desktops/lxqt/lxqt-archiver/default.nix
index 0adf8a0859654..9cef42cdb6294 100644
--- a/pkgs/desktops/lxqt/lxqt-archiver/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-archiver/default.nix
@@ -1,5 +1,5 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , pkg-config
@@ -10,19 +10,20 @@
 , menu-cache
 , qtbase
 , qttools
-, qtx11extras
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-archiver";
-  version = "0.9.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "lxqt-archiver";
     rev = version;
-    hash = "sha256-8pfUpyjn01D8CL+2PjGkZqyHu+lpHZIXlXn67rZoxMY=";
+    hash = "sha256-32Wq0Faphu0uSG0RdOqrDD/igrNaP6l1mtuV+HcsdcQ=";
   };
 
   nativeBuildInputs = [
@@ -30,6 +31,7 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -38,7 +40,7 @@ mkDerivation rec {
     libfm-qt
     menu-cache
     qtbase
-    qtx11extras
+    qtwayland
   ];
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/desktops/lxqt/lxqt-build-tools/default.nix b/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
index 4398dd3427749..418738f5853bf 100644
--- a/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
@@ -1,5 +1,5 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , pkg-config
@@ -7,36 +7,37 @@
 , qtbase
 , glib
 , perl
+, wrapQtAppsHook
 , gitUpdater
+, version ? "2.0.0"
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-build-tools";
-  version = "0.13.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-4/hVlEdqqqd6CNitCRkIzsS1R941vPJdirIklp4acXA=";
+    hash = {
+      "0.13.0" = "sha256-4/hVlEdqqqd6CNitCRkIzsS1R941vPJdirIklp4acXA=";
+      "2.0.0" = "sha256-ZFvnIumP03Mp+4OHPe1yMVsSYhMmYUY1idJGCAy5IhA=";
+    }."${version}";
   };
 
   postPatch = ''
     # Nix clang on darwin identifies as 'Clang', not 'AppleClang'
     # Without this, dependants fail to link.
     substituteInPlace cmake/modules/LXQtCompilerSettings.cmake \
-      --replace AppleClang Clang
-
-    # GLib 2.72 moved the file from gio-unix-2.0 to gio-2.0.
-    # https://github.com/lxqt/lxqt-build-tools/pull/74
-    substituteInPlace cmake/find-modules/FindGLIB.cmake \
-      --replace gio/gunixconnection.h gio/gunixfdlist.h
+      --replace-fail AppleClang Clang
   '';
 
   nativeBuildInputs = [
     cmake
     pkg-config
     setupHook
+    wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -54,8 +55,7 @@ mkDerivation rec {
   # We're dependent on this macro doing add_definitions in most places
   # But we have the setup-hook to set the values.
   postInstall = ''
-    rm $out/share/cmake/lxqt-build-tools/modules/LXQtConfigVars.cmake
-    cp ${./LXQtConfigVars.cmake} $out/share/cmake/lxqt-build-tools/modules/LXQtConfigVars.cmake
+    cp ${./LXQtConfigVars.cmake} $out/share/cmake/lxqt${lib.optionalString (lib.versionAtLeast version "2.0.0") "2"}-build-tools/modules/LXQtConfigVars.cmake
   '';
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-config/default.nix b/pkgs/desktops/lxqt/lxqt-config/default.nix
index 64b54b3e6bc37..3eb1c3a1013f0 100644
--- a/pkgs/desktops/lxqt/lxqt-config/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-config/default.nix
@@ -1,33 +1,39 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
 , glib
-, lxqt-build-tools
-, lxqt-menu-data
-, qtbase
-, qtx11extras
-, qttools
-, qtsvg
 , kwindowsystem
+, libXScrnSaver
+, libXcursor
+, libXdmcp
 , libkscreen
 , liblxqt
+, libpthreadstubs
 , libqtxdg
+, libxcb
+, lxqt-build-tools
+, lxqt-menu-data
+, pkg-config
+, qtbase
+, qtsvg
+, qttools
+, qtwayland
+, wrapQtAppsHook
+, xf86inputlibinput
 , xkeyboard_config
-, xorg
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-config";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-ypHjUYRtrWx1Cp9KGSqsWpRHg7zoV0YDW6P4amJKapI=";
+    hash = "sha256-lFZTu6MqqWTjytYC7In/YJ38PYksZXduHvA/FRY4v0U=";
   };
 
   nativeBuildInputs = [
@@ -35,34 +41,35 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
     glib.bin
-    qtbase
-    qtx11extras
-    qtsvg
     kwindowsystem
+    libXScrnSaver
+    libXcursor
+    libXdmcp
     libkscreen
     liblxqt
+    libpthreadstubs
     libqtxdg
+    libxcb
     lxqt-menu-data
-    xorg.libpthreadstubs
-    xorg.libXdmcp
-    xorg.libXScrnSaver
-    xorg.libxcb
-    xorg.libXcursor
-    xorg.xf86inputlibinput
-    xorg.xf86inputlibinput.dev
+    qtbase
+    qtsvg
+    qtwayland
+    xf86inputlibinput
+    xf86inputlibinput.dev
   ];
 
   postPatch = ''
     substituteInPlace lxqt-config-appearance/configothertoolkits.cpp \
-      --replace 'QStringLiteral("gsettings' \
+      --replace-fail 'QStringLiteral("gsettings' \
                 'QStringLiteral("${glib.bin}/bin/gsettings'
 
     substituteInPlace lxqt-config-input/keyboardlayoutconfig.h \
-      --replace '/usr/share/X11/xkb/rules/base.lst' \
+      --replace-fail '/usr/share/X11/xkb/rules/base.lst' \
                 '${xkeyboard_config}/share/X11/xkb/rules/base.lst'
   '';
 
diff --git a/pkgs/desktops/lxqt/lxqt-globalkeys/default.nix b/pkgs/desktops/lxqt/lxqt-globalkeys/default.nix
index 83235bfdaebd0..df6972bd80e19 100644
--- a/pkgs/desktops/lxqt/lxqt-globalkeys/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-globalkeys/default.nix
@@ -1,38 +1,38 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , lxqt-build-tools
 , qtbase
 , qttools
-, qtx11extras
 , qtsvg
 , kwindowsystem
 , liblxqt
 , libqtxdg
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-globalkeys";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-2S61d7BSuDPU1dNXLENpmpt6BB+CAeCtBVQS+ZGxrtU=";
+    hash = "sha256-24alERAnzlU/ZwIlRy9B+58zjRnF9eXunWeEO/lDVxM=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
     qtbase
-    qtx11extras
     qtsvg
     kwindowsystem
     liblxqt
diff --git a/pkgs/desktops/lxqt/lxqt-menu-data/default.nix b/pkgs/desktops/lxqt/lxqt-menu-data/default.nix
index 5ac4a5b0b7149..84b4882f3643f 100644
--- a/pkgs/desktops/lxqt/lxqt-menu-data/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-menu-data/default.nix
@@ -1,27 +1,29 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , lxqt-build-tools
 , qttools
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-menu-data";
-  version = "1.4.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-I9jb2e57ZBvND27F5C1zMaoFtij5TetmN9zbJSjxiS4=";
+    hash = "sha256-CNY23xdFiDQKKJf9GccwDOuBWXwfc7WNI7vMv/zOM9U=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
index a39c560d48d07..0ca6d4fe61fe9 100644
--- a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
@@ -1,42 +1,46 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, lxqt-build-tools
-, qtbase
-, qttools
-, qtsvg
 , kwindowsystem
+, layer-shell-qt
 , liblxqt
 , libqtxdg
-, qtx11extras
+, lxqt-build-tools
+, qtbase
+, qtsvg
+, qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-notificationd";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-Y3+ShGb1DKJw4zv3SCwEq2unJesI1q5OaTlSO8fP76A=";
+    hash = "sha256-zEoTjDD65bBJBbvAZVtov8HyiN1G6CqYkmcPH4T8Jhc=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtsvg
     kwindowsystem
+    layer-shell-qt
     liblxqt
     libqtxdg
-    qtx11extras
+    qtbase
+    qtsvg
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix b/pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix
index ab23fc36da838..eb0784840d1fa 100644
--- a/pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix
@@ -1,42 +1,44 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, lxqt-build-tools
-, qtbase
-, qttools
-, qtsvg
-, qtx11extras
 , kwindowsystem
 , liblxqt
 , libqtxdg
+, lxqt-build-tools
+, qtbase
+, qtsvg
+, qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-openssh-askpass";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-o/hJdaGtjcJiwjqfvfwfcOUv4YdAeeW+rCxsmZZdJQ0=";
+    hash = "sha256-YDGKp8Fd6lEFSRWGAFUG7SUUFq7gEpJnKlr+ZFsBCRU=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtx11extras
-    qtsvg
     kwindowsystem
     liblxqt
     libqtxdg
+    qtbase
+    qtsvg
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-panel/default.nix b/pkgs/desktops/lxqt/lxqt-panel/default.nix
index 5b141e7962d53..dda96380a3eb3 100644
--- a/pkgs/desktops/lxqt/lxqt-panel/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-panel/default.nix
@@ -1,14 +1,19 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , pkg-config
 , alsa-lib
+, libdbusmenu-lxqt
 , kguiaddons
 , kwindowsystem
+, layer-shell-qt
 , libXdamage
+, libXdmcp
+, libXtst
 , libdbusmenu
 , liblxqt
+, libpthreadstubs
 , libpulseaudio
 , libqtxdg
 , libstatgrab
@@ -17,26 +22,26 @@
 , lxqt-build-tools
 , lxqt-globalkeys
 , lxqt-menu-data
-, gitUpdater
 , menu-cache
 , pcre
 , qtbase
 , qtsvg
 , qttools
-, qtx11extras
+, qtwayland
 , solid
-, xorg
+, wrapQtAppsHook
+, gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-panel";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-LQq1XOA0dGXXORVr2H/gI+axvCAd4P3nB4zCFYWgagc=";
+    hash = "sha256-2I7I3AiLptKbBXiTPbbpcj16zuIx0e9SQnvbalpoFvM=";
   };
 
   nativeBuildInputs = [
@@ -44,15 +49,21 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
     alsa-lib
+    libdbusmenu-lxqt
     kguiaddons
     kwindowsystem
+    layer-shell-qt
     libXdamage
+    libXdmcp
+    libXtst
     libdbusmenu
     liblxqt
+    libpthreadstubs
     libpulseaudio
     libqtxdg
     libstatgrab
@@ -64,11 +75,8 @@ mkDerivation rec {
     pcre
     qtbase
     qtsvg
-    qtx11extras
+    qtwayland
     solid
-    xorg.libXdmcp
-    xorg.libXtst
-    xorg.libpthreadstubs
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-policykit/default.nix b/pkgs/desktops/lxqt/lxqt-policykit/default.nix
index da3480b73e39b..601987b93ee80 100644
--- a/pkgs/desktops/lxqt/lxqt-policykit/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-policykit/default.nix
@@ -1,31 +1,32 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
-, lxqt-build-tools
-, qtbase
-, qttools
-, qtx11extras
-, qtsvg
-, polkit
-, polkit-qt
 , kwindowsystem
 , liblxqt
 , libqtxdg
+, lxqt-build-tools
 , pcre
+, pkg-config
+, polkit
+, polkit-qt-1
+, qtbase
+, qtsvg
+, qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-policykit";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-w0o76oBFNy3syQqyFZdAbFUu8yX+uA6cMOHf3WfKPEU=";
+    hash = "sha256-oYKvQBilpD2RLhN1K6qgRNNAfohCOqmBrKcWy1fXZT8=";
   };
 
   nativeBuildInputs = [
@@ -33,18 +34,19 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtx11extras
-    qtsvg
-    polkit
-    polkit-qt
     kwindowsystem
     liblxqt
     libqtxdg
     pcre
+    polkit
+    polkit-qt-1
+    qtbase
+    qtsvg
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix b/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix
index 1823e7fb5d0dd..f9fae3718f6f4 100644
--- a/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix
@@ -1,48 +1,50 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, lxqt-build-tools
-, qtbase
-, qttools
-, qtx11extras
-, qtsvg
-, kwindowsystem
-, solid
 , kidletime
+, kwindowsystem
 , liblxqt
 , libqtxdg
+, lxqt-build-tools
 , lxqt-globalkeys
+, qtbase
+, qtsvg
+, qttools
+, qtwayland
+, solid
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-powermanagement";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-1koP+ElW5e85TJqToaErnGkTn3uRHk45bDDrXG6Oy68=";
+    hash = "sha256-wtqVUXYQWIPhvHj7Ig9qR6sglCRQzcxG192DM3xq/mA=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtx11extras
-    qtsvg
-    kwindowsystem
-    solid
     kidletime
+    kwindowsystem
     liblxqt
     libqtxdg
     lxqt-globalkeys
+    qtbase
+    qtsvg
+    qtwayland
+    solid
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix b/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
index 264575b019d89..a496274c73b35 100644
--- a/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
@@ -1,8 +1,9 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, libdbusmenu
+, libdbusmenu-lxqt
+, libdbusmenu ? null
 , libfm-qt
 , libqtxdg
 , lxqt-build-tools
@@ -10,38 +11,42 @@
 , qtbase
 , qtsvg
 , qttools
-, qtx11extras
+, wrapQtAppsHook
+, version ? "2.0.0"
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-qtplugin";
-  version = "1.4.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-0shNkM1AGAjzMQDGLOIP2DFx6goJGoD0U0Gr+rRRFrk=";
+    hash = {
+      "1.4.1" = "sha256-sp/LvQNfodMYQ4kNbBv4PTNfs38XjYLezuxRltZd4kc=";
+      "2.0.0" = "sha256-o5iD4VzsbN81lwDZJuFj8Ugg1RP752M4unu3J5/h8g8=";
+    }."${version}";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    libdbusmenu
+    (if lib.versionAtLeast version "2.0.0" then libdbusmenu-lxqt else libdbusmenu)
     libfm-qt
     libqtxdg
     qtbase
     qtsvg
-    qtx11extras
   ];
 
   postPatch = ''
     substituteInPlace src/CMakeLists.txt \
-      --replace "DESTINATION \"\''${QT_PLUGINS_DIR}" "DESTINATION \"$qtPluginPrefix"
+      --replace-fail "DESTINATION \"\''${QT_PLUGINS_DIR}" "DESTINATION \"$qtPluginPrefix"
   '';
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-runner/default.nix b/pkgs/desktops/lxqt/lxqt-runner/default.nix
index 465a844c451ff..0ea4ab9dce0f9 100644
--- a/pkgs/desktops/lxqt/lxqt-runner/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-runner/default.nix
@@ -1,32 +1,34 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
-, lxqt-build-tools
-, qtbase
-, qttools
-, qtsvg
 , kwindowsystem
+, layer-shell-qt
 , liblxqt
 , libqtxdg
+, lxqt-build-tools
 , lxqt-globalkeys
-, qtx11extras
 , menu-cache
 , muparser
 , pcre
+, pkg-config
+, qtbase
+, qtsvg
+, qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-runner";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-NGytLQ2D5t1UdMGZoeHxHaXPwbRFDx+11ocjImXqZBU=";
+    hash = "sha256-r9rz6rJX60+1/+Wd5APobyZRioXzD1xveFIMToTvpXQ=";
   };
 
   nativeBuildInputs = [
@@ -34,19 +36,21 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtsvg
-    qtx11extras
     kwindowsystem
+    layer-shell-qt
     liblxqt
     libqtxdg
     lxqt-globalkeys
     menu-cache
     muparser
     pcre
+    qtbase
+    qtsvg
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/lxqt-session/default.nix b/pkgs/desktops/lxqt/lxqt-session/default.nix
index 421d166734f1b..2fe8de9eef548 100644
--- a/pkgs/desktops/lxqt/lxqt-session/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-session/default.nix
@@ -1,32 +1,35 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
-, lxqt-build-tools
-, qtbase
-, qttools
-, qtsvg
-, qtx11extras
 , kwindowsystem
+, layer-shell-qt
+, libXdmcp
 , liblxqt
+, libpthreadstubs
 , libqtxdg
-, qtxdg-tools
+, lxqt-build-tools
+, pkg-config
 , procps
-, xorg
+, qtbase
+, qtsvg
+, qttools
+, qtwayland
+, qtxdg-tools
+, wrapQtAppsHook
 , xdg-user-dirs
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-session";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-kVDPJPYBwK7aXCIWGClwfM9J3067U8lPVWt0jFfqooY=";
+    hash = "sha256-IgpGtIVTcSs0O3jEniIuyIAyKBSkwN/jpGL6yZg3AVo=";
   };
 
   nativeBuildInputs = [
@@ -34,19 +37,21 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtsvg
-    qtx11extras
     kwindowsystem
+    layer-shell-qt
+    libXdmcp
     liblxqt
+    libpthreadstubs
     libqtxdg
-    qtxdg-tools
     procps
-    xorg.libpthreadstubs
-    xorg.libXdmcp
+    qtbase
+    qtsvg
+    qtwayland
+    qtxdg-tools
     xdg-user-dirs
   ];
 
diff --git a/pkgs/desktops/lxqt/lxqt-sudo/default.nix b/pkgs/desktops/lxqt/lxqt-sudo/default.nix
index 73794bad7a1fc..f1fc740c7186b 100644
--- a/pkgs/desktops/lxqt/lxqt-sudo/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-sudo/default.nix
@@ -1,43 +1,45 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, lxqt-build-tools
-, qtbase
-, qttools
-, qtx11extras
-, qtsvg
 , kwindowsystem
 , liblxqt
 , libqtxdg
+, lxqt-build-tools
+, qtbase
+, qtsvg
+, qttools
+, qtwayland
 , sudo
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-sudo";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-J7jiap3qZD+P0kGzt+b3wa16pxbS2fr3OmalhV5O9ro=";
+    hash = "sha256-kDcOHqHuAyHTQ7ccsCelPOBieXdRLloEvSMjq9PIa30=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtx11extras
-    qtsvg
     kwindowsystem
     liblxqt
     libqtxdg
+    qtbase
+    qtsvg
+    qtwayland
     sudo
   ];
 
diff --git a/pkgs/desktops/lxqt/lxqt-themes/default.nix b/pkgs/desktops/lxqt/lxqt-themes/default.nix
index a9a957091df44..f4283c1927ea8 100644
--- a/pkgs/desktops/lxqt/lxqt-themes/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-themes/default.nix
@@ -1,20 +1,20 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , lxqt-build-tools
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "lxqt-themes";
-  version = "1.3.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-bmkvg62lNFRhSerKFSo2POP8MWa1ZrdSi2E9nWDQSRQ=";
+    hash = "sha256-bAdwC1YrXCT4eJUafTK6kcfQ/YnMbBLHyyWvsBLIisA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lxqt/obconf-qt/default.nix b/pkgs/desktops/lxqt/obconf-qt/default.nix
index fc0a0ddd076d4..bf4d89a1e020f 100644
--- a/pkgs/desktops/lxqt/obconf-qt/default.nix
+++ b/pkgs/desktops/lxqt/obconf-qt/default.nix
@@ -1,19 +1,23 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
-, pkg-config
+, libSM
+, libXdmcp
+, libpthreadstubs
+, lxqt-build-tools
+, openbox
 , pcre
+, pkg-config
 , qtbase
 , qttools
-, qtx11extras
-, xorg
-, lxqt-build-tools
-, openbox
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "obconf-qt";
   version = "0.16.4";
 
@@ -29,16 +33,25 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
+    libSM
+    libXdmcp
+    libpthreadstubs
+    openbox
     pcre
     qtbase
-    qtx11extras
-    xorg.libpthreadstubs
-    xorg.libXdmcp
-    xorg.libSM
-    openbox
+    qtwayland
+  ];
+
+  patches = [
+    (fetchpatch {
+      name = "obconf-qt.port-to-qt6";
+      url = "https://patch-diff.githubusercontent.com/raw/lxqt/obconf-qt/pull/230.patch";
+      hash = "sha256-XLt8+/4oMXeli07qTAGc73U9RD1fGYqxTX0QdhuXpII=";
+    })
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/pavucontrol-qt/default.nix b/pkgs/desktops/lxqt/pavucontrol-qt/default.nix
index 6703ed1154fc4..1ddb787309eee 100644
--- a/pkgs/desktops/lxqt/pavucontrol-qt/default.nix
+++ b/pkgs/desktops/lxqt/pavucontrol-qt/default.nix
@@ -1,24 +1,26 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
-, lxqt-build-tools
 , libpulseaudio
+, lxqt-build-tools
+, pkg-config
 , qtbase
 , qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "pavucontrol-qt";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-eNhoqY1pak96x0xCypvgHmgCYjw4CYH8ABtWjIZrD3w=";
+    hash = "sha256-dhFVVqJIX40oiHCcnG1166RsllXtfaO7MqM6ZNizjQQ=";
   };
 
   nativeBuildInputs = [
@@ -26,11 +28,13 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
     libpulseaudio
+    qtbase
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/pcmanfm-qt/default.nix b/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
index 3d8efb1e9f0a0..466c365d2c3b9 100644
--- a/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
@@ -1,29 +1,31 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
+, layer-shell-qt
 , libexif
+, libfm-qt
 , lxqt-build-tools
 , lxqt-menu-data
+, menu-cache
+, pkg-config
 , qtbase
-, qttools
-, qtx11extras
 , qtimageformats
-, libfm-qt
-, menu-cache
+, qttools
+, qtwayland
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "pcmanfm-qt";
-  version = "1.4.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-Z3OivGlUZQVoeMWn8ZBvhajH5hrvVMIsjGKcrx5FkEE=";
+    hash = "sha256-PyCtcn+QHwX/iy85A3y7Phf8ogdSRrwtXrJYGxrjyLM=";
   };
 
   nativeBuildInputs = [
@@ -31,22 +33,24 @@ mkDerivation rec {
     pkg-config
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
+    layer-shell-qt
     libexif
+    libfm-qt
     lxqt-menu-data
+    menu-cache
     qtbase
-    qtx11extras
     qtimageformats # add-on module to support more image file formats
-    libfm-qt
-    menu-cache
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
 
   postPatch = ''
-    substituteInPlace config/pcmanfm-qt/lxqt/settings.conf.in --replace @LXQT_SHARE_DIR@ /run/current-system/sw/share/lxqt
+    substituteInPlace config/pcmanfm-qt/lxqt/settings.conf.in --replace-fail @LXQT_SHARE_DIR@ /run/current-system/sw/share/lxqt
   '';
 
   meta = with lib; {
diff --git a/pkgs/desktops/lxqt/qlipper/default.nix b/pkgs/desktops/lxqt/qlipper/default.nix
index 5ebb69a861c05..7ae58dadd84f3 100644
--- a/pkgs/desktops/lxqt/qlipper/default.nix
+++ b/pkgs/desktops/lxqt/qlipper/default.nix
@@ -1,13 +1,14 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , qtbase
 , qttools
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qlipper";
   version = "5.1.2";
 
@@ -21,6 +22,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     cmake
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/lxqt/qps/default.nix b/pkgs/desktops/lxqt/qps/default.nix
index f04b2e595862d..a162c7f21d440 100644
--- a/pkgs/desktops/lxqt/qps/default.nix
+++ b/pkgs/desktops/lxqt/qps/default.nix
@@ -1,32 +1,35 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , kwindowsystem
 , liblxqt
 , libqtxdg
 , lxqt-build-tools
-, gitUpdater
 , qtbase
+, qtsvg
 , qttools
-, qtx11extras
+, qtwayland
+, wrapQtAppsHook
+, gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qps";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-Xr+61t6LzoXASHuXrE5ro3eWGxMSDCVnck49dCtiaww=";
+    hash = "sha256-Jit1CdFZyhKOjNytTBH9T4NqqmhxoifXGgPUyVdzJ+4=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -34,7 +37,8 @@ mkDerivation rec {
     liblxqt
     libqtxdg
     qtbase
-    qtx11extras
+    qtsvg
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/qterminal/default.nix b/pkgs/desktops/lxqt/qterminal/default.nix
index 8a47980d67b72..720f3ad7e8e44 100644
--- a/pkgs/desktops/lxqt/qterminal/default.nix
+++ b/pkgs/desktops/lxqt/qterminal/default.nix
@@ -1,17 +1,18 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , lxqt-build-tools
-, qtermwidget
 , qtbase
+, qtermwidget
 , qttools
 , qtx11extras
+, wrapQtAppsHook
 , gitUpdater
 , nixosTests
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qterminal";
   version = "1.4.0";
 
@@ -26,12 +27,13 @@ mkDerivation rec {
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
     qtbase
-    qtx11extras
     qtermwidget
+    qtx11extras
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/qtermwidget/default.nix b/pkgs/desktops/lxqt/qtermwidget/default.nix
index e92df23f2d5f9..d8e168af562fb 100644
--- a/pkgs/desktops/lxqt/qtermwidget/default.nix
+++ b/pkgs/desktops/lxqt/qtermwidget/default.nix
@@ -1,15 +1,15 @@
 { stdenv
 , lib
-, mkDerivation
 , fetchFromGitHub
 , cmake
 , qtbase
 , qttools
 , lxqt-build-tools
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qtermwidget";
   version = "1.4.0";
 
@@ -24,6 +24,7 @@ mkDerivation rec {
     cmake
     lxqt-build-tools
     qttools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/lxqt/qtxdg-tools/default.nix b/pkgs/desktops/lxqt/qtxdg-tools/default.nix
index 06374affdaacc..5243b6e6ef22f 100644
--- a/pkgs/desktops/lxqt/qtxdg-tools/default.nix
+++ b/pkgs/desktops/lxqt/qtxdg-tools/default.nix
@@ -1,32 +1,36 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, qtbase
 , libqtxdg
 , lxqt-build-tools
+, qtbase
+, qtsvg
+, wrapQtAppsHook
 , gitUpdater
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qtxdg-tools";
-  version = "3.12.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-3i5SVhEMHar09xoSfVCxJtPXeR81orcNR7pSIJImipQ=";
+    hash = "sha256-w9pFHG+q2oT33Lfg88MUzfWSyvHUgC0Fi2V8XcueJ/Q=";
   };
 
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
     libqtxdg
+    qtbase
+    qtsvg
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/screengrab/default.nix b/pkgs/desktops/lxqt/screengrab/default.nix
index d2c00bebef011..a7e65d746b609 100644
--- a/pkgs/desktops/lxqt/screengrab/default.nix
+++ b/pkgs/desktops/lxqt/screengrab/default.nix
@@ -1,29 +1,30 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
-, qtbase
-, qttools
-, qtx11extras
-, qtsvg
+, autoPatchelfHook
+, gitUpdater
 , kwindowsystem
+, libXdmcp
+, libpthreadstubs
 , libqtxdg
 , perl
-, xorg
-, autoPatchelfHook
-, gitUpdater
+, pkg-config
+, qtbase
+, qtsvg
+, qttools
+, wrapQtAppsHook
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "screengrab";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-mmN3BQum7X0GWTUYauEN2mAo3GWdmtkIl2i84g5cp78=";
+    hash = "sha256-PMe2NyIoc12n4l/oWPi3GL6pemuHyxL2HFBLTIyD690=";
   };
 
   nativeBuildInputs = [
@@ -32,16 +33,16 @@ mkDerivation rec {
     perl # needed by LXQtTranslateDesktop.cmake
     qttools
     autoPatchelfHook # fix libuploader.so and libextedit.so not found
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
-    qtx11extras
-    qtsvg
     kwindowsystem
+    libXdmcp
+    libpthreadstubs
     libqtxdg
-    xorg.libpthreadstubs
-    xorg.libXdmcp
+    qtbase
+    qtsvg
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix b/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
index 622a445bb9fdd..6f668abb7ea5f 100644
--- a/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
+++ b/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
@@ -1,5 +1,5 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , kwindowsystem
@@ -7,24 +7,26 @@
 , libfm-qt
 , lxqt-qtplugin
 , menu-cache
-, qtx11extras
+, qtbase
+, wrapQtAppsHook
 , gitUpdater
 , extraQtStyles ? []
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-lxqt";
-  version = "0.5.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-6yfLjDK8g8cpeeyuFUEjERTLLn6h3meKjD2Eb7Cj9qY=";
+    hash = "sha256-JSbFZ7R1Cu5VPPb50fRVSAsaE0LE15BbbHpvJZP6+w0=";
   };
 
   nativeBuildInputs = [
     cmake
+    wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -33,7 +35,7 @@ mkDerivation rec {
     libfm-qt
     lxqt-qtplugin
     menu-cache
-    qtx11extras
+    qtbase
   ]
   ++ extraQtStyles;
 
diff --git a/pkgs/development/compilers/cakelisp/default.nix b/pkgs/development/compilers/cakelisp/default.nix
index 1dffc52f7576f..c71f2dd48e21c 100644
--- a/pkgs/development/compilers/cakelisp/default.nix
+++ b/pkgs/development/compilers/cakelisp/default.nix
@@ -3,12 +3,12 @@
 stdenv.mkDerivation {
   pname = "cakelisp";
   # using unstable as it's the only version that builds against gcc-13
-  version = "0.3.0-unstable-2024-04-01";
+  version = "0.3.0-unstable-2024-04-18";
 
   src = fetchgit {
     url = "https://macoy.me/code/macoy/cakelisp";
-    rev = "7f09a08623f4141d3c2940bca3e8ea646a7049cc";
-    hash = "sha256-5ey2j38bhoRADMFcTGcUiOHE/UlU2mPGqzfv7dEk6oQ=";
+    rev = "115ab436056602b7f3a1ca30be40edbfcc88299d";
+    hash = "sha256-rgBtT24aopXLTeDffjXGvJ3RgT+QLlr50Ju9a6ccyzc=";
   };
 
   buildInputs = [ gcc ];
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index aed2ede3e0c60..58174f3fde0ad 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -17,12 +17,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.72.0";
+  version = "1.73.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-Jy+/nwb1CkbNjS0mZ244hG0Rzb/2QRYXrlki4yWZ1lk=";
+    hash = "sha256-C50PiToXrKf94Vg1yv++3xVhIuCW/KVPs0yLv5Fg0dY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/compilers/crystal/build-package.nix b/pkgs/development/compilers/crystal/build-package.nix
index cb5869392b6b9..536ad3acda7b5 100644
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@@ -26,6 +26,9 @@
   # The default `crystal build` options can be overridden with { foo.options = [ "--optionname" ]; }
 , crystalBinaries ? { }
 , enableParallelBuilding ? true
+  # Copy all shards dependencies instead of symlinking and add write permissions
+  # to make environment more local-like
+, copyShardDeps ? false
 , ...
 }@args:
 
@@ -78,7 +81,8 @@ stdenv.mkDerivation (mkDerivationArgs // {
       ++ lib.optional (lockFile != null) "cp ${lockFile} ./shard.lock"
       ++ lib.optionals (shardsFile != null) [
         "test -e lib || mkdir lib"
-        "for d in ${crystalLib}/*; do ln -s $d lib/; done"
+        (if copyShardDeps then "for d in ${crystalLib}/*; do cp -r $d/ lib/; done; chmod -R +w lib/"
+          else "for d in ${crystalLib}/*; do ln -s $d lib/; done")
         "cp shard.lock lib/.shards.info"
       ]
       ++ [ "runHook postConfigure" ]
diff --git a/pkgs/development/compilers/gcc/common/meta.nix b/pkgs/development/compilers/gcc/common/meta.nix
index 84c3dc189b1fa..a578705a66ec2 100644
--- a/pkgs/development/compilers/gcc/common/meta.nix
+++ b/pkgs/development/compilers/gcc/common/meta.nix
@@ -1,6 +1,15 @@
 { lib, version, }:
 
-with lib; {
+let
+  inherit (lib)
+    licenses
+    maintainers
+    platforms
+    teams
+    versionOlder
+    ;
+in
+{
   homepage = "https://gcc.gnu.org/";
   license = licenses.gpl3Plus; # runtime support libraries are typically LGPLv3+
   description = "GNU Compiler Collection, version ${version}";
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index 0144ab4cfff9b..c3a0efe6aaa11 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
+{ lib, stdenv, targetPackages, fetchurl, fetchpatch, fetchFromGitHub, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
 , langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
@@ -48,19 +48,37 @@
 }:
 
 let
-  versions = import ./versions.nix;
-  version = versions.fromMajorMinor majorMinorVersion;
-
-  majorVersion = lib.versions.major version;
-  atLeast13 = lib.versionAtLeast version "13";
-  atLeast12 = lib.versionAtLeast version "12";
-  atLeast11 = lib.versionAtLeast version "11";
-  atLeast10 = lib.versionAtLeast version "10";
-  atLeast9  = lib.versionAtLeast version  "9";
-  atLeast8  = lib.versionAtLeast version  "8";
-  atLeast7  = lib.versionAtLeast version  "7";
-  atLeast6  = lib.versionAtLeast version  "6";
-  atLeast49 = lib.versionAtLeast version  "4.9";
+  inherit (lib)
+    callPackageWith
+    filter
+    getBin
+    maintainers
+    makeLibraryPath
+    makeSearchPathOutput
+    mapAttrs
+    optional
+    optionalAttrs
+    optionals
+    optionalString
+    pipe
+    platforms
+    versionAtLeast
+    versions
+    ;
+
+  gccVersions = import ./versions.nix;
+  version = gccVersions.fromMajorMinor majorMinorVersion;
+
+  majorVersion = versions.major version;
+  atLeast13 = versionAtLeast version "13";
+  atLeast12 = versionAtLeast version "12";
+  atLeast11 = versionAtLeast version "11";
+  atLeast10 = versionAtLeast version "10";
+  atLeast9  = versionAtLeast version  "9";
+  atLeast8  = versionAtLeast version  "8";
+  atLeast7  = versionAtLeast version  "7";
+  atLeast6  = versionAtLeast version  "6";
+  atLeast49 = versionAtLeast version  "4.9";
   is13 = majorVersion == "13";
   is12 = majorVersion == "12";
   is11 = majorVersion == "11";
@@ -69,37 +87,9 @@ let
   is8  = majorVersion == "8";
   is7  = majorVersion == "7";
   is6  = majorVersion == "6";
-  is49 = majorVersion == "4" && lib.versions.minor version == "9";
-  is48 = majorVersion == "4" && lib.versions.minor version == "8";
-in
-
-# We enable the isl cloog backend.
-assert !atLeast6 -> (cloog != null -> isl != null);
-
-assert langJava -> !atLeast7 && zip != null && unzip != null && zlib != null && boehmgc != null && perl != null;  # for `--enable-java-home'
-
-# Make sure we get GNU sed.
-assert stdenv.buildPlatform.isDarwin -> gnused != null;
-
-# The go frontend is written in c++
-assert langGo -> langCC;
-assert (atLeast6 && !is7 && !is8) -> (langAda -> gnat-bootstrap != null);
-
-# TODO: fixup D bootstapping, probably by using gdc11 (and maybe other changes).
-#   error: GDC is required to build d
-assert atLeast12 -> !langD;
-
-# threadsCross is just for MinGW
-assert threadsCross != {} -> stdenv.targetPlatform.isWindows;
-
-# profiledCompiler builds inject non-determinism in one of the compilation stages.
-# If turned on, we can't provide reproducible builds anymore
-assert reproducibleBuild -> profiledCompiler == false;
-
-with lib;
-with builtins;
+  is49 = majorVersion == "4" && versions.minor version == "9";
+  is48 = majorVersion == "4" && versions.minor version == "8";
 
-let inherit version;
     disableBootstrap = atLeast11 && !stdenv.hostPlatform.isDarwin && (atLeast12 -> !profiledCompiler);
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -117,7 +107,7 @@ let inherit version;
       libX11 libXt libSM libICE libXtst libXrender libXrandr libXi
       xorgproto
     ];
-    callFile = lib.callPackageWith ({
+    callFile = callPackageWith ({
       # lets
       inherit
         majorVersion
@@ -182,7 +172,7 @@ let inherit version;
         zip
         zlib
       ;
-    } // lib.optionalAttrs (!atLeast7) {
+    } // optionalAttrs (!atLeast7) {
       inherit
         boehmgc
         flex
@@ -225,10 +215,33 @@ let inherit version;
 
 in
 
+# We enable the isl cloog backend.
+assert !atLeast6 -> (cloog != null -> isl != null);
+
+assert langJava -> !atLeast7 && zip != null && unzip != null && zlib != null && boehmgc != null && perl != null;  # for `--enable-java-home'
+
+# Make sure we get GNU sed.
+assert stdenv.buildPlatform.isDarwin -> gnused != null;
+
+# The go frontend is written in c++
+assert langGo -> langCC;
+assert (atLeast6 && !is7 && !is8) -> (langAda -> gnat-bootstrap != null);
+
+# TODO: fixup D bootstapping, probably by using gdc11 (and maybe other changes).
+#   error: GDC is required to build d
+assert atLeast12 -> !langD;
+
+# threadsCross is just for MinGW
+assert threadsCross != {} -> stdenv.targetPlatform.isWindows;
+
+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 # We need all these X libraries when building AWT with GTK.
 assert !atLeast7 -> (x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == []);
 
-lib.pipe ((callFile ./common/builder.nix {}) ({
+pipe ((callFile ./common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
@@ -249,14 +262,14 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
           then "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz"
           else "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
     ${if is10 || is11 || is13 then "hash" else "sha256"} =
-      versions.srcHashForVersion version;
+      gccVersions.srcHashForVersion version;
   };
 
   inherit patches;
 
   outputs =
     if atLeast7
-    then [ "out" "man" "info" ] ++ lib.optional (!langJit) "lib"
+    then [ "out" "man" "info" ] ++ optional (!langJit) "lib"
     else if atLeast49 && (langJava || langGo || (if atLeast6 then langJit else targetPlatform.isDarwin)) then ["out" "man" "info"]
     else [ "out" "lib" "man" "info" ];
 
@@ -265,9 +278,9 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
   libc_dev = stdenv.cc.libc_dev;
 
   hardeningDisable = [ "format" "pie" ]
-  ++ lib.optionals (is11 && langAda) [ "fortify3" ];
+  ++ optionals (is11 && langAda) [ "fortify3" ];
 
-  postPatch = lib.optionalString atLeast7 ''
+  postPatch = optionalString atLeast7 ''
     configureScripts=$(find . -name configure)
     for configureScript in $configureScripts; do
       patchShebangs $configureScript
@@ -275,8 +288,8 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
   ''
   # This should kill all the stdinc frameworks that gcc and friends like to
   # insert into default search paths.
-  + lib.optionalString (atLeast6 && hostPlatform.isDarwin) ''
-    substituteInPlace gcc/config/darwin-c.c${lib.optionalString atLeast12 "c"} \
+  + optionalString (atLeast6 && hostPlatform.isDarwin) ''
+    substituteInPlace gcc/config/darwin-c.c${optionalString atLeast12 "c"} \
       --replace 'if (stdinc)' 'if (0)'
 
     substituteInPlace libgcc/config/t-slibgcc-darwin \
@@ -286,7 +299,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
       --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
   ''
   + (
-    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
+    optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
       (let
@@ -296,18 +309,18 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
         '' echo "fixing the {GLIBC,UCLIBC,MUSL}_DYNAMIC_LINKER macros..."
            for header in "gcc/config/"*-gnu.h "gcc/config/"*"/"*.h
            do
-             grep -q ${lib.optionalString (!atLeast6) "LIBC"}_DYNAMIC_LINKER "$header" || continue
+             grep -q ${optionalString (!atLeast6) "LIBC"}_DYNAMIC_LINKER "$header" || continue
              echo "  fixing $header..."
              sed -i "$header" \
                  -e 's|define[[:blank:]]*\([UCG]\+\)LIBC_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define \1LIBC_DYNAMIC_LINKER\2 "${libc.out}\3"|g' \
                  -e 's|define[[:blank:]]*MUSL_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define MUSL_DYNAMIC_LINKER\1 "${libc.out}\2"|g'
              done
-        '' + lib.optionalString (atLeast6 && targetPlatform.libc == "musl") ''
+        '' + optionalString (atLeast6 && targetPlatform.libc == "musl") ''
            sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
         )
     ))
-      + lib.optionalString (atLeast7 && targetPlatform.isAvr) (''
+      + optionalString (atLeast7 && targetPlatform.isAvr) (''
             makeFlagsArray+=(
                '-s' # workaround for hitting hydra log limit
                'LIMITS_H_TEST=false'
@@ -319,7 +332,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
 
   inherit (callFile ./common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  preConfigure = (callFile ./common/pre-configure.nix { }) + lib.optionalString atLeast10 ''
+  preConfigure = (callFile ./common/pre-configure.nix { }) + optionalString atLeast10 ''
     ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
   '';
 
@@ -338,9 +351,9 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
     assert atLeast12 -> (profiledCompiler -> !disableBootstrap);
     if atLeast11
     then let target =
-               lib.optionalString (profiledCompiler) "profiled" +
-               lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
-         in lib.optional (target != "") target
+               optionalString (profiledCompiler) "profiled" +
+               optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+         in optional (target != "") target
     else
       optional
         (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
@@ -394,24 +407,24 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
       EXTRA_LDFLAGS_FOR_TARGET
       ;
   } // optionalAttrs is7 {
-    NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument"
+    NIX_CFLAGS_COMPILE = optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument"
       # Downgrade register storage class specifier errors to warnings when building a cross compiler from a clang stdenv.
-      + lib.optionalString (stdenv.cc.isClang && targetPlatform != hostPlatform) " -Wno-register";
+      + optionalString (stdenv.cc.isClang && targetPlatform != hostPlatform) " -Wno-register";
   } // optionalAttrs (!is7 && !atLeast12 && stdenv.cc.isClang && targetPlatform != hostPlatform) {
     NIX_CFLAGS_COMPILE = "-Wno-register";
   } // optionalAttrs (!atLeast7) {
     inherit langJava;
   } // optionalAttrs atLeast6 {
-    NIX_LDFLAGS = lib.optionalString hostPlatform.isSunOS "-lm";
+    NIX_LDFLAGS = optionalString hostPlatform.isSunOS "-lm";
   });
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
     isGNU = true;
-    hardeningUnsupportedFlags = lib.optional is48 "stackprotector"
-      ++ lib.optional (!atLeast11) "zerocallusedregs"
-      ++ lib.optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
-      ++ lib.optionals (langFortran) [ "fortify" "format" ];
+    hardeningUnsupportedFlags = optional is48 "stackprotector"
+      ++ optional (!atLeast11) "zerocallusedregs"
+      ++ optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
+      ++ optionals (langFortran) [ "fortify" "format" ];
   };
 
   enableParallelBuilding = true;
@@ -426,19 +439,19 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
       platforms
       maintainers
     ;
-  } // lib.optionalAttrs (!atLeast11) {
+  } // optionalAttrs (!atLeast11) {
     badPlatforms =
       # avr-gcc8 is maintained for the `qmk` package
       if (is8 && targetPlatform.isAvr) then []
       else if !(is48 || is49) then [ "aarch64-darwin" ]
-      else lib.platforms.darwin;
-  } // lib.optionalAttrs is11 {
+      else platforms.darwin;
+  } // optionalAttrs is11 {
     badPlatforms = if targetPlatform != hostPlatform then [ "aarch64-darwin" ] else [ ];
   };
-} // lib.optionalAttrs (!atLeast10 && stdenv.targetPlatform.isDarwin) {
+} // optionalAttrs (!atLeast10 && stdenv.targetPlatform.isDarwin) {
   # GCC <10 requires default cctools `strip` instead of `llvm-strip` used by Darwin bintools.
   preBuild = ''
-    makeFlagsArray+=('STRIP=${lib.getBin darwin.cctools-port}/bin/${stdenv.cc.targetPrefix}strip')
+    makeFlagsArray+=('STRIP=${getBin darwin.cctools-port}/bin/${stdenv.cc.targetPrefix}strip')
   '';
 } // optionalAttrs (!atLeast8) {
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
diff --git a/pkgs/development/compilers/gnat-bootstrap/default.nix b/pkgs/development/compilers/gnat-bootstrap/default.nix
index 162518adb56b0..d59a6b4f51fbd 100644
--- a/pkgs/development/compilers/gnat-bootstrap/default.nix
+++ b/pkgs/development/compilers/gnat-bootstrap/default.nix
@@ -67,8 +67,9 @@ in {
     zlib
   ] ++ lib.optionals stdenv.buildPlatform.isLinux [
     autoPatchelfHook
-    elfutils
     glibc
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.buildPlatform elfutils) [
+    elfutils
   ];
 
   postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin) ''
diff --git a/pkgs/development/compilers/go/1.22.nix b/pkgs/development/compilers/go/1.22.nix
index 84a72ac562257..6a3cfd39203d5 100644
--- a/pkgs/development/compilers/go/1.22.nix
+++ b/pkgs/development/compilers/go/1.22.nix
@@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.22.1";
+  version = "1.22.2";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-ecm5HX8QlRWiX8Ps2q0SXWfmvbVPbU2YWA9GeZyuoyE=";
+    hash = "sha256-N06oKyiexzjpaCZ8rFnH1f8YD5SSJQJUeEsgROkN9ak=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
index 1d76cfdbdd80c..e48736559fb5b 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
@@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "24.0.0";
+  "version" = "24.0.1";
   "hashes" = {
     "aarch64-linux" = {
-      sha256 = "1hz56nvl7av3xvwm7bxrzyri289h6hbawxsacn4zr7nm1snjn7i0";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.0/graalpy-community-24.0.0-linux-aarch64.tar.gz";
+      sha256 = "09zrp1l80294p4dzkfcvabs7l2hbs6500j1cibhdphcghjwip2l7";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.1/graalpy-community-24.0.1-linux-aarch64.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "1ngqwrx1bc22jm12gmwqmqjfhhccpim1pai6885vg5xqsvc94y57";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.0/graalpy-community-24.0.0-linux-amd64.tar.gz";
+      sha256 = "06m4dw0mnhlnm764xzip3nxzzs8yxbbps2f1cs75zfyakmhpa5c2";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.1/graalpy-community-24.0.1-linux-amd64.tar.gz";
     };
     "x86_64-darwin" = {
-      sha256 = "07bh2fgk3l7vpws91ah48dsbrvvlq8wzfq88wq6ywilbikmnp0bw";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.0/graalpy-community-24.0.0-macos-amd64.tar.gz";
+      sha256 = "0x36l03fqkrjdazv4q50dpilx8y0jr27wsgvy8wqbdzjvbcf7rd4";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.1/graalpy-community-24.0.1-macos-amd64.tar.gz";
     };
     "aarch64-darwin" = {
-      sha256 = "00kljb24835l51jrnzdfblbhf2psdfw3wg00rllcdhpmiji40mbz";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.0/graalpy-community-24.0.0-macos-aarch64.tar.gz";
+      sha256 = "1mgpspjxs1s8rzsyw760xlm21zlx7gflgqvcslw3xfq59bf76npw";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.1/graalpy-community-24.0.1-macos-aarch64.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix
index 40e44e22954de..40d3832675b17 100644
--- a/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix
@@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "24.0.0";
+  "version" = "24.0.1";
   "hashes" = {
     "aarch64-linux" = {
-      sha256 = "0nq2wnc7kb3x37m68b2ylay6c341fzv4453k150a47fnj0p4d85p";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.0/truffleruby-community-24.0.0-linux-aarch64.tar.gz";
+      sha256 = "145199fv1kpf992gvidcbs0zs2950gbbvmm8qg17sbi8fg1ggqkq";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.1/truffleruby-community-24.0.1-linux-aarch64.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "1h8zqf9clxg3azma86gdm6yl8mif2sgmyhnvqdilap28vmj4mpns";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.0/truffleruby-community-24.0.0-linux-amd64.tar.gz";
+      sha256 = "06vc8ym8bwyw057i4bjybbi92af8v3ic2yq4n1fms374n3iism4a";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.1/truffleruby-community-24.0.1-linux-amd64.tar.gz";
     };
     "x86_64-darwin" = {
-      sha256 = "03c4bxdzdz5m7n1kkmzsb8x0m1h4ms6ah29p9m4wrz8pjsb8682l";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.0/truffleruby-community-24.0.0-macos-amd64.tar.gz";
+      sha256 = "0q419zpa02zlmf5lgmn9a12wlizm83d3ikwjzayp2h6mrg8zv825";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.1/truffleruby-community-24.0.1-macos-amd64.tar.gz";
     };
     "aarch64-darwin" = {
-      sha256 = "0ph6ki66w4kqwnznbpgfd8k85xx6cgqslzy07v4sywhp9k246qld";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.0/truffleruby-community-24.0.0-macos-aarch64.tar.gz";
+      sha256 = "02ri76ain3vjg3d0v8jf7ii0b0ppmqq7nbc73mvzvg7hl3hxlir7";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.1/truffleruby-community-24.0.1-macos-aarch64.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/ligo/default.nix b/pkgs/development/compilers/ligo/default.nix
index 9443f7a8cc08b..9b57fd0a2e257 100644
--- a/pkgs/development/compilers/ligo/default.nix
+++ b/pkgs/development/compilers/ligo/default.nix
@@ -15,12 +15,12 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "ligo";
-  version = "1.4.0";
+  version = "1.6.0";
   src = fetchFromGitLab {
     owner = "ligolang";
     repo = "ligo";
     rev = version;
-    sha256 = "sha256-N2RkeKJ+lEyNJwpmF5sORmOkDhNmTYRYAgvyR7Pc5EI=";
+    hash = "sha256-ZPHOgozuUij9+4YXZTnn1koddQEQZe/yrpb+OPHO+nA=";
     fetchSubmodules = true;
   };
 
@@ -30,8 +30,6 @@ ocamlPackages.buildDunePackage rec {
   # This is a hack to work around the hack used in the dune files
   OPAM_SWITCH_PREFIX = "${tezos-rust-libs}";
 
-  strictDeps = true;
-
   nativeBuildInputs = [
     ocaml-crunch
     git
@@ -98,7 +96,7 @@ ocamlPackages.buildDunePackage rec {
     bls12-381
     bls12-381-signature
     ptime
-    mtime_1
+    mtime
     lwt_log
     secp256k1-internal
     resto
@@ -112,6 +110,7 @@ ocamlPackages.buildDunePackage rec {
     simple-diff
     seqes
     stdint
+    tezt
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
   ];
diff --git a/pkgs/development/compilers/llvm/17/llvm/default.nix b/pkgs/development/compilers/llvm/17/llvm/default.nix
index ec2edabe4ec5f..a045bea9f4728 100644
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/17/llvm/default.nix
@@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
diff --git a/pkgs/development/compilers/llvm/18/llvm/default.nix b/pkgs/development/compilers/llvm/18/llvm/default.nix
index 670171a707f9c..a9732763e9d7b 100644
--- a/pkgs/development/compilers/llvm/18/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/18/llvm/default.nix
@@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
diff --git a/pkgs/development/compilers/llvm/common/libcxx/default.nix b/pkgs/development/compilers/llvm/common/libcxx/default.nix
index de895125f8832..0e91f50551c55 100644
--- a/pkgs/development/compilers/llvm/common/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/common/libcxx/default.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation (rec {
   # libc++.so.1 and libc++abi.so or the external cxxabi. ld-wrapper doesn't
   # support linker scripts so the external cxxabi needs to be symlinked in
   postInstall = lib.optionalString (cxxabi != null) ''
-    lndir ${lib.getDev cxxabi}/include $out/include/c++/v1
+    lndir ${lib.getDev cxxabi}/include $dev/include/c++/v1
     lndir ${lib.getLib cxxabi}/lib $out/lib
   '';
 
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index a9987ab2426d2..8987103e22fe5 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
diff --git a/pkgs/development/compilers/nasm/default.nix b/pkgs/development/compilers/nasm/default.nix
index b9f0e856f65c1..64abd3a1e322d 100644
--- a/pkgs/development/compilers/nasm/default.nix
+++ b/pkgs/development/compilers/nasm/default.nix
@@ -1,12 +1,17 @@
-{ lib, stdenv, fetchurl, perl }:
+{ lib
+, stdenv
+, fetchurl
+, perl
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "nasm";
-  version = "2.16.01";
+  version = "2.16.02";
 
   src = fetchurl {
     url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-x3dF9IAjde/u4uxcCta38DfqnIfJKxSaljf/CZ8WJVg=";
+    sha256 = "sha256-HhuULqiPIu2uiWWeFb4m+gJ+rgdH9RQTVA9S1OrEeQ0=";
   };
 
   nativeBuildInputs = [ perl ];
@@ -16,10 +21,20 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   checkPhase = ''
+    runHook preCheck
+
     make golden
     make test
+
+    runHook postCheck
   '';
 
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/netwide-assembler/nasm.git";
+    rev-prefix = "nasm-";
+    ignoredVersions = "rc.*";
+  };
+
   meta = with lib; {
     homepage = "https://www.nasm.us/";
     description = "An 80x86 and x86-64 assembler designed for portability and modularity";
diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index 4d7be6c4b2825..07bee8ecd2786 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -18,11 +18,11 @@
   inherit (lib) optional optionals;
 in stdenv.mkDerivation rec {
   pname = "orc";
-  version = "0.4.36";
+  version = "0.4.38";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/orc/${pname}-${version}.tar.xz";
-    sha256 = "sha256-g7B0y2cxfVi+8ejQzIYveuinekW7/wVqH5h8ZIiy9f0=";
+    sha256 = "sha256-pVqY1HclZ6o/rtj7hNVAw9t36roW0+LhCwRPvJIoZo0=";
   };
 
   postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
diff --git a/pkgs/development/compilers/rust/1_76.nix b/pkgs/development/compilers/rust/1_77.nix
index e04939735df49..24c1b7bcb534f 100644
--- a/pkgs/development/compilers/rust/1_76.nix
+++ b/pkgs/development/compilers/rust/1_77.nix
@@ -19,8 +19,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.76.0";
-  rustcSha256 = "sha256-nlz/Azp/DSJmgYmCrZDk0+Tvj47hcVd2xuJQc6E2wCE=";
+  rustcVersion = "1.77.1";
+  rustcSha256 = "7hBuTFafUtujtbKCsQWCD4a9j2s9CcBrjc6C+xuzpKE=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
@@ -34,24 +34,24 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.75.0";
+  bootstrapVersion = "1.76.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "107b8d8825deab338f338b15f047829da6225bb34644790847e96f0957c6678f";
-    x86_64-unknown-linux-gnu = "473978b6f8ff216389f9e89315211c6b683cf95a966196e7914b46e8cf0d74f6";
-    x86_64-unknown-linux-musl = "cc6ef41aa811ab34f946fe2b4338d1107daf08642125fd566386bf45563597de";
-    arm-unknown-linux-gnueabihf = "985454b6c385cb461cc8a39d2d7d55dcf6c50495033fe5d28edcc717729d8ae9";
-    armv7-unknown-linux-gnueabihf = "bd876a75f72040d96be2fb882770b16b482ac0ab15d7e3ad24e6d25b7c74bcf7";
-    aarch64-unknown-linux-gnu = "30828cd904fcfb47f1ac43627c7033c903889ea4aca538f53dcafbb3744a9a73";
-    aarch64-unknown-linux-musl = "26b5989525b7cf623f3868a37549736e0efe1142a08f191a97e29758cc640ac4";
-    x86_64-apple-darwin = "ad066e4dec7ae5948c4e7afe68e250c336a5ab3d655570bb119b3eba9cf22851";
-    aarch64-apple-darwin = "878ecf81e059507dd2ab256f59629a4fb00171035d2a2f5638cb582d999373b1";
-    powerpc64le-unknown-linux-gnu = "2599cdfea5860b4efbceb7bca69845a96ac1c96aa50cf8261151e82280b397a0";
-    riscv64gc-unknown-linux-gnu = "7f7b73d8924d7dd24dcb2ef0da257eb48d9aed658b00fe68e8f1ade0b1ce4511";
+    i686-unknown-linux-gnu = "4c3eefc9341b8809235e6c4fbcbc19ab52a5cbe771292c400df068c12984fa3e";
+    x86_64-unknown-linux-gnu = "9d589d2036b503cc45ecc94992d616fb3deec074deb36cacc2f5c212408f7399";
+    x86_64-unknown-linux-musl = "aa8568f4d262468aaf4f622bd421c5435b24454d8fbcdae48da1162962205384";
+    arm-unknown-linux-gnueabihf = "7d1da067362fc64bcad198d90a61e024d5712aed76e17b28e1cd7e8ba263cc6f";
+    armv7-unknown-linux-gnueabihf = "c03346d56d4a860cd3a8d2d2a7ea75c510b68204e3ad97b3770076595261c913";
+    aarch64-unknown-linux-gnu = "2e8313421e8fb673efdf356cdfdd4bc16516f2610d4f6faa01327983104c05a0";
+    aarch64-unknown-linux-musl = "a1d1c8ccb8ea00cfa2b79d80411b8eb22b2bef5214f86536825361e98d7c617a";
+    x86_64-apple-darwin = "7bdbe085695df8e46389115e99eda7beed37a9494f6b961b45554c658e53b8e7";
+    aarch64-apple-darwin = "17496f15c3cb6ff73d5c36f5b54cc110f1ac31fa09521a7991c0d7ddd890dceb";
+    powerpc64le-unknown-linux-gnu = "44b3494675284d26b04747a824dc974e32fd8fd46fc0aa06a7c8ebe851332d2c";
+    riscv64gc-unknown-linux-gnu = "4a9db321874fc441235b71eb8aa295fc50251305e461540b25b4eef89fb56255";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_76;
+  selectRustPackage = pkgs: pkgs.rust_1_77;
 
   rustcPatches = [ ];
 }
diff --git a/pkgs/development/compilers/rust/cargo-auditable.nix b/pkgs/development/compilers/rust/cargo-auditable.nix
index 34d877501c3b9..1cf765b35100d 100644
--- a/pkgs/development/compilers/rust/cargo-auditable.nix
+++ b/pkgs/development/compilers/rust/cargo-auditable.nix
@@ -1,4 +1,4 @@
-{ lib, buildPackages, fetchFromGitHub, makeRustPlatform, installShellFiles, stdenv }:
+{ lib, buildPackages, fetchFromGitHub, fetchpatch, makeRustPlatform, installShellFiles, stdenv }:
 
 let
   args = rec {
@@ -12,6 +12,14 @@ let
       sha256 = "sha256-ERIzx9Fveanq7/aWcB2sviTxIahvSu0sTwgpGf/aYE8=";
     };
 
+    patches = [
+      (fetchpatch {
+        name = "rust-1.77-tests.patch";
+        url = "https://github.com/rust-secure-code/cargo-auditable/commit/5317a27244fc428335c4e7a1d066ae0f65f0d496.patch";
+        hash = "sha256-UblGseiSC/2eE4rcnTgYzxAMrutHFSdxKTHqKj1mX5o=";
+      })
+    ];
+
     cargoHash = "sha256-4o3ctun/8VcBRuj+j0Yaawdkyn6Z6LPp+FTyhPxQWU8=";
 
     # Cargo.lock is outdated
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 0a4a351b1cfda..ee4ee37dfc98b 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -93,7 +93,7 @@ in stdenv.mkDerivation (finalAttrs: {
     # attempts to download the missing source tarball
     "--set=build.rustfmt=${rustfmt}/bin/rustfmt"
   ] ++ [
-    "--tools=rustc,rust-analyzer-proc-macro-srv"
+    "--tools=rustc,rustdoc,rust-analyzer-proc-macro-srv"
     "--enable-rpath"
     "--enable-vendor"
     "--build=${stdenv.buildPlatform.rust.rustcTargetSpec}"
diff --git a/pkgs/development/compilers/zig/0.12.nix b/pkgs/development/compilers/zig/0.12.nix
new file mode 100644
index 0000000000000..e234b600bc227
--- /dev/null
+++ b/pkgs/development/compilers/zig/0.12.nix
@@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, llvmPackages
+, libxml2
+, zlib
+, coreutils
+, callPackage
+}@args:
+
+import ./generic.nix args {
+  version = "0.12.0";
+
+  hash = "sha256-RNZiUZtaKXoab5kFrDij6YCAospeVvlLWheTc3FGMks=";
+
+  outputs = [ "out" "doc" ];
+
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH
+    (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+
+    # always link against static build of LLVM
+    (lib.cmakeBool "ZIG_STATIC_LLVM" true)
+
+    # ensure determinism in the compiler build
+    (lib.cmakeFeature "ZIG_TARGET_MCPU" "baseline")
+  ];
+
+  postBuild = ''
+    stage3/bin/zig run ../tools/docgen.zig -- ../doc/langref.html.in langref.html --zig $PWD/stage3/bin/zig
+  '';
+
+  postInstall = ''
+    install -Dm444 langref.html -t $doc/share/doc/zig-$version/html
+  '';
+}
diff --git a/pkgs/development/compilers/zig/generic.nix b/pkgs/development/compilers/zig/generic.nix
index 220f3240f2852..f3c725e1e5ce0 100644
--- a/pkgs/development/compilers/zig/generic.nix
+++ b/pkgs/development/compilers/zig/generic.nix
@@ -40,7 +40,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Zig's build looks at /usr/bin/env to find dynamic linking info. This doesn't
   # work in Nix's sandbox. Use env from our coreutils instead.
-  postPatch = ''
+  postPatch = if lib.versionAtLeast args.version "0.12" then ''
+    substituteInPlace lib/std/zig/system.zig \
+      --replace "/usr/bin/env" "${coreutils}/bin/env"
+  '' else ''
     substituteInPlace lib/std/zig/system/NativeTargetInfo.zig \
       --replace "/usr/bin/env" "${coreutils}/bin/env"
   '';
diff --git a/pkgs/development/coq-modules/CoLoR/default.nix b/pkgs/development/coq-modules/CoLoR/default.nix
index e275f8be0d7d5..618ba3fd0a46e 100644
--- a/pkgs/development/coq-modules/CoLoR/default.nix
+++ b/pkgs/development/coq-modules/CoLoR/default.nix
@@ -5,13 +5,14 @@ mkCoqDerivation {
   owner = "fblanqui";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.version [
-    {case = range "8.14" "8.18"; out = "1.8.4"; }
+    {case = range "8.14" "8.19"; out = "1.8.5"; }
     {case = range "8.12" "8.16"; out = "1.8.2"; }
     {case = range "8.10" "8.11"; out = "1.7.0"; }
     {case = range "8.8"  "8.9";  out = "1.6.0"; }
     {case = range "8.6"  "8.7";  out = "1.4.0"; }
   ] null;
 
+  release."1.8.5".sha256 = "sha256-zKAyj6rKAasDF+iKExmpVHMe2WwgAwv2j1mmiVAl7ys=";
   release."1.8.4".sha256 = "sha256-WlRiaLgnFFW5AY0z6EzdP1mevNe1GHsik6wULJLN4k0=";
   release."1.8.3".sha256 = "sha256-mMUzIorkQ6WWQBJLk1ioUNwAdDdGHJyhenIvkAjALVU=";
   release."1.8.2".sha256 = "sha256:1gvx5cxm582793vxzrvsmhxif7px18h9xsb2jljy2gkphdmsnpqj";
diff --git a/pkgs/development/cuda-modules/backend-stdenv.nix b/pkgs/development/cuda-modules/backend-stdenv.nix
index 5d1c0c735806f..57219ad607c0f 100644
--- a/pkgs/development/cuda-modules/backend-stdenv.nix
+++ b/pkgs/development/cuda-modules/backend-stdenv.nix
@@ -1,11 +1,9 @@
 {
+  cudaVersion,
   lib,
   nvccCompatibilities,
-  cudaVersion,
   pkgs,
-  overrideCC,
   stdenv,
-  wrapCCWith,
   stdenvAdapters,
 }:
 
diff --git a/pkgs/development/cuda-modules/cuda-library-samples/extension.nix b/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
index 456ab8168a459..1184547c7f934 100644
--- a/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
@@ -1,5 +1,7 @@
-{ hostPlatform, lib }:
+{ lib, stdenv }:
 let
+  inherit (stdenv) hostPlatform;
+
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
   platformIsSupported = hostPlatform.isx86_64 && hostPlatform.isLinux;
diff --git a/pkgs/development/cuda-modules/cuda-library-samples/generic.nix b/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
index 4797871731b86..64131ab59b82e 100644
--- a/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
@@ -76,7 +76,7 @@ in
       # CUTENSOR_ROOT is double escaped
       postPatch = ''
         substituteInPlace CMakeLists.txt \
-          --replace "\''${CUTENSOR_ROOT}/include" "${cutensor.dev}/include"
+          --replace-fail "\''${CUTENSOR_ROOT}/include" "${cutensor.dev}/include"
       '';
 
       CUTENSOR_ROOT = cutensor;
diff --git a/pkgs/development/cuda-modules/cuda-samples/extension.nix b/pkgs/development/cuda-modules/cuda-samples/extension.nix
index d41da90cd5d0e..0a8a3f9ff6eae 100644
--- a/pkgs/development/cuda-modules/cuda-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/extension.nix
@@ -1,7 +1,7 @@
 {
   cudaVersion,
-  hostPlatform,
   lib,
+  stdenv,
 }:
 let
   cudaVersionToHash = {
@@ -23,6 +23,8 @@ let
     "12.3" = "sha256-fjVp0G6uRCWxsfe+gOwWTN+esZfk0O5uxS623u0REAk=";
   };
 
+  inherit (stdenv) hostPlatform;
+
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
   cudaVersionIsSupported = cudaVersionToHash ? ${cudaVersion};
diff --git a/pkgs/development/cuda-modules/cuda-samples/generic.nix b/pkgs/development/cuda-modules/cuda-samples/generic.nix
index a6a382c8a2195..7b3a46acea920 100644
--- a/pkgs/development/cuda-modules/cuda-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/generic.nix
@@ -11,6 +11,7 @@
   hash,
   lib,
   pkg-config,
+  stdenv,
 }:
 let
   inherit (lib) lists strings;
@@ -63,7 +64,7 @@ backendStdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 -t $out/bin bin/${backendStdenv.hostPlatform.parsed.cpu.name}/${backendStdenv.hostPlatform.parsed.kernel.name}/release/*
+    install -Dm755 -t $out/bin bin/${stdenv.hostPlatform.parsed.cpu.name}/${stdenv.hostPlatform.parsed.kernel.name}/release/*
 
     runHook postInstall
   '';
diff --git a/pkgs/development/cuda-modules/cuda/overrides.nix b/pkgs/development/cuda-modules/cuda/overrides.nix
index 9a2360d7f7c11..5d23d8f7f2a1a 100644
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@@ -1,122 +1,178 @@
-{
-  cudaVersion,
-  lib,
-  addDriverRunpath,
-}:
 let
-  inherit (lib) attrsets lists strings;
-  # cudaVersionOlder : Version -> Boolean
-  cudaVersionOlder = strings.versionOlder cudaVersion;
-  # cudaVersionAtLeast : Version -> Boolean
-  cudaVersionAtLeast = strings.versionAtLeast cudaVersion;
+  filterAndCreateOverrides =
+    createOverrideAttrs: final: prev:
+    let
+      # It is imperative that we use `final.callPackage` to perform overrides,
+      # so the final package set is available to the override functions.
+      inherit (final) callPackage;
 
-  addBuildInputs =
-    drv: buildInputs:
-    drv.overrideAttrs (prevAttrs: {
-      buildInputs = prevAttrs.buildInputs ++ buildInputs;
-    });
-in
-# NOTE: Filter out attributes that are not present in the previous version of
-# the package set. This is necessary to prevent the appearance of attributes
-# like `cuda_nvcc` in `cudaPackages_10_0, which predates redistributables.
-final: prev:
-attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
-  libcufile = prev.libcufile.overrideAttrs (prevAttrs: {
-    buildInputs = prevAttrs.buildInputs ++ [
-      final.libcublas.lib
-      final.pkgs.numactl
-      final.pkgs.rdma-core
+      # NOTE(@connorbaker): We MUST use `lib` from `prev` because the attribute
+      # names CAN NOT depend on `final`.
+      inherit (prev.lib.attrsets) filterAttrs mapAttrs;
+      inherit (prev.lib.trivial) pipe;
+
+      # NOTE: Filter out attributes that are not present in the previous version of
+      # the package set. This is necessary to prevent the appearance of attributes
+      # like `cuda_nvcc` in `cudaPackages_10_0, which predates redistributables.
+      filterOutNewAttrs = filterAttrs (name: _: prev ? ${name});
+
+      # Apply callPackage to each attribute value, yielding a value to be passed
+      # to overrideAttrs.
+      callPackageThenOverrideAttrs = mapAttrs (
+        name: value: prev.${name}.overrideAttrs (callPackage value { })
+      );
+    in
+    pipe createOverrideAttrs [
+      filterOutNewAttrs
+      callPackageThenOverrideAttrs
     ];
-    # Before 11.7 libcufile depends on itself for some reason.
-    autoPatchelfIgnoreMissingDeps =
-      prevAttrs.autoPatchelfIgnoreMissingDeps
-      ++ lists.optionals (cudaVersionOlder "11.7") [ "libcufile.so.0" ];
-  });
+in
+# Each attribute name is the name of an existing package in the previous version
+# of the package set.
+# The value is a function (to be provided to callPackage), which yields a value
+# to be provided to overrideAttrs. This allows us to override the attributes of
+# a package without losing access to the fixed point of the package set --
+# especially useful given that some packages may depend on each other!
+filterAndCreateOverrides {
+  libcufile =
+    {
+      cudaOlder,
+      lib,
+      libcublas,
+      numactl,
+      rdma-core,
+    }:
+    prevAttrs: {
+      buildInputs = prevAttrs.buildInputs ++ [
+        libcublas.lib
+        numactl
+        rdma-core
+      ];
+      # Before 11.7 libcufile depends on itself for some reason.
+      autoPatchelfIgnoreMissingDeps =
+        prevAttrs.autoPatchelfIgnoreMissingDeps
+        ++ lib.lists.optionals (cudaOlder "11.7") [ "libcufile.so.0" ];
+    };
 
-  libcusolver = addBuildInputs prev.libcusolver (
-    # Always depends on this
-    [ final.libcublas.lib ]
-    # Dependency from 12.0 and on
-    ++ lists.optionals (cudaVersionAtLeast "12.0") [ final.libnvjitlink.lib ]
-    # Dependency from 12.1 and on
-    ++ lists.optionals (cudaVersionAtLeast "12.1") [ final.libcusparse.lib ]
-  );
+  libcusolver =
+    {
+      cudaAtLeast,
+      lib,
+      libcublas,
+      libcusparse ? null,
+      libnvjitlink ? null,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # Always depends on this
+        ++ [ libcublas.lib ]
+        # Dependency from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ libnvjitlink.lib ]
+        # Dependency from 12.1 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.1") [ libcusparse.lib ];
 
-  libcusparse = addBuildInputs prev.libcusparse (
-    lists.optionals (cudaVersionAtLeast "12.0") [ final.libnvjitlink.lib ]
-  );
+      brokenConditions = prevAttrs.brokenConditions // {
+        "libnvjitlink missing (CUDA >= 12.0)" =
+          !(cudaAtLeast "12.0" -> (libnvjitlink != null && libnvjitlink.lib != null));
+        "libcusparse missing (CUDA >= 12.1)" =
+          !(cudaAtLeast "12.1" -> (libcusparse != null && libcusparse.lib != null));
+      };
+    };
+
+  libcusparse =
+    {
+      cudaAtLeast,
+      lib,
+      libnvjitlink ? null,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # Dependency from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ libnvjitlink.lib ];
+
+      brokenConditions = prevAttrs.brokenConditions // {
+        "libnvjitlink missing (CUDA >= 12.0)" =
+          !(cudaAtLeast "12.0" -> (libnvjitlink != null && libnvjitlink.lib != null));
+      };
+    };
 
-  cuda_cudart = prev.cuda_cudart.overrideAttrs (prevAttrs: {
-    # Remove once cuda-find-redist-features has a special case for libcuda
-    outputs =
-      prevAttrs.outputs
-      ++ lists.optionals (!(builtins.elem "stubs" prevAttrs.outputs)) [ "stubs" ];
+  # TODO(@connorbaker): cuda_cudart.dev depends on crt/host_config.h, which is from
+  # cuda_nvcc.dev. It would be nice to be able to encode that.
+  cuda_cudart =
+    { addDriverRunpath, lib }:
+    prevAttrs: {
+      # Remove once cuda-find-redist-features has a special case for libcuda
+      outputs =
+        prevAttrs.outputs
+        ++ lib.lists.optionals (!(builtins.elem "stubs" prevAttrs.outputs)) [ "stubs" ];
 
-    allowFHSReferences = false;
+      allowFHSReferences = false;
 
-    # The libcuda stub's pkg-config doesn't follow the general pattern:
-    postPatch =
-      prevAttrs.postPatch or ""
-      + ''
-        while IFS= read -r -d $'\0' path ; do
-          sed -i \
-            -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
-            -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
-            "$path"
-        done < <(find -iname 'cuda-*.pc' -print0)
-      ''
-      + ''
+      # The libcuda stub's pkg-config doesn't follow the general pattern:
+      postPatch =
+        prevAttrs.postPatch or ""
+        + ''
+          while IFS= read -r -d $'\0' path; do
+            sed -i \
+              -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
+              -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
+              "$path"
+          done < <(find -iname 'cuda-*.pc' -print0)
+        ''
         # Namelink may not be enough, add a soname.
         # Cf. https://gitlab.kitware.com/cmake/cmake/-/issues/25536
-        if [[ -f lib/stubs/libcuda.so && ! -f lib/stubs/libcuda.so.1 ]] ; then
-          ln -s libcuda.so lib/stubs/libcuda.so.1
-        fi
-      '';
-
-    postFixup =
-      prevAttrs.postFixup or ""
-      + ''
-        moveToOutput lib/stubs "$stubs"
-        ln -s "$stubs"/lib/stubs/* "$stubs"/lib/
-        ln -s "$stubs"/lib/stubs "''${!outputLib}/lib/stubs"
-      '';
-  });
+        + ''
+          if [[ -f lib/stubs/libcuda.so && ! -f lib/stubs/libcuda.so.1 ]]; then
+            ln -s libcuda.so lib/stubs/libcuda.so.1
+          fi
+        '';
 
-  cuda_compat = prev.cuda_compat.overrideAttrs (prevAttrs: {
-    autoPatchelfIgnoreMissingDeps = prevAttrs.autoPatchelfIgnoreMissingDeps ++ [
-      "libnvrm_gpu.so"
-      "libnvrm_mem.so"
-      "libnvdla_runtime.so"
-    ];
-    # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
-    badPlatformsConditions = prevAttrs.badPlatformsConditions // {
-      "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" =
-        !final.flags.isJetsonBuild;
+      postFixup =
+        prevAttrs.postFixup or ""
+        + ''
+          moveToOutput lib/stubs "$stubs"
+          ln -s "$stubs"/lib/stubs/* "$stubs"/lib/
+          ln -s "$stubs"/lib/stubs "''${!outputLib}/lib/stubs"
+        '';
     };
-  });
-
-  cuda_gdb = addBuildInputs prev.cuda_gdb (
-    # x86_64 only needs gmp from 12.0 and on
-    lists.optionals (cudaVersionAtLeast "12.0") [ final.pkgs.gmp ]
-  );
 
-  cuda_nvcc = prev.cuda_nvcc.overrideAttrs (
-    oldAttrs:
-    let
-      # This replicates the logic in stdenvAdapters.useLibsFrom, except we use
-      # gcc from pkgsHostTarget and not from buildPackages.
-      ccForLibs-wrapper = final.pkgs.stdenv.cc;
-      gccMajorVersion = final.nvccCompatibilities.${cudaVersion}.gccMaxMajorVersion;
-      cc = final.pkgs.wrapCCWith {
-        cc = final.pkgs."gcc${gccMajorVersion}".cc;
-        useCcForLibs = true;
-        gccForLibs = ccForLibs-wrapper.cc;
+  cuda_compat =
+    { flags, lib }:
+    prevAttrs: {
+      autoPatchelfIgnoreMissingDeps = prevAttrs.autoPatchelfIgnoreMissingDeps ++ [
+        "libnvrm_gpu.so"
+        "libnvrm_mem.so"
+        "libnvdla_runtime.so"
+      ];
+      # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
+      badPlatformsConditions = prevAttrs.badPlatformsConditions // {
+        "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" = !flags.isJetsonBuild;
       };
-    in
-    {
+    };
 
-      outputs = oldAttrs.outputs ++ lists.optionals (!(builtins.elem "lib" oldAttrs.outputs)) [ "lib" ];
+  cuda_gdb =
+    {
+      cudaAtLeast,
+      gmp,
+      lib,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # x86_64 only needs gmp from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ gmp ];
+    };
 
+  cuda_nvcc =
+    {
+      backendStdenv,
+      cuda_cudart,
+      lib,
+      setupCudaHook,
+    }:
+    prevAttrs: {
       # Patch the nvcc.profile.
       # Syntax:
       # - `=` for assignment,
@@ -131,38 +187,37 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # backend-stdenv.nix
 
       postPatch =
-        (oldAttrs.postPatch or "")
+        (prevAttrs.postPatch or "")
         + ''
           substituteInPlace bin/nvcc.profile \
-            --replace \
-              '$(TOP)/lib' \
-              "''${!outputLib}/lib" \
-            --replace \
+            --replace-fail \
               '$(TOP)/$(_NVVM_BRANCH_)' \
               "''${!outputBin}/nvvm" \
-            --replace \
+            --replace-fail \
               '$(TOP)/$(_TARGET_DIR_)/include' \
               "''${!outputDev}/include"
 
           cat << EOF >> bin/nvcc.profile
 
           # Fix a compatible backend compiler
-          PATH += ${lib.getBin cc}/bin:
+          PATH += "${backendStdenv.cc}/bin":
 
           # Expose the split-out nvvm
-          LIBRARIES =+ -L''${!outputBin}/nvvm/lib
-          INCLUDES =+ -I''${!outputBin}/nvvm/include
-
-          # Expose cudart and the libcuda stubs
-          LIBRARIES =+ -L$static/lib" "-L${final.cuda_cudart.lib}/lib -L${final.cuda_cudart.lib}/lib/stubs
-          INCLUDES =+ -I${final.cuda_cudart.dev}/include
+          LIBRARIES =+ "-L''${!outputBin}/nvvm/lib"
+          INCLUDES =+ "-I''${!outputBin}/nvvm/include"
           EOF
         '';
 
-      propagatedBuildInputs = [ final.setupCudaHook ];
+      # NOTE(@connorbaker):
+      # Though it might seem odd or counter-intuitive to add the setup hook to `propagatedBuildInputs` instead of
+      # `propagatedNativeBuildInputs`, it is necessary! If you move the setup hook from `propagatedBuildInputs` to
+      # `propagatedNativeBuildInputs`, it stops being propagated to downstream packages during their build because
+      # setup hooks in `propagatedNativeBuildInputs` are not designed to affect the runtime or build environment of
+      # dependencies; they are only meant to affect the build environment of the package that directly includes them.
+      propagatedBuildInputs = (prevAttrs.propagatedBuildInputs or [ ]) ++ [ setupCudaHook ];
 
       postInstall =
-        (oldAttrs.postInstall or "")
+        (prevAttrs.postInstall or "")
         + ''
           moveToOutput "nvvm" "''${!outputBin}"
         '';
@@ -170,48 +225,77 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # The nvcc and cicc binaries contain hard-coded references to /usr
       allowFHSReferences = true;
 
-      meta = (oldAttrs.meta or { }) // {
+      meta = (prevAttrs.meta or { }) // {
         mainProgram = "nvcc";
       };
-    }
-  );
+    };
 
-  cuda_nvprof = prev.cuda_nvprof.overrideAttrs (prevAttrs: {
-    buildInputs = prevAttrs.buildInputs ++ [ final.cuda_cupti.lib ];
-  });
+  cuda_nvprof =
+    { cuda_cupti }: prevAttrs: { buildInputs = prevAttrs.buildInputs ++ [ cuda_cupti.lib ]; };
 
-  cuda_demo_suite = addBuildInputs prev.cuda_demo_suite [
-    final.pkgs.freeglut
-    final.pkgs.libGLU
-    final.pkgs.libglvnd
-    final.pkgs.mesa
-    final.libcufft.lib
-    final.libcurand.lib
-  ];
+  cuda_demo_suite =
+    {
+      freeglut,
+      libcufft,
+      libcurand,
+      libGLU,
+      libglvnd,
+      mesa,
+    }:
+    prevAttrs: {
+      buildInputs = prevAttrs.buildInputs ++ [
+        freeglut
+        libcufft.lib
+        libcurand.lib
+        libGLU
+        libglvnd
+        mesa
+      ];
+    };
 
-  nsight_compute = prev.nsight_compute.overrideAttrs (prevAttrs: {
-    nativeBuildInputs =
-      prevAttrs.nativeBuildInputs
-      ++ (
-        if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
-          [ final.pkgs.qt5.wrapQtAppsHook ]
-        else
-          [ final.pkgs.qt6.wrapQtAppsHook ]
-      );
-    buildInputs =
-      prevAttrs.buildInputs
-      ++ (
-        if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
-          [ final.pkgs.qt5.qtwebview ]
-        else
-          [ final.pkgs.qt6.qtwebview ]
-      );
-  });
+  nsight_compute =
+    {
+      lib,
+      qt5 ? null,
+      qt6 ? null,
+    }:
+    prevAttrs:
+    let
+      inherit (lib.strings) versionOlder versionAtLeast;
+      inherit (prevAttrs) version;
+      qt = if versionOlder version "2022.2.0" then qt5 else qt6;
+      inherit (qt) wrapQtAppsHook qtwebview;
+    in
+    {
+      nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ wrapQtAppsHook ];
+      buildInputs = prevAttrs.buildInputs ++ [ qtwebview ];
+      brokenConditions = prevAttrs.brokenConditions // {
+        "Qt 5 missing (<2022.2.0)" = !(versionOlder version "2022.2.0" -> qt5 != null);
+        "Qt 6 missing (>=2022.2.0)" = !(versionAtLeast version "2022.2.0" -> qt6 != null);
+      };
+    };
 
-  nsight_systems = prev.nsight_systems.overrideAttrs (
+  nsight_systems =
+    {
+      cuda_cudart,
+      cudaOlder,
+      gst_all_1,
+      lib,
+      nss,
+      numactl,
+      pulseaudio,
+      qt5 ? null,
+      qt6 ? null,
+      rdma-core,
+      ucx,
+      wayland,
+      xorg,
+    }:
     prevAttrs:
     let
-      qt = if lib.versionOlder prevAttrs.version "2022.4.2.1" then final.pkgs.qt5 else final.pkgs.qt6;
+      inherit (lib.strings) versionOlder versionAtLeast;
+      inherit (prevAttrs) version;
+      qt = if lib.strings.versionOlder prevAttrs.version "2022.4.2.1" then qt5 else qt6;
       qtwayland =
         if lib.versions.major qt.qtbase.version == "5" then
           lib.getBin qt.qtwayland
@@ -223,55 +307,57 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # An ad hoc replacement for
       # https://github.com/ConnorBaker/cuda-redist-find-features/issues/11
       env.rmPatterns = toString [
+        "nsight-systems/*/*/lib{arrow,jpeg}*"
+        "nsight-systems/*/*/lib{ssl,ssh,crypto}*"
+        "nsight-systems/*/*/libboost*"
+        "nsight-systems/*/*/libexec"
         "nsight-systems/*/*/libQt*"
         "nsight-systems/*/*/libstdc*"
-        "nsight-systems/*/*/libboost*"
-        "nsight-systems/*/*/lib{ssl,ssh,crypto}*"
-        "nsight-systems/*/*/lib{arrow,jpeg}*"
         "nsight-systems/*/*/Mesa"
-        "nsight-systems/*/*/python/bin/python"
-        "nsight-systems/*/*/libexec"
         "nsight-systems/*/*/Plugins"
+        "nsight-systems/*/*/python/bin/python"
       ];
       postPatch =
         prevAttrs.postPatch or ""
         + ''
-          for path in $rmPatterns ; do
+          for path in $rmPatterns; do
             rm -r "$path"
           done
         '';
       nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ qt.wrapQtAppsHook ];
       buildInputs = prevAttrs.buildInputs ++ [
-        final.cuda_cudart.stubs
-        final.pkgs.alsa-lib
-        final.pkgs.boost178
-        final.pkgs.e2fsprogs
-        final.pkgs.gst_all_1.gst-plugins-base
-        final.pkgs.gst_all_1.gstreamer
-        final.pkgs.nss
-        final.pkgs.numactl
-        final.pkgs.pulseaudio
-        final.pkgs.rdma-core
-        final.pkgs.ucx
-        final.pkgs.wayland
-        final.pkgs.xorg.libXcursor
-        final.pkgs.xorg.libXdamage
-        final.pkgs.xorg.libXrandr
-        final.pkgs.xorg.libXtst
-        qt.qtbase
         (qt.qtdeclarative or qt.full)
         (qt.qtsvg or qt.full)
+        cuda_cudart.stubs
+        gst_all_1.gst-plugins-base
+        gst_all_1.gstreamer
+        nss
+        numactl
+        pulseaudio
+        qt.qtbase
         qtWaylandPlugins
+        rdma-core
+        ucx
+        wayland
+        xorg.libXcursor
+        xorg.libXdamage
+        xorg.libXrandr
+        xorg.libXtst
       ];
 
-      # Older releases require boost 1.70 deprecated in Nixpkgs
-      meta.broken = prevAttrs.meta.broken or false || lib.versionOlder final.cudaVersion "11.8";
-    }
-  );
+      brokenConditions = prevAttrs.brokenConditions // {
+        # Older releases require boost 1.70, which is deprecated in Nixpkgs
+        "CUDA too old (<11.8)" = cudaOlder "11.8";
+        "Qt 5 missing (<2022.4.2.1)" = !(versionOlder version "2022.4.2.1" -> qt5 != null);
+        "Qt 6 missing (>=2022.4.2.1)" = !(versionAtLeast version "2022.4.2.1" -> qt6 != null);
+      };
+    };
 
-  nvidia_driver = prev.nvidia_driver.overrideAttrs {
-    # No need to support this package as we have drivers already
-    # in linuxPackages.
-    meta.broken = true;
-  };
+  nvidia_driver =
+    { }:
+    prevAttrs: {
+      brokenConditions = prevAttrs.brokenConditions // {
+        "Package is not supported; use drivers from linuxPackages" = true;
+      };
+    };
 }
diff --git a/pkgs/development/cuda-modules/cutensor/extension.nix b/pkgs/development/cuda-modules/cutensor/extension.nix
index c41113939ca2e..5fdf356df916e 100644
--- a/pkgs/development/cuda-modules/cutensor/extension.nix
+++ b/pkgs/development/cuda-modules/cutensor/extension.nix
@@ -15,9 +15,9 @@
 {
   cudaVersion,
   flags,
-  hostPlatform,
   lib,
   mkVersionedPackageName,
+  stdenv,
 }:
 let
   inherit (lib)
@@ -29,6 +29,8 @@ let
     trivial
     ;
 
+  inherit (stdenv) hostPlatform;
+
   redistName = "cutensor";
   pname = "libcutensor";
 
diff --git a/pkgs/development/cuda-modules/flags.nix b/pkgs/development/cuda-modules/flags.nix
index 196b6b9f8f990..93952a66216b4 100644
--- a/pkgs/development/cuda-modules/flags.nix
+++ b/pkgs/development/cuda-modules/flags.nix
@@ -7,7 +7,7 @@
   cudaForwardCompat ? (config.cudaForwardCompat or true),
   lib,
   cudaVersion,
-  hostPlatform,
+  stdenv,
   # gpus :: List Gpu
   gpus,
 }:
@@ -20,6 +20,8 @@ let
     trivial
     ;
 
+  inherit (stdenv) hostPlatform;
+
   # Flags are determined based on your CUDA toolkit by default.  You may benefit
   # from improved performance, reduced file size, or greater hardware support by
   # passing a configuration based on your specific GPU environment.
@@ -207,6 +209,11 @@ let
       # E.g. "-gencode=arch=compute_75,code=sm_75 ... -gencode=arch=compute_86,code=compute_86"
       gencodeString = strings.concatStringsSep " " gencode;
 
+      # cmakeCudaArchitecturesString :: String
+      # A semicolon-separated string of CUDA capabilities without dots, suitable for passing to CMake.
+      # E.g. "75;86"
+      cmakeCudaArchitecturesString = strings.concatMapStringsSep ";" dropDot cudaCapabilities;
+
       # Jetson devices cannot be targeted by the same binaries which target non-Jetson devices. While
       # NVIDIA provides both `linux-aarch64` and `linux-sbsa` packages, which both target `aarch64`,
       # they are built with different settings and cannot be mixed.
@@ -270,6 +277,8 @@ assert
       ];
       gencodeString = "-gencode=arch=compute_75,code=sm_75 -gencode=arch=compute_86,code=sm_86 -gencode=arch=compute_86,code=compute_86";
 
+      cmakeCudaArchitecturesString = "75;86";
+
       isJetsonBuild = false;
     };
     actual = formatCapabilities {
@@ -339,6 +348,8 @@ assert
       ];
       gencodeString = "-gencode=arch=compute_62,code=sm_62 -gencode=arch=compute_72,code=sm_72 -gencode=arch=compute_72,code=compute_72";
 
+      cmakeCudaArchitecturesString = "62;72";
+
       isJetsonBuild = true;
     };
     actual = formatCapabilities {
diff --git a/pkgs/development/cuda-modules/generic-builders/manifest.nix b/pkgs/development/cuda-modules/generic-builders/manifest.nix
index 73c34b0c86ee5..006abb456cdc5 100644
--- a/pkgs/development/cuda-modules/generic-builders/manifest.nix
+++ b/pkgs/development/cuda-modules/generic-builders/manifest.nix
@@ -10,7 +10,6 @@
   markForCudatoolkitRootHook,
   flags,
   stdenv,
-  hostPlatform,
   # Builder-specific arguments
   # Short package name (e.g., "cuda_cccl")
   # pname : String
@@ -40,6 +39,8 @@ let
     sourceTypes
     ;
 
+  inherit (stdenv) hostPlatform;
+
   # Get the redist architectures for which package provides distributables.
   # These are used by meta.platforms.
   supportedRedistArchs = builtins.attrNames featureRelease;
@@ -48,7 +49,7 @@ let
   # It is `"unsupported"` if the redistributable is not supported on the target platform.
   redistArch = flags.getRedistArch hostPlatform.system;
 
-  sourceMatchesHost = flags.getNixSystem redistArch == stdenv.hostPlatform.system;
+  sourceMatchesHost = flags.getNixSystem redistArch == hostPlatform.system;
 in
 backendStdenv.mkDerivation (finalAttrs: {
   # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
@@ -127,7 +128,18 @@ backendStdenv.mkDerivation (finalAttrs: {
   # brokenConditions :: AttrSet Bool
   # Sets `meta.broken = true` if any of the conditions are true.
   # Example: Broken on a specific version of CUDA or when a dependency has a specific version.
-  brokenConditions = { };
+  brokenConditions = {
+    # Unclear how this is handled by Nix internals.
+    "Duplicate entries in outputs" = finalAttrs.outputs != lists.unique finalAttrs.outputs;
+    # Typically this results in the static output being empty, as all libraries are moved
+    # back to the lib output.
+    "lib output follows static output" =
+      let
+        libIndex = lists.findFirstIndex (x: x == "lib") null finalAttrs.outputs;
+        staticIndex = lists.findFirstIndex (x: x == "static") null finalAttrs.outputs;
+      in
+      libIndex != null && staticIndex != null && libIndex > staticIndex;
+  };
 
   # badPlatformsConditions :: AttrSet Bool
   # Sets `meta.badPlatforms = meta.platforms` if any of the conditions are true.
@@ -137,44 +149,43 @@ backendStdenv.mkDerivation (finalAttrs: {
   };
 
   # src :: Optional Derivation
-  src = trivial.pipe redistArch [
-    # If redistArch doesn't exist in redistribRelease, return null.
-    (redistArch: redistribRelease.${redistArch} or null)
-    # If the release is non-null, fetch the source; otherwise, return null.
-    (trivial.mapNullable (
-      { relative_path, sha256, ... }:
-      fetchurl {
-        url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
-        inherit sha256;
-      }
-    ))
-  ];
-
-  # Handle the pkg-config files:
-  # 1. No FHS
-  # 2. Location expected by the pkg-config wrapper
-  # 3. Generate unversioned names too
-  postPatch = ''
-    for path in pkg-config pkgconfig ; do
-      [[ -d "$path" ]] || continue
-      mkdir -p share/pkgconfig
-      mv "$path"/* share/pkgconfig/
-      rmdir "$path"
-    done
-
-    for pc in share/pkgconfig/*.pc ; do
-      sed -i \
-        -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
-        -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
-        -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
-        "$pc"
-    done
+  # If redistArch doesn't exist in redistribRelease, return null.
+  src = trivial.mapNullable (
+    { relative_path, sha256, ... }:
+    fetchurl {
+      url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
+      inherit sha256;
+    }
+  ) (redistribRelease.${redistArch} or null);
 
+  postPatch =
+    # Pkg-config's setup hook expects configuration files in $out/share/pkgconfig
+    ''
+      for path in pkg-config pkgconfig; do
+        [[ -d "$path" ]] || continue
+        mkdir -p share/pkgconfig
+        mv "$path"/* share/pkgconfig/
+        rmdir "$path"
+      done
+    ''
+    # Rewrite FHS paths with store paths
+    # NOTE: output* fall back to out if the corresponding output isn't defined.
+    + ''
+      for pc in share/pkgconfig/*.pc; do
+        sed -i \
+          -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
+          -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
+          -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
+          "$pc"
+      done
+    ''
+    # Generate unversioned names.
     # E.g. cuda-11.8.pc -> cuda.pc
-    for pc in share/pkgconfig/*-"$majorMinorVersion.pc" ; do
-      ln -s "$(basename "$pc")" "''${pc%-$majorMinorVersion.pc}".pc
-    done
-  '';
+    + ''
+      for pc in share/pkgconfig/*-"$majorMinorVersion.pc"; do
+        ln -s "$(basename "$pc")" "''${pc%-$majorMinorVersion.pc}".pc
+      done
+    '';
 
   env.majorMinorVersion = cudaMajorMinorVersion;
 
@@ -233,7 +244,7 @@ backendStdenv.mkDerivation (finalAttrs: {
     # Handle the existence of libPath, which requires us to re-arrange the lib directory
     + strings.optionalString (libPath != null) ''
       full_lib_path="lib/${libPath}"
-      if [[ ! -d "$full_lib_path" ]] ; then
+      if [[ ! -d "$full_lib_path" ]]; then
         echo "${finalAttrs.pname}: '$full_lib_path' does not exist, only found:" >&2
         find lib/ -mindepth 1 -maxdepth 1 >&2
         echo "This release might not support your CUDA version" >&2
@@ -264,9 +275,9 @@ backendStdenv.mkDerivation (finalAttrs: {
   postInstallCheck = ''
     echo "Executing postInstallCheck"
 
-    if [[ -z "''${allowFHSReferences-}" ]] ; then
+    if [[ -z "''${allowFHSReferences-}" ]]; then
       mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "''${!o}"; done)
-      if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}" ; then
+      if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}"; then
         echo "Detected references to /usr" >&2
         exit 1
       fi
diff --git a/pkgs/development/cuda-modules/generic-builders/multiplex.nix b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
index 0b523e56b8c43..ce50653bb5d46 100644
--- a/pkgs/development/cuda-modules/generic-builders/multiplex.nix
+++ b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
@@ -3,7 +3,7 @@
   lib,
   cudaVersion,
   flags,
-  hostPlatform,
+  stdenv,
   # Expected to be passed by the caller
   mkVersionedPackageName,
   # pname :: String
@@ -40,6 +40,8 @@ let
     strings
     ;
 
+  inherit (stdenv) hostPlatform;
+
   evaluatedModules = modules.evalModules {
     modules = [
       ../modules
diff --git a/pkgs/development/cuda-modules/nccl/default.nix b/pkgs/development/cuda-modules/nccl/default.nix
index 8043adae4d1eb..dd767d2781f06 100644
--- a/pkgs/development/cuda-modules/nccl/default.nix
+++ b/pkgs/development/cuda-modules/nccl/default.nix
@@ -17,9 +17,10 @@ let
     cuda_cccl
     cuda_cudart
     cuda_nvcc
+    cudaAtLeast
     cudaFlags
+    cudaOlder
     cudatoolkit
-    cudaVersion
     ;
 in
 backendStdenv.mkDerivation (finalAttrs: {
@@ -33,6 +34,7 @@ backendStdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IF2tILwW8XnzSmfn7N1CO7jXL95gUp02guIW5n1eaig=";
   };
 
+  __structuredAttrs = true;
   strictDeps = true;
 
   outputs = [
@@ -46,12 +48,12 @@ backendStdenv.mkDerivation (finalAttrs: {
       autoAddDriverRunpath
       python3
     ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
+    ++ lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [ cuda_nvcc ];
 
   buildInputs =
-    lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [
       cuda_nvcc.dev # crt/host_config.h
       cuda_cudart
     ]
@@ -59,25 +61,25 @@ backendStdenv.mkDerivation (finalAttrs: {
     # against other version, like below, it's important that we use the same format. Otherwise,
     # we'll get incorrect results.
     # For example, lib.versionAtLeast "12.0" "12.0.0" == false.
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [ cuda_cccl ];
+    ++ lib.optionals (cudaAtLeast "12.0") [ cuda_cccl ];
 
   env.NIX_CFLAGS_COMPILE = toString [ "-Wno-unused-function" ];
 
-  preConfigure = ''
+  postPatch = ''
     patchShebangs ./src/device/generate.py
-    makeFlagsArray+=(
-      "NVCC_GENCODE=${lib.concatStringsSep " " cudaFlags.gencode}"
-    )
   '';
 
-  makeFlags =
-    [ "PREFIX=$(out)" ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [
+  makeFlagsArray =
+    [
+      "PREFIX=$(out)"
+      "NVCC_GENCODE=${cudaFlags.gencodeString}"
+    ]
+    ++ lib.optionals (cudaOlder "11.4") [
       "CUDA_HOME=${cudatoolkit}"
       "CUDA_LIB=${lib.getLib cudatoolkit}/lib"
       "CUDA_INC=${lib.getDev cudatoolkit}/include"
     ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    ++ lib.optionals (cudaAtLeast "11.4") [
       "CUDA_HOME=${cuda_nvcc}"
       "CUDA_LIB=${lib.getLib cuda_cudart}/lib"
       "CUDA_INC=${lib.getDev cuda_cudart}/include"
diff --git a/pkgs/development/cuda-modules/saxpy/default.nix b/pkgs/development/cuda-modules/saxpy/default.nix
index 2a2eedbcb1dbf..a36cec3e692b3 100644
--- a/pkgs/development/cuda-modules/saxpy/default.nix
+++ b/pkgs/development/cuda-modules/saxpy/default.nix
@@ -10,8 +10,9 @@ let
     cuda_cccl
     cuda_cudart
     cuda_nvcc
+    cudaAtLeast
+    cudaOlder
     cudatoolkit
-    cudaVersion
     flags
     libcublas
     setupCudaHook
@@ -24,6 +25,7 @@ backendStdenv.mkDerivation {
 
   src = ./.;
 
+  __structuredAttrs = true;
   strictDeps = true;
 
   nativeBuildInputs =
@@ -31,24 +33,22 @@ backendStdenv.mkDerivation {
       cmake
       autoAddDriverRunpath
     ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
+    ++ lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [ cuda_nvcc ];
 
   buildInputs =
-    lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [
       (getDev libcublas)
       (getLib libcublas)
       (getOutput "static" libcublas)
       cuda_cudart
     ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [ cuda_cccl ];
+    ++ lib.optionals (cudaAtLeast "12.0") [ cuda_cccl ];
 
-  cmakeFlags = [
+  cmakeFlagsArray = [
     (lib.cmakeBool "CMAKE_VERBOSE_MAKEFILE" true)
-    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" (
-      with flags; lib.concatStringsSep ";" (lib.lists.map dropDot cudaCapabilities)
-    ))
+    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" flags.cmakeCudaArchitecturesString)
   ];
 
   meta = rec {
@@ -56,6 +56,6 @@ backendStdenv.mkDerivation {
     license = lib.licenses.mit;
     maintainers = lib.teams.cuda.members;
     platforms = lib.platforms.unix;
-    badPlatforms = lib.optionals flags.isJetsonBuild platforms;
+    badPlatforms = lib.optionals (flags.isJetsonBuild && cudaOlder "11.4") platforms;
   };
 }
diff --git a/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh b/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
index ba04c2e0806af..0abd651005c66 100644
--- a/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
+++ b/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
@@ -1,14 +1,25 @@
 # shellcheck shell=bash
 
-# Should we mimick cc-wrapper's "hygiene"?
-[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
+(( ${hostOffset:?} == -1 && ${targetOffset:?} == 0)) || return 0
 
 echo "Sourcing mark-for-cudatoolkit-root-hook" >&2
 
 markForCUDAToolkit_ROOT() {
-    mkdir -p "${prefix}/nix-support"
-    [[ -f "${prefix}/nix-support/include-in-cudatoolkit-root" ]] && return
-    echo "$pname-$output" > "${prefix}/nix-support/include-in-cudatoolkit-root"
+    mkdir -p "${prefix:?}/nix-support"
+    local markerPath="$prefix/nix-support/include-in-cudatoolkit-root"
+
+    # Return early if the file already exists.
+    [[ -f "$markerPath" ]] && return 0
+
+    # Always create the file, even if it's empty, since setup-cuda-hook relies on its existence.
+    # However, only populate it if strictDeps is not set.
+    touch "$markerPath"
+
+    # Return early if strictDeps is set.
+    [[ -n "${strictDeps-}" ]] && return 0
+
+    # Populate the file with the package name and output.
+    echo "${pname:?}-${output:?}" > "$markerPath"
 }
 
 fixupOutputHooks+=(markForCUDAToolkit_ROOT)
diff --git a/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh b/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
index a4a444fcd2417..6e57c7b1072e1 100644
--- a/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
+++ b/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
@@ -9,7 +9,7 @@ reason=
 [[ -n ${cudaSetupHookOnce-} ]] && guard=Skipping && reason=" because the hook has been propagated more than once"
 
 if (( "${NIX_DEBUG:-0}" >= 1 )) ; then
-    echo "$guard hostOffset=$hostOffset targetOffset=$targetOffset setupCudaHook$reason" >&2
+    echo "$guard hostOffset=$hostOffset targetOffset=$targetOffset setup-cuda-hook$reason" >&2
 else
     echo "$guard setup-cuda-hook$reason" >&2
 fi
@@ -24,16 +24,19 @@ extendcudaHostPathsSeen() {
     (( "${NIX_DEBUG:-0}" >= 1 )) && echo "extendcudaHostPathsSeen $1" >&2
 
     local markerPath="$1/nix-support/include-in-cudatoolkit-root"
-    [[ ! -f "${markerPath}" ]] && return
-    [[ -v cudaHostPathsSeen[$1] ]] && return
+    [[ ! -f "${markerPath}" ]] && return 0
+    [[ -v cudaHostPathsSeen[$1] ]] && return 0
 
     cudaHostPathsSeen["$1"]=1
 
     # E.g. cuda_cudart-lib
     local cudaOutputName
-    read -r cudaOutputName < "$markerPath"
+    # Fail gracefully if the file is empty.
+    # One reason the file may be empty: the package was built with strictDeps set, but the current build does not have
+    # strictDeps set.
+    read -r cudaOutputName < "$markerPath" || return 0
 
-    [[ -z "$cudaOutputName" ]] && return
+    [[ -z "$cudaOutputName" ]] && return 0
 
     local oldPath="${cudaOutputToPath[$cudaOutputName]-}"
     [[ -n "$oldPath" ]] && echo "extendcudaHostPathsSeen: warning: overwriting $cudaOutputName from $oldPath to $1" >&2
@@ -59,7 +62,7 @@ setupCUDAToolkitCompilers() {
     echo Executing setupCUDAToolkitCompilers >&2
 
     if [[ -n "${dontSetupCUDAToolkitCompilers-}" ]] ; then
-        return
+        return 0
     fi
 
     # Point NVCC at a compatible compiler
@@ -99,7 +102,7 @@ preConfigureHooks+=(setupCUDAToolkitCompilers)
 propagateCudaLibraries() {
     (( "${NIX_DEBUG:-0}" >= 1 )) && echo "propagateCudaLibraries: cudaPropagateToOutput=$cudaPropagateToOutput cudaHostPathsSeen=${!cudaHostPathsSeen[*]}" >&2
 
-    [[ -z "${cudaPropagateToOutput-}" ]] && return
+    [[ -z "${cudaPropagateToOutput-}" ]] && return 0
 
     mkdir -p "${!cudaPropagateToOutput}/nix-support"
     # One'd expect this should be propagated-bulid-build-deps, but that doesn't seem to work
diff --git a/pkgs/development/cuda-modules/tensorrt/fixup.nix b/pkgs/development/cuda-modules/tensorrt/fixup.nix
index 3615284fb080a..42359aedac118 100644
--- a/pkgs/development/cuda-modules/tensorrt/fixup.nix
+++ b/pkgs/development/cuda-modules/tensorrt/fixup.nix
@@ -1,12 +1,12 @@
 {
   cudaVersion,
   final,
-  hostPlatform,
   lib,
   mkVersionedPackageName,
   package,
   patchelf,
   requireFile,
+  stdenv,
   ...
 }:
 let
@@ -17,6 +17,7 @@ let
     strings
     versions
     ;
+  inherit (stdenv) hostPlatform;
   # targetArch :: String
   targetArch = attrsets.attrByPath [ hostPlatform.system ] "unsupported" {
     x86_64-linux = "x86_64-linux-gnu";
diff --git a/pkgs/development/embedded/avrdude/default.nix b/pkgs/development/embedded/avrdude/default.nix
index 924c502358216..41b6c5ffc9401 100644
--- a/pkgs/development/embedded/avrdude/default.nix
+++ b/pkgs/development/embedded/avrdude/default.nix
@@ -1,16 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, cmake, bison, flex, libusb-compat-0_1, libelf
-, libftdi1, readline, libserialport
-# documentation building is broken on darwin
-, docSupport ? (!stdenv.isDarwin), texliveMedium, texinfo, texi2html, unixtools }:
+{ lib, callPackage, stdenv, fetchFromGitHub, cmake, bison, flex, libusb1, elfutils
+, libftdi1, readline, hidapi, libserialport
+# Documentation building doesn't work on Darwin. It fails with:
+#   Undefined subroutine &Locale::Messages::dgettext called in ... texi2html
+#
+# https://github.com/NixOS/nixpkgs/issues/224761
+, docSupport ? (!stdenv.hostPlatform.isDarwin), texliveMedium, texinfo, texi2html, unixtools }:
 
-stdenv.mkDerivation rec {
+let
+  useElfutils = lib.meta.availableOn stdenv.hostPlatform elfutils;
+in
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "avrdude";
   version = "7.3";
 
   src = fetchFromGitHub {
     owner = "avrdudes";
-    repo = pname;
-    rev = "v${version}";
+    repo = "avdude";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-JqW3AOMmAfcy+PQRcqviWlxA6GoMSEfzIFt1pRYY7Dw=";
   };
 
@@ -21,17 +28,36 @@ stdenv.mkDerivation rec {
     texi2html
   ];
 
-  buildInputs = [ libusb-compat-0_1 libelf libftdi1 libserialport readline ];
-
-  cmakeFlags = lib.optionals docSupport [
-    "-DBUILD_DOC=ON"
+  buildInputs = [
+    (if useElfutils then elfutils else finalAttrs.finalPackage.passthru.libelf)
+    hidapi
+    libusb1
+    libftdi1
+    libserialport
+    readline
   ];
 
+  postPatch = lib.optionalString (!useElfutils) ''
+    # vendored libelf is a static library
+    sed -i "s/PREFERRED_LIBELF elf/PREFERRED_LIBELF libelf.a elf/" CMakeLists.txt
+  '';
+
+  # Not used:
+  #   -DHAVE_LINUXGPIO=ON    because it's incompatible with libgpiod 2.x
+  cmakeFlags = lib.optionals docSupport [ "-DBUILD_DOC=ON" ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ "-DHAVE_LINUXSPI=ON" "-DHAVE_PARPORT=ON" ];
+
   # dvips output references texlive in comments, resulting in a huge closure
   postInstall = lib.optionalString docSupport ''
-    rm $out/share/doc/${pname}/*.ps
+    rm $out/share/doc/avrdude/*.ps
   '';
 
+  passthru = {
+    # Vendored and mutated copy of libelf for avrdudes use.
+    # Produces a static library only.
+    libelf = callPackage ./libelf.nix { };
+  };
+
   meta = with lib; {
     description = "Command-line tool for programming Atmel AVR microcontrollers";
     mainProgram = "avrdude";
@@ -45,4 +71,4 @@ stdenv.mkDerivation rec {
     platforms = with platforms; linux ++ darwin;
     maintainers = [ maintainers.bjornfor ];
   };
-}
+})
diff --git a/pkgs/development/embedded/avrdude/libelf.nix b/pkgs/development/embedded/avrdude/libelf.nix
new file mode 100644
index 0000000000000..bd7b7be7066a3
--- /dev/null
+++ b/pkgs/development/embedded/avrdude/libelf.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "libelf";
+  version = "0.8.13-unstable-2023-01-14";
+
+  src = fetchFromGitHub {
+    owner = "avrdudes";
+    repo = "libelf";
+    rev = "0c55bfe1d3020a20bddf6ce57c0d9d98ccb12586";
+    hash = "sha256-jz7Ef0Eg673IJVZvVNklY40s13LCuMVAc7FGrRI7scQ=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/lib
+    cp liblibelf.a $out/lib/libelf.a
+    cp -r $src/include $out/include
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "ELF object file access library (vendored by avrdudes)";
+    homepage = "https://github.com/avrdudes/libelf";
+    license = lib.licenses.lgpl2Plus;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.bjornfor ];
+  };
+}
diff --git a/pkgs/development/interpreters/babashka/clojure-tools.nix b/pkgs/development/interpreters/babashka/clojure-tools.nix
index afd170a419386..082cb99f476d9 100644
--- a/pkgs/development/interpreters/babashka/clojure-tools.nix
+++ b/pkgs/development/interpreters/babashka/clojure-tools.nix
@@ -6,10 +6,10 @@
 }:
 clojure.overrideAttrs (previousAttrs: {
   pname = "babashka-clojure-tools";
-  version = "1.11.1.1435";
+  version = "1.11.2.1446";
 
   src = fetchurl {
     url = previousAttrs.src.url;
-    hash = "sha256-RS/FebIED8RYYXRXBKXZPRROO0HqyDo0zhb+p4Q5m8A=";
+    hash = "sha256-qn7/sPyVDfjZPLeWxlUBBljAW/d8cCw6lEm3/deS73E=";
   };
 })
diff --git a/pkgs/development/interpreters/babashka/default.nix b/pkgs/development/interpreters/babashka/default.nix
index 9844920366c7b..4b8376a330906 100644
--- a/pkgs/development/interpreters/babashka/default.nix
+++ b/pkgs/development/interpreters/babashka/default.nix
@@ -9,11 +9,11 @@
 let
   babashka-unwrapped = buildGraalvmNativeImage rec {
     pname = "babashka-unwrapped";
-    version = "1.3.189";
+    version = "1.3.190";
 
     src = fetchurl {
       url = "https://github.com/babashka/babashka/releases/download/v${version}/babashka-${version}-standalone.jar";
-      sha256 = "sha256-C3N++tTTvebtQid3p+zrnBgHTqQmECQhiS2/3VIEojI=";
+      sha256 = "sha256-zGWUuFyCOZXrcAOJ2sGvzvfJbFti1IlDS1gx9Oye9fg=";
     };
 
     graalvmDrv = graalvmCEPackages.graalvm-ce;
diff --git a/pkgs/development/interpreters/lua-5/hooks/setup-hook.sh b/pkgs/development/interpreters/lua-5/hooks/setup-hook.sh
index 3041b7f1c3f71..3027021661393 100644
--- a/pkgs/development/interpreters/lua-5/hooks/setup-hook.sh
+++ b/pkgs/development/interpreters/lua-5/hooks/setup-hook.sh
@@ -25,7 +25,8 @@ addToLuaSearchPathWithCustomDelimiter() {
   # export only if the folder contains lua files
   shopt -s globstar
 
-  for _file in ${absPattern/\?/\*\*}; do
+  local adjustedPattern="${absPattern/\?/\*\*\/\*}"
+  for _file in $adjustedPattern; do
     export "${varName}=${!varName:+${!varName};}${absPattern}"
     shopt -u globstar
     return;
diff --git a/pkgs/development/interpreters/lua-5/tests/default.nix b/pkgs/development/interpreters/lua-5/tests/default.nix
index 6ca6b153c0b62..c95d11aefc967 100644
--- a/pkgs/development/interpreters/lua-5/tests/default.nix
+++ b/pkgs/development/interpreters/lua-5/tests/default.nix
@@ -66,6 +66,21 @@ in
       touch $out
     '');
 
+  # checks that lua's setup-hook adds dependencies to LUA_PATH
+  # Prevents the following regressions
+  # $ env NIX_PATH=nixpkgs=. nix-shell --pure -Q -p luajitPackages.lua luajitPackages.http
+  # nix-shell$ luajit
+  # > require('http.request')
+  # stdin:1: module 'http.request' not found:
+  checkSetupHook = pkgs.runCommandLocal "test-${lua.name}-setup-hook" ({
+      nativeBuildInputs = [lua];
+      buildInputs = [ lua.pkgs.http ];
+      meta.platforms = lua.meta.platforms;
+    }) (''
+      ${lua}/bin/lua -e "require'http.request'"
+      touch $out
+    '');
+
   checkRelativeImports = pkgs.runCommandLocal "test-${lua.name}-relative-imports" ({
     }) (''
       source ${./assert.sh}
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 86b09fa877685..dda254fca3894 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -318,6 +318,8 @@ in with passthru; stdenv.mkDerivation ({
     inherit passthru;
 
     postFixup = ''
+      # Include a sitecustomize.py file. Note it causes an error when it's in postInstall with 2.7.
+      cp ${../../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
     '' + lib.optionalString strip2to3 ''
       rm -R $out/bin/2to3 $out/lib/python*/lib2to3
     '' + lib.optionalString stripConfig ''
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 96dcb6c25a131..301af7a29c9ea 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -537,7 +537,8 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     # Strip tests
     rm -R $out/lib/python*/test $out/lib/python*/**/test{,s}
     '' + optionalString includeSiteCustomize ''
-
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
     '' + optionalString stripBytecode ''
     # Determinism: deterministic bytecode
     # First we delete all old bytecode.
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 0edf4dcc027bc..4cc3f6f4e59eb 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "8";
+        patch = "9";
         suffix = "";
       };
-      hash = "sha256-ngYAjIkBkkOVvB2jA+rFZ6cprgErqhgqs5Jp9lA4O7M=";
+      hash = "sha256-mx6JZSP8UQaREmyGRAbZNgo9Hphqy9pZzaV7Wr2kW4c=";
     };
   };
 
@@ -79,10 +79,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "12";
-      patch = "2";
+      patch = "3";
       suffix = "";
     };
-    hash = "sha256-vigRLayBPSBTVFwUvxOhZAGiGHfxpp626l2ExKDz2HA=";
+    hash = "sha256-Vr/vH9/BIhzmcg5DpmHj60F4XdkUzplpjYx4lq9L2qE=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 04b1f4a512c98..c61cd77fc7ecd 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -191,10 +191,12 @@ in {
 
   setuptoolsBuildHook = callPackage ({ makePythonHook, setuptools, wheel }:
     makePythonHook {
-      name = "setuptools-setup-hook";
+      name = "setuptools-build-hook";
       propagatedBuildInputs = [ setuptools wheel ];
       substitutions = {
-        inherit pythonInterpreter pythonSitePackages setuppy;
+        inherit pythonInterpreter setuppy;
+        # python2.pkgs.setuptools does not support parallelism
+        setuptools_has_parallel = setuptools != null && lib.versionAtLeast setuptools.version "69";
       };
     } ./setuptools-build-hook.sh) {};
 
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index 958a9378ef14a..4c63a18eca43c 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -3,7 +3,7 @@ echo "Sourcing setuptools-build-hook"
 
 setuptoolsBuildPhase() {
     echo "Executing setuptoolsBuildPhase"
-    local args
+    local args setuptools_has_parallel=@setuptools_has_parallel@
     runHook preBuild
 
     cp -f @setuppy@ nix_run_setup
@@ -12,7 +12,9 @@ setuptoolsBuildPhase() {
         args+="$setupPyGlobalFlags"
     fi
     if [ -n "$enableParallelBuilding" ]; then
-        setupPyBuildFlags+=" --parallel $NIX_BUILD_CORES"
+        if [ -n "$setuptools_has_parallel" ]; then
+            setupPyBuildFlags+=" --parallel $NIX_BUILD_CORES"
+        fi
     fi
     if [ -n "$setupPyBuildFlags" ]; then
         args+=" build_ext $setupPyBuildFlags"
@@ -23,36 +25,7 @@ setuptoolsBuildPhase() {
     echo "Finished executing setuptoolsBuildPhase"
 }
 
-setuptoolsShellHook() {
-    echo "Executing setuptoolsShellHook"
-    runHook preShellHook
-
-    if test -e setup.py; then
-        tmp_path=$(mktemp -d)
-        export PATH="$tmp_path/bin:$PATH"
-        export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
-        mkdir -p "$tmp_path/@pythonSitePackages@"
-        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path \
-          --no-build-isolation >&2"
-
-        # Process pth file installed in tmp path. This allows one to
-        # actually import the editable installation. Note site.addsitedir
-        # appends, not prepends, new paths. Hence, it is not possible to override
-        # an existing installation of the package.
-        # https://github.com/pypa/setuptools/issues/2612
-        export NIX_PYTHONPATH="$tmp_path/@pythonSitePackages@:${NIX_PYTHONPATH-}"
-    fi
-
-    runHook postShellHook
-    echo "Finished executing setuptoolsShellHook"
-}
-
 if [ -z "${dontUseSetuptoolsBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using setuptoolsBuildPhase"
     buildPhase=setuptoolsBuildPhase
 fi
-
-if [ -z "${dontUseSetuptoolsShellHook-}" ] && [ -z "${shellHook-}" ]; then
-    echo "Using setuptoolsShellHook"
-    shellHook=setuptoolsShellHook
-fi
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index 5724f4944d9c2..9b414944bba5b 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -126,6 +126,9 @@ in with passthru; stdenv.mkDerivation rec {
     ln -s $out/${executable}-c/include $out/include/${libPrefix}
     ln -s $out/${executable}-c/lib-python/${if isPy3k then "3" else pythonVersion} $out/lib/${libPrefix}
 
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${if isPy38OrNewer then sitePackages else "lib/${libPrefix}/${sitePackages}"}/sitecustomize.py
+
     runHook postInstall
   '';
 
diff --git a/pkgs/development/interpreters/python/pypy/prebuilt.nix b/pkgs/development/interpreters/python/pypy/prebuilt.nix
index 70f8711ef0866..4b47c642eca4c 100644
--- a/pkgs/development/interpreters/python/pypy/prebuilt.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt.nix
@@ -95,6 +95,9 @@ in with passthru; stdenv.mkDerivation {
     echo "Removing bytecode"
     find . -name "__pycache__" -type d -depth -delete
 
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+
     runHook postInstall
   '';
 
diff --git a/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix b/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
index f0b60c2333f56..37a06f9f61ed5 100644
--- a/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
@@ -96,6 +96,9 @@ in with passthru; stdenv.mkDerivation {
     echo "Removing bytecode"
     find . -name "__pycache__" -type d -depth -delete
 
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+
     runHook postInstall
   '';
 
diff --git a/pkgs/development/interpreters/python/sitecustomize.py b/pkgs/development/interpreters/python/sitecustomize.py
new file mode 100644
index 0000000000000..c6924a8e93f04
--- /dev/null
+++ b/pkgs/development/interpreters/python/sitecustomize.py
@@ -0,0 +1,39 @@
+"""
+This is a Nix-specific module for discovering modules built with Nix.
+
+The module recursively adds paths that are on `NIX_PYTHONPATH` to `sys.path`. In
+order to process possible `.pth` files `site.addsitedir` is used.
+
+The paths listed in `PYTHONPATH` are added to `sys.path` afterwards, but they
+will be added before the entries we add here and thus take precedence.
+
+Note the `NIX_PYTHONPATH` environment variable is unset in order to prevent leakage.
+
+Similarly, this module listens to the environment variable `NIX_PYTHONEXECUTABLE`
+and sets `sys.executable` to its value.
+"""
+import site
+import sys
+import os
+import functools
+
+paths = os.environ.pop('NIX_PYTHONPATH', None)
+if paths:
+    functools.reduce(lambda k, p: site.addsitedir(p, k), paths.split(':'), site._init_pathinfo())
+
+# Check whether we are in a venv or virtualenv.
+# For Python 3 we check whether our `base_prefix` is different from our current `prefix`.
+# For Python 2 we check whether the non-standard `real_prefix` is set.
+# https://stackoverflow.com/questions/1871549/determine-if-python-is-running-inside-virtualenv
+in_venv = (sys.version_info.major == 3 and sys.prefix != sys.base_prefix) or (sys.version_info.major == 2 and hasattr(sys, "real_prefix"))
+
+if not in_venv:
+    executable = os.environ.pop('NIX_PYTHONEXECUTABLE', None)
+    prefix = os.environ.pop('NIX_PYTHONPREFIX', None)
+
+    if 'PYTHONEXECUTABLE' not in os.environ and executable is not None:
+        sys.executable = executable
+    if prefix is not None:
+        # Sysconfig does not like it when sys.prefix is set to None
+        sys.prefix = sys.exec_prefix = prefix
+        site.PREFIXES.insert(0, prefix)
diff --git a/pkgs/development/interpreters/python/tests.nix b/pkgs/development/interpreters/python/tests.nix
index 0251a903a7ae8..2cd29ca990321 100644
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@@ -38,22 +38,14 @@ let
         is_nixenv = "False";
         is_virtualenv = "False";
       };
-    } // lib.optionalAttrs (!python.isPyPy) {
-      # Use virtualenv with symlinks from a Nix env.
-      nixenv-virtualenv-links = rec {
-        env = runCommand "${python.name}-virtualenv-links" {} ''
-          ${pythonVirtualEnv.interpreter} -m virtualenv --system-site-packages --symlinks --no-seed $out
-        '';
-        interpreter = "${env}/bin/${python.executable}";
-        is_venv = "False";
-        is_nixenv = "True";
-        is_virtualenv = "True";
-      };
-    } // lib.optionalAttrs (!python.isPyPy) {
-      # Use virtualenv with copies from a Nix env.
-      nixenv-virtualenv-copies = rec {
-        env = runCommand "${python.name}-virtualenv-copies" {} ''
-          ${pythonVirtualEnv.interpreter} -m virtualenv --system-site-packages --copies --no-seed $out
+    } // lib.optionalAttrs (!python.isPyPy && !stdenv.isDarwin) {
+      # Use virtualenv from a Nix env.
+      # Fails on darwin with
+      #   virtualenv: error: argument dest: the destination . is not write-able at /nix/store
+      nixenv-virtualenv = rec {
+        env = runCommand "${python.name}-virtualenv" {} ''
+          ${pythonVirtualEnv.interpreter} -m virtualenv venv
+          mv venv $out
         '';
         interpreter = "${env}/bin/${python.executable}";
         is_venv = "False";
@@ -69,48 +61,27 @@ let
         is_nixenv = "True";
         is_virtualenv = "False";
       };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8" && (!python.isPyPy)) {
-      # Venv built using links to plain Python
+    } // lib.optionalAttrs (python.isPy3k && (!python.isPyPy)) {
+      # Venv built using plain Python
       # Python 2 does not support venv
       # TODO: PyPy executable name is incorrect, it should be pypy-c or pypy-3c instead of pypy and pypy3.
-      plain-venv-links = rec {
-        env = runCommand "${python.name}-venv-links" {} ''
-          ${python.interpreter} -m venv --system-site-packages --symlinks --without-pip $out
+      plain-venv = rec {
+        env = runCommand "${python.name}-venv" {} ''
+          ${python.interpreter} -m venv $out
         '';
         interpreter = "${env}/bin/${python.executable}";
         is_venv = "True";
         is_nixenv = "False";
         is_virtualenv = "False";
       };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8" && (!python.isPyPy)) {
-      # Venv built using copies from plain Python
-      # Python 2 does not support venv
-      # TODO: PyPy executable name is incorrect, it should be pypy-c or pypy-3c instead of pypy and pypy3.
-      plain-venv-copies = rec {
-        env = runCommand "${python.name}-venv-copies" {} ''
-          ${python.interpreter} -m venv --system-site-packages --copies --without-pip $out
-        '';
-        interpreter = "${env}/bin/${python.executable}";
-        is_venv = "True";
-        is_nixenv = "False";
-        is_virtualenv = "False";
-      };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
-      # Venv built using Python Nix environment (python.buildEnv)
-      nixenv-venv-links = rec {
-        env = runCommand "${python.name}-venv-links" {} ''
-          ${pythonEnv.interpreter} -m venv --system-site-packages --symlinks --without-pip $out
-        '';
-        interpreter = "${env}/bin/${pythonEnv.executable}";
-        is_venv = "True";
-        is_nixenv = "True";
-        is_virtualenv = "False";
-      };
+
     } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
       # Venv built using Python Nix environment (python.buildEnv)
-      nixenv-venv-copies = rec {
-        env = runCommand "${python.name}-venv-copies" {} ''
-          ${pythonEnv.interpreter} -m venv --system-site-packages --copies --without-pip $out
+      # TODO: Cannot create venv from a  nix env
+      # Error: Command '['/nix/store/ddc8nqx73pda86ibvhzdmvdsqmwnbjf7-python3-3.7.6-venv/bin/python3.7', '-Im', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.
+      nixenv-venv = rec {
+        env = runCommand "${python.name}-venv" {} ''
+          ${pythonEnv.interpreter} -m venv $out
         '';
         interpreter = "${env}/bin/${pythonEnv.executable}";
         is_venv = "True";
@@ -122,33 +93,11 @@ let
     testfun = name: attrs: runCommand "${python.name}-tests-${name}" ({
       inherit (python) pythonVersion;
     } // attrs) ''
-      mkdir $out
-
-      # set up the test files
       cp -r ${./tests/test_environments} tests
       chmod -R +w tests
       substituteAllInPlace tests/test_python.py
-
-      # run the tests by invoking the interpreter via full path
-      echo "absolute path: ${attrs.interpreter}"
-      ${attrs.interpreter} -m unittest discover --verbose tests 2>&1 | tee "$out/full.txt"
-
-      # run the tests by invoking the interpreter via $PATH
-      export PATH="$(dirname ${attrs.interpreter}):$PATH"
-      echo "PATH: $(basename ${attrs.interpreter})"
-      "$(basename ${attrs.interpreter})" -m unittest discover --verbose tests 2>&1 | tee "$out/path.txt"
-
-      # make sure we get the right path when invoking through a result link
-      ln -s "${attrs.env}" result
-      relative="result/bin/$(basename ${attrs.interpreter})"
-      expected="$PWD/$relative"
-      actual="$(./$relative -c "import sys; print(sys.executable)" | tee "$out/result.txt")"
-      if [ "$actual" != "$expected" ]; then
-        echo "expected $expected, got $actual"
-        exit 1
-      fi
-
-      # if we got this far, the tests passed
+      ${attrs.interpreter} -m unittest discover --verbose tests #/test_python.py
+      mkdir $out
       touch $out/success
     '';
 
diff --git a/pkgs/development/interpreters/python/tests/test_environments/test_python.py b/pkgs/development/interpreters/python/tests/test_environments/test_python.py
index 538273f65dbc7..0fc4b8a9e91c1 100644
--- a/pkgs/development/interpreters/python/tests/test_environments/test_python.py
+++ b/pkgs/development/interpreters/python/tests/test_environments/test_python.py
@@ -38,7 +38,7 @@ class TestCasePython(unittest.TestCase):
 
     @unittest.skipIf(IS_PYPY or sys.version_info.major==2, "Python 2 does not have base_prefix")
     def test_base_prefix(self):
-        if IS_VENV or IS_VIRTUALENV:
+        if IS_VENV or IS_NIXENV or IS_VIRTUALENV:
             self.assertNotEqual(sys.prefix, sys.base_prefix)
         else:
             self.assertEqual(sys.prefix, sys.base_prefix)
diff --git a/pkgs/development/interpreters/python/wrapper.nix b/pkgs/development/interpreters/python/wrapper.nix
index aa568a01b1b0c..f5f9b03e0fd3c 100644
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@@ -35,8 +35,6 @@ let
       fi
       mkdir -p "$out/bin"
 
-      rm -f $out/bin/.*-wrapped
-
       for path in ${lib.concatStringsSep " " paths}; do
         if [ -d "$path/bin" ]; then
           cd "$path/bin"
@@ -44,13 +42,7 @@ let
             if [ -f "$prg" ]; then
               rm -f "$out/bin/$prg"
               if [ -x "$prg" ]; then
-                if [ -f ".$prg-wrapped" ]; then
-                  echo "#!${pythonExecutable}" > "$out/bin/$prg"
-                  sed -e '1d' -e '3d' ".$prg-wrapped" >> "$out/bin/$prg"
-                  chmod +x "$out/bin/$prg"
-                else
-                  makeWrapper "$path/bin/$prg" "$out/bin/$prg" --inherit-argv0 --resolve-argv0 ${lib.optionalString (!permitUserSite) ''--set PYTHONNOUSERSITE "true"''} ${lib.concatStringsSep " " makeWrapperArgs}
-                fi
+                makeWrapper "$path/bin/$prg" "$out/bin/$prg" --set NIX_PYTHONPREFIX "$out" --set NIX_PYTHONEXECUTABLE ${pythonExecutable} --set NIX_PYTHONPATH ${pythonPath} ${lib.optionalString (!permitUserSite) ''--set PYTHONNOUSERSITE "true"''} ${lib.concatStringsSep " " makeWrapperArgs}
               fi
             fi
           done
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 8aed134441985..ce99311e45f79 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -74,7 +74,7 @@ let
 
         strictDeps = true;
 
-        nativeBuildInputs = [ autoreconfHook bison ]
+        nativeBuildInputs = [ autoreconfHook bison removeReferencesTo ]
           ++ (op docSupport groff)
           ++ (ops (dtraceSupport && stdenv.isLinux) [ systemtap libsystemtap ])
           ++ ops yjitSupport [ rustPlatform.cargoSetupHook cargo rustc ]
@@ -190,10 +190,10 @@ let
           ${
             lib.optionalString (!jitSupport) ''
               # Get rid of the CC runtime dependency
-              ${removeReferencesTo}/bin/remove-references-to \
+              remove-references-to \
                 -t ${stdenv.cc} \
                 $out/lib/libruby*
-              ${removeReferencesTo}/bin/remove-references-to \
+              remove-references-to \
                 -t ${stdenv.cc} \
                 $rbConfig
               sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
@@ -237,7 +237,7 @@ let
           cp ${./rbconfig.rb} $devdoc/lib/ruby/site_ruby/rbconfig.rb
         '' + opString useBaseRuby ''
           # Prevent the baseruby from being included in the closure.
-          ${removeReferencesTo}/bin/remove-references-to \
+          remove-references-to \
             -t ${baseRuby} \
             $rbConfig $out/lib/libruby*
         '';
@@ -257,7 +257,7 @@ let
         '';
         doInstallCheck = true;
 
-        disallowedRequisites = op (!jitSupport) stdenv.cc.cc
+        disallowedRequisites = op (!jitSupport) stdenv.cc
           ++ op useBaseRuby baseRuby;
 
         meta = with lib; {
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 2c756931169a9..6a28bbb488ee4 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.5.6";
+  version = "3.5.7";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-8/zAMnzuC3677i7wFKQroFtAMtfhg0280xZd3nAMmcI=";
+    hash = "sha256-w9BKIE0vcmX+mmtDqF1tInhplHdBok1W5R1xNtRinjk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/LAStools/default.nix b/pkgs/development/libraries/LAStools/default.nix
index 2f2b3b23ae313..5dfd6570c0808 100644
--- a/pkgs/development/libraries/LAStools/default.nix
+++ b/pkgs/development/libraries/LAStools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "LAStools";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "LAStools";
     repo = "LAStools";
     rev = "v${version}";
-    sha256 = "sha256-HL64koe0GNzJzyA0QP4I0M1y2HSxigsZTqOw67RCwNc=";
+    sha256 = "sha256-IyZjM8YvIVB0VPNuEhmHHw7EuKw5RanB2qhCnBD1fRY=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 838bb9ecdbe5c..a15a963cb78bf 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -58,13 +58,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2";
-  version = "2.30.1";
+  version = "2.30.2";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-nwmmyJK1/5Mu7l1YCk4PsasJIrx3jdiM5f/Cu3n0paA=";
+    hash = "sha256-yYYtsF6+IKynXpfay0rUmCQPdL8vp6dlmon8N7UG89A=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/abseil-cpp/202401.nix b/pkgs/development/libraries/abseil-cpp/202401.nix
index 0192241a9de93..73e663b0d0c6f 100644
--- a/pkgs/development/libraries/abseil-cpp/202401.nix
+++ b/pkgs/development/libraries/abseil-cpp/202401.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abseil-cpp";
-  version = "20240116.1";
+  version = "20240116.2";
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-cpp";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-D4E11bICKr3Z5RRah7QkfXVsXtuUg32FMmKpiOGjZDM=";
+    hash = "sha256-eA2/dZpNOlex1O5PNa3XSZhpMB3AmaIoHzVDI9TD/cg=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index cb515ebde8848..da288f145613e 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.7.4";
+  version = "0.7.6";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-FgD5M16uOQQImmKG9SWBKWHFTONqBd/m7qpXbdkyjz8=";
+    hash = "sha256-Fi1yowa7LhFMJPolJn0NCgrBbzn9laXA38daZm7l5PU=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/avahi/CVE-2023-38469.patch b/pkgs/development/libraries/avahi/CVE-2023-38469.patch
deleted file mode 100644
index ff6cd65de0f44..0000000000000
--- a/pkgs/development/libraries/avahi/CVE-2023-38469.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From a337a1ba7d15853fb56deef1f464529af6e3a1cf Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Mon, 23 Oct 2023 20:29:31 +0000
-Subject: [PATCH 1/2] core: reject overly long TXT resource records
-
-Closes https://github.com/lathiat/avahi/issues/455
-
-CVE-2023-38469
----
- avahi-core/rr.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/avahi-core/rr.c b/avahi-core/rr.c
-index 2bb89244..9c04ebbd 100644
---- a/avahi-core/rr.c
-+++ b/avahi-core/rr.c
-@@ -32,6 +32,7 @@
- #include <avahi-common/malloc.h>
- #include <avahi-common/defs.h>
- 
-+#include "dns.h"
- #include "rr.h"
- #include "log.h"
- #include "util.h"
-@@ -689,11 +690,17 @@ int avahi_record_is_valid(AvahiRecord *r) {
-         case AVAHI_DNS_TYPE_TXT: {
- 
-             AvahiStringList *strlst;
-+            size_t used = 0;
- 
--            for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next)
-+            for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next) {
-                 if (strlst->size > 255 || strlst->size <= 0)
-                     return 0;
- 
-+                used += 1+strlst->size;
-+                if (used > AVAHI_DNS_RDATA_MAX)
-+                    return 0;
-+            }
-+
-             return 1;
-         }
-     }
-
-From c6cab87df290448a63323c8ca759baa516166237 Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Wed, 25 Oct 2023 18:15:42 +0000
-Subject: [PATCH 2/2] tests: pass overly long TXT resource records
-
-to make sure they don't crash avahi any more.
-
-It reproduces https://github.com/lathiat/avahi/issues/455
----
- avahi-client/client-test.c       | 14 ++++++++++++++
- 2 files changed, 20 insertions(+)
-
-diff --git a/avahi-client/client-test.c b/avahi-client/client-test.c
-index ba979988..da0e43ad 100644
---- a/avahi-client/client-test.c
-+++ b/avahi-client/client-test.c
-@@ -22,6 +22,7 @@
- #endif
- 
- #include <stdio.h>
-+#include <string.h>
- #include <assert.h>
- 
- #include <avahi-client/client.h>
-@@ -33,6 +34,8 @@
- #include <avahi-common/malloc.h>
- #include <avahi-common/timeval.h>
- 
-+#include <avahi-core/dns.h>
-+
- static const AvahiPoll *poll_api = NULL;
- static AvahiSimplePoll *simple_poll = NULL;
- 
-@@ -222,6 +225,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
-     uint32_t cookie;
-     struct timeval tv;
-     AvahiAddress a;
-+    uint8_t rdata[AVAHI_DNS_RDATA_MAX+1];
-+    AvahiStringList *txt = NULL;
-+    int r;
- 
-     simple_poll = avahi_simple_poll_new();
-     poll_api = avahi_simple_poll_get(simple_poll);
-@@ -261,6 +267,14 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
-     error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0);
-     assert(error != AVAHI_OK);
- 
-+    memset(rdata, 1, sizeof(rdata));
-+    r = avahi_string_list_parse(rdata, sizeof(rdata), &txt);
-+    assert(r >= 0);
-+    assert(avahi_string_list_serialize(txt, NULL, 0) == sizeof(rdata));
-+    error = avahi_entry_group_add_service_strlst(group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", "_qotd._tcp", NULL, NULL, 123, txt);
-+    assert(error == AVAHI_ERR_INVALID_RECORD);
-+    avahi_string_list_free(txt);
-+
-     avahi_entry_group_commit (group);
- 
-     domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u");
diff --git a/pkgs/development/libraries/avahi/CVE-2023-38471-2.patch b/pkgs/development/libraries/avahi/CVE-2023-38471-2.patch
deleted file mode 100644
index be0faddbfef5d..0000000000000
--- a/pkgs/development/libraries/avahi/CVE-2023-38471-2.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 04ac71fd56a16365360f14bd4691219913e22f21 Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Tue, 24 Oct 2023 21:57:32 +0000
-Subject: [PATCH 1/2] smoke-test: call SetHostName with unusual names
-
-It's prompted by https://github.com/lathiat/avahi/issues/453
----
- avahi-core/server.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/avahi-core/server.c b/avahi-core/server.c
-index f6a21bb7..84df6b5d 100644
---- a/avahi-core/server.c
-+++ b/avahi-core/server.c
-@@ -1309,10 +1309,13 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     else
-         hn = avahi_normalize_name_strdup(host_name);
- 
-+    if (!hn)
-+        return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY);
-+
-     h = hn;
-     if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) {
-         avahi_free(h);
--        return AVAHI_ERR_INVALID_HOST_NAME;
-+        return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME);
-     }
- 
-     avahi_free(h);
-@@ -1320,7 +1323,7 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     h = label_escaped;
-     len = sizeof(label_escaped);
-     if (!avahi_escape_label(label, strlen(label), &h, &len))
--        return AVAHI_ERR_INVALID_HOST_NAME;
-+        return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME);
- 
-     if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION)
-         return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE);
-@@ -1330,7 +1333,7 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     avahi_free(s->host_name);
-     s->host_name = avahi_strdup(label_escaped);
-     if (!s->host_name)
--        return AVAHI_ERR_NO_MEMORY;
-+        return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY);
- 
-     update_fqdn(s);
- 
diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index 0381146988a0b..ac3db3650e76f 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -57,6 +57,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c.patch";
       sha256 = "sha256-Fanh9bvz+uknr5pAmltqijuUAZIG39JR2Lyq5zGKJ58=";
     })
+    # https://github.com/avahi/avahi/pull/480 merged Sept 19
+    (fetchpatch {
+      name = "bail-out-unless-escaped-labels-fit.patch";
+      url = "https://github.com/avahi/avahi/commit/20dec84b2480821704258bc908e7b2bd2e883b24.patch";
+      sha256 = "sha256-p/dOuQ/GInIcUwuFhQR3mGc5YBL5J8ho+1gvzcqEN0c=";
+    })
     # CVE-2023-38473
     # https://github.com/lathiat/avahi/pull/486 merged Oct 18
     (fetchpatch {
@@ -79,12 +85,39 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-4dG+5ZHDa+A4/CszYS8uXWlpmA89m7/jhbZ7rheMs7U=";
     })
     # https://github.com/lathiat/avahi/pull/499 merged Oct 25
-    # (but with the changes to '.github/workflows/smoke-tests.sh removed)
-    ./CVE-2023-38471-2.patch
+    (fetchpatch {
+      name = "CVE-2023-38471-2.patch";
+      url = "https://github.com/avahi/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460.patch";
+      sha256 = "sha256-uDtMPWuz1lsu7n0Co/Gpyh369miQ6GWGyC0UPQB/yI8=";
+    })
     # CVE-2023-38469
     # https://github.com/lathiat/avahi/pull/500 merged Oct 25
-    # (but with the changes to '.github/workflows/smoke-tests.sh removed)
-    ./CVE-2023-38469.patch
+    (fetchpatch {
+      name = "CVE-2023-38469.patch";
+      url = "https://github.com/avahi/avahi/commit/61b9874ff91dd20a12483db07df29fe7f35db77f.patch";
+      sha256 = "sha256-qR7scfQqhRGxg2n4HQsxVxCLkXbwZi+PlYxrOSEPsL0=";
+      excludes = [ ".github/workflows/smoke-tests.sh" ];
+    })
+    # https://github.com/avahi/avahi/pull/515 merged Nov 3
+    (fetchpatch {
+      name = "fix-compare-rrs-with-zero-length-rdata.patch";
+      url = "https://github.com/avahi/avahi/commit/177d75e8c43be45a8383d794ce4084dd5d600a9e.patch";
+      sha256 = "sha256-uwIyruAWgiWt0yakRrvMdYjjhEhUk5cIGKt6twyXbHw=";
+    })
+    # https://github.com/avahi/avahi/pull/519 merged Nov 8
+    (fetchpatch {
+      name = "reject-non-utf-8-service-names.patch";
+      url = "https://github.com/avahi/avahi/commit/2b6d3e99579e3b6e9619708fad8ad8e07ada8218.patch";
+      sha256 = "sha256-lwSA3eEQgH0g51r0i9/HJMJPRXrhQnTIEDxcYqUuLdI=";
+      excludes = [ "fuzz/fuzz-domain.c" ];
+    })
+    # https://github.com/avahi/avahi/pull/523 merged Nov 12
+    (fetchpatch {
+      name = "core-no-longer-supply-bogus-services-to-callbacks.patch";
+      url = "https://github.com/avahi/avahi/commit/93b14365c1c1e04efd1a890e8caa01a2a514bfd8.patch";
+      sha256 = "sha256-VBm8vsBZkTbbWAK8FI71SL89lZuYd1yFNoB5o+FvlEU=";
+      excludes = [ ".github/workflows/smoke-tests.sh" "fuzz/fuzz-packet.c" ];
+    })
   ];
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index f818e35c458e8..7a7d808795587 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.10";
+  version = "0.7.16";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    hash = "sha256-yJ0sgw0y9tIiIHgTPVnfYd8zAGjO83qfeeEzstGH9CE=";
+    hash = "sha256-76sBv4oChDrkv80HPktkULFNC37kfTNxjlwNg/FJiyA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 5c3abbc580879..360b82b6c6797 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.9.10";
+  version = "0.9.14";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xqNqyVtibR8oSMvl5RTU166FIxcbvGjZJOjJ9j6fU78=";
+    hash = "sha256-aeuIXqnO8divpguDpiPlYJHABYIqegpaDNGwqJ5TKZw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-event-stream/default.nix b/pkgs/development/libraries/aws-c-event-stream/default.nix
index 7f273ac80fa0b..8f469d93054ab 100644
--- a/pkgs/development/libraries/aws-c-event-stream/default.nix
+++ b/pkgs/development/libraries/aws-c-event-stream/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-event-stream";
-  version = "0.3.2";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uKprdBJn9yHDm2HCBOiuanizCtLi/VKrvUUScNv6OPY=";
+    hash = "sha256-wj3PZshUay3HJy+v7cidDL4mDAqSDiX+MmQtJDK4rTI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-http/default.nix b/pkgs/development/libraries/aws-c-http/default.nix
index 52d3507b55706..4b22e53a317e4 100644
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
-  version = "0.7.14";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    sha256 = "sha256-HrNdePWNw/5tDBeybnUjK3LgftnGQ4CBXPG0URaxIeU=";
+    hash = "sha256-S5ETVkdGTndt2GJBNL4DU5SycHAufsmN06xBDRMFVKo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index abb51d0df4176..65b5843897612 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.13.36";
+  version = "0.14.6";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TwPcsTMBOE1uIInH6/eQdUMV6uD7d60773THzc1/G9Y=";
+    hash = "sha256-fekeGghqMKbUqKWIfpZg3a6dCpgxywhmXPoGz9y4Aos=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-mqtt/default.nix b/pkgs/development/libraries/aws-c-mqtt/default.nix
index eb20be82f353b..2e6c6a5611150 100644
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-mqtt";
-  version = "0.9.10";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${version}";
-    sha256 = "sha256-hxisqBUARJLtmZniXaZ2th0hqWiKn4XQIy6I0Oz/kUs=";
+    hash = "sha256-MWcXTMwKtFnrNp+OnHxkiYCUXc3IUhM6iTQa+F9JwsQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index b3051916fbb8c..8db5b837ba6b3 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.4.0";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-tb9h78Gd4N11DPB2ETq241lvDQqHIy2HYBsJrBlLpxA=";
+    hash = "sha256-8eKQsP7AftNDccsZHPC9PcwpbpgZSvsioUuSsiggQDs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-sdkutils/default.nix b/pkgs/development/libraries/aws-c-sdkutils/default.nix
index 2c76371955cb7..7ced8b5a415d7 100644
--- a/pkgs/development/libraries/aws-c-sdkutils/default.nix
+++ b/pkgs/development/libraries/aws-c-sdkutils/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-sdkutils";
-  version = "0.1.12";
+  version = "0.1.15";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-sdkutils";
     rev = "v${version}";
-    sha256 = "sha256-4YuOC90FBcuNYGBsqw3wKYNGkg3MssezvR8bu6BNGeM=";
+    hash = "sha256-RTRDbdv+QmRG0Sk/R9qhl45WYEVyl+M0EceLFsoONTI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index 0cd6e4940c4dc..c41c5426d5666 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
-  version = "0.24.7";
+  version = "0.26.4";
 
   outputs = [ "out" "dev" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-AYO0ckqEx2jG7HduvaxASQMOsxuHGkRkyVsUP5WOs98=";
+    sha256 = "sha256-H5ms6fhhlkARn9g8S5Ma8bnisZv8mfNizP0QpzsF1tA=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 448139358e65c..0d210abd4a15e 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -27,13 +27,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.11.207";
+  version = "1.11.296";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "sha256-IsPDQJo+TZ2noLefroiWl/Jx8fXmrmY73WHNRO41sik=";
+    hash = "sha256-yg+OkeUaqwUQGQ5ThIVQUpF2rHm4FuFbcl5gE5WHHOQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/embree/default.nix b/pkgs/development/libraries/embree/default.nix
index 419572f3ff160..d956eae27e8da 100644
--- a/pkgs/development/libraries/embree/default.nix
+++ b/pkgs/development/libraries/embree/default.nix
@@ -1,32 +1,24 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, cmake, pkg-config, ispc, tbb, glfw,
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, ispc, tbb, glfw,
   openimageio, libjpeg, libpng, libpthreadstubs, libX11, glib }:
 
 stdenv.mkDerivation rec {
   pname = "embree";
-  version = "3.13.5";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "embree";
     repo = "embree";
     rev = "v${version}";
-    sha256 = "sha256-tfM4SGOFVBG0pQK9B/iN2xDaW3yjefnTtsoUad75m80=";
+    sha256 = "sha256-gQPlk0bDn04s2pncF22m/OpIbzF3NXKkRCZbmxfXEY4=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fixed-compilation-issues-for-arm-aarch64-processor-under-linux.patch";
-      url = "https://github.com/embree/embree/commit/82ca6b5ccb7abe0403a658a0e079926478f04cb1.patch";
-      hash = "sha256-l9S4PBk+yQUypQ22l05daD0ruouZKE4VHkGvzKxkH4o=";
-    })
-  ];
-
   postPatch = ''
     # Fix duplicate /nix/store/.../nix/store/.../ paths
     sed -i "s|SET(EMBREE_ROOT_DIR .*)|set(EMBREE_ROOT_DIR $out)|" \
       common/cmake/embree-config.cmake
     sed -i "s|$""{EMBREE_ROOT_DIR}/||" common/cmake/embree-config.cmake
-    substituteInPlace common/math/math.h --replace 'defined(__MACOSX__) && !defined(__INTEL_COMPILER)' 0
-    substituteInPlace common/math/math.h --replace 'defined(__WIN32__) || defined(__FreeBSD__)' 'defined(__WIN32__) || defined(__FreeBSD__) || defined(__MACOSX__)'
+    substituteInPlace common/math/emath.h --replace 'defined(__MACOSX__) && !defined(__INTEL_COMPILER)' 0
+    substituteInPlace common/math/emath.h --replace 'defined(__WIN32__) || defined(__FreeBSD__)' 'defined(__WIN32__) || defined(__FreeBSD__) || defined(__MACOSX__)'
   '';
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index fd79b8d7e97f3..383a157acbd14 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.6.7";
+  version = "2.6.8";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-ocLltZrMoAC7+ySBCvShFlcz1AfyFUeGWI4HbIzVe/w=";
+    hash = "sha256-9WWSMGLHfz1YhG8FWNIebQfKSkiMWIEt/e+zUgL6x64=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index 65e12e6b36729..6da6713a7f79b 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -6,13 +6,10 @@ let
     callPackage ./generic.nix (
       {
         inherit (darwin.apple_sdk.frameworks)
-          Cocoa
-          CoreServices
-          CoreAudio
-          CoreMedia
+          AppKit
+          AudioToolbox
           AVFoundation
-          MediaToolbox
-          VideoDecodeAcceleration
+          CoreImage
           VideoToolbox
           ;
       }
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index a15c41f100b59..bdc0cdd5ffa4c 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -35,22 +35,28 @@
   # Feature flags
 , withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
 , withAom ? withFullDeps # AV1 reference encoder
+, withAppKit ? withHeadlessDeps && stdenv.isDarwin # Apple AppKit framework
 , withAribcaption ? withFullDeps && lib.versionAtLeast version "6.1" # ARIB STD-B24 Caption Decoder/Renderer
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
+, withAudioToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple AudioToolbox
+, withAvFoundation ? withHeadlessDeps && stdenv.isDarwin # Apple AVFoundation framework
 , withBluray ? withFullDeps # BluRay reading
 , withBs2b ? withFullDeps # bs2b DSP library
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
 , withChromaprint ? withFullDeps # Audio fingerprinting
-, withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch && !hostPlatform.isRiscV))
+, withCoreImage ? withHeadlessDeps && stdenv.isDarwin # Apple CoreImage framework
+, withCuda ? withFullDeps && withNvcodec
 , withCudaLLVM ? withFullDeps
+, withCuvid ? withHeadlessDeps && withNvcodec
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
 , withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
 , withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
 , withDvdnav ? withFullDeps && withGPL && lib.versionAtLeast version "7" # needed for DVD demuxing
 , withDvdread ? withFullDeps && withGPL && lib.versionAtLeast version "7" # needed for DVD demuxing
 , withFdkAac ? withFullDeps && (!withGPL || withUnfree) # Fraunhofer FDK AAC de/encoder
+, withNvcodec ? withHeadlessDeps && (with stdenv; !isDarwin && !isAarch32 && !hostPlatform.isRiscV && hostPlatform == buildPlatform) # dynamically linked Nvidia code
 , withFlite ? withFullDeps # Voice Synthesis
 , withFontconfig ? withHeadlessDeps # Needed for drawtext filter
 , withFreetype ? withHeadlessDeps # Needed for drawtext filter
@@ -68,14 +74,14 @@
 , withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
 , withMp3lame ? withHeadlessDeps # LAME MP3 encoder
 , withMysofa ? withFullDeps # HRTF support via SOFAlizer
-, withNvdec ? withHeadlessDeps && (with stdenv; !isDarwin && hostPlatform == buildPlatform && !isAarch32 && !hostPlatform.isRiscV)
-, withNvenc ? withHeadlessDeps && (with stdenv; !isDarwin && hostPlatform == buildPlatform && !isAarch32 && !hostPlatform.isRiscV)
+, withNvdec ? withHeadlessDeps && withNvcodec
+, withNvenc ? withHeadlessDeps && withNvcodec
 , withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
 , withOpenal ? withFullDeps # OpenAL 1.1 capture support
 , withOpencl ? withFullDeps
 , withOpencoreAmrnb ? withFullDeps && withVersion3 # AMR-NB de/encoder
 , withOpencoreAmrwb ? withFullDeps && withVersion3 # AMR-WB decoder
-, withOpengl ? false # OpenGL rendering
+, withOpengl ? withFullDeps && !stdenv.isDarwin # OpenGL rendering
 , withOpenh264 ? withFullDeps # H.264/AVC encoder
 , withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
 , withOpenmpt ? withFullDeps # Tracked music files decoder
@@ -85,7 +91,7 @@
 , withQrencode ? withFullDeps && lib.versionAtLeast version "7" # QR encode generation
 , withQuirc ? withFullDeps && lib.versionAtLeast version "7" # QR decoding
 , withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
-, withRtmp ? false # RTMP[E] support
+, withRtmp ? withFullDeps # RTMP[E] support
 , withSamba ? withFullDeps && !stdenv.isDarwin && withGPLv3 # Samba protocol
 , withSdl2 ? withSmallDeps
 , withShaderc ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
@@ -95,12 +101,13 @@
 , withSsh ? withHeadlessDeps # SFTP protocol
 , withSvg ? withFullDeps # SVG protocol
 , withSvtav1 ? withHeadlessDeps && !stdenv.isAarch64 && !stdenv.hostPlatform.isMinGW # AV1 encoder/decoder (focused on speed and correctness)
-, withTensorflow ? false # Tensorflow dnn backend support
+, withTensorflow ? false # Tensorflow dnn backend support (Increases closure size by ~390 MiB)
 , withTheora ? withHeadlessDeps # Theora encoder
 , withV4l2 ? withHeadlessDeps && stdenv.isLinux  # Video 4 Linux support
 , withV4l2M2m ? withV4l2
 , withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
 , withVdpau ? withSmallDeps && !stdenv.hostPlatform.isMinGW # Vdpau hardware acceleration
+, withVideoToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple VideoToolbox
 , withVidStab ? withFullDeps && withGPL # Video stabilization
 , withVmaf ? withFullDeps && !stdenv.isAarch64 && lib.versionAtLeast version "5" # Netflix's VMAF (Video Multi-Method Assessment Fusion)
 , withVoAmrwbenc ? withFullDeps && withVersion3 # AMR-WB encoder
@@ -299,13 +306,10 @@
 /*
  *  Darwin frameworks
  */
+, AppKit
+, AudioToolbox
 , AVFoundation
-, Cocoa
-, CoreAudio
-, CoreMedia
-, CoreServices
-, MediaToolbox
-, VideoDecodeAcceleration
+, CoreImage
 , VideoToolbox
 /*
  *  Testing
@@ -366,6 +370,11 @@ assert buildAvformat -> buildAvcodec && buildAvutil; # configure flag since 0.6
 assert buildPostproc -> buildAvutil;
 assert buildSwscale -> buildAvutil;
 
+/*
+ *  External Library dependencies
+ */
+assert (withCuda || withCuvid || withNvdec  || withNvenc) -> withNvcodec;
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "ffmpeg" + (optionalString (ffmpegVariant != "small") "-${ffmpegVariant}");
   inherit version;
@@ -511,18 +520,23 @@ stdenv.mkDerivation (finalAttrs: {
      */
     (enableFeature withAlsa "alsa")
     (enableFeature withAom "libaom")
+    (enableFeature withAppKit "appkit")
   ] ++ optionals (versionAtLeast version "6.1") [
     (enableFeature withAribcaption "libaribcaption")
   ] ++ [
     (enableFeature withAss "libass")
+    (enableFeature withAudioToolbox "audiotoolbox")
+    (enableFeature withAvFoundation "avfoundation")
     (enableFeature withBluray "libbluray")
     (enableFeature withBs2b "libbs2b")
     (enableFeature withBzlib "bzlib")
     (enableFeature withCaca "libcaca")
     (enableFeature withCelt "libcelt")
     (enableFeature withChromaprint "chromaprint")
+    (enableFeature withCoreImage "coreimage")
     (enableFeature withCuda "cuda")
     (enableFeature withCudaLLVM "cuda-llvm")
+    (enableFeature withCuvid "cuvid")
     (enableFeature withDav1d "libdav1d")
     (enableFeature withDc1394 "libdc1394")
     (enableFeature withDrm "libdrm")
@@ -531,6 +545,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withDvdread "libdvdread")
   ] ++ [
     (enableFeature withFdkAac "libfdk-aac")
+    (enableFeature withNvcodec "ffnvcodec")
     (enableFeature withFlite "libflite")
     (enableFeature withFontconfig "fontconfig")
     (enableFeature withFontconfig "libfontconfig")
@@ -551,7 +566,6 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withModplug "libmodplug")
     (enableFeature withMp3lame "libmp3lame")
     (enableFeature withMysofa "libmysofa")
-    (enableFeature withNvdec "cuvid")
     (enableFeature withNvdec "nvdec")
     (enableFeature withNvenc "nvenc")
     (enableFeature withOpenal "openal")
@@ -593,6 +607,7 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ optionals (versionAtLeast version "6.0")  [
     (enableFeature withVpl "libvpl")
   ] ++ [
+    (enableFeature withVideoToolbox "videotoolbox")
     (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
     (enableFeature withVmaf "libvmaf")
     (enableFeature withVoAmrwbenc "libvo-amrwbenc")
@@ -651,20 +666,25 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = []
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
+  ++ optionals withAppKit [ AppKit ]
   ++ optionals withAribcaption [ libaribcaption ]
   ++ optionals withAss [ libass ]
+  ++ optionals withAudioToolbox [ AudioToolbox ]
+  ++ optionals withAvFoundation [ AVFoundation ]
   ++ optionals withBluray [ libbluray ]
   ++ optionals withBs2b [ libbs2b ]
   ++ optionals withBzlib [ bzip2 ]
   ++ optionals withCaca [ libcaca ]
   ++ optionals withCelt [ celt ]
   ++ optionals withChromaprint [ chromaprint ]
+  ++ optionals withCoreImage [ CoreImage ]
   ++ optionals withDav1d [ dav1d ]
   ++ optionals withDc1394 [ libdc1394 libraw1394 ]
   ++ optionals withDrm [ libdrm ]
   ++ optionals withDvdnav [ libdvdnav ]
   ++ optionals withDvdread [ libdvdread ]
   ++ optionals withFdkAac [ fdk_aac ]
+  ++ optionals withNvcodec [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withFlite [ flite ]
   ++ optionals withFontconfig [ fontconfig ]
   ++ optionals withFreetype [ freetype ]
@@ -682,7 +702,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withModplug [ libmodplug ]
   ++ optionals withMp3lame [ lame ]
   ++ optionals withMysofa [ libmysofa ]
-  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withOgg [ libogg ]
   ++ optionals withOpenal [ openal ]
   ++ optionals withOpencl [ ocl-icd opencl-headers ]
@@ -712,6 +731,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withV4l2 [ libv4l ]
   ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
   ++ optionals withVdpau [ libvdpau ]
+  ++ optionals withVideoToolbox [ VideoToolbox ]
   ++ optionals withVidStab [ vid-stab ]
   ++ optionals withVmaf [ libvmaf ]
   ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
@@ -732,17 +752,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withZimg [ zimg ]
   ++ optionals withZlib [ zlib ]
   ++ optionals withZmq [ zeromq4 ]
-  ++ optionals stdenv.isDarwin [
-    # TODO fine-grained flags
-    AVFoundation
-    Cocoa
-    CoreAudio
-    CoreMedia
-    CoreServices
-    MediaToolbox
-    VideoDecodeAcceleration
-    VideoToolbox
-  ];
+  ;
 
   buildFlags = [ "all" ]
     ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
@@ -810,7 +820,16 @@ stdenv.mkDerivation (finalAttrs: {
       ++ optional withGPLv3 gpl3Plus
       ++ optional withUnfree unfreeRedistributable
       ++ optional (withGPL && withUnfree) unfree;
-    pkgConfigModules = [ "libavutil" ];
+    pkgConfigModules = [ ]
+      ++ optional buildAvcodec "libavcodec"
+      ++ optional buildAvdevice "libavdevice"
+      ++ optional buildAvfilter "libavfilter"
+      ++ optional buildAvformat "libavformat"
+      ++ optional buildAvresample "libavresample"
+      ++ optional buildAvutil "libavutil"
+      ++ optional buildPostproc "libpostproc"
+      ++ optional buildSwresample "libswresample"
+      ++ optional buildSwscale "libswscale";
     platforms = platforms.all;
     # See https://github.com/NixOS/nixpkgs/pull/295344#issuecomment-1992263658
     broken = stdenv.hostPlatform.isMinGW && stdenv.hostPlatform.is64bit;
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 1786d84e7a4ba..cb2fc48c31de6 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -54,14 +54,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak";
-  version = "1.14.5";
+  version = "1.14.6";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [ "out" "dev" "man" "doc" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-W3DGTOesE04eoIARJW5COuXFTydyl0QVg/d9AT8n/6w="; # Taken from https://github.com/flatpak/flatpak/releases/
+    sha256 = "sha256-U482ssb4xw7v0S0TrVsa2DCCAQaovTqfa45NnegeSUY="; # Taken from https://github.com/flatpak/flatpak/releases/
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glfw/3.x.nix b/pkgs/development/libraries/glfw/3.x.nix
index 014e5f7e9f0e5..5e0b6adbb2267 100644
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@@ -1,47 +1,54 @@
 { stdenv, lib, fetchFromGitHub, cmake
 , libGL, libXrandr, libXinerama, libXcursor, libX11, libXi, libXext
 , Carbon, Cocoa, Kernel, OpenGL, fixDarwinDylibNames
-, waylandSupport ? false, extra-cmake-modules, wayland
-, wayland-protocols, libxkbcommon
+, extra-cmake-modules, wayland
+, wayland-scanner, wayland-protocols, libxkbcommon
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.3.10";
+  version = "3.4";
   pname = "glfw";
 
   src = fetchFromGitHub {
     owner = "glfw";
     repo = "GLFW";
     rev = version;
-    sha256 = "sha256-kTRXsfQ+9PFurG3ffz0lwnITAYAXtNl3h/3O6FSny5o=";
+    sha256 = "sha256-FcnQPDeNHgov1Z07gjFze0VMz2diOrpbKZCsI96ngz0=";
   };
 
   # Fix linkage issues on X11 (https://github.com/NixOS/nixpkgs/issues/142583)
-  patches = lib.optional (!waylandSupport) ./x11.patch;
+  patches = ./x11.patch;
 
   propagatedBuildInputs =
     lib.optionals stdenv.isDarwin [ OpenGL ]
     ++ lib.optionals stdenv.isLinux [ libGL ];
 
-  nativeBuildInputs = [ cmake ]
+  nativeBuildInputs = [ cmake extra-cmake-modules ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames
-    ++ lib.optional waylandSupport extra-cmake-modules;
+    ++ lib.optionals stdenv.isLinux [ wayland-scanner ];
 
   buildInputs =
     lib.optionals stdenv.isDarwin [ Carbon Cocoa Kernel ]
-    ++ lib.optionals (stdenv.isLinux && waylandSupport) [ wayland wayland-protocols libxkbcommon ]
-    ++ lib.optionals (stdenv.isLinux && !waylandSupport) [ libX11 libXrandr libXinerama libXcursor libXi libXext ];
+    ++ lib.optionals stdenv.isLinux [
+      wayland
+      wayland-protocols
+      libxkbcommon
+      libX11
+      libXrandr
+      libXinerama
+      libXcursor
+      libXi
+      libXext
+    ];
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
   ] ++ lib.optionals (!stdenv.isDarwin && !stdenv.hostPlatform.isWindows) [
     "-DCMAKE_C_FLAGS=-D_GLFW_GLX_LIBRARY='\"${lib.getLib libGL}/lib/libGL.so.1\"'"
-  ] ++ lib.optionals waylandSupport [
-    "-DGLFW_USE_WAYLAND=ON"
     "-DCMAKE_C_FLAGS=-D_GLFW_EGL_LIBRARY='\"${lib.getLib libGL}/lib/libEGL.so.1\"'"
   ];
 
-  postPatch = lib.optionalString waylandSupport ''
+  postPatch = lib.optionalString stdenv.isLinux ''
     substituteInPlace src/wl_init.c \
       --replace "libxkbcommon.so.0" "${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0"
   '';
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 68a6acdc83b17..be56527ec47bd 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -67,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals stdenv.isLinux [
     libcap
     libunwind
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
     elfutils
   ] ++ lib.optionals stdenv.isDarwin [
     Cocoa
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 72ec69bc177b7..e558428c67e0b 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "8.3.0";
+  version = "8.4.0";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${finalAttrs.version}/harfbuzz-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EJUB6uuL3j6tsl+rQWTpk/us4pw9d1vKocHlji8V+Ec=";
+    hash = "sha256-r06nPiWrdIyMBjt4wviOSIM9ubKsNp4pvRFXAueJdV4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/ldb/default.nix b/pkgs/development/libraries/ldb/default.nix
index 2f2f195245350..cdcf21edd799c 100644
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@@ -13,14 +13,15 @@
 , cmocka
 , wafHook
 , libxcrypt
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ldb";
   version = "2.9.0";
 
   src = fetchurl {
-    url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
+    url = "mirror://samba/ldb/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-EFqv9xrYgaf661gv1BauKCIbb94zj/+CgoBlBiwlB6U=";
   };
 
@@ -70,11 +71,16 @@ stdenv.mkDerivation rec {
 
   stripDebugList = [ "bin" "lib" "modules" ];
 
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = finalAttrs.finalPackage;
+  };
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "A LDAP-like embedded database";
     homepage = "https://ldb.samba.org/";
     license = licenses.lgpl3Plus;
+    pkgConfigModules = [ "ldb" ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index a808b62c3a3bf..ffac6412ef950 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -8,11 +8,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.8.1";
+  version = "3.8.2";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    hash = "sha256-qng9fEbm71HqPnPzfgqswSium9egIgpB6ZLesOQVg6c=";
+    hash = "sha256-x152jIe7QxeprFEFJnXBfou8yHuW0oHImLIVkSxByWw=";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index d58ba0bc5c5c1..ac8ebcb3eb1cb 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -44,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/libarchive/libarchive/commit/3bd918d92f8c34ba12de9c6604d96f9e262a59fc.patch";
       hash = "sha256-RM3xFM6S2DkM5DJ0kAba8eLzEXuY5/7AaU06maHJ6rM=";
     })
+    (fetchpatch {
+      name = "fix-suspicious-commit-from-known-bad-actor.patch";
+      url = "https://github.com/libarchive/libarchive/commit/6110e9c82d8ba830c3440f36b990483ceaaea52c.patch";
+      hash = "sha256-/j6rJ0xWhtXU0YCu1LOokxxNppy5Of6Q0XyO4U6la7M=";
+    })
   ];
 
   outputs = [ "out" "lib" "dev" ];
@@ -59,6 +64,10 @@ stdenv.mkDerivation (finalAttrs: {
       # access-time-related tests flakey on some systems
       "cpio/test/test_option_a.c"
       "cpio/test/test_option_t.c"
+    ] ++ lib.optionals (stdenv.isAarch64 && stdenv.isLinux) [
+      # only on some aarch64-linux systems?
+      "cpio/test/test_basic.c"
+      "cpio/test/test_format_newc.c"
     ];
     removeTest = testPath: ''
       substituteInPlace Makefile.am --replace "${testPath}" ""
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index 52bf3a272bab6..c59ace0aa23e8 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeflate";
-  version = "1.19";
+  version = "1.20";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-HgZ2an1PCPhiLsd3ZA7tgZ1wVTOdHzDr8FHrqJhEbQw=";
+    sha256 = "sha256-kHLdu/Pb94+arj98Jjp57FpvWbAXW49s9cxCA1cf898=";
   };
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "-DLIBDEFLATE_BUILD_SHARED_LIB=OFF" ];
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 243c26af8e58d..9cfe47fcb4d53 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.17";
+  version = "3.0.18";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "sha256-GqPCjI40kkqNv9zTnLdJgZVBxS4eZRHl+k/BN9vGnDo=";
+    sha256 = "sha256-32FNnCybXO67Vtg1LM6miJUaK+r0mlfjxgLQg1LD8Es=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix
index 44f4b025e50ef..ed162d115298c 100644
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@@ -37,12 +37,12 @@ stdenv.mkDerivation rec {
     + lib.optionalString enableDarwinABICompat ''
       for iconv_h_in in iconv.h.in iconv.h.build.in; do
         substituteInPlace "include/$iconv_h_in" \
-          --replace "#define iconv libiconv" "" \
-          --replace "#define iconv_close libiconv_close" "" \
-          --replace "#define iconv_open libiconv_open" "" \
-          --replace "#define iconv_open_into libiconv_open_into" "" \
-          --replace "#define iconvctl libiconvctl" "" \
-          --replace "#define iconvlist libiconvlist" ""
+          --replace-fail "#define iconv libiconv" "" \
+          --replace-fail "#define iconv_close libiconv_close" "" \
+          --replace-fail "#define iconv_open libiconv_open" "" \
+          --replace-fail "#define iconv_open_into libiconv_open_into" "" \
+          --replace-fail "#define iconvctl libiconvctl" "" \
+          --replace-fail "#define iconvlist libiconvlist" ""
       done
     '';
 
diff --git a/pkgs/development/libraries/libimobiledevice-glue/default.nix b/pkgs/development/libraries/libimobiledevice-glue/default.nix
index b17a571b33974..f85c559593d16 100644
--- a/pkgs/development/libraries/libimobiledevice-glue/default.nix
+++ b/pkgs/development/libraries/libimobiledevice-glue/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libimobiledevice-glue";
-  version = "1.0.0";
+  version = "1.2.0";
 
   outputs = [ "out" "dev" ];
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     owner = "libimobiledevice";
     repo = pname;
     rev = version;
-    hash = "sha256-9TjIYz6w61JaJgOJtWteIDk9bO3NnXp/2ZJwdirFcYM=";
+    hash = "sha256-Rfs1i1Tt8uf3WfR+cDlF4L75nFHg9VypjMhHt0TgkyQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 10dcc29785bd6..38414e56d7d2f 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -8,15 +8,22 @@
 , libjpeg
 , libpng
 , libwebp
+, gdk-pixbuf
 , openexr_3
 , pkg-config
+, makeWrapper
 , zlib
 , asciidoc
 , graphviz
 , doxygen
 , python3
+, lcms2
 }:
 
+let
+  loadersPath = "${gdk-pixbuf.binaryDir}/jxl-loaders.cache";
+in
+
 stdenv.mkDerivation rec {
   pname = "libjxl";
   version = "0.9.1";
@@ -37,6 +44,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
+    gdk-pixbuf
+    makeWrapper
     asciidoc
     doxygen
     python3
@@ -63,12 +72,14 @@ stdenv.mkDerivation rec {
   # conclusively in its README or otherwise; they can best be determined
   # by checking the CMake output for "Could NOT find".
   buildInputs = [
+    lcms2
     giflib
     gperftools # provides `libtcmalloc`
     gtest
     libjpeg
     libpng
     libwebp
+    gdk-pixbuf
     openexr_3
     zlib
   ];
@@ -96,17 +107,30 @@ stdenv.mkDerivation rec {
     # Viewer tools for evaluation.
     # "-DJPEGXL_ENABLE_VIEWERS=ON"
 
-    # TODO: Update this package to enable this (overridably via an option):
     # Enable plugins, such as:
     # * the `gdk-pixbuf` one, which allows applications like `eog` to load jpeg-xl files
     # * the `gimp` one, which allows GIMP to load jpeg-xl files
-    # "-DJPEGXL_ENABLE_PLUGINS=ON"
+    "-DJPEGXL_ENABLE_PLUGINS=ON"
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
     "-DJPEGXL_STATIC=ON"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch32 [
     "-DJPEGXL_FORCE_NEON=ON"
   ];
 
+  postPatch = ''
+    substituteInPlace plugins/gdk-pixbuf/jxl.thumbnailer \
+      --replace '/usr/bin/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-jxl"
+  '';
+
+  postInstall = ''
+    GDK_PIXBUF_MODULEDIR="$out/${gdk-pixbuf.moduleDir}" \
+    GDK_PIXBUF_MODULE_FILE="$out/${loadersPath}" \
+      gdk-pixbuf-query-loaders --update-cache
+    mkdir -p "$out/bin"
+    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-jxl" \
+      --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
+  '';
+
   CXXFLAGS = lib.optionalString stdenv.hostPlatform.isAarch32 "-mfp16-format=ieee";
 
   # FIXME x86_64-darwin:
diff --git a/pkgs/development/libraries/liblc3/default.nix b/pkgs/development/libraries/liblc3/default.nix
index f2ec852d3bf0a..bcefd8311fbf2 100644
--- a/pkgs/development/libraries/liblc3/default.nix
+++ b/pkgs/development/libraries/liblc3/default.nix
@@ -7,7 +7,7 @@
 
 let
   name = "liblc3";
-  version = "1.0.4";
+  version = "1.1.0";
 in
 stdenv.mkDerivation {
   pname = name;
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     owner = "google";
     repo = "liblc3";
     rev = "v${version}";
-    sha256 = "sha256-nQJgF/cWoCx5TkX4xOaLB9SzvhVXPY29bLh7UwPMWEE=";
+    sha256 = "sha256-pKd9wOrDjKhWX8vTsg6qkE71FQlsC7VM/uq0ss1vsAQ=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libplist/default.nix b/pkgs/development/libraries/libplist/default.nix
index e6d5fd920246f..8e38347c722e1 100644
--- a/pkgs/development/libraries/libplist/default.nix
+++ b/pkgs/development/libraries/libplist/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libplist";
-  version = "2.3.0";
+  version = "2.4.0";
 
   outputs = [ "bin" "dev" "out" ] ++ lib.optional enablePython "py";
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     owner = "libimobiledevice";
     repo = pname;
     rev = version;
-    hash = "sha256-fZfDSWVRg73dN+WF6LbgRSj8vtyeKeyjC8pWXFxUmBg=";
+    hash = "sha256-bH40HSp76w56tlxO5M1INAW4wRR7O27AY4H/CyEcp+Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libproxy/default.nix b/pkgs/development/libraries/libproxy/default.nix
index 076e4c33b964d..340cfafee3271 100644
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@@ -1,83 +1,131 @@
 { lib
-, stdenv
+, _experimental-update-script-combinators
+, curl
+, darwin
+, duktape
 , fetchFromGitHub
 , fetchpatch
-, pkg-config
-, cmake
-, zlib
-, dbus
-, networkmanager
-, enableJavaScript ? stdenv.isDarwin || lib.meta.availableOn stdenv.hostPlatform duktape
-, duktape
-, pcre
-, gsettings-desktop-schemas
+, gi-docgen
+, gitUpdater
 , glib
-, makeWrapper
-, python3
-, SystemConfiguration
-, CoreFoundation
-, JavaScriptCore
+, gobject-introspection
+, gsettings-desktop-schemas
+, makeHardcodeGsettingsPatch
+, meson
+, ninja
+, pkg-config
+, stdenv
+, substituteAll
+, vala
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libproxy";
-  version = "0.4.18";
+  version = "0.5.3";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchFromGitHub {
     owner = "libproxy";
     repo = "libproxy";
-    rev = version;
-    hash = "sha256-pqj1LwRdOK2CUu3hYIsogQIXxWzShDuKEbDTbtWkgnQ=";
+    rev = finalAttrs.version;
+    hash = "sha256-qdYB6HJkgboS8kkTvTqLy6Z3JYY5SOJsRl6nZM0iuvw=";
   };
 
-  patches = lib.optionals stdenv.isDarwin [
-    # https://github.com/libproxy/libproxy/pull/189
+  patches = [
+    # Minor refactoring. Allows the following patches to apply without rebasing.
     (fetchpatch {
-      url = "https://github.com/libproxy/libproxy/commit/4331b9db427ce2c25ff5eeb597bec4bc35ed1a0b.patch";
-      sha256 = "sha256-uTh3rYVvEke1iWVHsT3Zj2H1F+gyLrffcmyt0JEKaCA=";
+      url = "https://github.com/libproxy/libproxy/commit/397f4dc72607cc1bb3b584ffd3de49f8ba80491a.patch";
+      hash = "sha256-iUMBMpcVOLG+NxEj8Nd7JtKZFmoGXn0t6A2r2ayiteg=";
+      includes = [
+        "src/backend/plugins/config-gnome/config-gnome.c"
+      ];
+    })
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    # Disable schema presence detection, it would fail because it cannot be autopatched,
+    # and it will be hardcoded by the next patch anyway.
+    ./skip-gsettings-detection.patch
+
+    # Hardcode path to Settings schemas for GNOME & related desktops.
+    # Otherwise every app using libproxy would need to be wrapped individually.
+    (substituteAll {
+      src = ./hardcode-gsettings.patch;
+      gds = glib.getSchemaPath gsettings-desktop-schemas;
     })
   ];
 
-  outputs = [ "out" "dev" "py3" ];
+  postPatch = ''
+    # Fix running script that will try to install git hooks.
+    # Though it will not do anything since we do not keep .git/ directory.
+    # https://github.com/libproxy/libproxy/issues/262
+    chmod +x data/install-git-hook.sh
+    patchShebangs data/install-git-hook.sh
+
+    # Fix include-path propagation in non-static builds.
+    # https://github.com/libproxy/libproxy/pull/239#issuecomment-2056620246
+    substituteInPlace src/libproxy/meson.build \
+      --replace-fail "requires_private: 'gobject-2.0'" "requires: 'gobject-2.0'"
+  '';
 
   nativeBuildInputs = [
+    gi-docgen
+    gobject-introspection
+    meson
+    ninja
     pkg-config
-    cmake
-    makeWrapper
+    vala
   ];
 
   buildInputs = [
-    pcre
-    python3
-    zlib
-  ] ++ lib.optionals enableJavaScript [
-    (if stdenv.hostPlatform.isDarwin then JavaScriptCore else duktape)
-  ] ++ (if stdenv.hostPlatform.isDarwin then [
-    SystemConfiguration
-    CoreFoundation
-  ] else [
+    curl
+    duktape
+  ] ++ (if stdenv.hostPlatform.isDarwin then (with darwin.apple_sdk.frameworks; [
+    Foundation
+  ]) else [
     glib
-    dbus
-    networkmanager
+    gsettings-desktop-schemas
   ]);
 
-  cmakeFlags = [
-    "-DWITH_PYTHON2=OFF"
-    "-DPYTHON3_SITEPKG_DIR=${placeholder "py3"}/${python3.sitePackages}"
-  ] ++ lib.optional (enableJavaScript && !stdenv.hostPlatform.isDarwin) "-DWITH_MOZJS=ON";
+  mesonFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-Dconfig-gnome=false"
+  ];
 
-  postFixup = lib.optionalString stdenv.isLinux ''
-    # config_gnome3 uses the helper to find GNOME proxy settings
-    wrapProgram $out/libexec/pxgsettings --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
   '';
 
-  doCheck = false; # fails 1 out of 10 tests
+  passthru = {
+    hardcodeGsettingsPatch = makeHardcodeGsettingsPatch {
+      schemaIdToVariableMapping = {
+        "org.gnome.system.proxy" = "gds";
+        "org.gnome.system.proxy.http" = "gds";
+        "org.gnome.system.proxy.https" = "gds";
+        "org.gnome.system.proxy.ftp" = "gds";
+        "org.gnome.system.proxy.socks" = "gds";
+      };
+      inherit (finalAttrs) src;
+    };
+
+    updateScript =
+      let
+        updateSource = gitUpdater { };
+        updatePatch = _experimental-update-script-combinators.copyAttrOutputToFile "libproxy.hardcodeGsettingsPatch" ./hardcode-gsettings.patch;
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updatePatch
+      ];
+  };
 
   meta = with lib; {
-    platforms = platforms.linux ++ platforms.darwin;
-    license = licenses.lgpl21;
-    homepage = "https://libproxy.github.io/libproxy/";
     description = "A library that provides automatic proxy configuration management";
+    homepage = "https://libproxy.github.io/libproxy/";
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux ++ platforms.darwin;
     mainProgram = "proxy";
   };
-}
+})
diff --git a/pkgs/development/libraries/libproxy/hardcode-gsettings.patch b/pkgs/development/libraries/libproxy/hardcode-gsettings.patch
new file mode 100644
index 0000000000000..22aeb5836f9c5
--- /dev/null
+++ b/pkgs/development/libraries/libproxy/hardcode-gsettings.patch
@@ -0,0 +1,140 @@
+diff --git a/src/backend/plugins/config-gnome/config-gnome.c b/src/backend/plugins/config-gnome/config-gnome.c
+index 820827b..338e269 100644
+--- a/src/backend/plugins/config-gnome/config-gnome.c
++++ b/src/backend/plugins/config-gnome/config-gnome.c
+@@ -85,11 +85,60 @@ px_config_gnome_init (PxConfigGnome *self)
+   if (!self->available)
+     return;
+ 
+-  self->proxy_settings = g_settings_new ("org.gnome.system.proxy");
+-  self->http_proxy_settings = g_settings_new ("org.gnome.system.proxy.http");
+-  self->https_proxy_settings = g_settings_new ("org.gnome.system.proxy.https");
+-  self->ftp_proxy_settings = g_settings_new ("org.gnome.system.proxy.ftp");
+-  self->socks_proxy_settings = g_settings_new ("org.gnome.system.proxy.socks");
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy", FALSE);
++    self->proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.http",
++                                             FALSE);
++    self->http_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.https",
++                                             FALSE);
++    self->https_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.ftp",
++                                             FALSE);
++    self->ftp_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.socks",
++                                             FALSE);
++    self->socks_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
+ }
+ 
+ static void
+diff --git a/tests/config-gnome-test.c b/tests/config-gnome-test.c
+index f80914a..118d429 100644
+--- a/tests/config-gnome-test.c
++++ b/tests/config-gnome-test.c
+@@ -60,11 +60,60 @@ static void
+ fixture_setup (Fixture       *self,
+                gconstpointer  data)
+ {
+-  self->proxy_settings = g_settings_new ("org.gnome.system.proxy");
+-  self->http_proxy_settings = g_settings_new ("org.gnome.system.proxy.http");
+-  self->https_proxy_settings = g_settings_new ("org.gnome.system.proxy.https");
+-  self->ftp_proxy_settings = g_settings_new ("org.gnome.system.proxy.ftp");
+-  self->socks_proxy_settings = g_settings_new ("org.gnome.system.proxy.socks");
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy", FALSE);
++    self->proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.http",
++                                             FALSE);
++    self->http_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.https",
++                                             FALSE);
++    self->https_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.ftp",
++                                             FALSE);
++    self->ftp_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.socks",
++                                             FALSE);
++    self->socks_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
+ }
+ 
+ static void
diff --git a/pkgs/development/libraries/libproxy/skip-gsettings-detection.patch b/pkgs/development/libraries/libproxy/skip-gsettings-detection.patch
new file mode 100644
index 0000000000000..1882079b94b0b
--- /dev/null
+++ b/pkgs/development/libraries/libproxy/skip-gsettings-detection.patch
@@ -0,0 +1,29 @@
+diff --git a/src/backend/plugins/config-gnome/config-gnome.c b/src/backend/plugins/config-gnome/config-gnome.c
+index 52e812e..a1edcab 100644
+--- a/src/backend/plugins/config-gnome/config-gnome.c
++++ b/src/backend/plugins/config-gnome/config-gnome.c
+@@ -57,7 +57,6 @@ enum {
+ static void
+ px_config_gnome_init (PxConfigGnome *self)
+ {
+-  GSettingsSchemaSource *source;
+   g_autoptr (GSettingsSchema) proxy_schema = NULL;
+   const char *desktops;
+ 
+@@ -71,15 +70,7 @@ px_config_gnome_init (PxConfigGnome *self)
+   if (strstr (desktops, "GNOME") == NULL)
+     return;
+ 
+-  source = g_settings_schema_source_get_default ();
+-  if (!source) {
+-    g_warning ("GNOME desktop detected but no schemes installed, aborting.");
+-    return;
+-  }
+-
+-  proxy_schema = g_settings_schema_source_lookup (source, "org.gnome.system.proxy", TRUE);
+-
+-  self->available = proxy_schema != NULL;
++  self->available = TRUE;
+   if (!self->available)
+     return;
+ 
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index f82cc8b4c1081..c5788e6903446 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.57.92";
+  version = "2.58.0";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -50,13 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Kiwwvqvzz91ApKbb7T+zPmd8ruXY8wR4gkm3Mee+OFI=";
+    hash = "sha256-18REqSZAa1l5C+DerhluGO0mBZ2lc/oaqeycp2WKVZw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-yJf3V2dPwI+RcDH6Lh/AhUgaisdbTnzdAFt+SeNw9NY=";
+    hash = "sha256-ta+3KkDtqTLGoKknUn89c+3XHzvcZyPFPFpgLH5f5uw=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };
diff --git a/pkgs/development/libraries/libsamplerate/default.nix b/pkgs/development/libraries/libsamplerate/default.nix
index 198bc73628261..bebe6c591ba43 100644
--- a/pkgs/development/libraries/libsamplerate/default.nix
+++ b/pkgs/development/libraries/libsamplerate/default.nix
@@ -5,11 +5,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "libsamplerate";
-  version = "0.1.9";
+  version = "0.2.2";
 
   src = fetchurl {
-    url = "http://www.mega-nerd.com/SRC/${pname}-${version}.tar.gz";
-    sha256 = "1ha46i0nbibq0pl0pjwcqiyny4hj8lp1bnl4dpxm64zjw9lb2zha";
+    url = "https://github.com/libsndfile/libsamplerate/releases/download/${version}/libsamplerate-${version}.tar.xz";
+    hash = "sha256-MljaKAUR0ktJ1rCGFbvoJNDKzJhCsOTK8RxSzysEOJM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -18,20 +18,17 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-fftw" ];
 
-  outputs = [ "bin" "dev" "out" ];
+  outputs = [ "dev" "out" ];
 
   postConfigure = optionalString stdenv.isDarwin ''
     # need headers from the Carbon.framework in /System/Library/Frameworks to
     # compile this on darwin -- not sure how to handle
     NIX_CFLAGS_COMPILE+=" -I${Carbon}/Library/Frameworks/Carbon.framework/Headers"
-
-    substituteInPlace examples/Makefile --replace "-fpascal-strings" ""
   '';
 
   meta = with lib; {
     description = "Sample Rate Converter for audio";
-    mainProgram = "sndfile-resample";
-    homepage    = "http://www.mega-nerd.com/SRC/index.html";
+    homepage    = "https://libsndfile.github.io/libsamplerate/";
     license     = licenses.bsd2;
     maintainers = with maintainers; [ lovek323 ];
     platforms   = platforms.all;
diff --git a/pkgs/development/libraries/libtiff/4.5.nix b/pkgs/development/libraries/libtiff/4.5.nix
deleted file mode 100644
index 3b24c6f1a2e1d..0000000000000
--- a/pkgs/development/libraries/libtiff/4.5.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitLab
-, fetchpatch
-
-, autoreconfHook
-, pkg-config
-, sphinx
-
-, libdeflate
-, libjpeg
-, xz
-, zlib
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libtiff";
-  version = "4.5.1";
-
-  src = fetchFromGitLab {
-    owner = "libtiff";
-    repo = "libtiff";
-    rev = "v${version}";
-    hash = "sha256-qQEthy6YhNAQmdDMyoCIvK8f3Tx25MgqhJZW74CB93E=";
-  };
-
-  patches = [
-    # cf. https://bugzilla.redhat.com/2224974
-    (fetchpatch {
-      name = "CVE-2023-40745.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/bdf7b2621c62e04d0408391b7d5611502a752cd0.diff";
-      hash = "sha256-HdU02YJ1/T3dnCT+yG03tUyAHkgeQt1yjZx/auCQxyw=";
-    })
-    # cf. https://bugzilla.redhat.com/2224971
-    (fetchpatch {
-      name = "CVE-2023-41175.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/965fa243004e012adc533ae8e38db3055f101a7f.diff";
-      hash = "sha256-Pvg6JfJWOIaTrfFF0YSREZkS9saTG9IsXnsXtcyKILA=";
-    })
-    # FreeImage needs this patch
-    ./headers-4.5.patch
-    # libc++abi 11 has an `#include <version>`, this picks up files name
-    # `version` in the project's include paths
-    ./rename-version-4.5.patch
-  ];
-
-  postPatch = ''
-    mv VERSION VERSION.txt
-  '';
-
-  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
-
-  postFixup = ''
-    moveToOutput include/tif_config.h $dev_private
-    moveToOutput include/tif_dir.h $dev_private
-    moveToOutput include/tif_hash_set.h $dev_private
-    moveToOutput include/tiffiop.h $dev_private
-  '';
-
-  # If you want to change to a different build system, please make
-  # sure cross-compilation works first!
-  nativeBuildInputs = [ autoreconfHook pkg-config sphinx ];
-
-  propagatedBuildInputs = [
-    libdeflate
-    libjpeg
-    xz
-    zlib
-  ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  meta = with lib; {
-    description = "Library and utilities for working with the TIFF image file format";
-    homepage = "https://libtiff.gitlab.io/libtiff";
-    changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
-    # XXX not enabled for now to keep hydra builds running,
-    # but we have to keep an eye on security updates in supported version
-    #knownVulnerabilities = [ "support for version 4.5 ended in Sept 2023" ];
-    maintainers = with maintainers; [ yarny ];
-    license = licenses.libtiff;
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 04b67ff83bdeb..c8871a4ba68e8 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -28,9 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libtiff";
   version = "4.6.0";
 
-  # if you update this, please consider adding patches and/or
-  # setting `knownVulnerabilities` in libtiff `4.5.nix`
-
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
@@ -93,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "Library and utilities for working with the TIFF image file format";
     homepage = "https://libtiff.gitlab.io/libtiff";
-    changelog = "https://libtiff.gitlab.io/libtiff/v${finalAttrs.version}.html";
+    changelog = "https://libtiff.gitlab.io/libtiff/releases/v${finalAttrs.version}.html";
     license = licenses.libtiff;
     platforms = platforms.unix ++ platforms.windows;
     pkgConfigModules = [ "libtiff-4" ];
diff --git a/pkgs/development/libraries/libtiff/headers-4.5.patch b/pkgs/development/libraries/libtiff/headers-4.5.patch
deleted file mode 100644
index 49af1abb0a54a..0000000000000
--- a/pkgs/development/libraries/libtiff/headers-4.5.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-export private headers for freeimage
---- i/libtiff/Makefile.am
-+++ w/libtiff/Makefile.am
-@@ -36,8 +36,12 @@ EXTRA_DIST = \
- 	tiffconf.h.cmake.in
-
- libtiffinclude_HEADERS = \
-+	tif_config.h \
-+	tif_dir.h \
-+	tif_hash_set.h \
- 	tiff.h \
- 	tiffio.h \
-+	tiffiop.h \
- 	tiffvers.h
-
- if HAVE_CXX
diff --git a/pkgs/development/libraries/libtiff/libtiff_t.nix b/pkgs/development/libraries/libtiff/libtiff_t.nix
new file mode 100644
index 0000000000000..37e48f6ea14f4
--- /dev/null
+++ b/pkgs/development/libraries/libtiff/libtiff_t.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, fetchzip
+
+, autoreconfHook
+, pkg-config
+, sphinx
+
+, libdeflate
+, libjpeg
+, xz
+, zlib
+}:
+
+# This is a fork created by the hylafaxplus developer to
+# restore tools dropped by original libtiff in version 4.6.0.
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libtiff_t";
+  version = "4.6.0t";
+
+  src = fetchzip {
+    url = "http://www.libtiff.org/downloads/tiff-${finalAttrs.version}.tar.xz";
+    hash = "sha256-9ov4w2jw4LtKr82/4jWMAGhc5GEdviJ7bT+y0+U/Ac4=";
+  };
+
+  patches = [
+    # FreeImage needs this patch
+    ./headers.patch
+    # libc++abi 11 has an `#include <version>`, this picks up files name
+    # `version` in the project's include paths
+    ./rename-version.patch
+  ];
+
+  postPatch = ''
+    mv VERSION VERSION.txt
+  '';
+
+  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
+
+  postFixup = ''
+    moveToOutput include/tif_config.h $dev_private
+    moveToOutput include/tif_dir.h $dev_private
+    moveToOutput include/tif_hash_set.h $dev_private
+    moveToOutput include/tiffiop.h $dev_private
+  '';
+
+  # If you want to change to a different build system, please make
+  # sure cross-compilation works first!
+  nativeBuildInputs = [ autoreconfHook pkg-config sphinx ];
+
+  # TODO: opengl support (bogus configure detection)
+  propagatedBuildInputs = [
+    libdeflate
+    libjpeg
+    xz
+    zlib
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Library and utilities for working with the TIFF image file format (fork containing tools dropped in original libtiff version)";
+    homepage = "http://www.libtiff.org";
+    changelog = "http://www.libtiff.org/releases/v${finalAttrs.version}.html";
+    maintainers = with maintainers; [ yarny ];
+    license = licenses.libtiff;
+    platforms = platforms.unix ++ platforms.windows;
+    pkgConfigModules = [ "libtiff-4" ];
+  };
+})
diff --git a/pkgs/development/libraries/libtiff/rename-version-4.5.patch b/pkgs/development/libraries/libtiff/rename-version-4.5.patch
deleted file mode 100644
index 3e93569d4245a..0000000000000
--- a/pkgs/development/libraries/libtiff/rename-version-4.5.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-fix case-insensitive build
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -34,7 +34,7 @@ docfiles = \
- 	README.md \
- 	RELEASE-DATE \
- 	TODO \
--	VERSION
-+	VERSION.txt
-
- EXTRA_DIST = \
- 	cmake \
-@@ -61,7 +61,7 @@ SUBDIRS = port libtiff tools build contrib test doc
-
- release:
-	(rm -f $(top_srcdir)/RELEASE-DATE && echo $(LIBTIFF_RELEASE_DATE) > $(top_srcdir)/RELEASE-DATE)
--	(rm -f $(top_srcdir)/VERSION && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION)
-+	(rm -f $(top_srcdir)/VERSION.txt && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION.txt)
-	(rm -f $(top_srcdir)/libtiff/tiffvers.h && sed 's,LIBTIFF_VERSION,$(LIBTIFF_VERSION),;s,LIBTIFF_RELEASE_DATE,$(LIBTIFF_RELEASE_DATE),;s,LIBTIFF_MAJOR_VERSION,$(LIBTIFF_MAJOR_VERSION),;s,LIBTIFF_MINOR_VERSION,$(LIBTIFF_MINOR_VERSION),;s,LIBTIFF_MICRO_VERSION,$(LIBTIFF_MICRO_VERSION),' $(top_srcdir)/libtiff/tiffvers.h.in > $(top_srcdir)/libtiff/tiffvers.h)
-
- pkgconfigdir = $(libdir)/pkgconfig
diff --git a/pkgs/development/libraries/libucl/default.nix b/pkgs/development/libraries/libucl/default.nix
index 77f8f6bfb920a..6275a85e6ee2e 100644
--- a/pkgs/development/libraries/libucl/default.nix
+++ b/pkgs/development/libraries/libucl/default.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libucl";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "vstakhov";
     repo = pname;
     rev = version;
-    sha256 = "sha256-udgsgo6bT7WnUYnAzqHxOtdDg6av3XplptS8H5ukxjo=";
+    sha256 = "sha256-esNEVBa660rl3Oo2SLaLrFThFkjbqtZ1r0tjMq3h6cM=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/development/libraries/libzim/default.nix b/pkgs/development/libraries/libzim/default.nix
index 50cb0847089be..80d3db6d2e322 100644
--- a/pkgs/development/libraries/libzim/default.nix
+++ b/pkgs/development/libraries/libzim/default.nix
@@ -1,25 +1,26 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, icu
-, meson
-, ninja
-, pkg-config
-, python3
-, xapian
-, xz
-, zstd
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  icu,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  xapian,
+  xz,
+  zstd,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libzim";
-  version = "9.1.0";
+  version = "9.2.0";
 
   src = fetchFromGitHub {
     owner = "openzim";
-    repo = pname;
+    repo = "libzim";
     rev = "refs/tags/${version}";
-    hash = "sha256-yWnW/+CaQwbemrNLzvQpXw5yvW2Q6LtwDgvA58+fVUs=";
+    hash = "sha256-WAbNSrgm/lTARD7Ml4vVLChQLNR23vEZtyE4MXnhnB4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mesa/backport-radeon-crash-fix.patch b/pkgs/development/libraries/mesa/backport-radeon-crash-fix.patch
deleted file mode 100644
index 62915abcf242a..0000000000000
--- a/pkgs/development/libraries/mesa/backport-radeon-crash-fix.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-index 2e1d9c488e2..7979cad75fa 100644
---- a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-+++ b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-@@ -729,7 +729,7 @@ bool radeon_bo_can_reclaim_slab(void *priv, struct pb_slab_entry *entry)
- {
-    struct radeon_bo *bo = container_of(entry, struct radeon_bo, u.slab.entry);
- 
--   return radeon_bo_can_reclaim(NULL, &bo->base);
-+   return radeon_bo_can_reclaim(priv, &bo->base);
- }
- 
- static void radeon_bo_slab_destroy(void *winsys, struct pb_buffer_lean *_buf)
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 7920b4405b2e1..a544e1b25466e 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -81,8 +81,8 @@
 # nix build .#mesa .#pkgsi686Linux.mesa .#pkgsCross.aarch64-multiplatform.mesa .#pkgsMusl.mesa
 
 let
-  version = "24.0.3";
-  hash = "sha256-d67JoqN7fTWW6hZAs8xT0LXZs7Uqvtid4H43F+kb/b4=";
+  version = "24.0.5";
+  hash = "sha256-OMwkXKj6o8adptJof4kGN3AB9jNlNIpizG9/r7HowBg=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
@@ -141,11 +141,6 @@ self = stdenv.mkDerivation {
 
   patches = [
     ./opencl.patch
-
-    # Backport crash fix for Radeon (legacy) kernel driver
-    # see https://gitlab.freedesktop.org/mesa/mesa/-/issues/10613
-    # FIXME: remove when merged upstream
-    ./backport-radeon-crash-fix.patch
   ];
 
   postPatch = ''
@@ -254,7 +249,8 @@ self = stdenv.mkDerivation {
   ] ++ [
     python3Packages.python # for shebang
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ elfutils libomxil-bellagio libva-minimal udev lm_sensors ]
+    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [ elfutils ]
     ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader
diff --git a/pkgs/development/libraries/mtdev/default.nix b/pkgs/development/libraries/mtdev/default.nix
index e067e0c3d2746..334cda54d1bf4 100644
--- a/pkgs/development/libraries/mtdev/default.nix
+++ b/pkgs/development/libraries/mtdev/default.nix
@@ -1,16 +1,26 @@
-{ lib, stdenv, fetchurl, evdev-proto }:
+{ lib
+, stdenv
+, fetchurl
+, evdev-proto
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "mtdev";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchurl {
     url = "https://bitmath.org/code/mtdev/${pname}-${version}.tar.bz2";
-    sha256 = "1q700h9dqcm3zl6c3gj0qxxjcx6ibw2c51wjijydhwdcm26v5mqm";
+    hash = "sha256-oQetrSEB/srFSsf58OCg3RVdlUGT2lXCNAyX8v8dgU4=";
   };
 
   buildInputs = lib.optional stdenv.hostPlatform.isFreeBSD evdev-proto;
 
+  passthru.updateScript = gitUpdater {
+    url = "https://bitmath.org/git/mtdev.git";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     homepage = "https://bitmath.org/code/mtdev/";
     description = "Multitouch Protocol Translation Library";
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index 805fe6e3bb200..5566b0c8f67df 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -32,11 +32,11 @@ assert enableJemalloc -> enableApp;
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.60.0";
+  version = "1.61.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-W4wmgdQstLMcs+DaDggb+jAl1cNZKN6PYHAVUgFbAM4=";
+    sha256 = "sha256-Toz37DLUxaQwlmJC1yA10lXNlHCodm1h7tegGQ3VRP0=";
   };
 
   outputs = [ "out" "dev" "lib" "doc" "man" ];
diff --git a/pkgs/development/libraries/npth/default.nix b/pkgs/development/libraries/npth/default.nix
index f7a31ad8086fd..1ca747048e332 100644
--- a/pkgs/development/libraries/npth/default.nix
+++ b/pkgs/development/libraries/npth/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook }:
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, pkgsCross }:
 
 stdenv.mkDerivation rec {
   pname = "npth";
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests = {
+    musl = pkgsCross.musl64.npth;
+  };
+
   meta = with lib; {
     description = "The New GNU Portable Threads Library";
     mainProgram = "npth-config";
diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index a59c9795b223d..e5fe5bd40a1b5 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.2.2";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-7KBjZpImSaW4GiK0ZCpMcjBPQ9aMmN5LW+/m6lkGK68=";
+    hash = "sha256-mVUxxYe6teiJ18PQ9703/kjBpJ9+a7vcDme+NwtQQQM=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 4d1c256e301bc..23234c40e3f89 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -13,6 +13,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-4qU5hP8LB9/bWuRIa7ubIcyo598kNAlsyb8bcow1C8s=";
   };
 
+  postPatch = ''
+    # Fix jit autodetection:
+    #   https://github.com/PCRE2Project/pcre2/pull/396
+    # Applying manually to avoid fetchpatch and autoreconfHook.
+    # TODO: remove once 10.44 is released
+    substituteInPlace configure --replace-fail \
+      '#include "src/sljit/sljitConfigInternal.h"' \
+      '#include "src/sljit/sljitConfigCPU.h"'
+  '';
+
   configureFlags = [
     "--enable-pcre2-16"
     "--enable-pcre2-32"
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 3459112456fe9..f22a86277b8e2 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -76,7 +76,7 @@ assert ldacbtSupport -> bluezSupport;
 
 stdenv.mkDerivation(finalAttrs: {
   pname = "pipewire";
-  version = "1.0.4";
+  version = "1.0.5";
 
   outputs = [
     "out"
@@ -92,7 +92,7 @@ stdenv.mkDerivation(finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     rev = finalAttrs.version;
-    sha256 = "sha256-LROI1rGQELlGXkapX3XfDqB7Rc5YAOdCwaMQUG/iU8c=";
+    sha256 = "sha256-lgrwN83eywMKdsm0ig9QATDt3U5RboJ4kyILE+ts9Ts=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index e18bc64502066..3a83c89cd05d1 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -31,6 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-oGJNuQGAx923n8epFRCT3DfGRtjDjT8jL3Z89kuFoiY=";
   };
 
+  # Raise test timeout, 120s can be slightly exceeded on slower hardware
+  postPatch = ''
+    substituteInPlace test/meson.build \
+      --replace-fail 'timeout : 120' 'timeout : 240'
+  '';
+
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
   nativeBuildInputs = [ meson ninja pkg-config ];
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
index 37be727298521..e1ed990dc0b38 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
@@ -3,16 +3,28 @@
 , qtlanguageserver
 , qtshadertools
 , openssl
+, stdenv
 , python3
+, lib
+, pkgsBuildBuild
 }:
 
 qtModule {
   pname = "qtdeclarative";
-  propagatedBuildInputs = [ qtbase qtlanguageserver qtshadertools openssl python3 ];
+  strictDeps = !stdenv.isDarwin; # fails to detect python3 otherwise
+  propagatedBuildInputs = [ qtbase qtlanguageserver qtshadertools openssl ];
+  nativeBuildInputs = [ python3 ];
   patches = [
     # prevent headaches from stale qmlcache data
     ../patches/0001-qtdeclarative-disable-qml-disk-cache.patch
     # add version specific QML import path
     ../patches/0002-qtdeclarative-also-use-versioned-qml-paths.patch
   ];
+  cmakeFlags = [
+    "-DQt6ShaderToolsTools_DIR=${pkgsBuildBuild.qt6.qtshadertools}/lib/cmake/Qt6ShaderTools"
+  ]
+  # Conditional is required to prevent infinite recursion during a cross build
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "-DQt6QmlTools_DIR=${pkgsBuildBuild.qt6.qtdeclarative}/lib/cmake/Qt6QmlTools"
+  ];
 }
diff --git a/pkgs/development/libraries/qt-6/modules/qtmultimedia.nix b/pkgs/development/libraries/qt-6/modules/qtmultimedia.nix
index 5c9a0e58a82c9..4045a55f6d6e9 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmultimedia.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmultimedia.nix
@@ -22,18 +22,30 @@
 , libunwind
 , orc
 , VideoToolbox
+, pkgsBuildBuild
 }:
 
 qtModule {
   pname = "qtmultimedia";
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libunwind orc ffmpeg_6 ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ libpulseaudio elfutils alsa-lib wayland libXrandr libva ];
-  propagatedBuildInputs = [ qtbase qtdeclarative qtsvg qtshadertools qtquick3d ]
+  buildInputs = [ ffmpeg_6 ]
+    ++ lib.optionals (!stdenv.hostPlatform.isMinGW) [ libunwind orc ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ libpulseaudio alsa-lib wayland libXrandr libva ]
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [ elfutils ];
+  propagatedBuildInputs = [ qtbase qtdeclarative qtsvg qtshadertools ]
+    ++ lib.optionals (!stdenv.hostPlatform.isMinGW) [ qtquick3d ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [ gstreamer gst-plugins-base gst-plugins-good gst-libav gst-vaapi ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ VideoToolbox ];
 
-  cmakeFlags = [ "-DENABLE_DYNAMIC_RESOLVE_VAAPI_SYMBOLS=0" ];
+  patches = lib.optionals stdenv.hostPlatform.isMinGW [
+    ../patches/qtmultimedia-windows-no-uppercase-libs.patch
+    ../patches/qtmultimedia-windows-resolve-function-name.patch
+  ];
+
+  cmakeFlags = [
+    "-DENABLE_DYNAMIC_RESOLVE_VAAPI_SYMBOLS=0"
+    "-DQt6ShaderToolsTools_DIR=${pkgsBuildBuild.qt6.qtshadertools}/lib/cmake/Qt6ShaderToolsTools"
+  ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin
     "-include AudioToolbox/AudioToolbox.h";
diff --git a/pkgs/development/libraries/qt-6/patches/qtmultimedia-windows-no-uppercase-libs.patch b/pkgs/development/libraries/qt-6/patches/qtmultimedia-windows-no-uppercase-libs.patch
new file mode 100644
index 0000000000000..05f009bacdad8
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtmultimedia-windows-no-uppercase-libs.patch
@@ -0,0 +1,13 @@
+diff --git a/src/plugins/multimedia/ffmpeg/qffmpegscreencapture_dxgi.cpp b/src/plugins/multimedia/ffmpeg/qffmpegscreencapture_dxgi.cpp
+index c0fbb53..3c82085 100644
+--- a/src/plugins/multimedia/ffmpeg/qffmpegscreencapture_dxgi.cpp
++++ b/src/plugins/multimedia/ffmpeg/qffmpegscreencapture_dxgi.cpp
+@@ -14,7 +14,7 @@
+ #include <qwaitcondition.h>
+ #include <qmutex.h>
+ 
+-#include "D3d11.h"
++#include "d3d11.h"
+ #include "dxgi1_2.h"
+ 
+ #include <system_error>
diff --git a/pkgs/development/libraries/qt-6/patches/qtmultimedia-windows-resolve-function-name.patch b/pkgs/development/libraries/qt-6/patches/qtmultimedia-windows-resolve-function-name.patch
new file mode 100644
index 0000000000000..681e36e0c5135
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtmultimedia-windows-resolve-function-name.patch
@@ -0,0 +1,30 @@
+diff --git a/src/plugins/multimedia/ffmpeg/qwincapturablewindows.cpp b/src/plugins/multimedia/ffmpeg/qwincapturablewindows.cpp
+index aac77ae..71ffed6 100644
+--- a/src/plugins/multimedia/ffmpeg/qwincapturablewindows.cpp
++++ b/src/plugins/multimedia/ffmpeg/qwincapturablewindows.cpp
+@@ -42,11 +42,7 @@ static QString windowTitle(HWND hwnd) {
+     return QString::fromStdWString(buffer);
+ }
+ 
+-QList<QCapturableWindow> QWinCapturableWindows::windows() const
+-{
+-    QList<QCapturableWindow> result;
+-
+-    auto windowHandler = [](HWND hwnd, LPARAM lParam) {
++static int __stdcall windowHandler(HWND hwnd, LPARAM lParam) {
+         if (!canCaptureWindow(hwnd))
+             return TRUE; // Ignore window and continue enumerating
+ 
+@@ -58,7 +54,11 @@ QList<QCapturableWindow> QWinCapturableWindows::windows() const
+         windows.push_back(windowData.release()->create());
+ 
+         return TRUE;
+-    };
++}
++
++QList<QCapturableWindow> QWinCapturableWindows::windows() const
++{
++    QList<QCapturableWindow> result;
+ 
+     ::EnumWindows(windowHandler, reinterpret_cast<LPARAM>(&result));
+ 
diff --git a/pkgs/development/libraries/rustls-ffi/default.nix b/pkgs/development/libraries/rustls-ffi/default.nix
index 46c16c9cc4370..380405217e3da 100644
--- a/pkgs/development/libraries/rustls-ffi/default.nix
+++ b/pkgs/development/libraries/rustls-ffi/default.nix
@@ -28,7 +28,8 @@ rustPlatform.buildRustPackage rec {
 
   passthru.tests = {
     apacheHttpd = apacheHttpd.override { modTlsSupport = true; };
-    curl = curl.override { opensslSupport = false; rustlsSupport = true; };
+    # Currently broken notably because of https://github.com/curl/curl/issues/13248
+    # curl = curl.override { opensslSupport = false; rustlsSupport = true; };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index 1d50f1d89fa42..8ef3df4992618 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.4.8";
+  version = "1.4.9";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fDofKp/WUPY4+1HUeBdRklInTS7Qndycnci4h3F/mLY=";
+    hash = "sha256-YH35+kCvPjeBYMMJi7YdAGk/ds3YPm5SSKpoWfbCI3M=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/soundtouch/default.nix b/pkgs/development/libraries/soundtouch/default.nix
index c337edfa0917b..2778f7ff6f7cd 100644
--- a/pkgs/development/libraries/soundtouch/default.nix
+++ b/pkgs/development/libraries/soundtouch/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "soundtouch";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "soundtouch";
     repo = "soundtouch";
     rev = version;
-    sha256 = "sha256-+RprzCn0NCueHhDkk2Lgg7Ihw8JDzu25eIVoVZwF+BA=";
+    sha256 = "sha256-imeeTj+3gXxoGTuC/13+BAplwcnQ0wRJdSVt7MPlBxc=";
   };
 
   nativeBuildInputs = [ autoconf automake libtool ];
diff --git a/pkgs/development/libraries/structuresynth/default.nix b/pkgs/development/libraries/structuresynth/default.nix
new file mode 100644
index 0000000000000..362aaa7e25c95
--- /dev/null
+++ b/pkgs/development/libraries/structuresynth/default.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  qtbase,
+  wrapQtAppsHook,
+  libGL,
+  libGLU,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "structuresynth";
+  version = "1.5.1";
+
+  src = fetchFromGitHub {
+    owner = "alemuntoni";
+    repo = "structuresynth";
+    rev = finalAttrs.version;
+    hash = "sha256-uFz4WPwA586B/5p+DUJ/W8KzbHLBhLIwP6mySZJ1vPY=";
+  };
+
+  patches = [
+    # This PR in 2 commits allow packaging of this project as standalone.
+    # It was merged upstream, so those 2 patches can be removed on next release.
+    (fetchpatch {
+      name = "shared-lib.patch";
+      url = "https://github.com/alemuntoni/StructureSynth/pull/1/commits/fdb87c55a03c6a0faa4335de5d29f0fb547b6102.patch";
+      hash = "sha256-/66x8HGyNhGwoxsbV+QIRFYQNuFSHYXNYkJzAn4jyJI=";
+    })
+    (fetchpatch {
+      name = "install-project.patch";
+      url = "https://github.com/alemuntoni/StructureSynth/pull/1/commits/f96a90f6a4c60e9e0316edd20ea77674a2b764a7.patch";
+      hash = "sha256-cSZAL1N2/Gd0x+9UkTUQxqVlb2m2MM8AA1Zzlo6S35w=";
+    })
+  ];
+
+  outputs = [
+    "dev"
+    "out"
+  ];
+
+  buildInputs = [
+    libGL
+    libGLU
+    qtbase
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
+
+  meta = with lib; {
+    description = "Generate 3D structures by specifying a design grammar";
+    homepage = "https://github.com/alemuntoni/StructureSynth";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index 1fe1c0b01d928..2d543f5a5364f 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "umockdev";
-  version = "0.18.0";
+  version = "0.18.1";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${finalAttrs.version}/umockdev-${finalAttrs.version}.tar.xz";
-    hash = "sha256-uJkeaKK89C6mCYjfqLzvAFUNmo6IvvZvn2mxp7H44ng=";
+    hash = "sha256-ZRtoaQM7sUiBNu1zxY6SRfWwGFYmHhzqBBAwuD+x7Xw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 37cc66834462b..0eb3bda4286da 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
         --replace 'current_toolchain == host_toolchain || !use_xcode_clang' \
                   'false'
     ''}
-    ${lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    ${lib.optionalString stdenv.isDarwin ''
       substituteInPlace build/config/compiler/BUILD.gn \
         --replace "-Wl,-fatal_warnings" ""
     ''}
@@ -143,7 +143,11 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.cc.isClang ''clang_base_path="${llvmCcAndBintools}"''
   ++ lib.optional stdenv.isDarwin ''use_lld=false'';
 
-  env.NIX_CFLAGS_COMPILE = "-O2";
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-O2"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=enum-constexpr-conversion"
+  ]);
   FORCE_MAC_SDK_MIN = stdenv.hostPlatform.sdkVer or "10.12";
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index f857b2a0b89e7..91e8a435db804 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -1,40 +1,29 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , nasm
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
 stdenv.mkDerivation rec {
   pname = "x264";
-  version = "unstable-2021-06-13";
+  version = "0-unstable-2023-10-01";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = pname;
-    rev = "5db6aa6cab1b146e07b60cc1736a01f21da01154";
-    sha256 = "0swyrkz6nvajivxvrr08py0jrfcsjvpxw78xm1k5gd9xbdrxvknh";
+    rev = "31e19f92f00c7003fa115047ce50978bc98c3a0d";
+    hash = "sha256-7/FaaDFmoVhg82BIhP3RbFq4iKGNnhviOPxl3/8PWCM=";
   };
 
-  # Upstream ./configure greps for (-mcpu|-march|-mfpu) in CFLAGS, which in nix
-  # is put in the cc wrapper anyway.
   patches = [
+    # Upstream ./configure greps for (-mcpu|-march|-mfpu) in CFLAGS, which in nix
+    # is put in the cc wrapper anyway.
     ./disable-arm-neon-default.patch
-    (fetchpatch {
-      # https://code.videolan.org/videolan/x264/-/merge_requests/114
-      name = "fix-parallelism.patch";
-      url = "https://code.videolan.org/videolan/x264/-/commit/e067ab0b530395f90b578f6d05ab0a225e2efdf9.patch";
-      hash = "sha256-16h2IUCRjYlKI2RXYq8QyXukAdfoQxyBKsK/nI6vhRI=";
-    })
   ];
 
-  postPatch = ''
-    patchShebangs .
-  ''
-  # Darwin uses `llvm-strip`, which results in a crash at runtime in assembly-based routines when `-x` is specified.
-  + lib.optionalString stdenv.isDarwin ''
+  postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace Makefile --replace '$(if $(STRIP), $(STRIP) -x $@)' '$(if $(STRIP), $(STRIP) -S $@)'
   '';
 
@@ -53,6 +42,12 @@ stdenv.mkDerivation rec {
     ++ lib.optional (!stdenv.isi686) "--enable-pic"
     ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "--cross-prefix=${stdenv.cc.targetPrefix}";
 
+  makeFlags = [
+    "BASHCOMPLETIONSDIR=$(out)/share/bash-completion/completions"
+    "install-bashcompletion"
+    "install-lib-shared"
+  ];
+
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isx86 nasm;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix b/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
index 11f598b6544b1..966109fa00864 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
@@ -14,6 +14,7 @@
 , xdg-desktop-portal
 , wayland
 , gnome
+, libjxl
 , librsvg
 , webp-pixbuf-loader
 }:
@@ -50,10 +51,11 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    # Pull in WebP support for gnome-backgrounds.
+    # Pull in WebP and JXL support for gnome-backgrounds.
     # In postInstall to run before gappsWrapperArgsHook.
     export GDK_PIXBUF_MODULE_FILE="${gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
       extraLoaders = [
+        libjxl
         librsvg
         webp-pixbuf-loader
       ];
diff --git a/pkgs/development/libraries/xdg-desktop-portal/default.nix b/pkgs/development/libraries/xdg-desktop-portal/default.nix
index 561342a7b052e..626c40f3bb336 100644
--- a/pkgs/development/libraries/xdg-desktop-portal/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal/default.nix
@@ -31,7 +31,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal";
-  version = "1.18.3";
+  version = "1.18.4";
 
   outputs = [ "out" "installedTests" ];
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "flatpak";
     repo = "xdg-desktop-portal";
     rev = finalAttrs.version;
-    hash = "sha256-VqIQLUAf/n5m1tHCvnlxi0eaLOuG1R44tMFI/Hc992A=";
+    hash = "sha256-o+aO7uGewDPrtgOgmp/CE2uiqiBLyo07pVCFrtlORFQ=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/zziplib/default.nix b/pkgs/development/libraries/zziplib/default.nix
index e90df0888a0db..c40cf9594cfa9 100644
--- a/pkgs/development/libraries/zziplib/default.nix
+++ b/pkgs/development/libraries/zziplib/default.nix
@@ -13,36 +13,15 @@
 
 stdenv.mkDerivation rec {
   pname = "zziplib";
-  version = "0.13.72";
+  version = "0.13.74";
 
   src = fetchFromGitHub {
     owner = "gdraheim";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Ht3fBgdrTm4mCi5uhgQPNtpGzADoRVOpSuGPsIS6y0Q=";
+    hash = "sha256-MjqGHzb+dsAq2PrcBhU3sv4eMX3afkgFWUbhDp+5o/s=";
   };
 
-  patches = [
-    # apply https://github.com/gdraheim/zziplib/pull/113
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/82a7773cd17828a3b0a4f5f552ae80c1cc8777c7.diff";
-      sha256 = "0ifqdzxwb5d19mziy9j6lhl8wj95jpxzm0d2c6y3bgwa931avd3y";
-    })
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/1cd611514c5f9559eb9dfc191d678dfc991f66db.diff";
-      sha256 = "11w9qa46xq49l113k266dnv8izzdk1fq4y54yy5w8zps8zd3xfny";
-    })
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/e47b1e1da952a92f917db6fb19485b8a0b1a42f3.diff";
-      sha256 = "0d032hkmi3s3db12z2zbppl2swa3gdpbj0c6w13ylv2g2ixglrwg";
-    })
-    # Fixes invalid pointer conversions that cause compilation to fail with clang 15+
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/38e4d5f561318fa825e6544c2ef55ac5899c81b0.diff";
-      sha256 = "sha256-VJuFyiPhuAZlDxmNHBty+JbYwG85ea5u2sv7HZRHMwo=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     perl
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 31ff2e6e3c580..45cd51b717538 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -480,6 +480,16 @@ in
     };
   });
 
+  haskell-tools-nvim  = prev.haskell-tools-nvim.overrideAttrs(oa: {
+    doCheck = lua.luaversion == "5.1";
+    nativeCheckInputs = [ final.nlua final.busted ];
+    checkPhase = ''
+      runHook preCheck
+      export HOME=$(mktemp -d)
+      busted --lua=nlua
+      runHook postCheck
+      '';
+  });
 
   plenary-nvim = prev.plenary-nvim.overrideAttrs (oa: {
     postPatch = ''
@@ -585,6 +595,15 @@ in
     };
   });
 
+  nlua = prev.nlua.overrideAttrs(oa: {
+
+    # patchShebang removes the nvim in nlua's shebang so we hardcode one
+    postFixup = ''
+      sed -i -e "1 s|.*|#\!${coreutils}/bin/env -S ${neovim-unwrapped}/bin/nvim -l|" "$out/bin/nlua"
+      '';
+    dontPatchShebangs = true;
+  });
+
   rapidjson = prev.rapidjson.overrideAttrs (oa: {
     preBuild = ''
       sed -i '/set(CMAKE_CXX_FLAGS/d' CMakeLists.txt
diff --git a/pkgs/development/misc/resholve/0014-clang_incompatible_function_pointer_conversions.patch b/pkgs/development/misc/resholve/0014-clang_incompatible_function_pointer_conversions.patch
deleted file mode 100644
index 52d5e6adfe74e..0000000000000
--- a/pkgs/development/misc/resholve/0014-clang_incompatible_function_pointer_conversions.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-diff -ur a/decoder.c b/decoder.c
---- a/decoder.c	1980-01-02 00:00:00.000000000 -0500
-+++ b/decoder.c	2023-11-08 17:42:43.981838074 -0500
-@@ -94,7 +94,7 @@
-     return PlaceObject(ctx, PyBool_FromLong((long)(value)));
- }
- 
--static int handle_number(void *ctx, const char *value, unsigned int length)
-+static int handle_number(void *ctx, const char *value, size_t length)
- {
-     //fprintf(stderr, "handle_number: ");
-     //fwrite(value, length, 1, stderr);
-@@ -127,7 +127,7 @@
-     return status;
- }
- 
--static int handle_string(void *ctx, const unsigned char *value, unsigned int length)
-+static int handle_string(void *ctx, const unsigned char *value, size_t length)
- {
-     return PlaceObject(ctx, PyString_FromStringAndSize((char *)value, length));
- }
-@@ -142,7 +142,7 @@
-     return success;
- }
- 
--static int handle_dict_key(void *ctx, const unsigned char *value, unsigned int length)
-+static int handle_dict_key(void *ctx, const unsigned char *value, size_t length)
- {
-     PyObject *object = PyString_FromStringAndSize((const char *) value, length);
- 
-diff -ur a/yajl.c b/yajl.c
---- a/yajl.c	1980-01-02 00:00:00.000000000 -0500
-+++ b/yajl.c	2023-11-08 17:41:18.781350335 -0500
-@@ -161,7 +161,7 @@
- }
- 
- static struct PyMethodDef yajl_methods[] = {
--    {"dumps", (PyCFunctionWithKeywords)(py_dumps), METH_VARARGS | METH_KEYWORDS,
-+    {"dumps", (PyCFunction)(py_dumps), METH_VARARGS | METH_KEYWORDS,
- "yajl.dumps(obj [, indent=None])\n\n\
- Returns an encoded JSON string of the specified `obj`\n\
- \n\
diff --git a/pkgs/development/misc/resholve/README.md b/pkgs/development/misc/resholve/README.md
index 0e875a7656588..734ff26d8c4e5 100644
--- a/pkgs/development/misc/resholve/README.md
+++ b/pkgs/development/misc/resholve/README.md
@@ -52,13 +52,13 @@ Here's a simple example of how `resholve.mkDerivation` is already used in nixpkg
 
 resholve.mkDerivation rec {
   pname = "dgoss";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "goss-org";
     repo = "goss";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dpMTUBMEG5tDi7E6ZRg1KHqIj5qDlvwfwJEgq/5z7RE=";
+    hash = "sha256-FDn1OETkYIpMenk8QAAHvfNZcSzqGl5xrD0fAZPVmRM=";
   };
 
   dontConfigure = true;
@@ -87,6 +87,7 @@ resholve.mkDerivation rec {
     license = licenses.asl20;
     platforms = platforms.linux;
     maintainers = with maintainers; [ hyzual anthonyroussel ];
+    mainProgram = "dgoss";
   };
 }
 ```
diff --git a/pkgs/development/misc/resholve/default.nix b/pkgs/development/misc/resholve/default.nix
index 8499ba7553da5..13fd7a9adecc4 100644
--- a/pkgs/development/misc/resholve/default.nix
+++ b/pkgs/development/misc/resholve/default.nix
@@ -28,7 +28,7 @@ let
     stripTests = true;
     enableOptimizations = false;
   };
-  callPackage = lib.callPackageWith (pkgs // { python27 = python27'; });
+  callPackage = lib.callPackageWith (pkgsBuildHost // { python27 = python27'; });
   source = callPackage ./source.nix { };
   deps = callPackage ./deps.nix { };
 in
diff --git a/pkgs/development/misc/resholve/oildev.nix b/pkgs/development/misc/resholve/oildev.nix
index 767cedee3913f..c770fb894a3b0 100644
--- a/pkgs/development/misc/resholve/oildev.nix
+++ b/pkgs/development/misc/resholve/oildev.nix
@@ -4,35 +4,15 @@
 , callPackage
 , fetchFromGitHub
 , makeWrapper
-, # py-yajl deps
-  git
-, # oil deps
-  pkgsBuildBuild
 , re2c
+, # oil deps
+  glibcLocales
 , file
 , six
 , typing
 }:
 
 rec {
-  py-yajl = python27.pkgs.buildPythonPackage rec {
-    pname = "oil-pyyajl-unstable";
-    version = "2022-09-01";
-    src = fetchFromGitHub {
-      owner = "oilshell";
-      repo = "py-yajl";
-      rev = "72686b0e2e9d13d3ce5fefe47ecd607c540c90a3";
-      hash = "sha256-H3GKN0Pq1VFD5+SWxm8CXUVO7zAyj/ngKVmDaG/aRT4=";
-      fetchSubmodules = true;
-    };
-    patches = [
-      # Fixes several incompatible function pointer conversions, which are errors in clang 16.
-      ./0014-clang_incompatible_function_pointer_conversions.patch
-    ];
-    # just for submodule IIRC
-    nativeBuildInputs = [ git ];
-  };
-
   /*
     Upstream isn't interested in packaging this as a library
     (or accepting all of the patches we need to do so).
@@ -40,14 +20,14 @@ rec {
   */
   oildev = python27.pkgs.buildPythonPackage rec {
     pname = "oildev-unstable";
-    version = "2021-07-14";
+    version = "2024-02-26";
 
     src = fetchFromGitHub {
       owner = "oilshell";
       repo = "oil";
-      # rev == present HEAD of release/0.14.0
-      rev = "3d0427e222f7e42ae7be90c706d7fde555efca2e";
-      hash = "sha256-XMoNkBEEmD6AwNSu1uSh3OcWLfy4/ADtRckn/Pj2cP4=";
+      # rev == present HEAD of release/0.20.0
+      rev = "f730c79e2dcde4bc08e85a718951cfa42102bd01";
+      hash = "sha256-HBj3Izh1gD63EzbgZ/9If5vihR5L2HhnyCyMah6rMg4=";
 
       /*
         It's not critical to drop most of these; the primary target is
@@ -58,7 +38,7 @@ rec {
         hash on rev updates. Command will fail w/o and not print hash.
       */
       postFetch = ''
-        rm -rf $out/{Python-2.7.13,metrics,py-yajl,rfc,gold,web,testdata,services,demo,devtools}
+        rm -rf $out/{Python-2.7.13,metrics,py-yajl,rfc,gold,web,testdata,services,demo}
       '';
     };
 
@@ -66,13 +46,13 @@ rec {
     patchSrc = fetchFromGitHub {
       owner = "abathur";
       repo = "nix-py-dev-oil";
-      rev = "v0.14.0.1";
-      hash = "sha256-47+986+SohdtoNzTYAgF2vPPWgakyg0VCmR+MgxMzTk=";
+      rev = "v0.20.0.0";
+      hash = "sha256-qoA54rnzAdnFZ3k4kRzQWEdgtEjraCT5+NFw8AWnRDk=";
     };
+
     patches = [
       "${patchSrc}/0001-add_setup_py.patch"
       "${patchSrc}/0002-add_MANIFEST_in.patch"
-      "${patchSrc}/0004-disable-internal-py-yajl-for-nix-built.patch"
       "${patchSrc}/0006-disable_failing_libc_tests.patch"
       "${patchSrc}/0007-namespace_via_init.patch"
       "${patchSrc}/0009-avoid_nix_arch64_darwin_toolchain_bug.patch"
@@ -80,37 +60,32 @@ rec {
       "${patchSrc}/0011-disable-fanos.patch"
       "${patchSrc}/0012-disable-doc-cmark.patch"
       "${patchSrc}/0013-fix-pyverify.patch"
+      "${patchSrc}/0015-fix-compiled-extension-import-paths.patch"
     ];
 
     configureFlags = [
       "--without-readline"
     ];
 
-    depsBuildBuild = [ re2c ];
-
-    nativeBuildInputs = [ file makeWrapper ];
+    nativeBuildInputs = [ re2c file makeWrapper ];
 
-    propagatedBuildInputs = [ six typing py-yajl ];
+    propagatedBuildInputs = [ six typing ];
 
     doCheck = true;
 
     preBuild = ''
-      build/dev.sh all
+      build/py.sh all
     '';
 
     postPatch = ''
-      patchShebangs asdl build core doctools frontend pyext oil_lang
-      substituteInPlace pyext/fastlex.c --replace '_gen/frontend' '../_gen/frontend'
-      substituteInPlace core/main_loop.py --replace 'import fanos' '# import fanos'
+      patchShebangs asdl build core doctools frontend pyext oil_lang ysh
       rm cpp/stdlib.h # keep modules from finding the wrong stdlib?
       # work around hard parse failure documented in oilshell/oil#1468
       substituteInPlace osh/cmd_parse.py --replace 'elif self.c_id == Id.Op_LParen' 'elif False'
-      # disable fragile libc tests
-      substituteInPlace build/py.sh --replace "py-ext-test pyext/libc_test.py" "#py-ext-test pyext/libc_test.py"
     '';
 
     # See earlier note on glibcLocales TODO: verify needed?
-    LOCALE_ARCHIVE = lib.optionalString (stdenv.buildPlatform.libc == "glibc") "${pkgsBuildBuild.glibcLocales}/lib/locale/locale-archive";
+    LOCALE_ARCHIVE = lib.optionalString (stdenv.buildPlatform.libc == "glibc") "${glibcLocales}/lib/locale/locale-archive";
 
     # not exhaustive; sample what resholve uses as a sanity check
     pythonImportsCheck = [
@@ -121,7 +96,8 @@ rec {
       "oil._devbuild"
       "oil._devbuild.gen.id_kind_asdl"
       "oil._devbuild.gen.syntax_asdl"
-      "oil.tools.osh2oil"
+      "oil.osh"
+      "oil.tools.ysh_ify"
     ];
 
     meta = {
diff --git a/pkgs/development/misc/resholve/resholve.nix b/pkgs/development/misc/resholve/resholve.nix
index 28a0e401cf5dd..5c7984b66d223 100644
--- a/pkgs/development/misc/resholve/resholve.nix
+++ b/pkgs/development/misc/resholve/resholve.nix
@@ -2,17 +2,31 @@
 , stdenv
 , callPackage
 , python27
+, fetchFromGitHub
 , installShellFiles
 , rSrc
 , version
 , oildev
 , configargparse
+, gawk
 , binlore
 , resholve
 , resholve-utils
 }:
 
-python27.pkgs.buildPythonApplication {
+let
+  sedparse = python27.pkgs.buildPythonPackage rec {
+    pname = "sedparse";
+    version = "0.1.2";
+    src = fetchFromGitHub {
+      owner = "aureliojargas";
+      repo = "sedparse";
+      rev = "0.1.2";
+      hash = "sha256-Q17A/oJ3GZbdSK55hPaMdw85g43WhTW9tuAuJtDfHHU=";
+    };
+  };
+
+in python27.pkgs.buildPythonApplication {
   pname = "resholve";
   inherit version;
   src = rSrc;
@@ -22,6 +36,11 @@ python27.pkgs.buildPythonApplication {
   propagatedBuildInputs = [
     oildev
     configargparse
+    sedparse
+  ];
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ gawk ]}"
   ];
 
   postPatch = ''
diff --git a/pkgs/development/misc/resholve/source.nix b/pkgs/development/misc/resholve/source.nix
index 5e74bdc06acce..1492e3685779c 100644
--- a/pkgs/development/misc/resholve/source.nix
+++ b/pkgs/development/misc/resholve/source.nix
@@ -3,11 +3,11 @@
 }:
 
 rec {
-  version = "0.9.1";
+  version = "0.10.2";
   rSrc = fetchFromGitHub {
     owner = "abathur";
     repo = "resholve";
     rev = "v${version}";
-    hash = "sha256-hkLKQKhEMD1UQ9EunPmx5Tsh44q4+tYj820OXF2ueUo=";
+    hash = "sha256-QXIX3Ai9HUFosvhfYTUJILZ588cvxTzULUUp1LYkQ0A=";
   };
 }
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index ebf1f9ca4af6f..90093aaafde12 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -51,7 +51,6 @@
   purs-tidy = "purs-tidy";
   purty = "purty";
   pscid = "pscid";
-  pyright = "pyright";
   remod-cli = "remod";
   svelte-language-server = "svelteserver";
   teck-programmer = "teck-firmware-upgrade";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index f7015177d57be..c0d021e9f4728 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -200,7 +200,6 @@
 , "purescript-psa"
 , "purs-tidy"
 , "purty"
-, "pyright"
 , "remod-cli"
 , "reveal.js"
 , "rimraf"
diff --git a/pkgs/development/ocaml-modules/clap/default.nix b/pkgs/development/ocaml-modules/clap/default.nix
new file mode 100644
index 0000000000000..83d420c80f335
--- /dev/null
+++ b/pkgs/development/ocaml-modules/clap/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, fetchFromGitHub
+, buildDunePackage
+}:
+
+buildDunePackage rec {
+  pname = "clap";
+  version = "0.3.0";
+
+  minimalOCamlVersion = "4.07";
+
+  src = fetchFromGitHub {
+    owner = "rbardou";
+    repo = pname;
+    rev = version;
+    hash = "sha256-IEol27AVYs55ntvNprBxOk3/EsBKAdPkF3Td3w9qOJg=";
+  };
+
+  meta = {
+    description = "Command-Line Argument Parsing, imperative style with a consumption mechanism";
+    license = lib.licenses.mit;
+  };
+}
+
diff --git a/pkgs/development/ocaml-modules/data-encoding/default.nix b/pkgs/development/ocaml-modules/data-encoding/default.nix
index db139d2b26aed..f94abebbcbdf0 100644
--- a/pkgs/development/ocaml-modules/data-encoding/default.nix
+++ b/pkgs/development/ocaml-modules/data-encoding/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitLab
 , buildDunePackage
 , ppx_hash
+, bigstringaf
 , either
 , ezjsonm
 , zarith
@@ -16,19 +17,12 @@
 
 buildDunePackage rec {
   pname = "data-encoding";
-  version = "0.7.1";
+  inherit (json-data-encoding) src version;
 
-  duneVersion = "3";
   minimalOCamlVersion = "4.10";
 
-  src = fetchFromGitLab {
-    owner = "nomadic-labs";
-    repo = "data-encoding";
-    rev = "v${version}";
-    hash = "sha256-V3XiCCtoU+srOI+KVSJshtaSJLBJ4m4o10GpBfdYKCU=";
-  };
-
   propagatedBuildInputs = [
+    bigstringaf
     either
     ezjsonm
     ppx_hash
@@ -39,14 +33,10 @@ buildDunePackage rec {
     json-data-encoding-bson
   ];
 
-  checkInputs = [
-    alcotest
-    crowbar
+  buildInputs = [
     ppx_expect
   ];
 
-  doCheck = true;
-
   meta = {
     homepage = "https://gitlab.com/nomadic-labs/data-encoding";
     description = "Library of JSON and binary encoding combinators";
diff --git a/pkgs/development/ocaml-modules/index/default.nix b/pkgs/development/ocaml-modules/index/default.nix
index ebc0507875558..3cc3643429c72 100644
--- a/pkgs/development/ocaml-modules/index/default.nix
+++ b/pkgs/development/ocaml-modules/index/default.nix
@@ -6,15 +6,14 @@
 
 buildDunePackage rec {
   pname = "index";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "https://github.com/mirage/index/releases/download/${version}/index-${version}.tbz";
-    hash = "sha256-rPwNzqkWqDak2mDTDIBqIvachY1vfOIzFmwaXjZea+4=";
+    hash = "sha256-k4iDUJik7UTuztBw7YaFXASd8SqYMR1JgLm3JOyriGA=";
   };
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
   buildInputs = [
     stdlib-shims
diff --git a/pkgs/development/ocaml-modules/irmin/chunk.nix b/pkgs/development/ocaml-modules/irmin/chunk.nix
index 59bd81544945a..3e7f3c2a1b705 100644
--- a/pkgs/development/ocaml-modules/irmin/chunk.nix
+++ b/pkgs/development/ocaml-modules/irmin/chunk.nix
@@ -3,7 +3,7 @@
 buildDunePackage rec {
 
   pname = "irmin-chunk";
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [ irmin fmt logs lwt ];
 
diff --git a/pkgs/development/ocaml-modules/irmin/containers.nix b/pkgs/development/ocaml-modules/irmin/containers.nix
index 73cd25f3170dd..32677d9604c2f 100644
--- a/pkgs/development/ocaml-modules/irmin/containers.nix
+++ b/pkgs/development/ocaml-modules/irmin/containers.nix
@@ -6,7 +6,7 @@
 buildDunePackage {
   pname = "irmin-containers";
 
-  inherit (ppx_irmin) src version strictDeps;
+  inherit (ppx_irmin) src version;
 
   nativeBuildInputs = [
     ppx_irmin
diff --git a/pkgs/development/ocaml-modules/irmin/default.nix b/pkgs/development/ocaml-modules/irmin/default.nix
index d273d19553c15..3f6e551e67139 100644
--- a/pkgs/development/ocaml-modules/irmin/default.nix
+++ b/pkgs/development/ocaml-modules/irmin/default.nix
@@ -7,7 +7,7 @@
 buildDunePackage {
   pname = "irmin";
 
-  inherit (ppx_irmin) src version strictDeps;
+  inherit (ppx_irmin) src version;
 
   minimalOCamlVersion = "4.10";
 
diff --git a/pkgs/development/ocaml-modules/irmin/fs.nix b/pkgs/development/ocaml-modules/irmin/fs.nix
index 1788cf1eda239..8d56e90fad8bb 100644
--- a/pkgs/development/ocaml-modules/irmin/fs.nix
+++ b/pkgs/development/ocaml-modules/irmin/fs.nix
@@ -6,7 +6,7 @@ buildDunePackage rec {
 
   pname = "irmin-fs";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [ irmin astring logs lwt ];
 
diff --git a/pkgs/development/ocaml-modules/irmin/git.nix b/pkgs/development/ocaml-modules/irmin/git.nix
index 387fc60a0aa9b..1e4397e89298b 100644
--- a/pkgs/development/ocaml-modules/irmin/git.nix
+++ b/pkgs/development/ocaml-modules/irmin/git.nix
@@ -9,7 +9,7 @@ buildDunePackage {
 
   pname = "irmin-git";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [
     git
diff --git a/pkgs/development/ocaml-modules/irmin/http.nix b/pkgs/development/ocaml-modules/irmin/http.nix
deleted file mode 100644
index 1b376425bdcec..0000000000000
--- a/pkgs/development/ocaml-modules/irmin/http.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, buildDunePackage, astring, cohttp-lwt, cohttp-lwt-unix, irmin, webmachine
-, fmt, jsonm, logs, lwt, uri
-, git-unix, irmin-git, irmin-test, irmin-fs, digestif
-, cacert
-}:
-
-buildDunePackage rec {
-
-  pname = "irmin-http";
-
-  inherit (irmin) version src strictDeps;
-
-  propagatedBuildInputs = [ astring cohttp-lwt cohttp-lwt-unix fmt jsonm logs lwt uri irmin webmachine ];
-
-  checkInputs = [
-    digestif git-unix irmin-git irmin-test irmin-fs cacert
-  ];
-
-  doCheck = true;
-
-  meta = irmin.meta // {
-    description = "HTTP client and server for Irmin";
-  };
-
-}
diff --git a/pkgs/development/ocaml-modules/irmin/mirage-git.nix b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
index 09c1820d6094d..7528e469913f7 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage-git.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
@@ -6,7 +6,7 @@
 buildDunePackage {
   pname = "irmin-mirage-git";
 
-  inherit (irmin-mirage) version src strictDeps;
+  inherit (irmin-mirage) version src;
 
   propagatedBuildInputs = [
     irmin-mirage
diff --git a/pkgs/development/ocaml-modules/irmin/mirage-graphql.nix b/pkgs/development/ocaml-modules/irmin/mirage-graphql.nix
index bfbe45b390190..1973cde8c3b6d 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage-graphql.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage-graphql.nix
@@ -5,7 +5,7 @@
 buildDunePackage {
   pname = "irmin-mirage-graphql";
 
-  inherit (irmin-mirage) version src strictDeps;
+  inherit (irmin-mirage) version src;
 
   propagatedBuildInputs = [
     irmin-mirage
diff --git a/pkgs/development/ocaml-modules/irmin/mirage.nix b/pkgs/development/ocaml-modules/irmin/mirage.nix
index 9e4bd9330799c..eabb1e5874e87 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage.nix
@@ -3,7 +3,7 @@
 buildDunePackage {
   pname = "irmin-mirage";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [
     irmin fmt ptime mirage-clock
diff --git a/pkgs/development/ocaml-modules/irmin/pack.nix b/pkgs/development/ocaml-modules/irmin/pack.nix
index 9afb40c207669..3a00c5e99f5f0 100644
--- a/pkgs/development/ocaml-modules/irmin/pack.nix
+++ b/pkgs/development/ocaml-modules/irmin/pack.nix
@@ -8,7 +8,7 @@ buildDunePackage rec {
 
   pname = "irmin-pack";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   nativeBuildInputs = [ ppx_irmin ];
 
diff --git a/pkgs/development/ocaml-modules/irmin/ppx.nix b/pkgs/development/ocaml-modules/irmin/ppx.nix
index 78207bf009e88..23165099443eb 100644
--- a/pkgs/development/ocaml-modules/irmin/ppx.nix
+++ b/pkgs/development/ocaml-modules/irmin/ppx.nix
@@ -2,11 +2,11 @@
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "3.7.2";
+  version = "3.9.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    hash = "sha256-aqW6TGoCM3R9S9OrOW8rOjO7gPnY7UoXjIOgNQM8DlI=";
+    hash = "sha256-jgc6vhtf+1ttWMMmBsnX2rwyxTUBdWvoCpLtR3etUaA=";
   };
 
   minimalOCamlVersion = "4.10";
diff --git a/pkgs/development/ocaml-modules/irmin/test.nix b/pkgs/development/ocaml-modules/irmin/test.nix
index 942200bf429a0..a0e206cade720 100644
--- a/pkgs/development/ocaml-modules/irmin/test.nix
+++ b/pkgs/development/ocaml-modules/irmin/test.nix
@@ -1,13 +1,13 @@
 { buildDunePackage, irmin, ppx_irmin, mtime, astring, fmt, jsonm, logs, lwt
 , metrics-unix, ocaml-syntax-shims, cmdliner, metrics, alcotest-lwt
-, hex, vector
+, hex, vector, qcheck-alcotest
 }:
 
 buildDunePackage {
 
   pname = "irmin-test";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   nativeBuildInputs = [ ppx_irmin ];
 
@@ -27,7 +27,8 @@ buildDunePackage {
     metrics
   ];
 
-  checkInputs = [ hex vector ];
+  doCheck = true;
+  checkInputs = [ hex qcheck-alcotest vector ];
 
   meta = irmin.meta // {
     description = "Irmin test suite";
diff --git a/pkgs/development/ocaml-modules/irmin/tezos.nix b/pkgs/development/ocaml-modules/irmin/tezos.nix
index 82a89daec3590..ec005921c938b 100644
--- a/pkgs/development/ocaml-modules/irmin/tezos.nix
+++ b/pkgs/development/ocaml-modules/irmin/tezos.nix
@@ -6,7 +6,7 @@
 buildDunePackage rec {
   pname = "irmin-tezos";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [
     irmin
diff --git a/pkgs/development/ocaml-modules/json-data-encoding/bson.nix b/pkgs/development/ocaml-modules/json-data-encoding/bson.nix
index c0d1a5260bc7d..46810ab1566be 100644
--- a/pkgs/development/ocaml-modules/json-data-encoding/bson.nix
+++ b/pkgs/development/ocaml-modules/json-data-encoding/bson.nix
@@ -5,8 +5,6 @@ buildDunePackage {
 
   inherit (json-data-encoding) version src doCheck;
 
-  duneVersion = "3";
-
   propagatedBuildInputs = [
     json-data-encoding
     ocplib-endian
diff --git a/pkgs/development/ocaml-modules/json-data-encoding/default.nix b/pkgs/development/ocaml-modules/json-data-encoding/default.nix
index c517725c74e21..5bb3f7701bba6 100644
--- a/pkgs/development/ocaml-modules/json-data-encoding/default.nix
+++ b/pkgs/development/ocaml-modules/json-data-encoding/default.nix
@@ -1,28 +1,21 @@
-{ lib, fetchFromGitLab, buildDunePackage, uri, crowbar, alcotest }:
+{ lib, fetchFromGitLab, buildDunePackage, hex, uri }:
 
 buildDunePackage rec {
   pname = "json-data-encoding";
-  version = "0.12.1";
+  version = "1.0.1";
   minimalOCamlVersion = "4.10";
-  duneVersion = "3";
   src = fetchFromGitLab {
     owner = "nomadic-labs";
-    repo = "json-data-encoding";
-    rev = version;
-    hash = "sha256-ticulOKiFNQIZNFOQE9UQOw/wqRfygQwLVIc4kkmwg4=";
+    repo = "data-encoding";
+    rev = "v${version}";
+    hash = "sha256-KoA4xX4tNyi6bX5kso/Wof1LA7431EXJ34eD5X4jnd8=";
   };
 
   propagatedBuildInputs = [
+    hex
     uri
   ];
 
-  checkInputs = [
-    crowbar
-    alcotest
-  ];
-
-  doCheck = true;
-
   meta = {
     homepage = "https://gitlab.com/nomadic-labs/json-data-encoding";
     description = "Type-safe encoding to and decoding from JSON";
diff --git a/pkgs/development/ocaml-modules/mirage-kv/default.nix b/pkgs/development/ocaml-modules/mirage-kv/default.nix
index d32a9e3935e59..97eb3128e15b8 100644
--- a/pkgs/development/ocaml-modules/mirage-kv/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-kv/default.nix
@@ -1,22 +1,23 @@
 { lib, fetchurl, buildDunePackage
 , fmt
 , lwt
+, optint
+, ptime
 , alcotest
 }:
 
 buildDunePackage rec {
   pname = "mirage-kv";
-  version = "4.0.1";
+  version = "6.1.1";
 
-  duneVersion = "3";
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-kv/releases/download/v${version}/mirage-kv-${version}.tbz";
-    hash = "sha256-p6i4zUVgxtTnUiBIjb8W6u9xRTczVl4WwfFcl5tVqnE=";
+    hash = "sha256-fNXNlaDpb5zUA2rTwi5h1j4v4LQmovxG+Am6u+1guPQ=";
   };
 
-  propagatedBuildInputs = [ fmt lwt ];
+  propagatedBuildInputs = [ fmt lwt optint ptime ];
 
   doCheck = true;
   checkInputs = [ alcotest ];
diff --git a/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix b/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
index 85b741dbc1996..e3627431d9593 100644
--- a/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.sternenseemann ];
     homepage = "https://github.com/mirage/ocaml-freestanding";
     platforms = builtins.map ({ arch, os }: "${arch}-${os}")
-      (cartesianProductOfSets {
+      (cartesianProduct {
           arch = [ "aarch64" "x86_64" ];
           os = [ "linux" ];
       } ++ [
diff --git a/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix b/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix
index 067b61212acec..ed9b299320d89 100644
--- a/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix
@@ -49,5 +49,9 @@ buildDunePackage rec {
       and de-serialization function from a .proto file.
     '';
     maintainers = [ lib.maintainers.GirardR1006 ];
+    # Broken with Dune 3.15.1:
+    #   Error: Dependency cycle between:
+    #      %{read:config/support_proto3_optional.conf} at test/dune:16
+    broken = true;
   };
 }
diff --git a/pkgs/development/ocaml-modules/progress/default.nix b/pkgs/development/ocaml-modules/progress/default.nix
index b714cdf337123..7ca95a0882434 100644
--- a/pkgs/development/ocaml-modules/progress/default.nix
+++ b/pkgs/development/ocaml-modules/progress/default.nix
@@ -7,7 +7,6 @@ buildDunePackage rec {
   pname = "progress";
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
   inherit (terminal) version src;
 
diff --git a/pkgs/development/ocaml-modules/terminal/default.nix b/pkgs/development/ocaml-modules/terminal/default.nix
index 1700da0606891..8daf53abdb502 100644
--- a/pkgs/development/ocaml-modules/terminal/default.nix
+++ b/pkgs/development/ocaml-modules/terminal/default.nix
@@ -5,14 +5,13 @@
 
 buildDunePackage rec {
   pname = "terminal";
-  version = "0.2.1";
+  version = "0.2.2";
 
   minimalOCamlVersion = "4.03";
-  duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/CraigFe/progress/releases/download/${version}/terminal-${version}.tbz";
-    hash = "sha256:0vjqkvmpyi8kvmb4vrx3f0994rph8i9pvlrz1dyi126vlb2zbrvs";
+    url = "https://github.com/CraigFe/progress/releases/download/${version}/progress-${version}.tbz";
+    hash = "sha256-M0HCGSOiHNa1tc+p7DmB9ZVyw2eUD+XgJFBTPftBELU=";
   };
 
   propagatedBuildInputs = [ stdlib-shims uutf uucp ];
diff --git a/pkgs/development/ocaml-modules/tezt/default.nix b/pkgs/development/ocaml-modules/tezt/default.nix
new file mode 100644
index 0000000000000..afad07e779177
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tezt/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitLab
+, buildDunePackage
+, clap
+, ezjsonm
+, lwt
+, re
+}:
+
+buildDunePackage rec {
+  pname = "tezt";
+  version = "4.0.0";
+
+  minimalOCamlVersion = "4.12";
+
+  src = fetchFromGitLab {
+    owner = "nomadic-labs";
+    repo = pname;
+    rev = version;
+    hash = "sha256-waFjE/yR+XAJOew1YsCnbvsJR8oe9gflyVj4yXAvNuM=";
+  };
+
+  propagatedBuildInputs = [
+    clap
+    ezjsonm
+    lwt
+    re
+  ];
+
+  meta = {
+    description = "Test framework for unit tests, integration tests, and regression tests";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index 40709f4b49739..28606fdfa2e27 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -16,7 +16,7 @@ php.buildComposerProject (finalAttrs: {
   # use together with the version from this package to keep the
   # bootstrap phar file up-to-date together with the end user composer
   # package.
-  passthru.pharHash = "sha256-BJuODtnyZNdwoFEIWM/7w1QBUQdZ7cmnhLOlxuAgvKw=";
+  passthru.pharHash = "sha256-/MAv8ES1oE++z/AVjLYEHCXo94rElAmHNv7NK7TzgeQ=";
 
   composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
     inherit (finalAttrs) version;
@@ -24,13 +24,13 @@ php.buildComposerProject (finalAttrs: {
   };
 
   pname = "composer";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "composer";
     repo = "composer";
     rev = finalAttrs.version;
-    hash = "sha256-Rev3OW1G+LVgJmHLwuV5u0s7F7lKrvtI43eS7y9SAYA=";
+    hash = "sha256-4cQ/p6lC8qgba/GSKuP2rFc0mZrUc+HuwvBMXnVERoU=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
@@ -40,7 +40,7 @@ php.buildComposerProject (finalAttrs: {
       --prefix PATH : ${lib.makeBinPath [ _7zz cacert curl git unzip xz ]}
   '';
 
-  vendorHash = "sha256-JLMhjOradyo64mPNos0qtM5bTnAYTRvSWnFUQrLQNjw=";
+  vendorHash = "sha256-dNNV9fTyGyRoGeDV/vBjn0aMgkaUMsrKQv5AOoiYokQ=";
 
   meta = {
     changelog = "https://github.com/composer/composer/releases/tag/${finalAttrs.version}";
diff --git a/pkgs/development/php-packages/opentelemetry/default.nix b/pkgs/development/php-packages/opentelemetry/default.nix
index 360f4cc43841f..6770ecb432a6d 100644
--- a/pkgs/development/php-packages/opentelemetry/default.nix
+++ b/pkgs/development/php-packages/opentelemetry/default.nix
@@ -15,6 +15,8 @@ in buildPecl rec {
 
   sourceRoot = "${src.name}/ext";
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-parentheses-equality";
+
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index 1c31b82928090..eecbd37a90634 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -3,8 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , setuptools
 , numpy
 , packaging
@@ -47,7 +46,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     evaluate
     parameterized
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     transformers
   ];
   preCheck = ''
diff --git a/pkgs/development/python-modules/accuweather/default.nix b/pkgs/development/python-modules/accuweather/default.nix
index 6069d06d9984c..e27c617665561 100644
--- a/pkgs/development/python-modules/accuweather/default.nix
+++ b/pkgs/development/python-modules/accuweather/default.nix
@@ -1,30 +1,35 @@
-{ lib
-, aiohttp
-, aioresponses
-, buildPythonPackage
-, fetchFromGitHub
-, orjson
-, pytest-asyncio
-, pytest-error-for-skips
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
+  orjson,
+  pytest-asyncio,
+  pytest-error-for-skips,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  syrupy,
 }:
 
 buildPythonPackage rec {
   pname = "accuweather";
-  version = "2.1.1";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "bieniu";
-    repo = pname;
+    repo = "accuweather";
     rev = "refs/tags/${version}";
-    hash = "sha256-hbmeQnxVhBbXKHNdeXzAwRnMKBNvKsdfHg8MzALinhc=";
+    hash = "sha256-hnKwK0I8C8Xh7yn4yk2DqowqgyZYDB22IEllm5MeIGo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     aiohttp
     orjson
   ];
@@ -34,11 +39,10 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-error-for-skips
     pytestCheckHook
+    syrupy
   ];
 
-  pythonImportsCheck = [
-    "accuweather"
-  ];
+  pythonImportsCheck = [ "accuweather" ];
 
   meta = with lib; {
     description = "Python wrapper for getting weather data from AccuWeather servers";
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 81459f8f32ae0..282e27f3f8af4 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 
 # build-system
-, cython_3
+, cython
 , setuptools
 
 # dependencies
@@ -39,7 +39,7 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    cython_3
+    cython
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 823a0f9e14b73..e46b5989dd762 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -21,8 +21,7 @@
 , freezegun
 , gunicorn
 , pytest-mock
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , python-on-whales
 , re-assert
 , trustme
@@ -83,7 +82,7 @@ buildPythonPackage rec {
     freezegun
     gunicorn
     pytest-mock
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     python-on-whales
     re-assert
   ] ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) [
diff --git a/pkgs/development/python-modules/aiojobs/default.nix b/pkgs/development/python-modules/aiojobs/default.nix
index b4ccb7b7fb4e2..62633de45385f 100644
--- a/pkgs/development/python-modules/aiojobs/default.nix
+++ b/pkgs/development/python-modules/aiojobs/default.nix
@@ -3,6 +3,7 @@
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
@@ -23,6 +24,13 @@ buildPythonPackage rec {
     hash = "sha256-LwFXb/SHP6bbqPg1tqYwE03FKHf4Mv1PPOxnPdESH0I=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/aio-libs/aiojobs/commit/1b88049841397b01f88aee7d92174ac5a15217c1.patch";
+      hash = "sha256-b38Ipa29T6bEVsPe04ZO3WCcs6+0fOQDCJM+w8K1bVY=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace "--cov=aiojobs/ --cov=tests/ --cov-report term" ""
diff --git a/pkgs/development/python-modules/aiomisc/default.nix b/pkgs/development/python-modules/aiomisc/default.nix
index e3b0b7de9b486..9182859bb90ef 100644
--- a/pkgs/development/python-modules/aiomisc/default.nix
+++ b/pkgs/development/python-modules/aiomisc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "aiomisc";
-  version = "17.5.4";
+  version = "17.5.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/2WEaM9ZM9dbMA73XADOE2u5r3SfMAyjH8isOsXaJhE=";
+    hash = "sha256-oq4z+ULN6VYkXX4Oz/JqKZSIh55AHOxFJVLyaNGqaNA=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/aiounifi/default.nix b/pkgs/development/python-modules/aiounifi/default.nix
index 6f4b5e2c4f32a..05784995f70e4 100644
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@@ -1,21 +1,22 @@
-{ lib
-, aiohttp
-, aioresponses
-, buildPythonPackage
-, fetchFromGitHub
-, orjson
-, pytest-aiohttp
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, segno
-, setuptools
-, trustme
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
+  orjson,
+  pytest-aiohttp,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  segno,
+  setuptools,
+  trustme,
 }:
 
 buildPythonPackage rec {
   pname = "aiounifi";
-  version = "74";
+  version = "75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = "aiounifi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5xxgpbnTqR8AWUvRQJiXGJECn0neV8QQyjYKw09sqZg=";
+    hash = "sha256-IPm3/i+JJpjVfRFq+Yq1mfajHL/mOARk5koyy/t37NQ=";
   };
 
   postPatch = ''
@@ -35,9 +36,7 @@ buildPythonPackage rec {
     sed -i '/--cov=/d' pyproject.toml
   '';
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     aiohttp
@@ -53,13 +52,9 @@ buildPythonPackage rec {
     trustme
   ];
 
-  pytestFlagsArray = [
-    "--asyncio-mode=auto"
-  ];
+  pytestFlagsArray = [ "--asyncio-mode=auto" ];
 
-  pythonImportsCheck = [
-    "aiounifi"
-  ];
+  pythonImportsCheck = [ "aiounifi" ];
 
   meta = with lib; {
     description = "Python library for communicating with Unifi Controller API";
diff --git a/pkgs/development/python-modules/aiozeroconf/default.nix b/pkgs/development/python-modules/aiozeroconf/default.nix
index bfe406b05364b..aba0ed77c731d 100644
--- a/pkgs/development/python-modules/aiozeroconf/default.nix
+++ b/pkgs/development/python-modules/aiozeroconf/default.nix
@@ -1,28 +1,35 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, netifaces
-, isPy27
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  netifaces,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "aiozeroconf";
   version = "0.1.8";
-  format = "setuptools";
-  disabled = isPy27;
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "074plydm7sd113p3k0siihwwz62d3r42q3g83vqaffp569msknqh";
+    hash = "sha256-ENupazLlOqfwHugNLEgeTZjPOYxRgznuCKHpU5unlxw=";
   };
 
-  propagatedBuildInputs = [ netifaces ];
+  build-system = [ setuptools ];
+
+  dependencies = [ netifaces ];
+
+  pythonImportsCheck = [ "aiozeroconf" ];
 
   meta = with lib; {
-    description = "A pure python implementation of multicast DNS service discovery";
-    mainProgram = "aiozeroconf";
+    description = "Implementation of multicast DNS service discovery";
     homepage = "https://github.com/jstasiak/python-zeroconf";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
     maintainers = with maintainers; [ obadz ];
+    mainProgram = "aiozeroconf";
   };
 }
diff --git a/pkgs/development/python-modules/alembic/default.nix b/pkgs/development/python-modules/alembic/default.nix
index 9f41317788184..cd7b0696afd43 100644
--- a/pkgs/development/python-modules/alembic/default.nix
+++ b/pkgs/development/python-modules/alembic/default.nix
@@ -14,7 +14,7 @@
 , typing-extensions
 
 # tests
-, pytestCheckHook
+, pytest7CheckHook
 , pytest-xdist
 , python-dateutil
 }:
@@ -49,7 +49,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    pytest7CheckHook
     pytest-xdist
     python-dateutil
   ];
diff --git a/pkgs/development/python-modules/ansible-pylibssh/default.nix b/pkgs/development/python-modules/ansible-pylibssh/default.nix
index 898214c3b5084..068af47bca3c2 100644
--- a/pkgs/development/python-modules/ansible-pylibssh/default.nix
+++ b/pkgs/development/python-modules/ansible-pylibssh/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  cython_3,
+  cython,
   expandvars,
   fetchPypi,
   libssh,
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    cython_3
+    cython
     expandvars
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/anytree/default.nix b/pkgs/development/python-modules/anytree/default.nix
index f18fa10557f3e..0fe64bbe8f626 100644
--- a/pkgs/development/python-modules/anytree/default.nix
+++ b/pkgs/development/python-modules/anytree/default.nix
@@ -4,7 +4,7 @@
 , fontconfig
 , graphviz
 , poetry-core
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , six
 , substituteAll
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "anytree";
-  version = "2.12.0";
+  version = "2.12.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "c0fec0de";
     repo = "anytree";
     rev = "refs/tags/${version}";
-    hash = "sha256-8mV9Lf6NLPUDVurXCxG+tqe7+3TrIn2H+7tHa6BpTzk=";
+    hash = "sha256-5HU8kR3B2RHiGBraQ2FTgVtGHJi+Lha9U/7rpNsYCCI=";
   };
 
   patches = lib.optionals withGraphviz [
@@ -41,12 +41,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+    pytest7CheckHook
   ];
 
   # Tests print “Fontconfig error: Cannot load default config file”
diff --git a/pkgs/development/python-modules/anywidget/default.nix b/pkgs/development/python-modules/anywidget/default.nix
index 87450407ff99a..69b6416517bda 100644
--- a/pkgs/development/python-modules/anywidget/default.nix
+++ b/pkgs/development/python-modules/anywidget/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "anywidget";
-  version = "0.9.6";
+  version = "0.9.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nhDPAXwcsxwrTBG1kEBj77bDXMb3j/Xckk3FENjCS5E=";
+    hash = "sha256-mepiQbJVtIHgzEhnjy8MjBOEMYLvlpLJ/wzMSm3+2bE=";
   };
 
   # We do not need the jupyterlab build dependency, because we do not need to
diff --git a/pkgs/development/python-modules/apkinspector/default.nix b/pkgs/development/python-modules/apkinspector/default.nix
index 9bc15aafb82a8..925845c73da3f 100644
--- a/pkgs/development/python-modules/apkinspector/default.nix
+++ b/pkgs/development/python-modules/apkinspector/default.nix
@@ -1,40 +1,38 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, poetry-core
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "apkinspector";
-  version = "1.2.2";
+  version = "1.2.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-6n5WCQ6V63kbWT6b7t9PEFbrJpxEg1WOE9XV70tHnGA=";
+  src = fetchFromGitHub {
+    owner = "erev0s";
+    repo = "apkInspector";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-n6uVyN5XBEM/nuN7mvhNRwMUgUT5abOsh3CbhKK6ifY=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  # Tests are not available
-  # https://github.com/erev0s/apkInspector/issues/21
-  doCheck = false;
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [
-    "apkInspector"
-  ];
+  pythonImportsCheck = [ "apkInspector" ];
 
   meta = with lib; {
     description = "Module designed to provide detailed insights into the zip structure of APK files";
-    mainProgram = "apkInspector";
     homepage = "https://github.com/erev0s/apkInspector";
+    changelog = "https://github.com/erev0s/apkInspector/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "apkInspector";
   };
 }
diff --git a/pkgs/development/python-modules/apsw/default.nix b/pkgs/development/python-modules/apsw/default.nix
index 4d8d9649682c6..41eb2ade77eda 100644
--- a/pkgs/development/python-modules/apsw/default.nix
+++ b/pkgs/development/python-modules/apsw/default.nix
@@ -26,6 +26,7 @@ buildPythonPackage rec {
 
   buildInputs = [ sqlite ];
 
+
   # Project uses custom test setup to exclude some tests by default, so using pytest
   # requires more maintenance
   # https://github.com/rogerbinns/apsw/issues/335
@@ -36,9 +37,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "apsw" ];
 
   meta = with lib; {
+    changelog = "https://github.com/rogerbinns/apsw/blob/${src.rev}/doc/changes.rst";
     description = "A Python wrapper for the SQLite embedded relational database engine";
     homepage = "https://github.com/rogerbinns/apsw";
-    changelog = "https://github.com/rogerbinns/apsw/releases/tag/${version}";
     license = licenses.zlib;
     maintainers = with maintainers; [ gador ];
   };
diff --git a/pkgs/development/python-modules/aranet4/default.nix b/pkgs/development/python-modules/aranet4/default.nix
index 338e53fcb7880..d6fda0fb4fc20 100644
--- a/pkgs/development/python-modules/aranet4/default.nix
+++ b/pkgs/development/python-modules/aranet4/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aranet4";
-  version = "2.2.3";
+  version = "2.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Anrijs";
     repo = "Aranet4-Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Jd7yuddxwRrO7XFQsVGy5vRQxwIUZdwFSjiZZHdkE3g=";
+    hash = "sha256-j53d2Ki9xVWGHWkAu1wkjYE56Xq7kfMmqQrQiKrBg2I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/argcomplete/default.nix b/pkgs/development/python-modules/argcomplete/default.nix
index 5b4a4e45ce4ce..4427e75089fad 100644
--- a/pkgs/development/python-modules/argcomplete/default.nix
+++ b/pkgs/development/python-modules/argcomplete/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "argcomplete";
-  version = "3.2.2";
+  version = "3.2.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "kislyuk";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-xHUK57Adp3pnzHtFzvjFYb3t1cywRrEeKKXgJJqg10s=";
+    hash = "sha256-sGXHRHmzapJM/c4D4j3QWhkTNzPNZPLO7JOptnTXuR8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index bd05a3d076f56..d3b87ca99f442 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -65,7 +65,7 @@
 }:
 let
   pname = "argilla";
-  version = "1.26.1";
+  version = "1.27.0";
   optional-dependencies = {
     server = [
       fastapi
@@ -126,7 +126,7 @@ buildPythonPackage {
     owner = "argilla-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7d8zvP06GrHrSEJn2NNv2BUNea1wamf21e+qa1dZU18=";
+    hash = "sha256-CBVP/+XFKnJBMcxsDd7lgQ1JFX7zFlHmdBwkAMmq85g=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/aspy.yaml/default.nix b/pkgs/development/python-modules/aspy-yaml/default.nix
index 09543479014e4..732d19be0d10c 100644
--- a/pkgs/development/python-modules/aspy.yaml/default.nix
+++ b/pkgs/development/python-modules/aspy-yaml/default.nix
@@ -1,12 +1,13 @@
 { lib, buildPythonPackage, fetchPypi, pyyaml }:
 
 buildPythonPackage rec {
-  pname = "aspy.yaml";
+  pname = "aspy-yaml";
   version = "1.3.0";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "aspy.yaml";
+    inherit version;
     sha256 = "0i9z2jm2hjwdxdv4vw4kbs70h2ciz49rv8w73zbawb7z5qw45iz7";
   };
 
diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index 10076ca6d9ae9..d22420b9fcfe2 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -5,7 +5,7 @@
 
 # build time
 , astropy-extension-helpers
-, cython_3
+, cython
 , jinja2
 , oldest-supported-numpy
 , setuptools-scm
@@ -38,7 +38,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     astropy-extension-helpers
-    cython_3
+    cython
     jinja2
     oldest-supported-numpy
     setuptools-scm
diff --git a/pkgs/development/python-modules/aws-encryption-sdk/default.nix b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
index c525d79e4b6d8..13f8d29ca9136 100644
--- a/pkgs/development/python-modules/aws-encryption-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
@@ -41,16 +41,17 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   disabledTestPaths = [
     # Tests require networking
     "examples"
     "test/integration"
   ];
 
+  disabledTests = [
+    # pytest 8 compat issue
+    "test_happy_version"
+  ];
+
   pythonImportsCheck = [
     "aws_encryption_sdk"
   ];
diff --git a/pkgs/development/python-modules/awswrangler/default.nix b/pkgs/development/python-modules/awswrangler/default.nix
index 674b127fcae1b..ad861143dccab 100644
--- a/pkgs/development/python-modules/awswrangler/default.nix
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@@ -19,6 +19,7 @@
 , pyparsing
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , redshift-connector
 , requests-aws4auth
 }:
@@ -39,6 +40,11 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "packaging"
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/backports_shutil_get_terminal_size/default.nix b/pkgs/development/python-modules/backports-shutil-get-terminal-size/default.nix
index aec6077dd7667..237cde584ebde 100644
--- a/pkgs/development/python-modules/backports_shutil_get_terminal_size/default.nix
+++ b/pkgs/development/python-modules/backports-shutil-get-terminal-size/default.nix
@@ -6,7 +6,7 @@
 }:
 
 if !(pythonOlder "3.3") then null else buildPythonPackage {
-  pname = "backports.shutil_get_terminal_size";
+  pname = "backports-shutil-get-terminal-size";
   version = "unstable-2016-02-21";
 
   # there have been numerous fixes committed since the initial release.
diff --git a/pkgs/development/python-modules/barectf/default.nix b/pkgs/development/python-modules/barectf/default.nix
index 9875cdf0ac1c7..ed9be93dd0217 100644
--- a/pkgs/development/python-modules/barectf/default.nix
+++ b/pkgs/development/python-modules/barectf/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
-, pytestCheckHook
+, pytest7CheckHook
 , pythonRelaxDepsHook
 , setuptools
 , jsonschema
@@ -47,11 +47,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+    pytest7CheckHook
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 8c1502a8e1c5e..38c938bb74247 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -4,6 +4,7 @@
 , click
 , click-log
 , fetchFromGitHub
+, fetchpatch2
 , pure-pcapy3
 , pyserial-asyncio
 , pytest-asyncio
@@ -29,6 +30,13 @@ buildPythonPackage rec {
     hash = "sha256-oxPzjDb+FdHeHsgeGKH3SVvKb0vCB9dIhT7lGzhDcBw=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/zigpy/bellows/commit/7833647083f27f55b7ad345f4aaa7dffaa369abc.patch";
+      hash = "sha256-v+BOPqikWoyNtZ1qRWe3RwraG6nQnfZqoV6yj9PpGX8=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail '"setuptools-git-versioning<2"' "" \
diff --git a/pkgs/development/python-modules/betterproto/default.nix b/pkgs/development/python-modules/betterproto/default.nix
index c3a823169d46c..a20daf344f061 100644
--- a/pkgs/development/python-modules/betterproto/default.nix
+++ b/pkgs/development/python-modules/betterproto/default.nix
@@ -11,7 +11,7 @@
   isort,
   python,
   pydantic,
-  pytestCheckHook,
+  pytest7CheckHook,
   pytest-asyncio,
   pytest-mock,
   typing-extensions,
@@ -52,7 +52,7 @@ buildPythonPackage rec {
     pydantic
     pytest-asyncio
     pytest-mock
-    pytestCheckHook
+    pytest7CheckHook
     tomlkit
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
diff --git a/pkgs/development/python-modules/blis/default.nix b/pkgs/development/python-modules/blis/default.nix
index eec563c79a9dc..8b465bcebdc11 100644
--- a/pkgs/development/python-modules/blis/default.nix
+++ b/pkgs/development/python-modules/blis/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
-, cython
+, cython_0
 , hypothesis
 , numpy
 , pytestCheckHook
@@ -38,7 +38,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    cython
+    cython_0
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/blosc2/default.nix b/pkgs/development/python-modules/blosc2/default.nix
index d960139a7d6e3..efaec4ead7135 100644
--- a/pkgs/development/python-modules/blosc2/default.nix
+++ b/pkgs/development/python-modules/blosc2/default.nix
@@ -4,7 +4,7 @@
 
 # build-system
 , cmake
-, cython_3
+, cython
 , ninja
 , oldest-supported-numpy
 , pkg-config
@@ -47,7 +47,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
-    cython_3
+    cython
     ninja
     oldest-supported-numpy
     pkg-config
diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 95d6207de10a7..fbaf458be3f31 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , cryptography
-, cython_3
+, cython
 , poetry-core
 , pytestCheckHook
 , pythonOlder
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   env.REQUIRE_CYTHON = 1;
 
   nativeBuildInputs = [
-    cython_3
+    cython
     poetry-core
     setuptools
   ];
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 80176e169a9c7..7d2776ffe76a1 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -366,7 +366,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.84";
+  version = "1.34.88";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -374,7 +374,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-c7u1CaacSsjM4DivsVEGhriDmMvUbV3x4yOPzmbfmvU=";
+    hash = "sha256-I8qeDNDT53AtZjGh6UpCCKJrOfprEsc0Qn5op/pklHc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 1edd288f30ac0..3b536f15577c5 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.86";
+  version = "1.34.88";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-Lg0XDWJ0VKHYtoXvP07tjArfY08Z6clvGVyjrvc3pi4=";
+    hash = "sha256-ZW6WbqFSpPKCiJKqepZzvJF5mZj1qO/Y6P45D2HC9PE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bubop/default.nix b/pkgs/development/python-modules/bubop/default.nix
new file mode 100644
index 0000000000000..72c9737ce7b58
--- /dev/null
+++ b/pkgs/development/python-modules/bubop/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, loguru
+, python-dateutil
+, pyyaml
+, tqdm
+, click
+}:
+
+buildPythonPackage rec {
+  pname = "bubop";
+  version = "0.1.12";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "bubop";
+    rev = "v${version}";
+    hash = "sha256-p4Mv73oX5bsYKby7l0nGon89KyAMIUhDAEKSTNB++Cw=";
+  };
+
+  postPatch = ''
+    # Those versions seems to work with `bubop`.
+    substituteInPlace pyproject.toml \
+    --replace-fail 'loguru = "^0.5.3"' 'loguru = "^0.7"' \
+    --replace-fail 'PyYAML = "~5.3.1"' 'PyYAML = "^6.0"'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    loguru
+    python-dateutil
+    pyyaml
+    tqdm
+    click
+  ];
+
+  pythonImportsCheck = [ "bubop" ];
+
+  meta = with lib; {
+    description = "Bergercookie's Useful Bits Of Python; helper libraries for Bergercookie's programs";
+    homepage = "https://github.com/bergercookie/bubop";
+    changelog = "https://github.com/bergercookie/bubop/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/development/python-modules/cached-ipaddress/default.nix b/pkgs/development/python-modules/cached-ipaddress/default.nix
index c4d29b98bd76c..5e4781ec75032 100644
--- a/pkgs/development/python-modules/cached-ipaddress/default.nix
+++ b/pkgs/development/python-modules/cached-ipaddress/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, cython_3
+, cython
 , fetchFromGitHub
 , poetry-core
 , pytestCheckHook
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython_3
+    cython
     poetry-core
     setuptools
     wheel
diff --git a/pkgs/development/python-modules/camel-converter/default.nix b/pkgs/development/python-modules/camel-converter/default.nix
index 65703ad76bd09..95967d2300e4d 100644
--- a/pkgs/development/python-modules/camel-converter/default.nix
+++ b/pkgs/development/python-modules/camel-converter/default.nix
@@ -1,15 +1,16 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, poetry-core
-, pydantic
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pydantic,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "camel-converter";
-  version = "3.1.1";
+  version = "3.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,31 +19,23 @@ buildPythonPackage rec {
     owner = "sanders41";
     repo = "camel-converter";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xrdk5Y3H8KlQaGtJYdJNHq16Qfos2p+93uIAfIl098c=";
+    hash = "sha256-CJbflRI3wfUmPoVuLwZDYcobESmySvnS99PdpSDhDLk=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "--cov=camel_converter --cov-report term-missing --no-cov-on-fail" ""
+      --replace-fail "--cov=camel_converter --cov-report term-missing --no-cov-on-fail" ""
   '';
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
   passthru.optional-dependencies = {
-    pydantic = [
-      pydantic
-    ];
+    pydantic = [ pydantic ];
   };
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ] ++ passthru.optional-dependencies.pydantic;
+  nativeCheckInputs = [ pytestCheckHook ] ++ passthru.optional-dependencies.pydantic;
 
-  pythonImportsCheck = [
-    "camel_converter"
-  ];
+  pythonImportsCheck = [ "camel_converter" ];
 
   disabledTests = [
     # AttributeError: 'Test' object has no attribute 'model_dump'
diff --git a/pkgs/development/python-modules/cassandra-driver/default.nix b/pkgs/development/python-modules/cassandra-driver/default.nix
index e985ed544d3cd..8c05e5e0bbb6b 100644
--- a/pkgs/development/python-modules/cassandra-driver/default.nix
+++ b/pkgs/development/python-modules/cassandra-driver/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , buildPythonPackage
 , cryptography
-, cython
+, cython_0
 , eventlet
 , fetchFromGitHub
 , geomet
@@ -43,7 +43,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython
+    cython_0
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/catkin-pkg/default.nix b/pkgs/development/python-modules/catkin-pkg/default.nix
new file mode 100644
index 0000000000000..c9ddf02b05f47
--- /dev/null
+++ b/pkgs/development/python-modules/catkin-pkg/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  docutils,
+  pyparsing,
+  python-dateutil,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "catkin-pkg";
+  version = "0.5.2";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ros-infrastructure";
+    repo = "catkin_pkg";
+    rev = version;
+    hash = "sha256-DjaPpLDsLpYOZukf5tYe6ZetSNTe/DJ2lS9BUsehZ8k=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    docutils
+    pyparsing
+    python-dateutil
+  ];
+
+  pythonImportsCheck = [ "catkin_pkg" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTestPaths = [ "test/test_flake8.py" ];
+
+  meta = {
+    description = "Library for retrieving information about catkin packages.";
+    homepage = "http://wiki.ros.org/catkin_pkg";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+  };
+}
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index c6eaa72d2df12..73492baa076a2 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2023.11.17";
+  version = "2024.02.02";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    hash = "sha256-H3zsFJjWt2+tT7yqQOOZZwSL5y0AtfDz6Fqxwpm4Wl8=";
+    hash = "sha256-gnWJjZy5E/0lvAeLftXNtcHH6RHL/dUomXOBgumiWX8=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/certifi/env.patch b/pkgs/development/python-modules/certifi/env.patch
index 292f977ef2c07..97a48b46e05f7 100644
--- a/pkgs/development/python-modules/certifi/env.patch
+++ b/pkgs/development/python-modules/certifi/env.patch
@@ -1,13 +1,17 @@
 diff --git a/certifi/core.py b/certifi/core.py
-index de02898..c033d20 100644
+index 91f538b..1110ce0 100644
 --- a/certifi/core.py
 +++ b/certifi/core.py
-@@ -4,15 +4,25 @@ certifi.py
+@@ -4,6 +4,7 @@ certifi.py
  
  This module returns the installation location of cacert.pem or its contents.
  """
 +import os
  import sys
+ import atexit
+ 
+@@ -11,12 +12,21 @@ def exit_cacert_ctx() -> None:
+     _CACERT_CTX.__exit__(None, None, None)  # type: ignore[union-attr]
  
  
 +def get_cacert_path_from_environ():
@@ -29,17 +33,16 @@ index de02898..c033d20 100644
  
      def where() -> str:
          # This is slightly terrible, but we want to delay extracting the file
-@@ -39,14 +49,16 @@ if sys.version_info >= (3, 11):
+@@ -44,6 +54,8 @@ if sys.version_info >= (3, 11):
          return _CACERT_PATH
  
      def contents() -> str:
--        return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
 +        if _CACERT_PATH is not None:
 +            return open(_CACERT_PATH, encoding="utf-8").read()
-+        return files("certifi").joinpath("cacert.pem").read_text(encoding="utf-8")
+         return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
  
  elif sys.version_info >= (3, 7):
- 
+@@ -51,7 +63,7 @@ elif sys.version_info >= (3, 7):
      from importlib.resources import path as get_path, read_text
  
      _CACERT_CTX = None
@@ -48,7 +51,7 @@ index de02898..c033d20 100644
  
      def where() -> str:
          # This is slightly terrible, but we want to delay extracting the
-@@ -74,7 +86,9 @@ elif sys.version_info >= (3, 7):
+@@ -80,7 +92,9 @@ elif sys.version_info >= (3, 7):
          return _CACERT_PATH
  
      def contents() -> str:
@@ -59,7 +62,7 @@ index de02898..c033d20 100644
  
  else:
      import os
-@@ -84,6 +98,8 @@ else:
+@@ -90,6 +104,8 @@ else:
      Package = Union[types.ModuleType, str]
      Resource = Union[str, "os.PathLike"]
  
@@ -68,7 +71,7 @@ index de02898..c033d20 100644
      # This fallback will work for Python versions prior to 3.7 that lack the
      # importlib.resources module but relies on the existing `where` function
      # so won't address issues with environments like PyOxidizer that don't set
-@@ -102,7 +118,14 @@ else:
+@@ -108,7 +124,13 @@ else:
      def where() -> str:
          f = os.path.dirname(__file__)
  
@@ -78,9 +81,7 @@ index de02898..c033d20 100644
          return os.path.join(f, "cacert.pem")
  
      def contents() -> str:
--        return read_text("certifi", "cacert.pem", encoding="ascii")
 +        if _CACERT_PATH is not None:
 +            with open(_CACERT_PATH, encoding="utf-8") as data:
 +                return data.read()
-+
-+        return read_text("certifi", "cacert.pem", encoding="utf-8")
+         return read_text("certifi", "cacert.pem", encoding="ascii")
diff --git a/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix b/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
index dbab53868f66c..429467d65e309 100644
--- a/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
+++ b/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 
 # build-system
-, cython_3
+, cython
 , poetry-core
 , setuptools
 
@@ -34,7 +34,7 @@ buildPythonPackage {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     poetry-core
     setuptools
   ];
diff --git a/pkgs/development/python-modules/chalice/default.nix b/pkgs/development/python-modules/chalice/default.nix
index 2e880508e0b49..25b9998433a6b 100644
--- a/pkgs/development/python-modules/chalice/default.nix
+++ b/pkgs/development/python-modules/chalice/default.nix
@@ -10,7 +10,7 @@
 , mock
 , mypy-extensions
 , pip
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , pyyaml
 , requests
@@ -61,15 +61,11 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     hypothesis
     mock
-    pytestCheckHook
+    pytest7CheckHook
     requests
     websocket-client
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   disabledTestPaths = [
     # Don't check the templates and the sample app
     "chalice/templates"
diff --git a/pkgs/development/python-modules/chart-studio/default.nix b/pkgs/development/python-modules/chart-studio/default.nix
index 998174d6ccbb0..4f78d8728120c 100644
--- a/pkgs/development/python-modules/chart-studio/default.nix
+++ b/pkgs/development/python-modules/chart-studio/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "plotly";
     repo = "plotly.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LSZGaefxQC6h9VAJ2wgZyaQPR6vs0wrp2oxd51I3pL8=";
+    hash = "sha256-i//LKTNmoIrusBnpfSGc9cDijPxg/dY/7fumV3kfTAY=";
   };
 
   sourceRoot = "${src.name}/packages/python/chart-studio";
diff --git a/pkgs/development/python-modules/clarifai/default.nix b/pkgs/development/python-modules/clarifai/default.nix
index ee6a1eb6bc644..b1085bdc5b99c 100644
--- a/pkgs/development/python-modules/clarifai/default.nix
+++ b/pkgs/development/python-modules/clarifai/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "clarifai";
-  version = "10.3.0";
+  version = "10.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "Clarifai";
     repo = "clarifai-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-8EPs6kGB+Px9Fs2Z+YwDcmEYI5+z/kOIKLraJFMykF0=";
+    hash = "sha256-KCJ1Ev0fgww0JU1tDp9X/A9EIcXQRaFKeA/MRNnp5ng=";
   };
 
   pythonRelaxDeps = [ "clarifai-grpc" ];
diff --git a/pkgs/development/python-modules/clickhouse-cityhash/default.nix b/pkgs/development/python-modules/clickhouse-cityhash/default.nix
index d8fad65bef0d1..ecb3f3bf290e7 100644
--- a/pkgs/development/python-modules/clickhouse-cityhash/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cityhash/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, cython_3
+, cython
 , fetchPypi
 , pythonOlder
 , setuptools
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/clickhouse-connect/default.nix b/pkgs/development/python-modules/clickhouse-connect/default.nix
index a3768c8e577bf..e7bf0aa8e036b 100644
--- a/pkgs/development/python-modules/clickhouse-connect/default.nix
+++ b/pkgs/development/python-modules/clickhouse-connect/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 , pytestCheckHook
   # build_requires
-, cython_3
+, cython
   # install_requires
 , certifi
 , importlib-metadata
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     hash = "sha256-tdf9aYKAFpRyaqGGNxXs4bzmY6mdhKZ5toFBJRmD2VY=";
   };
 
-  nativeBuildInputs = [ cython_3 ];
+  nativeBuildInputs = [ cython ];
   setupPyBuildFlags = [ "--inplace" ];
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/python-modules/clickhouse-driver/default.nix b/pkgs/development/python-modules/clickhouse-driver/default.nix
index 716914b3caee3..1ddaa5398d9d9 100644
--- a/pkgs/development/python-modules/clickhouse-driver/default.nix
+++ b/pkgs/development/python-modules/clickhouse-driver/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , clickhouse-cityhash
-, cython_3
+, cython
 , fetchFromGitHub
 , freezegun
 , lz4
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/cloudpathlib/default.nix b/pkgs/development/python-modules/cloudpathlib/default.nix
index 3f14fae210d2d..063ba6ce10563 100644
--- a/pkgs/development/python-modules/cloudpathlib/default.nix
+++ b/pkgs/development/python-modules/cloudpathlib/default.nix
@@ -11,8 +11,7 @@
 , boto3
 , psutil
 , pydantic
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pytest-cases
 , pytest-cov
 , pytest-xdist
@@ -66,7 +65,7 @@ buildPythonPackage rec {
     google-cloud-storage
     psutil
     pydantic
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     pytest-cases
     pytest-cov
     pytest-xdist
diff --git a/pkgs/development/python-modules/cloudsmith-api/default.nix b/pkgs/development/python-modules/cloudsmith-api/default.nix
index 5f51009f4bd77..e49a0eb5f92f4 100644
--- a/pkgs/development/python-modules/cloudsmith-api/default.nix
+++ b/pkgs/development/python-modules/cloudsmith-api/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "cloudsmith-api";
-  version = "2.0.12";
+  version = "2.0.13";
   format = "wheel";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cloudsmith_api";
     inherit format version;
-    hash = "sha256-a33t963Q5+gnZI9pha4viuyWz3xLHUdcGE4ccw/w0s8=";
+    hash = "sha256-xPPARaxclTRy7thJXtXaMK0F5/91q7o35LyzSmx1HPU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/colorcet/default.nix b/pkgs/development/python-modules/colorcet/default.nix
index 0096e32bf7c04..08951a18fc492 100644
--- a/pkgs/development/python-modules/colorcet/default.nix
+++ b/pkgs/development/python-modules/colorcet/default.nix
@@ -1,34 +1,34 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
+, setuptools-scm
 , param
 , pyct
 , pytest-mpl
 , pytestCheckHook
-, setuptools
-, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "colorcet";
   version = "3.1.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-KSGzzYGiKIqvLWPbwM48JtzYgujDicxQXWiGv3qppOs=";
   };
 
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
   dependencies = [
     param
     pyct
   ];
 
-  build-system = [
-    setuptools-scm
-    setuptools
-  ];
-
   nativeCheckInputs = [
     pytest-mpl
     pytestCheckHook
diff --git a/pkgs/development/python-modules/consonance/default.nix b/pkgs/development/python-modules/consonance/default.nix
index b14d965e56295..e13665cd5dc3e 100644
--- a/pkgs/development/python-modules/consonance/default.nix
+++ b/pkgs/development/python-modules/consonance/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , dissononce
 , python-axolotl-curve25519
 , transitions
@@ -23,6 +24,15 @@ buildPythonPackage rec {
     hash = "sha256-BhgxLxjKZ4dSL7DqkaoS+wBPCd1SYZomRKrtDLdGmYQ=";
   };
 
+  patches = [
+    # https://github.com/tgalal/consonance/pull/9
+    (fetchpatch {
+      name = "fix-type-error.patch";
+      url = "https://github.com/tgalal/consonance/pull/9/commits/92fb78af98a18f0533ec8a286136968174fb0baf.patch";
+      hash = "sha256-wVUGxZ4W2zPyrcQPQTc85LcRUtsLbTBVzS10NEolpQY=";
+    })
+  ];
+
   propagatedBuildInputs = [
     dissononce
     python-axolotl-curve25519
diff --git a/pkgs/development/python-modules/cpyparsing/default.nix b/pkgs/development/python-modules/cpyparsing/default.nix
index c475652799ea8..e063e8847d436 100644
--- a/pkgs/development/python-modules/cpyparsing/default.nix
+++ b/pkgs/development/python-modules/cpyparsing/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, cython_3
+, cython
 , pexpect
 , python
 , pythonOlder
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/craft-application/default.nix b/pkgs/development/python-modules/craft-application/default.nix
new file mode 100644
index 0000000000000..0b90ccdff058b
--- /dev/null
+++ b/pkgs/development/python-modules/craft-application/default.nix
@@ -0,0 +1,114 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  git,
+  craft-archives,
+  craft-cli,
+  craft-grammar,
+  craft-parts,
+  craft-providers,
+  pydantic-yaml-0,
+  pyyaml,
+  setuptools,
+  setuptools-scm,
+  snap-helpers,
+  stdenv,
+  pygit2,
+  pyfakefs,
+  pytestCheckHook,
+  pytest-check,
+  pytest-mock,
+  responses,
+  hypothesis,
+}:
+
+buildPythonPackage rec {
+  pname = "craft-application";
+  version = "2.5.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "craft-application";
+    rev = "refs/tags/${version}";
+    hash = "sha256-66Ldo88DJ6v0+ekvDl++eDzhdn95yxq0SMdzQxTGl5k=";
+  };
+
+  postPatch = ''
+    substituteInPlace craft_application/__init__.py \
+      --replace-fail "dev" "${version}"
+
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools==69.4.0" "setuptools"
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    craft-archives
+    craft-cli
+    craft-grammar
+    craft-parts
+    craft-providers
+    pydantic-yaml-0
+    pygit2
+    pyyaml
+    snap-helpers
+  ];
+
+  pythonImportsCheck = [ "craft_application" ];
+
+  nativeCheckInputs = [
+    git
+    hypothesis
+    pyfakefs
+    pytest-check
+    pytest-mock
+    pytestCheckHook
+    responses
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+
+    # Tests require access to /etc/os-release, which isn't accessible in
+    # the test environment, so create a fake file, and modify the code
+    # to look for it.
+    echo 'ID=nixos' > $HOME/os-release
+    echo 'NAME=NixOS' >> $HOME/os-release
+    echo 'VERSION_ID="24.05"' >> $HOME/os-release
+
+    substituteInPlace craft_application/util/platforms.py \
+      --replace-fail "os_utils.OsRelease()" "os_utils.OsRelease(os_release_file='$HOME/os-release')"
+  '';
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  disabledTests = [
+    "test_to_yaml_file"
+    # Tests expecting pytest-time
+    "test_monitor_builds_success"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    # These tests have hardcoded "amd64" strings which fail on aarch64
+    "test_process_grammar_build_for"
+    "test_process_grammar_platform"
+    "test_process_grammar_default"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "The basis for Canonical craft applications";
+    homepage = "https://github.com/canonical/craft-application";
+    changelog = "https://github.com/canonical/craft-application/releases/tag/${version}";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/craft-providers/default.nix b/pkgs/development/python-modules/craft-providers/default.nix
index e3c384f455ba7..4f463e628bd6a 100644
--- a/pkgs/development/python-modules/craft-providers/default.nix
+++ b/pkgs/development/python-modules/craft-providers/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
   };
 
   patches = [
+    # This lib will try to inject snaps *from the host system* into the build
+    # system. This patch short-circuits that logic and ensures that snaps are
+    # installed on the build system from the snap store - because there is no
+    # snapd on NixOS hosts that can be used for the injection. This patch will
+    # likely never be accepted upstream.
     ./inject-snaps.patch
   ];
 
diff --git a/pkgs/development/python-modules/craft-providers/inject-snaps.patch b/pkgs/development/python-modules/craft-providers/inject-snaps.patch
index 85dec7f8bd97e..37f9f2f82d7e3 100644
--- a/pkgs/development/python-modules/craft-providers/inject-snaps.patch
+++ b/pkgs/development/python-modules/craft-providers/inject-snaps.patch
@@ -38,7 +38,7 @@ index 3c914a2..d9c2cf9 100644
 -                        details=error.details,
 -                    ) from error
 +            try:
-+                channel = "latest/edge" if snap.name == "rockcraft" else "latest/stable"
++                channel = "latest/beta"
 +                snap_installer.install_from_store(
 +                    executor=executor,
 +                    snap_name=snap.name,
diff --git a/pkgs/development/python-modules/cypari2/default.nix b/pkgs/development/python-modules/cypari2/default.nix
index f93e046297281..025692de1f740 100644
--- a/pkgs/development/python-modules/cypari2/default.nix
+++ b/pkgs/development/python-modules/cypari2/default.nix
@@ -5,7 +5,7 @@
 , fetchPypi
 , pari
 , gmp
-, cython_3
+, cython
 , cysignals
 }:
 
@@ -45,7 +45,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     cysignals
-    cython_3
+    cython
   ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/cysignals/default.nix b/pkgs/development/python-modules/cysignals/default.nix
index 107b552a631c0..62cc3dd30d8af 100644
--- a/pkgs/development/python-modules/cysignals/default.nix
+++ b/pkgs/development/python-modules/cysignals/default.nix
@@ -2,7 +2,7 @@
 , autoreconfHook
 , fetchPypi
 , buildPythonPackage
-, cython_3
+, cython
 , pariSupport ? true, pari # for interfacing with the PARI/GP signal handler
 }:
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    cython_3
+    cython
   ] ++ lib.optionals pariSupport [
     # When cysignals is built with pari, including cysignals into the
     # buildInputs of another python package will cause cython to link against
diff --git a/pkgs/development/python-modules/cython/0.nix b/pkgs/development/python-modules/cython/0.nix
new file mode 100644
index 0000000000000..72ba4a68f038f
--- /dev/null
+++ b/pkgs/development/python-modules/cython/0.nix
@@ -0,0 +1,91 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, setuptools
+, python
+, pkg-config
+, gdb
+, numpy
+, ncurses
+}:
+
+let
+  excludedTests = [ "reimport_from_subinterpreter" ]
+    # cython's testsuite is not working very well with libc++
+    # We are however optimistic about things outside of testsuite still working
+    ++ lib.optionals (stdenv.cc.isClang or false) [ "cpdef_extern_func" "libcpp_algo" ]
+    # Some tests in the test suite isn't working on aarch64. Disable them for
+    # now until upstream finds a workaround.
+    # Upstream issue here: https://github.com/cython/cython/issues/2308
+    ++ lib.optionals stdenv.isAarch64 [ "numpy_memoryview" ]
+    ++ lib.optionals stdenv.isi686 [ "future_division" "overflow_check_longlong" ]
+  ;
+
+in buildPythonPackage rec {
+  pname = "cython";
+  version = "0.29.36";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "Cython";
+    inherit version;
+    hash = "sha256-QcDP0tdU44PJ7rle/8mqSrhH0Ml0cHfd18Dctow7wB8=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    gdb numpy ncurses
+  ];
+
+  LC_ALL = "en_US.UTF-8";
+
+  patches = [
+    # backport Cython 3.0 trashcan support (https://github.com/cython/cython/pull/2842) to 0.X series.
+    # it does not affect Python code unless the code explicitly uses the feature.
+    # trashcan support is needed to avoid stack overflows during object deallocation in sage (https://trac.sagemath.org/ticket/27267)
+    ./trashcan.patch
+    # The above commit introduces custom trashcan macros, as well as
+    # compiler changes to use them in Cython-emitted code. The latter
+    # change is still useful, but the former has been upstreamed as of
+    # Python 3.8, and the patch below makes Cython use the upstream
+    # trashcan macros whenever available. This is needed for Python
+    # 3.11 support, because the API used in Cython's implementation
+    # changed: https://github.com/cython/cython/pull/4475
+    (fetchpatch {
+      name = "disable-trashcan.patch";
+      url = "https://github.com/cython/cython/commit/e337825cdcf5e94d38ba06a0cb0188e99ce0cc92.patch";
+      hash = "sha256-q0f63eetKrDpmP5Z4v8EuGxg26heSyp/62OYqhRoSso=";
+    })
+  ];
+
+  checkPhase = ''
+    export HOME="$NIX_BUILD_TOP"
+    ${python.interpreter} runtests.py -j$NIX_BUILD_CORES \
+      --no-code-style \
+      ${lib.optionalString (builtins.length excludedTests != 0)
+        ''--exclude="(${builtins.concatStringsSep "|" excludedTests})"''}
+  '';
+
+  # https://github.com/cython/cython/issues/2785
+  # Temporary solution
+  doCheck = false;
+  # doCheck = !stdenv.isDarwin;
+
+  # force regeneration of generated code in source distributions
+  # https://github.com/cython/cython/issues/5089
+  setupHook = ./setup-hook.sh;
+
+  meta = {
+    changelog = "https://github.com/cython/cython/blob/${version}/CHANGES.rst";
+    description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
+    homepage = "https://cython.org";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fridh ];
+  };
+}
diff --git a/pkgs/development/python-modules/cython/default.nix b/pkgs/development/python-modules/cython/default.nix
index 72ba4a68f038f..4467dc3b459ce 100644
--- a/pkgs/development/python-modules/cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , setuptools
 , python
 , pkg-config
@@ -25,16 +24,16 @@ let
 
 in buildPythonPackage rec {
   pname = "cython";
-  version = "0.29.36";
+  version = "3.0.9";
   pyproject = true;
 
   src = fetchPypi {
     pname = "Cython";
     inherit version;
-    hash = "sha256-QcDP0tdU44PJ7rle/8mqSrhH0Ml0cHfd18Dctow7wB8=";
+    hash = "sha256-otNU8FnR8FXTTPqmLFtovHisLOq2QHFI1H+1CM87pPM=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     pkg-config
     setuptools
   ];
@@ -43,26 +42,7 @@ in buildPythonPackage rec {
     gdb numpy ncurses
   ];
 
-  LC_ALL = "en_US.UTF-8";
-
-  patches = [
-    # backport Cython 3.0 trashcan support (https://github.com/cython/cython/pull/2842) to 0.X series.
-    # it does not affect Python code unless the code explicitly uses the feature.
-    # trashcan support is needed to avoid stack overflows during object deallocation in sage (https://trac.sagemath.org/ticket/27267)
-    ./trashcan.patch
-    # The above commit introduces custom trashcan macros, as well as
-    # compiler changes to use them in Cython-emitted code. The latter
-    # change is still useful, but the former has been upstreamed as of
-    # Python 3.8, and the patch below makes Cython use the upstream
-    # trashcan macros whenever available. This is needed for Python
-    # 3.11 support, because the API used in Cython's implementation
-    # changed: https://github.com/cython/cython/pull/4475
-    (fetchpatch {
-      name = "disable-trashcan.patch";
-      url = "https://github.com/cython/cython/commit/e337825cdcf5e94d38ba06a0cb0188e99ce0cc92.patch";
-      hash = "sha256-q0f63eetKrDpmP5Z4v8EuGxg26heSyp/62OYqhRoSso=";
-    })
-  ];
+  env.LC_ALL = "en_US.UTF-8";
 
   checkPhase = ''
     export HOME="$NIX_BUILD_TOP"
diff --git a/pkgs/development/python-modules/cytoolz/default.nix b/pkgs/development/python-modules/cytoolz/default.nix
index 64ac6ad9dfd01..afa9152c9babf 100644
--- a/pkgs/development/python-modules/cytoolz/default.nix
+++ b/pkgs/development/python-modules/cytoolz/default.nix
@@ -4,6 +4,7 @@
 , isPyPy
 , pytestCheckHook
 , cython
+, setuptools
 , toolz
 , python
 , isPy27
@@ -12,7 +13,8 @@
 buildPythonPackage rec {
   pname = "cytoolz";
   version = "0.12.3";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = isPy27 || isPyPy;
 
   src = fetchPypi {
@@ -20,7 +22,10 @@ buildPythonPackage rec {
     hash = "sha256-RQPcWfTO1TpUZDJyxh3DBdHbv719a98paUjenzTDooI=";
   };
 
-  nativeBuildInputs = [ cython ];
+  nativeBuildInputs = [
+    cython
+    setuptools
+  ];
 
   propagatedBuildInputs = [ toolz ];
 
@@ -31,6 +36,11 @@ buildPythonPackage rec {
     export PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH
   '';
 
+  disabledTests = [
+    # https://github.com/pytoolz/cytoolz/issues/200
+    "test_inspect_wrapped_property"
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/daqp/default.nix b/pkgs/development/python-modules/daqp/default.nix
index 2b134f9f723d8..e5ae5e62be901 100644
--- a/pkgs/development/python-modules/daqp/default.nix
+++ b/pkgs/development/python-modules/daqp/default.nix
@@ -1,9 +1,8 @@
 { lib
-, stdenv
 , fetchFromGitHub
 , buildPythonPackage
 , unittestCheckHook
-, cython
+, cython_0
 , setuptools
 , wheel
 , numpy
@@ -32,7 +31,7 @@ buildPythonPackage rec {
   unittestFlagsArray = [ "-s" "test" "-p" "'*.py'" "-v" ];
 
   nativeBuildInputs = [
-    cython
+    cython_0
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/dask-mpi/default.nix b/pkgs/development/python-modules/dask-mpi/default.nix
index 6ee614d23a939..ea9ff170908c9 100644
--- a/pkgs/development/python-modules/dask-mpi/default.nix
+++ b/pkgs/development/python-modules/dask-mpi/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , dask
 , distributed
 , mpi4py
@@ -19,6 +20,15 @@ buildPythonPackage rec {
     hash = "sha256-CgTx19NaBs3/UGWTMw1EFOokLJFySYzhkfV0LqxJnhc=";
   };
 
+  patches = [
+    # https://github.com/dask/dask-mpi/pull/123
+    (fetchpatch {
+      name = "fix-versioneer-on-python312.patch";
+      url = "https://github.com/dask/dask-mpi/pull/123/commits/0f3b0286b7e29b5d5475561a148dc398108fc259.patch";
+      hash = "sha256-xXADCSIhq1ARny2twzrhR1J8LkMFWFl6tmGxrM8RvkU=";
+    })
+  ];
+
   propagatedBuildInputs = [
     dask
     distributed
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 44614185f73f0..ee12386ae3d8b 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 
 # build-system
 , setuptools
@@ -38,7 +39,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2024.1.1";
+  version = "2024.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -47,9 +48,22 @@ buildPythonPackage rec {
     owner = "dask";
     repo = "dask";
     rev = "refs/tags/${version}";
-    hash = "sha256-L8bRh2bx36CYrAFXYJF67rCeCRfm5ufhTkMFRJo0yYo=";
+    hash = "sha256-8VFtKPaF0PqCjqFB+plFe1GjUno5j7j86+wxKhzByyw=";
   };
 
+  patches = [
+    # A pair of fixes with python 3.11.9, merged upstream;
+    # see https://github.com/dask/dask/issues/11038
+    (fetchpatch {
+      url = "https://github.com/dask/dask/pull/11035.diff";
+      hash = "sha256-aQTzas8gn7pCyp7L6VV3NpSYgqC1Ov7YN7YGnX0Vwmo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/dask/dask/pull/11039.diff";
+      hash = "sha256-gvEEvnyhFlhiFvVaB6jwMy4auUOvECf49FbFJyjqQm4=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
     wheel
@@ -127,8 +141,6 @@ buildPythonPackage rec {
     "--reruns 3"
     # Don't run tests that require network access
     "-m 'not network'"
-    # pytest.PytestRemovedIn8Warning: Passing None has been deprecated.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
   ];
 
   disabledTests = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index 014e7ad01f721..d4db4490415b3 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -1,7 +1,7 @@
 { lib
 , async-timeout
 , buildPythonPackage
-, cython_3
+, cython
 , fetchFromGitHub
 , poetry-core
 , pytest-asyncio
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   env.REQUIRE_CYTHON = 1;
 
   nativeBuildInputs = [
-    cython_3
+    cython
     poetry-core
     setuptools
     wheel
diff --git a/pkgs/development/python-modules/deal/default.nix b/pkgs/development/python-modules/deal/default.nix
index 41d966c8f1e80..7c75c5b0f608f 100644
--- a/pkgs/development/python-modules/deal/default.nix
+++ b/pkgs/development/python-modules/deal/default.nix
@@ -60,10 +60,6 @@ buildPythonPackage rec {
     vaa
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   disabledTests = [
     # Tests need internet access
     "test_smoke_has"
diff --git a/pkgs/development/python-modules/demes/default.nix b/pkgs/development/python-modules/demes/default.nix
index 4eadd670a1e15..522b075d2a6e2 100644
--- a/pkgs/development/python-modules/demes/default.nix
+++ b/pkgs/development/python-modules/demes/default.nix
@@ -5,7 +5,7 @@
 , ruamel-yaml
 , attrs
 , pythonOlder
-, pytestCheckHook
+, pytest7CheckHook
 , pytest-xdist
 , numpy
 }:
@@ -36,16 +36,11 @@ buildPythonPackage rec {
   '';
 
   nativeCheckInputs = [
-    pytestCheckHook
+    pytest7CheckHook
     pytest-xdist
     numpy
   ];
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Passing None has been deprecated.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   disabledTestPaths = [
     "tests/test_spec.py"
   ];
diff --git a/pkgs/development/python-modules/detect-secrets/default.nix b/pkgs/development/python-modules/detect-secrets/default.nix
index 589df56247784..a50b6dbd810ce 100644
--- a/pkgs/development/python-modules/detect-secrets/default.nix
+++ b/pkgs/development/python-modules/detect-secrets/default.nix
@@ -5,7 +5,7 @@
 , mock
 , pkgs
 , pyahocorasick
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , pyyaml
 , requests
@@ -37,17 +37,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     mock
-    pytestCheckHook
+    pytest7CheckHook
     responses
     unidiff
     pkgs.gitMinimal
   ];
 
-  pytestFlagsArray = [
-    # Pytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   preCheck = ''
     export HOME=$(mktemp -d);
   '';
diff --git a/pkgs/development/python-modules/devtools/default.nix b/pkgs/development/python-modules/devtools/default.nix
index 08a5f2e7f50c6..a36da40bece4c 100644
--- a/pkgs/development/python-modules/devtools/default.nix
+++ b/pkgs/development/python-modules/devtools/default.nix
@@ -39,11 +39,6 @@ buildPythonPackage rec {
     pytest-mock
   ];
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Passing None has been deprecated.
-    "-W ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   disabledTests = [
     # Test for Windows32
     "test_print_subprocess"
diff --git a/pkgs/development/python-modules/dirigera/default.nix b/pkgs/development/python-modules/dirigera/default.nix
index f8618c1e5a894..649c79632a3ef 100644
--- a/pkgs/development/python-modules/dirigera/default.nix
+++ b/pkgs/development/python-modules/dirigera/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dirigera";
-  version = "1.1.2";
+  version = "1.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Leggin";
     repo = "dirigera";
     rev = "refs/tags/v${version}";
-    hash = "sha256-EOnhkfU6DC0IfroHR8O45eNxIyyNS81Z/ptSViqyThU=";
+    hash = "sha256-60DLNp3mM4LpnmM98JVcKlOxj20jvtsBnYq7tL4WEW8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 727403f37c465..bc1fcbdfe9c8d 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch2
 , pythonAtLeast
 , pythonOlder
 , substituteAll
@@ -63,6 +64,13 @@ buildPythonPackage rec {
     # and disable failing tests
     ./django_4_tests.patch
 
+    (fetchpatch2 {
+      # https://github.com/django/django/pull/17979
+      name = "django-mime-utf8-surrogates.patch";
+      url = "https://github.com/django/django/commit/0d3ddcaf2c74638a32781f361d467af572ced95f.patch";
+      hash = "sha256-AoIFvehBsXIrzIlCsqOZ++RqtDFl/H+zXqA25OMQr7g=";
+    })
+
   ] ++ lib.optionals withGdal [
     (substituteAll {
       src = ./django_4_set_geos_gdal_lib.patch;
diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 2bcf41dc39d92..fc4ba20245fce 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch2
 , pythonAtLeast
 , pythonOlder
 , substituteAll
@@ -64,6 +65,13 @@ buildPythonPackage rec {
     # disable test that excpects timezone issues
     ./django_5_disable_failing_tests.patch
 
+    (fetchpatch2 {
+      # https://github.com/django/django/pull/17979
+      name = "django-mime-utf8-surrogates.patch";
+      url = "https://github.com/django/django/commit/b231bcd19e57267ce1fc21d42d46f0b65fdcfcf8.patch";
+      hash = "sha256-HhmRwi24VkoPoh+NygAThCoMywoMwrLijU4ZsDfVU34=";
+    })
+
   ] ++ lib.optionals withGdal [
     (substituteAll {
       src = ./django_5_set_geos_gdal_lib.patch;
diff --git a/pkgs/development/python-modules/djangorestframework/default.nix b/pkgs/development/python-modules/djangorestframework/default.nix
index 1499469c06b83..8bec94e665198 100644
--- a/pkgs/development/python-modules/djangorestframework/default.nix
+++ b/pkgs/development/python-modules/djangorestframework/default.nix
@@ -6,7 +6,7 @@
 , django-guardian
 , pythonOlder
 , pytest-django
-, pytestCheckHook
+, pytest7CheckHook
 , pytz
 , pyyaml
 , uritemplate
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest-django
-    pytestCheckHook
+    pytest7CheckHook
 
     # optional tests
     coreapi
@@ -41,11 +41,6 @@ buildPythonPackage rec {
     uritemplate
   ];
 
-  pytestFlagsArray = [
-    # ytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   pythonImportsCheck = [ "rest_framework" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/dtlssocket/default.nix b/pkgs/development/python-modules/dtlssocket/default.nix
index 80831ea0eb507..bad1a6c733777 100644
--- a/pkgs/development/python-modules/dtlssocket/default.nix
+++ b/pkgs/development/python-modules/dtlssocket/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , autoconf
-, cython
+, cython_0
 , setuptools
 }:
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     autoconf
-    cython
+    cython_0
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/editdistance/default.nix b/pkgs/development/python-modules/editdistance/default.nix
index d7c55b265a45f..b4f62dd6e8239 100644
--- a/pkgs/development/python-modules/editdistance/default.nix
+++ b/pkgs/development/python-modules/editdistance/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
-, cython_3
+, cython
 , pdm-backend
 , setuptools
 , pythonOlder
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     pdm-backend
     setuptools
   ];
diff --git a/pkgs/development/python-modules/editdistpy/default.nix b/pkgs/development/python-modules/editdistpy/default.nix
index a785e1b05b67c..5a53b3e868008 100644
--- a/pkgs/development/python-modules/editdistpy/default.nix
+++ b/pkgs/development/python-modules/editdistpy/default.nix
@@ -7,7 +7,7 @@
 , pythonOlder
 
 , setuptools
-, cython_3
+, cython
 
 , symspellpy
 , numpy
@@ -16,21 +16,21 @@
 
 buildPythonPackage rec {
   pname = "editdistpy";
-  version = "0.1.3";
+  version = "0.1.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mammothb";
     repo = "editdistpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4CtKadKpFmlZnz10NG0404oFl9DkdQwWwRSWgUPdh94=";
+    hash = "sha256-OSJXiuJtZ4w1IiRaZQZH2DDxA0AGoRHp0BKXdysff0Y=";
   };
 
   build-system = [
     setuptools
-    cython_3
+    cython
   ];
 
   # error: infinite recursion encountered
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index f19abc446058f..2dca56aa91763 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -31,6 +31,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = if pythonAtLeast "3.12" then [
+    # https://github.com/agronholm/exceptiongroup/issues/116
+    "test_deep_split"
+    "test_deep_subgroup"
+  ] else null;
+
   pythonImportsCheck = [
     "exceptiongroup"
   ];
diff --git a/pkgs/development/python-modules/falcon/default.nix b/pkgs/development/python-modules/falcon/default.nix
index 5dc0dd2e0b569..51f9bfd79a358 100644
--- a/pkgs/development/python-modules/falcon/default.nix
+++ b/pkgs/development/python-modules/falcon/default.nix
@@ -6,7 +6,7 @@
 , fetchFromGitHub
 
 # build
-, cython_3
+, cython
 , setuptools
 
 # tests
@@ -17,8 +17,7 @@
 , mujson
 , orjson
 , pytest-asyncio
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pyyaml
 , rapidjson
 , requests
@@ -44,7 +43,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools
   ] ++ lib.optionals (!isPyPy) [
-    cython_3
+    cython
   ];
 
   __darwinAllowLocalNetworking = true;
@@ -61,7 +60,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     # https://github.com/falconry/falcon/blob/master/requirements/tests
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     pyyaml
     requests
     rapidjson
diff --git a/pkgs/development/python-modules/fastapi-sso/default.nix b/pkgs/development/python-modules/fastapi-sso/default.nix
index c9a53db0501f6..fa4342cf170b6 100644
--- a/pkgs/development/python-modules/fastapi-sso/default.nix
+++ b/pkgs/development/python-modules/fastapi-sso/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "fastapi-sso";
-  version = "0.14.0";
+  version = "0.14.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "tomasvotava";
     repo = "fastapi-sso";
     rev = "refs/tags/${version}";
-    hash = "sha256-JFIVmpKsTaL7SYwamW/8zMWaBampmCTweiNz7zcgbco=";
+    hash = "sha256-mkaQY+fIc4zw+ESe3ybxAMgMQOOpjCIJDv+dDj76oAg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/fastjsonschema/default.nix b/pkgs/development/python-modules/fastjsonschema/default.nix
index c5381986d1c93..330bf096b2cee 100644
--- a/pkgs/development/python-modules/fastjsonschema/default.nix
+++ b/pkgs/development/python-modules/fastjsonschema/default.nix
@@ -2,13 +2,14 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch2
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "fastjsonschema";
-  version = "2.18.1";
+  version = "2.19.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,15 +19,19 @@ buildPythonPackage rec {
     repo = "python-fastjsonschema";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-t6JnqQgsWAL8oL8+LO0xrXMYsZOlTF3DlXkRiqUzYtU=";
+    hash = "sha256-UxcxVB4ldnGAYJKWEccivon1CwZD588mNiVJOJPNeN8=";
   };
 
-  nativeCheckInputs = [
-    pytestCheckHook
+  patches = [
+    (fetchpatch2 {
+      name = "fastjsonschema-pytest8-compat.patch";
+      url = "https://github.com/horejsek/python-fastjsonschema/commit/efc04daf4124a598182dfcfd497615cd1e633d18.patch";
+      hash = "sha256-G1/PIpdN+KFfRP9pUFf/ANXLq3mzrocEHyBNWQMVOZM=";
+    })
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
   dontUseSetuptoolsCheck = true;
diff --git a/pkgs/development/python-modules/favicon/default.nix b/pkgs/development/python-modules/favicon/default.nix
index 0800994eb61d9..db6b70cbf8932 100644
--- a/pkgs/development/python-modules/favicon/default.nix
+++ b/pkgs/development/python-modules/favicon/default.nix
@@ -2,7 +2,7 @@
 , beautifulsoup4
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , requests
 , requests-mock
@@ -30,14 +30,10 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    pytest7CheckHook
     requests-mock
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   pythonImportsCheck = [
     "favicon"
   ];
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index e19875296ff03..35c9b57ce5555 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, cython_3
+, cython
 , gdal
 , oldest-supported-numpy
 , setuptools
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     gdal # for gdal-config
     oldest-supported-numpy
     setuptools
diff --git a/pkgs/development/python-modules/flaky/default.nix b/pkgs/development/python-modules/flaky/default.nix
index 43b3288f94b9b..884593dbabfa8 100644
--- a/pkgs/development/python-modules/flaky/default.nix
+++ b/pkgs/development/python-modules/flaky/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , mock
 , pytest
 }:
 
 buildPythonPackage rec {
   pname = "flaky";
-  version = "3.7.0";
-  format = "setuptools";
+  version = "3.8.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OtEAeAchoZEfV6FlgJt+omWnhjMFrLZnCCIIIMr4qg0=";
+    hash = "sha256-RyBKgeyQXz1az71h2uq8raj51AMWFtm8sGGEYXKWmfU=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     mock
     pytest
@@ -29,6 +34,7 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://github.com/box/flaky/blob/v${version}/HISTORY.rst";
     homepage = "https://github.com/box/flaky";
     description = "Plugin for nose or py.test that automatically reruns flaky tests";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/flexmock/default.nix b/pkgs/development/python-modules/flexmock/default.nix
index 437868b70c821..45b2981ba9596 100644
--- a/pkgs/development/python-modules/flexmock/default.nix
+++ b/pkgs/development/python-modules/flexmock/default.nix
@@ -3,32 +3,33 @@
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
+, poetry-core
 , teamcity-messages
 , testtools
 }:
 
 buildPythonPackage rec {
   pname = "flexmock";
-  version = "0.11.3";
-  format = "setuptools";
+  version = "0.12.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sf419qXzJUe1zTGhXAYNmrhj3Aiv8BjNc9x40bZR7dQ=";
+    hash = "sha256-YdBvPRRCuBW3qoWh9HvoONBW9fXRTO/teuv7A0c9FKs=";
   };
 
+  build-system = [
+    poetry-core
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
     teamcity-messages
     testtools
   ];
 
-  disabledTests = [
-    "test_failed_test_case"
-  ];
-
   pythonImportsCheck = [
     "flexmock"
   ];
diff --git a/pkgs/development/python-modules/flow-record/default.nix b/pkgs/development/python-modules/flow-record/default.nix
index b3a57c134a125..3e836772aa851 100644
--- a/pkgs/development/python-modules/flow-record/default.nix
+++ b/pkgs/development/python-modules/flow-record/default.nix
@@ -5,8 +5,7 @@
 , fetchFromGitHub
 , lz4
 , msgpack
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pythonOlder
 , setuptools
 , setuptools-scm
@@ -52,7 +51,7 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index 6d48088a26605..be573a627e99e 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -21,8 +21,7 @@
 , xattr
 , skia-pathops
 , uharfbuzz
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -65,7 +64,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     # test suite fails with pytest>=8.0.1
     # https://github.com/fonttools/fonttools/issues/3458
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ] ++ lib.concatLists (lib.attrVals ([
     "woff"
     # "interpolatable" is not included because it only contains 2 tests at the time of writing but adds 270 extra dependencies
diff --git a/pkgs/development/python-modules/fpylll/default.nix b/pkgs/development/python-modules/fpylll/default.nix
index 97885a443ff02..95358d5f4aaf9 100644
--- a/pkgs/development/python-modules/fpylll/default.nix
+++ b/pkgs/development/python-modules/fpylll/default.nix
@@ -5,7 +5,7 @@
 
 # build-system
 , cysignals
-, cython_3
+, cython
 , pkgconfig
 , setuptools
 
@@ -43,7 +43,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    cython_3
+    cython
     cysignals
     pkgconfig
     setuptools
diff --git a/pkgs/development/python-modules/frozenlist/default.nix b/pkgs/development/python-modules/frozenlist/default.nix
index 7e26460455185..73860b6f79ff1 100644
--- a/pkgs/development/python-modules/frozenlist/default.nix
+++ b/pkgs/development/python-modules/frozenlist/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, cython_3
+, cython
 , expandvars
 , fetchFromGitHub
 , pep517
@@ -30,7 +30,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     expandvars
-    cython_3
+    cython
     pep517
     setuptools
     wheel
diff --git a/pkgs/development/python-modules/fugashi/default.nix b/pkgs/development/python-modules/fugashi/default.nix
index 021ac6dd1d118..64f5ef9afcdb8 100644
--- a/pkgs/development/python-modules/fugashi/default.nix
+++ b/pkgs/development/python-modules/fugashi/default.nix
@@ -3,7 +3,7 @@
 , pythonOlder
 , pytestCheckHook
 , buildPythonPackage
-, cython
+, cython_0
 , mecab
 , setuptools-scm
 , ipadic
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     hash = "sha256-4i7Q+TtXTQNSJ1EIcS8KHrVPdCJAgZh86Y6lB8772XU=";
   };
 
-  nativeBuildInputs = [ cython mecab setuptools-scm ];
+  nativeBuildInputs = [ cython_0 mecab setuptools-scm ];
 
   nativeCheckInputs = [ ipadic pytestCheckHook ]
     ++ passthru.optional-dependencies.unidic-lite;
diff --git a/pkgs/development/python-modules/gbinder-python/default.nix b/pkgs/development/python-modules/gbinder-python/default.nix
index 6608cf305063a..bb64e0c5e6a89 100644
--- a/pkgs/development/python-modules/gbinder-python/default.nix
+++ b/pkgs/development/python-modules/gbinder-python/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchFromGitHub
 , buildPythonPackage
-, cython
+, cython_0
 , pkg-config
 , libgbinder
 }:
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    cython
+    cython_0
     pkg-config
   ];
 
diff --git a/pkgs/development/python-modules/gevent/default.nix b/pkgs/development/python-modules/gevent/default.nix
index d6264794a505d..cee0b07bdf8f2 100644
--- a/pkgs/development/python-modules/gevent/default.nix
+++ b/pkgs/development/python-modules/gevent/default.nix
@@ -5,7 +5,7 @@
 , python
 , libev
 , cffi
-, cython_3
+, cython
 , greenlet
 , importlib-metadata
 , setuptools
@@ -13,6 +13,8 @@
 , zope-event
 , zope-interface
 , pythonOlder
+, c-ares
+, libuv
 
 # for passthru.tests
 , dulwich
@@ -34,7 +36,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     setuptools
     wheel
   ] ++ lib.optionals (!isPyPy) [
@@ -43,6 +45,8 @@ buildPythonPackage rec {
 
   buildInputs = [
     libev
+    libuv
+    c-ares
   ];
 
   propagatedBuildInputs = [
@@ -69,6 +73,8 @@ buildPythonPackage rec {
       pika;
   } // lib.filterAttrs (k: v: lib.hasInfix "gevent" k) python.pkgs;
 
+  GEVENTSETUP_EMBED = "0";
+
   meta = with lib; {
     description = "Coroutine-based networking library";
     homepage = "http://www.gevent.org/";
diff --git a/pkgs/development/python-modules/gios/default.nix b/pkgs/development/python-modules/gios/default.nix
index d7f9845b3075a..1d972641d3923 100644
--- a/pkgs/development/python-modules/gios/default.nix
+++ b/pkgs/development/python-modules/gios/default.nix
@@ -8,23 +8,29 @@
 , pytest-error-for-skips
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, syrupy
 }:
 
 buildPythonPackage rec {
   pname = "gios";
-  version = "3.2.2";
-  format = "setuptools";
+  version = "4.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "bieniu";
-    repo = pname;
+    repo = "gios";
     rev = "refs/tags/${version}";
-    hash = "sha256-5CiKikhIZ+1pb5/NJ2XzpG1XHrkyuW1WUvvNEpxJIcw=";
+    hash = "sha256-rjC4zWWtaPxuBcjiO9dVsXD4dTa47iwkKuSFx+QXeXw=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     aiohttp
     dacite
   ];
@@ -34,6 +40,7 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-error-for-skips
     pytestCheckHook
+    syrupy
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index ac9ed0be67d5f..3a8f62f6a02d6 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -1,22 +1,22 @@
-{ lib
-, anyio
-, buildPythonPackage
-, fetchFromGitHub
-, hishel
-, httpx
-, poetry-core
-, pydantic
-, pyjwt
-, pytest-xdist
-, pytestCheckHook
-, pythonOlder
-, pythonRelaxDepsHook
-, typing-extensions
+{
+  lib,
+  anyio,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hishel,
+  httpx,
+  poetry-core,
+  pydantic,
+  pyjwt,
+  pytest-xdist,
+  pytestCheckHook,
+  pythonOlder,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "githubkit";
-  version = "0.11.3";
+  version = "0.11.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,22 +25,15 @@ buildPythonPackage rec {
     owner = "yanyongyu";
     repo = "githubkit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GRuEzRqDfhLCanuQnCkMXmDnfNkLFb35Gixl9pWmA8w=";
+    hash = "sha256-uxXRDavp5c3e1MOZR2B4wUxEHh6K81avTeaIVsOdup8=";
   };
 
-  pythonRelaxDeps = [
-    "hishel"
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "--cov=githubkit --cov-append --cov-report=term-missing" ""
   '';
 
-  build-system = [
-    poetry-core
-    pythonRelaxDepsHook
-  ];
+  build-system = [ poetry-core ];
 
   dependencies = [
     hishel
@@ -54,15 +47,9 @@ buildPythonPackage rec {
       anyio
       pyjwt
     ];
-    jwt = [
-      pyjwt
-    ];
-    auth-app = [
-      pyjwt
-    ];
-    auth-oauth-device = [
-      anyio
-    ];
+    jwt = [ pyjwt ];
+    auth-app = [ pyjwt ];
+    auth-oauth-device = [ anyio ];
     auth = [
       anyio
       pyjwt
@@ -74,9 +61,7 @@ buildPythonPackage rec {
     pytest-xdist
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  pythonImportsCheck = [
-    "githubkit"
-  ];
+  pythonImportsCheck = [ "githubkit" ];
 
   disabledTests = [
     # Tests require network access
diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 74ee643bb6d68..a079fffd2510c 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -1,47 +1,46 @@
-{ lib
-, buildPythonPackage
-, db-dtypes
-, fetchPypi
-, freezegun
-, google-api-core
-, google-cloud-bigquery-storage
-, google-cloud-core
-, google-cloud-datacatalog
-, google-cloud-storage
-, google-cloud-testutils
-, google-resumable-media
-, grpcio
-, ipython
-, mock
-, pandas
-, proto-plus
-, protobuf
-, psutil
-, pyarrow
-, pytest-xdist
-, pytestCheckHook
-, python-dateutil
-, pythonOlder
-, requests
-, setuptools
-, tqdm
+{
+  lib,
+  buildPythonPackage,
+  db-dtypes,
+  fetchPypi,
+  freezegun,
+  google-api-core,
+  google-cloud-bigquery-storage,
+  google-cloud-core,
+  google-cloud-datacatalog,
+  google-cloud-storage,
+  google-cloud-testutils,
+  google-resumable-media,
+  grpcio,
+  ipython,
+  mock,
+  pandas,
+  proto-plus,
+  protobuf,
+  psutil,
+  pyarrow,
+  pytest-xdist,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  requests,
+  setuptools,
+  tqdm,
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.20.1";
+  version = "3.21.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MYqjq6tfGQDuJPY7qL0Cuc2vqpQtc4tNwUpO8swtkl8=";
+    hash = "sha256-YmXDn51b31DxHLganCoGBdKF3zSsE53g0jM7ElCt0P8=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     grpcio
@@ -66,12 +65,8 @@ buildPythonPackage rec {
       pandas
       pyarrow
     ];
-    tqdm = [
-      tqdm
-    ];
-    ipython = [
-      ipython
-    ];
+    tqdm = [ tqdm ];
+    ipython = [ ipython ];
   };
 
   nativeCheckInputs = [
@@ -83,8 +78,7 @@ buildPythonPackage rec {
     google-cloud-storage
     pytestCheckHook
     pytest-xdist
-  ] ++ passthru.optional-dependencies.pandas
-  ++ passthru.optional-dependencies.ipython;
+  ] ++ passthru.optional-dependencies.pandas ++ passthru.optional-dependencies.ipython;
 
   # prevent google directory from shadowing google imports
   preCheck = ''
diff --git a/pkgs/development/python-modules/google-generativeai/default.nix b/pkgs/development/python-modules/google-generativeai/default.nix
index a63b61ca09c21..4425966a00638 100644
--- a/pkgs/development/python-modules/google-generativeai/default.nix
+++ b/pkgs/development/python-modules/google-generativeai/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "google-generativeai";
-  version = "0.5.0";
+  version = "0.5.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "google";
     repo = "generative-ai-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WFkzqsiYADrxVUHClBHY0+oYz2sF52DrVblHT+94QYw=";
+    hash = "sha256-R1ndVzGKXWRNkWvvuP4HFBXbuk54bCZZvMJY+yalJGU=";
   };
 
   pythonRelaxDeps = [ "google-ai-generativelanguage" ];
diff --git a/pkgs/development/python-modules/graphene-django/default.nix b/pkgs/development/python-modules/graphene-django/default.nix
index e2c0ea0fdd7ae..a7248d1b80650 100644
--- a/pkgs/development/python-modules/graphene-django/default.nix
+++ b/pkgs/development/python-modules/graphene-django/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , buildPythonPackage
-, pythonAtLeast
 , pythonOlder
 , fetchFromGitHub
 
@@ -17,7 +16,7 @@
 , py
 , pytest-django
 , pytest-random-order
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -58,20 +57,15 @@ buildPythonPackage rec {
     py
     pytest-django
     pytest-random-order
-    pytestCheckHook
+    pytest7CheckHook
   ];
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Passing None has been deprecated.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
-  disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    # Python 3.11 support, https://github.com/graphql-python/graphene-django/pull/1365
-    "test_django_objecttype_convert_choices_enum_naming_collisions"
-    "test_django_objecttype_choices_custom_enum_name"
-    "test_django_objecttype_convert_choices_enum_list"
-    "test_schema_representation"
+  disabledTests = [
+    # https://github.com/graphql-python/graphene-django/issues/1510
+    "test_should_filepath_convert_string"
+    "test_should_choice_convert_enum"
+    "test_should_multiplechoicefield_convert_to_list_of_enum"
+    "test_perform_mutate_success_with_enum_choice_field"
   ] ++ lib.optionals stdenv.isDarwin [
     # this test touches files in the "/" directory and fails in darwin sandbox
     "test_should_filepath_convert_string"
diff --git a/pkgs/development/python-modules/graphene/default.nix b/pkgs/development/python-modules/graphene/default.nix
index 551ff8a86e645..e6de2b449cf42 100644
--- a/pkgs/development/python-modules/graphene/default.nix
+++ b/pkgs/development/python-modules/graphene/default.nix
@@ -8,7 +8,7 @@
 , pytest-asyncio
 , pytest-benchmark
 , pytest-mock
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , pytz
 , snapshottest
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    pytest7CheckHook
     pytest-asyncio
     pytest-benchmark
     pytest-mock
@@ -49,7 +49,6 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [
     "--benchmark-disable"
-    "-W ignore::pytest.PytestRemovedIn8Warning"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/green/default.nix b/pkgs/development/python-modules/green/default.nix
index 40b4851b0c77b..eef23f6ce0dff 100644
--- a/pkgs/development/python-modules/green/default.nix
+++ b/pkgs/development/python-modules/green/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "green";
-  version = "4.0.1";
+  version = "4.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O178HRtyKg/2fYD9jHzfbUfNGPlRpGuEvbx7H7yr0/w=";
+    hash = "sha256-pAZ8P5/CpkTtNfU2ZJUGQzROxGLm0uu1vXS3YpcVprE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index dbadab9432191..d14710b17b96e 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.62.1";
+  version = "1.62.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nlYYCpQbHTKgd9dJHgYR0Eg8OWNYr9U0m/ABUmEuRYM=";
+    hash = "sha256-pE0eoeFRC1xiJl2toE2GYhuxSR113ph3E8nA6gBcEKg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 799a805ba564a..4001d3663fbdb 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.62.1";
+  version = "1.62.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-q9RTABmRhxAxMV7y2Cr/6TCAwEM/o6AHvjS/Qn4oqIo=";
+    hash = "sha256-LdRIBtaNAAZjZSm9pXMBKxmkIoFHjC0FHNquu5HiUWw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/h5py/default.nix b/pkgs/development/python-modules/h5py/default.nix
index a11578f832ba2..4afd562e033dc 100644
--- a/pkgs/development/python-modules/h5py/default.nix
+++ b/pkgs/development/python-modules/h5py/default.nix
@@ -7,7 +7,7 @@
 , wheel
 , numpy
 , hdf5
-, cython
+, cython_0
 , pkgconfig
 , mpi4py ? null
 , openssh
@@ -50,7 +50,7 @@ in buildPythonPackage rec {
   preBuild = lib.optionalString mpiSupport "export CC=${lib.getDev mpi}/bin/mpicc";
 
   nativeBuildInputs = [
-    cython
+    cython_0
     oldest-supported-numpy
     pkgconfig
     setuptools
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 49af4f0fb0ffb..4d5d345d625dd 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "hatchling";
-  version = "1.21.1";
+  version = "1.22.4";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-u6RARToiTn1EeEV/oujYw2M3Zbr6Apdaa1O5v5F5gLw=";
+    hash = "sha256-ii3OyW1/uEg4LvWEjlrEP9rmQfNaCKP6tRFr1JXzQW4=";
   };
 
   # listed in backend/pyproject.toml
diff --git a/pkgs/development/python-modules/hid-parser/default.nix b/pkgs/development/python-modules/hid-parser/default.nix
index 15b7f3c587f3f..dc0bbb433fd11 100644
--- a/pkgs/development/python-modules/hid-parser/default.nix
+++ b/pkgs/development/python-modules/hid-parser/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
-, pytestCheckHook
+, pytest7CheckHook
 , hypothesis
 }:
 
@@ -21,14 +21,10 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    pytest7CheckHook
     hypothesis
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   pythonImportsCheck = [ "hid_parser" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/hidapi/default.nix b/pkgs/development/python-modules/hidapi/default.nix
index 9b4e76186f262..6ad7b62d05a83 100644
--- a/pkgs/development/python-modules/hidapi/default.nix
+++ b/pkgs/development/python-modules/hidapi/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , xcbuild
-, cython
+, cython_0
 , libusb1
 , udev
 , darwin
@@ -19,10 +19,10 @@ buildPythonPackage rec {
     sha256 = "a7cb029286ced5426a381286526d9501846409701a29c2538615c3d1a612b8be";
   };
 
-  nativeBuildInputs = lib.optionals stdenv.isDarwin [ xcbuild ];
+  nativeBuildInputs = [ cython_0 ]
+    ++ lib.optionals stdenv.isDarwin [ xcbuild ];
 
-  propagatedBuildInputs = [ cython ]
-    ++ lib.optionals stdenv.isLinux [ libusb1 udev ]
+  propagatedBuildInputs = lib.optionals stdenv.isLinux [ libusb1 udev ]
     ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ AppKit CoreFoundation IOKit ]);
 
   # Fix the USB backend library lookup
diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 4de61606e0c6c..34016262e93bb 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -5,8 +5,7 @@
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pythonAtLeast
 , pythonOlder
 , pytest-aiohttp
@@ -50,7 +49,7 @@ buildPythonPackage rec {
     aiohttp-wsgi
     pytest-aiohttp
     pytest-asyncio
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 2c99b43f94877..5cf3408c89b73 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "hypothesis";
-  version = "6.98.17";
+  version = "6.99.12";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "HypothesisWorks";
     repo = "hypothesis";
     rev = "hypothesis-python-${version}";
-    hash = "sha256-2knFmaa334vFo8bbLCmrWAXRDXFcC+GPRqj7RG3FqEQ=";
+    hash = "sha256-0nzjRDv4L3bxxnC0lBY5S7FP9CFhyzHzNchWXoX91Zg=";
   };
 
   # I tried to package sphinx-selective-exclude, but it throws
diff --git a/pkgs/development/python-modules/in-n-out/default.nix b/pkgs/development/python-modules/in-n-out/default.nix
index 39c7a3f7de882..ffd68b29b90d8 100644
--- a/pkgs/development/python-modules/in-n-out/default.nix
+++ b/pkgs/development/python-modules/in-n-out/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, cython_3
+, cython
 , fetchPypi
 , future
 , pytestCheckHook
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     hatchling
     hatch-vcs
   ];
diff --git a/pkgs/development/python-modules/influxdb3-python/default.nix b/pkgs/development/python-modules/influxdb3-python/default.nix
index f023b498c05a1..23b4bcc4c3bf5 100644
--- a/pkgs/development/python-modules/influxdb3-python/default.nix
+++ b/pkgs/development/python-modules/influxdb3-python/default.nix
@@ -1,19 +1,20 @@
-{ lib
-, buildPythonPackage
-, certifi
-, fetchFromGitHub
-, pyarrow
-, pytestCheckHook
-, python-dateutil
-, pythonOlder
-, reactivex
-, setuptools
-, urllib3
+{
+  lib,
+  buildPythonPackage,
+  certifi,
+  fetchFromGitHub,
+  pyarrow,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  reactivex,
+  setuptools,
+  urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "influxdb3-python";
-  version = "0.3.6";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,14 +23,12 @@ buildPythonPackage rec {
     owner = "InfluxCommunity";
     repo = "influxdb3-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZKN3chJvtOenk2jp02rvw+HooJcee0hwxWoLvEYjfcg=";
+    hash = "sha256-qFcXqbYsjn27BPeKxTsWxKJdF6y8Oz3VBrmSyO0vCGo=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     certifi
     pyarrow
     python-dateutil
diff --git a/pkgs/development/python-modules/ipyniivue/default.nix b/pkgs/development/python-modules/ipyniivue/default.nix
index 2f711f92a087d..c097f2cb404e8 100644
--- a/pkgs/development/python-modules/ipyniivue/default.nix
+++ b/pkgs/development/python-modules/ipyniivue/default.nix
@@ -4,37 +4,32 @@
 , pythonOlder
 , hatchling
 , hatch-jupyter-builder
-, ipywidgets
-, jupyter-ui-poll
+, anywidget
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "ipyniivue";
-  version = "1.1.0";
-  format = "pyproject";
+  version = "2.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kym7949VI6C+62p3IOQ2QIzWnuSBcrmySb83oqUwhjI=";
+    hash = "sha256-CvMSUvPyXxPexs0/0sa/xt65RFWtvmYZwGSMIQGvLkc=";
   };
 
-  # We do not need the jupyterlab build dependency, because we do not need to
+  # We do not need the build hooks, because we do not need to
   # build any JS components; these are present already in the PyPI artifact.
-  #
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '"jupyterlab==3.*",' ""
-  '';
+  env.HATCH_BUILD_NO_HOOKS = true;
 
-  nativeBuildInputs = [
+  build-system = [
     hatchling
     hatch-jupyter-builder
   ];
 
-  propagatedBuildInputs = [ ipywidgets jupyter-ui-poll ];
+  dependencies = [ anywidget ];
 
   nativeCheckImports = [ pytestCheckHook ];
   pythonImportsCheck = [ "ipyniivue" ];
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 7dacc7e2aa3cf..09935bb1bc06d 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -19,30 +19,39 @@
 , traitlets
 , typing-extensions
 
+# Optional dependencies
+, ipykernel
+, ipyparallel
+, ipywidgets
+, matplotlib
+, nbconvert
+, nbformat
+, notebook
+, qtconsole
+
 # Test dependencies
 , pickleshare
 , pytest-asyncio
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , testpath
 }:
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "8.22.2";
+  version = "8.23.0";
   pyproject = true;
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LcqtkEn5BW8f72NRTxdsfUH5MNqnjQW4KhdiAoGPLBQ=";
+    hash = "sha256-dGjtr09t4+G5EuV/ZsJB5v08cJny7CE24jnhQugAJ00=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     decorator
     jedi
     matplotlib-inline
@@ -53,10 +62,23 @@ buildPythonPackage rec {
     traitlets
   ] ++ lib.optionals (pythonOlder "3.11") [
     exceptiongroup
-  ] ++ lib.optionals (pythonOlder "3.10") [
+  ] ++ lib.optionals (pythonOlder "3.12") [
     typing-extensions
   ];
 
+  optional-dependencies = {
+    kernel = [ ipykernel ];
+    nbconvert = [ nbconvert ];
+    nbformat = [ nbformat ];
+    notebook = [
+      ipywidgets
+      notebook
+    ];
+    parallel = [ ipyparallel ];
+    qtconsole = [ qtconsole ];
+    matplotlib = [ matplotlib ];
+  };
+
   pythonImportsCheck = [
     "IPython"
   ];
@@ -72,7 +94,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pickleshare
     pytest-asyncio
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     testpath
   ];
 
diff --git a/pkgs/development/python-modules/ipyvue/default.nix b/pkgs/development/python-modules/ipyvue/default.nix
index c2211226f078e..2be0ddfe80755 100644
--- a/pkgs/development/python-modules/ipyvue/default.nix
+++ b/pkgs/development/python-modules/ipyvue/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "ipyvue";
-  version = "1.10.2";
+  version = "1.11.0";
   format = "setuptools";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qZc1hvouKWUQ2aJLk1oiokUKzKBXtd6fC6tm7LHDOrQ=";
+    hash = "sha256-ez2ygBvgU12FX/+qDkARlizq50rEgZYp4UH5Sx4E2QA=";
   };
 
   propagatedBuildInputs = [ ipywidgets ];
diff --git a/pkgs/development/python-modules/ipywidgets/default.nix b/pkgs/development/python-modules/ipywidgets/default.nix
index b4cefff029ddd..bbc1a102fbd06 100644
--- a/pkgs/development/python-modules/ipywidgets/default.nix
+++ b/pkgs/development/python-modules/ipywidgets/default.nix
@@ -8,7 +8,7 @@
 , jsonschema
 , jupyterlab-widgets
 , lib
-, pytestCheckHook
+, pytest7CheckHook
 , pytz
 , traitlets
 , widgetsnbextension
@@ -40,15 +40,10 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     ipykernel
     jsonschema
-    pytestCheckHook
+    pytest7CheckHook
     pytz
   ];
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   meta = {
     description = "IPython HTML widgets for Jupyter";
     homepage = "https://github.com/jupyter-widgets/ipywidgets";
diff --git a/pkgs/development/python-modules/isort/default.nix b/pkgs/development/python-modules/isort/default.nix
index a3e9359073418..100155f83a2ee 100644
--- a/pkgs/development/python-modules/isort/default.nix
+++ b/pkgs/development/python-modules/isort/default.nix
@@ -52,8 +52,6 @@ buildPythonPackage rec {
     "--ignore=tests/benchmark/" # requires pytest-benchmark
     "--ignore=tests/integration/" # pulls in 10 other packages
     "--ignore=tests/unit/profiles/test_black.py" # causes infinite recursion to include black
-    # pytest.PytestRemovedIn8Warning: Passing None has been deprecated.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
   ];
 
   disabledTests = [
@@ -74,6 +72,8 @@ buildPythonPackage rec {
     "test_value_assignment_list"
     # profiles not available
     "test_isort_supports_shared_profiles_issue_970"
+    # https://github.com/PyCQA/isort/issues/2234
+    "test_isort_should_warn_on_empty_custom_config_issue_1433"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/item-synchronizer/default.nix b/pkgs/development/python-modules/item-synchronizer/default.nix
new file mode 100644
index 0000000000000..2f568499eb086
--- /dev/null
+++ b/pkgs/development/python-modules/item-synchronizer/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, bidict
+, bubop
+}:
+
+buildPythonPackage rec {
+  pname = "item-synchronizer";
+  version = "1.1.5";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "item_synchronizer";
+    rev = "v${version}";
+    hash = "sha256-+mviKtCLlJhYV576Q07kcFJvtls5qohKSrqZtBqE/s4=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail 'bidict = "^0.21.4"' 'bidict = "^0.23"'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bidict
+    bubop
+  ];
+
+  pythonImportsCheck = [ "item_synchronizer" ];
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://github.com/bergercookie/item_synchronizer";
+    changelog = "https://github.com/bergercookie/item_synchronizer/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/development/python-modules/itemdb/default.nix b/pkgs/development/python-modules/itemdb/default.nix
index 4cc0cf6374845..6ac5deae5eaa1 100644
--- a/pkgs/development/python-modules/itemdb/default.nix
+++ b/pkgs/development/python-modules/itemdb/default.nix
@@ -5,7 +5,7 @@
 
 buildPythonPackage rec {
   pname = "itemdb";
-  version = "1.1.2";
+  version = "1.2.0";
   format = "setuptools";
 
   # PyPI tarball doesn't include tests directory
@@ -13,7 +13,7 @@ buildPythonPackage rec {
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-s7a+MJLTAcGv2rYRMO2SAlsDYen6Si10qUQOVDFuf6c=";
+    sha256 = "sha256-egxQ1tGC6R5p1stYm4r05+b2HkuT+nBySTZPGqeAbSE=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/itemloaders/default.nix b/pkgs/development/python-modules/itemloaders/default.nix
index d0fa322791d16..73957e6b0aea5 100644
--- a/pkgs/development/python-modules/itemloaders/default.nix
+++ b/pkgs/development/python-modules/itemloaders/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, setuptools
 , w3lib
 , parsel
 , jmespath
@@ -11,18 +12,22 @@
 
 buildPythonPackage rec {
   pname = "itemloaders";
-  version = "1.1.0";
-  format = "setuptools";
+  version = "1.2.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "scrapy";
-    repo = pname;
+    repo = "itemloaders";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jwxxKfr/SI1yfjSQbYqggWxBwusBZNYySHwZXHftgFs=";
+    hash = "sha256-DatHJnAIomVoN/GrDzM2fNnFHcXqo6zs3ucKCOCf9DU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     w3lib
     parsel
@@ -34,18 +39,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # Test are failing (AssertionError: Lists differ: ...)
-    "test_nested_css"
-    "test_nested_xpath"
-  ];
-
   pythonImportsCheck = [
     "itemloaders"
   ];
 
   meta = with lib; {
-    description = "Base library for scrapy's ItemLoader";
+    description = "Library to populate items using XPath and CSS with a convenient API";
     homepage = "https://github.com/scrapy/itemloaders";
     changelog = "https://github.com/scrapy/itemloaders/raw/v${version}/docs/release-notes.rst";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/jaraco-test/default.nix b/pkgs/development/python-modules/jaraco-test/default.nix
index 97bb762449889..fb6c3a883e93d 100644
--- a/pkgs/development/python-modules/jaraco-test/default.nix
+++ b/pkgs/development/python-modules/jaraco-test/default.nix
@@ -40,6 +40,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTestPaths = [
+    # https://github.com/jaraco/jaraco.test/issues/6
+    "jaraco/test/cpython.py"
+  ];
+
   pythonImportsCheck = [
     "jaraco.test"
   ];
diff --git a/pkgs/development/python-modules/jedi-language-server/default.nix b/pkgs/development/python-modules/jedi-language-server/default.nix
index fdc1d1a5a9b1d..1d6a173e265ee 100644
--- a/pkgs/development/python-modules/jedi-language-server/default.nix
+++ b/pkgs/development/python-modules/jedi-language-server/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "jedi-language-server";
-  version = "0.41.3";
+  version = "0.41.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pappasam";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-+k4WOoEbVe7mlPyPj0ttBM+kmjq8V739yHi36BDYK2U=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RDLwL9AZ3G8CzVwDtWqFFZNH/ulpHeFBhglbWNv/ZIk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/json-tricks/default.nix b/pkgs/development/python-modules/json-tricks/default.nix
index 2d348403c499a..1576cd141d4e4 100644
--- a/pkgs/development/python-modules/json-tricks/default.nix
+++ b/pkgs/development/python-modules/json-tricks/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , buildPythonPackage
 , pythonOlder
-, pytestCheckHook
+, pytest7CheckHook
 , numpy
 , pandas
 , pytz
@@ -26,11 +26,7 @@ buildPythonPackage rec {
     numpy
     pandas
     pytz
-    pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/jupyter-collaboration/default.nix b/pkgs/development/python-modules/jupyter-collaboration/default.nix
index 4b3ffb0f70b73..1c01c6d4d1d69 100644
--- a/pkgs/development/python-modules/jupyter-collaboration/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration/default.nix
@@ -64,6 +64,10 @@ buildPythonPackage rec {
     export HOME=$TEMP
   '';
 
+  pytestFlagsArray = [
+    "-Wignore::DeprecationWarning"
+  ];
+
   disabledTests = [
     # ExceptionGroup: unhandled errors in a TaskGroup (1 sub-exception)
     "test_dirty"
diff --git a/pkgs/development/python-modules/jupyter-lsp/default.nix b/pkgs/development/python-modules/jupyter-lsp/default.nix
index 74fc46f39afae..2f1342839db30 100644
--- a/pkgs/development/python-modules/jupyter-lsp/default.nix
+++ b/pkgs/development/python-modules/jupyter-lsp/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "jupyter-lsp";
-  version = "2.2.4";
+  version = "2.2.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XlADMUk0QGU0jmiGCPPG1lTvBtmFa2dlW9e2usnuLVk=";
+    hash = "sha256-eTFHoFrURvgJ/VPvHNGan1JW/Qota3zpQ6mCy09UUAE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyter-server-fileid/default.nix b/pkgs/development/python-modules/jupyter-server-fileid/default.nix
index 300f4bb835dd6..9fea67c3faa2c 100644
--- a/pkgs/development/python-modules/jupyter-server-fileid/default.nix
+++ b/pkgs/development/python-modules/jupyter-server-fileid/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "jupyter-server-fileid";
-  version = "0.9.1";
+  version = "0.9.2";
 
   disables = pythonOlder "3.7";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "jupyter-server";
     repo = "jupyter_server_fileid";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rEjrfioAmqijyObiK7CMLWhLqVpfcmNYhjdjKjkMp6s=";
+    hash = "sha256-ApCDBVjJqpkC5FGEjU/LxwWBunTkL6i5Ki85M6MMLE0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyter-server/default.nix b/pkgs/development/python-modules/jupyter-server/default.nix
index fbde4773c80ef..f0086e09c6614 100644
--- a/pkgs/development/python-modules/jupyter-server/default.nix
+++ b/pkgs/development/python-modules/jupyter-server/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage rec {
   pname = "jupyter-server";
-  version = "2.13.0";
+  version = "2.14.0";
   pyproject = true;
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "jupyter_server";
     inherit version;
-    hash = "sha256-yAv7BJ6iAFPD2WQcKt1ISLOAc7958XKc6h+u0y/Bx44=";
+    hash = "sha256-ZZFUzqUSCDQ0/XyTt/4Il696L9C53UdJKCtC6qxK5nc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/kivy/default.nix b/pkgs/development/python-modules/kivy/default.nix
index ce8503f19273d..0a9e006844a8d 100644
--- a/pkgs/development/python-modules/kivy/default.nix
+++ b/pkgs/development/python-modules/kivy/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv
 , buildPythonPackage, fetchFromGitHub, fetchpatch
-, pkg-config, cython, docutils
+, pkg-config, cython_0, docutils
 , kivy-garden
 , mesa, mtdev, SDL2, SDL2_image, SDL2_ttf, SDL2_mixer
 , Accelerate, ApplicationServices, AVFoundation, libcxx
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    cython
+    cython_0
     docutils
   ];
 
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index 1651d25c69ead..a6867075d9b5e 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -15,7 +15,7 @@
 , pycurl
 , pymongo
   #, pyro4
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , pyyaml
 , redis
@@ -89,14 +89,9 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     case
     hypothesis
-    pytestCheckHook
+    pytest7CheckHook
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   pythonImportsCheck = [
     "kombu"
   ];
diff --git a/pkgs/development/python-modules/lacuscore/default.nix b/pkgs/development/python-modules/lacuscore/default.nix
index 7bf59e72eb8a3..950c215e9005d 100644
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "lacuscore";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "ail-project";
     repo = "LacusCore";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DUgMql/KCy8g63HvA7qbrv9qia+nchPLIkufWmUXKDg=";
+    hash = "sha256-vfhRbbutNuZW/oI/eCJUXydCn47ThOlWRz2NJJrE3Tw=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/levenshtein/default.nix b/pkgs/development/python-modules/levenshtein/default.nix
index 9b4d9caaf6999..453ec1be90520 100644
--- a/pkgs/development/python-modules/levenshtein/default.nix
+++ b/pkgs/development/python-modules/levenshtein/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , buildPythonPackage
 , cmake
-, cython_3
+, cython
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
@@ -28,7 +28,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
-    cython_3
+    cython
     scikit-build
   ];
 
diff --git a/pkgs/development/python-modules/libgpuarray/default.nix b/pkgs/development/python-modules/libgpuarray/default.nix
index 710ef3dd1398c..d186233ccdc48 100644
--- a/pkgs/development/python-modules/libgpuarray/default.nix
+++ b/pkgs/development/python-modules/libgpuarray/default.nix
@@ -4,7 +4,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , cmake
-, cython
+, cython_0
 , numpy
 , six
 , nose
@@ -67,13 +67,13 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
+    cython_0
   ] ++ lib.optionals cudaSupport [
     addOpenGLRunpath
   ];
 
 
   buildInputs = [
-    cython
     nose
   ];
 
diff --git a/pkgs/development/python-modules/librouteros/default.nix b/pkgs/development/python-modules/librouteros/default.nix
index 5bb2072b7117d..5ba5f86aab10b 100644
--- a/pkgs/development/python-modules/librouteros/default.nix
+++ b/pkgs/development/python-modules/librouteros/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-xdist
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , setuptools
 }:
@@ -27,12 +27,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest-xdist
-    pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+    pytest7CheckHook
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/lightning-utilities/default.nix b/pkgs/development/python-modules/lightning-utilities/default.nix
index f1d94bad1af29..3af06818b8ee8 100644
--- a/pkgs/development/python-modules/lightning-utilities/default.nix
+++ b/pkgs/development/python-modules/lightning-utilities/default.nix
@@ -11,8 +11,7 @@
 
 # tests
 , pytest-timeout
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -42,7 +41,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest-timeout
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/line-profiler/default.nix b/pkgs/development/python-modules/line-profiler/default.nix
index d50b3fa36f49a..f8a3c5378bb0c 100644
--- a/pkgs/development/python-modules/line-profiler/default.nix
+++ b/pkgs/development/python-modules/line-profiler/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, cython_3
+, cython
 , isPyPy
 , ipython
 , scikit-build
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     cmake
     scikit-build
   ];
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index f1c24e88b7bb8..1d69fdd32aa1b 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.35.8";
+  version = "1.35.15";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/gj3WTsxFxw2VPqYCQdnSi83RjjPHZ/I1nR163u3pb0=";
+    hash = "sha256-cjOUInHaGD+E31D3BbwfgeA4229drOm69ltjU4x9F9o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/llama-index-embeddings-openai/default.nix b/pkgs/development/python-modules/llama-index-embeddings-openai/default.nix
index 00572d723d8f6..d15b27e075cf9 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-openai/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-embeddings-openai";
-  version = "0.1.7";
+  version = "0.1.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_embeddings_openai";
     inherit version;
-    hash = "sha256-xxzJggaAxM7fyYRdyHuU9oUdHMzh5Ib8kSmPj6jZ8n0=";
+    hash = "sha256-quTOPsL+LLYE2URkaYLHFmOouZ7V+MNwgj7oLu9N3Ts=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llama-index-llms-openai/default.nix b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
index 121cfee981e87..288fa1d35c4d9 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-llms-openai";
-  version = "0.1.15";
+  version = "0.1.16";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_openai";
     inherit version;
-    hash = "sha256-a9vzB7HUOpp8KlL3K6fbYcuW2QT5nn6l2IndeBjxCBQ=";
+    hash = "sha256-MTu8F8JBmSQwpr9oahse3EJ2yCVq1rBVCqG+oeD+0aY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
index 3b8ccd2a6f3b6..46ba1221f3838 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-qdrant";
-  version = "0.2.0";
+  version = "0.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_vector_stores_qdrant";
     inherit version;
-    hash = "sha256-eYgp2S4KubjyL0bgaL7nRCyFhvTuLU7c7vjw4tJ+9wA=";
+    hash = "sha256-begHJBxdu+19LIoNgAd3Gnei2TQqpEU3gd6cVrv0zGw=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llfuse/default.nix b/pkgs/development/python-modules/llfuse/default.nix
index 85c6d0fb50fd5..5e1ce47bdc670 100644
--- a/pkgs/development/python-modules/llfuse/default.nix
+++ b/pkgs/development/python-modules/llfuse/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, cython_3
+, cython
 , fuse
 , pkg-config
 , pytestCheckHook
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     hash = "sha256-6/iW5eHmX6ODVPLFkOo3bN9yW8ixqy2MHwQ2r9FA0iI=";
   };
 
-  nativeBuildInputs = [ cython_3 pkg-config setuptools ];
+  nativeBuildInputs = [ cython pkg-config setuptools ];
 
   buildInputs = [ fuse ];
 
diff --git a/pkgs/development/python-modules/lupa/default.nix b/pkgs/development/python-modules/lupa/default.nix
index c79f0de9dd893..4b879a90966f5 100644
--- a/pkgs/development/python-modules/lupa/default.nix
+++ b/pkgs/development/python-modules/lupa/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, cython_3
+, cython
 , fetchPypi
 , pythonOlder
 , setuptools
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   };
 
   build-system = [
-    cython_3
+    cython
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index e6d7234a59ce0..d1d7036eda2e3 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitHub
 
 # build-system
-, cython_3
+, cython
 , setuptools
 
 # native dependencies
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     libxml2.dev
     libxslt.dev
-    cython_3
+    cython
     setuptools
    ] ++ lib.optionals stdenv.isDarwin [
     xcodebuild
diff --git a/pkgs/development/python-modules/lz4/default.nix b/pkgs/development/python-modules/lz4/default.nix
index 4110a96a33286..cf1ac6294499c 100644
--- a/pkgs/development/python-modules/lz4/default.nix
+++ b/pkgs/development/python-modules/lz4/default.nix
@@ -6,20 +6,21 @@
 , pytestCheckHook
 , python
 , pythonOlder
+, setuptools
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
-  pname = "python-lz4";
+  pname = "lz4";
   version = "4.3.3";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.5";
 
   # get full repository in order to run tests
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "python-lz4";
+    repo = "python-lz4";
     rev = "refs/tags/v${version}";
     hash = "sha256-ZvGUkb9DoheYY2/sejUhxgh2lS5eoBrFCXR4E0IcFcs=";
   };
@@ -28,9 +29,10 @@ buildPythonPackage rec {
     sed -i '/pytest-cov/d' setup.py
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     pkgconfig
     setuptools-scm
+    setuptools
   ];
 
   pythonImportsCheck = [
@@ -46,7 +48,7 @@ buildPythonPackage rec {
   ];
 
   # for lz4.steam
-  PYLZ4_EXPERIMENTAL = true;
+  env.PYLZ4_EXPERIMENTAL = true;
 
   # prevent local lz4 directory from getting imported as it lacks native extensions
   preCheck = ''
diff --git a/pkgs/development/python-modules/maestral/default.nix b/pkgs/development/python-modules/maestral/default.nix
index 92c8dee9b0bec..4a733bb60a6f8 100644
--- a/pkgs/development/python-modules/maestral/default.nix
+++ b/pkgs/development/python-modules/maestral/default.nix
@@ -21,14 +21,14 @@
 , survey
 , typing-extensions
 , watchdog
+, xattr
 , pytestCheckHook
 , nixosTests
-, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
   pname = "maestral";
-  version = "1.8.0";
+  version = "1.9.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "SamSchott";
     repo = "maestral";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YYbdd0GLVKE7+Oi0mpQjqhFdjdlquk/XnIg5WrtKcfI=";
+    hash = "sha256-Bb0yE2OKdlZd6ZsTEWOD+hMuV41fZanesY49L+v4BBE=";
   };
 
   propagatedBuildInputs = [
@@ -58,6 +58,7 @@ buildPythonPackage rec {
     survey
     typing-extensions
     watchdog
+    xattr
   ];
 
   makeWrapperArgs = [
@@ -68,14 +69,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    pythonRelaxDepsHook
-  ];
-
-  pythonRelaxDeps = [
-    # https://github.com/samschott/maestral/commit/2c50d2ddb49a845ea97bd6b0f68c45d723fb304c
-    # Allow the use of survey >= 5
-    # Remove after new maestral release along with pythonRelaxDepsHook
-    "survey"
   ];
 
   preCheck = ''
@@ -95,6 +88,8 @@ buildPythonPackage rec {
     "test_cased_path_candidates"
     # AssertionError
     "test_locking_multiprocess"
+    # OSError: [Errno 95] Operation not supported
+    "test_move_preserves_xattrs"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/mailchecker/default.nix b/pkgs/development/python-modules/mailchecker/default.nix
index 62b97f53b1e87..00bb481c169bd 100644
--- a/pkgs/development/python-modules/mailchecker/default.nix
+++ b/pkgs/development/python-modules/mailchecker/default.nix
@@ -1,32 +1,29 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "mailchecker";
-  version = "6.0.1";
+  version = "6.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PXo6dfiAqC1WD/z5NBI6UZVUl/cwlvoqKDyfZI4fn2s=";
+    hash = "sha256-QRysmtKo5KXXAVcyQx2WwuwySUP8vAN/gqXWmgoOPmo=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "MailChecker"
-  ];
+  pythonImportsCheck = [ "MailChecker" ];
 
   meta = with lib; {
     description = "Module for temporary (disposable/throwaway) email detection";
diff --git a/pkgs/development/python-modules/marshmallow-enum/default.nix b/pkgs/development/python-modules/marshmallow-enum/default.nix
index 17f6742711949..fdf2771deebd4 100644
--- a/pkgs/development/python-modules/marshmallow-enum/default.nix
+++ b/pkgs/development/python-modules/marshmallow-enum/default.nix
@@ -1,16 +1,15 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , marshmallow
-, pytestCheckHook
-, isPy27
-, enum34
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
   pname = "marshmallow-enum";
   version = "1.5.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "justanr";
@@ -23,22 +22,16 @@ buildPythonPackage rec {
     sed -i '/addopts/d' tox.ini
   '';
 
-  propagatedBuildInputs = [
-    marshmallow
-  ] ++ lib.optionals isPy27 [ enum34 ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
+  build-system = [
+    setuptools
   ];
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+  dependencies = [
+    marshmallow
   ];
 
-  disabledTests = [
-    "test_custom_error_in_deserialize_by_name"
-    "test_custom_error_in_deserialize_by_value"
+  nativeCheckInputs = [
+    pytest7CheckHook
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/matchpy/default.nix b/pkgs/development/python-modules/matchpy/default.nix
index 5b880cfb5b09b..259038e7774ba 100644
--- a/pkgs/development/python-modules/matchpy/default.nix
+++ b/pkgs/development/python-modules/matchpy/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , hopcroftkarp
 , multiset
 , pytestCheckHook
@@ -22,6 +23,15 @@ buildPythonPackage rec {
     hash = "sha256-n5rXIjqVQZzEbfIZVQiGLh2PR1DHAJ9gumcrbvwnasA=";
   };
 
+  patches = [
+    # https://github.com/HPAC/matchpy/pull/77
+    (fetchpatch {
+      name = "fix-versioneer-py312.patch";
+      url = "https://github.com/HPAC/matchpy/commit/965d7c39689b9f2473a78ed06b83f2be701e234d.patch";
+      hash = "sha256-xXADCSIhq1ARny2twzrhR1J8LkMFWFl6tmGxrM8RvkU=";
+    })
+  ];
+
   postPatch = ''
     sed -i '/pytest-runner/d' setup.cfg
 
diff --git a/pkgs/development/python-modules/mdformat-admon/default.nix b/pkgs/development/python-modules/mdformat-admon/default.nix
index 10be705e1440e..7025864b440a8 100644
--- a/pkgs/development/python-modules/mdformat-admon/default.nix
+++ b/pkgs/development/python-modules/mdformat-admon/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "mdformat-admon";
-  version = "2.0.2";
+  version = "2.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KyleKing";
     repo = "mdformat-admon";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TybbkF6+dIfG+1fGYp+bTEdw2GXINZJfOX0QiAaqiWY=";
+    hash = "sha256-zKc0kKap4ipZ+P+RYDXcwqyzq9NKcTnCmx64cApFxFg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mdtraj/default.nix b/pkgs/development/python-modules/mdtraj/default.nix
index ad20cdbf06711..971688348a1d5 100644
--- a/pkgs/development/python-modules/mdtraj/default.nix
+++ b/pkgs/development/python-modules/mdtraj/default.nix
@@ -5,7 +5,7 @@
 , fetchpatch
 , llvmPackages
 , zlib
-, cython
+, cython_0
 , oldest-supported-numpy
 , setuptools
 , wheel
@@ -42,7 +42,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    cython
+    cython_0
     oldest-supported-numpy
     setuptools
     wheel
diff --git a/pkgs/development/python-modules/mechanize/default.nix b/pkgs/development/python-modules/mechanize/default.nix
index 0f89f3f42525a..3724fa64d06e7 100644
--- a/pkgs/development/python-modules/mechanize/default.nix
+++ b/pkgs/development/python-modules/mechanize/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch2
 , html5lib
 , pytestCheckHook
 , pythonOlder
@@ -19,6 +20,14 @@ buildPythonPackage rec {
     hash = "sha256-aaXtsJYvkh6LEINzaMIkLYrQSfC5H/aZzn9gG/xDFSE=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # python 3.11+ compat
+      url = "https://github.com/python-mechanize/mechanize/commit/1324b09b661aaac7d4cdc7e1e9d49e1c3851db2c.patch";
+      hash = "sha256-d0Zuz6m2Uv8pnR8TC0L+AStS82rPPTpQrrjkCZnJliE=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/memory-allocator/default.nix b/pkgs/development/python-modules/memory-allocator/default.nix
index 9f680255e1889..c4ddc5d06a1b8 100644
--- a/pkgs/development/python-modules/memory-allocator/default.nix
+++ b/pkgs/development/python-modules/memory-allocator/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchPypi
 , buildPythonPackage
-, cython_3
+, cython
 }:
 
 buildPythonPackage rec {
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     hash = "sha256-1gkhawMDGWfitFqASxL/kClXj07AGf3kLPau1soJ7+Q=";
   };
 
-  propagatedBuildInputs = [ cython_3 ];
+  propagatedBuildInputs = [ cython ];
 
   pythonImportsCheck = [ "memory_allocator" ];
 
diff --git a/pkgs/development/python-modules/mido/default.nix b/pkgs/development/python-modules/mido/default.nix
index fc2a97689806d..b5375b4f1dffc 100644
--- a/pkgs/development/python-modules/mido/default.nix
+++ b/pkgs/development/python-modules/mido/default.nix
@@ -3,13 +3,27 @@
 , buildPythonPackage
 , fetchPypi
 , substituteAll
+
+# build-system
+, setuptools
+, setuptools-scm
+, pythonRelaxDepsHook
+
+# dependencies
+, packaging
+
+# native dependencies
 , portmidi
+
+# optional-dependencies
+, pygame
 , python-rtmidi
+, rtmidi-python
+
+# tests
 , pytestCheckHook
-, pythonRelaxDepsHook
 , pythonOlder
-, setuptools
-, setuptools-scm
+
 }:
 
 buildPythonPackage rec {
@@ -21,7 +35,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Ouootu1zD3N9WxLaNXjevp3FAFj6Nw/pzt7ZGJtnw0g=";
+    hash = "sha256-Ouootu1zD3N9WxLaNXjevp3FAFj6Nw/pzt7ZGJtnw0g=";
   };
 
   patches = [
@@ -31,7 +45,7 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
     pythonRelaxDepsHook
@@ -41,10 +55,16 @@ buildPythonPackage rec {
     "packaging"
   ];
 
-  propagatedBuildInputs = [
-    python-rtmidi
+  dependencies = [
+    packaging
   ];
 
+  optional-dependencies = {
+    ports-pygame = [ pygame ];
+    ports-rtmidi = [ python-rtmidi ];
+    ports-rtmidi-python = [ rtmidi-python ];
+  };
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 860900902794a..8de8d9b8260d6 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "10.2.4";
+  version = "10.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "mitmproxy";
     repo = "mitmproxy";
     rev = "refs/tags/${version}";
-    hash = "sha256-6TPhxprrP6Bgc1yAhN3pBdr98WpvfGnVNvkNtFxROgE=";
+    hash = "sha256-YjvGsnpQQ8GWLyKmnd3lOxesnr+F2xCNXyahZh0JQnc=";
   };
 
   nativeBuildInputs = [
@@ -122,7 +122,9 @@ buildPythonPackage rec {
     "test_commands_exist"
     "test_contentview_flowview"
     "test_flowview"
+    "test_get_hex_editor"
     "test_integration"
+    "test_spawn_editor"
     "test_statusbar"
     # FileNotFoundError: [Errno 2] No such file or directory
     # likely wireguard is also not working in the sandbox
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index b8f7b60c97988..a329d6aea971d 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -18,6 +18,7 @@
 , xmltodict
 
 # optional-dependencies
+, antlr4-python3-runtime
 , aws-xray-sdk
 , cfn-lint
 , flask
@@ -25,6 +26,7 @@
 , docker
 , graphql-core
 , joserfc
+, jsonpath-ng
 , jsondiff
 , multipart
 , openapi-spec-validator
@@ -41,17 +43,17 @@
 
 buildPythonPackage rec {
   pname = "moto";
-  version = "5.0.3";
+  version = "5.0.5";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BwrC7fia167ihTRIHOaOLzRMimqP7+xUJ+6g1Zm/29s=";
+    hash = "sha256-Lqyi33dY9oaN9CC/ByXNC5PZhwlgbx+4sjQ7W9yCLZE=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
@@ -70,6 +72,7 @@ buildPythonPackage rec {
   passthru.optional-dependencies = {
     # non-exhaustive list of extras, that was cobbled together for testing
     all = [
+      antlr4-python3-runtime
       aws-xray-sdk
       cfn-lint
       docker
@@ -78,6 +81,7 @@ buildPythonPackage rec {
       graphql-core
       joserfc
       jsondiff
+      jsonpath-ng
       multipart
       openapi-spec-validator
       pyparsing
diff --git a/pkgs/development/python-modules/ndindex/default.nix b/pkgs/development/python-modules/ndindex/default.nix
index 5e98ea1857002..55704e1eef083 100644
--- a/pkgs/development/python-modules/ndindex/default.nix
+++ b/pkgs/development/python-modules/ndindex/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 
 # build-system
-, cython_3
+, cython
 
 # optional
 , numpy
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
   ];
 
   postPatch = ''
@@ -49,11 +49,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ passthru.optional-dependencies.arrays;
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Passing None has been deprecated.
-    "--deselect=ndindex/tests/test_ndindex.py::test_ndindex_invalid"
-  ];
-
   meta = with lib; {
     description = "";
     homepage = "https://github.com/Quansight-Labs/ndindex";
diff --git a/pkgs/development/python-modules/nettigo-air-monitor/default.nix b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
index 538aec6b4f248..a33f9d5286307 100644
--- a/pkgs/development/python-modules/nettigo-air-monitor/default.nix
+++ b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
@@ -1,36 +1,36 @@
-{ lib
-, aiohttp
-, aioresponses
-, aqipy-atmotech
-, buildPythonPackage
-, dacite
-, fetchFromGitHub
-, pytest-asyncio
-, pytest-error-for-skips
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  aqipy-atmotech,
+  buildPythonPackage,
+  dacite,
+  fetchFromGitHub,
+  pytest-asyncio,
+  pytest-error-for-skips,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  syrupy,
 }:
 
 buildPythonPackage rec {
   pname = "nettigo-air-monitor";
-  version = "2.2.2";
+  version = "3.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "nettigo-air-monitor";
     rev = "refs/tags/${version}";
-    hash = "sha256-Z88IkXQi9Uqc+HX++Cp5nj4S0puwMfToqXzBCnbG59g=";
+    hash = "sha256-aiJoY+6sNfBmE1057UuMjV80hjVJ29t2X16IIe6dxWs=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     aqipy-atmotech
     dacite
@@ -41,11 +41,10 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-error-for-skips
     pytestCheckHook
+    syrupy
   ];
 
-  pythonImportsCheck = [
-    "nettigo_air_monitor"
-  ];
+  pythonImportsCheck = [ "nettigo_air_monitor" ];
 
   meta = with lib; {
     description = "Python module to get air quality data from Nettigo Air Monitor devices";
diff --git a/pkgs/development/python-modules/nextdns/default.nix b/pkgs/development/python-modules/nextdns/default.nix
index 7d81eccbcabf7..9b84c400e5298 100644
--- a/pkgs/development/python-modules/nextdns/default.nix
+++ b/pkgs/development/python-modules/nextdns/default.nix
@@ -1,30 +1,35 @@
-{ lib
-, aiohttp
-, aioresponses
-, buildPythonPackage
-, fetchFromGitHub
-, orjson
-, pytest-asyncio
-, pytest-error-for-skips
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
+  orjson,
+  pytest-asyncio,
+  pytest-error-for-skips,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  syrupy,
 }:
 
 buildPythonPackage rec {
   pname = "nextdns";
-  version = "2.1.0";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "nextdns";
     rev = "refs/tags/${version}";
-    hash = "sha256-haw6t7pepMN77LFVgDFBbV4StRqcRMvnCaup8K38kEg=";
+    hash = "sha256-ka/VT7c72la4z/BVAWnV06MxVmu52ZcJ4GsEeP7vbKA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     aiohttp
     orjson
   ];
@@ -34,11 +39,10 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-error-for-skips
     pytestCheckHook
+    syrupy
   ];
 
-  pythonImportsCheck = [
-    "nextdns"
-  ];
+  pythonImportsCheck = [ "nextdns" ];
 
   meta = with lib; {
     description = "Module for the NextDNS API";
diff --git a/pkgs/development/python-modules/nibabel/default.nix b/pkgs/development/python-modules/nibabel/default.nix
index 71dba55c6ccfd..9b70a4fe20748 100644
--- a/pkgs/development/python-modules/nibabel/default.nix
+++ b/pkgs/development/python-modules/nibabel/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonOlder
 , hatchling
 , hatch-vcs
@@ -15,7 +16,7 @@
 , pytest-doctestplus
 , pytest-httpserver
 , pytest-xdist
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -70,15 +71,15 @@ buildPythonPackage rec {
     pytest-doctestplus
     pytest-httpserver
     pytest-xdist
-    pytestCheckHook
+    pytest7CheckHook
   ] ++ passthru.optional-dependencies.all;
 
   preCheck = ''
     export PATH=$out/bin:$PATH
   '';
 
-  disabledTestPaths = lib.optionals (!pythonOlder "3.12") [
-    # tries to use `distutils`, removed in Python 3.12
+  disabledTestPaths = lib.optionals (pythonAtLeast "3.12") [
+    # uses distutils
     "nisext/tests/test_sexts.py"
   ];
 
diff --git a/pkgs/development/python-modules/nipy/default.nix b/pkgs/development/python-modules/nipy/default.nix
index 1a1813ebb8afb..a5807ae224d5f 100644
--- a/pkgs/development/python-modules/nipy/default.nix
+++ b/pkgs/development/python-modules/nipy/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 
 # build-system
-, cython_3
+, cython
 , meson-python
 , ninja
 , setuptools
@@ -37,7 +37,7 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    cython_3
+    cython
     meson-python
     setuptools
     ninja
diff --git a/pkgs/development/python-modules/nocasedict/default.nix b/pkgs/development/python-modules/nocasedict/default.nix
index 9ab5c801da5cf..9d727ec0ecba2 100644
--- a/pkgs/development/python-modules/nocasedict/default.nix
+++ b/pkgs/development/python-modules/nocasedict/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
+, pytest7CheckHook
 , six
 }:
 
@@ -20,11 +20,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/nocaselist/default.nix b/pkgs/development/python-modules/nocaselist/default.nix
index d5f886ab1a1e7..fcad1844e2f65 100644
--- a/pkgs/development/python-modules/nocaselist/default.nix
+++ b/pkgs/development/python-modules/nocaselist/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , six
 }:
@@ -23,11 +23,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index 21346a9996376..6f09fdae9c67e 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "7.1.2";
+  version = "7.1.3";
   disabled = pythonOlder "3.8";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-78LIAEOQng+qF/zp6bN8BZwDrw7Jmk1NuEyyHZ0uk2o=";
+    hash = "sha256-Qfzr/0TPe7k3cYCAi8uuBmYptV2MdyLx6751ykT5z8E=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index b3c80a49798c9..7aee840ab9d3e 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -8,7 +8,7 @@
 , writeTextFile
 
 # build-system
-, cython_3
+, cython
 , gfortran
 , meson-python
 , mesonEmulatorHook
@@ -91,7 +91,7 @@ in buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython_3
+    cython
     gfortran
     meson-python
     pkg-config
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index 96288f52e4933..87f2fcfb43fb5 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -21,18 +21,24 @@
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "2.13.1";
+  version = "2.14";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "lilydjwg";
-    repo = pname;
+    repo = "nvchecker";
     rev = "v${version}";
-    hash = "sha256-q+az9oaxxIOv/vLFpkT3cF5GDJsa0Cid4oPWEKg5s7M=";
+    hash = "sha256-QqfF8PGY8sULv1x0blu21ucWxqhOpQ7jyLuRCzDIpco=";
   };
 
+  postPatch = ''
+    # Fix try/except syntax. Remove with the next release
+    substituteInPlace tests/test_jq.py \
+      --replace-warn "except jq" "except ImportError"
+  '';
+
   nativeBuildInputs = [
     setuptools
     docutils
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index ab9f362de4e6f..179ecd1a312e4 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "3.4.0";
+  version = "3.4.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-knMxVBibaX3wK7VNBODHeLeAbBOXHKNbyxjItiNcIfw=";
+    hash = "sha256-AZkbLTMWSUfrbgXZzvKy+maNaB7AwLPoh3Q8QT4Zq5U=";
   };
 
   buildInputs = [ pip ];
diff --git a/pkgs/development/python-modules/ondilo/default.nix b/pkgs/development/python-modules/ondilo/default.nix
index 1c5a25e048f45..ea863658e9918 100644
--- a/pkgs/development/python-modules/ondilo/default.nix
+++ b/pkgs/development/python-modules/ondilo/default.nix
@@ -1,16 +1,17 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, oauthlib
-, pythonOlder
-, requests
-, requests-oauthlib
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  oauthlib,
+  pythonOlder,
+  requests,
+  requests-oauthlib,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "ondilo";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -19,12 +20,10 @@ buildPythonPackage rec {
     owner = "JeromeHXP";
     repo = "ondilo";
     rev = "refs/tags/${version}";
-    hash = "sha256-BieWdPakQts0QxzQzJYlP6a7ieZ40rAyYqhy8zEvU38=";
+    hash = "sha256-l9pmamJbB/FAqB49S4vQAan9Wgj3qu1J2pboQO1Hg/Q=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     oauthlib
@@ -35,9 +34,7 @@ buildPythonPackage rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "ondilo"
-  ];
+  pythonImportsCheck = [ "ondilo" ];
 
   meta = with lib; {
     description = "Python package to access Ondilo ICO APIs";
diff --git a/pkgs/development/python-modules/openai-triton/default.nix b/pkgs/development/python-modules/openai-triton/default.nix
index 018852bdc7437..2bdb8d918af3f 100644
--- a/pkgs/development/python-modules/openai-triton/default.nix
+++ b/pkgs/development/python-modules/openai-triton/default.nix
@@ -115,6 +115,9 @@ buildPythonPackage rec {
 
   # Avoid GLIBCXX mismatch with other cuda-enabled python packages
   preConfigure = ''
+    # Ensure that the build process uses the requested number of cores
+    export MAX_JOBS="$NIX_BUILD_CORES"
+
     # Upstream's setup.py tries to write cache somewhere in ~/
     export HOME=$(mktemp -d)
 
diff --git a/pkgs/development/python-modules/openapi-core/default.nix b/pkgs/development/python-modules/openapi-core/default.nix
index 59611e1af3629..5e1c1d8ae9600 100644
--- a/pkgs/development/python-modules/openapi-core/default.nix
+++ b/pkgs/development/python-modules/openapi-core/default.nix
@@ -19,8 +19,7 @@
 , parse
 , poetry-core
 , pytest-aiohttp
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pythonOlder
 , responses
 , requests
@@ -94,7 +93,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     httpx
     pytest-aiohttp
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     responses
     webob
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
diff --git a/pkgs/development/python-modules/openpyxl/default.nix b/pkgs/development/python-modules/openpyxl/default.nix
index 94252131d9a00..c8934bf888a1d 100644
--- a/pkgs/development/python-modules/openpyxl/default.nix
+++ b/pkgs/development/python-modules/openpyxl/default.nix
@@ -5,7 +5,7 @@
 , lxml
 , pandas
 , pillow
-, pytestCheckHook
+, pytest7CheckHook
 , pythonAtLeast
 , pythonOlder
 , setuptools
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     lxml
     pandas
     pillow
-    pytestCheckHook
+    pytest7CheckHook
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/openstacksdk/default.nix b/pkgs/development/python-modules/openstacksdk/default.nix
index 94d2c1b7c216c..3f997d4d4cede 100644
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "openstacksdk";
-  version = "3.0.0";
+  version = "3.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sMf5oCXV2pKtTHYpQeasxMtTkwoH/3OamuvMXlpySuY=";
+    hash = "sha256-cH8V1+wHSrJDS5peGYT6yrAPgi0nL0wqXeDSKgnrec0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openstep-plist/default.nix b/pkgs/development/python-modules/openstep-plist/default.nix
index 2aa81629c6233..7921023f29420 100644
--- a/pkgs/development/python-modules/openstep-plist/default.nix
+++ b/pkgs/development/python-modules/openstep-plist/default.nix
@@ -1,29 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, cython
+, setuptools
 , setuptools-scm
 , pytestCheckHook
-, cython
-, pythonImportsCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "openstep-plist";
-  version = "0.3.0.post1";
-  format = "setuptools";
+  version = "0.3.1";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "openstep_plist";
     inherit version;
-    hash = "sha256-GK/z1e3tnr++3+ukRKPASDJGl7+KObsENhwN1Tv+qws=";
-    extension = "zip";
+    hash = "sha256-Au6taO+57Ost4slTlwc86A/ImFXZerZRab2S/ENo5PI=";
   };
 
-  nativeBuildInputs = [ setuptools-scm cython ];
-  nativeCheckInputs = [ pytestCheckHook ];
-  pythonImportsCheck = [ "openstep_plist" ];
+  build-system = [
+    cython
+    setuptools
+    setuptools-scm
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "openstep_plist"
+  ];
 
   meta = {
+    changelog = "https://github.com/fonttools/openstep-plist/releases/tag/v${version}";
     description = "Parser for the 'old style' OpenStep property list format also known as ASCII plist";
     homepage = "https://github.com/fonttools/openstep-plist";
     license = lib.licenses.mit;
diff --git a/pkgs/development/python-modules/openusd/default.nix b/pkgs/development/python-modules/openusd/default.nix
index 52a4bdc40573b..bc67c43a6b0b8 100644
--- a/pkgs/development/python-modules/openusd/default.nix
+++ b/pkgs/development/python-modules/openusd/default.nix
@@ -9,6 +9,7 @@
   draco,
   embree,
   fetchFromGitHub,
+  fetchpatch,
   flex,
   git,
   graphviz-nox,
@@ -63,6 +64,14 @@ buildPythonPackage rec {
 
   format = "other";
 
+  patches = [
+    (fetchpatch {
+      name = "port-to-embree-4.patch";
+      url = "https://github.com/PixarAnimationStudios/OpenUSD/pull/2266/commits/4b6c23d459c602fdac5e0ebc9b7722cbd5475e86.patch";
+      hash = "sha256-yjqdGAVqfEsOX1W/tG6c+GgQLYya5U9xgUe/sNIuDbw=";
+    })
+  ];
+
   cmakeFlags = [
     "-DPXR_BUILD_ALEMBIC_PLUGIN=ON"
     "-DPXR_BUILD_DRACO_PLUGIN=ON"
diff --git a/pkgs/development/python-modules/oracledb/default.nix b/pkgs/development/python-modules/oracledb/default.nix
index 6bba7f7191ea7..4434d5a386d37 100644
--- a/pkgs/development/python-modules/oracledb/default.nix
+++ b/pkgs/development/python-modules/oracledb/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , cryptography
-, cython_3
+, cython
 , fetchPypi
 , pythonOlder
 , setuptools
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   };
 
   build-system = [
-    cython_3
+    cython
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/palace/default.nix b/pkgs/development/python-modules/palace/default.nix
index 09aa409a42c12..5529d344dfff7 100644
--- a/pkgs/development/python-modules/palace/default.nix
+++ b/pkgs/development/python-modules/palace/default.nix
@@ -1,11 +1,19 @@
-{ lib, buildPythonPackage, fetchFromSourcehut, pythonOlder
-, cmake, cython, alure2, typing-extensions
+{ lib
+, buildPythonPackage
+, fetchFromSourcehut
+, pythonOlder
+, cmake
+, cython_0
+, setuptools
+, alure2
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "palace";
   version = "0.2.5";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromSourcehut {
@@ -21,15 +29,20 @@ buildPythonPackage rec {
       --replace IMPORTED_LOCATION_NOCONFIG IMPORTED_LOCATION_RELEASE
   '';
 
+  build-system = [
+    cmake
+    cython_0
+    setuptools
+  ];
+
   dontUseCmakeConfigure = true;
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ cython ];
-  propagatedBuildInputs = [ alure2 ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
+  propagatedBuildInputs = [
+    alure2
   ];
 
   doCheck = false; # FIXME: tests need an audio device
+
   pythonImportsCheck = [ "palace" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 6cb46d6777c9e..c42472682a7ec 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -6,7 +6,7 @@
 , pythonOlder
 
 # build-system
-, cython_3
+, cython
 , meson-python
 , meson
 , oldest-supported-numpy
@@ -84,7 +84,7 @@ let pandas = buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython_3
+    cython
     meson-python
     meson
     numpy
diff --git a/pkgs/development/python-modules/papermill/default.nix b/pkgs/development/python-modules/papermill/default.nix
index f5e31356e2b36..b419398eef996 100644
--- a/pkgs/development/python-modules/papermill/default.nix
+++ b/pkgs/development/python-modules/papermill/default.nix
@@ -97,11 +97,10 @@ buildPythonPackage rec {
     "papermill"
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
-  disabledTests = lib.optionals stdenv.isDarwin [
+  disabledTests = [
+    # pytest 8 compat
+    "test_read_with_valid_file_extension"
+  ] ++ lib.optionals stdenv.isDarwin [
     # might fail due to the sandbox
     "test_end2end_autosave_slow_notebook"
   ];
diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 2b3b6ff2507ec..36bc0c793f7a8 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -31,6 +31,11 @@ buildPythonPackage rec {
       url = "https://github.com/paramiko/paramiko/commit/18e38b99f515056071fb27b9c1a4f472005c324a.patch";
       hash = "sha256-bPDghPeLo3NiOg+JwD5CJRRLv2VEqmSx1rOF2Tf8ZDA=";
     })
+    (fetchpatch {
+      name = "paramiko-pytest8-compat.patch";
+      url = "https://github.com/paramiko/paramiko/commit/d71046151d9904df467ff72709585cde39cdd4ca.patch";
+      hash = "sha256-4CTIZ9BmzRdh+HOwxSzfM9wkUGJOnndctK5swqqsIvU=";
+    })
   ];
 
   propagatedBuildInputs = [
@@ -52,10 +57,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   disabledTestPaths = [
     # disable tests that require pytest-relaxed, which is broken
     "tests/test_client.py"
diff --git a/pkgs/development/python-modules/periodiq/default.nix b/pkgs/development/python-modules/periodiq/default.nix
index 478168de30d04..2d14561d120dd 100644
--- a/pkgs/development/python-modules/periodiq/default.nix
+++ b/pkgs/development/python-modules/periodiq/default.nix
@@ -26,6 +26,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace 'pendulum = "^2.0"' 'pendulum = "*"' \
       --replace 'poetry>=0.12' 'poetry-core' \
       --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
   '';
diff --git a/pkgs/development/python-modules/pint/default.nix b/pkgs/development/python-modules/pint/default.nix
index 99e8da4cdd30d..9a9029aca0623 100644
--- a/pkgs/development/python-modules/pint/default.nix
+++ b/pkgs/development/python-modules/pint/default.nix
@@ -50,6 +50,10 @@ buildPythonPackage rec {
     uncertainties
   ];
 
+  pytestFlagsArray = [
+    "--benchmark-disable"
+  ];
+
   preCheck = ''
     export HOME=$(mktemp -d)
   '';
@@ -57,6 +61,8 @@ buildPythonPackage rec {
   disabledTests = [
     # https://github.com/hgrecco/pint/issues/1898
     "test_load_definitions_stage_2"
+    # pytest8 deprecation
+    "test_nonnumeric_magnitudes"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/playwrightcapture/default.nix b/pkgs/development/python-modules/playwrightcapture/default.nix
index 367ccb2e669d3..8acdacb7c9b68 100644
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "playwrightcapture";
-  version = "1.24.4";
+  version = "1.24.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "Lookyloo";
     repo = "PlaywrightCapture";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/6Sdn4SdJ7e2Lm6Gl0oaLNWeb6XouLgtjNJbVYstL4w=";
+    hash = "sha256-3xbjcvBx5pHlCwqAVJUpiGsa4s9lScORlEB4YLfkvv4=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/plexapi/default.nix b/pkgs/development/python-modules/plexapi/default.nix
index a8e2c3ef4bc18..1519e44dac0bd 100644
--- a/pkgs/development/python-modules/plexapi/default.nix
+++ b/pkgs/development/python-modules/plexapi/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "plexapi";
-  version = "4.15.11";
+  version = "4.15.12";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "pkkid";
     repo = "python-plexapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-OPhmw7nCe0n7VLekXeB5PiLdBk2DPmLoQ1nZiGEwqis=";
+    hash = "sha256-i+Vg1SWxDKprZu+crf0iallaAIApDpidJ//2mivAn18=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 0e53ee17e04af..358b81eb4c209 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -1,27 +1,28 @@
- { lib
-, aiohttp
-, async-timeout
-, buildPythonPackage
-, crcmod
-, defusedxml
-, fetchFromGitHub
-, freezegun
-, jsonpickle
-, munch
-, pyserial
-, pytest-aiohttp
-, pytest-asyncio
-, pytestCheckHook
-, python-dateutil
-, pythonOlder
-, semver
-, setuptools
-, wheel
+{
+  lib,
+  aiohttp,
+  async-timeout,
+  buildPythonPackage,
+  crcmod,
+  defusedxml,
+  fetchFromGitHub,
+  freezegun,
+  jsonpickle,
+  munch,
+  pyserial,
+  pytest-aiohttp,
+  pytest-asyncio,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  semver,
+  setuptools,
+  wheel,
 }:
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.37.2";
+  version = "0.37.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -30,7 +31,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zPh4yko35aMhiTTIDbaBgVruRDyolhtvTzTIhF5fo+Y=";
+    hash = "sha256-aQz0p+DNi1XVoFwdFjc3RjpHqA2kGf4pU1QS6m271gU=";
   };
 
   postPatch = ''
@@ -64,9 +65,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "plugwise"
-  ];
+  pythonImportsCheck = [ "plugwise" ];
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/development/python-modules/pmdarima/default.nix b/pkgs/development/python-modules/pmdarima/default.nix
index 3223d071bdec3..9592ae32e09d6 100644
--- a/pkgs/development/python-modules/pmdarima/default.nix
+++ b/pkgs/development/python-modules/pmdarima/default.nix
@@ -12,7 +12,7 @@
 , urllib3
 , pythonOlder
 , python
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -49,11 +49,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     matplotlib
-    pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+    pytest7CheckHook
   ];
 
   disabledTests= [
diff --git a/pkgs/development/python-modules/pook/default.nix b/pkgs/development/python-modules/pook/default.nix
index b40f93b04af53..6abc4b43f34e8 100644
--- a/pkgs/development/python-modules/pook/default.nix
+++ b/pkgs/development/python-modules/pook/default.nix
@@ -7,8 +7,7 @@
 , jsonschema
 , pytest-asyncio
 , pytest-httpbin
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pythonOlder
 , requests
 , xmltodict
@@ -43,7 +42,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-asyncio
     pytest-httpbin
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pplpy/default.nix b/pkgs/development/python-modules/pplpy/default.nix
index 56797bcb55862..641008be07fca 100644
--- a/pkgs/development/python-modules/pplpy/default.nix
+++ b/pkgs/development/python-modules/pplpy/default.nix
@@ -5,7 +5,7 @@
 , mpfr
 , libmpc
 , ppl
-, cython_3
+, cython
 , cysignals
 , gmpy2
 , sphinx
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    cython_3
+    cython
     cysignals
     gmpy2
   ];
diff --git a/pkgs/development/python-modules/prefixed/default.nix b/pkgs/development/python-modules/prefixed/default.nix
index 9b0efcad461ea..fadc4be3ff2c3 100644
--- a/pkgs/development/python-modules/prefixed/default.nix
+++ b/pkgs/development/python-modules/prefixed/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "prefixed";
-  version = "0.7.0";
+  version = "0.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-C1TRXmAuuK9Kwxsdsho36pXOWJDgdBuw3Z3tSTzvu+k=";
+    hash = "sha256-0QrJCs/EzBTYLBQIszCy/ahe187CIGqADUOJn4w4UmU=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/primecountpy/default.nix b/pkgs/development/python-modules/primecountpy/default.nix
index 6653a65671b39..463a0cf50be64 100644
--- a/pkgs/development/python-modules/primecountpy/default.nix
+++ b/pkgs/development/python-modules/primecountpy/default.nix
@@ -2,7 +2,7 @@
 , fetchPypi
 , buildPythonPackage
 , primecount
-, cython_3
+, cython
 , cysignals
 }:
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
 
   buildInputs = [ primecount ];
 
-  propagatedBuildInputs = [ cython_3 cysignals ];
+  propagatedBuildInputs = [ cython cysignals ];
 
   # depends on pytest-cython for "pytest --doctest-cython"
   doCheck = false;
diff --git a/pkgs/development/python-modules/protobuf/3.nix b/pkgs/development/python-modules/protobuf/3.nix
index d9e3cce5f918e..9685ec88d99cf 100644
--- a/pkgs/development/python-modules/protobuf/3.nix
+++ b/pkgs/development/python-modules/protobuf/3.nix
@@ -45,6 +45,9 @@ buildPythonPackage {
   #
   postPatch = ''
     sed -i "/extra_compile_args.append('-std=c++14')/d" setup.py
+
+    substituteInPlace google/protobuf/internal/json_format_test.py \
+      --replace-fail assertRaisesRegexp assertRaisesRegex
   '';
 
   nativeBuildInputs = lib.optional isPyPy tzdata;
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 610313302ad8e..73e013d00af8c 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -60,6 +60,11 @@ buildPythonPackage {
   #
   postPatch = ''
     sed -i "/extra_compile_args.append('-std=c++14')/d" setup.py
+
+    # The former function has been renamed into the latter in Python 3.12.
+    # Does not apply to all protobuf versions, hence --replace-warn.
+    substituteInPlace google/protobuf/internal/json_format_test.py \
+      --replace-warn assertRaisesRegexp assertRaisesRegex
   '';
 
   nativeBuildInputs = lib.optional isPyPy tzdata;
diff --git a/pkgs/development/python-modules/proton-core/default.nix b/pkgs/development/python-modules/proton-core/default.nix
index 9623cb0544d9d..07eb0b9fc7072 100644
--- a/pkgs/development/python-modules/proton-core/default.nix
+++ b/pkgs/development/python-modules/proton-core/default.nix
@@ -10,16 +10,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-core";
-  version = "0.1.15-unstable-2023-10-24";
+  version = "0.1.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-core";
-    rev = "5e795e04094dff67c03c56f2f3de03ff43514cc4";
-    hash = "sha256-hchwrolc65tVmSe2IzxwH2zDU2JZzXrCMzWaETWcMDI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-072XuHvgWludlFwp/tqLpuAU89vzifFhwQ01FuiCoL8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix b/pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix
index 78de141dad56b..db8a0d14cdb31 100644
--- a/pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix
+++ b/pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix
@@ -6,16 +6,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-keyring-linux-secretservice";
-  version = "0.0.1-unstable-2023-04-14";
+  version = "0.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-keyring-linux-secretservice";
-    rev = "973d2646ec4d04bc270df53058df892950244e70";
-    hash = "sha256-JlhvJBpbewT2c8k31CPMUlvvo/orWW1qfylFZLnDxeY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IZPT2bL/1YD2TH/djwIQHUE1RRbYMTkQDacjjoqDQWo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-keyring-linux/default.nix b/pkgs/development/python-modules/proton-keyring-linux/default.nix
index 4dac98134ac0a..231a482658b37 100644
--- a/pkgs/development/python-modules/proton-keyring-linux/default.nix
+++ b/pkgs/development/python-modules/proton-keyring-linux/default.nix
@@ -7,16 +7,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-keyring-linux";
-  version = "0.0.1-unstable-2023-04-14";
+  version = "0.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-keyring-linux";
-    rev = "5ff3c7f9a1a162836649502dd23c2fbe1f487d73";
-    hash = "sha256-4d8ZePG8imURhdNtLbraMRisrTLoRvJ+L2UuuOo3MPM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-c2wdbd8Hkz2hF9zYMy4/V/W6uZRItz7tWqLJqTsJoHU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-api-core/default.nix b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
index ba8869e42daa4..3e602ab839de8 100644
--- a/pkgs/development/python-modules/proton-vpn-api-core/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
@@ -7,20 +7,21 @@
 , proton-vpn-logger
 , proton-vpn-killswitch
 , proton-vpn-session
+, sentry-sdk
 , distro
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "proton-vpn-api-core";
-  version = "0.20.3";
+  version = "0.22.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-api-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-acck0Nc/15soTJBC/4y83ID9fjF/q4vrYr6SsLAAVRY=";
+    hash = "sha256-BGei6tw6VTKkHmaIWa2VJfKOL5cRUbauOQ7zp1RY9Bo=";
   };
 
   nativeBuildInputs = [
@@ -34,6 +35,7 @@ buildPythonPackage rec {
     proton-vpn-logger
     proton-vpn-killswitch
     proton-vpn-session
+    sentry-sdk
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/proton-vpn-connection/default.nix b/pkgs/development/python-modules/proton-vpn-connection/default.nix
index 2257130c20e0e..9fb7250f10b33 100644
--- a/pkgs/development/python-modules/proton-vpn-connection/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-connection/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-connection";
-  version = "0.11.3";
+  version = "0.14.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-connection";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RuLnc/olI8S09WFG126N2xZgW4gf+DDpRstcelqMhs4=";
+    hash = "sha256-Ze/te0G0tDzyZPGVVqvuJlZoHWJqJ36LnHO+Cy5nxx8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix b/pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix
index d0f62ac6f9982..78e9b29a29254 100644
--- a/pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix
@@ -11,16 +11,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-vpn-killswitch-network-manager";
-  version = "0.2.0-unstable-2023-09-05";
+  version = "0.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-killswitch-network-manager";
-    rev = "39d4398f169539e335c1f661e0dfc5551df0e6af";
-    hash = "sha256-vmTXMIhXZgRvXeUX/XslT+ShqY60w4P7kJBQzWhA66k=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kN41b6OZ2YXoBsmNZD3NrX4uJChSmm6DVP+5LYwiZMw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-killswitch/default.nix b/pkgs/development/python-modules/proton-vpn-killswitch/default.nix
index d36dedfbd4aa9..912980453ad9c 100644
--- a/pkgs/development/python-modules/proton-vpn-killswitch/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-killswitch/default.nix
@@ -6,16 +6,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-vpn-killswitch";
-  version = "0.2.0-unstable-2023-09-05";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-killswitch";
-    rev = "6e84588ea6ae0946141d4b44b2cf5df8465d5eba";
-    hash = "sha256-eFwWN8E+nIDpbut8tkWqXucLhzm7HaLAMBIbAq/X2eo=";
+    rev = "v${version}";
+    hash = "sha256-XZqjAhxgIiATJd3JcW2WWUMC1b6+cfZRhXlIPyMUFH8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix b/pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix
index 9eca560ac0058..57c2615f53fcd 100644
--- a/pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix
@@ -8,16 +8,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-vpn-network-manager-openvpn";
-  version = "0.0.4-unstable-2023-07-05";
+  version = "0.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-network-manager-openvpn";
-    rev = "b79f6732646378ef1b92696de3665ff9560286d3";
-    hash = "sha256-Z5X8RRu+1KaZ0pnH7tzGhfeST2W8bxMZnuryLhFjG/g=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-AHG4jEEv1ihpboQwz6FmNtlqCE83qyOeGzBDHQcvD6o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
index ccd84eda66988..0327354e79277 100644
--- a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-network-manager";
-  version = "0.3.3";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-network-manager";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UEXoIFLB3/q3G3ASrgsXxF21iT5rCWm4knGezcmxmnk=";
+    hash = "sha256-zw6fzay1zCBIrouDg2EMhaxDLKIYV5TKYK5lQ3v8W6o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-session/default.nix b/pkgs/development/python-modules/proton-vpn-session/default.nix
index 38d89bb6d3e02..6295038b6f9ee 100644
--- a/pkgs/development/python-modules/proton-vpn-session/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-session/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-session";
-  version = "0.6.5";
+  version = "0.6.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-session";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1oyCxBO9YqMopbw88UJF8k4BJFP4+m23NwSrqTYqcg8=";
+    hash = "sha256-/5ju/2bxhqK6JWchkxFe3amBKHtO98GCVQWIrUsn+nQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proxy-py/default.nix b/pkgs/development/python-modules/proxy-py/default.nix
index 7c88211f5d276..72630b722bc4e 100644
--- a/pkgs/development/python-modules/proxy-py/default.nix
+++ b/pkgs/development/python-modules/proxy-py/default.nix
@@ -1,26 +1,31 @@
-{ lib
-, stdenv
-, bash
-, buildPythonPackage
-, fetchFromGitHub
-, fetchpatch
-, gnumake
-, httpx
-, openssl
-, paramiko
-, pytest-asyncio
-, pytest-mock
-, pytestCheckHook
-, pythonOlder
-, setuptools-scm
-, typing-extensions
-, wheel
+{
+  lib,
+  stdenv,
+  bash,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  gnumake,
+  h2,
+  hpack,
+  httpx,
+  hyperframe,
+  openssl,
+  paramiko,
+  pytest-asyncio,
+  pytest-mock,
+  pytest-xdist,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools-scm,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "proxy-py";
-  version = "2.4.3";
-  format = "pyproject";
+  version = "2.4.4rc5";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -28,51 +33,37 @@ buildPythonPackage rec {
     owner = "abhinavsingh";
     repo = "proxy.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dA7a9RicBFCSf6IoGX/CdvI8x/xMOFfNtyuvFn9YmHI=";
+    hash = "sha256-ngIskWzN6699C0WjSX/ZbHxV3Eb8ikQPNYZFzfzt7xU=";
   };
 
-  patches = [
-    # this patch is so that the one following it applies cleanly
-    # https://github.com/abhinavsingh/proxy.py/pull/1209
-    (fetchpatch {
-      name = "update-build-dependencies.patch";
-      url = "https://github.com/abhinavsingh/proxy.py/commit/2e535360ce5ed9734f2c00dc6aefe5ebd281cea5.patch";
-      hash = "sha256-eR3R4M7jwQMnY5ob0V6G71jXcrkV7YZvo1JOUG4gnrY=";
-    })
-    # https://github.com/abhinavsingh/proxy.py/pull/1345
-    (fetchpatch {
-      name = "remove-setuptools-scm-git-archive-dependency.patch";
-      url = "https://github.com/abhinavsingh/proxy.py/commit/027bfa6b912745f588d272f1a1082f6ca416f815.patch";
-      hash = "sha256-O2LlSrSrB3u2McAZRY+KviuU7Hv1tOuf0n+D/H4BWvI=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace Makefile \
     --replace "SHELL := /bin/bash" "SHELL := ${bash}/bin/bash"
     substituteInPlace pytest.ini \
-      --replace "-p pytest_cov" "" \
-      --replace "--no-cov-on-fail" ""
+      --replace-fail "-p pytest_cov" "" \
+      --replace-fail "--no-cov-on-fail" ""
     sed -i "/--cov/d" pytest.ini
   '';
 
-  nativeBuildInputs = [
-    setuptools-scm
-    wheel
-  ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     paramiko
     typing-extensions
   ];
 
   nativeCheckInputs = [
+    gnumake
+    h2
+    hpack
     httpx
+    hyperframe
     openssl
-    gnumake
     pytest-asyncio
     pytest-mock
+    pytest-xdist
     pytestCheckHook
+    requests
   ];
 
   preCheck = ''
@@ -81,14 +72,17 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Test requires network access
-    "test_http2_via_proxy"
+    "http"
+    "http2"
+    "proxy"
+    "web_server"
+    # Location is not writable
+    "test_gen_csr"
     # Tests run into a timeout
     "integration"
   ];
 
-  pythonImportsCheck = [
-    "proxy"
-  ];
+  pythonImportsCheck = [ "proxy" ];
 
   meta = with lib; {
     description = "Python proxy framework";
diff --git a/pkgs/development/python-modules/psd-tools/default.nix b/pkgs/development/python-modules/psd-tools/default.nix
index fbee76dfa02b8..74ca3b2e0874f 100644
--- a/pkgs/development/python-modules/psd-tools/default.nix
+++ b/pkgs/development/python-modules/psd-tools/default.nix
@@ -12,7 +12,7 @@
 , pytestCheckHook
 , pytest-cov
 , ipython
-, cython_3
+, cython
 }:
 
 buildPythonPackage rec {
@@ -29,8 +29,12 @@ buildPythonPackage rec {
     hash = "sha256-HUFJ2FP9WGcG9pkukS2LHIgPYFRAXAneiVK6VfYQ+zU=";
   };
 
+  postPatch = ''
+    sed -i "/addopts =/d" pyproject.toml
+  '';
+
   nativeBuildInputs = [
-    cython_3
+    cython
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/psycopg/default.nix b/pkgs/development/python-modules/psycopg/default.nix
index 84161d1a87812..65d9e35236206 100644
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@@ -15,7 +15,7 @@
 , typing-extensions
 
 # psycopg-c
-, cython_3
+, cython
 , tomli
 
 # docs
@@ -72,7 +72,7 @@ let
     '';
 
     nativeBuildInputs = [
-      cython_3
+      cython
       postgresql
       setuptools
       tomli
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index e80b04011e94c..a8cd6193d74be 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20240416";
+  version = "0.10.0.20240420";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Y0QP9SNJQOMGEKAEeDwKNTRQtFiwUOWGLbkGJx66SBk=";
+    hash = "sha256-s8xPkes/xFlejqfOlMZOPLmNK92e2TLK18UZmv3/a6I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pulsectl-asyncio/default.nix b/pkgs/development/python-modules/pulsectl-asyncio/default.nix
index 54500916e8844..1a985c8ab1d33 100644
--- a/pkgs/development/python-modules/pulsectl-asyncio/default.nix
+++ b/pkgs/development/python-modules/pulsectl-asyncio/default.nix
@@ -1,16 +1,16 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pulsectl
-, pythonOlder
-, setuptools
-, wheel
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pulsectl,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pulsectl-asyncio";
-  version = "1.1.1";
-  format = "pyproject";
+  version = "1.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,24 +18,17 @@ buildPythonPackage rec {
     owner = "mhthies";
     repo = "pulsectl-asyncio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Uc8iUo9THWNPRRsvJxfw++41cnKrANe/Fk6e8bgLSkc=";
+    hash = "sha256-WqUO4eERJkRg6O+gCmjqfdVbBT/3TVVBUUduoIxcPNQ=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    pulsectl
-  ];
+  dependencies = [ pulsectl ];
 
   # Tests require a running pulseaudio instance
   doCheck = false;
 
-  pythonImportsCheck = [
-    "pulsectl_asyncio"
-  ];
+  pythonImportsCheck = [ "pulsectl_asyncio" ];
 
   meta = with lib; {
     description = "Python bindings library for PulseAudio";
diff --git a/pkgs/development/python-modules/py-libzfs/default.nix b/pkgs/development/python-modules/py-libzfs/default.nix
index d22e931cd9373..661a79dd64855 100644
--- a/pkgs/development/python-modules/py-libzfs/default.nix
+++ b/pkgs/development/python-modules/py-libzfs/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, cython
+, cython_0
 , zfs
 }:
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     hash = "sha256-vBLbjP1gQEQNsTLc2W6uRzCFHQXZp+jGiwE0Pe8VTuw=";
   };
 
-  nativeBuildInputs = [ cython ];
+  nativeBuildInputs = [ cython_0 ];
   buildInputs = [ zfs ];
 
   # Passing CFLAGS in configureFlags does not work, see https://github.com/truenas/py-libzfs/issues/107
diff --git a/pkgs/development/python-modules/py-partiql-parser/default.nix b/pkgs/development/python-modules/py-partiql-parser/default.nix
index 9289ae14f69a7..95cfa9e9c9b74 100644
--- a/pkgs/development/python-modules/py-partiql-parser/default.nix
+++ b/pkgs/development/python-modules/py-partiql-parser/default.nix
@@ -3,13 +3,13 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
-, setuptools
+, hatchling
 , sure
 }:
 
 buildPythonPackage rec {
   pname = "py-partiql-parser";
-  version = "0.5.1";
+  version = "0.5.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,11 +18,11 @@ buildPythonPackage rec {
     owner = "getmoto";
     repo = "py-partiql-parser";
     rev = "refs/tags/${version}";
-    hash = "sha256-BPap4f9ro269K50qpVlTiEPNyyMCvBHCr2obuSfuNos=";
+    hash = "sha256-BSqc3xibStb3J6Rua4dDp/eRD5/ns/dU1vGa4vL1Cyo=";
   };
 
-  nativeBuildInputs = [
-    setuptools
+  build-system = [
+    hatchling
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index 7c19bdefd4f67..da50d8f45735a 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -8,7 +8,7 @@
 , cffi
 , cloudpickle
 , cmake
-, cython
+, cython_0
 , fsspec
 , hypothesis
 , numpy
@@ -45,7 +45,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
-    cython
+    cython_0
     pkg-config
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index cfb7d42a6f462..1a06de633b689 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -4,6 +4,8 @@
 , pythonOlder
 , fetchFromGitHub
 , cmake
+, ninja
+, setuptools
 , boost
 , eigen
 , python
@@ -37,23 +39,29 @@
     else python.stdenv;
 in buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.11.1";
-  format = "setuptools";
+  version = "2.12.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pybind";
-    repo = pname;
+    repo = "pybind11";
     rev = "v${version}";
-    hash = "sha256-sO/Fa+QrAKyq2EYyYMcjPrYI+bdJIrDoj6L3JHoDo3E=";
+    hash = "sha256-DVkI5NxM5uME9m3PFYVpJOOa2j+yjL6AJn76fCTv2nE=";
   };
 
   postPatch = ''
-    sed -i "/^timeout/d" pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace-fail "timeout=300" ""
   '';
 
-  nativeBuildInputs = [ cmake ];
+  build-system = [
+    cmake
+    ninja
+    setuptools
+  ];
+
   buildInputs = lib.optionals (pythonOlder "3.9") [ libxcrypt ];
-  propagatedBuildInputs = [ setupHook ];
+  propagatedNativeBuildInputs = [ setupHook ];
 
   stdenv = stdenv';
 
diff --git a/pkgs/development/python-modules/pydantic/1.nix b/pkgs/development/python-modules/pydantic/1.nix
index 6a1f5c52116c8..6078acc356ce2 100644
--- a/pkgs/development/python-modules/pydantic/1.nix
+++ b/pkgs/development/python-modules/pydantic/1.nix
@@ -1,11 +1,10 @@
 { lib
 , buildPythonPackage
-, cython
+, cython_0
 , email-validator
 , fetchFromGitHub
 , pytest-mock
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , python-dotenv
 , pythonAtLeast
 , pythonOlder
@@ -30,7 +29,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    cython
+    cython_0
   ];
 
   buildInputs = lib.optionals (pythonOlder "3.9") [
@@ -52,7 +51,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest-mock
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/pydash/default.nix b/pkgs/development/python-modules/pydash/default.nix
index 05ae5e165c27f..b9ac4770f71e9 100644
--- a/pkgs/development/python-modules/pydash/default.nix
+++ b/pkgs/development/python-modules/pydash/default.nix
@@ -1,10 +1,9 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , invoke
 , mock
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , setuptools
 , sphinx-rtd-theme
@@ -41,7 +40,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     invoke
     mock
-    pytestCheckHook
+    pytest7CheckHook
     sphinx-rtd-theme
   ];
 
diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index b3e4863f24725..45e4b014db726 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -1,24 +1,25 @@
-{ lib
-, awesomeversion
-, buildPythonPackage
-, envoy-utils
-, fetchFromGitHub
-, httpx
-, lxml
-, orjson
-, poetry-core
-, pyjwt
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, respx
-, syrupy
-, tenacity
+{
+  lib,
+  awesomeversion,
+  buildPythonPackage,
+  envoy-utils,
+  fetchFromGitHub,
+  httpx,
+  lxml,
+  orjson,
+  poetry-core,
+  pyjwt,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  respx,
+  syrupy,
+  tenacity,
 }:
 
 buildPythonPackage rec {
   pname = "pyenphase";
-  version = "1.20.1";
+  version = "1.20.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -27,7 +28,7 @@ buildPythonPackage rec {
     owner = "pyenphase";
     repo = "pyenphase";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Bxwd8qHsvq9BuBMSu5JI/Yk/KC5aQ7b7lnXuIoNQ6EI=";
+    hash = "sha256-sjZaLqTYoXJ1cpaSuyLNAsUrACOMVah7DKaKxGkG0zE=";
   };
 
   postPatch = ''
@@ -35,9 +36,7 @@ buildPythonPackage rec {
       --replace-fail " --cov=pyenphase --cov-report=term-missing:skip-covered" ""
   '';
 
-  build-system = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
   dependencies = [
     awesomeversion
@@ -61,9 +60,7 @@ buildPythonPackage rec {
     "test_with_7_x_firmware"
   ];
 
-  pythonImportsCheck = [
-    "pyenphase"
-  ];
+  pythonImportsCheck = [ "pyenphase" ];
 
   meta = with lib; {
     description = "Library to control enphase envoy";
diff --git a/pkgs/development/python-modules/pyfftw/default.nix b/pkgs/development/python-modules/pyfftw/default.nix
index e47184f9b15cc..746377c3c1313 100644
--- a/pkgs/development/python-modules/pyfftw/default.nix
+++ b/pkgs/development/python-modules/pyfftw/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchPypi
-, fftw, fftwFloat, fftwLongDouble, numpy, scipy, cython, dask }:
+, fftw, fftwFloat, fftwLongDouble, numpy, scipy, cython_0, dask }:
 
 buildPythonPackage rec {
   version = "0.13.1";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   buildInputs = [ fftw fftwFloat fftwLongDouble];
 
-  propagatedBuildInputs = [ numpy scipy cython dask ];
+  propagatedBuildInputs = [ numpy scipy cython_0 dask ];
 
   # Tests cannot import pyfftw. pyfftw works fine though.
   doCheck = false;
diff --git a/pkgs/development/python-modules/pyfuse3/default.nix b/pkgs/development/python-modules/pyfuse3/default.nix
index d339389057535..851b37bbfb9ca 100644
--- a/pkgs/development/python-modules/pyfuse3/default.nix
+++ b/pkgs/development/python-modules/pyfuse3/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, cython_3
+, cython
 , pkg-config
 , setuptools
 , fuse3
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython_3
+    cython
     pkg-config
     setuptools
   ];
diff --git a/pkgs/development/python-modules/pygame-sdl2/default.nix b/pkgs/development/python-modules/pygame-sdl2/default.nix
index 93eea02a9041a..0201c9cb4a8a0 100644
--- a/pkgs/development/python-modules/pygame-sdl2/default.nix
+++ b/pkgs/development/python-modules/pygame-sdl2/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchurl, isPy27, renpy
-, cython, SDL2, SDL2_image, SDL2_ttf, SDL2_mixer, libjpeg, libpng }:
+, cython_0, SDL2, SDL2_image, SDL2_ttf, SDL2_mixer, libjpeg, libpng }:
 
 buildPythonPackage rec {
   pname = "pygame-sdl2";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    SDL2.dev cython
+    SDL2.dev cython_0
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index 6bc41339d9275..a219804f34b81 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -6,7 +6,7 @@
 , pythonOlder
 
 # build-system
-, cython_3
+, cython
 , setuptools
 , pkg-config
 
@@ -70,7 +70,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython_3
+    cython
     pkg-config
     SDL2
     setuptools
diff --git a/pkgs/development/python-modules/pygeos/default.nix b/pkgs/development/python-modules/pygeos/default.nix
index 657da35b4ad32..298d4bdff7fe8 100644
--- a/pkgs/development/python-modules/pygeos/default.nix
+++ b/pkgs/development/python-modules/pygeos/default.nix
@@ -4,7 +4,7 @@
 , python
 , geos_3_11
 , pytestCheckHook
-, cython
+, cython_0
 , numpy
 }:
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     geos_3_11 # for geos-config
-    cython
+    cython_0
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pykdtree/default.nix b/pkgs/development/python-modules/pykdtree/default.nix
index b81bba27f1a41..b720f5b838b3a 100644
--- a/pkgs/development/python-modules/pykdtree/default.nix
+++ b/pkgs/development/python-modules/pykdtree/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 
 # build-system
-, cython_3
+, cython
 , numpy
 , setuptools
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     numpy
     setuptools
   ];
diff --git a/pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix b/pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix
index 3872fa6b2417e..9040f955efb4f 100644
--- a/pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix
+++ b/pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , pythonOlder
 , pytestCheckHook
-, cython_3
+, cython
 , poetry-core
 , setuptools
 , numpy
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     poetry-core
     setuptools
   ];
diff --git a/pkgs/development/python-modules/pyliblo/default.nix b/pkgs/development/python-modules/pyliblo/default.nix
index db962d165f8b2..0735fdcb72160 100644
--- a/pkgs/development/python-modules/pyliblo/default.nix
+++ b/pkgs/development/python-modules/pyliblo/default.nix
@@ -4,7 +4,7 @@
 , isPyPy
 , pythonAtLeast
 , liblo
-, cython
+, cython_0
 }:
 
 buildPythonPackage rec {
@@ -25,7 +25,9 @@ buildPythonPackage rec {
     })
   ];
 
-  buildInputs = [ liblo cython ];
+  build-system = [ cython_0 ];
+
+  buildInputs = [ liblo ];
 
   meta = with lib; {
     homepage = "https://das.nasophon.de/pyliblo/";
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 2d46d041df47d..046277a5fa586 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -17,7 +17,7 @@
 , py
 , pytest-timeout
 , pytest-xdist
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -57,7 +57,7 @@ buildPythonPackage rec {
     py
     pytest-timeout
     pytest-xdist
-    pytestCheckHook
+    pytest7CheckHook
     requests
     typing-extensions
   ];
diff --git a/pkgs/development/python-modules/pylitterbot/default.nix b/pkgs/development/python-modules/pylitterbot/default.nix
index ecf1ca2e4ef61..add82ecc2d15f 100644
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pylitterbot";
-  version = "2023.4.11";
+  version = "2023.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "natekspencer";
     repo = "pylitterbot";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OTyQgcGGNktCgYJN33SZn7La7ec+gwR/yVDuH7kcEh4=";
+    hash = "sha256-MSQdX2PKQohmPGqtRZnUmCCVgKgaf4+cHAUItiPv7pY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pymeeus/default.nix b/pkgs/development/python-modules/pymeeus/default.nix
index 821ad49e8206b..8799de9232457 100644
--- a/pkgs/development/python-modules/pymeeus/default.nix
+++ b/pkgs/development/python-modules/pymeeus/default.nix
@@ -1,8 +1,14 @@
-{ lib, buildPythonPackage, fetchPypi, pytest }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, pytest7CheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pymeeus";
   version = "0.5.12";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "PyMeeus";
@@ -10,11 +16,13 @@ buildPythonPackage rec {
     hash = "sha256-VI9xhr2LlsvAac9kmo6ON33OSax0SGcJhJ/mOpnK1oQ=";
   };
 
-  nativeCheckInputs = [ pytest ];
+  build-system = [
+    setuptools
+  ];
 
-  checkPhase = ''
-    pytest .
-  '';
+  nativeCheckInputs = [
+    pytest7CheckHook
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/architest/pymeeus";
diff --git a/pkgs/development/python-modules/pympler/default.nix b/pkgs/development/python-modules/pympler/default.nix
index 463de728aea29..388fba817f780 100644
--- a/pkgs/development/python-modules/pympler/default.nix
+++ b/pkgs/development/python-modules/pympler/default.nix
@@ -8,11 +8,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Pympler";
+  pname = "pympler";
   version = "1.0.1";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Pympler";
+    inherit version;
     sha256 = "993f1a3599ca3f4fcd7160c7545ad06310c9e12f70174ae7ae8d4e25f6c5d3fa";
   };
 
@@ -21,7 +22,7 @@ buildPythonPackage rec {
     # (see https://github.com/pympler/pympler/issues/148)
     # https://github.com/pympler/pympler/pull/149
     (fetchpatch {
-      name = "${pname}-python-3.11-compat.patch";
+      name = "Pympler-python-3.11-compat.patch";
       url = "https://github.com/pympler/pympler/commit/0fd8ad8da39207bd0dcb28bdac0407e04744c965.patch";
       hash = "sha256-6MK0AuhVhQkUzlk29HUh1+mSbfsVTBJ1YBtYNIFhh7U=";
     })
diff --git a/pkgs/development/python-modules/pyopengl-accelerate/default.nix b/pkgs/development/python-modules/pyopengl-accelerate/default.nix
index f85e825f26456..4dc8803fa037f 100644
--- a/pkgs/development/python-modules/pyopengl-accelerate/default.nix
+++ b/pkgs/development/python-modules/pyopengl-accelerate/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , pythonAtLeast
 , fetchPypi
-, cython_3
+, cython
 , numpy
 , setuptools
 , wheel
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     numpy
     setuptools
     wheel
diff --git a/pkgs/development/python-modules/pyowm/default.nix b/pkgs/development/python-modules/pyowm/default.nix
index d95cda12d600b..d342ce313e8cb 100644
--- a/pkgs/development/python-modules/pyowm/default.nix
+++ b/pkgs/development/python-modules/pyowm/default.nix
@@ -1,58 +1,54 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, geojson
-, pysocks
-, pythonOlder
-, requests
-, pytestCheckHook
-, pythonRelaxDepsHook
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  geojson,
+  pysocks,
+  pythonOlder,
+  requests,
+  setuptools,
+  pytestCheckHook,
+  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
   pname = "pyowm";
   version = "3.3.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "csparpa";
-    repo = pname;
-    rev = version;
+    repo = "pyowm";
+    rev = "refs/tags/${version}";
     hash = "sha256-cSOhm3aDksLBChZzgw1gjUjLQkElR2/xGFMOb9K9RME=";
   };
 
-  pythonRelaxDeps = [
-    "geojson"
-  ];
+  pythonRelaxDeps = [ "geojson" ];
 
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     geojson
     pysocks
     requests
+    setuptools
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   # Run only tests which don't require network access
-  pytestFlagsArray = [
-    "tests/unit"
-  ];
+  pytestFlagsArray = [ "tests/unit" ];
 
-  pythonImportsCheck = [
-    "pyowm"
-  ];
+  pythonImportsCheck = [ "pyowm" ];
 
   meta = with lib; {
     description = "Python wrapper around the OpenWeatherMap web API";
     homepage = "https://pyowm.readthedocs.io/";
+    changelog = "https://github.com/csparpa/pyowm/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyqtdarktheme/add-missing-argument-to-the-proxy-style-initializer.patch b/pkgs/development/python-modules/pyqtdarktheme/add-missing-argument-to-the-proxy-style-initializer.patch
new file mode 100644
index 0000000000000..9d77e2901bed0
--- /dev/null
+++ b/pkgs/development/python-modules/pyqtdarktheme/add-missing-argument-to-the-proxy-style-initializer.patch
@@ -0,0 +1,25 @@
+From 816afb6a3a6a340ae2a2a06dc054dd8e65ff9d8f Mon Sep 17 00:00:00 2001
+From: Pavel Sobolev <paveloom@riseup.net>
+Date: Mon, 30 Oct 2023 20:42:31 +0300
+Subject: [PATCH] Add missing argument to the `proxy_style` initializer.
+
+---
+ qdarktheme/_proxy_style.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/qdarktheme/_proxy_style.py b/qdarktheme/_proxy_style.py
+index b1fb358..f04f01e 100644
+--- a/qdarktheme/_proxy_style.py
++++ b/qdarktheme/_proxy_style.py
+@@ -14,7 +14,7 @@ class QDarkThemeStyle(QProxyStyle):
+
+     def __init__(self):
+         """Initialize style proxy."""
+-        super().__init__()
++        super().__init__(None)
+
+     def standardIcon(  # noqa: N802
+         self, standard_icon: QStyle.StandardPixmap, option: QStyleOption | None, widget
+--
+2.42.0
+
diff --git a/pkgs/development/python-modules/pyqtdarktheme/default.nix b/pkgs/development/python-modules/pyqtdarktheme/default.nix
new file mode 100644
index 0000000000000..0d60c8039898f
--- /dev/null
+++ b/pkgs/development/python-modules/pyqtdarktheme/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+
+, darkdetect
+, poetry-core
+
+, pyqt5
+, pytest-mock
+, pytest-qt
+, pytestCheckHook
+, qt5
+}:
+
+buildPythonPackage rec {
+  pname = "pyqtdarktheme";
+  version = "2.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "5yutan5";
+    repo = "PyQtDarkTheme";
+    rev = "v${version}";
+    hash = "sha256-jK+wnIyPE8Bav0pzbvVisYYCzdRshYw1S2t0H3Pro5M=";
+  };
+
+  patches = [
+    ./add-missing-argument-to-the-proxy-style-initializer.patch
+  ];
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    darkdetect
+  ];
+
+  nativeCheckInputs = [
+    pyqt5
+    pytest-mock
+    pytest-qt
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "qdarktheme"
+  ];
+
+  prePatch = ''
+    sed -i 's#darkdetect = ".*"#darkdetect = "*"#' pyproject.toml
+  '';
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    export QT_PLUGIN_PATH="${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}"
+    export QT_QPA_PLATFORM_PLUGIN_PATH="${qt5.qtbase.bin}/lib/qt-${qt5.qtbase.version}/plugins";
+    export QT_QPA_PLATFORM=offscreen
+  '';
+
+  meta = with lib; {
+    description = "A flat dark theme for PySide and PyQt";
+    homepage = "https://pyqtdarktheme.readthedocs.io/en/stable";
+    license = licenses.mit;
+    maintainers = with maintainers; [ paveloom ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyreadstat/default.nix b/pkgs/development/python-modules/pyreadstat/default.nix
index 1a575db7c2e21..b8eaa04b1a93c 100644
--- a/pkgs/development/python-modules/pyreadstat/default.nix
+++ b/pkgs/development/python-modules/pyreadstat/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
-, cython_3
+, cython
 , fetchFromGitHub
 , libiconv
 , pandas
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pyrevolve/default.nix b/pkgs/development/python-modules/pyrevolve/default.nix
index a097532e8c978..8fec5f23ef6e2 100644
--- a/pkgs/development/python-modules/pyrevolve/default.nix
+++ b/pkgs/development/python-modules/pyrevolve/default.nix
@@ -4,7 +4,7 @@
 , contexttimer
 , setuptools
 , versioneer
-, cython
+, cython_0
 , numpy
 , pytestCheckHook
 , pythonOlder
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython
+    cython_0
     setuptools
     versioneer
   ];
diff --git a/pkgs/development/python-modules/pysam/default.nix b/pkgs/development/python-modules/pysam/default.nix
index d2887eda58474..269b2249887a5 100644
--- a/pkgs/development/python-modules/pysam/default.nix
+++ b/pkgs/development/python-modules/pysam/default.nix
@@ -4,7 +4,7 @@
 , bzip2
 , bcftools
 , curl
-, cython_3
+, cython
 , htslib
 , libdeflate
 , xz
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     samtools
     setuptools
   ];
diff --git a/pkgs/development/python-modules/pysiaalarm/default.nix b/pkgs/development/python-modules/pysiaalarm/default.nix
index c5a7cdae56a53..db5973207f7e7 100644
--- a/pkgs/development/python-modules/pysiaalarm/default.nix
+++ b/pkgs/development/python-modules/pysiaalarm/default.nix
@@ -7,8 +7,7 @@
 , setuptools-scm
 , pytest-asyncio
 , pytest-cases
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pytz
 }:
 
@@ -44,7 +43,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-asyncio
     pytest-cases
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pysolcast/default.nix b/pkgs/development/python-modules/pysolcast/default.nix
index 891856f35b8c0..3123b1f392c68 100644
--- a/pkgs/development/python-modules/pysolcast/default.nix
+++ b/pkgs/development/python-modules/pysolcast/default.nix
@@ -1,20 +1,21 @@
-{ lib
-, anyconfig
-, buildPythonPackage
-, fetchFromGitHub
-, isodate
-, pytestCheckHook
-, pythonOlder
-, pyyaml
-, requests
-, responses
-, poetry-core
-, pythonRelaxDepsHook
+{
+  lib,
+  anyconfig,
+  buildPythonPackage,
+  fetchFromGitHub,
+  isodate,
+  pytestCheckHook,
+  pythonOlder,
+  pyyaml,
+  requests,
+  responses,
+  poetry-core,
+  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
   pname = "pysolcast";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,19 +24,16 @@ buildPythonPackage rec {
     owner = "mcaulifn";
     repo = "solcast";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JzGrE6zKj16Uzm3EC8ysMbgP5ouA00Gact7NYXbEkXI=";
+    hash = "sha256-DXJkbAlkxBjUEbziFNdr8SilB2GRUoAwvrr0HY56Deg=";
   };
 
-  pythonRelaxDeps = [
-    "responses"
-  ];
+  pythonRelaxDeps = [ "responses" ];
 
-  nativeBuildInputs = [
-    poetry-core
-    pythonRelaxDepsHook
-  ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
     anyconfig
     isodate
     pyyaml
@@ -47,9 +45,7 @@ buildPythonPackage rec {
     responses
   ];
 
-  pythonImportsCheck = [
-    "pysolcast"
-  ];
+  pythonImportsCheck = [ "pysolcast" ];
 
   meta = with lib; {
     description = "Python library for interacting with the Solcast API";
diff --git a/pkgs/development/python-modules/pystemmer/default.nix b/pkgs/development/python-modules/pystemmer/default.nix
index 0df510e0b55db..0c298904fdcd2 100644
--- a/pkgs/development/python-modules/pystemmer/default.nix
+++ b/pkgs/development/python-modules/pystemmer/default.nix
@@ -1,40 +1,39 @@
 { lib
 , python
-, fetchPypi
 , fetchFromGitHub
-, fetchpatch
+, fetchpatch2
 , buildPythonPackage
 , cython
+, setuptools
 , libstemmer
  }:
 
 buildPythonPackage rec {
   pname = "pystemmer";
-  version = "2.2.0";
-  format = "setuptools";
+  version = "2.2.0.1";
+  pyproejct = true;
 
   src = fetchFromGitHub {
     owner = "snowballstem";
     repo = "pystemmer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bJVFeO7XP+aZ2nowQiuws5ziL/FmS1eaOllW6QxA70U=";
+    hash = "sha256-ngPx95ybgJmndpNPBwCa3BCNsozRg+dlEw+nhlIwI58=";
   };
 
-  nativeBuildInputs = [ cython ];
-
   patches = [
-    (fetchpatch {
-      # Allow building with system libstemmer
-      url = "https://github.com/snowballstem/pystemmer/commit/2f52b4b2ff113fe6c33cebe14ed4fd4388bb1742.patch";
-      hash = "sha256-JqR/DUmABgWaq23CNjoKSasL0mNhM2QuU986mouK6A8=";
-    })
-    (fetchpatch {
-      # Fix doctests
-      url = "https://github.com/snowballstem/pystemmer/commit/b2826f19fe8ba65238b5f3b4cee7096a698f048e.patch";
-      hash = "sha256-VTZydjYaJJ/KoHD4KbON36kZnkuAyO51H0Oeg6VXTqg=";
+    (fetchpatch2 {
+      # relax cython constraint
+      name = "pystemmer-relax-cython.patch";
+      url = "https://github.com/snowballstem/pystemmer/commit/d3d423dc877b4f49e0ab1776f7edaff37feb6799.patch";
+      hash = "sha256-9K6gy/cLFPfW82XYHVVPXUbQhf8XyB4NUi4YqNtyWcw=";
     })
   ];
 
+  build-system = [
+    cython
+    setuptools
+  ];
+
   postConfigure = ''
     export PYSTEMMER_SYSTEM_LIBSTEMMER="${lib.getDev libstemmer}/include"
   '';
@@ -59,8 +58,12 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Snowball stemming algorithms, for information retrieval";
+    downloadPage = "https://github.com/snowballstem/pystemmer";
     homepage = "http://snowball.tartarus.org/";
-    license = licenses.mit;
+    license = with licenses; [
+      bsd3
+      mit
+    ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/pytest-asyncio/default.nix b/pkgs/development/python-modules/pytest-asyncio/default.nix
index 8b74f53149305..b7762e12175c1 100644
--- a/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "0.23.5.post1"; # N.B.: when updating, tests bleak and aioesphomeapi tests
+  version = "0.23.6"; # N.B.: when updating, tests bleak and aioesphomeapi tests
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pytest-dev";
     repo = "pytest-asyncio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-k+EmbUptZB2ZLiygwY9WwFA4PNJA+9fEAZYu0xaPZSQ=";
+    hash = "sha256-+kyKcVzW05kqtLeC81rk3fJpOtyW3xSYshgl5gqIddE=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/pytest-doctestplus/default.nix b/pkgs/development/python-modules/pytest-doctestplus/default.nix
index c54179d9b6904..ff5e1b0ef2b67 100644
--- a/pkgs/development/python-modules/pytest-doctestplus/default.nix
+++ b/pkgs/development/python-modules/pytest-doctestplus/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-doctestplus";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xa12Oi+uXu5bZ4jPVedU1AQOxJsOIoj8ncmgFe+buTI=";
+    hash = "sha256-JHKoosjOo00vZfZJlUP663SO7LWcWXhS/ZiDm0cwdnk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest-factoryboy/default.nix b/pkgs/development/python-modules/pytest-factoryboy/default.nix
index 349ccf311ddea..c1a89dbe012e9 100644
--- a/pkgs/development/python-modules/pytest-factoryboy/default.nix
+++ b/pkgs/development/python-modules/pytest-factoryboy/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-factoryboy";
-  version = "2.5.1";
+  version = "2.6.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = "pytest-factoryboy";
     rev = version;
-    sha256 = "sha256-zxgezo2PRBKs0mps0qdKWtBygunzlaxg8s9BoBaU1Ig=";
+    sha256 = "sha256-GYqYwtbmMWVqImVPPBbZNRJJGcbksUPsIbi6QuPRMco=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-snapshot/default.nix b/pkgs/development/python-modules/pytest-snapshot/default.nix
index 60b81487a987d..c04c9b74e3b3c 100644
--- a/pkgs/development/python-modules/pytest-snapshot/default.nix
+++ b/pkgs/development/python-modules/pytest-snapshot/default.nix
@@ -4,8 +4,7 @@
 , packaging
 , pytest
 , setuptools-scm
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pythonOlder
 }:
 
@@ -37,7 +36,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     # https://github.com/joseph-roitman/pytest-snapshot/issues/71
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pytest-unordered/default.nix b/pkgs/development/python-modules/pytest-unordered/default.nix
index b14a1e12ada5e..d0446e7646457 100644
--- a/pkgs/development/python-modules/pytest-unordered/default.nix
+++ b/pkgs/development/python-modules/pytest-unordered/default.nix
@@ -2,8 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytest
-, pytest_7
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -24,7 +23,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     # https://github.com/utapyngo/pytest-unordered/issues/15
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 86dc3f8f9aef0..9b99112a5f0e9 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -29,12 +29,12 @@
 
 buildPythonPackage rec {
   pname = "pytest";
-  version = "8.0.2";
+  version = "8.1.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1AUdYjouC35RlgupYxk7Cc5trrl1mkUYRKIeTd7fwb0=";
+    hash = "sha256-rJeBQadZSJSIF9NgKXt6rg/LnW/2vJ7G1RS4XVplwEQ=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/python-apt/default.nix b/pkgs/development/python-modules/python-apt/default.nix
new file mode 100644
index 0000000000000..5d5a703a1afc4
--- /dev/null
+++ b/pkgs/development/python-modules/python-apt/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  apt,
+  buildPythonPackage,
+  fetchgit,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "apt";
+  version = "2.7.6";
+
+  pyproject = true;
+
+  src = fetchgit {
+    url = "https://git.launchpad.net/python-apt";
+    rev = "refs/tags/${version}";
+    hash = "sha256-1jTe8ncMKV78+cfSZ6p6qdjxs0plZLB4VwVtPLtDlAc=";
+  };
+
+  buildInputs = [ apt.dev ];
+
+  nativeBuildInputs = [ setuptools ];
+
+  # Ensure the version is set properly without trying to invoke
+  # dpkg-parsechangelog
+  env.DEBVER = "${version}";
+
+  pythonImportsCheck = [ "apt_pkg" ];
+
+  meta = {
+    description = "Python bindings for APT";
+    homepage = "https://launchpad.net/python-apt";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/python-box/default.nix b/pkgs/development/python-modules/python-box/default.nix
index 3145debc745c4..9a7350c34eb8e 100644
--- a/pkgs/development/python-modules/python-box/default.nix
+++ b/pkgs/development/python-modules/python-box/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, cython_3
+, cython
 , fetchFromGitHub
 , msgpack
 , poetry-core
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/python-i18n/default.nix b/pkgs/development/python-modules/python-i18n/default.nix
index d452cde8a0d7c..1ae07dfbec6d8 100644
--- a/pkgs/development/python-modules/python-i18n/default.nix
+++ b/pkgs/development/python-modules/python-i18n/default.nix
@@ -7,14 +7,20 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "danhper";
-    repo = pname;
+    repo = "python-i18n";
     rev = "v${version}";
     sha256 = "6FahoHZqaOWYGaT9RqLARCm2kLfUIlYuauB6+0eX7jA=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook pyyaml ];
+  # Replace use of deprecated assertRaisesRegexp
+  postPatch = ''
+    substituteInPlace i18n/tests/loader_tests.py \
+      --replace-fail assertRaisesRegexp assertRaisesRegex
+  '';
 
+  nativeCheckInputs = [ pytestCheckHook pyyaml ];
   pytestFlagsArray = [ "i18n/tests/run_tests.py" ];
+  pythonImportsCheck = [ "i18n" ];
 
   meta = with lib; {
     description = "Easy to use i18n library";
diff --git a/pkgs/development/python-modules/python-openems/default.nix b/pkgs/development/python-modules/python-openems/default.nix
index 8da6b87f8ba5d..c4b07b18cafa9 100644
--- a/pkgs/development/python-modules/python-openems/default.nix
+++ b/pkgs/development/python-modules/python-openems/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, cython
+, cython_0
 , openems
 , csxcad
 , boost
@@ -20,7 +19,7 @@ buildPythonPackage rec {
   sourceRoot = "${src.name}/python";
 
   nativeBuildInputs = [
-    cython
+    cython_0
     boost
   ];
 
diff --git a/pkgs/development/python-modules/python-rtmidi/default.nix b/pkgs/development/python-modules/python-rtmidi/default.nix
index 6265d95008109..9f073fd0a6ae7 100644
--- a/pkgs/development/python-modules/python-rtmidi/default.nix
+++ b/pkgs/development/python-modules/python-rtmidi/default.nix
@@ -7,7 +7,7 @@
 , CoreMIDI
 , CoreServices
 , Foundation
-, cython_3
+, cython
 , fetchPypi
 , flake8
 , libjack2
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     meson-python
     ninja
     pkg-config
diff --git a/pkgs/development/python-modules/python-zbar/0001-python-enum-fix-build-for-Python-3.11.patch b/pkgs/development/python-modules/python-zbar/0001-python-enum-fix-build-for-Python-3.11.patch
deleted file mode 100644
index 11b5541517905..0000000000000
--- a/pkgs/development/python-modules/python-zbar/0001-python-enum-fix-build-for-Python-3.11.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 64de7911d2938fc3601fec39c08008465b9d4f6f Mon Sep 17 00:00:00 2001
-From: Nick Cao <nickcao@nichi.co>
-Date: Tue, 7 Feb 2023 17:12:50 +0800
-Subject: [PATCH] python: enum: fix build for Python 3.11
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Python 3.9 introduced Py_SET_SIZE function to set size instead of
-relying on Py_SIZE() as a macro [3.9].
-
-Python 3.10 started to encourage to use Py_SET_SIZE instead of
-assigning into return value of Py_SIZE [3.10].
-
-Python 3.11 flips the switch, turn Py_SIZE into a function [3.11],
-thus Py_SIZE(obj) will be a rvalue. We need to use Py_SET_SIZE
-to set size now.
-
-[3.9]: https://docs.python.org/3.9/c-api/structures.html#c.Py_SET_SIZE
-[3.10]: https://docs.python.org/3.10/c-api/structures.html#c.Py_SIZE
-[3.11]: https://docs.python.org/3.11/c-api/structures.html#c.Py_SIZE
-
-Adapted from https://github.com/mchehab/zbar/pull/231
-
-Signed-off-by: Đoàn Trần Công Danh <congdanhqx@gmail.com>
-Signed-off-by: Nick Cao <nickcao@nichi.co>
----
- python/enum.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/python/enum.c b/python/enum.c
-index dfe1b1e..4833a20 100644
---- a/python/enum.c
-+++ b/python/enum.c
-@@ -52,7 +52,11 @@ enumitem_new (PyTypeObject *type,
- 
-     /* we assume the "fast path" for a single-digit ints (see longobject.c) */
-     /* this also holds if we get a small_int preallocated long */
-+#if PY_VERSION_HEX >= 0x030900A4
-+    Py_SET_SIZE(&self->val, Py_SIZE(longval));
-+#else
-     Py_SIZE(&self->val) = Py_SIZE(longval);
-+#endif
-     self->val.ob_digit[0] = longval->ob_digit[0];
-     Py_DECREF(longval);
- #else
-@@ -143,7 +147,11 @@ zbarEnumItem_New (PyObject *byname,
- 
-     /* we assume the "fast path" for a single-digit ints (see longobject.c) */
-     /* this also holds if we get a small_int preallocated long */
-+#if PY_VERSION_HEX >= 0x030900A4
-+    Py_SET_SIZE(&self->val, Py_SIZE(longval));
-+#else
-     Py_SIZE(&self->val) = Py_SIZE(longval);
-+#endif
-     self->val.ob_digit[0] = longval->ob_digit[0];
-     Py_DECREF(longval);
- 
--- 
-2.39.1
-
diff --git a/pkgs/development/python-modules/python-zbar/default.nix b/pkgs/development/python-modules/python-zbar/default.nix
index a7c28b2992d48..539823f064ac9 100644
--- a/pkgs/development/python-modules/python-zbar/default.nix
+++ b/pkgs/development/python-modules/python-zbar/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
+, setuptools
 , pillow
 , zbar
 , pytestCheckHook
@@ -9,7 +11,10 @@
 buildPythonPackage rec {
   pname = "python-zbar";
   version = "0.23.93";
-  format = "setuptools";
+  pyproject = true;
+
+  # distutils usage in setup.py
+  disabled = pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "mchehab";
@@ -18,23 +23,18 @@ buildPythonPackage rec {
     hash = "sha256-6gOqMsmlYy6TK+iYPIBsCPAk8tYDliZYMYeTOidl4XQ=";
   };
 
-  patches = [
-    # python: enum: fix build for Python 3.11
-    # https://github.com/mchehab/zbar/pull/231
-    # the patch is reworked as it does not cleanly apply
-    ./0001-python-enum-fix-build-for-Python-3.11.patch
-  ];
+  postPatch = ''
+    cd python
+  '';
 
-  propagatedBuildInputs = [ pillow ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pillow ];
 
   buildInputs = [ zbar ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  preBuild = ''
-    cd python
-  '';
-
   disabledTests = [
     #AssertionError: b'Y800' != 'Y800'
     "test_format"
@@ -42,6 +42,9 @@ buildPythonPackage rec {
     #Requires loading a recording device
     #zbar.SystemError: <zbar.Processor object at 0x7ffff615a680>
     "test_processing"
+    # Version too long?
+    # self.assertEqual(len(ver), 2)
+    "test_version"
   ];
 
   pythonImportsCheck = [ "zbar" ];
diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index a7270958387df..ce562e48ce549 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, cython
+, cython_0
 , setuptools
 , libyaml
 , python
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython
+    cython_0
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/pyzmq/default.nix b/pkgs/development/python-modules/pyzmq/default.nix
index 0493381718c16..51429d535df4a 100644
--- a/pkgs/development/python-modules/pyzmq/default.nix
+++ b/pkgs/development/python-modules/pyzmq/default.nix
@@ -4,7 +4,7 @@
 , isPyPy
 
 # build-system
-, cython_3
+, cython
 , setuptools
 , setuptools-scm
 , packaging
@@ -40,7 +40,7 @@ buildPythonPackage rec {
   ] ++ (if isPyPy then [
     cffi
   ] else [
-    cython_3
+    cython
   ]);
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/qtile-extras/default.nix b/pkgs/development/python-modules/qtile-extras/default.nix
index 198cbdcdddf31..84cc437e48ca4 100644
--- a/pkgs/development/python-modules/qtile-extras/default.nix
+++ b/pkgs/development/python-modules/qtile-extras/default.nix
@@ -1,50 +1,52 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, setuptools-scm
-, pytestCheckHook
-, xorgserver
-, imagemagick
-, gobject-introspection
-, pulseaudio
-, pytest-asyncio
-, pytest-lazy-fixture
-, qtile
-, keyring
-, requests
-, librsvg
-, gtk3
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  gobject-introspection,
+  gtk3,
+  imagemagick,
+  keyring,
+  librsvg,
+  pulseaudio,
+  pytest-asyncio,
+  pytest-lazy-fixture,
+  pytestCheckHook,
+  qtile,
+  requests,
+  setuptools-scm,
+  xorgserver,
 }:
 
 buildPythonPackage rec {
   pname = "qtile-extras";
   version = "0.25.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elParaguayo";
-    repo = pname;
+    repo = "qtile-extras";
     rev = "refs/tags/v${version}";
     hash = "sha256-OYzSKOVg4D5gKxaEreclYq3D16dl8ddLipSdifokDNY=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
+
+  dependencies = [ gtk3 ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-    xorgserver
-    imagemagick
     gobject-introspection
-  ];
-  checkInputs = [
+    imagemagick
+    keyring
+    pulseaudio
     pytest-asyncio
     pytest-lazy-fixture
+    pytestCheckHook
     qtile
-    pulseaudio
-    keyring
     requests
+    xorgserver
     # stravalib  # marked as broken due to https://github.com/stravalib/stravalib/issues/379
   ];
+
   disabledTests = [
     # Needs a running DBUS
     "test_brightness_power_saving"
@@ -55,12 +57,13 @@ buildPythonPackage rec {
     "test_wifiicon_internet_check"
     # Image difference is outside tolerance
     "test_decoration_output"
-    # Needs github token
+    # Needs Github token
     "test_githubnotifications_reload_token"
     # AttributeError: 'NoneType' object has no attribute 'theta'
     "test_image_size_horizontal"
     "test_image_size_vertical"
   ];
+
   disabledTestPaths = [
     # Needs a running DBUS
     "test/widget/test_iwd.py"
@@ -68,16 +71,13 @@ buildPythonPackage rec {
     # Marked as broken due to https://github.com/stravalib/stravalib/issues/379
     "test/widget/test_strava.py"
   ];
+
   preCheck = ''
     export HOME=$(mktemp -d)
     export GDK_PIXBUF_MODULE_FILE=${librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache
     sed -i 's#/usr/bin/sleep#sleep#' test/widget/test_snapcast.py
   '';
 
-  propagatedBuildInputs = [
-    gtk3
-  ];
-
   pythonImportsCheck = [ "qtile_extras" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/qtile/default.nix b/pkgs/development/python-modules/qtile/default.nix
index 9a3ecbafc049e..3067892e638ac 100644
--- a/pkgs/development/python-modules/qtile/default.nix
+++ b/pkgs/development/python-modules/qtile/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "qtile";
-  version = "0.24.0";
+  version = "0.25.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "qtile";
     repo = "qtile";
-    rev = "v${version}";
-    hash = "sha256-mgMRkoKT0Gp5/OfVQbkeDTkg9QRFn4PU3ziM5E6V+oI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-j5hpXfUSDUT9nBr6CafIzqdTYQxSWok+ZlQA7bGdVvk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/quart/default.nix b/pkgs/development/python-modules/quart/default.nix
index d0da424c9f672..515e4c9a324dc 100644
--- a/pkgs/development/python-modules/quart/default.nix
+++ b/pkgs/development/python-modules/quart/default.nix
@@ -26,7 +26,7 @@
 , mock
 , py
 , pytest-asyncio
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -76,7 +76,7 @@ buildPythonPackage rec {
     mock
     py
     pytest-asyncio
-    pytestCheckHook
+    pytest7CheckHook
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/qutip/default.nix b/pkgs/development/python-modules/qutip/default.nix
index 6c57c8f3c0767..d30759869cc8e 100644
--- a/pkgs/development/python-modules/qutip/default.nix
+++ b/pkgs/development/python-modules/qutip/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , cvxopt
 , cvxpy
-, cython
+, cython_0
 , fetchFromGitHub
 , ipython
 , matplotlib
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython
+    cython_0
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rangehttpserver/default.nix b/pkgs/development/python-modules/rangehttpserver/default.nix
index bab8f73b412b0..6fbcebbffed8e 100644
--- a/pkgs/development/python-modules/rangehttpserver/default.nix
+++ b/pkgs/development/python-modules/rangehttpserver/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
-, pytestCheckHook
+, pytest7CheckHook
 , requests
 }:
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
-    pytestCheckHook
+    pytest7CheckHook
     requests
   ];
 
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 6caf19c721abf..740389c8e0d6a 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 , fetchFromGitHub
 , cmake
-, cython_3
+, cython
 , ninja
 , scikit-build
 , setuptools
@@ -37,7 +37,7 @@ buildPythonPackage rec {
 
   build-system = [
     cmake
-    cython_3
+    cython
     ninja
     scikit-build
     setuptools
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index 20eb3df934d44..b11ff18fc9db2 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -13,7 +13,7 @@
 , click
 , click-plugins
 , cligj
-, cython_3
+, cython
 , gdal
 , hypothesis
 , ipython
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     '';
 
   nativeBuildInputs = [
-    cython_3
+    cython
     gdal
     numpy
     setuptools
diff --git a/pkgs/development/python-modules/razdel/default.nix b/pkgs/development/python-modules/razdel/default.nix
index 0c9ade3931f8c..519abbd734f44 100644
--- a/pkgs/development/python-modules/razdel/default.nix
+++ b/pkgs/development/python-modules/razdel/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     hash = "sha256-QzTA/f401OiIzw7YVJaMnfFPClR9+Qmnf0Y0+f/mJuY=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytest7CheckHook ];
   pytestFlagsArray = [ "razdel" ];
   pythonImportsCheck = [ "razdel" ];
 
diff --git a/pkgs/development/python-modules/rdflib/default.nix b/pkgs/development/python-modules/rdflib/default.nix
index cef9ea902bb65..d0f62efa6a78b 100644
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@@ -23,8 +23,7 @@
 # tests
 , pip
 , pytest-cov
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , setuptools
 }:
 
@@ -69,7 +68,7 @@ buildPythonPackage rec {
     pip
     pytest-cov
     # Failed: DID NOT WARN. No warnings of type (<class 'UserWarning'>,) were emitted.
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     setuptools
   ]
   ++ passthru.optional-dependencies.networkx
diff --git a/pkgs/development/python-modules/reproject/default.nix b/pkgs/development/python-modules/reproject/default.nix
index bbab3a462dbb0..ff6e3070cf7e0 100644
--- a/pkgs/development/python-modules/reproject/default.nix
+++ b/pkgs/development/python-modules/reproject/default.nix
@@ -4,7 +4,7 @@
 , astropy-healpix
 , buildPythonPackage
 , cloudpickle
-, cython_3
+, cython
 , dask
 , fetchPypi
 , fsspec
@@ -37,7 +37,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     astropy-extension-helpers
-    cython_3
+    cython
     numpy
     oldest-supported-numpy
     setuptools-scm
diff --git a/pkgs/development/python-modules/result/default.nix b/pkgs/development/python-modules/result/default.nix
index 3f15c2ce4c1a7..111c8dad2a306 100644
--- a/pkgs/development/python-modules/result/default.nix
+++ b/pkgs/development/python-modules/result/default.nix
@@ -2,18 +2,20 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pytest-asyncio
+, nix-update-script
 }:
 
 buildPythonPackage rec {
   pname = "result";
-  version = "0.7.0";
+  version = "0.16.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "rustedpy";
     repo = "result";
-     rev = "v${version}";
-    hash = "sha256-bEf3OJg6ksDvzZE7ezA58Q2FObb5V7BG8vkKtX284Jg=";
+    rev = "v${version}";
+    hash = "sha256-7BvFIQbl4Udd9GTpbMrAqP0P1BGn/C1CHQ3QUCEMXPs=";
   };
 
   postPatch = ''
@@ -28,19 +30,16 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-asyncio
   ];
 
-  disabledTestPaths = [
-    #TODO: figure out the failure "match o:" Invalid Syntax
-    "tests/test_pattern_matching.py"
-  ];
-
+  passthru.updateScript = nix-update-script {};
   pythonImportsCheck = [ "result" ];
 
   meta = with lib; {
     description = "A simple Result type for Python 3 inspired by Rust, fully type annotated";
     homepage = "https://github.com/rustedpy/result";
     license = licenses.mit;
-    maintainers = [];
+    maintainers = with lib.maintainers; [ emattiza ];
   };
 }
diff --git a/pkgs/development/python-modules/rpyc/default.nix b/pkgs/development/python-modules/rpyc/default.nix
index 9d3d66b46f25f..73c40ee23f79f 100644
--- a/pkgs/development/python-modules/rpyc/default.nix
+++ b/pkgs/development/python-modules/rpyc/default.nix
@@ -34,6 +34,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  preCheck = ''
+    export PYTHONPATH=$(pwd)/tests:$PYTHONPATH
+  '';
+
   disabledTests = [
     # Disable tests that requires network access
     "test_api"
diff --git a/pkgs/development/python-modules/rtmidi-python/default.nix b/pkgs/development/python-modules/rtmidi-python/default.nix
index 33f6ba217882b..462207a2fea45 100644
--- a/pkgs/development/python-modules/rtmidi-python/default.nix
+++ b/pkgs/development/python-modules/rtmidi-python/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, cython
+, cython_0
 , alsa-lib
 , CoreAudio
 , CoreMIDI
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     rm rtmidi_python.cpp
   '';
 
-  nativeBuildInputs = [ cython ];
+  nativeBuildInputs = [ cython_0 ];
   buildInputs = lib.optionals stdenv.isLinux [
     alsa-lib
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/rustworkx/default.nix b/pkgs/development/python-modules/rustworkx/default.nix
index b199defc2a080..69b231854995d 100644
--- a/pkgs/development/python-modules/rustworkx/default.nix
+++ b/pkgs/development/python-modules/rustworkx/default.nix
@@ -15,19 +15,19 @@
 
 buildPythonPackage rec {
   pname = "rustworkx";
-  version = "0.13.1";
+  version = "0.14.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    hash = "sha256-WwQuvRMDGiY9VrWPfxL0OotPCUhCsvbXoVSCNhmIF/g=";
+    hash = "sha256-gck5X6J4Yg5it/YCBsk/yZ5qXg/iwCEbyDIKfBTRxHM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
-    hash = "sha256-QuzBJyM83VtB6CJ7i9/SFE8h6JbxkX/LQ9lOFSQIidU=";
+    hash = "sha256-FNCa5pshcnsYpjlz6yDITe2k0cHLTybj3rF34qrsRVU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/scikit-fuzzy/default.nix b/pkgs/development/python-modules/scikit-fuzzy/default.nix
index 5ed9d994c0e02..03f10f129cbd5 100644
--- a/pkgs/development/python-modules/scikit-fuzzy/default.nix
+++ b/pkgs/development/python-modules/scikit-fuzzy/default.nix
@@ -1,22 +1,24 @@
 { lib
 , buildPythonPackage
-, pythonOlder
 , fetchFromGitHub
 , fetchpatch
+, pythonAtLeast
+, setuptools
 , matplotlib
 , networkx
 , nose
 , numpy
 , scipy
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
   pname = "scikit-fuzzy";
   version = "unstable-2022-11-07";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  # code depends on distutils
+  disabled = pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = pname;
@@ -44,11 +46,20 @@ buildPythonPackage rec {
     })
   ];
 
-  propagatedBuildInputs = [ networkx numpy scipy ];
-  nativeCheckInputs = [ matplotlib nose pytestCheckHook ];
+  build-system = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    networkx
+    numpy
+    scipy
+  ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+  nativeCheckInputs = [
+    matplotlib
+    nose
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [ "skfuzzy" ];
diff --git a/pkgs/development/python-modules/scikit-hep-testdata/default.nix b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
index b7571c828ab01..be99cd22b6abd 100644
--- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix
+++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "scikit-hep-testdata";
-  version = "0.4.43";
+  version = "0.4.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+CJyo6motrS89eDJct1zh6zOOrrw+yfAODA/BaVm00A=";
+    hash = "sha256-7a1F7180mnbMiEwRWzDQt2EhRsleSoVhWtTc+5DR/2o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index b6c703d7870d1..bbcb44de2c02a 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -2,9 +2,10 @@
 , lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 
 # build-system
-, cython_3
+, cython
 , gfortran
 , numpy
 , scipy
@@ -34,6 +35,14 @@ buildPythonPackage rec {
     hash = "sha256-k9PUlv8ZZUcPmXfQXl7DN2+x5jsQ5P2l450jwtiWmjA=";
   };
 
+  patches = [
+    (fetchpatch { # included in >= 1.4.2
+      name = "test_standard_scaler_dtype.patch";
+      url = "https://github.com/jeremiedbb/scikit-learn/commit/87c32d35eeb8f6f7fec63dc3d97d9c416545f053.diff";
+      hash = "sha256-iOBOoWHuWChCTnZ5go7MobPcHRGMChROpCI7V/5ik1Y=";
+    })
+  ];
+
   buildInputs = [
     pillow
     glibcLocales
@@ -46,7 +55,7 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    cython_3
+    cython
     numpy
     scipy
     setuptools
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 2870e5ec3bbd9..609c595eeb24a 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -10,13 +10,13 @@
 , cython
 , gfortran
 , meson-python
+, nukeReferences
 , pkg-config
 , pythran
 , wheel
 , setuptools
 , hypothesis
-, pytestCheckHook
-, pytest_7
+, pytest7CheckHook
 , pytest-xdist
 , numpy
 , pybind11
@@ -34,8 +34,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.12.0";
-  srcHash = "sha256-PuiyYTgSegDTV9Kae5N68FOXT1jyJrNv9p2aFP70Z20=";
+  version = "1.13.0";
+  srcHash = "sha256-HaYk92hOREHMOXppK+Bs9DrBu9KUVUsZ0KV+isTofUo=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
@@ -76,24 +76,28 @@ in buildPythonPackage {
         "doc/source/dev/contributor/meson_advanced.rst"
       ];
     })
-    (fetchpatch {
-      name = "openblas-0.3.26-compat.patch";
-      url = "https://github.com/scipy/scipy/commit/8c96a1f742335bca283aae418763aaba62c03378.patch";
-      hash = "sha256-SGoYDxwSAkr6D5/XEqHLerF4e4nmmI+PX+z+3taWAps=";
-    })
+    # Fix for https://github.com/scipy/scipy/issues/20300 until 1.13.1 is
+    # released. Patch is based upon:
+    # https://github.com/scipy/pocketfft/commit/9367142748fcc9696a1c9e5a99b76ed9897c9daa
+    # Couldn't use fetchpatch because it is a submodule of scipy, and
+    # extraPrefix doesn't fit this purpose.
+    ./pocketfft-aligned_alloc.patch
   ];
 
-  # Upstream complicated numpy version pinning is causing issues in the
-  # configurePhase, so we pass on it.
+  # Upstream says in a comment in their pyproject.toml that building against
+  # both numpy 2 and numpy 1 should work, but they seem to worry about numpy
+  # incompatibilities that we here with Nixpkgs' Python ecosystem, shouldn't
+  # experience.
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail 'numpy==' 'numpy>=' \
+      --replace-fail 'numpy>=2.0.0rc1,' 'numpy' \
   '';
 
   nativeBuildInputs = [
     cython
     gfortran
     meson-python
+    nukeReferences
     pythran
     pkg-config
     wheel
@@ -117,7 +121,7 @@ in buildPythonPackage {
   nativeCheckInputs = [
     hypothesis
     # Failed: DID NOT WARN. No warnings of type (<class 'DeprecationWarning'>, <class 'PendingDeprecationWarning'>, <class 'FutureWarning'>) were emitted.
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     pytest-xdist
   ];
 
@@ -166,6 +170,12 @@ in buildPythonPackage {
   #
   hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
 
+  # remove references to dev dependencies
+  postInstall = ''
+    nuke-refs $out/${python.sitePackages}/scipy/__config__.py
+    rm $out/${python.sitePackages}/scipy/__pycache__/__config__.*.opt-1.pyc
+  '';
+
   preCheck = ''
     export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
     cd $out
diff --git a/pkgs/development/python-modules/scipy/pocketfft-aligned_alloc.patch b/pkgs/development/python-modules/scipy/pocketfft-aligned_alloc.patch
new file mode 100644
index 0000000000000..80b047c7061c5
--- /dev/null
+++ b/pkgs/development/python-modules/scipy/pocketfft-aligned_alloc.patch
@@ -0,0 +1,30 @@
+From fbe3c10d117de98d80a86a10f76d4cd74efc55a8 Mon Sep 17 00:00:00 2001
+From: Martin Reinecke <martin@mpa-garching.mpg.de>
+Date: Fri, 22 Mar 2024 10:53:05 +0100
+Subject: [PATCH] unconditionaly disable use of aligned_alloc
+
+---
+ pocketfft_hdronly.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/scipy/_lib/pocketfft/pocketfft_hdronly.h b/scipy/_lib/pocketfft/pocketfft_hdronly.h
+index 6c98f2d..66eea06 100644
+--- a/scipy/_lib/pocketfft/pocketfft_hdronly.h
++++ b/scipy/_lib/pocketfft/pocketfft_hdronly.h
+@@ -152,11 +152,11 @@ template<> struct VLEN<double> { static constexpr size_t val=2; };
+ #endif
+ #endif
+ 
+-// the __MINGW32__ part in the conditional below works around the problem that
+-// the standard C++ library on Windows does not provide aligned_alloc() even
+-// though the MinGW compiler and MSVC may advertise C++17 compliance.
+-// aligned_alloc is only supported from MacOS 10.15.
+-#if (__cplusplus >= 201703L) && (!defined(__MINGW32__)) && (!defined(_MSC_VER)) && (__MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_15)
++// std::aligned_alloc is a bit cursed ... it doesn't exist on MacOS < 10.15
++// and in musl, and other OSes seem to have even more peculiarities.
++// Let's unconditionally work around it for now.
++# if 0
++//#if (__cplusplus >= 201703L) && (!defined(__MINGW32__)) && (!defined(_MSC_VER)) && (__MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_15)
+ inline void *aligned_alloc(size_t align, size_t size)
+   {
+   // aligned_alloc() requires that the requested size is a multiple of "align"
diff --git a/pkgs/development/python-modules/seabreeze/default.nix b/pkgs/development/python-modules/seabreeze/default.nix
index 24aa665bccfcc..119e36d663ef9 100644
--- a/pkgs/development/python-modules/seabreeze/default.nix
+++ b/pkgs/development/python-modules/seabreeze/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 
 # build-system
-, cython_3
+, cython
 , git
 , pkgconfig
 , setuptools
@@ -40,7 +40,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     git
     pkgconfig
     setuptools
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 0185f2ca24d28..46a2597ed1419 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "setuptools";
-  version = "69.1.1";
+  version = "69.2.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "setuptools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TWW8kW7ZjRsl5Y0CEVHqhIVJsiRixSSYe/ctSO1c/78=";
+    hash = "sha256-kll4zYFQn4g/8Fq0Y5vLvDXtotxYMbiNAgGa0sClFQk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/sfepy/default.nix b/pkgs/development/python-modules/sfepy/default.nix
index 676c2510f6b94..8e2c18fb1e625 100644
--- a/pkgs/development/python-modules/sfepy/default.nix
+++ b/pkgs/development/python-modules/sfepy/default.nix
@@ -1,5 +1,4 @@
-{ stdenv
-, lib
+{ lib
 , buildPythonPackage
 , fetchFromGitHub
 , numpy
@@ -7,7 +6,7 @@
 , matplotlib
 , pyparsing
 , tables
-, cython
+, cython_0
 , python
 , sympy
 , meshio
@@ -34,7 +33,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     numpy
-    cython
+    cython_0
     scipy
     matplotlib
     pyparsing
diff --git a/pkgs/development/python-modules/shapely/1.8.nix b/pkgs/development/python-modules/shapely/1.8.nix
index 0e1c3135ab997..4382ba93ec5e2 100644
--- a/pkgs/development/python-modules/shapely/1.8.nix
+++ b/pkgs/development/python-modules/shapely/1.8.nix
@@ -6,7 +6,7 @@
 , pythonOlder
 , substituteAll
 
-, cython
+, cython_0
 , geos_3_11
 , numpy
 , oldest-supported-numpy
@@ -44,7 +44,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython
+    cython_0
     geos_3_11 # for geos-config
     oldest-supported-numpy
     setuptools
diff --git a/pkgs/development/python-modules/shapely/default.nix b/pkgs/development/python-modules/shapely/default.nix
index 209cdf3dee6d6..28f2acdffb2d5 100644
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@@ -5,7 +5,7 @@
 , pytestCheckHook
 , pythonOlder
 
-, cython
+, cython_0
 , geos
 , numpy
 , oldest-supported-numpy
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython
+    cython_0
     geos # for geos-config
     oldest-supported-numpy
     setuptools
diff --git a/pkgs/development/python-modules/shlib/default.nix b/pkgs/development/python-modules/shlib/default.nix
index a29ba450df8d3..81ffccead0e44 100644
--- a/pkgs/development/python-modules/shlib/default.nix
+++ b/pkgs/development/python-modules/shlib/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, flit-core
 , pytestCheckHook
 , braceexpand
 , inform
@@ -9,7 +10,7 @@
 buildPythonPackage rec {
   pname = "shlib";
   version = "1.6";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "KenKundert";
@@ -18,18 +19,25 @@ buildPythonPackage rec {
     hash = "sha256-f2jJgpjybutCpYnIT+RihtoA1YlXdhTs+MvV8bViSMQ=";
   };
 
-  pythonImportsCheck = [ "shlib" ];
   postPatch = ''
     patchShebangs .
   '';
-  nativeCheckInputs = [
-    pytestCheckHook
+
+  build-system = [
+    flit-core
   ];
-  propagatedBuildInputs = [
+
+  dependencies = [
     braceexpand
     inform
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "shlib" ];
+
   meta = with lib; {
     description = "shell library";
     homepage = "https://github.com/KenKundert/shlib";
diff --git a/pkgs/development/python-modules/smart-open/default.nix b/pkgs/development/python-modules/smart-open/default.nix
index 53aa2d76f6aa4..b9622276bdf88 100644
--- a/pkgs/development/python-modules/smart-open/default.nix
+++ b/pkgs/development/python-modules/smart-open/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "smart-open";
-  version = "7.0.1";
+  version = "7.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "RaRe-Technologies";
     repo = "smart_open";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yGy4xNoHCE+LclBBTMVtTKP6GYZ5w09NJ0OmsUPnir4=";
+    hash = "sha256-4HOTaF6AKXGlVCvSGKnnaH73aa4IO0aRxz03XQ4gSd8=";
   };
 
   build-system = [
@@ -88,6 +88,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog =  "https://github.com/piskvorky/smart_open/releases/tag/v${version}";
     description = "Library for efficient streaming of very large file";
     homepage = "https://github.com/RaRe-Technologies/smart_open";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/smpp.pdu/default.nix b/pkgs/development/python-modules/smpp-pdu/default.nix
index 8860c4b2c531b..e320b7e242c64 100644
--- a/pkgs/development/python-modules/smpp.pdu/default.nix
+++ b/pkgs/development/python-modules/smpp-pdu/default.nix
@@ -10,7 +10,7 @@
 }:
 
 buildPythonPackage {
-  pname = "smpp.pdu";
+  pname = "smpp-pdu";
   version = "unstable-2022-09-02";
   format = "pyproject";
 
diff --git a/pkgs/development/python-modules/snorkel/default.nix b/pkgs/development/python-modules/snorkel/default.nix
index 8da4fd87d736c..04e605d14554b 100644
--- a/pkgs/development/python-modules/snorkel/default.nix
+++ b/pkgs/development/python-modules/snorkel/default.nix
@@ -16,7 +16,7 @@
 , pyspark
 , dill
 , dask
-, spacy_models
+, spacy-models
 }:
 let
   pname = "snorkel";
@@ -56,7 +56,7 @@ buildPythonPackage {
     pyspark
     dill
     dask
-    spacy_models.en_core_web_sm
+    spacy-models.en_core_web_sm
   ] ++ dask.optional-dependencies.distributed;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/soxr/default.nix b/pkgs/development/python-modules/soxr/default.nix
index b000900d3a7b4..7cd1cc0af6bc6 100644
--- a/pkgs/development/python-modules/soxr/default.nix
+++ b/pkgs/development/python-modules/soxr/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 
 # build-system
-, cython_3
+, cython
 , numpy
 , oldest-supported-numpy
 , setuptools
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython_3
+    cython
     gnutar
     numpy
     oldest-supported-numpy
diff --git a/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix b/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
index c9e1f3400f3a1..f2b4bfb3a068f 100644
--- a/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pytest, spacy_models }:
+{ stdenv, pytest, spacy-models }:
 
 stdenv.mkDerivation {
   name = "spacy-transformers-annotation-test";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   dontBuild = true;
   doCheck = true;
 
-  nativeCheckInputs = [ pytest spacy_models.en_core_web_trf ];
+  nativeCheckInputs = [ pytest spacy-models.en_core_web_trf ];
 
   checkPhase = ''
     pytest annotate.py
diff --git a/pkgs/development/python-modules/spacy/annotation-test/default.nix b/pkgs/development/python-modules/spacy/annotation-test/default.nix
index c7d5efe86641a..91ab0f33acaac 100644
--- a/pkgs/development/python-modules/spacy/annotation-test/default.nix
+++ b/pkgs/development/python-modules/spacy/annotation-test/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pytest, spacy_models }:
+{ stdenv, pytest, spacy-models }:
 
 stdenv.mkDerivation {
   name = "spacy-annotation-test";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   dontBuild = true;
   doCheck = true;
 
-  nativeCheckInputs = [ pytest spacy_models.en_core_web_sm ];
+  nativeCheckInputs = [ pytest spacy-models.en_core_web_sm ];
 
   checkPhase = ''
     pytest annotate.py
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index fa1c101ecb386..8e2bd3cb48707 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -123,7 +123,7 @@ buildPythonPackage rec {
       nix-update python3Packages.spacy
 
       # update spacy models as well
-      echo | nix-shell maintainers/scripts/update.nix --argstr package python3Packages.spacy_models.en_core_web_sm
+      echo | nix-shell maintainers/scripts/update.nix --argstr package python3Packages.spacy-models.en_core_web_sm
     '';
     tests.annotation = callPackage ./annotation-test { };
   };
diff --git a/pkgs/development/python-modules/sparse/default.nix b/pkgs/development/python-modules/sparse/default.nix
index 0c81e34350989..acb9bfa1d8fa2 100644
--- a/pkgs/development/python-modules/sparse/default.nix
+++ b/pkgs/development/python-modules/sparse/default.nix
@@ -4,7 +4,7 @@
 , fetchPypi
 , numba
 , numpy
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , setuptools
 , setuptools-scm
@@ -41,7 +41,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     dask
-    pytestCheckHook
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 56c626d4591d8..43b7ebcd99ee9 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , pythonOlder
 , fetchFromGitHub
 , isPyPy
@@ -27,7 +28,6 @@
 , sphinxcontrib-websupport
 
 # check phase
-, cython
 , filelock
 , html5lib
 , pytestCheckHook
@@ -83,7 +83,6 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
-    cython
     filelock
     html5lib
     pytestCheckHook
@@ -102,12 +101,15 @@ buildPythonPackage rec {
     "test_check_link_response_only"
     "test_anchors_ignored_for_url"
     "test_autodoc_default_options"
+    "test_too_many_requests_retry_after_int_delay"
     # racy with pytest-xdist
     "test_domain_cpp_build_semicolon"
     "test_class_alias"
     "test_class_alias_having_doccomment"
     "test_class_alias_for_imported_object_having_doccomment"
     "test_decorators"
+    # requires cython_0, but fails miserably on 3.11
+    "test_cython"
   ] ++ lib.optionals isPyPy [
     # PyPy has not __builtins__ which get asserted
     # https://doc.pypy.org/en/latest/cpython_differences.html#miscellaneous
@@ -117,10 +119,12 @@ buildPythonPackage rec {
     "test_autodoc_inherited_members_None"
     "test_automethod_for_builtin"
     "test_builtin_function"
-    "test_cython"
     "test_isattributedescriptor"
     "test_methoddescriptor"
     "test_partialfunction"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/sphinx-doc/sphinx/issues/12202 (Fixed in 7.3)
+    "test_enum_class"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/sqlmodel/default.nix b/pkgs/development/python-modules/sqlmodel/default.nix
index b371cd23e2487..8e657920dfb62 100644
--- a/pkgs/development/python-modules/sqlmodel/default.nix
+++ b/pkgs/development/python-modules/sqlmodel/default.nix
@@ -6,7 +6,7 @@
 , poetry-core
 , pydantic
 , pytest-asyncio
-, pytestCheckHook
+, pytest7CheckHook
 , pythonOlder
 , sqlalchemy
 }:
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     dirty-equals
     fastapi
     pytest-asyncio
-    pytestCheckHook
+    pytest7CheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/srpenergy/default.nix b/pkgs/development/python-modules/srpenergy/default.nix
index 35a937f960888..8d82ad614d0dc 100644
--- a/pkgs/development/python-modules/srpenergy/default.nix
+++ b/pkgs/development/python-modules/srpenergy/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , python-dateutil
 , requests
 , pytestCheckHook
@@ -9,19 +10,28 @@
 
 buildPythonPackage rec {
   pname = "srpenergy";
-  version = "1.3.6";
-  format = "setuptools";
+  version = "1.3.7";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "lamoreauxlab";
     repo = "srpenergy-api-client-python";
-    rev = version;
-    hash = "sha256-aZnqGtfklWgigac2gdkQv29Qy5HC34zGGY2iWr2cOMo=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bdBF5y9hRj4rceUD5qjHOM9TIaHGElJ36YjWCJgCzX8=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools==" "setuptools>="
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     python-dateutil
     requests
   ];
@@ -33,6 +43,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "srpenergy.client" ];
 
   meta = with lib; {
+    changelog = "https://github.com/lamoreauxlab/srpenergy-api-client-python/releases/tag/${version}";
     description = "Unofficial Python module for interacting with Srp Energy data";
     homepage = "https://github.com/lamoreauxlab/srpenergy-api-client-python";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/srsly/default.nix b/pkgs/development/python-modules/srsly/default.nix
index c3549ca3df024..be1871c0dd14e 100644
--- a/pkgs/development/python-modules/srsly/default.nix
+++ b/pkgs/development/python-modules/srsly/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, cython
+, cython_0
 , catalogue
 , mock
 , numpy
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython
+    cython_0
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 6ea82d9b02a2a..5bdc0c505a090 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchPypi
 
 # build-system
 , hatchling
@@ -18,7 +17,6 @@
 , httpx
 
 # tests
-, pytest
 , pytestCheckHook
 , pythonOlder
 , trio
@@ -29,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.37.1";
+  version = "0.37.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,7 +36,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = "starlette";
     rev = "refs/tags/${version}";
-    hash = "sha256-SJdBss1WKC30oulVTYUwUAJ8WM0KF5xbn/gvV97WM2g=";
+    hash = "sha256-GiCN1sfhLu9i19d2OcLZrlY8E64DFrFh+ITRSvLaxdE=";
   };
 
   nativeBuildInputs = [
@@ -60,18 +58,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    (pytestCheckHook.override {
-      # pytest 8 changes warning message
-      # see https://github.com/encode/starlette/commit/8da52c2243b8855426c40c16ae24b27734824078
-      pytest = pytest.overridePythonAttrs (old: rec {
-        version = "8.1.0";
-        src = fetchPypi {
-          pname = "pytest";
-          inherit version;
-          hash = "sha256-+PoEq4+Y0YUROuYOptecIvgUOxS8HK7O1EoKuESSgyM=";
-        };
-      });
-    })
+    pytestCheckHook
     trio
     typing-extensions
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
diff --git a/pkgs/development/python-modules/std-uritemplate/default.nix b/pkgs/development/python-modules/std-uritemplate/default.nix
index 0c26a135d0ef1..5b5d2faa301c7 100644
--- a/pkgs/development/python-modules/std-uritemplate/default.nix
+++ b/pkgs/development/python-modules/std-uritemplate/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "std-uritemplate";
-  version = "0.0.56";
+  version = "0.0.57";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "std_uritemplate";
     inherit version;
-    hash = "sha256-85dldY+2WB+Hn6fBBHoKJ7fIe7fDyddYxAjDD83lHGc=";
+    hash = "sha256-9K3HF67BOFYuZSuV2nT8aBWpQiMdlxMUhWuB9DTBuUw=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/taskw-ng/default.nix b/pkgs/development/python-modules/taskw-ng/default.nix
new file mode 100644
index 0000000000000..28c15922d2544
--- /dev/null
+++ b/pkgs/development/python-modules/taskw-ng/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, poetry-dynamic-versioning
+, kitchen
+, packaging
+, python-dateutil
+, pytz
+, taskwarrior
+}:
+
+buildPythonPackage rec {
+  pname = "taskw-ng";
+  version = "0.2.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "taskw-ng";
+    rev = "v${version}";
+    hash = "sha256-tlidTt0TzWnvfajYiIfvRv7OfakHY6zWAicmAwq/Z8w=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'pytz = "^2023.3.post1"' 'pytz = "*"'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+    poetry-dynamic-versioning
+  ];
+
+  propagatedBuildInputs = [
+    kitchen
+    packaging
+    python-dateutil
+    pytz
+  ];
+
+  checkInputs = [
+    taskwarrior
+  ];
+
+  # TODO: doesn't pass because `can_use` fails and `task --version` seems not to be answering.
+  # pythonImportsCheck = [ "taskw_ng" ];
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://github.com/bergercookie/taskw-ng";
+    changelog = "https://github.com/bergercookie/taskw-ng/blob/${src.rev}/CHANGELOG.rst";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/development/python-modules/taskw/default.nix b/pkgs/development/python-modules/taskw/default.nix
index 40acca5735e3b..36ac9293e1d4c 100644
--- a/pkgs/development/python-modules/taskw/default.nix
+++ b/pkgs/development/python-modules/taskw/default.nix
@@ -1,20 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, nose
-, tox
-, six
-, python-dateutil
+
+# build-system
+, setuptools
+
+# native dependencies
+, pkgs
+
+# dependencies
 , kitchen
-, pytestCheckHook
+, python-dateutil
 , pytz
-, pkgs
+
+# tests
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
   pname = "taskw";
   version = "2.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -31,11 +37,19 @@ buildPythonPackage rec {
       --replace '@@taskwarrior@@' '${pkgs.taskwarrior}'
   '';
 
+  build-system = [
+    setuptools
+  ];
+
   buildInputs = [ pkgs.taskwarrior ];
 
-  propagatedBuildInputs = [ six python-dateutil kitchen pytz ];
+  dependencies = [
+    kitchen
+    python-dateutil
+    pytz
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytest7CheckHook ];
 
   meta = with lib; {
     homepage =  "https://github.com/ralphbean/taskw";
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index ca7643127fb6c..14b7c5c2f8197 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1131";
+  version = "3.0.1132";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-7VhDVpBcW/uDOvwkCpB+dHrTa+fC7mu6UWuSbnymJgU=";
+    hash = "sha256-SMdevyChfbUMIY/KynIUE5T3bQAvD23QTW8lyA87kDE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/textnets/default.nix b/pkgs/development/python-modules/textnets/default.nix
index 2ba5ff7019194..399bc5288022a 100644
--- a/pkgs/development/python-modules/textnets/default.nix
+++ b/pkgs/development/python-modules/textnets/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , cairocffi
-, cython_3
+, cython
 , fetchPypi
 , igraph
 , leidenalg
@@ -34,7 +34,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pythonRelaxDepsHook
-    cython_3
+    cython
     poetry-core
     setuptools
   ];
diff --git a/pkgs/development/python-modules/thinc/default.nix b/pkgs/development/python-modules/thinc/default.nix
index db53985506897..b62c408a77fb1 100644
--- a/pkgs/development/python-modules/thinc/default.nix
+++ b/pkgs/development/python-modules/thinc/default.nix
@@ -9,7 +9,7 @@
 , CoreGraphics
 , CoreVideo
 , cymem
-, cython
+, cython_0
 , fetchPypi
 , hypothesis
 , mock
@@ -50,7 +50,7 @@ buildPythonPackage rec {
   ];
 
   buildInputs = [
-    cython
+    cython_0
   ] ++ lib.optionals stdenv.isDarwin [
     Accelerate
     CoreFoundation
diff --git a/pkgs/development/python-modules/timetagger/default.nix b/pkgs/development/python-modules/timetagger/default.nix
index b09d968716214..3edaa14529048 100644
--- a/pkgs/development/python-modules/timetagger/default.nix
+++ b/pkgs/development/python-modules/timetagger/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "timetagger";
-  version = "23.11.4";
+  version = "24.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-YzS69Sapwbg29usIz93hSEPiDjulFdCTeXbX4I8ZW+Q=";
+    hash = "sha256-Qt6VKExigzMaEb5ZEEPHCe5DSYdx5KPIfVC0khx7pP4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tokenizers/Cargo.lock b/pkgs/development/python-modules/tokenizers/Cargo.lock
index 295d232e6b38e..a0324bff8aba5 100644
--- a/pkgs/development/python-modules/tokenizers/Cargo.lock
+++ b/pkgs/development/python-modules/tokenizers/Cargo.lock
@@ -4,18 +4,18 @@ version = 3
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "anstream"
-version = "0.6.4"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab91ebe16eb252986481c5b62f6098f3b698a45e34b5b98200cf20dd2484a44"
+checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -27,43 +27,43 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.4"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "317b9a89c1868f5ea6ff1d9539a69f45dffc21ce321ac1fd1160dfa48c8e2140"
+checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
+checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.1"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0699d10d2f4d628a98ee7b57b289abbc98ff3bad977cb3152709d4bf2330628"
+checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
 dependencies = [
  "anstyle",
- "windows-sys 0.48.0",
+ "windows-sys",
 ]
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
 
 [[package]]
 name = "base64"
@@ -79,18 +79,15 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "libc",
-]
+checksum = "17f6e324229dc011159fcc089755d1e2e216a90d43a7dea6853ca740b84f35e7"
 
 [[package]]
 name = "cfg-if"
@@ -99,46 +96,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
-name = "clap"
-version = "4.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2275f18819641850fa26c89acc84d465c1bf91ce57bc2748b28c420473352f64"
-dependencies = [
- "clap_builder",
- "clap_derive",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07cdf1b148b25c1e1f7a42225e30a0d99a615cd4637eae7365548dd4529b95bc"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.39",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
-
-[[package]]
 name = "colorchoice"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -146,55 +103,47 @@ checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
 
 [[package]]
 name = "console"
-version = "0.15.7"
+version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c926e00cc70edefdc64d3a5ff31cc65bb97a3460097762bd23afb4d8145fccf8"
+checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
 dependencies = [
  "encode_unicode",
  "lazy_static",
  "libc",
  "unicode-width",
- "windows-sys 0.45.0",
+ "windows-sys",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
  "crossbeam-utils",
- "memoffset",
- "scopeguard",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "darling"
-version = "0.14.4"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b750cb3417fd1b327431a470f388520309479ab0bf5e323505daf0290cd3850"
+checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -202,65 +151,65 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.14.4"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "109c1ca6e6b7f82cc233a97004ea8ed7ca123a9af07a8230878fcfda9b158bf0"
+checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
  "strsim",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.14.4"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4aab4dbc9f7611d8b55048a3a16d2d010c2c8334e46304b40ac1cc14bf3b48e"
+checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
  "darling_core",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
 name = "derive_builder"
-version = "0.12.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d67778784b508018359cbc8696edb3db78160bab2c2a28ba7f56ef6932997f8"
+checksum = "0350b5cb0331628a5916d6c5c0b72e97393b8b6b03b47a9284f4e7f5a405ffd7"
 dependencies = [
  "derive_builder_macro",
 ]
 
 [[package]]
 name = "derive_builder_core"
-version = "0.12.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c11bdc11a0c47bc7d37d582b5285da6849c96681023680b906673c5707af7b0f"
+checksum = "d48cda787f839151732d396ac69e3473923d54312c070ee21e9effcaa8ca0b1d"
 dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
 name = "derive_builder_macro"
-version = "0.12.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebcda35c7a396850a55ffeac740804b40ffec779b98fffbb1738f4033f0ee79e"
+checksum = "206868b8242f27cecce124c19fd88157fbd0dd334df2587f36417bafbc85097b"
 dependencies = [
  "derive_builder_core",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
 name = "either"
-version = "1.9.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "encode_unicode"
@@ -269,26 +218,36 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
 
 [[package]]
+name = "env_filter"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a009aa4810eb158359dda09d0c87378e4bbb89b5a801f016885a4707ba24f7ea"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
 name = "env_logger"
-version = "0.10.1"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95b3f3e67048839cb0d0781f445682a35113da7121f7c949db0e2be96a4fbece"
+checksum = "38b35839ba51819680ba087cd351788c9a3c476841207e0b8cee0b04722343b9"
 dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
  "humantime",
- "is-terminal",
  "log",
- "regex",
- "termcolor",
 ]
 
 [[package]]
 name = "errno"
-version = "0.3.6"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c18ee0ed65a5f1f81cac6b1d213b69c35fa47d4252ad41f1486dbd8226fe36e"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
  "libc",
- "windows-sys 0.48.0",
+ "windows-sys",
 ]
 
 [[package]]
@@ -302,9 +261,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
 
 [[package]]
 name = "fnv"
@@ -314,9 +273,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "getrandom"
-version = "0.2.11"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -330,12 +289,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
-name = "hermit-abi"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
-
-[[package]]
 name = "humantime"
 version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -349,9 +302,9 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "indicatif"
-version = "0.17.7"
+version = "0.17.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb28741c9db9a713d93deb3bb9515c20788cef5815265bee4980e87bde7e0f25"
+checksum = "763a5a8f45087d6bcea4222e7b72c291a054edf80e4ef6efd2a4979878c7bea3"
 dependencies = [
  "console",
  "instant",
@@ -362,9 +315,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "1.0.9"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa799dd5ed20a7e349f3b4639aa80d74549c81716d9ec4f994c9b5815598306"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "instant"
@@ -376,30 +329,28 @@ dependencies = [
 ]
 
 [[package]]
-name = "is-terminal"
-version = "0.4.9"
+name = "itertools"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
 dependencies = [
- "hermit-abi",
- "rustix",
- "windows-sys 0.48.0",
+ "either",
 ]
 
 [[package]]
 name = "itertools"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
 dependencies = [
  "either",
 ]
 
 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "lazy_static"
@@ -409,15 +360,15 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.150"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.11"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "lock_api"
@@ -431,9 +382,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "macro_rules_attribute"
@@ -463,15 +414,15 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.6.4"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memoffset"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
 dependencies = [
  "autocfg",
 ]
@@ -484,9 +435,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "monostate"
-version = "0.1.9"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15f370ae88093ec6b11a710dec51321a61d420fafd1bad6e30d01bd9c920e8ee"
+checksum = "a20fffcd8ca4c69d31e036a71abc400147b41f90895df4edcb36497a1f8af8bf"
 dependencies = [
  "monostate-impl",
  "serde",
@@ -494,13 +445,13 @@ dependencies = [
 
 [[package]]
 name = "monostate-impl"
-version = "0.1.9"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "371717c0a5543d6a800cac822eac735aa7d2d2fbb41002e9856a4089532dbdce"
+checksum = "bf307cbbbd777a9c10cec88ddafee572b3484caad5cce0c9236523c3803105a6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn",
 ]
 
 [[package]]
@@ -528,28 +479,27 @@ dependencies = [
 
 [[package]]
 name = "num-complex"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
+checksum = "23c6602fda94a57c990fe0df199a035d83576b496aa29f4e634a8ac6004e68a6"
 dependencies = [
  "num-traits",
 ]
 
 [[package]]
 name = "num-integer"
-version = "0.1.45"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
 dependencies = [
- "autocfg",
  "num-traits",
 ]
 
 [[package]]
 name = "num-traits"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
 dependencies = [
  "autocfg",
 ]
@@ -562,9 +512,9 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
 
 [[package]]
 name = "numpy"
-version = "0.19.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "437213adf41bbccf4aeae535fbfcdad0f6fed241e1ae182ebe97fa1f3ce19389"
+checksum = "ec170733ca37175f5d75a5bea5911d6ff45d2cd52849ce98b685394e4f2f37f4"
 dependencies = [
  "libc",
  "ndarray",
@@ -577,9 +527,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "onig"
@@ -634,15 +584,15 @@ checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.27"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
 [[package]]
 name = "portable-atomic"
-version = "1.5.1"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bccab0e7fd7cc19f820a1c8c91720af652d0c88dc9664dd72aef2614f04af3b"
+checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
 
 [[package]]
 name = "ppv-lite86"
@@ -652,24 +602,25 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.69"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "pyo3"
-version = "0.19.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e681a6cfdc4adcc93b4d3cf993749a4552018ee0a9b65fc0ccfad74352c72a38"
+checksum = "a5e00b96a521718e08e03b1a622f01c8a8deb50719335de3f60b3b3950f069d8"
 dependencies = [
  "cfg-if",
  "indoc",
  "libc",
  "memoffset",
  "parking_lot",
+ "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
  "pyo3-macros",
@@ -678,9 +629,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.19.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "076c73d0bc438f7a4ef6fdd0c3bb4732149136abd952b110ac93e4edb13a6ba5"
+checksum = "7883df5835fafdad87c0d888b266c8ec0f4c9ca48a5bed6bbb592e8dedee1b50"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -688,9 +639,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.19.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e53cee42e77ebe256066ba8aa77eff722b3bb91f3419177cf4cd0f304d3284d9"
+checksum = "01be5843dc60b916ab4dad1dca6d20b9b4e6ddc8e15f50c47fe6d85f1fb97403"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -698,32 +649,34 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.19.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfeb4c99597e136528c6dd7d5e3de5434d1ceaf487436a3f03b2d56b6fc9efd1"
+checksum = "77b34069fc0682e11b31dbd10321cbf94808394c56fd996796ce45217dfac53c"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.19.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "947dc12175c254889edc0c02e399476c2f652b4b9ebd123aa655c224de259536"
+checksum = "08260721f32db5e1a5beae69a55553f56b99bd0e1c3e6e0a5e8851a9d0f5a85c"
 dependencies = [
+ "heck",
  "proc-macro2",
+ "pyo3-build-config",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -766,9 +719,9 @@ checksum = "60a357793950651c4ed0f3f52338f53b2f809f32d83a07f72909fa13e4c6c1e3"
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
  "either",
  "rayon-core",
@@ -781,15 +734,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "059f538b55efd2309c9794130bc149c6a553db90e9d99c2030785c82f0bd7df9"
 dependencies = [
  "either",
- "itertools",
+ "itertools 0.11.0",
  "rayon",
 ]
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
@@ -806,38 +759,32 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.10.2"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata",
- "regex-syntax 0.8.2",
+ "regex-syntax",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.4.3"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.2",
+ "regex-syntax",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "rustc-hash"
@@ -847,22 +794,22 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.38.23"
+version = "0.38.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffb93593068e9babdad10e4fce47dc9b3ac25315a72a59766ffd9e9a71996a04"
+checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.48.0",
+ "windows-sys",
 ]
 
 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
 name = "scopeguard"
@@ -872,29 +819,29 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.192"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bca2a08484b285dcb282d0f67b26cadc0df8b19f8c12502c13d966bf9482f001"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.192"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6c7207fbec9faa48073f3e3074cbe553af6ea512d7c21ba46e434e70ea9fbc1"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.108"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
  "itoa",
  "ryu",
@@ -903,9 +850,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.2"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "spm_precompiled"
@@ -927,20 +874,9 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.39"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
+checksum = "909518bc7b1c9b779f1bbf07f2929d35af9f0f37e47c6e9ef7f9dddc1e1821f3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -949,63 +885,52 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.12"
+version = "0.12.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c39fd04924ca3a864207c66fc2cd7d22d7c016007f9ce846cbb9326331930a"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
 
 [[package]]
 name = "tempfile"
-version = "3.8.1"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
 dependencies = [
  "cfg-if",
  "fastrand",
- "redox_syscall",
  "rustix",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff1bc3d3f05aff0403e8ac0d92ced918ec05b666a43f83297ccef5bea8a3d449"
-dependencies = [
- "winapi-util",
+ "windows-sys",
 ]
 
 [[package]]
 name = "thiserror"
-version = "1.0.50"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.50"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn",
 ]
 
 [[package]]
 name = "tokenizers"
-version = "0.15.0"
+version = "0.19.1-rc0"
 dependencies = [
  "aho-corasick",
- "clap",
  "derive_builder",
  "esaxx-rs",
  "getrandom",
  "indicatif",
- "itertools",
+ "itertools 0.12.1",
  "lazy_static",
  "log",
  "macro_rules_attribute",
@@ -1016,7 +941,7 @@ dependencies = [
  "rayon",
  "rayon-cond",
  "regex",
- "regex-syntax 0.7.5",
+ "regex-syntax",
  "serde",
  "serde_json",
  "spm_precompiled",
@@ -1028,10 +953,10 @@ dependencies = [
 
 [[package]]
 name = "tokenizers-python"
-version = "0.15.0"
+version = "0.19.1-rc0"
 dependencies = [
  "env_logger",
- "itertools",
+ "itertools 0.12.1",
  "libc",
  "ndarray",
  "numpy",
@@ -1061,9 +986,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
+checksum = "d4c87d22b6e3f4a18d4d40ef354e97c90fcb14dd91d7dc0aa9d8a1172ebf7202"
 
 [[package]]
 name = "unicode-width"
@@ -1079,9 +1004,9 @@ checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
 
 [[package]]
 name = "unindent"
-version = "0.1.11"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1766d682d402817b5ac4490b3c3002d91dfa0d22812f341609f97b08757359c"
+checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce"
 
 [[package]]
 name = "utf8parse"
@@ -1096,67 +1021,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
-[[package]]
 name = "windows-sys"
-version = "0.48.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.48.5",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -1175,10 +1045,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
+name = "windows-targets"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
+]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
@@ -1187,10 +1067,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
+name = "windows_aarch64_gnullvm"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -1199,10 +1079,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
+name = "windows_aarch64_msvc"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -1211,10 +1091,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
+name = "windows_i686_gnu"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -1223,10 +1109,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
+name = "windows_i686_msvc"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -1235,10 +1121,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
+name = "windows_x86_64_gnu"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -1247,13 +1133,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
+name = "windows_x86_64_gnullvm"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
diff --git a/pkgs/development/python-modules/tokenizers/default.nix b/pkgs/development/python-modules/tokenizers/default.nix
index a008e15b37048..057190bda9836 100644
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@@ -63,16 +63,16 @@ let
 in
 buildPythonPackage rec {
   pname = "tokenizers";
-  version = "0.15.0";
-  format = "pyproject";
+  version = "0.19.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "huggingface";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-+yfX12eKtgZV1OQvPOlMVTONbpFuigHcl4SjoCIZkSk=";
+    repo = "tokenizers";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-sKEAt46cdme821tzz9WSKnQb3hPmFJ4zvHgBNRxjEuk=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
@@ -97,7 +97,13 @@ buildPythonPackage rec {
     Security
   ];
 
-  propagatedBuildInputs = [
+  # Cargo.lock is outdated
+  # TODO: remove at next release
+  preConfigure = ''
+    cargo update --offline
+  '';
+
+  dependencies = [
     numpy
   ];
 
@@ -123,6 +129,8 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Downloads data using the datasets module
+    "test_encode_special_tokens"
+    "test_splitting"
     "TestTrainFromIterators"
     # Those tests require more data
     "test_from_pretrained"
diff --git a/pkgs/development/python-modules/toolz/default.nix b/pkgs/development/python-modules/toolz/default.nix
index ccec8644b070c..572e09a41f2fd 100644
--- a/pkgs/development/python-modules/toolz/default.nix
+++ b/pkgs/development/python-modules/toolz/default.nix
@@ -16,6 +16,11 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = [
+    # https://github.com/pytoolz/toolz/issues/577
+    "test_inspect_wrapped_property"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/pytoolz/toolz";
     description = "List processing tools and functional utilities";
diff --git a/pkgs/development/python-modules/torchsde/default.nix b/pkgs/development/python-modules/torchsde/default.nix
index bffbeeaa2c970..66e23a594f91f 100644
--- a/pkgs/development/python-modules/torchsde/default.nix
+++ b/pkgs/development/python-modules/torchsde/default.nix
@@ -13,7 +13,7 @@
 , trampoline
 
 # tests
-, pytestCheckHook
+, pytest7CheckHook
 }:
 
 buildPythonPackage rec {
@@ -49,11 +49,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "torchsde" ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+    pytest7CheckHook
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/traitlets/default.nix b/pkgs/development/python-modules/traitlets/default.nix
index 012347e2f76b4..68a50d620d447 100644
--- a/pkgs/development/python-modules/traitlets/default.nix
+++ b/pkgs/development/python-modules/traitlets/default.nix
@@ -34,6 +34,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # https://github.com/ipython/traitlets/issues/902
+    "test_complete_custom_completers"
+  ];
+
   disabledTestPaths = [
     # requires mypy-testing
     "tests/test_typing.py"
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index 620382cf9646a..d261337be26d0 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, setuptools
 # propagated build inputs
 , filelock
 , huggingface-hub
@@ -53,8 +54,8 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.39.3";
-  format = "setuptools";
+  version = "4.40.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -62,9 +63,13 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MJZvPbj9ypr6YwFGkzwCp9fVuM3vEGpeXK+gEIFzwRA=";
+    hash = "sha256-k0AloOG7fRQhTW8IF6uQSfav8p1KC5633SaLNYZrZ2M=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     filelock
     huggingface-hub
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 3ac3baf1525a9..abcc25faafdbe 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.3.0";
+  version = "4.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kUXi26NhFGS3liGaGHfm0HTRWXlnaIa80lxgLQ/0FyM=";
+    hash = "sha256-SFD+nZVNb90+UVdWmZwnGEGF21zKhE7mfFPn2HluizE=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 440a5db457ab6..5558ce327290d 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "9.0.4";
+  version = "9.0.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-3014wT7DXRlWvRxfqx/wIR9v9uX9QROQICDHXcgtOHs=";
+    hash = "sha256-q7tY44L8KA29HeoLBJf75Xp3IZSiT5DOkhtZ+7BD7Hg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/txtai/default.nix b/pkgs/development/python-modules/txtai/default.nix
index 4bf59621b5ca7..256ed0889bfe7 100644
--- a/pkgs/development/python-modules/txtai/default.nix
+++ b/pkgs/development/python-modules/txtai/default.nix
@@ -52,7 +52,7 @@
 , unittestCheckHook
 }:
 let
-  version = "7.0.0";
+  version = "7.1.0";
   api = [ aiohttp fastapi uvicorn ];
   # cloud = [ apache-libcloud ];
   console = [ rich ];
@@ -105,7 +105,7 @@ buildPythonPackage {
     owner = "neuml";
     repo = "txtai";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dYAzbdGEu9gAUzptuSfej6T5LPyTneRWigdAMlGgeqM=";
+    hash = "sha256-L+L2jRkCQKOgd1k3N4mft0Kt6kvCN81lgSQUjoon5rk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-psycopg2/default.nix b/pkgs/development/python-modules/types-psycopg2/default.nix
index 4dce98b9c3795..e9901ef6678d5 100644
--- a/pkgs/development/python-modules/types-psycopg2/default.nix
+++ b/pkgs/development/python-modules/types-psycopg2/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-psycopg2";
-  version = "2.9.21.20240311";
+  version = "2.9.21.20240417";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cilF3/pqcpvrxmDxQTfzft/OrVosFesjQhKn0BfugHI=";
+    hash = "sha256-Bdslb0pFn7IaQmuOf8oGVsNTkQX/Agjq9r2vQGo4cIc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/uamqp/default.nix b/pkgs/development/python-modules/uamqp/default.nix
index 334a4ce20e4bd..2881c8ef0d6b2 100644
--- a/pkgs/development/python-modules/uamqp/default.nix
+++ b/pkgs/development/python-modules/uamqp/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
-, cython
+, cython_0
 , certifi
 , CFNetwork
 , cmake
@@ -68,7 +68,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
-    cython
+    cython_0
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/uarray/default.nix b/pkgs/development/python-modules/uarray/default.nix
index 7429ed5750ac0..b6070cb8d9e16 100644
--- a/pkgs/development/python-modules/uarray/default.nix
+++ b/pkgs/development/python-modules/uarray/default.nix
@@ -2,43 +2,55 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
+, setuptools
+, setuptools-scm
 , matchpy
 , numpy
 , astunparse
 , typing-extensions
-, pytestCheckHook
+, pytest7CheckHook
 , pytest-cov
 }:
 
 buildPythonPackage rec {
   pname = "uarray";
-  version = "0.8.2";
-  format = "setuptools";
+  version = "0.8.8";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Quansight-Labs";
     repo = pname;
     rev = version;
-    sha256 = "1x2jp7w2wmn2awyv05xs0frpq0fa0rprwcxyg72wgiss0bnzxnhm";
+    hash = "sha256-wTKqOw64b+/kdZpSYLwCJATOuo807BWCtVHB4pH58fY=";
   };
 
-  patches = [(
-    # Fixes a compile error with newer versions of GCC -- should be included
-    # in the next release after 0.8.2
-    fetchpatch {
-      url = "https://github.com/Quansight-Labs/uarray/commit/a2012fc7bb94b3773eb402c6fe1ba1a894ea3d18.patch";
-      sha256 = "1qqh407qg5dz6x766mya2bxrk0ffw5h17k478f5kcs53g4dyfc3s";
-    }
-  )];
+  nativeBuildInputs = [ setuptools setuptools-scm ];
+  build-system = [
+    setuptools
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook pytest-cov ];
-  propagatedBuildInputs = [ matchpy numpy astunparse typing-extensions ];
+  dependencies = [
+    astunparse
+    matchpy
+    numpy
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    pytest7CheckHook
+    pytest-cov
+  ];
 
   # Tests must be run from outside the source directory
   preCheck = ''
     cd $TMP
   '';
-  pytestFlagsArray = ["--pyargs" "uarray" "-W" "ignore::pytest.PytestRemovedIn8Warning" ];
+
+  pytestFlagsArray = [
+    "--pyargs"
+    "uarray"
+  ];
+
   pythonImportsCheck = [ "uarray" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/uharfbuzz/default.nix b/pkgs/development/python-modules/uharfbuzz/default.nix
index 15c0d79984b21..b4ea16f1abd5e 100644
--- a/pkgs/development/python-modules/uharfbuzz/default.nix
+++ b/pkgs/development/python-modules/uharfbuzz/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, cython_3
+, cython
 , setuptools
 , setuptools-scm
 , pytestCheckHook
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     setuptools
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index 0527e90f2636f..25be1098eb9d2 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "unearth";
-  version = "0.15.1";
+  version = "0.15.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hj3rMznA1lpb4NCtLGfUbV9XSnmOdO8FUr8R0pijCrs=";
+    hash = "sha256-OB8+aWnbCyjZ/C+/shaGBXm/NBvWlUcvLGLivM6ebT0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/unidata-blocks/default.nix b/pkgs/development/python-modules/unidata-blocks/default.nix
index 1275543088d39..93857756bb651 100644
--- a/pkgs/development/python-modules/unidata-blocks/default.nix
+++ b/pkgs/development/python-modules/unidata-blocks/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "unidata-blocks";
-  version = "0.0.9";
+  version = "0.0.10";
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     pname = "unidata_blocks";
     inherit version;
-    hash = "sha256-OuIhajgUyO5qdcxJCO06Q1xNbeSNGzlbaWnAqXORm9g=";
+    hash = "sha256-wwiOjfIAx6AZtK98uuPQ0jwblq+CdnMQp+JkQWh+RgM=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/uuid/default.nix b/pkgs/development/python-modules/uuid/default.nix
deleted file mode 100644
index 571e79a862941..0000000000000
--- a/pkgs/development/python-modules/uuid/default.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi }:
-
-buildPythonPackage rec {
-  pname = "uuid";
-  version = "1.30";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0gqrjsm85nnkxkmd1vk8350wqj2cigjflnvcydk084n5980cr1qz";
-  };
-
-  meta = with lib; {
-    description = "UUID object and generation functions (Python 2.3 or higher)";
-    homepage = "http://zesty.ca/python/";
-  };
-}
diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index 9ee7fec919445..7aa551086869d 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -5,7 +5,7 @@
 , fetchPypi
 
 # build-system
-, cython
+, cython_0
 , setuptools
 
 # native dependencies
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython
+    cython_0
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/vine/default.nix b/pkgs/development/python-modules/vine/default.nix
index 033e50ba2c40f..46330ac4247bb 100644
--- a/pkgs/development/python-modules/vine/default.nix
+++ b/pkgs/development/python-modules/vine/default.nix
@@ -23,9 +23,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
+  disabledTestPaths = [
+    # https://github.com/celery/vine/issues/106
+    "t/unit/test_synchronization.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/vispy/default.nix b/pkgs/development/python-modules/vispy/default.nix
index 21d8c68e74383..e25133dfda5b6 100644
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , substituteAll
 , fetchPypi
-, cython_3
+, cython
 , fontconfig
 , freetype-py
 , hsluv
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    cython_3
+    cython
     oldest-supported-numpy
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
index 2db6ff91f9ed4..f8e2a8bd56936 100644
--- a/pkgs/development/python-modules/vt-py/default.nix
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -1,40 +1,42 @@
-{ lib
-, aiohttp
-, buildPythonPackage
-, fetchFromGitHub
-, pytest-asyncio
-, pytest-httpserver
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytest-asyncio,
+  pytest-httpserver,
+  pytestCheckHook,
+  pythonRelaxDepsHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "vt-py";
-  version = "0.18.0";
+  version = "0.18.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
-    repo = pname;
+    repo = "vt-py";
     rev = "refs/tags/${version}";
-    hash = "sha256-QEe/ZoKM0uVH7Yqpgo7V17Odn4xqdEgdQeMVB+57xbA=";
+    hash = "sha256-rWzANh7tkayFR6V3JaF3BLhIjUlnrPMmEmI36Ncqz2M=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "pytest-runner" ""
+      --replace-fail "pytest-runner" ""
   '';
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  pythonRelaxDeps = [ "aiohttp" ];
 
-  propagatedBuildInputs = [
-    aiohttp
-  ];
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [ aiohttp ];
 
   nativeCheckInputs = [
     pytest-asyncio
@@ -42,9 +44,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "vt"
-  ];
+  pythonImportsCheck = [ "vt" ];
 
   meta = with lib; {
     description = "Python client library for VirusTotal";
diff --git a/pkgs/development/python-modules/wikipedia2vec/default.nix b/pkgs/development/python-modules/wikipedia2vec/default.nix
index 12f7ef753a59e..2e379b9ccb1ef 100644
--- a/pkgs/development/python-modules/wikipedia2vec/default.nix
+++ b/pkgs/development/python-modules/wikipedia2vec/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , click
-, cython_3
+, cython
 , fetchFromGitHub
 , jieba
 , joblib
@@ -30,13 +30,13 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    cython_3
+    cython
     setuptools
   ];
 
   propagatedBuildInputs = [
     click
-    cython_3
+    cython
     jieba
     joblib
     lmdb
diff --git a/pkgs/development/python-modules/xmlschema/default.nix b/pkgs/development/python-modules/xmlschema/default.nix
index b8c8be9de2dcf..f03f00068600d 100644
--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "xmlschema";
-  version = "3.2.1";
+  version = "3.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "xmlschema";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jhof4C/jbMcvBRTLFdeFq2+ZucoDhbdcLE9IWvgzN0Y=";
+    hash = "sha256-kqaS6h0bJvJQoVa4L2qhkvuZsK4a6vtqek/wWN22R6I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index 6b8e17d2ed194..a0c75cd238567 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, cython_3
+, cython
 , expandvars
 , setuptools
 , idna
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    cython_3
+    cython
     expandvars
     setuptools
   ];
diff --git a/pkgs/development/python-modules/yowsup/default.nix b/pkgs/development/python-modules/yowsup/default.nix
index bc79ff51823f1..a88a296944a57 100644
--- a/pkgs/development/python-modules/yowsup/default.nix
+++ b/pkgs/development/python-modules/yowsup/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , isPy3k
 , fetchFromGitHub
 , appdirs
@@ -7,6 +8,7 @@
 , protobuf
 , python-axolotl
 , six
+, pyasyncore
 , pytestCheckHook
 }:
 
@@ -42,6 +44,9 @@ buildPythonPackage rec {
     protobuf
     python-axolotl
     six
+  ]
+  ++ lib.optionals (!pythonOlder "3.12") [
+    pyasyncore
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index 6ecbe58a996ac..bd00a51c3fa50 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -1,5 +1,5 @@
 { lib
-, cython_3
+, cython
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    cython_3
+    cython
     poetry-core
     setuptools
   ];
diff --git a/pkgs/development/r-modules/bioc-packages.nix b/pkgs/development/r-modules/bioc-packages.nix
index 818fa41a432f4..982c6b793749b 100644
--- a/pkgs/development/r-modules/bioc-packages.nix
+++ b/pkgs/development/r-modules/bioc-packages.nix
@@ -1730,7 +1730,7 @@ in with self; {
   multiHiCcompare = derive2 { name="multiHiCcompare"; version="1.20.0"; sha256="152h62f41r2lay2zpnllsfamy0m63w5bi5gnyy7q32rhmq9z2k3b"; depends=[aggregation BiocParallel data_table dplyr edgeR GenomeInfoDb GenomeInfoDbData GenomicRanges HiCcompare pbapply pheatmap qqman]; };
   multiMiR = derive2 { name="multiMiR"; version="1.24.0"; sha256="0mxih9nfjmgq3zd2c08ahwhnx3ahynj9phyrii6chllm3jcsfx15"; depends=[AnnotationDbi BiocGenerics dplyr purrr RCurl tibble XML]; };
   multiWGCNA = derive2 { name="multiWGCNA"; version="1.0.0"; sha256="1jp8amw31l45b2h9b138rmbzc43xx2swfs5pnlqladnnzwsbxvn3"; depends=[cowplot data_table dcanr dplyr flashClust ggalluvial ggplot2 ggrepel igraph patchwork readr reshape2 scales stringr SummarizedExperiment WGCNA]; };
-  multicrispr = derive2 { name="multicrispr"; version="1.12.3"; sha256="13ahvfxp5jkjrhdp3bz480h2k3m055brni22dbl3144f9lnyrw5b"; depends=[assertive_base assertive_files assertive_numbers assertive_sets BiocGenerics Biostrings BSgenome CRISPRseek data_table GenomeInfoDb GenomicFeatures GenomicRanges ggplot2 karyoploteR magrittr plyranges Rbowtie reticulate rtracklayer stringi tidyr tidyselect]; };
+  multicrispr = derive2 { name="multicrispr"; version="1.12.9"; sha256="1rqd4l7gh48kviy9r5g5v6iq36p1h3gid9f250ps3zygc809garm"; depends=[BiocGenerics Biostrings BSgenome CRISPRseek data_table GenomeInfoDb GenomicFeatures GenomicRanges ggplot2 karyoploteR magrittr plyranges Rbowtie reticulate rtracklayer stringi tidyr tidyselect]; };
   multiscan = derive2 { name="multiscan"; version="1.62.0"; sha256="09shs3hpa285v3hsbrncljxs02dm10qcbnnx9ss6b16gbs6d34wi"; depends=[Biobase]; };
   multtest = derive2 { name="multtest"; version="2.58.0"; sha256="0s8x2rg2xp6awg2cikybgxrxpi9f91jah7dskk5dnfkazd20di4j"; depends=[Biobase BiocGenerics MASS survival]; };
   mumosa = derive2 { name="mumosa"; version="1.10.0"; sha256="1mmhfy8lh1yd02vgw9bg32850sb5l875as8bv3xgq55c78ishlgv"; depends=[batchelor beachmat BiocGenerics BiocNeighbors BiocParallel BiocSingular DelayedArray DelayedMatrixStats igraph IRanges Matrix metapod S4Vectors ScaledMatrix scran scuttle SingleCellExperiment SummarizedExperiment uwot]; };
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index e2b2e7feea004..ecc3d2d66b428 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -313,9 +313,9 @@ let
 
   packagesWithNativeBuildInputs = {
     adbcpostgresql = [ pkgs.postgresql ];
-    arrow = [ pkgs.pkg-config pkgs.arrow-cpp ];
     adimpro = [ pkgs.imagemagick ];
     animation = [ pkgs.which ];
+    arrow = with pkgs; [ pkg-config cmake ] ++ lib.optionals stdenv.isDarwin [ intltool ];
     audio = [ pkgs.portaudio ];
     BayesSAE = [ pkgs.gsl ];
     BayesVarSel = [ pkgs.gsl ];
@@ -960,6 +960,7 @@ let
     "paxtoolsr"
     "systemPipeShiny"
     "matlab2r"
+    "GNOSIS"
   ];
 
   packagesToSkipCheck = [
@@ -1017,6 +1018,27 @@ let
   ];
 
   otherOverrides = old: new: {
+    # it can happen that the major version of arrow-cpp is ahead of the
+    # rPackages.arrow that would be built from CRAN sources; therefore, to avoid
+    # build failures and manual updates of the hash, we use the R source at
+    # the GitHub release state of libarrow (arrow-cpp) in Nixpkgs. This may
+    # not exactly represent the CRAN sources, but because patching of the
+    # CRAN R package is mostly done to meet special CRAN build requirements,
+    # this is a straightforward approach. Example where patching was necessary
+    # -> arrow 14.0.0.2 on CRAN; was lagging behind libarrow release:
+    #   https://github.com/apache/arrow/issues/39698 )
+    arrow = old.arrow.overrideAttrs (attrs: {
+      src = pkgs.arrow-cpp.src;
+      name = "r-arrow-${pkgs.arrow-cpp.version}";
+      prePatch = "cd r";
+      postPatch = ''
+        patchShebangs configure
+      '';
+      buildInputs = attrs.buildInputs ++ [
+        pkgs.arrow-cpp
+      ];
+    });
+
     gifski = old.gifski.overrideAttrs (attrs: {
       cargoDeps = pkgs.rustPlatform.fetchCargoTarball {
         src = attrs.src;
@@ -1331,6 +1353,10 @@ let
         '';
     });
 
+    rgoslin = old.rgoslin.overrideAttrs (attrs: {
+      patches = [ ./patches/rgoslin.patch ];
+    });
+
     rpanel = old.rpanel.overrideAttrs (attrs: {
       preConfigure = ''
         export TCLLIBPATH="${pkgs.bwidget}/lib/bwidget${pkgs.bwidget.version}"
@@ -1471,15 +1497,10 @@ let
     });
 
     SICtools = old.SICtools.overrideAttrs (attrs: {
-      preConfigure = ''
-        substituteInPlace src/Makefile --replace "-lcurses" "-lncurses"
-      '';
-    });
-
-    arrow = old.arrow.overrideAttrs (attrs: {
-      preConfigure = ''
-        patchShebangs configure
+      postPatch = ''
+        substituteInPlace src/Makefile --replace-fail "-lcurses" "-lncurses"
       '';
+      hardeningDisable = [ "format" ];
     });
 
     ROracle = old.ROracle.overrideAttrs (attrs: {
diff --git a/pkgs/development/r-modules/patches/rgoslin.patch b/pkgs/development/r-modules/patches/rgoslin.patch
new file mode 100644
index 0000000000000..4e17b69b383f1
--- /dev/null
+++ b/pkgs/development/r-modules/patches/rgoslin.patch
@@ -0,0 +1,12 @@
+diff --git a/src/cppgoslin/cppgoslin/domain/StringFunctions.h b/src/cppgoslin/cppgoslin/domain/StringFunctions.h
+index 70e8544..de5c040 100644
+--- a/src/cppgoslin/cppgoslin/domain/StringFunctions.h
++++ b/src/cppgoslin/cppgoslin/domain/StringFunctions.h
+@@ -35,6 +35,7 @@ SOFTWARE.
+ #include "cppgoslin/domain/Element.h"
+ #include <algorithm>
+ #include <cctype>
++#include <cstdint>
+ 
+ 
+ #define contains_val(X, Y) ((X).find(Y) != (X).end())
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index d0b7a1d22a458..e59941e805382 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.5.6";
-  source.sha256 = "sha256-Gh8h0UVuFt0v7pNGHZZANIBHqi3K9dd2h0pg3dTfXGQ=";
+  version = "2.5.7";
+  source.sha256 = "sha256-Df4EofDsE828V59yTND3+hdDfbB7iaQfWZfiC/SoNA4=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/analysis/binlore/default.nix b/pkgs/development/tools/analysis/binlore/default.nix
index e081f43a768fa..f8a88b4ce6793 100644
--- a/pkgs/development/tools/analysis/binlore/default.nix
+++ b/pkgs/development/tools/analysis/binlore/default.nix
@@ -1,7 +1,8 @@
 { lib
 , fetchFromGitHub
 , runCommand
-, pkgsBuildBuild
+, yallback
+, yara
 }:
 
 /* TODO/CAUTION:
@@ -29,8 +30,8 @@ let
   src = fetchFromGitHub {
     owner = "abathur";
     repo = "binlore";
-    rev = "v0.2.0";
-    hash = "sha256-bBJky7Km+mieHTqoMz3mda3KaKxr9ipYpfQqn/4w8J0=";
+    rev = "v0.3.0";
+    hash = "sha256-4Fs6HThfDhKRskuDJx2+hucl8crMRm10K6949JdIwPY=";
   };
   /*
   binlore has one one more yallbacks responsible for
@@ -58,7 +59,7 @@ let
     callback = lore: drv: overrides: ''
       if [[ -d "${drv}/bin" ]] || [[ -d "${drv}/lib" ]] || [[ -d "${drv}/libexec" ]]; then
         echo generating binlore for $drv by running:
-        echo "${pkgsBuildBuild.yara}/bin/yara --scan-list --recursive ${lore.rules} <(printf '%s\n' ${drv}/{bin,lib,libexec}) | ${pkgsBuildBuild.yallback}/bin/yallback ${lore.yallback}"
+        echo "${yara}/bin/yara --scan-list --recursive ${lore.rules} <(printf '%s\n' ${drv}/{bin,lib,libexec}) | ${yallback}/bin/yallback ${lore.yallback}"
       else
         echo "failed to generate binlore for $drv (none of ${drv}/{bin,lib,libexec} exist)"
       fi
@@ -83,7 +84,7 @@ let
         ((i--)) || true # don't break build
       done # || true # don't break build
       if [[ -d "${drv}/bin" ]] || [[ -d "${drv}/lib" ]] || [[ -d "${drv}/libexec" ]]; then
-        ${pkgsBuildBuild.yara}/bin/yara --scan-list --recursive ${lore.rules} <(printf '%s\n' ${drv}/{bin,lib,libexec}) | ${pkgsBuildBuild.yallback}/bin/yallback ${lore.yallback} "$filter"
+        ${yara}/bin/yara --scan-list --recursive ${lore.rules} <(printf '%s\n' ${drv}/{bin,lib,libexec}) | ${yallback}/bin/yallback ${lore.yallback} "$filter"
       fi
     '';
   };
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 543c5f2db195e..6d5832f810432 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.69";
+  version = "3.2.72";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-q2hiIceWxQXwJWLXBuA3V3weqcr634yKbc6/VgQFkcQ=";
+    hash = "sha256-DcheCxZ21/wEwC0dYoL546wXyp1yIIfLkWbjkS0iKC0=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index 0da5fcc9efbbb..00fd9b08b1e13 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cppcheck";
-  version = "2.13.4";
+  version = "2.14.0";
 
   outputs = [ "out" "man" ];
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "danmar";
     repo = "cppcheck";
     rev = finalAttrs.version;
-    hash = "sha256-Bz8ACCsxKfN1Y8TpS+oD/6lixLItL1TQR0Ud4gj1txk=";
+    hash = "sha256-w5k7WO2Kwx0ac/vP54ndPUp/AG6jG3MDf03h5z/+Cso=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/castxml/default.nix b/pkgs/development/tools/castxml/default.nix
index 0547df5d4cc50..bceafd504dccc 100644
--- a/pkgs/development/tools/castxml/default.nix
+++ b/pkgs/development/tools/castxml/default.nix
@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "castxml";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "CastXML";
     repo = "CastXML";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6xeMkqsFchZxrAsE2DLaIzGU4VMwyDckm00s69wahOo=";
+    hash = "sha256-r9Emh2KHjANrg+oWeY8Ags3Gd8k3W68J88bAud+AH6I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 5557c4db17e5f..bee71dc2aeae7 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -1,4 +1,5 @@
 { lib
+, channel ? "stable"
 , fetchurl
 , installShellFiles
 , makeBinaryWrapper
@@ -9,18 +10,33 @@
 
 let
   inherit (stdenvNoCC.hostPlatform) system;
+
+  channels = {
+    stable = {
+      version = "2.9.3";
+      hash = {
+        x86_64-linux = "sha256-6VS21x2egWBV6eJqRCBGG7mEGPIDFtY9GN6Ry4ilC70=";
+        x86_64-darwin = "sha256-UBUGjA+jUkT6p9714l8IvDDI/qhWNctVFOvcA2S5kQU=";
+        aarch64-linux = "sha256-2QAahqcM2gi3lT+18q2Nm9GNqVsqzX3RajBsTn+KB1c=";
+        aarch64-darwin = "sha256-uEH7Y7c9BcU/Q/jwx/inFMvUrgm2dUruID+FJL+rA6Y=";
+      };
+    };
+    mainline = {
+      version = "2.10.1";
+      hash = {
+        x86_64-linux = "sha256-jNPL30e5xvyajlIqivtEpSb3cRhfgFhLFlC+CaLY2IM=";
+        x86_64-darwin = "sha256-U1eQaYwnm/mdQoZ8YxK/+s3HboVfMIAtdI7aQnCiDM8=";
+        aarch64-linux = "sha256-YtSyKZYG8vdubZUfo2FjEoVwSF82TXzeLJjPpHqgFDk=";
+        aarch64-darwin = "sha256-aQSiXK7voP5/mPFIscfTnSc4Ae5/f+WW8MR6ZtuC/eY=";
+      };
+    };
+  };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "coder";
-  version = "2.9.1";
-
+  version = channels.${channel}.version;
   src = fetchurl {
-    hash = {
-      x86_64-linux = "sha256-r4+u/s/dOn2GhyhEROu8i03QY3VA/bIyO/Yj7KSqicY=";
-      x86_64-darwin = "sha256-uShCmMvb5OcinqP0CmrlP9QAJkjfG3g1QuHE4JRDOjE=";
-      aarch64-linux = "sha256-tvpzfJ95YYfCY5V4iayjAmY5PDw+1uHUhY5F3pv/2Uk=";
-      aarch64-darwin = "sha256-sP9HnB2DzAU9IvL3+QPmIFLvRkGkoxSoa68uXGQrNkw=";
-    }.${system};
+    hash = (channels.${channel}.hash).${system};
 
     url =
       let
diff --git a/pkgs/development/tools/coder/update.sh b/pkgs/development/tools/coder/update.sh
index cf6febe7d8230..ebd40e3d5adbf 100755
--- a/pkgs/development/tools/coder/update.sh
+++ b/pkgs/development/tools/coder/update.sh
@@ -5,12 +5,13 @@ set -eu -o pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/coder/coder/releases/latest | jq -r '.tag_name')
-LATEST_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')
+# Fetch the latest stable version
+LATEST_STABLE_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/coder/coder/releases/latest | jq -r '.tag_name')
+LATEST_STABLE_VERSION=$(echo ${LATEST_STABLE_TAG} | sed 's/^v//')
 
-# change version number
-sed -e "s/version =.*;/version = \"$LATEST_VERSION\";/g" \
-    -i ./default.nix
+# Fetch the latest mainline version
+LATEST_MAINLINE_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/coder/coder/releases | jq -r '.[0].tag_name')
+LATEST_MAINLINE_VERSION=$(echo ${LATEST_MAINLINE_TAG} | sed 's/^v//')
 
 # Define the platforms
 declare -A ARCHS=(["x86_64-linux"]="linux_amd64.tar.gz"
@@ -18,15 +19,33 @@ declare -A ARCHS=(["x86_64-linux"]="linux_amd64.tar.gz"
                   ["x86_64-darwin"]="darwin_amd64.zip"
                   ["aarch64-darwin"]="darwin_arm64.zip")
 
-# Update hashes for each architecture
-for ARCH in "${!ARCHS[@]}"; do
-  URL="https://github.com/coder/coder/releases/download/v${LATEST_VERSION}/coder_${LATEST_VERSION}_${ARCHS[$ARCH]}"
-  echo "Fetching hash for $ARCH..."
+update_version_and_hashes() {
+    local version=$1
+    local channel=$2
 
-  # Fetch the new hash using nix-prefetch-url
-  NEW_HASH=$(nix-prefetch-url --type sha256 $URL)
-  SRI_HASH=$(nix hash to-sri --type sha256 $NEW_HASH)
+    # Update version number, using '#' as delimiter
+    sed -i "/${channel} = {/,/};/{
+        s#^\(\s*\)version = .*#\1version = \"$version\";#
+    }" ./default.nix
 
-  # Update the Nix file with the new hash
-  sed -i "s|${ARCH} = \"sha256-.*\";|${ARCH} = \"${SRI_HASH}\";|" ./default.nix
-done
+    # Update hashes for each architecture
+    for ARCH in "${!ARCHS[@]}"; do
+        local URL="https://github.com/coder/coder/releases/download/v${version}/coder_${version}_${ARCHS[$ARCH]}"
+        echo "Fetching hash for $channel/$ARCH..."
+
+        # Fetch the new hash using nix-prefetch-url
+        local NEW_HASH=$(nix-prefetch-url --type sha256 $URL)
+        local SRI_HASH=$(nix hash to-sri --type sha256 $NEW_HASH)
+
+        # Update the Nix file with the new hash, using '#' as delimiter and preserving indentation
+        sed -i "/${channel} = {/,/};/{
+            s#^\(\s*\)${ARCH} = .*#\1${ARCH} = \"${SRI_HASH}\";#
+        }" ./default.nix
+    done
+}
+
+# Update stable channel
+update_version_and_hashes $LATEST_STABLE_VERSION "stable"
+
+# Update mainline channel
+update_version_and_hashes $LATEST_MAINLINE_VERSION "mainline"
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index 8fc481e1f5aed..be2f7f75229ad 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.115.3";
+  version = "0.116.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kO2RgT5Y3fvayiYSFZsiHNwmOpIrNvNuD3BzbvhNRvg=";
+    sha256 = "sha256-cij6Yw8UEPDHsm9Oy809PWxfPpbCGXUFRALKFH80pqM=";
   };
 
   vendorHash = "sha256-tkKxg08uL1vlOyD/tpRLzjHpOVWOmYZxcq8B+Q7/3Zo=";
diff --git a/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix b/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
index d252266f2377e..c9ec0cc84ad4d 100644
--- a/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
+++ b/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "codeberg-pages";
-  version = "4.6.2";
+  version = "5.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "Codeberg";
     repo = "pages-server";
-    rev = "ce241fa40adee2b12f8e225db98e09a45bc2acbb";
-    sha256 = "sha256-mL2Xs7eyldoZK4zrX6WFlFtwdLN0iVyl1Qh8X6b2u9c=";
+    rev = "ea68a82cd22a8a8c1f265260af22b9406f13e3a9";
+    hash = "sha256-TSXRB0oq1CtHC9ooO+Y3ICS5YE+q+ivZAcYBSd1oWi0=";
   };
 
-  vendorHash = "sha256-R/LuZkA2xHmu7SO3BVyK1C6n9U+pYn50kNkyLltn2ng=";
+  vendorHash = "sha256-vTYB3ka34VooN2Wh/Rcj+2S1qAsA2a/VtXlILn1W7oU=";
 
   patches = [ ./disable_httptest.patch ];
 
diff --git a/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch b/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch
index 2095b603badc3..90c815712d388 100644
--- a/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch
+++ b/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch
@@ -1,12 +1,13 @@
 diff --git a/server/handler/handler_test.go b/server/handler/handler_test.go
 deleted file mode 100644
-index 626564a..0000000
+index 6521633..0000000
 --- a/server/handler/handler_test.go
 +++ /dev/null
-@@ -1,49 +0,0 @@
+@@ -1,52 +0,0 @@
 -package handler
 -
 -import (
+-	"net/http"
 -	"net/http/httptest"
 -	"testing"
 -	"time"
@@ -24,13 +25,15 @@ index 626564a..0000000
 -		"https://docs.codeberg.org/pages/raw-content/",
 -		[]string{"/.well-known/acme-challenge/"},
 -		[]string{"raw.codeberg.org", "fonts.codeberg.org", "design.codeberg.org"},
+-		[]string{"pages"},
+-		cache.NewKeyValueCache(),
 -		cache.NewKeyValueCache(),
 -		cache.NewKeyValueCache(),
 -	)
 -
 -	testCase := func(uri string, status int) {
 -		t.Run(uri, func(t *testing.T) {
--			req := httptest.NewRequest("GET", uri, nil)
+-			req := httptest.NewRequest("GET", uri, http.NoBody)
 -			w := httptest.NewRecorder()
 -
 -			log.Printf("Start: %v\n", time.Now())
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index 169332f46647e..10f2d9faba12b 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchurl, common-updater-scripts, coreutils, git, gnused
-, makeWrapper, nix, nixfmt-classic, openjdk, writeScript, nixosTests, jq, cacert, curl
-}:
+, makeWrapper, nix, nixfmt-classic, openjdk, writeScript, nixosTests, jq, cacert
+, curl }:
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.440.2";
+  version = "2.440.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-gSZijp4vjuL4B9SJ7ApuN/yfXWuoT6jzcY5/PionMS4=";
+    hash = "sha256-+NR9v9WTWVUa6tg4j6StcAXtp8R84hxmTJlhDKBK42c=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index 922f3c081d5d2..38f5ba2f19e5c 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jShFLwoxZdUEHA+gd87n3R+faOdC6TboXuPvcZp89+Y=";
+    hash = "sha256-crn2FSJm7CSBg5TOcB5bJOsWqBrlwDoik7OS3HiCIGw=";
   };
 
-  vendorHash = "sha256-kBk2KhPDVYBGIUQpXq4ANA7WX+JUOxz7/Ad+4h2CD1c=";
+  vendorHash = "sha256-eFGQ59fdS+QQounT/byA0w9W+MK2Lhp+mlXAWWAtk6U=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index b452658e9fe96..110131532e604 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "3.0.4";
+  version = "3.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlfluff";
     repo = "sqlfluff";
     rev = "refs/tags/${version}";
-    hash = "sha256-C8xH7LMCVXeJerdp8skIsTBQHkz0pPVKgUG+tEwx5GI=";
+    hash = "sha256-jH6o1moyyugKtIIccp8Tbcg5EAMOxzNco9saUgoDzWY=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/development/tools/electron/binary/default.nix b/pkgs/development/tools/electron/binary/default.nix
index 4386c7fdf5bcf..41b3f1022e065 100644
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@@ -15,22 +15,22 @@ rec {
     headers = "009p1ffh2cyn98fcmprrjzq79jysp7h565v4f54wvjxjsq2nkr97";
   };
 
-  electron_27-bin = mkElectron "27.3.10" {
-    armv7l-linux = "bb739ce18a9e09225e8e0e1889cf1ab35fefda4ec7c2b60bdda271e58c921271";
-    aarch64-linux = "f1783e222074de33fea2188a86499d6a9d8b1aceec3bbd85a17913817a5bd356";
-    x86_64-linux = "dcfe17763071f1ec694155176f9156d625e6a69ccc32253b6576ca65111783c0";
-    x86_64-darwin = "5f469975f5ed68001dedc0383b94562c0a29e05b885427f20187625251cb83cb";
-    aarch64-darwin = "cb0e524b14f0f882a61cdcc46d7f3563ce115158501caaf2e8642f647c1eed6d";
-    headers = "12in54rg4dr8lh5dm9xx00w6cvbzgnylq7hjp2jwbj339xsgnqjz";
+  electron_27-bin = mkElectron "27.3.11" {
+    armv7l-linux = "012127a3edf79e0e4623a08e853286e1cba512438a0414b1ab19b75d929c1cf2";
+    aarch64-linux = "ddbfcd5e04450178ca4e3113f776893454822af6757761adc792692f7978e0df";
+    x86_64-linux = "e3a6f55e54e7a623bba1a15016541248408eef5a19ab82a59d19c807aab14563";
+    x86_64-darwin = "357e70a1c8848d4ac7655346bec98dd18a7c0cee82452a7edf76142017779049";
+    aarch64-darwin = "a687b199fcb9890f43af90ac8a4d19dc7b15522394de89e42abd5f5c6b735804";
+    headers = "0vrjdvqllfyz09sw2y078mds1di219hnmska8bw8ni7j35wxr2br";
   };
 
-  electron_28-bin = mkElectron "28.3.0" {
-    armv7l-linux = "aa74e7240929ebfa817d03e025e117f7a0600c99e6ad9bc339eaf22b0144a71c";
-    aarch64-linux = "9ec29245bcbbd0007029b4a3f7976b209968dbaa6443406afbf208b1a5abf094";
-    x86_64-linux = "e5003391ffc5161f6d9987ed29fa97532142544326f15fbf90ee43daabeba639";
-    x86_64-darwin = "7d6a0f6a7ec606d1caa0e63a99e4c6103a3fedb6e05735f81a03aa8da099a420";
-    aarch64-darwin = "a0eb07c006b593be8f76f7f6ad7cb8ac619ec173d341ad4c3ca5e52b38dab8b8";
-    headers = "12z94fz4zyypjkjx5l8n0qxd7r5jsny19i4ray60mn5cd7j019z8";
+  electron_28-bin = mkElectron "28.3.1" {
+    armv7l-linux = "2e22fbab2376a9bbeb8cbdd7d9bb3ca69fda6adeafa2b22ffb67157fcfcdb6ff";
+    aarch64-linux = "3e46c3076041386213f7b9ebc12335889fbad5822ffc306cf7514abb88de8512";
+    x86_64-linux = "e3be93e1a15d61f72e074aee021e12f20465b81f51b8c1170bd9072d7d695c3a";
+    x86_64-darwin = "bd8a220fd906625ad4a8edf92e80e8eff89d51f40c22168e05090daa7c12bd66";
+    aarch64-darwin = "53fc040cd09e955e013254f784cf51712029ded4a574559cf5fa19c9a911d75d";
+    headers = "07iv5fh0yxv17c1akb2j4ab5xhv29d9zsgi6dm2r0n4pnf72wxwr";
   };
 
   electron_29-bin = mkElectron "29.3.0" {
diff --git a/pkgs/development/tools/electron/common.nix b/pkgs/development/tools/electron/common.nix
index 19f0dd427023b..fd17d7aa35555 100644
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -13,7 +13,10 @@
 , unzip
 , pkgs
 , pkgsBuildHost
-
+, pipewire
+, libsecret
+, libpulseaudio
+, speechd
 , info
 }:
 
@@ -190,6 +193,23 @@ in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
     runHook postInstall
   '';
 
+  postFixup =
+    let
+      libPath = lib.makeLibraryPath [
+        libnotify
+        pipewire
+        stdenv.cc.cc.lib
+        libsecret
+        libpulseaudio
+        speechd
+      ];
+    in
+  base.postFixup + ''
+    patchelf \
+      --add-rpath "${libPath}" \
+      $out/libexec/electron/electron
+  '';
+
   requiredSystemFeatures = [ "big-parallel" ];
 
   passthru = {
@@ -216,7 +236,7 @@ in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
     homepage = "https://github.com/electron/electron";
     platforms = lib.platforms.linux;
     license = licenses.mit;
-    maintainers = with maintainers; [ yuka ];
+    maintainers = with maintainers; [ yayayayaka yuka ];
     mainProgram = "electron";
     hydraPlatforms = lib.optionals (!(hasInfix "alpha" info.version) && !(hasInfix "beta" info.version)) ["aarch64-linux" "x86_64-linux"];
     timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index 67708aa5d43be..0304f0bbec437 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -3,10 +3,10 @@
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-AHiOejVRSeJ14Xn+A6yjfICbERDPr/eCbBq+2qPjGDc=",
+                "hash": "sha256-Y0uNoq5LhlFMxQfqrTjzOokbB7Y6UUAlBCj+Nghiz5w=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v28.3.0"
+                "rev": "v28.3.1"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -873,7 +873,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "28.3.0",
+        "version": "28.3.1",
         "modules": "119",
         "chrome": "120.0.6099.291",
         "node": "18.18.2",
@@ -895,10 +895,10 @@
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-vCM74wty0JN4PL9snwa4oFbNebA3cMZ8lorXz5DIVcE=",
+                "hash": "sha256-DmDAKUUyiDASGGylDVQe2OkDVfiA1ficDG+oaMbKqdo=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v27.3.10"
+                "rev": "v27.3.11"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -1765,7 +1765,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "27.3.10",
+        "version": "27.3.11",
         "modules": "118",
         "chrome": "118.0.5993.159",
         "node": "18.17.1",
diff --git a/pkgs/development/tools/go-minimock/default.nix b/pkgs/development/tools/go-minimock/default.nix
index 279004b9c8c71..10010fa822237 100644
--- a/pkgs/development/tools/go-minimock/default.nix
+++ b/pkgs/development/tools/go-minimock/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "go-minimock";
-  version = "3.3.6";
+  version = "3.3.7";
 
   src = fetchFromGitHub {
     owner = "gojuno";
     repo = "minimock";
     rev = "v${version}";
-    sha256 = "sha256-ru3+MJ1GbzVDi6niiz7SpL0qa9mE89uhcH5/PHbVugE=";
+    sha256 = "sha256-jwQT3JmVFS7e6wr+hCFLlA1YhiKdTrMai0RfClJafJQ=";
   };
 
   ldflags = [
     "-s" "-w" "-X main.version=${version}"
   ];
 
-  vendorHash = "sha256-eCM/EDdXZSa+pg35V6YiZ5gaC4rj8Wt8HhCgaMPoP+Y=";
+  vendorHash = "sha256-vcYhLMs/skZlhzdeEWUcv28VkRvraavziBwbwrgLZio=";
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/infisical/default.nix b/pkgs/development/tools/infisical/default.nix
index f19b021ed3a3b..849144616f927 100644
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@@ -15,7 +15,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.20.1";
+  version = "0.21.1";
 
   # the platform-specific, statically linked binary
   src =
diff --git a/pkgs/development/tools/infisical/hashes.json b/pkgs/development/tools/infisical/hashes.json
index 6b23b59dbf979..728568f1ee1ac 100644
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-W5k/xGL6R4ox9XQShWl2PqpvbJYIqeM4Qx3bG+5HpAo="
-, "x86_64-darwin": "sha256-sFGKUh4qkj5EZ5NE6wQqO2TAmHuMH4qgcdJlx92ygr8="
-, "aarch64-linux": "sha256-t80Nt1YXwmcjagZRaPgXH4m7D5sKhwLz9YcX6cOArRQ="
-, "aarch64-darwin": "sha256-INNcqrCy5px9vwh6yM03baSgj2uHgPrbKAatGl84R5M="
+, "x86_64-linux": "sha256-HdjqoT+iDYwQQlNZIPcC4j76bCh1k1+Axz46Hq2FNoE="
+, "x86_64-darwin": "sha256-X3QXlW0yqYuc3MLYesxNiWGz79r/fHO0mdwyZ3DyPKU="
+, "aarch64-linux": "sha256-osy/9dhSme4dyVeBWGjwfMt0YJVPLwV7rYu6ePkhFOs="
+, "aarch64-darwin": "sha256-O/F2xErHSFfeK6mamjFDstHW1yBpnfl/slWa1hQ159s="
 }
diff --git a/pkgs/development/tools/kubeswitch/default.nix b/pkgs/development/tools/kubeswitch/default.nix
index 64701124a1593..470fdac9b3c22 100644
--- a/pkgs/development/tools/kubeswitch/default.nix
+++ b/pkgs/development/tools/kubeswitch/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kubeswitch";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "danielfoehrKn";
     repo = "kubeswitch";
     rev = version;
-    hash = "sha256-0SY7JLFkhLEFcE1veqac9I9DZstXfxtnmSYIdDiVieg=";
+    hash = "sha256-cvMTuiXSpx+ZicN1P3JjGExzW7d51nN1YIpsGArXHzw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/language-servers/ccls/default.nix b/pkgs/development/tools/language-servers/ccls/default.nix
index 078d9129f58a2..c2e6ed7a0ea54 100644
--- a/pkgs/development/tools/language-servers/ccls/default.nix
+++ b/pkgs/development/tools/language-servers/ccls/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ccls";
-  version = "0.20230717";
+  version = "0.20240202";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
     rev = version;
-    sha256 = "sha256-u499fHd2lyqOYXJApFdiIXHQGF+QEVlQ4E8jm5VMb3w=";
+    sha256 = "sha256-xVx3+cnmIdoA7R1S31EaiPj+DOTqkINoQeMgauW61Ys=";
   };
 
   nativeBuildInputs = [ cmake llvmPackages.llvm.dev ];
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index 42d13fcbb320d..7e1d1d6305991 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "3.15.0";
+  version = "3.15.1";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    hash = "sha256-tcPRD29gSL+vVvxPCULVY4G1WvQofK+CUUh9TE55INc=";
+    hash = "sha256-tbeKSgLU3QiUI02/cYv/R3/Nheff3/6OzgC5oM89VHs=";
   };
 
   nativeBuildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/parsing/re-flex/default.nix b/pkgs/development/tools/parsing/re-flex/default.nix
index 3a69cb18803c2..2f989d9bfb1e5 100644
--- a/pkgs/development/tools/parsing/re-flex/default.nix
+++ b/pkgs/development/tools/parsing/re-flex/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re-flex";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = "RE-flex";
     rev = "v${version}";
-    hash = "sha256-+/Q3lcdV4tEArYmuQN5iL6r5TS0J/zoLQ85bNazpSf8=";
+    hash = "sha256-tWV7HnIeTao3IbT2xxsu+//4aLQLKP/+ySqrvzU139c=";
   };
 
   outputs = [ "out" "bin" "dev" ];
diff --git a/pkgs/development/tools/parsing/tree-sitter/Cargo.lock b/pkgs/development/tools/parsing/tree-sitter/Cargo.lock
deleted file mode 100644
index bbd2be01932a6..0000000000000
--- a/pkgs/development/tools/parsing/tree-sitter/Cargo.lock
+++ /dev/null
@@ -1,1935 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "ahash"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91429305e9f0a25f6205c5b8e0d2db09e0708a7a6df0f42212bb56c32c8ac97a"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
-[[package]]
-name = "aho-corasick"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "ansi_term"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.75"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
-
-[[package]]
-name = "arbitrary"
-version = "1.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2e1373abdaa212b704512ec2bd8b26bd0b7d5c3f70117411a5d9a451383c859"
-
-[[package]]
-name = "ascii"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "bindgen"
-version = "0.66.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b84e06fc203107bfbad243f4aba2af864eb7db3b1cf46ea0a023b0b433d2a7"
-dependencies = [
- "bitflags 2.4.1",
- "cexpr",
- "clang-sys",
- "lazy_static",
- "lazycell",
- "log",
- "peeking_take_while",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash",
- "shlex",
- "syn 2.0.38",
- "which",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
-
-[[package]]
-name = "bumpalo"
-version = "3.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
-
-[[package]]
-name = "bytes"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
-
-[[package]]
-name = "cc"
-version = "1.0.83"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "cesu8"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
-
-[[package]]
-name = "cexpr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-dependencies = [
- "nom",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "chunked_transfer"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cca491388666e04d7248af3f60f0c40cfb0991c72205595d7c396e3510207d1a"
-
-[[package]]
-name = "clang-sys"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c688fc74432808e3eb684cae8830a86be1d66a2bd58e1f248ed0960a590baf6f"
-dependencies = [
- "glob",
- "libc",
- "libloading",
-]
-
-[[package]]
-name = "clap"
-version = "2.34.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
-dependencies = [
- "ansi_term",
- "atty",
- "bitflags 1.3.2",
- "strsim",
- "textwrap",
- "unicode-width",
- "vec_map",
-]
-
-[[package]]
-name = "combine"
-version = "4.6.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35ed6e9d84f0b51a7f52daf1c7d71dd136fd7a3f41a8462b8cdb8c78d920fad4"
-dependencies = [
- "bytes",
- "memchr",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
-
-[[package]]
-name = "cranelift-bforest"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "cranelift-entity",
-]
-
-[[package]]
-name = "cranelift-codegen"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "bumpalo",
- "cranelift-bforest",
- "cranelift-codegen-meta",
- "cranelift-codegen-shared",
- "cranelift-control",
- "cranelift-entity",
- "cranelift-isle",
- "gimli",
- "hashbrown 0.14.2",
- "log",
- "regalloc2",
- "smallvec",
- "target-lexicon",
-]
-
-[[package]]
-name = "cranelift-codegen-meta"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "cranelift-codegen-shared",
-]
-
-[[package]]
-name = "cranelift-codegen-shared"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-
-[[package]]
-name = "cranelift-control"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "arbitrary",
-]
-
-[[package]]
-name = "cranelift-entity"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "serde",
- "serde_derive",
-]
-
-[[package]]
-name = "cranelift-frontend"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "cranelift-codegen",
- "log",
- "smallvec",
- "target-lexicon",
-]
-
-[[package]]
-name = "cranelift-isle"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-
-[[package]]
-name = "cranelift-native"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "cranelift-codegen",
- "libc",
- "target-lexicon",
-]
-
-[[package]]
-name = "cranelift-wasm"
-version = "0.102.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "cranelift-codegen",
- "cranelift-entity",
- "cranelift-frontend",
- "itertools",
- "log",
- "smallvec",
- "wasmparser",
- "wasmtime-types",
-]
-
-[[package]]
-name = "crc32fast"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "ctor"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37e366bff8cd32dd8754b0991fb66b279dc48f598c3a18914852a6673deef583"
-dependencies = [
- "quote",
- "syn 2.0.38",
-]
-
-[[package]]
-name = "ctrlc"
-version = "3.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82e95fbd621905b854affdc67943b043a0fbb6ed7385fd5a25650d19a8a6cfdf"
-dependencies = [
- "nix",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "diff"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
-
-[[package]]
-name = "difference"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524cbf6897b527295dff137cec09ecf3a05f4fddffd7dfcd1585403449e74198"
-
-[[package]]
-name = "dirs"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
-dependencies = [
- "dirs-sys 0.3.7",
-]
-
-[[package]]
-name = "dirs"
-version = "5.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
-dependencies = [
- "dirs-sys 0.4.1",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
-dependencies = [
- "libc",
- "option-ext",
- "redox_users",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "either"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
-
-[[package]]
-name = "equivalent"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
-
-[[package]]
-name = "errno"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860"
-dependencies = [
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
-[[package]]
-name = "fastrand"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "gimli"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
-dependencies = [
- "fallible-iterator",
- "indexmap",
- "stable_deref_trait",
-]
-
-[[package]]
-name = "glob"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
-
-[[package]]
-name = "hashbrown"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e"
-dependencies = [
- "ahash",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.14.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93e7192158dbcda357bdec5fb5788eebf8bbac027f3f33e719d29135ae84156"
-dependencies = [
- "ahash",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "home"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb"
-dependencies = [
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "html-escape"
-version = "0.2.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d1ad449764d627e22bfd7cd5e8868264fc9236e07c752972b4080cd351cb476"
-dependencies = [
- "utf8-width",
-]
-
-[[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
-name = "idna"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
-dependencies = [
- "equivalent",
- "hashbrown 0.14.2",
- "serde",
-]
-
-[[package]]
-name = "indoc"
-version = "2.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
-
-[[package]]
-name = "itertools"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
-
-[[package]]
-name = "jni"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
-dependencies = [
- "cesu8",
- "cfg-if",
- "combine",
- "jni-sys",
- "log",
- "thiserror",
- "walkdir",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "jni-sys"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
-
-[[package]]
-name = "js-sys"
-version = "0.3.64"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
-dependencies = [
- "wasm-bindgen",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
-[[package]]
-name = "leb128"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
-
-[[package]]
-name = "libc"
-version = "0.2.149"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
-
-[[package]]
-name = "libloading"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
-
-[[package]]
-name = "log"
-version = "0.4.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
-
-[[package]]
-name = "mach"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b823e83b2affd8f40a9ee8c29dbc56404c1e34cd2710921f2801e2cf29527afa"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "malloc_buf"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "memchr"
-version = "2.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
-
-[[package]]
-name = "memfd"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2cffa4ad52c6f791f4f8b15f0c05f9824b2ced1160e88cc393d64fff9a8ac64"
-dependencies = [
- "rustix",
-]
-
-[[package]]
-name = "memoffset"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
-[[package]]
-name = "ndk-context"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
-
-[[package]]
-name = "nix"
-version = "0.27.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
-dependencies = [
- "bitflags 2.4.1",
- "cfg-if",
- "libc",
-]
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
-[[package]]
-name = "objc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
-dependencies = [
- "malloc_buf",
-]
-
-[[package]]
-name = "object"
-version = "0.32.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
-dependencies = [
- "crc32fast",
- "hashbrown 0.14.2",
- "indexmap",
- "memchr",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
-
-[[package]]
-name = "option-ext"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
-
-[[package]]
-name = "paste"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
-
-[[package]]
-name = "path-slash"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e91099d4268b0e11973f036e885d652fb0b21fedcf69738c627f94db6a44f42"
-
-[[package]]
-name = "peeking_take_while"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
-
-[[package]]
-name = "ppv-lite86"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
-
-[[package]]
-name = "pretty_assertions"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af7cee1a6c8a5b9208b3cb1061f10c0cb689087b3d8ce85fb9d2dd7a29b6ba66"
-dependencies = [
- "diff",
- "yansi",
-]
-
-[[package]]
-name = "prettyplease"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae005bd773ab59b4725093fd7df83fd7892f7d8eafb48dbd7de6e024e4215f9d"
-dependencies = [
- "proc-macro2",
- "syn 2.0.38",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "psm"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5787f7cda34e3033a72192c018bc5883100330f362ef279a8cbccfce8bb4e874"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rand"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
-dependencies = [
- "libc",
- "rand_chacha",
- "rand_core",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom",
-]
-
-[[package]]
-name = "raw-window-handle"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ff9a1f06a88b01621b7ae906ef0211290d1c8a168a15542486a8f61c0833b9"
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
-dependencies = [
- "getrandom",
- "redox_syscall 0.2.16",
- "thiserror",
-]
-
-[[package]]
-name = "regalloc2"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad156d539c879b7a24a363a2016d77961786e71f48f2e2fc8302a92abd2429a6"
-dependencies = [
- "hashbrown 0.13.2",
- "log",
- "rustc-hash",
- "slice-group-by",
- "smallvec",
-]
-
-[[package]]
-name = "regex"
-version = "1.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax 0.8.2",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax 0.8.2",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
-
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "rustix"
-version = "0.38.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b426b0506e5d50a7d8dafcf2e81471400deb602392c7dd110815afb4eaf02a3"
-dependencies = [
- "bitflags 2.4.1",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "ryu"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
-
-[[package]]
-name = "same-file"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "semver"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090"
-
-[[package]]
-name = "serde"
-version = "1.0.190"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91d3c334ca1ee894a2c6f6ad698fe8c435b76d504b13d436f0685d648d6d96f7"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.190"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67c5609f394e5c2bd7fc51efda478004ea80ef42fee983d5c67a65e34f32c0e3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.38",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.107"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
-dependencies = [
- "indexmap",
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "serde_spanned"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12022b835073e5b11e90a14f86838ceb1c8fb0325b72416845c487ac0fa95e80"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "shlex"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cee0529a6d40f580e7a5e6c495c8fbfe21b7b52795ed4bb5e62cdf92bc6380"
-
-[[package]]
-name = "slice-group-by"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "826167069c09b99d56f31e9ae5c99049e932a98c9dc2dac47645b08dbbf76ba7"
-
-[[package]]
-name = "smallbitvec"
-version = "2.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75ce4f9dc4a41b4c3476cc925f1efb11b66df373a8fde5d4b8915fa91b5d995e"
-
-[[package]]
-name = "smallvec"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
-
-[[package]]
-name = "sptr"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b9b39299b249ad65f3b7e96443bad61c02ca5cd3589f46cb6d610a0fd6c0d6a"
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
-
-[[package]]
-name = "strsim"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
-
-[[package]]
-name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.38"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "target-lexicon"
-version = "0.12.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c39fd04924ca3a864207c66fc2cd7d22d7c016007f9ce846cbb9326331930a"
-
-[[package]]
-name = "tempfile"
-version = "3.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
-dependencies = [
- "cfg-if",
- "fastrand",
- "redox_syscall 0.4.1",
- "rustix",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "textwrap"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
-dependencies = [
- "unicode-width",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.50"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.50"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.38",
-]
-
-[[package]]
-name = "tiny_http"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389915df6413a2e74fb181895f933386023c71110878cd0825588928e64cdc82"
-dependencies = [
- "ascii",
- "chunked_transfer",
- "httpdate",
- "log",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "toml"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd79e69d3b627db300ff956027cc6c3798cef26d22526befdfcd12feeb6d2257"
-dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime",
- "toml_edit",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.19.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
-dependencies = [
- "indexmap",
- "serde",
- "serde_spanned",
- "toml_datetime",
- "winnow",
-]
-
-[[package]]
-name = "tracing"
-version = "0.1.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
-dependencies = [
- "pin-project-lite",
- "tracing-attributes",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-attributes"
-version = "0.1.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.38",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
-dependencies = [
- "once_cell",
-]
-
-[[package]]
-name = "tree-sitter"
-version = "0.20.10"
-dependencies = [
- "bindgen",
- "cc",
- "regex",
- "wasmtime",
- "wasmtime-c-api-impl",
-]
-
-[[package]]
-name = "tree-sitter-cli"
-version = "0.20.9"
-dependencies = [
- "ansi_term",
- "anyhow",
- "atty",
- "clap",
- "ctor",
- "ctrlc",
- "difference",
- "dirs 5.0.1",
- "glob",
- "html-escape",
- "indexmap",
- "indoc",
- "lazy_static",
- "log",
- "memchr",
- "path-slash",
- "pretty_assertions",
- "rand",
- "regex",
- "regex-syntax 0.7.5",
- "rustc-hash",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "smallbitvec",
- "tempfile",
- "tiny_http",
- "toml",
- "tree-sitter",
- "tree-sitter-config",
- "tree-sitter-highlight",
- "tree-sitter-loader",
- "tree-sitter-tags",
- "tree-sitter-tests-proc-macro",
- "unindent",
- "walkdir",
- "webbrowser",
- "which",
-]
-
-[[package]]
-name = "tree-sitter-config"
-version = "0.19.0"
-dependencies = [
- "anyhow",
- "dirs 3.0.2",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "tree-sitter-highlight"
-version = "0.20.2"
-dependencies = [
- "lazy_static",
- "regex",
- "thiserror",
- "tree-sitter",
-]
-
-[[package]]
-name = "tree-sitter-loader"
-version = "0.20.0"
-dependencies = [
- "anyhow",
- "cc",
- "dirs 3.0.2",
- "libloading",
- "once_cell",
- "regex",
- "serde",
- "serde_json",
- "tree-sitter",
- "tree-sitter-highlight",
- "tree-sitter-tags",
- "which",
-]
-
-[[package]]
-name = "tree-sitter-tags"
-version = "0.20.2"
-dependencies = [
- "memchr",
- "regex",
- "thiserror",
- "tree-sitter",
-]
-
-[[package]]
-name = "tree-sitter-tests-proc-macro"
-version = "0.0.0"
-dependencies = [
- "proc-macro2",
- "quote",
- "rand",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "unicode-bidi"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "unicode-width"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
-
-[[package]]
-name = "unindent"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce"
-
-[[package]]
-name = "url"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
-]
-
-[[package]]
-name = "utf8-width"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5190c9442dcdaf0ddd50f37420417d219ae5261bbf5db120d0f9bab996c9cba1"
-
-[[package]]
-name = "vec_map"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "walkdir"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
-dependencies = [
- "same-file",
- "winapi-util",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.87"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
-dependencies = [
- "cfg-if",
- "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.87"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
-dependencies = [
- "bumpalo",
- "log",
- "once_cell",
- "proc-macro2",
- "quote",
- "syn 2.0.38",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.87"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.87"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.38",
- "wasm-bindgen-backend",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.87"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
-
-[[package]]
-name = "wasm-encoder"
-version = "0.35.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ca90ba1b5b0a70d3d49473c5579951f3bddc78d47b59256d2f9d4922b150aca"
-dependencies = [
- "leb128",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.115.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e06c0641a4add879ba71ccb3a1e4278fd546f76f1eafb21d8f7b07733b547cd5"
-dependencies = [
- "indexmap",
- "semver",
-]
-
-[[package]]
-name = "wasmtime"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "anyhow",
- "bincode",
- "bumpalo",
- "cfg-if",
- "indexmap",
- "libc",
- "log",
- "object",
- "once_cell",
- "paste",
- "psm",
- "serde",
- "serde_derive",
- "serde_json",
- "target-lexicon",
- "wasmparser",
- "wasmtime-cranelift",
- "wasmtime-environ",
- "wasmtime-jit",
- "wasmtime-runtime",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "wasmtime-asm-macros"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "wasmtime-c-api-impl"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "anyhow",
- "log",
- "once_cell",
- "tracing",
- "wasmtime",
- "wasmtime-c-api-macros",
-]
-
-[[package]]
-name = "wasmtime-c-api-macros"
-version = "0.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "proc-macro2",
- "quote",
-]
-
-[[package]]
-name = "wasmtime-cranelift"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "anyhow",
- "cfg-if",
- "cranelift-codegen",
- "cranelift-control",
- "cranelift-entity",
- "cranelift-frontend",
- "cranelift-native",
- "cranelift-wasm",
- "gimli",
- "log",
- "object",
- "target-lexicon",
- "thiserror",
- "wasmparser",
- "wasmtime-cranelift-shared",
- "wasmtime-environ",
- "wasmtime-versioned-export-macros",
-]
-
-[[package]]
-name = "wasmtime-cranelift-shared"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "anyhow",
- "cranelift-codegen",
- "cranelift-control",
- "cranelift-native",
- "gimli",
- "object",
- "target-lexicon",
- "wasmtime-environ",
-]
-
-[[package]]
-name = "wasmtime-environ"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "anyhow",
- "cranelift-entity",
- "gimli",
- "indexmap",
- "log",
- "object",
- "serde",
- "serde_derive",
- "target-lexicon",
- "thiserror",
- "wasmparser",
- "wasmtime-types",
-]
-
-[[package]]
-name = "wasmtime-jit"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "anyhow",
- "bincode",
- "cfg-if",
- "gimli",
- "log",
- "object",
- "rustix",
- "serde",
- "serde_derive",
- "target-lexicon",
- "wasmtime-environ",
- "wasmtime-jit-icache-coherence",
- "wasmtime-runtime",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "wasmtime-jit-debug"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "once_cell",
- "wasmtime-versioned-export-macros",
-]
-
-[[package]]
-name = "wasmtime-jit-icache-coherence"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "cfg-if",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "wasmtime-runtime"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "anyhow",
- "cc",
- "cfg-if",
- "indexmap",
- "libc",
- "log",
- "mach",
- "memfd",
- "memoffset",
- "paste",
- "rand",
- "rustix",
- "sptr",
- "wasm-encoder",
- "wasmtime-asm-macros",
- "wasmtime-environ",
- "wasmtime-jit-debug",
- "wasmtime-versioned-export-macros",
- "wasmtime-wmemcheck",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "wasmtime-types"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "cranelift-entity",
- "serde",
- "serde_derive",
- "thiserror",
- "wasmparser",
-]
-
-[[package]]
-name = "wasmtime-versioned-export-macros"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.38",
-]
-
-[[package]]
-name = "wasmtime-wmemcheck"
-version = "15.0.0"
-source = "git+https://github.com/bytecodealliance/wasmtime?rev=fa6fcd946b8f6d60c2d191a1b14b9399e261a76d#fa6fcd946b8f6d60c2d191a1b14b9399e261a76d"
-
-[[package]]
-name = "web-sys"
-version = "0.3.64"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "webbrowser"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b2391658b02c27719fc5a0a73d6e696285138e8b12fba9d4baa70451023c71"
-dependencies = [
- "core-foundation",
- "home",
- "jni",
- "log",
- "ndk-context",
- "objc",
- "raw-window-handle",
- "url",
- "web-sys",
-]
-
-[[package]]
-name = "which"
-version = "4.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
-dependencies = [
- "either",
- "home",
- "once_cell",
- "rustix",
-]
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.5",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
-[[package]]
-name = "winnow"
-version = "0.5.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3b801d0e0a6726477cc207f60162da452f3a95adb368399bef20a946e06f65c"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "yansi"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
-
-[[package]]
-name = "zerocopy"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81ba595b9f2772fbee2312de30eeb80ec773b4cb2f1e8098db024afadda6c06f"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "772666c41fb6dceaf520b564b962d738a8e1a83b41bd48945f50837aed78bb1d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.38",
-]
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 84f505caeb5a2..97554e53de206 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -9,11 +9,15 @@
 , Security
 , callPackage
 , linkFarm
+, substitute
 , CoreServices
 , enableShared ? !stdenv.hostPlatform.isStatic
 , enableStatic ? stdenv.hostPlatform.isStatic
 , webUISupport ? false
 , extraGrammars ? { }
+
+# tests
+, lunarvim
 }:
 
 let
@@ -22,14 +26,14 @@ let
   # 2) nix-build -A tree-sitter.updater.update-all-grammars
   # 3) Set GITHUB_TOKEN env variable to avoid api rate limit (Use a Personal Access Token from https://github.com/settings/tokens It does not need any permissions)
   # 4) run the ./result script that is output by that (it updates ./grammars)
-  version = "0.20.9";
-  sha256 = "sha256-NxWqpMNwu5Ajffw1E2q9KS4TgkCH6M+ctFyi9Jp0tqQ=";
+  version = "0.22.2";
+  hash = "sha256-RhM3SgsCb8eLs56cm8/Yo1ptNnFrR21FriHAlMdvdrU=";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter";
     rev = "v${version}";
-    inherit sha256;
+    inherit hash;
     fetchSubmodules = true;
   };
 
@@ -58,14 +62,15 @@ let
         };
       grammars' = import ./grammars { inherit lib; } // extraGrammars;
       grammars = grammars' //
-        { tree-sitter-ocaml = grammars'.tree-sitter-ocaml // { location = "ocaml"; }; } //
-        { tree-sitter-ocaml-interface = grammars'.tree-sitter-ocaml // { location = "interface"; }; } //
+        { tree-sitter-ocaml = grammars'.tree-sitter-ocaml // { location = "grammars/ocaml"; }; } //
+        { tree-sitter-ocaml-interface = grammars'.tree-sitter-ocaml // { location = "grammars/interface"; }; } //
         { tree-sitter-org-nvim = grammars'.tree-sitter-org-nvim // { language = "org"; }; } //
         { tree-sitter-typescript = grammars'.tree-sitter-typescript // { location = "typescript"; }; } //
         { tree-sitter-tsx = grammars'.tree-sitter-typescript // { location = "tsx"; }; } //
-        { tree-sitter-typst = grammars'.tree-sitter-typst // { generate = true; }; } //
         { tree-sitter-markdown = grammars'.tree-sitter-markdown // { location = "tree-sitter-markdown"; }; } //
         { tree-sitter-markdown-inline = grammars'.tree-sitter-markdown // { language = "markdown_inline"; location = "tree-sitter-markdown-inline"; }; } //
+        { tree-sitter-php = grammars'.tree-sitter-php // { location = "php"; }; } //
+        { tree-sitter-sql = grammars'.tree-sitter-sql // { generate = true; }; } //
         { tree-sitter-wing = grammars'.tree-sitter-wing // { location = "libs/tree-sitter-wing"; generate = true; }; };
     in
     lib.mapAttrs build (grammars);
@@ -105,8 +110,7 @@ rustPlatform.buildRustPackage {
   pname = "tree-sitter";
   inherit src version;
 
-  cargoLock.lockFile = ./Cargo.lock;
-  cargoLock.outputHashes."cranelift-bforest-0.102.0" = "sha256-rJeRbRDrAnKb8s98gNn1NTMKuB8B4aOI8Fh6JeLX7as=";
+  cargoHash = "sha256-QWqg84naOIPhkHj2yLchZVb2gvjL9+AEK2rRK7K8uQY=";
 
   buildInputs =
     lib.optionals stdenv.isDarwin [ Security CoreServices ];
@@ -114,12 +118,19 @@ rustPlatform.buildRustPackage {
     [ which ]
     ++ lib.optionals webUISupport [ emscripten ];
 
+  patches = lib.optionals webUISupport [
+    (substitute {
+      src = ./fix-paths.patch;
+      substitutions = [ "--subst-var-by" "emcc" "${emscripten}/bin/emcc" ];
+    })
+  ];
+
   postPatch = lib.optionalString (!webUISupport) ''
     # remove web interface
     sed -e '/pub mod playground/d' \
         -i cli/src/lib.rs
     sed -e 's/playground,//' \
-        -e 's/playground::serve(&current_dir.*$/println!("ERROR: web-ui is not available in this nixpkgs build; enable the webUISupport"); std::process::exit(1);/' \
+        -e 's/playground::serve(&grammar_path.*$/println!("ERROR: web-ui is not available in this nixpkgs build; enable the webUISupport"); std::process::exit(1);/' \
         -i cli/src/main.rs
   '';
 
@@ -150,6 +161,8 @@ rustPlatform.buildRustPackage {
     tests = {
       # make sure all grammars build
       builtGrammars = lib.recurseIntoAttrs builtGrammars;
+
+      inherit lunarvim;
     };
   };
 
@@ -157,6 +170,7 @@ rustPlatform.buildRustPackage {
     homepage = "https://github.com/tree-sitter/tree-sitter";
     description = "A parser generator tool and an incremental parsing library";
     mainProgram = "tree-sitter";
+    changelog = "https://github.com/tree-sitter/tree-sitter/blob/v${version}/CHANGELOG.md";
     longDescription = ''
       Tree-sitter is a parser generator tool and an incremental parsing library.
       It can build a concrete syntax tree for a source file and efficiently update the syntax tree as the source file is edited.
diff --git a/pkgs/development/tools/parsing/tree-sitter/fix-paths.patch b/pkgs/development/tools/parsing/tree-sitter/fix-paths.patch
new file mode 100644
index 0000000000000..6023a5934c8f6
--- /dev/null
+++ b/pkgs/development/tools/parsing/tree-sitter/fix-paths.patch
@@ -0,0 +1,13 @@
+diff --git a/cli/loader/src/lib.rs b/cli/loader/src/lib.rs
+index 9c1d8dfc..a5cfc74c 100644
+--- a/cli/loader/src/lib.rs
++++ b/cli/loader/src/lib.rs
+@@ -747,7 +747,7 @@ impl Loader {
+             Podman,
+         }
+ 
+-        let emcc_name = if cfg!(windows) { "emcc.bat" } else { "emcc" };
++        let emcc_name = if cfg!(windows) { "emcc.bat" } else { "@emcc@" };
+ 
+         // Order of preference: emscripten > docker > podman > error
+         let source = if !force_docker && Command::new(emcc_name).output().is_ok() {
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bash.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bash.json
index d10cb04e0f295..1c7fb3888868e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bash.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bash.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-bash",
-  "rev": "c0f5797a728fc4ebd78a8b0e436b1494a8ab5f51",
-  "date": "2023-08-18T05:23:36-04:00",
-  "path": "/nix/store/4x7nwivwmyibiq0y1k5wpswsl1npqgb4-tree-sitter-bash",
-  "sha256": "11gjjaf9hrsw3rd774c3gq27im2j9gxmkn59wcpg4nwni60p0vjh",
-  "hash": "sha256-UG5wgYmWW/Iu46nYWftLUtR4BH6DkXNaHlxnmJyS8oU=",
+  "rev": "d1a1a3fe7189fdab5bd29a54d1df4a5873db5cb1",
+  "date": "2024-02-10T05:53:07-05:00",
+  "path": "/nix/store/wc1dawmsb13fbbag3jxaz30iklakkn7i-tree-sitter-bash",
+  "sha256": "00cjhv0zwlfp4i823y8r7wl2h2h63ygz2kmbcm16lvzspwiq8a2y",
+  "hash": "sha256-XiiEI7/6b2pCZatO8Z8fBgooKD8Z+SFQJNdR/sGGkgE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
index 93e266b4343cc..86ac2bc43009e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/polarmutex/tree-sitter-beancount",
-  "rev": "358e5ecbb87109eef7fd596ea518a4ff74cb9b31",
-  "date": "2023-07-02T15:37:32-04:00",
-  "path": "/nix/store/h24aaxhp4hhp7f21by7shjvx7v4k513z-tree-sitter-beancount",
-  "sha256": "1pa673dzsv41rxlqb2a5w7r31rw9z3m6a54yx22wm75cwr9hagxz",
-  "hash": "sha256-vz8FU+asnMqF6J4UZer4iecw8uFFiYVpz4Fs/ds4Rt0=",
+  "rev": "6c665e7cf15d76a1687959643868a78fb381458d",
+  "date": "2024-03-09T18:30:23-05:00",
+  "path": "/nix/store/al4c5f670bl596mlp3vk1njz7w8bhq98-tree-sitter-beancount",
+  "sha256": "0cwiw69br9y8w5iysdh31i4vlvfgj79zvpkz93y1spyxx6vlylc5",
+  "hash": "sha256-hVFPt+ndXx38SH/e/dORz226SQwDNu1j4cinvJLhkTM=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
index 61aeba0fec660..8d5167b488db3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/amaanq/tree-sitter-bitbake",
-  "rev": "ffe6c2f3dbf30224479a28ca5d50df594b2486a9",
-  "date": "2023-11-08T10:34:03-05:00",
-  "path": "/nix/store/zzckcglck1cr32cmp14i95r7q0qkgajf-tree-sitter-bitbake",
-  "sha256": "1g547sq2xsfn7xmdmz1ny4lvk75akwi7k1vrrq6bdfkcg7gzkp1b",
-  "hash": "sha256-K9z533lsurYMznmHeSKfqpy5KfE2/NpqP9bpLrA+pLw=",
+  "rev": "10bacac929ff36a1e8f4056503fe4f8717b21b94",
+  "date": "2023-11-10T20:00:03-05:00",
+  "path": "/nix/store/f2y79f98mwn86i12ggrydbhz1568ah78-tree-sitter-bitbake",
+  "sha256": "1pfma482nyc88x56v6l6rmhdy44qbwibrqri38wkkh66a1fka8ix",
+  "hash": "sha256-PSI1XVDGwDk5GjHjvCJfmBDfYM2Gmm1KR4h5KxBR1d0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json
index 0b347648c6fbd..0d894b7c53be3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-c",
-  "rev": "93ef1785bbf854cf964e6e53d6e1e6885a4d8ebc",
-  "date": "2023-08-09T15:22:48-04:00",
-  "path": "/nix/store/ni6ry3r1gqpgcn6xgc1nga110hl313m3-tree-sitter-c",
-  "sha256": "0bshiwf7rvbafgdv9lj1hgmq3wc8i45gis34n6p6qlb9r6g5jzz6",
-  "hash": "sha256-5n9ZnslpUWyusWTo+AqJiPGB64NB0rTbc2rtfByPUC8=",
+  "rev": "df6ac34d5eb1dccfac8f2a9011a8491300818d7c",
+  "date": "2024-01-22T11:11:13-05:00",
+  "path": "/nix/store/7v5nz25dl0qph3f75ipxv0g6y4kxmc4f-tree-sitter-c",
+  "sha256": "0ih9rqxxjzd9v0h6h42vzmnc5ixl3rfzznq0p8ka9mqdyznrx5xa",
+  "hash": "sha256-qpee7fcN16QmugDb/10etMfCbP1bEGgg2Kl92TvOCUY=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
index d66b68664042d..89afd7990d8b4 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/uyha/tree-sitter-cmake",
-  "rev": "73ab4b8e9522f014a67f87f585e820d36fa47408",
-  "date": "2023-08-15T15:07:39+00:00",
-  "path": "/nix/store/rzb3dvqw2ngdbqbpv1zshxm2q9g09f9j-tree-sitter-cmake",
-  "sha256": "1z49jdachwxwbzrrapskpi2kxq3ydihfj45ab9892gbamfij2zp5",
-  "hash": "sha256-5X4ho6tqPZFQWqoQ6WBsfuA+RbxTX5XzX7xzyFSTifw=",
+  "rev": "20ffd6d3b4da1acdbf2d08204b2130a5b2f7c4b3",
+  "date": "2024-03-19T09:50:27+02:00",
+  "path": "/nix/store/2fcf8g6rryigpy6grr284qzgmqw1gkd5-tree-sitter-cmake",
+  "sha256": "16klinbjr9k5piwqvfvl48wmprk9wlypqnmihryy2wj2m2xzlyqa",
+  "hash": "sha256-Cnv6u6hCcuF9hrFafD3laeZbOSJ0u415vGWmLJeNdJo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
index 5026e1d70f03a..190dda2ee3e9b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/thehamsta/tree-sitter-commonlisp",
-  "rev": "5153dbbc70e4cc2324320c1bdae020d31079c7c0",
-  "date": "2023-08-26T00:52:05+02:00",
-  "path": "/nix/store/w5assc5jjkg8j9gj7zgqlm07h5y8gxp7-tree-sitter-commonlisp",
-  "sha256": "195g5qp38j9371zxq9d7blf02bp1bnrbkb6jgi5x0gywdxrbdq6i",
-  "hash": "sha256-0eC2cm/cP9BLfNKsubJd4S4BHF2nJdx/OCNJNC4ur6Q=",
+  "rev": "cf10fc38bc24faf0549d59217ff37c789973dfdc",
+  "date": "2023-11-19T14:17:12+01:00",
+  "path": "/nix/store/91kc23ng7axqzd4xjiwrgij1mpriq459-tree-sitter-commonlisp",
+  "sha256": "1nq5cvf557w3vwr7rjzdgqcpcs3ikp1x5cs00f8z5n9hgdk1lvry",
+  "hash": "sha256-Pm8aZnsw2fKRA0Cz0sOdcWh2GX7ty3wy34OfUtxmBds=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
index 7aeb707a28a68..4ba7b97a57d8d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-cpp",
-  "rev": "a90f170f92d5d70e7c2d4183c146e61ba5f3a457",
-  "date": "2023-08-16T02:46:22-04:00",
-  "path": "/nix/store/vd49n2vnhsbmc8gdds9zh6psq93jj6cp-tree-sitter-cpp",
-  "sha256": "0lj5l0pahfixw5lqbw83r01s67szlc6a4ra8yg8s7cbci7rk7lvv",
-  "hash": "sha256-e9Mz84lssaPR80hlogyjXx+jA8gD8YVp4T06qC6gRVI=",
+  "rev": "e0c1678a78731e78655b7d953efb4daecf58be46",
+  "date": "2024-02-18T08:20:42-05:00",
+  "path": "/nix/store/dw86n9mqgfn9ymlbr7s7h05dvf8q867i-tree-sitter-cpp",
+  "sha256": "0fjxjm3gjqvcjqgjyq6lg6sgyy0ly69dinq33rmy56806da45lq9",
+  "hash": "sha256-CdNCVDMAmeJrHgPb2JLxFHj/tHnUYC8flmxj+UaVXTo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
index a59d21058007d..224b48ea52844 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-css",
-  "rev": "fec7d3757ab8f46a0ffe298be99b16ad5b9fa229",
-  "date": "2023-08-20T03:59:13-04:00",
-  "path": "/nix/store/dn0igch37dalqfrjdqzs2yj40a14ixql-tree-sitter-css",
-  "sha256": "0gvad0cpcxwmzgv75arcw40r5dxy6b3aq9kp91xf4bjlkfyajzvz",
-  "hash": "sha256-f3+pvJtULuJ6SHcmrMYyvreSAeEsq3L2+5V3dhloaj8=",
+  "rev": "02b4ee757654b7d54fe35352fd8e53a8a4385d42",
+  "date": "2024-02-14T18:09:29-05:00",
+  "path": "/nix/store/l2vr6xj78qrqjlpj6lzc0bi8dirqvfkx-tree-sitter-css",
+  "sha256": "0j1kg16sly7xsvvc3kxyy5zaznlbz7x2j2bwwv1r1nki2249ly12",
+  "hash": "sha256-IniaiBBx2pDD5nwJKfr5i9qvfvG+z8H21v14qk14M0g=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
index 646422b5df17e..376d5f83bf469 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/thehamsta/tree-sitter-cuda",
-  "rev": "275cfb95013b88382e11490aef1e7c9b17a95ef7",
-  "date": "2023-09-24T01:01:27+02:00",
-  "path": "/nix/store/cxvih9bkbpr3k2bcfzmcym6w3jw4k6p0-tree-sitter-cuda",
-  "sha256": "170qqhxnf5j34g1as5r5zamazvxss8rcmbxi92gkcgnindhgviny",
-  "hash": "sha256-3sb9YLPRPjafSLGvyjLSuu+vqvolF63CI0MWZzvEGJw=",
+  "rev": "221179d4287a2c24c08e4c67ff383ef67dc32156",
+  "date": "2024-02-20T23:55:20+01:00",
+  "path": "/nix/store/x8sqw6njbai4x9jlx6zn0mamvfjpcxy9-tree-sitter-cuda",
+  "sha256": "0n4c79iq5izdjrb50f5af02jkzfn6mp3kvr0iajfhxlj3x64ykbv",
+  "hash": "sha256-e01PTB+SduikiiDvOW411v0pBXCqOFBWlu3HgmM6jFg=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
index 2429e08f4b091..96341f8b54d3e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/eonpatapon/tree-sitter-cue",
-  "rev": "2df92e6755337e9234ad18ffef37f35d95e2ba9d",
-  "date": "2023-09-14T09:23:14+02:00",
-  "path": "/nix/store/96raymr29j4w3z8czzslb5n0w11789if-tree-sitter-cue",
-  "sha256": "195g75hrmgj17r7csjbwqrwqc21k4nbmrr4rjpcpfidnq0c9pia6",
-  "hash": "sha256-RsWbGMC2RXfZlZnkXJclMwiGecZ8Sc1OPkG+mmE5r6Q=",
+  "rev": "8a5f273bfa281c66354da562f2307c2d394b6c81",
+  "date": "2024-03-12T11:22:48+01:00",
+  "path": "/nix/store/58ar5h99vkn7f012hks83a6x8xnpdp3y-tree-sitter-cue",
+  "sha256": "16djln3n1cpi5vxv9dg9ysrg46z74rwzgflnp2y4y2aginbx6pmr",
+  "hash": "sha256-uV7Tl41PCU+8uJa693km5xvysvbptbT7LvGyYIelspk=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
index 738b30cbd116b..0cf8d54a9f4c4 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/usernobody14/tree-sitter-dart",
-  "rev": "7e447dc18a2d293498670fb5ea16138648c883e5",
-  "date": "2023-09-07T18:39:30-06:00",
-  "path": "/nix/store/fjmckpx1h2m3y8d63x05qn5lzgci37p8-tree-sitter-dart",
-  "sha256": "1hc2c2qmydka3iqz56md766lfy4s0xy2pr97hvdgvgq472jss984",
-  "hash": "sha256-BCWtpTgEv/3ahiflK3wHmnhHjTmtmvJxHGo2X7FggsE=",
+  "rev": "1a31399a08aefc93bc4cdbfadc0cb619136f86c1",
+  "date": "2024-02-10T18:16:57-07:00",
+  "path": "/nix/store/4pdnic3kb0856ajy2xfbxdn84lflvbw1-tree-sitter-dart",
+  "sha256": "0nx4hvvx239prxckddbcgadvk894lxl4ycmxxg7m30j2sp6a6049",
+  "hash": "sha256-iQCjzNVCglHP670yT2inJKG5m3pstTZZzzcN0feGpFs=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
index f3530c58c62ee..aeb72e594ba2d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/joelspadin/tree-sitter-devicetree",
-  "rev": "59faca63ab28d8aa8b79416bfcbe5b935f3fa604",
-  "date": "2023-04-23T12:18:55-05:00",
-  "path": "/nix/store/m39bl3vasy0b1r0qzdn8flb480ys8laq-tree-sitter-devicetree",
-  "sha256": "11r46v3zw03p1fldhawn9zwyzpi7h57pjw9sydwq7b1fgdmdxvn7",
-  "hash": "sha256-x+7eansurIN58zpxeU+BJ97v+U+WK9ioC3cA/sc2JIc=",
+  "rev": "05f12c50cdaafcd8969c9c712245f51a0611df23",
+  "date": "2024-03-15T23:40:59-05:00",
+  "path": "/nix/store/rlbnn034jn2vb5bg06ynrsc6xyxs9sa0-tree-sitter-devicetree",
+  "sha256": "1iw1az1xm3nlq61365lrj8prhx8417ha4f82a90hwfpb58dnf30m",
+  "hash": "sha256-FQxnGyrrOg5BUgI5ouAJBHWYL5KZFjOCwdSO2sNXgcc=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
index a421c98aeeb4d..70e129ea41bd2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/elixir-lang/tree-sitter-elixir",
-  "rev": "869dff3ceb8823ca4b17ca33b663667c8e41e8ba",
-  "date": "2023-03-14T10:58:34+01:00",
-  "path": "/nix/store/d8k07yvr8q14rc21fvhcnqrlpcwhlnmk-tree-sitter-elixir",
-  "sha256": "0m10vykaj36yxk0wwh0vk0pzvpdmac4apgihmxn3j0dwwgirchf0",
-  "hash": "sha256-wEGW4+O8ATlsrzC+qwhTtd39L5gbQM7B7N4MqabfIFQ=",
+  "rev": "11426c5fd20eef360d5ecaf10729191f6bc5d715",
+  "date": "2023-12-04T13:06:21+07:00",
+  "path": "/nix/store/l3868ga8dvvq06k7px3k9i3kpynfjmis-tree-sitter-elixir",
+  "sha256": "1fqsvqdjscmjj7vaq3mgs6j49m3412g5i9jrm1r61n1d8yrg3mzy",
+  "hash": "sha256-/tfxskct2GByqFmmWJ4IZNREpNGvDqz2kbIyLRveGrs=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
index 94e99286fc3da..1f0333795f1b2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/elm-tooling/tree-sitter-elm",
-  "rev": "b075803c445191af3cf7dbfdc84efef5f5bbc0f5",
-  "date": "2023-07-30T13:11:47+02:00",
-  "path": "/nix/store/mlg7amv3vmydvk9b21669zrk825pczlw-tree-sitter-elm",
-  "sha256": "1kn78h4w27r5kmf3vy3cc42xm0h0fj44cf4p6nfcl3jfqr9s7n1a",
-  "hash": "sha256-KtijU8ZODsqcNZc4Roh0AILaBWFs+D1cnSUfwQlEx84=",
+  "rev": "c26afd7f2316f689410a1622f1780eff054994b1",
+  "date": "2023-12-22T17:42:34+01:00",
+  "path": "/nix/store/4f7ldbwxns2iv0cf06ryc87raiacdp5x-tree-sitter-elm",
+  "sha256": "1cbn5qiq2n607hcxg786jrhs2abln8fcsvkcab9wp9j8iw9pb0xx",
+  "hash": "sha256-vYN1E49IpsvTUmxuzRyydCmhYZYGndcZPMBYgSMudrE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
index 4491070428a0f..2d29f1f4011b3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-embedded-template",
-  "rev": "203f7bd3c1bbfbd98fc19add4b8fcb213c059205",
-  "date": "2023-02-06T19:11:08+01:00",
-  "path": "/nix/store/mch0z6q00g2pp5vjjcdcl2xzs1h96jzh-tree-sitter-embedded-template",
-  "sha256": "0gf33p08a6hqbxwy9zlp8y65gds2d6siqpgasc58ladh5p5n99j9",
-  "hash": "sha256-SaZkyy2wKYoK0+pdHLVpQrdXjEeX/uR5XxgahcAdwz0=",
+  "rev": "6d791b897ecda59baa0689a85a9906348a2a6414",
+  "date": "2024-02-14T20:15:12-05:00",
+  "path": "/nix/store/fj8gk7h81lgj15x79cbrkfvdw2hmbmyb-tree-sitter-embedded-template",
+  "sha256": "0d4kc2bpbx1bvd0xv37wd87hbi775hq4938qz2n657h036dzg0i3",
+  "hash": "sha256-I4L3mxkAnmKs+BiNRDAs58QFD2r8jN1B2yv0dZdgkzQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
index e954be4a24d23..7df79d76a303e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/travonted/tree-sitter-fennel",
-  "rev": "517195970428aacca60891b050aa53eabf4ba78d",
-  "date": "2022-06-22T09:39:24-04:00",
-  "path": "/nix/store/v8by7ilv9fyv20rp714xq7vhwwi7vz0g-tree-sitter-fennel",
-  "sha256": "02ja5narbahc02f6gmnr5j2sg5sbjcc71hbny6n0nd57kcnapfgd",
-  "hash": "sha256-7bmrLJunNAus8XbBcBiTS5enhSzZ1mecAAyqlZUtSgo=",
+  "rev": "15e4f8c417281768db17080c4447297f8ff5343a",
+  "date": "2024-02-02T09:37:06-05:00",
+  "path": "/nix/store/cjqnj1i2z7s3xwivba9vgpqrs0lcinil-tree-sitter-fennel",
+  "sha256": "059avw3yhadqbfallflc5xxfzla81d5mc9wrc3ag09xj5w6n1n05",
+  "hash": "sha256-BdhgDS+yJ/DUYJknVksLSNHvei+MOkqVW7gp6AffKhU=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
index 2ac4b39f3710b..e766346aece94 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/prestonknopp/tree-sitter-gdscript",
-  "rev": "fbbe22c7e3f8191f65df8cfb4cc8c6137eedb09a",
-  "date": "2023-02-08T15:20:29-08:00",
-  "path": "/nix/store/62skx6k41f6k95qf32b7yjd9m516z3lk-tree-sitter-gdscript",
-  "sha256": "0f4g5vnls2rkwnry47cvpmhsymf1s109sbzdf4x7h94k58f5ggw4",
-  "hash": "sha256-hL9XHCqTJHg6ce0vnUDQwVWvYb2bHeKz5TMLTe0ujzg=",
+  "rev": "b5dea4d852db65f0872d849c24533eb121e03c76",
+  "date": "2024-02-21T19:10:52-08:00",
+  "path": "/nix/store/254bkv3lkgp7jk555rmxqxyg4p4g9smy-tree-sitter-gdscript",
+  "sha256": "17m2gdpdya8afm7fqgggi81m71xkiibbqa61vs2sspym6zna1ygx",
+  "hash": "sha256-/fmg7DfVX62F3sEovFaMs4dTA4rvPexOdQop3257op4=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
index 1a8bee300c6ef..44c6d89e29141 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/gleam-lang/tree-sitter-gleam",
   "rev": "2012f294baacf30e7a62414754021284377366c6",
-  "date": "2023-03-04T16:19:15-05:00",
-  "path": "/nix/store/qc0bxfrv9rb95cg5q8nf0prpz4gs93wd-tree-sitter-gleam",
-  "sha256": "sha256-W+PfxqPUKHhLH5UBATmQ1mlSfLPAWIQyDgiSQBWBtBs=",
+  "date": "2024-03-04T16:19:15-05:00",
+  "path": "/nix/store/2ms5f9sylr9v23pgw428dr8gqap4859m-tree-sitter-gleam",
+  "sha256": "06xlh4al14h81qr88n60ndy54sfnj0wh20cm3x5pha6llg3dzqsv",
   "hash": "sha256-W+PfxqPUKHhLH5UBATmQ1mlSfLPAWIQyDgiSQBWBtBs=",
   "fetchLFS": false,
   "fetchSubmodules": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
index ffafe86908936..e221099a39b80 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/alexlafroscia/tree-sitter-glimmer",
-  "rev": "a23d28de811976f3ca310df735fe09a5d2de16ab",
-  "date": "2022-06-24T09:27:51-04:00",
-  "path": "/nix/store/m0hr0x0s3j7r6dn1kv6c77c9qbl4ggkw-tree-sitter-glimmer",
-  "sha256": "07dzpjyc644clh2x3r48w3mi3i68pkac5mwzha2iaxly9fndm0zk",
-  "hash": "sha256-84ParEuedhWFgp/XwtS8yMQR6+CI5NEFpIwQw7y8vx0=",
+  "rev": "3e66b67efeba1a2001859f6e02d16e0bbdbf4a9b",
+  "date": "2023-10-05T16:33:40-04:00",
+  "path": "/nix/store/sizww81ylny2pnafn3d901qv15k3rlp2-tree-sitter-glimmer",
+  "sha256": "0ggxs83jq59z6vk4bvr7scfscmak41lgz038pcwczpm3hwfhasjq",
+  "hash": "sha256-WGoFHYej3s84u2iA/2ggU1WmHdMn70XmNj8VLAfS/T0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
index c6e1437552f9a..0cf5f37e53666 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/thehamsta/tree-sitter-glsl",
-  "rev": "ec6100d2bdf22363ca8a711a212f2144ea49233f",
-  "date": "2023-09-24T00:29:42+02:00",
-  "path": "/nix/store/lk8wn775vpa8aq8vm9fid6dvpijnk9sg-tree-sitter-glsl",
-  "sha256": "0grvl3dibfcy3rqyn621pdlr1dkgqifzalvhh8bqs7s6znmhwns0",
-  "hash": "sha256-QFsOq/1GH40XgnBT9V3Eb7aQabtBGOtxHp65FdugOz8=",
+  "rev": "284bed0e2f1d9f700756b96512baf33483642ff0",
+  "date": "2024-02-15T22:49:15+01:00",
+  "path": "/nix/store/vqnsavpda33cbzvfwk28cqz24m5lwrl7-tree-sitter-glsl",
+  "sha256": "1vcllf58mk1c1fiwh2amcjkgmq5m9dyhawvm744fx9phf0qlqb57",
+  "hash": "sha256-pyxMMXDwpu4IOXVzBX1LteD6pmRVCcijCyzMioqjlO0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
index 6080553537af0..075059a0599d5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/camdencheek/tree-sitter-go-mod",
-  "rev": "4a65743dbc2bb3094114dd2b43da03c820aa5234",
-  "date": "2022-05-16T16:12:37-04:00",
-  "path": "/nix/store/1aj3kwndjrimfijq0fxx6khn5r6ics3a-tree-sitter-go-mod",
-  "sha256": "1hblbi2bs4hlil703myqhvvq2y1x41rc3w903hg2bhbazh7x8yyf",
-  "hash": "sha256-znvUD/xqwSUeHCDxwXIgPXiB94bY1wEOjRQSvURcdME=",
+  "rev": "bbe2fe3be4b87e06a613e685250f473d2267f430",
+  "date": "2024-01-16T04:55:23-07:00",
+  "path": "/nix/store/xi1fr4l79pnqaa7md7gk4nqvg4ccgyzy-tree-sitter-go-mod",
+  "sha256": "1clw1wyjxiicdjav5g2b9m9q7vlg5k1iy1fqwmf2yc4fxrfnmyrq",
+  "hash": "sha256-OPtqXe6OMC9c5dgFH8Msj+6DU01LvLKVbCzGLj0PnLI=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
index 200e63638eed9..a41c8bc056c47 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-haskell",
-  "rev": "d7ac98f49e3ed7e17541256fe3881a967d7ffdd3",
-  "date": "2023-09-25T03:05:10+02:00",
-  "path": "/nix/store/8hjdhpw9g27hasl5czx80j7s3j65601k-tree-sitter-haskell",
-  "sha256": "0610dpnnrmwdxhj0cz4mnajx4aaxhr77w4vc756605zgv54djisw",
-  "hash": "sha256-XEfZSNnvF2BMOWwTfk6GXSnSpbKVfAYk7I3XbO1tIBg=",
+  "rev": "6b5ec205c9d4f23eb36a163f1edc4f2db8c98e4a",
+  "date": "2024-02-26T15:02:24+01:00",
+  "path": "/nix/store/ia666bffpywmack992f64jid4321fvdq-tree-sitter-haskell",
+  "sha256": "1d3klbflb1xl234s6pw874j1d5r82bkx5jdi7il1irfvhgdkjljc",
+  "hash": "sha256-TFI524Pb5RhoPLHJ0ucSKJcWJDmIX6PJELSHRd2ic7Q=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
index c00a9ac832cae..dc80021f2a218 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-html",
-  "rev": "e5d7d7decbbdec5a4c90bbc69436b3828f5646e7",
-  "date": "2023-07-10T14:25:09-04:00",
-  "path": "/nix/store/fv14r2cf4i369jfjb74d7y3cbxyyg762-tree-sitter-html",
-  "sha256": "0ghgv712gq9bdaa4msz347cffgdbb5fc6a13q73dl9gwdjx0zl4c",
-  "hash": "sha256-jNAPumz8JdrGwSMow1xZqz3n2CHj60qUaivhJ8LZDz4=",
+  "rev": "74cab04e10b71811a32dfdde10fd0162d55c54cc",
+  "date": "2024-02-19T01:18:16-05:00",
+  "path": "/nix/store/yz3yab424kskfrcvjz4y191rwpy78nd2-tree-sitter-html",
+  "sha256": "16ldv6p1zhbwqvy7g7m40rbswfjpc58cpmm9kxkd82wz5qv5i3sp",
+  "hash": "sha256-V49YNi6fC9Rmn6nWy1BhVzquVwaknnf8xnzBH67ZjZo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
index ae2366b33fa44..132aca585b140 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/ntbbloodbath/tree-sitter-http",
-  "rev": "6824a247d1326079aab4fa9f9164e9319678081d",
-  "date": "2023-05-04T18:36:43-04:00",
-  "path": "/nix/store/7d2x9w6nqlhvgk70jahwlp6zg19iriij-tree-sitter-http",
-  "sha256": "0vhipdljx3s2pgzdk2a1zgqf8dd7p3bdbjckcb6z01hdg2p9v121",
-  "hash": "sha256-QYSdrngNBvDNYpPJ1da4pzXk8PtBidn+u0KPLmm7EW4=",
+  "rev": "b639716df0698940b53de81e6fcefa2b6cd30724",
+  "date": "2024-03-16T17:35:45-04:00",
+  "path": "/nix/store/ynn327dwmxxakcbfrpq94b7m6sl5301h-tree-sitter-http",
+  "sha256": "0l2yzq0j3w20m9vy9z627jgnfylk1d8crldz3n8xmhisaxwl47ia",
+  "hash": "sha256-Kh5CeVc6wtqRHb/RzFALk3pnnzzC/OR3qkDwIQH+XlA=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
index c522ab892bf02..547cf21ab05d2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/sogaiu/tree-sitter-janet-simple",
-  "rev": "bd9cbaf1ea8b942dfd58e68df10c9a378ab3d2b6",
-  "date": "2023-04-29T13:15:11+09:00",
-  "path": "/nix/store/53gscixcapdpckbr4gfx26ax0jk84xcp-tree-sitter-janet-simple",
-  "sha256": "0hy1dm2jzghd7mi74n4b1ac5bhm809mcg3bcl9f300bh5m79qnyq",
-  "hash": "sha256-2FucTi1wATBcomyNx2oCqMJVmAqLWHJiPQ2+L0VtwUM=",
+  "rev": "51271e260346878e1a1aa6c506ce6a797b7c25e2",
+  "date": "2023-11-11T12:18:30+09:00",
+  "path": "/nix/store/whms9s60xj63bl0b7m2gqkd7900h5qwy-tree-sitter-janet-simple",
+  "sha256": "018vwy6y1kr1bh5wp399vspc1y4wpvvgh0c6p7541xl196rzywa1",
+  "hash": "sha256-QXH/s0mB9kDKuYYB+Pa+nPjArt4pjcsLXCHP4I3nGwU=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
index b6aa4cf02f9bf..723155cf451a3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-java",
-  "rev": "09d650def6cdf7f479f4b78f595e9ef5b58ce31e",
-  "date": "2022-09-19T09:37:51+02:00",
-  "path": "/nix/store/478mfssm2335hdflgba22n4f0dir7xmr-tree-sitter-java",
-  "sha256": "0440xh8x8rkbdlc1f1ail9wzl4583l29ic43x9lzl8290bm64q5l",
-  "hash": "sha256-tGBi6gJJIPpp6oOwmAQdqBD6eaJRBRcYbWtm1BHsgBA=",
+  "rev": "2b57cd9541f9fd3a89207d054ce8fbe72657c444",
+  "date": "2023-10-05T14:06:23+02:00",
+  "path": "/nix/store/6nark1nnsz96zl56i39dxrrlx2675k4i-tree-sitter-java",
+  "sha256": "1jhgmgiig5vxz8x961qdp9d3xwawgi5lwsfs1i7d53ffli1qm3v6",
+  "hash": "sha256-Zo+KQ6TOjdJODNppTkt8XPE+WroNB5M6+n2XF+OrD8o=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
index 95e9ca95234b1..7b03a81327734 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-javascript",
-  "rev": "f1e5a09b8d02f8209a68249c93f0ad647b228e6e",
-  "date": "2023-08-25T01:24:52-04:00",
-  "path": "/nix/store/iiwzzd2b6ngim7lwpy2zdgzik7lm2w1y-tree-sitter-javascript",
-  "sha256": "0jslqjlmfx0xdgwhqam0lgw22r521iynp8l10pfan2bmqxmbdcjm",
-  "hash": "sha256-VbK2asd1CavcBYGia30MomQh+KOgKgz5ax10V6nEVEs=",
+  "rev": "de1e682289a417354df5b4437a3e4f92e0722a0f",
+  "date": "2024-03-10T11:12:05-04:00",
+  "path": "/nix/store/8p9li6jcc247jzpy0x3cr4iskfyhqwmi-tree-sitter-javascript",
+  "sha256": "1mvvc6cv46zyhxhdjycmj7746hbss7lxcxks61bzrh229nlrh6hy",
+  "hash": "sha256-HhqYqU1CwPxXMHp21unRekFDzpGVedlgh/4bsplhe9c=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
index 1442cb58f4a8a..fbc2c37c8a296 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-jsdoc",
-  "rev": "d01984de49927c979b46ea5c01b78c8ddd79baf9",
-  "date": "2023-08-20T17:54:07-04:00",
-  "path": "/nix/store/8fz1cj9fs1b3y85rd3mbpkhwsh07k6hq-tree-sitter-jsdoc",
-  "sha256": "11w3a6jfvf8fq1jg90bsnhj89gvx32kv1gy4gb5y32spx6h87f1v",
-  "hash": "sha256-O7iDoOlXi+HLesS/sKcYfb+EJLR6gfRkwA657aRRg4c=",
+  "rev": "6a6cf9e7341af32d8e2b2e24a37fbfebefc3dc55",
+  "date": "2024-02-14T18:13:00-05:00",
+  "path": "/nix/store/9i7fgay23cjnvjapg95bj07jbliv8bmk-tree-sitter-jsdoc",
+  "sha256": "1xmkkqyb9mc18jh6dlffzw9j560mmc5i6fbic8ki9z0r30b1ravw",
+  "hash": "sha256-fKscFhgZ/BQnYnE5EwurFZgiE//O0WagRIHVtDyes/Y=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
index 2a32a4b3cd25f..00991afc31368 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-json",
-  "rev": "ca3f8919800e3c1ad4508de3bfd7b0b860ce434f",
-  "date": "2023-07-10T15:59:29-04:00",
-  "path": "/nix/store/3pkcya9skyx0k9k54sbp1sbqk9gpzwr4-tree-sitter-json",
-  "sha256": "038zdq2zf4phk082lrw466qd9fbkn1017n3nj53fbp1m8rmxwakk",
-  "hash": "sha256-cyrea0Y13OVGkXbYE0Cwc7nUsDGEZyoQmPAS9wVuHw0=",
+  "rev": "3b129203f4b72d532f58e72c5310c0a7db3b8e6d",
+  "date": "2024-02-23T13:05:26-08:00",
+  "path": "/nix/store/03dv24dlqkds0k1vjchzq6n8v6wys3ix-tree-sitter-json",
+  "sha256": "0rnfhmhr76fjlc6zzbxzrxrxa1xxpkg1jgq7vdw4630l1cg2nlbm",
+  "hash": "sha256-dVErHgsUDEN42wc/Gd68vQfVc8+/r/8No9KZk2GFzmY=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
index 37d884b2d1b81..505875342f498 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/joakker/tree-sitter-json5",
-  "rev": "5dd5cdc418d9659682556b6adca2dd9ace0ac6d2",
-  "date": "2021-08-24T18:08:31-04:00",
-  "path": "/nix/store/0qhffwc84sp97d8im4lfrd06jsyvmzc4-tree-sitter-json5",
-  "sha256": "1la7bq5vi21gy0kf4zpwh0c0jfyv1bb62a3v7158hnxdyd5ijz07",
-  "hash": "sha256-B3wZS/OtW4hKOHsoYdYK2zsJGID8fuIm8C+IuAteR9E=",
+  "rev": "c23f7a9b1ee7d45f516496b1e0e4be067264fa0d",
+  "date": "2023-10-05T17:25:17-03:00",
+  "path": "/nix/store/k0jyqq66qp3nq8nmzr1dhm3pk2vxhg1r-tree-sitter-json5",
+  "sha256": "11j8sjq2b0ibiygmcnxzl5vxa0p9ygngfhzjvjl19jnlnf0h7a6p",
+  "hash": "sha256-16gDgbPUyhSo3PJD9+zz6QLVd6G/W1afjyuCJbDUSIY=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
index 345c66b33ca1a..b94837ef46d06 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-julia",
-  "rev": "0c088d1ad270f02c4e84189247ac7001e86fe342",
-  "date": "2023-09-04T11:11:28-05:00",
-  "path": "/nix/store/4zj06y16xi9ab4syip4cxcfw2wb2x5zm-tree-sitter-julia",
-  "sha256": "16l2flg1pzfcqd02k05y90ydmnki5vzp2m9rf2j2afr8slnawjaq",
-  "hash": "sha256-WEmuLNUoOyWkcDlVcf8ucdraPEi+gClAw8z9Gx51gpo=",
+  "rev": "e84f10db8eeb8b9807786bfc658808edaa1b4fa2",
+  "date": "2024-02-14T19:03:11-05:00",
+  "path": "/nix/store/wv5r1xw2f3bfk4rqg660m6pqkwfdin68-tree-sitter-julia",
+  "sha256": "1fqirr8yjwmjy5dnfxk0djafq0hnl18mf28i7zg2gsfvy9a27d4f",
+  "hash": "sha256-jrQjVPLb6SfePxEJV1GgFgLslGxgdmdb8bJy6VHOEbs=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
index 46e3c31dc394e..e1b2ed4e16228 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/IndianBoy42/tree-sitter-just",
-  "rev": "f807ab33c36651ecb503a291aed933932754864d",
-  "date": "2024-01-11T04:53:14-05:00",
-  "path": "/nix/store/f6b4xvxkbzrwmxk8vr1gz4c3g3pqh2hz-tree-sitter-just",
-  "sha256": "1ng49slp5x98s9ydc7gha7gkcj93ks4iv0ixc7n0z9dr4akqrbw8",
-  "hash": "sha256-iK+MpyK5pQ/sYT2CHYmeI0k231HwHdZ80ij1cqlO5Nk=",
+  "rev": "442538ab5ae0913b05e0269a988b4d452dfa5361",
+  "date": "2024-03-19T12:21:46-05:00",
+  "path": "/nix/store/ibqsrr59gr2ww1z5f9vr4q2fdvz9gmmy-tree-sitter-just",
+  "sha256": "1zcc7qsapcq8rs0myknx8bd8svcb18gwgpcqzh5jw1cf1c45yryr",
+  "hash": "sha256-2WdfCAuOBS4L/Jjdxx8Ki22N2kLdTl+BzgizqzQ+jP0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
index 2c73ae9d6ea0d..ecd5333bc045f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/fwcd/tree-sitter-kotlin",
-  "rev": "607af7be5606ad6580246cd9c68fc615e1ad97fd",
-  "date": "2021-10-12T01:11:47+02:00",
-  "path": "/nix/store/49cvpcypxjzpb0srcpd383ay9f0g19dy-tree-sitter-kotlin",
-  "sha256": "1sisvx7cp95d309ykhimn8bhbwd1lzcwrpz3s0mdsb2i44p69469",
-  "hash": "sha256-yZBkLiFRLN0q0OPfzNmnofEFF7I1wukTGK2ky07fOuo=",
+  "rev": "51e451be6c18e2cc123249f49edf8e26fc50311c",
+  "date": "2024-03-14T00:25:12+01:00",
+  "path": "/nix/store/ab6r0biy5244mbw88zxbskfxi0xs4r6s-tree-sitter-kotlin",
+  "sha256": "0s41qgir95lcc68y2xvy7zzai7mm58mlx6w7xkndpc5jvgkc3akx",
+  "hash": "sha256-farB5tuysNvs7IebTisqtZ6o/j9+d+GRYYyWlOPDgWg=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
index 379628e12e05d..d0bbf38f3b887 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/MunifTanjim/tree-sitter-lua",
-  "rev": "9668709211b2e683f27f414454a8b51bf0a6bda1",
-  "date": "2023-09-07T13:41:24+06:00",
-  "path": "/nix/store/lahwsbw8a5lp7jg68wx7mfkhzz6sxzxl-tree-sitter-lua",
-  "sha256": "0iqqfncsli57ih5inllfzg5s8f9px7wdnddh6lkz4ycvmbq71pp6",
-  "hash": "sha256-5t5w8KqbefInNbA12/jpNzmky/uOUhsLjKdEqpl1GEc=",
+  "rev": "a24dab177e58c9c6832f96b9a73102a0cfbced4a",
+  "date": "2024-03-11T11:40:44+02:00",
+  "path": "/nix/store/dia2ry7m40yxfn4l4191c0by58vb2yn8-tree-sitter-lua",
+  "sha256": "1184dazb4agqf3v55sz8i7xmynsn4rkddhbph3mgmh5qsnk88mmq",
+  "hash": "sha256-uFaEptW4wPrqgHfB1mYmVltf+4no61L2cPgpsr5qBIU=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
index 2be685060e15a..68a671d810daa 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/MDeiml/tree-sitter-markdown",
-  "rev": "aaf76797aa8ecd9a5e78e0ec3681941de6c945ee",
-  "date": "2023-07-22T13:25:09+02:00",
-  "path": "/nix/store/5j100a9ksm598pvzzpdw91mmwxi11d03-tree-sitter-markdown",
-  "sha256": "1kksp7vx29f8qflg3sc1gi22xv24g7n9jz93v3fqvc4frx8iyyp0",
-  "hash": "sha256-4HofUc+OsI3d2CN9mex5ROwuRHyB6fGow8gl0fe5es4=",
+  "rev": "b2f01981a76e3251f5b660378136c248ed106b81",
+  "date": "2024-03-13T23:51:05+02:00",
+  "path": "/nix/store/z986603ky7a41d48i0rxkd23y5k1bxc7-tree-sitter-markdown",
+  "sha256": "183ig6p39wzlmb8vz5hyjr4787s03b8gsw5p210qxkl3xs46s37a",
+  "hash": "sha256-6gxtiO6Dzo5BELdw/dAaQB90SJYelr/RqvTzNK55caA=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
index 5db0b861a8fc3..90dff573ed1ea 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/nickel-lang/tree-sitter-nickel",
-  "rev": "b759233581fd8bae239e905c67a9ba453205da78",
-  "date": "2023-09-14T10:23:29+02:00",
-  "path": "/nix/store/s035753cs69k3pxcxn6pgmynfs9rlnxr-tree-sitter-nickel",
-  "sha256": "1y118sbpxqw045ys7y5g8iywa11b3jyldc8rzkc79c2jbavdvsp0",
-  "hash": "sha256-4OrdtlpSsHTY/BmxRr0cKwTFfUSv+KN9IYDjfpdGIfg=",
+  "rev": "58baf89db8fdae54a84bcf22c80ff10ee3f929ed",
+  "date": "2024-03-07T15:18:26+00:00",
+  "path": "/nix/store/z386k8b1asbadh303dpzkhydv8r4f6fz-tree-sitter-nickel",
+  "sha256": "1a62cngravp7pq3gs582larbd0my7k323s48rgidhpd7b5gkmrjs",
+  "hash": "sha256-WuY6X1mnXdjiy4joIcY8voK2sqICFf0GvudulZ9lwqg=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
index 797b2b19ea949..2fa6470e2a358 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/nvim-neorg/tree-sitter-norg",
-  "rev": "1a305093569632de50f9a316ff843dcda25b4ef5",
-  "date": "2023-02-12T20:47:35+01:00",
-  "path": "/nix/store/w7drx78c8w9claw3c6h7vlxdhyvfj8j6-tree-sitter-norg",
-  "sha256": "1wl6h5pin861msgmg5q3k0h62fl73svdwn0ppn4vp7a37s9p5xvm",
-  "hash": "sha256-dfdykz5DnbuJvRdY3rYehzphIJgDl1efrsEgG2+BhvI=",
+  "rev": "014073fe8016d1ac440c51d22c77e3765d8f6855",
+  "date": "2023-10-02T20:20:59+02:00",
+  "path": "/nix/store/xi96cyvgn1443wf54ykc90y80fqdmgzv-tree-sitter-norg",
+  "sha256": "05zrcglnpvyqx0gczzkx05qc95y5n3slbhjig7dqjyxvphyzf0nk",
+  "hash": "sha256-0wL3Pby7e4nbeVHCRfWwxZfEcAF9/s8e6Njva+lj+Rc=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
index cc31e36aee6b7..7bb3fd3c6f1ae 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/nushell/tree-sitter-nu",
-  "rev": "a0b80b2e21e5e39571252dc799e19eb89f1fc912",
-  "date": "2023-12-21T08:27:09-06:00",
-  "path": "/nix/store/nlczvz84gk9jjjiijczwyn1isy1rn1k7-tree-sitter-nu",
-  "sha256": "1y9bsdg9v7znlc1k4xxraaj8f8fn5m3zyc0r2m9fff2if9ijpll1",
-  "hash": "sha256-gdIrY3JROOdSFRkw/0ct1iGHpFK5dzIDo/afnV7TK/k=",
+  "rev": "c5b7816043992b1cdc1462a889bc74dc08576fa6",
+  "date": "2024-03-09T11:27:22-06:00",
+  "path": "/nix/store/gcmmkjxfhf4y1qc3fvbaww5pfcdbjlhv-tree-sitter-nu",
+  "sha256": "0g9b7d6306z96x90w9v687nyws5jrh5jy2cm8yxhaz3xgq9v3s1z",
+  "hash": "sha256-P+ixE359fAW7R5UJLwvMsmju7UFmJw5SN+kbMEw7Kz0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
index 24f45bacb80d4..95e3bed434e43 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-ocaml",
-  "rev": "694c57718fd85d514f8b81176038e7a4cfabcaaf",
-  "date": "2023-07-17T22:31:47+02:00",
-  "path": "/nix/store/2nq7apr98j81va00y74mfhcrqqdb7gwh-tree-sitter-ocaml",
-  "sha256": "03zqsdm6yy7g3ml0lganh4qg6vfc301255kg756y1icclgdfywcg",
-  "hash": "sha256-j3Hv2qOMxeBNOW+WIgIYzG3zMIFWPQpoHe94b2rT+A8=",
+  "rev": "dabe60a96553fbbda0a58b6ccda12b7d44047cb5",
+  "date": "2024-03-17T14:43:34+01:00",
+  "path": "/nix/store/sv3zz52xfyda4iwjwxfkyadg0bj1d2kj-tree-sitter-ocaml",
+  "sha256": "0pkw9bclbndcakaywdwj0ffvak78h68fjlbckdainfz99xgvg732",
+  "hash": "sha256-Ypy3X0/pOxtVm2xR6ZCB6Ey1nQOSN+7VVKzZRdlKfF4=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
index be45f9a7aee70..025f5005b9ddd 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/ganezdragon/tree-sitter-perl",
-  "rev": "ba2a3411ab2270df7f6da8689d50a1fe29811d06",
-  "date": "2023-07-29T21:08:04+05:30",
-  "path": "/nix/store/rfnlnycbqxp4hwzgig60l9i0w89p2g5a-tree-sitter-perl",
-  "sha256": "1kkap2vqa95z5fh63qvy1jd87d5s6qb79bqm91p210i9yj5270zr",
-  "hash": "sha256-+YMjivQpgiBuSBWvdBY2urSDmgx+42GgK78khbe4as4=",
+  "rev": "a882a928d4930716896039d1c10e91b6d7444c48",
+  "date": "2024-03-03T23:09:15+05:30",
+  "path": "/nix/store/6v3jxaiad68k4rak3ihqn1vxqah1pi85-tree-sitter-perl",
+  "sha256": "0ss26x37ldj4v6pwbijrz0hbnvj8xrm8cj3y1n1f2xanzvcalz15",
+  "hash": "sha256-JXyq2P5WdeGCDX5IhmruSG67IPhZxsWv2UQ2ekY3Qms=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
index c407d303c1dbd..2d45886a8df43 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-php",
-  "rev": "a05c6112a1dfdd9e586cb275700931e68d3c7c85",
-  "date": "2023-09-16T22:44:24-04:00",
-  "path": "/nix/store/sswg2fpbb5l59g0kdhzxks2k2mqamv1w-tree-sitter-php",
-  "sha256": "1z54hgzkcqrjh6w7bp5hh8g27wli04x0pq8imwal8ml1gi7bvpzn",
-  "hash": "sha256-9t+9TnyBVkQVrxHhCzoBkfIjHoKw3HW4gTJjNv+DpPw=",
+  "rev": "78a78df5e06b4c13173af2a1f607c9a853d0f240",
+  "date": "2024-02-25T14:41:06-06:00",
+  "path": "/nix/store/h63hh37wn6khk4gj4v1yv37w7kxgr595-tree-sitter-php",
+  "sha256": "07022kisc2r5pfcbv0smh5gnn9v0i7jazfbvckczz15d0wwrpfip",
+  "hash": "sha256-N7qbOQethP/ZZHu5r+SJYCdrX4FVg72YuyULpuMUAhw=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
index ce43cb5dda88d..257b3e4053464 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-python",
-  "rev": "a901729099257aac932d79c60adb5e8a53fa7e6c",
-  "date": "2023-09-21T03:55:53-04:00",
-  "path": "/nix/store/arzga89mcw3yns4cxdy7rwyr6qrfyymp-tree-sitter-python",
-  "sha256": "1kkpaf8gmkb9nkggdlhqjm8ddi20p8dckrrh80c6r4j3rpf46641",
-  "hash": "sha256-gRhD3M1DkmwYQDDnyRq6QMTWUJUY0vbetGnN+pBTd84=",
+  "rev": "b8a4c64121ba66b460cb878e934e3157ecbfb124",
+  "date": "2024-03-12T19:59:41-04:00",
+  "path": "/nix/store/qyvpyxlyxxmc1rwqvy14j9z1pjnpxbw9-tree-sitter-python",
+  "sha256": "12bgdbhkxl7lrca4257wnjks1m4z3mv5mzw5cfbyr91ypv59cfk5",
+  "hash": "sha256-ZTqWyr4+pOyXY4X/WnYdn9Sgp7T8FEEUy/TQPuFqb4k=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
index a03f115be9574..eb790ecf9cd86 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-ql",
-  "rev": "bd087020f0d8c183080ca615d38de0ec827aeeaf",
-  "date": "2022-08-17T11:53:16+02:00",
-  "path": "/nix/store/id24yb922kcjnqx160b5hga65k9zmnkh-tree-sitter-ql",
-  "sha256": "18yv6sag794k0l7i0wxaffxhay6zgwnap5bbhi48h04q1cvas0yr",
-  "hash": "sha256-2QOtNguYAIhIhGuVqyx/33gFu3OqcxAPBZOk85Q226M=",
+  "rev": "ff04ba61857ba05b80221e71b423b2728dbebe1e",
+  "date": "2024-02-14T19:32:53-05:00",
+  "path": "/nix/store/9s2i55p2nm5lz9lkxs2kkmhiy3zlgx8l-tree-sitter-ql",
+  "sha256": "1wdjy8287823rgl1vibljgf129ll9srxn9n6m1piaj3z46lv5b7x",
+  "hash": "sha256-/ayyqSF/SBVvqMYm27NOlCYR3JN0xR3oy0OggwTysvE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json
index 1dbdb3291d2f9..80676906d8dd1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/nvim-treesitter/tree-sitter-query",
-  "rev": "e97504446f14f529d5a8e649667d3d60391e4dfd",
-  "date": "2023-03-09T05:33:03-08:00",
-  "path": "/nix/store/3p8d4hl2bnm1fzn0nx7zc62l73118vm2-tree-sitter-query",
-  "sha256": "0xd00idgmyr55yd10xaxma1pwahlvn7gqy78zf8zknfbqvd3rzqs",
-  "hash": "sha256-Gv882sbL2fmR++h4/I7dFCp+g6pddRCaLyX7+loEoHU=",
+  "rev": "176a380df78800167565118bb0dadfc961abbd43",
+  "date": "2024-03-07T12:57:53+02:00",
+  "path": "/nix/store/wa9dwqw4z7gcsnizch00sssjfl35arpf-tree-sitter-query",
+  "sha256": "0w0f3zymch27s923j4wkxjn2rfgf2qrhsrcrxf56nxmsgbbkdlvg",
+  "hash": "sha256-b9M213q6dmuK65llDTMW7rksrOyTEzlE0kdAVv0fDnA=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
index fec31ced29cc8..24fa8e0c9c8f5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-regex",
-  "rev": "2354482d7e2e8f8ff33c1ef6c8aa5690410fbc96",
-  "date": "2023-07-19T17:58:43-04:00",
-  "path": "/nix/store/bvsgqya54sh9qxcida01iwcsl5schqhh-tree-sitter-regex",
-  "sha256": "1b5sbjzdhkvpqaq2jsb347mrspjzmif9sqmvs82mp2g08bmr122z",
-  "hash": "sha256-X4iQ60LgiVsF0rtinVysX16d6yFjaSmwwndP2L5cuqw=",
+  "rev": "ba22e4e0cb42b2ef066948d0ea030ac509cef733",
+  "date": "2024-02-14T19:05:11-05:00",
+  "path": "/nix/store/9fwryyszxm2fj1pm0l5p641yqiyggcvp-tree-sitter-regex",
+  "sha256": "02nxl4s5vx8nsmhg7cjaf45nl92x8q60b7jhlp29qdqvbgg35gwr",
+  "hash": "sha256-mb8y3lsbN5zEpVCeBQxGXSRqC3FKsvNg1Rb1XTSh3Qo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
index 16f2d8b4b3de6..0cf6618b45b71 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/FallenAngel97/tree-sitter-rego",
-  "rev": "b2667c975f07b33be3ceb83bea5cfbad88095866",
-  "date": "2022-11-18T14:07:12+02:00",
-  "path": "/nix/store/ky8xv5v5i273n0zqin0mnsx810382wfn-tree-sitter-rego",
-  "sha256": "18qw5ahx6qcfq9gs6gcakl178gnnryksv6gyamyd6vypz20kwz6b",
-  "hash": "sha256-y3w+gfjXb9N8Vf6ZrafP1j50Ap2KPaNfwo5h06EqHKM=",
+  "rev": "9ac75e71b2d791e0aadeef68098319d86a2a14cf",
+  "date": "2023-11-03T09:13:53+02:00",
+  "path": "/nix/store/7v3znqfnq89ik6svp70fzsin8j4ydl4s-tree-sitter-rego",
+  "sha256": "12napwjsv4hx2k4ad0p2v3mv4lhxgp894riglyqmidxxkikzma9g",
+  "hash": "sha256-L6n6Z5y9t1ixpy9mktB9HVKy69jigqbIFB2SrSW/yoo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
index 2cb04c8940d1c..f9ea1c01fafaa 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-ruby",
-  "rev": "fe6a2d634da0e16b11b5aa255cc3df568a4572fd",
-  "date": "2021-03-03T16:54:30-08:00",
-  "path": "/nix/store/ragrvqj7hm98r74v5b3fljvc47gd3nhj-tree-sitter-ruby",
-  "sha256": "0m3h4928rbs300wcb6776h9r88hi32rybbhcaf6rdympl5nzi83v",
-  "hash": "sha256-e6D4baG3+paNUwyu5bMYESKUEzTnmMU4AEOvjEQicFQ=",
+  "rev": "7a010836b74351855148818d5cb8170dc4df8e6a",
+  "date": "2024-02-10T23:07:01-05:00",
+  "path": "/nix/store/3k3zb8n4cy49hgzaai20ka8r3fam8djc-tree-sitter-ruby",
+  "sha256": "03d96cv6iqmyak2jw4wffyynmh9hqk8d4i4sgn5d5w24wfv6r3lb",
+  "hash": "sha256-i45stuNE8NKKfZpE0tDEMMFqvXeOEy7FVL7iaDYzqQ0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json
index c95bab92d3092..20b895d5d97a0 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-rust",
-  "rev": "48e053397b587de97790b055a1097b7c8a4ef846",
-  "date": "2023-09-21T23:15:14+00:00",
-  "path": "/nix/store/m01z8llh3nckvr7iiyap5mr91iisx6r1-tree-sitter-rust",
-  "sha256": "0jc8sisfj50jra89y3p6pv0b2smn125m4nvkaidz1cnympajbpc6",
-  "hash": "sha256-ht0l1a3esvBbVHNbUosItmqxwL7mDp+QyhIU6XTUiEk=",
+  "rev": "3a56481f8d13b6874a28752502a58520b9139dc7",
+  "date": "2024-03-10T12:55:02-04:00",
+  "path": "/nix/store/91xc2kv7dql3waccf2ih7k55bjw03n4z-tree-sitter-rust",
+  "sha256": "12806974pngxqv1brj4r15yqzp2fdvid926n7941nylgmdw9f4z9",
+  "hash": "sha256-6ROXeKuPehtIOtaI1OJuTtyPfQmZyLzCxv3ZS04yAIk=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
index 699ff6af97169..719d4ce9e2d1b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-scala",
-  "rev": "d50b6ca5cc3d925e3d1f497199cb8d8383ddae8a",
-  "date": "2023-08-20T03:15:51-04:00",
-  "path": "/nix/store/nb0987awf0a098gl9b43whbjlgxc428h-tree-sitter-scala",
-  "sha256": "0hs6gmkq5cx9qrmgfz1mh0c34flwffc0k2mhwf13laawswnywfkz",
-  "hash": "sha256-fzruLddcKTqC47CKCZhznDoyGIA1fPdqxqmzgmd9RkM=",
+  "rev": "b3ac6a5d959d3137e7f3146d4d9f7899872177de",
+  "date": "2024-03-12T14:34:11-04:00",
+  "path": "/nix/store/zi4bjbmxlhp003lk37pcyf5kg9m2wcf6-tree-sitter-scala",
+  "sha256": "1j2ivdm21c5db54rcff00n7bqcfrfjc91jwlfl4a2cm363hbrym2",
+  "hash": "sha256-ovq84DCjMqEIdZTLkJh02TG8jgXAOZZJWa2wIGrbUcg=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
index be1d9fa8e1a61..bdb762ed83cc5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/6cdh/tree-sitter-scheme",
-  "rev": "85b6188fb77c03dfb01d13e58e2844450506860c",
-  "date": "2023-09-01T09:52:02+08:00",
-  "path": "/nix/store/0ckxw6q3nh5vb2lmibzy2kw2p4kcrqf4-tree-sitter-scheme",
-  "sha256": "0rrygynsispdpkc5npvfcxri4x9n5w7j3ffbh27j5j8yw2jr1s5z",
-  "hash": "sha256-v+iQpeAeySKPgMu5IQ8vNnUSc2duX1vYvO3qqK1/Pmc=",
+  "rev": "184e7596ee0cbaef79230cae1b4ee5bb4fbad314",
+  "date": "2024-03-15T19:06:15+08:00",
+  "path": "/nix/store/wdhalppgf16xgcrm3llj0al5dimya5pc-tree-sitter-scheme",
+  "sha256": "0sqccw5az31di8jhb88v3afryiz7a4136g9a9xq8qni4znifw7y3",
+  "hash": "sha256-wx/uov0kWoxwTyo9MwJR50efnRoboQUlii2MrwpnDGs=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
index 7034af3f1c194..f777d50e6d5ec 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/JoranHonig/tree-sitter-solidity",
-  "rev": "168020304759ad5d8b4a88a541a699134e3730c5",
-  "date": "2022-12-14T12:24:29+01:00",
-  "path": "/nix/store/37x7jqscpg36xncjy7i4zbvmx42dc1wh-tree-sitter-solidity",
-  "sha256": "1bg7q7l5jv5xrr7pfzg6i3bfgs6mrzzflh3rf4lqcd373xf8290q",
-  "hash": "sha256-GCSBXB9nNIYpcXlA6v7P1ejn1ojmfXdPzr1sWejB560=",
+  "rev": "b239a95f94cfcc6e7b3e961bc73a28d55e214f02",
+  "date": "2024-03-12T10:13:22+00:00",
+  "path": "/nix/store/8bi3z4l3g890xgb7karzpqfinrcadk26-tree-sitter-solidity",
+  "sha256": "0kb8d6j81pv5bas7nfvq5wv12paicrv833d7iin5z0zy4y2fvqkg",
+  "hash": "sha256-b+LthCf+g19sjKeNgXZmUV0RNi94O3u0WmXfgKRpaE0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
index 41073e08e8c01..b18c4d8c71ef5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/derekstride/tree-sitter-sql",
-  "rev": "39750c48bf9ad63bcc1399554355b0aa0aaa1c33",
-  "date": "2023-09-07T13:39:32+00:00",
-  "path": "/nix/store/x1swbby8g0l0r7szdlgiqsqj3sdjambc-tree-sitter-sql",
-  "sha256": "1dnvmazyinchqj8gsv836m1kclycri0ypi4bf712nx3avw4ajwfz",
-  "hash": "sha256-33GpCN9qdCvCcYvE60HMzFM2QzUDbf2QxJDZ6L+q27Y=",
+  "rev": "c85ffb5228dd643d447ad8ebc75884f6c4fc6158",
+  "date": "2023-12-15T15:40:26-05:00",
+  "path": "/nix/store/mj8yhb4hs86y2yqyz4znpdp9x9bbd8bl-tree-sitter-sql",
+  "sha256": "0p6ay475y30wq949hrffl31lj46axkqi8abf71ak54dibx0892l3",
+  "hash": "sha256-g4qEQF+xkTJVOG4pFPHsyhBJw6DOZZhIwhwMXw7xylw=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
index 240368e1e55d2..256888ebf3fea 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/vrischmann/tree-sitter-templ",
-  "rev": "14d105789af342f7f0c32bff2fec1a6edec59f60",
-  "date": "2023-12-29T22:31:39+01:00",
-  "path": "/nix/store/8yixhjmhynryb79g3wff5kxgz35ncg3n-tree-sitter-templ",
-  "sha256": "1hr0l9ibm12ggiyk5m3h12fjgrdkfv7d2qlcfy6l6c10k4ghngf2",
-  "hash": "sha256-wj0LH5kgMEONd4xi0c52s+UnnQhw1DJ9fE+EumKiIMM=",
+  "rev": "592faa3186ef857c92e4bd1c31d73c07a4a334db",
+  "date": "2024-02-06T21:43:24+01:00",
+  "path": "/nix/store/nqchnmjz07500x1s9fqrvkzrzvzjls5d-tree-sitter-templ",
+  "sha256": "1i26q3ci8w14c8z5lsibpbza0xwn7cp6hl46c52c98wvr0zpwzax",
+  "hash": "sha256-XX1+P8ibo8REYYZQaC47lneg/roralo+YiRwFNnARsQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
index 69890d3d33fd9..e42a0ec6fc17d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tlaplus-community/tree-sitter-tlaplus",
-  "rev": "7ba226cf85280c7917d082940022006e6a3b7b6f",
-  "date": "2023-03-28T17:13:15-04:00",
-  "path": "/nix/store/biqm93z4n1ravfi5bs466fbp4bxadjmk-tree-sitter-tlaplus",
-  "sha256": "0md800h54792nv1mfzdw7wyjzz8wx5cvl6mzlb8l70p0ihjfrk1s",
-  "hash": "sha256-OszsJIzggkPRor8aulnpHP0vPT+8fVfDtiIdUiAAqFU=",
+  "rev": "3896a5be761f04ffb22a841b2a0672f7a8a43ef9",
+  "date": "2024-03-11T11:12:33-04:00",
+  "path": "/nix/store/7dq157m7v3mq9iscmjbywm3sy1p9hgyh-tree-sitter-tlaplus",
+  "sha256": "0bjyf470anxialbmphn19r7pdnni181r45zyyfrl9db2fsgz3q0h",
+  "hash": "sha256-EODxn3ZitUSz8/4XkgMK0dp2T07BwlsXVbFbBQ5xXi4=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
index 7aa30ca2812d6..cf6c2941a2411 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-tsq",
-  "rev": "b665659d3238e6036e22ed0e24935e60efb39415",
-  "date": "2021-05-18T15:57:40-04:00",
-  "path": "/nix/store/j59y4s3bsv6d5nbmhhdgb043hmk8157k-tree-sitter-tsq",
-  "sha256": "03bch2wp2jwxk69zjplvm0gbyw06qqdy7il9qkiafvhrbh03ayd9",
-  "hash": "sha256-qXk1AFwZbqfixInG4xvGBnC/HqibXvmTmZ1LcbmAbA0=",
+  "rev": "49da6de661be6a07cb51018880ebe680324e7b82",
+  "date": "2024-02-24T05:44:09-05:00",
+  "path": "/nix/store/jhz3i20lmr3cfwdxp3h6qad6dw1s7yxi-tree-sitter-tsq",
+  "sha256": "1np9li55b28iyg5msmqzkp7ydd887j2nb2fzx3jmzx3ifb533plr",
+  "hash": "sha256-md4xynJx9F/l6N+JZYU8CLXmz50fV13L8xGJVUqk6do=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
index f27faebc4d499..bd97462e4bd7e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-typescript",
-  "rev": "b1bf4825d9eaa0f3bdeb1e52f099533328acfbdf",
-  "date": "2023-07-19T03:17:33-04:00",
-  "path": "/nix/store/c858575avx33nmi4annm51fhasv43xm9-tree-sitter-typescript",
-  "sha256": "1r74108lxyp8hsq0pysy0na4kgn06b4xk4yrlq77fw8jr6vs54m1",
-  "hash": "sha256-oZKit8kScXcOptmT2ckywL5JlAVe+wuwhuj6ThEI5OQ=",
+  "rev": "eb6b845dee9ee22987262699a152312604313662",
+  "date": "2024-01-31T10:42:05-05:00",
+  "path": "/nix/store/f8pj12fbzxfipidrj1srz3ld8qw5x4h7-tree-sitter-typescript",
+  "sha256": "1109v1w6icm018hkc41ysn5iflc9gq2q02v23dy4bnfas7kzizyc",
+  "hash": "sha256-zP/459HK2UV8G2ILgAV+iVEXi9U+EDYhCqCyaHjYCYQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
index 0f35892e4d8ed..4333285d9e515 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/uben0/tree-sitter-typst",
-  "rev": "791cac478226e3e78809b67ff856010bde709594",
-  "date": "2023-10-01T17:18:34+02:00",
-  "path": "/nix/store/fsdpsqf4g0maba3lqnq7237hvp443wn0-tree-sitter-typst-791cac4",
-  "sha256": "1mwj2qf1k1pfd892lkpw6jsd014209aiz6kdsyh5mhxgnb4893v0",
-  "hash": "sha256-YI+EyLKvw1qg122aH1UCggTQtDT8TioSau6GGRwWktc=",
+  "rev": "77e23188c3a4287f6ff37f545722ac872a260ee8",
+  "date": "2023-12-30T18:08:13+01:00",
+  "path": "/nix/store/0zb749g1r03b3wnzfb3p98y33vyd8ybn-tree-sitter-typst",
+  "sha256": "02k5y63wh1gsfpfczrc86gkjr9ip4zqn21wbf6mxmm6qhmr5vkvz",
+  "hash": "sha256-f89dcoXY1NqrcYsHYfEnN6Ys5zOI5c/cdfoFyIfxZQo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
index 89e087c661c14..7db26325a7fda 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/shnarazk/tree-sitter-uiua",
-  "rev": "aa1e0202dbf2ba654d79f880b86f6c1073d81b20",
-  "date": "2023-11-20T13:01:37+09:00",
-  "path": "/nix/store/lawqd38bskf5gxsls3w9jjgdaj08q1ym-tree-sitter-uiua",
-  "sha256": "0sn1vrpdkkaw2j6sp403bhijz3561n0qjh2wcpgp6qbqaxj4gxap",
-  "hash": "sha256-V/VHZFd4YXPfZVxAiYENpowvI1wDkKuNFFzN2W7ewWo=",
+  "rev": "942e8365d10b9b62be9f2a8b0503459d3d8f3af3",
+  "date": "2024-02-29T15:18:16+09:00",
+  "path": "/nix/store/ahzzkr0wlxkxwnmp7sysjhfcgdfy4lkh-tree-sitter-uiua",
+  "sha256": "1pwhdsvdi6p70r9iij3mqnpdl0m2vz242l2qxlanplfcasf58sf9",
+  "hash": "sha256-yWlUnFbM0WsV7VhQQcTfogLarsV1yBhTBuea2LZukN8=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
index d802999df25c8..daa765d0c95d8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-verilog",
-  "rev": "902031343056bc0b11f3e47b33f036a9cf59f58d",
-  "date": "2023-07-28T00:21:49-04:00",
-  "path": "/nix/store/nnd12xzsd387bng3yp4zlgvsaya24r7x-tree-sitter-verilog",
-  "sha256": "1mrgdi0aj2bm4f2jdz93r1c3m1hiymjfhd2pc14xlz6waxpd48zg",
-  "hash": "sha256-7yPSblfcfNpJYFc06GT1EYY6WMgj/SaFI3UJqUBsL9c=",
+  "rev": "2dfddfcb891f74a1cdb9d8ce480a997d11846e17",
+  "date": "2024-02-14T20:12:08-05:00",
+  "path": "/nix/store/6jdd5vk6m85h4mir572admz08pcp7yqx-tree-sitter-verilog",
+  "sha256": "0qqk9066wlwjrmac43i1irjfnimbkdxwvx4srnnkjv466sn7si3s",
+  "hash": "sha256-ekR9rDaGbDmtzZr0zXubq0brZI4hDsJUzZJTbgxIE2M=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
index 15b26649a73b1..83c5a7ad66576 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/winglang/wing",
-  "rev": "60c61fd6b6e2e6dbea7c206653d3e360435bfee2",
-  "date": "2023-09-25T21:05:07+00:00",
-  "path": "/nix/store/rb1g46ia45yjh9bsf6d99nzgs0yf8vl9-wing",
-  "sha256": "0hig7ll1rph3i4fqwpcxadyjxa9d0ipscmhs33jdir2brhw93vmp",
-  "hash": "sha256-t+6ROMxL5NjkGBpWpm8ELakufVOdXY4diQPeHCg9L0I=",
+  "rev": "a43b5524b0adbb553d874a6ea8d08a2d791f56c5",
+  "date": "2024-03-21T08:10:44+00:00",
+  "path": "/nix/store/v4qvjygfjjx04c5jn0p96hx5zd3skvsx-wing",
+  "sha256": "1wqj0ilb9mqbghsby5ls0qm7jf5vi2zsihnwjnksj9lnrng368xh",
+  "hash": "sha256-sCMzns2WJqmnldzCqL+Iuzh5KgaaFr80fAvXtGgEEvM=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/update.nix b/pkgs/development/tools/parsing/tree-sitter/update.nix
index d2c0eb7b0b6fa..9b7558b53c7b4 100644
--- a/pkgs/development/tools/parsing/tree-sitter/update.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/update.nix
@@ -77,6 +77,16 @@ let
     "tree-sitter-fluent"
     # to unblock my update
     "csharp-tree-sitter"
+
+    # Non-grammar repositories
+    ".github"
+    "fuzz-action"
+    "parse-action"
+    "parser-setup-action"
+    "parser-test-action"
+    "parser-update-action"
+    "setup-action"
+    "workflows"
   ];
   ignoredTreeSitterOrgReposJson = jsonFile "ignored-tree-sitter-org-repos" ignoredTreeSitterOrgRepos;
 
diff --git a/pkgs/development/tools/renderdoc/default.nix b/pkgs/development/tools/renderdoc/default.nix
index f98d9ce201c3d..a5bc15ef3165f 100644
--- a/pkgs/development/tools/renderdoc/default.nix
+++ b/pkgs/development/tools/renderdoc/default.nix
@@ -32,13 +32,13 @@ let
 in
 mkDerivation rec {
   pname = "renderdoc";
-  version = "1.31";
+  version = "1.32";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "sha256-R9TMkq9bFRyA7oaPPp0zcUf+ovveLCcuxrm7EokyTbc=";
+    sha256 = "sha256-8Q2QMANieY/Bvb50NtlZEN/Nmd6xurU6AJU0Uo8qDTs=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 6b2b720590e66..17e43d5fe593d 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.3.7";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PS4YJpVut+KtEgSlTVtoVdlu6FVipPIzsl01/Io5N64=";
+    hash = "sha256-VTFwuNoqh0RLk0AHTPWEwrja0/aErmUlz82MnCc58jA=";
   };
 
-  cargoHash = "sha256-kxzI/MlhboF0cWnyciK4vewWGXijPsOV0tPzfo1DHWc=";
+  cargoHash = "sha256-COZGGmc6v3WGh8NICoRZ5iYrVs0tML8gG2b1LqWbJs0=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/rust/cargo-dist/default.nix b/pkgs/development/tools/rust/cargo-dist/default.nix
index bd87644a7d38e..04aae84d0d860 100644
--- a/pkgs/development/tools/rust/cargo-dist/default.nix
+++ b/pkgs/development/tools/rust/cargo-dist/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-dist";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "axodotdev";
     repo = "cargo-dist";
     rev = "v${version}";
-    hash = "sha256-uav2Q6NG7JW3ZrYkDWXNxR816bI3nxs71KoOdNr/unQ=";
+    hash = "sha256-sD3Y/FFfUgMtvBoSP0BBhS5aCZy+TkyO8S28q8Hoc5I=";
   };
 
-  cargoHash = "sha256-Kd7roUUfXfWlV6IHpu20f0VPoZWmGOPAJjELNqVS3b8=";
+  cargoHash = "sha256-efVhaL1yUEpOgNZ4Bog1OB37lT1yQHJVE9M938jnGeE=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/rust/cargo-modules/default.nix b/pkgs/development/tools/rust/cargo-modules/default.nix
index b237c64dc2af7..6fa78cef0b4d0 100644
--- a/pkgs/development/tools/rust/cargo-modules/default.nix
+++ b/pkgs/development/tools/rust/cargo-modules/default.nix
@@ -2,21 +2,44 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.11.2";
+  version = "0.15.5";
 
   src = fetchFromGitHub {
     owner = "regexident";
     repo = pname;
-    rev = version;
-    hash = "sha256-dfeY9YylHF1QHNv7yTNYxUBxzcb276H80WL6JgXR/KY=";
+    rev = "v${version}";
+    hash = "sha256-+jHanZ2/BIgNLUpMlibfUAVfA6QTPlavRci2YD1w3zE=";
   };
 
-  cargoHash = "sha256-elzLO2YNDsD9FjCW0+2pUWgcJzOvzK+lyZBxrjVXoA8=";
+  cargoHash = "sha256-umaKVs1fFiUKz2HIJuB+7skSwRQbG12dl9eD+et42go=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
   ];
 
+  checkFlags = [
+    "--skip=cfg_test::smoke"
+    "--skip=colors::ansi::smoke"
+    "--skip=colors::plain::smoke"
+    "--skip=colors::truecolor::smoke"
+    "--skip=focus_on::glob_path::smoke"
+    "--skip=focus_on::self_path::smoke"
+    "--skip=focus_on::simple_path::smoke"
+    "--skip=focus_on::use_tree::smoke"
+    "--skip=functions::function_body"
+    "--skip=functions::function_inputs"
+    "--skip=functions::function_outputs"
+    "--skip=max_depth::depth_2::smoke"
+    "--skip=selection::no_fns::smoke"
+    "--skip=selection::no_modules::smoke"
+    "--skip=selection::no_traits::smoke"
+    "--skip=selection::no_types::smoke"
+    "--skip=fields::enum_fields"
+    "--skip=fields::struct_fields"
+    "--skip=fields::tuple_fields"
+    "--skip=fields::union_fields"
+  ];
+
   meta = with lib; {
     description = "A cargo plugin for showing a tree-like overview of a crate's modules";
     mainProgram = "cargo-modules";
diff --git a/pkgs/development/tools/rust/cargo-show-asm/default.nix b/pkgs/development/tools/rust/cargo-show-asm/default.nix
index 1e313595358f9..bd08268d59287 100644
--- a/pkgs/development/tools/rust/cargo-show-asm/default.nix
+++ b/pkgs/development/tools/rust/cargo-show-asm/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-show-asm";
-  version = "0.2.31";
+  version = "0.2.32";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-TjkEzqGFqhVKMmZEcwAoDnHOZWi7+wha228loJjLxgQ=";
+    hash = "sha256-4pMIL/wru9uE8Uyp/qvmo6IJxFcB0HLUHRSSV6DoI3g=";
   };
 
-  cargoHash = "sha256-oUfBpx/hElXMw58Dj09JeG2FKy+biFt+4pb4pYNidxc=";
+  cargoHash = "sha256-N1NZONY8y88diAbWn+UaSHGpd4r7naxFWVmCyJkL3tQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/rust/cargo-spellcheck/default.nix b/pkgs/development/tools/rust/cargo-spellcheck/default.nix
index 23de1bc2a0708..f6312ee3f00dd 100644
--- a/pkgs/development/tools/rust/cargo-spellcheck/default.nix
+++ b/pkgs/development/tools/rust/cargo-spellcheck/default.nix
@@ -19,6 +19,11 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-6dhM+FzuLtKtRp2mpE9nlpT+0PBcgGqvBa9vqs6Rs7s=";
 
+  postPatch = ''
+    substituteInPlace src/lib.rs \
+      --replace "#![deny(dead_code)]" "#![warn(dead_code)]"
+  '';
+
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index aa95fcf3dbece..f7c213c13dd50 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-DXPhe6QI1IEPA/Y+qDMu92i18uhXCN0VVJpCoAIDs4c=";
+    hash = "sha256-3rID2epV1pCwpofFf9Wuafs1SlBWH7e7/4HPaSUAriQ=";
   };
 
-  cargoHash = "sha256-3K131d7bDvfmAhYWFNyY+qwi7F8vKk3kw4L+fM0LKMo=";
+  cargoHash = "sha256-hPyPMQm/Oege0PPjYIrd1fEDOGqoQ1ffS2l6o8je4t4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
diff --git a/pkgs/development/tools/rust/svd2rust/default.nix b/pkgs/development/tools/rust/svd2rust/default.nix
index 8891b364b56c9..260809a5c9bf7 100644
--- a/pkgs/development/tools/rust/svd2rust/default.nix
+++ b/pkgs/development/tools/rust/svd2rust/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svd2rust";
-  version = "0.33.0";
+  version = "0.33.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-EdU/Hr1OQ02Jeq4OgJPOS//4wltBPoYdUcFMvlOjIBY=";
+    hash = "sha256-omAL/nRdB5wngOQTaZdnq9XaPnDj6kxda+27TQS7dUQ=";
   };
 
-  cargoHash = "sha256-T4QRrSBjf47wGJIVfxZNGig8k7KWvQQIvV8zwRUP/38=";
+  cargoHash = "sha256-YmnKZhGDQ+eqHy/KQxp3ZdCxKrZEKcS2R+5/t6HhOCg=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
diff --git a/pkgs/development/tools/rust/typeshare/default.nix b/pkgs/development/tools/rust/typeshare/default.nix
index 8f784bc72d6cd..745784fc03047 100644
--- a/pkgs/development/tools/rust/typeshare/default.nix
+++ b/pkgs/development/tools/rust/typeshare/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typeshare";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "1password";
     repo = "typeshare";
     rev = "v${version}";
-    hash = "sha256-20IaTC0fMt6ADSwyQh9yBn3i3z6cmQ1j/wy1KNB3Dog=";
+    hash = "sha256-ccUeIywOHZYqfo4o0rKKswFmdPcQkwD18OP9v/wkfe0=";
   };
 
-  cargoHash = "sha256-5jY4GO/EbBokE9p9e68bTKj6nJ0LhtWYHtFGfTIf9Po=";
+  cargoHash = "sha256-mPA19+8Ti2fluOFn/oDvf62JZTtZNQRggMhf9cem5rU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/sqldef/default.nix b/pkgs/development/tools/sqldef/default.nix
index 695a4c1227c88..47f302a2ac78d 100644
--- a/pkgs/development/tools/sqldef/default.nix
+++ b/pkgs/development/tools/sqldef/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "sqldef";
-  version = "0.17.5";
+  version = "0.17.6";
 
   src = fetchFromGitHub {
     owner = "k0kubun";
     repo = "sqldef";
     rev = "v${version}";
-    hash = "sha256-iEQHrGGXfN/id4aV96MN6WKUl5XGL17u8mlPJKc6cvg=";
+    hash = "sha256-VgPc78xhafRlEUfNMKiYDyWqZVtYDkqwVDQ3BG9r70w=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-8fKJxnjLIWzWsLx/p9tRb/un63/QgJJzMb4/Y4DSZdY=";
+  vendorHash = "sha256-YmjQj116egYhcpJ9Vps1d30bfCY6pAu/mA9MEzXVJb8=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/development/tools/steamos-devkit/default.nix b/pkgs/development/tools/steamos-devkit/default.nix
index 4b2cabac6396f..894bfff77da83 100644
--- a/pkgs/development/tools/steamos-devkit/default.nix
+++ b/pkgs/development/tools/steamos-devkit/default.nix
@@ -23,7 +23,7 @@ let
     };
 
     nativeBuildInputs = with python3.pkgs; [
-      cython
+      cython_0
       pkg-config
       SDL2
     ];
diff --git a/pkgs/development/tools/supabase-cli/default.nix b/pkgs/development/tools/supabase-cli/default.nix
index b3e389987f4b2..201cc66d21306 100644
--- a/pkgs/development/tools/supabase-cli/default.nix
+++ b/pkgs/development/tools/supabase-cli/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "supabase-cli";
-  version = "1.156.3";
+  version = "1.162.6";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-mNWM+EKd6RVnh82aoKkqV8nOu9IZHslvE1qovkvo5yQ=";
+    hash = "sha256-BCJlYutgfHlJqUR1W/yWHkc/trszUuZZmgMMGd1XdFU=";
   };
 
-  vendorHash = "sha256-8V4rg7rKmogzZNPdNBhllxU4aDTQrSzabb5hDHqp+lU=";
+  vendorHash = "sha256-n69PwTcjEWqLetcRUM1YFkovYsE90Q3WaoBr4L/IwQU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/twilio-cli/default.nix b/pkgs/development/tools/twilio-cli/default.nix
index f1b348823f537..649dd335bd092 100644
--- a/pkgs/development/tools/twilio-cli/default.nix
+++ b/pkgs/development/tools/twilio-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "twilio-cli";
-  version = "5.19.3";
+  version = "5.19.4";
 
   src = fetchzip {
     url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-9OHulIASsU7udo5p0jxKlb7vZftWcOLmJYQffejOFqQ=";
+    hash = "sha256-dSM3B9C+H0sTnxCkElDXKWUxNtctW1Jgh/nRFWEXc2A=";
   };
 
   buildInputs = [ nodejs-slim ];
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index adbaf75631376..1d8c678a7a21e 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.20.8";
+  version = "1.20.9";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZigvL11M1bxc7cwDExgIdFhXnZE7LoHIu7oS4Ga2hWw=";
+    hash = "sha256-p9vw2BDfCb31nsHvkdW75fYgEV0Nd3xd7hibAvqL+MA=";
   };
 
-  cargoHash = "sha256-ZD56gy4untz5Ey/sopCFjFWsBiwMi+AZCdNch/aJD0c=";
+  cargoHash = "sha256-cLoTMzvJsjFhMZZRp24hacTdPRhWjcM5xc77obp8UGI=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/development/tools/vsce/default.nix b/pkgs/development/tools/vsce/default.nix
index ea3fc3bfa5fc7..a2be7f3abde52 100644
--- a/pkgs/development/tools/vsce/default.nix
+++ b/pkgs/development/tools/vsce/default.nix
@@ -12,16 +12,16 @@
 
 buildNpmPackage rec {
   pname = "vsce";
-  version = "2.25.0";
+  version = "2.26.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vscode-vsce";
     rev = "v${version}";
-    hash = "sha256-HPNKxplSJpo/30vpXu176JMzY3fAzTX/9XPRsYj9x+U=";
+    hash = "sha256-ILu09OerH5XNVN4el3R2GH2LtIzXiQ/ONU+W2pomHRg=";
   };
 
-  npmDepsHash = "sha256-wfgvGWSxV+N9Uh+jEEZCwPEN0yYNmooWXAV9PwWONkM=";
+  npmDepsHash = "sha256-EtzcWeqPy4XVlheBXBpSwxrsHJ678lhTgnYqzIYZn4M=";
 
   postPatch = ''
     substituteInPlace package.json --replace '"version": "0.0.0"' '"version": "${version}"'
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 84caa116eea47..78a69303a3cbc 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGo122Module rec {
   pname = "flyctl";
-  version = "0.2.25";
+  version = "0.2.40";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-yMkTLUM/1P9VrsYaF4m9YyRLV6qz6uMiYlhUN5S58uU=";
+    hash = "sha256-HIJ2EAfNKVlECXHgw2qx5OlWv5davaBrtrSQVsdrKKY=";
   };
 
-  vendorHash = "sha256-TMlJbh9tMRNdeZlem27lgknuJ/YNFkVaWS9BNTTuXic=";
+  vendorHash = "sha256-uA9Sfovz42+JT+AEY7t4dwWpIUgqX8qdGto7LU7qLtY=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/web/function-runner/default.nix b/pkgs/development/web/function-runner/default.nix
index ba1be2863f81f..1eb7dff5b2e2b 100644
--- a/pkgs/development/web/function-runner/default.nix
+++ b/pkgs/development/web/function-runner/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "function-runner";
-  version = "4.2.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-33UVo7mPD/o3Z/R5PFhosiSLFLLpJ0pHqUbKtX6THJE=";
+    sha256 = "sha256-Li3v3kXze0KgK16XVwdshZWaRF89YSC1Yk9iHXfGWKI=";
   };
 
-  cargoHash = "sha256-TNbGmqITCk1VKVuO46LxO+zjAG7Laguq7EAruuhJIxk=";
+  cargoHash = "sha256-jPiy4ULEfF/aRhWV1j2SOIe2u9uctEsmzWQ6MLXRu7A=";
 
   meta = with lib; {
     description = "A CLI tool which allows you to run Wasm Functions intended for the Shopify Functions infrastructure";
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 5b75793e8f690..b716f9bdd1ed5 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -8,8 +8,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.11.1";
-  sha256 = "sha256-d4E+2/P38W0tNdM1NEPe5OYdXuhNnjE4x1OKPAylIJ4=";
+  version = "20.12.2";
+  sha256 = "sha256-18vMX7+zHpAB8/AVC77aWavl3XE3qqYnOVjNWc41ztc=";
   patches = [
     ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
diff --git a/pkgs/games/gogui/default.nix b/pkgs/games/gogui/default.nix
index 43e1f3397b8fb..50cb29ddb454c 100644
--- a/pkgs/games/gogui/default.nix
+++ b/pkgs/games/gogui/default.nix
@@ -1,48 +1,46 @@
-{ ant
+{ lib
+, stdenv
+, fetchFromGitHub
+, ant
+, jdk
+, jre
 , docbook-xsl-ns
 , docbook_xml_dtd_42
-, fetchFromGitHub
 , imagemagick
-, lib
 , libxslt
+, stripJavaArchivesHook
 , makeWrapper
-, openjdk
-, stdenv
 }:
 
-let
-  version = "1.5.4a";
-in stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gogui";
-  inherit version;
+  version = "1.5.4a";
 
   src = fetchFromGitHub {
     owner = "Remi-Coulom";
     repo = "gogui";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-UFhOk2mAnTtxfwEOHquN64YDCRq7nNUqZAPQf77MEEw=";
   };
 
   nativeBuildInputs = [
-    makeWrapper
     ant
-  ];
-
-  buildInputs = [
+    jdk
     docbook-xsl-ns
     imagemagick
     libxslt
-    openjdk
+    stripJavaArchivesHook
+    makeWrapper
   ];
 
   buildPhase = ''
     runHook preBuild
 
     substituteInPlace doc/manual/xml/book.xml \
-      --replace http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd \
+      --replace-fail http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd \
       ${docbook_xml_dtd_42}/xml/dtd/docbook/docbookx.dtd
     substituteInPlace doc/manual/xml/manpages.xml \
-      --replace http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd \
+      --replace-fail http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd \
       ${docbook_xml_dtd_42}/xml/dtd/docbook/docbookx.dtd
 
     # generate required gui images from svg
@@ -75,21 +73,24 @@ in stdenv.mkDerivation {
     ln -s $out/share/doc/gogui/manual/man $out/share/man/man1
 
     # copy programs
-    mv -vi {bin,lib} $out/
+    mv -vi bin lib $out/
 
     # wrap programs
     for x in $out/bin/*; do
-      wrapProgram $x --prefix PATH ":" ${openjdk}/bin --set GOGUI_JAVA_HOME ${openjdk}
+        wrapProgram $x \
+            --prefix PATH : ${jre}/bin \
+            --set GOGUI_JAVA_HOME ${jre}
     done
 
     runHook postInstall
   '';
 
   meta = {
-    maintainers = [ lib.maintainers.cleverca22 lib.maintainers.omnipotententity];
     description = "A graphical user interface to programs that play the board game Go and support the Go Text Protocol such as GNU Go";
     homepage = "https://github.com/Remi-Coulom/gogui";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "gogui";
+    maintainers = with lib.maintainers; [ cleverca22 omnipotententity ];
     platforms = lib.platforms.unix;
-    license = lib.licenses.gpl3;
   };
-}
+})
diff --git a/pkgs/games/shattered-pixel-dungeon/rkpd2.nix b/pkgs/games/shattered-pixel-dungeon/rkpd2.nix
index d4a790370aeb5..5f73a825fca42 100644
--- a/pkgs/games/shattered-pixel-dungeon/rkpd2.nix
+++ b/pkgs/games/shattered-pixel-dungeon/rkpd2.nix
@@ -4,13 +4,13 @@
 
 callPackage ./generic.nix rec {
   pname = "rkpd2";
-  version = "2.0.3";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "Zrp200";
     repo = "rkpd2";
     rev = "v${version}";
-    hash = "sha256-dng/QoG9FTNU/fNVqPtLW/MVhO1uDBkXxWcI5mESUKw=";
+    hash = "sha256-jwH0nEsv3agUCZt5Mhuv1JSeELOKfrsj3cnmAJsV9sM=";
   };
 
   depsHash = "sha256-vihoR0bPh7590sRxeYJ1uuynNRxtRBuiFUrdmsRNUJc=";
diff --git a/pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh b/pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh
index 8f34f5f732e63..1f60ba1aed929 100644
--- a/pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh
+++ b/pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh
@@ -41,7 +41,7 @@ ecmPostHook() {
     cmakeFlags+=" -DKDE_INSTALL_KCONFUPDATEDIR=${!outputBin}/share/kconf_update"
     cmakeFlags+=" -DKDE_INSTALL_KAPPTEMPLATESDIR=${!outputDev}/share/kdevappwizard/templates"
     cmakeFlags+=" -DKDE_INSTALL_KFILETEMPLATESDIR=${!outputDev}/share/kdevfiletemplates/templates"
-    cmakeFlags+=" -DKDE_INSTALL_KXMLGUIDIR=${!outputBin}/share/kxmlgui6"
+    cmakeFlags+=" -DKDE_INSTALL_KXMLGUIDIR=${!outputBin}/share/kxmlgui5"  # Yes, this needs to be 5 and not 6. Don't ask.
     cmakeFlags+=" -DKDE_INSTALL_KNOTIFYRCDIR=${!outputBin}/share/knotifications6"
     cmakeFlags+=" -DKDE_INSTALL_ICONDIR=${!outputBin}/share/icons"
     cmakeFlags+=" -DKDE_INSTALL_LOCALEDIR=${!outputLib}/share/locale"
diff --git a/pkgs/kde/frameworks/ki18n/default.nix b/pkgs/kde/frameworks/ki18n/default.nix
index 2a082a9dfe579..02b03f875ffb4 100644
--- a/pkgs/kde/frameworks/ki18n/default.nix
+++ b/pkgs/kde/frameworks/ki18n/default.nix
@@ -1,9 +1,10 @@
 {
   mkKdeDerivation,
   qtdeclarative,
+  python3,
 }:
 mkKdeDerivation {
   pname = "ki18n";
 
-  extraBuildInputs = [qtdeclarative];
+  extraBuildInputs = [qtdeclarative python3];
 }
diff --git a/pkgs/misc/screensavers/slock/default.nix b/pkgs/misc/screensavers/slock/default.nix
index 7825576253381..e86358d2e4ea2 100644
--- a/pkgs/misc/screensavers/slock/default.nix
+++ b/pkgs/misc/screensavers/slock/default.nix
@@ -2,7 +2,10 @@
 , xorgproto, libX11, libXext, libXrandr, libxcrypt
 # default header can be obtained from
 # https://git.suckless.org/slock/tree/config.def.h
-, conf ? null }:
+, conf ? null
+# update script dependencies
+, gitUpdater
+}:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slock";
@@ -25,6 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "CC:=$(CC)" ];
 
+  passthru.updateScript = gitUpdater {
+    url = "git://git.suckless.org/slock";
+  };
+
   meta = with lib; {
     homepage = "https://tools.suckless.org/slock";
     description = "Simple X display locker";
@@ -33,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       Simple X display locker. This is the simplest X screen locker.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ astsmtl ];
+    maintainers = with maintainers; [ astsmtl qusic ];
     platforms = platforms.linux;
   };
 })
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 518ab4230156f..238c1b7e460b0 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -105,6 +105,8 @@ let
     # conflicting LLVM modules.
     objc4 = stdenv.objc4 or (callPackage ./libobjc.nix { });
 
+    sdkRoot = pkgs.callPackage ../apple-sdk/sdkRoot.nix { sdkVersion = "11.0"; };
+
     # questionable aliases
     configd = pkgs.darwin.apple_sdk.frameworks.SystemConfiguration;
     inherit (pkgs.darwin.apple_sdk.frameworks) IOKit;
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 962f7f681c49d..a3d1df0867a9a 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -352,5 +352,11 @@ in rec {
 
   inherit darwin-stubs;
 
+  objc4 = pkgs.darwin.libobjc;
+
+  sdkRoot = pkgs.callPackage ./sdkRoot.nix { sdkVersion = "10.12"; };
+
+  inherit (pkgs.darwin) Libsystem;
+
   inherit sdk;
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk/sdkRoot.nix b/pkgs/os-specific/darwin/apple-sdk/sdkRoot.nix
new file mode 100644
index 0000000000000..67d9cbe031059
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/sdkRoot.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  runCommand,
+  writeText,
+  sdkVersion,
+}:
+
+let
+  sdkName = "MacOSX${sdkVersion}";
+  toolchainName = "com.apple.dt.toolchain.XcodeDefault";
+  productBuildVer = null;
+
+  inherit (lib.generators) toPlist toJSON;
+
+  SDKSettings = {
+    CanonicalName = "macosx${sdkVersion}";
+    DisplayName = "macOS ${sdkVersion}";
+    Toolchains = [ toolchainName ];
+    Version = sdkVersion;
+    MaximumDeploymentTarget = "${sdkVersion}.99";
+    isBaseSDK = "YES";
+  };
+
+  SystemVersion =
+    lib.optionalAttrs (productBuildVer != null) { ProductBuildVersion = productBuildVer; }
+    // {
+      ProductName = "macOS";
+      ProductVersion = sdkVersion;
+    };
+in
+runCommand "sdkroot-${sdkVersion}" { } ''
+  sdk="$out/${sdkName}.sdk"
+
+  install -D ${writeText "SDKSettings.plist" (toPlist { } SDKSettings)} "$sdk/SDKSettings.plist"
+  install -D ${writeText "SDKSettings.json" (toJSON { } SDKSettings)} "$sdk/SDKSettings.json"
+  install -D ${
+    writeText "SystemVersion.plist" (toPlist { } SystemVersion)
+  } "$sdk/System/Library/CoreServices/SystemVersion.plist"
+
+  ln -s "$sdk" "$sdk/usr"
+
+  install -D '${../../../build-support/setup-hooks/role.bash}' "$out/nix-support/setup-hook"
+  cat >> "$out/nix-support/setup-hook" <<-hook
+  #
+  # See comments in cc-wrapper's setup hook. This works exactly the same way.
+  #
+  [[ -z \''${strictDeps-} ]] || (( "\$hostOffset" < 0 )) || return 0
+
+  sdkRootHook() {
+    # See ../../../build-support/setup-hooks/role.bash
+    local role_post
+    getHostRoleEnvHook
+
+    # Only set the SDK root if one has not been set via this hook or some other means.
+    if [[ ! \$NIX_CFLAGS_COMPILE =~ isysroot ]]; then
+      export NIX_CFLAGS_COMPILE\''${role_post}+=' -isysroot $out/${sdkName}.sdk'
+    fi
+  }
+
+  # See ../../../build-support/setup-hooks/role.bash
+  getTargetRole
+
+  addEnvHooks "\$targetOffset" sdkRootHook
+
+  # No local scope in sourced file
+  unset -v role_post
+  hook
+''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 7415e99e506cf..87fb8512fb646 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -10,24 +10,13 @@
 let
   darling.src = fetchzip {
     url = "https://github.com/darlinghq/darling/archive/d2cc5fa748003aaa70ad4180fff0a9a85dc65e9b.tar.gz";
-    sha256 = "11b51fw47nl505h63bgx5kqiyhf3glhp1q6jkpb6nqfislnzzkrf";
+    hash = "sha256-/YynrKJdi26Xj4lvp5wsN+TAhZjonOrNNHuk4L5tC7s=";
     postFetch = ''
-      # The archive contains both `src/opendirectory` and `src/OpenDirectory`,
-      # pre-create the directory to choose the canonical case on
-      # case-insensitive filesystems.
-      mkdir -p $out/src/OpenDirectory
-
-      cd $out
-      tar -xzf $downloadedFile --strip-components=1
-      rm -r $out/src/libm
-
-      # If `src/opendirectory` and `src/OpenDirectory` refer to different
-      # things, then combine them into `src/OpenDirectory` to match the result
-      # on case-insensitive filesystems.
-      if [ "$(stat -c %i src/opendirectory)" != "$(stat -c %i src/OpenDirectory)" ]; then
-        mv src/opendirectory/* src/OpenDirectory/
-        rmdir src/opendirectory
-      fi
+      # The archive contains both `src/opendirectory` and `src/OpenDirectory`.
+      # Since neither directory is used for anything, we just remove them to avoid
+      #  the potential issue where file systems with different case sensitivity produce
+      #  different hashes.
+      rm -rf $out/src/{OpenDirectory,opendirectory}
     '';
   };
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
index e91ee86cde08f..176cb8646f1e5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
@@ -13,7 +13,7 @@ appleDerivation' stdenvNoCC {
     cp -r dispatch/*.h $out/include/dispatch
     cp -r os/object*.h  $out/include/os
 
-    # gcc compatability. Source: https://stackoverflow.com/a/28014302/3714556
+    # gcc compatibility. Source: https://stackoverflow.com/a/28014302/3714556
     substituteInPlace $out/include/dispatch/object.h \
       --replace 'typedef void (^dispatch_block_t)(void);' \
                 '#ifdef __clang__
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index d7bdac6ceea34..78c510f7da4cd 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -11,6 +11,7 @@ let
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
     "codesign_allocate"
   ];
+  isCCToolsLLVM = lib.getName cctools == "cctools-llvm";
 in
 
 # TODO: loop over targetPrefixed binaries too
@@ -33,7 +34,7 @@ stdenv.mkDerivation {
     # - strip: the binutils one seems to break mach-o files
     # - lipo: gcc build assumes it exists
     # - nm: the gnu one doesn't understand many new load commands
-    for i in ${lib.concatStringsSep " " (builtins.map (e: targetPrefix + e) cmds)}; do
+    for i in ${lib.concatStringsSep " " (map (e: targetPrefix + e) cmds)}; do
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
@@ -41,51 +42,59 @@ stdenv.mkDerivation {
 
     ln -s ${binutils-unwrapped.out}/share $out/share
 
-    ln -s ${cctools}/libexec $out/libexec
-
     mkdir -p "$man"/share/man/man{1,5}
-    for i in ${builtins.concatStringsSep " " cmds}; do
+    for i in ${lib.concatStringsSep " " cmds}; do
       for path in "${cctools.man}"/share/man/man?/$i.*; do
         dest_path="$man''${path#${cctools.man}}"
         ln -sv "$path" "$dest_path"
       done
     done
   ''
-  # On aarch64-darwin we must use clang, because "as" from cctools just doesn't
-  # handle the arch. Proxying calls to clang produces quite a bit of warnings,
-  # and using clang directly here is a better option than relying on cctools.
-  # On x86_64-darwin the Clang version is too old to support this mode.
-  + lib.optionalString stdenv.isAarch64 ''
-    rm $out/bin/${targetPrefix}as
-    makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
-      --add-flags "-x assembler -integrated-as -c"
-  ''
-  # x86-64 Darwin gnat-bootstrap emits assembly
-  # with MOVQ as the mnemonic for quadword interunit moves
-  # such as `movq %rbp, %xmm0`.
-  # The clang integrated assembler recognises this as valid,
-  # but unfortunately the cctools-port GNU assembler does not;
-  # it instead uses MOVD as the mnemonic.
-  # The assembly that a GCC build emits is determined at build time
-  # and cannot be changed afterwards.
-  #
-  # To build GNAT on x86-64 Darwin, therefore,
-  # we need both the clang _and_ the cctools-port assemblers to be available:
-  # the former to build at least the stage1 compiler,
-  # and the latter at least to be detectable
-  # as the target for the final compiler.
-  #
-  # We choose to match the Aarch64 case above,
-  # wrapping the clang integrated assembler as `as`.
-  # It then seems sensible to wrap the cctools GNU assembler as `gas`.
-  #
-  + lib.optionalString (stdenv.isx86_64 && dualAs) ''
-    mv $out/bin/${targetPrefix}as $out/bin/${targetPrefix}gas
-    makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
-      --add-flags "-x assembler -integrated-as -c"
-  '';
+  + lib.optionalString (!isCCToolsLLVM) (
+    # cctools-port has a `libexec` folder for `as`, but cctools-llvm uses the clang
+    # assembler on both platforms. Only link it when cctools is cctools-port.
+    ''
+      ln -s ${cctools}/libexec $out/libexec
+    ''
+    # cctools-llvm uses the LLVM assembler on both architectures, so use the assembler
+    # from that instead of relinking it.
+    #
+    # On aarch64-darwin we must use clang, because "as" from cctools just doesn't
+    # handle the arch. Proxying calls to clang produces quite a bit of warnings,
+    # and using clang directly here is a better option than relying on cctools.
+    # On x86_64-darwin the Clang version is too old to support this mode.
+    + lib.optionalString stdenv.isAarch64 ''
+      rm $out/bin/${targetPrefix}as
+      makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
+        --add-flags "-x assembler -integrated-as -c"
+    ''
+    # x86-64 Darwin gnat-bootstrap emits assembly
+    # with MOVQ as the mnemonic for quadword interunit moves
+    # such as `movq %rbp, %xmm0`.
+    # The clang integrated assembler recognises this as valid,
+    # but unfortunately the cctools-port GNU assembler does not;
+    # it instead uses MOVD as the mnemonic.
+    # The assembly that a GCC build emits is determined at build time
+    # and cannot be changed afterwards.
+    #
+    # To build GNAT on x86-64 Darwin, therefore,
+    # we need both the clang _and_ the cctools-port assemblers to be available:
+    # the former to build at least the stage1 compiler,
+    # and the latter at least to be detectable
+    # as the target for the final compiler.
+    #
+    # We choose to match the Aarch64 case above,
+    # wrapping the clang integrated assembler as `as`.
+    # It then seems sensible to wrap the cctools GNU assembler as `gas`.
+    #
+    + lib.optionalString (stdenv.isx86_64 && dualAs) ''
+      mv $out/bin/${targetPrefix}as $out/bin/${targetPrefix}gas
+      makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
+        --add-flags "-x assembler -integrated-as -c"
+    ''
+  );
 
-  nativeBuildInputs = lib.optionals (stdenv.isAarch64 || dualAs) [ makeWrapper ];
+  nativeBuildInputs = lib.optionals (!isCCToolsLLVM && (stdenv.isAarch64 || dualAs)) [ makeWrapper ];
 
   passthru = {
     inherit targetPrefix;
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index a0b91f6d778b7..3cf9b26f4fdda 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -20,7 +20,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.29.1";
+  version = "0.30.0";
 
   disabled = !stdenv.isLinux;
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     rev = "v${version}";
-    hash = "sha256-+HYCweAI5axx0ZNFd/jLRXkUinRLDmKWMpLTk7FrEe0=";
+    hash = "sha256-ngGLGfLv2prnjhgaRPf8ea3oyy4129zGodR0Yz1QtCw=";
   };
   format = "other";
 
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 33edbc0a4f732..0e32966615ac1 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.7.0";
+  version = "2.7.1";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-lAA6AM1agZRPRejcUp4M/Spv9im9LNIc9eV05GXa95U=";
+    hash = "sha256-2l0UGeKobgGqMv15WCzVTSCIV8tUG8ov1Cal/xqqu8M=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index 5180917623e93..784024f8754d0 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -40,13 +40,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbus-broker";
-  version = "35";
+  version = "36";
 
   src = fetchFromGitHub {
     owner = "bus1";
     repo = "dbus-broker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Qwi9X5jXHiQ3TOWefzv/p7x8/JkQW1QgdYji5SpLej0=";
+    hash = "sha256-5dAMKjybqrHG57vArbtWEPR/svSj2ION75JrjvnnpVM=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/dbus-broker/disable-test.patch b/pkgs/os-specific/linux/dbus-broker/disable-test.patch
index 487967aea8406..14faf1907cc20 100644
--- a/pkgs/os-specific/linux/dbus-broker/disable-test.patch
+++ b/pkgs/os-specific/linux/dbus-broker/disable-test.patch
@@ -1,11 +1,14 @@
---- b/src/meson.build
-+++ a/src/meson.build
-@@ -196,9 +195,6 @@
- test_fdlist = executable('test-fdlist', ['util/test-fdlist.c'], dependencies: dep_bus)
- test('Utility File-Desciptor Lists', test_fdlist)
-
--test_fs = executable('test-fs', ['util/test-fs.c'], dependencies: dep_bus)
--test('File System Helpers', test_fs)
+diff --git a/src/meson.build b/src/meson.build
+index 4b9bc71..221ed5c 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -202,9 +202,6 @@ test('Error Handling', test_error, suite: 'unit')
+ test_fdlist = executable('test-fdlist', sources: ['util/test-fdlist.c'], kwargs: test_kwargs)
+ test('Utility File-Desciptor Lists', test_fdlist, suite: 'unit')
+ 
+-test_fs = executable('test-fs', sources: ['util/test-fs.c'], kwargs: test_kwargs)
+-test('File System Helpers', test_fs, suite: 'unit')
 -
- test_match = executable('test-match', ['bus/test-match.c'], dependencies: dep_bus)
- test('D-Bus Match Handling', test_match)
+ test_match = executable('test-match', sources: ['bus/test-match.c'], kwargs: test_kwargs)
+ test('D-Bus Match Handling', test_match, suite: 'unit')
+ 
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
deleted file mode 100644
index d1d95b4d3f959..0000000000000
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pandoc, installShellFiles, withManpage ? false, nixosTests }:
-
-stdenv.mkDerivation rec {
-  pname = "earlyoom";
-  version = "1.7";
-
-  src = fetchFromGitHub {
-    owner = "rfjakob";
-    repo = "earlyoom";
-    rev = "v${version}";
-    sha256 = "sha256-8YcT1TTlAet7F1U9Ginda4IApNqkudegOXqm8rnRGfc=";
-  };
-
-  nativeBuildInputs = lib.optionals withManpage [ pandoc installShellFiles ];
-
-  patches = [ ./fix-dbus-path.patch ];
-
-  makeFlags = [ "VERSION=${version}" ];
-
-  installPhase = ''
-    install -D earlyoom $out/bin/earlyoom
-  '' + lib.optionalString withManpage ''
-    installManPage earlyoom.1
-  '';
-
-  passthru.tests = {
-    inherit (nixosTests) earlyoom;
-  };
-
-  meta = with lib; {
-    description = "Early OOM Daemon for Linux";
-    mainProgram = "earlyoom";
-    homepage = "https://github.com/rfjakob/earlyoom";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [];
-  };
-}
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 9175f477bd607..b340b21c46339 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.63";
+  version = "0.64";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-husK3eurfL1NhRHgJUdFP6sYLqeZ4NSHa/tU8PUWmGo=";
+    hash = "sha256-LONfgFgPg8KCDwtw//WTOYQT9RpnIskdHAWcgafOhcg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/fw-ectool/default.nix b/pkgs/os-specific/linux/fw-ectool/default.nix
index 1d23411f3eefc..a73cc1896ecdc 100644
--- a/pkgs/os-specific/linux/fw-ectool/default.nix
+++ b/pkgs/os-specific/linux/fw-ectool/default.nix
@@ -1,43 +1,38 @@
 { stdenv
 , lib
-, fetchFromGitLab
-, cmake
+, fetchFromGitHub
 , pkg-config
-, libusb1
-, libftdi1
+, hostname
 }:
 
 stdenv.mkDerivation {
   pname = "fw-ectool";
-  version = "0-unstable-2023-12-15";
+  version = "unstable-2022-12-03";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.howett.net";
+  src = fetchFromGitHub {
     owner = "DHowett";
-    repo = "ectool";
-    rev = "3ebe7b8b713b2ebfe2ce92d48fd8d044276b2879";
-    hash = "sha256-s6PrFPAL+XJAENqLw5oJqFmAf11tHOJ8h3F5l3pOlZ4=";
+    repo = "fw-ectool";
+    rev = "54c140399bbc3e6a3dce6c9f842727c4128367be";
+    hash = "sha256-2teJFz4zcA+USpbVPXMEIHLdmMLem8ik7YrmrSxr/n0=";
   };
 
   nativeBuildInputs = [
-    cmake
     pkg-config
+    hostname
   ];
 
-  buildInputs = [
-    libusb1
-    libftdi1
-  ];
+  buildPhase = ''
+    patchShebangs util
+    make out=out utils
+  '';
 
   installPhase = ''
-    runHook preInstall
-    install -Dm555 src/ectool "$out/bin/ectool"
-    runHook postInstall
+    install -D out/util/ectool $out/bin/ectool
   '';
 
   meta = with lib; {
     description = "EC-Tool adjusted for usage with framework embedded controller";
-    homepage = "https://gitlab.howett.net/DHowett/ectool";
+    homepage = "https://github.com/DHowett/framework-ec";
     license = licenses.bsd3;
     maintainers = [ maintainers.mkg20001 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index f7303b182ec74..83519d7f2a7ac 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.380";
+  version = "0.381";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-Ioa0tUiwgOZO3qrtwAr9A/yGfYTBk83OON8Sr47J9Mg=";
+    hash = "sha256-FD1p4qyO+ZsBdMXRa9u6CpO07RewWH8OxULLxcYAsyk=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index f4a250d4a84c8..e686e06804197 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "24.09.28717.12";
+  version = "24.13.29138.7";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    hash = "sha256-RzXV6icenMcQxmOfKA8Tpb6FigLXz3ZyoL0n16+jFRc=";
+    hash = "sha256-AMIuA1AMrSX0xpdGSfye8iUJTk5s9HDiRy9Yy3kZss8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index e2e4384908a8c..031dbfa700bc8 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl
 , buildPackages, bison, flex, pkg-config
-, db, iptables, libelf, libmnl
+, db, iptables, elfutils, libmnl
 , gitUpdater
 }:
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
   nativeBuildInputs = [ bison flex pkg-config ];
-  buildInputs = [ db iptables libelf libmnl ];
+  buildInputs = [ db iptables elfutils libmnl ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index a15d21f2c3a1b..0a7d23d3d33c1 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.16";
+  version = "2.17";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    hash = "sha256-YWtiI2HkGyIdUeBXerQtN5UvgaMaUs9eoG88ZUQRrDg=";
+    hash = "sha256-o/Q8vUtB4Yiz1x+/6+8LUKUQNtiAmwcdh++/tTUN4mM=";
   };
 
   outputs = [ "out" "man" "doc" ]
@@ -81,9 +81,9 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     substituteInPlace $out/share/dbus-1/system-services/net.connman.ead.service \
-      --replace /bin/false ${coreutils}/bin/false
+      --replace-fail /bin/false ${coreutils}/bin/false
     substituteInPlace $out/share/dbus-1/system-services/net.connman.iwd.service \
-      --replace /bin/false ${coreutils}/bin/false
+      --replace-fail /bin/false ${coreutils}/bin/false
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index bce7d7d0dcb3b..20100774395e1 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -79,4 +79,18 @@
       hash = "sha256-q3iNBo8t4b1Rn5k5lau2myqOAqdA/9V9A+ok2jGkLdY=";
     };
   };
+
+  rust_1_77-6_8 = {
+    name = "rust-1.77.patch";
+    patch = fetchurl {
+      name = "rust-1.77.patch";
+      url = "https://lore.kernel.org/rust-for-linux/20240217002717.57507-1-ojeda@kernel.org/raw";
+      hash = "sha256-0KW9nHpJeMSDssCPXWZbrN8kxq5bA434t+XuPfwslUc=";
+    };
+  };
+
+  rust_1_77-6_9 = {
+    name = "rust-1.77.patch";
+    patch = ./rust-1.77.patch;
+  };
 }
diff --git a/pkgs/os-specific/linux/kernel/rust-1.77.patch b/pkgs/os-specific/linux/kernel/rust-1.77.patch
new file mode 100644
index 0000000000000..8bd0a5e337154
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/rust-1.77.patch
@@ -0,0 +1,792 @@
+From d69265b7d756931b2e763a3262f22ba4100895a0 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Sat, 17 Feb 2024 01:27:17 +0100
+Subject: [PATCH] rust: upgrade to Rust 1.77.0
+
+This is the next upgrade to the Rust toolchain, from 1.76.0 to 1.77.0
+(i.e. the latest) [1].
+
+See the upgrade policy [2] and the comments on the first upgrade in
+commit 3ed03f4da06e ("rust: upgrade to Rust 1.68.2").
+
+The `offset_of` feature (single-field `offset_of!`) that we were using
+got stabilized in Rust 1.77.0 [3].
+
+Therefore, now the only unstable features allowed to be used outside the
+`kernel` crate is `new_uninit`, though other code to be upstreamed may
+increase the list.
+
+Please see [4] for details.
+
+Rust 1.77.0 merged the `unused_tuple_struct_fields` lint into `dead_code`,
+thus upgrading it from `allow` to `warn` [5]. In turn, this makes `rustc`
+complain about the `ThisModule`'s pointer field being never read. Thus
+locally `allow` it for the moment, since we will have users later on
+(e.g. Binder needs a `as_ptr` method [6]).
+
+Rust 1.77.0 introduces the `--check-cfg` feature [7], for which there
+is a Call for Testing going on [8]. We were requested to test it and
+we found it useful [9] -- we will likely enable it in the future.
+
+The vast majority of changes are due to our `alloc` fork being upgraded
+at once.
+
+There are two kinds of changes to be aware of: the ones coming from
+upstream, which we should follow as closely as possible, and the updates
+needed in our added fallible APIs to keep them matching the newer
+infallible APIs coming from upstream.
+
+Instead of taking a look at the diff of this patch, an alternative
+approach is reviewing a diff of the changes between upstream `alloc` and
+the kernel's. This allows to easily inspect the kernel additions only,
+especially to check if the fallible methods we already have still match
+the infallible ones in the new version coming from upstream.
+
+Another approach is reviewing the changes introduced in the additions in
+the kernel fork between the two versions. This is useful to spot
+potentially unintended changes to our additions.
+
+To apply these approaches, one may follow steps similar to the following
+to generate a pair of patches that show the differences between upstream
+Rust and the kernel (for the subset of `alloc` we use) before and after
+applying this patch:
+
+    # Get the difference with respect to the old version.
+    git -C rust checkout $(linux/scripts/min-tool-version.sh rustc)
+    git -C linux ls-tree -r --name-only HEAD -- rust/alloc |
+        cut -d/ -f3- |
+        grep -Fv README.md |
+        xargs -IPATH cp rust/library/alloc/src/PATH linux/rust/alloc/PATH
+    git -C linux diff --patch-with-stat --summary -R > old.patch
+    git -C linux restore rust/alloc
+
+    # Apply this patch.
+    git -C linux am rust-upgrade.patch
+
+    # Get the difference with respect to the new version.
+    git -C rust checkout $(linux/scripts/min-tool-version.sh rustc)
+    git -C linux ls-tree -r --name-only HEAD -- rust/alloc |
+        cut -d/ -f3- |
+        grep -Fv README.md |
+        xargs -IPATH cp rust/library/alloc/src/PATH linux/rust/alloc/PATH
+    git -C linux diff --patch-with-stat --summary -R > new.patch
+    git -C linux restore rust/alloc
+
+Now one may check the `new.patch` to take a look at the additions (first
+approach) or at the difference between those two patches (second
+approach). For the latter, a side-by-side tool is recommended.
+
+Link: https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1770-2024-03-21 [1]
+Link: https://rust-for-linux.com/rust-version-policy [2]
+Link: https://github.com/rust-lang/rust/pull/118799 [3]
+Link: https://github.com/Rust-for-Linux/linux/issues/2 [4]
+Link: https://github.com/rust-lang/rust/pull/118297 [5]
+Link: https://lore.kernel.org/rust-for-linux/20231101-rust-binder-v1-2-08ba9197f637@google.com/#Z31rust:kernel:lib.rs [6]
+Link: https://doc.rust-lang.org/nightly/unstable-book/compiler-flags/check-cfg.html [7]
+Link: https://github.com/rust-lang/rfcs/pull/3013#issuecomment-1936648479 [8]
+Link: https://github.com/rust-lang/rust/issues/82450#issuecomment-1947462977 [9]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Link: https://lore.kernel.org/r/20240217002717.57507-1-ojeda@kernel.org
+Link: https://github.com/Rust-for-Linux/linux/commit/d69265b7d756931b2e763a3262f22ba4100895a0
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+---
+ Documentation/process/changes.rst |   2 +-
+ rust/alloc/alloc.rs               |   6 +-
+ rust/alloc/boxed.rs               |   4 +-
+ rust/alloc/lib.rs                 |   7 +-
+ rust/alloc/raw_vec.rs             |  13 ++--
+ rust/alloc/slice.rs               |   4 +-
+ rust/alloc/vec/into_iter.rs       | 108 +++++++++++++++++++-----------
+ rust/alloc/vec/mod.rs             | 101 +++++++++++++++++++---------
+ rust/kernel/lib.rs                |   3 +-
+ scripts/Makefile.build            |   2 +-
+ scripts/min-tool-version.sh       |   2 +-
+ 11 files changed, 161 insertions(+), 91 deletions(-)
+
+diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst
+index 7ef8de58f7f892..879ee628893ae1 100644
+--- a/Documentation/process/changes.rst
++++ b/Documentation/process/changes.rst
+@@ -31,7 +31,7 @@ you probably needn't concern yourself with pcmciautils.
+ ====================== ===============  ========================================
+ GNU C                  5.1              gcc --version
+ Clang/LLVM (optional)  13.0.1           clang --version
+-Rust (optional)        1.76.0           rustc --version
++Rust (optional)        1.77.0           rustc --version
+ bindgen (optional)     0.65.1           bindgen --version
+ GNU make               3.82             make --version
+ bash                   4.2              bash --version
+diff --git a/rust/alloc/alloc.rs b/rust/alloc/alloc.rs
+index abb791cc23715a..b1204f87227b23 100644
+--- a/rust/alloc/alloc.rs
++++ b/rust/alloc/alloc.rs
+@@ -5,7 +5,7 @@
+ #![stable(feature = "alloc_module", since = "1.28.0")]
+ 
+ #[cfg(not(test))]
+-use core::intrinsics;
++use core::hint;
+ 
+ #[cfg(not(test))]
+ use core::ptr::{self, NonNull};
+@@ -210,7 +210,7 @@ impl Global {
+                 let new_size = new_layout.size();
+ 
+                 // `realloc` probably checks for `new_size >= old_layout.size()` or something similar.
+-                intrinsics::assume(new_size >= old_layout.size());
++                hint::assert_unchecked(new_size >= old_layout.size());
+ 
+                 let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
+                 let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
+@@ -301,7 +301,7 @@ unsafe impl Allocator for Global {
+             // SAFETY: `new_size` is non-zero. Other conditions must be upheld by the caller
+             new_size if old_layout.align() == new_layout.align() => unsafe {
+                 // `realloc` probably checks for `new_size <= old_layout.size()` or something similar.
+-                intrinsics::assume(new_size <= old_layout.size());
++                hint::assert_unchecked(new_size <= old_layout.size());
+ 
+                 let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
+                 let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
+diff --git a/rust/alloc/boxed.rs b/rust/alloc/boxed.rs
+index c93a22a5c97f14..5fc39dfeb8e7bf 100644
+--- a/rust/alloc/boxed.rs
++++ b/rust/alloc/boxed.rs
+@@ -26,6 +26,7 @@
+ //! Creating a recursive data structure:
+ //!
+ //! ```
++//! ##[allow(dead_code)]
+ //! #[derive(Debug)]
+ //! enum List<T> {
+ //!     Cons(T, Box<List<T>>),
+@@ -194,8 +195,7 @@ mod thin;
+ #[fundamental]
+ #[stable(feature = "rust1", since = "1.0.0")]
+ // The declaration of the `Box` struct must be kept in sync with the
+-// `alloc::alloc::box_free` function or ICEs will happen. See the comment
+-// on `box_free` for more details.
++// compiler or ICEs will happen.
+ pub struct Box<
+     T: ?Sized,
+     #[unstable(feature = "allocator_api", issue = "32838")] A: Allocator = Global,
+diff --git a/rust/alloc/lib.rs b/rust/alloc/lib.rs
+index 36f79c07559338..39afd55ec0749e 100644
+--- a/rust/alloc/lib.rs
++++ b/rust/alloc/lib.rs
+@@ -105,7 +105,6 @@
+ #![feature(allocator_api)]
+ #![feature(array_chunks)]
+ #![feature(array_into_iter_constructors)]
+-#![feature(array_methods)]
+ #![feature(array_windows)]
+ #![feature(ascii_char)]
+ #![feature(assert_matches)]
+@@ -122,7 +121,6 @@
+ #![feature(const_size_of_val)]
+ #![feature(const_waker)]
+ #![feature(core_intrinsics)]
+-#![feature(core_panic)]
+ #![feature(deprecated_suggestion)]
+ #![feature(dispatch_from_dyn)]
+ #![feature(error_generic_member_access)]
+@@ -132,6 +130,7 @@
+ #![feature(fmt_internals)]
+ #![feature(fn_traits)]
+ #![feature(hasher_prefixfree_extras)]
++#![feature(hint_assert_unchecked)]
+ #![feature(inline_const)]
+ #![feature(inplace_iteration)]
+ #![feature(iter_advance_by)]
+@@ -141,6 +140,8 @@
+ #![feature(maybe_uninit_slice)]
+ #![feature(maybe_uninit_uninit_array)]
+ #![feature(maybe_uninit_uninit_array_transpose)]
++#![feature(non_null_convenience)]
++#![feature(panic_internals)]
+ #![feature(pattern)]
+ #![feature(ptr_internals)]
+ #![feature(ptr_metadata)]
+@@ -149,7 +150,6 @@
+ #![feature(set_ptr_value)]
+ #![feature(sized_type_properties)]
+ #![feature(slice_from_ptr_range)]
+-#![feature(slice_group_by)]
+ #![feature(slice_ptr_get)]
+ #![feature(slice_ptr_len)]
+ #![feature(slice_range)]
+@@ -182,6 +182,7 @@
+ #![feature(const_ptr_write)]
+ #![feature(const_trait_impl)]
+ #![feature(const_try)]
++#![feature(decl_macro)]
+ #![feature(dropck_eyepatch)]
+ #![feature(exclusive_range_pattern)]
+ #![feature(fundamental)]
+diff --git a/rust/alloc/raw_vec.rs b/rust/alloc/raw_vec.rs
+index 98b6abf30af6e4..1839d1c8ee7a04 100644
+--- a/rust/alloc/raw_vec.rs
++++ b/rust/alloc/raw_vec.rs
+@@ -4,7 +4,7 @@
+ 
+ use core::alloc::LayoutError;
+ use core::cmp;
+-use core::intrinsics;
++use core::hint;
+ use core::mem::{self, ManuallyDrop, MaybeUninit, SizedTypeProperties};
+ use core::ptr::{self, NonNull, Unique};
+ use core::slice;
+@@ -317,7 +317,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Aborts
+     ///
+@@ -358,7 +358,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+         }
+         unsafe {
+             // Inform the optimizer that the reservation has succeeded or wasn't needed
+-            core::intrinsics::assume(!self.needs_to_grow(len, additional));
++            hint::assert_unchecked(!self.needs_to_grow(len, additional));
+         }
+         Ok(())
+     }
+@@ -381,7 +381,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Aborts
+     ///
+@@ -402,7 +402,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+         }
+         unsafe {
+             // Inform the optimizer that the reservation has succeeded or wasn't needed
+-            core::intrinsics::assume(!self.needs_to_grow(len, additional));
++            hint::assert_unchecked(!self.needs_to_grow(len, additional));
+         }
+         Ok(())
+     }
+@@ -553,7 +553,7 @@ where
+         debug_assert_eq!(old_layout.align(), new_layout.align());
+         unsafe {
+             // The allocator checks for alignment equality
+-            intrinsics::assume(old_layout.align() == new_layout.align());
++            hint::assert_unchecked(old_layout.align() == new_layout.align());
+             alloc.grow(ptr, old_layout, new_layout)
+         }
+     } else {
+@@ -591,7 +591,6 @@ fn handle_reserve(result: Result<(), TryReserveError>) {
+ // `> isize::MAX` bytes will surely fail. On 32-bit and 16-bit we need to add
+ // an extra guard for this in case we're running on a platform which can use
+ // all 4GB in user-space, e.g., PAE or x32.
+-
+ #[inline]
+ fn alloc_guard(alloc_size: usize) -> Result<(), TryReserveError> {
+     if usize::BITS < 64 && alloc_size > isize::MAX as usize {
+diff --git a/rust/alloc/slice.rs b/rust/alloc/slice.rs
+index 1181836da5f462..a36b072c95195f 100644
+--- a/rust/alloc/slice.rs
++++ b/rust/alloc/slice.rs
+@@ -53,14 +53,14 @@ pub use core::slice::{from_mut, from_ref};
+ pub use core::slice::{from_mut_ptr_range, from_ptr_range};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{from_raw_parts, from_raw_parts_mut};
++#[stable(feature = "slice_group_by", since = "1.77.0")]
++pub use core::slice::{ChunkBy, ChunkByMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{Chunks, Windows};
+ #[stable(feature = "chunks_exact", since = "1.31.0")]
+ pub use core::slice::{ChunksExact, ChunksExactMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{ChunksMut, Split, SplitMut};
+-#[unstable(feature = "slice_group_by", issue = "80552")]
+-pub use core::slice::{GroupBy, GroupByMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{Iter, IterMut};
+ #[stable(feature = "rchunks", since = "1.31.0")]
+diff --git a/rust/alloc/vec/into_iter.rs b/rust/alloc/vec/into_iter.rs
+index 136bfe94af6c83..0f11744c44b34c 100644
+--- a/rust/alloc/vec/into_iter.rs
++++ b/rust/alloc/vec/into_iter.rs
+@@ -20,6 +20,17 @@ use core::ops::Deref;
+ use core::ptr::{self, NonNull};
+ use core::slice::{self};
+ 
++macro non_null {
++    (mut $place:expr, $t:ident) => {{
++        #![allow(unused_unsafe)] // we're sometimes used within an unsafe block
++        unsafe { &mut *(ptr::addr_of_mut!($place) as *mut NonNull<$t>) }
++    }},
++    ($place:expr, $t:ident) => {{
++        #![allow(unused_unsafe)] // we're sometimes used within an unsafe block
++        unsafe { *(ptr::addr_of!($place) as *const NonNull<$t>) }
++    }},
++}
++
+ /// An iterator that moves out of a vector.
+ ///
+ /// This `struct` is created by the `into_iter` method on [`Vec`](super::Vec)
+@@ -43,10 +54,12 @@ pub struct IntoIter<
+     // the drop impl reconstructs a RawVec from buf, cap and alloc
+     // to avoid dropping the allocator twice we need to wrap it into ManuallyDrop
+     pub(super) alloc: ManuallyDrop<A>,
+-    pub(super) ptr: *const T,
+-    pub(super) end: *const T, // If T is a ZST, this is actually ptr+len. This encoding is picked so that
+-                              // ptr == end is a quick test for the Iterator being empty, that works
+-                              // for both ZST and non-ZST.
++    pub(super) ptr: NonNull<T>,
++    /// If T is a ZST, this is actually ptr+len. This encoding is picked so that
++    /// ptr == end is a quick test for the Iterator being empty, that works
++    /// for both ZST and non-ZST.
++    /// For non-ZSTs the pointer is treated as `NonNull<T>`
++    pub(super) end: *const T,
+ }
+ 
+ #[stable(feature = "vec_intoiter_debug", since = "1.13.0")]
+@@ -70,7 +83,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+     /// ```
+     #[stable(feature = "vec_into_iter_as_slice", since = "1.15.0")]
+     pub fn as_slice(&self) -> &[T] {
+-        unsafe { slice::from_raw_parts(self.ptr, self.len()) }
++        unsafe { slice::from_raw_parts(self.ptr.as_ptr(), self.len()) }
+     }
+ 
+     /// Returns the remaining items of this iterator as a mutable slice.
+@@ -99,7 +112,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+     }
+ 
+     fn as_raw_mut_slice(&mut self) -> *mut [T] {
+-        ptr::slice_from_raw_parts_mut(self.ptr as *mut T, self.len())
++        ptr::slice_from_raw_parts_mut(self.ptr.as_ptr(), self.len())
+     }
+ 
+     /// Drops remaining elements and relinquishes the backing allocation.
+@@ -126,7 +139,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+         // this creates less assembly
+         self.cap = 0;
+         self.buf = unsafe { NonNull::new_unchecked(RawVec::NEW.ptr()) };
+-        self.ptr = self.buf.as_ptr();
++        self.ptr = self.buf;
+         self.end = self.buf.as_ptr();
+ 
+         // Dropping the remaining elements can panic, so this needs to be
+@@ -138,9 +151,9 @@ impl<T, A: Allocator> IntoIter<T, A> {
+ 
+     /// Forgets to Drop the remaining elements while still allowing the backing allocation to be freed.
+     pub(crate) fn forget_remaining_elements(&mut self) {
+-        // For th ZST case, it is crucial that we mutate `end` here, not `ptr`.
++        // For the ZST case, it is crucial that we mutate `end` here, not `ptr`.
+         // `ptr` must stay aligned, while `end` may be unaligned.
+-        self.end = self.ptr;
++        self.end = self.ptr.as_ptr();
+     }
+ 
+     #[cfg(not(no_global_oom_handling))]
+@@ -162,7 +175,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+                 // say that they're all at the beginning of the "allocation".
+                 0..this.len()
+             } else {
+-                this.ptr.sub_ptr(buf)..this.end.sub_ptr(buf)
++                this.ptr.sub_ptr(this.buf)..this.end.sub_ptr(buf)
+             };
+             let cap = this.cap;
+             let alloc = ManuallyDrop::take(&mut this.alloc);
+@@ -189,29 +202,35 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+ 
+     #[inline]
+     fn next(&mut self) -> Option<T> {
+-        if self.ptr == self.end {
+-            None
+-        } else if T::IS_ZST {
+-            // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
+-            // reducing the `end`.
+-            self.end = self.end.wrapping_byte_sub(1);
+-
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
++        if T::IS_ZST {
++            if self.ptr.as_ptr() == self.end as *mut _ {
++                None
++            } else {
++                // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
++                // reducing the `end`.
++                self.end = self.end.wrapping_byte_sub(1);
++
++                // Make up a value of this ZST.
++                Some(unsafe { mem::zeroed() })
++            }
+         } else {
+-            let old = self.ptr;
+-            self.ptr = unsafe { self.ptr.add(1) };
++            if self.ptr == non_null!(self.end, T) {
++                None
++            } else {
++                let old = self.ptr;
++                self.ptr = unsafe { old.add(1) };
+ 
+-            Some(unsafe { ptr::read(old) })
++                Some(unsafe { ptr::read(old.as_ptr()) })
++            }
+         }
+     }
+ 
+     #[inline]
+     fn size_hint(&self) -> (usize, Option<usize>) {
+         let exact = if T::IS_ZST {
+-            self.end.addr().wrapping_sub(self.ptr.addr())
++            self.end.addr().wrapping_sub(self.ptr.as_ptr().addr())
+         } else {
+-            unsafe { self.end.sub_ptr(self.ptr) }
++            unsafe { non_null!(self.end, T).sub_ptr(self.ptr) }
+         };
+         (exact, Some(exact))
+     }
+@@ -219,7 +238,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+     #[inline]
+     fn advance_by(&mut self, n: usize) -> Result<(), NonZeroUsize> {
+         let step_size = self.len().min(n);
+-        let to_drop = ptr::slice_from_raw_parts_mut(self.ptr as *mut T, step_size);
++        let to_drop = ptr::slice_from_raw_parts_mut(self.ptr.as_ptr(), step_size);
+         if T::IS_ZST {
+             // See `next` for why we sub `end` here.
+             self.end = self.end.wrapping_byte_sub(step_size);
+@@ -261,7 +280,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+             // Safety: `len` indicates that this many elements are available and we just checked that
+             // it fits into the array.
+             unsafe {
+-                ptr::copy_nonoverlapping(self.ptr, raw_ary.as_mut_ptr() as *mut T, len);
++                ptr::copy_nonoverlapping(self.ptr.as_ptr(), raw_ary.as_mut_ptr() as *mut T, len);
+                 self.forget_remaining_elements();
+                 return Err(array::IntoIter::new_unchecked(raw_ary, 0..len));
+             }
+@@ -270,7 +289,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+         // Safety: `len` is larger than the array size. Copy a fixed amount here to fully initialize
+         // the array.
+         return unsafe {
+-            ptr::copy_nonoverlapping(self.ptr, raw_ary.as_mut_ptr() as *mut T, N);
++            ptr::copy_nonoverlapping(self.ptr.as_ptr(), raw_ary.as_mut_ptr() as *mut T, N);
+             self.ptr = self.ptr.add(N);
+             Ok(raw_ary.transpose().assume_init())
+         };
+@@ -288,7 +307,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+         // Also note the implementation of `Self: TrustedRandomAccess` requires
+         // that `T: Copy` so reading elements from the buffer doesn't invalidate
+         // them for `Drop`.
+-        unsafe { if T::IS_ZST { mem::zeroed() } else { ptr::read(self.ptr.add(i)) } }
++        unsafe { if T::IS_ZST { mem::zeroed() } else { self.ptr.add(i).read() } }
+     }
+ }
+ 
+@@ -296,18 +315,25 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+ impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
+     #[inline]
+     fn next_back(&mut self) -> Option<T> {
+-        if self.end == self.ptr {
+-            None
+-        } else if T::IS_ZST {
+-            // See above for why 'ptr.offset' isn't used
+-            self.end = self.end.wrapping_byte_sub(1);
+-
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
++        if T::IS_ZST {
++            if self.end as *mut _ == self.ptr.as_ptr() {
++                None
++            } else {
++                // See above for why 'ptr.offset' isn't used
++                self.end = self.end.wrapping_byte_sub(1);
++
++                // Make up a value of this ZST.
++                Some(unsafe { mem::zeroed() })
++            }
+         } else {
+-            self.end = unsafe { self.end.sub(1) };
++            if non_null!(self.end, T) == self.ptr {
++                None
++            } else {
++                let new_end = unsafe { non_null!(self.end, T).sub(1) };
++                *non_null!(mut self.end, T) = new_end;
+ 
+-            Some(unsafe { ptr::read(self.end) })
++                Some(unsafe { ptr::read(new_end.as_ptr()) })
++            }
+         }
+     }
+ 
+@@ -333,7 +359,11 @@ impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
+ #[stable(feature = "rust1", since = "1.0.0")]
+ impl<T, A: Allocator> ExactSizeIterator for IntoIter<T, A> {
+     fn is_empty(&self) -> bool {
+-        self.ptr == self.end
++        if T::IS_ZST {
++            self.ptr.as_ptr() == self.end as *mut _
++        } else {
++            self.ptr == non_null!(self.end, T)
++        }
+     }
+ }
+ 
+diff --git a/rust/alloc/vec/mod.rs b/rust/alloc/vec/mod.rs
+index 220fb9d6f45b3f..0be27fff4554a1 100644
+--- a/rust/alloc/vec/mod.rs
++++ b/rust/alloc/vec/mod.rs
+@@ -360,7 +360,7 @@ mod spec_extend;
+ ///
+ /// `vec![x; n]`, `vec![a, b, c, d]`, and
+ /// [`Vec::with_capacity(n)`][`Vec::with_capacity`], will all produce a `Vec`
+-/// with exactly the requested capacity. If <code>[len] == [capacity]</code>,
++/// with at least the requested capacity. If <code>[len] == [capacity]</code>,
+ /// (as is the case for the [`vec!`] macro), then a `Vec<T>` can be converted to
+ /// and from a [`Box<[T]>`][owned slice] without reallocating or moving the elements.
+ ///
+@@ -447,7 +447,7 @@ impl<T> Vec<T> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -690,7 +690,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1013,7 +1013,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1043,7 +1043,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1140,8 +1140,11 @@ impl<T, A: Allocator> Vec<T, A> {
+ 
+     /// Shrinks the capacity of the vector as much as possible.
+     ///
+-    /// It will drop down as close as possible to the length but the allocator
+-    /// may still inform the vector that there is space for a few more elements.
++    /// The behavior of this method depends on the allocator, which may either shrink the vector
++    /// in-place or reallocate. The resulting vector might still have some excess capacity, just as
++    /// is the case for [`with_capacity`]. See [`Allocator::shrink`] for more details.
++    ///
++    /// [`with_capacity`]: Vec::with_capacity
+     ///
+     /// # Examples
+     ///
+@@ -1191,10 +1194,10 @@ impl<T, A: Allocator> Vec<T, A> {
+ 
+     /// Converts the vector into [`Box<[T]>`][owned slice].
+     ///
+-    /// If the vector has excess capacity, its items will be moved into a
+-    /// newly-allocated buffer with exactly the right capacity.
++    /// Before doing the conversion, this method discards excess capacity like [`shrink_to_fit`].
+     ///
+     /// [owned slice]: Box
++    /// [`shrink_to_fit`]: Vec::shrink_to_fit
+     ///
+     /// # Examples
+     ///
+@@ -2017,7 +2020,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -2133,7 +2136,7 @@ impl<T, A: Allocator> Vec<T, A> {
+         } else {
+             unsafe {
+                 self.len -= 1;
+-                core::intrinsics::assume(self.len < self.capacity());
++                core::hint::assert_unchecked(self.len < self.capacity());
+                 Some(ptr::read(self.as_ptr().add(self.len())))
+             }
+         }
+@@ -2143,7 +2146,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -2315,6 +2318,12 @@ impl<T, A: Allocator> Vec<T, A> {
+     /// `[at, len)`. After the call, the original vector will be left containing
+     /// the elements `[0, at)` with its previous capacity unchanged.
+     ///
++    /// - If you want to take ownership of the entire contents and capacity of
++    ///   the vector, see [`mem::take`] or [`mem::replace`].
++    /// - If you don't need the returned vector at all, see [`Vec::truncate`].
++    /// - If you want to take ownership of an arbitrary subslice, or you don't
++    ///   necessarily want to store the removed items in a vector, see [`Vec::drain`].
++    ///
+     /// # Panics
+     ///
+     /// Panics if `at > len`.
+@@ -2346,14 +2355,6 @@ impl<T, A: Allocator> Vec<T, A> {
+             assert_failed(at, self.len());
+         }
+ 
+-        if at == 0 {
+-            // the new vector can take over the original buffer and avoid the copy
+-            return mem::replace(
+-                self,
+-                Vec::with_capacity_in(self.capacity(), self.allocator().clone()),
+-            );
+-        }
+-
+         let other_len = self.len - at;
+         let mut other = Vec::with_capacity_in(other_len, self.allocator().clone());
+ 
+@@ -3027,6 +3028,50 @@ impl<T, I: SliceIndex<[T]>, A: Allocator> IndexMut<I> for Vec<T, A> {
+     }
+ }
+ 
++/// Collects an iterator into a Vec, commonly called via [`Iterator::collect()`]
++///
++/// # Allocation behavior
++///
++/// In general `Vec` does not guarantee any particular growth or allocation strategy.
++/// That also applies to this trait impl.
++///
++/// **Note:** This section covers implementation details and is therefore exempt from
++/// stability guarantees.
++///
++/// Vec may use any or none of the following strategies,
++/// depending on the supplied iterator:
++///
++/// * preallocate based on [`Iterator::size_hint()`]
++///   * and panic if the number of items is outside the provided lower/upper bounds
++/// * use an amortized growth strategy similar to `pushing` one item at a time
++/// * perform the iteration in-place on the original allocation backing the iterator
++///
++/// The last case warrants some attention. It is an optimization that in many cases reduces peak memory
++/// consumption and improves cache locality. But when big, short-lived allocations are created,
++/// only a small fraction of their items get collected, no further use is made of the spare capacity
++/// and the resulting `Vec` is moved into a longer-lived structure, then this can lead to the large
++/// allocations having their lifetimes unnecessarily extended which can result in increased memory
++/// footprint.
++///
++/// In cases where this is an issue, the excess capacity can be discarded with [`Vec::shrink_to()`],
++/// [`Vec::shrink_to_fit()`] or by collecting into [`Box<[T]>`][owned slice] instead, which additionally reduces
++/// the size of the long-lived struct.
++///
++/// [owned slice]: Box
++///
++/// ```rust
++/// # use std::sync::Mutex;
++/// static LONG_LIVED: Mutex<Vec<Vec<u16>>> = Mutex::new(Vec::new());
++///
++/// for i in 0..10 {
++///     let big_temporary: Vec<u16> = (0..1024).collect();
++///     // discard most items
++///     let mut result: Vec<_> = big_temporary.into_iter().filter(|i| i % 100 == 0).collect();
++///     // without this a lot of unused capacity might be moved into the global
++///     result.shrink_to_fit();
++///     LONG_LIVED.lock().unwrap().push(result);
++/// }
++/// ```
+ #[cfg(not(no_global_oom_handling))]
+ #[stable(feature = "rust1", since = "1.0.0")]
+ impl<T> FromIterator<T> for Vec<T> {
+@@ -3069,14 +3114,8 @@ impl<T, A: Allocator> IntoIterator for Vec<T, A> {
+                 begin.add(me.len()) as *const T
+             };
+             let cap = me.buf.capacity();
+-            IntoIter {
+-                buf: NonNull::new_unchecked(begin),
+-                phantom: PhantomData,
+-                cap,
+-                alloc,
+-                ptr: begin,
+-                end,
+-            }
++            let buf = NonNull::new_unchecked(begin);
++            IntoIter { buf, phantom: PhantomData, cap, alloc, ptr: buf, end }
+         }
+     }
+ }
+@@ -3598,8 +3637,10 @@ impl<T, A: Allocator> From<Box<[T], A>> for Vec<T, A> {
+ impl<T, A: Allocator> From<Vec<T, A>> for Box<[T], A> {
+     /// Convert a vector into a boxed slice.
+     ///
+-    /// If `v` has excess capacity, its items will be moved into a
+-    /// newly-allocated buffer with exactly the right capacity.
++    /// Before doing the conversion, this method discards excess capacity like [`Vec::shrink_to_fit`].
++    ///
++    /// [owned slice]: Box
++    /// [`Vec::shrink_to_fit`]: Vec::shrink_to_fit
+     ///
+     /// # Examples
+     ///
+diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
+index be68d5e567b1a1..71f95e5aa09abd 100644
+--- a/rust/kernel/lib.rs
++++ b/rust/kernel/lib.rs
+@@ -16,7 +16,6 @@
+ #![feature(coerce_unsized)]
+ #![feature(dispatch_from_dyn)]
+ #![feature(new_uninit)]
+-#![feature(offset_of)]
+ #![feature(receiver_trait)]
+ #![feature(unsize)]
+ 
+@@ -78,7 +77,7 @@ pub trait Module: Sized + Sync {
+ /// Equivalent to `THIS_MODULE` in the C API.
+ ///
+ /// C header: [`include/linux/export.h`](srctree/include/linux/export.h)
+-pub struct ThisModule(*mut bindings::module);
++pub struct ThisModule(#[allow(dead_code)] *mut bindings::module);
+ 
+ // SAFETY: `THIS_MODULE` may be used from all threads within a module.
+ unsafe impl Sync for ThisModule {}
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index baf86c0880b6d7..367cfeea74c5f5 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -263,7 +263,7 @@ $(obj)/%.lst: $(src)/%.c FORCE
+ # Compile Rust sources (.rs)
+ # ---------------------------------------------------------------------------
+ 
+-rust_allowed_features := new_uninit,offset_of
++rust_allowed_features := new_uninit
+ 
+ # `--out-dir` is required to avoid temporaries being created by `rustc` in the
+ # current working directory, which may be not accessible in the out-of-tree
+diff --git a/scripts/min-tool-version.sh b/scripts/min-tool-version.sh
+index 5927cc6b7de338..cc5141b67b4a71 100755
+--- a/scripts/min-tool-version.sh
++++ b/scripts/min-tool-version.sh
+@@ -33,7 +33,7 @@ llvm)
+ 	fi
+ 	;;
+ rustc)
+-	echo 1.76.0
++	echo 1.77.0
+ 	;;
+ bindgen)
+ 	echo 0.65.1
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index c09f5c485e432..e94b74fb00d73 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.27";
-    hash = "sha256-MYvt7QWRdUybbhva6B4MOYrwnJfuu/qvMlnaGKcO1Hw=";
+    version = "6.6.28";
+    hash = "sha256-0ld4pZIddfkGytxzqgC7AGD3gc2H9mhZbhpbFLD3G+s=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.8.6";
-    hash = "sha256-7GsiIl3rcLm/u2zxrjpP6dTxn7w/6at22gaU//mLlzw=";
+    version = "6.8.7";
+    hash = "sha256-S9UooZhMtvfyL2BVUfMBxvPLkZvXm37duWSjcpk5dvY=";
     variant = "main";
   };
 
diff --git a/pkgs/os-specific/linux/kexec-tools/default.nix b/pkgs/os-specific/linux/kexec-tools/default.nix
index c62f9047fc60b..530fd767bb909 100644
--- a/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
-  version = "2.0.26";
+  version = "2.0.28";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${pname}-${version}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${pname}-${version}.tar.xz"
     ];
-    sha256 = "sha256-f+NqBkEBzVxRXkGyvjk9zjyoitzlnW7maOCvfAxFcM0=";
+    sha256 = "sha256-0vDvhy854v5LGwH+tisAATgyByObn4BB+YqVVkFh0FM=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 22c162023e1c9..99454beb41878 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-wVCBLJK9nlS1N9/DrQtogoZmgWW4ECqInSeQTjUFhcY=";
+    sha256 = "sha256-3TCsIlr28vO6Zu9lDaEq6J4J+D5sHP7SSo1O/M0ZzUo=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 71de8ce3cdcc1..e525c9c3f5f7d 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -61,9 +61,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  # https://github.com/NixOS/nixpkgs/issues/300635
-  postInstall = ''chmod -R u-s,g-s "$out"'';
-
   passthru = {
     tests = {
       incus-legacy-init = nixosTests.incus.container-legacy-init;
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 30a1e4dd8b6f0..67733922f0c02 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -793,7 +793,13 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" =
     else
         cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
 
-        if [[ ! -f "${cmd[-1]}" ]]; then
+        if [ -z "$targetHost" ]; then
+            specialisationExists=$(test -f "${cmd[-1]}")
+        else
+            specialisationExists=$(targetHostCmd test -f "${cmd[-1]}")
+        fi
+
+        if ! $specialisationExists; then
             log "error: specialisation not found: $specialisation"
             exit 1
         fi
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index c956dfad4c64f..2b0c327fbc2e6 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -22,6 +22,15 @@ stdenv.mkDerivation rec {
       url = "https://github.com/linux-pam/linux-pam/commit/cc9d40b7cdbd3e15ccaa324a0dda1680ef9dea13.patch";
       hash = "sha256-tCnH2yPO4dBbJOZA0fP2gm1EavHRMEJyfzB5Vy7YjAA=";
     })
+
+    # Resotre handling of empty passwords:
+    #   https://github.com/linux-pam/linux-pam/pull/784
+    # TODO: drop upstreamed patch on 1.6.1 update.
+    (fetchpatch {
+      name = "revert-unconditional-helper.patch";
+      url = "https://github.com/linux-pam/linux-pam/commit/8d0c575336ad301cd14e16ad2fdec6fe621764b8.patch";
+      hash = "sha256-z9KfMxxqXQVnmNaixaVjLnQqaGsH8MBHhHbiP/8fvhE=";
+    })
   ];
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index edd11143ad609..9cdc5dcd9d44d 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -150,6 +150,10 @@
 , withUserDb ? true
 , withUtmp ? !stdenv.hostPlatform.isMusl
 , withVmspawn ? true
+  # kernel-install shouldn't usually be used on NixOS, but can be useful, e.g. for
+  # building disk images for non-NixOS systems. To save users from trying to use it
+  # on their live NixOS system, we disable it by default.
+, withKernelInstall ? false
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
   # build only libudev and libsystemd
@@ -628,6 +632,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "efi" withEfi)
     (lib.mesonBool "utmp" withUtmp)
     (lib.mesonBool "log-trace" withLogTrace)
+    (lib.mesonBool "kernel-install" withKernelInstall)
     (lib.mesonBool "quotacheck" false)
     (lib.mesonBool "ldconfig" false)
     (lib.mesonBool "install-sysconfdir" false)
@@ -819,7 +824,7 @@ stdenv.mkDerivation (finalAttrs: {
     done
 
     rm -rf $out/etc/rpm
-
+  '' + lib.optionalString (!withKernelInstall) ''
     # "kernel-install" shouldn't be used on NixOS.
     find $out -name "*kernel-install*" -exec rm {} \;
   '' + lib.optionalString (!withDocumentation) ''
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 3b08318c965ea..8a1d79a9d7bdd 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , makeWrapper
 , pkg-config
 , libxslt
@@ -33,7 +32,7 @@ assert withDocs -> withIntrospection;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
-  version = "1.90.2";
+  version = "1.90.4";
 
   outputs = [ "out" "dev" "installedTests" ]
     ++ lib.optionals withDocs [ "devdoc" ];
@@ -43,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upower";
     repo = "upower";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7WzMAJuf1czU8ZalsEU/NwCXYqTGvcqEqxFt5ocgt48=";
+    hash = "sha256-5twHuDLisVF07Y5KYwlqWMi12+p6UpARJvoBN/+tX2o=";
   };
 
   patches = lib.optionals (stdenv.hostPlatform.system == "i686-linux") [
@@ -52,10 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./i686-test-remove-battery-check.patch
   ] ++ [
     ./installed-tests-path.patch
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/upower/upower/-/merge_requests/207.diff";
-      hash = "sha256-ldr1bKbSAdYpwbbe/Iq9i0Q9zQrHWvIvBGym/F3+vxs=";
-    })
   ];
 
   strictDeps = true;
diff --git a/pkgs/pkgs-lib/formats/hocon/default.nix b/pkgs/pkgs-lib/formats/hocon/default.nix
index 318ee0143320a..0ae9c569ed2b1 100644
--- a/pkgs/pkgs-lib/formats/hocon/default.nix
+++ b/pkgs/pkgs-lib/formats/hocon/default.nix
@@ -107,7 +107,7 @@ in
     generate = name: value:
       let
         # TODO: remove in 24.11
-        # Backwards compatability for generators in the following locations:
+        # Backwards compatibility for generators in the following locations:
         #  - nixos/modules/services/networking/jibri/default.nix (__hocon_envvar)
         #  - nixos/modules/services/networking/jicofo.nix (__hocon_envvar, __hocon_unquoted_string)
         #  - nixos/modules/services/networking/jitsi-videobridge.nix (__hocon_envvar)
diff --git a/pkgs/servers/deconz/default.nix b/pkgs/servers/deconz/default.nix
index 7f5d60b153f81..110048f9de285 100644
--- a/pkgs/servers/deconz/default.nix
+++ b/pkgs/servers/deconz/default.nix
@@ -16,16 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "deconz";
-  version = "2.23.00";
+  version = "2.26.3";
 
   src = fetchurl {
     url = "https://deconz.dresden-elektronik.de/ubuntu/beta/deconz-${version}-qt5.deb";
-    sha256 = "sha256-TMftm1fz8c8ndSyA3HUd7JWT0DINxvbdUSDrmVMwmws=";
-  };
-
-  devsrc = fetchurl {
-    url = "https://deconz.dresden-elektronik.de/ubuntu/beta/deconz-dev-${version}.deb";
-    sha256 = "sha256-uW5iF3rvFlowFhMBVDTOHkJ2K4LBgAxxC79tXpMhy5U=";
+    sha256 = "sha256-BE/apFPutNdhlS1NWRHdVcVrt/16aFfZ6zRcjphIlZA=";
   };
 
   nativeBuildInputs = [ dpkg autoPatchelfHook makeWrapper wrapQtAppsHook ];
@@ -36,7 +31,6 @@ stdenv.mkDerivation rec {
     runHook preUnpack
 
     dpkg -x $src ./deconz-src
-    dpkg -x $devsrc ./deconz-devsrc
 
     runHook postUnpack
   '';
@@ -46,7 +40,6 @@ stdenv.mkDerivation rec {
 
     mkdir -p "$out"
     cp -r deconz-src/* "$out"
-    cp -r deconz-devsrc/* "$out"
 
     # Flatten /usr and manually merge lib/ and usr/lib/, since mv refuses to.
     mv "$out/lib" "$out/orig_lib"
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 30334840268bf..5af0a79c4dfde 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -18,11 +18,11 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.7.1";
+  version = "5.7.2";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "da14b415c61d53747a991f12d6209367ef826a13dc6bf4eeaf5d88760294c3a2";
+    hash = "sha256-X2oic5D81MLQqAKKZStVqdhj7HvgEpj+A43x0nP7mg8=";
   };
 
   outputs = [ "out" "dev" ];
@@ -53,8 +53,6 @@ unwrapped = stdenv.mkDerivation rec {
     echo 'os.exit(77)' > daemon/lua/trust_anchors.test/bootstrap.test.lua
     sed -E '/^[[:blank:]]*test_(dstaddr|headers),?$/d' -i \
       tests/config/doh2.test.lua modules/http/http_doh.test.lua
-  '' + /* FIXME: see PR #286822 */ ''
-    sed '/doh2\.test\.lua/d' -i tests/config/meson.build
   '';
 
   preConfigure = ''
@@ -120,8 +118,7 @@ wrapped-full = runCommand unwrapped.name
     allowSubstitutes = false;
     inherit (unwrapped) meta;
   }
-  (assert false; # FIXME: the http module won't work; see PR #286822
-  ''
+  (''
     mkdir -p "$out"/bin
     makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
       --set LUA_PATH  "$LUA_PATH" \
diff --git a/pkgs/servers/dns/trust-dns/default.nix b/pkgs/servers/dns/trust-dns/default.nix
index f330081893858..fa8fcc88261af 100644
--- a/pkgs/servers/dns/trust-dns/default.nix
+++ b/pkgs/servers/dns/trust-dns/default.nix
@@ -13,9 +13,9 @@ rustPlatform.buildRustPackage rec {
     owner = "hickory-dns";
     repo = "hickory-dns";
     rev = "v${version}";
-    hash = "sha256-+vZnozPsORe7nK6jL/yt/wp2qjwBTqyxZYz+cXaKNFk=";
+    hash = "sha256-szq21RuRmkhAfHlzhGQYpwjiIRkavFCPETOt+6TxhP4=";
   };
-  cargoHash = "sha256-VLpl6eMOstD0FsuPeHngKQitv1jcb+0dx2pc8ic3Cf4=";
+  cargoHash = "sha256-zGn5vHwsHgpkgOr30QiyScqnfXjH55LQIVtxoUUox64=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/elasticmq-server-bin/default.nix b/pkgs/servers/elasticmq-server-bin/default.nix
index 9da82d41996f2..395ac3609514e 100644
--- a/pkgs/servers/elasticmq-server-bin/default.nix
+++ b/pkgs/servers/elasticmq-server-bin/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "elasticmq-server";
-  version = "1.5.8";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://s3-eu-west-1.amazonaws.com/softwaremill-public/${finalAttrs.pname}-${finalAttrs.version}.jar";
-    sha256 = "sha256-7E1fkMPPwPUEZUL/VqTX0DSdL5mUlSlf7lDE1jNb3Ns=";
+    sha256 = "sha256-h71YX8mP9iB92gK+QQD/xl1JLZwKspAwE6D3wq+SOkU=";
   };
 
   # don't do anything?
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 33b56ccb134a8..51c324a0bef3b 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2024.4.2";
+  version = "2024.4.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix b/pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix
index d61d1850e13b8..5557e11761dfd 100644
--- a/pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix
@@ -3,13 +3,13 @@
 buildHomeAssistantComponent rec {
   owner = "KartoffelToby";
   domain = "better_thermostat";
-  version = "1.5.0-beta7";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "KartoffelToby";
     repo = "better_thermostat";
     rev = "refs/tags/${version}";
-    hash = "sha256-bJURpeBgoxXGR7C9MY/gmNY7OFvBxrJKz2cA61b5hNo=";
+    hash = "sha256-noo96Uks+MHtTbwIoU5gnekp/IwMry0U18X4I1qe4LQ=";
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/home-assistant/custom-components/default.nix b/pkgs/servers/home-assistant/custom-components/default.nix
index 1a7f9d47e1875..acfcf038f20ef 100644
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@@ -38,9 +38,15 @@
 
   sensi = callPackage ./sensi {};
 
+  smartir = callPackage ./smartir {};
+
   smartthinq-sensors = callPackage ./smartthinq-sensors {};
 
   waste_collection_schedule = callPackage ./waste_collection_schedule {};
 
+  xiaomi_gateway3 = callPackage ./xiaomi_gateway3 {};
+
+  xiaomi_miot = callPackage ./xiaomi_miot {};
+
   yassi = callPackage ./yassi {};
 }
diff --git a/pkgs/servers/home-assistant/custom-components/miele/default.nix b/pkgs/servers/home-assistant/custom-components/miele/default.nix
index 71624f674b4d7..3ebdc6283c035 100644
--- a/pkgs/servers/home-assistant/custom-components/miele/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/miele/default.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "astrandb";
   domain = "miele";
-  version = "0.1.19";
+  version = "2024.3.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     rev = "refs/tags/v${version}";
-    hash = "sha256-od7DV10/rkIw9eFMsTRw4bMmhQo9BAmw2rCbKKySeIk=";
+    hash = "sha256-J9n4PFcd87L301B2YktrLcxp5Vu1HwDeCYnrMEJ0+TA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/home-assistant/custom-components/smartir/default.nix b/pkgs/servers/home-assistant/custom-components/smartir/default.nix
new file mode 100644
index 0000000000000..5dc9eb2473d72
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/smartir/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildHomeAssistantComponent
+, fetchFromGitHub
+, aiofiles
+, broadlink
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "smartHomeHub";
+  domain = "smartir";
+  version = "1.17.9";
+
+  src = fetchFromGitHub {
+    owner = "smartHomeHub";
+    repo = "SmartIR";
+    rev = version;
+    hash = "sha256-E6TM761cuaeQzlbjA+oZ+wt5HTJAfkF2J3i4P1Wbuic=";
+  };
+
+  propagatedBuildInputs = [
+    aiofiles
+    broadlink
+  ];
+
+  dontBuild = true;
+
+  postInstall = ''
+    cp -r codes $out/custom_components/smartir/
+  '';
+
+  meta = with lib; {
+    changelog = "https://github.com/smartHomeHub/SmartIR/releases/tag/v${version}";
+    description = "Integration for Home Assistant to control climate, TV and fan devices via IR/RF controllers (Broadlink, Xiaomi, MQTT, LOOKin, ESPHome)";
+    homepage = "https://github.com/smartHomeHub/SmartIR";
+    maintainers = with maintainers; [ azuwis ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-components/xiaomi_gateway3/default.nix b/pkgs/servers/home-assistant/custom-components/xiaomi_gateway3/default.nix
new file mode 100644
index 0000000000000..fd453e0d321c0
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/xiaomi_gateway3/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildHomeAssistantComponent
+, fetchFromGitHub
+, zigpy
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "AlexxIT";
+  domain = "xiaomi_gateway3";
+  version = "4.0.3";
+
+  src = fetchFromGitHub {
+    owner = "AlexxIT";
+    repo = "XiaomiGateway3";
+    rev = "v${version}";
+    hash = "sha256-YGaVQaz3A0yM8AIC02CvMKWMJ3tW3OADYgKY8ViIt5U=";
+  };
+
+  propagatedBuildInputs = [
+    zigpy
+  ];
+
+  dontBuild = true;
+
+  meta = with lib; {
+    changelog = "https://github.com/AlexxIT/XiaomiGateway3/releases/tag/v{version}";
+    description = "Home Assistant custom component for control Xiaomi Multimode Gateway (aka Gateway 3), Xiaomi Multimode Gateway 2, Aqara Hub E1 on default firmwares over LAN";
+    homepage = "https://github.com/AlexxIT/XiaomiGateway3";
+    maintainers = with maintainers; [ azuwis ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/default.nix b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/default.nix
new file mode 100644
index 0000000000000..0c64655d76df5
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildHomeAssistantComponent
+, fetchFromGitHub
+, hap-python
+, micloud
+, pyqrcode
+, python-miio
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "al-one";
+  domain = "xiaomi_miot";
+  version = "0.7.17";
+
+  src = fetchFromGitHub {
+    owner = "al-one";
+    repo = "hass-xiaomi-miot";
+    rev = "v${version}";
+    hash = "sha256-IpL4e2mKCdtNu8NtI+xpx4FPW/uj1M5Rk6DswXmSJBk=";
+  };
+
+  propagatedBuildInputs = [
+    hap-python
+    micloud
+    pyqrcode
+    python-miio
+  ];
+
+  dontBuild = true;
+
+  meta = with lib; {
+    changelog = "https://github.com/al-one/hass-xiaomi-miot/releases/tag/${version}";
+    description = "Automatic integrate all Xiaomi devices to HomeAssistant via miot-spec, support Wi-Fi, BLE, ZigBee devices.";
+    homepage = "https://github.com/al-one/hass-xiaomi-miot";
+    maintainers = with maintainers; [ azuwis ];
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index afcb2e2cd18a9..e3bec47d25a80 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -262,7 +262,7 @@ let
         };
 
         nativeBuildInputs = with self; [
-          cython_3
+          cython
           setuptools
           libxml2.dev
           libxslt.dev
@@ -526,7 +526,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2024.4.2";
+  hassVersion = "2024.4.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -544,13 +544,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-V6qvpPrhfSLINH99hYkAjvG8pfIN8AXGO3HuwiKgMPo=";
+    hash = "sha256-jHt4cWi1JxUs2XKf0N9gqsYj5XZK7TXwgj7WPZ7dmEA=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZtTlLRDSXKUz+ZA+UctFL+d3wdKrcPdeROIUhS35qWU=";
+    hash = "sha256-sj3usdXUl/wNElO3OgGx6dsBqn9+h9zq/AC3Zdn379M=";
   };
 
   nativeBuildInputs = with python.pkgs; [
@@ -559,6 +559,7 @@ in python.pkgs.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "aiohttp"
     "attrs"
     "bcrypt"
     "ciso8601"
@@ -566,6 +567,7 @@ in python.pkgs.buildPythonApplication rec {
     "hass-nabucasa"
     "httpx"
     "orjson"
+    "pillow"
     "pyopenssl"
     "typing-extensions"
     "urllib3"
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 4b95c1cb86886..afa2c53ca3f7f 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20240404.1";
+  version = "20240404.2";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-Vuk/e+wn8Cbko7tbjLIbclhdj3R+BdHzu4OSsBUAOcU=";
+    hash = "sha256-xCpQHzfXXt9aOWWVGYtt9NYws//ZPjI/owXBQafb31k=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/parse-requirements.py b/pkgs/servers/home-assistant/parse-requirements.py
index 4a54f351ac490..404120d062acb 100755
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p nodePackages.pyright ruff isort
+#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p pyright ruff isort
 #
 # This script downloads Home Assistant's source tarball.
 # Inside the homeassistant/components directory, each integration has an associated manifest.json,
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index b70aa8ed3d230..f8e4e49b13ff0 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.4.2";
+  version = "2024.4.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-qt7NBbjjeiNcHOM6wKI7Y3+L579xBQJD48hU89BB+ss=";
+    hash = "sha256-uFQQNcRfo4m3GnfCbAe4yjdphkpqnhpqVr1EZP3bqVM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/home-assistant/update.py b/pkgs/servers/home-assistant/update.py
index c0c3cfdef9938..c9b9eb183890e 100755
--- a/pkgs/servers/home-assistant/update.py
+++ b/pkgs/servers/home-assistant/update.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=channel:nixpkgs-unstable -i python3 -p "python3.withPackages (ps: with ps; [ aiohttp packaging ])" -p git nurl nodePackages.pyright ruff isort
+#!nix-shell -I nixpkgs=channel:nixpkgs-unstable -i python3 -p "python3.withPackages (ps: with ps; [ aiohttp packaging ])" -p git nurl pyright ruff isort
 
 import asyncio
 import json
diff --git a/pkgs/servers/hylafaxplus/default.nix b/pkgs/servers/hylafaxplus/default.nix
index 278f0b4c5260a..246ad636ceb4c 100644
--- a/pkgs/servers/hylafaxplus/default.nix
+++ b/pkgs/servers/hylafaxplus/default.nix
@@ -32,8 +32,8 @@
 let
 
   pname = "hylafaxplus";
-  version = "7.0.7";
-  hash = "sha512-nUvt+M0HBYN+MsGskuuDt1j0nI5Dk8MbfK/OVxP2FCDby3eiDg0eDtcpIxlOe4o0klko07zDRIb06zqh8ABuKA==";
+  version = "7.0.8";
+  hash = "sha512-6wTLVcaHpASy+2i+jeoJ1cM2aLgI5vznGrLd4NCkLHiOxlfCh/ASRaj2Nxt9ZZ5NN/deEwf9tNSZ7MkFZHVsqA==";
 
   configSite = substituteAll {
     name = "${pname}-config.site";
diff --git a/pkgs/servers/hylafaxplus/libtiff-4.patch b/pkgs/servers/hylafaxplus/libtiff-4.patch
index e00d94b5a979b..d7284e2428651 100644
--- a/pkgs/servers/hylafaxplus/libtiff-4.patch
+++ b/pkgs/servers/hylafaxplus/libtiff-4.patch
@@ -1,11 +1,11 @@
 https://bugs.gentoo.org/706154
 --- a/configure
 +++ b/configure
-@@ -2583,7 +2583,7 @@ EOF
+@@ -2584,7 +2584,7 @@ EOF
  				echo '#define TIFFSTRIPBYTECOUNTS uint32_t'
  				echo '#define TIFFVERSION TIFF_VERSION'
  				echo '#define TIFFHEADER TIFFHeader';;
--		4.[012345])	tiff_runlen_t="uint32_t"
+-		4.[0123456])	tiff_runlen_t="uint32_t"
 +		4.[0-9])	tiff_runlen_t="uint32_t"
  				tiff_offset_t="uint64_t"
  				echo '#define TIFFSTRIPBYTECOUNTS uint64_t'
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index 3614e49e75bc1..1bc2afb4f8401 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "unstable-2024-04-05";
+  version = "unstable-2024-04-15";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "01c7befacb5b71643130433f2afb3f22ece68d71";
-    sha256 = "sha256-zFGFhO5EYyJ0qwQN+NOaKDlEu2LIbc9JAJVxFbMDJOU=";
+    rev = "2425a74638baa87efef3ca02253804d126101c8a";
+    sha256 = "sha256-ZGsMv4+Nv2G2bHRI5Vm1Uj+Uj6zee4oAVDMLrVrwurU=";
   };
 
   sourceRoot = "${src.name}/klippy";
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index 71740cf419081..e7babb51a8d41 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -1,12 +1,12 @@
 {lib, stdenv, fetchurl, cyrus_sasl, libevent, nixosTests }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.24";
+  version = "1.6.26";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-+QXsCzhDKoqAvM0E6Q501ey6mLj2R+XWHku1QIWnpCI=";
+    sha256 = "sha256-yTnHhZo8HPYDA+ndCAxjrEo4fuKEbVlc1SY6PcrNwvc=";
   };
 
   configureFlags = [
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 671eb4c108a84..411c609369b94 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2024-04-06T05-26-02Z";
+  version = "2024-04-18T19-09-19Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-6ThzAPpLKzhHAXYW6EC6aiyVRvI0nJ2a4Q2GvLpg3wo=";
+    hash = "sha256-yfVB9CTNg/Vv2j3q3vMU2rwtT6R1laA9MNhcpUKSg2U=";
   };
 
-  vendorHash = "sha256-JJfLeKoMBQ1/Q2xF6n9VD3khaiLB1ZLNl9HaQl9eKb8=";
+  vendorHash = "sha256-FMLxXwB1lSzV8C+tJZYhZHJbaKQ3xDhtHfc68ZIJFyw=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/misc/irrd/default.nix b/pkgs/servers/misc/irrd/default.nix
index e6cc723ab4dc0..c2ce5bed86e0b 100644
--- a/pkgs/servers/misc/irrd/default.nix
+++ b/pkgs/servers/misc/irrd/default.nix
@@ -16,7 +16,7 @@ let
       sqlalchemy = prev.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.24";
         src = fetchPypi {
-          inherit (oldAttrs) pname;
+          pname = "SQLAlchemy";
           inherit version;
           hash = "sha256-67t3fL+TEjWbiXv4G6ANrg9ctp+6KhgmXcwYpvXvdRk=";
         };
@@ -157,6 +157,7 @@ py.pkgs.buildPythonPackage rec {
     license = licenses.mit;
     homepage = "https://github.com/irrdnet/irrd";
     maintainers = teams.wdz.members;
+    broken = true; # last successful build 2023-10-21
   };
 }
 
diff --git a/pkgs/servers/monitoring/unpoller/default.nix b/pkgs/servers/monitoring/unpoller/default.nix
index 5ce7d27d86f92..5cae8fbc7982b 100644
--- a/pkgs/servers/monitoring/unpoller/default.nix
+++ b/pkgs/servers/monitoring/unpoller/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "unpoller";
-  version = "2.11.1";
+  version = "2.11.2";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${version}";
-    hash = "sha256-ZCNXwq0kSfXOqF7QktHg1Yw7gqUXkccCgLIs7GTZnuw=";
+    hash = "sha256-/X2hCtF38X0twHsHSjpf23Mdz9aK43z3jhWbfkUo0kQ=";
   };
 
-  vendorHash = "sha256-VK0ekEBHn0O41MgxhuPzueF6FazKiipL0OQRVPco3uk=";
+  vendorHash = "sha256-d7kkdiGMT3bN1dfNo8m+zp3VY8kaZM2BWO3B3iAdUQY=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 39063ca20860c..0d8f6a22a3e47 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.22.8";
+  version = "0.22.9";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-D9kxi/+e56/DREoT14EozAB4Z5X4QgmkhoD/sw1VAeY=";
+    hash = "sha256-0VzhjiNLAwZNi84ud/l00rWIFV4qPTXY7jZQB/pMD6A=";
   };
 
-  vendorHash = "sha256-5zO0C/+tVVOgV7TH6eC1Sjh6W8AKannU4e0+OITk4XY=";
+  vendorHash = "sha256-/SPJr2x3o1KkV8NgciBFC6zwDNUKmFQBWjEHO2CRgZ4=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index ea840413f5efa..b1b228a37ec91 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -10,15 +10,15 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-oZI2nvxvxOiv9F9c2AaP9hEBVd3kV4tjuEmvaR5V0Lc=";
-    arm64-linux_hash = "sha256-Pquc/b/VXJEi4N8uOfvg4X1083JaOdCXg2IPAGZAMV0=";
-    x64-osx_hash = "sha256-HHmx8bI4d+xmL63v/qmUIJDt+laoSs5Iqp+I7OzoU/k=";
-    arm64-osx_hash = "sha256-Us/ZEDlZ96/ybs8lxnl4bSFICwc9xJtXScA+hGEwfWk=";
+    x64-linux_hash = "sha256-eFJ31tZPxzK1Vx2EOZ1AMrzCUL7pXJIb5J1joL/ZIgs=";
+    arm64-linux_hash = "sha256-BtxHBHc2dYYdqZxwga7K49aGfSq5a8Z1TLjMPH4ldlw=";
+    x64-osx_hash = "sha256-GQ8wHU4wWu6fpjiLI9yQyMvhP1DS5FE+YQu2uLFdto4=";
+    arm64-osx_hash = "sha256-AnZ+mGeafJsRb6Koj0+oaER8d6vuDQ0x+Wc1eflzupo=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "5.3.6.8612";
+  version = "5.4.6.8723";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/radicale/3.x.nix b/pkgs/servers/radicale/3.x.nix
index 92db274bf7085..c9523233379e2 100644
--- a/pkgs/servers/radicale/3.x.nix
+++ b/pkgs/servers/radicale/3.x.nix
@@ -35,15 +35,10 @@ python3.pkgs.buildPythonApplication rec {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
+    pytest7CheckHook
     waitress
   ];
 
-  pytestFlagsArray = [
-    # pytest.PytestRemovedIn8Warning: Support for nose tests is deprecated and will be removed in a future release.
-    "-W" "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
   passthru.tests = {
     inherit (nixosTests) radicale;
   };
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index 5e816ab13b4db..7efd9f75154b1 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -7,12 +7,12 @@
 , stdenv
 }:
 let
-  version = "23.3.11";
+  version = "23.3.12";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-/z8KkkjGxHgtKXsM0OaUHHYI1bpe79gf9KYvAGLAVR8=";
+    sha256 = "sha256-gkJlqyPDsWaXcbOGB7m70YuHY44xLNymf9laK30yr1k=";
   };
   server = callPackage ./server.nix { inherit src version; };
 in
@@ -21,7 +21,7 @@ buildGoModule rec {
   inherit doCheck src version;
   modRoot = "./src/go/rpk";
   runVend = false;
-  vendorHash = "sha256-sN21Y1e08gG8z/RfYIPGEeWW58YH66uB+16b2Bzb/3I=";
+  vendorHash = "sha256-B//qmqxS3g9u2yir8Z3iV2fjQ4XXPAjFujeOZjdt8PE=";
 
   ldflags = [
     ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 192c5ade05b57..23b6597278414 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -35,6 +35,7 @@
 , python3Packages
 , nixosTests
 , libiconv
+, testers
 
 , enableLDAP ? false, openldap
 , enablePrinting ? false, cups
@@ -60,12 +61,12 @@ let
     inherit python;
   };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "samba";
   version = "4.20.0";
 
   src = fetchurl {
-    url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
+    url = "mirror://samba/pub/samba/stable/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-AmclQlEKxuXQyRwMFNkKtObsOXxwnpUsbaOm4LTVpC8=";
   };
 
@@ -239,8 +240,15 @@ stdenv.mkDerivation rec {
     lib.optionals (buildPackages.python3Packages.python != python3Packages.python)
       [ buildPackages.python3Packages.python ];
 
-  passthru = {
-    tests.samba = nixosTests.samba;
+  passthru.tests = {
+    samba = nixosTests.samba;
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+    version = testers.testVersion {
+      command = "${finalAttrs.finalPackage}/bin/smbd -V";
+      package = finalAttrs.finalPackage;
+    };
   };
 
   meta = with lib; {
@@ -250,5 +258,20 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     broken = enableGlusterFS;
     maintainers = with maintainers; [ aneeshusa ];
+    pkgConfigModules = [
+      "dcerpc_samr"
+      "dcerpc"
+      "ndr_krb5pac"
+      "ndr_nbt"
+      "ndr_standard"
+      "ndr"
+      "netapi"
+      "samba-credentials"
+      "samba-hostconfig"
+      "samba-util"
+      "samdb"
+      "smbclient"
+      "wbclient"
+    ];
   };
-}
+})
diff --git a/pkgs/servers/sql/postgresql/ext/citus.nix b/pkgs/servers/sql/postgresql/ext/citus.nix
index b5e8cfbeebcce..c51aa7946f5e9 100644
--- a/pkgs/servers/sql/postgresql/ext/citus.nix
+++ b/pkgs/servers/sql/postgresql/ext/citus.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    # "Our soft policy for Postgres version compatibilty is to support Citus'
+    # "Our soft policy for Postgres version compatibility is to support Citus'
     # latest release with Postgres' 3 latest releases."
     # https://www.citusdata.com/updates/v12-0/#deprecated_features
     broken = versionOlder postgresql.version "14";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
index dcd23a0949bb0..bf3b9d34cc4e6 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Fix compatiblity with PostgreSQL 16. Remove with the next release.
+    # Fix compatibility with PostgreSQL 16. Remove with the next release.
     (fetchpatch {
       url = "https://github.com/pgbigm/pg_bigm/commit/2a9d783c52a1d7a2eb414da6f091f6035da76edf.patch";
       hash = "sha256-LuMpSUPnT8cPChQfA9sJEKP4aGpsbN5crfTKLnDzMN8=";
diff --git a/pkgs/servers/sunshine/default.nix b/pkgs/servers/sunshine/default.nix
index 7d43eff483e8c..d4ad28ca4361d 100644
--- a/pkgs/servers/sunshine/default.nix
+++ b/pkgs/servers/sunshine/default.nix
@@ -5,6 +5,7 @@
 , autoAddDriverRunpath
 , makeWrapper
 , buildNpmPackage
+, nixosTests
 , cmake
 , avahi
 , libevdev
@@ -185,7 +186,10 @@ stdenv'.mkDerivation rec {
     install -Dm644 ../packaging/linux/${pname}.desktop $out/share/applications/${pname}.desktop
   '';
 
-  passthru.updateScript = ./updater.sh;
+  passthru = {
+    tests.sunshine = nixosTests.sunshine;
+    updateScript = ./updater.sh;
+  };
 
   meta = with lib; {
     description = "Sunshine is a Game stream host for Moonlight";
diff --git a/pkgs/servers/web-apps/changedetection-io/default.nix b/pkgs/servers/web-apps/changedetection-io/default.nix
index 1d45e156096ce..c3c9c8116addd 100644
--- a/pkgs/servers/web-apps/changedetection-io/default.nix
+++ b/pkgs/servers/web-apps/changedetection-io/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "changedetection-io";
-  version = "0.45.17";
+  version = "0.45.20";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dgtlmoon";
     repo = "changedetection.io";
-    rev = version;
-    hash = "sha256-3LaNZourDjFjdSh5+hwc2l2DRMEI/rbfyksFD9uUebg=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wnJz/yVOSBTgOfGxmrO4JXifZxoTk8bjqGKqKsbwXAI=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/web-apps/kavita/change-webroot.diff b/pkgs/servers/web-apps/kavita/change-webroot.diff
index 30e91134bd56f..7c31e6844c630 100644
--- a/pkgs/servers/web-apps/kavita/change-webroot.diff
+++ b/pkgs/servers/web-apps/kavita/change-webroot.diff
@@ -1,5 +1,5 @@
 diff --git a/API/Controllers/FallbackController.cs b/API/Controllers/FallbackController.cs
-index 0c925476..c7b30f39 100644
+index 0c92547..d54abb9 100644
 --- a/API/Controllers/FallbackController.cs
 +++ b/API/Controllers/FallbackController.cs
 @@ -22,7 +22,7 @@ public class FallbackController : Controller
@@ -12,20 +12,20 @@ index 0c925476..c7b30f39 100644
  }
  
 diff --git a/API/Services/DirectoryService.cs b/API/Services/DirectoryService.cs
-index 15afddf9..aff1f230 100644
+index e3dede8..8ec6358 100644
 --- a/API/Services/DirectoryService.cs
 +++ b/API/Services/DirectoryService.cs
-@@ -113,7 +113,7 @@ public class DirectoryService : IDirectoryService
+@@ -117,7 +117,7 @@ public class DirectoryService : IDirectoryService
          ExistOrCreate(SiteThemeDirectory);
          FaviconDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "config", "favicons");
          ExistOrCreate(FaviconDirectory);
 -        LocalizationDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "I18N");
 +        LocalizationDirectory = FileSystem.Path.Join("@out@/lib/kavita-backend", "I18N");
-     }
- 
-     /// <summary>
+         CustomizedTemplateDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "config", "templates");
+         ExistOrCreate(CustomizedTemplateDirectory);
+         TemplateDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "EmailTemplates");
 diff --git a/API/Services/LocalizationService.cs b/API/Services/LocalizationService.cs
-index ab3ad3d8..ac813a69 100644
+index ab3ad3d..f1a068b 100644
 --- a/API/Services/LocalizationService.cs
 +++ b/API/Services/LocalizationService.cs
 @@ -52,8 +52,7 @@ public class LocalizationService : ILocalizationService
@@ -39,7 +39,7 @@ index ab3ad3d8..ac813a69 100644
  
          _cacheOptions = new MemoryCacheEntryOptions()
 diff --git a/API/Startup.cs b/API/Startup.cs
-index 939bfb58..1adb9373 100644
+index 3b872f3..424984c 100644
 --- a/API/Startup.cs
 +++ b/API/Startup.cs
 @@ -36,6 +36,7 @@ using Microsoft.AspNetCore.StaticFiles;
@@ -50,7 +50,7 @@ index 939bfb58..1adb9373 100644
  using Microsoft.Extensions.Hosting;
  using Microsoft.Extensions.Logging;
  using Microsoft.Net.Http.Headers;
-@@ -298,9 +299,6 @@ public class Startup
+@@ -295,9 +296,6 @@ public class Startup
          app.UsePathBase(basePath);
          if (!env.IsDevelopment())
          {
@@ -60,7 +60,7 @@ index 939bfb58..1adb9373 100644
              // Update DB with what's in config
              var dataContext = serviceProvider.GetRequiredService<DataContext>();
              var setting = dataContext.ServerSetting.SingleOrDefault(x => x.Key == ServerSettingKey.BaseUrl);
-@@ -333,6 +334,7 @@ public class Startup
+@@ -341,6 +339,7 @@ public class Startup
  
          app.UseStaticFiles(new StaticFileOptions
          {
@@ -68,7 +68,7 @@ index 939bfb58..1adb9373 100644
              ContentTypeProvider = new FileExtensionContentTypeProvider(),
              HttpsCompression = HttpsCompressionMode.Compress,
              OnPrepareResponse = ctx =>
-@@ -394,7 +396,7 @@ public class Startup
+@@ -410,7 +409,7 @@ public class Startup
          try
          {
              var htmlDoc = new HtmlDocument();
diff --git a/pkgs/servers/web-apps/kavita/default.nix b/pkgs/servers/web-apps/kavita/default.nix
index cf9e80c89d3ee..2213b2560ede0 100644
--- a/pkgs/servers/web-apps/kavita/default.nix
+++ b/pkgs/servers/web-apps/kavita/default.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kavita";
-  version = "0.7.13";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "kareadita";
     repo = "kavita";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-S4lJTLxNjGmgBJt89i3whBglMU2EQ0VelLG6iP6bY8g=";
+    hash = "sha256-0pVQ/gezi8Hzxrn/1QVFTOXeHRCayYkA3Kh5b81oW34=";
   };
 
   backend = buildDotnetModule {
@@ -51,7 +51,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     npmBuildScript = "prod";
     npmFlags = [ "--legacy-peer-deps" ];
     npmRebuildFlags = [ "--ignore-scripts" ]; # Prevent playwright from trying to install browsers
-    npmDepsHash = "sha256-jseoczC2Ay3D1wDUZbWXTYQJGSWdgobJ3+Z1bp+PQG4=";
+    npmDepsHash = "sha256-yy4vEI+aDgAcCyXyzfPm31oGiTl+Gsycyh69D3yex2I=";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/web-apps/kavita/nuget-deps.nix b/pkgs/servers/web-apps/kavita/nuget-deps.nix
index b8c8edf8bee31..9a85ef26b24f2 100644
--- a/pkgs/servers/web-apps/kavita/nuget-deps.nix
+++ b/pkgs/servers/web-apps/kavita/nuget-deps.nix
@@ -4,37 +4,39 @@
 { fetchNuGet }: [
   (fetchNuGet { pname = "AutoMapper"; version = "12.0.1"; sha256 = "0s0wjl4ck3sal8a50x786wxs9mbca7bxaqk3558yx5wpld4h4z3b"; })
   (fetchNuGet { pname = "AutoMapper.Extensions.Microsoft.DependencyInjection"; version = "12.0.1"; sha256 = "0gjsjgfmfa3xx773idh7nxly4mz9ragiy0dqsc9xfzy7b5mlzw91"; })
+  (fetchNuGet { pname = "BouncyCastle.Cryptography"; version = "2.3.0"; sha256 = "1zdik0ifv2ir958ks7hgm9p11axwlkvbhw7vr98z24a009x4x02c"; })
+  (fetchNuGet { pname = "Cronos"; version = "0.8.4"; sha256 = "0gy75x1jb3ks2i9czb0sl5zdgf7mg14fn8174klb7jfhm5rcpnig"; })
+  (fetchNuGet { pname = "CsvHelper"; version = "31.0.3"; sha256 = "0ldq5715gj1j2w5qr2x28i6kfqfqk1zllhwcy2w1km2d8pvsdf1f"; })
   (fetchNuGet { pname = "Docnet.Core"; version = "2.6.0"; sha256 = "1b1nj984ly4zgj28fri1a6ych9sdiacxkms8pvzsclvyxkf0ri8m"; })
   (fetchNuGet { pname = "DotNet.Glob"; version = "3.1.3"; sha256 = "1klgj9m7i3g8x1yj96wnikvf0hlvr6rhqhl4mgis08imcrl95qg6"; })
   (fetchNuGet { pname = "EasyCaching.Core"; version = "1.9.2"; sha256 = "0qkzaxmn899hhfh32s8mhg3zcqqy2p05kaaldz246nram5gvf7qp"; })
   (fetchNuGet { pname = "EasyCaching.InMemory"; version = "1.9.2"; sha256 = "0ifcnmd3hqy44jvfwy3zzjccsxqalfv6clmj0clp9yln3js51awq"; })
-  (fetchNuGet { pname = "ExCSS"; version = "4.2.4"; sha256 = "04x3kaiywnjih8vrg5qafwvzgcsvshay8v3i2lv2ddkl6lnawh5n"; })
+  (fetchNuGet { pname = "ExCSS"; version = "4.2.5"; sha256 = "0p4456qkkxx9448y16xisj43a7syrq79wii2jnyqp2jm64wz5yb0"; })
   (fetchNuGet { pname = "Flurl"; version = "3.0.6"; sha256 = "1y82lbag0gkfpj361psk5761hn7k0zmrp9cpdvnjyp75bdimiaiy"; })
   (fetchNuGet { pname = "Flurl"; version = "3.0.7"; sha256 = "1i56774jsy2qlk573vzvcpjh5hf22yrhxs694j1c4gwggarnqz16"; })
   (fetchNuGet { pname = "Flurl.Http"; version = "3.2.4"; sha256 = "0vp5a1rrfi28in775d7fac96rcrikzjd2gbz0k3p925y1f2wlw5k"; })
-  (fetchNuGet { pname = "Hangfire"; version = "1.8.7"; sha256 = "11ygahx9bjd1y33cmihk5h7aggwcm7hvnzkg11cq066mrcrlzqr9"; })
-  (fetchNuGet { pname = "Hangfire.AspNetCore"; version = "1.8.7"; sha256 = "0lwvvk3d0rbghdk3k7r1z9a7hi6yagxynmzlp5bmb8raw5qx7q13"; })
-  (fetchNuGet { pname = "Hangfire.Core"; version = "1.6.1"; sha256 = "0rg4lzzckscck9gvjqhcn1yq9qymfs4dfkv6fwgnklyfpvxmsqbq"; })
+  (fetchNuGet { pname = "Hangfire"; version = "1.8.12"; sha256 = "0hbd21smpsb4vzi1y21zx4b51nd5z8isni0s0s2s78msgfh81a9b"; })
+  (fetchNuGet { pname = "Hangfire.AspNetCore"; version = "1.8.12"; sha256 = "1jaiz0nfmfjp9vr3x62qjgkwb2rk0jlzgl74ja089yaq6n3jwrqc"; })
   (fetchNuGet { pname = "Hangfire.Core"; version = "1.6.17"; sha256 = "0kr2hjnl9c4dpk4kf95jxcgsxalvixfm6xis37qn5ja9n9ygqans"; })
   (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.0"; sha256 = "047g50s2nz32dnpqm9lnsvpgz8g3azip2mpc6s15wb78b8c9s48n"; })
-  (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.7"; sha256 = "0f5l55sbw0shp0l9zv2h98l8ghvvhgdgqqwcq3rdlpapcv0w3z5j"; })
-  (fetchNuGet { pname = "Hangfire.InMemory"; version = "0.7.0"; sha256 = "0c6icc14kw5lybk2fqprks37vs3sv4j1acn8z12p3b62cxc2a3bb"; })
+  (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.12"; sha256 = "19bbk3cqd1vw2x94gilvgwfjgl9yr5nvy8y4hjngx93jg563i17y"; })
+  (fetchNuGet { pname = "Hangfire.InMemory"; version = "0.8.1"; sha256 = "1i1j4mysk636dmf0p41w5bvi1i2nmr39svwj8svyqhij4yhih019"; })
   (fetchNuGet { pname = "Hangfire.MaximumConcurrentExecutions"; version = "1.1.0"; sha256 = "181147h5dsbml58ffq1jc7k6012fahi0n20wply9gmn6v1dh8h66"; })
-  (fetchNuGet { pname = "Hangfire.MemoryStorage.Core"; version = "1.4.0"; sha256 = "1hw8dlclxgg21ay1pqj9mxxm3alm03k9wxaz055lb14w3nzyma3c"; })
-  (fetchNuGet { pname = "Hangfire.NetCore"; version = "1.8.7"; sha256 = "09p53pm7z3v549w7bb85qf66wg62nx0gxy6rgkgk2lbyabacyi1a"; })
-  (fetchNuGet { pname = "Hangfire.SqlServer"; version = "1.8.7"; sha256 = "0kzddl3r5rxx1m95skj7hkimzkz9x57b51bhkq1yhvchjd9j5wzj"; })
-  (fetchNuGet { pname = "Hangfire.Storage.SQLite"; version = "0.4.0"; sha256 = "0kyyisvvx8m40wmfay1kcrzqwr3hhdlkppadkwsgk0r892d5drqw"; })
-  (fetchNuGet { pname = "HtmlAgilityPack"; version = "1.11.57"; sha256 = "0brswm659d2vb11021z7xylljlnaf344yf5q093bqxyhbxva8ijq"; })
+  (fetchNuGet { pname = "Hangfire.NetCore"; version = "1.8.12"; sha256 = "19987w1nng7mr5r66y5523q67ig2xb98im4b1ahqsc5s9mwkm0qh"; })
+  (fetchNuGet { pname = "Hangfire.SqlServer"; version = "1.8.12"; sha256 = "0h68hz7bzbypff1sg5hq1b0pfg7ckz506rfsiphqninrpczc9zsa"; })
+  (fetchNuGet { pname = "Hangfire.Storage.SQLite"; version = "0.4.1"; sha256 = "029prxla8mpck49rxk2rygns958xpss5lg1lizws2nm8q547kwil"; })
+  (fetchNuGet { pname = "HtmlAgilityPack"; version = "1.11.60"; sha256 = "0jpv1vry0mfwbswxn70knbkzsrwwz2ijsm5d4rj9jf2kk37m0xga"; })
   (fetchNuGet { pname = "Humanizer.Core"; version = "2.14.1"; sha256 = "1ai7hgr0qwd7xlqfd92immddyi41j3ag91h3594yzfsgsy6yhyqi"; })
+  (fetchNuGet { pname = "MailKit"; version = "4.4.0"; sha256 = "0v0hzvzxw960j7j5y4sns4v9zawhcbs558drrihmhp1a8al0cjk4"; })
   (fetchNuGet { pname = "MarkdownDeep.NET.Core"; version = "1.5.0.4"; sha256 = "0cpshs1lwmyyg40lvnf4b9s1z7yaw6s4a0341qr4ww40791gzvrl"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.Abstractions"; version = "2.2.0"; sha256 = "0vj7fhpk0d95nkkxz4q0rma6pb4ym96mx6nms4603y0l19h0k5yh"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.JwtBearer"; version = "8.0.1"; sha256 = "0519873g49gdbhnqizgxlikifcgswr09ybrh0wcwhbwiqnx49dg9"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.OpenIdConnect"; version = "8.0.1"; sha256 = "0n9x563ihvkp7cncwzlnyzm6zwxm6nsm8hv0j6f66jv7vzmcsq0q"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.JwtBearer"; version = "8.0.4"; sha256 = "1q2ai2jqc4zc2bdrbjng9fb7n0pch4f8bap3drd1v2vrha0d2r3q"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.OpenIdConnect"; version = "8.0.4"; sha256 = "1gscq70xqnv2sv5ka8m754mzq875qp3r45bfl36jfa6ag0ivjxsb"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authorization"; version = "2.2.0"; sha256 = "1mpq8pmxlxfa625k2ghv6xcyy2wdpwv56xzya9mvmlnh50h1i8rx"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authorization.Policy"; version = "2.2.0"; sha256 = "1d1zh65kfjf81j21ssmhr465vx08bra8424vgnrb22gdx03mhwd2"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Connections.Abstractions"; version = "2.2.0"; sha256 = "1rl94r8b0zq14f3dhfnvfjj1ivr81iw9zh5kdgs3zkdv0xc9x21j"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.Internal"; version = "8.0.1"; sha256 = "1gc2y4v1cvayy2fai02gsv1z6fr58kxb5jnmbjqxnd0zf49m88j7"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.KeyDerivation"; version = "8.0.1"; sha256 = "0fnvim0rmiw9jm8xvajb5b9w4wawp95szy2dfh2aw1n8jgzs207x"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.Internal"; version = "8.0.4"; sha256 = "0nb87rimc7brciav6ngfcx3g2k0g903fmax3w408m5dm8fan2ysp"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.KeyDerivation"; version = "8.0.4"; sha256 = "1l9lvyw81f6ckby1q3wy1677jdcp46i25m58qpkma7wd1gmg36pg"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Hosting.Abstractions"; version = "2.2.0"; sha256 = "043k651vbfshh3s997x42ymj8nb32419m7q3sjw5q2c27anrhfhv"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Hosting.Server.Abstractions"; version = "2.2.0"; sha256 = "0nz73bwrvhc1n7gd7xxm3p5ww2wx9qr9m9i43y20gh0c54adkygh"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http"; version = "2.2.0"; sha256 = "1fcrafpa57sab3as18idqknzlxkx49n4sxzlzik3sj6pcji5j17q"; })
@@ -43,7 +45,7 @@
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Connections.Common"; version = "1.1.0"; sha256 = "0x3hq0d3bs6n46nfvbd5n4cgi6m4yjfsf3k25xjcc8gcj66072iy"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Extensions"; version = "2.2.0"; sha256 = "118gp1mfb8ymcvw87fzgjqwlc1d1b0l0sbfki291ydg414cz3dfn"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Features"; version = "2.2.0"; sha256 = "0xrlq8i61vzhzzy25n80m7wh2kn593rfaii3aqnxdsxsg6sfgnx1"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Identity.EntityFrameworkCore"; version = "8.0.1"; sha256 = "08pnswpz17pfr923p9iv6imgzb8yfhsi4g31lxrhzglagahv4hiy"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Identity.EntityFrameworkCore"; version = "8.0.4"; sha256 = "17hmg59zk537vvp7vl59xrzjwbnlp6lb42sil7xszw7assb51795"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Routing"; version = "2.2.0"; sha256 = "12kv602j2rxp43l1v3618yz3pdd7hqc3r98ya0bqz6y2ppvhbyws"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Routing.Abstractions"; version = "2.2.0"; sha256 = "0d9wwz1rsh1fslbv1y72jpkvqv2v9n28rl3vslcg0x74lp2678ly"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR"; version = "1.1.0"; sha256 = "16p01hxcrpj7iiwcqmwjfmciyisxp1mr0qa1wcx1ja4i0m0g292l"; })
@@ -60,14 +62,14 @@
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Workspaces.Common"; version = "4.5.0"; sha256 = "1wjwsrnn5frahqciwaxsgalv80fs6xhqy6kcqy7hcsh7jrfc1kjq"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
-  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.1"; sha256 = "1ippysjxq97vz4kd0jxiqbcamgd9xxb6n23ias5d4c7gbiwayz0z"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.1"; sha256 = "1k1c63vkzr020q0pb6xxf29xlgxldnzhlqpmpq9fig85y73s84ds"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.1"; sha256 = "1p8c2xfz8kgzswh9kq38mmy8qxfynnkywj9vwx15azbi8wcmh24x"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.1"; sha256 = "0l0fi9kiinj021sfk85qds1rdzavpkl24sjyzfyb8q8jmj5l2i0n"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.1"; sha256 = "1y21lmbnq271q7q1vsq1z5gnz4fy89zca8qzm6bg2qfv8bgqqrny"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.1"; sha256 = "12zmg196mpd0wacwyrckv6l5rl76dzmvr588i437xiwp0iyjcsh9"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.1"; sha256 = "1igwxjmzgzkzyhmg5jbis6hynnzf5vfzl00h053si89h5m6vvhmb"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.1"; sha256 = "0zg7whf02jlpcs72ngiydwd2xwwlvz3nja0xnyxv4k4w56qs8qcj"; })
+  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.4"; sha256 = "03i9b45n2vnsv4wdsk6qvjzj1ga2hcli168liyrqfa87l54skckd"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.4"; sha256 = "14a74ssvklpv9v1x023mfv3a5dncwfpw399larfp9qx7l6ifsjly"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.4"; sha256 = "1xs1cs29csnbahxgikc094xr878i8wp4h4n84xffaxms6wx5c1fb"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.4"; sha256 = "1h2bdh7cyw2z71brwjfirayd56rp3d2dx4qrhmsw573mb5jgvara"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.4"; sha256 = "1ni5qkjgarcjbqvw9cx0481fc99nna7rnp7170wq650jwm0f8c2f"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.4"; sha256 = "17v2wm6wwsl169sq6lawxhn9wvd299n1hdrxih8c3lzvi8igy4sd"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.4"; sha256 = "0h9ib00k54jmsrbhipr33q3sqd3mdiw31qi4g8vak1slal9b70zw"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.4"; sha256 = "0pa0xz96g2f99yj3x3hfj362br3zjcx3qd89ckqmymqpvnhk4bw0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.ApiDescription.Server"; version = "6.0.5"; sha256 = "1pi2bm3cm0a7jzqzmfc2r7bpcdkmk3hhjfvb2c81j7wl7xdw3624"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "8.0.0"; sha256 = "04m6ywsf9731z24nfd14z0ah8xl06619ba7mkdb4vg8h5jpllsn4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Memory"; version = "8.0.0"; sha256 = "0bv8ihd5i2gwr97qljwf56h8mdwspmlw0zs64qyk608fb3ciwi25"; })
@@ -103,8 +105,8 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "2.2.0"; sha256 = "1xc7xr1nq7akfahyl5in9iyxrygap2xi9nxh39rfm37sf8lk55v1"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "3.0.0"; sha256 = "13ijaki0nzlvbwxjxb1hjhzj86jgn23nw34gdwp2l7bf3x2h4hw9"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "8.0.0"; sha256 = "00d5dwmzw76iy8z40ly01hy9gly49a7rpf7k7m99vrid1kxp346h"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "8.0.1"; sha256 = "0gf68x3zxbn3gxzdjmbfcqhm58ybxvpanl4pq8vs5g492qw7h24b"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Stores"; version = "8.0.1"; sha256 = "19c0by2r85jqz6pj8mnr047aasasr7fbzi3ih04gchj8la69ka5h"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "8.0.4"; sha256 = "1k9x667wi3izxjjiprqkdgajfn1slb0w8lyjdp2x441hp4wyzf6c"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Stores"; version = "8.0.4"; sha256 = "0dajblmwx1z7jk08ycsfabv30b28mvazgv3wq6m7pnlrpijkvcp4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "2.0.0"; sha256 = "1jkwjcq1ld9znz1haazk8ili2g4pzfdp6i7r7rki4hg3jcadn386"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "6.0.0"; sha256 = "0fd9jii3y3irfcwlsiww1y9npjgabzarh33rn566wpcz24lijszi"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "8.0.0"; sha256 = "0nppj34nmq25gnrg0wh1q22y4wdqbih4ax493f226azv8mkp9s1i"; })
@@ -123,7 +125,7 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "2.2.0"; sha256 = "1b20yh03fg4nmmi3vlf6gf13vrdkmklshfzl3ijygcs4c2hly6v0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "6.0.0"; sha256 = "008pnk2p50i594ahz308v81a41mbjz9mwcarqhmrjpl2d20c868g"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; sha256 = "0p50qn6zhinzyhq9sy5svnmqqwhw2jajs2pbjh9sah504wjvhscz"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.1"; sha256 = "01jsya858i861x6d7qbl3wlr0gp2y7x2m4q6f1r743w360z8zgpn"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.2"; sha256 = "0as39ml1idgp42yvh725ddqp4illq87adzd1ymzx6xjxsxsjadq2"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "6.0.0"; sha256 = "1k6q91vrhq1r74l4skibn7wzxzww9l74ibxb2i8gg4q6fzbiivba"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "8.0.0"; sha256 = "04nm8v5a3zp0ill7hjnwnja3s2676b4wffdri8hdk2341p7mp403"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "2.0.0"; sha256 = "1xppr5jbny04slyjgngxjdm0maxdh47vq481ps944d7jrfs0p3mb"; })
@@ -132,14 +134,14 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; sha256 = "1kjiw6s4yfz9gm7mx3wkhp06ghnbs95icj9hi505shz9rjrg42q2"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; sha256 = "0aldaz5aapngchgdr7dax9jw5wy7k7hmjgjpfgfv1wfif27jlkqm"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.1.2"; sha256 = "01jdg8b1hi4nx5h1cn9baalfkp4y70kc2wf4lz77kw8w1fvrppa0"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.2.0"; sha256 = "06r0hv7n4v1s751k2032frfh9hkfkxpi42rdz10llcay7lcqjjh6"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.2.0"; sha256 = "17xbqb351xfnniwj2322xyaiajbdilihdp9j9knbr80d8rm62sv2"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.5.1"; sha256 = "0kdxb47rafvk6mx0xkf2pik7b638b2d847jlhzi3fvj6swg3v15b"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.5.1"; sha256 = "1ny97mhld7vzn5xwxvcy1jhfq4mw15wrk9c77z6cg2fydkgawyzx"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.1.2"; sha256 = "1yi7s2pm4f8vl6b0qck0nrfsrf1h4jwamznkzl75n1cwxpbdikp8"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.2.0"; sha256 = "01zfbgg1vcqq36cg5sdrq0fy78fywm7m2v4a79011k5ng9g0ck7z"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.5.1"; sha256 = "1zharnx3vhrfdn761w16ygxyj9ig5zn71346aqkk0nmzlll3gfjf"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols"; version = "7.1.2"; sha256 = "0ql5b7472g7359b1pqh2lfm8s3lym9vyzj1xpvbhsv9syk9czrg8"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols.OpenIdConnect"; version = "7.1.2"; sha256 = "06r9i1m6zhfbbx18p0drpcbswirlq7xg0wm3iqfjgzxyv053033h"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.1.2"; sha256 = "1q70c1ax9f5nggqp4g8nyfaz0481grsaxhp85cmjpmx8l3q35zx9"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.2.0"; sha256 = "17xi2sb041dkigkkvnbg0lb5r1i9gjxv2irncqycg60hl1fcp27l"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.5.1"; sha256 = "14fjr679hwal35mdwdv4w40mnxzfnnx65yc16807zzkyri011zc1"; })
   (fetchNuGet { pname = "Microsoft.IO.RecyclableMemoryStream"; version = "3.0.0"; sha256 = "1zl39k27r4zq75r1x1zr1yl4nzxpkxdnnv6dwd4qp0xr22my85aq"; })
   (fetchNuGet { pname = "Microsoft.Net.Http.Headers"; version = "2.2.0"; sha256 = "0w6lrk9z67bcirq2cj2ldfhnizc6id77ba6i30hjzgqjlyhh1gx5"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Jit"; version = "1.0.2"; sha256 = "0jaan2wmg80lr0mhgfy70kb5cqjwv1a2ikmxgd0glpcxp7wr7pag"; })
@@ -154,26 +156,25 @@
   (fetchNuGet { pname = "Microsoft.NETCore.Windows.ApiSets"; version = "1.0.1"; sha256 = "16k8chghkr25jf49banhzl839vs8n3vbfpg4wn4idi0hzjipix78"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.2.3"; sha256 = "07b19k89whj69j87afkz86gp9b3iybw8jqwvlgcn43m7fb2y99rr"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.3.1"; sha256 = "0icds4jxz90v156vkbza1s1rqdf737glfddbllkp6y2zcnin99yv"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
   (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
   (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "8.0.0"; sha256 = "05392f41ijgn17y8pbjcx535l1k09krnq3xdp60kyq568sn6xk2i"; })
+  (fetchNuGet { pname = "MimeKit"; version = "4.4.0"; sha256 = "107225n55ib9y0y7azarjq3xcf8shsn329fbh5rmpcj5rhcv47kx"; })
   (fetchNuGet { pname = "MimeTypeMapOfficial"; version = "1.0.17"; sha256 = "1l5d42pgfz4cpvgdyxf2crzyv7jycky5mhmrrl5501p3806i3r0y"; })
   (fetchNuGet { pname = "Mono.TextTemplating"; version = "2.2.1"; sha256 = "1ih6399x4bxzchw7pq5195imir9viy2r1w702vy87vrarxyjqdp1"; })
   (fetchNuGet { pname = "Nager.ArticleNumber"; version = "1.0.7"; sha256 = "1lfhr20527xhzql5nsn5c1s5as79haz9xcqan8pqsfk200hc27af"; })
-  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.0"; sha256 = "0nmmv4yw7gw04ik8ialj3ak0j6pxa9spih67hnn1h2c38ba8h58k"; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
-  (fetchNuGet { pname = "NetVips"; version = "2.4.0"; sha256 = "0q4ghm4d19hl6ilxvvmlgdffp3gjnkrirc5665lc85rvziw6xcx9"; })
-  (fetchNuGet { pname = "NetVips.Native"; version = "8.15.1"; sha256 = "1ah8frrady684nxf3w4iq6gjcmsrmhndhy6mcyrlsw2i4l4wf1lw"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-arm"; version = "8.15.1"; sha256 = "0c4q5wwb7zmz8skzyyg6iag7qlxbc9pklzvi3qlml6c3qwv4b0mi"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-arm64"; version = "8.15.1"; sha256 = "1dwjd780l1b1831x1ksiha0ds6414inwjxcl6mb5k3imzfzfck3a"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-musl-arm64"; version = "8.15.1"; sha256 = "1md5dk905s28n8q2j6c5wp7zglzmcaqy4dim1qgillkk1651pqnl"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-musl-x64"; version = "8.15.1"; sha256 = "1xwlwfidhwdnnw9c9dxag3y90h3l4n408jgq9v25ad8m441134zj"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-x64"; version = "8.15.1"; sha256 = "1905sd6zf8qbsfdbh16i6c5f9dznqdgzhz1fywvjfspsbdj3hilp"; })
-  (fetchNuGet { pname = "NetVips.Native.osx-arm64"; version = "8.15.1"; sha256 = "03gj78ibggm32nr6qpiykq0h463y81rzsawfdp091ikbxmnm98c7"; })
-  (fetchNuGet { pname = "NetVips.Native.osx-x64"; version = "8.15.1"; sha256 = "0r0mqfk9i59nvj15wgzh2rymv6fl0liw5bdcgmk80bfsfjqsrv4d"; })
-  (fetchNuGet { pname = "NetVips.Native.win-arm64"; version = "8.15.1"; sha256 = "1l8qwdw03vbc4dkmvw2iyw7b8w0cm20mydgv6diby48q46g5xgcy"; })
-  (fetchNuGet { pname = "NetVips.Native.win-x64"; version = "8.15.1"; sha256 = "1vriqri1ppk8glmsyxb7cfcsi42kz6skpx5ggqkrxsfp9yz22x46"; })
-  (fetchNuGet { pname = "NetVips.Native.win-x86"; version = "8.15.1"; sha256 = "0p8166fsqmyzy5xvfy2raxp9h38m702mbqf9ab88vxig3i4rsxk8"; })
+  (fetchNuGet { pname = "NetVips"; version = "2.4.1"; sha256 = "1jf0carq4aqw12shl91dbxmc65djhqlm5rlca1dag3aj5h05jzaj"; })
+  (fetchNuGet { pname = "NetVips.Native"; version = "8.15.2"; sha256 = "0jngfr5p37x5mjrrq7rq62nzq2fi9fsvls25i48ra62fscj1skva"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-arm"; version = "8.15.2"; sha256 = "1pcc2vkgjbcx1a88bnwn2vv71k7vv1q3hzcnpwbyaq8drh2q9zsy"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-arm64"; version = "8.15.2"; sha256 = "11wd1fxmipcd897rab9rdvb06ax71qg2zd4vsbdf0bqjq7ja741x"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-musl-arm64"; version = "8.15.2"; sha256 = "16fc3bf5n13yhd03wfdi3g8d9n2qgmbwiwil1vh3vxwb3qrdii03"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-musl-x64"; version = "8.15.2"; sha256 = "0iznsfxg0f3xw36j9rxa37zr7vryvxaj3a303mrsvj47qgxjd1fs"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-x64"; version = "8.15.2"; sha256 = "09zcfx71107wifj2qhvqbjcjsjs7v790mpplq7aczfvj8kccnfdx"; })
+  (fetchNuGet { pname = "NetVips.Native.osx-arm64"; version = "8.15.2"; sha256 = "04ak05razgqcizpbxwfcmb2cgzbq7yw2jgb74p354nkmrs7knwbr"; })
+  (fetchNuGet { pname = "NetVips.Native.osx-x64"; version = "8.15.2"; sha256 = "1028p1iyvp7rhmssr6hk1f5n2z2y7cvslf11kzb826gxd2yvn52m"; })
+  (fetchNuGet { pname = "NetVips.Native.win-arm64"; version = "8.15.2"; sha256 = "0yggh8mqvqidrlhc3756rxsaarhmvvp4yhwj0ffgyzzclcbff4nf"; })
+  (fetchNuGet { pname = "NetVips.Native.win-x64"; version = "8.15.2"; sha256 = "0y8x5w70c7y7xmc8g1b200d2yhkg8nx41k337c2416zfbm268wzg"; })
+  (fetchNuGet { pname = "NetVips.Native.win-x86"; version = "8.15.2"; sha256 = "08p2wbdv1j50s1yllycc1c5cglaimssmn3p1v1qybxmaasj2ff3x"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.1"; sha256 = "1z68j07if1xf71lbsrgbia52r812i2dv541sy44ph4dzjjp7pd4m"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.2"; sha256 = "1784xi44f4k8v1fr696hsccmwpy94bz7kixxqlri98zhcxn406b2"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "12.0.2"; sha256 = "0w2fbji1smd2y7x25qqibf1qrznmv4s6s0jvrbvr6alb7mfyqvh5"; })
@@ -199,13 +200,9 @@
   (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
   (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
   (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; sha256 = "1ppk69xk59ggacj9n7g6fyxvzmk1g5p4fkijm0d7xqfkig98qrkf"; })
   (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
-  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.1.0"; sha256 = "0d720z4lzyfcabmmnvh0bnj76ll7djhji2hmfh3h44sdkjnlkknk"; })
   (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; sha256 = "1vvivbqsk6y4hzcid27pqpm5bsi6sc50hvqwbcx8aap5ifrxfs8d"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.0.1"; sha256 = "1hgv2bmbaskx77v8glh7waxws973jn4ah35zysnkxmf0196sfxg6"; })
   (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography"; version = "4.0.0"; sha256 = "0k57aa2c3b10wl3hfqbgrl7xq7g8hh3a3ir44b31dn5p61iiw3z9"; })
   (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
   (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
   (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
@@ -226,7 +223,7 @@
   (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
   (fetchNuGet { pname = "Scrutor"; version = "3.3.0"; sha256 = "0qdfbp73hbsiqbv0rg6f91hnp1j535iqk8bmp3ickwd7w337m1vi"; })
   (fetchNuGet { pname = "Serilog"; version = "3.1.1"; sha256 = "0ck51ndmaqflsri7yyw5792z42wsp91038rx2i6vg7z4r35vfvig"; })
-  (fetchNuGet { pname = "Serilog.AspNetCore"; version = "8.0.0"; sha256 = "0g1scn1a5paiydxk1nnrwzzqny2vabc3hniy6jwjqycag6ch2pni"; })
+  (fetchNuGet { pname = "Serilog.AspNetCore"; version = "8.0.1"; sha256 = "0vmrbhj9vb00fhvxrw3w5j1gvdx4xzxz8d2cp65hps988zxwykkb"; })
   (fetchNuGet { pname = "Serilog.Enrichers.Thread"; version = "3.2.0-dev-00752"; sha256 = "0d0phxzdpc8xkbyd18s1dcv9xa22gqs2i2x5cpa9qzj0g8zwp641"; })
   (fetchNuGet { pname = "Serilog.Extensions.Hosting"; version = "8.0.0"; sha256 = "10cgp4nsrzkld5yxnvkfkwd0wkc1m8m7p5z42w4sqd8f188n8i9q"; })
   (fetchNuGet { pname = "Serilog.Extensions.Logging"; version = "3.0.1"; sha256 = "069qy7dm5nxb372ij112ppa6m99b4iaimj3sji74m659fwrcrl9a"; })
@@ -239,8 +236,8 @@
   (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
   (fetchNuGet { pname = "Serilog.Sinks.SignalR.Core"; version = "0.1.2"; sha256 = "16f86661vr7gw8xay1735y551p0z39mks7xagwxb8lxqxwmm4gzf"; })
   (fetchNuGet { pname = "SharpCompress"; version = "0.36.0"; sha256 = "164ikphk4glldr73l247cjb65v064md0ccccm06rh0zvjq5iqlph"; })
-  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.1.2"; sha256 = "0bc0753aczgw9mi9bcgly2x71w4adlr35krgf023vppc36809yhg"; })
-  (fetchNuGet { pname = "SonarAnalyzer.CSharp"; version = "9.17.0.82934"; sha256 = "1hk1fh8zp0ng6q29i2y17jdvbxxl3zgbzzag0dvap4wadqdpad1z"; })
+  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.1.3"; sha256 = "0f36my2lzkgc5fvk6s0lh4gn15vxhbl2zg71rdql7vrzh8b77c6q"; })
+  (fetchNuGet { pname = "SonarAnalyzer.CSharp"; version = "9.23.1.88495"; sha256 = "1mj18mc8k9nq074jksnh71r5cnlr45730n3ww5gi6c17xnar0m6p"; })
   (fetchNuGet { pname = "sqlite-net-pcl"; version = "1.8.116"; sha256 = "0h3s43pfjqgy9amrdj4d7p65hmys895hlkczj62wg974qb4z8l2y"; })
   (fetchNuGet { pname = "SQLitePCLRaw.bundle_e_sqlite3"; version = "2.1.6"; sha256 = "0pzgdfl707pd9fz108xaff22w7c2y27yaix6wfp36phqkdnzz43m"; })
   (fetchNuGet { pname = "SQLitePCLRaw.bundle_green"; version = "2.0.4"; sha256 = "1197ynpm4fl6il9vi0mi1s1pmw3rk3j0a05kwrxpqlfgp7iwhc22"; })
@@ -251,23 +248,20 @@
   (fetchNuGet { pname = "SQLitePCLRaw.provider.dynamic_cdecl"; version = "2.0.4"; sha256 = "084r98kilpm0q1aw41idq8slncpd7cz65g0m1wr0p8d12x8z5g6j"; })
   (fetchNuGet { pname = "SQLitePCLRaw.provider.e_sqlite3"; version = "2.1.6"; sha256 = "1vs1c7yhi0mdqrd35ji289cxkhg7dxdnn6wgjjbngvqxkdhkyxyc"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore"; version = "6.5.0"; sha256 = "0k61chpz5j59s1yax28vx0mppx20ff8vg8grwja112hfrzj1f45n"; })
-  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters"; version = "8.0.0"; sha256 = "13jiyn00cxslrgagkw69h6nxjxrrbyg3pwy8gj5iagk5x5gi6b6f"; })
-  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters.Abstractions"; version = "8.0.0"; sha256 = "1sz2r45z2prglw3svrqy7xzl0z958yip71x6s97xrxsj776sqcf9"; })
+  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters"; version = "8.0.1"; sha256 = "1qs9awkh9jijmrdb0w0j669sn1i5wrl3bk5phpq1kscfa6ywkp5g"; })
+  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters.Abstractions"; version = "8.0.1"; sha256 = "1739p184hihfl6p42bcn66d2wflilhrbsyq0ddbbqxgxi3kdcxn6"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.Swagger"; version = "5.0.0"; sha256 = "1341nv8nmh6avs3y7w2szzir5qd0bndxwrkdmvvj3hcxj1126w2f"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.Swagger"; version = "6.5.0"; sha256 = "1s6axf6fin8sss3bvzp0s039rxrx71vx4rl559miw12bz3lld8kc"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerGen"; version = "5.0.0"; sha256 = "00swg2avqnb38q2bsxljd34n8rpknp74h9vbn0fdnfds3a32cqr4"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerGen"; version = "6.5.0"; sha256 = "0hq93gy5vyrigpdk9lhqwxglxwkbxa8ydllwcqs4bwfcsspzrs83"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerUI"; version = "6.5.0"; sha256 = "17hx7kc187higm0gk67dndng3n7932sn3fwyj48l45cvyr3025h7"; })
-  (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
   (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.0.0"; sha256 = "13s659bcmg9nwb6z78971z1lr6bmh2wghxi1ayqyzl4jijd351gr"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.5.0"; sha256 = "1ywfqn4md6g3iilpxjn5dsr0f5lx6z0yvhqp4pgjcamygg73cz2c"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; sha256 = "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"; })
   (fetchNuGet { pname = "System.CodeDom"; version = "4.4.0"; sha256 = "1zgbafm5p380r50ap5iddp11kzhr9khrf2pnai6k593wjar74p1g"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; sha256 = "07y08kvrzpak873pmyxs129g1ch8l27zmg51pcyj2jvq03n0r0fc"; })
   (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "6.0.0"; sha256 = "1js98kmjn47ivcvkjqdmyipzknb9xbndssczm8gq224pbaj1p88c"; })
   (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "4.5.0"; sha256 = "1jj6f6g87k0iwsgmg3xmnn67a14mq88np0l1ys5zkxhkvbc8976p"; })
@@ -277,34 +271,28 @@
   (fetchNuGet { pname = "System.Composition.Hosting"; version = "6.0.0"; sha256 = "0big5nk8c44rxp6cfykhk7rxvn2cgwa99w6c3v2a36adc3lj36ky"; })
   (fetchNuGet { pname = "System.Composition.Runtime"; version = "6.0.0"; sha256 = "0vq5ik63yii1784gsa2f2kx9w6xllmm8b8rk0arid1jqdj1nyrlw"; })
   (fetchNuGet { pname = "System.Composition.TypedParts"; version = "6.0.0"; sha256 = "0y9pq3y60nyrpfy51f576a0qjjdh61mcv8vnik32pm4bz56h9q72"; })
-  (fetchNuGet { pname = "System.Console"; version = "4.0.0"; sha256 = "0ynxqbc3z1nwbrc11hkkpw9skw116z4y9wjzn7id49p9yi7mzmlf"; })
   (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.0.0"; sha256 = "1n6c3fbz7v8d3pn77h4v5wvsfrfg7v1c57lg3nff3cjyh597v23m"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "6.0.0"; sha256 = "0rrihs9lnb1h6x4h0hn6kgfnh58qq7hx8qq99gh6fayx4dcnx3s5"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "8.0.0"; sha256 = "0nzra1i0mljvmnj1qqqg37xs7bl71fnpl68nwmdajchh65l878zr"; })
   (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "8.0.0"; sha256 = "1xnvcidh2qf6k7w8ij1rvj0viqkq84cq47biw0c98xhxg5rk3pxf"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "8.0.1"; sha256 = "02l7y2j6f2qykl90iac28nvw1cnhic8vzixlq5fznw0zj72knz25"; })
+  (fetchNuGet { pname = "System.Drawing.Common"; version = "8.0.4"; sha256 = "17i50sbv5v9c138gjammn9nf1p0qa0lpmvmw26ffdhmlshjla6fi"; })
   (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; sha256 = "1pla2dx8gkidf7xkciig6nifdsb494axjvzvann8g2lp3dbqasm9"; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "8.0.0"; sha256 = "04h75wflmzl0qh125p0209wx006rkyxic1y404m606yjvpl2alq1"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
-  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1"; sha256 = "0bv0alrm2ck2zk3rz25lfyk9h42f3ywq77mx1syl6vvyncnpg4qh"; })
   (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
-  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.0.1"; sha256 = "0hjhdb5ri8z9l93bw04s7ynwrjrhx2n0p34sf33a9hl9phz69fyc"; })
   (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.2.0"; sha256 = "000sfpv1bjwkwwb65fl85f3ifwvdadzkx93gwsb56vrsh00kd026"; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.5.1"; sha256 = "0priwzi8w2rnspppldl2mhi4fh835dpyyy8f7ri6qbqs7n8l746n"; })
   (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
   (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.Abstractions"; version = "20.0.4"; sha256 = "0qdp4522v0k219iixg4zk7vmpyx149rsnqhq3ykzkpd2mdg0f4nx"; })
-  (fetchNuGet { pname = "System.IO.Compression"; version = "4.1.0"; sha256 = "0iym7s3jkl8n0vzm3jd6xqg9zjjjqni05x45dwxyjr2dy88hlgji"; })
+  (fetchNuGet { pname = "System.IO.Abstractions"; version = "21.0.2"; sha256 = "1mp73hkrxb83bs16458qgf7l3n20ddnfkij1pd603dr8w22j7279"; })
   (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; sha256 = "084zc82yi6yllgda0zkgl2ys48sypiswbiwrv7irb3r0ai1fp4vz"; })
-  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.0.1"; sha256 = "0h72znbagmgvswzr46mihn7xm7chfk2fhrp5krzkjf29pz0i6z82"; })
   (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; sha256 = "1yxy5pq4dnsm9hlkg9ysh5f6bf3fahqqb6p8668ndy5c0lk7w2ar"; })
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
@@ -318,12 +306,9 @@
   (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.1"; sha256 = "0f07d7hny38lq9w69wx4lxkn4wszrqf9m9js6fh9is645csm167c"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"; })
-  (fetchNuGet { pname = "System.Net.Http"; version = "4.1.0"; sha256 = "1i5rqij1icg05j8rrkw4gd4pgia1978mqhjzhsjg69lvwcdfg8yb"; })
   (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; sha256 = "1i4gc757xqrzflbk7kc5ksn20kwwfjhw9w7pgdkn19y3cgnl302j"; })
   (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
-  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.0.11"; sha256 = "10xzzaynkzkakp7jai1ik3r805zrqjxiz7vcagchyxs2v26a516r"; })
   (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
-  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.1.0"; sha256 = "1385fvh8h29da5hh58jm1v78fzi9fi5vj93vhlm2kvqpfahvpqls"; })
   (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; sha256 = "1ssa65k6chcgi6mfmzrznvqaxk8jp0gvl77xhf1hbzakjnpxspla"; })
   (fetchNuGet { pname = "System.Net.WebSockets.WebSocketProtocol"; version = "4.5.1"; sha256 = "1n0ag9ws6fgyqcz39xyk5dnchskfji8bcgqw90i2ai7lyvd843p6"; })
   (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; sha256 = "1sybkfi60a4588xn34nd9a58png36i0xr4y4v4kqpg8wlvy5krrj"; })
@@ -358,25 +343,17 @@
   (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.0.0"; sha256 = "0glmvarf3jz5xh22iy3w9v3wyragcm4hfdr17v90vs7vcrm7fgp6"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; sha256 = "0q18r1sh4vn7bvqgd6dmqlw5v28flbpj349mkdish2vjyvmnb2ii"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.0.1"; sha256 = "1y308zfvy0l5nrn46mqqr4wb4z1xk758pkk8svbz8b5ij7jnv4nn"; })
   (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
   (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.1.1"; sha256 = "042rfjixknlr6r10vx2pgf56yming8lkjikamg3g4v29ikk78h7k"; })
   (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.2.0"; sha256 = "148s9g5dgm33ri7dnh19s4lgnlxbpwvrw2jnzllq2kijj4i4vs85"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.2.0"; sha256 = "118jijz446kix20blxip0f0q8mhsh9bz118mwc2ch1p6g7facpzc"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.0.0"; sha256 = "1cwv8lqj8r15q81d2pz2jwzzbaji0l28xfrpw29kdpsaypm92z2q"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.0.0"; sha256 = "0a8y1a5wkmpawc787gfmnrnbzdgxmx1a14ax43jf3rj9gxmy3vk4"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.0.0"; sha256 = "16sx3cig3d0ilvzl8xxgffmxbiqx87zdi8fc73i3i7zjih1a7f4q"; })
   (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.0.0"; sha256 = "0i7cfnwph9a10bm26m538h5xcr8b36jscp9sy1zhgifksxz4yixh"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "8.0.0"; sha256 = "04kqf1lhsq3fngiljanmrz2774x5h2fc8p57v04c51jwwqhwi9ya"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.1.0"; sha256 = "0clg1bv55mfv5dq00m19cp634zx6inm31kf8ppbq1jgyjf2185dh"; })
   (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
   (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
@@ -385,6 +362,7 @@
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; sha256 = "0gm2kiz2ndm9xyzxgi0jhazgwslcs427waxgfa30m7yqll1kcrww"; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "8.0.0"; sha256 = "1lgdd78cik4qyvp2fggaa0kzxasw6kc9a6cjqw46siagrm0qnc3y"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
   (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "4.5.0"; sha256 = "0srd5bva52n92i90wd88pzrqjsxnfgka3ilybwh7s6sf469y5s53"; })
@@ -403,14 +381,14 @@
   (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
   (fetchNuGet { pname = "System.Threading.Thread"; version = "4.0.0"; sha256 = "1gxxm5fl36pjjpnx1k688dcw8m9l7nmf802nxis6swdaw8k54jzc"; })
   (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
-  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.0.1"; sha256 = "15n54f1f8nn3mjcjrlzdg6q3520571y012mx7v991x2fvp73lmg6"; })
   (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56"; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; sha256 = "0c6ky1jk5ada9m94wcadih98l6k1fvf6vi7vhn1msjixaha419l5"; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
-  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions"; version = "20.0.4"; sha256 = "16jw4zw8pvck754r6744d11460w1fih8c77r8yzzw2w58iv2mns6"; })
-  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions.Wrappers"; version = "20.0.4"; sha256 = "1c5sf8dva9vswl2qqkc6xcmznia8d5nqw46yvk4b1f9idv53j5nz"; })
+  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions"; version = "21.0.2"; sha256 = "1mc358wlq9y21gzj44af8hxlyjm0ws0i9f5vmsn31dn5wbfh4dy5"; })
+  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions.Wrappers"; version = "21.0.2"; sha256 = "0q3vghssyh6rd7w7n4rjv5ngh5byf1y80i22yw9fx10f4hcsw1az"; })
   (fetchNuGet { pname = "VersOne.Epub"; version = "3.3.1"; sha256 = "1v7ms857yhm38syi4l63g9hzn0y08n8csr4z4i56xmzpj1big2s6"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.7.0"; sha256 = "14g5pvv709ykkz3lgqbdisksqfll72792fkrg4qr0s8jcp38kpyc"; })
   (fetchNuGet { pname = "ZstdSharp.Port"; version = "0.7.4"; sha256 = "0087rymvclj96pscd8lbjidsdg1g4p83m6y20bcicz8sx7jnnzyg"; })
 ]
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index ca9483ab0c20e..a76a05fd05174 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -4158,11 +4158,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgserver = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, openssl, libX11, libXau, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xorg-server";
-    version = "21.1.12";
+    version = "21.1.13";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/xserver/xorg-server-21.1.12.tar.xz";
-      sha256 = "03x954bygi6sdynk5yy3yvsfhg6i9gjhisn3x9jxvk5mw4mnw08y";
+      url = "mirror://xorg/individual/xserver/xorg-server-21.1.13.tar.xz";
+      sha256 = "033lvjihidc68v08izrr63va8jhkfmzcjg0d6rm26wizjkah4nml";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index ce0d9105bea52..53836294211ef 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -218,4 +218,4 @@ mirror://xorg/individual/util/lndir-1.0.4.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.9.tar.xz
 mirror://xorg/individual/util/util-macros-1.20.0.tar.xz
 mirror://xorg/individual/util/xorg-cf-files-1.0.8.tar.xz
-mirror://xorg/individual/xserver/xorg-server-21.1.12.tar.xz
+mirror://xorg/individual/xserver/xorg-server-21.1.13.tar.xz
diff --git a/pkgs/shells/bash/bash-completion/default.nix b/pkgs/shells/bash/bash-completion/default.nix
index a909d9461e749..933fe08a61ed3 100644
--- a/pkgs/shells/bash/bash-completion/default.nix
+++ b/pkgs/shells/bash/bash-completion/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bash-completion";
-  version = "2.11";
+  version = "2.13.0";
 
   # Using fetchurl because fetchGithub or fetchzip will have trouble on
   # e.g. APFS filesystems (macOS) because of non UTF-8 characters in some of the
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   # See discussion in https://github.com/NixOS/nixpkgs/issues/107768
   src = fetchurl {
     url = "https://github.com/scop/${pname}/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1b0iz7da1sgifx1a5wdyx1kxbzys53v0kyk8nhxfipllmm5qka3k";
+    sha256 = "sha256-xfmaOeQPDRVMA/8VQ46H7OH1rGZjNqRFmJni/0vt89E=";
   };
 
   strictDeps = true;
diff --git a/pkgs/shells/hishtory/default.nix b/pkgs/shells/hishtory/default.nix
index 051fed0074cc3..b5bc4ce70539e 100644
--- a/pkgs/shells/hishtory/default.nix
+++ b/pkgs/shells/hishtory/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "hishtory";
-  version = "0.290";
+  version = "0.291";
 
   src = fetchFromGitHub {
     owner = "ddworken";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zFBq1BHj0w+ubKAnyL+Asd5vykM2Vpg2va0jxY2vwUk=";
+    hash = "sha256-pBUe0iwzv9Yv9/wmqIjZrDkjBYbARL+A8fhUZJnHRaQ=";
   };
 
   vendorHash = "sha256-qw4whXAX8y0x7IWnpZHT45XTQ82CdoWPDnoQhr20cII=";
diff --git a/pkgs/shells/nushell/plugins/formats.nix b/pkgs/shells/nushell/plugins/formats.nix
index 24500db008232..d52fb69dcec39 100644
--- a/pkgs/shells/nushell/plugins/formats.nix
+++ b/pkgs/shells/nushell/plugins/formats.nix
@@ -5,7 +5,6 @@
 , pkg-config
 , IOKit
 , Foundation
-, libclang
 , nix-update-script
 }:
 
@@ -14,10 +13,8 @@ rustPlatform.buildRustPackage rec {
   inherit (nushell) version src;
   cargoHash = "sha256-mInMs0kAJn3/fgRAG0E8hgvaly2G68kT5O+D83pLq78=";
 
-  env = lib.optionalAttrs stdenv.cc.isClang {
-    LIBCLANG_PATH = "${libclang.lib}/lib";
-  };
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config ]
+    ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
   buildInputs = lib.optionals stdenv.isDarwin [ IOKit Foundation ];
   cargoBuildFlags = [ "--package nu_plugin_formats" ];
 
diff --git a/pkgs/shells/nushell/plugins/gstat.nix b/pkgs/shells/nushell/plugins/gstat.nix
index 0b906ce174eb1..4f3e7f395d157 100644
--- a/pkgs/shells/nushell/plugins/gstat.nix
+++ b/pkgs/shells/nushell/plugins/gstat.nix
@@ -5,7 +5,6 @@
 , nushell
 , pkg-config
 , Security
-, libclang
 , nix-update-script
 }:
 
@@ -14,10 +13,8 @@ rustPlatform.buildRustPackage rec {
   inherit (nushell) version src;
   cargoHash = "sha256-1HfuMtjtUzwsIxkYV8azttnjEyAnC7X1aMIdw2N0yxQ=";
 
-  env = lib.optionalAttrs stdenv.cc.isClang {
-    LIBCLANG_PATH = "${libclang.lib}/lib";
-  };
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config ]
+    ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
   cargoBuildFlags = [ "--package nu_plugin_gstat" ];
 
diff --git a/pkgs/shells/nushell/plugins/query.nix b/pkgs/shells/nushell/plugins/query.nix
index 73dc9adaa0f1b..ed1e8c038e9dc 100644
--- a/pkgs/shells/nushell/plugins/query.nix
+++ b/pkgs/shells/nushell/plugins/query.nix
@@ -4,7 +4,6 @@
 , nushell
 , IOKit
 , CoreFoundation
-, libclang
 , nix-update-script
 }:
 
@@ -13,9 +12,7 @@ rustPlatform.buildRustPackage {
   inherit (nushell) version src;
   cargoHash = "sha256-takIDfMriDzZT/9JkqWPis10EaZhfwGpi7EkoOh4+vw=";
 
-  env = lib.optionalAttrs stdenv.cc.isClang {
-    LIBCLANG_PATH = "${libclang.lib}/lib";
-  };
+  nativeBuildInputs = lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
   buildInputs = lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];
   cargoBuildFlags = [ "--package nu_plugin_query" ];
 
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index c6b0aece45309..2304b3289b7eb 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -317,125 +317,17 @@ rec {
   # `sdkVersion` can be any of the following:
   # * A version string indicating the requested SDK version; or
   # * An attrset consisting of either or both of the following fields: darwinSdkVersion and darwinMinVersion.
-  overrideSDK = stdenv: sdkVersion:
-    let
-      inherit (
-        { inherit (stdenv.hostPlatform) darwinMinVersion darwinSdkVersion; }
-        // (if lib.isAttrs sdkVersion then sdkVersion else { darwinSdkVersion = sdkVersion; })
-      ) darwinMinVersion darwinSdkVersion;
-
-      sdk = pkgs.darwin."apple_sdk_${lib.replaceStrings [ "." ] [ "_" ] darwinSdkVersion}";
-      # TODO: Make this unconditional after #229210 has been merged,
-      # and the 10.12 SDK is updated to follow the new structure.
-      Libsystem = if darwinSdkVersion == "10.12" then pkgs.darwin.Libsystem else sdk.Libsystem;
-
-      replacePropagatedFrameworks = pkg:
-        let
-          propagatedInputs = pkg.propagatedBuildInputs;
-          mappedInputs = map mapPackageToSDK propagatedInputs;
-
-          env = {
-            inherit (pkg) outputs;
-            # Map old frameworks to new ones and the package’s outputs to their original outPaths.
-            # Also map any packages that have propagated frameworks to their proxy packages using
-            # the requested SDK version. These mappings are rendered into tab-separated files to be
-            # parsed and read back with `read`.
-            dependencies = lib.concatMapStrings (pair: "${pair.fst}\t${pair.snd}\n") (lib.zipLists propagatedInputs mappedInputs);
-            pkgOutputs = lib.concatMapStrings (output: "${output}\t${(lib.getOutput output pkg).outPath}\n") pkg.outputs;
-            passAsFile = [ "dependencies" "pkgOutputs" ];
-          };
-        in
-        # Only remap the package’s propagated inputs if there are any and if any of them were themselves remapped.
-        if lib.length propagatedInputs > 0 && propagatedInputs != mappedInputs
-          then pkgs.runCommand pkg.name env ''
-            # Iterate over the outputs in the package being replaced to make sure the proxy is
-            # a fully functional replacement. This is like `symlinkJoin` except for outputs and
-            # the contents of `nix-support`, which will be customized for the requested SDK.
-            while IFS=$'\t\n' read -r outputName pkgOutputPath; do
-              mkdir -p "''${!outputName}"
-
-              for targetPath in "$pkgOutputPath"/*; do
-                targetName=$(basename "$targetPath")
-
-                # `nix-support` is special-cased because any propagated inputs need their SDK
-                # frameworks replaced with those from the requested SDK.
-                if [ "$targetName" == "nix-support" ]; then
-                  mkdir "''${!outputName}/nix-support"
-
-                  for file in "$targetPath"/*; do
-                    fileName=$(basename "$file")
-
-                    if [ "$fileName" == "propagated-build-inputs" ]; then
-                      cp "$file" "''${!outputName}/nix-support/$fileName"
-
-                      while IFS=$'\t\n' read -r oldFramework newFramework; do
-                        substituteInPlace "''${!outputName}/nix-support/$fileName" \
-                          --replace "$oldFramework" "$newFramework"
-                      done < "$dependenciesPath"
-                    fi
-                  done
-                else
-                  ln -s "$targetPath" "''${!outputName}/$targetName"
-                fi
-              done
-            done < "$pkgOutputsPath"
-          ''
-        else pkg;
-
-      # Remap a framework from one SDK version to another.
-      mapPackageToSDK = pkg:
-        let
-          name = lib.getName pkg;
-          framework = lib.removePrefix "apple-framework-" name;
-        in
-        /**/ if pkg == null then pkg
-        else if name != framework then sdk.frameworks."${framework}"
-        else replacePropagatedFrameworks pkg;
-
-      mapRuntimeToSDK = pkg:
-        # Only remap xcbuild for now, which exports the SDK used to build it.
-        if pkg != null && lib.isAttrs pkg && lib.getName pkg == "xcodebuild"
-          then pkg.override { stdenv = overrideSDK stdenv { inherit darwinMinVersion darwinSdkVersion; }; }
-          else pkg;
-
-      mapInputsToSDK = inputs: args:
-        let
-          runsAtBuild = lib.flip lib.elem [
-            "depsBuildBuild"
-            "depsBuildBuildPropagated"
-            "nativeBuildInputs"
-            "propagatedNativeBuildInputs"
-            "depsBuildTarget"
-            "depsBuildTargetPropagated"
-          ];
-          atBuildInputs = lib.filter runsAtBuild inputs;
-          atRuntimeInputs = lib.subtractLists atBuildInputs inputs;
-        in
-        lib.genAttrs atRuntimeInputs (input: map mapPackageToSDK (args."${input}" or [ ]))
-        // lib.genAttrs atBuildInputs (input: map mapRuntimeToSDK (args."${input}" or [ ]));
-
-      mkCC = cc: cc.override {
-        bintools = cc.bintools.override { libc = Libsystem; };
-        libc = Libsystem;
-      };
-    in
-    # TODO: make this work across all input types and not just propagatedBuildInputs
-    stdenv.override (old: {
-      buildPlatform = old.buildPlatform // { inherit darwinMinVersion darwinSdkVersion; };
-      hostPlatform = old.hostPlatform // { inherit darwinMinVersion darwinSdkVersion; };
-      targetPlatform = old.targetPlatform // { inherit darwinMinVersion darwinSdkVersion; };
-
-      allowedRequisites = null;
-      cc = mkCC old.cc;
-
-      extraBuildInputs = [sdk.frameworks.CoreFoundation ];
-      mkDerivationFromStdenv = extendMkDerivationArgs old (mapInputsToSDK [
-        "buildInputs"
-        "nativeBuildInputs"
-        "propagatedNativeBuildInputs"
-        "propagatedBuildInputs"
-      ]);
-    });
+  overrideSDK = import ./darwin/override-sdk.nix {
+    inherit lib extendMkDerivationArgs;
+    inherit (pkgs)
+      stdenvNoCC
+      pkgsBuildBuild
+      pkgsBuildHost
+      pkgsBuildTarget
+      pkgsHostHost
+      pkgsHostTarget
+      pkgsTargetTarget;
+  };
 
   withDefaultHardeningFlags = defaultHardeningFlags: stdenv: let
     bintools = let
diff --git a/pkgs/stdenv/darwin/bootstrap-files/aarch64-apple-darwin.nix b/pkgs/stdenv/darwin/bootstrap-files/aarch64-apple-darwin.nix
index 8fd3537fa78a6..c3f2d88395474 100644
--- a/pkgs/stdenv/darwin/bootstrap-files/aarch64-apple-darwin.nix
+++ b/pkgs/stdenv/darwin/bootstrap-files/aarch64-apple-darwin.nix
@@ -1,12 +1,22 @@
-let
-  fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-darwin/aarch64/20acd4c4f14040485f40e55c0a76c186aa8ca4f3/${file}";
-    inherit sha256 executable;
-  }; in
+# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
+# $ ./refresh-tarballs.bash --targets=aarch64-apple-darwin
+#
+# Metadata:
+# - nixpkgs revision: d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f
+# - hydra build: https://hydra.nixos.org/job/nixpkgs/trunk/stdenvBootstrapTools.aarch64-apple-darwin.build/latest
+# - resolved hydra build: https://hydra.nixos.org/build/255282138
+# - instantiated derivation: /nix/store/cahnprnkg9z2aij3hj4rkbkc4l8190mf-stdenv-bootstrap-tools.drv
+# - output directory: /nix/store/zxxcz7sza5ypy061rsg7cmr7h0a96hbb-stdenv-bootstrap-tools
+# - build time: Wed, 03 Apr 2024 07:59:44 +0000
 {
-  sh = fetch { file = "sh"; sha256 = "17m3xrlbl99j3vm7rzz3ghb47094dyddrbvs2a6jalczvmx7spnj"; };
-  bzip2 = fetch { file = "bzip2"; sha256 = "1khs8s5klf76plhlvlc1ma838r8pc1qigk9f5bdycwgbn0nx240q"; };
-  mkdir = fetch { file = "mkdir"; sha256 = "1m9nk90paazl93v43myv2ay68c1arz39pqr7lk5ddbgb177hgg8a"; };
-  cpio = fetch { file = "cpio"; sha256 = "17pxq61yjjvyd738fy9f392hc9cfzkl612sdr9rxr3v0dgvm8y09"; };
-  tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "1v2332k33akm6mrm4bj749rxnnmc2pkbgcslmd0bbkf76bz2ildy"; executable = false; };
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/aarch64-apple-darwin/d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f/bootstrap-tools.tar.xz";
+    hash = "sha256-a37OgMdTHjFyKs4UTxoD7zx6Te3A7zsSjhbFHzbNxQ8=";
+  };
+  unpack = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/aarch64-apple-darwin/d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f/unpack.nar.xz";
+    hash = "sha256-XCVy6TMDJ1DKFnhIT1NHzdQUjY/TPKLV67Zi/ANIpms=";
+    name = "unpack";
+    unpack = true;
+  };
 }
diff --git a/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix b/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix
index aed2285d8936c..bbef3ec3345bb 100644
--- a/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix
+++ b/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix
@@ -1,12 +1,22 @@
-let
-  fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/c253216595572930316f2be737dc288a1da22558/${file}";
-    inherit sha256 executable;
-  }; in
+# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
+# $ ./refresh-tarballs.bash --targets=x86_64-apple-darwin
+#
+# Metadata:
+# - nixpkgs revision: d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f
+# - hydra build: https://hydra.nixos.org/job/nixpkgs/trunk/stdenvBootstrapTools.x86_64-apple-darwin.build/latest
+# - resolved hydra build: https://hydra.nixos.org/build/255281731
+# - instantiated derivation: /nix/store/44wnr0ikrbcxkakfqhhm2cz6gsh6wjni-stdenv-bootstrap-tools.drv
+# - output directory: /nix/store/lsl9rl3zj9nr318w471vvmlvxzj21b2k-stdenv-bootstrap-tools
+# - build time: Wed, 03 Apr 2024 07:56:15 +0000
 {
-  sh = fetch { file = "sh"; sha256 = "sha256-igMAVEfumFv/LUNTGfNi2nSehgTNIP4Sg+f3L7u6SMA="; };
-  bzip2 = fetch { file = "bzip2"; sha256 = "sha256-K3rhkJZipudT1Jgh+l41Y/fNsMkrPtiAsNRDha/lpZI="; };
-  mkdir = fetch { file = "mkdir"; sha256 = "sha256-VddFELwLDJGNADKB1fWwWPBtIAlEUgJv2hXRmC4NEeM="; };
-  cpio = fetch { file = "cpio"; sha256 = "sha256-SWkwvLaFyV44kLKL2nx720SvcL4ej/p2V/bX3uqAGO0="; };
-  tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "sha256-kRC/bhCmlD4L7KAvJQgcukk7AinkMz4IwmG1rqlh5tA="; executable = false; };
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f/bootstrap-tools.tar.xz";
+    hash = "sha256-3OBigzlbu/Z6g8r7hsOWg95HTv7IJw9Nvbamwvw+88w=";
+  };
+  unpack = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f/unpack.nar.xz";
+    hash = "sha256-93GK8LjjgUBknxsylfGVr0DG4AbWVIQEIWrwxhDW07k=";
+    name = "unpack";
+    unpack = true;
+  };
 }
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index b1094630dd465..3ab2382d0198c 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -52,10 +52,17 @@ let
     inherit system;
 
     name = "bootstrap-tools";
-    builder = bootstrapFiles.sh; # Not a filename! Attribute 'sh' on bootstrapFiles
-    args = if localSystem.isAarch64 then [ ./unpack-bootstrap-tools-aarch64.sh ] else [ ./unpack-bootstrap-tools.sh ];
+    builder = "${bootstrapFiles.unpack}/bin/bash";
 
-    inherit (bootstrapFiles) mkdir bzip2 cpio tarball;
+    args = [
+      "${bootstrapFiles.unpack}/bootstrap-tools-unpack.sh"
+        bootstrapFiles.bootstrapTools
+    ];
+
+    PATH = lib.makeBinPath [
+      (placeholder "out")
+      bootstrapFiles.unpack
+    ];
 
     __impureHostDeps = commonImpureHostDeps;
   } // lib.optionalAttrs config.contentAddressedByDefault {
@@ -76,9 +83,9 @@ let
         nativeTools = false;
         nativeLibc = false;
 
-        buildPackages = lib.optionalAttrs (prevStage ? stdenv) {
-          inherit (prevStage) stdenv;
-        };
+        expand-response-params = lib.optionalString
+          (prevStage.stdenv.hasCC or false && prevStage.stdenv.cc != "/dev/null")
+          prevStage.expand-response-params;
 
         extraPackages = [
           prevStage.llvmPackages.compiler-rt
@@ -117,6 +124,7 @@ let
         inherit (prevStage) coreutils gnugrep;
 
         stdenvNoCC = prevStage.ccWrapperStdenv;
+        runtimeShell = prevStage.ccWrapperStdenv.shell;
       };
 
       bash = prevStage.bash or bootstrapTools;
@@ -128,9 +136,11 @@ let
         hostPlatform = localSystem;
         targetPlatform = localSystem;
 
-        inherit config extraNativeBuildInputs;
+        inherit config;
 
         extraBuildInputs = [ prevStage.darwin.CF ];
+        extraNativeBuildInputs = extraNativeBuildInputs
+          ++ [ prevStage.darwin.apple_sdk.sdkRoot ];
 
         preHook = lib.optionalString (!isBuiltByNixpkgsCompiler bash) ''
           # Don't patch #!/interpreter because it leads to retained
@@ -189,6 +199,7 @@ in
     cpio = null;
 
     darwin = {
+      apple_sdk.sdkRoot = null;
       binutils = null;
       binutils-unwrapped = null;
       cctools = null;
@@ -223,20 +234,10 @@ in
       ccWrapperStdenv = self.stdenv;
 
       bash = bootstrapTools;
-
       coreutils = bootstrapTools;
+      cpio = bootstrapTools;
       gnugrep = bootstrapTools;
-
-      # Either pbzx or Libsystem is required from bootstrap tools (one is used building the other).
-      pbzx = if localSystem.isAarch64 then bootstrapTools else super.pbzx;
-      cpio = self.stdenv.mkDerivation {
-        name = "bootstrap-stage0-cpio";
-        buildCommand = ''
-          mkdir -p $out/bin
-          ln -s ${bootstrapFiles.cpio} $out/bin/cpio
-        '';
-        passthru.isFromBootstrapFiles = true;
-      };
+      pbzx = bootstrapTools;
 
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         # Prevent CF from being propagated to the initial stdenv. Packages that require it
@@ -247,17 +248,18 @@ in
           version = "boot";
         };
 
-        binutils = (import ../../build-support/bintools-wrapper) {
+        binutils = super.wrapBintoolsWith {
           name = "bootstrap-stage0-binutils-wrapper";
 
           nativeTools = false;
           nativeLibc = false;
 
-          buildPackages = { };
+          expand-response-params = "";
           libc = selfDarwin.Libsystem;
 
           inherit lib;
           inherit (self) stdenvNoCC coreutils gnugrep;
+          runtimeShell = self.stdenvNoCC.shell;
 
           bintools = selfDarwin.binutils-unwrapped;
 
@@ -438,6 +440,10 @@ in
       });
 
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
+        apple_sdk = superDarwin.apple_sdk // {
+          inherit (prevStage.darwin.apple_sdk) sdkRoot;
+        };
+
         # Use this stage’s CF to build configd. It’s required but can’t be included in the stdenv.
         configd = superDarwin.configd.overrideAttrs (old: {
           buildInputs = old.buildInputs or [ ] ++ [ self.darwin.CF ];
@@ -457,6 +463,8 @@ in
 
           bintools = selfDarwin.binutils-unwrapped;
           libc = selfDarwin.Libsystem;
+          # TODO(@sternenseemann): can this be removed?
+          runtimeShell = "${bootstrapTools}/bin/bash";
         };
 
         binutils-unwrapped = superDarwin.binutils-unwrapped.override {
@@ -503,7 +511,7 @@ in
     assert lib.all isFromBootstrapFiles (with prevStage; [ coreutils gnugrep ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      autoconf automake bash binutils-unwrapped bison brotli cmake cpio curl cyrus_sasl db
+      autoconf automake bash binutils-unwrapped bison brotli cmake cpio cyrus_sasl db
       ed expat flex gettext gmp groff icu libedit libffi libiconv libidn2 libkrb5 libssh2
       libtool libunistring libxml2 m4 ncurses nghttp2 ninja openldap openssh openssl
       patchutils pbzx perl pkg-config.pkg-config python3 python3Minimal scons serf sqlite
@@ -530,7 +538,7 @@ in
     overrides = self: super: {
       inherit (prevStage) ccWrapperStdenv
         autoconf automake bash binutils binutils-unwrapped bison brotli cmake cmakeMinimal
-        coreutils cpio curl cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu
+        coreutils cpio cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu
         libedit libffi libiconv libidn2 libkrb5 libssh2 libtool libunistring libxml2 m4
         ncurses nghttp2 ninja openldap openssh openssl patchutils pbzx perl pkg-config
         python3Minimal scons sed serf sharutils sqlite subversion texinfo unzip which xz
@@ -561,9 +569,13 @@ in
 
       darwin = super.darwin.overrideScope (_: superDarwin: {
         inherit (prevStage.darwin)
-          CF Libsystem binutils-unwrapped cctools cctools-port configd darwin-stubs dyld
+          CF sdkRoot Libsystem binutils-unwrapped cctools cctools-port configd darwin-stubs dyld
           launchd libclosure libdispatch libobjc locale objc4 postLinkSignHook
           print-reexports rewrite-tbd signingUtils sigtool;
+
+        apple_sdk = superDarwin.apple_sdk // {
+          inherit (prevStage.darwin.apple_sdk) sdkRoot;
+        };
       });
 
       llvmPackages = super.llvmPackages // (
@@ -602,7 +614,7 @@ in
     assert lib.all isFromBootstrapFiles (with prevStage; [ coreutils gnugrep ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      autoconf automake bash binutils-unwrapped bison brotli cmake cpio curl cyrus_sasl db
+      autoconf automake bash binutils-unwrapped bison brotli cmake cpio cyrus_sasl db
       ed expat flex gettext gmp groff icu libedit libffi libiconv libidn2 libkrb5 libssh2
       libtool libunistring libxml2 m4 ncurses nghttp2 ninja openldap openssh openssl
       patchutils pbzx perl pkg-config.pkg-config python3 python3Minimal scons serf sqlite
@@ -630,7 +642,7 @@ in
     overrides = self: super: {
       inherit (prevStage) ccWrapperStdenv
         autoconf automake bash binutils binutils-unwrapped bison brotli cmake cmakeMinimal
-        cpio curl cyrus_sasl db ed expat flex gettext gmp groff icu libedit libffi libiconv
+        cpio cyrus_sasl db ed expat flex gettext gmp groff icu libedit libffi libiconv
         libidn2 libkrb5 libssh2 libtool libunistring libxml2 m4 ncurses nghttp2 ninja
         openldap openssh openssl patchutils pbzx perl pkg-config python3 python3Minimal
         scons sed serf sharutils sqlite subversion sysctl texinfo unzip which xz zlib zstd;
@@ -641,6 +653,10 @@ in
           CF Libsystem configd darwin-stubs dyld launchd libclosure libdispatch libobjc
           locale objc4 postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
 
+        apple_sdk = superDarwin.apple_sdk // {
+          inherit (prevStage.darwin.apple_sdk) sdkRoot;
+        };
+
         # Avoid building unnecessary Python dependencies due to building LLVM manpages.
         cctools-llvm = superDarwin.cctools-llvm.override { enableManpages = false; };
       });
@@ -694,7 +710,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      brotli curl libffi libiconv libidn2 libkrb5 libssh2 libunistring libxml2 ncurses
+      brotli libffi libiconv libidn2 libkrb5 libssh2 libunistring libxml2 ncurses
       nghttp2 openssl zlib zstd
     ]);
 
@@ -722,7 +738,7 @@ in
     overrides = self: super: {
       inherit (prevStage) ccWrapperStdenv
         autoconf automake binutils-unwrapped bison brotli cmake cmakeMinimal coreutils
-        cpio curl cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu libedit libffi
+        cpio cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu libedit libffi
         libiconv libidn2 libkrb5 libssh2 libtool libunistring libxml2 m4 ncurses nghttp2
         ninja openbsm openldap openpam openssh openssl patchutils pbzx perl pkg-config
         python3 python3Minimal scons serf sqlite subversion sysctl texinfo unzip which xz
@@ -738,6 +754,10 @@ in
         inherit (prevStage.darwin)
           CF binutils-unwrapped cctools configd darwin-stubs launchd libobjc libtapi locale
           objc4 print-reexports rewrite-tbd signingUtils sigtool;
+
+        apple_sdk = superDarwin.apple_sdk // {
+          inherit (prevStage.darwin.apple_sdk) sdkRoot;
+        };
       });
 
       llvmPackages = super.llvmPackages // (
@@ -776,7 +796,7 @@ in
     '';
   })
 
-  # This stage rebuilds CF and compiler-rt.
+  # This stage rebuilds CF, compiler-rt, and the sdkRoot derivation.
   #
   # CF requires:
   # - aarch64-darwin: libobjc (due to being apple_sdk.frameworks.CoreFoundation instead of swift-corefoundation)
@@ -785,7 +805,7 @@ in
     # previous stage2-Libsystem stdenv:
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
       autoconf automake binutils-unwrapped bison brotli cmake cmakeMinimal coreutils
-      cpio curl cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu libedit libidn2
+      cpio cyrus_sasl db ed expat flex gettext gmp gnugrep groff icu libedit libidn2
       libkrb5 libssh2 libtool libunistring m4 nghttp2 ninja openbsm openldap openpam openssh
       openssl patchutils pbzx perl pkg-config.pkg-config python3 python3Minimal scons serf
       sqlite subversion sysctl.provider texinfo unzip which xz zstd
@@ -821,7 +841,7 @@ in
 
     overrides = self: super: {
       inherit (prevStage) ccWrapperStdenv
-        autoconf automake bash bison brotli cmake cmakeMinimal coreutils cpio curl
+        autoconf automake bash bison brotli cmake cmakeMinimal coreutils cpio
         cyrus_sasl db ed expat flex gettext gmp gnugrep groff libedit libidn2 libkrb5
         libssh2 libtool libunistring m4 ncurses nghttp2 ninja openbsm openldap openpam
         openssh openssl patchutils pbzx perl pkg-config python3 python3Minimal scons serf
@@ -837,9 +857,7 @@ in
 
         # Rewrap binutils so it uses the rebuilt Libsystem.
         binutils = superDarwin.binutils.override {
-          buildPackages = {
-            inherit (prevStage) stdenv;
-          };
+          inherit (prevStage) expand-response-params;
           libc = selfDarwin.Libsystem;
         } // {
           passthru = { inherit (prevStage.bintools.passthru) isFromBootstrapFiles; };
@@ -908,7 +926,7 @@ in
   (prevStage:
     # previous stage2-CF stdenv:
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      autoconf automake bison brotli cmake cmakeMinimal coreutils cpio curl cyrus_sasl
+      autoconf automake bison brotli cmake cmakeMinimal coreutils cpio cyrus_sasl
       db ed expat flex gettext gmp gnugrep groff libedit libidn2 libkrb5 libssh2 libtool
       libunistring m4 ncurses nghttp2 ninja openbsm openldap openpam openssh openssl
       patchutils pbzx perl pkg-config.pkg-config python3 python3Minimal scons serf sqlite
@@ -945,7 +963,7 @@ in
     overrides = self: super: {
       inherit (prevStage) ccWrapperStdenv
         autoconf automake bash binutils binutils-unwrapped bison brotli cmake cmakeMinimal
-        coreutils cpio curl cyrus_sasl db ed expat flex gettext gmp gnugrep groff libedit
+        coreutils cpio cyrus_sasl db ed expat flex gettext gmp gnugrep groff libedit
         libidn2 libkrb5 libssh2 libtool libunistring m4 nghttp2 ninja openbsm openldap
         openpam openssh openssl patchutils pbzx perl pkg-config python3 python3Minimal scons
         sed serf sharutils sqlite subversion sysctl texinfo unzip which xz zstd
@@ -961,6 +979,10 @@ in
           CF Libsystem binutils binutils-unwrapped cctools cctools-llvm cctools-port configd
           darwin-stubs dyld launchd libclosure libdispatch libobjc libtapi locale objc4
           postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
+
+        apple_sdk = superDarwin.apple_sdk // {
+          inherit (prevStage.darwin.apple_sdk) sdkRoot;
+        };
       });
 
       llvmPackages = super.llvmPackages // (
@@ -988,7 +1010,7 @@ in
   (prevStage:
     # previous stage3 stdenv:
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      autoconf automake bison brotli cmake cmakeMinimal coreutils cpio curl cyrus_sasl
+      autoconf automake bison brotli cmake cmakeMinimal coreutils cpio cyrus_sasl
       db ed expat flex gettext gmp gnugrep groff libedit libidn2 libkrb5 libssh2 libtool
       libunistring m4 nghttp2 ninja openbsm openldap openpam openssh openssl patchutils pbzx
       perl pkg-config.pkg-config python3 python3Minimal scons serf sqlite subversion
@@ -1039,16 +1061,16 @@ in
           # CF dependencies - don’t rebuild them.
           libobjc objc4;
 
+        apple_sdk = superDarwin.apple_sdk // {
+          inherit (prevStage.darwin.apple_sdk) sdkRoot;
+        };
+
         signingUtils = superDarwin.signingUtils.override {
           inherit (selfDarwin) sigtool;
         };
 
         binutils = superDarwin.binutils.override {
-          shell = self.bash + "/bin/bash";
-
-          buildPackages = {
-            inherit (prevStage) stdenv;
-          };
+          inherit (prevStage) expand-response-params;
 
           bintools = selfDarwin.binutils-unwrapped;
           libc = selfDarwin.Libsystem;
@@ -1085,9 +1107,7 @@ in
               nativeTools = false;
               nativeLibc = false;
 
-              buildPackages = {
-                inherit (prevStage) stdenv;
-              };
+              inherit (prevStage) expand-response-params;
 
               extraPackages = [
                 self.llvmPackages.compiler-rt
@@ -1124,9 +1144,7 @@ in
               inherit (self.llvmPackages) libcxx;
 
               inherit lib;
-              inherit (self) stdenvNoCC coreutils gnugrep;
-
-              shell = self.bash + "/bin/bash";
+              inherit (self) stdenvNoCC coreutils gnugrep runtimeShell;
             };
           });
           libraries = super.llvmPackages.libraries.extend (_: _:{
@@ -1156,7 +1174,7 @@ in
   (prevStage:
     # previous stage4 stdenv:
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage; [
-      bash binutils-unwrapped brotli bzip2 cpio curl diffutils ed file findutils gawk
+      bash binutils-unwrapped brotli bzip2 cpio diffutils ed file findutils gawk
       gettext gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libkrb5
       libssh2 libunistring libxml2 libyaml ncurses nghttp2 openbsm openpam openssl patch
       pbzx pcre python3Minimal xar xz zlib zstd
@@ -1209,7 +1227,7 @@ in
 
       extraNativeBuildInputs = lib.optionals localSystem.isAarch64 [
         prevStage.updateAutotoolsGnuConfigScriptsHook
-      ];
+      ] ++ [ prevStage.darwin.apple_sdk.sdkRoot ];
 
       extraBuildInputs = [ prevStage.darwin.CF ];
 
@@ -1296,6 +1314,7 @@ in
         dyld
         libtapi
         locale
+        apple_sdk.sdkRoot
       ]
       ++ lib.optional useAppleSDKLibs [ objc4 ]
       ++ lib.optionals doSign [ postLinkSignHook sigtool signingUtils ]);
@@ -1305,14 +1324,18 @@ in
 
       overrides = self: super: {
         inherit (prevStage)
-          bash binutils brotli bzip2 coreutils cpio curl diffutils ed file findutils gawk
+          bash binutils brotli bzip2 coreutils cpio diffutils ed file findutils gawk
           gettext gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libssh2
           libunistring libxml2 libyaml ncurses nghttp2 openbsm openpam openssl patch pbzx
           pcre python3Minimal xar xz zlib zstd;
 
-        darwin = super.darwin.overrideScope (_: _: {
+        darwin = super.darwin.overrideScope (_: superDarwin: {
           inherit (prevStage.darwin)
             CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi rewrite-tbd xnu;
+
+          apple_sdk = superDarwin.apple_sdk // {
+            inherit (prevStage.darwin.apple_sdk) sdkRoot;
+          };
         } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
           inherit (prevStage.darwin) binutils binutils-unwrapped cctools-llvm cctools-port;
         });
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index 1783ac7a535af..bacad15a68bc7 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -395,8 +395,7 @@ rec {
   };
 
   # The ultimate test: bootstrap a whole stdenv from the tools specified above and get a package set out of it
-  # TODO: uncomment once https://github.com/NixOS/nixpkgs/issues/222717 is resolved
-  /*
+  # eg: nix-build -A freshBootstrapTools.test-pkgs.stdenv
   test-pkgs = import test-pkgspath {
     # if the bootstrap tools are for another platform, we should be testing
     # that platform.
@@ -406,5 +405,4 @@ rec {
         args' = args // { inherit bootstrapFiles; };
       in (import (test-pkgspath + "/pkgs/stdenv/darwin") args');
   };
-  */
 }
diff --git a/pkgs/stdenv/darwin/override-sdk.nix b/pkgs/stdenv/darwin/override-sdk.nix
new file mode 100644
index 0000000000000..6de67537b4990
--- /dev/null
+++ b/pkgs/stdenv/darwin/override-sdk.nix
@@ -0,0 +1,437 @@
+# The basic algorithm is to rewrite the propagated inputs of a package and any of its
+# own propagated inputs recursively to replace references from the default SDK with
+# those from the requested SDK version. This is done across all propagated inputs to
+# avoid making assumptions about how those inputs are being used.
+#
+# For example, packages may propagate target-target dependencies with the expectation that
+# they will be just build inputs when the package itself is used as a native build input.
+#
+# To support this use case and operate without regard to the original package set,
+# `overrideSDK` creates a mapping from the default SDK in all package categories to the
+# requested SDK. If the lookup fails, it is assumed the package is not part of the SDK.
+# Non-SDK packages are processed per the algorithm described above.
+{
+  lib,
+  stdenvNoCC,
+  extendMkDerivationArgs,
+  pkgsBuildBuild,
+  pkgsBuildHost,
+  pkgsBuildTarget,
+  pkgsHostHost,
+  pkgsHostTarget,
+  pkgsTargetTarget,
+}@args:
+
+let
+  # Takes a mapping from a package to its replacement and transforms it into a list of
+  # mappings by output (e.g., a package with three outputs produces a list of size 3).
+  expandOutputs =
+    mapping:
+    map (output: {
+      name = builtins.unsafeDiscardStringContext (lib.getOutput output mapping.original);
+      value = lib.getOutput output mapping.replacement;
+    }) mapping.original.outputs;
+
+  # Produces a list of mappings from the default SDK to the new SDK (`sdk`).
+  # `attr` indicates which SDK path to remap (e.g., `libs` remaps `apple_sdk.libs`).
+  #
+  # TODO: Update once the SDKs have been refactored to a common pattern to better handle
+  # frameworks that are not present in both SDKs. Currently, they’re dropped.
+  mkMapping =
+    attr: pkgs: sdk:
+    lib.foldlAttrs (
+      mappings: name: pkg:
+      let
+        # Avoid evaluation failures due to missing or throwing
+        # frameworks (such as QuickTime in the 11.0 SDK).
+        maybeReplacement = builtins.tryEval sdk.${attr}.${name} or { success = false; };
+      in
+      if maybeReplacement.success then
+        mappings
+        ++ expandOutputs {
+          original = pkg;
+          replacement = maybeReplacement.value;
+        }
+      else
+        mappings
+    ) [ ] pkgs.darwin.apple_sdk.${attr};
+
+  # Produces a list of overrides for the given package set, SDK, and version.
+  # If you want to manually specify a mapping, this is where you should do it.
+  mkOverrides =
+    pkgs: sdk: version:
+    lib.concatMap expandOutputs [
+      # Libsystem needs to match the one used by the SDK or weird errors happen.
+      {
+        original = pkgs.darwin.apple_sdk.Libsystem;
+        replacement = sdk.Libsystem;
+      }
+      # Make sure darwin.CF is mapped to the correct version for the SDK.
+      {
+        original = pkgs.darwin.CF;
+        replacement = sdk.frameworks.CoreFoundation;
+      }
+      # libobjc needs to be handled specially because it’s not actually in the SDK.
+      {
+        original = pkgs.darwin.libobjc;
+        replacement = sdk.objc4;
+      }
+      # Unfortunately, this is not consistent between Darwin SDKs in nixpkgs, so
+      # try both versions to map between them.
+      {
+        original = pkgs.darwin.apple_sdk.sdk or pkgs.darwin.apple_sdk.MacOSX-SDK;
+        replacement = sdk.sdk or sdk.MacOSX-SDK;
+      }
+      # Remap the SDK root. This is used by clang to set the SDK version when
+      # linking. This behavior is automatic by clang and can’t be overriden.
+      # Otherwise, without the SDK root set, the SDK version will be inferred to
+      # be the same as the deployment target, which is not usually what you want.
+      {
+        original = pkgs.darwin.apple_sdk.sdkRoot;
+        replacement = sdk.sdkRoot;
+      }
+      # Override xcodebuild because it hardcodes the SDK version.
+      # TODO: Make xcodebuild defer to the SDK root set in the stdenv.
+      {
+        original = pkgs.xcodebuild;
+        replacement = pkgs.xcodebuild.override {
+          # Do the override manually to avoid an infinite recursion.
+          stdenv = pkgs.stdenv.override (old: {
+            buildPlatform = mkPlatform version old.buildPlatform;
+            hostPlatform = mkPlatform version old.hostPlatform;
+            targetPlatform = mkPlatform version old.targetPlatform;
+
+            allowedRequisites = null;
+            cc = mkCC sdk.Libsystem old.cc;
+          });
+        };
+      }
+    ];
+
+  mkBintools =
+    Libsystem: bintools:
+    if bintools ? override then
+      bintools.override { libc = Libsystem; }
+    else
+      let
+        # `override` isn’t available, so bintools has to be rewrapped with the new libc.
+        # Most of the required arguments can be recovered except for `postLinkSignHook`
+        # and `signingUtils`, which have to be scrapped from the original’s `postFixup`.
+        # This isn’t ideal, but it works.
+        postFixup = lib.splitString "\n" bintools.postFixup;
+
+        postLinkSignHook = lib.pipe postFixup [
+          (lib.findFirst (lib.hasPrefix "echo 'source") null)
+          (builtins.match "^echo 'source (.*-post-link-sign-hook)' >> \\$out/nix-support/post-link-hook$")
+          lib.head
+        ];
+
+        signingUtils = lib.pipe postFixup [
+          (lib.findFirst (lib.hasPrefix "export signingUtils") null)
+          (builtins.match "^export signingUtils=(.*)$")
+          lib.head
+        ];
+
+        newBintools = pkgsBuildTarget.wrapBintoolsWith {
+          inherit (bintools) name;
+
+          buildPackages = { };
+          libc = Libsystem;
+
+          inherit lib;
+
+          coreutils = bintools.coreutils_bin;
+          gnugrep = bintools.gnugrep_bin;
+
+          inherit (bintools) bintools;
+
+          inherit postLinkSignHook signingUtils;
+        };
+      in
+      lib.getOutput bintools.outputName newBintools;
+
+  mkCC =
+    Libsystem: cc:
+    if cc ? override then
+      cc.override {
+        bintools = mkBintools Libsystem cc.bintools;
+        libc = Libsystem;
+      }
+    else
+      builtins.throw "CC has no override: ${cc}";
+
+  mkPlatform =
+    version: platform:
+    platform
+    // lib.optionalAttrs platform.isDarwin { inherit (version) darwinMinVersion darwinSdkVersion; };
+
+  # Creates a stub package. Unchanged files from the original package are symlinked
+  # into the package. The contents of `nix-support` are updated to reference any
+  # replaced packages.
+  #
+  # Note: `env` is an attrset containing `outputs` and `dependencies`.
+  # `dependencies` is a regex passed to sed and must be `passAsFile`.
+  mkProxyPackage =
+    name: env:
+    stdenvNoCC.mkDerivation {
+      inherit name;
+
+      inherit (env) outputs replacements sourceOutputs;
+
+      # Take advantage of the fact that replacements and sourceOutputs will be passed
+      # via JSON and parsed into environment variables.
+      __structuredAttrs = true;
+
+      buildCommand = ''
+        # Map over the outputs in the package being replaced to make sure the proxy is
+        # a fully functional replacement. This is like `symlinkJoin` except for
+        # outputs and the contents of `nix-support`, which will be customized.
+        function replacePropagatedInputs() {
+          local sourcePath=$1
+          local targetPath=$2
+
+          mkdir -p "$targetPath"
+
+          local sourceFile
+          for sourceFile in "$sourcePath"/*; do
+            local fileName=$(basename "$sourceFile")
+            local targetFile="$targetPath/$fileName"
+
+            if [ -d "$sourceFile" ]; then
+              replacePropagatedInputs "$sourceFile" "$targetPath/$fileName"
+              # Check to see if any of the files in the folder were replaced.
+              # Otherwise, replace the folder with a symlink if none were changed.
+              if [ "$(find -maxdepth 1 "$targetPath/$fileName" -not -type l)" = "" ]; then
+                rm "$targetPath/$fileName"/*
+                ln -s "$sourceFile" "$targetPath/$fileName"
+              fi
+            else
+              cp "$sourceFile" "$targetFile"
+              local original
+              for original in "''${!replacements[@]}"; do
+                substituteInPlace "$targetFile" \
+                  --replace-quiet "$original" "''${replacements[$original]}"
+              done
+              if cmp -s "$sourceFile" "$targetFile"; then
+                rm "$targetFile"
+                ln -s "$sourceFile" "$targetFile"
+              fi
+            fi
+          done
+        }
+
+        local outputName
+        for outputName in "''${!outputs[@]}"; do
+          local outPath=''${outputs[$outputName]}
+          mkdir -p "$outPath"
+
+          local sourcePath
+          for sourcePath in "''${sourceOutputs[$outputName]}"/*; do
+            sourceName=$(basename "$sourcePath")
+            # `nix-support` is special-cased because any propagated inputs need their
+            # SDK frameworks replaced with those from the requested SDK.
+            if [ "$sourceName" == "nix-support" ]; then
+              replacePropagatedInputs "$sourcePath" "$outPath/nix-support"
+            else
+              ln -s "$sourcePath" "$outPath/$sourceName"
+            fi
+          done
+        done
+      '';
+    };
+
+  # Gets all propagated inputs in a package. This does not recurse.
+  getPropagatedInputs =
+    pkg:
+    lib.optionals (lib.isDerivation pkg) (
+      lib.concatMap (input: pkg.${input} or [ ]) [
+        "depsBuildBuildPropagated"
+        "propagatedNativeBuildInputs"
+        "depsBuildTargetPropagated"
+        "depsHostHostPropagated"
+        "propagatedBuildInputs"
+        "depsTargetTargetPropagated"
+      ]
+    );
+
+  # Looks up the replacement for `pkg` in the `newPackages` mapping. If `pkg` is a
+  # compiler (meaning it has a `libc` attribute), the compiler will be overriden.
+  getReplacement =
+    newPackages: pkg:
+    let
+      pkgOrCC =
+        if pkg.libc or null != null then
+          # Heuristic to determine whether package is a compiler or bintools.
+          if pkg.wrapperName == "CC_WRAPPER" then
+            mkCC (getReplacement newPackages pkg.libc) pkg
+          else
+            mkBintools (getReplacement newPackages pkg.libc) pkg
+        else
+          pkg;
+    in
+    if lib.isDerivation pkg then
+      newPackages.${builtins.unsafeDiscardStringContext pkg} or pkgOrCC
+    else
+      pkg;
+
+  # Replaces all packages propagated by `pkgs` using the `newPackages` mapping.
+  # It is assumed that all possible overrides have already been incorporated into
+  # the mapping. If any propagated packages are replaced, a proxy package will be
+  # created with references to the old packages replaced in `nix-support`.
+  replacePropagatedPackages =
+    newPackages: pkg:
+    let
+      propagatedInputs = getPropagatedInputs pkg;
+      env = {
+        inherit (pkg) outputs;
+
+        replacements = lib.pipe propagatedInputs [
+          (lib.filter (pkg: pkg != null))
+          (map (dep: {
+            name = builtins.unsafeDiscardStringContext dep;
+            value = getReplacement newPackages dep;
+          }))
+          (lib.filter (mapping: mapping.name != mapping.value))
+          lib.listToAttrs
+        ];
+
+        sourceOutputs = lib.genAttrs pkg.outputs (output: lib.getOutput output pkg);
+      };
+    in
+    # Only remap the package’s propagated inputs if there are any and if any of them
+    # had packages remapped (with frameworks or proxy packages).
+    if propagatedInputs != [ ] && env.replacements != { } then mkProxyPackage pkg.name env else pkg;
+
+  # Gets all propagated dependencies in a package in reverse order sorted topologically.
+  # This takes advantage of the fact that items produced by `operator` are pushed to
+  # the end of the working set, ensuring that dependencies always appear after their
+  # parent in the list with leaf nodes at the end.
+  topologicallyOrderedPropagatedDependencies =
+    pkgs:
+    let
+      mapPackageDeps = lib.flip lib.pipe [
+        (lib.filter (pkg: pkg != null))
+        (map (pkg: {
+          key = builtins.unsafeDiscardStringContext pkg;
+          package = pkg;
+          deps = getPropagatedInputs pkg;
+        }))
+      ];
+    in
+    lib.genericClosure {
+      startSet = mapPackageDeps pkgs;
+      operator = { deps, ... }: mapPackageDeps deps;
+    };
+
+  # Returns a package mapping based on remapping all propagated packages.
+  getPackageMapping =
+    baseMapping: input:
+    let
+      dependencies = topologicallyOrderedPropagatedDependencies input;
+    in
+    lib.foldr (
+      pkg: newPackages:
+      let
+        replacement = replacePropagatedPackages newPackages pkg.package;
+        outPath = pkg.key;
+      in
+      if pkg.key == null || newPackages ? ${outPath} then
+        newPackages
+      else
+        newPackages // { ${outPath} = replacement; }
+    ) baseMapping dependencies;
+
+  overrideSDK =
+    stdenv: sdkVersion:
+    let
+      newVersion = {
+        inherit (stdenv.hostPlatform) darwinMinVersion darwinSdkVersion;
+      } // (if lib.isAttrs sdkVersion then sdkVersion else { darwinSdkVersion = sdkVersion; });
+
+      inherit (newVersion) darwinMinVersion darwinSdkVersion;
+
+      # Used to get an SDK version corresponding to the requested `darwinSdkVersion`.
+      # TODO: Treat `darwinSdkVersion` as a constraint rather than as an exact version.
+      resolveSDK = pkgs: pkgs.darwin."apple_sdk_${lib.replaceStrings [ "." ] [ "_" ] darwinSdkVersion}";
+
+      # `newSdkPackages` is constructed based on the assumption that SDK packages only
+      # propagate versioned packages from that SDK -- that they neither propagate
+      # unversioned SDK packages nor propagate non-SDK packages (such as curl).
+      #
+      # Note: `builtins.unsafeDiscardStringContext` is used to allow the path from the
+      # original package output to be mapped to the replacement. This is safe because
+      # the value is not persisted anywhere and necessary because store paths are not
+      # allowed as attrset names otherwise.
+      baseSdkMapping = lib.pipe args [
+        (lib.flip removeAttrs [
+          "lib"
+          "stdenvNoCC"
+          "extendMkDerivationArgs"
+        ])
+        (lib.filterAttrs (_: lib.hasAttr "darwin"))
+        lib.attrValues
+        (lib.concatMap (
+          pkgs:
+          let
+            newSDK = resolveSDK pkgs;
+
+            frameworks = mkMapping "frameworks" pkgs newSDK;
+            libs = mkMapping "libs" pkgs newSDK;
+            overrides = mkOverrides pkgs newSDK newVersion;
+          in
+          frameworks ++ libs ++ overrides
+        ))
+        lib.listToAttrs
+      ];
+
+      # Remaps all inputs given to the requested SDK version. The result is an attrset
+      # that can be passed to `extendMkDerivationArgs`.
+      mapInputsToSDK =
+        inputs: args:
+        lib.pipe inputs [
+          (lib.filter (input: args ? ${input}))
+          (lib.flip lib.genAttrs (
+            inputName:
+            let
+              input = args.${inputName};
+              newPackages = getPackageMapping baseSdkMapping input;
+            in
+            map (getReplacement newPackages) input
+          ))
+        ];
+    in
+    stdenv.override (
+      old:
+      {
+        buildPlatform = mkPlatform newVersion old.buildPlatform;
+        hostPlatform = mkPlatform newVersion old.hostPlatform;
+        targetPlatform = mkPlatform newVersion old.targetPlatform;
+      }
+      # Only perform replacements if the SDK version has changed. Changing only the
+      # deployment target does not require replacing the libc or SDK dependencies.
+      // lib.optionalAttrs (old.hostPlatform.darwinSdkVersion != darwinSdkVersion) {
+        allowedRequisites = null;
+
+        mkDerivationFromStdenv = extendMkDerivationArgs old (mapInputsToSDK [
+          "depsBuildBuild"
+          "nativeBuildInputs"
+          "depsBuildTarget"
+          "depsHostHost"
+          "buildInputs"
+          "depsTargetTarget"
+          "depsBuildBuildPropagated"
+          "propagatedNativeBuildInputs"
+          "depsBuildTargetPropagated"
+          "depsHostHostPropagated"
+          "propagatedBuildInputs"
+          "depsTargetTargetPropagated"
+        ]);
+
+        cc = getReplacement baseSdkMapping old.cc;
+
+        extraBuildInputs = map (getReplacement baseSdkMapping) stdenv.extraBuildInputs;
+        extraNativeBuildInputs = map (getReplacement baseSdkMapping) stdenv.extraNativeBuildInputs;
+      }
+    );
+in
+overrideSDK
diff --git a/pkgs/stdenv/darwin/unpack-bootstrap-tools-aarch64.sh b/pkgs/stdenv/darwin/unpack-bootstrap-tools-aarch64.sh
deleted file mode 100644
index 4bb84f6409cbd..0000000000000
--- a/pkgs/stdenv/darwin/unpack-bootstrap-tools-aarch64.sh
+++ /dev/null
@@ -1,57 +0,0 @@
-set -euo pipefail
-
-# Unpack the bootstrap tools tarball.
-echo Unpacking the bootstrap tools...
-$mkdir $out
-$bzip2 -d < $tarball | (cd $out && $cpio -i)
-
-export PATH=$out/bin
-
-# Fix codesign wrapper paths
-sed -i \
-  -e "1c\
-#!$out/bin/bash" \
-  -e "s|[^( ]*\bsigtool\b|$out/bin/sigtool|g" \
-  $out/bin/codesign
-
-updateInstallName() {
-  local path="$1"
-
-  cp "$path" "$path.new"
-  install_name_tool -id "$path" "$path.new"
-  # workaround for https://github.com/NixOS/nixpkgs/issues/294518
-  # libc++.1.0.dylib contains wrong LC_RPATH
-  if [[ ${path} == *libc++.1.0.dylib ]]; then
-    install_name_tool -add_rpath @loader_path/.. "${path}.new"
-  fi
-  codesign -f -i "$(basename "$path")" -s - "$path.new"
-  mv -f "$path.new" "$path"
-}
-
-find $out
-
-ln -s bash $out/bin/sh
-ln -s bzip2 $out/bin/bunzip2
-
-find $out/lib -type f -name '*.dylib' -print0 | while IFS= read -r -d $'\0' lib; do
-  updateInstallName "$lib"
-done
-
-# Provide a gunzip script.
-cat > $out/bin/gunzip <<EOF
-#!$out/bin/sh
-exec $out/bin/gzip -d "\$@"
-EOF
-chmod +x $out/bin/gunzip
-
-# Provide fgrep/egrep.
-echo "#! $out/bin/sh" > $out/bin/egrep
-echo "exec $out/bin/grep -E \"\$@\"" >> $out/bin/egrep
-echo "#! $out/bin/sh" > $out/bin/fgrep
-echo "exec $out/bin/grep -F \"\$@\"" >> $out/bin/fgrep
-
-cat >$out/bin/dsymutil << EOF
-#!$out/bin/sh
-EOF
-
-chmod +x $out/bin/egrep $out/bin/fgrep $out/bin/dsymutil
diff --git a/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh b/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
deleted file mode 100644
index 37beeaf28f94b..0000000000000
--- a/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-set -e
-
-# Unpack the bootstrap tools tarball.
-echo Unpacking the bootstrap tools...
-$mkdir $out
-$bzip2 -d < $tarball | (cd $out && $cpio -i)
-
-# Set the ELF interpreter / RPATH in the bootstrap binaries.
-echo Patching the tools...
-
-export PATH=$out/bin
-
-for i in $out/bin/*; do
-  if ! test -L $i; then
-    echo patching $i
-    install_name_tool -add_rpath $out/lib $i || true
-  fi
-done
-
-for i in $out/lib/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
-  if test ! -L "$i" -a "$i" != "$out/lib/libSystem*.dylib"; then
-    echo "Patching $i"
-
-    id=$(otool -D "$i" | tail -n 1)
-    install_name_tool -id "$(dirname $i)/$(basename $id)" $i
-
-    libs=$(otool -L "$i" | tail -n +2 | grep -v libSystem | cat)
-    if [ -n "$libs" ]; then
-      install_name_tool -add_rpath $out/lib $i
-    fi
-  fi
-done
-
-ln -s bash $out/bin/sh
-ln -s bzip2 $out/bin/bunzip2
-
-# Provide a gunzip script.
-cat > $out/bin/gunzip <<EOF
-#!$out/bin/sh
-exec $out/bin/gzip -d "\$@"
-EOF
-chmod +x $out/bin/gunzip
-
-# Provide fgrep/egrep.
-echo "#! $out/bin/sh" > $out/bin/egrep
-echo "exec $out/bin/grep -E \"\$@\"" >> $out/bin/egrep
-echo "#! $out/bin/sh" > $out/bin/fgrep
-echo "exec $out/bin/grep -F \"\$@\"" >> $out/bin/fgrep
-
-cat >$out/bin/dsymutil << EOF
-#!$out/bin/sh
-EOF
-
-chmod +x $out/bin/egrep $out/bin/fgrep $out/bin/dsymutil
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 9c918b12f96ef..45c73d7709c66 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1069,12 +1069,12 @@ _defaultUnpack() {
                 # disregard the error code from the xz invocation. Otherwise,
                 # it can happen that tar exits earlier, causing xz to fail
                 # from a SIGPIPE.
-                (XZ_OPT="--threads=$NIX_BUILD_CORES" xz -d < "$fn"; true) | tar xf - --warning=no-timestamp
+                (XZ_OPT="--threads=$NIX_BUILD_CORES" xz -d < "$fn"; true) | tar xf - --mode=+w --warning=no-timestamp
                 ;;
             *.tar | *.tar.* | *.tgz | *.tbz2 | *.tbz)
                 # GNU tar can automatically select the decompression method
                 # (info "(tar) gzip").
-                tar xf "$fn" --warning=no-timestamp
+                tar xf "$fn" --mode=+w --warning=no-timestamp
                 ;;
             *)
                 return 1
@@ -1421,7 +1421,8 @@ fixupPhase() {
     # Make sure everything is writable so "strip" et al. work.
     local output
     for output in $(getAllOutputNames); do
-        if [ -e "${!output}" ]; then chmod -R u+w "${!output}"; fi
+        # for set*id bits see #300635
+        if [ -e "${!output}" ]; then chmod -R u+w,u-s,g-s "${!output}"; fi
     done
 
     runHook preFixup
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 0e1852805cfd2..e1801abcb485b 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -185,9 +185,9 @@ let
           name = "${name}-gcc-wrapper";
           nativeTools = false;
           nativeLibc = false;
-          buildPackages = lib.optionalAttrs (prevStage ? stdenv) {
-            inherit (prevStage) stdenv;
-          };
+          expand-response-params = lib.optionalString
+            (prevStage.stdenv.hasCC or false && prevStage.stdenv.cc != "/dev/null")
+            prevStage.expand-response-params;
           cc = prevStage.gcc-unwrapped;
           bintools = prevStage.binutils;
           isGNU = true;
@@ -196,6 +196,7 @@ let
           inherit (prevStage) coreutils gnugrep;
           stdenvNoCC = prevStage.ccWrapperStdenv;
           fortify-headers = prevStage.fortify-headers;
+          runtimeShell = prevStage.ccWrapperStdenv.shell;
         }).overrideAttrs(a: lib.optionalAttrs (prevStage.gcc-unwrapped.passthru.isXgcc or false) {
           # This affects only `xgcc` (the compiler which compiles the final compiler).
           postFixup = (a.postFixup or "") + ''
@@ -260,11 +261,12 @@ in
         name = "bootstrap-stage0-binutils-wrapper";
         nativeTools = false;
         nativeLibc = false;
-        buildPackages = { };
+        expand-response-params = "";
         libc = getLibc self;
         inherit lib;
         inherit (self) stdenvNoCC coreutils gnugrep;
         bintools = bootstrapTools;
+        runtimeShell = "${bootstrapTools}/bin/bash";
       };
       coreutils = bootstrapTools;
       gnugrep = bootstrapTools;
@@ -332,6 +334,14 @@ in
         inherit (prevStage) ccWrapperStdenv coreutils gnugrep gettext bison texinfo zlib gnum4 perl patchelf;
         ${localSystem.libc} = getLibc prevStage;
         gmp = super.gmp.override { cxx = false; };
+        # This stage also rebuilds binutils which will of course be used only in the next stage.
+        # We inherit this until stage3, in stage4 it will be rebuilt using the adjacent bash/runtimeShell pkg.
+        # TODO(@sternenseemann): Can we already build the wrapper with the actual runtimeShell here?
+        # Historically, the wrapper didn't use runtimeShell, so the used shell had to be changed explicitly
+        # (or stdenvNoCC.shell would be used) which happened in stage4.
+        binutils = super.binutils.override {
+          runtimeShell = "${bootstrapTools}/bin/bash";
+        };
         gcc-unwrapped =
           (super.gcc-unwrapped.override (commonGccOverrides // {
             # The most logical name for this package would be something like
@@ -544,13 +554,10 @@ in
       # other purposes (binutils and top-level pkgs) too.
       inherit (prevStage) gettext gnum4 bison perl texinfo zlib linuxHeaders libidn2 libunistring;
       ${localSystem.libc} = getLibc prevStage;
+      # Since this is the first fresh build of binutils since stage2, our own runtimeShell will be used.
       binutils = super.binutils.override {
-        # Don't use stdenv's shell but our own
-        shell = self.bash + "/bin/bash";
         # Build expand-response-params with last stage like below
-        buildPackages = {
-          inherit (prevStage) stdenv;
-        };
+        inherit (prevStage) expand-response-params;
       };
 
       # To allow users' overrides inhibit dependencies too heavy for
@@ -561,15 +568,12 @@ in
         nativeTools = false;
         nativeLibc = false;
         isGNU = true;
-        buildPackages = {
-          inherit (prevStage) stdenv;
-        };
+        inherit (prevStage) expand-response-params;
         cc = prevStage.gcc-unwrapped;
         bintools = self.binutils;
         libc = getLibc self;
         inherit lib;
-        inherit (self) stdenvNoCC coreutils gnugrep;
-        shell = self.bash + "/bin/bash";
+        inherit (self) stdenvNoCC coreutils gnugrep runtimeShell;
         fortify-headers = self.fortify-headers;
       };
     };
@@ -646,7 +650,9 @@ in
         # More complicated cases
         ++ (map (x: getOutput x (getLibc prevStage)) [ "out" "dev" "bin" ] )
         ++  [ linuxHeaders # propagated from .dev
-            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params gcc.cc.libgcc glibc.passthru.libgcc
+              binutils gcc gcc.cc gcc.cc.lib
+              gcc.expand-response-params # != (prevStage.)expand-response-params
+              gcc.cc.libgcc glibc.passthru.libgcc
           ]
         ++ lib.optionals (localSystem.libc == "musl") [ fortify-headers ]
         ++ [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ]
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 3a45cdffe4210..03965a5c0557f 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -175,11 +175,14 @@ let
         "xscreensaver-command"      # Xscreensaver
         "xset"                      # generic-ish X
       ];
-      fix."$lockfile_command" = [ "lockfile" ];
       keep = {
         "$MV" = true;
         "$XPROP" = true;
+        "$lockfile_command" = true;
       };
+      execer = [
+        "cannot:${perl}/bin/perl"
+      ];
       prologue = "${writeText "xdg-screensaver-prologue" ''
         export PERL5LIB=${with perlPackages; makePerlPath [ NetDBus XMLTwig XMLParser X11Protocol ]}
         export PATH=$PATH:${coreutils}/bin
diff --git a/pkgs/tools/admin/copilot-cli/default.nix b/pkgs/tools/admin/copilot-cli/default.nix
index 4664c60694d38..505e44f3b3c14 100644
--- a/pkgs/tools/admin/copilot-cli/default.nix
+++ b/pkgs/tools/admin/copilot-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "copilot-cli";
-  version = "1.33.2";
+  version = "1.33.3";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+1ri9l6ngNIMFYg+n0wDluqZ6/Zl3it4yPOBglk/0JU=";
+    hash = "sha256-WPPEox4NKFsVUpLkXawCK2QFwW1BAFaxQ85elvrneHo=";
   };
 
-  vendorHash = "sha256-HoiBg32L+aRsdDXFOvwZFURV2RttLIGuOOjB8lcYGXU=";
+  vendorHash = "sha256-tVZ8TxJ77Qy+wn+O0otjZ6/VoKkav4OhNKWcrLhudgU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/credhub-cli/default.nix b/pkgs/tools/admin/credhub-cli/default.nix
index b4c79b8913b14..899b37e123954 100644
--- a/pkgs/tools/admin/credhub-cli/default.nix
+++ b/pkgs/tools/admin/credhub-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.28";
+  version = "2.9.29";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-2LHWbTvxE8awSUm33XocjWxrY8dosMEaCPOx85+tj4s=";
+    sha256 = "sha256-6icF+Dg4IdCjeqcX058aewj702oCoch6VYqgdCVPoNc=";
   };
 
   # these tests require network access that we're not going to give them
diff --git a/pkgs/tools/admin/mycli/default.nix b/pkgs/tools/admin/mycli/default.nix
index 36fc0ff4a3b39..15600c3255616 100644
--- a/pkgs/tools/admin/mycli/default.nix
+++ b/pkgs/tools/admin/mycli/default.nix
@@ -42,13 +42,6 @@ buildPythonApplication rec {
     "mycli/packages/paramiko_stub/__init__.py"
   ];
 
-  disabledTests = [
-    # Note: test_auto_escaped_col_names is currently failing due to a bug upstream.
-    # TODO: re-enable this test once there is a fix upstream. See
-    # https://github.com/dbcli/mycli/issues/1103 for details.
-    "test_auto_escaped_col_names"
-  ];
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace "cryptography == 36.0.2" "cryptography"
diff --git a/pkgs/tools/admin/pulumi-packages/base.nix b/pkgs/tools/admin/pulumi-packages/base.nix
index 8327e41dcd5f2..5f5857f1a1fd2 100644
--- a/pkgs/tools/admin/pulumi-packages/base.nix
+++ b/pkgs/tools/admin/pulumi-packages/base.nix
@@ -10,9 +10,10 @@ let
     , vendorHash
     , cmd
     , extraLdflags
+    , env
     , ...
     }@args: buildGoModule (rec {
-      inherit pname src vendorHash version;
+      inherit pname src vendorHash version env;
 
       sourceRoot = "${src.name}/provider";
 
@@ -88,6 +89,7 @@ in
 , cmdGen
 , cmdRes
 , extraLdflags
+, env ? { }
 , meta
 , fetchSubmodules ? false
 , ...
@@ -99,14 +101,14 @@ let
   };
 
   pulumi-gen = mkBasePackage rec {
-    inherit src version vendorHash extraLdflags;
+    inherit src version vendorHash extraLdflags env;
 
     cmd = cmdGen;
     pname = cmdGen;
   };
 in
 mkBasePackage ({
-  inherit meta src version vendorHash extraLdflags;
+  inherit meta src version vendorHash extraLdflags env;
 
   pname = repo;
 
diff --git a/pkgs/tools/admin/pulumi-packages/default.nix b/pkgs/tools/admin/pulumi-packages/default.nix
index 5aed6b1717833..9e232a1f45bf4 100644
--- a/pkgs/tools/admin/pulumi-packages/default.nix
+++ b/pkgs/tools/admin/pulumi-packages/default.nix
@@ -11,4 +11,5 @@ in
   pulumi-language-nodejs = callPackage ./pulumi-language-nodejs.nix { };
   pulumi-language-python = callPackage ./pulumi-language-python.nix { };
   pulumi-random = callPackage' ./pulumi-random.nix { };
+  pulumi-yandex-unofficial = callPackage' ./pulumi-yandex-unofficial.nix { };
 }
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix b/pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix
new file mode 100644
index 0000000000000..52079fbda066e
--- /dev/null
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix
@@ -0,0 +1,27 @@
+{ lib
+, mkPulumiPackage
+}:
+# Note that we are not using https://github.com/pulumi/pulumi-yandex because
+# it has been archived in 2022.
+mkPulumiPackage rec {
+  owner = "Regrau";
+  repo = "pulumi-yandex";
+  version = "0.98.0";
+  rev = "v${version}";
+  hash = "sha256-Olwl4JNrJUiJaGha7ZT0Qb0+6hRKxOOy06eKMJfYf0I=";
+  vendorHash = "sha256-8mu0msSq59f5GZNo7YIGuNTYealGyEL9kwk0jCcSO68=";
+  cmdGen = "pulumi-tfgen-yandex";
+  cmdRes = "pulumi-resource-yandex";
+  extraLdflags = [
+    "-X github.com/regrau/${repo}/provider/pkg/version.Version=v${version}"
+  ];
+  __darwinAllowLocalNetworking = true;
+  env.GOWORK = "off";
+  meta = with lib; {
+    description = "Unofficial Yandex Cloud Resource Provider";
+    homepage = "https://github.com/Regrau/pulumi-yandex";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tie veehaitch trundle ];
+    mainProgram = cmdRes;
+  };
+}
diff --git a/pkgs/tools/audio/beets/builtin-plugins.nix b/pkgs/tools/audio/beets/builtin-plugins.nix
index c6ae24dc6906e..6b89f74795a8b 100644
--- a/pkgs/tools/audio/beets/builtin-plugins.nix
+++ b/pkgs/tools/audio/beets/builtin-plugins.nix
@@ -136,4 +136,7 @@
   autobpm = {
     testPaths = [ ];
   };
+  listenbrainz = {
+    testPaths = [ ];
+  };
 }
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 7631d106654db..513470b0ffd16 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -85,12 +85,12 @@ in lib.makeExtensible (self: {
 
   beets-unstable = callPackage ./common.nix {
     inherit python3Packages;
-    version = "unstable-2023-10-26";
+    version = "unstable-2024-03-16";
     src = fetchFromGitHub {
       owner = "beetbox";
       repo = "beets";
-      rev = "6655760732100f5387fad2d2890c015ee5039981";
-      hash = "sha256-Nz9BHtacYpJMLmB3f9WFg6GvMa+BuUhiNbJ9cyannek=";
+      rev = "b09806e0df8f01b9155017d3693764ae7beedcd5";
+      hash = "sha256-jE6nZLOEFufqclT6p1zK7dW+vt69q2ulaRsUldL7cSQ=";
     };
     extraPatches = [
       # Bash completion fix for Nix
diff --git a/pkgs/tools/audio/headsetcontrol/default.nix b/pkgs/tools/audio/headsetcontrol/default.nix
index 68a799a55c76e..d1d7a75416906 100644
--- a/pkgs/tools/audio/headsetcontrol/default.nix
+++ b/pkgs/tools/audio/headsetcontrol/default.nix
@@ -1,21 +1,29 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , hidapi
 }:
 
 stdenv.mkDerivation rec {
   pname = "headsetcontrol";
-  version = "2.7.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "Sapd";
     repo = "HeadsetControl";
     rev = version;
-    sha256 = "sha256-tAndkfLEgj81JWzXtDBNspRxzKAL6XaRw0aDI1XbC1E=";
+    sha256 = "sha256-N1c94iAJgCPhGNDCGjMINg0AL2wPX5gVIsJ+pzn/l9Y=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/Sapd/HeadsetControl/pull/337.patch";
+      hash = "sha256-18w9BQsMljEA/eY3rnosHvKwhiaF79TrWH/ayuyZMrM=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
@@ -24,11 +32,6 @@ stdenv.mkDerivation rec {
     hidapi
   ];
 
-  /*
-  Tests depend on having the appropriate headsets connected.
-  */
-  doCheck = false;
-
   meta = with lib; {
     description = "Sidetone and Battery status for Logitech G930, G533, G633, G933 SteelSeries Arctis 7/PRO 2019 and Corsair VOID (Pro)";
     longDescription = ''
diff --git a/pkgs/tools/audio/yabridge/default.nix b/pkgs/tools/audio/yabridge/default.nix
index 57534b93a6ff6..05982bc10e83a 100644
--- a/pkgs/tools/audio/yabridge/default.nix
+++ b/pkgs/tools/audio/yabridge/default.nix
@@ -98,6 +98,7 @@ multiStdenv.mkDerivation (finalAttrs: {
     # Hard code bitbridge & runtime dependencies
     (substituteAll {
       src = ./hardcode-dependencies.patch;
+      libdbus = dbus.lib;
       libxcb32 = pkgsi686Linux.xorg.libxcb;
       inherit wine;
     })
@@ -148,10 +149,11 @@ multiStdenv.mkDerivation (finalAttrs: {
 
   # Hard code wine path in wrapper scripts generated by winegcc
   postFixup = ''
-    for exe in "$out"/bin/*.exe; do
-      substituteInPlace "$exe" \
-        --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine"'
-    done
+    substituteInPlace "$out/bin/yabridge-host-32.exe" \
+      --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine"'
+
+    substituteInPlace "$out/bin/yabridge-host.exe" \
+      --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine64"'
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/tools/audio/yabridge/hardcode-dependencies.patch b/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
index bd9e08bc6cf3e..d33bdf30eed23 100644
--- a/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
+++ b/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
@@ -11,6 +11,21 @@ index c602c5ad..a52e20a1 100644
  endif
  
  # These are all headers-only libraries, and thus won't require separate 32-bit
+diff --git a/src/common/notifications.cpp b/src/common/notifications.cpp
+index 66e08527..685c54af 100644
+--- a/src/common/notifications.cpp
++++ b/src/common/notifications.cpp
+@@ -29,8 +29,8 @@
+ #include "process.h"
+ #include "utils.h"
+ 
+-constexpr char libdbus_library_name[] = "libdbus-1.so.3";
+-constexpr char libdbus_library_fallback_name[] = "libdbus-1.so";
++constexpr char libdbus_library_name[] = "@libdbus@/lib/libdbus-1.so.3";
++constexpr char libdbus_library_fallback_name[] = "@libdbus@/lib/libdbus-1.so";
+ 
+ std::atomic<void*> libdbus_handle = nullptr;
+ std::mutex libdbus_mutex;
 diff --git a/src/plugin/utils.cpp b/src/plugin/utils.cpp
 index 82db99a5..491f005d 100644
 --- a/src/plugin/utils.cpp
diff --git a/pkgs/tools/backup/borgbackup/default.nix b/pkgs/tools/backup/borgbackup/default.nix
index d7853d0506f64..778f5a5aad9f5 100644
--- a/pkgs/tools/backup/borgbackup/default.nix
+++ b/pkgs/tools/backup/borgbackup/default.nix
@@ -2,54 +2,46 @@
 , stdenv
 , acl
 , e2fsprogs
+, fetchFromGitHub
 , libb2
 , lz4
 , openssh
 , openssl
-, python3Packages
+, python3
 , xxHash
 , zstd
 , installShellFiles
 , nixosTests
-, fetchPypi
 }:
 
 let
-  python = python3Packages.python.override {
-    packageOverrides = self: super: {
-      msgpack = super.msgpack.overrideAttrs (oldAttrs: rec {
-        version ="1.0.4";
-
-        src = fetchPypi {
-          pname = "msgpack";
-          inherit version;
-          hash = "sha256-9dhpwY8DAgLrQS8Iso0q/upVPWYTruieIA16yn7wH18=";
-        };
-      });
-    };
-  };
+  python = python3;
 in
 python.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.2.7";
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-9j8oozg8BBlxzsh7BhyjmoFbX9RF2ySqgXLKxBfZQRo=";
+  version = "1.2.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "borgbackup";
+    repo = "borg";
+    rev = "refs/tags/${version}";
+    hash = "sha256-+FHqOVuHlY9QUjCrYVnrMBZPMFH9Z2U7eZ6eUSINSrw=";
   };
 
   postPatch = ''
     # sandbox does not support setuid/setgid/sticky bits
     substituteInPlace src/borg/testsuite/archiver.py \
-      --replace "0o4755" "0o0755"
+      --replace-fail "0o4755" "0o0755"
   '';
 
-  nativeBuildInputs = with python.pkgs; [
+  build-system = with python.pkgs; [
     cython
     setuptools-scm
     pkgconfig
+  ];
 
+  nativeBuildInputs = with python.pkgs; [
     # docs
     sphinxHook
     guzzle-sphinx-theme
@@ -70,7 +62,7 @@ python.pkgs.buildPythonApplication rec {
     acl
   ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python.pkgs; [
     msgpack
     packaging
     (if stdenv.isLinux then pyfuse3 else llfuse)
@@ -130,7 +122,7 @@ python.pkgs.buildPythonApplication rec {
   outputs = [ "out" "doc" "man" ];
 
   meta = with lib; {
-    changelog = "https://github.com/borgbackup/borg/blob/${version}/docs/changes.rst";
+    changelog = "https://github.com/borgbackup/borg/blob/${src.rev}/docs/changes.rst";
     description = "Deduplicating archiver with compression and encryption";
     homepage = "https://www.borgbackup.org";
     license = licenses.bsd3;
diff --git a/pkgs/tools/backup/zfs-replicate/default.nix b/pkgs/tools/backup/zfs-replicate/default.nix
index c5a4d2f0317f2..1ae5c0de79fa3 100644
--- a/pkgs/tools/backup/zfs-replicate/default.nix
+++ b/pkgs/tools/backup/zfs-replicate/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonApplication rec {
   pname = "zfs_replicate";
-  version = "3.2.12";
+  version = "3.2.13";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Pyn/ehXVb5knHS1A/MFTYE0t+IVgtBe1dAnYdaHutyk=";
+    hash = "sha256-Xmg33bqs3gQJWqkCNiWYUem3o6XsxpfbHIVvLs/2D94=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/bootloaders/refind/default.nix b/pkgs/tools/bootloaders/refind/default.nix
index 9574632f4bad3..0a33305d10f7a 100644
--- a/pkgs/tools/bootloaders/refind/default.nix
+++ b/pkgs/tools/bootloaders/refind/default.nix
@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
       computers, such as all Intel-based Macs and recent (most 2011
       and later) PCs. rEFInd presents a boot menu showing all the EFI
       boot loaders on the EFI-accessible partitions, and optionally
-      BIOS-bootable partitions on Macs. EFI-compatbile OSes, including
+      BIOS-bootable partitions on Macs. EFI-compatible OSes, including
       Linux, provide boot loaders that rEFInd can detect and
       launch. rEFInd can launch Linux EFI boot loaders such as ELILO,
       GRUB Legacy, GRUB 2, and 3.3.0 and later kernels with EFI stub
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 4ba37c1502f65..d42866cdda9f9 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zstd";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "zstd";
     rev = "v${version}";
-    sha256 = "sha256-tHHHIsQU7vJySrVhJuMKUSq11MzkmC+Pcsj00uFJdnQ=";
+    hash = "sha256-qcd92hQqVBjMT3hyntjcgk29o9wGQsg5Hg7HE5C0UNc=";
   };
 
   nativeBuildInputs = [ cmake ]
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 27d7660607042..6b01e22f61695 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -239,8 +239,8 @@ let
           inherit version;
           hash = "sha256-hBSYub7GFiOxtsR+u8AjZ8B9YODhlfGXkIF/EMyNsLc=";
         };
-        pytestFlagsArray = [
-          "-W" "ignore::pytest.PytestRemovedIn8Warning"
+        disabledTests = old.disabledTests or [ ] ++ [
+          "test_export_md5_digest"
         ];
       });
 
@@ -270,7 +270,7 @@ let
     ceph-common
 
     # build time
-    cython
+    cython_0
 
     # debian/control
     bcrypt
diff --git a/pkgs/tools/filesystems/mount-zip/default.nix b/pkgs/tools/filesystems/mount-zip/default.nix
index 362ca4e2743e3..8bff2e4fb47e1 100644
--- a/pkgs/tools/filesystems/mount-zip/default.nix
+++ b/pkgs/tools/filesystems/mount-zip/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mount-zip";
-  version = "1.0.13";
+  version = "1.0.14";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mount-zip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/iPq/v7ap5livYR5tA90JiaGxQfR9VG+FONECeCFdOQ=";
+    hash = "sha256-S2snseC9JAjYRberL2/CyRQTcZQ8GtGQNU3WuTqSRl4=";
   };
 
   nativeBuildInputs = [ boost gcc icu pandoc pkg-config ];
diff --git a/pkgs/tools/inputmethods/keymapper/default.nix b/pkgs/tools/inputmethods/keymapper/default.nix
index 5cedfce201985..8886f5b691a66 100644
--- a/pkgs/tools/inputmethods/keymapper/default.nix
+++ b/pkgs/tools/inputmethods/keymapper/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "keymapper";
-  version = "3.5.3";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "houmain";
     repo = "keymapper";
     rev = finalAttrs.version;
-    hash = "sha256-CfZdLeWgeNwy9tEJ3UDRplV0sRcKE4J6d3CxC9gqdmE=";
+    hash = "sha256-a9CuLchSSfS4w3pZylzdiUr/llMsuU2qDR3mJrAupZk=";
   };
 
   # all the following must be in nativeBuildInputs
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 388dcd428c717..efcdce15bf028 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -32,19 +32,25 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "coreutils" + (optionalString (!minimal) "-full");
-  version = "9.4";
+  version = "9.5";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz";
-    hash = "sha256-6mE6TPRGEjJukXIBu7zfvTAd4h/8O1m25cB+BAsnXlI=";
+    hash = "sha256-zTKO3qyS9qZl3p8yPJO3Eq8YWLwuDYjz9xAEaUcKG4o=";
   };
 
+  patches = lib.optionals stdenv.hostPlatform.isMusl [
+    # https://lists.gnu.org/archive/html/bug-coreutils/2024-03/msg00089.html
+    ./fix-test-failure-musl.patch
+  ];
+
   postPatch = ''
     # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh
     sed '2i echo Skipping du threshold test && exit 77' -i ./tests/du/threshold.sh
     sed '2i echo Skipping cp reflink-auto test && exit 77' -i ./tests/cp/reflink-auto.sh
     sed '2i echo Skipping cp sparse test && exit 77' -i ./tests/cp/sparse.sh
+    sed '2i echo Skipping env test && exit 77' -i ./tests/env/env.sh
     sed '2i echo Skipping rm deep-2 test && exit 77' -i ./tests/rm/deep-2.sh
     sed '2i echo Skipping du long-from-unreadable test && exit 77' -i ./tests/du/long-from-unreadable.sh
 
@@ -69,6 +75,11 @@ stdenv.mkDerivation rec {
       echo "int main() { return 77; }" > "$f"
     done
 
+    # We don't have localtime in the sandbox
+    for f in gnulib-tests/{test-localtime_r.c,test-localtime_r-mt.c}; do
+      echo "int main() { return 77; }" > "$f"
+    done
+
     # intermittent failures on builders, unknown reason
     sed '2i echo Skipping du basic test && exit 77' -i ./tests/du/basic.sh
   '' + (optionalString (stdenv.hostPlatform.libc == "musl") (concatStringsSep "\n" [
diff --git a/pkgs/tools/misc/coreutils/fix-test-failure-musl.patch b/pkgs/tools/misc/coreutils/fix-test-failure-musl.patch
new file mode 100644
index 0000000000000..2d54dd27ab3fb
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/fix-test-failure-musl.patch
@@ -0,0 +1,23 @@
+From 1defda6356c29c7f731bddb9e9231f594e01d9c9
+(adjusted so it can be applied on coreutils to coreutils tarball)
+
+Reported by Adept's Lab via Pádraig Brady at
+<https://lists.gnu.org/archive/html/bug-coreutils/2024-03/msg00086.html>.
+
+diff --git a/gnulib-tests/test-canonicalize.c b/gnulib-tests/test-canonicalize.c
+index 6763a525c9..5d19285c00 100644
+--- a/gnulib-tests/test-canonicalize.c
++++ b/gnulib-tests/test-canonicalize.c
+@@ -394,9 +394,9 @@ main (void)
+     ASSERT (stat ("/", &st1) == 0);
+     ASSERT (stat ("//", &st2) == 0);
+     bool same = psame_inode (&st1, &st2);
+-#if defined __MVS__ || defined MUSL_LIBC
+-    /* On IBM z/OS and musl libc, "/" and "//" both canonicalize to
+-       themselves, yet they both have st_dev == st_ino == 1.  */
++#if defined __MVS__
++    /* On IBM z/OS, "/" and "//" both canonicalize to themselves, yet they both
++       have st_dev == st_ino == 1.  */
+     same = false;
+ #endif
+     if (same)
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 69f25a35c7397..580d01376eb87 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -79,11 +79,11 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "263";
+  version = "265";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-tKGPit8rPn/fMdEWP3cC93qakU5d7mBeRiKNQT3DBJ4=";
+    hash = "sha256-YE81R8lTOM3wmv/GIaIBqUq2O6UvnUaHjuXZ00yDU8U=";
   };
 
   outputs = [
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index fc9493be55211..27da89ceb31ac 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-FTZXfZhLplpjB6QQssz/5hXckNaR9KTdw8NRDLYOvaM=";
+    hash = "sha256-SEt/qw8ixlgRY2+fqyCmhqzLVoAw/BMl//JqQxbuB0s=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/tools/misc/leanify/default.nix b/pkgs/tools/misc/leanify/default.nix
index a8a7625bcbecd..86aef217e1100 100644
--- a/pkgs/tools/misc/leanify/default.nix
+++ b/pkgs/tools/misc/leanify/default.nix
@@ -6,19 +6,20 @@
 
 stdenv.mkDerivation rec {
   pname = "leanify";
-  version = "unstable-2023-10-19";
+  version = "unstable-2023-12-17";
 
   src = fetchFromGitHub {
     owner = "JayXon";
     repo = "Leanify";
-    rev = "5511415b02a7669f5fe9b454e5705e8328ab0359";
-    hash = "sha256-eOp/SOynh0HUz62Ki5ADRk7FjQY0Gh55ydVnO0MCXAA=";
+    rev = "9daa4303cdc03f6b90b72c369e6377c6beb75c39";
+    hash = "sha256-fLazKCQnOT3bN3Kz25Q80RLk54EU5U6HCf6kPLcXn9c=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace Makefile \
-      --replace "-flto" "" \
-      --replace "lib/LZMA/Alloc.o" "lib/LZMA/CpuArch.o lib/LZMA/Alloc.o"
+      --replace-fail "-flto" "" \
+      --replace-fail "lib/LZMA/Alloc.o" "lib/LZMA/CpuArch.o lib/LZMA/Alloc.o" \
+      --replace-quiet "-Werror" ""
   '';
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index e5829a56a8b43..8e2365f475d25 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-db";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/man-db-${version}.tar.xz";
-    hash = "sha256-QVpihKInZK0i/w9mcQ2FO+d5DdRRzXFDbj0lx02ZapU=";
+    hash = "sha256-3e4kna63jPkrq3lMzQacyLV1mSJl6iDiOeiHFW6IAmU=";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/tools/misc/markdown-anki-decks/default.nix b/pkgs/tools/misc/markdown-anki-decks/default.nix
index 082bdf5a5f98a..3632bc2ff6053 100644
--- a/pkgs/tools/misc/markdown-anki-decks/default.nix
+++ b/pkgs/tools/misc/markdown-anki-decks/default.nix
@@ -6,18 +6,23 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "markdown-anki-decks";
   version = "1.1.1";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-SvKjjE629OwxWsPo2egGf2K6GzlWAYYStarHhA4Ex0w=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'typer = "^0.4.0"' 'typer = "*"'
+  '';
+
+  build-system = with python3.pkgs; [
     poetry-core
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     beautifulsoup4
     genanki
     markdown
@@ -25,11 +30,6 @@ python3.pkgs.buildPythonApplication rec {
     typer
   ] ++ typer.optional-dependencies.all;
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'typer = "^0.4.0"' 'typer = "*"'
-  '';
-
   # No tests available on Pypi and there is only a failing version assertion test in the repo.
   doCheck = false;
 
@@ -40,6 +40,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Tool to convert Markdown files into Anki Decks";
     homepage = "https://github.com/lukesmurray/markdown-anki-decks";
+    changelog = "https://github.com/lukesmurray/markdown-anki-decks/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/misc/phrase-cli/default.nix b/pkgs/tools/misc/phrase-cli/default.nix
index e780f451040b4..c06b1d386768d 100644
--- a/pkgs/tools/misc/phrase-cli/default.nix
+++ b/pkgs/tools/misc/phrase-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "phrase-cli";
-  version = "2.23.2";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = version;
-    sha256 = "sha256-CzDkIFlStfCJpF82pqD8hTxbjH9Nu+0/uygTR0xxxV4=";
+    sha256 = "sha256-i1gf/xTdZaseUiu70i0Yh+DZlRoJjKYG1Q+D7uUyMl8=";
   };
 
-  vendorHash = "sha256-r07nHJqFWHAMTkmQmy0/jK7N/lDzpnHqmuGTG1FTUiI=";
+  vendorHash = "sha256-+UjUk2Uf4ESHkUSM9X+a3fBF05cVsQ4JwPn93hbELLs=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];
 
diff --git a/pkgs/tools/misc/plocate/default.nix b/pkgs/tools/misc/plocate/default.nix
index d4ea53b2301f9..b44cb0b148607 100644
--- a/pkgs/tools/misc/plocate/default.nix
+++ b/pkgs/tools/misc/plocate/default.nix
@@ -33,9 +33,6 @@ stdenv.mkDerivation rec {
     "-Ddbpath=locatedb"
   ];
 
-  # https://github.com/NixOS/nixpkgs/issues/300635
-  postInstall = ''chmod -R u-s,g-s "$out"'';
-
   meta = with lib; {
     description = "Much faster locate";
     homepage = "https://plocate.sesse.net/";
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index f8565e8642319..1dc464fe36464 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.8.3";
+  version = "5.8.4";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qLB0HJXH99t/rfsbed3NHgcy8ZGB4K+HjPjhCZ0pM6Q=";
+    sha256 = "sha256-VTg+GDyPAxyxXP9VgKi63LhBKhuVx6rPWc9o/fRmHho=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
diff --git a/pkgs/tools/misc/thefuck/default.nix b/pkgs/tools/misc/thefuck/default.nix
index 150913c31d131..48d4f395b0474 100644
--- a/pkgs/tools/misc/thefuck/default.nix
+++ b/pkgs/tools/misc/thefuck/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, buildPythonApplication
 , colorama, decorator, psutil, pyte, six
-, go, mock, pytestCheckHook, pytest-mock, pytest_7
+, go, mock, pytest7CheckHook, pytest-mock
 }:
 
 buildPythonApplication rec {
@@ -16,7 +16,7 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [ colorama decorator psutil pyte six ];
 
-  nativeCheckInputs = [ go mock (pytestCheckHook.override { pytest = pytest_7; }) pytest-mock ];
+  nativeCheckInputs = [ go mock pytest7CheckHook pytest-mock ];
 
   disabledTests = lib.optionals stdenv.isDarwin [
     "test_settings_defaults"
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index c2438f1b5777a..6559a5cf4ecb0 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -49,14 +49,14 @@ assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsS
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.6.0";
+  version = "8.7.1";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
       "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-PM1V2Rr5UWU534BiX4GMc03G8uz5utozx2dl6ZEh2xU=";
+    hash = "sha256-b+oqrGpGEPvQQAr7C83b5yWKZMY/H2jlhV68DGWXEM0=";
   };
 
   postPatch = ''
@@ -196,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
       # nginx-http3 = useThisCurl nixosTests.nginx-http3;
       nginx-http3 = nixosTests.nginx-http3;
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    } // lib.optionalAttrs (stdenv.hostPlatform.system != "x86_64-darwin") {
       static = pkgsStatic.curl;
     } // lib.optionalAttrs (!stdenv.isDarwin) {
       fetchpatch = tests.fetchpatch.simple.override { fetchpatch = (fetchpatch.override { fetchurl = useThisCurl fetchurl; }) // { version = 1; }; };
@@ -210,7 +211,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with maintainers; [ lovek323 ];
     platforms = platforms.all;
     # Fails to link against static brotli or gss
-    broken = stdenv.hostPlatform.isStatic && (brotliSupport || gssSupport);
+    broken = (stdenv.hostPlatform.isStatic && (brotliSupport || gssSupport || stdenv.hostPlatform.system == "x86_64-darwin")) || rustlsSupport;
     pkgConfigModules = [ "libcurl" ];
     mainProgram = "curl";
   };
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 8b2dff9e462b7..e9f010e89dd31 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.67.0";
+  version = "0.70.0";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "dnsproxy";
     rev = "v${version}";
-    hash = "sha256-CqEvGE1MSll+khEFvH8Y0q4XyxbTjwNRr9h9FKf5Kfs=";
+    hash = "sha256-kXIUcTT3LGhKeUVlq/hDvO6/y/mQNIFBhJLSe1F89EI=";
   };
 
-  vendorHash = "sha256-AZQl70NJwE6lVMO/G1RG1NIfXK1SbYWh4/wAIi4Ac5o=";
+  vendorHash = "sha256-ECi6NciA5oyUyVaVlON4mAPKoWQSDvgV0uwk5MGYjy4=";
 
   ldflags = [ "-s" "-w" "-X" "github.com/AdguardTeam/dnsproxy/internal/version.version=${version}" ];
 
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index cd18dbf5ee0e0..a8adbf7a7d0ea 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.56.0";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FQtbR4tiFRtMwawf9rdsK/U0bwJFvfXmzqM/ZU+Yhi0=";
+    hash = "sha256-TE00xGHe8Dhm9rxD3zlB4Cf8OasPsZQhxoqXFSsSDL8=";
   };
 
-  vendorHash = "sha256-W+H7PxpG3MuioN+nEeX4tArVSDuhQ2LD+927mhPaLas=";
+  vendorHash = "sha256-WtpsgN3zf2fELJ1yXWYSEkqXe1Fx+j3uwoJx6Q17OU8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/juicity/default.nix b/pkgs/tools/networking/juicity/default.nix
index 3278a5a45b605..5ced17c74824a 100644
--- a/pkgs/tools/networking/juicity/default.nix
+++ b/pkgs/tools/networking/juicity/default.nix
@@ -4,13 +4,13 @@
 }:
 buildGoModule rec {
   pname = "juicity";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "juicity";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-rwGtAystB9rUE2jVij4YdBr4T8bVlVLtNaBmSZQ/39A=";
+    hash = "sha256-JC4VGM7aY+fYo0F9yAkgTbZA56ztyeoIx9PARlBjkh4=";
   };
 
   vendorHash = "sha256-SM5ZrTtuqenPsGjphkCM9JHzucw0/qBmevD+3/kyF6k=";
diff --git a/pkgs/tools/networking/knock/package.nix b/pkgs/tools/networking/knock/package.nix
index b9879859722a6..1197bec808cff 100644
--- a/pkgs/tools/networking/knock/package.nix
+++ b/pkgs/tools/networking/knock/package.nix
@@ -1,6 +1,6 @@
 { lib
 , buildGoModule
-, fetchFromGitHub
+, fetchFromGitea
 , installShellFiles
 }:
 
@@ -8,11 +8,12 @@ buildGoModule rec {
   pname = "knock";
   version = "0.0.2";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
     owner = "nat-418";
     repo ="knock";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-VXrWphfBDGDNsz4iuUdwwd46oqnmhJ9i3TtzMqHoSJk=";
+    rev = "v${version}";
+    hash = "sha256-K+L4F4bTERQSqISAmfyps/U5GJ2N0FdJ3RmpiUmt4uA=";
   };
 
   vendorHash = "sha256-wkSXdIgfkHbVJYsgm/hLAeKA9geof92U3mzSzt7eJE8=";
@@ -27,9 +28,9 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "A simple CLI network reachability tester";
-    homepage = "https://github.com/nat-418/knock";
+    homepage = "https://codeberg.org/nat-418/knock";
     license = licenses.bsd0;
-    changelog = "https://github.com/nat-418/knock/blob/${version}/CHANGELOG.md";
+    changelog = "https://codeberg.org/nat-418/knock/raw/branch/trunk/CHANGELOG.md";
     maintainers = with maintainers; [ nat-418 ];
   };
 }
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 12bd432c7329c..1fc7c0fd59f40 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , nixosTests
 , pkg-config
 , systemd
@@ -46,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libreswan";
-  version = "4.12";
+  version = "4.15";
 
   src = fetchurl {
     url = "https://download.libreswan.org/${pname}-${version}.tar.gz";
-    hash = "sha256-roWr5BX3vs9LaiuYl+FxLyflqsnDXfvd28zgrX39mfc=";
+    hash = "sha256-/mDX2zmMjuIlBV2zZeyWiiSuvLxcNQYRMfz/2tG+BK8=";
   };
 
   strictDeps = true;
@@ -115,14 +114,6 @@ stdenv.mkDerivation rec {
         -i configs/Makefile
   '';
 
-  patches = [
-    (fetchpatch {
-      name = "ignoring-return-value.patch";
-      url = "https://github.com/libreswan/libreswan/commit/ba5bad09f55959872022fa506d5ac06eafe3a314.diff";
-      hash = "sha256-xJ8rZWoRtJixamGY8sjOS+63Lw3RX7620HlRWYfvSxc=";
-    })
-  ];
-
   makeFlags = [
     "PREFIX=$(out)"
     "INITSYSTEM=systemd"
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index 9e27fd8e3f93b..3b09ddf5694d6 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2024-03-30T15-29-52Z";
+  version = "2024-04-18T16-45-29Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-xt/WDQFE4uw/eno8RSIjxgjpahjbJVMMOapleuv5avE=";
+    sha256 = "sha256-aEhkk1nB8CGzuZfD8a62RwzcvF2HZTm1LPfb13c6x9Q=";
   };
 
-  vendorHash = "sha256-RwhkR3uQreSO1tq8R7ip7CY7E88MRa151HV8rT68YdQ=";
+  vendorHash = "sha256-qb4gR//8UzJAJ5WthfyxYwhR3YCwUGxfy8aRMW2MXks=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/networking/ockam/default.nix b/pkgs/tools/networking/ockam/default.nix
index 2d477923dde80..c191efbff6e1a 100644
--- a/pkgs/tools/networking/ockam/default.nix
+++ b/pkgs/tools/networking/ockam/default.nix
@@ -7,6 +7,7 @@
 , pkg-config
 , openssl
 , dbus
+, AppKit
 , Security
 }:
 
@@ -21,43 +22,23 @@ rustPlatform.buildRustPackage {
     owner = "build-trust";
     repo = pname;
     rev = "ockam_v${version}";
-    hash = "sha256-qHvgqK8K6F69m511VbNcSNFVe/tKpf8uonsBIOz3uKA=";
+    hash = "sha256-WXkprfA7DY3ZKCtTkVYMqYxyhLbfXPbXhYd0Oj5mJ+w=";
   };
 
-  cargoHash = "sha256-1MCiC808VNg5SoHxomJ9WWJ1Pj0IrLky6nshHfK2Fpg=";
+  cargoHash = "sha256-TLNV+6n9J9rhf8Lck0HK+ZNPDDh8C+M+MLbIWBS8cO0=";
   nativeBuildInputs = [ git pkg-config ];
   buildInputs = [ openssl dbus ]
-    ++ lib.optionals stdenv.isDarwin [ Security ];
+    ++ lib.optionals stdenv.isDarwin [ AppKit Security ];
 
   passthru.updateScript = nix-update-script { };
 
   # too many tests fail for now
   doCheck = false;
-  # checkFlags = [
-  #   # tries to make a network access
-  #   "--skip=tests::curl_http_ockam"
-  #   "--skip=medium_file_transfer"
-  #   "--skip=medium_file_transfer_large_chunks"
-  #   "--skip=medium_file_transfer_small_chunks"
-  #   "--skip=tiny_file_transfer"
-  #   "--skip=tiny_file_transfer_small_chunks"
-  #   # tries to do IO
-  #   "--skip=cli_state::tests::integration"
-  #   "--skip=cli_state::tests::test_create_default_identity_state"
-  #   "--skip=cli_state::tests::test_create_named_identity_state"
-  #   "--skip=kafka::integration_test::test::producer__flow_with_mock_kafka__content_encryption_and_decryption"
-  #   "--skip=kafka::portal_worker::test::kafka_portal_worker__metadata_exchange__response_changed"
-  #   "--skip=full_flow"
-  #   "--skip=run::parser::tests::detect_circular_dependency"
-  #   "--skip=run::parser::tests::test_parse_config_with_depends_on"
-  #   "--skip=util::tests::test_process_multi_addr"
-  # ];
 
   meta = with lib; {
     description = "Orchestrate end-to-end encryption, cryptographic identities, mutual authentication, and authorization policies between distributed applications – at massive scale";
     homepage = "https://github.com/build-trust/ockam";
     license = licenses.mpl20;
     maintainers = with maintainers; [ happysalada ];
-    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/openapi-generator-cli/default.nix b/pkgs/tools/networking/openapi-generator-cli/default.nix
index 4ae4325abf150..215d2466d4c82 100644
--- a/pkgs/tools/networking/openapi-generator-cli/default.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/default.nix
@@ -1,7 +1,7 @@
 { callPackage, lib, stdenv, fetchurl, jre, makeWrapper }:
 
 let this = stdenv.mkDerivation (finalAttrs: {
-  version = "7.4.0";
+  version = "7.5.0";
   pname = "openapi-generator-cli";
 
   jarfilename = "${finalAttrs.pname}-${finalAttrs.version}.jar";
@@ -12,7 +12,7 @@ let this = stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://maven/org/openapitools/${finalAttrs.pname}/${finalAttrs.version}/${finalAttrs.jarfilename}";
-    sha256 = "sha256-5CdpqY/vVjS+4Pkh5LkHhqazKSqhH+jS+EwEWsQ1qyk=";
+    sha256 = "sha256-R+u9G+3a99++5SPnuHYjxuwbHUKWD74V9srS9kJsab8=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 617f5f03f1c30..45c794a532eb3 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , openssl
 , nettle
 , expat
@@ -51,37 +50,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.19.2";
+  version = "1.19.3";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${finalAttrs.version}.tar.gz";
-    hash = "sha256-zFYNNFc0ImwbOecadpeX5/3eImXLt3685UJwS7pInlU=";
+    hash = "sha256-OuMivn3C+DFgPksDkUNVM61YYcIyLjSnYAap+2XrVrk=";
   };
 
-
-  # Cherry pick some already merged upstream patches for configure
-  patches = [
-    # Search for protobuf-c with pkg-config
-    # https://github.com/NLnetLabs/unbound/pull/999
-    (fetchpatch {
-      url = "https://github.com/NLnetLabs/unbound/commit/59d98b9ef64e597c331c27160715d7a1b40c8638.patch";
-      hash = "sha256-DvYoYBTXOwbR8Z0GRgt724WqX3dbIEOdICU2/VMRSVQ=";
-    })
-    # Fix for previous patch
-    # https://github.com/NLnetLabs/unbound/issues/1006
-    (fetchpatch {
-      url = "https://github.com/NLnetLabs/unbound/commit/93490a0fc1bf9e62e6edcd6b69f1463c7ac410e9.patch";
-      hash = "sha256-mBo63ZlayD3YkOgIoQN0dG+xuFq/BxcjBmSo1vapiYA=";
-      excludes = [ "doc/Changelog" ];
-    })
-    # Fix for previous patch
-    # https://github.com/NLnetLabs/unbound/commit/3f5175584b0bb9ff7d417bc195ec6e4316ae58d3
-    (fetchpatch {
-      url = "https://github.com/NLnetLabs/unbound/commit/3f5175584b0bb9ff7d417bc195ec6e4316ae58d3.patch";
-      hash = "sha256-DcWfvmk+4K3c9Z+4grwzEGIkEBYNpbTK3xuBqRI33fY=";
-    })
-  ];
-
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
 
   nativeBuildInputs =
diff --git a/pkgs/tools/nix/nixci/default.nix b/pkgs/tools/nix/nixci/default.nix
index bc78b3aab59a5..dbbc7ae1cc4f4 100644
--- a/pkgs/tools/nix/nixci/default.nix
+++ b/pkgs/tools/nix/nixci/default.nix
@@ -6,23 +6,31 @@
 , openssl
 , pkg-config
 , Security
+, SystemConfiguration
+, IOKit
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nixci";
-  version = "0.2.0";
+  version = "0.4.0";
 
   src = fetchCrate {
     inherit version;
     pname = "nixci";
-    hash = "sha256-Q3V/JL64xkIj0X0NSMRTjRAP3PJC9ouj3CmEscVWdns=";
+    hash = "sha256-JC1LUny8UKflANlcx6Hcgx39CRry+ossnp/RQK36oaI=";
   };
 
-  cargoHash = "sha256-tjk91AaPsMLfXYB2o1HTTxb6Qr3l8BABPStrKEGvbtM=";
+  cargoHash = "sha256-pYPzM7QlQ2EXwrvuXMa1qs0m7cmumh1iPesgJZ0H2kg=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libiconv openssl ]
-    ++ lib.optionals stdenv.isDarwin [ Security ];
+
+  buildInputs = lib.optionals stdenv.isLinux [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    IOKit
+    Security
+    SystemConfiguration
+  ];
 
   # The rust program expects an environment (at build time) that points to the
   # devour-flake flake.
@@ -37,7 +45,7 @@ rustPlatform.buildRustPackage rec {
     description = "Define and build CI for Nix projects anywhere";
     homepage = "https://github.com/srid/nixci";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ srid ];
+    maintainers = with maintainers; [ srid shivaraj-bh ];
     mainProgram = "nixci";
   };
 }
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index 69e5db4b0aeb6..b04c59369f185 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -266,7 +266,7 @@ self = stdenv.mkDerivation {
       environments.
     '';
     homepage = "https://nixos.org/";
-    license = licenses.lgpl2Plus;
+    license = licenses.lgpl21Plus;
     inherit maintainers;
     platforms = platforms.unix;
     outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 541787942a0ee..e931ca16de7e8 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
   propagatedBuildInputs = [ popt nss db bzip2 libarchive libbfd ]
-    ++ lib.optional stdenv.isLinux elfutils;
+    ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform elfutils) elfutils;
 
   env.NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
 
diff --git a/pkgs/tools/security/afl/README.md b/pkgs/tools/security/afl/README.md
deleted file mode 100644
index 180cad6bc4ca6..0000000000000
--- a/pkgs/tools/security/afl/README.md
+++ /dev/null
@@ -1,19 +0,0 @@
-Updating the QEMU patches
-=========================
-
-When updating to the latest American Fuzzy Lop, make sure to check for
-any new patches to qemu for binary fuzzing support:
-
-https://github.com/google/AFL/tree/master/qemu_mode
-
-Be sure to check the build script and make sure it's also using the
-right QEMU version and options in `qemu.nix`:
-
-https://github.com/google/AFL/blob/master/qemu_mode/build_qemu_support.sh
-
-`afl-config.h`, `afl-types.h`, and `afl-qemu-cpu-inl.h` are part of
-the afl source code, and copied from `config.h`, `types.h` and
-`afl-qemu-cpu-inl.h` appropriately. These files and the QEMU patches
-need to be slightly adjusted to fix their `#include`s (the patches
-try to otherwise include files like `../../config.h` which causes the
-build to fail).
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
deleted file mode 100644
index ccdbd78716d96..0000000000000
--- a/pkgs/tools/security/afl/default.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, callPackage, makeWrapper
-, clang, llvm, which, libcgroup
-}:
-
-let
-  afl-qemu = callPackage ./qemu.nix { inherit afl; };
-  qemu-exe-name = if stdenv.hostPlatform.system == "x86_64-linux" then "qemu-x86_64"
-    else if stdenv.hostPlatform.system == "i686-linux" then "qemu-i386"
-    else throw "afl: no support for ${stdenv.hostPlatform.system}!";
-  afl = stdenv.mkDerivation rec {
-    pname = "afl";
-    version = "2.57b";
-
-    src = fetchFromGitHub {
-      owner = "google";
-      repo = pname;
-      rev = "v${version}";
-      sha256 = "0fqj3g6ds1f21kxz7m9mc1fspi9r4jg9jcmi60inwxijrc5ncvr6";
-    };
-    enableParallelBuilding = true;
-
-    # Note: libcgroup isn't needed for building, just for the afl-cgroup
-    # script.
-    nativeBuildInputs = [ makeWrapper which llvm.dev ];
-    buildInputs = [ llvm ];
-
-    makeFlags = [ "PREFIX=$(out)" ];
-    postBuild = ''
-      make -C llvm_mode $makeFlags -j$NIX_BUILD_CORES
-    '';
-    postInstall = ''
-      # Install the custom QEMU emulator for binary blob fuzzing.
-      cp ${afl-qemu}/bin/${qemu-exe-name} $out/bin/afl-qemu-trace
-
-      # Install the cgroups wrapper for asan-based fuzzing.
-      cp experimental/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup
-      chmod +x $out/bin/afl-cgroup
-      substituteInPlace $out/bin/afl-cgroup \
-        --replace "cgcreate" "${libcgroup}/bin/cgcreate" \
-        --replace "cgexec"   "${libcgroup}/bin/cgexec" \
-        --replace "cgdelete" "${libcgroup}/bin/cgdelete"
-
-      # Patch shebangs before wrapping
-      patchShebangs $out/bin
-
-      # Wrap afl-clang-fast(++) with a *different* AFL_PATH, because it
-      # has totally different semantics in that case(?) - and also set a
-      # proper AFL_CC and AFL_CXX so we don't pick up the wrong one out
-      # of $PATH.
-      # first though we need to replace the afl-clang-fast++ symlink with
-      # a real copy to prevent wrapProgram skipping the symlink and confusing
-      # nix's cc wrapper
-      rm $out/bin/afl-clang-fast++
-      cp $out/bin/afl-clang-fast $out/bin/afl-clang-fast++
-      for x in $out/bin/afl-clang-fast $out/bin/afl-clang-fast++; do
-        wrapProgram $x \
-          --prefix AFL_PATH : "$out/lib/afl" \
-          --run 'export AFL_CC=''${AFL_CC:-${clang}/bin/clang} AFL_CXX=''${AFL_CXX:-${clang}/bin/clang++}'
-      done
-    '';
-
-    passthru.qemu = afl-qemu;
-
-    meta = {
-      description = "Powerful fuzzer via genetic algorithms and instrumentation";
-      longDescription = ''
-        American fuzzy lop is a fuzzer that employs a novel type of
-        compile-time instrumentation and genetic algorithms to
-        automatically discover clean, interesting test cases that
-        trigger new internal states in the targeted binary. This
-        substantially improves the functional coverage for the fuzzed
-        code. The compact synthesized corpora produced by the tool are
-        also useful for seeding other, more labor or resource-intensive
-        testing regimes down the road.
-      '';
-      homepage    = "https://lcamtuf.coredump.cx/afl/";
-      license     = lib.licenses.asl20;
-      platforms   = ["x86_64-linux" "i686-linux"];
-      maintainers = with lib.maintainers; [ thoughtpolice ris ];
-    };
-  };
-in afl
diff --git a/pkgs/tools/security/afl/libdislocator.nix b/pkgs/tools/security/afl/libdislocator.nix
deleted file mode 100644
index 1030ffaf9eb85..0000000000000
--- a/pkgs/tools/security/afl/libdislocator.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, stdenv, afl}:
-
-stdenv.mkDerivation {
-  version = lib.getVersion afl;
-  pname = "libdislocator";
-
-  src = afl.src;
-  sourceRoot = "${afl.src.name}/libdislocator";
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  preInstall = ''
-    mkdir -p $out/lib/afl
-  '';
-  postInstall = ''
-    mkdir $out/bin
-    cat > $out/bin/get-libdislocator-so <<END
-    #!${stdenv.shell}
-    echo $out/lib/afl/libdislocator.so
-    END
-    chmod +x $out/bin/get-libdislocator-so
-  '';
-
-  meta = with lib; {
-    homepage = "https://lcamtuf.coredump.cx/afl/";
-    description = ''
-      Drop-in replacement for the libc allocator which improves
-      the odds of bumping into heap-related security bugs in
-      several ways.
-    '';
-    mainProgram = "get-libdislocator-so";
-    license = lib.licenses.asl20;
-    maintainers = with maintainers; [ ris ];
-  };
-}
diff --git a/pkgs/tools/security/afl/qemu-patches/no-etc-install.patch b/pkgs/tools/security/afl/qemu-patches/no-etc-install.patch
deleted file mode 100644
index 5dfbfd780f1ca..0000000000000
--- a/pkgs/tools/security/afl/qemu-patches/no-etc-install.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/Makefile b/Makefile
-index d6b9dc1..ce7c493 100644
---- a/Makefile
-+++ b/Makefile
-@@ -601,7 +601,7 @@ install-localstatedir:
- endif
- 
- 
--install: all $(if $(BUILD_DOCS),install-doc) install-datadir install-localstatedir
-+install: all $(if $(BUILD_DOCS),install-doc) install-datadir
- ifneq ($(TOOLS),)
- 	$(call install-prog,$(subst qemu-ga,qemu-ga$(EXESUF),$(TOOLS)),$(DESTDIR)$(bindir))
- endif
diff --git a/pkgs/tools/security/afl/qemu-patches/syscall-glibc2_30.diff b/pkgs/tools/security/afl/qemu-patches/syscall-glibc2_30.diff
deleted file mode 100644
index aa2950bf157c7..0000000000000
--- a/pkgs/tools/security/afl/qemu-patches/syscall-glibc2_30.diff
+++ /dev/null
@@ -1,51 +0,0 @@
---- qemu-2.10.0-clean/linux-user/syscall.c	2020-03-12 18:47:47.898592169 +0100
-+++ qemu-2.10.0/linux-user/syscall.c	2020-03-13 09:13:42.461809699 +0100
-@@ -34,6 +34,7 @@
- #include <sys/resource.h>
- #include <sys/swap.h>
- #include <linux/capability.h>
-+#include <linux/sockios.h> // https://lkml.org/lkml/2019/6/3/988
- #include <sched.h>
- #include <sys/timex.h>
- #ifdef __ia64__
-@@ -256,7 +257,9 @@ static type name (type1 arg1,type2 arg2,
- #endif
- 
- #ifdef __NR_gettid
--_syscall0(int, gettid)
-+// taken from https://patchwork.kernel.org/patch/10862231/
-+#define __NR_sys_gettid __NR_gettid
-+_syscall0(int, sys_gettid)
- #else
- /* This is a replacement for the host gettid() and must return a host
-    errno. */
-@@ -6219,7 +6222,7 @@ static void *clone_func(void *arg)
-     cpu = ENV_GET_CPU(env);
-     thread_cpu = cpu;
-     ts = (TaskState *)cpu->opaque;
--    info->tid = gettid();
-+    info->tid = sys_gettid();
-     task_settid(ts);
-     if (info->child_tidptr)
-         put_user_u32(info->tid, info->child_tidptr);
-@@ -6363,9 +6366,9 @@ static int do_fork(CPUArchState *env, un
-                mapping.  We can't repeat the spinlock hack used above because
-                the child process gets its own copy of the lock.  */
-             if (flags & CLONE_CHILD_SETTID)
--                put_user_u32(gettid(), child_tidptr);
-+                put_user_u32(sys_gettid(), child_tidptr);
-             if (flags & CLONE_PARENT_SETTID)
--                put_user_u32(gettid(), parent_tidptr);
-+                put_user_u32(sys_gettid(), parent_tidptr);
-             ts = (TaskState *)cpu->opaque;
-             if (flags & CLONE_SETTLS)
-                 cpu_set_tls (env, newtls);
-@@ -11402,7 +11405,7 @@ abi_long do_syscall(void *cpu_env, int n
-         break;
- #endif
-     case TARGET_NR_gettid:
--        ret = get_errno(gettid());
-+        ret = get_errno(sys_gettid());
-         break;
- #ifdef TARGET_NR_readahead
-     case TARGET_NR_readahead:
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
deleted file mode 100644
index 845d9fa3e6f15..0000000000000
--- a/pkgs/tools/security/afl/qemu.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ lib, stdenv, fetchurl, afl, python2, zlib, pkg-config, glib, perl
-, texinfo, libuuid, flex, bison, pixman, autoconf
-}:
-
-let
-  cpuTarget = if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux-user"
-    else if stdenv.hostPlatform.system == "i686-linux" then "i386-linux-user"
-    else throw "afl: no support for ${stdenv.hostPlatform.system}!";
-in
-stdenv.mkDerivation rec {
-  pname = "afl-qemu";
-  version = "2.10.0";
-
-  srcs = [
-    (fetchurl {
-      url = "https://download.qemu.org/qemu-${version}.tar.bz2";
-      sha256 = "0j3dfxzrzdp1w21k21fjvmakzc6lcha1rsclaicwqvbf63hkk7vy";
-    })
-    afl.src
-  ];
-
-  sourceRoot = "qemu-${version}";
-
-  postUnpack = ''
-    cp ${afl.src.name}/types.h $sourceRoot/afl-types.h
-    substitute ${afl.src.name}/config.h $sourceRoot/afl-config.h \
-      --replace "types.h" "afl-types.h"
-    substitute ${afl.src.name}/qemu_mode/patches/afl-qemu-cpu-inl.h $sourceRoot/afl-qemu-cpu-inl.h \
-      --replace "../../config.h" "afl-config.h"
-    substituteInPlace ${afl.src.name}/qemu_mode/patches/cpu-exec.diff \
-      --replace "../patches/afl-qemu-cpu-inl.h" "afl-qemu-cpu-inl.h"
-  '';
-
-  nativeBuildInputs = [
-    python2 perl pkg-config flex bison autoconf texinfo
-  ];
-
-  buildInputs = [
-    zlib glib pixman libuuid
-  ];
-
-  enableParallelBuilding = true;
-
-  patches = [
-    # patches extracted from afl source
-    "../${afl.src.name}/qemu_mode/patches/cpu-exec.diff"
-    "../${afl.src.name}/qemu_mode/patches/elfload.diff"
-    "../${afl.src.name}/qemu_mode/patches/syscall.diff"
-    "../${afl.src.name}/qemu_mode/patches/configure.diff"
-    "../${afl.src.name}/qemu_mode/patches/memfd.diff"
-    # nix-specific patches to make installation more well-behaved
-    ./qemu-patches/no-etc-install.patch
-    # patch for fixing qemu build on glibc >= 2.30
-    ./qemu-patches/syscall-glibc2_30.diff
-  ];
-
-  configureFlags =
-    [ "--disable-system"
-      "--enable-linux-user"
-      "--disable-gtk"
-      "--disable-sdl"
-      "--disable-vnc"
-      "--disable-kvm"
-      "--target-list=${cpuTarget}"
-      "--enable-pie"
-      "--sysconfdir=/etc"
-      "--localstatedir=/var"
-    ];
-
-  meta = with lib; {
-    homepage = "https://www.qemu.org/";
-    description = "Fork of QEMU with AFL instrumentation support";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ thoughtpolice ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index b1e59b4551154..50b1860535eb3 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "10.12.2";
+  version = "11.0.2";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FpUWCIMpBfJDEQKNwKjDSH5u2dxh9jO97cfmj77IdAc=";
+    hash = "sha256-TSTOhfFNFwuF9kNf1q2HVcoxhKS1pKW4kSorSPyyeQU=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-7Cor+SYujUKdXwWzBNT5POkNnxtnEPE5iffNbFbVfys=";
+  vendorHash = "sha256-Uuz/ghtd/1ol1ugDI7pz5Fyv6U5PpOdcoerU/qx4MPA=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 8efface2051a5..5c3019eb7979f 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-04-16";
+  version = "2024-04-20";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-ExtWNve7YGkr6JHjzw39FJZwSNFLEJNurEn5uWwSlbY=";
+    hash = "sha256-mz82w3maizWnaWcBqMFYgCNN9uwhSgo9D4j+XCvZDW0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index cc3ae15e9a1c7..721c99dc4de9a 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     "--with-libgcrypt-prefix=${libgcrypt.dev}"
     "--with-libassuan-prefix=${libassuan.dev}"
     "--with-ksba-prefix=${libksba.dev}"
-    "--with-npth-prefix=${npth}"
+    "GPGRT_CONFIG=${lib.getDev libgpg-error}/bin/gpgrt-config"
   ]
   ++ lib.optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentry.binaryPath or "bin/pinentry"}"
   ++ lib.optional withTpm2Tss "--with-tss=intel"
diff --git a/pkgs/tools/security/keepwn/default.nix b/pkgs/tools/security/keepwn/default.nix
index 1d9c740960f32..9c878f37fd0c8 100644
--- a/pkgs/tools/security/keepwn/default.nix
+++ b/pkgs/tools/security/keepwn/default.nix
@@ -1,26 +1,25 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, python3
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "keepwn";
-  version = "0.3";
+  version = "0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Orange-Cyberdefense";
     repo = "KeePwn";
     rev = "refs/tags/${version}";
-    hash = "sha256-haKWuoTtyC9vIise+gznruHEwMIDz1W6euihLLKnSdc=";
+    hash = "sha256-AkqBC65XrMt4V5KgzLepnQoqpdvbrtWLY3DmVuy8Zck=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     chardet
     impacket
     lxml
@@ -37,16 +36,14 @@ python3.pkgs.buildPythonApplication rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "keepwn"
-  ];
+  pythonImportsCheck = [ "keepwn" ];
 
   meta = with lib; {
     description = "Tool to automate KeePass discovery and secret extraction";
-    mainProgram = "keepwn";
     homepage = "https://github.com/Orange-Cyberdefense/KeePwn";
     changelog = "https://github.com/Orange-Cyberdefense/KeePwn/releases/tag/${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "keepwn";
   };
 }
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index a5b308981a8c5..2adc7f605c817 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.3"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.5"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 1f700eb547616..1496f83026256 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 3855e135a14eec07e12f3d26416713a691b3c149
-  ref: refs/tags/6.4.3
+  revision: 6dfd13e04c9e9763b485a5b7d6e85d97632a8edf
+  ref: refs/tags/6.4.5
   specs:
-    metasploit-framework (6.4.3)
+    metasploit-framework (6.4.5)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
@@ -135,29 +135,29 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.3.0)
-    aws-partitions (1.895.0)
-    aws-sdk-core (3.191.3)
+    aws-partitions (1.916.0)
+    aws-sdk-core (3.192.1)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.8)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.440.0)
+    aws-sdk-ec2 (1.450.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-ec2instanceconnect (1.37.0)
+    aws-sdk-ec2instanceconnect (1.38.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-iam (1.94.0)
+    aws-sdk-iam (1.96.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-kms (1.77.0)
+    aws-sdk-kms (1.79.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.143.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-s3 (1.147.0)
+      aws-sdk-core (~> 3, >= 3.192.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.8)
-    aws-sdk-ssm (1.165.0)
+    aws-sdk-ssm (1.166.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
     aws-sigv4 (1.8.0)
@@ -165,7 +165,7 @@ GEM
     base64 (0.2.0)
     bcrypt (3.1.20)
     bcrypt_pbkdf (1.1.0)
-    bigdecimal (3.1.6)
+    bigdecimal (3.1.7)
     bindata (2.4.15)
     bootsnap (1.18.3)
       msgpack (~> 1.2)
@@ -177,7 +177,7 @@ GEM
     crass (1.0.6)
     daemons (1.4.1)
     date (3.3.4)
-    dnsruby (1.70.0)
+    dnsruby (1.72.1)
       simpleidn (~> 0.2.1)
     domain_name (0.6.20240107)
     ed25519 (1.3.0)
@@ -191,13 +191,13 @@ GEM
       eventmachine (>= 1.0.0.beta.4)
     erubi (1.12.0)
     eventmachine (1.2.7)
-    faker (3.2.3)
+    faker (3.3.1)
       i18n (>= 1.8.11, < 2)
     faraday (2.9.0)
       faraday-net_http (>= 2.0, < 3.2)
     faraday-net_http (3.1.0)
       net-http
-    faraday-retry (2.2.0)
+    faraday-retry (2.2.1)
       faraday (~> 2.0)
     faye-websocket (0.11.3)
       eventmachine (>= 0.12.0)
@@ -218,7 +218,7 @@ GEM
       domain_name (~> 0.5)
     http_parser.rb (0.8.0)
     httpclient (2.8.3)
-    i18n (1.14.1)
+    i18n (1.14.4)
       concurrent-ruby (~> 1.0)
     io-console (0.7.2)
     irb (1.7.4)
@@ -226,7 +226,7 @@ GEM
     jmespath (1.6.2)
     jsobfu (0.4.2)
       rkelly-remix
-    json (2.7.1)
+    json (2.7.2)
     little-plugger (1.1.4)
     logging (2.3.1)
       little-plugger (~> 1.1)
@@ -240,7 +240,7 @@ GEM
       activesupport (~> 7.0)
       railties (~> 7.0)
       zeitwerk
-    metasploit-credential (6.0.8)
+    metasploit-credential (6.0.9)
       metasploit-concern
       metasploit-model
       metasploit_data_models (>= 5.0.0)
@@ -266,9 +266,9 @@ GEM
       recog
       webrick
     metasploit_payloads-mettle (1.0.26)
-    method_source (1.0.0)
-    mini_portile2 (2.8.5)
-    minitest (5.22.2)
+    method_source (1.1.0)
+    mini_portile2 (2.8.6)
+    minitest (5.22.3)
     mqtt (0.6.0)
     msgpack (1.6.1)
     multi_json (1.15.0)
@@ -283,12 +283,12 @@ GEM
     net-ldap (0.19.0)
     net-protocol (0.2.2)
       timeout
-    net-smtp (0.4.0.1)
+    net-smtp (0.5.0)
       net-protocol
-    net-ssh (7.2.1)
+    net-ssh (7.2.3)
     network_interface (0.0.4)
     nexpose (7.3.0)
-    nio4r (2.7.0)
+    nio4r (2.7.1)
     nokogiri (1.14.5)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
@@ -311,11 +311,11 @@ GEM
       ruby-rc4
       ttfunk
     pg (1.5.6)
-    public_suffix (5.0.4)
+    public_suffix (5.0.5)
     puma (6.4.2)
       nio4r (~> 2.0)
     racc (1.7.3)
-    rack (2.2.8.1)
+    rack (2.2.9)
     rack-protection (3.2.0)
       base64 (>= 0.1.0)
       rack (~> 2.2, >= 2.2.4)
@@ -335,14 +335,14 @@ GEM
       rake (>= 12.2)
       thor (~> 1.0)
       zeitwerk (~> 2.5)
-    rake (13.1.0)
+    rake (13.2.1)
     rasn1 (0.13.0)
       strptime (~> 0.2.5)
     rb-readline (0.5.5)
-    recog (3.1.4)
+    recog (3.1.5)
       nokogiri
     redcarpet (3.6.0)
-    reline (0.4.3)
+    reline (0.5.2)
       io-console (~> 0.5)
     rex-arch (0.1.15)
       rex-text
@@ -382,14 +382,14 @@ GEM
       metasm
       rex-core
       rex-text
-    rex-socket (0.1.56)
+    rex-socket (0.1.57)
       rex-core
     rex-sslscan (0.1.10)
       rex-core
       rex-socket
       rex-text
     rex-struct2 (0.1.4)
-    rex-text (0.2.56)
+    rex-text (0.2.57)
     rex-zip (0.1.5)
       rex-text
     rexml (3.2.6)
@@ -398,7 +398,7 @@ GEM
     ruby-mysql (4.1.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (3.3.4)
+    ruby_smb (3.3.5)
       bindata (= 2.4.15)
       openssl-ccm
       openssl-cmac
@@ -416,7 +416,7 @@ GEM
       rack (~> 2.2, >= 2.2.4)
       rack-protection (= 3.2.0)
       tilt (~> 2.0)
-    sqlite3 (1.7.2)
+    sqlite3 (2.0.0)
       mini_portile2 (~> 2.8.0)
     sshkey (3.0.0)
     strptime (0.2.5)
@@ -428,7 +428,8 @@ GEM
     thor (1.3.1)
     tilt (2.3.0)
     timeout (0.4.1)
-    ttfunk (1.7.0)
+    ttfunk (1.8.0)
+      bigdecimal (~> 3.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     tzinfo-data (1.2024.1)
@@ -469,4 +470,4 @@ DEPENDENCIES
   metasploit-framework!
 
 BUNDLED WITH
-   2.5.6
+   2.4.13
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index b0f8748635328..1026323587d66 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.3";
+  version = "6.4.5";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-3FCTKiZ9vTmguGXRrfWGlUVVEKrV8uWMPeSF9zRz+UE=";
+    hash = "sha256-KmELKjbWjhHmyj8IlL5U2yNHwtpc8qX5ZAT1PcIJOd8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 7d83382e6a79c..fbf6bb89b8a3f 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,80 +104,80 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "018hh97dcj3nd80jb1cf63fxk6h8gc4rrq118bv9npnw5ahd5pv8";
+      sha256 = "1gilrh9fb1576xm2ah0l6d33qkiabz55zpq004qqia9xavl43ylz";
       type = "gem";
     };
-    version = "1.895.0";
+    version = "1.916.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "088nq8yz9n4p7pnhjwp9nbxlkj7jwchpkzvnl4nybfb1dkvk4dns";
+      sha256 = "1hp8rxk9wl3kmb7xabcz5hbcv7kzsvsx0wyib2fsg9d42kz149n0";
       type = "gem";
     };
-    version = "3.191.3";
+    version = "3.192.1";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kcsfkpfqx96ax1slvl4lq61cdasaki6hddi22ja1zyc1ak4x9dg";
+      sha256 = "101jjqf912jwca119v86i4inlkf2gldmmhgdm2rdk5hqrwl4yrf4";
       type = "gem";
     };
-    version = "1.440.0";
+    version = "1.450.0";
   };
   aws-sdk-ec2instanceconnect = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hd4xdhf6b2bvfb4h9fc0c96vwz30cmdhra3r7zpdllhz7d1hh5q";
+      sha256 = "1mhqk2s8klp8djibrhgmh9lz9nr4rh1yy7y6c86if55r07i1912c";
       type = "gem";
     };
-    version = "1.37.0";
+    version = "1.38.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ymb6lnkmhi98lwk402msanr7i012k82pvspd2rd66aq0vdql9rd";
+      sha256 = "0zcvkal9ahwr84pz1cb3y9ylx3f74m4kgs4n160dfzf51b8m917l";
       type = "gem";
     };
-    version = "1.94.0";
+    version = "1.96.0";
   };
   aws-sdk-kms = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gbxms3daszl4mk89swjrpq3fqgm9lg0wl65yjfp0nfz8jm4jyqf";
+      sha256 = "1cb0006xf5isq5drdwkvd6xz20886x3rzcj5qyly7g8gql5lc8aw";
       type = "gem";
     };
-    version = "1.77.0";
+    version = "1.79.0";
   };
   aws-sdk-s3 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1safbxycz517m2v981z8kbmdiqx9jypl093ia0mcrskkgh4fyb3s";
+      sha256 = "0ibw2v56k8v2sw92cyliprq1xxfyavnd60yl6ach3f4qbp156xrn";
       type = "gem";
     };
-    version = "1.143.0";
+    version = "1.147.0";
   };
   aws-sdk-ssm = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wbizrm7spkwx6rnwmwbxyg16mpkn3hllxz8aj7v2dlplzkwksb6";
+      sha256 = "0drad0zka0kjayiy971vcl5dfp6j37wgga4xncya8w8xsrknh9s8";
       type = "gem";
     };
-    version = "1.165.0";
+    version = "1.166.0";
   };
   aws-sigv4 = {
     groups = ["default"];
@@ -224,10 +224,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00db5v09k1z3539g1zrk7vkjrln9967k08adh6qx33ng97a2gg5w";
+      sha256 = "0cq1c29zbkcxgdihqisirhcw76xc768z2zpd5vbccpq0l1lv76g7";
       type = "gem";
     };
-    version = "3.1.6";
+    version = "3.1.7";
   };
   bindata = {
     groups = ["default"];
@@ -334,10 +334,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17bjlic4ac9980vas3pgnhi5lkisq28vd730bhcg8jdh8xcp6r48";
+      sha256 = "1qpa5d8i6ay25grwb9d6x47jdn5c8vykhg02m8rgpmc3hci4mbsb";
       type = "gem";
     };
-    version = "1.70.0";
+    version = "1.72.1";
   };
   domain_name = {
     groups = ["default"];
@@ -404,10 +404,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rrwh78515yqljh09wjxfsb64siqd8qgp4hv57syajhza5x8vbzz";
+      sha256 = "0isxcqv4xkw7hrdf89mga6zsi4alban16xyw84bkqvbsr859nax4";
       type = "gem";
     };
-    version = "3.2.3";
+    version = "3.3.1";
   };
   faraday = {
     groups = ["default"];
@@ -434,10 +434,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ia19zgni6cw96rvsr0s004vjs9m2r6la4s00zcff36xaia4m0l0";
+      sha256 = "023ncwlagnf2irx2ckyj1pg1f1x436jgr4a5y45mih298p8zwij1";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.2.1";
   };
   faye-websocket = {
     groups = ["default"];
@@ -554,10 +554,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qaamqsh5f3szhcakkak8ikxlzxqnv49n2p7504hcz2l0f4nj0wx";
+      sha256 = "0lbm33fpb3w06wd2231sg58dwlwgjsvym93m548ajvl6s3mfvpn7";
       type = "gem";
     };
-    version = "1.14.1";
+    version = "1.14.4";
   };
   io-console = {
     groups = ["default"];
@@ -604,10 +604,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r9jmjhg2ly3l736flk7r2al47b5c8cayh0gqkq0yhjqzc9a6zhq";
+      sha256 = "0b4qsi8gay7ncmigr0pnbxyb17y3h8kavdyhsh7nrlqwr35vb60q";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.7.2";
   };
   little-plugger = {
     groups = ["default"];
@@ -664,22 +664,22 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0v1bylci121psqg669lgxpp6d965m4xxmg1djvmy0srcys8dvp5n";
+      sha256 = "06zkgwwhzmazi263l61zwml6mkbyjkwc4lshalm9rbhj3agnsm22";
       type = "gem";
     };
-    version = "6.0.8";
+    version = "6.0.9";
   };
   metasploit-framework = {
     groups = ["default"];
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "3855e135a14eec07e12f3d26416713a691b3c149";
-      sha256 = "0hgrfcsgg1g47n6fbwnmm885aicmhvssvlb5p2h3kgbx4qm96l6w";
+      rev = "6dfd13e04c9e9763b485a5b7d6e85d97632a8edf";
+      sha256 = "1prr1713vx84ckwsbwjwvb14f8yvajz9821zrbk133nn6qm0nq9a";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.3";
+    version = "6.4.5";
   };
   metasploit-model = {
     groups = ["default"];
@@ -726,30 +726,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pnyh44qycnf9mzi1j6fywd5fkskv3x7nmsqrrws0rjn5dd4ayfp";
+      sha256 = "1igmc3sq9ay90f8xjvfnswd1dybj1s3fi0dwd53inwsvqk4h24qq";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.1.0";
   };
   mini_portile2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kl9c3kdchjabrihdqfmcplk3lq4cw1rr9f378y6q22qwy5dndvs";
+      sha256 = "149r94xi6b3jbp6bv72f8383b95ndn0p5sxnq11gs1j9jadv0ajf";
       type = "gem";
     };
-    version = "2.8.5";
+    version = "2.8.6";
   };
   minitest = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0667vf0zglacry87nkcl3ns8421aydvz71vfa3g3yjhiq8zh19f5";
+      sha256 = "07lq26b86giy3ha3fhrywk9r1ajhc2pm2mzj657jnpnbj1i6g17a";
       type = "gem";
     };
-    version = "5.22.2";
+    version = "5.22.3";
   };
   mqtt = {
     groups = ["default"];
@@ -846,20 +846,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0csspzqrg7s2v2wdp6vqqs1rra6w5ilpgnps5h52ig6rp7x2i389";
+      sha256 = "0amlhz8fhnjfmsiqcjajip57ici2xhw089x7zqyhpk51drg43h2z";
       type = "gem";
     };
-    version = "0.4.0.1";
+    version = "0.5.0";
   };
   net-ssh = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i01340c4i144vvn3x54lc2rb77ch829qipl1rh6rqwm3yxzml9w";
+      sha256 = "0sqbq5aks9xxnldbd2hy20ypnd59zcra98ql0r7jjc26s5rgc18n";
       type = "gem";
     };
-    version = "7.2.1";
+    version = "7.2.3";
   };
   network_interface = {
     groups = ["default"];
@@ -886,10 +886,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xkjz56qc7hl7zy7i7bhiyw5pl85wwjsa4p70rj6s958xj2sd1lm";
+      sha256 = "15iwbiij52x6jhdbl0rkcldnhfndmsy0sbnsygkr9vhskfqrp72m";
       type = "gem";
     };
-    version = "2.7.0";
+    version = "2.7.1";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -1007,10 +1007,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bni4qjrsh2q49pnmmd6if4iv3ak36bd2cckrs6npl111n769k9m";
+      sha256 = "14y4vzjwf5gp0mqgs880kis0k7n2biq8i6ci6q2n315kichl1hvj";
       type = "gem";
     };
-    version = "5.0.4";
+    version = "5.0.5";
   };
   puma = {
     groups = ["default"];
@@ -1037,10 +1037,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10mpk0hl6hnv324fp1pfimi2nw9acj0z4gyhrph36qg84pk1s4m7";
+      sha256 = "0hj0rkw2z9r1lcg2wlrcld2n3phwrcgqcp7qd1g9a7hwgalh2qzx";
       type = "gem";
     };
-    version = "2.2.8.1";
+    version = "2.2.9";
   };
   rack-protection = {
     groups = ["default"];
@@ -1097,10 +1097,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ilr853hawi09626axx0mps4rkkmxcs54mapz9jnqvpnlwd3wsmy";
+      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
       type = "gem";
     };
-    version = "13.1.0";
+    version = "13.2.1";
   };
   rasn1 = {
     groups = ["default"];
@@ -1127,10 +1127,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a9m9ngmcgvgzg8m8ahdhjvfm65k6hp8r7dqmrsh3zcphim4x71k";
+      sha256 = "179h412g435dwzzswma0incss8mhw4qgcabbhyij1fbc9ch1y1zx";
       type = "gem";
     };
-    version = "3.1.4";
+    version = "3.1.5";
   };
   redcarpet = {
     groups = ["default"];
@@ -1147,10 +1147,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zx7sdh11p4z77c3f9ka6f065mgl6xwbamnsq4rrgwk310qhn41n";
+      sha256 = "0xwf7i2kvgaxbpdqqkncv9dpfhlj55shig4sdzgy7kgbfj09mm03";
       type = "gem";
     };
-    version = "0.4.3";
+    version = "0.5.2";
   };
   rex-arch = {
     groups = ["default"];
@@ -1287,10 +1287,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vd9gfhyplwg2y55jk1c6nfsin733dy831x8zx78cp2lxp07s0p7";
+      sha256 = "1qmj5pya6ssghi3dfdmrykkbazhqlhq86ahwijdvrfr2q3g76p86";
       type = "gem";
     };
-    version = "0.1.56";
+    version = "0.1.57";
   };
   rex-sslscan = {
     groups = ["default"];
@@ -1317,10 +1317,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "108x7k7x0ghc1zzqwbmja1f81b1wnllpda2rzbkws9ckvqx0cayf";
+      sha256 = "08wrqy8sgncsn6kcplw7bl6c2bmyj9fza7x77wrlwh1gza7pcjk4";
       type = "gem";
     };
-    version = "0.2.56";
+    version = "0.2.57";
   };
   rex-zip = {
     groups = ["default"];
@@ -1397,10 +1397,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wcbglknz86qf7sbsns84a35a0vvfn9cn1cbhf9ycjwh6nqxhcim";
+      sha256 = "0fwk5hqaph37apa5zf1mg2n2wd5lkz3sgwl0f4ndhkv1vfxbb2ys";
       type = "gem";
     };
-    version = "3.3.4";
+    version = "3.3.5";
   };
   rubyntlm = {
     groups = ["default"];
@@ -1457,10 +1457,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "137xkh8jnk3xyajvzmn2390yzs13hnb37jylr0sm02d3zrshf18n";
+      sha256 = "01sfiwn60czgpabfr7xq8dk3qkc17ai3z7d4yfwanq1zw6mf927n";
       type = "gem";
     };
-    version = "1.7.2";
+    version = "2.0.0";
   };
   sshkey = {
     groups = ["default"];
@@ -1537,10 +1537,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15iaxz9iak5643bq2bc0jkbjv8w2zn649lxgvh5wg48q9d4blw13";
+      sha256 = "1ji0kn8jkf1rpskv3ijzxvqwixg4p6sk8kg0vmwyjinci7jcgjx7";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.8.0";
   };
   tzinfo = {
     groups = ["default"];
diff --git a/pkgs/tools/security/onlykey-cli/default.nix b/pkgs/tools/security/onlykey-cli/default.nix
index 624290c6d5554..6d43a4df4afff 100644
--- a/pkgs/tools/security/onlykey-cli/default.nix
+++ b/pkgs/tools/security/onlykey-cli/default.nix
@@ -10,9 +10,12 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-ZmQnyZx9YlIIxMMdZ0U2zb+QANfcwrtG7iR1LpgzmBQ=";
   };
 
+  build-system = with python3Packages; [
+    cython
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     aenum
-    cython
     ecdsa
     hidapi
     onlykey-solo-python
diff --git a/pkgs/tools/security/osv-scanner/default.nix b/pkgs/tools/security/osv-scanner/default.nix
index e51ce66ad0240..70393cb9aad8c 100644
--- a/pkgs/tools/security/osv-scanner/default.nix
+++ b/pkgs/tools/security/osv-scanner/default.nix
@@ -4,18 +4,19 @@
 , testers
 , osv-scanner
 }:
+
 buildGoModule rec {
   pname = "osv-scanner";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-JlTD8el4hXVYI76+cxGNemkUu0n2QxCqisr6R9aPqdI=";
+    repo = "osv-scanner";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UE6iCvv/ByODZX+FoLvIw+EeyISWFkHb4xK5L33w1hU=";
   };
 
-  vendorHash = "sha256-J5qLs4EirBOfjnLv8eQBSd9w9nzpxBW5GS28CgQMsN8=";
+  vendorHash = "sha256-c/Wjhpa7upSRMaU+rheGF9dbvK0MQe3ZmPLpR5bRiUI=";
 
   subPackages = [
     "cmd/osv-scanner"
@@ -24,9 +25,9 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/google/osv-scanner/internal/version.OSVVersion=${version}"
-    "-X main.commit=n/a"
-    "-X main.date=1970-01-01T00:00:00Z"
+    "-X=github.com/google/osv-scanner/internal/version.OSVVersion=${version}"
+    "-X=main.commit=n/a"
+    "-X=main.date=1970-01-01T00:00:00Z"
   ];
 
   # Tests require network connectivity to query https://api.osv.dev.
diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix
index cff903021591a..328717aca5817 100644
--- a/pkgs/tools/security/pomerium-cli/default.nix
+++ b/pkgs/tools/security/pomerium-cli/default.nix
@@ -8,16 +8,16 @@ let
 in
 buildGoModule rec {
   pname = "pomerium-cli";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-0vRLjmzW/U/Kssu4VQO6mFqVH4UovmTGEEfxeWI8Nqo=";
+    sha256 = "sha256-2upvdL8kk0Kbll8UbviyzIX2jdK+tqcHvVlkpz5JjrA=";
   };
 
-  vendorHash = "sha256-dnfJnndYXR6LQKDruLSsDav4DtyaGu5/rNnk69oMhPU=";
+  vendorHash = "sha256-aQo58i+XuCkdjIg/IPf7kNLXXA0NwZbQMhgWyMb45B4=";
 
   subPackages = [
     "cmd/pomerium-cli"
diff --git a/pkgs/tools/security/pwdsafety/default.nix b/pkgs/tools/security/pwdsafety/default.nix
index e713d7e014ab5..53bb59aa1ef24 100644
--- a/pkgs/tools/security/pwdsafety/default.nix
+++ b/pkgs/tools/security/pwdsafety/default.nix
@@ -1,26 +1,33 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {
   pname = "pwdsafety";
-  version = "0.3";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-ryMLiehJVZhQ3ZQf4/g7ILeJri78A6z5jfell0pD9E8=";
+    repo = "pwdsafety";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cKxTcfNjvwcDEw0Z1b50A4u0DUYXlGMMfGWJLPaSkcw=";
   };
 
-  vendorHash = "sha256-b+tWTQUyYDzY2O28hwy5vI6b6S889TCiVh7hQhw/KAc=";
+  vendorHash = "sha256-RoRq9JZ8lOMtAluz8TB2RRuDEWFOBtWVhz21aTkXXy4=";
+
+  ldflags = [
+    "-w"
+    "-s"
+  ];
 
   meta = with lib; {
     description = "Command line tool checking password safety";
-    mainProgram = "cmd";
     homepage = "https://github.com/edoardottt/pwdsafety";
+    changelog = "https://github.com/edoardottt/pwdsafety/releases/tag/v${version}";
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "pwdsafety";
   };
 }
diff --git a/pkgs/tools/security/semgrep/common.nix b/pkgs/tools/security/semgrep/common.nix
index cfc4045457be7..9fb3ae427a2ec 100644
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@@ -1,9 +1,9 @@
 { lib }:
 
 rec {
-  version = "1.67.0";
+  version = "1.69.0";
 
-  srcHash = "sha256-B+2DgwU+yhU337yZh518Z2Tq0Wbun8WEXX9IpC0Ut/c=";
+  srcHash = "sha256-LA0mRuYJg97tMbmlmJpZ8wQc83S/jXNWBUjcoXSqoVo=";
 
   # submodule dependencies
   # these are fetched so we:
@@ -13,8 +13,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "3ee41bc436308a7c12b66247cfcb60df0aeff8ea";
-      hash = "sha256-rlhArVSNJr4AgZw/TOOMPgpBOfHWsAm77YgrRdCjIzI=";
+      rev = "d5b91fa4f6a03240db31e9bbbc5376a99bc8eeea";
+      hash = "sha256-IQ22HvO0gHAfbZrt+bz1yMb/XRZOU+z03X+SOK9iDQs=";
     };
   };
 
@@ -25,19 +25,19 @@ rec {
   core = {
     x86_64-linux = {
       platform = "any";
-      hash = "sha256-iv02L/dvcfI/9XubC+EOeqMaVwdXh0sqLv02j1fn1aM=";
+      hash = "sha256-QFE8NzGW2kkP5xtmbXgxE1OAxz6z7MT8wW/EmIVMgHE=";
     };
     aarch64-linux = {
       platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-wFuEcgCuciAOR8MNCxHW8TCoji97g7dXUf06M0T9MWg=";
+      hash = "sha256-E1fGT5TO2DbP4oYtkRs794jXGOp75q3o+xlOao8E7Lk=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-wMkOZFvR6HBBTvu8mXRDF2s0Mqp/LkhVH2I+2sIIa94=";
+      hash = "sha256-oWY57rQvxjMIhzjR62cpIVmKynmdF3zQOLMHBjbf1ig=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-AKNc9SxXbKb6WdFlE6aqzFDdtMGzl+3LhXTbNvFSHYQ=";
+      hash = "sha256-L2eFkahzwfBzPcx7Zq+NhtgJvBq5W1vZ4m1YNQ3dWAo=";
     };
   };
 
diff --git a/pkgs/tools/security/step-kms-plugin/default.nix b/pkgs/tools/security/step-kms-plugin/default.nix
index fd3faedf61289..95a3b85fca637 100644
--- a/pkgs/tools/security/step-kms-plugin/default.nix
+++ b/pkgs/tools/security/step-kms-plugin/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "step-kms-plugin";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FQ9UW1zz+8HMFETZVef7oyh2+Nm5z3ksvmOv/MTiKAU=";
+    hash = "sha256-EkLLhHXvh10tfEY6AY6o3n3JcmCXwauHsQ8VJRBpnnY=";
   };
 
-  vendorHash = "sha256-bpQHe7B7dG1oeGP/V3su0Zc6in7tive7lmh18KqxGfo=";
+  vendorHash = "sha256-kwM5eNeAVtA6DaoFtBhxc7Jnfb7vVkdIGpUxVGjWwC8=";
 
   proxyVendor = true;
 
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 7c41e7c8a5183..5525c73f43a85 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -1,17 +1,19 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitHub
 , bison
 , flex
 }:
 
 stdenv.mkDerivation rec {
   pname = "acpica-tools";
-  version = "20230628";
+  version = "20240322";
 
-  src = fetchurl {
-    url = "https://downloadmirror.intel.com/783534/acpica-unix-${version}.tar.gz";
-    hash = "sha256-hodqdF49Ik3P0iLtPeRltHVZ6FgR3y25gg7wmp3/XM4=";
+  src = fetchFromGitHub {
+    owner = "acpica";
+    repo = "acpica";
+    rev = "refs/tags/G${version}";
+    hash = "sha256-k5rDaRKYPwdP4SmEXlrqsA2NLZDlqXBclz1Lwmufa2M=";
   };
 
   nativeBuildInputs = [ bison flex ];
@@ -29,9 +31,6 @@ stdenv.mkDerivation rec {
 
   env.NIX_CFLAGS_COMPILE = toString ([
     "-O3"
-  ] ++ lib.optionals (stdenv.cc.isGNU) [
-    # Needed with GCC 12
-    "-Wno-dangling-pointer"
   ]);
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index defad03c0b6b9..483b0b43661b3 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pciutils";
-  version = "3.11.1"; # with release-date database
+  version = "3.12.0"; # with release-date database
 
   src = fetchurl {
     url = "mirror://kernel/software/utils/pciutils/pciutils-${version}.tar.xz";
-    hash = "sha256-P0cq2GRHPeW6F/dlzJbvXzPhtzCRjTrdpvlFoqkpDfQ=";
+    hash = "sha256-8YXRFtX/mbeXSX786PGfHujMxaZouXoVnj0TRy9nQVQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index e82ef305a522f..d5cef467f5072 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lOZ2JFQG4x4xv/fdTlpOEp9lpdjR0ACyAIUWEZUm6L8=";
+    hash = "sha256-yEYdFpIIY+nAaeMPEwgz0th2rf67LeYK19Ov9QB/7J0=";
   };
 
   vendorHash = "sha256-aoc8KSznkWJpn0Ye7FUOH5sNQ4fslIGJhIaQdGrwcqQ=";
diff --git a/pkgs/tools/text/goawk/default.nix b/pkgs/tools/text/goawk/default.nix
index 2ed24f93d4d75..4d84d133775e3 100644
--- a/pkgs/tools/text/goawk/default.nix
+++ b/pkgs/tools/text/goawk/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "goawk";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "benhoyt";
     repo = "goawk";
     rev = "v${version}";
-    hash = "sha256-EJf5Qv5ICJJdGNcRQ7v/ANyxx2j9d9NsZJnzIBrwam4=";
+    hash = "sha256-KB9N345xkgsPfI4DQYFag7qSdFv/JSU18YG8IPFrcQA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/text/mdbook-admonish/default.nix b/pkgs/tools/text/mdbook-admonish/default.nix
index 1deaf9bc7c2b0..381bf8e6b1ad8 100644
--- a/pkgs/tools/text/mdbook-admonish/default.nix
+++ b/pkgs/tools/text/mdbook-admonish/default.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     description = "A preprocessor for mdbook to add Material Design admonishments";
     mainProgram = "mdbook-admonish";
     license = licenses.mit;
-    maintainers = with maintainers; [ jmgilman Frostman ];
+    maintainers = with maintainers; [ jmgilman Frostman matthiasbeyer ];
     homepage = "https://github.com/tommilligan/mdbook-admonish";
   };
 }
diff --git a/pkgs/tools/text/mdbook-cmdrun/default.nix b/pkgs/tools/text/mdbook-cmdrun/default.nix
index 05d27d3e3ad5c..8945a7cbd83bc 100644
--- a/pkgs/tools/text/mdbook-cmdrun/default.nix
+++ b/pkgs/tools/text/mdbook-cmdrun/default.nix
@@ -1,27 +1,37 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib
+, mdbook
+, nodePackages
+, python3
+, util-linux
+, rustPlatform
+, fetchFromGitHub
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-cmdrun";
-  version = "unstable-2023-01-10";
+  version = "0.6.0-unstable-2024-04-15";
 
   src = fetchFromGitHub {
     owner = "FauconFan";
     repo = pname;
-    rev = "3f6d243cd9de5659f166a5642eb46b2a6d8384e7";
-    hash = "sha256-JuKMAb3vwGTju9U1vaS9I39gObTz0JQQV4uol9SmsfM=";
+    rev = "d1fef67f100563c2a433b1f5dd5a71810db6b90d";
+    hash = "sha256-Q2h64XCyDxLmmCNC3wTw81pBotaMEUjY5y0Oq6q20cQ=";
   };
 
-  # Tests are outdated currently, application works fine
-  # See for more info: https://github.com/FauconFan/mdbook-cmdrun/issues/2
-  doCheck = false;
+  nativeCheckInputs = [
+    mdbook # used by tests/book.rs
+    nodePackages.nodejs # used by tests/regression/inline_call/input.md
+    python3 # used by tests/regression/py_*
+    util-linux # used by tests/regression/shell/input.md
+  ];
 
-  cargoHash = "sha256-h3xCnx6byToZx83uWNLz05F3VIDR0D1NVtSOKPuYeG4=";
+  cargoHash = "sha256-gT3DyQRJWn1HuR6fXeqk8aUPb+jmC+V1McdDN2JGXuI=";
 
   meta = with lib; {
     description = "mdbook preprocessor to run arbitrary commands";
     mainProgram = "mdbook-cmdrun";
     homepage = "https://github.com/FauconFan/mdbook-cmdrun";
     license = licenses.mit;
-    maintainers = with maintainers; [ pinpox ];
+    maintainers = with maintainers; [ pinpox matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-d2/default.nix b/pkgs/tools/text/mdbook-d2/default.nix
index afff44b9f473a..61176e2020201 100644
--- a/pkgs/tools/text/mdbook-d2/default.nix
+++ b/pkgs/tools/text/mdbook-d2/default.nix
@@ -29,6 +29,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/danieleades/mdbook-d2";
     changelog = "https://github.com/danieleades/mdbook-d2/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ blaggacao ];
+    maintainers = with maintainers; [ blaggacao matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-emojicodes/default.nix b/pkgs/tools/text/mdbook-emojicodes/default.nix
index 21c8e48468a29..d57ba39b803cd 100644
--- a/pkgs/tools/text/mdbook-emojicodes/default.nix
+++ b/pkgs/tools/text/mdbook-emojicodes/default.nix
@@ -28,6 +28,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/blyxyas/mdbook-emojicodes";
     changelog = "https://github.com/blyxyas/mdbook-emojicodes/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ blaggacao ];
+    maintainers = with maintainers; [ blaggacao matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-epub/default.nix b/pkgs/tools/text/mdbook-epub/default.nix
index 16e3bff734439..830d6f92a8ad4 100644
--- a/pkgs/tools/text/mdbook-epub/default.nix
+++ b/pkgs/tools/text/mdbook-epub/default.nix
@@ -37,6 +37,6 @@ in rustPlatform.buildRustPackage {
     mainProgram = "mdbook-epub";
     homepage = "https://michael-f-bryan.github.io/mdbook-epub";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ yuu ];
+    maintainers = with maintainers; [ yuu matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-footnote/default.nix b/pkgs/tools/text/mdbook-footnote/default.nix
index cc140a5b5d83d..01777669c4afa 100644
--- a/pkgs/tools/text/mdbook-footnote/default.nix
+++ b/pkgs/tools/text/mdbook-footnote/default.nix
@@ -24,6 +24,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-footnote";
     homepage = "https://github.com/daviddrysdale/mdbook-footnote";
     license = licenses.asl20;
-    maintainers = with maintainers; [ brianmcgillion ];
+    maintainers = with maintainers; [ brianmcgillion matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-graphviz/default.nix b/pkgs/tools/text/mdbook-graphviz/default.nix
index 060fd5871d1b8..43171c92dc96f 100644
--- a/pkgs/tools/text/mdbook-graphviz/default.nix
+++ b/pkgs/tools/text/mdbook-graphviz/default.nix
@@ -23,6 +23,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/dylanowen/mdbook-graphviz";
     changelog = "https://github.com/dylanowen/mdbook-graphviz/releases/tag/v${version}";
     license = [ licenses.mpl20 ];
-    maintainers = with maintainers; [ lovesegfault ];
+    maintainers = with maintainers; [ lovesegfault matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-i18n-helpers/default.nix b/pkgs/tools/text/mdbook-i18n-helpers/default.nix
index e00103b2c4f3f..e38da146b1fa6 100644
--- a/pkgs/tools/text/mdbook-i18n-helpers/default.nix
+++ b/pkgs/tools/text/mdbook-i18n-helpers/default.nix
@@ -22,6 +22,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/google/mdbook-i18n-helpers";
     changelog = "https://github.com/google/mdbook-i18n-helpers/releases/tag/${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ teutat3s ];
+    maintainers = with maintainers; [ teutat3s matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-katex/default.nix b/pkgs/tools/text/mdbook-katex/default.nix
index cd9534761966d..84e04e8e5669f 100644
--- a/pkgs/tools/text/mdbook-katex/default.nix
+++ b/pkgs/tools/text/mdbook-katex/default.nix
@@ -18,6 +18,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-katex";
     homepage = "https://github.com/lzanini/${pname}";
     license = [ licenses.mit ];
-    maintainers = with maintainers; [ lovesegfault ];
+    maintainers = with maintainers; [ lovesegfault matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix b/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix
index d419d8b0c1169..e69c8185e3c3a 100644
--- a/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix
+++ b/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix
@@ -36,6 +36,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-kroki-preprocessor";
     homepage = "https://github.com/joelcourtney/mdbook-kroki-preprocessor";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ blaggacao ];
+    maintainers = with maintainers; [ blaggacao matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-linkcheck/default.nix b/pkgs/tools/text/mdbook-linkcheck/default.nix
index d90b536edc86c..b8d19d01e7633 100644
--- a/pkgs/tools/text/mdbook-linkcheck/default.nix
+++ b/pkgs/tools/text/mdbook-linkcheck/default.nix
@@ -29,6 +29,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-linkcheck";
     homepage = "https://github.com/Michael-F-Bryan/mdbook-linkcheck";
     license = licenses.mit;
-    maintainers = with maintainers; [ zhaofengli ];
+    maintainers = with maintainers; [ zhaofengli matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-mermaid/default.nix b/pkgs/tools/text/mdbook-mermaid/default.nix
index b69dd103917da..2dafb13d508cd 100644
--- a/pkgs/tools/text/mdbook-mermaid/default.nix
+++ b/pkgs/tools/text/mdbook-mermaid/default.nix
@@ -28,6 +28,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/badboy/mdbook-mermaid";
     changelog = "https://github.com/badboy/mdbook-mermaid/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ xrelkd ];
+    maintainers = with maintainers; [ xrelkd matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-pagetoc/default.nix b/pkgs/tools/text/mdbook-pagetoc/default.nix
index 2cd4afee9616f..eaeecf7648096 100644
--- a/pkgs/tools/text/mdbook-pagetoc/default.nix
+++ b/pkgs/tools/text/mdbook-pagetoc/default.nix
@@ -18,6 +18,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-pagetoc";
     homepage = "https://github.com/slowsage/mdbook-pagetoc";
     license = licenses.mit;
-    maintainers = with maintainers; [ blaggacao ];
+    maintainers = with maintainers; [ blaggacao matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-pdf/default.nix b/pkgs/tools/text/mdbook-pdf/default.nix
index e0c63f595db14..0b3b0bfbc8606 100644
--- a/pkgs/tools/text/mdbook-pdf/default.nix
+++ b/pkgs/tools/text/mdbook-pdf/default.nix
@@ -48,6 +48,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/HollowMan6/mdbook-pdf";
     changelog = "https://github.com/HollowMan6/mdbook-pdf/releases/tag/v${version}";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ hollowman6 ];
+    maintainers = with maintainers; [ hollowman6 matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-plantuml/default.nix b/pkgs/tools/text/mdbook-plantuml/default.nix
index e07bd812cec9d..e5ee827d816eb 100644
--- a/pkgs/tools/text/mdbook-plantuml/default.nix
+++ b/pkgs/tools/text/mdbook-plantuml/default.nix
@@ -40,6 +40,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-plantuml";
     homepage = "https://github.com/sytsereitsma/mdbook-plantuml";
     license = [ licenses.mit ];
-    maintainers = with maintainers; [ jcouyang ];
+    maintainers = with maintainers; [ jcouyang matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/ov/default.nix b/pkgs/tools/text/ov/default.nix
index d74d4bc061826..e0ccf023a5ae7 100644
--- a/pkgs/tools/text/ov/default.nix
+++ b/pkgs/tools/text/ov/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.33.3";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dKAZ8rcm1J3jRfOyLz74YuVv0hZ3iWXR1slBTu5CtYU=";
+    hash = "sha256-2Qk94xaDD+O8jO7Pq1MUWieEjUlVLxYxMMcsrEUwP4M=";
   };
 
-  vendorHash = "sha256-6Ik//r6JJ2n9lXr6JZ6BGIIL7yXXray+flEwQ0IKyA4=";
+  vendorHash = "sha256-USMDIgB4LhI4kzSg2kkCXfbN9t49WEg0fUtAcZkngac=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 9fa3c12ccc88a..5bb73a50f9e64 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -1,11 +1,18 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeBinaryWrapper
+, runCommand
+, symlinkJoin
+, vale
+, valeStyles
+}:
 
 buildGoModule rec {
   pname = "vale";
   version = "3.4.1";
 
   subPackages = [ "cmd/vale" ];
-  outputs = [ "out" "data" ];
 
   src = fetchFromGitHub {
     owner = "errata-ai";
@@ -16,18 +23,29 @@ buildGoModule rec {
 
   vendorHash = "sha256-HMzFLSmO6sBDNU89UoIvHcPPd3ubpti2ii4sFMKUDmI=";
 
-  postInstall = ''
-    mkdir -p $data/share/vale
-    cp -r testdata/styles $data/share/vale
-  '';
-
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   # Tests require network access
   doCheck = false;
 
+  passthru.withStyles = selector: symlinkJoin {
+    name = "vale-with-styles-${vale.version}";
+    paths = [ vale ] ++ selector valeStyles;
+    nativeBuildInputs = [ makeBinaryWrapper ];
+    postBuild = ''
+      wrapProgram "$out/bin/vale" \
+        --set VALE_STYLES_PATH "$out/share/vale/styles/"
+    '';
+  };
+
   meta = with lib; {
     description = "A syntax-aware linter for prose built with speed and extensibility in mind";
+    longDescription = ''
+      Vale in Nixpkgs offers the helper `.withStyles` allow you to install it
+      predefined styles:
+
+          vale.withStyles (s: [ s.alex s.google ])
+    '';
     homepage = "https://vale.sh/";
     changelog = "https://github.com/errata-ai/vale/releases/tag/v${version}";
     mainProgram = "vale";
diff --git a/pkgs/tools/text/vale/styles.nix b/pkgs/tools/text/vale/styles.nix
new file mode 100644
index 0000000000000..f2513289a5488
--- /dev/null
+++ b/pkgs/tools/text/vale/styles.nix
@@ -0,0 +1,144 @@
+{ lib, stdenvNoCC, fetchFromGitHub, fetchzip, nix-update-script }:
+
+let
+  buildStyle =
+    { name
+    , stylePath ? name
+    , ...
+    }@args:
+    stdenvNoCC.mkDerivation ({
+      pname = "vale-style-${lib.toLower name}";
+
+      dontConfigure = true;
+      dontBuild = true;
+      doCheck = false;
+      dontFixup = true;
+
+      installPhase = ''
+        runHook preInstall
+        mkdir -p $out/share/vale/styles
+        cp -R ${stylePath} "$out/share/vale/styles/${name}"
+        runHook postInstall
+      '';
+
+      passthru.updateScript = nix-update-script { };
+
+      meta = {
+        platforms = lib.platforms.all;
+        maintainers = with lib.maintainers; [ katexochen ];
+      } // (args.meta or { });
+    } // removeAttrs args [ "meta" "name" ]);
+in
+{
+  alex = buildStyle rec {
+    name = "alex";
+    version = "0.2.1";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "alex";
+      rev = "v${version}";
+      hash = "sha256-xNF7se2FwKgNe5KYx/zvGWpIwBsBADYGH4JV1lUww+Q=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the guidelines enforced by the alex linter";
+      homepage = "https://github.com/errata-ai/alex";
+      license = lib.licenses.mit;
+    };
+  };
+
+  google = buildStyle rec {
+    name = "Google";
+    version = "0.6.0";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "Google";
+      rev = "v${version}";
+      hash = "sha256-TQS/hgS6tEWPSuZpEbX65MdYSE/+HJVcnzIuQbhIG2M=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the Google Developer Documentation Style Guide";
+      homepage = "https://github.com/errata-ai/Google";
+      license = lib.licenses.mit;
+    };
+  };
+
+  joblint = buildStyle rec {
+    name = "Joblint";
+    version = "0.4.1";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "Joblint";
+      rev = "v${version}";
+      hash = "sha256-zRz5ThOg5RLTZj3dYPe0PDvOF5DjO31lduSpi2Us87U=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the Joblint linter";
+      homepage = "https://github.com/errata-ai/Joblint";
+      license = lib.licenses.mit;
+    };
+  };
+
+  microsoft = buildStyle rec {
+    name = "Microsoft";
+    version = "0.14.0";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "Microsoft";
+      rev = "v${version}";
+      hash = "sha256-22rGNLZOsWYQ+H3CcM2b1zOXV3kNPcgYqDpaCg1iv9o=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the Microsoft Writing Style Guide";
+      homepage = "https://github.com/errata-ai/Microsoft";
+      license = lib.licenses.mit;
+    };
+  };
+
+  proselint = buildStyle rec {
+    name = "proselint";
+    version = "0.3.3";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "proselint";
+      rev = "v${version}";
+      hash = "sha256-faeWr1bRhnKsycJY89WqnRv8qIowUmz3EQvDyjtl63w=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of Python's proselint linter";
+      homepage = "https://github.com/errata-ai/proselint";
+      license = lib.licenses.bsd3;
+    };
+  };
+
+  readability = buildStyle rec {
+    name = "Readability";
+    version = "0.1.1";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "readability";
+      rev = "v${version}";
+      hash = "sha256-5Y9v8QsZjC2w3/pGIcL5nBdhpogyJznO5IFa0s8VOOI=";
+    };
+    meta = {
+      description = "Vale-compatible implementations of many popular \"readability\" metrics";
+      homepage = "https://github.com/errata-ai/readability";
+      license = lib.licenses.mit;
+    };
+  };
+
+  write-good = buildStyle rec {
+    name = "write-good";
+    version = "0.4.0";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "write-good";
+      rev = "v${version}";
+      hash = "sha256-KQzY6MeHV/owPVmUAfzGUO0HmFPkD7wdQqOvBkipwP8=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the write-good linter";
+      homepage = "https://github.com/errata-ai/write-good";
+      license = lib.licenses.mit;
+    };
+  };
+}
diff --git a/pkgs/tools/typesetting/tex/texpresso/default.nix b/pkgs/tools/typesetting/tex/texpresso/default.nix
index ccbc43a1c6151..e2e244ceda69d 100644
--- a/pkgs/tools/typesetting/tex/texpresso/default.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "texpresso";
-  version = "0-unstable-2024-04-08";
+  version = "0-unstable-2024-04-18";
 
   nativeBuildInputs = [
     makeWrapper
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    rev = "9db77502f238c75ef03ce94f34cc5170d0b2a833";
-    hash = "sha256-YK4+GqjBjKui4J7YkNyeF1GyquMQMLMhp9o5u4Z8Bmc=";
+    rev = "62b2b5913420d92bb2863d9c92ac2072f7aaa5f9";
+    hash = "sha256-kVGRuFVkJvQfl1bEjBU0pyx+SB+k5yI9C6XFiKZRpLQ=";
   };
 
   buildFlags = [ "texpresso" ];
diff --git a/pkgs/tools/virtualization/cloud-init/default.nix b/pkgs/tools/virtualization/cloud-init/default.nix
index e5385bf7fbca0..3b8e619e864de 100644
--- a/pkgs/tools/virtualization/cloud-init/default.nix
+++ b/pkgs/tools/virtualization/cloud-init/default.nix
@@ -71,7 +71,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeCheckInputs = with python3.pkgs; [
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
     httpretty
     dmidecode
     # needed for tests; at runtime we rather want the setuid wrapper
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index 95203d44a74af..f3d233e7d49b4 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "govc";
-  version = "0.37.0";
+  version = "0.37.1";
 
   subPackages = [ "govc" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "sha256-rE19ky/x3pqlz2/6W8ucrctgpJFefEKfzpW4DEDCQ3E=";
+    sha256 = "sha256-lErMWVr0UWR2Hc6fYZiauLz6kAZY/uGPNjm6oJGBAuw=";
   };
 
   vendorHash = "sha256-1EAQMYaTEtfAiu7+UTkC7QZwSWC1Ihwj9leTd90T0ZU=";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c8a80540f9e82..f879d9ca98f07 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -61,6 +61,7 @@ mapAliases ({
   adtool = throw "'adtool' has been removed, as it was broken and unmaintained";
   advcpmv = throw "'advcpmv' has been removed, as it is not being actively maintained and break recent coreutils."; # Added 2024-03-29
   aether = throw "aether has been removed from nixpkgs; upstream unmaintained, security issues"; # Added 2023-10-03
+  afl = throw "afl has been removed as the upstream project was archived. Consider using 'aflplusplus'"; # Added 2024-04-21
   airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
   alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream"; # Added 2023-07-28
   alsa-project = throw "alsa-project was removed and its sub-attributes were promoted to top-level."; # Added 2023-11-12
@@ -413,6 +414,7 @@ mapAliases ({
 
   gitter = throw "gitter has been removed since the client has been abandoned by upstream with the backend migration to Matrix"; # Added 2023-09-18
   glide = throw "'glide' has been removed as it is unmaintained, please use Go modules instead"; # Added 2023-12-26
+  glfw-wayland = glfw; # Added 2024-04-19
   gmailieer = lieer; # Added 2020-04-19
   gmic-qt-krita = throw "gmic-qt-krita was removed as it's no longer supported upstream."; # Converted to throw 2023-02-02
   gnatboot11 = gnat-bootstrap11;
@@ -1290,6 +1292,7 @@ mapAliases ({
   virtmanager-qt = throw "'virtmanager-qt' has been renamed to/replaced by 'virt-manager-qt'"; # Converted to throw 2023-09-10
   vivaldi-widevine = throw "'vivaldi-widevine' has been renamed to/replaced by 'widevine-cdm'"; # Added 2023-02-25
   vkBasalt = vkbasalt; # Added 2022-11-22
+  vkdt-wayland = vkdt; # Added 2024-04-19
   vsmtp = throw "'vsmtp' has been removed, upstream gone"; # Added 2023-12-18
   vte_290 = throw "'vte_290' has been renamed to/replaced by 'vte'"; # Added 2023-01-05
   varnish72 = throw "varnish 7.2 is EOL. Either use the LTS or upgrade."; # Added 2023-10-09
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f07cc19c7b3e4..dc83c7246644f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -656,6 +656,8 @@ with pkgs;
 
   evhz = callPackage ../tools/misc/evhz { };
 
+  expand-response-params = callPackage ../build-support/expand-response-params { };
+
   expressvpn = callPackage ../applications/networking/expressvpn { };
 
   faq = callPackage ../development/tools/faq { };
@@ -1610,10 +1612,6 @@ with pkgs;
 
   afio = callPackage ../tools/archivers/afio { };
 
-  afl = callPackage ../tools/security/afl {
-    stdenv = clangStdenv;
-  };
-
   honggfuzz = callPackage ../tools/security/honggfuzz {
     clang = clang_16;
     llvm = llvm_16;
@@ -1628,7 +1626,7 @@ with pkgs;
 
   ledfx = callPackage ../applications/audio/ledfx { };
 
-  libdislocator = callPackage ../tools/security/afl/libdislocator.nix { };
+  libdislocator = callPackage ../tools/security/aflplusplus/libdislocator.nix { };
 
   afpfs-ng = callPackage ../tools/filesystems/afpfs-ng { };
 
@@ -2748,12 +2746,6 @@ with pkgs;
     description = mame.meta.description + " (tools only)";
   } (lib.getOutput "tools" mame);
 
-  mednafen = callPackage ../applications/emulators/mednafen { };
-
-  mednafen-server = callPackage ../applications/emulators/mednafen/server.nix { };
-
-  mednaffe = callPackage ../applications/emulators/mednaffe { };
-
   melonDS = libsForQt5.callPackage ../applications/emulators/melonDS { };
 
   mgba = libsForQt5.callPackage ../applications/emulators/mgba { };
@@ -5128,8 +5120,6 @@ with pkgs;
 
   earlybird = callPackage ../tools/security/earlybird { };
 
-  earlyoom = callPackage ../os-specific/linux/earlyoom { };
-
   easyabc = callPackage ../applications/audio/easyabc { };
 
   easycrypt = callPackage ../applications/science/logic/easycrypt {
@@ -5541,7 +5531,11 @@ with pkgs;
 
   grobi = callPackage ../tools/X11/grobi { };
 
-  gscan2pdf = callPackage ../applications/graphics/gscan2pdf { };
+  gscan2pdf = callPackage ../applications/graphics/gscan2pdf {
+    # needs this fork of libtiff, because original libtiff
+    # stopped packaging required tools with version 4.6
+    libtiff = libtiff_t;
+  };
 
   gsctl = callPackage ../applications/misc/gsctl { };
 
@@ -6089,7 +6083,7 @@ with pkgs;
 
 
   ockam = callPackage ../tools/networking/ockam {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) AppKit Security;
   };
 
   odoo = callPackage ../applications/finance/odoo { };
@@ -6673,7 +6667,7 @@ with pkgs;
   cdrkit = callPackage ../tools/cd-dvd/cdrkit { };
 
   cdrtools = callPackage ../tools/cd-dvd/cdrtools {
-    stdenv = if stdenv.isDarwin then overrideLibcxx llvmPackages_14.stdenv else stdenv;
+    stdenv = if stdenv.isDarwin then llvmPackages_14.stdenv else stdenv;
     inherit (darwin.apple_sdk.frameworks) Carbon IOKit;
   };
 
@@ -9165,8 +9159,9 @@ with pkgs;
   hybridreverb2 = callPackage ../applications/audio/hybridreverb2 { };
 
   hylafaxplus = callPackage ../servers/hylafaxplus {
-    # libtiff >= 4.6 dropped many executables needed by hylafaxplus
-    libtiff = libtiff_4_5;
+    # needs this fork of libtiff, because original libtiff
+    # stopped packaging required tools with version 4.6
+    libtiff = libtiff_t;
   };
 
   hyphen = callPackage ../development/libraries/hyphen { };
@@ -9778,14 +9773,7 @@ with pkgs;
   ldc = callPackage ../development/compilers/ldc { };
 
   ligo =
-    let ocaml_p = ocaml-ng.ocamlPackages_4_14_janeStreet_0_15.overrideScope (self: super: {
-      zarith = super.zarith.overrideAttrs (o: {
-        src = fetchzip {
-          url = "https://github.com/ocaml/Zarith/archive/refs/tags/release-1.12.tar.gz";
-          hash = "sha256-SQegsMc1+UIod8XeJDE+H5q1huNDQI8CUh7IsHOoVMs=";
-        };
-      });
-    }); in
+    let ocaml_p = ocaml-ng.ocamlPackages_4_14_janeStreet_0_15; in
     callPackage ../development/compilers/ligo {
     coq = coq_8_13.override {
       customOCamlPackages = ocaml_p;
@@ -14412,8 +14400,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  wireproxy = callPackage ../tools/networking/wireproxy { };
-
   wiringpi = callPackage ../os-specific/linux/wiringpi { };
 
   wg-friendly-peer-names = callPackage ../tools/networking/wg-friendly-peer-names { };
@@ -15607,7 +15593,6 @@ with pkgs;
 
   default-gcc-version =
     if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
-    else if stdenv.buildPlatform.isDarwin  then 12  # unable to test
     else 13;
   gcc = pkgs.${"gcc${toString default-gcc-version}"};
   gccFun = callPackage ../development/compilers/gcc;
@@ -16676,11 +16661,11 @@ with pkgs;
   wrapRustcWith = { rustc-unwrapped, ... } @ args: callPackage ../build-support/rust/rustc-wrapper args;
   wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
 
-  rust_1_76 = callPackage ../development/compilers/rust/1_76.nix {
+  rust_1_77 = callPackage ../development/compilers/rust/1_77.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_17 = llvmPackages_17.libllvm;
   };
-  rust = rust_1_76;
+  rust = rust_1_77;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16688,8 +16673,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_76 = rust_1_76.packages.stable;
-  rustPackages = rustPackages_1_76;
+  rustPackages_1_77 = rust_1_77.packages.stable;
+  rustPackages = rustPackages_1_77;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -19053,6 +19038,9 @@ with pkgs;
 
   inotify-tools = callPackage ../development/tools/misc/inotify-tools { };
 
+  inherit (callPackage ../applications/misc/inochi2d { })
+    inochi-creator inochi-session;
+
   intel-gpu-tools = callPackage ../development/tools/misc/intel-gpu-tools { };
 
   insomnia = callPackage ../development/web/insomnia { };
@@ -21132,9 +21120,6 @@ with pkgs;
   };
 
   glfw = glfw3;
-  glfw-wayland = glfw.override {
-    waylandSupport = true;
-  };
   glfw-wayland-minecraft = callPackage ../development/libraries/glfw/3.x-wayland-minecraft.nix {};
   glfw2 = callPackage ../development/libraries/glfw/2.x.nix { };
   glfw3 = callPackage ../development/libraries/glfw/3.x.nix {
@@ -21895,7 +21880,7 @@ with pkgs;
   lerc = callPackage ../development/libraries/lerc { };
 
   lib2geom = callPackage ../development/libraries/lib2geom {
-    stdenv = if stdenv.cc.isClang then overrideLibcxx llvmPackages_13.stdenv else stdenv;
+    stdenv = if stdenv.cc.isClang then llvmPackages_13.stdenv else stdenv;
   };
 
   lib3ds = callPackage ../development/libraries/lib3ds { };
@@ -22924,9 +22909,7 @@ with pkgs;
     stdenv = gccStdenv; # Required for darwin
   }) libprom libpromhttp;
 
-  libproxy = callPackage ../development/libraries/libproxy {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration CoreFoundation JavaScriptCore;
-  };
+  libproxy = callPackage ../development/libraries/libproxy { };
 
   libpseudo = callPackage ../development/libraries/libpseudo { };
 
@@ -23039,8 +23022,14 @@ with pkgs;
 
   libtifiles2 = callPackage ../development/libraries/libtifiles2 { };
 
-  libtiff = callPackage ../development/libraries/libtiff { };
-  libtiff_4_5 = callPackage ../development/libraries/libtiff/4.5.nix { };
+  inherit
+    ({
+      libtiff = callPackage ../development/libraries/libtiff { };
+      libtiff_t = callPackage ../development/libraries/libtiff/libtiff_t.nix { };
+    })
+    libtiff
+    libtiff_t
+    ;
 
   libtiger = callPackage ../development/libraries/libtiger { };
 
@@ -24713,6 +24702,8 @@ with pkgs;
   streamlink = callPackage ../applications/video/streamlink { };
   streamlink-twitch-gui-bin = callPackage ../applications/video/streamlink-twitch-gui/bin.nix { };
 
+  structuresynth = libsForQt5.callPackage ../development/libraries/structuresynth { };
+
   sub-batch = callPackage ../applications/video/sub-batch { };
 
   subdl = callPackage ../applications/video/subdl { };
@@ -24918,16 +24909,9 @@ with pkgs;
 
   ucommon = callPackage ../development/libraries/ucommon { };
 
-  v8 = callPackage ../development/libraries/v8 (
-    let
-      stdenv' = if stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc.cc) "16"
-        then overrideLibcxx llvmPackages_15.stdenv
-        else stdenv;
-    in
-    {
-      stdenv = if stdenv'.isDarwin then overrideSDK stdenv' "11.0" else stdenv';
-    }
-  );
+  v8 = callPackage ../development/libraries/v8 {
+    stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
+  };
 
   intel-vaapi-driver = callPackage ../development/libraries/intel-vaapi-driver { };
 
@@ -24937,6 +24921,8 @@ with pkgs;
 
   vale = callPackage ../tools/text/vale { };
 
+  valeStyles = recurseIntoAttrs (callPackages ../tools/text/vale/styles.nix { });
+
   valhalla = callPackage ../development/libraries/valhalla {
     boost = boost.override { enablePython = true; python = python3; };
     protobuf = protobuf_21.override {
@@ -24974,8 +24960,6 @@ with pkgs;
 
   vkdt = callPackage ../applications/graphics/vkdt { };
 
-  vkdt-wayland = callPackage ../applications/graphics/vkdt { glfw = glfw-wayland; };
-
   vlock = callPackage ../misc/screensavers/vlock { };
 
   virtualpg = callPackage ../development/libraries/virtualpg { };
@@ -25244,6 +25228,10 @@ with pkgs;
   zig_0_11 = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig/0.11.nix {
     llvmPackages = llvmPackages_16;
   };
+  # requires a newer Apple SDK
+  zig_0_12 = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig/0.12.nix {
+    llvmPackages = llvmPackages_17;
+  };
   zig = zig_0_11;
 
   zig-shell-completions = callPackage ../development/compilers/zig/shell-completions.nix { };
@@ -27718,7 +27706,8 @@ with pkgs;
   nu_scripts = callPackage ../shells/nushell/nu_scripts { };
 
   nushellPlugins = recurseIntoAttrs (callPackage ../shells/nushell/plugins {
-    inherit (darwin.apple_sdk_11_0.frameworks) IOKit CoreFoundation Foundation Security;
+    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk_11_0.frameworks) IOKit CoreFoundation Foundation;
   });
 
   nettools = if stdenv.isLinux
@@ -28713,8 +28702,6 @@ with pkgs;
 
   fanwood = callPackage ../data/fonts/fanwood { };
 
-  fira = callPackage ../data/fonts/fira { };
-
   fira-code = callPackage ../data/fonts/fira-code { };
   fira-code-symbols = callPackage ../data/fonts/fira-code/symbols.nix { };
   fira-code-nerdfont = nerdfonts.override {
@@ -28723,8 +28710,6 @@ with pkgs;
 
   fira-go = callPackage ../data/fonts/fira-go { };
 
-  fira-mono = callPackage ../data/fonts/fira-mono { };
-
   flat-remix-icon-theme = callPackage ../data/icons/flat-remix-icon-theme {
     inherit (plasma5Packages) breeze-icons;
   };
@@ -28790,6 +28775,23 @@ with pkgs;
 
   spacx-gtk-theme = callPackage ../data/themes/gtk-theme-framework { theme = "spacx"; };
 
+  inherit
+    ({
+      gruppled-black-cursors = callPackage ../data/icons/gruppled-cursors { theme = "gruppled_black"; };
+      gruppled-black-lite-cursors = callPackage ../data/icons/gruppled-lite-cursors {
+        theme = "gruppled_black_lite";
+      };
+      gruppled-white-cursors = callPackage ../data/icons/gruppled-cursors { theme = "gruppled_white"; };
+      gruppled-white-lite-cursors = callPackage ../data/icons/gruppled-lite-cursors {
+        theme = "gruppled_white_lite";
+      };
+    })
+    gruppled-black-cursors
+    gruppled-black-lite-cursors
+    gruppled-white-cursors
+    gruppled-white-lite-cursors
+    ;
+
   gruvbox-dark-icons-gtk = callPackage ../data/icons/gruvbox-dark-icons-gtk {
     inherit (plasma5Packages) breeze-icons;
   };
@@ -33449,8 +33451,6 @@ with pkgs;
 
   ptex = callPackage ../development/libraries/ptex { };
 
-  pyright = nodePackages.pyright;
-
   qbec = callPackage ../applications/networking/cluster/qbec { };
 
   qemacs = callPackage ../applications/editors/qemacs { };
@@ -34629,7 +34629,7 @@ with pkgs;
 
   maestral = with python3Packages; toPythonApplication maestral;
 
-  maestral-gui = qt6.callPackage ../applications/networking/maestral-qt { };
+  maestral-gui = qt6Packages.callPackage ../applications/networking/maestral-qt { };
 
   maestro = callPackage ../development/mobile/maestro { };
 
@@ -37939,7 +37939,7 @@ with pkgs;
   lxqt = recurseIntoAttrs (import ../desktops/lxqt {
     inherit pkgs;
     inherit (lib) makeScope;
-    inherit qt5 libsForQt5;
+    inherit kdePackages;
   });
 
   mate = recurseIntoAttrs (callPackage ../desktops/mate { });
@@ -39995,7 +39995,7 @@ with pkgs;
   alejandra = callPackage ../tools/nix/alejandra { };
 
   nixci = callPackage ../tools/nix/nixci {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration IOKit;
   };
 
   nixfmt-classic = haskellPackages.nixfmt.bin;
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index 92a9c7915b6b7..5c538abcf5cef 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -75,7 +75,7 @@ let
         Whether to expose old attribute names for compatibility.
 
         The recommended setting is to enable this, as it
-        improves backward compatibity, easing updates.
+        improves backward compatibility, easing updates.
 
         The only reason to disable aliases is for continuous
         integration purposes. For instance, Nixpkgs should
diff --git a/pkgs/top-level/cuda-packages.nix b/pkgs/top-level/cuda-packages.nix
index 92960422af44c..d34a37294ae0a 100644
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -90,7 +90,7 @@ let
     [
       (import ../development/cuda-modules/setup-hooks/extension.nix)
       (callPackage ../development/cuda-modules/cuda/extension.nix { inherit cudaVersion; })
-      (callPackage ../development/cuda-modules/cuda/overrides.nix { inherit cudaVersion; })
+      (import ../development/cuda-modules/cuda/overrides.nix)
       (callPackage ../development/cuda-modules/generic-builders/multiplex.nix {
         inherit cudaVersion flags mkVersionedPackageName;
         pname = "cudnn";
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 307576e85687f..31e5f88845440 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -192,6 +192,7 @@ in {
         kernelPatches.request_key_helper
         kernelPatches.rust_1_75
         kernelPatches.rust_1_76
+        kernelPatches.rust_1_77-6_8
       ];
     };
 
@@ -203,6 +204,7 @@ in {
         kernelPatches = [
           kernelPatches.bridge_stp_helper
           kernelPatches.request_key_helper
+          kernelPatches.rust_1_77-6_9
         ];
       };
       latest = packageAliases.linux_latest.kernel;
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 0f1c92be89bc3..17df40fa0fb16 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -34,9 +34,6 @@ pkgs.releaseTools.sourceTarball {
 
   requiredSystemFeatures = [ "big-parallel" ]; # 1 thread but ~36G RAM (!) see #227945
 
-  nixpkgs-basic-release-checks = import ./nixpkgs-basic-release-checks.nix
-   { inherit nix pkgs nixpkgs supportedSystems; };
-
   dontBuild = false;
 
   doCheck = true;
diff --git a/pkgs/top-level/nixpkgs-basic-release-checks.nix b/pkgs/top-level/nixpkgs-basic-release-checks.nix
index 4acdab996787a..ea18890903281 100644
--- a/pkgs/top-level/nixpkgs-basic-release-checks.nix
+++ b/pkgs/top-level/nixpkgs-basic-release-checks.nix
@@ -1,9 +1,9 @@
-{ supportedSystems, nixpkgs, pkgs, nix }:
+{ supportedSystems, nixpkgs, pkgs }:
 
 pkgs.runCommand "nixpkgs-release-checks"
   {
     src = nixpkgs;
-    buildInputs = [ nix ];
+    buildInputs = [ pkgs.nix ];
     requiredSystemFeatures = [ "big-parallel" ]; # 1 thread but ~10G RAM; see #227945
   }
   ''
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 2403b1d57300a..529e893894cf0 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -56,9 +56,9 @@ let
 
     atdgen-runtime = callPackage ../development/ocaml-modules/atdgen/runtime.nix { };
 
-    awa = callPackage ../development/ocaml-modules/awa { mtime = mtime_1; };
+    awa = callPackage ../development/ocaml-modules/awa { };
 
-    awa-mirage = callPackage ../development/ocaml-modules/awa/mirage.nix { mtime = mtime_1; };
+    awa-mirage = callPackage ../development/ocaml-modules/awa/mirage.nix { };
 
     ### B ###
 
@@ -192,6 +192,8 @@ let
 
     cil = callPackage ../development/ocaml-modules/cil { };
 
+    clap = callPackage ../development/ocaml-modules/clap { };
+
     class_group_vdf = callPackage ../development/ocaml-modules/class_group_vdf { };
 
     cmarkit = callPackage ../development/ocaml-modules/cmarkit { };
@@ -321,11 +323,11 @@ let
 
     dns-certify =  callPackage ../development/ocaml-modules/dns/certify.nix { };
 
-    dns-cli =  callPackage ../development/ocaml-modules/dns/cli.nix { mtime = mtime_1; };
+    dns-cli =  callPackage ../development/ocaml-modules/dns/cli.nix { };
 
-    dns-client =  callPackage ../development/ocaml-modules/dns/client.nix { mtime = mtime_1; };
+    dns-client =  callPackage ../development/ocaml-modules/dns/client.nix { };
 
-    dns-client-lwt = callPackage ../development/ocaml-modules/dns/client-lwt.nix { mtime = mtime_1; };
+    dns-client-lwt = callPackage ../development/ocaml-modules/dns/client-lwt.nix { };
 
     dns-client-mirage = callPackage ../development/ocaml-modules/dns/client-mirage.nix { };
 
@@ -586,7 +588,6 @@ let
 
     git-unix = callPackage ../development/ocaml-modules/git/unix.nix {
       git-binary = pkgs.git;
-      mtime = mtime_1;
     };
 
     github = callPackage ../development/ocaml-modules/github {  };
@@ -639,7 +640,7 @@ let
 
     happy-eyeballs = callPackage ../development/ocaml-modules/happy-eyeballs { };
 
-    happy-eyeballs-lwt = callPackage ../development/ocaml-modules/happy-eyeballs/lwt.nix { mtime = mtime_1; };
+    happy-eyeballs-lwt = callPackage ../development/ocaml-modules/happy-eyeballs/lwt.nix { };
 
     happy-eyeballs-mirage = callPackage ../development/ocaml-modules/happy-eyeballs/mirage.nix { };
 
@@ -669,7 +670,7 @@ let
 
     imagelib = callPackage ../development/ocaml-modules/imagelib { };
 
-    index = callPackage ../development/ocaml-modules/index { mtime = mtime_1; };
+    index = callPackage ../development/ocaml-modules/index { };
 
     inifiles = callPackage ../development/ocaml-modules/inifiles { };
 
@@ -691,29 +692,27 @@ let
 
     iri = callPackage ../development/ocaml-modules/iri { };
 
-    irmin = callPackage ../development/ocaml-modules/irmin { mtime = mtime_1; };
+    irmin = callPackage ../development/ocaml-modules/irmin { };
 
     irmin-chunk = callPackage ../development/ocaml-modules/irmin/chunk.nix { };
 
-    irmin-containers = callPackage ../development/ocaml-modules/irmin/containers.nix { mtime = mtime_1; };
+    irmin-containers = callPackage ../development/ocaml-modules/irmin/containers.nix { };
 
     irmin-fs = callPackage ../development/ocaml-modules/irmin/fs.nix { };
 
-    irmin-git = callPackage ../development/ocaml-modules/irmin/git.nix { mtime = mtime_1; };
+    irmin-git = callPackage ../development/ocaml-modules/irmin/git.nix { };
 
     irmin-graphql = callPackage ../development/ocaml-modules/irmin/graphql.nix { };
 
-    irmin-http = callPackage ../development/ocaml-modules/irmin/http.nix { };
-
     irmin-mirage = callPackage ../development/ocaml-modules/irmin/mirage.nix { };
 
     irmin-mirage-git = callPackage ../development/ocaml-modules/irmin/mirage-git.nix { };
 
     irmin-mirage-graphql = callPackage ../development/ocaml-modules/irmin/mirage-graphql.nix { };
 
-    irmin-pack = callPackage ../development/ocaml-modules/irmin/pack.nix { mtime = mtime_1; };
+    irmin-pack = callPackage ../development/ocaml-modules/irmin/pack.nix { };
 
-    irmin-test = callPackage ../development/ocaml-modules/irmin/test.nix { mtime = mtime_1; };
+    irmin-test = callPackage ../development/ocaml-modules/irmin/test.nix { };
 
     irmin-tezos = callPackage ../development/ocaml-modules/irmin/tezos.nix { };
 
@@ -1065,7 +1064,6 @@ let
 
     metrics-unix = callPackage ../development/ocaml-modules/metrics/unix.nix {
       inherit (pkgs) gnuplot;
-      mtime = mtime_1;
     };
 
     mew = callPackage ../development/ocaml-modules/mew { };
@@ -1122,7 +1120,7 @@ let
 
     mirage-crypto-rng-async = callPackage ../development/ocaml-modules/mirage-crypto/rng-async.nix { };
 
-    mirage-crypto-rng-lwt = callPackage ../development/ocaml-modules/mirage-crypto/rng-lwt.nix { mtime = mtime_1; };
+    mirage-crypto-rng-lwt = callPackage ../development/ocaml-modules/mirage-crypto/rng-lwt.nix { };
 
     mirage-crypto-rng-mirage = callPackage ../development/ocaml-modules/mirage-crypto/rng-mirage.nix { };
 
@@ -1546,7 +1544,7 @@ let
 
     prometheus = callPackage ../development/ocaml-modules/prometheus { };
 
-    progress = callPackage ../development/ocaml-modules/progress { mtime = mtime_1; };
+    progress = callPackage ../development/ocaml-modules/progress { };
 
     promise_jsoo = callPackage ../development/ocaml-modules/promise_jsoo { };
 
@@ -1761,6 +1759,8 @@ let
 
     tezos-base58 = callPackage ../development/ocaml-modules/tezos-base58 { };
 
+    tezt = callPackage ../development/ocaml-modules/tezt { };
+
     theora = callPackage ../development/ocaml-modules/theora { };
 
     thread-table = callPackage ../development/ocaml-modules/thread-table { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 40351281d5c53..4f0c0d4219cf0 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -57,6 +57,7 @@ mapAliases ({
   Babel = babel; # added 2022-05-06
   backports_csv = throw "backports_csv has been removed, since we no longer need to backport to python2"; # added 2023-07-28
   backports_functools_lru_cache = throw "backports_functools_lru_cache has been removed, since we no longer need to backport to python3.2"; # added 2023-07-28
+  backports_shutil_get_terminal_size = backports-shutil-get-terminal-size; # added 2024-04-21
   backports_tempfile = throw "backports_tempfile has been removed, since we no longer need to backport to python3.3"; # added 2023-07-28
   backports_unittest-mock = throw "backports_unittest-mock has been removed, since we no longer need to backport to python3.2"; # added 2023-07-28
   backports_weakref = throw "backports_weakref has been removed, since we no longer need to backport to python3.3"; # added 2023-07-28
@@ -476,6 +477,7 @@ mapAliases ({
   smpp_pdu = smpp-pdu; # added 2024-03-05
   somecomfort = throw "somecomfort was removed because Home Assistant switched to aiosomecomfort"; # added 2023-02-01
   sorl_thumbnail = sorl-thumbnail; # added 2023-11-12
+  spacy_models = spacy-models; # added 2024-04-21
   SPARQLWrapper = sparqlwrapper;
   spark_parser = spark-parser; # added 2024-01-07
   sphinx-jquery = sphinxcontrib-jquery; # added 2023-02-24
@@ -518,6 +520,7 @@ mapAliases ({
   update_checker = update-checker; # added 2024-01-07
   uproot3 = throw "uproot3 has been removed, use uproot instead"; # added 2022-12-13
   uproot3-methods = throw "uproot3-methods has been removed"; # added 2022-12-13
+  uuid = throw "uuid is a Python standard module"; # added 2024-04-18
   validictory = throw "validictory has been removed, since it abandoned"; # added 2023-07-07
   vega_datasets = vega-datasets; # added 2023-11-04
   ViennaRNA = viennarna; # added 2023-08-23
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7adc954a45c80..947e18d2d784d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -815,7 +815,7 @@ self: super: with self; {
 
   aspy-refactor-imports = callPackage ../development/python-modules/aspy-refactor-imports { };
 
-  aspy-yaml = callPackage ../development/python-modules/aspy.yaml { };
+  aspy-yaml = callPackage ../development/python-modules/aspy-yaml { };
 
   assay = callPackage ../development/python-modules/assay { };
 
@@ -1352,7 +1352,7 @@ self: super: with self; {
 
   backports-entry-points-selectable = callPackage ../development/python-modules/backports-entry-points-selectable { };
 
-  backports_shutil_get_terminal_size = callPackage ../development/python-modules/backports_shutil_get_terminal_size { };
+  backports-shutil-get-terminal-size = callPackage ../development/python-modules/backports-shutil-get-terminal-size { };
 
   backports-shutil-which = callPackage ../development/python-modules/backports-shutil-which { };
 
@@ -1782,6 +1782,8 @@ self: super: with self; {
 
   btsocket = callPackage ../development/python-modules/btsocket { };
 
+  bubop = callPackage ../development/python-modules/bubop { };
+
   bucketstore = callPackage ../development/python-modules/bucketstore { };
 
   bugsnag = callPackage ../development/python-modules/bugsnag { };
@@ -1932,6 +1934,8 @@ self: super: with self; {
     };
   };
 
+  catkin-pkg = callPackage ../development/python-modules/catkin-pkg { };
+
   catppuccin = callPackage ../development/python-modules/catppuccin { };
 
   cattrs = callPackage ../development/python-modules/cattrs { };
@@ -2484,6 +2488,8 @@ self: super: with self; {
 
   craft-application-1 = callPackage ../development/python-modules/craft-application-1 { };
 
+  craft-application = callPackage ../development/python-modules/craft-application { };
+
   craft-archives = callPackage ../development/python-modules/craft-archives { };
 
   craft-cli = callPackage ../development/python-modules/craft-cli { };
@@ -2650,14 +2656,7 @@ self: super: with self; {
 
   cython = callPackage ../development/python-modules/cython { };
 
-  cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.9";
-    src = old.src.override {
-      inherit version;
-      hash = "sha256-otNU8FnR8FXTTPqmLFtovHisLOq2QHFI1H+1CM87pPM=";
-    };
-    patches = [ ];
-  });
+  cython_0 = callPackage ../development/python-modules/cython/0.nix { };
 
   cython-test-exception-raiser = callPackage ../development/python-modules/cython-test-exception-raiser { };
 
@@ -5908,6 +5907,8 @@ self: super: with self; {
 
   itanium-demangler = callPackage ../development/python-modules/itanium-demangler { };
 
+  item-synchronizer = callPackage ../development/python-modules/item-synchronizer { };
+
   itemadapter = callPackage ../development/python-modules/itemadapter { };
 
   itemdb = callPackage ../development/python-modules/itemdb { };
@@ -9676,6 +9677,8 @@ self: super: with self; {
 
   pypemicro = callPackage ../development/python-modules/pypemicro { };
 
+  pymeshlab = toPythonModule (pkgs.libsForQt5.callPackage ../applications/graphics/pymeshlab { });
+
   pyprecice = callPackage ../development/python-modules/pyprecice { };
 
   pyprobables = callPackage ../development/python-modules/pyprobables { };
@@ -11546,6 +11549,8 @@ self: super: with self; {
       setuptools sip;
   };
 
+  pyqtdarktheme = callPackage ../development/python-modules/pyqtdarktheme { };
+
   pyqtdatavisualization = pkgs.libsForQt5.callPackage ../development/python-modules/pyqtdatavisualization {
     inherit (self) buildPythonPackage pyqt5 pyqt-builder python pythonOlder
       setuptools sip;
@@ -11921,6 +11926,8 @@ self: super: with self; {
 
   pytest_7 = callPackage ../development/python-modules/pytest/7.nix { };
 
+  pytest7CheckHook = pytestCheckHook.override { pytest = pytest_7; };
+
   pytest-aio = callPackage ../development/python-modules/pytest-aio { };
 
   pytest-aiohttp = callPackage ../development/python-modules/pytest-aiohttp { };
@@ -12186,6 +12193,8 @@ self: super: with self; {
 
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
+  python-apt = callPackage ../development/python-modules/python-apt { };
+
   python-arango = callPackage ../development/python-modules/python-arango { };
 
   python-awair = callPackage ../development/python-modules/python-awair { };
@@ -13949,7 +13958,7 @@ self: super: with self; {
 
   smpplib = callPackage ../development/python-modules/smpplib { };
 
-  smpp-pdu = callPackage ../development/python-modules/smpp.pdu { };
+  smpp-pdu = callPackage ../development/python-modules/smpp-pdu { };
 
   smtpdfix = callPackage ../development/python-modules/smtpdfix { };
 
@@ -14085,7 +14094,7 @@ self: super: with self; {
 
   spacy-lookups-data = callPackage ../development/python-modules/spacy/lookups-data.nix { };
 
-  spacy_models = callPackage ../development/python-modules/spacy/models.nix {
+  spacy-models = callPackage ../development/python-modules/spacy/models.nix {
       inherit (pkgs) jq;
   };
 
@@ -14674,6 +14683,8 @@ self: super: with self; {
 
   taskw = callPackage ../development/python-modules/taskw { };
 
+  taskw-ng = callPackage ../development/python-modules/taskw-ng { };
+
   tatsu = callPackage ../development/python-modules/tatsu { };
 
   taxi = callPackage ../development/python-modules/taxi { };
@@ -14912,7 +14923,7 @@ self: super: with self; {
   textacy = callPackage ../development/python-modules/textacy { };
 
   textnets = callPackage ../development/python-modules/textnets {
-    en_core_web_sm = spacy_models.en_core_web_sm;
+    en_core_web_sm = spacy-models.en_core_web_sm;
   };
 
   texttable = callPackage ../development/python-modules/texttable { };
@@ -16435,8 +16446,6 @@ self: super: with self; {
 
   utils = callPackage ../development/python-modules/utils { };
 
-  uuid = callPackage ../development/python-modules/uuid { };
-
   uvcclient = callPackage ../development/python-modules/uvcclient { };
 
   uvicorn = callPackage ../development/python-modules/uvicorn { };
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index e8ede387b4c2d..2da2d7d64675c 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -80,6 +80,8 @@ let
   nonPackageJobs =
     { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease supportedSystems; };
 
+      release-checks = import ./nixpkgs-basic-release-checks.nix { inherit pkgs nixpkgs supportedSystems; };
+
       metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
 
       manual = import ../../doc { inherit pkgs nixpkgs; };
@@ -91,6 +93,7 @@ let
           meta.description = "Release-critical builds for the Nixpkgs darwin channel";
           constituents =
             [ jobs.tarball
+              jobs.release-checks
               jobs.cabal2nix.x86_64-darwin
               jobs.ghc.x86_64-darwin
               jobs.git.x86_64-darwin
@@ -140,6 +143,7 @@ let
           meta.description = "Release-critical builds for the Nixpkgs unstable channel";
           constituents =
             [ jobs.tarball
+              jobs.release-checks
               jobs.metrics
               jobs.manual
               jobs.lib-tests